golden hour

/opt/osquery/share/osquery/lenses

File/Folder	Size	Actions
COPYING	25.91 KB
access.aug	3.58 KB
activemq_conf.aug	1.47 KB
activemq_xml.aug	864 B
afs_cellalias.aug	1.56 KB
aliases.aug	2.18 KB
anaconda.aug	775 B
anacron.aug	2.49 KB
approx.aug	1.26 KB
apt_update_manager.aug	1.11 KB
aptcacherngsecurity.aug	726 B
aptconf.aug	3.9 KB
aptpreferences.aug	1.79 KB
aptsources.aug	1.98 KB
authorized_keys.aug	1.84 KB
automaster.aug	3.31 KB
automounter.aug	4.05 KB
avahi.aug	1.38 KB
backuppchosts.aug	1014 B
bbhosts.aug	4.24 KB
bootconf.aug	3.65 KB
build.aug	16.65 KB
cachefilesd.aug	2 KB
carbon.aug	1.54 KB
ceph.aug	719 B
cgconfig.aug	3.37 KB
cgrules.aug	2.38 KB
channels.aug	3.84 KB
chrony.aug	12.87 KB
clamav.aug	1.53 KB
cobblermodules.aug	398 B
cobblersettings.aug	2.24 KB
collectd.aug	869 B
cpanel.aug	824 B
cron.aug	4.05 KB
cron_user.aug	1.26 KB
crypttab.aug	3.01 KB
csv.aug	1.18 KB
cups.aug	459 B
cyrus_imapd.aug	1.51 KB
darkice.aug	773 B
debctrl.aug	3.61 KB
desktop.aug	1.39 KB
devfsrules.aug	619 B
device_map.aug	620 B
dhclient.aug	6.69 KB
dhcpd.aug	20.88 KB
dns_zone.aug	2.89 KB
dnsmasq.aug	2.16 KB
dovecot.aug	3.98 KB
dpkg.aug	2.78 KB
dput.aug	2.16 KB
erlang.aug	4.33 KB
ethers.aug	663 B
exports.aug	2.37 KB
fai_diskconfig.aug	9.28 KB
fonts.aug	819 B
fstab.aug	1.23 KB
fuse.aug	871 B
gdm.aug	1.8 KB
getcap.aug	1.57 KB
group.aug	1.66 KB
grub.aug	11.04 KB
grubenv.aug	508 B
gshadow.aug	2.19 KB
gtkbookmarks.aug	855 B
host_conf.aug	1.9 KB
hostname.aug	435 B
hosts.aug	485 B
hosts_access.aug	4.32 KB
htpasswd.aug	1.02 KB
httpd.aug	7.35 KB
inetd.aug	6.22 KB
inifile.aug	15.49 KB
inittab.aug	780 B
inputrc.aug	1.62 KB
interfaces.aug	4.62 KB
iproute2.aug	323 B
iptables.aug	2.64 KB
iscsid.aug	684 B
jaas.aug	1.57 KB
jettyrealm.aug	1.52 KB
jmxaccess.aug	1.35 KB
jmxpassword.aug	1.34 KB
json.aug	2.15 KB
kdump.aug	2.91 KB
keepalived.aug	10.7 KB
known_hosts.aug	1.93 KB
koji.aug	898 B
krb5.aug	6.16 KB
ldif.aug	7.65 KB
ldso.aug	1.06 KB
lightdm.aug	1.75 KB
limits.aug	2.02 KB
login_defs.aug	615 B
logrotate.aug	4.22 KB
logwatch.aug	1.44 KB
lokkit.aug	2.16 KB
lvm.aug	2.03 KB
mailscanner.aug	1.66 KB
mailscanner_rules.aug	2.84 KB
masterpasswd.aug	4.36 KB
mcollective.aug	1.09 KB
mdadm_conf.aug	10.05 KB
memcached.aug	1.24 KB
mke2fs.aug	4.67 KB
modprobe.aug	3.34 KB
modules.aug	741 B
modules_conf.aug	1.04 KB
mongodbserver.aug	1.17 KB
monit.aug	2.13 KB
