Alert suppression during change window or change outage window

[SaswatiC]

Dear Members,

I came across a query recently and would really need your help to know how alert suppression works for change. Is it like alert turned off for all the affected CI of change during planned change window? What if change has outage records in it with outage start and end time, will alert suppression follow change outage window or it follows only change planned maintenance window? It would be really helpful if you can help to know how it works and why. Thanks.

[wojasso · Accepted solution]

When Event Management (EM) is integrated with Change Management, the out‑of‑the‑box "CI in Change Window" maintenance rule automatically marks configuration items on a change request as **in maintenance** when the change enters the implementation phase. This creates a record in the **em_impact_maint_ci** table and suppresses alerts: events for those CIs are still stored, but alert rules are not processed and the Alert Console filters them out. When the change leaves implementation, the CI is removed from maintenance and normal alert processing resumes.

Key points:

* **Planned window drives suppression.** The OOB rule uses the change’s **planned start** and **planned end** dates to calculate the maintenance window. Once the change moves into **Implementation**, all affected CIs go into maintenance for the full planned window. No outage record is needed for this to happen.

* **Outage records are for availability reporting.** CI outage records created on a change serve a different purpose—they record downtime for availability metrics. By default they do **not** control Event Management suppression. If you want alerts suppressed only when an outage exists, you must build a custom maintenance rule that reads the outage table.

* **Custom fields or windows.** If your process uses custom start/end fields or you want to tie suppression to a different window, clone the "CI in Change Window" maintenance rule and modify the script to read your custom fields or outage table. The suppression logic runs in the scheduled job **Event Management – Maintenance Calculator**, which adds or removes CIs from *em_impact_maint_ci* according to your rules.

In summary, Event Management suppresses alerts for all CIs on a change during the change’s planned maintenance window once the change is in implementation. Outage windows are not considered unless you implement your own maintenance rule.

[SaswatiC]

Thank you so much for helping out here to understand the concept.