Metric alert not triggering through arm template unless i deploy an equal metric alert through portal

Question

Metric alert not triggering through arm template unless i deploy an equal metric alert through portal

Hugo Souza Almeida 45

I have a metric alert arm template deploying multiple metric alerts to various virtual machines through dimensions on prod. The filters show that the alerts should have triggered, but the alerts do not trigger unless I deploy a mimick metric alert on sandbox, then it triggers the prod metric alert.

The metric alerts through arm templates do not deploy a log search alert rule, only a metric alert, and the sandbox one does. Maybe its related?

Ex:

Prod

User's image

Sandbox

User's image

Prod:

User's image

Sandbox:

User's image

Deleted

This comment has been deleted due to a violation of our Code of Conduct. The comment was manually reported or identified through automated detection before action was taken. Please refer to our Code of Conduct for more information.

Accepted answer

0 additional answers

Your answer

Deleted

This comment has been deleted due to a violation of our Code of Conduct. The comment was manually reported or identified through automated detection before action was taken. Please refer to our Code of Conduct for more information.

Answer 1

Stanislav Zhelyazkov 26,706 MVP

Hi,

In order to help can you provide the full ARM template that you use to deploy the metric alert and also the JSON from the metrics alert you have deployed in sandbox? As far as I understood the alert for sandbox you create via Azure Portal where the alert for production you create via ARM template, correct? I am not sure why you have mentioned log alert. There is a screenshot of some log alert but there is no information how it is created and configured. From the screenshots the full information is not clear as parts of the alerts configurations are cut off. Take also into consideration that alert fires if the configured threshold is hit. As it is metric alert you may even be targeting different resources that may result in one hitting the threshold where another it does not which causes one to fire alert and the other to not.

Update: customer is using old concept for alerts Create a metric alert in Azure Monitor Logs. Recommendation is not to use those type of alerts as those are old concept from early days of Log Analytics alerts when they did not support stateful alerts and 1 minute frequency. I have suggested to use metric alerts or Log alerts to avoid future problems.

Please "Accept the answer" if the information helped you. This will help us and others in the community as well.

Hugo Souza Almeida 45

Hi, I realized what is going on. I'm retrieving information from a log analytics workspace, and when I deploy from portal it deploys a scheduled query rule linked to the metric alert / law.

I tried mirroring this template

{
    "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
    "contentVersion": "1.0.0.0",
    "parameters": {
        "scheduledqueryrules_testugoprivate_name": {
            "defaultValue": "testugoprivate",
            "type": "String"
        },
        "workspaces_rm_mc_dgtavd_pd_01_euw_law_01_externalid": {
            "defaultValue": "/subscriptions/<subscription id>/resourceGroups/<resoruce group name>/providers/Microsoft.OperationalInsights/workspaces/<resource name>",
            "type": "String"
        }
    },
    "variables": {},
    "resources": [
        {
            "type": "microsoft.insights/scheduledqueryrules",
            "apiVersion": "2024-01-01-preview",
            "name": "[parameters('scheduledqueryrules_testugoprivate_name')]",
            "location": "westeurope",
            "tags": {
                "hidden-link:/subscriptions/<subscription id>/resourceGroups/<resoruce group name>/providers/Microsoft.OperationalInsights/workspaces/<resource name>": "Resource"
            },
            "kind": "LogToMetric",
            "properties": {
                "enabled": true,
                "scopes": [
                    "[parameters('workspaces_rm_mc_dgtavd_pd_01_euw_law_01_externalid')]"
                ],
                "criteria": {
                    "allOf": [
                        {
                            "metricName": "Average_% Committed Bytes In Use",
                            "dimensions": [
                                {
                                    "name": "Computer",
                                    "operator": "Include",
                                    "values": [
                                        "*"
                                    ]
                                }
                            ]
                        }
                    ]
                }
            }
        }
    ]
}

but i end up running into this error

The request content was

| invalid and could not be deserialized: 'Query must be specified'

I deployed a scheduled query rule with these parameters:

