Monitor a Hybrid computer shutdown in Azure Arc

If your intention is to alert when an Arc-enabled machine stops reporting, I would base the rule on missing Azure Monitor Agent heartbeat data, rather than interpreting an empty query result as an error by itself.

First verify that the machine currently sends heartbeat records:

Heartbeat

| where Category == "Azure Monitor Agent"

| where Computer == "<computer-name>"

| order by TimeGenerated desc

| take 10

Microsoft recommends this exact type of heartbeat check when troubleshooting AMA on Arc-enabled servers.

For the alert you could use:

Heartbeat

| where TimeGenerated > ago(24h)

| where Category == "Azure Monitor Agent"

| where Computer == "<computer-name>"

| summarize LastHeartbeat=max(TimeGenerated)

| extend MinutesSinceLastHeartbeat =

datetime_diff("minute", now(), LastHeartbeat)

| where MinutesSinceLastHeartbeat > 10

Then configure the alert to trigger when number of results > 0.

Heartbeat records are normally generated regularly and Microsoft's sample queries also use the last received heartbeat to establish agent availability.

One important distinction: this detects loss of monitoring connectivity, which could mean shutdown, network failure or AMA failure. It doesn't by itself prove the operating system was intentionally shut down.

I’ve seen this happen with Azure Arc alerts. If the query isn’t returning any values, I’d first check whether the Arc machine is actually sending the expected heartbeat data to the Log Analytics workspace. Also make sure the alert query is looking at the correct table and that the time window matches your alert evaluation period. A missing heartbeat is usually easier to monitor than the machine’s actual shutdown state.

Azure Arc Heartbeat table only records entries when the Connected Machine Agent reports in. If the agent stops reporting, it generates no new rows, so it returns no results, which paradoxically means the alert never triggers correctly.

https://learn.microsoft.com/en-us/azure/azure-monitor/reference/tables/heartbeat

https://learn.microsoft.com/en-us/azure/azure-arc/site-manager/how-to-configure-monitor-site