In case of service oriented monitoring structure like below:

Service based notifications was configured. We interested to receive notification only from top level service if service status changing. We need to send notification if service in "High" or "Disaster" status.

In case of status changed like this OK->High(or disaster)->OK.: No problem

But if status change lie this:

OK->Average->High->Average->OK

We are receiving negative time:

Below you can see events:

Look like this operate like this:

I think that negative time itself for problem duration - problem.

Service level actions and notification should be not the same as trigger based.