Scheduled query rules CMK check flag, stateful alerts and 1-minute frequency

[yanivlavi]

Resource Provider
Scheduled query rules

Description of Feature or Work Requested
We added stateful log alerts (autoMitigate flag, alerts that automatically resolve), a flag to check if LA has linked storage (for CMK policy) and 1-minute frequency alerts.

Minimum API Version Required
2021-02-01-preview

Swagger Link
https://github.com/Azure/azure-rest-api-specs/blob/master/specification/monitor/resource-manager/Microsoft.Insights/preview/2021-02-01-preview/scheduledQueryRule_API.json

[yonzhan]

monitor

[kairu-ms]

@yanivlavi I get an error from new-version api that "(BadRequest) Alert rule payload cannot be empty". What does this mean?

[yanivlavi]

@avjerafi Can you help here?

[avjerafi]

@kairu-ms This looks like the result of an unexpected parsing failure of some kind. Can you please share the body of the request?

[kairu-ms]

@avjerafi I created a VM and tried to create a scheduled query for it. Below is the body of request.

{
   "location":"westus",
   "kind":"LogAlert",
   "properties":{
      "description":"Test rule",
      "severity":2.0,
      "enabled":true,
      "scopes":[
         "/subscriptions/0000000000000000000000000000000/resourceGroups/kairu/providers/Microsoft.Compute/virtualMachines/kairu-ws"
      ],
      "evaluationFrequency":"PT5M",
      "windowSize":"PT5M",
      "criteria":{
         "allOf":[
            {
               "query":"union Event, Syslog | where TimeGenerated > ago(1h)",
               "timeAggregation":"Count",
               "dimensions":[],
               "operator":"GreaterThan",
               "threshold":360.0,
               "failingPeriods":{
                  "numberOfEvaluationPeriods":1,
                  "minFailingPeriodsToAlert":1
               }
            }
         ]
      },
      "muteActionsDuration":"PT30M",
      "skipQueryValidation":false,
      "autoMitigate":false
   }
}

[avjerafi]

@kairu-ms The error is caused by the Severity value being provided as a float instead of as an integer.
Please use:
"severity":2,
instead of:
"severity":2.0,

@yanivlavi We should have validated the datatype and returned a specific validation error. I've opened a ticket for this.

[kairu-ms]

Swagger updated by PR Azure/azure-rest-api-specs#14942

[Jing-song]

Azure/azure-cli-extensions#3753