Contributor III
ModeratorSL1 event "suppression" is a configuration of event policies such that if this event occurs again on specific device(s), that an active event record will not be created. The conditional if/else logic to which you refer is not a feature of the SL1 event engine whereby an event would only be created based off of the existence, or not, of other active events.
SL1 will actively mask events that are newer and equal or less severe generated on the same device in 10min buckets by default (Event Masks). This feature inherently "hides" such event noise from event tables and can be set to be excluded from Run Book Automation. Can you elaborate on what impact or objective you are currently aiming to address by conditionally "suppressing" the operationally down event? What problem(s) or impact is this currently having for your operations?
