How to prevent Incident creation for CIs in Event Management Maintenance (em_impact_maint_ci)?

[Sravani36]

Hi Team,

I understand that Maintenance Rules add the matching CIs to em_impact_maint_ci. My question is what happens next when an alert is generated for a CI that is under maintenance.

Does ServiceNow automatically mark the alert as Maintenance = true, and should the Incident creation Alert Management Rule have a condition like Maintenance = false to prevent incidents?

Is this the recommended OOB approach, or is there any other configuration required to stop Incident creation during maintenance?

Thank you

Sravani C

[Jeffreys Quinti]

Hi,

Does ServiceNow automatically mark the alert as Maintenance = true, and should the Incident creation Alert Management Rule have a condition like Maintenance = false to prevent incidents?

Yes SN will mark the alert as maintenance true based off  activated maintenance rules. There's a scheduled job that runs every few seconds to evaluate CIs in maintenance and adds/removes entries in the em_impact_... table

should the Incident creation Alert Management Rule have a condition like Maintenance = false to prevent incidents?

Normally yes, that depends on the customer's needs

Is this the recommended OOB approach, or is there any other configuration required to stop Incident creation during maintenance?

There are inconvieniences with the OOB rules.

-Your alert will be in maintenance for the whole duration of your change or until you document the end/date close it.

-A change that has no impact on the service will still put your CI in maintenance.

You can also consider developping a different rule to use the planned outage table if you're already documenting planned outages in change requests.