Weird Alerting behavior...bug or expected??

  If you have a test hobbit server you could change your
time on the server and run some test alerts to see which rule is getting
hit.
  

You don't have to change the time on the server to simulate alerts. Check the man page of hobbitd_alert. It has a --test option that lets you test any alert scenario, including allowing you to set the duration and time.

-Charles