Pretty simple question, but the answer is eluding me. We have a logfile monitor that we want to check for the presence of Failed OR Error. How should the expression be built? I've selected Insert OR group, added Params/Param[1] Contains Failed and then added another expression, added Params/Param[1] Contains Error. I add Failed [cr] and Error [cr] and no event ever shows up. It will only show up if I have one parameter, even when I reset the monitor. Am I missing something? Thanks!

I suggest you use 'Matches Regular Expression' and do an OR comparion that way, which is done with the pipe symbox | . You'd want to copy a line from your log file and test your regular expression in a tool like the 'Regular Expression Workbench' which can be downloaded from one of the Microsoft properties (msdn if memory serves). Do a Bing search and you'll find the tool to help you test your regular expression logic.Pete Zerger, MVP-OpsMgr and SCE | http://www.systemcentercentral.com