I think you have to use metachars instead of spaces if you are using a
regex, so try this:
LOG /var/adm/messages %(?-i)NOTICE|WARNING|Error
IGNORE="%setuid.execution.not.allowed" COLOR=yellow
or even "%setuid.*allowed".
You may also have to put quotes around the previous regex.
-Charles
James Wade wrote:
I can't get the ignore working. Is this syntax wrong:
HOST=sau102
LOG /var/adm/messages %(?-i)NOTICE|WARNING|Error
IGNORE="%setuid execution not allowed" COLOR=yellow
Thie above is in the hobbit-clients.cfg file.