default_connection {
  server_type = MYSQL; // server type may by FIREBIRD, MYSQL, ODBC

  firebird {
// for unix
//  client_library = libfbclient.so;
//  client_library = libfbembed.so;
// for windows
//  client_library = fbclient.dll;
//  client_library = fb/fbembed.dll;
    database = localhost:macroscope; // default FIREBIRD port 3050
    page_size = 16384; // default FIREBIRD database page size 1024
    user = sysdba;
    password = masterkey;
    role = ;
    set_properties = no;
    dialect = 3;
    reserve_space = yes;
    page_buffers = 4096;
    async_write = yes;
    sweep_interval = 20000;
    default_charset = UNICODE_FSS;
    messages_charset = WIN1251;
  }

  mysql {
// for unix
//  client_library = libmysqlclient_r.so;
// for windows
//  client_library = libmysql.dll;
    protocol = DEFAULT; // protocol may by DEFAULT, TCP, PIPE, MEMORY
    database = macroscope;
//    port = 3306; // default MYSQL port 3306
    user = macroscope;
    password = mkey;
//    connect_timeout = 0;
//    read_timeout = 0;
//    write_timeout = 0;
//    reconnect = no;
    compress = yes; // default no
  }

  odbc {
// for unix
//  client_library = libodbc.so;
// for windows
//  client_library = odbc32.dll;
// MySQL ODBC connection example
//    connection = "DRIVER={MySQL Connector/ODBC v5};SERVER=redstar;UID=macroscope;PWD=mkey;DATABASE=macroscope;";
    connection = "DRIVER={MySQL ODBC 3.51 Driver};SERVER=redstar;UID=macroscope;PWD=mkey;DATABASE=macroscope;";
//    connection = "DRIVER={Firebird/Interbase(r) driver};CHARSET=UNICODE_FSS;DIALECT=3;CLIENT=fbclient.dll;UID=sysdba;PWD=masterkey;DATABASE={redstar:macroscope};";
  }
}

macroscope {
//  connection = default_connection; // default is default_connection
  process_squid_log = no;
  process_sendmail_log = no;

  squid {
//    log_file_name = /usr/local/squid/logs/access.log;
    log_file_name = /mnt/.3/access.log;
//    reset_log_file_position = yes;
//    log_file_codepage = 0;
    skip_url = folium.local;
    top10_url = yes;
//    start_time = 01.01.2007;
//    identity_column = 7;
  }

  sendmail {
//    log_file_name = /var/log/maillog;
    log_file_name = D:/DB/maillog;
//    log_file_codepage = 0;
//    reset_log_file_position = yes;
    main_domain = tehnomir.lipetsk.ru;
//    calculate_interdomain_traffic = no;
    start_year = 2006;    
  }

  html_report {
    decoration {
      heads {
        smtp = "SMTP (KB)";
        www = "WWW (KB)";
        all = "All (KB)";
      }
      colors {
        table_head = #C0C0C0;
        detail_head = #3F8FD0;
        head {
	  user = #00A0FF;
          smtp = #9F9020;
          www = #1F9F90;
          all = #FFFF00;
        }
        body {
	  user = #00E0FF;
          smtp = #8F6020;
          www = #1FFF80;
          all = #DFDF00;
        }
        tail {
	  user = #00A0FF;
          smtp = #9F9020;
          www = #1F9F90;
          all = #FFFF00;
        }
        details {
          head {
            smtp = #FF80F0;
            www = #FF80F0;
            all = #FFFF00;
          }
          body {
            smtp = #1FF010;
            www = #1FF010;
            all = #DFDF00;
          }
          tail {
            smtp = #9F9020;
            www = #FF80F0;
            all = #FFFF00;
          }
        }
      }
    }
    enabled = no;
    directory = "html report";
//    directory_mode = 755;
//    directory_user = www;
//    directory_group = www;
//    file_mode = 644;
//    file_user = www;
//    file_group = www;
//    index_file_name = index.html;
    top10_url = yes;
    top10_min_significant_threshold = 8k;
    group_top10_url = no; // very slowly if yes, be careful
    refresh_only_current = yes;
//    traffic_cache_size = 262144; // default 0 no limit
    groups = no;
    groups_report_directories {
      bt = "html report/bt";
      zol = "html report/zol"; // if not set then report disabled
    }
  }

