Use logcheck to filter out benign messages; have everything else emailed to you in real time.
He then focuses on what remains. At least as described, it sounded like an effective way to focus attention on the needles in the haystack.
Note that this doesn't mean shrinking your logs. It means an automated process for extracting an interesting subset. You still have the complete logs for other work. I'd also regularly audit the extract process both for sufficiency and as a reminder that its output is not the only thing you should be paying attention to.
It's not my idea, and I'm probably not doing it justice. Maybe someone else recalls the article / blog entry and has a link. It's also not something I need to do; perhaps if I did, I'd see shortcomings in the methodology.
> [...] first filtering out all the...
> I'll use the word "typical" entries.
> He identified patterns for these and
> lets a script strip these out. As he continues
> to identify those types of entries, he adds
> patterns for them to the script.
> He then focuses on what remains.