<?xml version='1.0' encoding="GB2312"?>
<config>
  <report>
    <name>fhosttraffic</name>
    <title>主机访问流量TOP10包过滤格式</title>
    <field>msg</field>
    <count>10</count>
    <iptype>2</iptype>
    <format>logtype=1</format>        
    <statnum>6</statnum>
    <stat1>sa=%A(20)saddr% </stat1>
    <stat2>proto=%I(3)proto% </stat2>
    <stat3>duration=%M(20)durationsum% </stat3>
    <stat4>rcvd=%M(20)rcvdsum% </stat4>
    <stat5>sent=%M(20)sentsum% </stat5>
    <stat6>%C(20)count%</stat6>
  </report>
  <report>
    <name>phosttraffic</name>
    <title>主机访问流量TOP10代理日志</title>
    <field>msg</field>
    <count>10</count>
    <iptype>2</iptype>
    <format>logtype=2</format>        
    <statnum>5</statnum>
    <stat1>sa=%A(20)saddr% </stat1>
    <stat2>sent=%M(20)sentsum% </stat2>
    <stat3>rcvd=%M(20)rcvdsum% </stat3>
    <stat4>duration=%M(20)durationsum% </stat4>
    <stat5>%C(20)count%</stat5>
  </report>
  <report>
    <name>fsitetraffic</name>
    <title>站点被访问流量TOP10包过滤格式</title>
    <field>msg</field>
    <count>10</count>
    <iptype>2</iptype>
    <format>logtype=1</format>        
    <statnum>6</statnum>
    <stat1>da=%A(20)daddr% </stat1>
    <stat2>proto=%I(3)proto% </stat2>
    <stat3>duration=%M(20)durationsum% </stat3>
    <stat4>rcvd=%M(20)rcvdsum% </stat4>
    <stat5>sent=%M(20)sentsum% </stat5>
    <stat6>%C(20)count%</stat6>
  </report>
  <report>
    <name>psitetraffic</name>
    <title>站点被访问流量TOP10代理日志</title>
    <field>msg</field>
    <count>10</count>
    <iptype>2</iptype>
    <format>logtype=2</format>        
    <statnum>6</statnum>
    <stat1>result=%I(2)result% </stat1>
    <stat2>da=%A(20)daddr% </stat2>
    <stat3>sent=%M(20)sentsum% </stat3>
    <stat4>rcvd=%M(20)rcvdsum% </stat4>
    <stat5>duration=%M(20)durationsum% </stat5>
    <stat6>%C(20)count%</stat6>    
  </report>
  <report>
    <name>fdenytype</name>
    <title>拒绝访问类型TOP10包过滤</title>
    <field>msg</field>
    <count>10</count>
    <iptype>2</iptype>
    <format>logtype=1</format>        
    <statnum>4</statnum>
    <stat1>sa=%A(20)saddr% </stat1>
    <stat2>proto=%I(3)proto% </stat2>
    <stat3>policy=%I(3)policy% </stat3>
    <stat4>%C(20)count%</stat4>
  </report>
  <report>
    <name>pdenytype</name>
    <title>拒绝访问类型TOP10代理日志</title>
    <field>msg</field>
    <count>10</count>
    <iptype>2</iptype>
    <format>logtype=2</format>        
    <statnum>3</statnum>
    <stat1>result=%I(2)result% </stat1>
    <stat2>sa=%A(20)saddr% </stat2>
    <stat3>%C(20)count%</stat3>    
  </report>
  <report>
    <name>denysite</name>
    <title>禁访站点访问尝试次数TOP10</title>
    <field>msg</field>
    <count>10</count>
    <iptype>2</iptype>
    <format>act="deny"</format>        
    <statnum>3</statnum>
    <stat1>user=%A(20)daddr% </stat1>
    <stat2>url=%S(100)url% </stat2>
    <stat3>%C(20)count%</stat3>    
  </report>
  <report>
    <name>usertraffic</name>
    <title>用户流量统计TOP10</title>
    <field>msg</field>
    <count>10</count>
    <iptype>2</iptype>
    <format>logtype=5</format>        
    <statnum>6</statnum>
    <stat1>user=%S(20)username% </stat1>    
    <stat2>ip=%A(20)userip% </stat2>
    <stat3>inbytes=%M(20)inbytes% </stat3>
    <stat4>outbytes=%M(20)outbytes% </stat4> 
    <stat5>duration=%M(20)duration%</stat5>
    <stat6>%C(20)count%</stat6>   
  </report>
  <report>
    <name>userlogin</name>
    <title>用户登录统计TOP10</title>
    <field>msg</field>
    <count>10</count>
    <iptype>2</iptype>
    <format>logtype=5</format>        
    <statnum>4</statnum>
    <stat1>user=%S(20)username% </stat1>
    <!--result表示登录状态，0表示成功，1表示失败 -->    
    <stat2>result=%I(2)result% </stat2>
    <stat3>ip=%A(20)userip% </stat3>
    <stat4>%C(20)count%</stat4>   
  </report>
  <report>
    <name>systemstatus</name>
    <title>系统启动/关闭</title>
    <field>msg</field>
    <iptype>2</iptype>
    <format>logtype=8</format>        
    <statnum>3</statnum>
    <stat1>act%S(10)status% </stat1>
    <stat2>result=%I(2)result% </stat2>
    <stat3>%C(20)count%</stat3>    
  </report>
  <report>
    <name>systemadmin</name>
    <title>系统管理</title>
    <field>msg</field>
    <iptype>2</iptype>
    <format>logtype=9</format>        
    <statnum>3</statnum>
    <stat1>act%S(10)status% </stat1>
    <stat2>result=%I(2)result% </stat2>
    <stat3>%C(20)count%</stat3>    
  </report>
 </config>