Multitail

Multitail

• See the author's official page at http://www.vanheusden.com/multitail/ to get multitail.

Multitail Color Schemes

Multitail allows you to color lines in a couple ways:

• cs_re - this colors the *entire* match for the regexp
• cd_re_s - this colors any substrings that are matched by the subpatterns

The available colors are red, green, yellow, blue, magenta, cyan and white. Additionally you can specify a background color and an attribute using the format [fg-color][,bg-color][,attribute].

The attributes that I've found that seem to work are bold, underline and inverse. The example config uses blink but that attribute doesn't seem to work in my terminal. Additional valid attributes may be lurking in the source.

Some examples:

• red - simply make the text red
• red,blue - red with a blue background
• red,,bold - red with a bold background
• ,blue - blue background
• ,blue,bold - default text color with a blue background and bold text
• ,,bold - bold text

pflog

 # multitail -cS pflog -l 'tcpdump -n -s0 -i pflog0'
 colorscheme:pflog:pflog
 cs_re:cyan:^[0-9][0-9]:[0-9][0-9]:[0-9][0-9]\.[0-9]+\
 cs_re:green:[0-9]+\.[0-9]+\.[0-9]+\.[0-9]+
 cs_re_s:yellow:....(\.[0-9]+):\
 cs_re_s:yellow:....(\.[0-9]+\ )
 cs_re_s:magenta::\ (.*),\
 cs_re:red:\ [SRPF]\
 cs_re_s:red:length\: (.*)$

ntsyslog

 #
 # Windows (NTsyslog)
 colorscheme:ntsyslog:Windows NTsyslog
 cs_re:cyan:^[A-Z][a-z][a-z]\ [0-9][0-9]\ [0-9][0-9]:[0-9][0-9]:[0-9][0-9]\
 cs_re_s:magenta:...:[0-9][0-9]\ ([A-Za-z0-9]+)
 cs_re_s:green:...\[(info)\]
 cs_re_s:yellow:...\[(warning)\]
 cs_re_s:red:...\[(failure)\]
 cs_re_s:red:...\[(error)\]
 cs_re:red:Logon\ Failure
 cs_re_s:red:User\ Name:([A-Za-z0-9]+)\ \
 cs_re_s:red:Workstation\ Name:([A-Za-z0-9]+)
 cs_re_s:blue,,bold:...:[0-9][0-9]\ [A-Za-z0-9]+\ ([-A-Za-z0-9_ ]+)

ra (Argus)

This colorscheme is a bit more complicated, due to multitail's limitations multiple groups of rules based on protocol are defined. Each group contains a rule to highlight the port (except ICMP), make the bytecount red if it's greater than 20,000, and color the directional markers (<-, <?, <->, ?> and ->). The last set of rules set the background color for the entire line. Multitail does not allow you to overwrite the background color set by a previous rule so this is why the 3 groups of rules which do identical things except for the background color are needed.

NOTE: these problems were addressed by Folkert van Heusden (the multitail author) after he somehow found this page. Many thanks to him for writing a solution and letting me test it for him.

This colorscheme is in production use at a medium sized facility, see the Argus page for more info.

This one is for really decent displays: it runs together otherwise, see the next one for average displays.

 #
 # multitail -cS ra -l 'ra -n -S localhost'
 #
 # ra (argus)
 colorscheme:ra:ra
 #ICMP
 cs_re_val_bigger:red,cyan:20000:.*icmp.*([0-9]+)[ ]+([0-9]+)[ ]+[A-Z][A-Z][A-Z]
 cs_re_s:magenta,cyan,bold:.*icmp.*(<->)
 cs_re_s:blue,cyan,bold:.*icmp.*(<[-?]) 
 cs_re_s:yellow,cyan,bold:.*icmp.* ([-?]>)
 #TCP
 cs_re_s:,blue,bold:.*tcp.*[0-9]+\.[0-9]+\.[0-9]+\.[0-9]+\.([0-9]+).*[0-9]+\.[0-9]+\.[0-9]+\.[0-9]+\.([0-9]+)
 cs_re_val_bigger:red,blue,bold:20000:.*tcp.*([0-9]+)[ ]+([0-9]+)[ ]+[A-Z][A-Z][A-Z]
 cs_re_s:magenta,blue,bold:.*tcp.*(<->)
 cs_re_s:cyan,blue,bold:.*tcp.*(<[-?]) 
 cs_re_s:yellow,blue,bold:.*tcp.* ([-?]>)
 #UDP
 cs_re_s:,green,bold:.*udp.*[0-9]+\.[0-9]+\.[0-9]+\.[0-9]+\.([0-9]+).*[0-9]+\.[0-9]+\.[0-9]+\.[0-9]+\.([0-9]+)
 cs_re_val_bigger:red,green,bold:20000:.*udp.*([0-9]+)[ ]+([0-9]+)[ ]+[A-Z][A-Z][A-Z]
 cs_re_s:magenta,green,bold:.*udp.*(<->)
 cs_re_s:cyan,green,bold:.*udp.*(<[-?]) 
 cs_re_s:yellow,green,bold:.*udp.*([-?]\>)
 #background coloring
 cs_re:,blue:.*tcp.*
 cs_re:,green:.*udp.*
 cs_re:,cyan:.*icmp.*
 cs_re:,,inverse:.*man.*

