feat(health): add azure monitor alerts (#22007)
Ilya Mashchenko committed
Mar 23, 2026 at 10:53 UTC
761a848920a792c8fa4715335e450188beec7a0c
38 files changed
+8141
src/health/health.d/azure_monitor_aks.conf
new
+207
@@ -0,0 +1,207 @@
1
+# you can disable an alarm notification by setting the 'to' line to: silent
2
+
3
+# --- API Server ---
4
+
5
+ template: am_aks_apiserver_cpu
6
+ on: azure_monitor.aks.apiserver_cpu
7
+ class: Utilization
8
+ type: Kubernetes
9
+component: AKS
10
+ lookup: average -5m unaligned of average
11
+ units: percentage
12
+ every: 1m
13
+ warn: $this > (($status >= $WARNING) ? (75) : (80))
14
+ crit: $this > (($status == $CRITICAL) ? (85) : (95))
15
+ delay: down 5m multiplier 1.5 max 1h
16
+ summary: AKS API server CPU on ${label:resource_name}
17
+ info: Average API server CPU utilization on AKS cluster ${label:resource_name} \
18
+ in ${label:resource_group} (${label:region})
19
+ to: sysadmin
20
+
21
+ template: am_aks_apiserver_memory
22
+ on: azure_monitor.aks.apiserver_memory
23
+ class: Utilization
24
+ type: Kubernetes
25
+component: AKS
26
+ lookup: average -5m unaligned of average
27
+ units: percentage
28
+ every: 1m
29
+ warn: $this > (($status >= $WARNING) ? (75) : (80))
30
+ crit: $this > (($status == $CRITICAL) ? (85) : (95))
31
+ delay: down 5m multiplier 1.5 max 1h
32
+ summary: AKS API server memory on ${label:resource_name}
33
+ info: Average API server memory utilization on AKS cluster ${label:resource_name} \
34
+ in ${label:resource_group} (${label:region})
35
+ to: sysadmin
36
+
37
+ template: am_aks_apiserver_inflight_requests
38
+ on: azure_monitor.aks.apiserver_inflight_requests
39
+ class: Workload
40
+ type: Kubernetes
41
+component: AKS
42
+ lookup: average -5m unaligned of average
43
+ units: requests
44
+ every: 1m
45
+ warn: $this > (($status >= $WARNING) ? (400) : (600))
46
+ crit: $this > (($status == $CRITICAL) ? (600) : (800))
47
+ delay: down 5m multiplier 1.5 max 1h
48
+ summary: AKS API server inflight requests on ${label:resource_name}
49
+ info: Average number of inflight requests to the API server on AKS cluster ${label:resource_name} \
50
+ in ${label:resource_group} (${label:region})
51
+ to: sysadmin
52
+
53
+# --- etcd ---
54
+
55
+ template: am_aks_etcd_cpu
56
+ on: azure_monitor.aks.etcd_cpu
57
+ class: Utilization
58
+ type: Kubernetes
59
+component: AKS
60
+ lookup: average -5m unaligned of average
61
+ units: percentage
62
+ every: 1m
63
+ warn: $this > (($status >= $WARNING) ? (75) : (80))
64
+ crit: $this > (($status == $CRITICAL) ? (85) : (95))
65
+ delay: down 5m multiplier 1.5 max 1h
66
+ summary: AKS etcd CPU on ${label:resource_name}
67
+ info: Average etcd CPU utilization on AKS cluster ${label:resource_name} \
68
+ in ${label:resource_group} (${label:region})
69
+ to: sysadmin
70
+
71
+ template: am_aks_etcd_memory
72
+ on: azure_monitor.aks.etcd_memory
73
+ class: Utilization
74
+ type: Kubernetes
75
+component: AKS
76
+ lookup: average -5m unaligned of average
77
+ units: percentage
78
+ every: 1m
79
+ warn: $this > (($status >= $WARNING) ? (75) : (80))
80
+ crit: $this > (($status == $CRITICAL) ? (85) : (95))
81
+ delay: down 5m multiplier 1.5 max 1h
82
+ summary: AKS etcd memory on ${label:resource_name}
83
+ info: Average etcd memory utilization on AKS cluster ${label:resource_name} \
84
+ in ${label:resource_group} (${label:region})
85
+ to: sysadmin
86
+
87
+ template: am_aks_etcd_database
88
+ on: azure_monitor.aks.etcd_database
89
+ class: Utilization
90
+ type: Kubernetes
91
+component: AKS
92
+ lookup: average -5m unaligned of average
93
+ units: percentage
94
+ every: 1m
95
+ warn: $this > (($status >= $WARNING) ? (75) : (80))
96
+ crit: $this > (($status == $CRITICAL) ? (85) : (90))
97
+ delay: down 5m multiplier 1.5 max 1h
98
+ summary: AKS etcd database usage on ${label:resource_name}
99
+ info: Average etcd database utilization on AKS cluster ${label:resource_name} \
100
+ in ${label:resource_group} (${label:region}). \
101
+ High etcd database usage can lead to cluster instability.
102
+ to: sysadmin
103
+
104
+# --- Autoscaler ---
105
+
106
+ template: am_aks_autoscaler_safe_to_autoscale
107
+ on: azure_monitor.aks.autoscaler_health
108
+ class: Availability
109
+ type: Kubernetes
110
+component: AKS
111
+ lookup: average -5m unaligned of safe_to_autoscale
112
+ units: state
113
+ every: 1m
114
+ warn: $this != nan AND $this < 1
115
+ delay: down 5m multiplier 1.5 max 1h
116
+ summary: AKS autoscaler unsafe on ${label:resource_name}
117
+ info: Cluster autoscaler reports the cluster is not safe to autoscale on AKS cluster ${label:resource_name} \
118
+ in ${label:resource_group} (${label:region})
119
+ to: sysadmin
120
+
121
+ template: am_aks_autoscaler_unschedulable_pods
122
+ on: azure_monitor.aks.autoscaler_unschedulable_pods
123
+ class: Errors
124
+ type: Kubernetes
125
+component: AKS
126
+ lookup: average -5m unaligned of average
127
+ units: pods
128
+ every: 1m
129
+ warn: $this > (($status >= $WARNING) ? (0) : (5))
130
+ crit: $this > (($status == $CRITICAL) ? (5) : (20))
131
+ delay: down 5m multiplier 1.5 max 1h
132
+ summary: AKS unschedulable pods on ${label:resource_name}
133
+ info: Number of pods that cannot be scheduled by the cluster autoscaler on AKS cluster ${label:resource_name} \
134
+ in ${label:resource_group} (${label:region}). \
135
+ Indicates insufficient cluster capacity.
136
+ to: sysadmin
137
+
138
+# --- Node CPU ---
139
+
140
+ template: am_aks_node_cpu
141
+ on: azure_monitor.aks.node_cpu_percentage
142
+ class: Utilization
143
+ type: Kubernetes
144
+component: AKS
145
+ lookup: average -5m unaligned of average
146
+ units: percentage
147
+ every: 1m
148
+ warn: $this > (($status >= $WARNING) ? (80) : (90))
149
+ crit: $this > (($status == $CRITICAL) ? (90) : (95))
150
+ delay: down 5m multiplier 1.5 max 1h
151
+ summary: AKS node CPU on ${label:resource_name}
152
+ info: Average node CPU utilization on AKS cluster ${label:resource_name} \
153
+ in ${label:resource_group} (${label:region})
154
+ to: sysadmin
155
+
156
+# --- Node Memory ---
157
+
158
+ template: am_aks_node_memory_working_set
159
+ on: azure_monitor.aks.node_memory_working_set_percentage
160
+ class: Utilization
161
+ type: Kubernetes
162
+component: AKS
163
+ lookup: average -5m unaligned of average
164
+ units: percentage
165
+ every: 1m
166
+ warn: $this > (($status >= $WARNING) ? (80) : (85))
167
+ crit: $this > (($status == $CRITICAL) ? (85) : (95))
168
+ delay: down 5m multiplier 1.5 max 1h
169
+ summary: AKS node memory working set on ${label:resource_name}
170
+ info: Average node memory working set utilization on AKS cluster ${label:resource_name} \
171
+ in ${label:resource_group} (${label:region})
172
+ to: sysadmin
173
+
174
+ template: am_aks_node_memory_rss
175
+ on: azure_monitor.aks.node_memory_rss_percentage
176
+ class: Utilization
177
+ type: Kubernetes
178
+component: AKS
179
+ lookup: average -5m unaligned of average
180
+ units: percentage
181
+ every: 1m
182
+ warn: $this > (($status >= $WARNING) ? (80) : (85))
183
+ crit: $this > (($status == $CRITICAL) ? (85) : (95))
184
+ delay: down 5m multiplier 1.5 max 1h
185
+ summary: AKS node memory RSS on ${label:resource_name}
186
+ info: Average node memory RSS utilization on AKS cluster ${label:resource_name} \
187
+ in ${label:resource_group} (${label:region})
188
+ to: sysadmin
189
+
190
+# --- Node Disk ---
191
+
192
+ template: am_aks_node_disk
193
+ on: azure_monitor.aks.node_disk_percentage
194
+ class: Utilization
195
+ type: Kubernetes
196
+component: AKS
197
+ lookup: average -5m unaligned of average
198
+ units: percentage
199
+ every: 1m
200
+ warn: $this > (($status >= $WARNING) ? (75) : (80))
201
+ crit: $this > (($status == $CRITICAL) ? (85) : (90))
202
+ delay: down 5m multiplier 1.5 max 1h
203
+ summary: AKS node disk usage on ${label:resource_name}
204
+ info: Average node disk utilization on AKS cluster ${label:resource_name} \
205
+ in ${label:resource_group} (${label:region}). \
206
+ High disk usage can cause pod evictions.
