More color tag presets: system, applications and general

The preset menu is grouped (HTTP/HTTPS, System, Applications, General) and
gains SSH/logins, sudo, kernel, systemd, firewall/fail2ban, Docker,
databases, log levels and IPv4 addresses.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

web/app.js

@@ -53,6 +53,15 @@ const I18N = {
     preset_http_probes: 'Probes and attacks', preset_http_bots: 'Bots and scripts',
     preset_http_errors: 'TLS/HTTPS and proxy errors',
     pl_probes: 'probes / attacks', pl_bots: 'bots / scripts', pl_tls: 'TLS errors', pl_proxy: 'proxy errors',
+    presetGroupSys: 'System', presetGroupApps: 'Applications', presetGroupGen: 'General',
+    preset_sys_auth: 'SSH and logins', preset_sys_sudo: 'sudo commands', preset_sys_kernel: 'Kernel: OOM, crashes, disks',
+    preset_sys_systemd: 'systemd services', preset_sys_firewall: 'Firewall and fail2ban',
+    preset_app_docker: 'Docker and containers', preset_app_db: 'Databases',
+    preset_gen_levels: 'Log levels', preset_gen_ip: 'IPv4 addresses',
+    pl_authFail: 'login failures', pl_authOk: 'logins', pl_sudo: 'sudo commands', pl_oom: 'out of memory',
+    pl_kernel: 'kernel errors', pl_unitFail: 'failed services', pl_unitOk: 'service start/stop',
+    pl_firewall: 'firewall', pl_docker: 'container problems', pl_db: 'database errors',
+    pl_fatal: 'fatal / critical', pl_info: 'info / notice', pl_debug: 'debug / trace', pl_ip: 'IPv4 addresses',
     presetAdded: (n) => (n ? `${n} tag(s) added` : 'These tags are already in the list'),
     tagsLoadErr: 'Tags: ',
     err_pattern_required: 'The keyword is required',
@@ -207,6 +216,15 @@ const I18N = {
     preset_http_probes: 'Sondes et attaques', preset_http_bots: 'Robots et scripts',
     preset_http_errors: 'Erreurs TLS/HTTPS et proxy',
     pl_probes: 'sondes / attaques', pl_bots: 'robots / scripts', pl_tls: 'erreurs TLS', pl_proxy: 'erreurs proxy',
+    presetGroupSys: 'Système', presetGroupApps: 'Applications', presetGroupGen: 'Général',
+    preset_sys_auth: 'SSH et connexions', preset_sys_sudo: 'Commandes sudo', preset_sys_kernel: 'Noyau : OOM, plantages, disques',
+    preset_sys_systemd: 'Services systemd', preset_sys_firewall: 'Pare-feu et fail2ban',
+    preset_app_docker: 'Docker et conteneurs', preset_app_db: 'Bases de données',
+    preset_gen_levels: 'Niveaux de log', preset_gen_ip: 'Adresses IPv4',
+    pl_authFail: 'échecs de connexion', pl_authOk: 'connexions', pl_sudo: 'commandes sudo', pl_oom: 'mémoire épuisée',
+    pl_kernel: 'erreurs noyau', pl_unitFail: 'services en échec', pl_unitOk: 'démarrage/arrêt de service',
+    pl_firewall: 'pare-feu', pl_docker: 'problèmes de conteneur', pl_db: 'erreurs base de données',
+    pl_fatal: 'fatal / critique', pl_info: 'info / notice', pl_debug: 'debug / trace', pl_ip: 'adresses IPv4',
     presetAdded: (n) => (n ? `${n} tag(s) ajouté(s)` : 'Ces tags sont déjà dans la liste'),
     tagsLoadErr: 'Tags : ',
     err_pattern_required: 'Le mot-clé est obligatoire',
@@ -479,6 +497,7 @@ function applyLang() {
   for (const el of document.querySelectorAll('[data-i18n-title]')) el.title = t(el.dataset.i18nTitle) + (el.dataset.user ? ` (${el.dataset.user})` : '');
   for (const el of document.querySelectorAll('[data-i18n-aria]')) el.setAttribute('aria-label', t(el.dataset.i18nAria));
   for (const el of document.querySelectorAll('[data-i18n-ph]')) el.placeholder = t(el.dataset.i18nPh);
+  for (const el of document.querySelectorAll('[data-i18n-label]')) el.label = t(el.dataset.i18nLabel);
   for (const b of document.querySelectorAll('#langSwitch [data-lang]')) b.setAttribute('aria-checked', String(b.dataset.lang === lang));
 }
 
