To find which notify rule was used that generated multiple emails use SQL Query Analyzer, select the Altiris_Incident database and run the following query. This query may require multiple execution to find the version that generated the multiple emails. Substitute '128' with the incident where the emails were generated from. The version can be incremented until you find a workitem_rules_fired column value that has multiples of the same number (see example below).
1. Select workitem_rules_fired from workitem_detail_view where workitem_number = '128' and workitem_version = '1'
2. Select wuci_name from wuci_history where id='<duplicate workitem ID number>'
Incident 128 has generated 4 emails from one notify rule, but not sure which notify rule generated the emails. Use query 1 from above and will get the results below:
From the query found that workitem_rules_fired - '130' was executed 4 times. Using the 130 value, execute query 2 from above.
In the wuci_name value the notify rule used was 'Incident Assigned to Worker' is the rule that generated the emails.
This issue requires several conditions to be true before the issue will surface.
1. Have inactive Notify rules that are set to default or the rule was active on workitems before the rule was made inactive.
2. The inactive notify rule(s) ID must be greater than the ID of an active notify rule that is evaluated (set to default).
3. The active evaluated notify rule must evaluate to true.
This issue is resolved in Helpdesk SP5 (6.0.308)
Export all the inactive notify rules using the "Admin Export" menu option and then delete all the inactive notify rules that were just exported. (Recommended)
Make all inactive notify rules active with an addtional Advanced condtion of 1 is equal to 0 so that what was an "inactive" rule will always evaluate to false.
Helpdesk SP3 (6.0.292)
Helpdesk SP4 (6.0.297)