multipath.aug	4.21 KB
mysql.aug	1.95 KB
nagioscfg.aug	2.09 KB
nagiosobjects.aug	1.57 KB
netmasks.aug	1.69 KB
networkmanager.aug	2 KB
networks.aug	1.09 KB
nginx.aug	3.65 KB
nrpe.aug	1.75 KB
nslcd.aug	9.87 KB
nsswitch.aug	2.33 KB
ntp.aug	5.29 KB
ntpd.aug	4.75 KB
odbc.aug	1.42 KB
opendkim.aug	3.08 KB
openshift_config.aug	2.46 KB
openshift_http.aug	1.03 KB
openshift_quickstarts.aug	1.02 KB
openvpn.aug	22.28 KB
oz.aug	1.35 KB
pagekite.aug	2.6 KB
pam.aug	2.58 KB
pamconf.aug	1.23 KB
passwd.aug	3.52 KB
pbuilder.aug	638 B
pg_hba.aug	2.97 KB
pgbouncer.aug	1.43 KB
php.aug	2.34 KB
phpvars.aug	3.85 KB
postfix_access.aug	771 B
postfix_main.aug	1.52 KB
postfix_master.aug	1.9 KB
postfix_passwordmap.aug	1.28 KB
postfix_sasl_smtpd.aug	697 B
postfix_transport.aug	1.48 KB
postfix_virtual.aug	1.32 KB
postgresql.aug	2.1 KB
properties.aug	2.3 KB
protocols.aug	1.05 KB
puppet.aug	1.52 KB
puppet_auth.aug	1.95 KB
puppetfile.aug	2.27 KB
puppetfileserver.aug	3.12 KB
pylonspaste.aug	2.3 KB
pythonpaste.aug	1.99 KB
qpid.aug	670 B
quote.aug	6.71 KB
rabbitmq.aug	4.69 KB
radicale.aug	1.48 KB
rancid.aug	927 B
redis.aug	4.96 KB
reprepro_uploaders.aug	5.47 KB
resolv.aug	3.87 KB
rhsm.aug	1.1 KB
rmt.aug	788 B
rsyncd.aug	1.97 KB
rsyslog.aug	3.17 KB
rtadvd.aug	854 B
rx.aug	4.06 KB
samba.aug	1.71 KB
schroot.aug	1.79 KB
securetty.aug	450 B
semanage.aug	859 B
sep.aug	1.28 KB
services.aug	2.82 KB
shadow.aug	2.35 KB
shells.aug	745 B
shellvars.aug	11.97 KB
shellvars_list.aug	1.74 KB
simplelines.aug	1.13 KB
simplevars.aug	1.34 KB
sip_conf.aug	1.61 KB
slapd.aug	5.2 KB
smbusers.aug	781 B
solaris_system.aug	3.15 KB
soma.aug	1.14 KB
spacevars.aug	1.42 KB
splunk.aug	1.64 KB
squid.aug	15.95 KB
ssh.aug	3.91 KB
sshd.aug	4.01 KB
sssd.aug	861 B
star.aug	941 B
strongswan.aug	1.63 KB
stunnel.aug	2.21 KB
subversion.aug	2.75 KB
sudoers.aug	20.03 KB
sysconfig.aug	2.49 KB
sysconfig_route.aug	2.55 KB
sysctl.aug	923 B
syslog.aug	7.33 KB
systemd.aug	5.88 KB
termcap.aug	1.03 KB
thttpd.aug	1.31 KB
tmpfiles.aug	3.03 KB
toml.aug	4.06 KB
trapperkeeper.aug	4.01 KB
tuned.aug	387 B
up2date.aug	2.21 KB
updatedb.aug	1.13 KB
util.aug	4.85 KB
vfstab.aug	1.71 KB
vmware_config.aug	702 B
vsftpd.aug	2.72 KB
webmin.aug	1.23 KB
wine.aug	1.92 KB
xendconfsxp.aug	1.07 KB
xinetd.aug	4.02 KB
xml.aug	6.33 KB
xorg.aug	10.43 KB
xymon.aug	2.26 KB
xymon_alerting.aug	6.11 KB
yaml.aug	1.54 KB
yum.aug	2.19 KB

