home *** CD-ROM | disk | FTP | other *** search
/ PC World 2005 December / PCWorld_2005-12_cd.bin / software / temacd / tiny / tpf-6[1].5.126.exe / Tiny Firewall 2005.msi / webui.dll / REPORTS / LOG.XSL < prev    next >
Encoding:
Extensible Markup Language  |  2005-08-17  |  36.7 KB  |  462 lines
  1.  ■<?xml version='1.0' ?>
  3. <!--
  4. /*//////////////////////////////////////////////////////////////////////
  5. Filename:          log.xsl
  6. Company Name:      Computer Associates International, Inc.
  7. Legal Copyright: Copyright (c) Computer Associates International, Inc.
  8. Author:          Jozef Palocko
  9. Product:          Tiny Firewall
  10. Description:      Log analyzer stylesheet
  11. Changelog:    
  12.     18.8.2003 - added displaying date in local time zone
  13. ///////////////////////////////////////////////////////////////////////*/
  14.  -->
  16. <xsl:stylesheet version="1.0" 
  17.     xmlns:xsl="http://www.w3.org/1999/XSL/Transform"
  18.     xmlns:msxsl="urn:schemas-microsoft-com:xslt"
  19.     xmlns:time="http://mycompany.com/mynamespace">
  21. <msxsl:script language="JScript" implements-prefix="time">
  22.   <![CDATA[
  23.      function LocalTime(node)
  24.    {
  25.        nd = node.nextNode();
  26.         t = new Date(Date.parse(nd.getAttribute("dateTimeLast")));
  27.        return t.toLocaleString( );
  28.    }
  29.    ]]>
  30. </msxsl:script>
  32. <xsl:variable name="Filter" select="//Root/Params/Filter"/>
  33. <xsl:variable name="Def" select="document($Filter//fncidsfile)"/>
  35.  <!--
  36.  //////////////////////////////////////
  37.  ///////// Named filter templates
  38.  -->
  40.     <!-- ///////// tplModule //////////// -->
  41.     <xsl:template name="tplModule" >
  42.         <xsl:param name="Events"/>
  43.         <xsl:choose>
  44.             <xsl:when test='$Filter//module="1"'>
  45.                 <xsl:call-template name="tplObject">
  46.                     <xsl:with-param name="Events" select='$Events[@module = "Windows Security" ]'/>
  47.                 </xsl:call-template>
  48.             </xsl:when>
  49.             <xsl:when test='$Filter//module="2"'>
  50.                 <xsl:call-template name="tplDirection">
  51.                     <xsl:with-param name="Events" select='$Events[@module = "Firewall" ]'/>
  52.                 </xsl:call-template>
  53.             </xsl:when>
  54.             <xsl:when test='$Filter//module="16"'>
  55.                 <xsl:call-template name="tplMessage">
  56.                     <xsl:with-param name="Events" select='$Events[@module = "IDS" ]'/>
  57.                 </xsl:call-template>
  58.             </xsl:when>
  59.             <xsl:otherwise>
  60.                 <xsl:call-template name="tplAr">
  61.                     <xsl:with-param name="Events"  select="$Events"/>
  62.                 </xsl:call-template>
  63.             </xsl:otherwise>
  64.         </xsl:choose>
  65.     </xsl:template>
  67.     <!-- ///////// tplObject //////////// -->
  68.     <xsl:template name="tplObject" >
  69.         <xsl:param name="Events"/>
  70.         <xsl:choose>
  71.             <xsl:when test="$Filter//string=''">
  72.                 <xsl:call-template name="tplAr">
  73.                     <xsl:with-param name="Events" select="$Events"/>
  74.                 </xsl:call-template>
  75.             </xsl:when>
  76.             <xsl:otherwise>
  77.                 <xsl:call-template name="tplAr">
  78.                     <xsl:with-param name="Events" select="$Events[contains(
  79.                             translate( Object, '_-\/.:;,ABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789' , '_-\/.:;,abcdefghijklmnopqrstuvwxyz0123456789'),
  80.                             translate($Filter//string,'_-\/.:;,ABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789','_-\/.:;,abcdefghijklmnopqrstuvwxyz0123456789'))]"/>
  82.                 </xsl:call-template>
  83.             </xsl:otherwise>
  84.         </xsl:choose>
  85.     </xsl:template>
  87.     <!-- ///////// tplMessage //////////// -->
  88.     <xsl:template name="tplMessage" >
  89.         <xsl:param name="Events"/>
  90.         <xsl:choose>
  91.             <xsl:when test="$Filter//string=''">
  92.                 <xsl:call-template name="tplAr">
  93.                     <xsl:with-param name="Events" select="$Events"/>
  94.                 </xsl:call-template>
  95.             </xsl:when>
  96.             <xsl:otherwise>
  97.                 <xsl:call-template name="tplAr">
  98.                     <xsl:with-param name="Events" select="$Events[contains(
