The requirement is that the customer wants to receive an alert each time a message or instance got suspended. So this is a bit like an event driven approach.
Applications
Say you have an alert for Suspended Instances with a Warning threshold of (more than) 0 and an Error threshold of (more than) 5. This would result in getting a notification when:
a. nothing is suspended yet and
b. a Message or Instance got suspended
This is because the Warning threshold is set to (more than) 0. As far as I am aware of, the next notification you would get is when the Error threshold is met. So when this is set to 5, you would not get notifications of suspended messages/instances 2, 3 and 4.
Of course you have the 'If violation persists...' functionality, but when the 2nd, 3rd or 4th instance(s) got suspended outside that timeframe, multiplied by 'Limit Number...', you would not get a notification for the instances which occur outside that timeframe.
Data Monitoring
With Data Monitoring you could set the Data Filter to Suspended Service Instances and the Warning threshold to > 0, but when there are no suspended instances within the configured frequency you would get an email that no instances got suspended, which is a bit over-informative .
As far as my experience with Data Monitoring reaches, the closest you can currently get is a daily report with the number of suspended instances of that day, even when that's zero...
To solve this you could think of adding an Information Threshold which can be assigned a number, just like Warning and Error Threshold under Applications. When assigned:
- 0 no notifications will be sent
- 1 a notification will be sent for each suspended instance
- 2 a notification will be sent for every 2nd suspended instance
- 3 a notification will be sent for every 3rd suspended instance
- etc.
To prevent flooding the 'If violation persists...' / 'Limit Number...' functionality would apply.

• Idea shared by Lex Hegt.