Автор: SXP
Дата сообщения: 26.05.2003 07:44
		Ilich Ramiras 
 gde stavit to tsiferki! op_log.ini bolsoy! 
  
 
Код:  
 [Main] 
 DisplayName=Firewall Logs 
 Icon=op_log.dll, 1 
 OpenIcon=op_log.dll, 1 
 DataTable= 
 Childs=Plugins, conn_log_allow, conn_log_block, systemlog, Traffic 
 [Settings] 
 OvewriteUserMenus=yes 
 ShowTooltips=no 
 GridLines=yes 
 ShowDirectionText=yes 
 ShowIconForDirection=no 
 ShowShortTodayDate=yes 
 ResolveIP=yes 
 ShowPortAliase=yes 
 SizeUnit=auto 
 ShowShortFileName=yes 
 ShowIconForFile=yes 
 ShowRawAppExtesion=no 
 [PresetsVer] 
 IniSectionVer=68, 00000000 
 [Fields] 
 100000="Count", VISIBLE|FORMAT_RIGHT, 80, TEXT_INTEGER, 
 100100="Count", VISIBLE|FORMAT_RIGHT, 80, TEXT_INTEGER, 
 100101="Count", VISIBLE|FORMAT_RIGHT, 80, TEXT_INTEGER, 
 100200="Count", VISIBLE|FORMAT_RIGHT, 80, TEXT_INTEGER, 
 100300="Count", VISIBLE|FORMAT_RIGHT, 80, TEXT_INTEGER, 
 100500="Count", VISIBLE|FORMAT_RIGHT, 80, TEXT_INTEGER, 
 20001="", HIDE, 100, TEXT_KEY,               
 20002="Block Reason", VISIBLE, 150, <ad_int.ofp>, <ad_int.ofp> RULE_NUMBER_LOOKUP 
 20003="Details", VISIBLE, 150, TEXT_STRING, RULE_STRING 
 20004="Ad-String/Ad-Size", VISIBLE, 150, TEXT_STRING, RULE_STRING 
 20005="Date/Time", VISIBLE, 100, TEXT_DATETIME, RULE_DATETIME 
 21001="", HIDE, 100, TEXT_KEY,               
 21002="Block Reason", VISIBLE, 150, <cnt_int.ofp>, <cnt_int.ofp> RULE_NUMBER_LOOKUP 
 21003="URL", VISIBLE, 150, TEXT_STRING, RULE_STRING 
 21004="Keyword", VISIBLE, 150, TEXT_STRING, RULE_STRING 
 21005="Date/Time", VISIBLE, 100, TEXT_DATETIME, RULE_DATETIME 
 22001="", HIDE, 100, TEXT_KEY,               
 22002="Event", VISIBLE, 80, <dns_int.ofp>, <dns_int.ofp> RULE_NUMBER_LOOKUP 
 22003="IP", VISIBLE, 160, TEXT_STRING, RULE_STRING 
 22004="Domain Name", VISIBLE, 220, TEXT_STRING, RULE_STRING 
 22005="Date/Time", VISIBLE, 100, TEXT_DATETIME, RULE_DATETIME 
 23001="", HIDE, 100, TEXT_KEY,               
 23002="Date/Time", VISIBLE, 100, TEXT_DATETIME, RULE_DATETIME 
 23003="Sender", VISIBLE, 180, TEXT_STRING, RULE_STRING 
 23004="Sender's e-mail", VISIBLE, 180, TEXT_STRING, RULE_STRING 
 23005="File Name", VISIBLE, 150, TEXT_STRING, RULE_STRING 
 23006="File Type", VISIBLE, 150, TEXT_APP_EXT, RULE_APP_EXT 
 23007="Action", VISIBLE, 180, <file_int.ofp>, <file_int.ofp> RULE_NUMBER_LOOKUP 
 25001="", HIDE, 100, TEXT_KEY,          
 25002="Action", VISIBLE, 150, <web_int.ofp>, <web_int.ofp> RULE_NUMBER_LOOKUP 
 25003="URL", VISIBLE, 150, TEXT_STRING, RULE_STRING 
 25004="Details", INVISIBLE, 150, TEXT_STRING, RULE_STRING 
 25005="Date/Time", VISIBLE, 100, TEXT_DATETIME, RULE_DATETIME 
 24001="", HIDE, 100, TEXT_KEY,               
 24002="IP Address", VISIBLE, 140, <prot_int.ofp>, RULE_IPADDR 
 24003="", HIDE, 100, TEXT_IPADDR,               
 24004="Attack Type", VISIBLE, 100, <prot_int.ofp>, <prot_int.ofp> RULE_NUMBER_LOOKUP 
 24005="", HIDE, 100, TEXT_LONG,               
 24006="Scan Port Details", VISIBLE, 210, <prot_int.ofp>,               
 24007="Date/Time", VISIBLE, 100, TEXT_DATETIME, RULE_DATETIME 
