A little late to the party, but here's my take: enVision has a few built in correlation rules for collector related problems, but I set up my own to alert on the following event IDs: 100000; 100002; 100002:01; 100009; 400001; 400014; 400015; 507142; 507143; 507144; 507145:01; 507145 These will pretty much cover any issue with a collector and storage (file overwrite, storage nearing full, collector shutdown, etc). It's working fine for me, and not too noisy! Good luck!
