Some Quick Mutt Tips for Sysadmins

by Kyle Rankin

So I haven't written the followup to my previous "Introduction to Mutt" blog post, but until I get to that, I figured I should pass along a few timesaving tips I've discovered with mutt. These tips mostly appeal to system administrators, but I can see them being easily adapted to other uses...

Colorize errors and warnings in email

If you are a sysadmin, you likely find yourself running through quite a bit of email your servers have sent to you. Sometimes all of these messages can seem like a blur, especially if some of them aren't necessarily reporting errors. What I've found that if I colorize some "danger words" within the body of the email, they will naturally attract my attention when I'm skimming through it.

For starters I decided to colorize the word "warning" as bright yellow, and the word "error" as bright red, so I add the following to my .muttrc:

color body brightyellow default warning
color body brightred default error

In case you are unfamiliar with the syntax, the color configuration option in mutt takes as arguments where to colorize (in this case the body of a message), the foreground color, the background color, and then the pattern to colorize.

This caused a problem though, as the word "error" was being highlighted in the body of any email that had the phrase "no error" which was the opposite of what I wanted. So I had to add another rule after the above to fix that:

color body white default 'no error'

Finally, I decided that different iterations of the word "fail' should also jump out at me. Mutt supports regular expressions for patterns, so the following line will match the words 'fail,' 'failure,' and 'failed':

color body brightred default "fail(ure|ed)?"

These of course are the few keywords I wanted to stand out, but you could easily add your own keywords to the list and colorize them how you want.

Limit the Index to Error Email

The above method works great--whenever an email contains those key words, they immediately jump out at me, but there was still a problem. I noticed with a huge body of email, I would spend a lot of time filtering through email that contained no errors before I got to the email I needed to pay attention to. The solution I came up with was to use mutt's limit function (hit 'l') to limit my index to email that matched a certain pattern. That way I could read the email that contained key words first, and then type 'l.' to view all of the rest of the email (typing 'l.' will tell mutt to limit the index to all messages matching '.' which matches everything).

What I ended up with was a macro bound to the F3 key that contained a rather large regular expression. The following will limit the index to all new messages (no need to read through the old error emails again) that contained the keywords 'error' or 'fail' or 'FAIL' in the body:

macro index <F3> "l~N ~b \"([\^nN][\^oO].error|[Ff][Aa][Ii][Ll])\""

Note that I also added an extra bit to weed out those pesky messages that said 'no error'. Now when I go to one of my email folders that contain log output (you filter mail from computers to different folders than you do people, right?) I just hit F3 to read through the important email first, then hit 'l.' to read through the rest.

How do you weed out the important email from the less important with mutt?


Big Ray
2006-02-23 12:52:59
I'm waiting for the "Mutt Hacks" book. :-)
2006-04-27 01:09:19
hello everybody