Just a point on this - devices don’t listen for associations. Other devices get configured to send notifications, so it would be other devices that potentially could be configured with an association to change the state…
Thanks for your check…
That means - OH (the binding) does see the “change state of a switch” but does not sniff what messages made other nodes react like this…hm, then DEBUG logging does not help at all in this case… 
If you say “get configured to send notifications”…where would i find such settings?
Configuration Parameters? or Device Configuration?..
I guess “include in ALL ON Groups” needs to be excluded as well in order to never react to ALL ON notifications, right?
I’m not sure I understand what you mean. The binding only logs ZWave information. In this case, it logs the messages coming in from the device to say that the device has changed state. It doesn’t log what changed the state - either because it wasn’t triggered through ZWave, or at least it wasn’t triggered through the ZWave binding.
This effectively points to either the device randomly changing state (which seems unlikely if there are multiple devices doing this) or to something else in the ZWave network sending the command through a linked association.
Associations are configured in the configuration options in each thing. If a device supports associations then there should be an associations section shown in HABmin (this is a separate section to Configuration Parameters and Device Configuration).
Yes, if you are using “All On” type commands, then you might need to disable this function in switches that don’t require it.
Thanks Chris…
I mean that my hope was that the binding logs all traffic in the zwave network that even is not related to the controller. So i could see if a certain message not intended for the controller is in charge of turning suddenly ON some switches. Relatively sure that it has to be some trigger from a node otherwise not always the same switches turn ON without any defined rule.
Not using SWITCH-ALL, but my thought is that if there is a e.g. alarm from a sensor that sends ALL notifications that some ALL-configured nodes would react…
Strange to me that this behaviour never happened for years but suddenly…but one can also assume that by growing the amount of nodes over time, the “bad” guy came in some day…
Cheers,
No - the controller doesn’t even see all the traffic… It’s a network - nodes can communicate directly, and they don’t have to go via the controller.