Forum Discussion

ScottAllison's avatar
ScottAllison
Iron Contributor
Mar 21, 2022

Automatically resolve Heartbeat alerts

Greetings,

 

I'm trying to use the newer feature "Automatically resolve alerts" with a Heartbeat alert, but I am having no luck no matter how I configure the alert. 

 

My query:

Heartbeat
| where TimeGenerated >= ago(24h)
| summarize LastHeartbeat=max(TimeGenerated) by Computer, _ResourceId
| where LastHeartbeat < ago(15m)

 

Signal logic:

...and under Alert rule details, I have "Automatically resolve alerts" selected. 


My alerts trigger just fine (I've never had a problem with that), but when I bring a VM back online, the alert does not switch to a "Resolved" condition. All the alerts remain in a "Fired" condition. 

 

Am I missing something or does this feature even work?

 

Thanks in advance!

  • twellinghurst's avatar
    twellinghurst
    Copper Contributor
    Have you found a solution for resolving the alerts? We are experiencing the same issue.
  • SHL1209's avatar
    SHL1209
    Copper Contributor
    I'm having the same issue too. I have noticed that if alert is setup with dimension, it will not get resolved automatically. Try removing those dimensions in your rule and check if it works for you.
    Understand you may want alert to be fired based on dimension but at least we can narrow the scope of the issue.
    • ScottAllison's avatar
      ScottAllison
      Iron Contributor
      Thanks. We already have a working alert. However, there is a newer option to automatically resolve the alert. This is the feature that is not working.
      • Mishagen's avatar
        Mishagen
        Copper Contributor
        Hello Scott Allison I tested your query and I got the same behavior. The alerts are triggered but they are unable to auto resolve, even if the condition met. I would suggest to open a support ticket for further investigation

Resources