alert.conf

#{{pattern1} {pattern2}} {{exclude1} {exclude2}} {hash} {delay} {email} {page} {ignore} {custom tcl code}

#ignore blank lines and syslog-ng file marks
{{""} {"*-- MARK --*"}} {} {} {} {} {} {1} {}

# disk related
{{"*mdadm*"}} {} {"$log(host) raid event"} {86400} {admin disk} {admin} {0} {}
{{"*smartd*"}} {{all="*someserver*smartd*Device: /dev/sde*"}} {"$log(host) disk event"} {86400} {admin disk} {} {0} {}

# custom backup script
{{"*backups*fail*"}} {} {"backup problem on $log(host)"} {600} {admin} {} {0} {}

# catch priority levels
{{"*emerg*"}} {} {"$log(host) $log(program) emergency"} {3600} {admin} {admin} {0} {}
{{"*alert*"}} {} {"$log(host) $log(program) alert"} {3600} {admin} {} {0} {}
{{"*crit*"}} {} {"$log(host) $log(program) critical"} {3600} {admin} {} {0} {}
#{{"*err*"}} {{}} {"$log(host) $log(program) error"} {86400} {admin} {} {0} {}

## default condition for what does not match above
# this could be defined to ignore if you don't want to catch the unknown
{{default}} {} {"$log(host) $log(msg)"} {3600} {admin} {} {} {set subject "$log(host) event"}