Quickstart: Create alerts with Azure Resource Graph and Log Analytics

In this quickstart, you learn how you can use Azure Log Analytics to create alerts on Azure Resource Graph queries. You can create alerts with Azure Resource Graph query, Log Analytics workspace, and managed identities. The alert's conditions send notifications at a specified interval.

You can use queries to set up alerts for your deployed Azure resources. You can create queries using Azure Resource Graph tables, or you can combine Azure Resource Graph tables and Log Analytics data from Azure Monitor Logs.

This article includes two examples of alerts:

• Azure Resource Graph: Uses the Azure Resource Graph Resources table to create a query that gets data for your deployed Azure resources and create an alert.
• Azure Resource Graph and Log Analytics: Uses the Azure Resource Graph Resources table and Log Analytics data from the from Azure Monitor Logs Heartbeat table. This example uses a virtual machine to show how to set up the query and alert.

Note

Azure Resource Graph alerts integration with Log Analytics is in public preview.

Prerequisites

• If you don't have an Azure account, create a free account before you begin.
• Resources deployed in Azure like virtual machines or storage accounts.
• To use the example for the Azure Resource Graph and Log Analytics query, you need at least one Azure virtual machine with the Azure Monitor Agent.

What problem will we solve?

You want to use an Azure Resource Graph query to get information about your Azure resources. You can use Azure Log Analytics to set up alerts that notify you when certain conditions are met.

Create workspace

Create a Log Analytics Workspace in the subscription that's being monitored.

1. Sign in to the Azure portal.

2. In the search field, type log analytics workspaces and select Log Analytics workspaces.

   If you've used Log Analytics workspaces, you can select it from Azure services.

   

3. Select Create.

   • Subscription: Select your Azure subscription
   • Resource group: demo-arg-alert-rg
   • Name: demo-arg-alert-workspace
   • Region: West US3

4. Select Review + Create and wait for Validation passed to be displayed.

5. Select Create to begin the deployment.

6. Select Go to resource when the deployment is completed.

Create virtual machine

Azure Resource Graph

You don't need to create a virtual machine for the example that uses the Azure Resource Graph table.

Azure Resource Graph and Log Analytics

Note

This section is optional if you have existing virtual machines or know how to create a virtual machine. This example uses a virtual machine to show how to create a query using an Azure Resource Graph table and Log Analytics data.

To get log information, when you connect your virtual machine to the Log Analytics workspace, the Azure Monitor Agent is installed on the virtual machine. If you don't have a virtual machine, you can create one for this example. To avoid unnecessary costs, delete the virtual machine when you're finished with the example.

The following instructions are basic settings for a Linux virtual machine. Detailed steps about how to create a virtual machine are outside the scope of this article.

1. In Azure, create an Ubuntu Linux virtual machine.

2. Select Create.

3. Use the Create a virtual machine. You can accept most default settings with the following exceptions:

   Create a virtual machine

   • Resource group: demo-arg-alert-rg
   • virtual machine name: Type a virtual machine name
   • Availability options: No infrastructure redundancy required
   • Size: B1ms
   • Administrator account: Create key pair or username and password
   • Public inbound ports: None

   Disks: accept defaults

   • Verify Delete with VM is selected.

   Networking

   • Accept defaults.
   • Select Delete public IP and NIC when VM is deleted.

   Management

   • Accept defaults
   • Change the Auto-shutdown Time zone to your time zone.

   Monitoring, Advanced, and Tags

   • No changes needed for this example.

4. Select Review and Create and then Create.

   If you selected SSH for authentication, you're prompted to Generate new key pair. Download the private key and create the virtual machine. When you're finished with the VM, delete the key file.

Select Go to resource after the virtual machine is deployed.

Note

This section is optional if you know how to connect a virtual machine to a Log Analytics workspace.

Set up monitoring for a virtual machine.

1. Go to your virtual machine.
2. Select Monitoring > Insights > Azure Monitor > Overview.
3. Select Not Monitored.
4. Select Enable for virtual machine's Monitor Coverage.
5. Select Enable for the Azure Monitor Insights Onboarding.
6. Set up the Monitoring Configuration
   • Enable Insights using: Azure Monitoring Agent
   • Subscription: Select your subscription.
   • Create a new Data Collection Rule
     • Create a name.
     • Select your subscription.
     • Select your Log Analytics workspace demo-arg-alert-workspace.
   • Select Create, verify the settings are correct, and select Configure to begin the deployment.
7. Close Azure Monitor Insights Onboarding.

After a successful deployment, Insights > Overview > Monitored shows the virtual machine's Monitor Coverage is enabled and a link to the data collection rule.

Select the link to the data collection rule and verify the Configuration settings:

• Resources: Shows the virtual machine, resource group, and subscription.
• Data Sources:
  • Data source: Performance Counters
  • Destination: Azure Monitor Logs

You can select the Performance Counters link to verify details.

Go to your Log Analytics workspace demo-arg-alert-workspace. Select Settings > Agents > Linux servers and one Linux computer is connected to the Azure Monitor Linux agent.

