Skip to content

Commit 4d89c3c

Browse files
Stacyrch140Stacyrch140
authored
Merge pull request #222544 from AbbyMSFT/metric-alert-arm-templates
Combine alerts articles with ARM templates
2 parents 87d0dd7 + 824c09e commit 4d89c3c

File tree

4 files changed

+448
-132
lines changed

4 files changed

+448
-132
lines changed

‎articles/azure-monitor/alerts/alerts-create-new-alert-rule.md

Lines changed: 44 additions & 126 deletions
Original file line numberDiff line numberDiff line change
@@ -5,7 +5,7 @@ author: AbbyMSFT
55
ms.author: abbyweisberg
66
ms.topic: conceptual
77
ms.custom: ignite-2022
8-
ms.date: 12/27/2022
8+
ms.date: 12/28/2022
99
ms.reviewer: harelbr
1010
---
1111
# Create a new alert rule
@@ -267,6 +267,9 @@ Then you define these elements for the resulting alert actions by using:
267267

268268
1. (Optional) If you've configured action groups for this alert rule, you can add custom properties to the alert payload to add more information to the payload. In the **Custom properties** section, add the property **Name** and **Value** for the custom property you want included in the payload.
269269

270+
> [!NOTE]
271+
> The [common schema](alerts-common-schema.md) overwrites custom configurations. Therefore, you can't use both custom properties and the common schema for log alerts.
272+
270273
:::image type="content" source="media/alerts-create-new-alert-rule/alerts-log-rule-details-tab.png" alt-text="Screenshot that shows the Details tab when creating a new log alert rule.":::
271274

272275
### [Activity log alert](#tab/activity-log)
@@ -276,6 +279,9 @@ Then you define these elements for the resulting alert actions by using:
276279
1. (Optional) In the **Advanced options** section, select **Enable upon creation** for the alert rule to start running as soon as you're done creating it.
277280
1. (Optional) If you've configured action groups for this alert rule, you can add custom properties to the alert payload to add more information to the payload. In the **Custom properties** section, add the property **Name** and **Value** for the custom property you want included in the payload.
278281

282+
> [!NOTE]
283+
> The [common schema](alerts-common-schema.md) overwrites custom configurations. Therefore, you can't use both custom properties and the common schema for activity log alerts.
284+
279285
:::image type="content" source="media/alerts-create-new-alert-rule/alerts-activity-log-rule-details-tab.png" alt-text="Screenshot that shows the Actions tab when creating a new activity log alert rule.":::
280286

281287
### [Resource Health alert](#tab/resource-health)
@@ -299,9 +305,9 @@ Then you define these elements for the resulting alert actions by using:
299305

300306
:::image type="content" source="media/alerts-create-new-alert-rule/alerts-rule-review-create.png" alt-text="Screenshot that shows the Review and create tab when creating a new alert rule.":::
301307

302-
## Create a new alert rule by using the CLI
308+
## Create a new alert rule using the CLI
303309

304-
You can create a new alert rule by using the [Azure CLI](/cli/azure/get-started-with-azure-cli). The following code examples use [Azure Cloud Shell](../../cloud-shell/overview.md). You can see the full list of the [Azure CLI commands for Azure Monitor](/cli/azure/azure-cli-reference-for-monitor#azure-monitor-references).
310+
You can create a new alert rule using the [Azure CLI](/cli/azure/get-started-with-azure-cli). The following code examples use [Azure Cloud Shell](../../cloud-shell/overview.md). You can see the full list of the [Azure CLI commands for Azure Monitor](/cli/azure/azure-cli-reference-for-monitor#azure-monitor-references).
305311

306312
1. In the [portal](https://portal.azure.com/), select **Cloud Shell**. At the prompt, use the commands that follow.
307313