207
+ to: sysadmin
src/health/health.d/azure_monitor_api_management.conf
new
+182
@@ -0,0 +1,182 @@
1
+# you can disable an alarm notification by setting the 'to' line to: silent
2
+
3
+# --- Capacity / Utilization ---
4
+
5
+ template: am_api_management_capacity
6
+ on: azure_monitor.api_management.capacity
7
+ class: Utilization
8
+ type: Web Server
9
+component: API Management
10
+ lookup: average -5m unaligned of capacity
11
+ units: percentage
12
+ every: 1m
13
+ warn: $this > (($status >= $WARNING) ? (70) : (80))
14
+ crit: $this > (($status == $CRITICAL) ? (80) : (90))
15
+ delay: down 5m multiplier 1.5 max 1h
16
+ summary: APIM capacity on ${label:resource_name}
17
+ info: Average capacity utilization of API Management service ${label:resource_name} \
18
+ in ${label:resource_group} (${label:region}). \
19
+ High capacity indicates the service is approaching its scaling limits
20
+ to: sysadmin
21
+
22
+ template: am_api_management_gateway_cpu
23
+ on: azure_monitor.api_management.gateway_cpu
24
+ class: Utilization
25
+ type: Web Server
26
+component: API Management
27
+ lookup: average -5m unaligned of cpu
28
+ units: percentage
29
+ every: 1m
30
+ warn: $this != nan AND $this > (($status >= $WARNING) ? (70) : (80))
31
+ crit: $this != nan AND $this > (($status == $CRITICAL) ? (85) : (95))
32
+ delay: down 5m multiplier 1.5 max 1h
33
+ summary: APIM gateway CPU on ${label:resource_name}
34
+ info: Average gateway CPU utilization of API Management service ${label:resource_name} \
35
+ in ${label:resource_group} (${label:region})
36
+ to: sysadmin
37
+
38
+ template: am_api_management_gateway_memory
39
+ on: azure_monitor.api_management.gateway_memory
40
+ class: Utilization
41
+ type: Web Server
42
+component: API Management
43
+ lookup: average -5m unaligned of memory
44
+ units: percentage
45
+ every: 1m
46
+ warn: $this != nan AND $this > (($status >= $WARNING) ? (70) : (80))
47
+ crit: $this != nan AND $this > (($status == $CRITICAL) ? (85) : (95))
48
+ delay: down 5m multiplier 1.5 max 1h
49
+ summary: APIM gateway memory on ${label:resource_name}
50
+ info: Average gateway memory utilization of API Management service ${label:resource_name} \
51
+ in ${label:resource_group} (${label:region})
52
+ to: sysadmin
53
+
54
+# --- Request Latency ---
55
+
56
+ template: am_api_management_request_duration
57
+ on: azure_monitor.api_management.request_duration
58
+ class: Latency
59
+ type: Web Server
60
+component: API Management
61
+ lookup: average -5m unaligned of overall
62
+ units: milliseconds
63
+ every: 1m
64
+ warn: $this > (($status >= $WARNING) ? (3000) : (5000))
65
+ crit: $this > (($status == $CRITICAL) ? (5000) : (10000))
66
+ delay: down 5m multiplier 1.5 max 1h
67
+ summary: APIM request duration on ${label:resource_name}
68
+ info: Average overall request duration of API Management service ${label:resource_name} \
69
+ in ${label:resource_group} (${label:region})
70
+ to: sysadmin
71
+
72
+ template: am_api_management_backend_duration
73
+ on: azure_monitor.api_management.request_duration
74
+ class: Latency
75
+ type: Web Server
76
+component: API Management
77
+ lookup: average -5m unaligned of backend
78
+ units: milliseconds
79
+ every: 1m
80
+ warn: $this > (($status >= $WARNING) ? (3000) : (5000))
81
+ crit: $this > (($status == $CRITICAL) ? (5000) : (10000))
82
+ delay: down 5m multiplier 1.5 max 1h
83
+ summary: APIM backend duration on ${label:resource_name}
84
+ info: Average backend request duration of API Management service ${label:resource_name} \
85
+ in ${label:resource_group} (${label:region})
86
+ to: sysadmin
87
+
88
+# --- Network Connectivity ---
89
+
90
+ template: am_api_management_network_connectivity
91
+ on: azure_monitor.api_management.network_connectivity
92
+ class: Availability
93
+ type: Web Server
94
+component: API Management
95
+ lookup: average -5m unaligned of connectivity
96
+ units: status
97
+ every: 1m
98
+ crit: $this < (($status == $CRITICAL) ? (1) : (0.5))
99
+ delay: down 5m multiplier 1.5 max 1h
100
+ summary: APIM network connectivity on ${label:resource_name}
101
+ info: Network connectivity status of API Management service ${label:resource_name} \
102
+ in ${label:resource_group} (${label:region}). \
103
+ Values below 1 indicate connectivity problems to backend dependencies
104
+ to: sysadmin
105
+
106
+# --- EventHub Errors ---
107
+
108
+ template: am_api_management_eventhub_failed_events
109
+ on: azure_monitor.api_management.eventhub_events
110
+ class: Errors
111
+ type: Web Server
112
+component: API Management
113
+ lookup: average -5m unaligned of failed
114
+ units: events/s
115
+ every: 1m
116
+ warn: $this != nan AND $this > (($status >= $WARNING) ? (0) : (5))
117
+ delay: down 5m multiplier 1.5 max 1h
118
+ summary: APIM EventHub failed events on ${label:resource_name}
119
+ info: Rate of failed EventHub events for API Management service ${label:resource_name} \
120
+ in ${label:resource_group} (${label:region})
121
+ to: sysadmin
122
+
123
+ template: am_api_management_eventhub_dropped_events
124
+ on: azure_monitor.api_management.eventhub_events
125
+ class: Errors
126
+ type: Web Server
127
+component: API Management
128
+ lookup: average -5m unaligned of dropped
129
+ units: events/s
130
+ every: 1m
131
+ warn: $this != nan AND $this > (($status >= $WARNING) ? (0) : (5))
132
+ delay: down 5m multiplier 1.5 max 1h
133
+ summary: APIM EventHub dropped events on ${label:resource_name}
134
+ info: Rate of dropped EventHub events for API Management service ${label:resource_name} \
135
+ in ${label:resource_group} (${label:region})
136
+ to: sysadmin
137
+
138
+ template: am_api_management_eventhub_rejected_events
139
+ on: azure_monitor.api_management.eventhub_events
140
+ class: Errors
141
+ type: Web Server
142
+component: API Management
143
+ lookup: average -5m unaligned of rejected
144
+ units: events/s
145
+ every: 1m
146
+ warn: $this != nan AND $this > (($status >= $WARNING) ? (0) : (5))
147
+ delay: down 5m multiplier 1.5 max 1h
148
+ summary: APIM EventHub rejected events on ${label:resource_name}
149
+ info: Rate of rejected EventHub events for API Management service ${label:resource_name} \
150
+ in ${label:resource_group} (${label:region})
151
+ to: sysadmin
152
+
153
+ template: am_api_management_eventhub_throttled_events
154
+ on: azure_monitor.api_management.eventhub_events
155
+ class: Errors
156
+ type: Web Server
157
+component: API Management
158
+ lookup: average -5m unaligned of throttled
159
+ units: events/s
160
+ every: 1m
161
+ warn: $this != nan AND $this > (($status >= $WARNING) ? (0) : (10))
162
+ delay: down 5m multiplier 1.5 max 1h
163
+ summary: APIM EventHub throttled events on ${label:resource_name}
164
+ info: Rate of throttled EventHub events for API Management service ${label:resource_name} \
165
+ in ${label:resource_group} (${label:region}). \
166
+ Throttling indicates EventHub throughput limits are being reached
167
+ to: sysadmin
168
+
169
+ template: am_api_management_eventhub_timedout_events
170
+ on: azure_monitor.api_management.eventhub_events
171
+ class: Errors
172
+ type: Web Server
173
+component: API Management
174
+ lookup: average -5m unaligned of timed_out
175
+ units: events/s
176
+ every: 1m
177
+ warn: $this != nan AND $this > (($status >= $WARNING) ? (0) : (5))
178
+ delay: down 5m multiplier 1.5 max 1h
179
+ summary: APIM EventHub timed out events on ${label:resource_name}
180
+ info: Rate of timed out EventHub events for API Management service ${label:resource_name} \
181
+ in ${label:resource_group} (${label:region})
182
+ to: sysadmin
src/health/health.d/azure_monitor_app_service.conf
new
+148
@@ -0,0 +1,148 @@
1
+# you can disable an alarm notification by setting the 'to' line to: silent
2
+
3
+# Health check status (0-100%). Low is bad.
4
+# AMBA: HealthCheckStatus < 100 is Sev1 (critical)
5
+
6
+ template: am_app_service_health_check
7
+ on: azure_monitor.app_service.health
8
+ class: Availability
9
+ type: Web Server
10
+component: App Service
11
+ lookup: average -5m unaligned of average
12
+ units: percentage
13
+ every: 1m
14
+ warn: $this < (($status >= $WARNING) ? (100) : (80))
15
+ crit: $this < (($status == $CRITICAL) ? (80) : (50))
16
+ delay: down 5m multiplier 1.5 max 1h
17
+ summary: App Service health on ${label:resource_name}
18
+ info: Health check status of App Service ${label:resource_name} \
19
+ in ${label:resource_group} (${label:region})
20
+ to: sysadmin
21
+
22
+# HTTP 5xx server errors (rate).
