I am editing the local_rules.xml file and have been using <match> to change the alert level of some events. I want to switch to <regex> to consolidate the numerous types of capitalization and other minor differences between servers. I am stuck on getting the evaluation to ignore case.
As an example: 'C:\WINDOWS/system32/CCM/ServiceData/Messaging/EndpointQueues/CertificateMaintenanceEndpoint/000000HV.msg' <regex>/'C:[\\/]WIN(nt\|dows)[\\/]system32[\\/]CCM[\\/]ServiceData[\\/]Messaging/i</regex> My goal with this expression was to match 'C:\WINDOWS/system32/CCM/ServiceData/Messaging I believe the reason that it is not matching is because of capitalization which I thought the /i flag would take care of. Does anyone know if there is a way to get the regex to ignore case? Duane
