In order to get my virus graph to work, I had to change "Intercepted" to "infected" here: elsif($prog eq 'clamav-milter') { if($text =~ /infected/) { event($time, 'virus'); } This is for a Postfix / Clamav solution running on FreeBSD.