23
+# AMBA: Http5xx > 10 is Sev1
24
+
25
+ template: am_app_service_http_5xx_rate
26
+ on: azure_monitor.app_service.http_status
27
+ class: Errors
28
+ type: Web Server
29
+component: App Service
30
+ lookup: average -5m unaligned of 5xx
31
+ units: responses/s
32
+ every: 1m
33
+ warn: $this > (($status >= $WARNING) ? (5) : (10))
34
+ crit: $this > (($status == $CRITICAL) ? (10) : (25))
35
+ delay: down 5m multiplier 1.5 max 1h
36
+ summary: App Service 5xx errors on ${label:resource_name}
37
+ info: HTTP 5xx server error rate on App Service ${label:resource_name} \
38
+ in ${label:resource_group} (${label:region})
39
+ to: sysadmin
40
+
41
+# HTTP response time (seconds). High is bad.
42
+# AMBA: HttpResponseTime average > 5s is Sev2
43
+
44
+ template: am_app_service_response_time
45
+ on: azure_monitor.app_service.response_time
46
+ class: Latency
47
+ type: Web Server
48
+component: App Service
49
+ lookup: average -5m unaligned of average
50
+ units: seconds
51
+ every: 1m
52
+ warn: $this > (($status >= $WARNING) ? (3) : (5))
53
+ crit: $this > (($status == $CRITICAL) ? (5) : (10))
54
+ delay: down 5m multiplier 1.5 max 1h
55
+ summary: App Service response time on ${label:resource_name}
56
+ info: Average HTTP response time of App Service ${label:resource_name} \
57
+ in ${label:resource_group} (${label:region})
58
+ to: sysadmin
59
+
60
+# CPU utilization (percentage). High is bad.
61
+# AMBA: CpuPercentage > 90 is Sev2
62
+
63
+ template: am_app_service_cpu_utilization
64
+ on: azure_monitor.app_service.cpu
65
+ class: Utilization
66
+ type: Web Server
67
+component: App Service
68
+ lookup: average -5m unaligned of average
69
+ units: percentage
70
+ every: 1m
71
+ warn: $this > (($status >= $WARNING) ? (75) : (85))
72
+ crit: $this > (($status == $CRITICAL) ? (85) : (95))
73
+ delay: down 5m multiplier 1.5 max 1h
74
+ summary: App Service CPU on ${label:resource_name}
75
+ info: CPU utilization of App Service ${label:resource_name} \
76
+ in ${label:resource_group} (${label:region})
77
+ to: sysadmin
78
+
79
+# Request queue depth (absolute). High means saturation.
80
+# AMBA: RequestsInApplicationQueue > 10 is Sev2
81
+
82
+ template: am_app_service_request_queue
83
+ on: azure_monitor.app_service.request_queue
84
+ class: Workload
85
+ type: Web Server
86
+component: App Service
87
+ lookup: average -5m unaligned of queued
88
+ units: requests
89
+ every: 1m
90
+ warn: $this > (($status >= $WARNING) ? (10) : (25))
91
+ crit: $this > (($status == $CRITICAL) ? (25) : (100))
92
+ delay: down 5m multiplier 1.5 max 1h
93
+ summary: App Service request queue on ${label:resource_name}
94
+ info: Requests queued in application queue of App Service ${label:resource_name} \
95
+ in ${label:resource_group} (${label:region})
96
+ to: sysadmin
97
+
98
+# HTTP 4xx client errors (rate). Sustained high rates may indicate
99
+# broken clients, missing endpoints, or auth problems.
100
+
101
+ template: am_app_service_http_4xx_rate
102
+ on: azure_monitor.app_service.http_status
103
+ class: Errors
104
+ type: Web Server
105
+component: App Service
106
+ lookup: average -5m unaligned of 4xx
107
+ units: responses/s
108
+ every: 1m
109
+ warn: $this > (($status >= $WARNING) ? (50) : (100))
110
+ delay: down 5m multiplier 1.5 max 1h
111
+ summary: App Service 4xx errors on ${label:resource_name}
112
+ info: HTTP 4xx client error rate on App Service ${label:resource_name} \
113
+ in ${label:resource_group} (${label:region})
114
+ to: sysadmin
115
+
116
+# HTTP 403 Forbidden spikes — may indicate WAF blocks or permission issues
117
+
118
+ template: am_app_service_http_403_rate
119
+ on: azure_monitor.app_service.http_error_detail
120
+ class: Errors
121
+ type: Web Server
122
+component: App Service
123
+ lookup: average -5m unaligned of 403_forbidden
124
+ units: responses/s
125
+ every: 1m
126
+ warn: $this > (($status >= $WARNING) ? (10) : (25))
127
+ delay: down 5m multiplier 1.5 max 1h
128
+ summary: App Service 403 forbidden on ${label:resource_name}
129
+ info: HTTP 403 Forbidden response rate on App Service ${label:resource_name} \
130
+ in ${label:resource_group} (${label:region})
131
+ to: sysadmin
132
+
133
+# HTTP 401 Unauthorized spikes — may indicate auth service failures
134
+
135
+ template: am_app_service_http_401_rate
136
+ on: azure_monitor.app_service.http_error_detail
137
+ class: Errors
138
+ type: Web Server
139
+component: App Service
140
+ lookup: average -5m unaligned of 401_unauthorized
141
+ units: responses/s
142
+ every: 1m
143
+ warn: $this > (($status >= $WARNING) ? (10) : (25))
144
+ delay: down 5m multiplier 1.5 max 1h
145
+ summary: App Service 401 unauthorized on ${label:resource_name}
146
+ info: HTTP 401 Unauthorized response rate on App Service ${label:resource_name} \
147
+ in ${label:resource_group} (${label:region})
148
+ to: sysadmin
src/health/health.d/azure_monitor_application_gateway.conf
new
+153
@@ -0,0 +1,153 @@
1
+# you can disable an alarm notification by setting the 'to' line to: silent
2
+
3
+# --- Errors: Failed Requests ---
4
+
5
+# helper: total requests over 5m (no alarm, value only)
6
+ template: am_appgw_total_requests
7
+ on: azure_monitor.application_gateway.requests
8
+ class: Workload
9
+ type: Web Server
10
+component: Application Gateway
11
+ lookup: sum -5m unaligned of total
12
+ units: requests/s
13
+ every: 1m
14
+ info: Total requests on Application Gateway ${label:resource_name}
15
+
16
+# failed request ratio — fires only when traffic is meaningful
17
+ template: am_appgw_failed_requests
18
+ on: azure_monitor.application_gateway.requests
19
+ class: Errors
20
+ type: Web Server
21
+component: Application Gateway
22
+ lookup: sum -5m unaligned of failed
23
+ calc: ($am_appgw_total_requests > 10) ? ($this * 100 / $am_appgw_total_requests) : (0)
24
+ units: %
25
+ every: 1m
26
+ warn: $this > (($status >= $WARNING) ? (5) : (10))
27
+ crit: $this > (($status == $CRITICAL) ? (10) : (25))
28
+ delay: down 5m multiplier 1.5 max 1h
29
+ summary: App Gateway failed requests on ${label:resource_name}
30
+ info: Percentage of failed requests on Application Gateway ${label:resource_name} \
31
+ in ${label:resource_group} (${label:region})
32
+ to: sysadmin
33
+
34
+# --- Availability: Backend Health ---
35
+
36
+ template: am_appgw_unhealthy_hosts
37
+ on: azure_monitor.application_gateway.backend_health
38
+ class: Errors
39
+ type: Web Server
40
+component: Application Gateway
41
+ lookup: average -5m unaligned of unhealthy
42
+ units: hosts
43
+ every: 1m
44
+ warn: $this > (($status >= $WARNING) ? (0) : (1))
45
+ crit: $this > (($status == $CRITICAL) ? (1) : (2))
46
+ delay: down 5m multiplier 1.5 max 1h
47
+ summary: App Gateway unhealthy backends on ${label:resource_name}
48
+ info: Unhealthy backend hosts on Application Gateway ${label:resource_name} \
49
+ in ${label:resource_group} (${label:region})
50
+ to: sysadmin
51
+
52
+# --- Latency: Backend Connect Time ---
53
+
54
+ template: am_appgw_backend_connect_time
55
+ on: azure_monitor.application_gateway.backend_latency
56
+ class: Latency
57
+ type: Web Server
58
+component: Application Gateway
59
+ lookup: average -5m unaligned of connect
60
+ units: milliseconds
61
+ every: 1m
62
+ warn: $this > (($status >= $WARNING) ? (100) : (250))
63
+ crit: $this > (($status == $CRITICAL) ? (250) : (500))
64
+ delay: down 5m multiplier 1.5 max 1h
65
+ summary: App Gateway backend connect time on ${label:resource_name}
66
+ info: Average backend connection time on Application Gateway ${label:resource_name} \
67
+ in ${label:resource_group} (${label:region})
68
+ to: sysadmin
69
+
70
+# --- Latency: Backend First Byte ---
71
+
72
+ template: am_appgw_backend_first_byte
73
+ on: azure_monitor.application_gateway.backend_latency
74
+ class: Latency
75
+ type: Web Server
76
+component: Application Gateway
77
+ lookup: average -5m unaligned of first_byte
78
+ units: milliseconds
79
+ every: 1m
80
+ warn: $this > (($status >= $WARNING) ? (2000) : (4000))
81
+ crit: $this > (($status == $CRITICAL) ? (4000) : (8000))
82
+ delay: down 5m multiplier 1.5 max 1h
83
+ summary: App Gateway backend TTFB on ${label:resource_name}
84
+ info: Average backend time to first byte on Application Gateway ${label:resource_name} \
85
+ in ${label:resource_group} (${label:region})
86
+ to: sysadmin
87
+
88
+# --- Latency: Total Client Request Time ---
89
+
90
+ template: am_appgw_total_time
91
+ on: azure_monitor.application_gateway.client_latency
92
+ class: Latency
93
+ type: Web Server
94
+component: Application Gateway
95
+ lookup: average -5m unaligned of total_time
96
+ units: milliseconds
97
+ every: 1m
98
+ warn: $this > (($status >= $WARNING) ? (3000) : (5000))
99
+ crit: $this > (($status == $CRITICAL) ? (5000) : (10000))
100
+ delay: down 5m multiplier 1.5 max 1h
101
+ summary: App Gateway total request time on ${label:resource_name}