"scheduledQueryParameters": {
            "value": [
                {
                    "name": "rm-mc-dgtavd-pd-01-euw-alr-mem-03",
                    "kind": "LogToMetric",
                    "scopes": [
                        "/subscriptions/<subscription id>/resourcegroups/<resoruce group name>/providers/microsoft.operationalinsights/workspaces/rm-mc-dgtavd-pd-01-euw-law-01"
                    ],
                    "tags": {
                        "hidden-link:/subscriptions/<subscription ID>/resourceGroups/<resoruce group name>/providers/Microsoft.OperationalInsights/workspaces/<resource name>": "Resource"
                    },
                    "criteria": [
                        {
                            "metricName": "Average_% Committed Bytes In Use",
                            "query": "Perf",
                            "timeAggregation": "Count",
                            "threshold": 0,
                            "operator": "GreaterThan",
                            "dimensions": [
                                {
                                    "name": "Computer",
                                    "operator": "Include",
                                    "values": [
                                        "*"
                                    ]
                                }
                            ]
                        }
                    ]
                }

to bypass deployment requirements but I don't get the same effect.

Hugo Souza Almeida 45 Reputation points

2025-03-07T17:20:51.1533333+00:00

i found this but using an older template i guessa

https://docs.azure.cn/en-us/azure-monitor/alerts/alerts-metric-logs
Stanislav Zhelyazkov 26,706 Reputation points MVP

2025-03-07T17:41:46.41+00:00

These are not metric alerts. They also not Log alerts exactly. They are something in between. I will not go into details explaining them as they were something that was used in time where certain Log Analytics features were lacking. I would not recommend to use those. Instead I would suggest to use either metric alerts. For metric alerts you need to target the VM resource or target subscription and location where your VMs are located if you want to create one alert rule that applies for all VMs in a subscription for specific region. Other option is to use Log alerts but you will need to make sure that you have data to query with that information. I see that may be you have Perf table in Log Analytics that may be has data from your VMs for different windows/linux performance counters. If so you can use Log alerts. You can use simple mode if you are not good with KQL to create query that targets a single performance counter. Once you have the query you can create alert rule for it. Here are also documents for creating alerts via ARM templates:

Resource Manager template samples for metric alert rules in Azure Monitor

Resource Manager template samples for log search alert rules in Azure Monitor

FYI: avoid putting sensitive information like subscription ids, resource groups and resource names in public. I have scrubbed that data from your reply.
Hugo Souza Almeida 45 Reputation points

2025-03-07T17:57:31.34+00:00

Is there a way to use them though? I would greatly appreciate information on it! I got a requirement to extract data from a log analytics workspace and use it in a metric alert for better visual control, I have other proper scheduledqueryrules haha Thank you for the scrubbing!
Stanislav Zhelyazkov 26,706 Reputation points MVP

2025-03-07T18:19:09.8866667+00:00

Can I ask what would be the point of using something that is legacy and widely adopted? It can only bring you technical debt.

You can find information on how these are created with arm template here: Create a metric alert in Azure Monitor Logs. Again I do not recommend using those type of alerts. 1 minute frequency and stateful state is supported for Log Alerts for quite some time. So Log alerts have all the features that were suppose to be benefit of those alerts which makes them useless. Also keep in mind that pricing is not clear if you will be charged twice as basically you are having two different alert resources.
Naveena Patlolla 975 Reputation points Microsoft External Staff

2025-03-11T06:51:31.6666667+00:00

Hi Hugo Souza Almeida

Just want to check if the above solution provided by Stanislav Zhelyazkov worked for you or else please let us know if any help, we are always here to help whenever you need us.

Please do not forget to "Accept the answer” and “upvote it” wherever the information provided helps you, this can be beneficial to other community members.it would be greatly appreciated and helpful to others.
Hugo Souza Almeida 45 Reputation points

2025-03-11T14:30:27.1433333+00:00

It helped me, thank you!

Share via

Metric alert not triggering through arm template unless i deploy an equal metric alert through portal

0 additional answers

Your answer