  99.                             translate( Msg, '_-\/.:;,ABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789' , '_-\/.:;,abcdefghijklmnopqrstuvwxyz0123456789'),
  100.                             translate($Filter//string,'_-\/.:;,ABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789','_-\/.:;,abcdefghijklmnopqrstuvwxyz0123456789'))]"/>
  102.                 </xsl:call-template>
  103.             </xsl:otherwise>
  104.         </xsl:choose>
  105.     </xsl:template>
  107.     <!-- ///////// tplDirection //////////// -->
  108.     <xsl:template name="tplDirection" >
  109.         <xsl:param name="Events"/>
  110.         <xsl:choose>
  111.             <xsl:when test="$Filter//direction=''">
  112.                 <xsl:call-template name="tplProtocol">
  113.                     <xsl:with-param name="Events" select="$Events"/>
  114.                 </xsl:call-template>
  115.             </xsl:when>
  116.             <xsl:otherwise>
  117.                 <xsl:call-template name="tplProtocol">
  118.                     <xsl:with-param name="Events" select="$Events[InetDef/@dir = $Filter//direction]"/>
  119.                 </xsl:call-template>
  120.             </xsl:otherwise>
  121.         </xsl:choose>
  122.     </xsl:template>
  124.     <!-- ///////// tplProtocol //////////// -->
  125.     <xsl:template name="tplProtocol" >
  126.         <xsl:param name="Events"/>
  127.         <xsl:choose>
  128.             <xsl:when test="$Filter//protocol=''">
  129.                 <xsl:call-template name="tplIPAddress">
  130.                     <xsl:with-param name="Events" select="$Events"/>
  131.                 </xsl:call-template>
  132.             </xsl:when>
  133.             <xsl:otherwise>
  134.                 <xsl:call-template name="tplIPAddress">
  135.                     <xsl:with-param name="Events" select="$Events[contains(InetDef/@prot , $Filter//protocol)]"/>
  136.                 </xsl:call-template>
  137.             </xsl:otherwise>
  138.         </xsl:choose>
  139.     </xsl:template>
  141.     <!-- ///////// tplIPAddress //////////// -->
  142.     <xsl:template name="tplIPAddress" >
  143.         <xsl:param name="Events"/>
  144.         <xsl:choose>
  145.             <xsl:when test="$Filter//ip=''">
  146.                 <xsl:call-template name="tplRemPort">
  147.                     <xsl:with-param name="Events" select="$Events"/>
  148.                 </xsl:call-template>
  149.             </xsl:when>
  150.             <xsl:otherwise>
  151.                 <xsl:call-template name="tplRemPort">
  152.                     <xsl:with-param name="Events" select="$Events[contains(
  153.                             translate( InetDef/@remIp, '_-\/.:;,ABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789' , '_-\/.:;,abcdefghijklmnopqrstuvwxyz0123456789'),
  154.                             translate($Filter//ip,'_-\/.:;,ABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789','_-\/.:;,abcdefghijklmnopqrstuvwxyz0123456789'))]"/>
  155.                 </xsl:call-template>
  156.             </xsl:otherwise>
  157.         </xsl:choose>
  158.     </xsl:template>
  160.     <!-- ///////// tplRemPort //////////// -->
  161.     <xsl:template name="tplRemPort" >
  162.         <xsl:param name="Events"/>
  163.         <xsl:choose>
  164.             <xsl:when test="$Filter//remport=''">
  165.                 <xsl:call-template name="tplLocPort">
  166.                     <xsl:with-param name="Events" select="$Events"/>
  167.                 </xsl:call-template>
  168.             </xsl:when>
  169.             <xsl:otherwise>
  170.                 <xsl:call-template name="tplLocPort">
  171.                     <xsl:with-param name="Events" select="$Events[InetDef/@remPort = $Filter//remport]"/>
  172.                 </xsl:call-template>
  173.             </xsl:otherwise>
  174.         </xsl:choose>
  175.     </xsl:template>
  177.     <!-- ///////// tplLocPort //////////// -->
  178.     <xsl:template name="tplLocPort" >
  179.         <xsl:param name="Events"/>
  180.         <xsl:choose>
  181.             <xsl:when test="$Filter//locport=''">
  182.                 <xsl:call-template name="tplAr">
  183.                     <xsl:with-param name="Events"  select="$Events"/>
  184.                 </xsl:call-template>
  185.             </xsl:when>
  186.             <xsl:otherwise>
  187.                 <xsl:call-template name="tplAr">
  188.                     <xsl:with-param name="Events" select="$Events[InetDef/@locPort = $Filter//locport]"/>
