You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: articles/log-analytics/log-analytics-tutorial-response.md
+22-22Lines changed: 22 additions & 22 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -19,64 +19,64 @@ ms.component: na
19
19
---
20
20
21
21
# Respond to events with Azure Monitor Alerts
22
-
Log search rules are created by Azure Alerts to automatically run specified log queries at regular intervals. If the results of the log query match particular criteria, then an alert record is created. The rule can then automatically run one or more actions using [Action Groups](monitoring-action-groups.md).
22
+
Log search rules are created by Azure Alerts to automatically run specified log queries at regular intervals. If the results of the log query match particular criteria, then an alert record is created. The rule can then automatically run one or more actions using [Action Groups](../monitoring-and-diagnostics/monitoring-action-groups.md).
23
23
24
24
In this tutorial, you learn how to:
25
25
26
26
> [!div class="checklist"]
27
27
> * Create an alert rule
28
28
> * Configure an Action Group to send an e-mail notification
29
29
30
-
To complete the example in this tutorial, you must have an existing virtual machine [connected to the Log Analytics workspace](log-analytics-quick-collect-azurevm.md).
30
+
To complete the example in this tutorial, you must have an existing virtual machine [connected to the Log Analytics workspace](log-analytics-quick-collect-azurevm.md).
31
31
32
32
## Sign in to Azure portal
33
-
Log in to the Azure portal at [https://portal.azure.com](https://portal.azure.com).
33
+
Log in to the Azure portal at [https://portal.azure.com](https://portal.azure.com).
34
34
35
35
## Create alerts
36
-
Alerts are created by alert rules in Azure Monitor and can automatically run saved queries or custom log searches at regular intervals. You can create alerts based on specific performance metrics or when certain events are created, absence of an event, or a number of events are created within a particular time window. For example, alerts can be used to notify you when average CPU usage exceeds a certain threshold, when a missing update is detected, or when an event is generated upon detecting that a specific Windows service or Linux daemon is not running. If the results of the log search match particular criteria, then an alert is created. The rule can then automatically run one or more actions, such as notify you of the alert or invoke another process.
36
+
Alerts are created by alert rules in Azure Monitor and can automatically run saved queries or custom log searches at regular intervals. You can create alerts based on specific performance metrics or when certain events are created, absence of an event, or a number of events are created within a particular time window. For example, alerts can be used to notify you when average CPU usage exceeds a certain threshold, when a missing update is detected, or when an event is generated upon detecting that a specific Windows service or Linux daemon is not running. If the results of the log search match particular criteria, then an alert is created. The rule can then automatically run one or more actions, such as notify you of the alert or invoke another process.
37
37
38
-
In the following example, you create a metric measurement alert rule based off of the *Azure VMs - Processor Utilization* query saved in the [Visualize data tutorial](log-analytics-tutorial-dashboards.md). An alert is created for each virtual machine that exceeds a threshold of 90%.
38
+
In the following example, you create a metric measurement alert rule based off of the *Azure VMs - Processor Utilization* query saved in the [Visualize data tutorial](log-analytics-tutorial-dashboards.md). An alert is created for each virtual machine that exceeds a threshold of 90%.
39
39
40
40
1. In the Azure portal, click **All services**. In the list of resources, type **Monitor**. As you begin typing, the list filters based on your input. Select **Monitor**.
41
41
2. In the left-hand pane, select **Alerts** and then click **New Alert Rule** from the top of the page to create a new alert.<br><br> <br>
42
42
3. For the first step, under the **Create Alert** section, you are going to select your Log Analytics workspace as the resource, since this is a log based alert signal. Filter the results by choosing the specific **Subscription** from the drop-down list if you have more than one, which contains the VM and Log Analytics workspace created earlier. Filter the **Resource Type** by selecting **Log Analytics** from the drop-down list. Finally, select the **Resource****DefaultLAWorkspace** and then click **Done**.<br><br> <br>
43
43
4. Under the section **Alert Criteria**, click **Add Criteria** to define the query and then specify logic that the alert rule follows. From the **Configure signal logic** pane, select **Custom log search** as signal name and enter your query in **Search query**.
44
44
45
45
For example:
46
-
```
46
+
```
47
47
Perf
48
48
| where CounterName == "% Processor Time" and ObjectName == "Processor" and InstanceName == "_Total"
49
-
| summarize AggregatedValue=avg(CounterValue) by bin(TimeGenerated, 1m)
49
+
| summarize AggregatedValue=avg(CounterValue) by bin(TimeGenerated, 1m)
50
50
```
51
51
52
-
The pane updates to present the configuration settings for the alert. On the top, it shows the results for the last 30 minutes of the selected signal.
