I have just found the answer to my own question by trial and error: @@ Peter ________________________________ From: Peter Mills Sent: 17 September 2010 09:56 To: syslog-ng@lists.balabit.hu. Cc: Sam Moore Subject: Matching against an embedded @ Since @ is a special character, how do you match against strings containing an @? Do you escape them e.g. \@ in order to parse them correctly? I am trying to skip over/match the string [wx-event@juniper.net and have had no success. Thanks Peter root@nagios-collector:/opt/syslog-ng/var <mailto:root@nagios-collector:/opt/syslog-ng/var> # /opt/syslog-ng/bin/pdbtool match -D -c -p /opt/syslog-ng/var/db/patterns/v1/test2.xml -M "- - WXC-192.168.61.202 register 1102 [wx-event@juniper.net eventtime="1284641119" metric="Primary Reg Server Unreachable" sev="major" type="sys"] REG: Self registration failed. IP=192.168.61.242" Pattern matching part: - - WXC-@IPv4:.wxc.host_ip=192.168.61.202 <mailto:WXC-@IPv4:.wxc.host_ip=192.168.61.202> @ @STRING:.wxc.process=register@ @NUMBER:.wxc.pid=1102@ @ANYSTRING:rest=[wx-event@juniper.net eventtime=1284641119 metric=Primary@ Matching part: - - WXC-192.168.61.202 register 1102 [wx-event@juniper.net eventtime=1284641119 metric=Primary Values: MESSAGE=- - WXC-192.168.61.202 register 1102 [wx-event@juniper.net eventtime=1284641119 metric=Primary .classifier.class=system .classifier.rule_id=1 .wxc.host_ip=192.168.61.202 .wxc.process=register .wxc.pid=1102 rest=[wx-event@juniper.net eventtime=1284641119 metric=Primary Imtech Telecom Global is a limited company registered in England and Wales. Registered number: GB04407184. Registered office: Viables 3, Jays Close, Basingstoke, Hampshire, RG22 4BS. ______________________________________________________________________ This email has been scanned by the MessageLabs Email Security System. For more information please visit http://www.messagelabs.com/email ______________________________________________________________________