#
# reptor.cfg
#
#
# This file contains site specific settings that will determine what logfile
# entries Reptor selects for reporting, what types of reports are generated,
# and how those reports are formatted. By creating multiple configuration files
# and using the --config command line option to select one at runtime, you may
# create reporting scenarios for different firewalls, or different reporting
# scenarios for the same firewall.
#
# For example, you may want to generate an alert report that is emailed to the
# firewall administrator, and a separate summary report that is posted to an
# intranet web server. Create one configuration file called alerts.cfg that
# generates alerts only and outputs to email, and create one configuration file
# called summary.cfg that generates summaries only and outputs to an ftp
# server. Then, run Reptor once with each configuration file:
#
#   perl reptor.pl --config alerts.cfg
#   perl reptor.pl --config summary.cfg
#
# Options in this file must be listed one per line. A line beginning with a
# pound sign indicates a comment. Keywords are not case sensitive, but just
# about everything else is.
#
# For example, these two lines are identical:
#
#   directory /var/adm/sg/oldlogs
#   DIRECTORY /var/adm/sg/oldlogs
#
# but these two lines are not:
#
#   directory /var/adm/sg/oldlogs
#   directory /VAR/ADM/SG/OLDLOGS
#
# If it's not obvious to you where it makes a difference, stick to lowercase.
#
# Text in <angle brackets> denotes a required field. Text in [square brackets]
# denotes an optional field. The pipe character | is used to denote the concept
# of "OR". For example, <one|two> indicates that either "one" or "two" is
# required.
#
# If you wish to specify a string that contains spaces, you must enclose it in
# double quotes. For example:
#
#   alias http "Web Access"
#
# Unless otherwise stated, each option may only be specified once.
#


#
# basedir <directory>
#
# Indicates the directory in which Reptor is installed. This is not required,
# but is useful to avoid problems when Reptor is run from a command scheduler.
#
# Examples:
#
# basedir /usr/local/reptor
# basedir c:\raptor\logs\reptor
#


#
# remotelog <host> [path to remotelogfile executable]
#
# If specified, Reptor will use the remotelog utility provided with the
# firewall to obtain the logfile to process. The remotelog utilities are
# initiated from the client side, so no server side scripting is necessary to
# transfer logfiles. The data stream is also encrypted, so possible
# eavesdropping from packet sniffers is deterred. Use of this option requires
# previous setup of the remotelog utilities. Refer to your firewall
# documentation for further details on this process. Before attempting to
# utilize this feature, verify that the remotelogfile command works when
# manually invoked from a command prompt.
#
# Specify the name or IP address of the firewall server for the <host>
# parameter. If you are not going to use this feature, make sure this option is
# deleted or commented out -- it has precedence over the other options.
#
# Depending on how you have installed the remotelog utilities, you may also
# have to specify the full path to the remotelogfile executable.
#
# Examples:
#
# remotelog firewall.domain.com
# remotelog 10.1.1.7 c:\utilities\remotelog
#


#
# save_logfile [directory]
#
# If specified, Reptor will save a local copy of the logfile that was retrieved
# with remotelog. This is useful if you want to have a local copy of the
# logfile for further analysis or backup. The logfile will be written to the
# current directory if none is specified. If you haven't specified the
# remotelog option, specifying this option is meaningless.
#
# Example:
#
# save_logfile /usr/local/backup
#


#
# compress <command>
#
# If save_logfile is also specified, Reptor will compress logfiles after
# saving them. The command string is the full path name to the compression
# program, plus any options. If there are any spaces in the command string, it
# must be double quoted. This feature only works with compression programs
# that can work with just the name of the file to compress as an argument. For
# example, "gzip file" or "bzip2 file". It will not work with programs that
# require archive names like "pkzip file.zip file".
#
# Examples:
#
# compress "/bin/gzip -9"
# compress "/bin/bzip2 -9"
#


#
# directory <directory>
#
# If you are not using remotelog, this option specifies the directory where the
# firewall logfiles are located on the local machine. This should be an
# absolute path name, and should include the drive letter for Windows NT
# installations. There should be no trailing (back)slash. If Reptor is being
# run on the firewall server and this option is omitted, Reptor will probably
# be able to guess where the logfiles are located. If the "remotelog" option is
# used to retrieve logfiles, this option should not be specified.
#
# Examples:
#
# directory c:\raptor\eagle\sg\oldlogs
# directory /var/adm/sg/oldlogs
#
directory c:\raptor\eagle\sg\oldlogs