 30021="", HIDE, 100, TEXT_KEY,               
 30022="", HIDE, 150, TEXT_DWORD,               
 30010="", HIDE, 150, TEXT_DWORD,               
 30023="State", HIDE, 150, TEXT_DIRECTION, RULE_DIRECTION 
 30024="Direction", INVISIBLE, 80, TEXT_DIRECTION, RULE_DIRECTION 
 30033="Protocol", VISIBLE, 100, TEXT_PROTOCOL, RULE_PROTOCOL 
 30031="Remote Address", VISIBLE, 100, TEXT_IPADDR, RULE_IPADDR 
 30032="Remote Port", VISIBLE, 100, TEXT_PORT, RULE_PORT 
 30029="Local Address", INVISIBLE, 100, TEXT_IPADDR, RULE_IPADDR 
 30030="Local Port", INVISIBLE, 100, TEXT_PORT, RULE_PORT 
 30034="Sent", INVISIBLE, 100, TEXT_DATASIZE, RULE_DATASIZE 
 30035="Recv", INVISIBLE, 100, TEXT_DATASIZE, RULE_DATASIZE 
 30027="Start Time", VISIBLE, 100, TEXT_DATETIME, RULE_DATETIME 
 30028="Up Time", INVISIBLE, 100, TEXT_TIMESPAN, RULE_TIMESPAN 
 30036="BPS", INVISIBLE, 100, TEXT_DATASPEED, RULE_DATASPEED 
 30025="Reason", VISIBLE, 300, TEXT_REASON, RULE_REASON 
 30037="Requested Address", INVISIBLE, 300, TEXT_STRING, RULE_STRING 
 30038="Application", VISIBLE, 120, TEXT_PROCESS, RULE_PROCESS 
 30040="", HIDE, 100, TEXT_KEY,               
 30043="Filename", VISIBLE, 150, TEXT_FILENAME,               
 30047="", HIDE, 0, ,               
 30050="", HIDE, 100, TEXT_KEY,               
 30051="Date/Time", VISIBLE, 150, TEXT_DATETIME,               
 30052="IP Address", VISIBLE, 150, TEXT_IPADD_RAW,               
 30053="DNS name", VISIBLE, 150, TEXT_STRING,               
 30055="", HIDE, 100, TEXT_KEY,               
 30057="Context", VISIBLE, 150, TEXT_DWORD,               
 30058="Allow/Block Reason", VISIBLE, 150, TEXT_STRING,               
 30054="Filename", VISIBLE, 150, TEXT_STRING,               
 1001="", HIDE, 100, TEXT_KEY,               
 1002="Date/Time", VISIBLE, 100, TEXT_DATETIME,               
 1003="Event", VISIBLE, 350, TEXT_STRING,               
 900034="Send", VISIBLE|FORMAT_RIGHT, 140, TEXT_DATASIZE, RULE_DATASIZE 
 900035="Recv", VISIBLE|FORMAT_RIGHT, 140, TEXT_DATASIZE, RULE_DATASIZE 
 [AliaseToIDMapping] 
 tr_send_sum=900034 
 tr_recv_sum=900035 
 ps_ads_key_count=100000 
 ps_content_key_count=100100 
 ps_content_url_count=100101 
 ps_dns_count=100200 
 ps_attach_file_count=100300 
 ps_act_cont_event_count=100500 
 [Ads] 
 Childs=ps_ads_block,ps_ads_keywords 
 DisplayName=Ads 
 DataTable=ads_log 
 EnableDBNotify=no 
 Icon=ad_int.ofp, 0 
 OpenIcon=ad_int.ofp, 0 
 DefaultOrder=20005, 20002, 20003, 20004 
 CanAddFilter=1 
 CanClearLog=1 
 SortField=fld_20005_11 
 AscSort=no 
 [ps_ads_block] 
 DisplayName=Last 10 Ads blocked 
 Icon=op_log.dll, 16 
 OpenIcon=op_log.dll, 16 
 DataTable=SELECT TOP 10 * from ads_log 
 DefaultOrder=20005, 20002, 20003, 20004 
 SortField=fld_20005_11 
 AscSort=no 
 [ps_ads_keywords] 
 DisplayName=Most popular keywords 
 Icon=op_log.dll, 16 
 OpenIcon=op_log.dll, 16 
 DataTable=SELECT fld_20004_9/*Keyword*/, count(fld_20004_9) as ps_ads_key_count from ads_log group by fld_20004_9 order by 2 desc 
 DefaultOrder=20004, 100000 
 SortField= 
 AscSort=no 
 [Content] 
 Childs=ps_content_keywords,ps_content_often,ps_content_10 
