[英]Azure Log Analytics Metric Measurement Alert
I have a log query like, 我有一个日志查询,
example_cl
| top 1 by TimeGenerated desc
| project in_use, unused, total = (in_use + unused)
Which gives me a simple output; 这给了我一个简单的输出;
in_use unused total
75 45 120
I wish to set a metric alert to this query such that when the in_use cross 90% of total it would send an email alert 我希望为此查询设置指标警报,以便当in_use超过总数的90%时将发送电子邮件警报
On trying to make the alert Im given the following error always 在尝试发出警报时,我总是给出以下错误
Search Query should contain 'AggregatedValue' and 'bin(TimeGenerated, [roundTo])' for Metric alert type
Need help figuring our the right query for this particular metric alert. 需要帮助来确定针对此特定指标警报的正确查询。
In general you get such AggregatedValue related error when you select alert logic 'based on' parameter as 'Metric measurement'. 通常,当您选择“基于”参数的警报逻辑作为“度量标准”时,会遇到与AggregatedValue相关的错误。
For all the Metric measurement alert rules, please refer this -> https://docs.microsoft.com/en-us/azure/azure-monitor/platform/alerts-unified-log#metric-measurement-alert-rules Microsoft documentation link. 对于所有度量标准警报规则,请参考此-> https://docs.microsoft.com/zh-cn/azure/azure-monitor/platform/alerts-unified-log#metric-measurement-alert-rules Microsoft文档链接。
You would have to update your query something like shown below. 您将必须更新查询,如下所示。 Note that xxxxxxx in the below sample query is a group field record.
请注意,以下示例查询中的xxxxxxx是一个组字段记录。 To understand what you may have to use in that field, please refer the above provided Microsoft documentation link.
要了解您可能在该字段中使用的内容,请参阅上面提供的Microsoft文档链接。
example_cl
| top 1 by TimeGenerated desc
| project in_use, unused, total = (in_use + unused)
| summarize AggregatedValue= avg(in_use) by xxxxxxx, bin(TimeGenerated, 30s)
Hope this helps!! 希望这可以帮助!! Cheers!!
干杯!!
To add to what @KrishnaG-MSFT, If you dont want to use the average as aggregated value you can use aggregate functions like count() that would just treat the individual results as unique values and render the results. 要添加到@ KrishnaG-MSFT中,如果您不想将平均值用作聚合值,则可以使用诸如count()之类的聚合函数,这些函数会将单个结果视为唯一值并呈现结果。
example_cl
| top 1 by TimeGenerated desc
| project in_use, unused, total = (in_use + unused)
| summarize AggregatedValue= count() by xxxxxxx, bin(TimeGenerated, 30s)
Some more examples how i have re written 我如何重写一些更多的例子
Event
| where EventID == 1235
| project Computer, TimeGenerated, AlertType_s = "Test Connectrix", Severity = 4,
SeverityName_s = "Information", AffectedCI_s = Computer , AlertTitle_s =
strcat(Computer, ":Test Connectrix" ) , AlertDetails_s = RenderedDescription
Observe that aggregation done on the number of rows returned. 观察到聚合是在返回的行数上完成的。
Event
| where EventID == 1235
| project Computer, TimeGenerated, AlertType_s = "Test Connectrix", Severity = 4,
SeverityName_s = "Information", AffectedCI_s = Computer , AlertTitle_s =
strcat(Computer, ":Test Connectrix" ) , AlertDetails_s = RenderedDescription
| summarize AggregatedValue = count() by bin(TimeGenerated, 30m) , Computer
let _maxValue = 80;
let _timeWindow = 4h;
let _AvgCpu = Perf
| where TimeGenerated >= ago(_timeWindow)
| where CounterName == "% Processor Time" and InstanceName =~ "_Total"
| summarize mtgPerf=max(TimeGenerated), CounterValue=round(avg(CounterValue)),
SampleCount= count(CounterValue) by Computer, InstanceName, CounterName, ObjectName;
_AvgCpu
| where CounterValue > _maxValue
| project Computer , ObjectName , CounterName , InstanceName ,
TimeGenerated=mtgPerf , CounterValue , AlertType_s = "Sustained High CPU
Utilization" , Severity = 4 , SeverityName_s = "WARNING" , AffectedCI_s =
strcat(Computer, "/CPUPercent/", InstanceName) , AlertTitle_s = strcat(Computer,
": Sustained High CPU Utilization") , AlertDetails_s = strcat("Computer: ",
Computer, "Average CPU Utilization: ", CounterValue, "%Sample Period: Last ",
_timeWindow, "Sample Count: ", SampleCount, "Alert Threshold: > ", _maxValue, "%")
| summarize AggregatedValue = count() by bin(TimeGenerated, 30m), Computer ,
ObjectName , CounterName , InstanceName, CounterValue, AlertType_s, Severity,
SeverityName_s, AffectedCI_s , AlertTitle_s, AlertDetails_s
Hope this helps. 希望这可以帮助。
声明:本站的技术帖子网页,遵循CC BY-SA 4.0协议,如果您需要转载,请注明本站网址或者原文地址。任何问题请咨询:yoyou2525@163.com.