Sandfly is written to have extremely low chance of false alarms. However, in some environments you may have a configuration that can cause a sandfly to activate repeatedly when it shouldn't. In these cases you have two options.
You can whitelist that sandfly for that particular host so it never activates but is still active for all other systems.
You can disable the sandfly across the board so it doesn't run against any of your hosts.
For the first option, you can follow this guide. For the second option, please see the section under Activating and Deactivating Sandflies.
Updated over 2 years ago