Automatically clear Log alerts

Question

Hi,
we are using Log Alerts V2 and Log Analytics (Monitoring Service) alerts e.g following query to generate log alerts.

Heartbeat  
| where TimeGenerated > ago(12h)  
| summarize LastCall = max(TimeGenerated) by Computer, _ResourceId  
| where LastCall < ago(2h)  

We have issues that alert never goes to "Resolved" states and we thus never received email when alert is cleared even thought in reality alert is basically resolved. Are there any work around to resolves this 'problem'?

This is also enabled for the alert

Answer 1

Hi,
Try with the query below. Set aggregation granularity to 12 hours. For Measure choose HeartBeatMissing and for aggregation type Average. Add Computer and _ResourceId as dimensions. Operator is greater than 0.

 Heartbeat  
 | summarize LastCall = max(TimeGenerated) by Computer, _ResourceId  
| extend HeartBeatMissing = iff(LastCall < ago(2h), 1, 0)  

If you want to use the automitigate feature you will have to generate results and if alert is generated or not will depend on the threshold. If the threshold is no longer met but the _ResourceId is still in the results of the query automitigate will know to resolve the alert. Also if you want to have this by Computer and _ResourceId those columns needs to be in dimensions.

Please "Accept the answer" if the information helped you. This will help us and others in the community as well.