How to check Alerts triggered on App Services

Question

How to check Alerts triggered on App Services

Priyanka Mahadik 21

We are currently getting too many alerts on our APP SERVICES which is informational level but it was triggered for the whole day till I did not disable it, need to find out why are we getting those and the alerts are of All Admin Tasks which is configured on Azure Monitor over our Production Environment.

Below is the screenshot of the alerts triggered through email.

User's image

AnuragSingh-MSFT 12,971 Reputation points

2023-05-23T14:48:37.35+00:00
@Priyanka Mahadik , the alert was triggered based on Activity Log. I would suggest looking at the alerting criteria of the rule whcih is creating the alert. You can get the rule by followig the steps below:

In Azure, search for "Monitor" --> Alerts.

Click on the Alert in portal --> This would open a blade with details of alert, like criteria, time, description etc.

On the bottom right of the blade, look for "Alert rule"

Clicking it would take you to the rule generating the alert. Click on "Edit" command and review the criteria.

Based on the symptom, either of the following 2 things are happening:

The activity for which this alert rule was configured happened multiple times throughout the day

The filter used in the criteria is too broad and the criteria is also selecting additional activities which are not even relevant.

Please review the alert criteria and rectify it as required.

Hope it helps. Please let us know if you have any questions.
Priyanka Mahadik 21 Reputation points

2023-05-24T11:56:52.8933333+00:00

I had checked the criteria of alerts as I understand if we perform any of the activity the alert gets triggered but continuously if no activity has been made than too if I receive those its unusual so just wanted to have clarity over the continuous generation of All Admin Task Alerts.

Also sharing a screenshot which shows Activity logs which has been auto generated.
AnuragSingh-MSFT 12,971 Reputation points

2023-05-26T08:35:04.3066667+00:00
@Priyanka Mahadik , thank you for the reply. I am sorry, I could not understand the scenario completely. Can you please answer the query below to help me understand it better?

Are you saying that there are no activity logs generated, and STILL the alerts were getting triggered? OR

The activity logs are getting generated even when nothing is being performed on the resource.

If the scenario is the second point, I would suggest looking at the details of the activity (sessions started) here. As I can see, there are multiple logs of similar Operation name. This might be getting triggered on schedule or through something else.

Please clarify the scenario above to help us understand it better.
AnuragSingh-MSFT 12,971 Reputation points

2023-05-31T05:38:26.1466667+00:00

@Priyanka Mahadik , following up to check if you had a chance to review the questions above.

Please answer the question in my reply to help us understand this issue better.
Priyanka Mahadik 21 Reputation points

2023-06-02T10:31:38.0733333+00:00

The activity logs are getting generated even when nothing is being performed on the resource.
AnuragSingh-MSFT 12,971 Reputation points

2023-06-05T07:17:05.24+00:00
@Priyanka Mahadik , thank you for the clarification. The screenshot shared are for "Sessions" getting created. Please click on this session to verify the scope. Most probably, these are related to DaaS session (Diagnostics as a Service), which can be verified by examining the scope of JSON for the session start. It would be similar to following:

These get created if you are visiting the resources under "Diagnose and Solve Problems" resource menu. Generally, there is a lag of few minutes for the activities to appear in the activity log.
In this scenario, I would suggest the following:

Update the Alert rule to not capture this activity for alerting.

Disable the alert rule, if it was created specifically to capture this scenario. As a single time navigation in the "Diagnose and Solve Problems" will trigger multiple such events (although nothing is being changed on the app itself).

Hope this helps.

AnuragSingh-MSFT 12,971 Reputation points

2023-05-23T14:48:37.35+00:00

@Priyanka Mahadik , the alert was triggered based on Activity Log. I would suggest looking at the alerting criteria of the rule whcih is creating the alert. You can get the rule by followig the steps below:

In Azure, search for "Monitor" --> Alerts.

Click on the Alert in portal --> This would open a blade with details of alert, like criteria, time, description etc.

On the bottom right of the blade, look for "Alert rule"

Clicking it would take you to the rule generating the alert. Click on "Edit" command and review the criteria.

Based on the symptom, either of the following 2 things are happening:

The activity for which this alert rule was configured happened multiple times throughout the day

The filter used in the criteria is too broad and the criteria is also selecting additional activities which are not even relevant.

Please review the alert criteria and rectify it as required.

Hope it helps. Please let us know if you have any questions.
Priyanka Mahadik 21 Reputation points

2023-05-24T11:56:52.8933333+00:00

I had checked the criteria of alerts as I understand if we perform any of the activity the alert gets triggered but continuously if no activity has been made than too if I receive those its unusual so just wanted to have clarity over the continuous generation of All Admin Task Alerts.

Also sharing a screenshot which shows Activity logs which has been auto generated.
AnuragSingh-MSFT 12,971 Reputation points

2023-05-26T08:35:04.3066667+00:00

@Priyanka Mahadik , thank you for the reply. I am sorry, I could not understand the scenario completely. Can you please answer the query below to help me understand it better?

Are you saying that there are no activity logs generated, and STILL the alerts were getting triggered? OR

The activity logs are getting generated even when nothing is being performed on the resource.

If the scenario is the second point, I would suggest looking at the details of the activity (sessions started) here. As I can see, there are multiple logs of similar Operation name. This might be getting triggered on schedule or through something else.

Please clarify the scenario above to help us understand it better.
AnuragSingh-MSFT 12,971 Reputation points

2023-05-31T05:38:26.1466667+00:00

@Priyanka Mahadik , following up to check if you had a chance to review the questions above.

Please answer the question in my reply to help us understand this issue better.
Priyanka Mahadik 21 Reputation points

2023-06-02T10:31:38.0733333+00:00

The activity logs are getting generated even when nothing is being performed on the resource.
AnuragSingh-MSFT 12,971 Reputation points

2023-06-05T07:17:05.24+00:00

@Priyanka Mahadik , thank you for the clarification. The screenshot shared are for "Sessions" getting created. Please click on this session to verify the scope. Most probably, these are related to DaaS session (Diagnostics as a Service), which can be verified by examining the scope of JSON for the session start. It would be similar to following:

These get created if you are visiting the resources under "Diagnose and Solve Problems" resource menu. Generally, there is a lag of few minutes for the activities to appear in the activity log.
In this scenario, I would suggest the following:

Update the Alert rule to not capture this activity for alerting.

Disable the alert rule, if it was created specifically to capture this scenario. As a single time navigation in the "Diagnose and Solve Problems" will trigger multiple such events (although nothing is being changed on the app itself).

Hope this helps.

How to check Alerts triggered on App Services

Activity