|
| 1 | +--- |
| 2 | +title: Create Azure Advisor alerts for new recommendations | Microsoft Docs |
| 3 | +description: Create Azure Advisor alerts for new recommendation |
| 4 | +services: advisor |
| 5 | +author: sagupt |
| 6 | +ms.service: advisor |
| 7 | +ms.topic: article |
| 8 | +ms.tgt_pltfrm: NA |
| 9 | +ms.workload: NA |
| 10 | +ms.date: 09/09/2019 |
| 11 | +ms.author: sagupt |
| 12 | +--- |
| 13 | + |
| 14 | +# Create Azure Advisor alerts on new recommendations |
| 15 | + |
| 16 | +This article shows you how to set up an alert for new recommendations from Azure Advisor using the Azure portal and Azure Resource Manager templates. |
| 17 | + |
| 18 | +Whenever Azure Advisor detects a new recommendation for one of your resources, an event is stored in [Azure Activity log](https://docs.microsoft.com/azure/azure-monitor/platform/activity-logs-overview). You can set up alerts for these events from Azure Advisor using a recommendation-specific alerts creation experience. You can select a subscription and optionally a resource group to specify the resources that you want to receive alerts on. |
| 19 | + |
| 20 | +You can also determine the types of recommendations by using these properties: |
| 21 | + |
| 22 | +* Category |
| 23 | +* Impact level |
| 24 | +* Recommendation type |
| 25 | + |
| 26 | +You can also configure the action that will take place when an alert is triggered by: |
| 27 | + |
| 28 | +* Selecting an existing action group |
| 29 | +* Creating a new action group |
| 30 | + |
| 31 | +To learn more about action groups, see [Create and manage action groups](../azure-monitor/platform/action-groups.md. |
| 32 | + |
| 33 | +> [!NOTE] |
| 34 | +> Advisor alerts are currently only available for High Availability, Performance, and Cost recommendations. Security recommendations are not supported. |
| 35 | +
|
| 36 | +## In the Azure portal |
| 37 | +1. In the **portal**, select **Azure Advisor**. |
| 38 | + |
| 39 | +  |
| 40 | + |
| 41 | +2. In the **Monitoring** section of the left menu, select **Alerts**. |
| 42 | + |
| 43 | +  |
| 44 | + |
| 45 | +3. Select **New Advisor Alert**. |
| 46 | + |
| 47 | +  |
| 48 | + |
| 49 | +4. In the **Scope** section, select the subscription and optionally the resource group that you want to be alerted on. |
| 50 | + |
| 51 | +  |
| 52 | + |
| 53 | +5. In the **Condition** section, select the method you want to use for configuring your alert. If you want to alert for all recommendations for a certain category and/or impact level, select **Category and impact level**. If you want to alert for all recommendations of a certain type, select **Recommendation type**. |
| 54 | + |
| 55 | +  |
| 56 | + |
| 57 | +6. Depending on the Configure by option that you select, you will be able to specify the criteria. If you want all recommendations, just leave the remaining fields blank. |
| 58 | + |
| 59 | +  |
| 60 | + |
| 61 | +7. In the **action groups** section, select **Add existing** to use an action group you already created or select **Create new** to set up a new [action group](https://docs.microsoft.com/azure/azure-monitor/platform/action-groups). |
| 62 | + |
| 63 | +  |
| 64 | + |
| 65 | +8. In the Alert details section, give your alert a name and short description. If you want your alert to be enabled, leave **Enable rule upon creation** selection set to **Yes**. Then select the resource group to save your alert to. This will not impact the targeting scope of the recommendation. |
