Switch dependency triggering when it's not supposed to

[jmayniac]

I have a router, router1. I have it monitored via ICMP Ping (icmpping) the expression:

last(/Router by SNMP/icmpping,#5)=0

I have a switch (switch1) behind router1. The switch's icmpping trigger is dependent on router1's icmpping trigger with expression

last(/Switch by SNMP/icmpping,#5)=0

What's happening is that router1 goes down and I get a single notification that router1 is down. This is what I want. When router1 comes back up, I get a notification that router 1 is up, but also get a notification that switch1 is down, then a minute later another notification that switch1 is up. I'm not sure why I'm getting the notifications about switch1 as it is supposed to be dependent on router1 being up and the notifications for switch1 are only sent after router1 comes back up. Does anybody know what I'm doing wrong?

Screenshots of Alert Action:

[ISiroshtan]

I would be interested to see the history of icmpping item from both router and switch 10 minutes before resolution and 10 min after issue resolution. It should give better understanding of what Zabbix actually see during it decision making.

Also, any reason to use last(,#5)? it does not evaluate last five values, it evaluates 5th value, essentially moving your evaluation point 5 x item_interval in the past...

[cyber]

Wrong use of last function, I would assume...