Alerting
What it is
Alerting is the practice of acting when monitoring data indicates a problem. In Azure Monitor, an alert rule evaluates a signal and condition; when the condition is met, it creates an alert and can trigger an action group to notify people or start automation.
Why it exists
Telemetry in a dashboard helps only when someone is looking at it. Alerting turns a defined symptom into a timely response: it sends the right context to the people or automation that can investigate and reduce customer impact.
Key ideas
- An alert rule = resource(s) + signal + condition + action:
- Signal — metric (metric alert), log query (KQL), activity-log event, or App Insights condition.
- Condition/logic — e.g. CPU > 85%, error count > 5, URL unavailable.
- Action groups can notify by email, SMS, or push and can start runbooks, Functions, Logic Apps, webhooks, ITSM incidents, or other supported automation.
- Alerts can be stateful or stateless. A stateful alert can resolve after its condition clears; a user response such as Acknowledged is a separate operational record.
- Choose the signal before the rule: metric, log query, activity-log event, smart detection, or another supported alert type. Static and dynamic thresholds both need tuning against real workload behavior.
Northwind example
Northwind alerts when order API failed requests exceed a tested threshold. The rule creates one alert per affected resource and triggers an action group that pages the on-call team and opens an ITSM incident. The alert remains visible even if a maintenance processing rule suppresses the page. Maya acknowledges the alert while investigating; that user response does not change whether the underlying metric condition has resolved.
Exam notes
- An alert rule monitors resource data, evaluates a condition, and triggers action groups when it fires.
- Metric alerts use numeric time series; log alerts use query results; activity-log alerts use matching management events.
- Action groups centralize notifications and automation. Processing rules can add or suppress action groups after an alert fires.
Related
azure-monitor · metric-alert · application-insights · action-group · telemetry · synthetic-testing · feedback-loop
📘 Source: Microsoft Learn — Azure Monitor alerts