| 66 | + |
| 67 | +  |
| 68 | + |
| 69 | + |
| 70 | +## With an Azure Resource Manager template |
| 71 | + |
| 72 | +This Resource Manager template creates an recommendation alert and a new action group. |
| 73 | + |
| 74 | +```json |
| 75 | +{ |
| 76 | + "$schema": "https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#", |
| 77 | + "contentVersion": "1.0.0.0", |
| 78 | + "parameters": { |
| 79 | + "actionGroups_name": { |
| 80 | + "defaultValue": "advisorAlert", |
| 81 | + "type": "string" |
| 82 | + }, |
| 83 | + "activityLogAlerts_name": { |
| 84 | + "defaultValue": "AdvisorAlertsTest2", |
| 85 | + "type": "string" |
| 86 | + }, |
| 87 | + "emailAddress": { |
| 88 | + "defaultValue": "<email address>", |
| 89 | + "type": "string" |
| 90 | + } |
| 91 | + }, |
| 92 | + "variables": { |
| 93 | + "alertScope": "[concat('/','subscriptions','/',subscription().subscriptionId)]" |
| 94 | + }, |
| 95 | + "resources": [ |
| 96 | + { |
| 97 | + "comments": "Action Group", |
| 98 | + "type": "microsoft.insights/actionGroups", |
| 99 | + "name": "[parameters('actionGroups_name')]", |
| 100 | + "apiVersion": "2017-04-01", |
| 101 | + "location": "Global", |
| 102 | + "tags": {}, |
| 103 | + "scale": null, |
| 104 | + "properties": { |
| 105 | + "groupShortName": "[parameters('actionGroups_name')]", |
| 106 | + "enabled": true, |
| 107 | + "emailReceivers": [ |
| 108 | + { |
| 109 | + "name": "[parameters('actionGroups_name')]", |
| 110 | + "emailAddress": "[parameters('emailAddress')]" |
| 111 | + } |
| 112 | + ], |
| 113 | + "smsReceivers": [], |
| 114 | + "webhookReceivers": [] |
| 115 | + }, |
| 116 | + "dependsOn": [] |
| 117 | + }, |
| 118 | + { |
| 119 | + "comments": "Azure Advisor Activity Log Alert", |
| 120 | + "type": "microsoft.insights/activityLogAlerts", |
| 121 | + "name": "[parameters('activityLogAlerts_name')]", |
| 122 | + "apiVersion": "2017-04-01", |
| 123 | + "location": "Global", |
| 124 | + "tags": {}, |
| 125 | + "scale": null, |
| 126 | + "properties": { |
| 127 | + "scopes": [ |
| 128 | + "[variables('alertScope')]" |
| 129 | + ], |
| 130 | + "condition": { |
| 131 | + "allOf": [ |
| 132 | + { |
| 133 | + "field": "category", |
| 134 | + "equals": "Recommendation" |
| 135 | + }, |
| 136 | + { |
| 137 | + "field": "properties.recommendationCategory", |
| 138 | + "equals": "Cost" |
| 139 | + }, |
| 140 | + { |
| 141 | + "field": "properties.recommendationImpact", |
| 142 | + "equals": "Medium" |
| 143 | + }, |
| 144 | + { |
| 145 | + "field": "operationName", |
| 146 | + "equals": "Microsoft.Advisor/recommendations/available/action" |
| 147 | + } |
| 148 | + ] |
| 149 | + }, |
| 150 | + "actions": { |
| 151 | + "actionGroups": [ |
| 152 | + { |
| 153 | + "actionGroupId": "[resourceId('microsoft.insights/actionGroups', parameters('actionGroups_name'))]", |
| 154 | + "webhookProperties": {} |
| 155 | + } |
| 156 | + ] |
| 157 | + }, |
| 158 | + "enabled": true, |
| 159 | + "description": "" |
| 160 | + }, |
| 161 | + "dependsOn": [ |
| 162 | + "[resourceId('microsoft.insights/actionGroups', parameters('actionGroups_name'))]" |
| 163 | + ] |
| 164 | + } |
| 165 | + ] |
| 166 | +} |
| 167 | + ``` |
| 168 | + |
| 169 | +## Configure recommendation alerts to use a webhook |
| 170 | +This section shows you how to configure Azure Advisor alerts to send recommendation data through webhooks to your existing systems. |
