mtsprofessional = { # The name of the log format log.format.format_label = "MTS Professional Log Format" log.miscellaneous.log_data_type = "generic" log.miscellaneous.log_format_type = "mail_server" # The log is in this format if any of the first ten lines match this regular expression log.format.autodetect_regular_expression = "^[0-9][0-9]/[0-9][0-9]/[0-9][0-9][0-9][0-9] [0-9][0-9]:[0-9][0-9]:[0-9][0-9]-0X[^-]+-[^:]+: " # The format of dates and times in this log log.format.date_format = "auto" log.format.time_format = "auto" # Log entries are called messages statistics.miscellaneous.entry_name = "messages" # All log field parsing will be done using the parsing filters log.format.parse_only_with_filters = "true" # Log fields log.fields = { date = { label = "$lang_stats.field_labels.date" type = "date" index = 0 subindex = 0 hierarchy_dividers = "" left_to_right = false leading_divider = "false" } # date time = { label = "$lang_stats.field_labels.time" type = "time" index = 0 subindex = 0 hierarchy_dividers = "" left_to_right = false leading_divider = "false" } # time component = { label = "$lang_stats.field_labels.component" type = "flat" index = 0 subindex = 0 } # component remote_ip = { label = "$lang_stats.field_labels.remote_ip" type = "flat" index = 0 subindex = 0 } # remote_ip from = { label = "$lang_stats.field_labels.from" type = "flat" index = 0 subindex = 0 } # from to = { label = "$lang_stats.field_labels.to" type = "flat" index = 0 subindex = 0 } # to user = { label = "$lang_stats.field_labels.user" type = "flat" index = 0 subindex = 0 } # user action = { label = "$lang_stats.field_labels.action" type = "flat" index = 0 subindex = 0 } # action size = { label = "$lang_stats.field_labels.size" type = "flat" index = 0 subindex = 0 } # size } # log.fields # # Log Parsing Filters log.parsing_filters = { # Parse out the header 1 = { label = "1" comment = "" value = "collect_fields_using_regexp('^([0-9/]+) ([0-9:]+)-(0X[^-]+)-([^:]+):', 'date,time,*KEY*,component')" } # 1 # Parse Remote IP line 2 = { label = "2" comment = "" value = "collect_fields_using_regexp('^([0-9/]+) ([0-9:]+)-(0X[^-]+)-([^:]+): Remote IP = (.*)\\\\.\\\\.$', 'date,time,*KEY*,component,remote_ip')" } # 2 # Parse MAIL FROM line 3 = { label = "3" comment = "" value = "collect_fields_using_regexp('^([0-9/]+) ([0-9:]+)-(0X[^-]+)-([^:]+): .*Got [Mm][Aa][Ii][Ll] [Ff][Rr][Oo][Mm]:<([^>]+)>', 'date,time,*KEY*,component,from')" } # 3 # Parse SIZE= line 4 = { label = "4" comment = "" value = "collect_fields_using_regexp('^([0-9/]+) ([0-9:]+)-(0X[^-]+)-([^:]+): .*SIZE=([0-9]+)', 'date,time,*KEY*,component,size')" } # 4 # Parse RCPT TO line 5 = { label = "5" comment = "" value = "collect_fields_using_regexp('^([0-9/]+) ([0-9:]+)-(0X[^-]+)-([^:]+): .*Got [Rr][Cc][Pp][Tt] [Tt][Oo]:<([^>]+)>', 'date,time,*KEY*,component,to')" } # 5 # Parse black holed line 6 = { label = "6" comment = "" value = "collect_fields_using_regexp('^([0-9/]+) ([0-9:]+)-(0X[^-]+)-([^:]+): (.* is .* black holed, rejecting connection)', 'date,time,*KEY*,component,action')" } # 6 # Parse SCAN found line 7 = { label = "7" comment = "" value = "collect_fields_using_regexp('^([0-9/]+) ([0-9:]+)-(0X[^-]+)-([^:]+): SCAN found: .* (Found the .* virus)', 'date,time,*KEY*,component,action')" } # 7 # Parse mail OK lines 8 = { label = "8" comment = "" value = "collect_fields_using_regexp('^([0-9/]+) ([0-9:]+)-(0X[^-]+)-([^:]+): Got (mail OK)', 'date,time,*KEY*,component,action')" } # 8 # Parse Writing mail line # do_b # "" "" "" "" "" # collect_multiple_fields_regexp "^([0-9/]+) ([0-9:]+)-(0X[^-]+)-([^:]+): (Writing mail)" "date,time,*KEY*,component,action" "" "" # goto_next_filter "" "" "" "" # "" # Parse POP3 login line 9 = { label = "9" comment = "" value = "collect_fields_using_regexp('^([0-9/]+) ([0-9:]+)-(0X[^-]+)-([^:]+): User ([^ ]+) (POP3 login) complete', 'date,time,*KEY*,component,user,action')" } # 9 # Accept on Closing connection or Login complete 10 = { label = "10" comment = "" value = "accept_collected_entry_using_regexp('^[0-9/]+ [0-9:]+-(0X[^-]+)-[^:]+: (Closing connection|Login complete)', false)" } # 10 } # log.parsing_filters # Database fields database.fields = { date_time = { label = "$lang_stats.field_labels.date_time" log_field = "date_time" type = "string" suppress_top = 0 suppress_bottom = 3 display_format_type = "date_time" } # date_time day_of_week = { label = "$lang_stats.field_labels.day_of_week" log_field = "day_of_week" type = "string" suppress_top = 0 suppress_bottom = 2 display_format_type = "day_of_week" } # day_of_week hour_of_day = { label = "$lang_stats.field_labels.hour_of_day" log_field = "hour_of_day" type = "string" suppress_top = 0 suppress_bottom = 2 display_format_type = "hour_of_day" } # hour_of_day component = { label = "$lang_stats.field_labels.component" log_field = "component" type = "string" suppress_top = 0 suppress_bottom = 9 } # component remote_ip = { label = "$lang_stats.field_labels.remote_ip" log_field = "remote_ip" type = "string" suppress_top = 0 suppress_bottom = 2 } # remote_ip from = { label = "$lang_stats.field_labels.from" log_field = "from" type = "string" suppress_top = 0 suppress_bottom = 9 } # from to = { label = "$lang_stats.field_labels.to" log_field = "to" type = "string" suppress_top = 0 suppress_bottom = 9 } # to user = { label = "$lang_stats.field_labels.user" log_field = "user" type = "string" suppress_top = 0 suppress_bottom = 2 } # user action = { label = "$lang_stats.field_labels.action" log_field = "action" type = "string" suppress_top = 0 suppress_bottom = 2 } # action } # database.fields database.numerical_fields = { messages = { label = "$lang_stats.field_labels.messages" default = true requires_log_field = false type = "int" display_format_type = "integer" entries_field = true } # messages } # database.numerical_fields log.filters = { mark_entry = { label = '$lang_admin.log_filters.mark_entry_label' comment = '$lang_admin.log_filters.mark_entry_comment' value = 'messages = 1;' } # mark_entry } # log.filters create_profile_wizard_options = { date_time_tracking = true # How the reports should be grouped in the report menu report_groups = { date_time_group = "" day_of_week = true hour_of_day = true component = true remote_ip = true from = true to = true user = true action = true } # report_groups } # create_profile_wizard_options not_supported = { individualhosts = true sessions = true visitors = true pageviews = true } # not_supported } # mtsprofessional