Nordlicht Reisen GmbH, a fictional travel agency, runs its booking portal. Nobody should have to stare at a chart at night. When something looks off, Azure should notify the person responsible, and during planned maintenance it should stay quiet. The exam calls this: configure alert rules, action groups, and alert processing rules.
Prior knowledge: Metrics, diagnostic settings, and logs in Log Analytics are explained in lessons 5.1 and 5.2 of this course. Observing from the application's point of view is covered in K3, module 3.4. This lesson is about what turns data into a notification.
Alert rule, alert, action group
Four things are separate, and the exam asks about their roles:
| Building block | Job |
|---|---|
| Alert rule | watches the data of a resource and checks a condition: monitored resources, signal, condition |
| Alert | is created when the condition is met; it starts the assigned action groups and gets a state |
| Action group | a collection of notifications and actions that an alert triggers |
| Alert processing rule | changes fired alerts on the fly: adds action groups or suppresses them |
If a rule is created for several resources, Azure checks the condition for each resource separately and fires its own alert for each one. Alerts are kept for 30 days and then deleted. Fired alerts are read-only; changes to a rule apply only to future alerts.
States
Two pieces of information are independent of each other:
- Alert condition: set by the system. Fired as long as the cause exists, Resolved once it is gone.
- User response: set by you and stays until you change it: New, Acknowledged, or Closed.
Then there is the difference between stateless and stateful alerts. Stateless alerts fire every time the condition is met; all activity log alerts are stateless. Stateful alerts fire once and fire again only if the condition was resolved in between. For metric alerts, an alert counts as resolved when the condition is not met in three consecutive checks.
The severity ranges from 0 to 4; Microsoft gives 0, 1, 2, 3, and 4 as the allowed values, and the rule sets it.