Xshell Highlight Sets Jun 2026

By default, Xshell highlights only the matching word. To highlight the whole line, use ^.* before and after your keyword. ^.*ERROR.*$ – This will color the entire line red if it contains "ERROR".

[Highlight Set: MyLogs] Rule1 = "ERROR" : fg=white bg=red bold Rule2 = "WARNING" : fg=yellow Rule3 = "SUCCESS" : fg=green Rule4 = "\b[0-9]+\.[0-9]+ms\b" : fg=blue underline (regex) CaseSensitive = true Enabled = true xshell highlight sets

There’s craft in building a useful set. Start with purpose: what recurring signals do you miss? Then make rules surgical rather than noisy. A rule that matches an overly broad term—“error,” unqualified—will paint the screen so often that the color loses meaning. Better to match “ERROR [Auth]” or “segfault” or a specific exception name. Balance is key: reserve bright colors for the most urgent items and subtler shades for context. Use background highlighting sparingly; it reads strongly and can overwhelm. Combine regex power with negative lookaheads where supported so you avoid false positives. Importantly, test changes in a low-risk environment—once you begin to rely on highlight cues, a broken pattern can lull you into missing real alerts. By default, Xshell highlights only the matching word

| Pattern | Highlight Color | Purpose | |---------|----------------|---------| | \b(curl|wget|nc|ncat|bash -i|sh -i)\b | 🔴 Red + Bold | Reverse shell / downloader | | (failed|denied|invalid|unauthorized) | 🟡 Yellow | Auth failures | | (root|admin|sudo|su) followed by (accepted|logged) | 🟢 Green + Bold | Privileged access success | | (SELECT.*FROM|DROP TABLE|INSERT INTO) | 🟣 Magenta | SQL injection in logs | | (\.\./|\%2e\%2e/) | 🔵 Cyan | Path traversal attempt | | (passwd|shadow|\.ssh|\.bashrc) | 🟠 Orange | Sensitive file access | | (\d1,3\.)3\d1,3 | 🟡 Dim yellow | IP addresses (less intrusive) | | (chmod 777|chmod 666) | 🔴 Red + Underline | Dangerous permissions | [Highlight Set: MyLogs] Rule1 = "ERROR" : fg=white

Unlike static themes that change the color of the entire background, highlight sets are . They only trigger when specific data—like "Error," "Failed," or a specific IP—appears. Why You Should Use Highlight Sets

Great for making log timestamps stand out.