#
# uncompress <command> <extension>
#
# If specified, Reptor will assume the logfile is compressed. The command
# string should contain the command to uncompress to stdout, with the full path
# name and any options. The extension string is the filename extension that the
# compression program uses. Strings with spaces should be double quoted.
#
# Examples:
#
# uncompress /bin/zcat Z
# uncompress "/bin/gunzip -c" gz
# uncompress "/bin/bunzip2 -c" bz2
#


#
# split
#
# If specified, Reptor will automatically attempt to handle log files that have
# been split by the firewall. These logs are named:
#
# logfile.date
# logfile.date-1
# logfile.date-2
# logfile.date-3
# [...]
#
# The split option may be combined with either the remotelog or uncompress
# options.
#
# When combined with remotelog, you may receive an error message from the
# remotelogfile program. Since Reptor has no way of knowing ahead of time
# how many chunks there will be, it just keeps trying to open new chunks
# until a failure occurs. The resulting error message can be safely
# ignored.
#
# If you've specified the save_logfile option, the local copy that will be
# created will consist of the concatenation of all the chunks.
#


#
# interface <interface> [alias]
#
# Properly specifying the interface parameters is crucial! The defaults
# set here are probably not correct. If these values are not properly set,
# filtering will not work and most of the report sections will be inaccurate.
#
# This option identifies the network interfaces that are installed in the
# firewall server. The firewall uses identifiers such as "Vpn1" to designate
# these interfaces. If you wish to use a more easily understandable identifier,
# you may also specify an alias for the interface. Interface aliases are case
# sensitive.
#
# You'll probably have to manually browse a logfile to determine which
# identifier refers to which interface. Refer to the FAQ for more details. For
# a Windows NT installation, you may be able to use a program that is available
# at the Raptor public ftp site:
#   ftp://ftp.raptor.com/pub/unsupported/istat5.exe
#
# One "interface" option must be specified for each interface in your
# firewall.
#
# Examples:
#
# interface Vpn1 Inside
# interface Vpn2 Outside
# interface Vpn3 DMZ
#
interface Vpn1 Inside
interface Vpn2 Outside
interface Vpn3 DMZ


#
# filter <source interface> <destination interface>
#
# Instructs Reptor to process only connections made from the specified source
# interface to the specified destination interface. This option is useful if
# you wish to process traffic in only one direction or if your firewall has
# more than two network interfaces and you want to ignore traffic on one of
# them.
#
# If you specified an alias for an interface, use the alias instead of the
# interface identifier. The special keyword "any" may be used to match any
# interface. More than one "filter" option may be specified.
#
# For example, assuming a network structure where the internal interface is
# called Vpn1, the external interface is called Vpn2, and the DMZ interface
# is called Vpn3:
#
# filter any Vpn2
#   Processes traffic from the inside to the outside.
#
# filter Vpn1 Vpn2
# filter Vpn2 Vpn1
#   Processes traffic from the inside out and from the outside in.
#
# filter Vpn3 Vpn2
#   Processes traffic from the DMZ to the outside.
#
# If you have used the "interface" option to specify interface aliases like
# this:
#
# interface Vpn1 Inside
# interface Vpn2 Outside
# interface Vpn3 DMZ
#
# then you must use those aliases in the filter specification like this:
#
# filter Inside Outside
#
filter any any


#
# alias <protocol> <alias>
#
# Protocol aliases allow Reptor to use a more easily understandable string to
# represent protocols that may have confusing identifiers. For example, you
# may wish to use the phrase "Web Access" to represent the HTTP protocol.
# Protocol aliases are case sensitive, and may not refer to other aliases.
#
# The protocol string is the value that actually appears in the firewall log
# file following the "proto=" tag. The alias string is the value that Reptor
# will use to refer to this protocol.
#
# Protocol aliases are often dependent on any GSP services that you may have
# created in your firewall configuration. In this case, the protocol string
# is usually constructed of the port number that the protocol utilizes,
# followed by a forward slash, followed by the transport protocol, which
# is usually tcp or udp.
#
# Examples:
#
# alias 110/tcp pop3
# alias 143/tcp imap
# alias http "Web Browsing"
# alias http-https "Secure Web Browsing"
#
# Two or more similar protocols may be combined into a single reporting group
# by giving them the same alias. For example:
#
# alias http "Web Browsing"
# alias http-https "Web Browsing"
# alias ftp "File Transfer"
# alias ftp-data "File Transfer"
# alias 110/tcp "Email"
# alias 143/tcp "Email"
# alias smtp "Email"
#
# This option may be specified more than once.
#
alias http-https http
alias ftp-data ftp
alias 22/tcp ssh
alias 110/tcp pop3
alias 119/tcp nntp
alias 143/tcp imap


#
# totals
#
# If specified, Reptor will generate a table of statistics summarizing the
# total amount of traffic detailed in the logfile.
#
totals


