> > Once conflicts are disallowed, how is the behavior changed by an > 'invert' entry? Isn't the behavior the same as not including the entry > at all? Another good point. I think it should work if I do two passes. The first pass to find if the event should be filtered. Iff it should, do a second pass to see if a masked event exists to negate that (ie: a match is found with the invert bit set).
