Have you tried it without the regular expression components? I've had a lot of problems getting those to work in analysis.cfg. Try it with just a straight string.

cheers, Phil

...

...

So, I got an email saying this:

&red %^syslog-ng$ (found 0, req. between 1 and 1)

Yet, in the process list in the same email is this:

PID PPID USER STARTED S PRI %CPU TIME %MEM RSZ VSZ CMD 11357 1 root May 20 S 24 23.3 1-05:57:01 0.2 10028 26356 syslog-ng

It seems when the CPU percentage gets to a certain level, Xymon no longer sees the process as valid.

Any ideas on fixing this?

Thanks! Skadz