On 14/07/11 15:31, Arran Cudbard-Bell wrote: >> >> >>> >>> Example condition... >>> if (SoH-MS-Windows-Health-Status =~ /antivirus (warn|error) /) { > > I'm not sure alternate submatches are supported. I'm fairly sure they are; we use them locally.