Custom log alerts not resolved

Question

Hello All,

Custom log alerts are not resolved, Could you please tell us why these custom log alerts are not resolved automatically.

And we have written terrform code for both metric alert and custom log metric. Metric alerts are automatically resolved. In terrform we didnt mention auto resolve setting. But metric alert is resolved automatically, custom log alert not resolved automatically.

What are the statefull and stateless alerts in azure ?

Please tell us!.

Thanks

Answer 1

I haven't experimented with this feature but usually auto resolution requires a threshold or state for a monitoring system to auto resolve. Metrics are easy. When the metric drops the threshold it can be auto resolved. I assume the built-in policy alerts could also auto resolve based on the compliance status. In SCOM we use a timer or positive event to resolve the state.

Stateless and stateful refer to the ability to identify a state (healthy/unhealthy). Stateless is unaware of the state.

Ideally, when the query runs and the results are below the stated threshold the alert will be resolved. You might want to revisit the queries to ensure the outcome is represented as a threshold. In simpler terms it can be number of rows returned. If that is unsuccessful you might try rendering the results as time series (bin) data. Something like the following example; basing the threshold on the count.

SecurityEvent
| summarize count() by bin(TimeGenerated, 1h)
| render timechart