102
+ info: Average total client request time on Application Gateway ${label:resource_name} \
103
+ in ${label:resource_group} (${label:region})
104
+ to: sysadmin
105
+
106
+# --- Utilization: CPU ---
107
+
108
+ template: am_appgw_cpu_utilization
109
+ on: azure_monitor.application_gateway.cpu
110
+ class: Utilization
111
+ type: Web Server
112
+component: Application Gateway
113
+ lookup: average -5m unaligned of average
114
+ units: percentage
115
+ every: 1m
116
+ warn: $this > (($status >= $WARNING) ? (75) : (85))
117
+ crit: $this > (($status == $CRITICAL) ? (85) : (95))
118
+ delay: down 5m multiplier 1.5 max 1h
119
+ summary: App Gateway CPU utilization on ${label:resource_name}
120
+ info: CPU utilization on Application Gateway ${label:resource_name} \
121
+ in ${label:resource_group} (${label:region})
122
+ to: sysadmin
123
+
124
+# --- Errors: WAF Blocked Request Ratio ---
125
+
126
+# helper: total WAF requests over 5m (no alarm, value only)
127
+ template: am_appgw_waf_total_requests
128
+ on: azure_monitor.application_gateway.waf_requests
129
+ class: Workload
130
+ type: Web Server
131
+component: Application Gateway
132
+ lookup: sum -5m unaligned of total
133
+ units: requests/s
134
+ every: 1m
135
+ info: Total WAF requests on Application Gateway ${label:resource_name}
136
+
137
+# WAF blocked ratio — fires only when WAF has meaningful traffic
138
+ template: am_appgw_waf_blocked_ratio
139
+ on: azure_monitor.application_gateway.waf_requests
140
+ class: Errors
141
+ type: Web Server
142
+component: Application Gateway
143
+ lookup: sum -5m unaligned of blocked
144
+ calc: ($am_appgw_waf_total_requests > 10) ? ($this * 100 / $am_appgw_waf_total_requests) : (0)
145
+ units: %
146
+ every: 1m
147
+ warn: $this != nan AND $this > (($status >= $WARNING) ? (25) : (50))
148
+ delay: down 5m multiplier 1.5 max 1h
149
+ summary: App Gateway WAF block ratio on ${label:resource_name}
150
+ info: Percentage of requests blocked by WAF on Application Gateway ${label:resource_name} \
151
+ in ${label:resource_group} (${label:region}). \
152
+ High values may indicate an attack or WAF misconfiguration
153
+ to: sysadmin
src/health/health.d/azure_monitor_application_insights.conf
new
+269
@@ -0,0 +1,269 @@
1
+# you can disable an alarm notification by setting the 'to' line to: silent
2
+
3
+# ── Availability ─────────────────────────────────────────────────────────────
4
+
5
+ template: am_appinsights_availability
6
+ on: azure_monitor.application_insights.availability_percentage
7
+ class: Availability
8
+ type: Other
9
+component: Application Insights
10
+ lookup: average -5m unaligned of average
11
+ units: percentage
12
+ every: 1m
13
+ warn: $this < (($status >= $WARNING) ? (99.9) : (99))
14
+ crit: $this < (($status == $CRITICAL) ? (99) : (90))
15
+ delay: down 5m multiplier 1.5 max 1h
16
+ summary: App Insights availability on ${label:resource_name}
17
+ info: Availability test success rate for Application Insights resource ${label:resource_name} \
18
+ in ${label:resource_group} (${label:region})
19
+ to: sysadmin
20
+
21
+ template: am_appinsights_availability_duration
22
+ on: azure_monitor.application_insights.availability_duration
23
+ class: Latency
24
+ type: Other
25
+component: Application Insights
26
+ lookup: average -5m unaligned of average
27
+ units: milliseconds
28
+ every: 1m
29
+ warn: $this > (($status >= $WARNING) ? (3000) : (5000))
30
+ crit: $this > (($status == $CRITICAL) ? (5000) : (10000))
31
+ delay: down 5m multiplier 1.5 max 1h
32
+ summary: App Insights availability test duration on ${label:resource_name}
33
+ info: Average availability test duration for Application Insights resource ${label:resource_name} \
34
+ in ${label:resource_group} (${label:region})
35
+ to: sysadmin
36
+
37
+# ── Server Requests ──────────────────────────────────────────────────────────
38
+
39
+# Helper: total request rate over 5 minutes (used for minimum-data guard)
40
+ template: am_appinsights_request_rate
41
+ on: azure_monitor.application_insights.server_requests
42
+ class: Workload
43
+ type: Other
44
+component: Application Insights
45
+ lookup: average -5m unaligned of total
46
+ units: requests/s
47
+ every: 1m
48
+ summary: App Insights request rate on ${label:resource_name}
49
+ info: Average server request rate for Application Insights resource ${label:resource_name} \
50
+ in ${label:resource_group} (${label:region})
51
+ to: silent
52
+
53
+ template: am_appinsights_failed_requests
54
+ on: azure_monitor.application_insights.server_requests
55
+ class: Errors
56
+ type: Other
57
+component: Application Insights
58
+ lookup: average -5m unaligned percentage of failed
59
+ units: %
60
+ every: 1m
61
+ warn: ($am_appinsights_request_rate > 0.5) ? ($this > (($status >= $WARNING) ? (3) : (5))) : (0)
62
+ crit: ($am_appinsights_request_rate > 0.5) ? ($this > (($status == $CRITICAL) ? (10) : (15))) : (0)
63
+ delay: down 5m multiplier 1.5 max 1h
64
+ summary: App Insights failed requests on ${label:resource_name}
65
+ info: Percentage of failed server requests for Application Insights resource ${label:resource_name} \
66
+ in ${label:resource_group} (${label:region})
67
+ to: sysadmin
68
+
69
+ template: am_appinsights_response_time
70
+ on: azure_monitor.application_insights.server_response_time
71
+ class: Latency
72
+ type: Other
73
+component: Application Insights
74
+ lookup: average -5m unaligned of average
75
+ units: milliseconds
76
+ every: 1m
77
+ warn: $this > (($status >= $WARNING) ? (3000) : (5000))
78
+ crit: $this > (($status == $CRITICAL) ? (5000) : (10000))
79
+ delay: down 5m multiplier 1.5 max 1h
80
+ summary: App Insights server response time on ${label:resource_name}
81
+ info: Average server response time for Application Insights resource ${label:resource_name} \
82
+ in ${label:resource_group} (${label:region})
83
+ to: sysadmin
84
+
85
+# ── Dependencies ─────────────────────────────────────────────────────────────
86
+
87
+# Helper: total dependency call rate over 5 minutes
88
+ template: am_appinsights_dependency_rate
89
+ on: azure_monitor.application_insights.dependency_calls
90
+ class: Workload
91
+ type: Other
92
+component: Application Insights
93
+ lookup: average -5m unaligned of total
94
+ units: calls/s
95
+ every: 1m
96
+ summary: App Insights dependency call rate on ${label:resource_name}
97
+ info: Average dependency call rate for Application Insights resource ${label:resource_name} \
98
+ in ${label:resource_group} (${label:region})
99
+ to: silent
100
+
101
+ template: am_appinsights_failed_dependencies
102
+ on: azure_monitor.application_insights.dependency_calls
103
+ class: Errors
104
+ type: Other
105
+component: Application Insights
106
+ lookup: average -5m unaligned percentage of failed
107
+ units: %
108
+ every: 1m
109
+ warn: ($am_appinsights_dependency_rate > 0.5) ? ($this > (($status >= $WARNING) ? (5) : (10))) : (0)
110
+ crit: ($am_appinsights_dependency_rate > 0.5) ? ($this > (($status == $CRITICAL) ? (15) : (25))) : (0)
111
+ delay: down 5m multiplier 1.5 max 1h
112
+ summary: App Insights failed dependencies on ${label:resource_name}
113
+ info: Percentage of failed dependency calls for Application Insights resource ${label:resource_name} \
114
+ in ${label:resource_group} (${label:region})
115
+ to: sysadmin
116
+
117
+ template: am_appinsights_dependency_duration
118
+ on: azure_monitor.application_insights.dependency_duration
119
+ class: Latency
120
+ type: Other
121
+component: Application Insights
122
+ lookup: average -5m unaligned of average
123
+ units: milliseconds
124
+ every: 1m
125
+ warn: $this > (($status >= $WARNING) ? (3000) : (5000))
126
+ crit: $this > (($status == $CRITICAL) ? (5000) : (10000))
127
+ delay: down 5m multiplier 1.5 max 1h
128
+ summary: App Insights dependency duration on ${label:resource_name}
129
+ info: Average dependency call duration for Application Insights resource ${label:resource_name} \
130
+ in ${label:resource_group} (${label:region})
131
+ to: sysadmin
132
+
133
+# ── Exceptions ───────────────────────────────────────────────────────────────
134
+
135
+ template: am_appinsights_exception_rate
136
+ on: azure_monitor.application_insights.exception_rate
137
+ class: Errors
138
+ type: Other
139
+component: Application Insights
140
+ lookup: average -5m unaligned of average
141
+ units: exceptions/s
142
+ every: 1m
143
+ warn: $this != nan AND $this > (($status >= $WARNING) ? (5) : (10))
144
+ crit: $this != nan AND $this > (($status == $CRITICAL) ? (25) : (50))
145
+ delay: down 5m multiplier 1.5 max 1h
146
+ summary: App Insights exception rate on ${label:resource_name}
147
+ info: Server exception rate for Application Insights resource ${label:resource_name} \
148
+ in ${label:resource_group} (${label:region})
149
+ to: sysadmin
150
+
151
+ template: am_appinsights_server_exceptions
152
