Maybe I'm misunderstanding something.
<match>ERROR</match> matches ERROR and error <regex>^\.*ERROR\.*$</regex> matches "blah ERROR blah" and "blah error blah" I'd really like to be able to match capitalized ERROR and not match lower case error - that was one (perhaps not very clever) trick the developers of this application chose to distinguish between a big and a small error. Does ossec have case-insensitivity built into everything it does? Is there any way to get around this? Thanks, Barnaby
