<LOG>
	<Product ID="15" Name="XFW">
		<Table ID="1" Name="RFW_BrowsingAuditLog" Bestow="0">
			<Fields>
				<Field ID="1"  Name="Time" Type="datetime"/>
				<Field ID="2"  Name="EventType" Type="int"/>
				<Field ID="3"  Name="EventLevel" Type="int"/>
				<Field ID="4"  Name="EventSource" Type="string" Size="50"/>
				<Field ID="5"  Name="Category" Type="int"/>
				<Field ID="6"  Name="UserName" Type="string" Size="64"/>
				<Field ID="9"  Name="Description" Type="string"/>

				<Field ID="10" Name="Website" Type="string" Size="512"/>
				<Field ID="11" Name="URL" Type="string" Size="2048"/>
				<Field ID="12" Name="Result" Type="int"/>
				<Field ID="13" Name="BrowserName" Type="string" Size="256"/>
				<Field ID="14" Name="SoftID" Type="int"/>
				<Field ID="15" Name="Title" Type="string" Size="256"/>
			</Fields>
		</Table>

		<Table ID="2" Name="RFW_NetProcAuditLog" Bestrow="0">
			<Fields>
				<Field ID="1" Name="Time" Type="datetime"/>
				<Field ID="2" Name="EventType" Type="int"/>
				<Field ID="3" Name="EventLevel" Type="int"/>
				<Field ID="4" Name="EventSource" Type="string" Size="50"/>
				<Field ID="5" Name="Category" Type="int"/>
				<Field ID="6" Name="UserName" Type="string" Size="64"/>
				<Field ID="9" Name="Description" Type="string"/>

				<Field ID="10" Name="SoftName" Type="string" Size="256"/>
				<Field ID="11" Name="SoftId" Type="int"/>
				<Field ID="12" Name="ProcPath" Type="string" Size="512"/>
				<Field ID="13" Name="CommandLine" Type="string" Size="512"/>        
				<Field ID="14" Name="IsSysProc" Type="int"/>
				<Field ID="15" Name="SrcAddr" Type="string" Size="128"/>
				<Field ID="16" Name="SrcPort" Type="int"/>
				<Field ID="17" Name="DstAddr" Type="string" Size="128"/>
				<Field ID="18" Name="DstPort" Type="int"/>  
				<Field ID="19" Name="Action" Type="int"/>
				<Field ID="20" Name="Result" Type="int"/>
				<Field ID="21" Name="IsOffLine" Type="int"/>
				<Field ID="22" Name="MachType" Type="int"/>     
				<Field ID="23" Name="Counts" Type="int"/>
				<Field ID="24" Name="ProcName" Type="string" Size="256"/>
			</Fields>
		</Table>

		<Table ID="3" Name="RFW_TerminalFlowAuditLog" Bestrow="0">
			<Fields>
				<Field ID="1" Name="Time" Type="datetime"/>
				<Field ID="2" Name="EventType" Type="int"/>
				<Field ID="3" Name="EventLevel" Type="int"/>
				<Field ID="4" Name="EventSource" Type="string" Size="50"/>
				<Field ID="5" Name="Category" Type="int"/>
				<Field ID="6" Name="UserName" Type="string" Size="64"/>
				<Field ID="9" Name="Description" Type="string"/>

				<Field ID="10" Name="StartTime" Type="datetime"/>
				<Field ID="11" Name="EndTime" Type="datetime"/>
				<Field ID="12" Name="UpdateFlow" Type="bigint"/>
				<Field ID="13" Name="DownloadFlow" Type="bigint"/>
				<Field ID="14" Name="CurUpdateSpeed" Type="int"/>
				<Field ID="15" Name="CurDownloadSpeed" Type="int"/>
			</Fields>
		</Table>
 
		<Table ID="4" Name="RFW_SharedResListLog" Bestrow="1" Identifier="13">
			<Fields>
				<Field ID="1" Name="Time" Type="datetime"/>
				<Field ID="2" Name="EventType" Type="int"/>
				<Field ID="3" Name="EventLevel" Type="int"/>
				<Field ID="4" Name="EventSource" Type="string" Size="50"/>
				<Field ID="5" Name="Category" Type="int"/>
				<Field ID="6" Name="UserName" Type="string" Size="64"/>
				<Field ID="9" Name="Description" Type="string"/>