+ on: azure_monitor.application_insights.exceptions
153
+ class: Errors
154
+ type: Other
155
+component: Application Insights
156
+ lookup: average -5m unaligned of server
157
+ units: exceptions/s
158
+ every: 1m
159
+ warn: $this != nan AND $this > (($status >= $WARNING) ? (5) : (10))
160
+ crit: $this != nan AND $this > (($status == $CRITICAL) ? (25) : (50))
161
+ delay: down 5m multiplier 1.5 max 1h
162
+ summary: App Insights server exceptions on ${label:resource_name}
163
+ info: Server-side exception rate for Application Insights resource ${label:resource_name} \
164
+ in ${label:resource_group} (${label:region})
165
+ to: sysadmin
166
+
167
+# ── Browser Performance ──────────────────────────────────────────────────────
168
+
169
+ template: am_appinsights_browser_page_load_time
170
+ on: azure_monitor.application_insights.browser_page_load_time
171
+ class: Latency
172
+ type: Other
173
+component: Application Insights
174
+ lookup: average -5m unaligned of total
175
+ units: milliseconds
176
+ every: 1m
177
+ warn: $this != nan AND $this > (($status >= $WARNING) ? (5000) : (10000))
178
+ crit: $this != nan AND $this > (($status == $CRITICAL) ? (10000) : (20000))
179
+ delay: down 5m multiplier 1.5 max 1h
180
+ summary: App Insights browser page load time on ${label:resource_name}
181
+ info: Average browser page load time for Application Insights resource ${label:resource_name} \
182
+ in ${label:resource_group} (${label:region})
183
+ to: sysadmin
184
+
185
+# ── Performance - CPU ────────────────────────────────────────────────────────
186
+
187
+ template: am_appinsights_process_cpu
188
+ on: azure_monitor.application_insights.cpu_utilization
189
+ class: Utilization
190
+ type: Other
191
+component: Application Insights
192
+ lookup: average -5m unaligned of process
193
+ units: percentage
194
+ every: 1m
195
+ warn: $this != nan AND $this > (($status >= $WARNING) ? (75) : (85))
196
+ crit: $this != nan AND $this > (($status == $CRITICAL) ? (85) : (95))
197
+ delay: down 5m multiplier 1.5 max 1h
198
+ summary: App Insights process CPU on ${label:resource_name}
199
+ info: Application process CPU utilization for Application Insights resource ${label:resource_name} \
200
+ in ${label:resource_group} (${label:region})
201
+ to: sysadmin
202
+
203
+ template: am_appinsights_processor_cpu
204
+ on: azure_monitor.application_insights.cpu_utilization
205
+ class: Utilization
206
+ type: Other
207
+component: Application Insights
208
+ lookup: average -5m unaligned of processor
209
+ units: percentage
210
+ every: 1m
211
+ warn: $this != nan AND $this > (($status >= $WARNING) ? (80) : (90))
212
+ crit: $this != nan AND $this > (($status == $CRITICAL) ? (90) : (95))
213
+ delay: down 5m multiplier 1.5 max 1h
214
+ summary: App Insights processor CPU on ${label:resource_name}
215
+ info: Host processor CPU utilization for Application Insights resource ${label:resource_name} \
216
+ in ${label:resource_group} (${label:region})
217
+ to: sysadmin
218
+
219
+# ── Performance - HTTP Pipeline ──────────────────────────────────────────────
220
+
221
+ template: am_appinsights_http_execution_time
222
+ on: azure_monitor.application_insights.http_request_execution_time
223
+ class: Latency
224
+ type: Other
225
+component: Application Insights
226
+ lookup: average -5m unaligned of average
227
+ units: milliseconds
228
+ every: 1m
229
+ warn: $this != nan AND $this > (($status >= $WARNING) ? (3000) : (5000))
230
+ crit: $this != nan AND $this > (($status == $CRITICAL) ? (5000) : (10000))
231
+ delay: down 5m multiplier 1.5 max 1h
232
+ summary: App Insights HTTP execution time on ${label:resource_name}
233
+ info: Average HTTP request execution time for Application Insights resource ${label:resource_name} \
234
+ in ${label:resource_group} (${label:region})
235
+ to: sysadmin
236
+
237
+ template: am_appinsights_http_queue_length
238
+ on: azure_monitor.application_insights.http_request_queue
239
+ class: Utilization
240
+ type: Other
241
+component: Application Insights
242
+ lookup: average -5m unaligned of queued
243
+ units: requests
244
+ every: 1m
245
+ warn: $this != nan AND $this > (($status >= $WARNING) ? (50) : (100))
246
+ crit: $this != nan AND $this > (($status == $CRITICAL) ? (100) : (250))
247
+ delay: down 5m multiplier 1.5 max 1h
248
+ summary: App Insights HTTP request queue on ${label:resource_name}
249
+ info: Number of HTTP requests waiting in the application queue for Application Insights resource \
250
+ ${label:resource_name} in ${label:resource_group} (${label:region})
251
+ to: sysadmin
252
+
253
+# ── Usage - Page Views ───────────────────────────────────────────────────────
254
+
255
+ template: am_appinsights_page_view_load_time
256
+ on: azure_monitor.application_insights.page_view_load_time
257
+ class: Latency
258
+ type: Other
259
+component: Application Insights
260
+ lookup: average -5m unaligned of average
261
+ units: milliseconds
262
+ every: 1m
263
+ warn: $this != nan AND $this > (($status >= $WARNING) ? (5000) : (10000))
264
+ crit: $this != nan AND $this > (($status == $CRITICAL) ? (10000) : (20000))
265
+ delay: down 5m multiplier 1.5 max 1h
266
+ summary: App Insights page view load time on ${label:resource_name}
267
+ info: Average page view load time for Application Insights resource ${label:resource_name} \
268
+ in ${label:resource_group} (${label:region})
269
+ to: sysadmin
src/health/health.d/azure_monitor_cognitive_services.conf
new
+302
@@ -0,0 +1,302 @@
1
+# you can disable an alarm notification by setting the 'to' line to: silent
2
+
3
+# --- Cognitive Services - Availability ---
4
+
5
+ template: am_cognitive_services_availability
6
+ on: azure_monitor.cognitive_services.availability
7
+ class: Availability
8
+ type: Other
9
+component: Cognitive Services
10
+ lookup: average -5m unaligned of availability
11
+ units: percentage
12
+ every: 1m
13
+ warn: $this < (($status >= $WARNING) ? (99.9) : (99))
14
+ crit: $this < (($status == $CRITICAL) ? (99) : (90))
15
+ delay: down 5m multiplier 1.5 max 1h
16
+ summary: Cognitive Services availability on ${label:resource_name}
17
+ info: Success rate of Cognitive Services resource ${label:resource_name} \
18
+ in ${label:resource_group} (${label:region})
19
+ to: sysadmin
20
+
21
+# --- Cognitive Services - Errors ---
22
+
23
+ template: am_cognitive_services_server_errors
24
+ on: azure_monitor.cognitive_services.errors
25
+ class: Errors
26
+ type: Other
27
+component: Cognitive Services
28
+ lookup: average -5m unaligned of server
29
+ units: errors/s
30
+ every: 1m
31
+ warn: $this > (($status >= $WARNING) ? (1) : (5))
32
+ crit: $this > (($status == $CRITICAL) ? (5) : (20))
33
+ delay: down 5m multiplier 1.5 max 1h
34
+ summary: Cognitive Services server errors on ${label:resource_name}
35
+ info: Rate of server errors (5xx) from Cognitive Services resource ${label:resource_name} \
36
+ in ${label:resource_group} (${label:region})
37
+ to: sysadmin
38
+
39
+ template: am_cognitive_services_client_errors
40
+ on: azure_monitor.cognitive_services.errors
41
+ class: Errors
42
+ type: Other
43
+component: Cognitive Services
44
+ lookup: average -5m unaligned of client
45
+ units: errors/s
46
+ every: 1m
47
+ warn: $this > (($status >= $WARNING) ? (10) : (50))
48
+ delay: down 5m multiplier 1.5 max 1h
49
+ summary: Cognitive Services client errors on ${label:resource_name}
50
+ info: Rate of client errors (4xx) from Cognitive Services resource ${label:resource_name} \
51
+ in ${label:resource_group} (${label:region}). \
52
+ High client error rates may indicate misconfigured API calls or invalid requests
53
+ to: sysadmin
54
+
55
+# --- Cognitive Services - Latency ---
56
+
57
+ template: am_cognitive_services_latency
58
+ on: azure_monitor.cognitive_services.latency
59
+ class: Latency
60
+ type: Other
61
+component: Cognitive Services
62
+ lookup: average -5m unaligned of average
63
+ units: milliseconds
64
+ every: 1m
65
+ warn: $this > (($status >= $WARNING) ? (3000) : (5000))
66
+ crit: $this > (($status == $CRITICAL) ? (5000) : (10000))
67
+ delay: down 5m multiplier 1.5 max 1h
68
+ summary: Cognitive Services latency on ${label:resource_name}
69
+ info: Average API latency of Cognitive Services resource ${label:resource_name} \
70
+ in ${label:resource_group} (${label:region})
71
+ to: sysadmin
72
+
73
+# --- Cognitive Services - Rate Limiting ---
74
+
75
+ template: am_cognitive_services_rate_limit
76
+ on: azure_monitor.cognitive_services.rate_limit
77
+ class: Workload
78
+ type: Other
79
+component: Cognitive Services
80
+ lookup: average -5m unaligned of rate_limit
81
+ units: requests/s
82
+ every: 1m
83
+ warn: $this > (($status >= $WARNING) ? (1) : (5))
84
+ crit: $this > (($status == $CRITICAL) ? (5) : (20))
85
+ delay: down 5m multiplier 1.5 max 1h
86
+ summary: Cognitive Services rate limiting on ${label:resource_name}
87
