Hi, in version 9.50 you can set up an alarm on this values:
Try a little bit wizh the the idel time.
Also you can set up an Alarm with a field match
Device possibly down 146-2 Network discovery event stating a device. can be down. Software Monitor ESM Low
Device unreachable 146-1 Network discovery device added to ESM is unreachable. Software Monitor ESM Low
But this two signitaur ID is for the Network connectivity, i think.
i have my doubts about both methods. they seem more related to the lower level connectivity and not the number of events.
i would assume that counting number of events should be possible in some form, perhaps not on alarms?