Forum Discussion
ScottAllison
Mar 21, 2022Iron Contributor
Automatically resolve Heartbeat alerts
Greetings,
I'm trying to use the newer feature "Automatically resolve alerts" with a Heartbeat alert, but I am having no luck no matter how I configure the alert.
My query:
Heartbeat
| where TimeGenerated >= ago(24h)
| summarize LastHeartbeat=max(TimeGenerated) by Computer, _ResourceId
| where LastHeartbeat < ago(15m)
Signal logic:
...and under Alert rule details, I have "Automatically resolve alerts" selected.
My alerts trigger just fine (I've never had a problem with that), but when I bring a VM back online, the alert does not switch to a "Resolved" condition. All the alerts remain in a "Fired" condition.
Am I missing something or does this feature even work?
Thanks in advance!
- twellinghurstCopper ContributorHave you found a solution for resolving the alerts? We are experiencing the same issue.
- SHL1209Copper ContributorI'm having the same issue too. I have noticed that if alert is setup with dimension, it will not get resolved automatically. Try removing those dimensions in your rule and check if it works for you.
Understand you may want alert to be fired based on dimension but at least we can narrow the scope of the issue. - MishagenCopper ContributorI would suggest to follow the steps described in the following article. https://contoso.se/blog/?p=4532
Hope this helps. 🙂- ScottAllisonIron ContributorThanks. We already have a working alert. However, there is a newer option to automatically resolve the alert. This is the feature that is not working.
- MishagenCopper ContributorHello Scott Allison I tested your query and I got the same behavior. The alerts are triggered but they are unable to auto resolve, even if the condition met. I would suggest to open a support ticket for further investigation