#
# alerts
#
# If specified, Reptor will generate a table of details about individual
# logfile entries that have triggered alert conditions. At least one of the
# "time", "duration", "volume", "user", or "word" options must also be
# specified in order to define the alert conditions.
#
alerts


#
# show_reason
#
# If specified, the reason for the alert will be included in the alert section.
# If this option is specified, the "alerts" option must be also.
#
show_reason


#
# show_interface
#
# If specified, the source and destination interface will be included in the
# alert section of the report. If this option is specified, the "alerts" option
# must be also.
#
#show_interface


#
# show_user
#
# If specified, the logfile "user" field will be included in the alert section
# of the report. This field contains the user name for authenticated
# connections or the email address of the sender for SMTP connections. If this
# option is specified, the "alerts" option must be also.
#
#show_user


#
# show_auth
#
# If specified, the logfile "auth" field will be included in the alert section
# of the report. This field contains the type of authentication used for
# authenticated connections. If this option is specified, the "alerts" option
# must be also.
#
#show_auth


#
# show_rule
#
# If specified, the rule number that allows a connection to pass through the
# firewall will be included in the alert section of the report. If this option
# is specified, the "alerts" option must be also.
#
#show_rule


#
# show_op
#
# If specified, the logfile "op" field will be included in the alert section of
# the report. If this option is specified, the "alerts" option must be also.
#
#show_op


#
# show_id
#
# If specified, the logfile "id" field will be included in the alert section of
# the report. I have no idea what the id field contains, but if you do, there
# it is. If this option is specified, the "alerts" option must be also.
#
#show_id


#
# show_result
#
# If specified, the logfile "result" field will be included in the alert
# section of the report. If this option is specified, the "alerts" option must
# be also.
#
#show_result


#
# show_arg
#
# If specified, the logfile "arg" field will be included in the alert section
# of the report. This field typically contains the URL for the connection. If
# this option is specified, the "alerts" option must be also.
#
show_arg


#
# all
#
# If specified, all logfile entries will be reported in the alert section,
# regardless of the alert settings. If not specified, only logfile entries that
# trigger alerts will be reported. Use of this option will result in a huge
# amount of output. If this option is specified, the "alerts" option must be
# also.
#
# You really don't want to use this. I don't even know why it's here.
#


#
# time <protocol> <period begin> <period end>
#
# Specifies a condition that will trigger an alert if there is any traffic of
# the specified protocol within the specified time period. If you have
# specified an alias for the protocol, use the alias instead of the protocol
# name. The format of the time period string is HHMM. Use "0000" for midnight
# at the beginning of a period, and "2400" for midnight at the end of a period.
# If this option is specified, the "alerts" option must be also. This option
# may be specified more than once.
#
# Examples:
#
# time telnet 0000 0800
#    Report all telnet activity between midnight and 8am.
#
# time ftp 1830 2400
#    Report all ftp activity between 6:30pm and midnight.
#
time telnet 0000 0800
time telnet 2000 2400
time ftp 0000 0800
time ftp 2000 2400


#
# duration <protocol> <duration> [modifier]
#
# Specifies a condition that will trigger an alert if the duration of the
# connection is greater than or equal to the specified duration. The duration
# is understood as number of seconds unless followed by a modifier of "M" for
# minutes or "H" for hours. If you have specified an alias for the protocol,
# use the alias instead of the protocol name. If this option is specified, the
# "alerts" option must be also. This option may be specified more than once.
#
# Examples:
# 
# duration telnet 1 H
#   Report all telnet activity that lasts longer than 1 hour.
#
# duration ftp 15 M
#   Report all ftp activity that lasts longer than 15 minutes.
#
# duration smtp 30
#   Report all smtp activity that lasts longer than 30 seconds.
#
duration ftp 5 M
duration http 2 M
duration pop3 5 M
duration smtp 5 M
duration telnet 30 M


#
# volume <protocol> <volume> [modifier]
#
# Specifies a condition that will trigger an alert if the amount of traffic
# transferred (sent + received) during a connection is greater than or equal to
# the specified number of bytes. The volume is understood as number of bytes
# unless followed by a modifier of "K" for kilobytes or "M" for megabytes. If
# you have specified an alias for the protocol, use the alias instead of the
# protocol name. If this option is specified, the "alerts" option must be also.
# This option may be specified more than once.
#
# Examples:
#
# volume ftp 2 M
#   Report all ftp transfers that are greater than 2 megabytes.
#
# volume smtp 200 K
#   Report all smtp transfers that are greater than 200 kilobytes.
#
# volume telnet 500
#   Report all telnet transfers that are greater than 500 bytes.
#
volume ftp 5 M
volume http 1 M
volume pop3 1 M
volume smtp 1 M
volume telnet 1 M


