Formatting the Login/Logout Monitor

You can greatly customize how event report lines appear. You do this by putting a special format string into the shell parameter WATCHFMT. Like the various prompt parameters, many useful escape sequences can be used...

Straight from the man page... (almost) 

%n	The name of the user that logged in/out.
%a	The observed action, i.e. "logged on"  or  "logged
	off".
%l	The line (tty) the user is logged in on.
%M	The full hostname of the remote host.
%m	The hostname up to the first `.'.  If only the  IP
	address  is  available  or the utmp field contains
	the name of an X-windows display, the  whole  name
	is printed.

	NOTE:  The `%m' and `%M' escapes will work only if
	there  is  a  host  name field in the utmp on your
	machine.  Otherwise they are treated  as  ordinary
	strings.
%S (%s) 	Start (stop) standout mode.
%U (%u) 	Start (stop) underline mode.
%B (%b)		Start (stop) boldface mode.
%t or %@	The time, in 12-hour, am/pm format.
%T	The time, in 24-hour format.
%w	The date in `day-dd' format.
%W	The date in `mm/dd/yy' format.
%D	The date in `yy-mm-dd' format.
%(x:true-text:false-text)

This is very similar to the conditional tests in prompt strings. If x evaluates to true, format true-text and print it. If x evaluates to false, format false-text instead and print it.

The :'s can actually be any arbitrary character. The x is one of 'l'', 'n', 'm', 'M', or 'a'. These letrers evaluate to true if their corresponding escape sequence maps to a non-empty value. (IE, if %l evaluates to an empty string, then l is false in the conditional test. If %l is not empty, l is true.) a is a special case, often quite useful. It evaluates to true if the event is a login event, and false if the event is a logout event. A few notes: