The analyse of log is one of the better means to supervise the correct operation of a system or to carry out intrusion detection. For that, the rational expressions are a very powerful tool in order to describe the events. The generation of these expressions can be a long work, especially in an initial way when administrator receive an hundreds event per day. Slct is a tool allowing to guide administrator by presenting solutions to him describing the greatest possible event number.