Create tasks that respond to event notifications
In this tutorial we will learn how to create tasks that respond to event notifications.
However, Alerts in Azure Monitor can identify important information in your Log Analytics repository. They are created by alert rules that automatically run log searches at regular intervals. And if results of the log search match particular criteria, then an alert record is created and it can be configured to perform an automated response.
Create alerts
Alerts are created by alert rules in Azure Monitor and can automatically run saved queries or custom log searches at regular intervals. Moreover, you can create alerts based on specific performance metrics, absence of an event, or a number of events are created within a particular time window.
However, in the following example, you create a metric measurement alert rule based off of the Azure VMs – Processor Utilization query saved in the Visualize data tutorial.
- Firstly, in the Azure portal, click All services. In the list of resources, type Log Analytics. As you begin typing, the list filters based on your input. Select Log Analytics.
- Secondly, in the left-hand pane, select Alerts and then click New Alert Rule from the top of the page to create a new alert.
- Thirdly, under the Create Alert section, you are going to select your Log Analytics workspace as the resource, since this is a log based alert signal. Filter the results by choosing the specific Subscription from the drop-down list if you have more than one, which contains the VM and Log Analytics workspace created earlier. Then, filter the Resource Type by selecting Log Analytics from the drop-down list. Finally, select the Resource DefaultLAWorkspace and then click Done.
- After that, under the section Alert Criteria, click Add Criteria to select our saved query and then specify logic that the alert rule follows. From the Configure signal logic pane, select Azure VMs – Processor Utilization from the list. The pane updates to present the configuration settings for the alert. On the top, it shows the results for the last 30 minutes of the selected signal and the search query itself.
Next, Configure the alert with the following information:
a. From the Based on drop-down list, select Metric measurement. A metric measurement will create an alert for each object in the query with a value that exceeds our specified threshold.
b. Then, for the Condition, select Greater than and enter 90 for Threshold.
c. Under Trigger Alert Based On section, select Consecutive breaches and from the drop-down list select Greater than enter a value of 3.
Lastly, u. Under Evaluation based on section, modify the Period value to 30 minutes. The rule will run every five minutes and return records that were created within the last thirty minutes from the current time.
- After that, click Done to complete the alert rule.
- Now moving onto the second step, provide a name of your alert in the Alert rule name field, such as Percentage CPU greater than 90 percent. Here, specify a Description detailing specifics for the alert. And then, select Critical(Sev 0) for the Severity value from the options provided.
- Now, for the third and final step, you specify an Action Group. This will ensure that the same actions are taken each time an alert get trigger and can be used for each rule you define.
Configure a new action group with the following information:
a. Select New action group and the Add action group pane appears.
b. For Action group name, specify a name such as IT Operations – Notify and a Short name such as itops-n.
c. Verify the default values for Subscription and Resource group are correct. If not, select the correct one from the drop-down list.
d. Under the Actions section, specify a name for the action. This can be Send Email and under Action Type select Email/SMS/Push/Voice from the drop-down list.
e. On the Email/SMS/Push/Voice pane, enable Email and provide a valid email SMTP address to deliver the message to.
f. Click OK to save your changes.
- After that, click OK to complete the action group.
- Lastly, click Create alert rule to complete the alert rule. It starts running immediately.
Reference: Microsoft Documentation