wc -l /etc/wireguard/wgctl/core/lib/events.py
head -30 /etc/wireguard/wgctl/core/lib/events.py
673 /etc/wireguard/wgctl/core/lib/events.py
"""
events.py — WireGuard and firewall event processing.
"""

import os
import json
import sys
from collections import defaultdict
from datetime import datetime

from lib.util import (
    DATETIME_FMT, PROTO_MAP,
    build_ip_to_name, load_net_data, load_hosts_data,
    reverse_lookup, hosts_lookup, resolve_display,
    fmt_ts, fmt_ts_hour, ts_to_unix, parse_since,
    make_dest_display,
)


# ──────────────────────────────────────────
# fw_events
# ──────────────────────────────────────────

def fw_events(file, filter_ip, filter_type, clients_dir, net_file,
              limit, collapse='1', since='', filter_dest_ip='',
              filter_dest_port='', sort_order='desc', endpoint_cache_file=''):
    """
    Format firewall drop events with dedup, counts, and service annotation.

    collapse='1' (default): hourly aggregation