Go to your virtual machine and select Settings > Extensions + applications and verify that the AzureMonitorLinuxAgentshows provisioning succeeded.

Create query

Azure Resource Graph

From the Log Analytics workspace, create an Azure Resource Graph query to get a count of your Azure resources. This example uses the Azure Resource Graph Resources table.

1. Select Logs from the left side of the Log Analytics workspace page.

   Close the Queries window if it's displayed.

2. Use the following code in the New Query.

   arg("").Resources
   | count
   

   Table names in Log Analytics need to be camel case with the first letter of each word capitalized, like Resources or ResourceContainers. You can also use lowercase like resources or resourcecontainers.

   

3. Select Run.

   The Results displays the Count of resources in your Azure subscription. Make a note of that number because you need it for the alert rule's condition. When you manually run the query the count is based on user identity, and a fired alert uses a managed identity. It's possible that the count might vary between a manual run or fired alert.

4. Remove the count from your query.

   arg("").Resources
   

Azure Resource Graph and Log Analytics

From the Log Analytics workspace, create an Azure Resource Graph query to get the last heartbeat information from your virtual machine. This example uses the Azure Resource Graph Resources table and Log Analytics data from the from Azure Monitor Logs Heartbeat table.

1. Go to your demo-arg-alert-workspace Log Analytics workspace.

2. Select Logs from the left side of the Log Analytics workspace page.

   Close the Queries window if it's displayed.

3. Use the following code in the New Query.

   arg("").Resources
   | where type == 'microsoft.compute/virtualmachines'
   | project ResourceId = id, name, PowerState = tostring(properties.extended.instanceView.powerState.code)
   | join (Heartbeat
     | where TimeGenerated > ago(15m)
     | summarize lastHeartBeat = max(TimeGenerated) by ResourceId)
     on ResourceId
   | project lastHeartBeat, PowerState, name, ResourceId
   

   Table names in Log Analytics need to be camel case with the first letter of each word capitalized, like Resources or ResourceContainers. You can also use lowercase like resources or resourcecontainers.

   You can use other timeframes for the TimeGenerated. For example, rather than minutes like 15m use hours like 12h, 24h, 48h.

   

4. Select Run.

   The query should return the virtual machine's last heartbeat, power state, name, and resource ID. If no Results are displayed, continue to the next steps.

Create alert rule

Azure Resource Graph

From the Log Analytics workspace, select New alert rule. The query from your Log Analytics workspace is copied to the alert rule. Create an alert rule has several tabs that need to be updated to create the alert.

Scope

Verify that the scope is set to your Log Analytics workspace named demo-arg-alert-workspace.

If you need to change the scope, do the following steps.

1. Go to the Scope tab and select Select scope.
2. At the bottom of the Selected resources screen, delete the current scope.
3. Expand the demo-arg-alert-rg from the list of resources and select demo-arg-alert-workspace.
4. Select Apply.
5. Select Next: Condition.

Condition

The form has several fields to complete.

• Signal name: Custom log search
• Search query: Displays the query code.

Measurement

• Measure: Table rows
• Aggregation type: Count
• Aggregation granularity: 5 minutes

Alert logic

• Operator: Greater than

• Threshold value: Use a number that's less that the number returned from the resources count.

  For example, if your resource count was 50 then use 45. This value triggers the alert to fire when it evaluates your resources because your number of resources is greater than the threshold value.

• Frequency of evaluation: 5 minutes

Select Next: Actions.

Actions

Select Create action group.

• Subscription: Select your Azure subscription.
• Resource group: demo-arg-alert-rg
• Region: Global
• Action group name: demo-arg-alert-action-group
• Display name: demo-action (limit is 12 characters)

Select Next: Notifications.

• Notification type: Select Email/SMS message/Push/Voice.
• Name: email-alert
• Select the Email checkbox and type your email address.
• Select Ok.

Select Review + Create, verify the summary is correct, and select Create. You're returned to the Actions tab of the Create an alert rule page. The Action group name shows the action group you created.

Select Next: Details.

Details

Use the following information on the Details tab.

• Subscription: Select your Azure subscription
• Resource group: demo-arg-alert-rg
• Severity: Accept the default value 3 - Informational
• Alert rule name: demo-arg-alert-rule
• Alert rule description: Email alert for count of Azure resources
• Identity: Select System assigned managed identity

Select Review + Create, verify the summary is correct, and select Create. You're returned to the Logs page of your Log Analytics workspace.

You receive an email notification to confirm you were added to the action group.

Assign role

Assign the Log Analytics Reader to the system-assigned managed identity so that it has permissions fire alerts that send email notifications.

1. Select Monitoring > Alerts in the Log Analytics workspace.

   Select OK if you're prompted that Your unsaved edits will be discarded.

2. Select Alert rules.

3. Select demo-arg-alert-rule.

4. Select Settings > Identity > System assigned.

   • Status: On
   • Object ID: Shows the GUID for your Enterprise Application (service principal) in Microsoft Entra ID.
   • Permission: Select Azure role assignments
     • Verify the correct subscription is selected.
     • Select Add role assignment
     • Scope: Subscription
     • Subscription: Your Azure subscription name
     • Role: Log Analytics Reader

5. Select Save.

It takes a few minutes for the Log Analytics Reader to display on the Azure role assignments page. Select Refresh to update the page.