This one is high-contrast:

 #
 # ra (argus)  (jon)
 colorscheme:ra:ra
 #ICMP 
 cs_re_val_bigger:red,black:20000:.*icmp.*([0-9]+)[ ]+([0-9]+)[ ]+[A-Z][A-Z][A-Z]
 cs_re_s:magenta,black,bold:.*icmp.*(<->) 
 cs_re_s:blue,black,bold:.*icmp.*(<[-?]) 
 cs_re_s:yellow,black,bold:.*icmp.* ([-?]>)
 #TCP
 cs_re_s:,blue,bold:.*tcp.*[0-9]+\.[0-9]+\.[0-9]+\.[0-9]+\.([0-9]+).*[0-9]+\.[0-9]+\.[0-9]+\.[0-9]+\.([0-9]+)
 cs_re_val_bigger:red,blue,bold:20000:.*tcp.*([0-9]+)[ ]+([0-9]+)[ ]+[A-Z][A-Z][A-Z]
 cs_re_s:magenta,blue,bold:.*tcp.*(<->)
 cs_re_s:cyan,blue,bold:.*tcp.*(<[-?])
 cs_re_s:yellow,blue,bold:.*tcp.* ([-?]>)
 #UDP 
 cs_re_s:,magenta,bold:.*udp.*[0-9]+\.[0-9]+\.[0-9]+\.[0-9]+\.([0-9]+).*[0-9]+\.[0-9]+\.[0-9]+\.[0-9]+\.([0-9]+)
 cs_re_val_bigger:red,magenta,bold:20000:.*udp.*([0-9]+)[ ]+([0-9]+)[ ]+[A-Z][A-Z][A-Z]
 cs_re_s:green,magenta,bold:.*udp.*(<->)
 cs_re_s:cyan,magenta,bold:.*udp.*(<[-?])
 cs_re_s:yellow,magenta,bold:.*udp.*([-?]\>)
 #background coloring
 cs_re:,blue:.*tcp.*
 cs_re:,magenta:.*udp.*
 cs_re:,black:.*icmp.*
 cs_re:,,inverse:.*man.*

This is for multitail versions >= 4.3.6

 #
 # ra (argus)
 colorscheme:ra:argus
 cs_re_s:,,bold:[0-9]+\.[0-9]+\.[0-9]+\.[0-9]+\.([0-9]+).*[0-9]+\.[0-9]+\.[0-9]+\.[0-9]+\.([0-9]+)
 cs_re_val_bigger:red,,bold:20000:([0-9]+)[ ]+([0-9]+)[ ]+[A-Z][A-Z][A-Z]
 cs_re_s:magenta,,bold: (<->)
 cs_re_s:cyan,,bold: (<[-?] )
 cs_re_s:yellow,,bold: ([-?]>)
 mcsre:,blue:.*tcp.*
 mcsre:,green:.*udp.*
 mcsre:,cyan:.*icmp.*
 mcsre:,,inverse:.*man.*

This one is for black-bg/grey-fg displays, multitail versions >= 4.3.6 (fairly good contrast)

 #
 # Argus
 colorscheme:argus:Argus http://qosient.com/argus/
 cs_re_s:,,bold:[0-9]+\.[0-9]+\.[0-9]+\.[0-9]+\.([0-9]+).*[0-9]+\.[0-9]+\.[0-9]+\.[0-9]+\.([0-9]+)
 cs_re_val_bigger:red,,bold:20000:([0-9]+)[ ]+([0-9]+)[ ]+[A-Z][A-Z][A-Z]
 cs_re_s:magenta,,bold: (<->)
 cs_re_s:cyan,,bold: (<[-?] )
 cs_re_s:yellow,,bold: ([-?]>)
 mcsre:,blue:.*tcp.*
 mcsre:black,green:.*udp.*
 mcsre:black,cyan:.*icmp.*
 mcsre:,,inverse:.*man.*