Custom log alerts not resolved

Rajesh Bommagani 81 Reputation points
2022-11-25T13:28:19.313+00:00

Hello All,

Custom log alerts are not resolved, Could you please tell us why these custom log alerts are not resolved automatically.

And we have written terrform code for both metric alert and custom log metric. Metric alerts are automatically resolved. In terrform we didnt mention auto resolve setting. But metric alert is resolved automatically, custom log alert not resolved automatically.

What are the statefull and stateless alerts in azure ?

Please tell us!.

Thanks

Azure Monitor
Azure Monitor
An Azure service that is used to collect, analyze, and act on telemetry data from Azure and on-premises environments.
2,988 questions
Azure AI Metrics Advisor
Azure AI Metrics Advisor
An Azure artificial intelligence analytics service that proactively monitors metrics and diagnoses issues.
80 questions
{count} votes

1 answer

Sort by: Most helpful
  1. Andrew Blumhardt 9,841 Reputation points Microsoft Employee
    2022-11-25T15:39:13.873+00:00

    I haven't experimented with this feature but usually auto resolution requires a threshold or state for a monitoring system to auto resolve. Metrics are easy. When the metric drops the threshold it can be auto resolved. I assume the built-in policy alerts could also auto resolve based on the compliance status. In SCOM we use a timer or positive event to resolve the state.

    Stateless and stateful refer to the ability to identify a state (healthy/unhealthy). Stateless is unaware of the state.

    Ideally, when the query runs and the results are below the stated threshold the alert will be resolved. You might want to revisit the queries to ensure the outcome is represented as a threshold. In simpler terms it can be number of rows returned. If that is unsuccessful you might try rendering the results as time series (bin) data. Something like the following example; basing the threshold on the count.

    SecurityEvent
    | summarize count() by bin(TimeGenerated, 1h)
    | render timechart

    0 comments No comments