I am trying to use SYSLOG Parser.  In the documentation describes that it's possible to parse incoming messages using built in netxms syslog daemon but i am enable to generate events of this incoming messages to syslog.

for instance i want to grab all messages containing ntpd

ntpd[3938]: can't open /var/lib/ntp/ntp.drift

<parser>
   <rules>
      <rule>
         <match>*ntpd*</match>
         <event params="1">503</event>
      </rule>
   </rules>
   <macros/>
</parser>

What is wrong with this argument i even try to use .* *, etc.

I am using netxms 1.2.6 compiled with:

./configure --with-server --with-mysql --with-agent --prefix=/opt/netxms --enable-unicode

thank you in advanced,
Best Regards