#
# user <protocol> <user>
#
# Specifies a condition that will trigger an alert if the connection is
# authenticated to the specified user. If you have specified an alias for the
# protocol, use the alias instead of the protocol name. If this option is
# specified, the "alerts" option must be also. This option may be specified
# more than once.
#
# Examples:
#
# user telnet joe
#   Report all telnet activity attributed to authenticated user joe.
#
# user smtp fred@domain.com
#   Report all emails sent from fred@domain.com.
#


#
# ratings
#
# If specified, connections that trigger WebNOT ratings settings will be
# reported in the alert section.
#
ratings


#
# word <word>
#
# Specifies a condition that will trigger an alert if the specified regular
# expression is matched to the search string. The content of the search string
# is determined by the setting of the "search_source", "search_destination",
# and "search_arg" options. If this option is specified, the "alerts" option
# must be also. This option may be specified more than once.
#
# Note: A large number of word alerts will significantly slow the reporting
# process.
#
word casino
word gamble
word playboy
word nude
word naked
word sex
word [^x]xxx[^x]


#
# search_source
#
# If specified, Reptor will include the name of the source host in the search
# for the indicated alert words.
#
#search_source


#
# search_destination
#
# If specified, Reptor will include the name of the destination host in the
# search for the indicated alert words.
#
search_destination


#
# search_arg
#
# If specified, Reptor will include the "arg" field in the search for the
# indicated alert words. This typically contains the full URL for the
# connection, and is usually where the search words will be found.
#
search_arg


#
# alert_summary <sort> [limit]
#
# If specified, Reptor will generate a summary of the hosts that have triggered
# alerts. The summary will be grouped by source host and sorted by the field
# indicated in <sort>. Valid values for <sort> are:
#
#   "host" to sort by the name or address of the source host
#   "alerts" to sort by the number of alerts generated
#
# The <sort> string may be preceded with "-" to indicate descending order.
#
# To indicate the maximum number of entries allowed in the summary, specify
# a value for [limit].
#
# If this option is specified, the "alerts" option must be also.
#
# Example:
#
# alert_summary -alerts 10
#   Generate a summary of the top ten hosts that generated alerts, sorted by
#   number of alerts descending.
#
alert_summary -alerts 5


#
# protocol_summary <sort> [limit]
#
# If specified, Reptor will generate a summary of traffic grouped by protocol
# and sorted by the field indicated in <sort>. Valid values for <sort> are:
# 
#   "protocol" to sort by the protocol
#   "hits" to sort by the number of logfile entries
#   "sent" to sort by the number of bytes sent
#   "received" to sort by the number of bytes received
#   "total" to sort by the total number of bytes transferred
#   "duration" to sort by the amount of time elapsed
#
# The <sort> string may be preceded with "-" to indicate descending order.
#
# To indicate the maximum number of entries allowed in the summary, specify
# a value for [limit].
#
# Example:
#
# protocol_summary -total
#   Generate a summary of all protocols, sorted by total traffic volume
#   descending.
#
protocol_summary -total


#
# protocol_user_detail <protocol> <sort> [limit]
#
# If specified, Reptor will generate a detailed report of traffic for the
# specified protocol, grouped by user and sorted by the field indicated in
# <sort>. Valid values for <sort> are:
#
#   "user" to sort by the user
#   "hits" to sort by the number of logfile entries
#   "sent" to sort by the number of bytes sent
#   "received" to sort by the number of bytes received
#   "total" to sort by the total number of bytes transferred
#   "duration" to sort by the amount of time elapsed
#
# The <sort> string may be preceded with "-" to indicate descending order.
#
# To indicate the maximum number of entries allowed in the report, specify a
# value for [limit].
#
# If you have specified an alias for the protocol desired, use the alias name.
# For example, if you have specified:
#
# alias 143/tcp imap
#
# then use imap here, and not 143/tcp.
#
# This option may be specified more than once. Specify one entry for each
# detail section desired.
#
# Example:
#
# protocol_user_detail ftp -total 10
# protocol_user_detail http -total 10
# protocol_user_detail imap -total 10
#   Generate a report of the top ten users using ftp, http, and imap.
#


