Mar 21 2022
05:14 AM
- last edited on
Apr 08 2022
11:02 AM
by
TechCommunityAP
Mar 21 2022
05:14 AM
- last edited on
Apr 08 2022
11:02 AM
by
TechCommunityAP
Greetings,
I'm trying to use the newer feature "Automatically resolve alerts" with a Heartbeat alert, but I am having no luck no matter how I configure the alert.
My query:
Heartbeat
| where TimeGenerated >= ago(24h)
| summarize LastHeartbeat=max(TimeGenerated) by Computer, _ResourceId
| where LastHeartbeat < ago(15m)
Signal logic:
...and under Alert rule details, I have "Automatically resolve alerts" selected.
My alerts trigger just fine (I've never had a problem with that), but when I bring a VM back online, the alert does not switch to a "Resolved" condition. All the alerts remain in a "Fired" condition.
Am I missing something or does this feature even work?
Thanks in advance!
Mar 27 2022 02:20 PM
Mar 28 2022 05:04 AM
Mar 29 2022 02:34 PM
@Scott Allison Interesting. Have you checked if there is something "strange" in Avanced Options in the logic condition?
Mar 30 2022 11:53 AM
Apr 10 2022 06:16 PM
Aug 16 2022 11:06 AM