{"id":2303,"date":"2020-08-14T14:39:33","date_gmt":"2020-08-14T21:39:33","guid":{"rendered":"https:\/\/SUMMALAI.COM\/?p=2303"},"modified":"2020-08-14T14:39:34","modified_gmt":"2020-08-14T21:39:34","slug":"create-view-and-manage-log-alerts-using-azure-monitor","status":"publish","type":"post","link":"https:\/\/SUMMALAI.COM\/?p=2303","title":{"rendered":"Create, view, and manage log alerts using Azure Monitor"},"content":{"rendered":"\n<p>This article shows you how to create and manage log alerts using the alerts interface inside the Azure portal. Alert rules are defined by three components:<\/p>\n\n\n\n<ul class=\"wp-block-list\"><li>Target: A specific Azure resource to monitor<\/li><li>Criteria: A condition or logic to evaluate for truth. If true, the alert fires.<\/li><li>Action: Specific call sent to a receiver of a notification &#8211; email, SMS, webhook etc.<\/li><\/ul>\n\n\n\n<p>The term&nbsp;<strong>Log Alert<\/strong>&nbsp;describes alerts where a log query in&nbsp;<a href=\"https:\/\/docs.microsoft.com\/en-us\/azure\/azure-monitor\/log-query\/get-started-portal\">Log Analytics workspace<\/a>&nbsp;or&nbsp;<a href=\"https:\/\/docs.microsoft.com\/en-us\/azure\/azure-monitor\/log-query\/log-query-overview\">Application Insights<\/a>&nbsp;is evaluated, and an alert fired if the result is true. Learn more about functionality, terminology, and types from&nbsp;<a href=\"https:\/\/docs.microsoft.com\/en-us\/azure\/azure-monitor\/platform\/alerts-unified-log\">Log alerts &#8211; Overview<\/a>.<\/p>\n\n\n\n<p>&nbsp;Note<\/p>\n\n\n\n<p>Log data from&nbsp;<a href=\"https:\/\/docs.microsoft.com\/en-us\/azure\/azure-monitor\/log-query\/get-started-portal\">a Log Analytics workspace<\/a>&nbsp;can also be routed to the Azure Monitor metrics database. Metrics alerts have&nbsp;<a href=\"https:\/\/docs.microsoft.com\/en-us\/azure\/azure-monitor\/platform\/alerts-metric-overview\">different behavior<\/a>, which may be more desirable depending on the data you are working with. For information on what and how you can route logs to metrics, see&nbsp;<a href=\"https:\/\/docs.microsoft.com\/en-us\/azure\/azure-monitor\/platform\/alerts-metric-logs\">Metric Alert for Logs<\/a>.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"create-a-log-alert-rule-with-the-azure-portal\">Create a log alert rule with the Azure portal<\/h3>\n\n\n\n<ol class=\"wp-block-list\"><li>In the&nbsp;<a href=\"https:\/\/portal.azure.com\/\">portal<\/a>, select&nbsp;<strong>Monitor<\/strong>. In that section, choose&nbsp;<strong>Alerts<\/strong>.<img decoding=\"async\" src=\"https:\/\/docs.microsoft.com\/en-us\/azure\/azure-monitor\/platform\/media\/alerts-log\/alertspreviewmenu.png\" alt=\"Monitoring\"><\/li><li>Click&nbsp;<strong>New Alert Rule<\/strong>.<img decoding=\"async\" src=\"https:\/\/docs.microsoft.com\/en-us\/azure\/azure-monitor\/platform\/media\/alerts-log\/alertspreviewoption.png\" alt=\"Add Alert\"><\/li><li>The&nbsp;<strong>Create Alert<\/strong>&nbsp;pane appears. It has four parts:<ul><li>The resource to which the alert applies<\/li><li>The condition to check<\/li><li>The action to take if the condition is true<\/li><li>The details to name and describe the alert.<\/li><\/ul><img decoding=\"async\" src=\"https:\/\/docs.microsoft.com\/en-us\/azure\/azure-monitor\/platform\/media\/alerts-log\/alertspreviewadd.png\" alt=\"Create rule\"><\/li><li>Define the alert condition by using the&nbsp;<strong>Select Resource<\/strong>&nbsp;link and specifying the target by selecting a resource. Filter by choosing the&nbsp;<em>Subscription<\/em>,&nbsp;<em>Resource Type<\/em>, and required&nbsp;<em>Resource<\/em>.<img decoding=\"async\" src=\"https:\/\/docs.microsoft.com\/en-us\/azure\/azure-monitor\/platform\/media\/alerts-log\/alert-selectresourcelog.png\" alt=\"Select resource\"><\/li><li>Ensure&nbsp;<strong>Resource Type<\/strong>&nbsp;is an analytics source like&nbsp;<em>Log Analytics<\/em>&nbsp;or&nbsp;<em>Application Insights<\/em>&nbsp;and signal type as&nbsp;<em>Log<\/em>. Click&nbsp;<strong>Done<\/strong>. Next use the&nbsp;<strong>Add criteria<\/strong>&nbsp;button to view list of signal options available for the resource. Find and choose&nbsp;<strong>Custom log search<\/strong>&nbsp;option for either&nbsp;<em>Log Analytics<\/em>&nbsp;or&nbsp;<em>Application Insights<\/em>, depending on where the data for your log alerts resides.