53
-
5. Configure the alert with the following information:
54
-
a. From the **Based on* drop-down list select **Metric measurement**. A metric measurement will create an alert for each object in the query with a value that exceeds our specified threshold.
55
-
b. For the **Condition**, select **Greater than** and enter **90** for **Threshold**.
56
-
c. Under Trigger Alert Based On section, select **Consecutive breaches** and from the drop-down list select **Greater than** enter a value of 3.
57
-
d. Under Evaluation based on section, accept the defaults. The rule will run every five minutes and return records that were created within this range of the current time.
58
-
6. Click **Done** to complete the alert rule.<br><br> <br>
52
+
The pane updates to present the configuration settings for the alert. On the top, it shows the results for the last 30 minutes of the selected signal.
53
+
5. Configure the alert with the following information:
54
+
a. From the **Based on* drop-down list select **Metric measurement**. A metric measurement will create an alert for each object in the query with a value that exceeds our specified threshold.
55
+
b. For the **Condition**, select **Greater than** and enter **90** for **Threshold**.
56
+
c. Under Trigger Alert Based On section, select **Consecutive breaches** and from the drop-down list select **Greater than** enter a value of 3.
57
+
d. Under Evaluation based on section, accept the defaults. The rule will run every five minutes and return records that were created within this range of the current time.
58
+
6. Click **Done** to complete the alert rule.<br><br> <br>
59
59
7. Now moving onto the second step, provide a name of your alert in the **Alert rule name** field, such as **Percentage CPU greater than 90 percent**. Specify a **Description** detailing specifics for the alert, and select **Critical(Sev 0)** for the **Severity** value from the options provided.<br><br> <br>
60
60
8. To immediately activate the alert rule on creation, accept the default value for **Enable rule upon creation**.
61
-
9. For the third and final step, you specify an **Action Group**, which ensures that the same actions are taken each time an alert is triggered and can be used for each rule you define. Configure a new action group with the following information:
61
+
9. For the third and final step, you specify an **Action Group**, which ensures that the same actions are taken each time an alert is triggered and can be used for each rule you define. Configure a new action group with the following information:
62
62
a. Select **New action group** and the **Add action group** pane appears.
63
-
b. For **Action group name**, specify a name such as **IT Operations - Notify** and a **Short name** such as **itops-n**.
64
-
c. Verify the default values for **Subscription** and **Resource group** are correct. If not, select the correct one from the drop-down list.
63
+
b. For **Action group name**, specify a name such as **IT Operations - Notify** and a **Short name** such as **itops-n**.
64
+
c. Verify the default values for **Subscription** and **Resource group** are correct. If not, select the correct one from the drop-down list.
65
65
d. Under the Actions section, specify a name for the action, such as **Send Email** and under **Action Type** select **Email/SMS/Push/Voice** from the drop-down list. The **Email/SMS/Push/Voice** properties pane will open to the right in order to provide additional information.
66
-
e. On the **Email/SMS/Push/Voice** pane, enable **Email** and provide a valid email SMTP address to deliver the message to.
66
+
e. On the **Email/SMS/Push/Voice** pane, enable **Email** and provide a valid email SMTP address to deliver the message to.
67
67
f. Click **OK** to save your changes.<br><br> <br>
68
-
10. Click **OK** to complete the action group.
69
-
11. Click **Create alert rule** to complete the alert rule. It starts running immediately.<br><br> <br>
68
+
10. Click **OK** to complete the action group.
69
+
11. Click **Create alert rule** to complete the alert rule. It starts running immediately.<br><br> <br>
70
70
71
71
## View your alerts in Azure portal
72
-
Now that you have created an alert, you can view Azure alerts in a single pane and manage all alert rules across your Azure subscriptions. It lists all the alert rules (enabled or disabled) and can be sorted based on target resources, resource groups, rule name, or status. Included is an aggregated summary of all the fired alerts, and total configured/enabled alert rules.<br><br> 
72
+
Now that you have created an alert, you can view Azure alerts in a single pane and manage all alert rules across your Azure subscriptions. It lists all the alert rules (enabled or disabled) and can be sorted based on target resources, resource groups, rule name, or status. Included is an aggregated summary of all the fired alerts, and total configured/enabled alert rules.<br><br> 
73
73
74
74
When the alert triggers, the table reflects the condition and how many times it occurred within the time range selected (the default is last six hours). There should be a corresponding email in your inbox similar to the following example showing the offending virtual machine and the top results that matched the search query in this case.<br><br> 
75
75
76
76
## Next steps
77
77
In this tutorial, you learned how alert rules can proactively identify and respond to an issue when they run log searches at scheduled intervals and match a particular criteria.
78
78
79
-
Follow this link to see pre-built Log Analytics script samples.
79
+
Follow this link to see pre-built Log Analytics script samples.
0 commit comments