Alerts "Maintenance" field is updated without clear logic as to what is controlling this behavior, maintenance on/off.
An alert will be put into maintenance when either:
- The CI associated with the alert status is set to "in maintenance"
- An active change request for the CI meets the following conditions:
- The state is Scheduled or Implement.
- The current time is between the "planned start date" and "planned end date" on the change request OR the current time is between the "actual start date" and "actual end date" on the change request.
When a child CI is put in maintenance, it puts the parent CI in maintenance as well. Therefore, for CI(s) such as a business service, the maintenance field will alternate from true to false or false to true, more often.
The alerts are set to maintenance = true so that its impact is not shown on the CI's impact calculations.
This behavior is expected. More information can be found at the following link, for Kingston (or search for the following document titles for your version in docs.servicenow.com):
How Alerts Work with CI(s) in Maintenance:
Create Maintenance Rule: