Here is an example scenario:
We have a node with a few assigned application monitors on it. Let's say one of these app monitors on this node gets unmanaged for whatever reason. Then, while that app monitor is unmanaged, the node it lives on gets unmanaged for another reason. When we remanage that Node the app monitor that was previously unmanaged gets remanaged along with the node. That shouldn't happen and I don't recall this being the way it used to happen. If we unmanage an application monitor then that application monitor should stay unmanaged until it either reaches the end of it's unmanage duration, or we manually remanage that app monitor specifically. Remanaging the node should not effect that app monitor in any way.
We are on NPM 12.2, SAM 6.6.0, Orion Core 2017.3.5 if it matters. However, one of my co-workers said that this has been happening for a while now, so either it's always been this way and I never noticed, or it was introduced a few versions ago. It is a pain because whenever we do patching we unmanage all of our Windows nodes, so we have to make sure to first get a list of all of the app monitors that are already unmanaged before we unmanage the nodes so that when patching is over and we've remanaged the nodes we can go back in and manually unmanage those apps again. If we forget to do this step then we are in some real trouble because we've got to go figure those apps out before we start alerting on them and disturbing others.
Has anybody else experienced this? Also, and maybe alterego can answer this better than anyone else, but is this the expected behavior? If not, is there a fix for this that either we can implement ourselves or that support can help us with?
I'm not aware of this being a change in behavior. While that's certainly possible, it's certainly not something that's changed in the last few releases. I can though, see how this would be annoying and not necessarily the most desirable behavior. As such I've logged this internally under SAM-7119.