Thank you all for your responses thus far.
We did have "component down" alerts but never sent emails from them, so few people ever saw them. Application monitors were taking care of all our needs: if a component went down, "application down" alerts would trigger. (I see there are exceptions to this logic, e.g. when a component is in the "warning" state but for now, let's skip that part.)
However if I need to include Event Log messages, yet not have redundant alerts, I would need to:
- Suppress alerts from "Errors in Event Logs" app monitors.
- Create a new set of component alerts (with tier-based escalation), for "Errors in Event Logs" component monitors.
I.e. there is no way for me to have generic (as in, "not specific to particular monitors") app or component alerts that are yet that include event log messages? Does this sound right?
Thanks again.