--- gl_tail-0.05.rb	2007-10-11 11:18:49.000000000 -0400
+++ gl_tail-0.05-prox1.rb.dist	2007-10-12 10:52:09.000000000 -0400
@@ -40,6 +40,7 @@
 #   ./gl_tail.rb
 #
 # Changelog:
+#   12 Oct 2007 - v0.05 - Crappy patch for NetScreen traffic logs (Mark Kamichoff <prox@prolixium.com>)
 #   10 Oct 2007 - v0.05 - Basic instructions on missing gems
 #                       - Fallback to BitmapCharacterX on RangeError
 #                       - Attempt to fix text color on non Linux platforms
@@ -87,22 +88,27 @@
 
 $SERVERS = [
             # List of machines to log in to via SSH, and which files to tail for traffic data.
-            {:name => 'server1', :host => 'server1.example.com', :user => 'joeuser', :password => 'secret', :command => 'tail -f', :files => ['/var/log/apache/access_log'], :color => [0.2, 1.0, 0.2, 1.0], :parser => :apache },
-            {:name => 'server2', :host => 'login.mycoolsite.com', :user => 'otheruser', :password => 'othersecret', :port => 22222, :command => 'xtail', :files => ['/usr/local/www/apps/myapp/current/log/production.log'], :color => [0.2, 0.2, 1.0, 1.0], :parser => :rails },
-            {:name => 'mail', :host => 'mail.spamme.com', :user => 'otheruser', :password => 'othersecret', :command => 'tail -f', :files => ['/var/log/maillog'], :color => [0.8, 1.0, 0.0, 1.0], :parser => :postfix },
-            {:name => 'database', :host => 'db.example.com', :user => 'db', :password => 'othersecret', :command => 'tail -f', :files => ['/var/log/pgsql.log'], :color => [0.6, 0.6, 1.0, 1.0], :parser => :postgresql },
+            # Uncomment some of the following, and edit.
+#            {:name => 'localhost', :host => 'localhost', :user => 'user', :password => 'stuff', :command => 'tail -Fs0', :files => ['/var/log/netscreen.log'], :color => [0.0, 0.5, 1.0, 1.0], :parser => :netscreen },
+#            {:name => 'server1', :host => 'server1.example.com', :user => 'joeuser', :password => 'secret', :command => 'tail -f', :files => ['/var/log/apache/access_log'], :color => [0.2, 1.0, 0.2, 1.0], :parser => :apache },
+#            {:name => 'server2', :host => 'login.mycoolsite.com', :user => 'otheruser', :password => 'othersecret', :port => 22222, :command => 'xtail', :files => ['/usr/local/www/apps/myapp/current/log/production.log'], :color => [0.2, 0.2, 1.0, 1.0], :parser => :rails },
+#            {:name => 'mail', :host => 'mail.spamme.com', :user => 'otheruser', :password => 'othersecret', :command => 'tail -f', :files => ['/var/log/maillog'], :color => [0.8, 1.0, 0.0, 1.0], :parser => :postfix },
+#            {:name => 'database', :host => 'db.example.com', :user => 'db', :password => 'othersecret', :command => 'tail -f', :files => ['/var/log/pgsql.log'], :color => [0.6, 0.6, 1.0, 1.0], :parser => :postgresql },
            ]
 
 $BLOCKS = [
            # Sections with different information to display on the screen
-           { :name => 'info',          :position => :left,  :order => 0, :size => 10, :auto_clean => false, :show => :total },
-           { :name => 'sites',         :position => :left,  :order => 1, :size => 10 },
-           { :name => 'content',       :position => :left,  :order => 2, :size => 5,  :show => :total, :color => [1.0, 0.8, 0.4, 1.0] },
-           { :name => 'status',        :position => :left,  :order => 3, :size => 10, :color => [1.0, 0.8, 0.4, 1.0] },
-           { :name => 'users',         :position => :left,  :order => 4, :size => 10 },
-           { :name => 'smtp',          :position => :left,  :order => 5, :size => 5  },
-           { :name => 'sasl users',    :position => :left,  :order => 6, :size => 5  },
-           { :name => 'database',      :position => :left,  :order => 7, :size => 10 },
+           { :name => 'info',                   :position => :left,  :order => 0,  :size => 10, :auto_clean => false, :show => :total },
+           { :name => 'sites',                  :position => :left,  :order => 1,  :size => 10 },
+           { :name => 'content',                :position => :left,  :order => 2,  :size => 5,  :show => :total, :color => [1.0, 0.8, 0.4, 1.0] },
+           { :name => 'status',                 :position => :left,  :order => 3,  :size => 10, :color => [1.0, 0.8, 0.4, 1.0] },
+           { :name => 'users',                  :position => :left,  :order => 4,  :size => 10 },
+           { :name => 'smtp',                   :position => :left,  :order => 5,  :size => 5  },
+           { :name => 'sasl users',             :position => :left,  :order => 6,  :size => 5  },
+           { :name => 'database',               :position => :left,  :order => 7,  :size => 10 },
+           # netscreen
+           { :name => 'source addresses',       :position => :left,  :order => 9,  :size => 8, :color => [0.25, 1.0, 0.25, 1.0] },
+           { :name => 'destination addresses',  :position => :left,  :order => 10, :size => 8, :color => [1.0, 1.0, 0.0, 1.0] },
 
