We detected the following situation in customer environment and were able to reproduce it as follows:
I have modeled my PC as SysEdge device in my test environment.
In the next step I stopped the SysEdge agent on my PC and shutdown the primary SpectroServer.
Then I cleared the alert on the model on the secondary SS and recreated the alert by starting / stopping the agent.
Following that I started the primary SpectroServer again and noticed the same behavior, as I described in my initial description.
That means, the alert, that was still present on the model (alert from sec SS) had a cleared timestamp.
Release : All
Component : Spectrum Core / SpectroSERVER
When Primary SS starts, it will sync all secondary alarms and events with primary as during down time it's quite possible that few alarms got cleared on secondary and few got newly generated on secondary. After this sync, primary starts sending updates to secondary SS. In this update, there will be few alarms that will merge with secondary alarms. In the merge process, alarms will be cleared and with same alarm ID and a new alarm will be created. As the alarm ID is the same, this alarm will be linked with the same older event only. But as same alarm got clear first, so there will be an alarm clear on time and cleared by user information will be updated in event linked with this alarm. Also as we are creating a new alarm with same alarm ID, there will one active alarm for the same. This cleared alarm will also be seen in "Cleared Alarm History" OC tab. We can easily verify this flow by checking events for this device. By default create alarm(0x10701), system clear alarm(0x10702), user clear alarm(0x10706) are excluded so these events will not be seen under events tab. To these event we have to remove these event from "Events => filter => Event Type".
Events Tab of device:
Excluded Events:
This is working as designed.
In future releases, we will try to improve this behavior.