@@ -2055,10 +2074,12 @@ $('#purgeBtn').addEventListener('click', async () => {
 
 const PALETTE = ['#6366f1', '#0ea5e9', '#14b8a6', '#a855f7', '#ec4899', '#eab308', '#64748b', '#f97316'];
 
-// Ready-made tags for HTTP/HTTPS access logs. The patterns are valid in both
-// JavaScript and Go (RE2) and cover nginx/Apache (common, combined), Traefik
-// (CLF, JSON), Caddy (JSON) and HAProxy (httplog). For status codes and
-// methods only the "hl" group is colored, not the context around it.
+// Ready-made tags. The patterns are valid in both JavaScript and Go (RE2).
+// The HTTP ones cover nginx/Apache (common, combined), Traefik (CLF, JSON),
+// Caddy (JSON) and HAProxy (httplog); for status codes and methods only the
+// "hl" group is colored, not the context around it. The others target the
+// usual messages of sshd/PAM, sudo, the kernel, systemd, UFW/iptables,
+// fail2ban, Docker, PostgreSQL and MySQL/MariaDB.
 const HTTP_STATUS_CTX = '(?:" |"(?:status|DownstreamStatus|OriginStatus|status_code)": ?|(?:-1|\\d+)/(?:-1|\\d+)/(?:-1|\\d+)/(?:-1|\\d+)/\\+?\\d+ )';
 const httpStatus = (d, color) => ({ label: `HTTP ${d}xx`, pattern: `${HTTP_STATUS_CTX}(?<hl>${d}\\d\\d)\\b`, color });
 const httpMethod = (m, color) => ({ label: m.replace(/\|/g, '/'), pattern: `"(?<hl>${m})[ "]`, color, caseSensitive: true });
@@ -2075,6 +2096,38 @@ const PRESETS = {
     { label: t('pl_proxy'), color: '#fdba74',
       pattern: '(?:upstream timed out|upstream prematurely closed|no live upstreams|connect\\(\\) failed|connection refused|bad gateway|gateway time-?out|service unavailable)' },
   ],
+  sys_auth: () => [
+    { label: t('pl_authFail'), color: '#fca5a5',
+      pattern: '(?:Failed (?:password|publickey|none)|Invalid user|authentication failures?|Connection closed by (?:invalid|authenticating) user|maximum authentication attempts exceeded|FAILED (?:LOGIN|SU)|incorrect password attempts?|NOT in sudoers)' },
+    { label: t('pl_authOk'), color: '#86efac',
+      pattern: '(?:Accepted (?:password|publickey|keyboard-interactive(?:/pam)?)|session opened for user|New session \\S+ of user)' },
+  ],
+  sys_sudo: () => [{ label: t('pl_sudo'), color: '#fde68a', pattern: '\\bCOMMAND=\\S+', caseSensitive: true }],
+  sys_kernel: () => [
+    { label: t('pl_oom'), color: '#f87171',
+      pattern: '(?:Out of memory|oom-kill(?:er)?|oom_reaper|Killed process \\d+|invoked oom-killer)' },
+    { label: t('pl_kernel'), color: '#fda4af',
+      pattern: '(?:Kernel panic|\\bBUG: |\\bOops\\b|Call Trace|segfault at|general protection fault|I/O error|EXT4-fs error|Buffer I/O error|blocked for more than \\d+ seconds|Hardware Error|soft lockup|hard LOCKUP)' },
+  ],
+  sys_systemd: () => [
+    { label: t('pl_unitFail'), color: '#fca5a5',
+      pattern: '(?:Failed to start|failed with result|Main process exited, code=(?:exited|killed|dumped)|entered failed state|Start request repeated too quickly|Dependency failed)' },
+    { label: t('pl_unitOk'), color: '#bbf7d0', caseSensitive: true,
+      pattern: '\\b(?:Started|Starting|Stopped|Stopping|Reloaded|Reloading|Reached target)\\b' },
+  ],
+  sys_firewall: () => [{ label: t('pl_firewall'), color: '#fdba74', caseSensitive: true,
+    pattern: '(?:\\[UFW (?:BLOCK|ALLOW|AUDIT|LIMIT BLOCK)\\]|\\b(?:DROP|REJECT)\\b|\\b(?:Ban|Unban|Found) \\d{1,3}(?:\\.\\d{1,3}){3}\\b)' }],
+  app_docker: () => [{ label: t('pl_docker'), color: '#fcd34d',
+    pattern: '(?:\\bOOMKilled\\b|exited with code [1-9]\\d*|exit code: [1-9]\\d*|health_status: unhealthy|\\bunhealthy\\b|Back-off restarting|CrashLoopBackOff|container (?:die|kill|oom)\\b|restarting \\(\\d+\\))' }],
+  app_db: () => [{ label: t('pl_db'), color: '#c4b5fd',
+    pattern: '(?:\\bdeadlock(?: detected| found)?\\b|duplicate key|too many (?:connections|clients)|lock wait timeout|slow query|could not connect to server|server has gone away|out of shared memory|terminating connection|Access denied for user|password authentication failed)' }],
+  gen_levels: () => [
+    { label: t('pl_fatal'), color: '#ef4444', pattern: '\\b(?:fatal|crit(?:ical)?|panic|emerg(?:ency)?)\\b' },
+    { label: t('pl_info'), color: '#bfdbfe', pattern: '\\b(?:info|notice)\\b' },
+    { label: t('pl_debug'), color: '#e5e7eb', pattern: '\\b(?:debug|trace)\\b' },
+  ],
+  gen_ip: () => [{ label: t('pl_ip'), color: '#a5f3fc',
+    pattern: '\\b(?:(?:25[0-5]|2[0-4]\\d|1?\\d?\\d)\\.){3}(?:25[0-5]|2[0-4]\\d|1?\\d?\\d)\\b' }],
 };
 
