azureazure-monitoringazure-alerts

Create a log alert from Azure CLI


I need to create an alert from Azure CLI (no access to portal), using a "custom log search" signal on containerLogV2 to see if there are any exceptions in any of my containers. I have an action group which I need to use for sending emails and sms. I have the below command and am quite sure that I am not setting the condition right. Please advise what the right approach would be. I couldn't find any example for this case on MSDN docs. Thanks.

az monitor metrics alert create \
--condition  "ContainerLogV2 | where LogMessage has "Exception" | where ContainerName !has "sms-management" | where TimeGenerated > ago(1h)" \
--name "Dev AKS Errors Alert" \
--resource-group "my-rg" \
--scopes "/subscriptions/my-sub/resourcegroups/my-rg/" \
--evaluation-frequency "60m" \
--severity 1 \
--region "west europe" \
--action "/subscriptions/my-sub/resourcegroups/my-rg/providers/microsoft.insights/actiongroups/my-ag" 

I probably need to figure out what details I need to send in the email and the sms from my alert next. Any help on that would be appreciated as well. Thank you.

[Update] Based on the advice from @Jahnavi I tried the below command

az monitor scheduled-query create \
--resource-group "my-rg" \
--name "AKS Errors Alert" \
--scopes "/subscriptions/supscription-id/resourcegroups/my-rg/providers/Microsoft.ContainerService/managedClusters/aks-dev" \
--condition "count 'AppExceptions' > 1 resource id _ResourceId at least 1 violations out of 5 aggregated points" \
--condition-query AppExceptions="ContainerLogV2 | where LogMessage has \"Exception\" | where TimeGenerated > ago(1h)" \
--description "Notify team on exceptions in AKS" \
--location "westeurope" \
--evaluation-frequency "5m" \
--severity 1 \
--action-groups "/subscriptions/supscription-id/resourceGroups/my-rg/providers/microsoft.insights/actionGroups/my-ag"

I was able to create a new alert rule with the above command.


Solution

  • az monitor metrics alert create is mostly used to create the inbuilt metrics, not conditional queries or custom log search queries.

    You need to execute the az monitor scheduled-query create command to create an alert using a "custom log search" signal on any application using Az CLI.

    I've modified your script as below:

    rg="ResourceGroup"
    workspace="ws"
    
    query='ContainerLogV2 
    | where ContainerName !has \"sms-management\" 
    | where LogMessage has \"Exception\" 
    | where TimeGenerated > ago(1h)'
    
    WID=$(az monitor log-analytics workspace show --resource-group $rg --workspace-name $workspace --query id --out tsv)
    
    az monitor scheduled-query create \
        --name "TestQuery" \
        --resource-group $rg \
        --scopes $workspace \
        --description "Test" \
        --action $ActionID \
        --evaluation-frequency 5m \
        --severity 1 \
        --condition "" \ #Provide the required condition
        --condition-query $query
    

    As per the MSDoc, I've taken the sample conditional query and it worked as below:

    Output:

    enter image description here