<img decoding=\"async\" src=\"https:\/\/docs.microsoft.com\/en-us\/azure\/azure-monitor\/platform\/media\/alerts-log\/alertspreviewresourceselectionlog.png\" alt=\"Select a resource - custom log search\">&nbsp;NoteAlerts lists can import analytics query as signal type &#8211;&nbsp;<strong>Log (Saved Query)<\/strong>, as seen in above illustration. So users can perfect your query in Analytics and then save them for future use in alerts. For more details on using saved queries, see&nbsp;<a href=\"https:\/\/docs.microsoft.com\/en-us\/azure\/azure-monitor\/log-query\/log-query-overview\">using log query in Azure Monitor<\/a>&nbsp;and&nbsp;<a href=\"https:\/\/docs.microsoft.com\/en-us\/azure\/azure-monitor\/app\/app-insights-overview\">shared query in Application Insights analytics<\/a>.<\/li><li>Once selected, create the alerting query in the&nbsp;<strong>Search Query<\/strong>&nbsp;field. If the query syntax is incorrect, the field displays and error in red.<\/li><li>If the query syntax is correct, then historical data for the query appears as a graph with the option to tweak the time window from last six hours to last week.<img decoding=\"async\" src=\"https:\/\/docs.microsoft.com\/en-us\/azure\/azure-monitor\/platform\/media\/alerts-log\/alertspreviewalertlog.png\" alt=\"Configure alert rule\">The historical data visualization is only shown if the query results have time details. If your query results in summarized data or specific column values, the display shows a single plot.For metric measurements using Application Insights or&nbsp;<a href=\"https:\/\/docs.microsoft.com\/en-us\/rest\/api\/monitor\/scheduledqueryrules\">the Log Analytics API<\/a>, you can specify which specific variable to group the data by using the&nbsp;<strong>Aggregate on<\/strong>&nbsp;option; as shown here:<img decoding=\"async\" src=\"https:\/\/docs.microsoft.com\/en-us\/azure\/azure-monitor\/platform\/media\/alerts-log\/aggregate-on.png\" alt=\"aggregate on option\"><\/li><li>Next choose the&nbsp;<strong>Alert Logic<\/strong>&nbsp;condition, aggregation and threshold.<\/li><li>Choose the time period over which to assess the specified condition, using&nbsp;<strong>Period<\/strong>&nbsp;option.<\/li><li>Choose how often the alert runs in&nbsp;<strong>Frequency<\/strong>.<strong>Log Alerts<\/strong>&nbsp;can be based on:<ul><li><a href=\"https:\/\/docs.microsoft.com\/en-us\/azure\/azure-monitor\/platform\/alerts-unified-log#number-of-results-alert-rules\">Number of Records<\/a>: An alert is created if the count of records returned by the query is either greater than or less than the value provided.<\/li><li><a href=\"https:\/\/docs.microsoft.com\/en-us\/azure\/azure-monitor\/platform\/alerts-unified-log#metric-measurement-alert-rules\">Metric Measurement<\/a>: An alert is created if each&nbsp;<em>aggregate value<\/em>&nbsp;in the results exceeds the threshold value provided and it is&nbsp;<em>grouped by<\/em>&nbsp;chosen value. The number of breaches for an alert is the number of times the threshold is exceeded in the chosen time period. You can specify Total breaches for any combination of breaches across the results set or Consecutive breaches to require that the breaches must occur in consecutive samples.<\/li><\/ul><\/li><li>Click&nbsp;<strong>Done<\/strong>.<\/li><li>Define a name for your alert in the&nbsp;<strong>Alert rule name<\/strong>&nbsp;field along with a&nbsp;<strong>Description<\/strong>&nbsp;detailing specifics for the alert and&nbsp;<strong>Severity<\/strong>&nbsp;value from the options provided. These details are reused in all alert emails, notifications, or pushes done by Azure Monitor. Additionally, you can choose to immediately activate the alert rule on creation by clicking&nbsp;<strong>Enable rule upon creation<\/strong>.<\/li><li>Choose if you want to&nbsp;<strong>Suppress Alerts<\/strong>&nbsp;for a period of time. When you turn on suppression for the alert rule, actions for the rule are disabled for a defined length of time after creating a new alert. The rule still runs and creates alert records provided the criteria is met. This setting allows you time to correct the problem without running duplicate actions.<img decoding=\"async\" src=\"https:\/\/docs.microsoft.com\/en-us\/azure\/azure-monitor\/platform\/media\/alerts-log\/alertspreviewsuppress.png\" alt=\"Suppress Alerts for Log Alerts\">&nbsp;TipSpecify a suppress alert value greater than the frequency of alert to ensure notifications are stopped without overlap<\/li><li>As the third and final step, specify if the alert rule should trigger one or more&nbsp;<strong>Action Group<\/strong>&nbsp;when alert condition is met. You can choose any existing Action Group or create a new one. With action groups, you can send perform a number of actions such as send email(s), send SMS(s), call Webhook(s), remediate using Azure Runbooks, push to your ITSM tool, and more. Learn more about&nbsp;<a href=\"https:\/\/docs.microsoft.com\/en-us\/azure\/azure-monitor\/platform\/action-groups\">Action Groups<\/a>.