Hi Stefan & welcome to the forum.
I've done a simple test with my EMC 8.0.2 - configure a alarm for the syslog event if a user logs in to my switch.
Here how the syslog event looks like...
![2dd9133c541e4a6a9f731afad588ca81_RackMultipart20170721-78846-1405gp1-EMC_alarm_syslog01_inline.png 2dd9133c541e4a6a9f731afad588ca81_RackMultipart20170721-78846-1405gp1-EMC_alarm_syslog01_inline.png](/t5/image/serverpage/image-id/5227i7374E1D9A06DEF30/image-size/large?v=v2&px=999)
And here my customer alarm...you'd need to match on the Syslog log manager and and then on the information text i.e. passed - in my test.
![2dd9133c541e4a6a9f731afad588ca81_RackMultipart20170721-79250-1s2kk6j-EMC_alarm_syslog02_inline.png 2dd9133c541e4a6a9f731afad588ca81_RackMultipart20170721-79250-1s2kk6j-EMC_alarm_syslog02_inline.png](/t5/image/serverpage/image-id/4929i4729A93AB4584E83/image-size/large?v=v2&px=999)
If it still doesn't work could you please open a new post so we'd separate it from the other ones and make sure to incl some screenshots of the configuration.
-Ron