Automatically resolve Heartbeat alerts

[Scott Allison]

Greetings,

I'm trying to use the newer feature "Automatically resolve alerts" with a Heartbeat alert, but I am having no luck no matter how I configure the alert. 

My query:

Heartbeat
| where TimeGenerated >= ago(24h)
| summarize LastHeartbeat=max(TimeGenerated) by Computer, _ResourceId
| where LastHeartbeat < ago(15m)

Signal logic:

...and under Alert rule details, I have "Automatically resolve alerts" selected. 


My alerts trigger just fine (I've never had a problem with that), but when I bring a VM back online, the alert does not switch to a "Resolved" condition. All the alerts remain in a "Fired" condition. 

Am I missing something or does this feature even work?

Thanks in advance!

[#2]

I would suggest to follow the steps described in the following article. https://contoso.se/blog/?p=4532

Hope this helps. :)

[#3]

Thanks. We already have a working alert. However, there is a newer option to automatically resolve the alert. This is the feature that is not working.

[#4]

@Scott Allison Interesting. Have you checked if there is something "strange" in Avanced Options in the logic condition?

[#5]

Hello @Scott Allison I tested your query and I got the same behavior. The alerts are triggered but they are unable to auto resolve, even if the condition met. I would suggest to open a support ticket for further investigation

[#6]

I'm having the same issue too. I have noticed that if alert is setup with dimension, it will not get resolved automatically. Try removing those dimensions in your rule and check if it works for you.
Understand you may want alert to be fired based on dimension but at least we can narrow the scope of the issue.

[#7]

Have you found a solution for resolving the alerts? We are experiencing the same issue.