alert macro and SERVICE rule