I know for a fact that TEXT requires the quotes around the whole thing, as shown on line 303 of analysis.cfg, comments:

Example: Check that at least 5 "ssh" connections are established, but

not more than 10; warn but do not error; graph the connection count:

PORT "LOCAL=%([.:]22)$" state=ESTABLISHED min=5 max=20 color=yellow

TRACK= ssh "TEXT=SSH logins"

And I have the quotes around other TRACK entries that are working fine. It would be bad from a consistency standpoint to have TEXT and TRACK be different.

I'll check the dump-config.

Thanks, Paul.

D'oh! I'm definitely wrong here then... :)

-jc