  189.                 </xsl:call-template>
  190.             </xsl:otherwise>
  191.         </xsl:choose>
  192.     </xsl:template>
  194.     <!-- ///////// tpl access result //////////// -->
  195.     <xsl:template name="tplAr" >
  196.         <xsl:param name="Events"/>
  197.         <xsl:choose>
  198.             <xsl:when test="$Filter//ar=''">
  199.                 <xsl:call-template name="tplApplication">
  200.                     <xsl:with-param name="Events" select="$Events"/>
  201.                 </xsl:call-template>
  202.             </xsl:when>
  203.             <xsl:otherwise>
  204.                 <xsl:call-template name="tplApplication">
  205.                     <xsl:with-param name="Events"  select="$Events[Action = $Filter//ar]"/>
  206.                 </xsl:call-template>
  207.             </xsl:otherwise>
  208.         </xsl:choose>
  209.     </xsl:template>
  211.     <!-- ///////// tplApplication result //////////// -->
  212.     <xsl:template name="tplApplication" >
  213.         <xsl:param name="Events"/>
  214.         <xsl:choose>
  215.             <xsl:when test="$Filter//app=''">
  216.                 <xsl:call-template name="tplUser">
  217.                     <xsl:with-param name="Events" select="$Events"/>
  218.                 </xsl:call-template>
  219.             </xsl:when>
  220.             <xsl:otherwise>
  221.                 <xsl:call-template name="tplUser">
  222.                     <xsl:with-param name="Events" select="$Events[contains(
  223.                             translate( App, '_-\/.:;,ABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789' , '_-\/.:;,abcdefghijklmnopqrstuvwxyz0123456789'),
  224.                             translate($Filter//app, '_-\/.:;,ABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789' , '_-\/.:;,abcdefghijklmnopqrstuvwxyz0123456789'))]"/>
  225.                 </xsl:call-template>
  226.             </xsl:otherwise>
  227.         </xsl:choose>
  228.     </xsl:template>
  230.     <!-- ///////// tplUser result //////////// -->
  231.     <xsl:template name="tplUser" >
  232.         <xsl:param name="Events"/>
  233.         <xsl:choose>
  234.             <xsl:when test="$Filter//user=''">
  235.                 <!-- should never occur -->
  236.                 <xsl:call-template name="tplDomain">
  237.                     <xsl:with-param name="Events" select="$Events"/>
  238.                 </xsl:call-template>
  239.             </xsl:when>
  240.             
  241.             <xsl:when test="$Filter//user='All Users (*)'">
  242.                 <xsl:choose>
  243.                 <xsl:when test="$Filter//sort='App'">
  244.                 
  245.                     <xsl:variable name="EventsSortedByApp" select="$Events[     not(@module='IDS') and not(App=preceding-sibling::Event/App) or
  246.                                                             not(@module=preceding-sibling::Event/@module) or
  247.                                                             not(count(@domain)=0) and not(@domain=preceding-sibling::Event/@domain) or
  248.                                                             @module='IDS' and not(Msg=preceding-sibling::Event/Msg) or
  249.                                                             not(Action/@ar=preceding-sibling::Event/Action/@ar) or
  250.                                                             @module='Firewall' and not (
  251.                                                                         InetDef/@prot=preceding-sibling::Event/InetDef/@prot and
  252.                                                                         (count(InetDef/@dir)=0 or InetDef/@dir=preceding-sibling::Event/InetDef/@dir) and
  253.                                                                         (count(InetDef/@remPort)=0 or InetDef/@remPort=preceding-sibling::Event/InetDef/@remPort) and
  254.                                                                         (count(InetDef/@remIp)=0 or InetDef/@remIp=preceding-sibling::Event/InetDef/@remIp)
  255.                                                                            )
  256.                                                         ]"/>
  257.                                                         
  258.                     <xsl:call-template name="sortEvents">
  259.                         <xsl:with-param name="Events" select="$EventsSortedByApp"/>
  260.                         <xsl:with-param name="OrigEvents" select="$Events"/>
  261.                     </xsl:call-template>
  262.                     
