Need to query the average cpu is more than threshold value - azure

Question

Im writing query in logs in alert rule of the vm to get the results of average vm cpu is more then some value like 80 for every 1 hr need to fire alert. I need to get the condition true if the query results true by getting the average cpu value for last 1hr of the vm is greater than 80. Then it passes the condition to fire alert but i don't want any duplication of alert like last 3hr cpu value is more than 80, it shouldn't trigger 3 alert. Lookin for one alert only as per the current alert is still active. Also is any condition to close the fired alert if it is cleared as per condition by integrating with azure devops board work item?
Kql query:
Perf
| where TimeGenerated > ago(1h)
| where CounterName == "% Processor Time" and InstanceName == "_Total" and Countervalue > 80
| summarize avg(CounterValue) by Computer, Countervalue
I don't want to fire alert if the alert already fired in last result to avoid duplication. How to set in query and alert rules condition in azure monitor

Answer 1

A couple of problems:
The query filters on Countervalue > 80 which means that if during that hour the CPU loads spikes above 80 even just once you are guaranteed to have an average of more than 80. That condition probably just needs to be removed.
The query summarizes by Countervalue which means you get one row per distinct CPU usage value which doesn't really make sense.
Should probably look like this:
Perf
| where TimeGenerated >= ago(1h)
| where CounterName == "% Processor Time" and InstanceName == "_Total"
| summarize avg(CounterValue) by Computer
Now to the problem that you do not want to trigger the alarm again if the alarm was already triggered: The solution here would be to look at the previous' hour average as well and see if it was above 80 and only trigger if it just rose above 80. So something like this:
Perf
| where TimeGenerated >= ago(2h)
| where CounterName == "% Processor Time" and InstanceName == "_Total"
| summarize AvgCPU = avg(CounterValue) by bin(TimeGenerated, 1h), Computer
| order by TimeGenerated asc
| extend ShouldTrigger = prev(AvgCPU) <= 80 and AvgCPU > 80
| summarize arg_max(TimeGenerated, ShouldTrigger)
Then set your alarm condition to be `ShouldTrigger == true`