&nbsp;NoteRefer to the&nbsp;<a href=\"https:\/\/docs.microsoft.com\/en-us\/azure\/azure-resource-manager\/management\/azure-subscription-service-limits\">Azure subscription service limits<\/a>&nbsp;for limits on the actions that can be performed.Some additional functionality is available to override the default Actions:<ul><li><strong>Email Notification<\/strong>: Overrides&nbsp;<em>e-mail subject<\/em>&nbsp;in the email sent via the Action Group. You cannot modify the body of the mail and this field is&nbsp;<strong>not<\/strong>&nbsp;for email address.<\/li><li><strong>Include custom Json payload<\/strong>: Overrides the webhook JSON used by Action Groups assuming the action group contains a webhook type. For more information on webhook formats, see&nbsp;<a href=\"https:\/\/docs.microsoft.com\/en-us\/azure\/azure-monitor\/platform\/alerts-log-webhook\">webhook action for Log Alerts<\/a>. View Webhook option is provided to check format using sample JSON data.<img decoding=\"async\" src=\"https:\/\/docs.microsoft.com\/en-us\/azure\/azure-monitor\/platform\/media\/alerts-log\/alertspreviewoverridelog.png\" alt=\"Action Overrides for Log Alerts\"><\/li><\/ul><\/li><li>If all fields are valid and with green tick the&nbsp;<strong>create alert rule<\/strong>&nbsp;button can be clicked and an alert is created in Azure Monitor &#8211; Alerts. All alerts can be viewed from the alerts Dashboard.<img decoding=\"async\" src=\"https:\/\/docs.microsoft.com\/en-us\/azure\/azure-monitor\/platform\/media\/alerts-log\/alertspreviewcreate.png\" alt=\"Rule Creation\">Within a few minutes, the alert is active and triggers as previously described.<\/li><\/ol>\n\n\n\n<p>Users can also finalize their analytics query in&nbsp;<a href=\"https:\/\/docs.microsoft.com\/en-us\/azure\/azure-monitor\/log-query\/log-query-overview\">log analytics<\/a>&nbsp;and then push it to create an alert via &#8216;Set Alert&#8217; button &#8211; then following instructions from Step 6 onwards in the above tutorial.<\/p>\n\n\n\n<figure class=\"wp-block-image\"><img decoding=\"async\" src=\"https:\/\/docs.microsoft.com\/en-us\/azure\/azure-monitor\/platform\/media\/alerts-log\/alertsanalyticscreate.png\" alt=\"Log Analytics - Set Alert\"\/><\/figure>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"view--manage-log-alerts-in-azure-portal\">View &amp; manage log alerts in Azure portal<\/h3>\n\n\n\n<ol class=\"wp-block-list\"><li>In the&nbsp;<a href=\"https:\/\/portal.azure.com\/\">portal<\/a>, select&nbsp;<strong>Monitor<\/strong>&nbsp;and under the MONITOR section &#8211; choose&nbsp;<strong>Alerts<\/strong>.<\/li><li>The&nbsp;<strong>Alerts Dashboard<\/strong>&nbsp;is displayed &#8211; wherein all Azure Alerts (including log alerts) are displayed in a singular board; including every instance of when your log alert rule has fired. To learn more, see&nbsp;<a href=\"https:\/\/aka.ms\/managealertinstances\">Alert Management<\/a>.&nbsp;NoteLog alert rules comprise of custom query-based logic provided by users and hence without a resolved state. Due to which every time the conditions specified in the log alert rule are met, it is fired.<\/li><li>Select the&nbsp;<strong>Manage rules<\/strong>&nbsp;button on the top bar, to navigate to the rule management section &#8211; where all alert rules created are listed; including alerts that have been disabled.&nbsp;<img decoding=\"async\" src=\"https:\/\/docs.microsoft.com\/en-us\/azure\/azure-monitor\/platform\/media\/alerts-log\/manage-alert-rules.png\" alt=\" manage alert rules\"><\/li><\/ol>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"managing-log-alerts-using-azure-resource-template\">Managing log alerts using Azure Resource Template<\/h3>\n\n\n\n<p>Log alerts in Azure Monitor are associated with resource type&nbsp;<code>Microsoft.Insights\/scheduledQueryRules\/<\/code>. For more information on this resource type, see&nbsp;<a href=\"https:\/\/docs.microsoft.com\/en-us\/rest\/api\/monitor\/scheduledqueryrules\/\">Azure Monitor &#8211; Scheduled Query Rules API reference<\/a>. Log alerts for Application Insights or Log Analytics, can be created using&nbsp;<a href=\"https:\/\/docs.microsoft.com\/en-us\/rest\/api\/monitor\/scheduledqueryrules\/\">Scheduled Query Rules API<\/a>.<\/p>\n\n\n\n<p>&nbsp;Note<\/p>\n\n\n\n<p>Log alerts for Log Analytics can also be managed using legacy&nbsp;<a href=\"https:\/\/docs.microsoft.com\/en-us\/azure\/azure-monitor\/platform\/api-alerts\">Log Analytics Alert API<\/a>&nbsp;and legacy templates of&nbsp;<a href=\"https:\/\/docs.microsoft.com\/en-us\/azure\/azure-monitor\/insights\/solutions\">Log Analytics saved searches and alerts<\/a>&nbsp;as well. For more information on using the new ScheduledQueryRules API detailed here by default, see&nbsp;<a href=\"https:\/\/docs.microsoft.com\/en-us\/azure\/azure-monitor\/platform\/alerts-log-api-switch\">Switch to new API for Log Analytics Alerts<\/a>.