Alarms with odd behavior


I am currently working on a project where a client wants a list of all the alarms. The standard alarm status table component is not sufficient in this case since the client wish to see each associated data as a new column.
For this reason I have explored to ways of building this table on my own.

  1. option is to use the system.alarm.queryStatus() and get the status for all current alarms. Here I am able to return a dataset with the desired columns.
  2. option is to query the two tables, alarm_events and alarm_events_data, configured for the alarm journal.

I ended up going for the second option and query the two tables and everything works just fine.
However, I have noticed that some alarms shown in my solution only has a cleared event time and no active event time. I find this extremely odd since I assume that for an alarm to be cleared it needs to be active first.
When I check with the standard component, alarm status table, I can find the same alarm but here the active event time is exactly the same as the cleared event time down to the second.
It could look like ignition is just using the same time for the cleared event time as for the active event time.

Here is an image of the query browser to give a better understanding of the problem. As you can see the alarm with the specified eventid only has a cleared eventtype:

Here is an image of an alarm with a active, cleared and acknowledged alarm:

I have noticed that these events with only a cleared event time is for tags created inside a UDT.
So far my theory is that the alarms initially don’t have an event state and therefore goes directly to cleared? Are any of you able to give a better explanation of this behavior?
It is important that I understand why this is happening in order to be sure that my solution works and to be able to explain the reason why these strange alarm events are happening to the client.

All help is very much appreciated.