logscanner ignore help

[rick111]

/var/log/messages:
Oct 3 14:57:01 mail auditd[1882]: Audit daemon rotating log files

ignore rule: ^(\S+|\S+\s+\d+\s+\S+) [^\s\.]+ mail auditd\[\d+\]:

Still reporting though?

[rick111]

^(\S+|\S+\s+\d+\s+\S+) [^\s\.]+ [^\s\.]+ mail auditd\[\d+\]: Audit daemon rotating log files

If I don't post back again, it's because the above has worked.