  263. <!--                    <xsl:apply-templates select='$Events[     not(@module="IDS") and not(App=preceding-sibling::Event/App) or
  264.                                                             not(@module=preceding-sibling::Event/@module) or
  265.                                                             not(count(@user)=0) and not(@user=preceding-sibling::Event/@user) or
  266.                                                             not(count(@domain)=0) and not(@domain=preceding-sibling::Event/@domain) or
  267.                                                             @module="IDS" and not(Msg=preceding-sibling::Event/Msg) or
  268.                                                             not(Action=preceding-sibling::Event/Action) or
  269.                                                             @module="Firewall" and not (
  270.                                                                         InetDef/@prot=preceding-sibling::Event/InetDef/@prot and
  271.                                                                         (count(InetDef/@dir)=0 or InetDef/@dir=preceding-sibling::Event/InetDef/@dir) and
  272.                                                                         (count(InetDef/@remPort)=0 or InetDef/@remPort=preceding-sibling::Event/InetDef/@remPort) and
  273.                                                                         (count(InetDef/@remIp)=0 or InetDef/@remIp=preceding-sibling::Event/InetDef/@remIp)
  274.                                                                            )
  275.                                                         ]'>
  276.                         <xsl:with-param name="Total" select="count($Events)"/>
  277.                         <xsl:with-param name="Events" select="$Events"/>
  279.                         <xsl:sort select="App" order="ascending"/>
  280.                         <xsl:sort select="@module" order="ascending"/>
  281.                         <xsl:sort select="@user" order="ascending"/>
  282.                         <xsl:sort select="@domain" order="ascending"/>
  283.                         <xsl:sort select="Object" order="ascending"/>
  284.                         <xsl:sort select="Msg" order="ascending"/>
  285.                         <xsl:sort select="Action" order="ascending"/>
  286.                         <xsl:sort select="InetDef/@dir" order="ascending"/>
  287.                         <xsl:sort select="InetDef/@remIp" order="ascending"/>
  288.                         <xsl:sort select="InetDef/@LocIp" order="ascending"/>
  290.                     </xsl:apply-templates>-->
  291.                 </xsl:when>
  292.                 <xsl:otherwise>
  293.                     <xsl:call-template name="sortEvents">
  294.                         <xsl:with-param name="Total" select="count($Events)"/>
  295.                         <xsl:with-param name="Events" select="$Events"/>
  296.                     </xsl:call-template>
  297.                     
