it's probably a server notice (knocks aren't handled by ChanServ, are they?), take a look at /help on SNOTICE

i've also seen knocks sent in the same format as joins and parts, ie. ":nick!user@host KNOCK #chan :msg", in which case you may use this to detect them:

Code:
raw KNOCK:*:{ ; $1 is #chan, $2- is the message }


"The only excuse for making a useless script is that one admires it intensely" - Oscar Wilde