 async function loadTags() {

web/index.html

@@ -193,11 +193,28 @@
                   <button id="addTag" class="btn primary" type="button" data-i18n="addTag">+ Add tag</button>
                   <select id="presetTags" class="field" aria-label="Presets" data-i18n-aria="presetAria">
                     <option value="" data-i18n="presetPick">+ Preset…</option>
-                    <option value="http_status" data-i18n="preset_http_status">HTTP status codes</option>
-                    <option value="http_methods" data-i18n="preset_http_methods">HTTP methods</option>
-                    <option value="http_probes" data-i18n="preset_http_probes">Probes and attacks</option>
-                    <option value="http_bots" data-i18n="preset_http_bots">Bots and scripts</option>
-                    <option value="http_errors" data-i18n="preset_http_errors">TLS/HTTPS and proxy errors</option>
+                    <optgroup label="HTTP/HTTPS">
+                      <option value="http_status" data-i18n="preset_http_status">HTTP status codes</option>
+                      <option value="http_methods" data-i18n="preset_http_methods">HTTP methods</option>
+                      <option value="http_probes" data-i18n="preset_http_probes">Probes and attacks</option>
+                      <option value="http_bots" data-i18n="preset_http_bots">Bots and scripts</option>
+                      <option value="http_errors" data-i18n="preset_http_errors">TLS/HTTPS and proxy errors</option>
+                    </optgroup>
+                    <optgroup label="System" data-i18n-label="presetGroupSys">
+                      <option value="sys_auth" data-i18n="preset_sys_auth">SSH and logins</option>
+                      <option value="sys_sudo" data-i18n="preset_sys_sudo">sudo commands</option>
+                      <option value="sys_kernel" data-i18n="preset_sys_kernel">Kernel: OOM, crashes, disks</option>
+                      <option value="sys_systemd" data-i18n="preset_sys_systemd">systemd services</option>
+                      <option value="sys_firewall" data-i18n="preset_sys_firewall">Firewall and fail2ban</option>
+                    </optgroup>
+                    <optgroup label="Applications" data-i18n-label="presetGroupApps">
+                      <option value="app_docker" data-i18n="preset_app_docker">Docker and containers</option>
+                      <option value="app_db" data-i18n="preset_app_db">Databases</option>
+                    </optgroup>
+                    <optgroup label="General" data-i18n-label="presetGroupGen">
+                      <option value="gen_levels" data-i18n="preset_gen_levels">Log levels</option>
+                      <option value="gen_ip" data-i18n="preset_gen_ip">IPv4 addresses</option>
+                    </optgroup>
                   </select>
                 </span>
                 <button id="resetTags" class="btn ghost" type="button" data-i18n="resetTags">Restore default tags</button>