Merge pull request #251099 from AbbyMSFT/alerts-state

Clarification about stateful alerts and retention

Author: v-dirichards

articles/azure-monitor/alerts/alerts-manage-alert-instances.md

@@ -6,7 +6,8 @@ ms.date: 07/11/2023
 ms.reviewer: harelbr
 ---
 # Manage your alert instances
-The **Alerts** page summarizes all alert instances in all your Azure resources generated in the last 30 days. You can search for a specific alert and manage alert instances.
+The **Alerts** page summarizes all alert instances in all your Azure resources generated in the last 30 days. Alerts are stored for 30 days and are deleted after the 30-day retention period. 
+For stateful alerts, while the alert itself is deleted after 30 days, and is not viewable on the alerts page, the alert condition is stored until the alert is resolved, to prevent firing another alert, and so that notifications can be sent when the alert is resolved. For more information, see [Alerts and state](alerts-overview.md#alerts-and-state).
 
 You can get to the **Alerts** page in a few ways:
 

articles/azure-monitor/alerts/alerts-overview.md

@@ -4,7 +4,7 @@ description: Learn about Azure Monitor alerts, alert rules, action processing ru
 author: AbbyMSFT
 ms.author: abbyweisberg
 ms.topic: overview 
-ms.date: 07/19/2022
+ms.date: 09/12/2023
 ms.custom: template-overview 
 ms.reviewer: harelbr
 ---
@@ -19,15 +19,18 @@ This diagram shows you how alerts work.
 
 :::image type="content" source="media/alerts-overview/alerts.png"  alt-text="Diagram that explains Azure Monitor alerts." lightbox="media/alerts-overview/alerts.png":::
 
-An *alert rule* monitors your data and captures a signal that indicates something is happening on the specified resource. The alert rule captures the signal and checks to see if the signal meets the criteria of the condition. If the conditions are met, an alert is triggered, which initiates the associated action group and updates the state of the alert.
+An **alert rule** monitors your data and captures a signal that indicates something is happening on the specified resource. The alert rule captures the signal and checks to see if the signal meets the criteria of the condition.
 
 An alert rule combines:
  - The resources to be monitored.
  - The signal or data from the resource.
  - Conditions.
 
-If you're monitoring more than one resource, the condition is evaluated separately for each of the resources. Alerts are fired for each resource separately.
+An **alert** is triggered if the conditions of the alert rule are met. The alert initiates the associated action group and updates the state of the alert. If you're monitoring more than one resource, the alert rule condition is evaluated separately for each of the resources, and alerts are fired for each resource separately. 
 
+Alerts are stored for 30 days and are deleted after the 30-day retention period. You can see all alert instances for all of your Azure resources on the [Alerts page](alerts-manage-alert-instances.md) in the Azure portal.
+
+Alerts consist of:
  - **Action groups**: These groups can trigger notifications or an automated workflow to let users know that an alert has been triggered. Action groups can include:
      - Notification methods, such as email, SMS, and push notifications.
      - Automation runbooks.
@@ -37,11 +40,9 @@ If you're monitoring more than one resource, the condition is evaluated separate
      - Secure webhooks.
      - Webhooks.
      - Event hubs.
-- **Alert conditions**: These conditions are set by the system. When an alert fires, the alert's monitor condition is set to **fired**. After the underlying condition that caused the alert to fire clears, the monitor condition is set to **resolved**.
+- **Alert conditions**: These conditions are set by the system. When an alert fires, the alert condition is set to **fired**. After the underlying condition that caused the alert to fire clears, the alert condition is set to **resolved**.
 - **User response**: The response is set by the user and doesn't change until the user changes it.
 - **Alert processing rules**: You can use alert processing rules to make modifications to triggered alerts as they're being fired. You can use alert processing rules to add or suppress action groups, apply filters, or have the rule processed on a predefined schedule.
-
-You can see all alert instances in all your Azure resources generated in the last 30 days on the [Alerts page](alerts-page.md) in the Azure portal.
 ## Types of alerts
 
 This table provides a brief description of each alert type. For more information about each alert type and how to choose which alert type best suits your needs, see [Types of Azure Monitor alerts](alerts-types.md).
@@ -54,6 +55,35 @@ This table provides a brief description of each alert type. For more information
 |[Smart detection alerts](alerts-types.md#smart-detection-alerts)|Smart detection on an Application Insights resource automatically warns you of potential performance problems and failure anomalies in your web application. You can migrate smart detection on your Application Insights resource to create alert rules for the different smart detection modules.|
 |[Prometheus alerts](alerts-types.md#prometheus-alerts)|Prometheus alerts are used for alerting on Prometheus metrics stored in [Azure Monitor managed services for Prometheus](../essentials/prometheus-metrics-overview.md). The alert rules are based on the PromQL open-source query language.|
 
