Here's my scenario
The NOC receives alerts on SAM alarms that fire off after a Windows Update does its thing and reboots. I do not want those alerts to go out, but here's my dilemma:
- The patch window is four hours and it's unknown which server is being patched at what time. I don't want to put each server in a maintenance window for 4 hours. A lot can happen in four hours.
- I could put a 10-15 minute condition on the alert, but I don't want the the users to report the problem before we know about it.
I think the lesser of the two evils is the 10-15 minute condition, but I'm curious what other people are doing.