Hello, I have same problem ... Problem is when SYS_NODE_DOWN emails are sent after few polls and SYS_NODE_UP with blocking timer key ... so the result is I am getting SPAM of SYS_NODE_UP emails.

I've moved your post to a separate thread, most probably it's something different.

Can you show your EPP configuration for SYS_NODE_DOWN and UP events with these blocking timer keys?

Hello, Ok:)

SYS_NODE_DOWN Offline EPP is here (+ Events SYS_NODE_DOWN, defined Source Objects):



+ Alarm




EPP for SYS_NODE_UP Alarm:



+ Server Actions:



+ Timer Cancellations all 3 Delay timer keys.

I think problem is due to not getting SYS_NODE_DOWN first ... only SYS_NODE_UNREACHABLE AND SYS_ICMP_UNREACHABLE.

Yes, I think you are right - if it's SYS_NODE_UNREACHABLE, then alarm is not created and timers are not set. 

Actually SYS_NODE_UP event has parameter at index 1 which is set to 1 if node is returning from "unreachable" state and 0 if from "down", so you can filter by that in your recovery EPP rule by the following script:

return $event.getParameter("reason") != 1;