+## Alerts and state
+
+Alerts can be stateful or stateless.
+- Stateless alerts fire each time the condition is met, even if fired previously.
+- Stateful alerts fire when the rule conditions are met, and will not fire again or trigger any more actions until the conditions are resolved.
+
+Alerts are stored for 30 days and are deleted after the 30-day retention period.
+
+### Stateless alerts
+Stateless alerts fire each time the condition is met. The alert condition for all stateless alerts is always `fired`. 
+
+- All activity log alerts are stateless.
+- The frequency of notifications for stateless metric alerts differs based on the alert rule's configured frequency:
+    - **Alert frequency of less than 5 minutes**: While the condition continues to be met, a notification is sent sometime between one and six minutes.
+    - **Alert frequency of more than 5 minutes**: While the condition continues to be met, a notification is sent between the configured frequency and double the frequency. For example, for an alert rule with a frequency of 15 minutes, a notification is sent sometime between 15 to 30 minutes.
+
+### Stateful alerts
+Stateful alerts fire when the rule conditions are met, and will not fire again or trigger any more actions until the conditions are resolved. 
+The alert condition for stateful alerts is `fired`, until it is considered resolved. When an alert is considered resolved, the alert rule sends out a resolved notification by using webhooks or email, and the alert condition is set to `resolved`.
+
+For stateful alerts, while the alert itself is deleted after 30 days, the alert condition is stored until the alert is resolved, to prevent firing another alert, and so that notifications can be sent when the alert is resolved.
+
+This table describes when a stateful alert is considered resolved:
+
+|Alert type |The alert is resolved when |
+|---------|---------|
+|Metric alerts|The alert condition isn't met for three consecutive checks.|
+|Log alerts| The alert condition isn't met for a specific time range. The time range differs based on the frequency of the alert:<ul> <li>**1 minute**: The alert condition isn't met for 10 minutes.</li> <li>**5 to 15 minutes**: The alert condition isn't met for three frequency periods.</li> <li>**15 minutes to 11 hours**: The alert condition isn't met for two frequency periods.</li> <li>**11 to 12 hours**: The alert condition isn't met for one frequency period.</li></ul>|
+
 ## Recommended alert rules
 
 If you don't have alert rules defined for the selected resource, you can [enable recommended out-of-the-box alert rules in the Azure portal](alerts-manage-alert-rules.md#enable-recommended-alert-rules-in-the-azure-portal).
@@ -84,23 +114,6 @@ These built-in Azure roles, supported at all Azure Resource Manager scopes, have
 
 If the target action group or rule location is in a different scope than the two built-in roles, create a user with the appropriate permissions.
 
-## Alerts and state
-
-You can configure whether log or metric alerts are stateful or stateless. Activity log alerts are stateless.
-- Stateless alerts fire each time the condition is met, even if fired previously.
-
-    The frequency of notifications for stateless metric alerts differs based on the alert rule's configured frequency:
-    - **Alert frequency of less than 5 minutes**: While the condition continues to be met, a notification is sent sometime between one and six minutes.
-    - **Alert frequency of more than 5 minutes**: While the condition continues to be met, a notification is sent between the configured frequency and double the frequency. For example, for an alert rule with a frequency of 15 minutes, a notification is sent sometime between 15 to 30 minutes.
-
-- Stateful alerts fire when the condition is met. They don't fire again or trigger any more actions until the conditions are resolved, as described in this table:
-
-    |Alert type |The alert is resolved when |
-    |---------|---------|
-    |Metric alerts|The alert condition isn't met for three consecutive checks.|
-    |Log alerts| The alert condition isn't met for a specific time range. The time range differs based on the frequency of the alert:<ul> <li>**1 minute**: The alert condition isn't met for 10 minutes.</li> <li>**5 to 15 minutes**: The alert condition isn't met for three frequency periods.</li> <li>**15 minutes to 11 hours**: The alert condition isn't met for two frequency periods.</li> <li>**11 to 12 hours**: The alert condition isn't met for one frequency period.</li></ul>|
-
-When an alert is considered resolved, the alert rule sends out a resolved notification by using webhooks or email. The monitor state in the Azure portal is set to **resolved**.
 ## Pricing
 For information about pricing, see [Azure Monitor pricing](https://azure.microsoft.com/pricing/details/monitor/).