Edit: xorg.aug

(*
Module: Xorg
 Parses /etc/X11/xorg.conf

Authors: Raphael Pinson <raphink@gmail.com>
         Matthew Booth <mbooth@redhat.com>

About: Reference
 This lens tries to keep as close as possible to `man xorg.conf` where
 possible.

The definitions from `man xorg.conf` are put as commentaries for reference
throughout the file. More information can be found in the manual.

About: License
  This file is licensed under the LGPLv2+, like the rest of Augeas.

About: Lens Usage
  Sample usage of this lens in augtool

* Get the identifier of the devices with a "Clone" option:
      > match "/files/etc/X11/xorg.conf/Device[Option = 'Clone']/Identifier"

About: Configuration files
  This lens applies to /etc/X11/xorg.conf. See <filter>.
*)

module Xorg =
  autoload xfm

(************************************************************************
 * Group:                 USEFUL PRIMITIVES
 *************************************************************************)

(* Group: Generic primitives *)

(* Variable: eol *)
let eol     = Util.eol

(* Variable: to_eol
 * Match everything from here to eol, cropping whitespace at both ends
 *)
let to_eol  = /[^ \t\n](.*[^ \t\n])?/

(* Variable: indent *)
let indent  = Util.indent

(* Variable: comment *)
let comment = Util.comment

(* Variable: empty *)
let empty   = Util.empty

(* Group: Separators *)

(* Variable: sep_spc *)
let sep_spc = Util.del_ws_spc

(* Variable: sep_dquote *)
let sep_dquote  = Util.del_str "\""

(* Group: Fields and values *)

(* Variable: generic_entry_re *)
let generic_entry_re = /[^# \t\n\/]+/ - entries_re

(* Variable: quoted_non_empty_string_val *)
let quoted_non_empty_string_val = del "\"" "\"" . store /[^"\n]+/
                                  . del "\"" "\""
                                              (* " relax, emacs *)

(* Variable: quoted_string_val *)
let quoted_string_val = del "\"" "\"" . store /[^"\n]*/ . del "\"" "\""
                                              (* " relax, emacs *)

(* Variable: int *)
let int = /[0-9]+/

(************************************************************************
 * Group:                          ENTRIES AND OPTIONS
 *************************************************************************)

(* View: entry_int
 * This matches an entry which takes a single integer for an argument
 *)
let entry_int (canon:string) (re:regexp) =
        [ indent . del re canon . label canon . sep_spc . store int . eol ]

(* View: entry_rgb
 * This matches an entry which takes 3 integers as arguments representing red,
 * green and blue components
 *)
let entry_rgb (canon:string) (re:regexp) =
        [ indent . del re canon . label canon
          . [ label "red"   . sep_spc . store int ]
          . [ label "green" . sep_spc . store int ]
          . [ label "blue"  . sep_spc . store int ]
          . eol ]

(* View: entry_xy
 * This matches an entry which takes 2 integers as arguments representing X and
 * Y coordinates
 *)
let entry_xy (canon:string) (re:regexp) =
        [ indent . del re canon . label canon
          . [ label "x" . sep_spc . store int ]
          . [ label "y" . sep_spc . store int ]
          . eol ]

(* View: entry_str
 * This matches an entry which takes a single quoted string
 *)
let entry_str (canon:string) (re:regexp) =
        [ indent . del re canon . label canon
          . sep_spc . quoted_non_empty_string_val . eol ]

(* View: entry_generic
 * An entry without a specific handler. Store everything after the keyword,
 * cropping whitespace at both ends.
 *)
let entry_generic  = [ indent . key generic_entry_re
                       . sep_spc . store to_eol . eol ]

(* View: option *)
let option = [ indent . del /[oO]ption/ "Option" . label "Option" . sep_spc
               . quoted_non_empty_string_val
               . [ label "value" . sep_spc . quoted_string_val ]*
               . eol ]

(* View: screen
 * The Screen entry of ServerLayout
 *)
let screen = [ indent . del /[sS]creen/ "Screen" . label "Screen"
               . [ sep_spc . label "num" . store int ]?
               . ( sep_spc . quoted_non_empty_string_val
               . [ sep_spc . label "position" . store to_eol ]? )?
               . eol ]

(* View: input_device *)
let input_device = [ indent . del /[iI]nput[dD]evice/ "InputDevice"
                     . label "InputDevice" . sep_spc
		     . quoted_non_empty_string_val
                     . [ label "option" . sep_spc
		         . quoted_non_empty_string_val ]*
                     . eol ]

