Henrik,
Would it be possible to create a log of only NK events? We currently use bbgen views to present a limited view to our NOC (via the bbgen ignore strings) and then use a custom php program to parse the allevents log and only pick out events that would have shown up on their view. We use this as a metric to track successful escalation of alerts. I'm considering switching to the NK model, but it would require a more complex program to identify NK alerts. Any thoughts?
Thanks,
Brian
PS. Switching live to clustered hobbit in 2 weeks! Thanks for all your hard work!