  298.                 </xsl:otherwise>
  299.                 </xsl:choose>
  300.             </xsl:when>
  301.             <xsl:otherwise>
  302.                 <xsl:call-template name="tplDomain">
  303.                     <xsl:with-param name="Events" select="$Events[@module='IDS' or contains(
  304.                         translate( @user, '_-\/.:;,ABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789' , '_-\/.:;,abcdefghijklmnopqrstuvwxyz0123456789'),
  305.                         translate($Filter//user,'_-\/.:;,ABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789','_-\/.:;,abcdefghijklmnopqrstuvwxyz0123456789'))]"/>
  306.                 </xsl:call-template>
  307.             </xsl:otherwise>
  308.         </xsl:choose>
  309.     </xsl:template>
  311.     <!-- ///////// tplDomain result //////////// -->
  313.     <xsl:template name="tplDomain" >
  314.         <xsl:param name="Events"/>
  315.         <xsl:variable name="EventsSortedByApp" select="$Events[     not(@module='IDS') and not(App=preceding-sibling::Event/App) or
  316.                                                             not(@module=preceding-sibling::Event/@module) or
  317.                                                             not(count(@domain)=0) and not(@domain=preceding-sibling::Event/@domain) or
  318.                                                             @module='IDS' and not(Msg=preceding-sibling::Event/Msg) or
  319.                                                             not(Action/@ar=preceding-sibling::Event/Action/@ar) or
  320.                                                             @module='Firewall' and not (
  321.                                                                         InetDef/@prot=preceding-sibling::Event/InetDef/@prot and
  322.                                                                         (count(InetDef/@dir)=0 or InetDef/@dir=preceding-sibling::Event/InetDef/@dir) and
  323.                                                                         (count(InetDef/@remPort)=0 or InetDef/@remPort=preceding-sibling::Event/InetDef/@remPort) and
  324.                                                                         (count(InetDef/@remIp)=0 or InetDef/@remIp=preceding-sibling::Event/InetDef/@remIp)
  325.                                                                            )
  326.                                                         ]"/>
  327.         <xsl:choose>
  328.             <xsl:when test="$Filter//domain=''">
  329.                 <!-- domain filter is empty -->
  330.                 <xsl:choose>
  331.                 <xsl:when test="$Filter//sort='App'">
  332.                     <!-- xx -->
  333.                     <xsl:call-template name="sortEvents">
  334.                         <xsl:with-param name="Events" select="$EventsSortedByApp"/>
  335.                         <xsl:with-param name="OrigEvents" select="$Events"/>
  336.                     </xsl:call-template>
  337.                     
  338. <!--                    <xsl:apply-templates select="$EventsSortedByApp">
  339.                         <xsl:with-param name="Total" select="count($Events)"/>
  340.                         <xsl:with-param name="Events" select="$Events"/>
  342.                         <xsl:sort select="App" order="ascending"/>
  343.                         <xsl:sort select="@domain" order="ascending"/>
  344.                         <xsl:sort select="@module" order="ascending"/>
  345.                         <xsl:sort select="Object" order="ascending"/>
  346.                         <xsl:sort select="Msg" order="ascending"/>
  347.                         <xsl:sort select="Action" order="ascending"/>
  348.                         <xsl:sort select="InetDef/@dir" order="ascending"/>
  349.                         <xsl:sort select="InetDef/@remIp" order="ascending"/>
  350.                         <xsl:sort select="InetDef/@LocIp" order="ascending"/>
  352.                     </xsl:apply-templates>-->
  353.                 </xsl:when>
  354.                 <xsl:otherwise>
  355.                     <xsl:call-template name="sortEvents">
  356.                         <xsl:with-param name="Total" select="count($Events)"/>
  357.                         <xsl:with-param name="Events" select="$Events"/>
  358.                     </xsl:call-template>
  359.                 </xsl:otherwise>
  360.                 </xsl:choose>
  361.             </xsl:when>
  362.             <xsl:otherwise>
  363.                 <!-- domain filter is not empty -->
  364.                 <xsl:choose>
  365.                     <xsl:when test="$Filter//sort='App'">
  366.                         <xsl:variable name="selected_events" select="$EventsSortedByApp[contains(
  367.                             translate( @domain, '_-\/.:;,ABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789' , '_-\/.:;,abcdefghijklmnopqrstuvwxyz0123456789'),
  368.                             translate($Filter//domain,'_-\/.:;,ABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789','_-\/.:;,abcdefghijklmnopqrstuvwxyz0123456789'))]"/>
  369.                             
  370.                         <xsl:call-template name="sortEvents">
  371.                             <xsl:with-param name="Events" select="$selected_events"/>
  372.                             <xsl:with-param name="OrigEvents" select="$Events[contains(
  373.                                 translate( @domain, '_-\/.:;,ABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789' , '_-\/.:;,abcdefghijklmnopqrstuvwxyz0123456789'),
  374.                                 translate($Filter//domain,'_-\/.:;,ABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789','_-\/.:;,abcdefghijklmnopqrstuvwxyz0123456789'))]"/>
  375.                         </xsl:call-template>
  376.                             
  377.                         <!--<xsl:apply-templates select="$selected_events">
  378.                             <xsl:with-param name="Total" select="count($selected_events)"/> -->
  379.                             <!-- count all events from this user and domain, not sorted by app -->
  380.                             <!--<xsl:with-param name="Events" select="$Events[contains(
  381.                             translate( @domain, '_-\/.:;,ABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789' , '_-\/.:;,abcdefghijklmnopqrstuvwxyz0123456789'),
  382.                             translate($Filter//domain,'_-\/.:;,ABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789','_-\/.:;,abcdefghijklmnopqrstuvwxyz0123456789'))]"/>
  383.                             
