Only enable the IP regex rule when running show ip route or show access-list . For general logs, it might highlight too many false positives (like decimal numbers). Create two separate highlight sets – one for "config review" and one for "log monitoring." Category 5: Cisco Specific Debug & Syntax (Gray/White) These highlight the structure of Cisco CLI, making it scannable.
| Purpose | Regex Pattern | Style | | :--- | :--- | :--- | | Interface Down | \b(?:down|DOWN|down/down)\b | Red text, Bold | | Error-Disabled | err-disable|errdisabled|error-disable | White text, Red background, Bold | | Shutdown | administratively down|shutdown | Dark Red text | | Routing Loss | neighbor down|flapping|reset | Red text, Underline | | Crash | %SYS-2-MALLOCFAIL|%CORE|Stack Overflow | Red background, Yellow text | xshell highlight sets cisco
When show process cpu history runs, the line with "75%" will not trigger, but if the text "high utilization" appears in a log, it will pop. Category 3: Success & Healthy States (Green/Cyan) Instant positive confirmation. Useful for auditing configs or monitoring. Only enable the IP regex rule when running