Are you looking at Events and not Alarms?
Just as reference for the timestamps and what happened on the node.
When the nodeUp event comes it, it should reduce into the Down alarm and there for clear the Down alarm without incrementing the counter.
Yes. That is the default behavior and it works like this in my setup.
If you are seeing Up alarms then you’ve either configured Alarmd to not reduce Ups into Downs (old style behavior)
Not I am aware of. What do you mean with old style behavior?
or you’ve modified the reduction/clear keys of the corresponding Down and Up events.
No modifications made.
If your are looking at events, they are purely informational and are not part of situations
Maybe I should have also a look into the Alarm history in ES. Didn’t want to set up an additional Kibana until now.