Several date/time fields on the event record like initial_event_time and last_event_time are being cleared out when an alert moves out of a maintenance window.
When a CI is in a change window, if an event comes in for that CI, an alert is created for it with maintenance flag set to true, because the CI is in change window. At this point the initial and last event times have valid values. Once the change is closed, the maintenance flag on the alerts is removed, causing all the glide_date_time fields on the alert to be emptied.
The impact calculator runs when there are any changes to the alert. Once the maintenance flag on the alert becomes inactive, the impact calculation triggers and calls a method in the backend code that is blanking out the fields.
Steps to Reproduce
1 - Create two alerts on a CI.
2 - Set one to closed and leave one open.
3 - Set one alert with maintenance=true.
4 - Run the background script below against the alert in maintenance.
var alert = new GlideRecord('em_alert');
alert.addEncodedQuery('numberSTARTSWITHAlert0013047'); // Change the alert to reproduce the issue
While a definitive fix is not available yet, import the attached business rule which runs on the [em_alert] table. This will copy all the alert fields before update, and will rewrite these date fields back into the alert. When the alert moves out of maintenance, the fields will be cleared out .
You can add more alert fields to the script if needed:
current.sys_created_on = previous.sys_created_on;
current.initial_remote_time = previous.initial_remote_time;
current.last_remote_time = previous.last_remote_time;
current.initial_event_time = previous.initial_event_time;
current.last_event_time = previous.last_event_time;
current.flap_start_window = previous.flap_start_window;
current.flap_last_update_time = previous.flap_last_update_time;
current.u_monitoringlink = previous.u_monitoringlink;
Related Problem: PRB1291875