There really is no best practice. It is up to you and your organization to determine what events you are about. For example, if you use OSPF heavily as an IGP, you might want to look for %OSPF-5-ADJCHG syslog messages to indicate a neighbor state change.
There is no limit to what messages can be tied to an automated action. You should group together interesting messages in a way that makes sense to you, then build an appropriate action (e.g. email).
You may need to baseline your syslog message traffic for a while (i.e. what messages do you see when problems occur) to figure out which messages are really interesting. You want to try and manage by exception so that you do not overwhelm those receiving the notifications. You might also want to establish a catch-all-critical rule that says any messages with a severity of 2 or lower is automatically sent as an email. But no matter which approach you take, be aware that you may be constantly refining your AAs as your network changes. What you really want to avoid is flooding people with false positive messages since that can make them deaf to real problems.
