search for: input644

...rectory. The file already contains this rule: ^\w{3} [ :0-9]{11} [._[:alnum:]-]+ kernel: input: Logitech USB Mouse as /class/input/input[[:digit:]]+$ However my system was reporting the following two similar events: [date] [hostname] kernel: input: B16_b_02 USB-PS/2 Optical Mouse as /class/input/input644 [date] [hostname] kernel: input: Chicony PFU-65 USB Keyboard as /class/input/input636 Which I was able to capture with the following two rules: ^\w{3} [ :0-9]{11} [._[:alnum:]-]+ kernel: input: Chicony PFU-65 USB Keyboard as /class/input/input[[:digit:]]+$ ^\w{3} [ :0-9]{11} [._[:alnum:]-]+ kern...