Event Manager ↔ Syslog Server: Unresolved Alert Throttling Behavior

Goal

Reduce notification noise in a busy pfSense deployment while still receiving critical alerts for firewall, VPN, and system events.

Current Setup

The Event Manager is configured to generate alerts for a broad set of categories. Email notifications are enabled for every alert that matches the active filter, and syslog forwarding is set to send all alerts above a chosen severity to an external collector.

Constraints & Uncertainty

High‑traffic periods cause the email engine to flood administrators. Syslog forwarding works, but there is no documented suppression or deduplication for repeated alerts; each instance is treated as new. The Event Manager’s “Alert Throttling” (rate limiting) feature is mentioned in the UI but its exact collapse or drop thresholds are not documented.

Unresolved Decision

Should the internal Event Manager filtering be relied on, or is routing all alerts to an external SIEM via syslog/SNMP necessary to achieve consistent suppression?

Specific Questions

• What are the documented parameters (time window, count threshold) for the Event Manager’s alert throttling, and how can they be configured?
• Is there a built‑in mechanism to deduplicate or suppress repeated alerts before they are forwarded to syslog?
• Can syslog forwarding be configured to perform its own deduplication or rate limiting, and if so, what syntax or options are required?