				<Field ID="10" Name="Name" Type="string" Size="256"/>
				<Field ID="11" Name="Path" Type="string" Size="512"/>
				<Field ID="12" Name="ShareType" Type="int"/>            
				<Field ID="13" Name="ShareMode" Type="int"/>
				<Field ID="14" Name="UniqueValue" Type="bigint"/>
			</Fields>
		</Table>

		<Table ID="5" Name="RFW_SharedResAccessAuditLog" Bestrow="0">
			<Fields>
				<Field ID="1" Name="Time" Type="datetime"/>
				<Field ID="2" Name="EventType" Type="int"/>
				<Field ID="3" Name="EventLevel" Type="int"/>
				<Field ID="4" Name="EventSource" Type="string" Size="50"/>
				<Field ID="5" Name="Category" Type="int"/>
				<Field ID="6" Name="UserName" Type="string" Size="64"/>
				<Field ID="9" Name="Description" Type="string"/>

				<Field ID="10" Name="Name" Type="string" Size="256"/>
				<Field ID="11" Name="Path" Type="string" Size="512"/>
				<Field ID="12" Name="ShareMode" Type="int"/>   
				<Field ID="13" Name="RemoteIP" Type="string" Size="128"/>  
				<Field ID="14" Name="Action" Type="int"/>
				<Field ID="15" Name="PathEx" Type="string" Size="512"/>
			</Fields>
		</Table>

		<Table ID="6" Name="RFW_IPAccessAuditLog" Bestrow="0">
			<Fields>
				<Field ID="1" Name="Time" Type="datetime"/>
				<Field ID="2" Name="EventType" Type="int"/>
				<Field ID="3" Name="EventLevel" Type="int"/>
				<Field ID="4" Name="EventSource" Type="string" Size="50"/>
				<Field ID="5" Name="Category" Type="int"/>
				<Field ID="6" Name="UserName" Type="string" Size="64"/>
				<Field ID="9" Name="Description" Type="string"/>

				<Field ID="10" Name="SrcAddr" Type="string" Size="128"/>
				<Field ID="11" Name="SrcPort" Type="int"/>
				<Field ID="12" Name="DstAddr" Type="string" Size="128"/>
				<Field ID="13" Name="DstPort" Type="int"/>
				<Field ID="14" Name="Result" Type="int"/>
				<Field ID="15" Name="Reason" Type="int"/>
				<Field ID="16" Name="IsOffLine" Type="int"/>
				<Field ID="17" Name="Counts" Type="int"/>
				<Field ID="18" Name="RuleName" Type="string" Size="128"/>
			</Fields>
		</Table>

		<Table ID="7" Name="RFW_UrlInterceptLog" Bestrow="0">
			<Fields>
				<Field ID="1" Name="Time" Type="datetime"/>
				<Field ID="2" Name="EventType" Type="int"/>
				<Field ID="3" Name="EventLevel" Type="int"/>
				<Field ID="4" Name="EventSource" Type="string" Size="50"/>
				<Field ID="5" Name="Category" Type="int"/>
				<Field ID="6" Name="UserName" Type="string" Size="64"/>
				<Field ID="9" Name="Description" Type="string"/>

				<Field ID="10" Name="WebSite" Type="string" Size="512"/>
				<Field ID="11" Name="URL" Type="string" Size="2048"/>
				<Field ID="12" Name="Result" Type="int"/>
				<Field ID="13" Name="BrowserName" Type="string" Size="256"/>
				<Field ID="14" Name="SoftID" Type="int"/>
			</Fields>
		</Table>

