2

I am trying to build an ALERT for a condition where in a timespan of 15mins if the number of FailedRequests were Greater than 99% of the requests received I want to raise the Alert. I have written a KQL Query but unfortunately it just fires of even without real issues happening i.e. without really getting the condition of greater than 99%. following is the query and I am sure I am making some silly mistake in it any help?

Any help in fixing above query so it really gives results only when it is crictical i.e. when all of the requests received are failing.

requests 
| where cloud_RoleName == 'ABCDEF_cloudRName' and resultCode != '404' 
| summarize FailedPercent=((countif(success == false))/count() by timestamp, cloud_RoleName, appName)*100 
| where FailedPercent > 99 
| project RelatedCI='XYZZZ',AlarmTime=timestamp,Category="Cloud-Azure-Monitor",SubCategory="Application",Object=appName ,"Value of Metric","Percentage Failed Requests"," is ", FailedPercent
Ivan Glasenberg
  • 29,865
  • 2
  • 44
  • 60
user42012
  • 722
  • 12
  • 33

1 Answers1

3

Here is an similar issue for sending alert when failed percentage is greater than xx%.

I simply write a query, please feel free to modify it if it does not meet your need:

requests
| where resultCode != "404" and success == "False" 
| summarize exceptionsCount =count()
| extend a = "a"
| join
(
    requests
    | where resultCode != "404" 
    | summarize requestsCount =count()
    | extend a = "a"
)
on a
| project isFail = 1.0 * exceptionsCount / requestsCount > 0.99 //check if the failed percentage is greater than 99%.
| project rr=iff(isFail, "Fail","Pass" ) 
| where rr=="Fail"

After the query code is ready, you can create a query-based alert following the steps in the issue above.

Ivan Glasenberg
  • 29,865
  • 2
  • 44
  • 60
  • 1
    Thank you Ivan, like u r query this is what I cam up with:- requests | where cloud_RoleName has 'THREE-CMS' and resultCode != '404' | extend isSuccesss=iff(success=="True" ,1, 0) | summarize failures=sum(1-isSuccesss) , successes=sum(isSuccesss) by bin(timestamp,5m), cloud_RoleName, appName | extend ratio=(todouble(failures) / todouble(failures+successes))*100 | where ratio > 99 | project RelatedCI='APP-CMS',AlarmTime=timestamp,Category="Cloud-Azure-Monitor",SubCategory="Application",Object=appName ,"Value of Metric","Percentage Failed Requests"," is ", failure_Percent=ratio – user42012 Jun 06 '19 at 13:26