problem with LOG and IGNORE in analysis.cfg

I think your regular expressions are not right. Try runnign them
through pcretest.

               LOG /var/adm/messages %ERROR|WARNING COLOR=red IGNORE=TEST

I think that should be %(ERROR|WARNING)