I suppose that you have option "process all thresholds" turned on. If this is the case then for all values in first four thresholds last threshold will also be activated. Then you will have two active thresholds, and when UPS goes back online, both will be deactivated, generating two UPS_ONLINE events. There are few possible fixes:
Do not use "process all thresholds" - it should work as expected without that option.
Use more complex condition for last threshold - exclude all explicitly checked values.
Use different deactivation event for last threshold.
Best regards,
Victor