		<!-- - - - -esm\rba (8, 18)- - - - -->
		<Table ID="8" Name="RFW_MailAuditLog" Bestrow="0">
			<Fields>
				<Field ID="1" Name="Time" Type="datetime"/>
				<Field ID="2" Name="EventType" Type="int"/>
				<Field ID="3" Name="EventLevel" Type="int"/>
				<Field ID="4" Name="EventSource" Type="string" Size="50"/>
				<Field ID="5" Name="Category" Type="int"/>
				<Field ID="6" Name="UserName" Type="string" Size="64"/>
				<Field ID="9" Name="Description" Type="string"/>
				<Field ID="10" Name="[From]" Type="string" Size="128"/>
				<Field ID="11" Name="[To]" Type="string" Size="128"/>
				<Field ID="12" Name="Title" Type="string" Size="512"/>
				<Field ID="13" Name="Content" Type="string"/>
				<Field ID="14" Name="AttachmentInfo" Type="string" Size="512"/>
				<Field ID="15" Name="Result" Type="int"/>
				<Field ID="16" Name="Proto"  Type="int"/>
				<Field ID="17" Name="ProtoPort" Type="int"/>
				<Field ID="18" Name="LocalIp"  Type="string" Size="128"/>
				<Field ID="19" Name="RemoteIp" Type="string" Size="128"/>
				<Field ID="20" Name="SessionId" Type="int"/>
				<Field ID="21" Name="ProcessId" Type="int"/>
				<Field ID="22" Name="ProcessName" Type="string" Size="260"/>
			</Fields>
		</Table>

		<Table ID="9" Name="RFW_NetProcSnapshotLog" Bestrow="1" Identifier="18">
			<Fields>
				<Field ID="1" Name="Time" Type="datetime"/>
				<Field ID="2" Name="EventType" Type="int"/>
				<Field ID="3" Name="EventLevel" Type="int"/>
				<Field ID="4" Name="EventSource" Type="string" Size="50"/>
				<Field ID="5" Name="Category" Type="int"/>
				<Field ID="6" Name="UserName" Type="string" Size="64"/>
				<Field ID="9" Name="Description" Type="string"/>
				<Field ID="10" Name="ProcName" Type="string" Size="256"/>
				<Field ID="11" Name="ProcPath" Type="string" Size="512"/>
				<Field ID="12" Name="CommandLine" Type="string" Size="512"/>
				<Field ID="13" Name="IsSysProc" Type="int"/>
				<Field ID="14" Name="SrcAddr" Type="string" Size="128"/>
				<Field ID="15" Name="SrcPort" Type="int"/>
				<Field ID="16" Name="DstAddr" Type="string" Size="128"/>
				<Field ID="17" Name="DstPort" Type="int"/>
				<Field ID="18" Name="UniqueValue" Type="bigint"/>
			</Fields>
		</Table>

		<Table ID="10" Name="RFW_SoftwareFlowAuditLog" Bestrow="0">
			<Fields>
				<Field ID="1" Name="Time" Type="datetime"/>
				<Field ID="2" Name="EventType" Type="int"/>
				<Field ID="3" Name="EventLevel" Type="int"/>
				<Field ID="4" Name="EventSource" Type="string" Size="50"/>
				<Field ID="5" Name="Category" Type="int"/>
				<Field ID="6" Name="UserName" Type="string" Size="64"/>
				<Field ID="9" Name="Description" Type="string"/>
				<Field ID="10" Name="SoftPath" Type="string" Size="256"/>
				<Field ID="11" Name="SoftID" Type="int"/>
				<Field ID="12" Name="StartTime" Type="datetime"/>
				<Field ID="13" Name="EndTime" Type="datetime"/>
				<Field ID="14" Name="UpdateFlow" Type="bigint"/>
				<Field ID="15" Name="DownloadFlow" Type="bigint"/>
				<Field ID="16" Name="CurUpdateSpeed" Type="int"/>
				<Field ID="17" Name="CurDownloadSpeed" Type="int"/>
			</Fields>
		</Table>

