after much trial and error--it *appears* these are the only rights you
need to run the health driver--by default it runs it as the account you
deployed with--with in some cases may be your admin account which you dont
want a named password for.

the user you run health job as must have the following rights:
DirXML-AccessSubmitCommand Fullrights--inherit
Alltribute rights--CompareRead inherit
Entry rights--CompareRead inherit

Driver you are monitoring
Same rights as above without the inheritance.

I wish novell would get in the practice of documenting the *exact* rights
needed for operations---many times I think the mindset is just run as
admin. And it is sometimes a pain to figure out otherwise. and who knows
maybe I am missing a right--but it appears to be running fine.