 DisplayName=Content 
 DataTable=cnt_log 
 EnableDBNotify=no 
 Icon=cnt_int.ofp, 0 
 OpenIcon=cnt_int.ofp, 0 
 DefaultOrder=21005, 21002, 21003, 21004 
 CanAddFilter=1 
 CanClearLog=1 
 SortField=fld_21005_11 
 AscSort=no 
 [ps_content_keywords] 
 DisplayName=Most often keywords used for blocking 
 Icon=op_log.dll, 16 
 OpenIcon=op_log.dll, 16 
 DataTable=SELECT fld_21004_9/*Keyword*/, count(fld_21004_9) as ps_content_key_count from cnt_log group by fld_21004_9 order by 2 desc 
 DefaultOrder=21004, 100100 
 [ps_content_often] 
 DisplayName=Most often sites blocked 
 Icon=op_log.dll, 16 
 OpenIcon=op_log.dll, 16 
 DataTable=SELECT fld_21003_9/*URL*/, count(fld_21003_9) as ps_content_url_count from cnt_log group by fld_21003_9 order by 2 desc 
 DefaultOrder=21003, 100101 
 [ps_content_10] 
 DisplayName=Last 10 sites blocked 
 Icon=op_log.dll, 16 
 OpenIcon=op_log.dll, 16 
 DataTable=SELECT TOP 10 * FROM cnt_log order by fld_21005_11/*Date Time*/ desc 
 DefaultOrder=21005, 21002, 21003, 21004 
 SortField= 
 AscSort=no 
 [Dns] 
 Childs=ps_dNS_cache_used,ps_dNS_cache_10_used,ps_dNS_cache_10_new 
 DisplayName=DNS Cache 
 DataTable=dns_log 
 EnableDBNotify=no 
 Icon=dns_int.ofp, 0 
 OpenIcon=dns_int.ofp, 0 
 DefaultOrder=22005, 22004, 22002, 22003 
 CanAddFilter=1 
 CanClearLog=1 
 SortField=fld_22005_11 
 AscSort=no 
 [ps_dNS_cache_used] 
 DisplayName=Most used records 
 Icon=op_log.dll, 16 
 OpenIcon=op_log.dll, 16 
 DataTable=SELECT fld_22004_9/*Host*/, count(fld_22004_9) as ps_dns_count from dns_log WHERE fld_22002_7=2/*Event Type*/ group by fld_22004_9 order by 2 desc 
 DefaultOrder=22004, 100200 
 [ps_dNS_cache_10_used] 
 DisplayName=Last 10 used records 
 Icon=op_log.dll, 16 
 OpenIcon=op_log.dll, 16 
 DataTable=SELECT TOP 10 fld_22003_9/*IP*/, fld_22004_9/*Host*/, fld_22005_11/*Date Time*/ FROM dns_log WHERE fld_22002_7=2/*Event Type*/ order by fld_22005_11/*Date Time*/ desc 
 DefaultOrder=22005, 22004, 22003 
 [ps_dNS_cache_10_new] 
 DisplayName=Last 10 new records 
 Icon=op_log.dll, 16 
 OpenIcon=op_log.dll, 16 
 DataTable=SELECT TOP 10 fld_22003_9/*IP*/, fld_22004_9/*Host*/, fld_22005_11/*Date Time*/ FROM dns_log WHERE fld_22002_7=0/*Event Type*/ order by fld_22005_11/*Date Time*/ desc 
 DefaultOrder=22005, 22004, 22003 
 [EmailAttachments] 
 Childs=ps_attachment_quar,ps_attachment_10 
 DisplayName=Attachments Filter 
 DataTable=email_log 
 EnableDBNotify=no 
 Icon=file_int.ofp, 0 
 OpenIcon=file_int.ofp, 0 
 DefaultOrder=23002, 23003, 23004, 23005, 23006, 23007 
 CanAddFilter=1 
 CanClearLog=1 
 SortField=fld_23002_11 
 AscSort=no 
 [ps_attachment_quar] 
 DisplayName=Most often renamed file types 
 Icon=op_log.dll, 16 
 OpenIcon=op_log.dll, 16 
 DataTable=SELECT fld_23006_9/*File type*/, count(fld_23006_9) as ps_attach_file_count FROM email_log where fld_23007_2=1 or fld_23007_2=3 group by fld_23006_9 order by 2 desc 
 DefaultOrder=23006, 100300 
 [ps_attachment_10] 
 DisplayName=Last 10 e-mails with attachments 
 Icon=op_log.dll, 16 
 OpenIcon=op_log.dll, 16 
 DataTable=SELECT TOP 10 * FROM email_log order by fld_23002_11/*Date Time*/ desc 
