%%

log:
      fw
    | tcplog 
;
fw:
      syslogdate 'S' hostname 'S' process ':' fwdatas 
;
tcplog:
      syslogdate 'S' hostname 'S' tcplogid tcplogopen
    | syslogdate 'S' hostname 'S' tcplogid tcplogclose 
;
fwdatas:
      fwdata + 
;
fwdata:
      'S' 'KEYPAIR'
    | 'S' 'ALPHA'
    | 'S' 
;
tcplogid:
      'TCPLOG' 'OPENPAREN' 'HEXID8' 'CLOSEPAREN' ':' 'S' 
;
tcplogopen:
      'ALPHA' 'S' 'ALPHA' ',' 'S' ip ':' port 'S' '-' '>' 'S' ip ':' port 
;
tcplogclose:
      'ALPHA' 'S' 'ALPHA' ',' 'S' 'ALPHA' 'S' 'INT' ',' 'S' 'ALPHA' 'S' 'INT' 
;
syslogdate:
      year 'S' month 'S' day 'S' time 
;
year:
      'INT' 
;
month:
      'ALPHA' 
;
day:
      'INT' 
;
time:
      'INT' ':' 'INT' ':' 'INT' 
;
hostname:
      'ALPHA' '-' 'ALPHA' '-' 'INT' 
;
process:
      'ALPHA' 'S' 'ALPHA' 'S' 'ALPHA' 
;
port:
      'INT'  
;
ip:
      'INT' '.' 'INT' '.' 'INT' '.' 'INT' 
;

%%