Abstract: A rules engine for application of rules to a plurality of log events from a plurality of log and event sources has separate threads for the collection of log entries and events, which logs and events are merged together to form a merged log events. A rules thread applies the merged events to a series of rules in search of a match condition, where the match condition involves a log source and one or more fields selected from a particular log or event. When a match condition occurs according to criteria specified by the rule, an action is performed. In one example, the action is the presentation of a distilled message which indicates a corrective action or problem source based on the application of the rules to the merged stream of messages. In another example, multi-tab displays indicate unprocessed logs and the results of applied rules.