First incident: Server1 is down, system works on Server2 and Service is available. In Service Desk 4.5(SP21) we register only one incident with CI=Server1, field Service is empty (or Impact=Low) as Service for end-users is available.
Second incident: Server2 is down. Command sd_event.exe should generate many incidents with Parent CIs, in some of Incidents the field Service is filled. So downtime will be shown in SLA Reports.
What is the best way to build DB Rule so Service Desk could “understand” that two servers are in Cluster?