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"sample-log-alert-creation-using-azure-resource-template\">Sample Log alert creation using Azure Resource Template<\/h3>\n\n\n\n<p>The following is the structure for&nbsp;<a href=\"https:\/\/docs.microsoft.com\/en-us\/rest\/api\/monitor\/scheduledqueryrules\/createorupdate\">Scheduled Query Rules creation<\/a>&nbsp;based resource template using standard log search query of&nbsp;<a href=\"https:\/\/docs.microsoft.com\/en-us\/azure\/azure-monitor\/platform\/alerts-unified-log#number-of-results-alert-rules\">number of results type log alert<\/a>, with sample data set as variables.JSONCopy<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>{\n    \"$schema\": \"https:\/\/schema.management.azure.com\/schemas\/2015-01-01\/deploymentTemplate.json#\",\n    \"contentVersion\": \"1.0.0.0\",\n    \"parameters\": {\n    },\n    \"variables\": {\n        \"alertLocation\": \"southcentralus\",\n        \"alertName\": \"samplelogalert\",\n        \"alertDescription\": \"Sample log search alert\",\n        \"alertStatus\": \"true\",\n        \"alertSource\":{\n            \"Query\":\"requests\",\n            \"SourceId\": \"\/subscriptions\/a123d7efg-123c-1234-5678-a12bc3defgh4\/resourceGroups\/myRG\/providers\/microsoft.insights\/components\/sampleAIapplication\",\n            \"Type\":\"ResultCount\"\n        },\n        \"alertSchedule\":{\n            \"Frequency\": 15,\n            \"Time\": 60\n        },\n        \"alertActions\":{\n            \"SeverityLevel\": \"4\"\n        },\n        \"alertTrigger\":{\n            \"Operator\":\"GreaterThan\",\n            \"Threshold\":\"1\"\n        },\n        \"actionGrp\":{\n            \"ActionGroup\": \"\/subscriptions\/a123d7efg-123c-1234-5678-a12bc3defgh4\/resourceGroups\/myRG\/providers\/microsoft.insights\/actiongroups\/sampleAG\",\n            \"Subject\": \"Customized Email Header\",\n            \"Webhook\": \"{ \\\"alertname\\\":\\\"#alertrulename\\\", \\\"IncludeSearchResults\\\":true }\"\n        }\n    },\n    \"resources\":&#91; {\n        \"name\":\"&#91;variables('alertName')]\",\n        \"type\":\"Microsoft.Insights\/scheduledQueryRules\",\n        \"apiVersion\": \"2018-04-16\",\n        \"location\": \"&#91;variables('alertLocation')]\",\n        \"properties\":{\n            \"description\": \"&#91;variables('alertDescription')]\",\n            \"enabled\": \"&#91;variables('alertStatus')]\",\n            \"source\": {\n                \"query\": \"&#91;variables('alertSource').Query]\",\n                \"dataSourceId\": \"&#91;variables('alertSource').SourceId]\",\n                \"queryType\":\"&#91;variables('alertSource').Type]\"\n            },\n            \"schedule\":{\n                \"frequencyInMinutes\": \"&#91;variables('alertSchedule').Frequency]\",\n                \"timeWindowInMinutes\": \"&#91;variables('alertSchedule').Time]\"\n            },\n            \"action\":{\n                \"odata.type\": \"Microsoft.WindowsAzure.Management.Monitoring.Alerts.Models.Microsoft.AppInsights.Nexus.DataContracts.Resources.ScheduledQueryRules.AlertingAction\",\n                \"severity\":\"&#91;variables('alertActions').SeverityLevel]\",\n                \"aznsAction\":{\n                    \"actionGroup\":\"&#91;array(variables('actionGrp').ActionGroup)]\",\n                    \"emailSubject\":\"&#91;variables('actionGrp').Subject]\",\n                    \"customWebhookPayload\":\"&#91;variables('actionGrp').Webhook]\"\n                },\n                \"trigger\":{\n                    \"thresholdOperator\":\"&#91;variables('alertTrigger').Operator]\",\n                    \"threshold\":\"&#91;variables('alertTrigger').Threshold]\"\n                }\n            }\n        }\n    } ]\n}\n\n<\/code><\/pre>\n\n\n\n<p>The sample json above can be saved as (say) sampleScheduledQueryRule.json for the purpose of this walk through and can be deployed using&nbsp;<a href=\"https:\/\/docs.microsoft.com\/en-us\/azure\/azure-resource-manager\/templates\/deploy-portal#deploy-resources-from-custom-template\">Azure Resource Manager in Azure portal<\/a>.