# /etc/multitail.d/color.conf
#
# Color schemes for multitail(1)
# Included by main.conf
# The paths.conf file applies these to known log file locations.
#
# A color scheme is a set of rules to match log lines by regexp pattern,
# and then apply text attributes to the matching text.  For example,
# to highlight a particular error message, or make dates a different color.
# Different schemes are used for different log file formats.
#

###########################################################################

colorscheme:generic:generic log highlighting
# punctuation
cs_re:cyan:[[()<>=:]
# can't seem to escape ] within char class
cs_re:cyan:\]
# various trouble keywords
cs_re:yellow:([Cc]ould|[Cc]an|[Dd]id|[Dd]oes).not
cs_re:yellow:[Ii](ncorrect|nvalid)
cs_re:yellow:WARNING|Warning|warning|WARN|Warn|warn|WRN
cs_re:yellow:UNKNOWN|Unknown|unknown
cs_re:yellow:MISSING|Missing|missing
cs_re:yellow:UNABLE|Unable|unable
cs_re:yellow:LOST|Lost|lost
cs_re:yellow:TIMEOUT|Timeout|timeout|TIMED OUT|Timed out|timed out
cs_re:red:ERROR|Error|error|\<ERR|\<Err|\<err
cs_re:red:ABORTED|Aborted|aborted|ABORT|Abort|abort
cs_re:red:FAILED|Failed|failed|FAILURE|Failure|failure|FAIL|Fail|fail
cs_re:red:REJECTED|Rejected|rejected|REJECT|Reject|reject

###########################################################################

colorscheme:syslog:traditional Unix log format
# segfaults
cs_re_s:red,,bold:kernel: ([^:]*): segfault at [^ ]* rip [^ ]* rsp [^ ]* error
cs_re:red,,bold:kernel: .*: segfault at [^ ]* rip [^ ]* rsp [^ ]* error
# highlight program name
cs_re_s:,,bold:^... .. ..:..:.. [^[:space:]]+ ([-_[:alnum:]]*)

###########################################################################

colorscheme:liniptfw:Linux IPtables firewall (2.6.x kernel)
# we highlight just the values, to make it easier to find them
# red = source/input
cs_re_s:red:kernel: .*IN=([^ ]*)
cs_re_s:red:kernel: .*SRC=([^ ]*)
cs_re_s:red:kernel: .*SPT=([0-9]*)
# green = destination/output
cs_re_s:green:kernel: .*OUT=([^ ]*)
cs_re_s:green:kernel: .*DST=([^ ]*)
cs_re_s:green:kernel: .*DPT=([0-9]*)
# magenta = protocol
cs_re_s:magenta:kernel: .*PROTO=([^ ]*)
# dark grey = MAC address
cs_re_s:black,black,bold/dim:kernel: .*MAC=([^ ]*)
# SYN flag (new connection) = green
cs_re_s:green:kernel: .*(SYN)
# RST flag (bad connection) = red
cs_re_s:red:kernel: .*(RST)

###########################################################################

colorscheme:ssh:OpenSSH secure shell
cs_re:yellow:error: Could not get shadow information for.*
cs_re:yellow:fatal: Timeout before authentication for.*
cs_re_s:red,,bold:error: PAM: Authentication failure for(.*)
cs_re:red:error: PAM: Authentication failure for
cs_re:red,,blink:error: Bind to port [0-9]* on [^ ]* failed: Address already in use.
cs_re_s:red,,bold:error: PAM: Authentication failure for ([^ ]*) from (.*)
cs_re:red:error: PAM: Authentication failure for ([^ ]*) from (.*)
cs_re_s:green,,bold:Accepted [^ ]* for ([^ ]*) from ([^ ]*) port ([0-9]*) ssh2
cs_re:green:Accepted [^ ]* for [^ ]* from [^ ]* port.*
cs_re:red:PAM session setup failed\[[0-9]*\]:.*
cs_re_s:yellow,,bold:Failed ([^ ]*) for ([^ ]*) from ([^ ]*) port ([0-9]*).*
cs_re:yellow:Failed [^ ]* for [^ ]* from [^ ]* port [0-9]* .*
cs_re:red:Disconnecting: Too many authentication failures for.*

###########################################################################

colorscheme:netstat:Network ports and connections
# example: multitail -R 1 -l "netstat"
# see www.vanheusden.com/multitail/examples.html
cs_re:green:ESTABLISHED
cs_re:yellow:SYN_SENT
cs_re:magenta:CLOSE_WAIT
cs_re:blue:FIN_WAIT1
cs_re:blue,,underline:FIN_WAIT2
cs_re_s:red::([^ ]*)
cs_re:cyan:^[^ ]*

