Actions are not triggering when alerts are triggered - azure

Question

Using Terraform I have created Alert, Action group and Logicapp. (Code-1 show below)
Action to trigger when an alert is triggered, where one of Action type is Logic app, which was as expected. Alert got triggered when condition is true further it trigger Logic app action.
Later, I got requirement to adjust alert’s threshold and frequency and made changes to Terraform code, while doing plan/apply noticed only changes in Alert Frequency and threshold value and these are expected. (Code-2 show below)
After this change(update) of Alert properties action as stopped functioning. when alert is triggered, Action is not triggered.
Test 1: Checking weather alert itself truly triggering
• Just to test the functionality of alert whether itself getting triggered, I subscribed Notification type to send mail to my Inbox. Which worked and I got mail regarding the alert but the alert unable to trigger action.
Test 1.2: Changes from Portal
• I removed testing-logicapp (Logic app action) under Action type from Azure Portal.
• And Added testing-logicapp (Logic app action) under Action type from Azure Portal. (As show in below JPG-3)
• This resulted Action to trigger when an alert is triggered.
So, my doubt is, how should I handle this scenario in terraform way.
Code-1 :
resource "azurerm_monitor_scheduled_query_rules_alert_v2" "myvm_task_alert_v2" {
name = "myvm-auto-deletion-alert"
resource_group_name = azurerm_resource_group.myvm_task_resource_group.name
evaluation_frequency = "PT1H"
window_duration = "PT1H"
scopes = [data.azurerm_log_analytics_workspace.azurerm_log_analytics_workspace.id]
severity = 4
criteria {
query = <<-QUERY
Perf
| where TimeGenerated > ago(1h)
| where CounterName == "% Processor Time" and InstanceName == "_Total"
| project TimeGenerated, Computer, CounterValue, _ResourceId
| summarize AggregatedValue = avg(CounterValue) by bin(TimeGenerated, 1h), Computer, _ResourceId
QUERY
time_aggregation_method = "Maximum"
threshold = 30.0
operator = "LessThan"
metric_measure_column = "AggregatedValue"
}
display_name = "myvm-auto-deletion-alert"
enabled = true
action {
action_groups = [azurerm_monitor_action_group.delete_myvm_action_group.id]
}
}
resource "azurerm_monitor_action_group" "delete_myvm_action_group" {
name = "myvm-auto-deletion-action-group"
resource_group_name = azurerm_resource_group.myvm_task_resource_group.name
short_name = "myvm-autodel"
tags = module.metadata.tags
logic_app_receiver {
name = "myvm-auto-deletion-logicapp"
resource_id = azurerm_logic_app_workflow.myvm_task_logicapp.id
callback_url = azurerm_logic_app_workflow.myvm_task_logicapp.access_endpoint
use_common_alert_schema = true
}
email_receiver {
name = "sendtoPraveen"
email_address = "praveen#goog.gov.net"
use_common_alert_schema = true
}
}
resource "azurerm_logic_app_workflow" "myvm_task_logicapp" {
name = "myvm-auto-deletion-logicapp"
location = "us east"
resource_group_name = azurerm_resource_group.myvm_task_resource_group.name
}
Code-2 :
resource "azurerm_monitor_scheduled_query_rules_alert_v2" "myvm_task_alert_v2" {
name = "myvm-auto-deletion-alert"
resource_group_name = azurerm_resource_group.myvm_task_resource_group.name
evaluation_frequency = "PT1H"
window_duration = "PT10H" ####################-------------------->change1
scopes = [data.azurerm_log_analytics_workspace.azurerm_log_analytics_workspace.id]
severity = 4
criteria {
query = <<-QUERY
Perf
| where TimeGenerated > ago(1h)
| where CounterName == "% Processor Time" and InstanceName == "_Total"
| project TimeGenerated, Computer, CounterValue, _ResourceId
| summarize AggregatedValue = avg(CounterValue) by bin(TimeGenerated, 1h), Computer, _ResourceId
QUERY
time_aggregation_method = "Maximum"
threshold = 50.0 ####################-------------------->change2
operator = "LessThan"
metric_measure_column = "AggregatedValue"
}
display_name = "myvm-auto-deletion-alert"
enabled = true
action {
action_groups = [azurerm_monitor_action_group.delete_myvm_action_group.id]
}
}
JPG-1