#
# protocol_host_detail <protocol> <sort> [limit]
#
# If specified, Reptor will generate a detailed report of traffic for the
# specified protocol, grouped by host and sorted by the field indicated in
# <sort>. Valid values for <sort> are:
#
#   "host" to sort by the host
#   "hits" to sort by the number of logfile entries
#   "sent" to sort by the number of bytes sent
#   "received" to sort by the number of bytes received
#   "total" to sort by the total number of bytes transferred
#   "duration" to sort by the amount of time elapsed
#
# The <sort> string may be preceded with "-" to indicate descending order.
#
# To indicate the maximum number of entries allowed in the report, specify a
# value for [limit].
#
# If you have specified an alias for the protocol desired, use the alias name.
# For example, if you have specified:
#
# alias 143/tcp imap
#
# then use imap here, and not 143/tcp.
#
# This option may be specified more than once. Specify one entry for each
# detail section desired.
#
# Example:
#
# protocol_host_detail ftp -total 10
# protocol_host_detail http -total 10
# protocol_host_detail imap -total 10
#   Generate a report of the top ten hosts using ftp, http, and imap.
#
protocol_host_detail http -total 10
protocol_host_detail ftp -total 10


#
# interface_summary <sort> [limit]
#
# If specified, Reptor will generate a summary of traffic for each interface
# specified with the "interface" option, grouped by interface and sorted by the
# field indicated in <sort>. Valid values for <sort> are:
# 
#   "interface" to sort by the interface
#   "hits" to sort by the number of logfile entries
#   "sent" to sort by the number of bytes sent
#   "received" to sort by the number of bytes received
#   "total" to sort by the total number of bytes transferred
#   "duration" to sort by the amount of time elapsed
#
# The <sort> string may be preceded with "-" to indicate descending order.
#
# To indicate the maximum number of entries allowed in the summary, specify a
# value for [limit].
#
# Example:
#
# interface_summary -total
#   Generate a summary of all interfaces, sorted by total traffic volume
#   descending.
#
interface_summary -total


#
# host_summary <interface> <sort> [limit]
#
# If specified, Reptor will generate a summary of traffic for hosts on the
# specified interface, grouped by host and sorted by the field indicated in
# <sort>. If you have specified an alias for the interface, use the alias
# instead of the interface identifier. Valid values for <sort> are:
# 
#   "host" to sort by the name or address of the source host
#   "hits" to sort by the number of logfile entries
#   "sent" to sort by the number of bytes sent
#   "received" to sort by the number of bytes received
#   "total" to sort by the total number of bytes transferred
#   "duration" to sort by the amount of time elapsed
#
# The <sort> string may be preceded with "-" to indicate descending order.
#
# To indicate the maximum number of entries allowed in the summary, specify a
# value for [limit].
#
# One "host_summary" option may be specified for each interface.
#
# Example:
#
# host_summary Vpn1 -total 10
#   Generate a summary of the top ten hosts on interface Vpn1, sorted by total
#   traffic volume descending.
#
host_summary Inside -total 10
host_summary Outside -total 10


#
# host_user_detail <host> <sort> [limit]
#
# If specified, Reptor will generate a detailed report of traffic for the
# specified host machine, grouped by user and sorted by the field indicated in
# <sort>. Valid values for <sort> are:
#
#   "user" to sort by the user
#   "hits" to sort by the number of logfile entries
#   "sent" to sort by the number of bytes sent
#   "received" to sort by the number of bytes received
#   "total" to sort by the total number of bytes transferred
#   "duration" to sort by the amount of time elapsed
#
# The <sort> string may be preceded with "-" to indicate descending order.
#
# To indicate the maximum number of entries allowed in the report, specify
# a value for [limit].
#
# This option may be specified more than once. Specify one entry for each
# detail section desired.
#
# Example:
#
# host_user_detail 192.168.1.7 -total 10
#   Generate a report of the top ten users for 192.168.1.7.
#


#
# host_protocol_detail <host> <sort> [limit]
#
# If specified, Reptor will generate a detailed report of traffic for the
# specified host machine, grouped by protocol and sorted by the field indicated
# in <sort>. Valid values for <sort> are:
#
#   "protocol" to sort by the protocol
#   "hits" to sort by the number of logfile entries
#   "sent" to sort by the number of bytes sent
#   "received" to sort by the number of bytes received
#   "total" to sort by the total number of bytes transferred
#   "duration" to sort by the amount of time elapsed
#
# The <sort> string may be preceded with "-" to indicate descending order.
#
# To indicate the maximum number of entries allowed in the report, specify a
# value for [limit].
#
# This option may be specified more than once. Specify one entry for each
# detail section desired.
#
# Example:
#
# host_protocol_detail 192.168.1.7 -total 10
#   Generate a report of the top ten protocols for 192.168.1.7.
#


