the prelude lml nagios rule looks like this

regex=SERVICE ALERT: (\w+)\;([\w\s]+)\;(CRITICAL|WARNING|OK)\;HARD\;\d\;(.+);

a nagios (version 2) log entry can look like this

SERVICE ALERT: app1.env2.domain.com;check_getDslProfile1i-version1

so the (\w+) won't match the host and the ([\w\s]+) won't match the check_name

i would change it to

regex=SERVICE ALERT: ([\w\-\.]+\;(\S+);(CRITICAL|WARNING|OK)\;

i am not shur if the there a white spaces allowed in the check_name ...

cheers
philipp