Need syntax eyes on badtest entry

[Xymon User in Richmond]

I'm trying to give a little resiliency to reporting on an Outlook Web
Access server that intermittently returns bad https results without
visibly disrupting user services.  "badhttps" doesn't seem to be working
for me.  I have:

xx.xxx.xx.xxx   webmail.example.com # noconn noping
https://webmail.vita.example.com/Exchweb/bin/auth/owalogon.asp
badhttps:2:3:5 \
  COMMENT:"external prod Shared E-mail Web Interface"

IP and hostname are of course obfuscated.  It's on two lines, as indicated
by the "\".  But it still appears to go red on a single https failure. 
Can anyone out there point out my error?