如何获取 IIS 启动日志以获取相应 IIS 停止日志中的 Azure Log Analytics 在警报的监视时间段之外

Question

I'm working on configuring an Azure Log Analytics alert (using KQL) to capture the IIS Stop & Start events (from Events table) in my OMS Workspace, and if the alert query finds that there's no corresponding IIS Start event log generated from a PaaS Role for a particular IIS Stop event log- the user should get notified by an alert so that he can bring IIS back up.

Problem: Let's say I setup my alert to run over a Time Period & Frequency of 15mins. If the alert triggered at 10:30AM, that means it will scan the IIS logs from 10:15:01 AM to 10:29:59 AM. Now, suppose an IIS Stop event got logged in around 10:28 AM, then the respective IIS Start log (if any) will be logged in after a couple of minutes around 10:31AM or 10:32 AM – and hence it will go out of the alert's monitoring time period. This will create a false positive failure scenario. (IIS got started back but my alert didn't captured the Start event log). And thus, it might lead to some unnecessary IIS Start/Reset operations on my PaaS roles.

Attaching a representative quick sketch to explain it figuratively.

Please let me know if there's any possible approach to achieve this. Any suggestions are welcome. Thanks in advance!

Answer 1

Current implementation as follows.

Here we can see False Alert generated at 10:30.

You can see the below approach, where we select last 10 minutes data(Overlapped) every 5 minutes.

For the below case you can generate the alert

See if its helping you.