Masked systemd units shouldn't alert

We sometimes have masked systemd units with a failed status, for instance:

* mariadb.service
   Loaded: masked (/dev/null; bad)
   Active: failed (Result: exit-code) since Sat 2018-10-27 07:00:49 GMT; 10min ago
 Main PID: 7939 (code=exited, status=1/FAILURE)
   Status: "MariaDB server is down"
      CPU: 214ms

this currently results in a SystemdUnitFailed alert. The alert should exclude masked units.