Hi Alain,
Great to see you on the forum. I possibly need a couple examples (Feel free to email those directly to me if they contain private values) but in generate I believe there are several approaches:
1. Analyst - Using an analyst to alert instead of a threshold add much more flexibility including pattern matching
2. Alets + - Alerts + is a possible approach here and I urge you to check out the other forum topics on that
3. Custom Pace Solution - Engaging consulting for a pace solution that copies the syslog data to another record first and then apply some pattern matching on it seems viable.
I think the analyst option offers the best possibilities here. If you are already familiar with Analyst code, this defnitely is the way to go. If not, maybe some consulting training in this area and they acn use this syslog need as a great training exercise for you.
Feel free to respond here if you have further questions about any of these options.
