Hi,  first, you should not that in Smarts' wildcard patterns, the char * doesn't mean the same thing as usual (POSIX) regex. * means _any_ character, not a repetition in your pattern matching there is a risk of false positive (although it is low because of the complete wildcard)  now, the issue in your case seems to be the missing * at the end of your wilcard. Because without this, it will not try to "match" the rest of the string.  HTH,  --Fred  == APG5 ReportPack4Event for Smarts can report on millions of notifications in seconds == Frederic Meunier Solutions Watch4Net Inc APG & Smarts InCharge integration [URL]
I want to filter out the Interface Down alarms that are coming in from the async ports on our 3662 and 2610 routers. I wrote a filter but its only filtering out part of the alarms (45%) . This is my first post so if I should be somewhere else please let me know.  Sample alarms:   IF-SLLKWAXA-3662M01/12 [As197] [Console Port access to SLLKWAXA06W-2950U02] IF-SMTRSCXA-3662M01/20 [As197] IF-SMRWORXA-3662M01/33 [As202] [Console Port access for Firewall #2] IF-RCMDINXB-3662M01/19 [As200] IF-TGRDORXC-3662M01/32 [As201] [Console Port access for Firewall #2] IF-RGCYMIXG-3662M01/8 [As193] [Learn port ] IF-SMRWORXA-2610M01/13 [As43] [console access for Juniper E320] IF-SLLKWAXA-3662M01/22 [As207] [SLLKWAXA-2924M03 Console Port] IF-RDMDWAXA-3662M01/23 [As208] [RDMDWAXA-2924M02 Console Port] IF-THRRMIXT-3662M01/36 [As205]   My filter: ~IF-[A-Z]*-3662M01\/[0-9]*\ \[As[0-9][0-9][0-9]\]  Alarms not being filtered out:  IF-SMRWORXA-3662M01/31 [As200] [Console Port access for Cisco 2610 TS] IF-SNPRWIXA-3662M01/35 [As208] [Console Port Access To AIVORTEX-140TD] IF-WAUSWIXA-3662M01/23 [As196] [Console access for E911 CISC 2811 #2 S6/3] IF-RNTLILXC-3662M01/8 [As193] [Console Access to S6/0 DN7100 ATM SWITCH] IF-TGRDORXA-3662M01/14 [As195] [Console Port access to TGRDORXA-2950U01]   I cant seem to find the difference between the entries. 
Alarm filtering expression not working for all alarms.