Availability alerting for arc-enabled machine using HeartBeat does not work.

NIJSTEN Stephen 80

Dear Microsoft community,

I want to configure an alert that fires when an arc-enabled machine has been down for 5m or longer. For this I use the heartbeat of the agent running on this arc-enabled machine. I wrote the following query for this:

Heartbeat| where _ResourceId has 'microsoft.hybridcompute'| summarize lastcall = max(TimeGenerated) by Computer, _ResourceId| where lastcall < ago(5m)

This query works when used in the log analytic workspace. But this doesn't trigger an alert when used in a alert rule.

Alert rule configuration:

Measurement

Measure: Table rows
Aggregation type: count
Aggregation granularity: 5 minutes

Split by dimensions

Resource ID column: _ResourceId

Alert logic

Operator: Greater than
Treshold value: 0
Frequency of evaluation: 5 minutes

Any idea why this doesn't trigger an alert?

Kind regards,

Stephen.

tbgangav-MSFT 10,386 Reputation points

2024-01-29T16:46:21.6133333+00:00

Hi @NIJSTEN Stephen , Can you set the aggregation type to maximum, which would ensure that the alert is triggered when the maximum value of the Heartbeat table rows is greater than 0.
NIJSTEN Stephen 80 Reputation points

2024-01-30T09:28:28.3333333+00:00

Hi tbgangav-MSFT, I'm not able to set the aggregation type to "Maximum". Only "Count" is available for this query.
tbgangav-MSFT 10,386 Reputation points

2024-01-30T17:38:59.4866667+00:00

Hi @NIJSTEN Stephen , You are correct. It might be something related to the "| where lastcall < ago(5m)" part of the query impacting here. Let me try to reproduce in my lab and get back to you with correct findings.

NIJSTEN Stephen 80

Thank you tbgangav-MSFT. I found another query which can partially fulfill my needs. The alert configuration is the same as in the description of this post. The query is:

let RelevantResources= Heartbeat      
	| where TimeGenerated > ago(1d)      
	| summarize TimeSinceLastHeartbeatSeconds=(now() - max(TimeGenerated)) / 1s by _ResourceId      
	| extend AgentState = iff(TimeSinceLastHeartbeatSeconds < 300, "Healthy", "Unhealthy")      				  
	| where AgentState == 'Unhealthy' or 'Unhealthy' == "All agents"     
	| project _ResourceId; 

let Trend= Heartbeat    
  	| where TimeGenerated > ago(1d)      	
	| where _ResourceId in (RelevantResources)      		
	| make-series HeartbeatsTrend=count() on TimeGenerated from (ago(1d)) to (now()) step (30m) by _ResourceId;  

Heartbeat  
| where TimeGenerated > ago(1d)
| where _ResourceId in (RelevantResources)  
| summarize TimeSinceLastHeartbeatSeconds=(now() - max(TimeGenerated)) / 1s    
	by    
 	_ResourceId,    
 	ResourceType,   
  	Computer,  
   	OSType,     
	OSName,     
	Version,     
	SubscriptionId,    
	ResourceGroup,
	Category,     
	ComputerEnvironment  
| join kind=inner (Trend) on _ResourceId  
| extend OS = strcat(OSType, iff(OSName == "", "", strcat(" (", OSName, ")")))  
| project     
	_ResourceId,     
	ResourceType,     
	Computer,     
	TimeSinceLastHeartbeatSeconds,     
	HeartbeatsTrend,     
	OS,     
	Category,     
	Version,     
	ComputerEnvironment,     
	SubscriptionId,    
	ResourceGroup 
| sort by TimeSince LastHeartbeatSeconds desc

I think the problem with this query is that the alert is using the aggregate count of the table rows at a given time. So for this example it counts the table rows every 5min (aggregate with granularity 5min) so if the undesired state is still the same as 5min ago THEN it will fire an alert. This is way too much of a window for alerting on a machine being powered down (window of 10min). Is there a way to not use an aggregate? I would like to have an alert that fires instantly if there is one table row at a given time. Kind regards, Stephen.

NIJSTEN Stephen 80 Reputation points

2024-01-31T08:54:34.56+00:00

Deleted comment

Share via

Availability alerting for arc-enabled machine using HeartBeat does not work.