azureazure-alerts

Azure Alert remains active all the time


I am working with Azure Synapse and have a SynapseIntegrationPipelineRuns Table in Log Analytics Workspace which contains the pipeline runs. Whenever a Pipeline run fails, I want to get an alert.

My query looks like the following:

SynapseIntegrationPipelineRuns
| where Status !=  "Succeeded" and Status != "Queued"  and Status != "InProgress" 

I use that query for creating an alert with the following setup. Now, as soon as one Pipeline fails, I receive an E-Mail but then I always have at least one row and so the alert seems to be active all the time and so it is not re-fired. What is the easiest solution to handle such an situation?

enter image description here


Solution

  • To create an alert when a Synapse pipeline run fails and ensure that the alert is not continuously active when there's at least one successful run, you can make use of the following KQL query and set up an alert based on a specific condition.

    KQL Query:

    SynapseIntegrationPipelineRuns
    | where Status == "Failed" and TimeGenerated > ago(1h)
    

    The ago(1h) function ensures that the query only considers pipeline runs in the past hour, preventing the alert from firing continuously if there are older failed runs.

    The condition below will check and trigger an alert if there are exactly 5 failed pipeline runs within the 1-hour evaluation window. You can set the alert logic according to your requirements.

    enter image description here

    By follow above configuration, the alert will trigger when a pipeline run fails, and it will reset when there are no failed runs, preventing constant notifications.