Only pass messages of specific interest

 ------------steam-raw
 \# This swatchrc takes the swatch log (after some initial filtering)
 \# and puts all steam issues into a "raw" file
 /steam disk array/ system="echo `$*` >> /local/home/swatch/local/logs/swatch/swatchlog.steam-raw"
 ------------steam.error
 \# This swatchrc takes the steam swatch log (after some initial filtering)
 \# and flags SERIOUS steam issues ..
 /steam disk array error: CRITICAL: Validation failed - Unauthorized client/ ignore
 /steam disk array error:/ system="echo `$*` >> /local/home/swatch/local/logs/swatch/swatchlog.steamerror"
 ------------steam.warning
 \# This swatchrc takes the steam swatch log (after some initial filtering)
 \# and flags WARNING steam issues ...
 /steam disk array warning: WARNING:.*OVRL=0/ ignore
 /steam disk array warning: WARNING: Validation failed - Unauthorized client .* access level: -1.* connection refused/ ignore
 /steam disk array warning: WARNING: Socket error - connecting to .* - Bad file number/ ignore
 /steam disk array warning: WARNING: - socketRead.* Bad file number .*SP_SOCKET: socketRead/ ignore
 /steam disk array warning: WARNING: - .* 00000000000 HSZ/ ignore
 /steam disk array warning: WARNING: Unknown storage subsystem - Error - Invalid storage subsystem: .* SP_TCP: ProcessRequest/ ignore
 /steam disk array warning:/ system="echo `$*` >> /local/home/swatch/local/logs/swatch/swatchlog.steamwarning"
 ------------nscd (now this is WAY COOL ... monitor, notify, AND auto-fix!!!)
 \# This swatchrc takes the swatch log (after some initial filtering)
 \# and logs any syslog conditions that indicate that nscd has croaked
 \# on a server - this appears to be a bug in Solaris2.6 ... the client
 \# machine is not able to mount anything `cause it is known as the
 \# fully-qualified hostname to the server ... the server also send a message
 \# that look like this - note the fully qualified hostname
 \# Apr 13 11:05:13 SERVER1 mountd[747]: CLIENT1.somedomain.com denied access to /vdisk8
 \#
 \# To fix it, login to the server and do a
 \# sudo nscd -i hosts ; sudo shareall
 \# cd /etc/init.d ; sudo ./nscd stop ; sudo ./nscd start
 /nscd-shareall run/ system="echo `$*` >> /local/home/swatch/local/logs/swatch/swatchlog.nscd" 15:00 0:15
 /mountd.*somedomain.com denied access to/ system="/local/home/swatch/scripts/nscd-parse $*" 15:00 0:15