question

RobC-CTL avatar image
1 Vote"
RobC-CTL asked olufemiaMSFT edited

Azure Alert - Updated query not being used

Hi,

I have a simple heartbeat alert configured within OMS that uses the following log query

 Heartbeat
 | summarize LastHeartbeat=max(TimeGenerated) by Computer
 | where LastHeartbeat < ago(5m)

This worked great, if a server missed a heartbeat I'd get an email alerting me. One of the servers is on a very slow broadband connection so I was getting false alerts so I tweaked the query to 10 minutes. This was done over 48 hours ago but I am still getting alerts that show the original query. I've tried disabling/enabling the rule but the problem persists. The next step will be to delete and re-create but before I did that I just wanted to check I've not missed something?

azure-monitor
· 5
5 |1600 characters needed characters left characters exceeded
Toggle Comment visibility. Current Visibility: Visible to all users

Up to 10 attachments (including images) can be used with a maximum of 3.0 MiB each and 30.0 MiB total.

olufemiaMSFT avatar image olufemiaMSFT ·

Hello RobC-CTL , sorry for the delay. disabling + enabling should have worked. Please don't hesitate to reply if this remains an issue and we can help investigate further or connect you to our technical support channel.

CHeers.

1 Vote 1 ·
RobC-CTL avatar image RobC-CTL ·

Hi @olufemiaMSFT thanks for the reply. Since posting this I've deleted the and recreated it with a new name but I am still getting alerts being triggered by the old (now deleted) rule, very odd?


Cheers
Rob


1 Vote 1 ·
RobC-CTL avatar image RobC-CTL ·

cc @olufemiaMSFT


This is getting daft now, I am getting emails every 20 minutes from a action rule that has long since been deleted. If I click on the alert from the portal it shows the alert id and a URL to the alert rule as seen here


11385-azurealerterror.png



If I click on the URL I just get taken to a error screen


11386-azurealerterror1.png




I've tried using CLI to find the rule but I can't find any reference to it - very confusing.


Any help gratefully received!


Cheers
Rob



1 Vote 1 ·
azurealerterror.png (43.1 KiB)
azurealerterror1.png (24.1 KiB)
HUNTERROBERT-6810 avatar image HUNTERROBERT-6810 ·

did you check resource group name, documentation reference to remove AlertRule


https://docs.microsoft.com/en-us/powershell/module/azurerm.insights/remove-azurermalertrule?view=azurermps-6.13.0


@olufemiaMSFT
@RobC-CTL


0 Votes 0 ·
olufemiaMSFT avatar image olufemiaMSFT ·

@RobC-CTL - sincere apologies for the inconsistent response. At this point, I would like to see what you are seeing so we can resolve this asap. do you mind connecting via email?


If yes, send mail to AzCommunity@microsoft.com including "Attn:femi" in subject line.
Also add your Azure subscription ID and a link to this Post (for context).


Looking forward to your response.


Have a nice weekend.



0 Votes 0 ·

1 Answer

olufemiaMSFT avatar image
0 Votes"
olufemiaMSFT answered olufemiaMSFT edited

Hello @RobC-CTL - as discussed offline, Your issue has been linked to a known product bug that typically occurs when an alert is created and deleted almost immediately. Good news is there's already a fix in the works Will share more updates on the fix timelines once I hear back from the feature team. If the issue persists, raise a support request directly with our support channel or reach out to the previously shared email address.


Cheers.



5 |1600 characters needed characters left characters exceeded
Toggle Comment visibility. Current Visibility: Visible to all users

Up to 10 attachments (including images) can be used with a maximum of 3.0 MiB each and 30.0 MiB total.