Right now it's not possible. Services do not have "expected state", as interfaces do. Right now they are expected to be up, so if normal state for network service is "down", you'll always get critical status.
As a workaround, you can handle SYS_SERVICE_UP / SYS_SERVICE_DOWN (there is default rule for that in Event Processin Policy, so add your rule before that and select "stop processing" checkbox) to create alarm / send notification.
To prevent "critical" status on the node itself as well as whole tree, you can status propagation for service to fixed -> Normal. This way service itself will be shown with red dot, but whole tree will be left intact.
[image: Screen Shot 2013-01-18 at 12.56.00 PM.png]
