It's possible that ntservices and/or processes probe triggers the alarm at the second time that a nt service or a process be found in down/stopped state?... This is to act as the cdm probe where we can configure the samples parameter.
Thanks...