		<Table ID="11" Name="RFW_ConnectOutsideOutLawLog" Bestrow="0">
			<Fields>
				<Field ID="1" Name="Time" Type="datetime"/>
				<Field ID="2" Name="EventType" Type="int"/>
				<Field ID="3" Name="EventLevel" Type="int"/>
				<Field ID="4" Name="EventSource" Type="string" Size="50"/>
				<Field ID="5" Name="Category" Type="int"/>
				<Field ID="6" Name="UserName" Type="string" Size="64"/>
				<Field ID="9" Name="Description" Type="string"/>
				<Field ID="10" Name="Result" Type="int"/>
				<Field ID="11" Name="IsOffLine" Type="int"/>
				<Field ID="12" Name="LocalIp" Type="string"/>
				<Field ID="13" Name="OutsideIp" Type="string"/>
				<Field ID="14" Name="ConnType" Type="string"/>
				<Field ID="15" Name="Mac" Type="string"/>
				<Field ID="16" Name="AdapterName" Type="string"/>
				<Field ID="17" Name="AdapterDesc" Type="string"/>
			</Fields>
		</Table>

		<Table ID="12" Name="RFW_OutFloodLog" Bestrow="0">
			<Fields>
				<Field ID="1" Name="Time" Type="datetime"/>
				<Field ID="2" Name="EventType" Type="int"/>
				<Field ID="3" Name="EventLevel" Type="int"/>
				<Field ID="4" Name="EventSource" Type="string" Size="50"/>
				<Field ID="5" Name="Category" Type="int"/>
				<Field ID="6" Name="UserName" Type="string" Size="64"/>
				<Field ID="9" Name="Description" Type="string"/>

				<Field ID="10" Name="LocalAddr" Type="string" Size="128"/>
				<Field ID="11" Name="Pathname" Type="string" Size="260"/>
				<Field ID="12" Name="SoftID" Type="int" />
				<Field ID="13" Name="RemoteAddr" Type="string" Size="128" />
				<Field ID="14" Name="Protocol" Type="int" />
				<Field ID="15" Name="Type" Type="int"/>
				<Field ID="16" Name="Counts" Type="int"/>
			</Fields>
		</Table>

		<!-- - - - -esm\rsm (13, 17)- - - - -->
		<Table ID="13" Name="RFW_ArpEventLog" Bestrow="0">
			<Fields>
				<Field ID="1" Name="Time" Type="datetime"/>
				<Field ID="2" Name="EventType" Type="int"/>
 				<Field ID="3" Name="EventLevel" Type="int"/>
				<Field ID="4" Name="EventSource" Type="string" Size="50"/>
				<Field ID="5" Name="Category" Type="int"/>
				<Field ID="6" Name="UserName" Type="string" Size="64"/>
				<Field ID="9" Name="Description" Type="string"/>

				<Field ID="10" Name="Result" Type="int"/>
				<Field ID="11" Name="IP" Type="string" Size="128" />
				<Field ID="12" Name="ConflictMAC" Type="string" Size="128" />
				<Field ID="13" Name="RuleName" Type="string" Size="256" />
				<Field ID="14" Name="Type" Type="int"/>    
				<Field ID="15" Name="OriginalMAC" Type="string" Size="128" />
				<Field ID="16" Name="Counts" Type="int"/>    
			</Fields>
		</Table>

		<Table ID="14" Name="RFW_ArpCheatEventLog" Bestrow="0">
			<Fields>
				<Field ID="1" Name="Time" Type="datetime"/>
				<Field ID="2" Name="EventType" Type="int"/>
				<Field ID="3" Name="EventLevel" Type="int"/>
				<Field ID="4" Name="EventSource" Type="string" Size="50"/>
				<Field ID="5" Name="Category" Type="int"/>
				<Field ID="6" Name="UserName" Type="string" Size="64"/>
				<Field ID="9" Name="Description" Type="string"/>
				<Field ID="10" Name="SrcIp"  Type="string" Size="32"/>
				<Field ID="11" Name="SrcMac" Type="string" Size="32"/>
				<Field ID="12" Name="DstIp"  Type="string" Size="32"/>
				<Field ID="13" Name="DstMac" Type="string" Size="32"/>
				<Field ID="14" Name="Option" Type="int"/>
				<Field ID="15" Name="Mode"   Type="int"/>
				<Field ID="16" Name="Counts" Type="int"/>
			</Fields>
		</Table>

