On Thu, Sep 3, 2015, at 10:35, David Welker wrote: > Found the solution. This works... > > LOG %/var/(adm|log)/messages "%named.*?general.*?exiting" COLOR-=yellow > > Found it in a 2009 Xymon archive after some serious digging. :) > Could the wording in the analysis.cfg man page for LOG be improved in any way?