| 171 | + |
| 172 | +You can set up alerts to be notified when you have a new Advisor recommendation on one of your resources. These alerts can notify you through email or text message, but they can also be used to integrate with your existing systems through a webhook. |
| 173 | + |
| 174 | + |
| 175 | +### Using the Advisor recommendation alert payload |
| 176 | +If you want to integrate Advisor alerts into your own systems using a webhook, you will need to parse the JSON payload that is sent from the notification. |
| 177 | + |
| 178 | +When you set up your action group for this alert, you select if you would like to use the common alert schema. If you select the common alert schema, your payload will look like: |
| 179 | + |
| 180 | +```json |
| 181 | +{ |
| 182 | + "schemaId":"azureMonitorCommonAlertSchema", |
| 183 | + "data":{ |
| 184 | + "essentials":{ |
| 185 | + "alertId":"/subscriptions/<subid>/providers/Microsoft.AlertsManagement/alerts/<alerted>", |
| 186 | + "alertRule":"Webhhook-test", |
| 187 | + "severity":"Sev4", |
| 188 | + "signalType":"Activity Log", |
| 189 | + "monitorCondition":"Fired", |
| 190 | + "monitoringService":"Activity Log - Recommendation", |
| 191 | + "alertTargetIDs":[ |
| 192 | + "/subscriptions/<subid>/resourcegroups/<resource group name>/providers/microsoft.dbformariadb/servers/<resource name>" |
| 193 | + ], |
| 194 | + "originAlertId":"001d8b40-5d41-4310-afd7-d65c9d4428ed", |
| 195 | + "firedDateTime":"2019-07-17T23:00:57.3858656Z", |
| 196 | + "description":"A new recommendation is available.", |
| 197 | + "essentialsVersion":"1.0", |
| 198 | + "alertContextVersion":"1.0" |
| 199 | + }, |
| 200 | + "alertContext":{ |
| 201 | + "channels":"Operation", |
| 202 | + "claims":"{\"http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddress\":\"Microsoft.Advisor\"}", |
| 203 | + "caller":"Microsoft.Advisor", |
| 204 | + "correlationId":"8554b847-2a72-48ef-9776-600aca3c3aab", |
| 205 | + "eventSource":"Recommendation", |
| 206 | + "eventTimestamp":"2019-07-17T22:28:54.1566942+00:00", |
| 207 | + "httpRequest":"{\"clientIpAddress\":\"0.0.0.0\"}", |
| 208 | + "eventDataId":"001d8b40-5d41-4310-afd7-d65c9d4428ed", |
| 209 | + "level":"Informational", |
| 210 | + "operationName":"Microsoft.Advisor/recommendations/available/action", |
| 211 | + "properties":{ |
| 212 | + "recommendationSchemaVersion":"1.0", |
| 213 | + "recommendationCategory":"Performance", |
| 214 | + "recommendationImpact":"Medium", |
| 215 | + "recommendationName":"Increase the MariaDB server vCores", |
| 216 | + "recommendationResourceLink":"https://portal.azure.com/#blade/Microsoft_Azure_Expert/RecommendationListBlade/source/ActivityLog/recommendationTypeId/a5f888e3-8cf4-4491-b2ba-b120e14eb7ce/resourceId/%2Fsubscriptions%<subscription id>%2FresourceGroups%2<resource group name>%2Fproviders%2FMicrosoft.DBforMariaDB%2Fservers%2F<resource name>", |
| 217 | + "recommendationType":"a5f888e3-8cf4-4491-b2ba-b120e14eb7ce" |
| 218 | + }, |
| 219 | + "status":"Active", |
| 220 | + "subStatus":"", |
| 221 | + "submissionTimestamp":"2019-07-17T22:28:54.1566942+00:00" |
| 222 | + } |
| 223 | + } |
| 224 | +} |
| 225 | + ``` |
| 226 | + |
| 227 | +If you do not use the common schema, your payload looks like the following: |
| 228 | + |
| 229 | +```json |
| 230 | +{ |
| 231 | + "schemaId":"Microsoft.Insights/activityLogs", |
