Closed alerts reopen after several days not honoring the evt_mgmt.active_interval propertyDescriptionThe "updated" field value of a closed alert that is being put in "maintenance" is being updated although it shouldn'tIt's been observed that for a closed alert, if the maintenance flag value changes, then it updates the "Updated" field on alert which it shouldn't.Logically, the updated field of open alert should be updated in such scenarios.Steps to Reproduce Close any open alert (create one by an event if none exist and close its alert right after)Look at the closed alert's "updated" field value.Change the CI state to maintenance and save.See its "updated" field value was updated although it shouldn't haveWorkaroundThis problem is currently under review. You can contact ServiceNow Technical Support or subscribe to this Known Error article by clicking the Subscribe button at the top right of this form to be notified when more information will become available.Below workaround steps can be followed to fix this issue in the impacted instance: Connect to the Instance and Navigate to System Definition > Business RulesOpen the business rule named "Set update time" and Switch to "advanced" tabTake a back up the existing script and add the condition to the script so the final script will look below.(function executeRule(current, previous /*null when async*/) {if ((current.state != "Closed") || (current.maintenance == previous.maintenance)) {// Update the alert update time to “now” at the end of all before BR’s// so it will not be in the past if before BR’s run long time (and can be missed by the impact copy job).var currentTime = new GlideDateTime();current.sys_updated_on = currentTime;}})(current, previous);Save the business rule. This will stop updating a closed alert in case it moves to maintenance mode.Related Problem: PRB1413047