Forum Discussion

akshay25june's avatar
akshay25june
Copper Contributor
Sep 02, 2024

Auto Disabled (Rule Name)

Hi Team,

 

One of scheduled rule is auto disabled 2 days ago (31-aug) and showing like  "The alert rule was disabled due to too many consecutive failures. Reason: The query was blocked as it was consuming too many resources."

When I tried to re-enabled and it showing:

"Failed to save analytics rule 'rule name'. Conflict:Newer instance of rule 'ID' exists for workspace 'workspace id' (Etag does not match). Data was not saved."

I made some changes in KQL but still showing same message.

Can someone help me to find out solution  ?

 

"

Alerts
KQL
  • G_Wilson3468's avatar
    G_Wilson3468
    Iron Contributor
    Nov 25, 2024

    I would try deleting the old one and then create a new analytic with the adjusted logic. Let me know if that helps. 

    G.

  • jdom's avatar
    jdom
    Copper Contributor
    Nov 26, 2024

    akshay25june- Sometimes the GUI can cause issues like this when a rule cannot be overwritten, I recommend 

    Export the rule via the gui to save it, remove using powershell and re-import.


    Searching for the rule, capture the rule ID and then utilise Remove-AzSentinelAlertRule.

    Get-AzSentinelAlertRule -ResourceGroupName <RG-Name> -WorkspaceName <LogAnalytics-Name> `
     | where Name -eq "<Rule-ID>"

     

    And the equivalent removal PS: Remove-AzSentinelAlertRule (Az.SecurityInsights) | Microsoft Learn

Resources