Hi Zaxo,

Thanks for the reply. My code probably looked a bit odd in isolation, my test cases were very much cut down, I have about 500 various error texts to map to four Tivoli severities. Most of the error texts are simple as they contain the word Warning, Error or Critical some in mixed case, some all upper (this is why I use regex not an equality test) here are some typical examples

WARNING CPU Temperature High
disk read error
System Powering Down
Fan Powering Down

The system powering down needs to be sending a more severe event than other generic powering downs so the order I compare the mappings when I characterise these error texts is important so no hash.

I did not do anything with severity here as this is a fragment cut from a larger script. In reality the severity is stored in a structure with a bunch of other info characterising this alert that all goes into creating the Tivoli event (Sun's error identifier, Sub system info, The description itself etc).

Cheers,
Random.