When I disable a red alert, first a "recovery" notice is sent, indicating that the host "recovered". Then the disable notice is sent, informing that the host was disabled. The first message is a bit confusing since for example it will say the host recovered but the df output in the email/page clearly shows the disk is still 99% full.
I would think that recovery messages should not be sent if a host/service is DISABLED, but perhaps it is a feature to notify folks who do not have the NOTIFY tag on their alert definition?
-Charles