Well since notifications not created I dont think notify logs can help, but I checked above rules and they look fine. This system is around for long years and most probably there is some kind of rule causes it. I almost gave up with fake checks, no other way to check rule? maybe some cmk command to fire test notification?