Use your browser's back button to return to the Identity and then select Overview to return to the alert rule. Select the link to your resource group named demo-arg-alert-rg.

Azure Resource Graph and Log Analytics

From the Log Analytics workspace, select New alert rule. The query from your Log Analytics workspace is copied to the alert rule. The Create an alert rule has several tabs that need to be updated.

Scope

Verify that the scope is set to your Log Analytics workspace.

If you need to change the scope, do the following steps.

1. Go to the Scope tab and select Select scope.
2. At the bottom of the Selected resources screen, delete the current scope.
3. Expand the demo-arg-alert-rg from the list of resources and select demo-arg-alert-workspace.
4. Select Apply.
5. Select Next: Condition.

Condition

The form has several fields to complete.

• Signal name: Custom log search
• Search query: Displays the query code.

Measurement

• Measure: Table rows
• Aggregation type: Count
• Aggregation granularity: 5 minutes

Alert logic

• Operator: Less than
• Threshold value: 2
• Frequency of evaluation: 5 minutes

Select Next: Actions.

Actions

Select Create action group.

• Subscription: Select your Azure subscription.
• Resource group: demo-arg-alert-rg
• Region: Global
• Action group name: demo-arg-la-alert-action-group
• Display name: demo-argla (limit is 12 characters)

Select Next: Notifications.

• Notification type: Select Email/SMS message/Push/Voice
• Name: email-alert-arg-la
• Select the Email checkbox and type your email address
• Select Ok

Select Review + Create, verify the summary is correct, and select Create. You're returned to the Actions tab of the Create an alert rule page. The Action group name shows the action group you created.

Select Next: Details.

Details

Use the following information on the Details tab.

• Subscription: Select your Azure subscription
• Resource group: demo-arg-alert-rg
• Severity: Accept the default value 2 - Warning
• Alert rule name: demo-arg-la-alert-rule
• Alert rule description: Email alert for ARG-LA query of Azure virtual machine
• Identity: Select System assigned managed identity

Select Review + Create, verify the summary is correct, and select Create. You're returned to the Logs page of your Log Analytics workspace.

You receive an email notification to confirm you were added to the action group.

Assign role

Assign the Log Analytics Reader to the system-assigned managed identity so that it has permissions fire alerts that send email notifications.

1. Select Monitoring > Alerts in the Log Analytics workspace.

   Select OK if you're prompted that Your unsaved edits will be discarded.

2. Select Alert rules

3. Select demo-arg-la-alert-rule

4. Select Settings > Identity > System assigned

   • Status: On
   • Object ID: Shows the GUID for your Enterprise Application (service principal) in Microsoft Entra ID.
   • Permission: Select Azure role assignments
     • Verify the correct subscription is selected.
     • Select Add role assignment
     • Scope: Subscription
     • Subscription: Your Azure subscription name
     • Role: Log Analytics Reader

5. Select Save.

It takes a few minutes for the Log Analytics Reader to display on the Azure role assignments page. Select Refresh to update the page.

Use your browser's back button to return to the Identity and select Overview to return to the alert rule. Select the link to your resource group named demo-arg-alert-rg.

Verify alerts

Azure Resource Graph

After the role is assigned to your alert rule, you begin to receive email for alert messages. The rule was created to send alerts every five minutes and it takes a few minutes to get the first alert.

You can also view the alerts in the Azure portal.

1. Go to the resource group demo-arg-alert-rg.

2. Select demo-arg-alert-workspace in your list of resources.

3. Select Monitoring > Alerts.

4. A list of alerts is displayed.

   

Azure Resource Graph and Log Analytics

After the role is assigned to your alert rule, you begin to receive email for alert messages. The rule was created to send alerts every five minutes and it takes a few minutes to get the first alert.

You can also view the alerts in the Azure portal.

1. Go to the resource group demo-arg-alert-rg.

2. Select your virtual machine.

3. Select Monitoring > Alerts.

4. A list of alerts is displayed.

   

Note

It might take 30 minutes for log information to become available to create alerts.

How did we solve the problem?

You created an Azure Resource Graph query and a Log Analytics workspace to monitor Azure resources. You also set up alerts to notify you for events and assigned a role to the system-assigned managed identity. After the alert was created, you received email alerts based on conditions in the alert rule.

Clean up resources

If you want to keep the alert configuration but stop the alert from firing and sending email notifications, you can disable it. Go to your alert rule demo-arg-alert-rule or demo-arg-la-alert-rule and select Disable.

If you don't need this alert or the resources you created in this example, delete the resource group with the following steps:

1. Go to your resource group demo-arg-alert-rg.
2. Select Delete resource group.
3. Type the resource group name to confirm.
4. Select Delete.

Related content

For more information about the query language or how to explore resources, go to the following articles.

• Understanding the Azure Resource Graph query language
• Explore your Azure resources with Resource Graph
• Overview of Log Analytics in Azure Monitor
• Troubleshoot Azure Resource Graph alerts