Summary
In thold_functions.php (lines ~3178-3224), $trigger starts as an integer (the configured fail count) but gets overwritten with a boolean to drive the email subject line:
$trigger = $thold_data['time_fail_trigger']; // integer, e.g. 3
// ... re-alert logic ...
if ($notify) {
$trigger = false;
} else {
$trigger = true;
}
$subject = get_email_subject('ALERT', $trigger, ...);
// Later, still using the now-boolean $trigger:
$thold_snmp_data['eventFailCountTrigger'] = $trigger; // false or true, not the count
eventFailCountTrigger in every type-2 SNMP trap is always 0 or 1. The alert path in type 0 uses a separate $etrigger variable to avoid this.
Fix
Use a separate boolean variable (e.g., $etrigger) instead of clobbering $trigger.