Use maintenance window fields

The in maintenance field is important when creating correlation definitions which identify alerts that are currently impacted by maintenance windows. You can use this information in conjunction with correlation definitions to reduce noise, or to prevent in maintenance alerts from triggering notifications to external systems.

Alerts created and updated outside of active maintenance windows have a value of false for this field. The value remains false, unless new events are added to the alert via deduplication during a matching active maintenance window.

Alerts created or updated during an active maintenance window have an in maintenance value of true. For this reason, it is recommended that you use the in maintenance field to determine whether an alert is currently affected by a maintenance window. However, it is important to note that the value for in maintenance switches from true to false for the alert when the maintenance window ends.

Because the value changes, you cannot use in maintenance to determine if an alert was ever impacted by a maintenance window. It only tells you if the alert received new events during the window that is active right now. Alerts that were impacted at some point by one or more now-expired maintenance windows have values for maintenance and maintenance windows. Once these fields contain values, they will always contain values, and you can use these fields to determine if an alert was updated during a maintenance window sometime in the past.

The following principles assume that the alerts match the maintenance windows. If an alert does not match the filter in an active maintenance window, then it is not identified as in maintenance. Maintenance window filters determine which alerts will be identified as in maintenance = true while the window is active.

Note that overlapping maintenance window schedules do not affect alerts at all. Only active, matching maintenance windows have any impact.

When alerts are not updated during a matching window, they are not added to any window.

Example 1. One window is active at a time

Alerts are placed in the maintenance window that's active when they are created or a new event is added to the alert. When maintenance windows expire, then alerts are no longer considered in maintenance. If another maintenance window becomes active later on, and the alert matches that window, then the same alert can become part of that window if new events are added. For this reason, it is possible for alerts to switch between in maintenance = true and in maintenance = false multiple times.

For a new alert:

1. Window 1 becomes active.

2. Alert 1 is created.

3. Alert 1 matches Window 1, so in maintenance = true and Alert 1 is in Window 1.

4. Window 1 expires.

5. For Alert 1, in maintenance = false.

For an existing alert:

1. Alert 1 is created.

   in maintenance = false

2. Window 1 becomes active.

3. Alert 1 matches Window 1, but because it has added no new events during the window, in maintenance = false for Alert 1.

4. Alert 1 updates with a new event while Window 1 is active.

   Now in maintenance = true for Alert 1.

5. Window 1 expires.

6. For Alert 1, in maintenance = false.

Example 2. Two windows are active and overlap

If two windows are active when a new alert is created (or an existing one updated), and the alert matches both windows, then the alert is included in the maintenance window that became active first.

1. Window 1 becomes active.

2. Window 2 becomes active 10 minutes after Window 1.

3. Alert 1 is created.

4. Alert 1 matches both windows but is included in Window 1 because it was active first.

If two maintenance windows simultaneously became active, and an alert matches both, then the alert could be in either window. It is not possible to determine in advance which maintenance window an alert would be in. However, an alert can only be in one active window at a time.

Example 3. Two active windows overlap and expire at different times

Whenever a maintenance window expires, Moogsoft Cloud checks for older alerts that could potentially be in active windows.

This affects overlapping windows as follows. In this example, Alert 1 matches both Window 1 and Window 2:

1. Window 1 becomes active.

2. Alert 1 updates with a new event and is included in Window 1.

3. Window 2 becomes active while Window 1 is active.

   Alert 1 is still in Window 1.

4. While both Window 1 and Window 2 are active, Alert 1 updates with a new event.

   Alert 1 is still in Window 1.

5. Window 1 expires.

6. The expiration of Window 1 triggers the addition of Alert 1 to Window 2.

   The alert switches windows, even though the alert has not added any new events after Window 1 expired. The alert is still in maintenance (in maintenance = true) though it is now part of Window 2.

Note that the process of moving alerts between windows is not instantaneous, so Alert 1 in this example may briefly show in maintenance = false after Window 1 expires.

This scenario only occurs when an alert is updated or created during the overlap of the two windows. If the alert did not update during the overlap, it would not move to Window 2 and in maintenance would be false when Window 1 expired.