I created a rule called Test Rule Notepad.
The rule is simple.
Its based on a custom log search and it looks if notepad is running on a VM.
This is the rule:
-------------------------------------- Rule --------------------------------------------------------------
Perf
|where Computer == "ServerName"
|where (CounterName == "Process ID") or (CounterName == "ID Process")
|project TimeGenerated, Computer, ObjectName, CounterName , CounterValue,InstanceName
|summarize count() by bin(TimeGenerated, 1m), Computer, CounterName, CounterValue , InstanceName
|summarize AggregatedValue=avg(InstanceName=="notepad") by bin(TimeGenerated, 1m), Computer,Running= InstanceName=="notepad"
|extend Running = iff((Running=="true"), "1", "0")
|render timechart
-------------------------------------- Rule --------------------------------------------------------------
I have tried multiple flavors of this rule, but feel free to suggest.
the configuration of the rule is this:
And the end result is something like this:
The behavior that I get is that the rule is triggered, multiple times, instead of the rule being triggered 1 time, or at least "aggregate" the alerts.
I just want to "use" the custom log search "like the metric". One alert one entrance.
This creates a major issue, when you are trying to manage multiple client subscriptions, and honestly kind of shoots in the foot, the tool itself.
How can a custom log search be used in the same way as metric alerts,
and trigger only 1 alert.
I don't want to use suppression on alerts, because it still creates an entrance on the alert tool for every time it verifies the alert, creating like 1000 alerts for just one situation.
This only happens with Custom log Searches, either been a "metric" (using the aggregated value, like the rule above) or a count.
PLEASE HELP ME!!
I have already looked into a lot of post's here and in some of the they talk of a bug, and fix in azure monitor, however, i still see this happening today.
