I've setup a central rsyslog server that is writing events to a MySQL database.
Looking through the events one sees all kinds of events that are probably unnecessarily captured.
On RHEL/CentOS systems I see and am thinking of discarding the following (in rsyslog.conf format):
:msg, contains, "(root) CMD (run-parts /etc/cron.hourly)" ~
:msg, contains, "running program /usr/sbin/rhn_check" ~
What other types of messages are candidates for discarding?