Hi,
could not find this information on about docs so hopefully someone knows here.
If my alert fires and goes to Alert condition -> 'fired' how much time can there be between until Alert condition can't anymore go to 'resolved' automatically?
I have few alerts and affected resources that are still in condition 'fired' but the issue is really solved and condition is not anymore met.
Hello @bombbe,
Is your alert stateful or stateless? Is your alert a metric alert or log alert? Please check below scenarios that might be matching with yours. If not, then please provide more details or context to try to help you.
Scenario 1:
As explained here (for illustration check below screenshot), if you have made a metric alert rule stateless then it prevents fired alerts from becoming resolved so even after the condition isn’t met anymore the fired alerts will remain in a fired state until the 30 days retention period.
Scenario 2:
As explained here, if you have a stateless alert then it fires each time the condition is met, even if fired previously and you can mark the alert as closed once the alert instance is resolved. Stateful alerts fire once per incident and resolve. The alert rule resolves when the alert condition isn't met for 30 minutes for a specific evaluation period (to account for log ingestion delay), and for three consecutive evaluations to reduce noise if there is flapping conditions. Stateful alerts feature is currently in preview. You can set this using Automatically resolve alerts in the alert details section.
Hi,
I'm alert is log query v2 and it is following
Heartbeat
| summarize LastCall = max(TimeGenerated) by Computer, _ResourceId
| extend HeartBeatMissing = iff(LastCall < ago(2h), 1, 0)
is this stateful or stateless? I would say stateless so what is maximum time that these alerts can be automatically closed?
Hi @bombbe,
Your response clarifies that you have configured log alert and as you have enabled Automatically resolve alerts section so its a stateful log alert which is currently in preview. As per scenario 2 in my earlier comment and as explained here, stateful alerts fire once per incident and resolve. The alert rule resolves when the alert condition isnt met for 30 minutes for a specific evaluation period to account for log ingestion delay, and for three consecutive evaluations to reduce noise if there is flapping conditions.
this still not really answers my question. Can that alert e.g resolve automatically after 2 weeks being open when alert condition isnt met for X minutes or what is maximum time time for this?
12 people are following this question.