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"log-alert-with-cross-resource-query-using-azure-resource-template\">Log alert with cross-resource query using Azure Resource Template<\/h3>\n\n\n\n<p>The following is the structure for&nbsp;<a href=\"https:\/\/docs.microsoft.com\/en-us\/rest\/api\/monitor\/scheduledqueryrules\/createorupdate\">Scheduled Query Rules creation<\/a>&nbsp;based resource template using&nbsp;<a href=\"https:\/\/docs.microsoft.com\/en-us\/azure\/azure-monitor\/log-query\/cross-workspace-query\">cross-resource log search query<\/a>&nbsp;of&nbsp;<a href=\"https:\/\/docs.microsoft.com\/en-us\/azure\/azure-monitor\/platform\/alerts-unified-log#metric-measurement-alert-rules\">metric measurement type log alert<\/a>, with sample data set as variables.JSONCopy<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>\n{\n    \"$schema\": \"https:\/\/schema.management.azure.com\/schemas\/2015-01-01\/deploymentTemplate.json#\",\n    \"contentVersion\": \"1.0.0.0\",\n    \"parameters\": {\n    },\n    \"variables\": {\n        \"alertLocation\": \"Region Name for your Application Insights App or Log Analytics Workspace\",\n        \"alertName\": \"sample log alert\",\n        \"alertDescr\": \"Sample log search alert\",\n        \"alertStatus\": \"true\",\n        \"alertSource\":{\n            \"Query\":\"union workspace(\\\"servicews\\\").Update, app('serviceapp').requests | summarize AggregatedValue = count() by bin(TimeGenerated,1h), Classification\",\n            \"Resource1\": \"\/subscriptions\/a123d7efg-123c-1234-5678-a12bc3defgh4\/resourceGroups\/contosoRG\/providers\/microsoft.OperationalInsights\/workspaces\/servicews\",\n            \"Resource2\": \"\/subscriptions\/a123d7efg-123c-1234-5678-a12bc3defgh4\/resourceGroups\/contosoRG\/providers\/microsoft.insights\/components\/serviceapp\",\n            \"SourceId\": \"\/subscriptions\/a123d7efg-123c-1234-5678-a12bc3defgh4\/resourceGroups\/contosoRG\/providers\/microsoft.OperationalInsights\/workspaces\/servicews\",\n            \"Type\":\"ResultCount\"\n        },\n        \"alertSchedule\":{\n            \"Frequency\": 15,\n            \"Time\": 60\n        },\n        \"alertActions\":{\n            \"SeverityLevel\": \"4\",\n            \"SuppressTimeinMin\": 20\n        },\n        \"alertTrigger\":{\n            \"Operator\":\"GreaterThan\",\n            \"Threshold\":\"1\"\n        },\n        \"metricMeasurement\": {\n            \"thresholdOperator\": \"Equal\",\n            \"threshold\": \"1\",\n            \"metricTriggerType\": \"Consecutive\",\n            \"metricColumn\": \"Classification\"\n        },\n        \"actionGrp\":{\n            \"ActionGroup\": \"\/subscriptions\/a123d7efg-123c-1234-5678-a12bc3defgh4\/resourceGroups\/contosoRG\/providers\/microsoft.insights\/actiongroups\/sampleAG\",\n            \"Subject\": \"Customized Email Header\",\n            \"Webhook\": \"{ \\\"alertname\\\":\\\"#alertrulename\\\", \\\"IncludeSearchResults\\\":true }\"\n        }\n    },\n    \"resources\":&#91; {\n        \"name\":\"&#91;variables('alertName')]\",\n        \"type\":\"Microsoft.Insights\/scheduledQueryRules\",\n        \"apiVersion\": \"2018-04-16\",\n        \"location\": \"&#91;variables('alertLocation')]\",\n        \"properties\":{\n            \"description\": \"&#91;variables('alertDescr')]\",\n            \"enabled\": \"&#91;variables('alertStatus')]\",\n            \"source\": {\n                \"query\": \"&#91;variables('alertSource').Query]\",\n                \"authorizedResources\": \"&#91;concat(array(variables('alertSource').Resource1), array(variables('alertSource').Resource2))]\",\n                \"dataSourceId\": \"&#91;variables('alertSource').SourceId]\",\n                \"queryType\":\"&#91;variables('alertSource').Type]\"\n            },\n            \"schedule\":{\n                \"frequencyInMinutes\": \"&#91;variables('alertSchedule').Frequency]\",\n                \"timeWindowInMinutes\": \"&#91;variables('alertSchedule').Time]\"\n            },\n            \"action\":{\n                \"odata.type\": \"Microsoft.WindowsAzure.Management.Monitoring.Alerts.Models.Microsoft.AppInsights.Nexus.DataContracts.Resources.ScheduledQueryRules.AlertingAction\",\n                \"severity\":\"&#91;variables('alertActions').SeverityLevel]\",\n                \"throttlingInMin\": \"&#91;variables('alertActions').SuppressTimeinMin]\",\n                \"aznsAction\":{\n                    \"actionGroup\": \"&#91;array(variables('actionGrp').ActionGroup)]\",\n                    \"emailSubject\":\"&#91;variables('actionGrp').Subject]\",\n                    \"customWebhookPayload\":\"&#91;variables('actionGrp').Webhook]\"\n                },\n                \"trigger\":{\n                    \"thresholdOperator\":\"&#91;variables('alertTrigger').Operator]\",\n                    \"threshold\":\"&#91;variables('alertTrigger').Threshold]\",\n                    \"metricTrigger\":{\n                        \"thresholdOperator\": \"&#91;variables('metricMeasurement').thresholdOperator]\",\n                        \"threshold\": \"&#91;variables('metricMeasurement').threshold]\",\n                        \"metricColumn\": \"&#91;variables('metricMeasurement').metricColumn]\",\n                        \"metricTriggerType\": \"&#91;variables('metricMeasurement').metricTriggerType]\"\n                    }\n                }\n            }\n        }\n    } ]\n}\n\n<\/code><\/pre>\n\n\n\n<p>&nbsp;Important<\/p>\n\n\n\n<p>When using cross-resource query in log alert, the usage of&nbsp;<a href=\"https:\/\/docs.microsoft.com\/en-us\/rest\/api\/monitor\/scheduledqueryrules\/createorupdate#source\">authorizedResources<\/a>&nbsp;is mandatory and user must have access to the list of resources stated<\/p>\n\n\n\n<p>The sample json above can be saved as (say) sampleScheduledQueryRule.json for the purpose of this walk through and can be deployed using&nbsp;<a href=\"https:\/\/docs.microsoft.com\/en-us\/azure\/azure-resource-manager\/templates\/deploy-portal#deploy-resources-from-custom-template\">Azure Resource Manager in Azure portal<\/a>.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"managing-log-alerts-using-powershell\">Managing log alerts using PowerShell<\/h3>\n\n\n\n<p>&nbsp;Note<\/p>\n\n\n\n<p>This article has been updated to use the new Azure PowerShell Az module. You can still use the AzureRM module, which will continue to receive bug fixes until at least December 2020. To learn more about the new Az module and AzureRM compatibility, see&nbsp;<a href=\"https:\/\/docs.microsoft.com\/en-us\/powershell\/azure\/new-azureps-module-az?view=azps-3.3.0\">Introducing the new Azure PowerShell Az module<\/a>. For Az module installation instructions, see&nbsp;<a href=\"https:\/\/docs.microsoft.com\/en-us\/powershell\/azure\/install-az-ps?view=azps-3.3.0\">Install Azure PowerShell<\/a>.<\/p>\n\n\n\n<p>Azure Monitor &#8211;&nbsp;<a href=\"https:\/\/docs.microsoft.com\/en-us\/rest\/api\/monitor\/scheduledqueryrules\/\">Scheduled Query Rules API<\/a>&nbsp;is a REST API and fully compatible with Azure Resource Manager REST API. And PowerShell cmdlets listed below are available to leverage the&nbsp;<a href=\"https:\/\/docs.microsoft.com\/en-us\/rest\/api\/monitor\/scheduledqueryrules\/\">Scheduled Query Rules API<\/a>.<\/p>\n\n\n\n<ul class=\"wp-block-list\"><li><a href=\"https:\/\/docs.microsoft.com\/en-us\/powershell\/module\/az.monitor\/new-azscheduledqueryrule\">New-AzScheduledQueryRule<\/a>&nbsp;: PowerShell cmdlet to create a new log alert rule.<\/li><li><a href=\"https:\/\/docs.microsoft.com\/en-us\/powershell\/module\/az.monitor\/set-azscheduledqueryrule\">Set-AzScheduledQueryRule<\/a>&nbsp;: PowerShell cmdlet to update an existing log alert rule.<\/li><li><a href=\"https:\/\/docs.microsoft.com\/en-us\/powershell\/module\/az.monitor\/new-azscheduledqueryrulesource\">New-AzScheduledQueryRuleSource<\/a>&nbsp;: PowerShell cmdlet to create or update object specifying source parameters for a log alert. Used as input by&nbsp;<a href=\"https:\/\/docs.microsoft.com\/en-us\/powershell\/module\/az.monitor\/new-azscheduledqueryrule\">New-AzScheduledQueryRule<\/a>&nbsp;and&nbsp;<a href=\"https:\/\/docs.microsoft.com\/en-us\/powershell\/module\/az.monitor\/set-azscheduledqueryrule\">Set-AzScheduledQueryRule<\/a>&nbsp;cmdlet.<\/li><li><a href=\"https:\/\/docs.microsoft.com\/en-us\/powershell\/module\/az.monitor\/new-azscheduledqueryruleschedule\">New-AzScheduledQueryRuleSchedule<\/a>: PowerShell cmdlet to create or update object specifying schedule parameters for a log alert. Used as input by&nbsp;<a href=\"https:\/\/docs.microsoft.com\/en-us\/powershell\/module\/az.monitor\/new-azscheduledqueryrule\">New-AzScheduledQueryRule<\/a>&nbsp;and&nbsp;<a href=\"https:\/\/docs.microsoft.com\/en-us\/powershell\/module\/az.monitor\/set-azscheduledqueryrule\">Set-AzScheduledQueryRule<\/a>&nbsp;cmdlet.<\/li><li><a href=\"https:\/\/docs.microsoft.com\/en-us\/powershell\/module\/az.monitor\/new-azscheduledqueryrulealertingaction\">New-AzScheduledQueryRuleAlertingAction<\/a>&nbsp;: PowerShell cmdlet to create or update object specifying action parameters for a log alert. Used as input by&nbsp;<a href=\"https:\/\/docs.microsoft.com\/en-us\/powershell\/module\/az.monitor\/new-azscheduledqueryrule\">New-AzScheduledQueryRule<\/a>&nbsp;and&nbsp;<a href=\"https:\/\/docs.microsoft.com\/en-us\/powershell\/module\/az.monitor\/set-azscheduledqueryrule\">Set-AzScheduledQueryRule<\/a>&nbsp;cmdlet.<\/li><li><a href=\"https:\/\/docs.microsoft.com\/en-us\/powershell\/module\/az.monitor\/new-azscheduledqueryruleaznsactiongroup\">New-AzScheduledQueryRuleAznsActionGroup<\/a>&nbsp;: PowerShell cmdlet to create or update object specifying action groups parameters for a log alert. Used as input by&nbsp;<a href=\"https:\/\/docs.microsoft.com\/en-us\/powershell\/module\/az.monitor\/new-azscheduledqueryrulealertingaction\">New-AzScheduledQueryRuleAlertingAction<\/a>&nbsp;cmdlet.