beta_amavis = { # The name of the log format log.format.format_label = "Amavis Log Format (BETA)" log.miscellaneous.log_data_type = "syslog_required" log.miscellaneous.log_format_type = "mail_server" # The log is in this format if any of the first ten lines match this regular expression log.format.autodetect_regular_expression = "\\([0-9]+-[0-9-]+\\) (Passed|Blocked) (CLEAN|INFECTED|BAD-HEADER|SPAM), " log.format.autodetect_lines = 100 # Log fields log.fields = { result = "" sender = { type = "hierarchical" hierarchy_dividers = "@" left_to_right = false leading_divider = "false" } # sender recipient = { type = "hierarchical" hierarchy_dividers = "@" left_to_right = false leading_divider = "false" } # recipient message_id = "" mail_id = "" duration = "" messages = "" } # log.fields # # Log Parsing Filters log.parsing_filters.parse = ` # e.g.: Sep 3 19:29:14 newftp.anchovies.com /usr/sbin/amavisd[27292]: (27292-03) Passed CLEAN, [211.117.198.143] [211.117.198.143] -> ,, Message-ID: , mail_id: Yd3kwA9j62ZN, Hits: -0.734, 19550 ms if (matches_regular_expression(v.syslog_message, '\\\\([0-9-]+\\\\) ([^,]*), (.*)$')) then ( set_collected_field('', 'result', $1); v.remainder = $2; # Ignore bracketed IPs if (matches_regular_expression(v.remainder, '^\\\\[([^]])*\\\\] \\\\[([^]])*\\\\] (.*)$')) then v.remainder = $3; if (matches_regular_expression(v.remainder, '^<([^>]*)> -> <([^ ]*)>, Message-ID: <([^>]*)>, mail_id: ([^,]*), Hits: [^,]+, ([0-9]+) ms')) then ( set_collected_field('', 'sender', $1); set_collected_field('', 'recipient', $2); set_collected_field('', 'message_id', $3); set_collected_field('', 'mail_id', $4); set_collected_field('', 'duration', $5); set_collected_field('', 'messages', 1); ); accept_collected_entry('', false); ); ` # Database fields database.fields = { result = "" sender = "" recipient = "" message_id = "" mail_id = "" } # database.fields database.numerical_fields = { messages = { default = true requires_log_field = false entries_field = true } # messages duration = { default = false type = "float" display_format_type = "duration_milliseconds" } } # database.numerical_fields create_profile_wizard_options = { # How the reports should be grouped in the report menu report_groups = { date_time_group = "" } # report_groups } # create_profile_wizard_options } # beta_amavis