Everything ok with your syntax, i just would try removing the double-quotes...
BTW, If you need to ignore a phrase that uses spaces, use \s to separate, like the following syntax:
LOG blablabla %blablabla IGNORE=%one\stwo\swords
Another example: IGNORE=%one\stwo|other\sword|word
Cheers
Asif Iqbal wrote:
Is this a valid syntax?
LOG /var/adm/messages "%(?-i)WARNING|(?-i)NOTICE|(?-i)ERROR" IGNORE=%SUNWsrspx|srsxfer
I want no alert for lines, in `/var/adm/messages', that has either or both of these two words
SUNWsrspx
srsxfer
Thanks
--
Asif Iqbal
PGP Key: 0xE62693C5 KeyServer: pgp.mit.edu <http://pgp.mit.edu>;