+ info: Rate of throttled requests due to rate limiting on Cognitive Services resource ${label:resource_name} \
88
+ in ${label:resource_group} (${label:region}). \
89
+ Indicates the service is hitting its API call quota
90
+ to: sysadmin
91
+
92
+# --- Cognitive Services - Blocked Calls ---
93
+
94
+ template: am_cognitive_services_blocked_calls
95
+ on: azure_monitor.cognitive_services.calls
96
+ class: Errors
97
+ type: Other
98
+component: Cognitive Services
99
+ lookup: average -5m unaligned of blocked
100
+ units: calls/s
101
+ every: 1m
102
+ warn: $this > (($status >= $WARNING) ? (0) : (5))
103
+ crit: $this > (($status == $CRITICAL) ? (5) : (20))
104
+ delay: down 5m multiplier 1.5 max 1h
105
+ summary: Cognitive Services blocked calls on ${label:resource_name}
106
+ info: Rate of blocked API calls on Cognitive Services resource ${label:resource_name} \
107
+ in ${label:resource_group} (${label:region}). \
108
+ Blocked calls indicate authorization or policy violations
109
+ to: sysadmin
110
+
111
+# --- Azure OpenAI - Availability ---
112
+
113
+ template: am_cognitive_services_openai_availability
114
+ on: azure_monitor.cognitive_services.openai_availability
115
+ class: Availability
116
+ type: Other
117
+component: Cognitive Services
118
+ lookup: average -5m unaligned of availability
119
+ units: percentage
120
+ every: 1m
121
+ warn: $this != nan AND $this < (($status >= $WARNING) ? (99.9) : (99))
122
+ crit: $this != nan AND $this < (($status == $CRITICAL) ? (99) : (90))
123
+ delay: down 5m multiplier 1.5 max 1h
124
+ summary: Azure OpenAI availability on ${label:resource_name}
125
+ info: Availability rate of Azure OpenAI service on ${label:resource_name} \
126
+ in ${label:resource_group} (${label:region})
127
+ to: sysadmin
128
+
129
+# --- Azure OpenAI - Latency ---
130
+
131
+ template: am_cognitive_services_openai_time_to_response
132
+ on: azure_monitor.cognitive_services.openai_latency
133
+ class: Latency
134
+ type: Other
135
+component: Cognitive Services
136
+ lookup: average -5m unaligned of time_to_response
137
+ units: milliseconds
138
+ every: 1m
139
+ warn: $this != nan AND $this > (($status >= $WARNING) ? (5000) : (10000))
140
+ crit: $this != nan AND $this > (($status == $CRITICAL) ? (10000) : (30000))
141
+ delay: down 5m multiplier 1.5 max 1h
142
+ summary: Azure OpenAI time to response on ${label:resource_name}
143
+ info: Average time to response for Azure OpenAI requests on ${label:resource_name} \
144
+ in ${label:resource_group} (${label:region})
145
+ to: sysadmin
146
+
147
+ template: am_cognitive_services_openai_time_to_first_token
148
+ on: azure_monitor.cognitive_services.openai_latency
149
+ class: Latency
150
+ type: Other
151
+component: Cognitive Services
152
+ lookup: average -5m unaligned of time_to_first_token
153
+ units: milliseconds
154
+ every: 1m
155
+ warn: $this != nan AND $this > (($status >= $WARNING) ? (3000) : (5000))
156
+ crit: $this != nan AND $this > (($status == $CRITICAL) ? (5000) : (10000))
157
+ delay: down 5m multiplier 1.5 max 1h
158
+ summary: Azure OpenAI time to first token on ${label:resource_name}
159
+ info: Average normalized time to first token for Azure OpenAI requests on ${label:resource_name} \
160
+ in ${label:resource_group} (${label:region})
161
+ to: sysadmin
162
+
163
+# --- Azure OpenAI - Provisioned Utilization ---
164
+
165
+ template: am_cognitive_services_openai_provisioned_utilization
166
+ on: azure_monitor.cognitive_services.openai_provisioned_utilization
167
+ class: Utilization
168
+ type: Other
169
+component: Cognitive Services
170
+ lookup: average -5m unaligned of utilization
171
+ units: percentage
172
+ every: 1m
173
+ warn: $this != nan AND $this > (($status >= $WARNING) ? (70) : (80))
174
+ crit: $this != nan AND $this > (($status == $CRITICAL) ? (80) : (90))
175
+ delay: down 5m multiplier 1.5 max 1h
176
+ summary: Azure OpenAI provisioned utilization on ${label:resource_name}
177
+ info: Provisioned-managed utilization of Azure OpenAI deployment on ${label:resource_name} \
178
+ in ${label:resource_group} (${label:region}). \
179
+ High utilization means requests may be throttled or rejected
180
+ to: sysadmin
181
+
182
+# --- Models - Availability ---
183
+
184
+ template: am_cognitive_services_model_availability
185
+ on: azure_monitor.cognitive_services.model_availability
186
+ class: Availability
187
+ type: Other
188
+component: Cognitive Services
189
+ lookup: average -5m unaligned of availability
190
+ units: percentage
191
+ every: 1m
192
+ warn: $this != nan AND $this < (($status >= $WARNING) ? (99.9) : (99))
193
+ crit: $this != nan AND $this < (($status == $CRITICAL) ? (99) : (90))
194
+ delay: down 5m multiplier 1.5 max 1h
195
+ summary: Model availability on ${label:resource_name}
196
+ info: Model availability rate on Cognitive Services resource ${label:resource_name} \
197
+ in ${label:resource_group} (${label:region})
198
+ to: sysadmin
199
+
200
+# --- Models - Latency ---
201
+
202
+ template: am_cognitive_services_model_time_to_response
203
+ on: azure_monitor.cognitive_services.model_latency
204
+ class: Latency
205
+ type: Other
206
+component: Cognitive Services
207
+ lookup: average -5m unaligned of time_to_response
208
+ units: milliseconds
209
+ every: 1m
210
+ warn: $this != nan AND $this > (($status >= $WARNING) ? (5000) : (10000))
211
+ crit: $this != nan AND $this > (($status == $CRITICAL) ? (10000) : (30000))
212
+ delay: down 5m multiplier 1.5 max 1h
213
+ summary: Model time to response on ${label:resource_name}
214
+ info: Average time to response for model requests on Cognitive Services resource ${label:resource_name} \
215
+ in ${label:resource_group} (${label:region})
216
+ to: sysadmin
217
+
218
+ template: am_cognitive_services_model_time_to_first_token
219
+ on: azure_monitor.cognitive_services.model_latency
220
+ class: Latency
221
+ type: Other
222
+component: Cognitive Services
223
+ lookup: average -5m unaligned of time_to_first_token
224
+ units: milliseconds
225
+ every: 1m
226
+ warn: $this != nan AND $this > (($status >= $WARNING) ? (3000) : (5000))
227
+ crit: $this != nan AND $this > (($status == $CRITICAL) ? (5000) : (10000))
228
+ delay: down 5m multiplier 1.5 max 1h
229
+ summary: Model time to first token on ${label:resource_name}
230
+ info: Average normalized time to first token for model requests on Cognitive Services resource ${label:resource_name} \
231
+ in ${label:resource_group} (${label:region})
232
+ to: sysadmin
233
+
234
+# --- Models - Provisioned Utilization ---
235
+
236
+ template: am_cognitive_services_model_provisioned_utilization
237
+ on: azure_monitor.cognitive_services.model_provisioned_utilization
238
+ class: Utilization
239
+ type: Other
240
+component: Cognitive Services
241
+ lookup: average -5m unaligned of utilization
242
+ units: percentage
243
+ every: 1m
244
+ warn: $this != nan AND $this > (($status >= $WARNING) ? (70) : (80))
245
+ crit: $this != nan AND $this > (($status == $CRITICAL) ? (80) : (90))
246
+ delay: down 5m multiplier 1.5 max 1h
247
+ summary: Model provisioned utilization on ${label:resource_name}
248
+ info: Provisioned utilization of model deployment on Cognitive Services resource ${label:resource_name} \
249
+ in ${label:resource_group} (${label:region}). \
250
+ High utilization means requests may be throttled or rejected
251
+ to: sysadmin
252
+
253
+# --- Content Safety - Harmful Requests ---
254
+
255
+ template: am_cognitive_services_harmful_requests
256
+ on: azure_monitor.cognitive_services.content_safety_requests
257
+ class: Errors
258
+ type: Other
259
+component: Cognitive Services
260
+ lookup: average -5m unaligned of harmful
261
+ units: requests/s
262
+ every: 1m
263
+ warn: $this != nan AND $this > (($status >= $WARNING) ? (1) : (5))
264
+ crit: $this != nan AND $this > (($status == $CRITICAL) ? (5) : (20))
265
+ delay: down 5m multiplier 1.5 max 1h
266
+ summary: Harmful content requests on ${label:resource_name}
267
+ info: Rate of requests flagged as harmful by content safety on Cognitive Services resource ${label:resource_name} \
268
+ in ${label:resource_group} (${label:region}). \
269
+ High rates may indicate abuse or prompt injection attempts
270
+ to: sysadmin
271
+
272
+ template: am_cognitive_services_blocked_content_requests
273
+ on: azure_monitor.cognitive_services.content_safety_requests
274
+ class: Errors
275
+ type: Other
276
+component: Cognitive Services
277
+ lookup: average -5m unaligned of blocked
278
+ units: requests/s
279
+ every: 1m
280
+ warn: $this != nan AND $this > (($status >= $WARNING) ? (1) : (10))
281
+ delay: down 5m multiplier 1.5 max 1h
282
+ summary: Blocked content requests on ${label:resource_name}
283
+ info: Rate of requests rejected by content safety on Cognitive Services resource ${label:resource_name} \
284
+ in ${label:resource_group} (${label:region})
