IBM Enterprise Console Manual page 160

Using the system log message from the preceding September 29 example, the
component specifiers and matches are as follows:
%t
%s
su: 'su su: 'su
%s
succeeded for
%s
on
%s
The white space characters that separate the words of a system log message must
also be present in the format string. A single space character (that is, one blank) in
the format string will match any number of white space characters in the message.
For example, if the space between the colon (:) and the quotation mark (') is
deleted in the preceding specialized format string, as shown in the following
example, the system log message would no longer match it.
Care should be taken when using the arbitrary length repeater component
specifiers (%s* and *s+). The following format string does not make much sense:
The first %s* matches everything through the end of the message, and the second
%s* never matches anything. It might appear that this does not matter, but the
importance is apparent as discussed in "Mappings" on page 149.
The following format string, however, is meaningful:
The first %s* matches everything up to the first colon (:), and the second %s* now
matches everything through the end of the message.
The format string must also reflect whether white space precedes a constant or
component specifier. In the following example, both messages match a format
string of %s*company_xyz because they are preceded by zero ( ) or more
constants and no white space.
However, the following example requires a format string with a space after the
%s* component specifier, as in %s* company_xyz, because it is preceded by white
space and does not match the previous format string.
From the preceding examples, you can see that you can specialize a generic format
string to match a more specific event by either replacing component specifiers with
constants or by restricting the arbitrary length repeater specifiers to a fixed length,
using constants to complete the specifier.
148
IBM Tivoli Enterprise Console: Adapters Guide
Sep 29 14:57:28
aspen
root
succeeded for
jsmith
on
/dev/ttypd