#
# user_summary <sort> [limit]
#
# If specified, Reptor will generate a summary of traffic grouped by user and
# sorted by the field indicated in <sort>. This option is only useful if users
# authenticate with the firewall. Valid values for <sort> are:
#
#   "user" to sort by the user
#   "hits" to sort by the number of logfile entries
#   "sent" to sort by the number of bytes sent
#   "received" to sort by the number of bytes received
#   "total" to sort by the total number of bytes transferred
#   "duration" to sort by the amount of time elapsed
#
# The <sort> string may be preceded with "-" to indicate descending order.
#
# To indicate the maximum number of entries allowed in the summary, specify a
# value for [limit].
#
# Example:
#
# user_summary -total 10
#   Generate a summary of the top ten users sorted by total volume descending.
#
user_summary -total 10


#
# user_www_summary <sort> [limit]
#
# If specified, Reptor will generate a report of per-user WWW traffic grouped
# by user and sorted by the field indicated in <sort>. For each user, the most
# popular web sites they have visited will be displayed. The site name will be
# displayed as the top-level domain only, not the entire URL. So, hits to
# different pages within the www.wankwood.com site will be summarized on one
# report line as "www.wankwood.com". This option is only useful if users
# authenticate with the firewall. Both the user list and the sites visited by
# that user will be sorted by the field indicated in <sort>. If "user" is
# specified for the sort value, the user list will be sorted by user and the
# per-user site lists will be sorted by domain name. Valid values for <sort>
# are:
# 
#   "user" to sort by the user
#   "hits" to sort by the number of logfile entries
#   "sent" to sort by the number of bytes sent
#   "received" to sort by the number of bytes received
#   "total" to sort by the total number of bytes transferred
#   "duration" to sort by the amount of time elapsed
#
# The <sort> string may be preceded with "-" to indicate descending order.
#
# To indicate the maximum number of entries allowed in the summary, specify a
# value for [limit]. If a limit is specified, it will limit both the number of
# users reported, and the number of sites reported for each user.
#
# Example:
#
# user_www_summary -hits 10
#   Generate a report listing the top ten users, and the top ten sites that
#   each of those users visited.
#
user_www_summary -hits 10


#
# user_protocol_detail <user> <sort> [limit]
#
# If specified, Reptor will generate a detailed report of traffic for the
# specified user, grouped by protocol and sorted by the field indicated in
# <sort>. Valid values for <sort> are:
#
#   "protocol" to sort by the protocol
#   "hits" to sort by the number of logfile entries
#   "sent" to sort by the number of bytes sent
#   "received" to sort by the number of bytes received
#   "total" to sort by the total number of bytes transferred
#   "duration" to sort by the amount of time elapsed
#
# The <sort> string may be preceded with "-" to indicate descending order.
#
# To indicate the maximum number of entries allowed in the report, specify a
# value for [limit].
#
# Note: User information is not available in the logfile unless you are
# performing authentication at the firewall.
#
# This option may be specified more than once. Specify one entry for each
# detail section desired.
#
# Example:
#
# user_protocol_detail fred -total 10
# user_protocol_detail stan -total 10
#   Generate a report of the top ten protocols for users fred and stan.
#


#
# user_host_detail <user> <sort> [limit]
#
# If specified, Reptor will generate a detailed report of traffic for the
# specified user, grouped by host and sorted by the field indicated in <sort>.
# Valid values for <sort> are:
#
#   "host" to sort by the host
#   "hits" to sort by the number of logfile entries
#   "sent" to sort by the number of bytes sent
#   "received" to sort by the number of bytes received
#   "total" to sort by the total number of bytes transferred
#   "duration" to sort by the amount of time elapsed
#
# The <sort> string may be preceded with "-" to indicate descending order.
#
# To indicate the maximum number of entries allowed in the report, specify a
# value for [limit].
#
# Note: User information is not available in the logfile unless you are
# performing authentication at the firewall.
#
# This option may be specified more than once. Specify one entry for each
# detail section desired.
#
# Example:
#
# user_host_detail fred -total 10
# user_host_detail stan -total 10
#   Generate a report of the top ten hosts hosts for users fred and stan.
#


# hour_summary <sort> [limit]
#
# If specified, Reptor will generate a summary of traffic grouped by time of
# day (in one hour periods) and sorted by the field indicated in <sort>. Valid
# values for <sort> are:
# 
#   "hour" to sort by time of day
#   "hits" to sort by the number of logfile entries
#   "sent" to sort by the number of bytes sent
#   "received" to sort by the number of bytes received
#   "total" to sort by the total number of bytes transferred
#   "duration" to sort by the amount of time elapsed
#
# The <sort> string may be preceded with "-" to indicate descending order.
#
# To indicate the maximum number of entries allowed in the summary, specify a
# value for [limit].
#
# Example:
#
# hour_summary hour 12
#   Generate a summary of the first twelve hours of the day.
#
hour_summary hour


