3

I'm working on configuring an Azure Log Analytics alert (using KQL) to capture the IIS Stop & Start events (from Events table) in my OMS Workspace, and if the alert query finds that there's no corresponding IIS Start event log generated from a PaaS Role for a particular IIS Stop event log- the user should get notified by an alert so that he can bring IIS back up.

Problem: Let’s say I setup my alert to run over a Time Period & Frequency of 15mins. If the alert triggered at 10:30AM, that means it will scan the IIS logs from 10:15:01 AM to 10:29:59 AM. Now, suppose an IIS Stop event got logged in around 10:28 AM, then the respective IIS Start log (if any) will be logged in after a couple of minutes around 10:31AM or 10:32 AM – and hence it will go out of the alert’s monitoring time period. This will create a false positive failure scenario. (IIS got started back but my alert didn’t captured the Start event log). And thus, it might lead to some unnecessary IIS Start/Reset operations on my PaaS roles.

Attaching a representative quick sketch to explain it figuratively.

IIS_Start_Stop_Events_issue

Please let me know if there's any possible approach to achieve this. Any suggestions are welcome. Thanks in advance!

Yash Gupta
  • 1,807
  • 15
  • 21

1 Answers1

2

Current implementation as follows.

enter image description here

Here we can see False Alert generated at 10:30.

You can see the below approach, where we select last 10 minutes data(Overlapped) every 5 minutes.

enter image description here

For the below case you can generate the alert

enter image description here

See if its helping you.

Justin Mathew
  • 950
  • 8
  • 34