date - office hours start time - office hours end time - is working day
01/01/2017 - 08:00 am - 08:00 pm - 0
02/01/2017 - 08:00 am - 08:00 pm - 1
...
09/01/2017 - 08:00 am - 08:00 pm - 1
10/01/2017 - 08:00 am - 08:00 pm - 1
11/01/2017 - 08:00 am - 08:00 pm - 1
...

date - system downtime start time - system downtime end time
01/01/2017 - 08:17 am - 9:43 am
10/01/2017 - 7:00 pm - 8:00 pm

EventID - start datetime - end datetime - effective duration
1 - 01/01/2017 7:40 am - 01/01/2017 8:40 am - 0; Comment: 0 is because though there was a dowtime of the system overlapping this event, the event itself was during non working day
2 - 09/01/2017 7:40 am - 11/01/2017 11:00 am - 24; Comment: [total duration of event] - [out of office hours overlapping the event] - [system downtime during office hours] = 24 hours
3 -