I agree, I try to avoid using event sources because of the reasons you've stated. Your keying suggestion is similar to Netcool does it with its AlertKey field which can be configured as part of configuring the event collector in Netcool. Everytime an alert comes in with the same exact key, they are de-duplicated and the counter increased on the first occurrence alert. Alerts should have a last occurrence time stamp to show when the alert with the same key was last received, i.e. when the count last increased.