How do query Azure logs for occurrences of alert by VM?

Matthew Scott 45 Reputation points


Excuse my ignorance, but I'm just learning this. We have a number of alerts set up and they are working without issue. I wanted to learn how I could query the Azure logs to find all occurrences of an Alert for a specific resource. For example, I'd like to find all the times in the last 30 days that a lowMemory alert was fired for a specific VM.

The second part to this is that I'd like to put this on a dashboard. So we could see the total number of times the lowMemory alert fired, then drill into it to see the total number of times it fired by resource, and then drill in further to review the actual alerts of this type for the resource.

I hope I am explaining this well enough.

Thank you!


Azure Monitor
Azure Monitor
An Azure service that is used to collect, analyze, and act on telemetry data from Azure and on-premises environments.
2,867 questions
{count} votes

Accepted answer
  1. Clive Watson 5,801 Reputation points MVP

    For part 1, a simple example would be this snippet below. This could be much improved.

    Workbooks are pretty good to use for the 2nd part of your question, I'll add an example later.

    | where AlertName contains "lowMemory" and Computer =="<insert my vm name>"
    1 person found this answer helpful.

0 additional answers

Sort by: Most helpful