Feb 06 2018
- last edited on
Apr 07 2022
I code up a search in Log Analytics and then from that fashion an alert, from which I want to trigger a runbook that may run on Azure or a Hybrid Worker. I save that alert and then want to change something in the alert such as the runbook selected or the Run On destination or the hybrid worker. However, when I go back in to the Edit page I find the runbook fields are grayed out. The workaround as advised by MS Support was to turn off the runbook entirely, save the alert and then go back in to check the fields I initially wanted. Of course that is rather long winded. Can you please expose the runbook fields "Select a runbook", "Run on" and "Select a hybrid worker" within the Edit page. This needs to show the current state of the alert and make it clear where the alert is going to run from.
Feb 18 2018 09:19 AM
I'm not an expert on alerts but what you ask for makes sense to me. I've forwarded this request to some of our alerts experts and will post a reply as soon as we have it.
You are also welcome to post the request on the user voice where other users can vote it up.
Feb 19 2018 04:48 AM
Vijay from the Azure Alerts team here.
I am not quite able to gather what is going wrong, on OMS portal.
Can you try again, in Azure instead?
Using Azure Alerts (Preview) where you can create and manage all your alerts including log alerts for log-analytics. More details here: https://azure.microsoft.com/en-us/blog/new-alerts-preview-in-azure-monitor/
You can also import saved search queries into Azure Alerts (Preview); steps of creating alerts available on docs: https://docs.microsoft.com/en-us/azure/monitoring-and-diagnostics/monitor-alerts-unified-usage
And you can in Alerts (Preview) configure appropriate Azure ActionGroup which supports multiple services including SMS, E-Mail, ITSM and also Runbooks as illustrated below:
Feb 20 2018 05:53 AM
I was contacted by MS about this after posting. For the meantime the resolution to this issue is to deselect the runbook in the portal, then select it again and make any modifications. It's a little clunky but as a workaround this is OK. Below is what the engineer advised and I assume that this will be improved as time goes on. Thanks for the response - much appreciated.
After you have saved your alert with the runbook selections made, go to the edit button to edit the alert.
This does add in an extra step to the process of saving and editing.
Feb 20 2018 06:05 AM
Interestingly there is no Alerts Preview in the Portal I am using. Perhaps I should have mentioned that I am using the Azure Gov portal as opposed to the Public portal.
Feb 20 2018 06:56 AM