Thank you! I've fixed the offending test. Not knowing how to make it stop being blue/purple was the biggest problem, which you've also answered
pcre compile 'your-pattern-here' failed (offset N): <error message> No errors with pcre anywhere in the log directory (possibly because it crashed first) Don't have a xymond_client log, do have a hobbitclient.log but it's empty.
Ideally what I want to do is this: Ignore *any* errors from lpr go yellow on any level of error from puppet or gmond go yellow on any other "warning" message go red on any other "error" message
I think I need to use "greedier" regexp's for the match that include white space - am I understanding correctly that if I match on %ERROR then only the string "error" gets passed to the IGNORE statement?
thanks Betsy PS I would enjoy seeing other people's LOG tests if anyone has good ones