Avoid double trigger the same alerts.

Question

Hello everyone,

I don't know what to do anymore, I tried everything, but it worked. I ask you to help. There is a ContainerLog which comes every 35 seconds. You need to make a warning so that there is some string inside the log. For example,

ContainerLog |where Image has "nginx" and Log has "Log=Warning"  

I made an alert custom log search and the alert logic is

Operator: greater than   
Threshold value: 0   
Frequency of evaluation: 1 minute.  

Measurement

Measure: Table rows  
Aggregation type: Count  
Aggregation granularity: 1 minute  

If you need more info, I can provide.

Thanks,

Regards,
Nasimjon.

Answer 1

Hi, It is not completely clear what issue you have exactly and what your question is. Nevertheless, I will try to guess and answer best on your guess. I will start with the title of your question: "Avoid double trigger the same alerts." You will not get alert triggered for twice for the same data. Each time the alert rule triggers it produces a separate alert instance. Each alert instance is triggered for different set of data (parameters). So even if you see many of the information repeating in the results of the data something will be different like the TimeGenerated value. With the information provided a new alert instance will be generated every time there are results from the query. For example, let's say you have created the alert, and you get 5 alert instances in the next 10 minutes. When you execute the query on your own you will see for example 5 records for the same thing but each one of them generated at 2 minutes difference between each other. This is how the alert rules work. If you need more information on Log Alert v2 you can check my blog post. In the blog post you can also find a link to another blog post explaining Log Alert v1 as well. In general, v1 and v2 work in the same way but v2 adds some important capabilities to enhance the experience of setting alert rule. When you read the blog post take a note on the stateful vs stateless capability (auto mitigate feature). As you are alerting based on events not metrics I would not advise you to use stateful capability as the alert rule will not work correctly. Stateful is suitable for metrics data which has a constant logging of data on certain frequency. Depends on what you want to achieve exactly may be Mute action option could be suitable for you. But keep in mind that the mute action will halt the whole rule for the number of time you specify. So even if you get warnings for another container during that mute period you will not get alert instance.

Please "Accept the answer" if the information helped you. This will help us and others in the community as well.