(* View: driver *)
let driver = entry_str "Driver" /[dD]river/

(* View: identifier *)
let identifier = entry_str "Identifier" /[iI]dentifier/

(* View: videoram *)
let videoram = entry_int "VideoRam" /[vV]ideo[rR]am/

(* View: default_depth *)
let default_depth = entry_int "DefaultDepth" /[dD]efault[dD]epth/

(* View: device *)
let device = entry_str "Device" /[dD]evice/

(************************************************************************
 * Group:                          DISPLAY SUBSECTION
 *************************************************************************)

(* View: display_modes *)
let display_modes = [ indent . del /[mM]odes/ "Modes" . label "Modes"
                      . [ label "mode" . sep_spc
		          . quoted_non_empty_string_val ]+
                      . eol ]

(*************************************************************************
 * View: display_entry
 *   Known values for entries in the Display subsection
 *
 *   Definition:
 *     > Depth    depth
 *     > FbBpp    bpp
 *     > Weight   red-weight green-weight blue-weight
 *     > Virtual  xdim ydim
 *     > ViewPort x0 y0
 *     > Modes    "mode-name" ...
 *     > Visual   "visual-name"
 *     > Black    red green blue
 *     > White    red green blue
 *     > Options
 *)

(* View: display *)
let display = [ indent . del "SubSection" "SubSection" . sep_spc
                       . sep_dquote . key "Display" . sep_dquote
                       . eol
                       . display_entry*
                       . indent . del "EndSubSection" "EndSubSection" . eol ]

(************************************************************************
 * Group:                          EXTMOD SUBSECTION
 *************************************************************************)

let extmod_entry =  entry_str "Option"  /[oO]ption/ |
                    empty |
                    comment

let extmod = [ indent . del "SubSection" "SubSection" . sep_spc
                       . sep_dquote . key "extmod" . sep_dquote
                       . eol
                       . extmod_entry*
                       . indent . del "EndSubSection" "EndSubSection" . eol ]

(************************************************************************
 * Group:                       SECTIONS
 *************************************************************************)

(************************************************************************
 * Variable: section_re
 *   Known values for Section names
 *
 *   Definition:
 *     >   The section names are:
 *     >
 *     >   Files          File pathnames
 *     >   ServerFlags    Server flags
 *     >   Module         Dynamic module loading
 *     >   Extensions     Extension Enabling
 *     >   InputDevice    Input device description
 *     >   InputClass     Input Class description
 *     >   Device         Graphics device description
 *     >   VideoAdaptor   Xv video adaptor description
 *     >   Monitor        Monitor description
 *     >   Modes          Video modes descriptions
 *     >   Screen         Screen configuration
 *     >   ServerLayout   Overall layout
 *     >   DRI            DRI-specific configuration
 *     >   Vendor         Vendor-specific configuration
 *************************************************************************)
let section_re = /(Extensions|Files|ServerFlags|Module|InputDevice|InputClass|Device|VideoAdaptor|Monitor|Modes|Screen|ServerLayout|DRI|Vendor)/

(************************************************************************
 * Variable: secton_re_obsolete
 *   The  following obsolete section names are still recognised for
 *   compatibility purposes.  In new config files, the InputDevice
 *   section should be used instead.
 *
 *   Definition:
 *     >  Keyboard       Keyboard configuration
 *     >  Pointer        Pointer/mouse configuration
 *************************************************************************)
let section_re_obsolete = /(Keyboard|Pointer)/

(************************************************************************
 * View: section
 *   A section in xorg.conf
 *
 *   Definition:
 *     > Section  "SectionName"
 *     >    SectionEntry
 *     >    ...
 *     > EndSection
 *************************************************************************)
let section = [ indent . del "Section" "Section"
                       . sep_spc . sep_dquote
                       . key (section_re|section_re_obsolete) . sep_dquote
                       . eol
                .  section_entry*
                . indent . del "EndSection" "EndSection" . eol ]

(*
 * View: lns
 *   The xorg.conf lens
 *)
let lns = ( empty | comment | section )*

(* Variable: filter *)
let filter = incl "/etc/X11/xorg.conf"
           . incl "/etc/X11/xorg.conf.d/*.conf"
           . Util.stdexcl

let xfm = transform lns filter