I have several devices that reach their ERC via a syslog-ng relay. These devices behind the relay are all configured as Client Data Sources within the ESM, with the syslog-ng relay as the parent. The problem is activity on the Client doesn't get noticed for the Inactivity alarms, so after the threshold is reached the parent Device is shown as inactive, even thought the Client isn't.
So I'm torn between turning off Inactivity monitoring for the parent data source, or ignoring a lot of flags in the ESM console. Has anyone discovered a third option yet?