Log collection, structuring and processing

A method for use on a plurality of log manager devices of a data system, wherein each of the plurality of log manager devices is configured to monitor a plurality of devices of one or more platforms to identify events for handling by an event manager, the method comprising the steps of:

• creating, at a first log manager device of the plurality of log manager devices, a first log processing rule having a filtering setting that identifies logs having a first of a plurality of classifications regarding a type of each log and a second log processing rule having a filtering setting that identifies logs received from a first source on the data system, wherein the first log processing rule includes a first data management setting that specifies to take or not take at least one action in relation to logs having the first classification, and wherein the second log processing rule includes a second data management setting that specifies the other of taking or not taking the at least one action in relation to logs having the first source;
• establishing, at the first log manager device, a default setting stipulating that the second data management setting is to be applied instead of the first data management setting as to logs that match the filtering settings of both the first and second log processing rules;
• receiving, at the first log manager device, an override setting indicating on that the default setting is to be ignored and the first data management setting is to be applied instead of the second data management setting as to logs that match the filtering settings of both the first and second log processing rules;
• transmitting the override setting to each of the plurality of log manager devices based on a designation that the override setting is global;
• receiving, at the first log manager device, logs generated at and transmitted from the plurality of devices of the one or more platforms;
• identifying, at the first log manager device, at least a first of the received logs that matches the filtering settings of both the first and second log processing rules;
• determining, at the first log manager device, that the first data management setting conflicts with the second data management setting;
• and
• operating, based on the determining that first data management setting conflicts with the second data management setting, the first log manager device to implement the first data management setting on the first received log and ignore the second data management setting according to the override setting.