/ ARM

Explanation of Alerts from the Azure Monitor(ARM and REST API)

There have been many changes to Alerting on the Azure platform recently. I will try to explain the state as of today.

We have:

  • Metrics Alerts - Metric alerts in Azure Monitor provide a way to get notified when one of your metrics cross a threshold. Metric alerts work on a range of multi-dimensional platform metrics, custom metrics, Application Insights standard and custom metrics.
    • Example: Percentage CPU GreaterThan 95.
  • Metric Alerts for Logs - You can use metric alerts on popular Log Analytics logs extracted as metrics as part of Metrics from Logs including resources in Azure or on-premise. Near-real time monitoring capability.
    • Example: Heartbeat GreaterThan 1
  • Activity log alerts - Activity log alerts are the alerts that get activated when a new activity log event occurs that matches the conditions specified in the alert.
    • Example: Whenever the Recommendation Activity Log "Delete Resource Group (subscriptions/resourceGroups)" has "any" level, with "any" status and event is initiated by "any"
  • Log alerts - Log Alert consists of Log Search rules created for Azure Log Analytics or Application Insights.
    • Example: AzureDiagnostics | where ResourceProvider == "MICROSOFT.AUTOMATION" and Category == "JobLogs" and (ResultType == "Failed" or ResultType == "Stopped" or ResultType == "Suspended") | project TimeGenerated , RunbookName_s , ResultType , Resource

Metrics Alerts:

Metric Alerts for Logs:

Activity log alerts:

Log alerts: