Ninjaz-5333 avatar image
0 Votes"
Ninjaz-5333 asked bharathn-msft edited

Can't build a Heartbeat alert from Monitor | Logs

My goal is to reboot a vm whenever it has failed.

I previously tried the approach of creating an alert based on memory % (indeed, failures seem to be caused by a memory leak), via VM Insights. But that doesn't always work, as sometimes it seems some machines are failing without triggering the memory limit alert. This seems to be because they stop sending the monitoring data (probably because of the failure itself!).

Anyways, Monitor seems to be suggesting something perfectly tailored to my needs: Heartbeat, and the related queries.

I tried the following, grabbed from the Queries library:

 // Not reporting VMs 
 // VMs that have not reported a heartbeat in the last 5 minutes. 
 // To create an alert for this query, click '+ New alert rule'
 | where TimeGenerated > ago(24h)
 | summarize LastCall = max(TimeGenerated) by Computer, _ResourceId
 | where LastCall < ago(5m)

Alas, when clicking on the New Alert Rule button, I see the following error message:

The query didn't return the TimeGenerated column. Please edit the query and include the TimeGenerated column.

Please see screenshots attached.

How to overcome this error and get an alert based on Heartbeat failure?

Any other suggestion for building a reliable "reboot on failure" alert are welcome.

The Monitor | Logs interface with the queries library:


The Query with the New Alert button:


The Create Alert pane that shows up after clicking the New Alert button, with the error message:


siyji.png (365.6 KiB)
wj2qd.png (112.9 KiB)
r27te.png (173.6 KiB)
· 3
5 |1600 characters needed characters left characters exceeded

Up to 10 attachments (including images) can be used with a maximum of 3.0 MiB each and 30.0 MiB total.

@Ninjaz-5333 - Welcome to Microsoft Q&A, thanks for reaching out.

Apologies for your experience , I am able to repro the issue and will further work with our Internal team to better understand the issue and get back to you.

Meanwhile, can you please help confirm that you have selected the scope to respective workspace or resource where you are expected to see the Heartbeat events.


If you have selected the right scope and click on "+ New alert rule" , you should see some thing as below instead of the preview view you had earlier.


Please review the above and get back to us on what you see. Thanks

0 Votes 0 ·
alert-rule.png (82.7 KiB)

Thanks for the suggestion but even after the scope selection I still have the "preview" word appearing and the same error.

0 Votes 0 ·

@Ninjaz-5333 - Checking in to see, if you had a chance to review the information shared and have any further queries. Thank you.

0 Votes 0 ·

1 Answer

bharathn-msft avatar image
0 Votes"
bharathn-msft answered bharathn-msft edited

<<Moving the information from comments to here for broader community usage >>

@Ninjaz-5333 - Apologies for delay in getting back to you on this. Post validating with the internal team it was called out that currently the query you are running is not supported in the preview API (the examples target the GA experience). Team is working to change this soon in the preview as well ( probably it might take at least a month to get to the UI side) , for now use the GA option or change the query to be:

| where TimeGenerated > ago(1h)

Further use the alert controls to set the alert logic.

Please let me know if you have further queries. Thank you

5 |1600 characters needed characters left characters exceeded

Up to 10 attachments (including images) can be used with a maximum of 3.0 MiB each and 30.0 MiB total.