Ok, I have an apache error log that I want to put under swatch log monitoring, basically I want to get an email any time there is an error and I am not logged in under http authentication (my username is trutwijd). So I want a regex like: match on: /Anything that doesn't contain "trutwijd"/ I tried these: watchfor /^trutwijd/ watchfor /.*^trutwijd.*/ But neither works, they seem to not match anything. This should match: [Tue May 04 11:38:25 2004] [error] [client 64.83.223.150] user tclug: authentication failure for "/private": Password Mismatch This should not (because it's just me after all): [Tue May 04 11:38:25 2004] [error] [client 64.83.223.150] user trutwijd: authentication failure for "/private": Password Mismatch Any suggestions, Josh _______________________________________________ TCLUG Mailing List - Minneapolis/St. Paul, Minnesota http://www.mn-linux.org tclug-list at mn-linux.org https://mailman.real-time.com/mailman/listinfo/tclug-list