syntax for log monitoring with spaces?

[Craig Cook]

In hobbit-clients.cfg I have this defined

HOST=sun.example.com
   LOG /var/adm/messages %error|panic|ERROR|half-duplex|failing|transport failed|responding|core|NOTICE|offlin COLOR=red IGNORE=%upload|External request
 already in progress|pam_dial_auth
   LOG /var/adm/messages %(WARNING|xntpd) COLOR=yellow

(The first LOG line is a single line in hobbit-clients.cfg)

But, I get alarms like this:

System logs at Fri Dec 19 08:42:16 EST 2008

red Critical entries in /var/adm/messages
red Dec 19 08:09:41 sun bpjava-msvc[5400]: [ID 427199 user.error] pam_dial_auth: terminal-device not specifiedby login, returning Error in underlying service module.
red Dec 19 08:31:09 sun bpjava-msvc[3963]: [ID 427199 user.error] pam_dial_auth: terminal-device not specifiedby login, returning Error in underlying service module.


Is my logic wrong?

(Hobbit Monitor 4.3.0-0.20080403)

Thanks

Craig
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.xymon.com/pipermail/xymon/attachments/20081219/0f05fe4a/attachment.html>