Hi there, On Wed, 3 Jan 2007 Marlier, Ian wrote:

... need to get rid of a couple of error messages that appear on a single host [snip] [and only those messages, defined as] host("hostX") AND (match("ERROR 1: error 1 text") or match("ERROR 2: error 2 text")) [snip]

filter f_errors1 { not host("hostX") and not (match("ERROR 1:") or match("ERROR 2")); };

I think you need: not ( host("hostX") and ( match("ERROR 1:") or match("ERROR 2:") ) )

filter f_errors2 { host("hostX") and match("ERROR 1:") or match("ERROR 2"); }; ... not filter(f_errors1) ...

This is also incorrect. You need f_errors2 { host("hostX") and (match("ERROR 1:") or match("ERROR 2")); }; and ... not filter(f_errors2) ... which I assume was just a typo. You really have to be careful with this stuff, it can bring your server down if you get it wrong.

(Perhaps more to the point, what am I totally messing up? :-))

Your logic. You need to read about the precedence of operators. Have a look at deMorgan's theorem too. But your ideas are sound. :) -- 73, Ged.