<\/li><li><a href=\"https:\/\/docs.microsoft.com\/en-us\/powershell\/module\/az.monitor\/new-azscheduledqueryruletriggercondition\">New-AzScheduledQueryRuleTriggerCondition<\/a>&nbsp;: PowerShell cmdlet to create or update object specifying trigger condition parameters for log alert. Used as input by&nbsp;<a href=\"https:\/\/docs.microsoft.com\/en-us\/powershell\/module\/az.monitor\/new-azscheduledqueryrulealertingaction\">New-AzScheduledQueryRuleAlertingAction<\/a>&nbsp;cmdlet.<\/li><li><a href=\"https:\/\/docs.microsoft.com\/en-us\/powershell\/module\/az.monitor\/new-azscheduledqueryrulelogmetrictrigger\">New-AzScheduledQueryRuleLogMetricTrigger<\/a>&nbsp;: PowerShell cmdlet to create or update object specifying metric trigger condition parameters for&nbsp;<a href=\"https:\/\/docs.microsoft.com\/en-us\/azure\/azure-monitor\/platform\/alerts-unified-log#metric-measurement-alert-rules\">metric measurement type log alert<\/a>. Used as input by&nbsp;<a href=\"https:\/\/docs.microsoft.com\/en-us\/powershell\/module\/az.monitor\/new-azscheduledqueryruletriggercondition\">New-AzScheduledQueryRuleTriggerCondition<\/a>&nbsp;cmdlet.<\/li><li><a href=\"https:\/\/docs.microsoft.com\/en-us\/powershell\/module\/az.monitor\/get-azscheduledqueryrule\">Get-AzScheduledQueryRule<\/a>&nbsp;: PowerShell cmdlet to list existing log alert rules or a specific log alert rule<\/li><li><a href=\"https:\/\/docs.microsoft.com\/en-us\/powershell\/module\/az.monitor\/update-azscheduledqueryrule\">Update-AzScheduledQueryRule<\/a>&nbsp;: PowerShell cmdlet to enable or disable log alert rule<\/li><li><a href=\"https:\/\/docs.microsoft.com\/en-us\/powershell\/module\/az.monitor\/remove-azscheduledqueryrule\">Remove-AzScheduledQueryRule<\/a>: PowerShell cmdlet to delete an existing log alert rule<\/li><\/ul>\n\n\n\n<p>&nbsp;Note<\/p>\n\n\n\n<p>ScheduledQueryRules PowerShell cmdlets can only manage rules created cmdlet itself or using Azure Monitor &#8211;&nbsp;<a href=\"https:\/\/docs.microsoft.com\/en-us\/rest\/api\/monitor\/scheduledqueryrules\/\">Scheduled Query Rules API<\/a>. Log alert rules created using legacy&nbsp;<a href=\"https:\/\/docs.microsoft.com\/en-us\/azure\/azure-monitor\/platform\/api-alerts\">Log Analytics Alert API<\/a>&nbsp;and legacy templates of&nbsp;<a href=\"https:\/\/docs.microsoft.com\/en-us\/azure\/azure-monitor\/insights\/solutions\">Log Analytics saved searches and alerts<\/a>&nbsp;can be managed using ScheduledQueryRules PowerShell cmdlets only after user&nbsp;<a href=\"https:\/\/docs.microsoft.com\/en-us\/azure\/azure-monitor\/platform\/alerts-log-api-switch\">switches API preference for Log Analytics Alerts<\/a>.<\/p>\n\n\n\n<p>Illustrated next are the steps for creation of a sample log alert rule using the scheduledQueryRules PowerShell cmdlets.PowerShellCopy<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>$source = New-AzScheduledQueryRuleSource -Query 'Heartbeat | summarize AggregatedValue = count() by bin(TimeGenerated, 5m), _ResourceId' -DataSourceId \"\/subscriptions\/a123d7efg-123c-1234-5678-a12bc3defgh4\/resourceGroups\/contosoRG\/providers\/microsoft.OperationalInsights\/workspaces\/servicews\"\n\n$schedule = New-AzScheduledQueryRuleSchedule -FrequencyInMinutes 15 -TimeWindowInMinutes 30\n\n$metricTrigger = New-AzScheduledQueryRuleLogMetricTrigger -ThresholdOperator \"GreaterThan\" -Threshold 2 -MetricTriggerType \"Consecutive\" -MetricColumn \"_ResourceId\"\n\n$triggerCondition = New-AzScheduledQueryRuleTriggerCondition -ThresholdOperator \"LessThan\" -Threshold 5 -MetricTrigger $metricTrigger\n\n$aznsActionGroup = New-AzScheduledQueryRuleAznsActionGroup -ActionGroup \"\/subscriptions\/a123d7efg-123c-1234-5678-a12bc3defgh4\/resourceGroups\/contosoRG\/providers\/microsoft.insights\/actiongroups\/sampleAG\" -EmailSubject \"Custom email subject\" -CustomWebhookPayload \"{ `\"alert`\":`\"#alertrulename`\", `\"IncludeSearchResults`\":true }\"\n\n$alertingAction = New-AzScheduledQueryRuleAlertingAction -AznsAction $aznsActionGroup -Severity \"3\" -Trigger $triggerCondition\n\nNew-AzScheduledQueryRule -ResourceGroupName \"contosoRG\" -Location \"Region Name for your Application Insights App or Log Analytics Workspace\" -Action $alertingAction -Enabled $true -Description \"Alert description\" -Schedule $schedule -Source $source -Name \"Alert Name\"\n<\/code><\/pre>\n\n\n\n<h2 class=\"wp-block-heading\" id=\"managing-log-alerts-using-cli-or-api\">Managing log alerts using CLI or API<\/h2>\n\n\n\n<p>Azure Monitor &#8211;&nbsp;<a href=\"https:\/\/docs.microsoft.com\/en-us\/rest\/api\/monitor\/scheduledqueryrules\/\">Scheduled Query Rules API<\/a>&nbsp;is a REST API and fully compatible with Azure Resource Manager REST API. Hence it can be used via Powershell using Resource Manager commands for Azure CLI.