Edit RunBook fields for existing Azure RunBooks and Run on Hybrid Workers

[Joe Sheehan]

All,

I code up a search in Log Analytics and then from that fashion an alert, from which I want to trigger a runbook that may run on Azure or a Hybrid Worker. I save that alert and then want to change something in the alert such as the runbook selected or the Run On destination or the hybrid worker. However, when I go back in to the Edit page I find the runbook fields are grayed out. The workaround as advised by MS Support was to turn off the runbook entirely, save the alert and then go back in to check the fields I initially wanted. Of course that is rather long winded. Can you please expose the runbook fields "Select a runbook", "Run on" and "Select a hybrid worker" within the Edit page. This needs to show the current state of the alert and make it clear where the alert is going to run from.

regards,

Joe

[#2]

Hi Joe,

I'm not an expert on alerts but what you ask for makes sense to me. I've forwarded this request to some of our alerts experts and will post a reply as soon as we have it.

You are also welcome to post the request on the user voice where other users can vote it up.

[#3]

Hi Joe,

Vijay from the Azure Alerts team here.

I am not quite able to gather what is going wrong, on OMS portal.

Can you try again, in Azure instead?

Using Azure Alerts (Preview) where you can create and manage all your alerts including log alerts for log-analytics. More details here: https://azure.microsoft.com/en-us/blog/new-alerts-preview-in-azure-monitor/

You can also import saved search queries into Azure Alerts (Preview); steps of creating alerts available on docs: https://docs.microsoft.com/en-us/azure/monitoring-and-diagnostics/monitor-alerts-unified-usage

And you can in Alerts (Preview) configure appropriate Azure ActionGroup which supports multiple services including SMS, E-Mail, ITSM and also Runbooks as illustrated below:

[#4]

Hi Noa,

I was contacted by MS about this after posting. For the meantime the resolution to this issue is to deselect the runbook in the portal, then select it again and make any modifications. It's a little clunky but as a workaround this is OK.  Below is what the engineer advised and I assume that this will be improved as time goes on. Thanks for the response - much appreciated.

Joe

After you have saved your alert with the runbook selections made, go to the edit button to edit the alert.

1. You will see that it is grayed out and cant make any changes like you have experienced.   Turn off the runbook then save it
2. Once it is saved, edit the alert again a 2^nd time, select to “Yes” use a runbook, and now you can add back whatever you need and then save again.  You see below I can now make those changes as needed and save again.

This does add in an extra step to the process of saving and editing.  

[#5]

Hi Vijay,

Interestingly there is no Alerts Preview in the Portal I am using. Perhaps I should have mentioned that I am using the Azure Gov portal as opposed to the Public portal. 

[#6]

Hi Joe,
Alert (Preview) is currently available only on the public cloud; not on Govt clouds.
The editability issue stated with runbook is most probably resolved in Azure Alerts & Action Groups. I'll take it as an item for the team to explore a solution in OMS portal as well.

Thanks,
Vijay