This alert is supposed to alert when a node goes down as long as it doesn't contain certain things in it's node name, but it is alerting even when the node name contains these things.
Here is what it looks like:
Trigger alert when ALL of the following apply:
Node status is equal to down
Trigger alert when NONE of the following apply
Node name contains "abcd"
Node name contains "efgh"
In the trigger actions I have it email me with the variable ${NodeName}, when I enable the alert I get alerts for servers with node names such as "abcd-server-2" and "efgh-system-h". The body of the email will confirm that the node name contains "abcd" and "efgh" with the ${NodeName} variable. To make it even stranger, I have an identical alert that says "trigger alert when ANY of the following apply" in the 2nd condition group and it works just perfectly(basically those alerts go to email group one, and all node down alerts that don't go to group one will go to email group two.)