Hello, I have same problem ... Problem is when SYS_NODE_DOWN emails are sent after few polls and SYS_NODE_UP with blocking timer key ... so the result is I am getting SPAM of SYS_NODE_UP emails.
(https://i.ibb.co/zTwDRbFJ/obr-zek-2025-06-24-090405809.png)
I've moved your post to a separate thread, most probably it's something different.
Can you show your EPP configuration for SYS_NODE_DOWN and UP events with these blocking timer keys?
Hello, Ok:)
SYS_NODE_DOWN Offline EPP is here (+ Events SYS_NODE_DOWN, defined Source Objects):
(https://i.ibb.co/jZJ49ymJ/obr-zek-2025-06-30-095814550.png)
+ Alarm
(https://i.ibb.co/QvkHH7zk/obr-zek-2025-06-30-100031480.png)
EPP for SYS_NODE_UP Alarm:
(https://i.ibb.co/1f0MQf9X/obr-zek-2025-06-30-100143931.png)
+ Server Actions:
(https://i.ibb.co/Lz4vKH2M/obr-zek-2025-06-30-100250885.png)
+ Timer Cancellations all 3 Delay timer keys.
I think problem is due to not getting SYS_NODE_DOWN first ... only SYS_NODE_UNREACHABLE AND SYS_ICMP_UNREACHABLE.
Yes, I think you are right - if it's SYS_NODE_UNREACHABLE, then alarm is not created and timers are not set.
Actually SYS_NODE_UP event has parameter at index 1 which is set to 1 if node is returning from "unreachable" state and 0 if from "down", so you can filter by that in your recovery EPP rule by the following script:
return $event.getParameter("reason") != 1;