#
# domain_summary <sort> [limit]
#
# If specified, Reptor will generate a summary of top-level domains. The
# summary will be grouped by domain and sorted by the field indicated in
# <sort>. Valid values for <sort> are:
#
#   "domain" to sort by the name of the top-level domain
#   "hits" to sort by the number of logfile entries
#   "sent" to sort by the number of bytes sent
#   "received" to sort by the number of bytes received
#   "total" to sort by the total number of bytes transferred
#
# The <sort> string may be preceded with "-" to indicate descending order.
#
# To indicate the maximum number of entries allowed in the summary, specify a
# value for [limit].
#
# Note: In order for this summary to be useful, either the "dns all" option
# must be specified, or DNS resolution at the firewall must be enabled. Also,
# the sum of all traffic reported by the this summary will probably not reach
# 100% because not all logfile entries can be resolved.
#
# Example:
#
# domain_summary -total 10
#   Generate a summary of the top ten domains, sorted by number of bytes
#   descending.
#
domain_summary -total 5


#
# mobile_summary <sort> [limit]
#
# If specified, Reptor will generate a summary of Raptor Mobile connections.
# The summary will be grouped by source host and sorted by the field indicated
# in <sort>. Valid values for <sort> are:
#
#   "host" to sort by the name or address of the source host
#   "hits" to sort by the number of connections made
#
# The <sort> string may be preceded with "-" to indicate descending order.
#
# To indicate the maximum number of entries allowed in the summary, specify a
# value for [limit].
#
# Example:
#
# mobile_summary -count 10
#   Generate a summary of the top ten hosts that connected via Raptor Mobile,
#   sorted by number of connections descending.
#
mobile_summary -count


#
# ooba_summary <sort> [limit]
#
# If specified, Reptor will generate a summary of OOBA activity. The summary
# will be sorted by the field indicated in <sort>. Valid values for <sort>
# are:
#
#   "time" to sort by the time of day
#   "user" to sort by the user
#   "host" to sort by the name or address of the source host
#
# The <sort> string may be preceded with "-" to indicate descending order.
#
# To indicate the maximum number of entries allowed in the summary, specify a
# value for [limit].
#
# Example:
#
# ooba_summary time
#   Generate a summary of OOBA activity, sorted by time ascending.
#


#


#
# message_summary <sort> [severity]
#
# If specified, Reptor will generate a summary of all logfile messages. The
# summary will be grouped by message type and sorted by the field indicated in
# <sort>. Valid values for <sort> are:
#
#  "hits" to sort by the number of messages
#  "message" to sort by the message number
#
# The <sort> string may be preceded with "-" to indicate descending order.
#
# To only show messages "more severe" than a certain value, specify a value for
# [severity]. The message severity values are as follows:
#
#   100-199 Information
#   200-299 Notice
#   300-399 Warning
#   400-499 Error
#   500-599 Alert
#   600-699 Critical
#   700-799 Emergency
#
# Example:
#
# message_summary message
#   Generate a summary of all messages, sorted by message.
#
# message_summary -hits 400
#   Generate a summary of messages that are severity "Error" and above, sorted
#   by the number of messages descending.
#
message_summary message


#
# history_summary <value> <limit>
#
# Reptor can accumulate a file that contains historical traffic summary
# statistics for each day that is processed. If this option is specified, this
# file will be used to generate a simple historical summary graph of recent
# traffic. In order to generate the history file, you must specify the
# history_file option. In order for the summary to show anything, you must also
# specify the graphs option. The value of <value> determines what the graph
# graphs. Valid values are:
#
#   "hits" to graph the total number of hits for each day
#   "total" to graph the total number of bytes for each day
#   "duration" to graph the total connection duration for each day
#
# The history summary (but not the history file) will be limited to <limit>
# days. This option may be specified more than once if you want to graph
# multiple values.
#
# Example:
#
# history_summary total 30
#   Graph the total number of bytes for each day over the past 30 days.
#
history_summary total 30
history_summary hits 30


#
# history_file <file>
#
# If specified, Reptor will accumulate a file that contains historical traffic
# summary statistics. The file will only be updated if the logfile being
# processed is yesterday's log. This is to prevent duplicate entries in the
# case of using the --date or --log command line options.
#
# Note: If you are running Reptor from within a shell script or batch file, you
# may not be changing to the Reptor directory before running it. If this is the
# case, you will have to specify a full path name here, so that Reptor can
# properly find the file.
#
# The history file contains four comma separated fields per line. The fields
# (from left to right) are:
#
# date (in YYYYMMDD format)
# total number of hits for that day
# total number of bytes transferred for that day
# total duration of connections for that day
#
# Examples:
#   history_file /usr/local/reptor/history
#   history_file c:\reptor\history
#
history_file history


