1. as discussed in another thread, under linux logger utility could be helpful to generate syslog messages
2. A matched syslog line generates an event, so we have to do the logic in Event Processing Policy (EPP). There you have filtering script - if it's not empty, event will be processed further only if that script returns true. You can just take current time in that script and check it:

now = localtime();
return (now->hour >= 8);

3. I am not exactly sure how to use the repeatCount in syslog processing, but anyway reaction to syslog only happens when a new syslog message is received. Here we need something in another place that would be executed regularly, event if there will be no syslog messages from a given node. A possible approach could be:

• when you receive backup successful message, store current unixtime in custom attribute of the node. You can do this in filter script in EPP:

$node->setCustomAttribute("lastBackupTime", time());

• create a DCI with origin "Internal" and parameter "Dummy".
• in transformation script add the following:

return time() - $node->getCustomAttribute("lastBackupTime");

as the result this DCI will have time in seconds since last backup.

• add threshold so that an event will be generated when time since last backup is too big.