#
# LogSat SpamFilterISP Log Format
#
# Sawmill log format description file.  Copyright (c) 2004 Flowerfire.
#


# This log format cannot meaningfully track the following types of database data.
# Possible options for $notsupported are daybyday, individualhosts,
# sessions, sessionpages, hits, bandwidth, pageviews, and visitors.
$notsupported bandwidth
$notsupported visitors
$notsupported sessions
$notsupported pageviews
$notsupported individualhosts

# The name of the log format
log_file_format "LogSat SpamFilterISP Log Format"
log_data_type mail_server

# The log is in this format if any of the first ten lines match this regular expression
log_format_autodetect_regular_expression
  "^[0-9][0-9]/[0-9][0-9]/[0-9][0-9] [0-9][0-9]:[0-9][0-9]:[0-9][0-9]:[0-9][0-9][0-9] -- \([0-9]+\) "

# All log field parsing will be done using the parsing filters
parse_only_with_filters true

# The format of dates and times in this log
# log_date_format auto
# log_time_format auto
log_date_format "mm/dd/yy"
log_time_format "hh:mm:ss"

# Entries are called messages
entry_name message



#
# LOG FIELDS INFORMATION
#
# This describes the fields of the log file.
#
# The log fields have the following parameters:
#
#   TYPE:            the log field type.  Valid types include page, date/time,
#                    host, url, agent, size, integer, hierarchical, and flat.
#   INDEX:           the position of the field in the log entry.  The first field is index 1, second is 2, etc.
#   SUBINDEX:        the position of the subfield inside the quoted field.  The first subfield is subindex 1, etc.
#   DIVIDERS:        the characters which divide hierarchy levels in this field; e.g. / for page and . for hostname.
#   LEFT-TO-RIGHT:   true if the field is structured left-to-right, with enclosing items at the left (like a URL).
#   LEADING-DIVIDER: true if the field has a leading divider (like a page field, /dir1/file.html).
#   CASE-SENSITIVE:  true if the field is case sensitive
#

log_field_info
  standard

# NAME             TYPE       INDEX  SUBINDEX  DIVIDERS   LEFT-TO-RIGHT  LEADING-DIVIDER  CASE-SENSITIVE  (leave blank)
  date             date         0      0          ""         false            false           false           ""
  time             time         0      0          ""         false            false           false           ""
  "source IP"      host         0      0          ""         false            false           false           ""
  "source hostname" flat        0      0          ""         false            false           false           ""
  "source country" flat         0      0          ""         false            false           false           ""
  sender           hierarchical 0      0          "@"         false            false           false           ""
  recipient        hierarchical 0      0          "@"         false            false           false           ""
  action           flat         0      0          ""         false            false           false           ""
  reason           flat         0      0          ""         false            false           false           ""
  keywords         flat         0      0          ""         false            false           false           ""

  field_end


#
# LOG PARSING FILTERS
#
# This describes the log parsing filters.
#
# The filers have the following layout:
#
#       (type)
# (A:)     (left-exp) (left-exp-val) (operator) (right-exp) (right-exp-val)
# (B:)     (then-stmt-type) (then-value1) (then-value2) (then-field1) (then-field2)
# (C:)     (else-stmt-type) (else-value1) (else-value2) (else-field1) (else-field2)
#          
#


log_parsing_filters
  standard

  # Parse the date/time
  do_b
    "" "" "" "" ""
    collect_multiple_fields_regexp "^([0-9][0-9]/[0-9][0-9]/[0-9][0-9]) ([0-9][0-9]:[0-9][0-9]:[0-9][0-9]):[0-9][0-9][0-9] -- \(([0-9]+)\) " "date,time,*KEY*" "" ""
    goto_next_filter "" "" "" ""
    ""

  # Parse a Resolving line
  do_b
    "" "" "" "" ""
    collect_multiple_fields_regexp "\(([0-9]+)\) Resolving ([0-9.]+) - (.*)$" "*KEY*,source IP,source hostname" "" ""
    goto_next_filter "" "" "" ""
    ""