@@ -353,35 +359,39 @@ You can create a new alert rule by using the [Azure CLI](/cli/azure/get-started-
353359
354360
---
355361
356-
## Create a new alert rule by using PowerShell
357-
358-
- To create a metric alert rule by using PowerShell, use the [Add-AzMetricAlertRuleV2](/powershell/module/az.monitor/add-azmetricalertrulev2) cmdlet.
359-
- To create a log alert rule by using PowerShell, use the [New-AzScheduledQueryRule](/powershell/module/az.monitor/new-azscheduledqueryrule) cmdlet.
360-
- To create an activity log alert rule by using PowerShell, use the [Set-AzActivityLogAlert](/powershell/module/az.monitor/set-azactivitylogalert) cmdlet.
361-
362-
## Create an activity log alert rule from the Activity log pane
363-
364-
You can also create an activity log alert on future events similar to an activity log event that already occurred.
365-
366-
1. In the [portal](https://portal.azure.com/), [go to the Activity log pane](../essentials/activity-log.md#view-the-activity-log).
367-
1. Filter or find the desired event. Then create an alert by selecting **Add activity log alert**.
362+
## Create a new alert rule with PowerShell
368363
369-
:::image type="content" source="media/alerts-create-new-alert-rule/create-alert-rule-from-activity-log-event-new.png" alt-text="Screenshot that shows creating an alert rule from an activity log event." lightbox="media/alerts-create-new-alert-rule/create-alert-rule-from-activity-log-event-new.png":::
364+
- To create a metric alert rule using PowerShell, use the [Add-AzMetricAlertRuleV2](/powershell/module/az.monitor/add-azmetricalertrulev2) cmdlet.
365+
- To create a log alert rule using PowerShell, use the [New-AzScheduledQueryRule](/powershell/module/az.monitor/new-azscheduledqueryrule) cmdlet.
366+
- To create an activity log alert rule using PowerShell, use the [Set-AzActivityLogAlert](/powershell/module/az.monitor/set-azactivitylogalert) cmdlet.
370367
371-
1. The **Create alert rule** wizard opens, with the scope and condition already provided according to the previously selected activity log event. If necessary, you can edit and modify the scope and condition at this stage. By default, the exact scope and condition for the new rule are copied from the original event attributes. For example, the exact resource on which the event occurred, and the specific user or service name that initiated the event, are both included by default in the new alert rule.
368+
## Create a new alert rule using an ARM template
372369
373-
If you want to make the alert rule more general, modify the scope and condition accordingly. See steps 3-9 in the section "Create a new alert rule in the Azure portal."
374-
375-
1. Follow the rest of the steps from [Create a new alert rule in the Azure portal](#create-a-new-alert-rule-in-the-azure-portal).
376-
377-
## Create an activity log alert rule by using an ARM template
378-
379-
To create an activity log alert rule by using an Azure Resource Manager template (ARM template), create a `microsoft.insights/activityLogAlerts` resource. Then fill in all related properties.
370+
You can use an [Azure Resource Manager template (ARM template)](../../azure-resource-manager/templates/syntax.md) to configure alert rules consistently in all of your environments.
380371
372+
1. Create a new resource, using the following resource types:
373+
- For metric alerts: `Microsoft.Insights/metricAlerts`
374+
- For log alerts: `Microsoft.Insights/scheduledQueryRules`
375+
- For activity log, service health, and resource health alerts: `microsoft.Insights/activityLogAlerts`
376+
> [!NOTE]
377+
> - Metric alerts for an Azure Log Analytics workspace resource type (`Microsoft.OperationalInsights/workspaces`) are configured differently than other metric alerts. For more information, see [Resource Template for Metric Alerts for Logs](alerts-metric-logs.md#resource-template-for-metric-alerts-for-logs).
378+
> - We recommend that you create the metric alert using the same resource group as your target resource.
379+
1. Copy one of the templates from these sample ARM templates.
380+
- For metric alerts: [Resource Manager template samples for metric alert rules](resource-manager-alerts-metric.md)
381+
- For log alerts: [Resource Manager template samples for log alert rules](resource-manager-alerts-log.md)
382+
- For activity log alerts: [Resource Manager template samples for activity log alert rules](resource-manager-alerts-activity-log.md)
383+
- For resource health alerts: [Resource Manager template samples for resource health alert rules](resource-manager-alerts-resource-health.md)
384+
1. Edit the template file to contain appropriate information for your alert, and save the file as \<your-alert-template-file\>.json.
385+
1. Edit the corresponding parameters file to customize the alert, and save as \<your-alert-template-file\>.parameters.json.
386+
1. Set the `metricName` parameter, using one of the values in [Azure Monitor supported metrics](../essentials/metrics-supported.md).
387+
1. Deploy the template using [PowerShell](../../azure-resource-manager/templates/deploy-powershell.md#deploy-local-template) or the [CLI](../../azure-resource-manager/templates/deploy-cli.md#deploy-local-template).
388+
389+
### Additional properties for activity log alert ARM templates
381390
> [!NOTE]
382-
>The highest level that activity log alerts can be defined is the subscription level. Define the alert to alert per subscription. You can't define an alert on two subscriptions.
391+
> - Activity log alerts are defined at the subscription level. You can't define a single alert rule on more than one subscription.
392+
> - It may take up to five minutes for a new activity log alert rule to become active.
383393
384-
The following fields are the options in the ARM template for the conditions fields. The **Resource Health**, **Advisor** and **Service Health** fields have extra properties fields.