###########################################################################

colorscheme:tcpdump:Packet sniffer
# 17:44:07.363010 IP muur.intranet.vanheusden.com.49584 > keetweej.intranet.vanheusden.com.ssh:
cs_re:blue:^[^ ]*
cs_re:magenta::
cs_re_s:red:^[^ ]* [^ ]* *[^ ]* > [^:]*: *([^ ]*)
cs_re_s:green:^[^ ]* [^ ]* *[^ ]*\.([^ ]*) > [^ ]*\.([^:]*):
cs_re:magenta:\.
cs_re_s:yellow|yellow,,bold: IP (.*) > .*:
cs_re_s:yellow,,bold|yellow: IP [^ ]* > ([^:]*):

###########################################################################

colorscheme:vmstat:vmstat is part of sysstat
cs_re_s:magenta:^(procs)
cs_re_s:red:^procs *(-*memory-*)
cs_re_s:green:^procs *-*memory-* *(-*swap-*)
cs_re_s:yellow:^procs *-*memory-* *-*swap-* *(-*io-*)
cs_re_s:blue:^procs *-*memory-* *-*swap-* *-*io-* *(-*system-*)
cs_re_s:magenta,,bold:^ *(r *b)
cs_re_s:red,,bold:^ *r *b *(swpd *free *buff *cache)
cs_re_s:green,,bold:^ *r *b *swpd *free *buff *cache *(si *so)
cs_re_s:yellow,,bold:^ *r *b *swpd *free *buff *cache *si *so *(bi *bo)
cs_re_s:blue,,bold:^ *r *b *swpd *free *buff *cache *si *so *bi *bo *(in *cs)
cs_re_s:,,bold:^ *r *b *swpd *free *buff *cache *si *so *bi *bo *in *cs *(us *sy *id *wa)
cs_re_val_bigger:yellow:0:([0-9]{1,})

###########################################################################

colorscheme:mpstat:mpstat is part of systat
cs_re:magenta::
cs_re:blue:^..:..:.. ..
cs_re:blue,,bold:CPU.*
cs_re_val_bigger:yellow:0:([0-9]{1,}\.[0-9]{1,})

###########################################################################

colorscheme:sendmail:Sendmail SMTP mailer
cs_re:cyan:to=<[^>]*>
cs_re:cyan:[[:space:]]to=[[:alnum:]]+,[[:space:]]
cs_re:yellow:stat=Deferred.*
cs_re:red:stat=User unknown
cs_re:green:stat=Sent.*
cs_re:magenta:relay=[^ ]*
cs_re:red:verify=FAIL

###########################################################################

colorscheme:postfix:Postfix SMTP mailer
#cs_re:magenta:queue.active
cs_re:blue,,bold:[[:space:]]from=<[[:alnum:]@!#$%&'*+-/=?^_`{}|~]+>
cs_re:cyan:[[:space:]]orig_to=<[[:alnum:]@!#$%&'*+-/=?^_`{}|~]+>
cs_re:cyan:[[:space:]]to=<[[:alnum:]@!#$%&'*+-/=?^_`{}|~]+>
cs_re:magenta:relay=[^ ]*
cs_re:magenta:client=[^ ]*
cs_re:magenta:helo=<[^ <>]+>
cs_re:green:status=sent
cs_re:yellow:status=deferred
cs_re:red:status=bounced
cs_re:green:pickup
cs_re:yellow:non-delivery notification
cs_re:yellow:delay notification
cs_re:green:Trusted TLS
cs_re:red,,bold:stopping the Postfix mail system
cs_re:green,,bold:starting the Postfix mail system
cs_re:green,,bold:refreshing the Postfix mail system

###########################################################################

colorscheme:httping:ping for HTTP
cs_re:green:^PING .*:
cs_re:magenta:time=[0-9\.]* ms
cs_re:yellow:seq=[0-9]*
cs_re:green:^---.*
cs_re_s:green:^([0-9]*) connects, ([0-9]*) ok, ([^%]*)
cs_re_s:green:^round-trip.*= ([0-9\.]*)/([0-9\.]*)/([0-9\.]*)
cs_re:red:404 Not Found
cs_re:blue:[0-9]*KB/s
cs_re:red:could not connect

