file exclusion pattern for checksum

[Mark Foster]

I'm getting these messages from cfexecd...

cfengine:lu326: !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
cfengine:lu326: SECURITY ALERT: Checksum for /etc/mtab changed!
cfengine:lu326: !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!


This is the relevant section from cfagent.conf
files:
 any::
   /etc checksum=md5 inform=on recurse=inf xdev=false exclude=/etc/mtab

So the exclude "pattern" does not work. What kind of regex would 
properly represent /etc/mtab, and how would I combine other file paths 
to make a compound regex to exclude other paths as well (e.g. 
/etc/ntp/drift comes to mind).

Thanks.

--
Some days it's just not worth chewing through the restraints...
Mark D. Foster, CISSP <mark@foster.cc>  http://mark.foster.cc/