I realised the solution came about via direct emails with Andy so here is the solution for posterity: Now the LOG config in analysis.cfg is simply :LOG %/var/log/messages.*.log "XXXX"  COLOR=yellow And the accompanying client-local.cfg entry is :[linux]log:/var/log/messages:10240log:`find /var/log -maxdepth 1 -type f -name messages-\*.log`:10240000000 The requirement was the regex wildcar .* not the glob of just *.  

Next question...

I now see if I place the trigger word DIDDS in an appropriate logfile xymon does spot it and  alert on it, and the GUI page shows the contents of the logfile as  <CURRENT> DIDDS

But after 10 minutes...  it drops the alert and the gui page no longer also lists those contents - in fact it shows nothing as the contents.

Anybody any ideas as to why this behaviour is seen.  These tests are at the moment using dummy logfilesd which have no other info in them.  It is literally only the line "DIDDS" which remains there.

If I add another line DIDDS once again it spots it and then alerts and shows it as  <CURRENT> DIDDS.

For ten minutes - then it all drops again...

any ideas why this is occurring?  

didds