Steps to reproduce

I've created the following trigger:

Name: Test overall memory usage is larger than 400MB Traps {ITEM.VALUE}

Severity: High

Expression:

{System test template:system.run[wmic datafile where name="C:\\test1.exe" get Version /value].str()} and ({System test template:proc_info[example1.exe,wkset,avg].avg(5)}) +
({System test template:proc_info[example3,wkset,avg].avg(5)}) + ({System test template:proc_info[example2,wkset,avg].avg(5)}) + ({System test template:proc_info[example4,wkset,avg].avg(5)}) ) > 409600

 
OK event generation: Expression
PROBLEM event generation mode: Single
OK event closes: All problems  
 
This trigger sums up memory usage of a few processes and the sum is bigger than 4000 MB AND I get a string from another process than it is triggered. (I need that string for the email notification) 
 
The trigger is connected to the following action:
 
Name: System Test memory usage alert
 
Condition: Trigger = System test template: Test overall memory usage is larger than 400MB  UNKNOWN
 
Operations Default operation step duration: 4h
 

 
Operation details Step duration: 4h
 
Send only to: Email alerts
 

Result:

1) Although step action step duration is set to 4 hours, I am being bombarded by emails which occur every few minutes. 

2) Looking at the problems menu I see only ONE problem that relates to the trigger. In other words,  even if I got 50 emails with different problem IDs {EVENT.ID} in the course of an hour, only one problem is visible in the Monitoring --> Problem menu 

Expected:

1) The action should send only one email every 4 hours, regardless of trigger state. 

2) A corresponding Problem should appear under the problem menu. ( I found no way to correlate "Original problem ID" ({EVENT.ID} to anything under the Problem menu)