#charset 20866
  aliases {
    korvin = "Дукашвили Гурам Арсенович";
  }
#charset 0

  groups {
// groups names must not be mach with users names
    bt = korvin,phenix,sockor;
    zol = pasha,warlock;
  }

  bpft {
// lock memory pages in physical memory (only heap)
    mlock = yes; // default yes
// lock all memory pages in physical memory (may help sniffer stay from drop packets)
// bug in FreeBSD implementation dlopen crash with mlockall, do not use
    mlockall = no; // default no
    decoration {
      colors {
        table_head = #C0C0D0;
        detail_head = #3F8FC0;
        head {
          host = #A020C0;
          data = #1F9F90;
          dgram = #FFFF00;
        }
        body {
          host = #4FDF00;
          data = #1FFF80;
          dgram = #DFDF00;
        }
        tail {
          host = #A020C0;
          data = #1F9F90;
          dgram = #FFFF00;
        }
        details {
          body {
            data = #1FF010;
            dgram = #DFDF00;
          }
          tail {
            data = #FF80F0;
            dgram = #FFFF00;
          }
        }
      }
    }
//    dns_cache_size = 262144; // default 0 no limit
    sk0 { // section name must be in ascii charset and max 8 symbols because it used in sql index
      enabled = no;
      log_file_name = /mnt/.3/trafd.sk0;
//      reset_log_file_position = yes;
      log_32bit_os_compatible = yes;
      html_report {
        decoration {
          colors {
            table_head = #C0C0C0;
            detail_head = #3F8FD0;
	  }
	}
        enabled = no;
        directory = "html bpft report sk0";
//        directory_mode = 755;
//        directory_user = www;
//        directory_group = www;
//        file_mode = 644;
//        file_user = www;
//        file_group = www;
//        index_file_name = index.html;
        refresh_only_current = yes;
	min_significant_threshold = 16m;
        filter = "not (src 195.34.235.67/30 or dst 195.34.235.67/30)";
	show_filter = no; // default no
        bidirectional = no;
        protocols = no;
        ports = no;
        resolve_dns_names = yes;
//        gateway = tehnomir.lipetsk.ru; // deprecated
      }
    }
    sk1 {
      enabled = no;
      log_file_name = /mnt/.3/trafd.sk1;
//      reset_log_file_position = yes;
      log_32bit_os_compatible = yes;
      html_report {
        enabled = no;
        directory = "html bpft report sk1";
//        directory_mode = 755;
//        directory_user = www;
//        directory_group = www;
//        file_mode = 644;
//        file_user = www;
//        file_group = www;
//        index_file_name = index.html;
        filter = "src 192.168.0.0/16 and dst 192.168.0.0/16";
        bidirectional = yes;
        protocols = no;
        ports = no;
        refresh_only_current = yes;
	min_significant_threshold = 16m;
        resolve_dns_names = yes;
      }
    }
    win_test {
      enabled = no;
      sniffer {
//      connection = default_connection; // default is macroscope.connection value
// you may union traffic from devices in one with setup this parameter
//      join = sk1,sk2; // default '' no join
        enabled = no;
// you can get interfaces list via --iflist command line option
	interface = "\\Device\\NPF_{41B4AD5D-9D6A-49FD-8847-AE8A798F6E03}";
//	pcap_read_timeout = 100; // default 100 miliseconds
//        temp_file = ;
        pregrouping_buffer_size = 1k; // default 64k
        pregrouping_window_size = 0; // default 5 packets
        swap_threshold = 64k;
//        swap_low_watermark = 50;
        swap_high_watermark = 90;
//        swap_watch_time = 5; // default 5 seconds
        ports = yes; // default yes
        protocols = yes; // default yes
	promiscuous = no; // default no
        greenwich_mean_time_in_log = no;
//	packets_in_transaction = 100; // default 0 - no limit
	filter = "not (ether broadcast or arp)";
// grouping period must be one of following values
// None, Sec, Min, Hour, Day, Mon, Year
	grouping_period = Sec;
//	totals_period = Day; // default Day
//      maintenance = 86400;
//      maintenance_threshold = 0.1;
//      storage_period_of_statistics = 0;
      }
    }
    bsd_test {
      enabled = no;
      sniffer {
//      connection = default_connection; // default is macroscope.connection value
        enabled = yes;
	interface = em0;
//	pcap_read_timeout = 100; // default 100 miliseconds
//        temp_file = ;
        pregrouping_buffer_size = 8k; // default 64k
        pregrouping_window_size = 10; // default 5 packets
        swap_threshold = 1m;
        swap_low_watermark = 50;
        swap_high_watermark = 90;
        ports = yes; // default yes
        protocols = yes; // default yes
	promiscuous = no; // default no
        greenwich_mean_time_in_log = no;
//	packets_in_transaction = 100; // default 0 - no limit
	filter =
	  "not ("
	  "  ether broadcast or arp or"
          "  (src net 192.168.220.0 mask 255.255.255.0 and dst net 192.168.201.0 mask 255.255.255.0) or"
          "  (src net 192.168.201.0 mask 255.255.255.0 and dst net 192.168.220.0 mask 255.255.255.0)"
          ")"
	;
// grouping period must be one of following values
// None, Sec, Min, Hour, Day, Mon, Year
	grouping_period = Sec;
//	totals_period = Day; // default Day
//      maintenance = 86400;
//      maintenance_threshold = 0.1;
//      storage_period_of_statistics = 0;
      }
    }
    lin_test {
      enabled = no;
      sniffer {
//      connection = default_connection; // default is macroscope.connection value
        enabled = no;
	interface = eth0;
//	pcap_read_timeout = 100; // default 100 miliseconds
//        temp_file = ;
        pregrouping_buffer_size = 8k; // default 64k
        pregrouping_window_size = 10; // default 5 packets
        swap_threshold = 1m;
        swap_low_watermark = 50;
        swap_high_watermark = 90;
        ports = yes; // default yes
        protocols = yes; // default yes
	promiscuous = no; // default no
        greenwich_mean_time_in_log = no;
//	packets_in_transaction = 100; // default 0 - no limit
	filter =
	  "not ("
	  "  ether broadcast or arp"
          ")"
	;
// grouping period must be one of following values
// None, Sec, Min, Hour, Day, Mon, Year
	grouping_period = Sec;
//	totals_period = Day; // default Day
//      maintenance = 86400;
//      maintenance_threshold = 0.1;
//      storage_period_of_statistics = 0;
      }
    }
  }