  384.                             <xsl:sort select="App" order="ascending"/>
  385.                             <xsl:sort select="@domain" order="ascending"/>
  386.                             <xsl:sort select="@module" order="ascending"/>
  387.                             <xsl:sort select="Object" order="ascending"/>
  388.                             <xsl:sort select="Msg" order="ascending"/>
  389.                             <xsl:sort select="Action" order="ascending"/>
  390.                             <xsl:sort select="InetDef/@dir" order="ascending"/>
  391.                             <xsl:sort select="InetDef/@remIp" order="ascending"/>
  392.                             <xsl:sort select="InetDef/@LocIp" order="ascending"/>
  394.                         </xsl:apply-templates>-->
  395.                     </xsl:when>
  396.                     <xsl:otherwise>
  397.                             <xsl:variable name="selected_events" select="$Events[   @module='IDS' or contains(
  398.                             translate( @domain, '_-\/.:;,ABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789' , '_-\/.:;,abcdefghijklmnopqrstuvwxyz0123456789'),
  399.                             translate($Filter//domain,'_-\/.:;,ABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789','_-\/.:;,abcdefghijklmnopqrstuvwxyz0123456789'))]"/>
  401.                             <xsl:call-template name="sortEvents">
  402.                                 <xsl:with-param name="Events" select="$selected_events"/>
  403.                             </xsl:call-template>
  404.                             
  405. <!--                            <xsl:apply-templates select="$selected_events">
  406.                                 
  407.                                 <xsl:sort select="@count" order="descending"/>
  408.                             
  409.                                 <xsl:with-param name="Total" select="count($selected_events)"/>
  410.                             </xsl:apply-templates>-->
  411.                     </xsl:otherwise>
  412.                 </xsl:choose>
  414.             </xsl:otherwise>
  415.         </xsl:choose>
  416.     </xsl:template>
  417.     
  418.     <xsl:template name="sortEvents">
  419.         <xsl:param name="Events"/>
  420.         <xsl:param name="OrigEvents"/>
  421.         
  422.         <xsl:variable name="sortParamNoDir">
  423.             <xsl:choose>
  424.                 <xsl:when test="starts-with($Filter//sort,'-')">
  425.                     <xsl:value-of select="substring-after($Filter//sort, '-')"/>
  426.                 </xsl:when>
  427.                 <xsl:otherwise>
  428.                     <xsl:value-of select="$Filter//sort"/>
  429.                 </xsl:otherwise>
  430.             </xsl:choose>
  431.         </xsl:variable>
  432.         
  433.         <xsl:variable name="sortAtr">
  434.             <xsl:choose>
  435.                 <xsl:when test="$Filter//sort='App' or $Filter//sort='-App'"></xsl:when>
  436.                 <xsl:otherwise><xsl:value-of select="$sortParamNoDir"/></xsl:otherwise>
  437.             </xsl:choose>
  438.         </xsl:variable>
  439.         <xsl:variable name="sortNode">
  440.             <xsl:choose>
  441.                 <xsl:when test="$Filter//sort='App' or $Filter//sort='-App'">App</xsl:when>
  442.                 <xsl:otherwise></xsl:otherwise>
  443.             </xsl:choose>
  444.         </xsl:variable>
  445.         <xsl:variable name="sortDir">
  446.             <xsl:choose>
  447.                 <xsl:when test="starts-with($Filter//sort,'-')">ascending</xsl:when>
  448.                 <xsl:otherwise>descending</xsl:otherwise>
  449.             </xsl:choose>
  450.         </xsl:variable>
  451.         
  452.         <xsl:apply-templates select="$Events">
  453.             <xsl:sort select="@*[name()=$sortAtr] | Action/@*[name()=$sortAtr]" order="{$sortDir}"/>
  454.             <xsl:sort select="*[name()=$sortNode]" order="{$sortDir}"/>
  455.             <xsl:sort select="@dateTimeLast" order="{$sortDir}"/>
  456.             
  457.             <xsl:with-param name="Events" select="$OrigEvents"/>
  458.         </xsl:apply-templates>
  459.     </xsl:template>
  461. </xsl:stylesheet>