Take out the extra quotes and try it again "Application, error,1440,1,"Backup exec",0,0" "Application, error,1440,1,Backup exec,0,0" Since it is Comma delimited it does not need the extra quotes Also please use EVENTLOG_NEW if posible since it is more efficient. However it uses a slightly different syntex Tony (Author of NC_NEt) <div class="gmail_quote">On Dec 17, 2007 5:55 AM, Ronan REYNAUD <<a href="mailto:R.REYNAUD@omr.fr">R.REYNAUD@omr.fr</a>> wrote: <blockquote class="gmail_quote" style="PADDING-LEFT: 1ex; MARGIN: 0px 0px 0px 0.8ex; BORDER-LEFT: #ccc 1px solid">Hi I've set Nc_Net on a 2003server, and I can read the Application Log From my nagios-server : ./check_nt -H 192.168.x.X -s "None" -v EVENTLOG -w 1 -c 2 -l "Application, error,1440,0,0,0" .. and I get my results, every errors within 1440 mn. OK. I want only some errors based on the Event Source (ie WINSCTRS or Backup Exec ), and I tried to use the filter : ./check_nt -H 192.168.x.X -s "None" -v EVENTLOG -w 1 -c 2 -l "Application, error,1440,1,"Backup exec",0,0" .. then I get "no error" (But I know there are errors) I guess I should use some regexp, but can't figure how to write them. (I tried many search in the documentation and on the web, with no luck) Any clue, please ? Thanks Ronan ------------------------------------------------------------------------- SF.Net email is sponsored by: Check out the new SourceForge.net Marketplace. It's the best place to buy or sell services for just about anything Open Source. <a href="http://ad.doubleclick.net/clk;164216239;13503038;w?http://sf.net/marketplace" target="_blank"> http://ad.doubleclick.net/clk;164216239;13503038;w?http://sf.net/marketplace</a> _______________________________________________ Nagios-users mailing list <a href="mailto:Nagios-users@lists.sourceforge.net">Nagios-users@lists.sourceforge.net </a> <a href="https://lists.sourceforge.net/lists/listinfo/nagios-users" target="_blank">https://lists.sourceforge.net/lists/listinfo/nagios-users</a> ::: Please include Nagios version, plugin version (-v) and OS when reporting any issue. ::: Messages without supporting info will risk being sent to /dev/null </blockquote></div>