<?xml version="1.0" encoding="ISO-8859-1"?>
<!DOCTYPE lire:report-spec PUBLIC
  "-//LogReport.ORG//DTD Lire Report Specification Markup Language V1.0//EN"
  "http://www.logreport.org/LRSML/1.0/lrsml.dtd">
<lire:report-spec xmlns:lire="http://www.logreport.org/LRSML/"
 superservice="firewall" id="vol-summary">

 <lire:title>Volume Summary Firewall Report</lire:title>
 <lire:description>
  <para>This report shows some general statistics about the size of the
   packets logged by your firewall.</para>
 </lire:description>

 <lire:display-spec>
  <lire:title>Traffic's Volume Summary</lire:title>
 </lire:display-spec>

 <lire:report-calc-spec>
  <lire:summary>

   <lire:sum name="vol_count" field="length"/>

   <lire:group name="volume_by_action">
    <lire:field name="action"/>
    <lire:sum name="action_vol_count" field="length"/>
   </lire:group>

   <lire:group name="volume_by_protocol">
    <lire:field name="protocol"/>
    <lire:sum name="protocol_vol" field="length"/>
   </lire:group>
   
   <lire:avg name="avg_volume_by_from_host"
    field="length" by-fields="from_ip"/>

   <lire:avg name="avg_volume_by_to_host"
    field="length" by-fields="to_ip"/>
  </lire:summary>
 </lire:report-calc-spec>

</lire:report-spec>

<!-- 
Keep this comment at the end of the file
Local variables:
mode: xml
-->
