You cannot pass anything from the message (at least I never found one after looking for quite a while). While you can have glob expressions for the pattern match, you can not alter the execution based on the pattern matched. Worse yet, you can only match the variable text of the message, so for those systems with multiple CPUs and the message is issued once for each CPU, the match will occur many times (12 times on a 11050 10.2.1 HF2 system). That means you have to deal with collision/race conditions on your own.
Very sad!
This is a seriously needed utility and it should be able to 1) match the entire text string as an option, and 2) fork/exec commands passing the matched message as a parameter. Why it was so limited is beyond me - author didn't think far enough ahead. If I had access to the source code I'd have it fixed in no time ...
I wrote my own alertd-like Perl script because of such restrictions, but it was wandering a bit far from the "out of the box" configuration and was too confusing for others to grok. In my case, I was trying to take an action to alter a class when a pool had no members left. As such, hard coding the pool name in /config/user_alert.conf wasn't a big deal. (But the called code did need to deal with the collision/race conditions which opens a serious potential for error if things start flapping rapidly. :-()
Note that user_alert.conf is stat'ed every 10 seconds so there is no need to bounce alterd when changing the file, but by the same token, if you mess it up, alertd will go into a crash/restart loop, so be careful.
Also note that the F5 Support Center seems not to like alertd per SOL3727 -
even more sad!!!
See:
http://support.f5.com/kb/en-us/solutions/public/3000/600/sol3667.html
http://support.f5.com/kb/en-us/solutions/public/3000/700/sol3727.html
http://support.f5.com/kb/en-us/solutions/public/12000/400/sol12428.html