Facing challenges with a suppression rule that isn't working as expected for a couple of servers, despite following Microsoft's configuration suggestions

Question

How do you troubleshoot a suppression rule, if it does not work for a couple of servers?

PS - Based on the issues that we have seen from multiple customers and sources, we are posting these questions to help the Azure community.

Answer 1

@AnuragSingh-MSFT - Thanks for reaching out to us.

1. Verify the scope of the suppression rule is correctly set to the Log Analytics Workspace.
2. Add three specific filters to the rule:
3. Ensure the alert condition is set to 'Fired'.
4. Use the 'contains' operator in the alert context (payload) filter.
5. Apply the 'contains' operator for the alert rule ID filter. These steps should correct the suppression rule's functionality for the servers in question.

Hope this helps. and please feel free to reach out if you have any further questions.

---

Please don't forget to "Accept as Answer" and click "Yes" if the above response is helpful, so it can be beneficial to the community.