NetCrunch keeps extensive logs, in order to provide the administrator with the most reliable information when it comes to the performance of the network. Here you can see each event, as well as correlated events. For example, a node or service going down and the same node or service going up can be treated as a correlated event, and the NetCrunch Event Log can treat this as an issue which already has resolved itself. If you are not concerned about a particular node going down and up (for example, when it’s a desktop workstation), alerting you about dozens of nodes being restarted during a normal workday would create an alert overload. Therefore, NetCrunch tires to alert you of events in your network which are still relevant and occurring, rather than bothering you one-off or past events, which have already resolved. Of course, this feature can be turned off to your liking.
More details about how NetCrunch treats alerts and event logs is outlined here, including: pending alerts, conditional alerts and advanced alert correlation available in NetCrunch Premium XE. AdRem KnowledgeBase additionally outlines conditional alerts and advanced correlation here.