How to avoid the alarm flood of offline equipment chain?

[justrest]

I would like to ask the expert a question: if an aggregation device is disconnected, all the devices under it will be offline, and each device will send an alarm message at this time. How can we make sure that only the top device performs the action of sending alarm message, and the lower part relies on the device not to send alarm message?

[keenoar]

A quick solution would be to exclude the child nodes from source objects in the EPP for that rule.

[justrest]

Thank you very much, but  if  manually exclude the child nodes, it is too much trouble,  can there be any rule than can  automatically adapte  to it?

[keenoar]

you can use a filtering script in the EPP and match for the names of the nodes you want to dismiss. something like this:

if($node->name match "^unwanted_node.+")
{
    return false;
}
return true;

[justrest]

Thank you very much for the pointers!