prefix=%date:date-rfc3164% %host:word% %seqnum:number%: %othseq:char-to:\x3a%: %%%tag:char-to:\x3a%:

rule=: Configured from console by %tty:word:% (%ip:ipv4%)

rule=: Authentication failure for %proto:word% req from host %ip:ipv4%

rule=: Interface %interface:char-to:,%, changed state to %state:word%

rule=: Line protocol on Interface %interface:char-to:,%, changed state to %state:word%

rule=: Attempted to connect to %servname:word% from %ip:ipv4%

# too-generic syntaces (like %port:word% below) cause problems.

# Best is to have very specific syntaxes, but as an

# interim solution we may need to backtrack if there is no other way to handle it.

#: %port:word% transmit error