#
# fetcher_message
#
# If specified, Reptor will generate a small table reporting the status of the
# WebNOT fetcher process.
#
#fetcher_message


#
# links
#
# If specified, Reptor will make hyperlinks in the output where appropriate. If
# the "alerts" and "show_arg" options are also specified, the report will
# include links that will allow you to click on and visit the exact offending
# URL. Of course, doing so will cause an alert in tomorrow's report...
#
links


#
# output <
#   stdout |
#   file [>]directory/[filename] |
#   ftp username,password,address,directory/[filename] |
#   mail user@domain[,user@domain[...]]
# >
#
# Specifies the desired destination for the output. If "stdout" is specified,
# the output will be sent to the screen if not otherwise piped or redirected.
# If "file" is specified, you must also specify the desired target directory,
# and optionally, the desired file name. If specified without a filename, the
# directory should include a trailing (back)slash. If the filename is omitted,
# Reptor will automatically generate it based on the date of the logfile
# processed. If the string begins with ">", the output will be appended to the
# file if it already exists. Otherwise, it will overwrite an existing file of
# the same name. If "ftp" is specified, Reptor will upload the output to an ftp
# server using the specified settings. If "mail" is specified, Reptor will
# email the output to the list of addresses specified.
#
# Examples:
#
# output file /reports/
#   Save the output to the file /reports/<date>.html.
#
# output file /reports/output.html
#   Save the output to the file /reports/output.html, overwriting it if it
#   already exists.
#
# output file >/reports/output.html
#   Save the output to the file /reports/output.html, appending to it if it
#   already exists.
#
# output ftp anonymous,reptor,ftpsrv,/pub/incoming/reptor.html
#   Upload the output to the ftp server named ftpsrv. Log in with the userid
#   anonymous and the password reptor. Upload the file to the directory
#   /pub/incoming and name it reptor.html.
#
# output ftp apache,george,websrv,/apache/htdocs/reptor/
#   Upload the output to the ftp server named websrv. Log in with the userid
#   apache and the password george. Upload the file to the directory
#   /apache/htdocs/reptor and name it <date>.html.
#
# output mail joe@domain1.com,fred@domain2.com
#   Email the output to joe@domain1.com and fred@domain2.com.
#
output file ./


#
# mail_server <address>
#
# If you have indicated email output, this option specifies an SMTP server to
# relay mail through. If not specified, it will default to the local host.
#
# Example:
#
# mail_server 1.2.3.4
#


#
# mail_from <address>
#
# Indicates what to use for a From address when sending email output. This is
# not always required, but you may discover that your mail server has an
# anti-spam feature that rejects Reptor's output because the message does not
# have a valid From address.
#
# Example:
#
# mail_from root@domain.com
#


#
# dns <all|print>
#
# If specified, Reptor will perform reverse DNS lookups on unresolved IP
# addresses. If the "all" option is specified, Reptor will lookup all
# unresolved IP addresses, whether or not the logfile entry is selected to
# print. If the "print" option is specified, Reptor will only lookup unresolved
# IP addresses that are selected to be printed. Choosing "all" will
# significantly increase the amount of time required to process a logfile.
# However, in order to utilize the word search feature on a hostname, sort a
# summary by hostname, or specify the domain_summary option, full DNS
# resolution at the firewall is required. If these features are important to
# you, consider instead using a specially modified version of jdresolve, a high
# speed asynchronous resolver, specifically tweaked to handle Raptor logfiles.
# It can be downloaded from http://www.wankwood.com/reptor/jdresolve.html.
#
dns print


#
# nice_format
#
# If specified, large byte values will be represented in Kb or Mb, as
# appropriate. In addition, other large values will be printed with commas.
#
nice_format


#
# title
#
# If specified, will be used as a report title. It may include simple HTML
# tags, but don't get silly with it.
#
title "Company<br>Firewall Activity"


#
# theme <theme>
#
# If specified, Reptor will utilize the named theme to generate the HTML
# output. The theme determines the fonts, colors, and formatting used. This
# allows for easy customization of the output. Theme names are case sensitive.
# Browse the themes directory for the names of the available themes.
#
# Example:
#
# theme Classic
#
theme Kuro5hin


#
# graphs <scale>
#
# If specified, Reptor will include graphs in summary tables. Reduce the scale
# to make the graphs narrower, increase the scale to make the graphs wider.
#
graphs 0.75


#
# smtp_bugfix
#
# If specified, Reptor will work around a Raptor bug that occasionally produces
# impossibly huge values for the number of bytes received in some logfile
# entries for the SMTP protocol.
#


# End
