Pass everything except what we KNOW is OK to ignore

 \#####################################################################
 \# This file tells swatch what to look for in /var/adm/messages \#
 \#####################################################################
 \# Created: 9/26/95 by ADMIN1
 \# Major revision: Reorganized lines into a more logical order (Admins: 1/19/96)
 \#####################################################################
 \# Here`s where you can drop a string to ignore something
 \# in case some machine jabbers too much!
 \# This is temporary ... don`t leave stuff in here for more
 \# than a week ... fix the REAL problem instead!!!! ADMIN1
 \#/HOST1 FDDIP0: afddi0 ring/ ignore
 \# Have left in place and added HOST1 for planned server outages to prevent
 \# expected swatch storms (ADMIN2: 4/18/96)
 \#/HOST2/ ignore
 \#####################################################################
 \## Put everything to be ignored first.
 \# Ignore ADMIN1 or ADMIN2 doing work on swatch (ADMIN2: 11/2/95)
 /su: `su swatch`.*for ADMIN2/ ignore
 /su: `su swatch`.*for ADMIN1/ ignore
 \# ISS folks working on XXX (hopefully) (ADMIN2: 3/20/96)
 /su: `su group1`.*DBA1/ ignore
 /su: `su group1`.*DBA2/ ignore
 \# Ignore sendmail unparseable null user (ADMIN2: 9/27/95)
 \# added because ADMIN1 doesn`t know why this occurs, but
 \# it does (and shouldn`t)
 /sendmail.*Unparseable user <> wants to be <>/ ignore
 \# Ignore repeated messages (ADMIN2: 10/10/95)
 /ast message repeat.*times/ ignore
 \# Ignore oz FDDI warning (ADMIN2: 11/01/95)
 \# per ADMIN1`s discussion with auspex, this message can be safely ignored
 /HOST1 FDDIP0: A_SIOCADDRT failed status = 17/ ignore
 \# This can probably be removed when HOST2 goes to Solaris 2.5
 \# Commented out since HOST2 is at Solaris 2.5 now (ADMIN2: 1/19/96)
 \# These are still occuring ... uncommented (ADMIN2: 1/25/96)
 /HOST2 syslogd: Bad terminal owner;.*but utmp says/ ignore
 /HOST3 syslogd: Bad terminal owner.*but utmp says/ ignore
 \# Filter xntpd messages status messages (ADMIN1: 1/4/96)
 /xntpd/ ignore
 \# ADMIN3 can`t figure out why this happens (ADMIN2: 2/23/96)
 \# Uncommenting ... haven`t seen these for a while (ADMIN2: 10/24/96)
 /HOST2 automountd.* \/etc\/mnttab: No such file or directory/ ignore
 \# Some cron jobs that don`t need to run as root do this (ADMIN2: 2/28/96)
 \# ADMIN1 made this generic (i.e. no longer HOST2 specific), 5/6/96
 /su: `su nobody` succeeded for root/ ignore
 \# Don`t need to see HOST5 stuff (build/inst node - HOST4 too(?) ADMIN1, 4/9/96
 \# Added HOST4 (ADMIN2: 4/10/96)
 /HOST4 poweroff: poweroffed by/ ignore
 /HOST5 poweroff: poweroffed by/ ignore
 /HOST4 halt: halted by/ ignore
 /HOST5 halt: halted by/ ignore
 /HOST4 reboot: rebooted by/ ignore
 /HOST5 reboot: rebooted by/ ignore
 /HOST4 login: ROOT LOGIN \/dev\/console/ ignore
 /HOST5 login: ROOT LOGIN \/dev\/console/ ignore
 \# Filter rdist from HOST2 and HOST6 (ADMIN1, 9/24/96)
 /rdistd.*startup for HOST6/ ignore
 /rdistd.*startup for HOST2/ ignore
 \# ADMIN4 says this really can`t be turned off (ADMIN1, 9/24/96)
 /HOST8 printer/ ignore
 \# ADMIN5 says due to newsreader not setup in DNS and other misc.
 /HOST9 nnrpd.*cant gethostbyaddr/ ignore
 /HOST9 nnrpd.*cant read Connection reset by peer/ ignore
 /HOST9 innd: nntp.somedoman.net.*internal rejecting huge article/ ignore
 \# ADMIN1 added this `cause he`s doing network testing at the Remote1
 \# and I end up doing a ypwhich ... and it`s a different domain.
 /HOST8 ypbind.*service not installed/ ignore
 /HOST8 ypbind.*NIS server not responding for domain.*DOMAIN1/ ignore
 \# Filter these, since we use mixed $SERVER and apps-server in the
 \# automount entries, and usually (!) these can be ignored (ADMIN1,11/96)
 /cant mount.*:\/usr\/local\/share/ ignore
 /\/usr\/local\/share.*No such file or directory/ ignore
 \# This one is driving us up the wall ... so lets ignore for now (ADMIN1, 1/11/97)
 \# Appears to be CDE`ism - maybe fixed in HPUX10.30 (?)
 /rpc.ttdbserver/ ignore
 /ttdt_Xt_input_handler/ ignore
 /libtt.* _Tt_rpc_client::init/ ignore
 \# Mon complains about this on IRIX 6.2 (ADMIN2: 02/13/97)
 /monitor: ERROR determining username for uid 263636952/ ignore
 \#####################################################################
 \# Here we trap vmunix stuff, since SunOS and HPUX10.x are gabby
 /^\S+\s+\S+\s+\S+\s+\S+\s+vmunix: / system="/local/home/swatch/scripts/sw-filter-bootup $*"
 \# Log anything not ignored above to swatchlog for "future" manipulation! ;-)
 /.*/ system="echo `$*` >> /local/home/swatch/local/logs/swatch/swatchlog" 15:00 0:15