285
+ to: sysadmin
286
+
287
+# --- Content Safety - Abusive Users ---
288
+
289
+ template: am_cognitive_services_abusive_users
290
+ on: azure_monitor.cognitive_services.content_safety_abusive_users
291
+ class: Errors
292
+ type: Other
293
+component: Cognitive Services
294
+ lookup: average -5m unaligned of abusive_users
295
+ units: users/s
296
+ every: 1m
297
+ warn: $this != nan AND $this > (($status >= $WARNING) ? (0) : (1))
298
+ delay: down 5m multiplier 1.5 max 1h
299
+ summary: Abusive users detected on ${label:resource_name}
300
+ info: Rate of potentially abusive users detected on Cognitive Services resource ${label:resource_name} \
301
+ in ${label:resource_group} (${label:region})
302
+ to: sysadmin
src/health/health.d/azure_monitor_container_apps.conf
new
+195
@@ -0,0 +1,195 @@
1
+# you can disable an alarm notification by setting the 'to' line to: silent
2
+
3
+# CPU utilization
4
+
5
+ template: am_container_apps_cpu_utilization
6
+ on: azure_monitor.container_apps.cpu_percentage
7
+ class: Utilization
8
+ type: Containers
9
+component: Container Apps
10
+ lookup: average -5m unaligned of average
11
+ units: percentage
12
+ every: 1m
13
+ warn: $this > (($status >= $WARNING) ? (75) : (85))
14
+ crit: $this > (($status == $CRITICAL) ? (85) : (95))
15
+ delay: down 5m multiplier 1.5 max 1h
16
+ summary: Container Apps CPU on ${label:resource_name}
17
+ info: Average CPU utilization of Container App ${label:resource_name} \
18
+ in ${label:resource_group} (${label:region})
19
+ to: sysadmin
20
+
21
+# Memory utilization
22
+
23
+ template: am_container_apps_memory_utilization
24
+ on: azure_monitor.container_apps.memory_percentage
25
+ class: Utilization
26
+ type: Containers
27
+component: Container Apps
28
+ lookup: average -5m unaligned of average
29
+ units: percentage
30
+ every: 1m
31
+ warn: $this > (($status >= $WARNING) ? (75) : (85))
32
+ crit: $this > (($status == $CRITICAL) ? (85) : (95))
33
+ delay: down 5m multiplier 1.5 max 1h
34
+ summary: Container Apps memory on ${label:resource_name}
35
+ info: Average memory utilization of Container App ${label:resource_name} \
36
+ in ${label:resource_group} (${label:region})
37
+ to: sysadmin
38
+
39
+# Replica restarts
40
+
41
+ template: am_container_apps_restarts
42
+ on: azure_monitor.container_apps.restart_count
43
+ class: Errors
44
+ type: Containers
45
+component: Container Apps
46
+ lookup: sum -5m unaligned of restarts
47
+ units: restarts
48
+ every: 1m
49
+ warn: $this > (($status >= $WARNING) ? (3) : (5))
50
+ crit: $this > (($status == $CRITICAL) ? (10) : (15))
51
+ delay: down 5m multiplier 1.5 max 1h
52
+ summary: Container Apps restarts on ${label:resource_name}
53
+ info: Number of replica restarts in the last 5 minutes for Container App ${label:resource_name} \
54
+ in ${label:resource_group} (${label:region})
55
+ to: sysadmin
56
+
57
+# Response time (latency)
58
+
59
+ template: am_container_apps_response_time
60
+ on: azure_monitor.container_apps.response_time
61
+ class: Latency
62
+ type: Containers
63
+component: Container Apps
64
+ lookup: average -5m unaligned of average
65
+ units: milliseconds
66
+ every: 1m
67
+ warn: $this != nan AND $this > (($status >= $WARNING) ? (3000) : (5000))
68
+ crit: $this != nan AND $this > (($status == $CRITICAL) ? (5000) : (10000))
69
+ delay: down 5m multiplier 1.5 max 1h
70
+ summary: Container Apps response time on ${label:resource_name}
71
+ info: Average response time of Container App ${label:resource_name} \
72
+ in ${label:resource_group} (${label:region})
73
+ to: sysadmin
74
+
75
+# Resiliency - timeouts
76
+
77
+ template: am_container_apps_resiliency_timeouts
78
+ on: azure_monitor.container_apps.resiliency_timeouts
79
+ class: Errors
80
+ type: Containers
81
+component: Container Apps
82
+ lookup: sum -5m unaligned
83
+ units: timeouts
84
+ every: 1m
85
+ warn: $this != nan AND $this > (($status >= $WARNING) ? (3) : (5))
86
+ crit: $this != nan AND $this > (($status == $CRITICAL) ? (10) : (20))
87
+ delay: down 5m multiplier 1.5 max 1h
88
+ summary: Container Apps resiliency timeouts on ${label:resource_name}
89
+ info: Connection and request timeouts in the last 5 minutes for Container App ${label:resource_name} \
90
+ in ${label:resource_group} (${label:region})
91
+ to: sysadmin
92
+
93
+# Resiliency - retries
94
+
95
+ template: am_container_apps_resiliency_retries
96
+ on: azure_monitor.container_apps.resiliency_retries
97
+ class: Errors
98
+ type: Containers
99
+component: Container Apps
100
+ lookup: sum -5m unaligned of retries
101
+ units: retries
102
+ every: 1m
103
+ warn: $this != nan AND $this > (($status >= $WARNING) ? (10) : (20))
104
+ delay: down 5m multiplier 1.5 max 1h
105
+ summary: Container Apps resiliency retries on ${label:resource_name}
106
+ info: Request retries in the last 5 minutes for Container App ${label:resource_name} \
107
+ in ${label:resource_group} (${label:region})
108
+ to: sysadmin
109
+
110
+# Resiliency - pending connection pool
111
+
112
+ template: am_container_apps_pending_connections
113
+ on: azure_monitor.container_apps.resiliency_pending_connections
114
+ class: Workload
115
+ type: Containers
116
+component: Container Apps
117
+ lookup: sum -5m unaligned of pending
118
+ units: requests
119
+ every: 1m
120
+ warn: $this != nan AND $this > (($status >= $WARNING) ? (50) : (100))
121
+ delay: down 5m multiplier 1.5 max 1h
122
+ summary: Container Apps pending connections on ${label:resource_name}
123
+ info: Requests pending in the connection pool in the last 5 minutes for Container App ${label:resource_name} \
124
+ in ${label:resource_group} (${label:region})
125
+ to: sysadmin
126
+
127
+# Resiliency - host ejections
128
+
129
+ template: am_container_apps_host_ejections
130
+ on: azure_monitor.container_apps.resiliency_ejections
131
+ class: Errors
132
+ type: Containers
133
+component: Container Apps
134
+ lookup: sum -5m unaligned of ejected
135
+ units: ejections
136
+ every: 1m
137
+ warn: $this != nan AND $this > (($status >= $WARNING) ? (0) : (1))
138
+ delay: down 5m multiplier 1.5 max 1h
139
+ summary: Container Apps host ejections on ${label:resource_name}
140
+ info: Upstream hosts ejected from the load balancing pool in the last 5 minutes for Container App ${label:resource_name} \
141
+ in ${label:resource_group} (${label:region})
142
+ to: sysadmin
143
+
144
+# Replica count — zero replicas means the app is scaled down or crashed
145
+
146
+ template: am_container_apps_replica_count
147
+ on: azure_monitor.container_apps.replicas
148
+ class: Availability
149
+ type: Containers
150
+component: Container Apps
151
+ lookup: average -5m unaligned of average
152
+ units: replicas
153
+ every: 1m
154
+ crit: $this != nan AND $this < 1
155
+ delay: down 5m multiplier 1.5 max 1h
156
+ summary: Container Apps replicas on ${label:resource_name}
157
+ info: Average replica count for Container App ${label:resource_name} \
158
+ in ${label:resource_group} (${label:region}). \
159
+ Zero replicas means the app is either scaled to zero or all replicas have crashed
160
+ to: sysadmin
161
+
162
+# GPU utilization (optional - only present when GPU workload profiles are used)
163
+
164
+ template: am_container_apps_gpu_utilization
165
+ on: azure_monitor.container_apps.gpu_utilization
166
+ class: Utilization
167
+ type: Containers
168
+component: Container Apps
169
+ lookup: average -5m unaligned of average
170
+ units: percentage
171
+ every: 1m
172
+ warn: $this != nan AND $this > (($status >= $WARNING) ? (85) : (95))
173
+ delay: down 5m multiplier 1.5 max 1h
174
+ summary: Container Apps GPU on ${label:resource_name}
175
+ info: Average GPU utilization of Container App ${label:resource_name} \
176
+ in ${label:resource_group} (${label:region})
177
+ to: sysadmin
178
+
179
+# JVM GC duration (optional - only present for Java workloads)
180
+
181
+ template: am_container_apps_jvm_gc_duration
182
+ on: azure_monitor.container_apps.jvm_gc_duration
183
+ class: Latency
184
+ type: Containers
185
+component: Container Apps
186
+ lookup: sum -1m unaligned of duration
187
+ units: milliseconds
188
+ every: 1m
189
+ warn: $this != nan AND $this > (($status >= $WARNING) ? (3000) : (5000))
190
+ crit: $this != nan AND $this > (($status == $CRITICAL) ? (5000) : (10000))
191
+ delay: down 5m multiplier 1.5 max 1h
192
+ summary: Container Apps JVM GC duration on ${label:resource_name}
193
+ info: Time spent in JVM garbage collection in the last minute for Container App ${label:resource_name} \
194
+ in ${label:resource_group} (${label:region})
195
+ to: sysadmin
src/health/health.d/azure_monitor_container_instances.conf
new
+76
@@ -0,0 +1,76 @@
1
+# you can disable an alarm notification by setting the 'to' line to: silent
2
+
3
+# --- CPU ---
4
+# CPU usage in millicores. Default thresholds assume a 1 vCPU (1000 millicores) allocation.
