Alert if vms stop sending heartbeats but not if it shut down

Question

Hi,
I'm running following query to generate alerts if log analytics agents stops sending heartbeats and it works fine. Only problem that I'm facing that if someone shutdowns the vm ( it will generate alert because heartbeats has stopped.

Heartbeat
| summarize LastCall = max(TimeGenerated) by Computer, _ResourceId
| extend HeartBeatMissing = iff(LastCall < ago(1h), 1, 0)

Then I started to create query that would not generate alert if vm has been stopped but are facing a bit issues.

    Heartbeat
    | summarize LastCall = max(TimeGenerated) by Computer, _ResourceId
    | extend HeartBeatMissing = iff(LastCall < ago(1h), 1, 0)
    | join kind=leftanti (
        AzureActivity
        | where ActivityStatus == "Succeeded"
        | where Category == "Administrative"
        | where OperationName == "Deallocate Virtual Machine"
        | summarize by Resource _ResourceId
) on 

I'm not sure if this is the right or proper way to archive this and thus I'm banging my head to wall how and what should I next (not that great with join operator).

Answer 1

I got it working by myself and here are the query if somebody else is fighting with same issues. For some reason I can not mark my own comment as answer.

Heartbeat
| summarize LastCall = max(TimeGenerated) by Computer, _ResourceId
| extend HeartBeatMissing = iff(LastCall < ago(2h), 1, 0)
     | join kind=leftanti (
         AzureActivity
         | where ActivityStatus == "Succeeded"
         | where Category == "Administrative"
         | where OperationName == "Deallocate Virtual Machine"
         | summarize by _ResourceId
 ) on _ResourceId

Answer 2

Hi @Bombbe ,

Glad to know that you have self-resolved the question and thanks for sharing it. Yes, it would be of great help for other community users who might be looking for similar information. :)

As explained here, currently a user cannot accept their own answers. In past (around 2+ months ago), users were able to accept their own answers but that feature is revoked now.