On Sat 2009.05.23 at 00:15 -0400, Brian Gupta wrote: > I've used Simple Event Correlator in the past for this. > http://www.estpak.ee/~risto/sec/ It's basically swatch on crack. i'll second using sec, as well as risto's logpp.