Forum Discussion
Alert "Monitor Condition" never changes
We're starting our journey from SCOM to Azure Monitor and have run into an issue with Azure Alerts (sorry for posting this in Azure Log Analytics, but there is no Azure Monitor Tech Community).
I've noticed that when an Azure Alert is generated, that the Monitor Condition never changes from "Fired" to "Resolved". According to the https://docs.microsoft.com/en-us/azure/monitoring-and-diagnostics/monitoring-overview-unified-alerts#alert-rules, the Monitor Condition, "Indicates whether the condition that created a metric alert has been resolved. Metric alert rules sample a particular metric at regular intervals. If the criteria in the alert rule is met, then a new alert is created with a condition of "fired." When the metric is sampled again, if the criteria is still met, then nothing happens. If the criteria is not met, then the condition of the alert is changed to "resolved." The next time that the criteria is met, another alert is created with a condition of "fired.""
Despite the condition no longer being met (for instance, a service down), the Monitor Condition never changes. Am I missing something?
25 Replies
ScottAllison did you find an answer on how to change the monitor condition?
Thanks in advance,
Anders
- Noa Kuperberg
Microsoft
I've reached out to the alerts PM (Yaniv.Lavi@microsoft.com), awaiting his update on this.
Hi Noa.
I posted a similar question on Stackoverflow and with a little help I found the reason of my issue. I changed the aggregation count from "Count" to "Total" and that resolved the alert.
https://stackoverflow.com/questions/59009802/azure-alert-only-fired-once/59014950#59014950
- Noa Kuperberg
Hi there
I was out of the office for the last 6 months, and don't know what the status is yet. While I'm trying to get an answer, you are also welcome to contact the product manager of this here: Yaniv.Lavi@microsoft.com
Thanks for bringing this up again
Noa Kuperberg Welcome back! 🙂
- Noa Kuperberg
Thanks! so far the answer I have is that the alerts ownership is in transition, and we should ping again in a few weeks.
Did anything ever come of this? I'm seeing this behavior right now with V2 (non-classic) log-search-based alerts. I can't access the yammer thread, any info would be appreciated.
Steven Whitney Saw that they're planning to address this in a preview feature sometime this year (as of June).
This is driving me crazy. I am doing everything to get a list of Acknowledged alerts so our jr staff can have insight.
Did see this in Yammer: https://www.yammer.com/azureadvisors/#/Threads/show?threadId=1090097679
- Noa Kuperberg
I read Vijay's response about query based alerts, and I don't understand the logic. Added another question to him on that Yammer thread.
Thanks for bringing that up.
