How do I manage event suppression rules?

To view event suppression rules

To enable/disable event suppression rules

To enable suppression of events from recently added devices

To edit an event suppression rule

To view event suppressions on different servers

To delete an event suppression rule

Viewing, editing and deleting event suppression rules can be accessed through the Event Suppressions page.

Please see this article for an explanation of how event suppressions work in Entuity.

To view event suppression rules:

1. In the Main Menu, click Administration.
2. Click Event Suppressions.
3. Your event suppression rules are displayed in a table here.
   
   

The table has a number of columns for different details. The columns are as follows:

• Source - the selected object or objects to which the suppressed event applies.
• Origin Device (Entuity v20.0 P02 upwards) - origin device to which the suppressed event applies.
• Parent (Entuity v20.0 P02 upwards) - parent object of the origin device, if any. This might be the same as the origin device.
• Type - type of device to which this event suppression applies, e.g. Router Device.
• Suppress For - the attribute value on which the event is suppressed, e.g. IP address.
• Sub Components - whether events are suppressed for sub-components of the device, either Yes or No.
• Event Type - the selected event type to which the event suppression rule applies. If you have chosen multiple event types, each event type will be listed as a separate rule in this table.
• Starts At - time and date the suppression rule starts at.
• Ends At - time and date the suppression rule is applied until. If blank, there is no end date and so is always active.
• Recurrence - indicates if a Time & Day schedule is applied to the suppression rule.
• Reason - the description of the rule.
• Last Updated By - the user name of the last person to update the suppression rule.
• Last Updated At - time and date the suppression rule was last updated.

In a multi-server configuration, specify the server for which you want to view the event suppressions in the server selection dropdown field. From Entuity v19.0 P02 onwards, you can display the event suppressions for all servers by clicking 'All Servers'.

To enable/disable an event suppression rule:

1. In the Main Menu, click Administration.
2. Navigate to the Event Administration and click the Rules tab.
   
   
   
   
3. Navigate to the event suppression rule that you want to enable or disable in the navigation pane on the left of the window.
   
   
   
   
4. Select the rule you want to enable/disable and click Edit at the bottom of the window.
5. This will open the Edit Rule window. In the top right of this window is the enabled tick box.  Tick or untick this box as you prefer and click OK to save your changes, otherwise click Cancel.

You can deactivate event suppression rules by setting an elapsed date, after which suppression rules are expired, but by default are not deleted. There are two ways in which to do this:

• by setting deleteExpiredEventSuppressionsPeriodSeconds in entuity_home\etc\entuity.cfg. Entuity will then delete suppression rules that are expired for the set period or longer.
• via the Scheduled Event Suppression section of the Create Event Suppression form.

To enable suppression of events from recently added devices:

Entuity comes with an event suppression rule that discards events for devices that have been under management for less than 24 hours. This can prevent event floods generated at the start of monitoring. By default this is not turned on and you will need to manually enable it:

1. Navigate to Event Administration > Rules tab as described above.
2. In the navigation pane on the left of the window, click Pre Storage > Initial Filtering > Discard Events From Recently Added Devices.
   
   
   
   
3. Click Edit at the bottom of the window to open the Edit Rule window.
4. Tick the enabled box in the top right of this window. Click OK to save your changes, otherwise click Cancel.
   
   

To edit an event suppression rule:

1. Navigate to the Event Suppressions page as described above.
2. Select the rule you want to edit. 
3. Click Edit in the bottom right of the browser window to open the Suppress Events window.
4. Edit the suppression rule and click OK. Any changes to the rule are applied immediately.

From ENA v18.0 P04 onwards, you can select and edit multiple event suppression rules at the same time. Hold ctrl and select the rules you want to edit, and then click Edit. When editing multiple suppressions, if a conflict is found between suppressions, then only the changed values are saved.

To view event suppressions on different servers:

If you are signed into a server that manages other servers, you can use the Explorer button to find those servers and see the event suppressions on those servers. The Explorer button is only visible if your server is managing other servers.

The Event Suppressions page defaults to the event suppressions of the server that you are logged in to. In the below example, we are signed into the glenfiddich server. Glenfiddich is managing other servers, so the Explorer button is present. Click Explorer.

This will open the Explorer form, which lists the available servers that your current server manages. There are some event suppressions on the yamazaki server, so we will click that.

The Event Supression page will now show the event suppressions on the yamazaki server. You can edit and remove these suppressions just as you normally would, via the Edit Suppression and Remove Suppression buttons, via the Overflow Menu, or via the right-click Context Menu.

To delete an event suppression rule:

1. Navigate to the Event Suppressions page as described above.
2. Select the rule you want to delete and click Remove Suppression at the top of the page (or via the Overflow Menu or right-click Context Menu).
   
   
   
   
3. A deletion confirmation window will open. Click Yes.