###########################################################################

colorscheme:named:ISC BIND named DNS server
cs_re_s:yellow,,bold:lame server resolving ([^ ]*).*in ([^?]*).*: (.*$)
cs_re:yellow:lame server resolving [^ ]* .in [^:]*..:
cs_re_s:red,,bold:client ([^#]*)#[0-9]*: update forwarding denied
cs_re:red:client [^:]*: update forwarding denied
cs_re_s:cyan,,bold:received notify for zone (.*)
cs_re:cyan:received notify for zone
cs_re:cyan:zone [^:]*: transferred serial.*
cs_re:cyan:zone [^:]*: sending notifies .serial [0-9]*.
cs_re_s:green,,bold:transfer of [^ ]* from ([^#]*)#[0-9]*: end of transfer
cs_re:green:transfer of [^ ]* from [^:]*: end of transfer
cs_re:yellow:loading configuration from.*
cs_re:yellow:no IPv6 interfaces found
cs_re:red:logging channel [^ ]* file [^:]*: permission denied
cs_re:red:isc_log_open [^ ]* failed: permission denied
cs_re:red:zone [^:]*: loading master file [^:]*: file not found
cs_re:green,,bold:named reload succeeded

###########################################################################

colorscheme:strace:Linux system call trace
# comments
cs_re:green:/\*.*\*/
# call
cs_re:yellow:^[a-z_]*[0-9]*
# parenthesis around parameters
cs_re_s:yellow:^[a-z_]*[0-9]*(\()[^)]*(\))
# errno details
cs_re_s:blue:^[a-z]*\([^)]*\).*(\(.*\))
# return value
cs_re_s:green:^.*(= *-*[a-fx0-9]*)[^=]*$
# errno
cs_re_s:cyan:^.*= *-*[a-fx0-9]* *([A-Z]*)[^=]*$
# escapes
cs_re:magenta:\\[a-z]
cs_re:magenta:\\[0-9]*
# parameters (1)
cs_re:red:"[^"]*"
# names
cs_re:white:[a-z]*=
cs_re:white:[a-z0-9_]*:
# parameters (2)
cs_re:red:[0-9a-fx]*
cs_re:cyan:[A-Z_]*
# {}[]
cs_re:yellow:[\[\]]*

###########################################################################

colorscheme:procmail:local mail delivery agent
cs_re:magenta::
cs_re:magenta:/
cs_re_s:blue,,bold:^procmail: \[[0-9]*\] ([^ ]* [^ ]* *[^ ]* ..:..:.. [^ ]*)
cs_re:blue:^procmail: \[[0-9]*\] [^ ]* [^ ]* *[^ ]* ..:..:.. [^ ]*
cs_re_s:green,,bold:^procmail: Match on "(.*)"
cs_re:green:^procmail: Match on.*
cs_re:red:^procmail: Executing.*
cs_re:magenta,,bold:^procmail: Assigning
cs_re:yellow:warning:.*
cs_re:yellow:Couldn't determine implicit lockfile from.*

###########################################################################
# Apache httpd web server

colorscheme:apache_access:Apache HTTPd access/request log
cs_re:yellow:"[ ]1[0-9][0-9][ ]
cs_re:green:"[ ][2-3][0-9][0-9][ ]
cs_re:red:"[ ][4-5][0-9][0-9][ ]
cs_re:cyan::
cs_re:green:\[
cs_re:green:\]
# ip-adresses in the format x.x.x.x
cs_re:yellow:^[0-9]\{1,3\}\.[0-9]\{1,3\}\.[0-9]\{1,3\}\.[0-9]\{1,3\}
# hostnames
cs_re:yellow:^[^ ]*

colorscheme:apache_error:Apache HTTPd general/error log
cs_re:yellow:\[client .*\]
cs_re:red: [^ ]*$
cs_re:blue:^\[... ... .. ..:..:.. ....\]

###########################################################################

colorscheme:mysql:MySQL error log
cs_re:magenta::
cs_re_s:blue|blue,,bold:^..(..).. ..:..:..
cs_re_s:blue,,bold|blue:^(..)..(..) ..:..:..
cs_re:blue:^...... ..:..:..
cs_re:red,,bold:^...... ..:..:.. \[ERROR\]
cs_re:red:^...... ..:..:.. \[ERROR\].*
cs_re:yellow,,bold:^...... ..:..:.. \[Warning\]
cs_re:yellow:^...... ..:..:.. \[Warning\].*
cs_re:green,,bold:^...... ..:..:.. \[Note\]
cs_re:green:^...... ..:..:.. \[Note\].*
cs_re:magenta:mysqld ended
cs_re:red:Can't start server.*

# END
###########################################################################