<\/p>\n\n\n\n<p>&nbsp;Note<\/p>\n\n\n\n<p>Log alerts for Log Analytics can also be managed using legacy&nbsp;<a href=\"https:\/\/docs.microsoft.com\/en-us\/azure\/azure-monitor\/platform\/api-alerts\">Log Analytics Alert API<\/a>&nbsp;and legacy templates of&nbsp;<a href=\"https:\/\/docs.microsoft.com\/en-us\/azure\/azure-monitor\/insights\/solutions\">Log Analytics saved searches and alerts<\/a>&nbsp;as well. For more information on using the new ScheduledQueryRules API detailed here by default, see&nbsp;<a href=\"https:\/\/docs.microsoft.com\/en-us\/azure\/azure-monitor\/platform\/alerts-log-api-switch\">Switch to new API for Log Analytics Alerts<\/a>.<\/p>\n\n\n\n<p>Log alerts currently do not have dedicated CLI commands currently; but as illustrated below can be used via Azure Resource Manager CLI command for sample Resource Template shown earlier (sampleScheduledQueryRule.json) in the Resource Template section:Azure CLICopy<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>az group deployment create --resource-group contosoRG --template-file sampleScheduledQueryRule.json\n<\/code><\/pre>\n\n\n\n<p>On successful operation, 201 will be returned to state new alert rule creation or 200 will be returned if an existing alert rule was modified.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\" id=\"next-steps\">Next steps<\/h2>\n\n\n\n<ul class=\"wp-block-list\"><li>Learn about\u00a0<a href=\"https:\/\/docs.microsoft.com\/en-us\/azure\/azure-monitor\/platform\/alerts-unified-log\">Log Alerts in Azure Alerts<\/a><\/li><li>Understand\u00a0<a href=\"https:\/\/docs.microsoft.com\/en-us\/azure\/azure-monitor\/platform\/alerts-log-webhook\">Webhook actions for log alerts<\/a><\/li><li>Learn more about\u00a0<a href=\"https:\/\/docs.microsoft.com\/en-us\/azure\/azure-monitor\/log-query\/log-query-overview\">Application Insights<\/a><\/li><li>Learn more about\u00a0<a href=\"https:\/\/docs.microsoft.com\/en-us\/azure\/azure-monitor\/log-query\/log-query-overview\">log queries<\/a>.<\/li><\/ul>\n\n\n\n<p>Ref:  <a href=\"https:\/\/docs.microsoft.com\/en-us\/azure\/azure-monitor\/platform\/alerts-log\">https:\/\/docs.microsoft.com\/en-us\/azure\/azure-monitor\/platform\/alerts-log<\/a><\/p>\n","protected":false},"excerpt":{"rendered":"<p>This article shows you how to create and manage log alerts using the alerts interface inside the Azure portal. Alert rules are defined by three components: Target: A specific Azure resource to monitor Criteria: A condition or logic to evaluate for truth. If true, the alert fires. Action: Specific call sent to a receiver of <a class=\"read-more\" href=\"https:\/\/SUMMALAI.COM\/?p=2303\">Read More<\/a><\/p>\n","protected":false},"author":2,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_bbp_topic_count":0,"_bbp_reply_count":0,"_bbp_total_topic_count":0,"_bbp_total_reply_count":0,"_bbp_voice_count":0,"_bbp_anonymous_reply_count":0,"_bbp_topic_count_hidden":0,"_bbp_reply_count_hidden":0,"_bbp_forum_subforum_count":0,"om_disable_all_campaigns":false,"_monsterinsights_skip_tracking":false,"_monsterinsights_sitenote_active":false,"_monsterinsights_sitenote_note":"","_monsterinsights_sitenote_category":0,"footnotes":""},"categories":[238,239,10],"tags":[],"class_list":["post-2303","post","type-post","status-publish","format-standard","hentry","category-cloud","category-azure","category-microsoft"],"aioseo_notices":[],"_links":{"self":[{"href":"https:\/\/SUMMALAI.COM\/index.php?rest_route=\/wp\/v2\/posts\/2303","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/SUMMALAI.COM\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/SUMMALAI.COM\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/SUMMALAI.COM\/index.php?rest_route=\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/SUMMALAI.COM\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=2303"}],"version-history":[{"count":1,"href":"https:\/\/SUMMALAI.COM\/index.php?rest_route=\/wp\/v2\/posts\/2303\/revisions"}],"predecessor-version":[{"id":2304,"href":"https:\/\/SUMMALAI.COM\/index.php?rest_route=\/wp\/v2\/posts\/2303\/revisions\/2304"}],"wp:attachment":[{"href":"https:\/\/SUMMALAI.COM\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=2303"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/SUMMALAI.COM\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=2303"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/SUMMALAI.COM\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=2303"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}