James,
You need to have the '%' sign in front of your alert for it to be treated as
a regular expression.
In your examples:
HOST=%(sys002|sys003|sys004|sys005|sys3001|nu002|net003| \
u004|unx013|net004|com001|com003|com004|com005| \
unx006|unx012|com002) SERVICE=conn,disk,http,ldap,ports,memory
MAIL user-d157b1fa169f@xymon.invalid REPEAT=20 COLOR=RED RECOVERED
MAIL user-c67864fdccfd@xymon.invalid REPEAT=20 COLOR=RED,YELLOW RECOVERED
MAIL user-e1c0060939f2@xymon.invalid REPEAT=20 COLOR=RED RECOVERED
MAIL user-29042ac8a40c@xymon.invalid REPEAT=20 COLOR=RED,YELLOW RECOVERED
and
HOST=%sysdu* SERVICE=conn,disk
MAIL user-cf1d1f6c9046@xymon.invalid REPEAT=90 COLOR=RED RECOVERED
HOST=%unixdu* SERVICE=conn,disk
MAIL user-3e74c9666a7c@xymon.invalid REPEAT=90 COLOR=RED RECOVERED
Jeff