lwatch.conf(5)

💖 lwatch.conf(5) — the config file glow-up 💖

okay bestie, sit down, hydrate, because this is the manual page for lwatch.conf(5) — that's the File Formats Manual section, iykyk — and it's literally the config file for lwatch(1), aka the thing that does syntax highlighting for syslog/syslog-ng files. yes. colors in your logs. we ate. 🎀

---

✨ NAME ✨

lwatch.conf — the configuration file for lwatch(1), which does syntax highlighting for syslog/syslog-ng files. she's the blueprint, the vibe board, the whole aesthetic. 💅

---

🌸 DESCRIPTION 🌸

so the default config file for lwatch is /etc/lwatch.conf — that's the built-in value, no cap — but you can absolutely point at a different file with the -C command line option. go read lwatch(1) for the details, bestie. 🦋

💬 Comments

everything from # (hash) to the end of the line is a comment. periodt. 🫶

🔧 General options

• cfg_ver — this one is obligatory, like attendance at the group chat. it must be placed as the first option in the config file. it holds the version of the config file syntax. this manual right here describes version 1.
• rule_action — after a rule successfully matches, lwatch tries to match the next one. but you can choose to bail after executing a matching rule by flipping this parameter from continue (that's the default) to exit. you can also override this global parameter for each individual rule. see the Actions and modificators section below. 👀
• use_syslog — if you set this to yes, some messages get logged through syslog. default is yes.
• log_level — how verbose the log messages lwatch produces should be.
• date_color — default color of the date part.
• host_color — default color of the hostname part.
• serv_color — default color of the service part.
• mesg_color — default color of the message part.
• input_file — where lwatch is reading data from. built-in default is /var/lib/syslog.fifo, and it can be overwritten with command line option -i.
• output_file — where lwatch outputs colored data. built-in default is stdout (-), and it can be overwritten with command line option -o.
• show_unparsed — by default lwatch ignores lines that can't be split into date, host, service and message. set this variable to yes if you'd like to see those lines. it's the same as command line option -s.

🌈 Available colors

to specify a color you can use these strings, exactly: black, red, green, brown, blue, magenta, cyan, lightgray, darkgray, brightred, brightgreen, yellow, brightblue, purple, brightcyan, white. sixteen options, all iconic, no notes. ✨

📊 Available log levels

to specify the lower visible log level you can use these strings: LOG_EMERG, LOG_ALERT, LOG_CRIT, LOG_ERR, LOG_WARNING, LOG_NOTICE, LOG_INFO, LOG_DEBUG.

however, and this is the tea: lwatch logs some debug data at LOG_DEBUG, some maybe-useful messages at LOG_NOTICE, and errors at LOG_ERROR. so technically, the meaningful values are:

• LOG_DEBUG — log everything 📢
• LOG_NOTICE — log maybe useful messages and errors (this is the default) 💖
• LOG_ERROR — log only errors. if LOG_NOTICE is too verbose for you, this is the next recommended setting.
• LOG_CRIT — be quiet 🤫

please keep in mind that meaningful values may be a subject of change in future releases. she's growing, she's evolving. 🦋

🔍 Matching patterns

This. Is. The True Power of Lwatch. it's hidden here, bestie, this is where the main character energy lives. you can match input lines against PCRE (Perl Compatible Regular Expression) and change the output depending on the match. you can read more about PCRE in pcrepattern(3) (from libpcre) or in perlre(1) (from perl).

there are two ways to define a matching pattern/action.

first one is the simple one. just pattern and one action:

/regexp/      action

the second one is more complex, but it lets you specify more than one action or modificator with one pattern:

/regexp/      {
        action1
        action2
        ...
        actionN
}

there is one important thing you should remember. there is no need to quote / (slash) if you use it inside a regexp pattern. for example:

//USR/SBIN/CRON/        {       # cron's messages are not important
        color=blue              # display it in blue
        match_service
}

see? slashes just vibing. no escape needed. 🎀

🎬 Actions and modificators

• date_color — set date color
• mesg_color, color — set message color
• serv_color — set service name color
• host_color — set hostname color
• ignore — ignore this pattern, do not match next patterns
• exit — do not match next patterns when rule_action is set to continue. in any other case it is superfluous.
• continue — continue with next pattern when rule_action is set to exit. in any other case it is superfluous. please note that if ignore is used in the same action it takes a priority — it makes no sense to match other rules for a string that has been ignored. 🙈
• highlight — highlight matched string with given color (see NOTES)
• match_host — match hostname instead of message
• match_service — match service name instead of message

---

⚠️ NOTES ⚠️

okay so this is the part where things get spicy and you need to pay attention.

the highlight action changes the matched text. that's why the following part of configuration won't work:

/root/                         highlight=brown
/session closed for user root/ ignore

when

(pam_unix) session closed for user root

would appear as an input line.

the first rule changes the text to:

(pam_unix) session closed for user [BROWN]root[NORMAL]

where [BROWN] and [NORMAL] are control sequences to change color to brown, then change it back to default color of this part. of course this line does not match the second rule and you can see it on the output. 😭 the second rule got ghosted fr fr.

there are two possible workarounds:

• put the ignore pattern before the highlight one 🧚
• enhance your second rule like:

/session closed for user .*root.*/ ignore

---

🌟 EXAMPLES 🌟

just look into the provided lwatch.conf. she's right there. go read her. 📖✨

---

👑 COPYRIGHT 👑

this program is free software; you can redistribute it and/or modify it under the terms of the GNU General Public License as published by the Free Software Foundation; either version 2 of the License, or (at your option) any later version.

regular expression support is provided by the PCRE library package, which is open source software, written by Philip Hazel, and copyright by the University of Cambridge, England. this library is available at: ftp://ftp.csx.cam.ac.uk/pub/software/programming/pcre/

---

🔗 SEE ALSO 🔗

lwatch(1), pcrepattern(3), perlre(1)

---

and that's the whole page, bestie 💜 this was lwatch.conf(5) from the File Formats Manual section, and the footer down there just reads lwatch.conf(5) one more time because she loves a dramatic outro. now go forth and color your logs. slay. 🦋✨💅