Answer 1

Found the issue with the help of MIcrosoft support team.
Created new azurerm_logic_app_trigger_http_request flow.
resource "azurerm_logic_app_trigger_http_request" "logic_app_httptrigger_code" {
name = "alertv2httPayload"
logic_app_id = azurerm_logic_app_workflow.myvm_task_logicapp.id
schema = data.local_file.httptrigger_code.content
}
You'll need to use callbackurl of azurerm_logic_app_trigger_http_request in Logic_app_receiver under actiongroup :
azurerm_logic_app_trigger_http_request.logic_app_httptrigger_code.callback_url
instead of
azurerm_logic_app_workflow.myvm_task_logicapp.access_endpoint
Ref : Action groups not triggering Logic Apps #6056

Answer 2

Actions are not triggering when alerts are triggered:
I tried it in my environment by using this terraform template for scheduled alerts and making a few modifications as required. It was successfully deployed, and an action was triggered with appropriate information to the specified user's email address.
terraform {
required_providers {
azurerm = {
source = "hashicorp/azurerm"
version = "3.37.0"
}
}
}
provider "azurerm" {
features{}
}
resource "azurerm_resource_group" "example" {
name = "xxxxexample-resources"
location = "xxxxxx"
}
resource "azurerm_application_insights" "example" {
name = "xxxxexample-ai"
location = azurerm_resource_group.example.location
resource_group_name = azurerm_resource_group.example.name
application_type = "web"
}
resource "azurerm_logic_app_workflow" "example" {
name = "xxxxdeletion-logicapp"
location = "eastUS"
resource_group_name = azurerm_resource_group.example.name
}
resource "azurerm_monitor_action_group" "example" {
name = "xxxxx-mag"
resource_group_name = azurerm_resource_group.example.name
short_name = "xxxxxtest"
logic_app_receiver {
name = "xxxxxdeletion-logicapp"
resource_id = azurerm_logic_app_workflow.example.id
callback_url = azurerm_logic_app_workflow.example.access_endpoint
use_common_alert_schema = true
}
email_receiver {
name = "sendtouser"
email_address = "xxxxx#gmail.com"
use_common_alert_schema = true
}
}
resource "azurerm_monitor_scheduled_query_rules_alert_v2" "example" {
name = "xxxx-msqrv2"
resource_group_name = azurerm_resource_group.example.name
location = azurerm_resource_group.example.location
evaluation_frequency = "PT10M"
window_duration = "PT10M"
scopes = [azurerm_application_insights.example.id]
severity = 4
criteria {
query = <<-QUERY
requests
| summarize CountByCountry=count() by client_CountryOrRegion #Give query condition as per your requirements
QUERY
time_aggregation_method = "Maximum"
threshold = 30.0
operator = "LessThan"
metric_measure_column = "CountByCountry"
resource_id_column = "client_CountryOrRegion"
dimension {
name = "client_CountryOrRegion"
operator = "Exclude"
values = ["123"]
}
failing_periods {
minimum_failing_periods_to_trigger_alert = 1
number_of_evaluation_periods = 1
}
}
auto_mitigation_enabled = true
workspace_alerts_storage_enabled = false
description = "example sqr"
display_name = "example-sqr"
enabled = true
query_time_range_override = "PT1H"
skip_query_validation = true
action {
action_groups = [azurerm_monitor_action_group.example.id]
custom_properties = {
key1 = "xxx"
key2 = "xxx"
}
}
tags = {
key1 = "xxxx"
}
}
terraform init:
terraform plan:
terraform apply:
Deployed in Portal & added an action group:
Triggered alert mail successfully: