Current File : //backups/router/usr/local/share/syslog-ng/xsd/patterndb-2.xsd
<?xml version="1.0" encoding="UTF-8"?>
<xs:schema xmlns:xs="http://www.w3.org/2001/XMLSchema">
<xs:element name="patterndb">
<xs:complexType>
<xs:sequence>
<xs:element name="ruleset" type="rulesetType" minOccurs="0" maxOccurs="unbounded">
<xs:annotation>
<xs:documentation>
A container to group log patterns for an application/program.
</xs:documentation>
</xs:annotation>
</xs:element>
</xs:sequence>
<xs:attribute name="version" type="xs:NMTOKEN" use="required" fixed="2">
<xs:annotation>
<xs:documentation>
The schema version of the pattern database.
The current version is '2'.
</xs:documentation>
</xs:annotation>
</xs:attribute>
<xs:attribute name="pub_date" type="xs:date" use="required">
<xs:annotation>
<xs:documentation>
The publication date of the XML file.
</xs:documentation>
</xs:annotation>
</xs:attribute>
</xs:complexType>
<xs:unique name="ruleset_name">
<xs:selector xpath="ruleset"/>
<xs:field xpath="@name"/>
</xs:unique>
<xs:unique name="ids">
<xs:selector xpath=".//*"/>
<xs:field xpath="@id"/>
</xs:unique>
</xs:element>
<xs:complexType name="rulesetType">
<xs:all>
<xs:element name="description" type="xs:string" minOccurs="0">
<xs:annotation>
<xs:documentation>
An optional element to attach description to a ruleset.
</xs:documentation>
</xs:annotation>
</xs:element>
<xs:element name="url" type="xs:anyURI" minOccurs="0">
<xs:annotation>
<xs:documentation>
An optional element to point to a URL related to the ruleset.
</xs:documentation>
</xs:annotation>
</xs:element>
<xs:element name="pattern" type="patternType" minOccurs="0">
<xs:annotation>
<xs:documentation>
An optional element with a pattern representing the name of the application related
to the ruleset in the syslog program field.
</xs:documentation>
</xs:annotation>
</xs:element>
<xs:element name="rules">
<xs:annotation>
<xs:documentation>
The rules in the ruleset.
</xs:documentation>
</xs:annotation>
<xs:complexType>
<xs:sequence>
<xs:element name="rule" type="ruleType" minOccurs="0" maxOccurs="unbounded">
<xs:annotation>
<xs:documentation>
A rule describes one log event with classifications and details.
</xs:documentation>
</xs:annotation>
</xs:element>
</xs:sequence>
</xs:complexType>
<xs:unique name="patterns">
<xs:selector xpath="rule/patterns/pattern"/>
<xs:field xpath="."/>
</xs:unique>
</xs:element>
</xs:all>
<xs:attribute name="name" type="xs:string" use="required">
<xs:annotation>
<xs:documentation>
The name of the application.
</xs:documentation>
</xs:annotation>
</xs:attribute>
<xs:attribute name="id" type="uuidType" use="required"/>
</xs:complexType>
<xs:complexType name="ruleType">
<xs:all>
<xs:element name="description" type="xs:string" minOccurs="0">
<xs:annotation>
<xs:documentation>
An optional element to describe the log disposition.
</xs:documentation>
</xs:annotation>
</xs:element>
<xs:element name="urls" minOccurs="0">
<xs:annotation>
<xs:documentation>
Optional elements to point to some external resource for disposition.
</xs:documentation>
</xs:annotation>
<xs:complexType>
<xs:sequence>
<xs:element name="url" type="xs:anyURI" minOccurs="0" maxOccurs="unbounded"/>
</xs:sequence>
</xs:complexType>
<xs:unique name="urls">
<xs:selector xpath="url"/>
<xs:field xpath="."/>
</xs:unique>
</xs:element>
<xs:element name="tags" minOccurs="0">
<xs:annotation>
<xs:documentation>
Optional keywords that can be used for a freeform grouping of the rules.
</xs:documentation>
</xs:annotation>
<xs:complexType>
<xs:sequence>
<xs:element name="tag" type="xs:token" minOccurs="0" maxOccurs="unbounded"/>
</xs:sequence>
</xs:complexType>
<xs:unique name="tags">
<xs:selector xpath="tag"/>
<xs:field xpath="."/>
</xs:unique>
</xs:element>
<xs:element name="patterns">
<xs:annotation>
<xs:documentation>
Patterns representing the rule. Log messages matching any one of the patterns
are classified to this rule.
</xs:documentation>
</xs:annotation>
<xs:complexType>
<xs:sequence>
<xs:element name="pattern" type="patternType" minOccurs="0" maxOccurs="unbounded">
<xs:annotation>
<xs:documentation>
A pattern representing the log message.
</xs:documentation>
</xs:annotation>
</xs:element>
</xs:sequence>
</xs:complexType>
</xs:element>
</xs:all>
<xs:attribute name="provider" type="xs:string" use="required">
<xs:annotation>
<xs:documentation>
The provider of the rule. To distinguish between who supplied the rule,
or if it has been added to the xml by a local user.
</xs:documentation>
</xs:annotation>
</xs:attribute>
<xs:attribute name="id" type="uuidType" use="required"/>
<xs:attribute name="class" type="classType" use="required">
<xs:annotation>
<xs:documentation>
The class of the rule.
</xs:documentation>
</xs:annotation>
</xs:attribute>
</xs:complexType>
<xs:simpleType name="uuidType">
<xs:annotation>
<xs:documentation>
The globaly unique ID of the rule.
</xs:documentation>
</xs:annotation>
<xs:restriction base="xs:string">
<xs:pattern value="[a-zA-Z0-9]{8}-([a-zA-Z0-9]{4}-){3}[a-zA-Z0-9]{12}"/>
</xs:restriction>
</xs:simpleType>
<xs:simpleType name="patternType">
<xs:annotation>
<xs:documentation>
This type describes a radix/parser pattern which is used to match
a program name or a whole log message.
</xs:documentation>
</xs:annotation>
<xs:restriction base="xs:string"/>
</xs:simpleType>
<xs:simpleType name="classType">
<xs:annotation>
<xs:documentation>
The classification class for a single rule.
</xs:documentation>
</xs:annotation>
<xs:restriction base="xs:string">
<xs:enumeration value="violation">
<xs:annotation>
<xs:documentation>
The log message is a VIOLATION where immediate action must be taken.
</xs:documentation>
</xs:annotation>
</xs:enumeration>
<xs:enumeration value="security">
<xs:annotation>
<xs:documentation>
The log message is related to a SECURITY event.
</xs:documentation>
</xs:annotation>
</xs:enumeration>
<xs:enumeration value="system">
<xs:annotation>
<xs:documentation>
The log message is related to a normal SYSTEM event.
</xs:documentation>
</xs:annotation>
</xs:enumeration>
<xs:enumeration value="unknown">
<xs:annotation>
<xs:documentation>
The log message is UNKNOWN and as is an anomaly.
</xs:documentation>
</xs:annotation>
</xs:enumeration>
</xs:restriction>
</xs:simpleType>
</xs:schema>
Mini Shell