I think your regular expressions are not right. Try runnign them through pcretest. > LOG /var/adm/messages %ERROR|WARNING COLOR=red IGNORE=TEST I think that should be %(ERROR|WARNING)