microsoft_isa_w3c = {

  # The name of the log format
  log.format.format_label = "Microsoft ISA WebProxy Log Format (W3C)"
  log.miscellaneous.log_data_type = "generic_w3c"  
  log.miscellaneous.log_format_type = "firewall"

  # The log is in this format if any of the first ten lines match this regular expression
  log.format.autodetect_expression = `
starts_with(volatile.log_data_line, '#Software: Microsoft') and
(starts_with(volatile.log_data_line, '#Software: Microsoft\\(R\\) Internet Security and Acceleration Server ') or
 starts_with(volatile.log_data_line, '#Software: Microsoft Internet Security and Acceleration Server '))
`

  # The format of dates and times in this log
  log.format.date_format = "yyyy-mm-dd"
  log.format.time_format = "hh:mm:ss"

  # Don't track these fields as discrete database fields
#  auto_setup.omit_database_fields = "sc_bytes,cs_bytes,time_taken"


  # Get search engine and search phrase information from the referrer field (before it gets simplified).
  log.parsing_filters.compute_se_sp = {
    value = `
if (get_search_engine_info(referrer)) then (
  search_engine = volatile.search_engine;
  search_phrase = volatile.search_phrase;
);
`
    requires_fields = {
      referrer = true
    }
  } # compute_se_sp


  # Log Filters
  log.filters = {

    simplify_referrer = {
      label = "$lang_admin.log_filters.simplify_referrer_label"
      comment = "$lang_admin.log_filters.simplify_referrer_comment"
      value = "if (referrer eq '-') then referrer = '(no referrer)' else if (matches_regular_expression(referrer, '^([^:]+://[^/]+/)')) then referrer = $1 . '(omitted)'"
      requires_fields = {
        referrer = true
      }
    } # simplify_referrer

    internal_referrer = {
      label = "$lang_admin.log_filters.internal_referrer_label"
      comment = "$lang_admin.log_filters.internal_referrer_comment"
      value = "if (contains(referrer, 'mydomain.com/')) then referrer = '(internal referrer)';"
      disabled = true
      requires_fields = {
        referrer = true
      }
    } # internal_referrer

#    set_page_for_worm = {
#      label = "$lang_admin.log_filters.set_page_for_worm_label"
#      comment = "$lang_admin.log_filters.set_page_for_worm_comment"
#      value = "if (starts_with(worm, '(')) then '' else page = '(worm)';"
#      requires_fields = {
#        page = true
#     }
#    } # set_page_for_worm


    # This filter tacks the URL parameters ("URL query") onto the end of the URL field
    empty_uri_query = {
      label = "$lang_admin.log_filters.empty_uri_query_label"
      comment = "$lang_admin.log_filters.empty_uri_query_comment"
      value = "if (cs_uri_query eq '-') then cs_uri_query = '(empty)';"
      disabled = true
      requires_fields = {
        cs_uri_query = true
      }
    } # empty_uri_query

    1 = {
      label = "1"
      comment = ""
      value = "if (cs_uri_query ne '(empty)') then url = '' . url . '?' . cs_uri_query;"
      requires_fields = {
        cs_uri_query = true
      }
    } # 1

    simplify_url = {
      label = "$lang_admin.log_filters.simplify_url_label"
      comment = "$lang_admin.log_filters.simplify_url_comment"
      value = "if (matches_regular_expression(cs_uri, '^([^:]+://[^/]+/)')) then cs_uri = $1 . '(omitted)'"
      requires_fields = {
        cs_uri = true
      }
    } # simplify_url

    remove_query = {
      label = "$lang_admin.log_filters.remove_query_label"
      comment = "$lang_admin.log_filters.remove_query_comment"
      value = "if (contains(cs_uri, '?')) then cs_uri = substr(cs_uri, 0, index(cs_uri, '?') + 1) . '(parameters)';"
      requires_fields = {
        cs_uri = true
      }
    } # remove_query


    detect_page_views = {
      label = '$lang_admin.log_filters.detect_page_views_label'
      comment = '$lang_admin.log_filters.detect_page_views_comment'
      value = "if ((file_type eq 'JPEG') or (file_type eq 'JPG') or (file_type eq 'GIF') or (file_type eq 'ICO') or (file_type eq 'PNG') or (file_type eq 'CSS') or (file_type eq 'SWF') or (file_type eq 'JS')) then page_views = 0; else page_views = 1;"
      requires_fields = {
        file_type = true
      }
    } # detect_page_views

    strip_non_page_views = {
      label = '$lang_admin.log_filters.strip_non_page_views_label'
      comment = '$lang_admin.log_filters.strip_non_page_views_comment'
      value = "if (page_views == 0) then cs_uri = substr(cs_uri, 0, last_index(cs_uri, '/') + 1) . '(nonpage)';"
      requires_fields = {
        cs_uri = true
      }
    } # strip_non_page_views

    mark_entry = {
      label = '$lang_admin.log_filters.mark_entry_label'
      comment = '$lang_admin.log_filters.mark_entry_comment'
      value = 'hits = 1;'
    } # mark_entry

  } # log.filters

  log.field_options = {

    sessions_page_field = "cs_uri"
    sessions_visitor_id_field = "c_ip"
    sessions_event_field = "page_views"

  } # log.field_options


  database.numerical_fields = {

    hits = {
      label = "$lang_stats.field_labels.hits"
      default = false
      requires_log_field = false
      type = "int"
      display_format_type = "integer"
      entries_field = true
    } # hits

    page_views = {
      label = "$lang_stats.field_labels.page_views"
      default = true
      requires_log_field = false
      type = "int"
      display_format_type = "integer"
    } # page_views

    visitors = {
      label = "$lang_stats.field_labels.visitors"
      default = false
      requires_log_field = true
      log_field = "c_ip"
      type = "unique"
      display_format_type = "integer"
    } # visitors

    sc_bytes = {
      label = "$lang_stats.field_labels.sc_bytes"
      default = false
      requires_log_field = false
      type = "float"
      display_format_type = "bandwidth"
    }

    cs_bytes = {
      label = "$lang_stats.field_labels.cs_bytes"
      default = false
      requires_log_field = false
      type = "float"
      display_format_type = "bandwidth"
    }

    time_taken = {
      label = $lang_stats.field_labels.time_taken
      default = false
      requires_log_field = true
      type = int
      display_format_type = duration_milliseconds
    } # time_taken

  } # database.numerical_fields


  create_profile_wizard_options = {

    # How the reports should be grouped in the report menu
    report_groups = {
      date_time_group = ""
      content_group = {
        file_type = true
        cs_uri = true
        cs_uri_stem = true
        cs_uri_query = true
      }
      visitor_demographics_group = {
        c_ip = true
        domain_description = true
        location = true
        cs_username = true
      }
      visitor_systems_group = {
        screen_dimensions = true
        screen_depth = true
        web_browser = true
        operating_system = true
      }
      referrer_group = {
        referrer = true
        search_engine = true
        search_phrase = true
        referrer_description = true
        search_phrase_by_search_engine = true
      }
      server_group = {
        s_sitename = true
        s_computername = true
        s_ip = true
        s_port = true
        r_dns = true
        r_ip = true
        r_host = true
        r_port = true
        cs_host = true
        s_object_source = true
      }
      other_group = {
        cs_version = true
        worm = true
        spider = true
        cs_method = true
        sc_status = true
        sc_substatus = true
        sc_win32_status = true
        cs_cookie = true
        cs_protocol = true
        s_operation = true
      }
    } # report_groups

  } # create_profile_wizard_options

  not_supported = {
  } # not_supported

} # microsoft_isa_w3c