		<Table ID="15" Name="RFW_IPProtectEventLog" Bestrow="0">
			<Fields>
				<Field ID="1" Name="Time" Type="datetime"/>
				<Field ID="2" Name="EventType" Type="int"/>
				<Field ID="3" Name="EventLevel" Type="int"/>
				<Field ID="4" Name="EventSource" Type="string" Size="50"/>
				<Field ID="5" Name="Category" Type="int"/>
				<Field ID="6" Name="UserName" Type="string" Size="64"/>
				<Field ID="9" Name="Description" Type="string"/>

				<Field ID="10" Name="Result"   Type="int"/>
				<Field ID="11" Name="OrigIP"   Type="string" Size="128" />
				<Field ID="12" Name="NewIP"    Type="string" Size="128" />
				<Field ID="13" Name="MAC"      Type="string" Size="128" />
				<Field ID="14" Name="OldMasks" Type="string" Size="128" />
				<Field ID="15" Name="NewMasks" Type="string" Size="128" />
				<Field ID="16" Name="OldGates" Type="string" Size="128" />
				<Field ID="17" Name="NewGates" Type="string" Size="128" />
				<Field ID="18" Name="OldMac"   Type="string" Size="128" />
				<Field ID="19" Name="NewMac"   Type="string" Size="128" />
				<Field ID="20" Name="OldDhcp"  Type="int"/>
				<Field ID="21" Name="NewDhcp"  Type="int"/>
			</Fields>
		</Table>

		<Table ID="16" Name="RFW_NetSeparateRecordLog" Bestrow="0">
			<Fields>
				<Field ID="1" Name="Time" Type="datetime"/>
				<Field ID="2" Name="EventType" Type="int"/>
				<Field ID="3" Name="EventLevel" Type="int"/>
				<Field ID="4" Name="EventSource" Type="string" Size="50"/>
				<Field ID="5" Name="Category" Type="int"/>
				<Field ID="6" Name="UserName" Type="string" Size="64"/>
				<Field ID="9" Name="Description" Type="string"/>

				<Field ID="10" Name="OriginStatus" Type="int"/>
				<Field ID="11" Name="NewStaus" Type="int"/>
				<Field ID="12" Name="ReasonType" Type="int"/>
				<Field ID="13" Name="ReasonDesc" Type="string" Size="256" />
			</Fields>
		</Table>

		<Table ID="17" Name="RFW_RiskAuditStatusLog" Bestrow="1" Identifier="17">
			<Fields>
				<Field ID="1" Name="Time" Type="datetime"/>
				<Field ID="2" Name="EventType" Type="int"/>
				<Field ID="3" Name="EventLevel" Type="int"/>
				<Field ID="4" Name="EventSource" Type="string" Size="50"/>
				<Field ID="5" Name="Category" Type="int"/>
				<Field ID="6" Name="UserName" Type="string" Size="64"/>
				<Field ID="9" Name="Description" Type="string"/>
				<Field ID="10" Name="ChkProjName" Type="string" Size="128" />
				<Field ID="11" Name="TableName" Type="string" Size="128" />
				<Field ID="12" Name="FieldName" Type="string" Size="128" />
				<Field ID="13" Name="Value" Type="string" Size="128" />
				<Field ID="14" Name="Upline" Type="int" />
				<Field ID="15" Name="RiskDesc" Type="string" Size="128" />
				<Field ID="16" Name="ChkResult" Type="int" />
				<Field ID="17" Name="UniqueValue" Type="bigint"/>
			</Fields>
		</Table>

		<Table ID="18" Name="RFW_AsyncIpBlackLog" Bestrow="0">
			<Fields>
				<Field ID="1" Name="Time" Type="datetime"/>
				<Field ID="2" Name="EventType" Type="int"/>
				<Field ID="3" Name="EventLevel" Type="int"/>
				<Field ID="4" Name="EventSource" Type="string" Size="50"/>
				<Field ID="5" Name="Category" Type="int"/>
				<Field ID="6" Name="UserName" Type="string" Size="64"/>
				<Field ID="9" Name="Description" Type="string"/>

