<?xml version='1.0' encoding="GB2312"?>
<config>
  <syslog Name="pfilter" Text="包过滤日志格式" Format="logtype=1">
    <field>date="%S(20)logdate%" </field>
    <field>sa=%S(20)saddr% </field>
    <field>sport=%I(6)sport% </field>
    <field>da=%S(20)daddr% </field>
    <field>service=%I(6)dport% </field>
    <field>proto=%I(3)proto% </field>
    <field>policy=%I(3)% </field> 
    <field>duration=%L(20)duration% </field>
    <field>rcvd=%L(20)rcvd% </field>
    <field>sent=%L(20)sent% </field>
  </syslog>
  <syslog Name="proxylog" Text="代理日志" Format="logtype=2">
    <field>date="%S(20)logdate%" </field>
    <field>mod=%S(20)proxytype% </field>
    <field>sa=%S(20)saddr% </field>
    <field>sport=%I(6)sport% </field>
    <field>da=%S(20)daddr% </field>
    <field>service=%I(6)dport% </field>
    <field>url=%S(100)% </field> 
    <field>sent=%L(20)sent% =</field>
    <field>rcvd=%L(20)rcvd% </field>    
    <field>duration=%L(20)duration% </field>
  </syslog>
  <syslog Name="idslog" Text="入侵检测日志" Format="logtype=3">
    <field>date="%S(20)logdate%" </field>
    <field>sa=%S(20)saddr% </field>
    <field>sport=%I(6)sport% </field>
    <field>da=%S(20)daddr% </field>
    <field>service=%I(6)dport% </field>
    <field>proto=%I(3)proto% </field>
    <field>blockmode=%I(2)blockmode% </field> 
    %d
  </syslog>
  <syslog Name="useraccess" Text="用户访问日志" Format="logtype=5">
    <field>date="%S(20)logdate%" </field>
    <field>user=%S(20)username% </field>    
    <field>ip=%S(20)userip% </field>
    <field>inbytes=%L(20)inbytes% </field>
    <field>outbytes=%L(20)outbytes% </field> 
    <field>duration=%L(20)duration%</field>   
  </syslog>
  <syslog Name="urlfilter" Text="URL过滤日志" Format="logtype=6">
    <field>date="%S(20)logdate%" </field>
    <field>sa=%S(20)saddr% </field>
    <field>sport=%I(6)sport% </field>
    <field>da=%S(20)daddr% </field>
    <field>service=%I(6)dport% </field>
    <field>url=%S(100)url% </field>
    <field>act=%S(10)filtertype%</field> 
  </syslog>
  <syslog Name="devicestatus" Text="设备运行状况日志" Format="logtype=8">
    <field>date="%S(20)logdate%" </field>
    <field>act=%S(10)act% </field>
    <field>result=%I(2)result% </field>
  </syslog>
  <syslog Name="deviceadmin" Text="设备管理日志" Format="logtype=9">
    <field>date="%S(20)logdate%" </field>
    <field>act=%S(10)act% </field>
    <field>result=%I(2)result% </field>
  </syslog>
  <syslog Name="clusterlog" Text="集群日志" Format="logtype=10">
     <field>date="%S(20)logdate%" </field>
    <field>haid=%L(20)haid% </field>
    <field>nodeip=%S(20)nodeip% </field>
    <field>msg=%S(100)msg%</field>
  </syslog>
</config>