I have experienced similar issues with Windows nodes. The volume was "up" at the time as well as the node. I created an alert with an advanced query as follows:
SELECT Nodes.NodeID AS NetObjectID, Nodes.Caption AS Name
FROM Nodes
INNER JOIN Volumes ON (Nodes.NodeID = Volumes.NodeID)
WHERE
(
(Nodes.Status = '1') AND
(UnManaged = '0') AND
(
(LastSystemUpTimePollUtc < DATEADD(hour,-1,GETUTCDATE()) OR
(Volumes.VolumeResponding <> 'Y')))
)
Basically I want to know if the Volume is responding and the node has been polled within the last hour. Of course I'm getting CPU/Memory data from the node, not as a "volume" element which is probably how are getting it. In your case perhaps just the Volumes.VolumeResponding <> 'Y' part would be useful.
I hope this helps.