Everything ok with your syntax, i just would try removing the double-quotes...

BTW, If you need to ignore a phrase that uses spaces, use \s to separate, like the following syntax: LOG blablabla %blablabla IGNORE=%one\stwo\swords

Another example: IGNORE=%one\stwo|other\sword|word

Cheers

Asif Iqbal wrote:

Is this a valid syntax?

LOG /var/adm/messages "%(?-i)WARNING|(?-i)NOTICE|(?-i)ERROR" IGNORE=%SUNWsrspx|srsxfer

I want no alert for lines, in `/var/adm/messages', that has either or both of these two words

SUNWsrspx srsxfer

Thanks

--

Asif Iqbal PGP Key: 0xE62693C5 KeyServer: pgp.mit.edu <http://pgp.mit.edu>