| 232 | + "data":{ |
| 233 | + "status":"Activated", |
| 234 | + "context":{ |
| 235 | + "activityLog":{ |
| 236 | + "channels":"Operation", |
| 237 | + "claims":"{\"http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddress\":\"Microsoft.Advisor\"}", |
| 238 | + "caller":"Microsoft.Advisor", |
| 239 | + "correlationId":"3ea7320f-c002-4062-adb8-96d3bd92a5f4", |
| 240 | + "description":"A new recommendation is available.", |
| 241 | + "eventSource":"Recommendation", |
| 242 | + "eventTimestamp":"2019-07-17T20:36:39.3966926+00:00", |
| 243 | + "httpRequest":"{\"clientIpAddress\":\"0.0.0.0\"}", |
| 244 | + "eventDataId":"a12b8e59-0b1d-4003-bfdc-3d8152922e59", |
| 245 | + "level":"Informational", |
| 246 | + "operationName":"Microsoft.Advisor/recommendations/available/action", |
| 247 | + "properties":{ |
| 248 | + "recommendationSchemaVersion":"1.0", |
| 249 | + "recommendationCategory":"Performance", |
| 250 | + "recommendationImpact":"Medium", |
| 251 | + "recommendationName":"Increase the MariaDB server vCores", |
| 252 | + "recommendationResourceLink":"https://portal.azure.com/#blade/Microsoft_Azure_Expert/RecommendationListBlade/source/ActivityLog/recommendationTypeId/a5f888e3-8cf4-4491-b2ba-b120e14eb7ce/resourceId/%2Fsubscriptions%2F<subscription id>%2FresourceGroups%2F<resource group name>%2Fproviders%2FMicrosoft.DBforMariaDB%2Fservers%2F<resource name>", |
| 253 | + "recommendationType":"a5f888e3-8cf4-4491-b2ba-b120e14eb7ce" |
| 254 | + }, |
| 255 | + "resourceId":"/subscriptions/<subscription id>/resourcegroups/<resource group name>/providers/microsoft.dbformariadb/servers/<resource name>", |
| 256 | + "resourceGroupName":"<resource group name>", |
| 257 | + "resourceProviderName":"MICROSOFT.DBFORMARIADB", |
| 258 | + "status":"Active", |
| 259 | + "subStatus":"", |
| 260 | + "subscriptionId":"<subscription id>", |
| 261 | + "submissionTimestamp":"2019-07-17T20:36:39.3966926+00:00", |
| 262 | + "resourceType":"MICROSOFT.DBFORMARIADB/SERVERS" |
| 263 | + } |
| 264 | + }, |
| 265 | + "properties":{ |
| 266 | + |
| 267 | + } |
| 268 | + } |
| 269 | +} |
| 270 | +``` |
| 271 | + |
| 272 | +In either schema, you can identify Advisor recommendation events by looking for **eventSource** is `Recommendation` and **operationName** is `Microsoft.Advisor/recommendations/available/action`. |
| 273 | + |
| 274 | +Some of the other important fields that you may want to use are: |
| 275 | + |
| 276 | +* *alertTargetIDs* (in the common schema) or *resourceId* (legacy schema) |
| 277 | +* *recommendationType* |
| 278 | +* *recommendationName* |
| 279 | +* *recommendationCategory* |
| 280 | +* *recommendationImpact* |
| 281 | +* *recommendationResourceLink* |
| 282 | + |
| 283 | + |
| 284 | +## Manage your alerts |
| 285 | + |
| 286 | +From Azure Advisor, you can edit, delete, or disable and enable your recommendations alerts. |
| 287 | + |
| 288 | +1. In the **portal**, select **Azure Advisor**. |
| 289 | + |
| 290 | +  |
| 291 | + |
| 292 | +2. In the **Monitoring** section of the left menu, select **Alerts**. |
| 293 | + |
| 294 | +  |
| 295 | + |
| 296 | +3. To edit an alert, click on the Alert name to open the alert and edit the fields you want to edit. |
| 297 | + |
| 298 | +4. To delete, enable, or disable an alert, click on the ellipse at the end of the row and then select the action you would like to take. |
| 299 | + |
| 300 | + |
0 commit comments