Abstract: Computer systems have the ability to monitor their components and operations, generate events which indicate the occurrence of a monitored condition (e.g. out of paper, Joe Smith just signed on, disk utilization nearing capacity, etc.), and process these events in some manner. The present invention provides significant enhancements to the latter capability.The events of an event stream or streams are "filtered" into categories or groups of events. Once categorized, the invention associates an action or actions with the categorized event. The associated action can be logging the event, routing the event to the electronic address of a user, or sending the event to an application program for further processing.