Do not use "/". The regex syntax follows Java Regex rules: http://download.oracle.com/javase/6/docs/api/java/util/regex/Pattern.html So try: ^\(AM\).* And even though I think ^ (matching start of string) should work - if you still can't get it to match, just try: .*\(AM\).* and see what happens On 01/13/2011 03:44 PM, Bala Nair wrote: > I am trying to monitor some legacy windows applications which use the > windows event log to notify of error conditions in the application. I > enabled event tracking on the windows platform for the server in > question and set the minimum severity level to Warning. I then verified > that windows event log events with severity warning and higher were > being collected as Rhq events. I then created an alert definition for > the windows platform resource that defined a single "If Condition" as > 'Event level(ERROR) and matching expression "/^\(AM\).*/"' I am assuming > that the regular expression is applied to the value in the event detail > and is perl like syntax. So I get events like this: > > > but I don't get an alert generated from these events. I've tried > different regular expressions, but nothing seems to work. Any idea what > I'm doing wrong? We're using the 3.0 release of RHQ and running the > agent as a windows service. Any help would be appreciated. Thanks. > > Bala Nair > Senior Engineer > SeaChange International > > > > _______________________________________________ > rhq-users mailing list > rhq-users(a)lists.fedorahosted.org > https://fedorahosted.org/mailman/listinfo/rhq-users _______________________________________________ rhq-users mailing list rhq-users(a)lists.fedorahosted.org https://fedorahosted.org/mailman/listinfo/rhq-users