Interface admin/operationally down events

SL1 event "suppression" is a configuration of event policies such that if this event occurs again on specific device(s), that an active event record will not be created. The conditional if/else logic to which you refer is not a feature of the SL1 event engine whereby an event would only be created based off of the existence, or not, of other active events. 

SL1 will actively mask events that are newer and equal or less severe generated on the same device in 10min buckets by default (Event Masks). This feature inherently "hides" such event noise from event tables and can be set to be excluded from Run Book Automation. Can you elaborate on what impact or objective you are currently aiming to address by conditionally "suppressing" the operationally down event? What problem(s) or impact is this currently having for your operations?

By default, the "Poller: Interface Admin down" event has a severity level of Notice (which is appropriate given that condition requires a manual configuration change).  The "Poller: Interface operationally down" event has a severity level of Major.  Any time an interface is administratively brought down, it also brings it operationally down (down/down).  Since the operationally down condition is a higher severity level than the admin down condition, it is not being suppressed.  This is the situation where the operationally down events are essentially causing false positives for our NOC.  They have procedures in place to respond to all operationally down messages (up/down), and the ones being generated due to a network admin administratively bringing down the interface is essentially a big waste of time.  When it comes to interface states, the current logic in SL1 just appears to be flawed.  What we really need is the following:

Interface up/up = healthy
Interface up/down = major
Interface down/down = notice

Can we use (Admin Down event policy) to be treated as the "healthy" condition that clears another event (Operational Down), so that alarms open when an interface is simply administratively disabled.

Our customers do not want to receive a ticket in ServiceNow for an interface that is admin down. It creates unnecessary work for them to investigate and close these tickets in their eyes.