To resolve the issue I'd like to suggest the following patch: --- hobbitd/hobbitd_alert.c.orig Thu Jul 26 20:38:33 2007 +++ hobbitd/hobbitd_alert.c Thu Jul 26 20:39:12 2007 @@ -636,9 +636,10 @@ /* * Send one "recovered" message out now, then go to A_DEAD. * Dont update the color here - we want recoveries to go out - * only if the alert color triggered an alert + * only if the alert maxcolor triggered an alert */ awalk->state = A_RECOVERED; + awalk->color = awalk->maxcolor; } if (oldalertstatus != newalertstatus) { This makes sure that when filtering recovery messages, we don't compare the current (most recent) color of the alert, but the worst color the alert has gone through. So when you have a filter like MAIL foo at bar.com COLOR=red RECOVERED and the service goes through the sequence green -> red -> yellow -> green you not only get a critical mail on red, but also a recovery mail on green. Or is the existing behaviour (without the patch) really intentional, and some people actually prefer to get only the critical mail without any recovery mail in this and similar cases? If so, why? Daniel