//  service_name = macroscope;
//  service_display_name = "Macroscope Packet Collection Service";
//  service_start_type = auto;
// You can install macroscope sniffer as windows service
// macroscope.exe --install --service --sniffer -c macroscope.conf --log macroscope.log
// or run from command line without --install and --service options
// be carefuly, windows set services current directory to %SystemRoot%\System32 and
// for this reason you must set --chdir option or specify full path name in -c and --log options.
// Under Unix os'es you must use --daemon option if you want daemonize macroscope

// may be FILL, REPORT or BOTH
// FILL mode use threads only for parsing log files and filling database
// REPORT mode use threads only for generating reports
// BOTH mode use threads for all
  multithreaded_mode = FILL;

  reactivate_indices = no;
  set_indices_statistics = no;
  drop_database = no;
  mysql_table_type = innodb;
  mysql_table_partitions = 8;
  create_database_structure = no;
  verbose = yes;
// IDLE_PRIORITY_CLASS
// BELOW_NORMAL_PRIORITY_CLASS
// NORMAL_PRIORITY_CLASS
// ABOVE_NORMAL_PRIORITY_CLASS
// HIGH_PRIORITY_CLASS
// REALTIME_PRIORITY_CLASS
  process_priority = HIGH_PRIORITY_CLASS; // default priority unchanged
//  cgi_process_priority = IDLE_PRIORITY_CLASS; // default priority IDLE_PRIORITY_CLASS
}

debug_levels = +0,+1,+2,+3,+5,+6,+7,+8,+9,+80,-128;
//debug_file_rotate_threshold = 1g;
//debug_file_rotate_count = 0;
debug_file_max_collection_time = 0; // default 60 seconds
//log_file = ; // path name of log file if no redirection or stdout or stderr
