That now makes 2 people who have seen a Warning event get through an 'error only' filter, although I have not been able to duplicate it here at all yet.
Code checking reveals no reason why this should be, it all looks very clear

.
Can you please post the full details of the Eventlog entry that was incorrectly matched, plus a registry dump of the
HKEY_LOCAL_MACHINE/SOFTWARE/Cheshire Cat
branch? Email these to me if they are too big to post here. Finally, if you have a way to reliably duplicate this on demand, I'd like you to enable Debug mode on the agent and then do so, and send me the Eventlog debug entries generated by the matching process to see how it matched.
Thanks in advance for the help