An apparatus, method and programming product for preventing event flooding in an event processing system, comprising, responsive to receiving monitored a activity data, analysing the monitored activity data to identify a first event value corresponding to a first event; determining whether the first event value has met a first threshold value of a set of threshold values; in response to determining the first event value has met a first threshold value of the set of threshold values, select a second threshold value of the set of threshold values; responsive to receiving the monitored activity data, analysing the monitored activity data to identify a second event value corresponding to a second event; responsive to determining that the second event value has exceeded the first threshold value and not exceeded the second threshold value, disregarding the second event.