<?xml version="1.0" encoding="ISO-8859-1"?>
<!DOCTYPE lire:global-filter-spec PUBLIC
  "-//LogReport.ORG//DTD Lire Report Specification Markup Language V1.0//EN"
  "http://www.logreport.org/LRSML/1.0/lrsml.dtd">
<lire:global-filter-spec xmlns:lire="http://www.logreport.org/LRSML/"
 superservice="firewall" id="select-action">

 <lire:title>Select Action Filter</lire:title>
 <lire:description>
  <para>This filter specification can be used to select only the
   firewall events that were permitted or denied.
  </para>
 </lire:description>

<lire:param-spec>
  <lire:param name="action_match" type="string" default="denied">
   <lire:description>
    <para>This parameter contains the action that should selected:
    <variablelist>
      <varlistentry>
       <term><constant>denied</constant></term>
       <listitem>
	<para>Select only denied events.</para>
       </listitem>
      </varlistentry>
      <varlistentry>
       <term><constant>permitted</constant></term>
       <listitem>
	<para>Select only permitted events.</para>
       </listitem>
      </varlistentry>
      <varlistentry>
      <term><constant>-</constant></term>
       <listitem>
	<para>This is also a possible action when we can't determine
	from the log information if this event was
	<constant>denied</constant> or <constant>permitted</constant>.
       </para>
       </listitem>
      </varlistentry>
     </variablelist>
    </para>
   </lire:description>
  </lire:param>
 </lire:param-spec>

 <lire:display-spec>
  <lire:title>$action_match events</lire:title>
 </lire:display-spec>

 <lire:filter-spec>
  <lire:eq arg1="$action" arg2="$action_match"/>
 </lire:filter-spec>

</lire:global-filter-spec>
