I will have to give it a try myself, but why is the alert configured so, its just a basic question, you would know your system better than me for sure , why aren't you actually monitoring the process or service or event logs for cluster failover? Do you have SAM in your environment ? If you don't then it makes sense.
As well please paste your complete trigger condition and scrub the information which is client specific, let me look into the complete trigger condition.
Yes, I do have SAM. Have seen the SAM template available for this but the requirement is to get an alert only when the cluster is failed over to Node2. We shouldn't get alerts when it fail overs to Node1.
I've attached the screenshot of the trigger condition in the question description.
Perfect, in that case just create an alert like the one mentioned below:
1. Start monitoring Cluster Service on both the nodes, create a template -> create a cluster service monitor and place this template on both the nodes.
2. Create an alert only when the below condition is met
a. 'Cluster Service' up on Node2 AND 'Cluster Service' down on Node1
1. Enable Event log monitoring on Node 2 and capture/monitor specific Event ID (Event Log Monitor on Node 2) 'Cluster Service failover' Event Id or 'Cluster Service coming up' Event ID.
2. Trigger an alert based on the Event ID
Why don't you change that trigger condition of yours and give it a try, rather than ends with , try 'contains' Node2 / 'is-equals' Node2