ExpertCan't tell if past alerts were during an SDT or not?!
I consider this a bug, but maybe it's WAD and needs to be reevaluated.
When an alert occurs during an SDT, the "IN SDT" field for that alert gets set to True. This is good because the alert is during an SDT. The problem is that once the alert clears, even if it's still in an SDT, the IN SDT field gets changed to False. This is not good. Because it does this, there is no way to run a report on alerts for the week/month/whatever and tell which ones were during an SDT and which ones weren't.
Example:
We do patching every month and this causes some of our websites and servers to go down, and CPUs to spike, while things are installing and rebooting. We set these to an SDT because we know it's going to happen. When we go to run our monthly alert reports, we see lots of errors for uptime, ping, CPU, etc from the checks that ran during the reboot. We don't need to investigate these because they were during SDT which means they were expected. When I set the IN SDT field to False in the report, assuming it's going to then show me only the alerts that occurred outside of an SDT, that's not what I get. I get EVERY alert because that field gets set to False for every alert when it clears.
I don't understand what the rationale is for doing this as it removes very important functionality for anyone who runs reports after-the-fact. Simply leaving the IN SDT field alone, when the alert clears, would solve this problem. If the alerts cleared while in an SDT, leave the field as True. If the alert cleared wile not in an SDT, leave the field as False. That way I can tell, and run reports on, which alerts were expected and which were not.
Thanks
