Try:

/%OSPF-\d-(…CHANGE)/

Also, you’re matching on the program I guess? That doesn’t work, it only matches against the message

Mine is much simpler, and looks like this:

http://www.maartenmoerman.nl/screenshots/339b57594a065588be5970eb.png

Maarten

From: observium <observium-bounces@observium.org> on behalf of Serghei Golipad <s.golipad@uk.cdw.com>
Reply-To: Observium Network Observation System <observium@observium.org>
Date: Thursday, July 28, 2016 at 3:48 PM
To: Observium Network Observation System <observium@observium.org>
Subject: Re: [Observium] Syslog Rules

Hi,

 

Rule Name: OSPF State Change

Message: Not sure what that  is, presumably email body message?

Regex: %OSPF-\d-(...CHANGE)

 

Cheers

 

 

From: observium [mailto:observium-bounces@observium.org] On Behalf Of Moerman, Maarten
Sent: 28 July 2016 14:45
To: Observium Network Observation System <observium@observium.org>
Subject: Re: [Observium] Syslog Rules

 

Hi,

 

I’ve not seen that message yet. What does the rule look like?

 

Maarten

-- 

Maarten Moerman | Mgr, Network Engineering | eBay Classifieds | +31-655122247 | mmoerman@ebay.com

 

 

 

 

 

From: observium <observium-bounces@observium.org> on behalf of Serghei Golipad <s.golipad@uk.cdw.com>
Reply-To: Observium Network Observation System <observium@observium.org>
Date: Thursday, July 28, 2016 at 3:25 PM
To: Observium Network Observation System <observium@observium.org>
Subject: [Observium] Syslog Rules

 

Hi Guys,

 

Having issue with creating a syslog alert rule, getting the following error

 

Failed to create new rule. Incorrect rule passed.

 

Anyone else had this before?

 

Thanks




PLEASE CONSIDER THE ENVIRONMENT BEFORE PRINTING THIS EMAIL.

CDW Limited is a Company registered in England and Wales.
This email is sent for and on behalf of CDW Finance Holdings Limited. CDW Finance Holdings Limited is the UK holding company for CDW Limited trading as CDW. The registered office for CDW Finance Holdings Limited (Company Number 05872067) and its UK group undertakings is 10 Fleet Place, London, EC4M 7RB. VAT Registration 902 1949 39.
Confidentiality: This e-mail contains proprietary information, some or all of which may be confidential and/or legally privileged. It is for the intended recipient only. If an addressing or transmission error has misdirected this e-mail, please notify the author by replying to this e-mail and then delete the original. If you are not the intended recipient you may not use, disclose, distribute, copy, print or rely on any information contained in this e-mail. You must not inform any other person other than CDW or the sender of its existence.

For more information about CDW please visit www.uk.cdw.com