Oracle Enterprise Manager: How to Supress 'EM Event: Warning: - User SYS logged on '

User Logged on can be really pain as it makes a lot of noise, It is one of the collected metrics without any threshold and will generate a warning or critical message (and probably clear as well) as per your configuration.

so, what do you do about it ? 

There can be many solutions
1. Remove SYS from Auditing 

• Go to database home page
• Oracle Database (drop down menu)/Monitoring/Metric and Collection Settings
• Scroll down to:   User Audit/Audited User
• make sure that no values are set for the 'warning' and 'critical' boxes apply the changes 

2. Remove this from Template if you want to do it for all Databases

3. The final solution is that the metric is still collected and you see it in the database, however you just remove it from the Incident rules and notification.

For this first, identify the Incident rule which created this, you will find this in the alert email. 

• Go to Incidents -> incident rules
• Select your In
• Edit the incident rule 
• and then in the filter 'Select a Filter' Event not equals 'UserAudit:username'cident rule

This will stop the notification emails for user log-ons all together.