default to alerts.totalOpenTime, not used, but useful for ldapinfoshow
remove duplicate search string for auto generated rule
fix revertRules