<html><head></head><body><div style="font-family:Helvetica Neue, Helvetica, Arial, sans-serif;font-size:10px;"><div style="font-family:Helvetica Neue, Helvetica, Arial, sans-serif;font-size:10px;"><div></div>
<div>Sorry Andy - I'm not with you?<br><span style="color: rgb(38, 40, 42); font-size: 13px;"><br></span></div><div><span style="color: rgb(38, 40, 42); font-size: 13px;">"Convert your rule in analysis.cfg from a glob to a regex :-</span><br></div></div><div id="ydp84287e93yahoo_quoted_4767778980" class="ydp84287e93yahoo_quoted"><div style="font-family:'Helvetica Neue', Helvetica, Arial, sans-serif;font-size:13px;color:#26282a;"><div><div class="ydp84287e93yqt1975644852" id="ydp84287e93yqtfd07799"><br clear="none">LOG %/var/log/messages.*.log "DIDDS"| COLOR=yellow"</div><div class="ydp84287e93yqt1975644852" id="ydp84287e93yqtfd07799"><br></div><div class="ydp84287e93yqt1975644852" id="ydp84287e93yqtfd07799">The file name is messages-YYMMDD.log - what you have above seems to be<br>mesages.<something>.log ? and the pipe ie "|" ?</div><div class="ydp84287e93yqt1975644852" id="ydp84287e93yqtfd07799"><br></div><div class="ydp84287e93yqt1975644852" id="ydp84287e93yqtfd07799">sorry to be so thick !<br><br>didds</div><div class="ydp84287e93yqt1975644852" id="ydp84287e93yqtfd07799"><br></div><div class="ydp84287e93yqt1975644852" id="ydp84287e93yqtfd07799"><br></div><div class="ydp84287e93yqt1975644852" id="ydp84287e93yqtfd23904"><br clear="none"></div></div>
</div>
</div></div></body></html>