# Config file for lwatch
# Created by Artur Czechowski <arturcz@hell.pl>
# $Id: lwatch.conf,v 1.29 2009/03/23 21:15:34 arturcz Exp $
# $Source: /cvsroot/lwatch/files/src/lwatch.conf,v $
# Format of this file is described in manual
# That file is public domain. You can use, copy, modify, distribute
# and sell it.

# This configuration file has syntax version 1.
cfg_ver=1

# The default is that after success match the rule is executed
# then the next rule is taken into action. You can change this behavior
# changing rule_action from continue to exit. Read lwatch.conf(5) for details.
# rule_action=continue

# Available colors:
# black red green brown blue magenta cyan lightgray darkgray brightred
# brightgreen yellow brightblue purple brightcyan white

# Default color for displaying date
# date_color=cyan
# Default color for displaying hostname
# host_color=magenta
# Default color for displaying service
# serv_color=blue
# Default color for displaing message body
# mesg_color=lightgray

# Where is the source for reading data?
# if filename - it should be named fifo, where syslogd logs
# - means: read from stdin (via tail -f logfile | lwatch )
# Run lwatch -h to see default input file.
#input_file=/var/lwatch/syslog.fifo # remember to configure your syslog

# Where to print colored logs?
# Any filename accepted, especially /dev/tty*. 
# Run lwatch -h to see default output file.
#output_file=/dev/tty11

# What to do with unparsed lines like:
# Mar 21 15:45:06 musashi -- MARK --
# or
# Mar 21 16:02:58 goofie last message repeated 2 times
# Default is no
show_unparsed=no

#and below the clue of lwatch: configuration rules for message higlighting.
# format:
# /regexp/	action
# or
# /regexp/	{
#			action1
#			action2
#			...
#			actionN
#		}
#
# Comments start from # (hash) and end with end of line.

# Below is the configuration which works for me

/root/		highlight=brown	# all messages with root string are brown

/failed/	color=red	# attention, operation failed

/^ICMP message type time exceeded from [0-9.]*$/ ignore

/^fw-reject:/		{	# all rejectd from fw are red
	color=red
	serv_color=brown
	continue
}

/border/ {
	match_host		# if message is originated by host border
	host_color=red		# show its name in red
}

/kernel/	{		# if string kernel ...
	match_service		# appears in service ...
	serv_color=brown	# write it in brown
}

#/borys\.lan/	ignore		# don't mess with this zone


/reject\w*/	highlight=red
/accept\w*/	highlight=green
/success\w*/	highlight=green
/sent/		highlight=green
/lost/		highlight=red	

/deferred/	highlight=brown

//USR/SBIN/CRON/	{	# cron's messages are not important
	color=blue		# display it in blue
	match_service
}

# Most cron messages are not important, except ones like this:
/mailman/ color=red #pick a color you like

/([0-9A-Z]{2}:){5}[0-9A-Z]{2}/ highlight=brown # highlight MAC in brown

/^pam/ {			# PAM
	match_service		# service
	serv_color=brown	# highlight in brown
}

/disconnect\w*/	{
	highlight=red	# highlight only disconnect in red
	exit		# dont process next actions
}
/connect\w*/	highlight=green	# highlight only connect in green
