#Dameware Connect
type=single
ptype=regexp
pattern=([A-z._0-9-]*) DMWRCS: (.*) Connect: (.*)
desc = Dameware Connect
action=add WINDOWS_REPORT DAMEWARE CONNECT: %s; \
pipe 'DAMEWARE Connect -- : %s' /usr/bin/mail -s 'DAMEWARE CONNECT' alerts@yourdomain.com


#Dameware Disconnect
type=single
ptype=regexp
pattern=([A-z._0-9-]*) DMWRCS: (.*) Disconnect: (.*)
desc = Dameware Disconnect
action=add WINDOWS_REPORT DAMEWARE DISCONNECT: %s