394+
ARM templates for activity log alerts contain additional properties for the conditions fields. The **Resource Health**, **Advisor** and **Service Health** fields have extra properties fields.
385395
386396
|Field |Description |
387397
|---------|---------|
@@ -396,114 +406,22 @@ The following fields are the options in the ARM template for the conditions fiel
396406
|subStatus |Usually, this field is the HTTP status code of the corresponding REST call. This field can also include other strings describing a substatus. Examples of HTTP status codes include `OK` (HTTP Status Code: 200), `No Content` (HTTP Status Code: 204), and `Service Unavailable` (HTTP Status Code: 503), among many others. |
397407
|resourceType |The type of the resource that was affected by the event. An example is `Microsoft.Resources/deployments`. |
398408
399-
This example sets the condition to the **Administrative** category:
400-
401-
```json
402-
"condition": {
403-
"allOf": [
404-
{
405-
"field": "category",
406-
"equals": "Administrative"
407-
},
408-
{
409-
"field": "resourceType",
410-
"equals": "Microsoft.Resources/deployments"
411-
}
412-
]
413-
}
414-
415-
```
416-
417-
This example template creates an activity log alert rule by using the **Administrative** condition:
418-
419-
```json
420-
{
421-
"$schema": "https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#",
422-
"contentVersion": "1.0.0.0",
423-
"parameters": {
424-
"activityLogAlertName": {
425-
"type": "string",
426-
"metadata": {
427-
"description": "Unique name (within the Resource Group) for the Activity log alert."
428-
}
429-
},
430-
"activityLogAlertEnabled": {
431-
"type": "bool",
432-
"defaultValue": true,
433-
"metadata": {
434-
"description": "Indicates whether or not the alert is enabled."
435-
}
436-
},
437-
"actionGroupResourceId": {
438-
"type": "string",
439-
"metadata": {
440-
"description": "Resource Id for the Action group."
441-
}
442-
}
443-
},
444-
"resources": [
445-
{
446-
"type": "Microsoft.Insights/activityLogAlerts",
447-
"apiVersion": "2017-04-01",
448-
"name": "[parameters('activityLogAlertName')]",
449-
"location": "Global",
450-
"properties": {
451-
"enabled": "[parameters('activityLogAlertEnabled')]",
452-
"scopes": [
453-
"[subscription().id]"
454-
],
455-
"condition": {
456-
"allOf": [
457-
{
458-
"field": "category",
459-
"equals": "Administrative"
460-
},
461-
{
462-
"field": "operationName",
463-
"equals": "Microsoft.Resources/deployments/write"
464-
},
465-
{
466-
"field": "resourceType",
467-
"equals": "Microsoft.Resources/deployments"
468-
}
469-
]
470-
},
471-
"actions": {
472-
"actionGroups":
473-
[
474-
{
475-
"actionGroupId": "[parameters('actionGroupResourceId')]"
476-
}
477-
]
478-
}
479-
}
480-
}
481-
]
482-
}
483-
```
484-
485-
This sample JSON can be saved as, for example, *sampleActivityLogAlert.json*. You can deploy the sample by using [Azure Resource Manager in the Azure portal](../../azure-resource-manager/templates/deploy-portal.md).
486-
487409
For more information about the activity log fields, see [Azure activity log event schema](../essentials/activity-log-schema.md).
488410
489-
> [!NOTE]
490-
> It might take up to five minutes for the new activity log alert rule to become active.
491-
492-
## Create a new activity log alert rule by using the REST API
411+
## Create an activity log alert rule from the Activity log pane
493412
494-
The Azure Monitor Activity Log Alerts API is a REST API. It's fully compatible with the Azure Resource Manager REST API. You can use it with PowerShell by using the Resource Manager cmdlet or the Azure CLI.
413+
You can also create an activity log alert on future events similar to an activity log event that already occurred.
495414
496-
[!INCLUDE [updated-for-az](../../../includes/updated-for-az.md)]
415+
1. In the [portal](https://portal.azure.com/), [go to the Activity log pane](../essentials/activity-log.md#view-the-activity-log).
416+
1. Filter or find the desired event. Then create an alert by selecting **Add activity log alert**.
497417
498-
### Deploy the ARM template with PowerShell
418+
:::image type="content" source="media/alerts-create-new-alert-rule/create-alert-rule-from-activity-log-event-new.png" alt-text="Screenshot that shows creating an alert rule from an activity log event." lightbox="media/alerts-create-new-alert-rule/create-alert-rule-from-activity-log-event-new.png":::
499419
500-
To use PowerShell to deploy the sample ARM template shown in the [previous section](#create-an-activity-log-alert-rule-by-using-an-arm-template), use the following command:
420+
1. The **Create alert rule** wizard opens, with the scope and condition already provided according to the previously selected activity log event. If necessary, you can edit and modify the scope and condition at this stage. By default, the exact scope and condition for the new rule are copied from the original event attributes. For example, the exact resource on which the event occurred, and the specific user or service name that initiated the event, are both included by default in the new alert rule.
501421
502-
```powershell
503-
New-AzResourceGroupDeployment -ResourceGroupName "myRG" -TemplateFile sampleActivityLogAlert.json -TemplateParameterFile sampleActivityLogAlert.parameters.json
504-
```
422+
If you want to make the alert rule more general, modify the scope and condition accordingly. See steps 3-9 in the section "Create a new alert rule in the Azure portal."
505423
506-
The *sampleActivityLogAlert.parameters.json* file contains values for the parameters that you need for alert rule creation.
424+
1. Follow the rest of the steps from [Create a new alert rule in the Azure portal](#create-a-new-alert-rule-in-the-azure-portal).
507425
508426
## Changes to the log alert rule creation experience
509427

0 commit comments

Comments
 (0)