Hi thanks for your reply. I tried that but how can I define that only critical syslog traps should be forwarded in mail from all devices. I dont know the wht severity to use what facility to use ?/ can you tell me wht would b the value for all the field for critical syslog alerts in automated action ?

It depends on what you consider critical. If you go by simply severity, severities 0, 1, and 2 are generally considered critical. To setup an AA for those, you would need to add three syslog message types:

Facility : *

Sub-facility : *

Severity : 0

Mnemonic : *

Description : *

Facility : *

Sub-facility : *

Severity : 1

Mnemonic : *

Description : *

Facility : *

Sub-facility : *

Severity : 2

Mnemonic : *

Description : *