            { :name => 'urls',          :position => :right, :order => 0, :size => 15 },
            { :name => 'slow requests', :position => :right, :order => 1, :size => 5, :show => :average },
@@ -112,6 +118,10 @@
            { :name => 'viruses',       :position => :right, :order => 5, :size => 5  },
            { :name => 'rejections',    :position => :right, :order => 6, :size => 5  },
            { :name => 'warnings',      :position => :right, :order => 7, :size => 5  },
+           # netscreen
+           { :name => 'ports',         :position => :right, :order => 8, :size => 8, :color => [1.0, 1.0, 1.0, 1.0] },
+           { :name => 'protocols',     :position => :right, :order => 9, :size => 3, :color => [1.0, 0.5, 0.0, 1.0]  },
+           { :name => 'firewalls',     :position => :right, :order => 10, :size => 4, :color => [1.5, 1.0, 1.0, 1.0] }
           ]
 
 $PARSERS = {
@@ -159,11 +169,35 @@
     end
   },
 
+  :netscreen => Proc.new { |server,line|
+    #Oct 10 09:10:41 perimiter.something.com perimiter: NetScreen device_id=perimiter  [Root]system-notification-00257(traffic): start_time="2007-10-10 13:10:28" duration=12 policy_id=300 service=http proto=6 src zone=in dst zone=out action=Permit sent=540 rcvd=9091 src=10.1.1.1 dst=1.5.6.2 src_port=2070 dst_port=80 src-xlated ip=192.168.55.3 port=10255 dst-xlated ip=1.5.6.2 port=80 session_id=10328
+    _, device, protocol, action, sent, rcvd, src, dst, port = /NetScreen.device_id=([^\s]+).+system-notification-00257.+\sproto=([^\s]+).+action=(Permit|Deny)\s+sent=(\d+)\s+rcvd=(\d+)\s+src=(\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})\sdst=(\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})\s.+\sdst_port=(\d+)\s/.match(line).to_a
+
+    if not src =~ /10.157.208/
+      if src && sent && rcvd && port
+
+        # debug
+#       puts src + " -> " + dst + ":" + port
+#       totalbytes = sent.to_i + rcvd.to_i
+
+        # src
+        server.add_activity(:block => 'source addresses', :name => src, :size => sent.to_i/1000000.0)
+        # dst
+        server.add_activity(:block => 'destination addresses', :name => dst, :size => rcvd.to_i/1000000.0)
+        # ports
+        server.add_activity(:block => 'ports', :name => port)
+        # proto
+        server.add_activity(:block => 'protocols', :name => protocol)
+
+        # (might get noisy)
+        server.add_event(:block => 'info', :name => "dropped", :message => "Connection denied!", :update_stats => true, :color => [1.0, 0.0, 0.0, 1.0]) if action == "Deny"
+      end
+    end
+  },
   :rails => Proc.new { |server,line|
     #Completed in 0.02100 (47 reqs/sec) | Rendering: 0.01374 (65%) | DB: 0.00570 (27%) | 200 OK [http://example.com/whatever/whatever]
     _, ms, url = /^Completed in ([\d.]+) .* \[([^\]]+)\]/.match(line).to_a
 
-
     if url
       _, host, url = /^http[s]?:\/\/([^\/]+)(.*)/.match(url).to_a
 