				<Field ID="10" Name="SrcAddr"  Type="string" Size="40"/>
				<Field ID="11" Name="DstAddr"  Type="string" Size="40"/>
				<Field ID="12" Name="SrcPort"  Type="int"/>
				<Field ID="13" Name="DstPort"  Type="int"/>
				<Field ID="14" Name="ProcId"   Type="int"/>
				<Field ID="15" Name="ProcPath" Type="string" Size="260"/>
				<Field ID="16" Name="Protocol" Type="string" Size="8"/>
				<Field ID="17" Name="CountryCode" Type="string" Size="8"/>
				<Field ID="18" Name="ThreatName"  Type="string" Size="260"/>
				<Field ID="19" Name="ThreatType"  Type="string" Size="260"/>
			</Fields>
		</Table>
		<Table ID="19" Name="RFW_AsyncDomainBlackLog" Bestrow="0">
			<Fields>
				<Field ID="1" Name="Time" Type="datetime"/>
				<Field ID="2" Name="EventType" Type="int"/>
				<Field ID="3" Name="EventLevel" Type="int"/>
				<Field ID="4" Name="EventSource" Type="string" Size="50"/>
				<Field ID="5" Name="Category" Type="int"/>
				<Field ID="6" Name="UserName" Type="string" Size="64"/>
				<Field ID="9" Name="Description" Type="string"/>

				<Field ID="10" Name="SrcAddr"  Type="string" Size="40"/>
				<Field ID="11" Name="DstAddr"  Type="string" Size="40"/>
				<Field ID="12" Name="SrcPort"  Type="int"/>
				<Field ID="13" Name="DstPort"  Type="int"/>
				<Field ID="14" Name="ProcId"   Type="int"/>
				<Field ID="15" Name="ProcPath" Type="string" Size="260"/>
				<Field ID="16" Name="Domain"   Type="string" Size="260"/>
				<Field ID="17" Name="CountryCode" Type="string" Size="8"/>
				<Field ID="18" Name="ThreatName"  Type="string" Size="260"/>
				<Field ID="19" Name="ThreatType"  Type="string" Size="260"/>
			</Fields>
		</Table>
		<Table ID="20" Name="RFW_AsyncIpAccessLog" Bestrow="0">
			<Fields>
				<Field ID="1" Name="Time" Type="datetime"/>
				<Field ID="2" Name="EventType" Type="int"/>
				<Field ID="3" Name="EventLevel" Type="int"/>
				<Field ID="4" Name="EventSource" Type="string" Size="50"/>
				<Field ID="5" Name="Category" Type="int"/>
				<Field ID="6" Name="UserName" Type="string" Size="64"/>
				<Field ID="9" Name="Description" Type="string"/>

				<Field ID="10" Name="SrcAddr"  Type="string" Size="40"/>
				<Field ID="11" Name="DstAddr"  Type="string" Size="40"/>
				<Field ID="12" Name="SrcPort"  Type="int"/>
				<Field ID="13" Name="DstPort"  Type="int"/>
				<Field ID="14" Name="ProcId"   Type="int"/>
				<Field ID="15" Name="ProcPath" Type="string" Size="260"/>
				<Field ID="16" Name="Protocol" Type="string" Size="8"/>
			</Fields>
		</Table>
		<Table ID="21" Name="RFW_AsyncDomainAccessLog" Bestrow="0">
			<Fields>
				<Field ID="1" Name="Time" Type="datetime"/>
				<Field ID="2" Name="EventType" Type="int"/>
				<Field ID="3" Name="EventLevel" Type="int"/>
				<Field ID="4" Name="EventSource" Type="string" Size="50"/>
				<Field ID="5" Name="Category" Type="int"/>
				<Field ID="6" Name="UserName" Type="string" Size="64"/>
				<Field ID="9" Name="Description" Type="string"/>

				<Field ID="10" Name="ProcId"   Type="int"/>
				<Field ID="11" Name="ProcPath" Type="string" Size="260"/>
				<Field ID="12" Name="Domain"   Type="string" Size="260"/>
				<Field ID="13" Name="Ip"       Type="string" Size="260"/>
				<Field ID="14" Name="DomainType" Type="int"/>
			</Fields>
		</Table>
	</Product>
</LOG>