  # Parse a Mail from line
  do_b
    "" "" "" "" ""
    collect_multiple_fields_regexp "\(([0-9]+)\) Mail from: (.*)$" "*KEY*,sender" "" ""
    goto_next_filter "" "" "" ""
    ""

  # Parse a Connection from line
  do_b
    "" "" "" "" ""
    collect_multiple_fields_regexp "\(([0-9]+)\) Connection from: ([0-9.]+)  -  Originating country : (.*)$" "*KEY*,source IP,source country" "" ""
    goto_next_filter "" "" "" ""
    ""

  # Parse a MAPS blacklist line
  do_b
    "" "" "" "" ""
    collect_multiple_fields_regexp "\(([0-9]+)\) - MAPS search done.*(Blacklisted by [^ ]+\. )" "*KEY*,reason" "" ""
    goto_next_filter "" "" "" ""
    ""

  # Parse a Reverse DNS failed line
  do_b
    "" "" "" "" ""
    collect_multiple_fields_regexp "\(([0-9]+)\) - (Reverse DNS not found)" "*KEY*,reason" "" ""
    goto_next_filter "" "" "" ""
    ""

  # Parse a quarantined line
  do_b
    "" "" "" "" ""
    collect_multiple_fields_regexp "\(([0-9]+)\) ([0-9.]+) - Mail from: ([^ ]+) To: ([^ ]+) will be (quarantined)" "*KEY*,source IP,sender,recipient,action" "" ""
    goto_next_filter "" "" "" ""
    ""

  # Parse an "accepted" line
  do_b
    "" "" "" "" ""
    collect_multiple_fields_regexp "\(([0-9]+)\) RCPT TO: (.*) (accepted)" "*KEY*,recipient,action" "" ""
    goto_next_filter "" "" "" ""
    ""

  # Parse an "matches content filter rules" line
  do_b
    "" "" "" "" ""
    collect_multiple_fields_regexp "\(([0-9]+)\) EMail from (.*) to (.*) (matches content filter rules) - (rejected)" "*KEY*,sender,recipient,reason,action" "" ""
    goto_next_filter "" "" "" ""
    ""

  # Parse a "Found Keywords" line
  do_b
    "" "" "" "" ""
    collect_multiple_fields_regexp "\(([0-9]+)\) Found Keywords: \[(.*)\]" "*KEY*,keywords" "" ""
    goto_next_filter "" "" "" ""
    ""

  # Accept on Disconnect
  do_b
    "" "" "" "" ""
    accept_collected_entry_regexp "\(([0-9]+)\) Disconnect" "" "" ""
    goto_next_filter "" "" "" ""
    ""

  filter_end



#
# DATABASE FIELDS INFORMATION
#
# This describes the fields of the database (the data which will be tracked and summarized in the statistics)
#
# The database fields have the following parameters.  See Hierarchies in the docs for information about hierarchies.
#
#   LOG-FIELD:       the name of the log field to track (may be a derived field)
#   SUPPRESS-TOP:    the number of levels to suppress at the top of the hierarchy
#   SUPPRESS-BOTTOM: the number of levels to suppress at the bottom of the hierarchy
#   INCLUDE_BOTTOM:  true to always include all bottom-level items, regardless of SUPPRESS-BOTTOM
#

database_field_info
  standard

# LOG-FIELD       SUPPRESS-TOP  SUPPRESS-BOTTOM  INCLUDE-BOTTOM  (leave-blank)
  date/time               0              3             false           ""
  "day of week"           0              2             false           ""
  "hour of day"           0              2             false           ""
  "source IP"             0              2             false           ""
  "source hostname"       0              2             false           ""
  location                0              2             false           ""
  sender                  0              3             false           ""
  recipient               0              3             false           ""
  action                  0              2             false           ""
  reason                  0              2             false           ""
  keywords                0              2             false           ""

  field_end

