You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
1.**Is the type of action “Email Azure Resource Manager Role”?**
30
+
1.**Is the type of action "Email Azure Resource Manager Role"?**
31
31
32
32
This action only looks at Azure Resource Manager role assignments that are at the subscription scope, and of type *User*. Make sure that you have assigned the Resource Manager role at the subscription level, and not at the resource level or resource group level.
33
33
@@ -120,35 +120,32 @@ If you can see a fired alert in the portal, but its configured action did not tr
120
120
121
121
1.**Did a webhook not trigger?**
122
122
123
-
1.**Have the source IP addresses been blocked?**
124
-
123
+
1.**Have the source IP addresses been blocked?**
125
124
Whitelist the [IP addresses](action-groups.md#action-specific-information) that the webhook is called from.
126
125
127
126
1.**Does your webhook endpoint work correctly?**
128
-
129
127
Verify the webhook endpoint you have configured is correct and the endpoint is working correctly. Check your webhook logs or instrument its code so you could investigate (for example, log the incoming payload).
130
128
131
129
1.**Are you calling Slack or Microsoft Teams?**
132
-
133
130
Each of these endpoints expects a specific JSON format. Follow [these instructions](action-groups-logic-app.md) to configure a logic app action instead.
134
131
135
132
1.**Did your webhook became unresponsive or returned errors?**
136
-
137
-
Our timeout period for a webhook response is 10 seconds. The webhook call will be retried up to two additional times when the following HTTP status codes are returned: 408, 429, 503, 504, or when the HTTP endpoint does not respond. The first retry happens after 10 seconds. The second and final retry happens after 100 seconds. If the second retry fails, the endpoint will not be called again for 30 minutes for any action group.
133
+
134
+
Our timeout period for a webhook response is 10 seconds. The webhook call will be retried up to two additional times when the following HTTP status codes are returned: 408, 429, 503, 504, or when the HTTP endpoint does not respond. The first retry happens after 10 seconds. The second and final retry happens after 100 seconds. If the second retry fails, the endpoint will not be called again for 30 minutes for any action group.
138
135
139
136
## Action or notification happened more than once
140
137
141
-
If you have received a notification for an alert (such as an email or an SMS) more than once, or the alert’s action (such as webhook or Azure function) was triggered multiple times, follow these steps:
138
+
If you have received a notification for an alert (such as an email or an SMS) more than once, or the alert's action (such as webhook or Azure function) was triggered multiple times, follow these steps:
142
139
143
140
1.**Is it really the same alert?**
144
141
145
-
In some cases, multiple similar alerts are fired at around the same time. So, it might just seem like the same alert triggered its actions multiple times. For example, an activity log alert rule might be configured to fire both when an event has started, and when it has finished (succeeded or failed), by not filtering on the event status field.
142
+
In some cases, multiple similar alerts are fired at around the same time. So, it might just seem like the same alert triggered its actions multiple times. For example, an activity log alert rule might be configured to fire both when an event has started, and when it has finished (succeeded or failed), by not filtering on the event status field.
146
143
147
144
To check if these actions or notifications came from different alerts, examine the alert details, such as its timestamp and either the alert id or its correlation id. Alternatively, check the list of fired alerts in the portal. If that is the case, you would need to adapt the alert rule logic or otherwise configure the alert source.
148
145
149
146
1.**Does the action repeat in multiple action groups?**
150
147
151
-
When an alert is fired, each of its action groups is processed independently. So, if an action (such as an email address) appears in multiple triggered action groups, it would be called once per action group.
148
+
When an alert is fired, each of its action groups is processed independently. So, if an action (such as an email address) appears in multiple triggered action groups, it would be called once per action group.
152
149
153
150
To check which action groups were triggered, check the alert history tab. You would see there both action groups defined in the alert rule, and action groups added to the alert by action rules:
154
151
@@ -160,7 +157,7 @@ If you have received the alert, but believe some of its fields are missing or in
160
157
161
158
1.**Did you pick the correct format for the action?**
162
159
163
-
Each action type (email, webhook, etc.) has two formats – the default, legacy format, and the [newer common schema format](alerts-common-schema.md). When you create an action group, you specify the format you want per action – different actions in the action groups may have different formats.
160
+
Each action type (email, webhook, etc.) has two formats – the default, legacy format, and the [newer common schema format](alerts-common-schema.md). When you create an action group, you specify the format you want per action – different actions in the action groups may have different formats.
164
161
165
162
For example, for webhook action:
166
163
@@ -173,7 +170,7 @@ Each action type (email, webhook, etc.) has two formats – the default, legacy
173
170
174
171
1.**Activity log alerts: Is the information available in the activity log?**
175
172
176
-
[Activity log alerts](activity-log-alerts.md) are alerts that are based on events written to the Azure Activity Log, such as events about creating, updating or deleting Azure resources, service health and resource health events, or findings from Azure Advisor and Azure Policy. If you have received an alert based on the activity log but some fields that you need are missing or incorrect, first check the events in the activity log itself. If the Azure resource did not write the fields you are looking for in its activity log event, those fields will not be included in the corresponding alert.
173
+
[Activity log alerts](activity-log-alerts.md) are alerts that are based on events written to the Azure Activity Log, such as events about creating, updating or deleting Azure resources, service health and resource health events, or findings from Azure Advisor and Azure Policy. If you have received an alert based on the activity log but some fields that you need are missing or incorrect, first check the events in the activity log itself. If the Azure resource did not write the fields you are looking for in its activity log event, those fields will not be included in the corresponding alert.
177
174
178
175
## Action rule is not working as expected
179
176
@@ -187,7 +184,7 @@ If you can see a fired alert in the portal, but a related action rule did not wo
187
184
188
185
1.**Is it a service health alert?**
189
186
190
-
Service health alerts (monitor service = “Service Health”) are not affected by action rules.
187
+
Service health alerts (monitor service = "Service Health") are not affected by action rules.
191
188
192
189
1.**Did the action rule act on your alert?**
193
190
@@ -204,20 +201,20 @@ If you can see a fired alert in the portal, but a related action rule did not wo
204
201
205
202
1.**Does the action rule scope and filter match the fired alert?**
206
203
207
-
If you think the action rule should have fired but didn’t, or that it shouldn’t have fired but it did, carefully examine the action rule scope and filter conditions versus the properties of the fired alert.
204
+
If you think the action rule should have fired but didn't, or that it shouldn't have fired but it did, carefully examine the action rule scope and filter conditions versus the properties of the fired alert.
208
205
209
206
210
207
## How to find the alert id of a fired alert
211
208
212
209
When opening a case about a specific fired alert (such as – if you did not receive its email notification), you will need to provide the alert id.
213
210
214
-
To locate it, follow these steps:
211
+
To locate it, follow these steps:
215
212
216
213
1. In the Azure portal, navigate to the list of fired alerts, and find that specific alert. You can use the filters to help you locate it.
217
214
218
215
1. Click on the alert to open the alert details.
219
216
220
-
1. Scroll down in the alert fields of the first tab (the summary tab) until you locate it, and copy it. That field also includes a “Copy to clipboard” helper button you can use.
217
+
1. Scroll down in the alert fields of the first tab (the summary tab) until you locate it, and copy it. That field also includes a "Copy to clipboard" helper button you can use.
0 commit comments