 DefaultOrder=23002, 23003, 23004, 23005, 23006, 23007 
 [Protect] 
 Childs=ps_suspicious_packets,ps_atack_10 
 DisplayName=Attack Detection 
 DataTable=select * from prot_log where (fld_24004_6 <> 3) 
 EnableDBNotify=no 
 Icon=prot_int.ofp, 0 
 OpenIcon=prot_int.ofp, 0 
 DefaultOrder=24007, 24004, 24002, 24006 
 CanAddFilter=1 
 CanClearLog=1 
 SortField=fld_24007_11 
 AscSort=no 
 [ps_suspicious_packets] 
 DisplayName=Suspicious packets 
 Icon=op_log.dll, 16 
 OpenIcon=op_log.dll, 16 
 DataTable=select fld_24007_11/*Date Time*/, fld_24002_8/*IP*/, fld_24006_10/*Scan data*/, fld_24005_7/*Scan count*/, fld_24003_8/*IP1*/ from prot_log where fld_24004_6=3 order by 1 desc 
 DefaultOrder=24007, 24002, 24006 
 SortField= 
 AscSort=no 
 [ps_atack_10] 
 DisplayName=Last 10 Attacks detected 
 Icon=op_log.dll, 16 
 OpenIcon=op_log.dll, 16 
 DataTable=SELECT TOP 10 * FROM prot_log where fld_24004_6 <> 3 ORDER BY fld_24007_11/*Date Time*/ desc 
 DefaultOrder=24007, 24004, 24002, 24006 
 SortField= 
 AscSort=no 
 [Web] 
 Childs=ps_active_content_blocked,ps_active_content_active,ps_active_content_10 
 DisplayName=Active Content 
 DataTable=web_log 
 EnableDBNotify=no 
 Icon=web_int.ofp, 0 
 OpenIcon=web_int.ofp, 0 
 DefaultOrder=25005, 25002, 25003, 25004 
 CanAddFilter=1 
 CanClearLog=1 
 SortField=fld_25005_11 
 AscSort=no 
 [ps_active_content_blocked] 
 DisplayName=Most often active elements blocked 
 Icon=op_log.dll, 16 
 OpenIcon=op_log.dll, 16 
 DataTable=SELECT fld_25002_7/*Event Type*/, count(fld_25002_7) as ps_act_cont_event_count from web_log group by fld_25002_7/*Event Type*/ order by 2 desc 
 DefaultOrder=25002, 100500 
 [ps_active_content_active] 
 DisplayName=Sites with a lot of active elements 
 Icon=op_log.dll, 16 
 OpenIcon=op_log.dll, 16 
 DataTable=SELECT fld_25003_9/*URL*/, count(fld_25003_9) as ps_act_cont_event_count from web_log group by fld_25003_9  order by 2 desc 
 DefaultOrder=25003, 100500 
 [ps_active_content_10] 
 DisplayName=Last 10 active elements blocked 
 Icon=op_log.dll, 16 
 OpenIcon=op_log.dll, 16 
 DataTable=SELECT TOP 10 fld_25003_9/*URL*/, fld_25002_7/*Elements*/, fld_25005_11/*Date Time*/ FROM web_log order by fld_25005_11/*Date Time*/ desc 
 DefaultOrder=25005, 25002, 25003 
 SortField= 
 AscSort=no 
 [conn_log_allow] 
 Childs=ps_conn_log_allow_today,ps_conn_log_allow_10_min,conn_log_allow_netbios_filter,conn_log_allow_web_filter,conn_log_allow_email_filter, 
 DisplayName=Allowed Connections 
 DataTable=select * from conn_log where (fld_30023_7 = 1) or (fld_30023_7 = 2) 
 EnableDBNotify=no 
 Icon=engine.dll, 1 
 OpenIcon=engine.dll, 1 
 DefaultOrder=30023, 30027, 30038, 30024, 30033, 30031, 30032, 30029, 30030, 30025, 30037, 30028, 30036, 30034, 30035 
 CanAddFilter=1 
 CanClearLog=1 
 SortField=fld_30027_11 
 AscSort=no 
 [ps_conn_log_allow_today] 
 DisplayName=Allowed Today 
 IsFilter=true 
 EnableDBNotify=false 
 DefaultOrder=30023, 30027, 30038, 30024, 30033, 30031, 30032, 30029, 30030, 30025, 30037, 30028, 30036, 30034, 30035 
 SortField=fld_30027_11 
 AscSort=no