I had the same problem with this synthax. I have resolved it by using this synthax :The 'hobbit-clients.cfg' man page give this example: LOG /var/log/daemon.log %WARNING|NOTICE COLOR=yellow IGNORE=lpr
This is identical to mine except the actual log file name and strings.
log /var/log/messages %WARNING|NOTICE|ERROR yellow "IGNORE=relabeling"
-> no use of COLOR= keyword
-> use of quote (") on the ignore keyword and string.Cdl
Olivier