While debugging a case where newSuspect events were not being processed - they appeared in provisiond.log, but not further action was taken - I found that these were being discarded due to the fact that the monitoring system id, or distpoller id that was referenced in the events was not present in the database.

We perform this lookup so that the newSuspect events generated by a given monitoring system are processed at the same location, however we should continue to process the events at the default location if the system is not found.