5
+# Adjust warn/crit values to match your container group CPU allocation:
6
+# 2 vCPU = 2000 millicores, 4 vCPU = 4000 millicores, etc.
7
+
8
+ template: am_container_instances_cpu_usage
9
+ on: azure_monitor.container_instances.cpu_usage
10
+ class: Utilization
11
+ type: Containers
12
+component: Azure Container Instances
13
+ lookup: average -5m unaligned of average
14
+ units: millicores
15
+ every: 1m
16
+ warn: $this > (($status >= $WARNING) ? (850) : (900))
17
+ crit: $this > (($status == $CRITICAL) ? (900) : (950))
18
+ delay: down 5m multiplier 1.5 max 1h
19
+ summary: Container CPU on ${label:resource_name}
20
+ info: Average CPU usage of container group ${label:resource_name} \
21
+ in ${label:resource_group} (${label:region})
22
+ to: sysadmin
23
+
24
+# --- Memory ---
25
+# Memory usage in bytes. Default thresholds assume a 1.5 GiB memory allocation.
26
+# Adjust warn/crit values to match your container group memory allocation.
27
+# 1.5 GiB: warn ~1.3 GiB (1395864371), crit ~1.4 GiB (1503238553)
28
+# 4.0 GiB: warn ~3.4 GiB (3650722201), crit ~3.6 GiB (3865470566)
29
+
30
+ template: am_container_instances_memory_usage
31
+ on: azure_monitor.container_instances.memory_usage
32
+ class: Utilization
33
+ type: Containers
34
+component: Azure Container Instances
35
+ lookup: average -5m unaligned of average
36
+ units: bytes
37
+ every: 1m
38
+ warn: $this > (($status >= $WARNING) ? (1288490189) : (1395864371))
39
+ crit: $this > (($status == $CRITICAL) ? (1395864371) : (1503238553))
40
+ delay: down 5m multiplier 1.5 max 1h
41
+ summary: Container memory on ${label:resource_name}
42
+ info: Average memory usage of container group ${label:resource_name} \
43
+ in ${label:resource_group} (${label:region})
44
+ to: sysadmin
45
+
46
+# --- Network ---
47
+
48
+ template: am_container_instances_network_rx
49
+ on: azure_monitor.container_instances.network
50
+ class: Workload
51
+ type: Containers
52
+component: Azure Container Instances
53
+ lookup: average -5m unaligned of received
54
+ units: bytes/s
55
+ every: 1m
56
+ warn: $this > (($status >= $WARNING) ? (100000000) : (125000000))
57
+ delay: down 5m multiplier 1.5 max 1h
58
+ summary: Container inbound traffic on ${label:resource_name}
59
+ info: High inbound network traffic on container group ${label:resource_name} \
60
+ in ${label:resource_group} (${label:region})
61
+ to: sysadmin
62
+
63
+ template: am_container_instances_network_tx
64
+ on: azure_monitor.container_instances.network
65
+ class: Workload
66
+ type: Containers
67
+component: Azure Container Instances
68
+ lookup: average -5m unaligned of sent
69
+ units: bytes/s
70
+ every: 1m
71
+ warn: $this > (($status >= $WARNING) ? (100000000) : (125000000))
72
+ delay: down 5m multiplier 1.5 max 1h
73
+ summary: Container outbound traffic on ${label:resource_name}
74
+ info: High outbound network traffic on container group ${label:resource_name} \
75
+ in ${label:resource_group} (${label:region})
76
+ to: sysadmin
src/health/health.d/azure_monitor_container_registry.conf
new
+63
@@ -0,0 +1,63 @@
1
+# you can disable an alarm notification by setting the 'to' line to: silent
2
+
3
+# helper: total pull rate over 5 minutes (used as denominator for failure ratio)
4
+
5
+ template: am_container_registry_pull_total
6
+ on: azure_monitor.container_registry.pull_count
7
+ class: Workload
8
+ type: Containers
9
+component: Azure ACR
10
+ lookup: average -5m unaligned of total
11
+ units: pulls/s
12
+ every: 1m
13
+ info: Total image pull rate on ACR ${label:resource_name}
14
+
15
+# Pull failure ratio: fires only when there is meaningful pull traffic
16
+
17
+ template: am_container_registry_pull_failures
18
+ on: azure_monitor.container_registry.pull_count
19
+ class: Errors
20
+ type: Containers
21
+component: Azure ACR
22
+ lookup: average -5m unaligned of successful
23
+ calc: ($am_container_registry_pull_total > 0.01) ? (($am_container_registry_pull_total - $this) * 100 / $am_container_registry_pull_total) : (0)
24
+ units: %
25
+ every: 1m
26
+ warn: $this > (($status >= $WARNING) ? (1) : (5))
27
+ crit: $this > (($status == $CRITICAL) ? (5) : (15))
28
+ delay: down 5m multiplier 1.5 max 1h
29
+ summary: ACR pull failures on ${label:resource_name}
30
+ info: Percentage of failed image pulls on ACR ${label:resource_name} \
31
+ in ${label:resource_group} (${label:region})
32
+ to: sysadmin
33
+
34
+# helper: total push rate over 5 minutes (used as denominator for failure ratio)
35
+
36
+ template: am_container_registry_push_total
37
+ on: azure_monitor.container_registry.push_count
38
+ class: Workload
39
+ type: Containers
40
+component: Azure ACR
41
+ lookup: average -5m unaligned of total
42
+ units: pushes/s
43
+ every: 1m
44
+ info: Total image push rate on ACR ${label:resource_name}
45
+
46
+# Push failure ratio: fires only when there is meaningful push traffic
47
+
48
+ template: am_container_registry_push_failures
49
+ on: azure_monitor.container_registry.push_count
50
+ class: Errors
51
+ type: Containers
52
+component: Azure ACR
53
+ lookup: average -5m unaligned of successful
54
+ calc: ($am_container_registry_push_total > 0.01) ? (($am_container_registry_push_total - $this) * 100 / $am_container_registry_push_total) : (0)
55
+ units: %
56
+ every: 1m
57
+ warn: $this > (($status >= $WARNING) ? (1) : (5))
58
+ crit: $this > (($status == $CRITICAL) ? (5) : (15))
59
+ delay: down 5m multiplier 1.5 max 1h
60
+ summary: ACR push failures on ${label:resource_name}
61
+ info: Percentage of failed image pushes on ACR ${label:resource_name} \
62
+ in ${label:resource_group} (${label:region})
63
+ to: sysadmin
src/health/health.d/azure_monitor_cosmos_db.conf
new
+175
@@ -0,0 +1,175 @@
1
+# you can disable an alarm notification by setting the 'to' line to: silent
2
+
3
+# --- Availability ---
4
+
5
+ template: am_cosmos_db_availability
6
+ on: azure_monitor.cosmos_db.availability
7
+ class: Availability
8
+ type: Database
9
+component: Cosmos DB
10
+ lookup: average -10m unaligned of average
11
+ units: percentage
12
+ every: 1m
13
+ warn: $this < (($status >= $WARNING) ? (99.99) : (99.9))
14
+ crit: $this < (($status == $CRITICAL) ? (99.9) : (99))
15
+ delay: down 5m multiplier 1.5 max 1h
16
+ summary: Cosmos DB availability on ${label:resource_name}
17
+ info: Service availability of Cosmos DB account ${label:resource_name} \
18
+ in ${label:resource_group} (${label:region})
19
+ to: dba
20
+
21
+# --- Utilization ---
22
+
23
+ template: am_cosmos_db_normalized_ru_consumption
24
+ on: azure_monitor.cosmos_db.normalized_ru_consumption
25
+ class: Utilization
26
+ type: Database
27
+component: Cosmos DB
28
+ lookup: average -5m unaligned of maximum
29
+ units: percentage
30
+ every: 1m
31
+ warn: $this > (($status >= $WARNING) ? (70) : (80))
32
+ crit: $this > (($status == $CRITICAL) ? (80) : (90))
33
+ delay: down 5m multiplier 1.5 max 1h
34
+ summary: Cosmos DB RU consumption on ${label:resource_name}
35
+ info: Normalized request unit consumption on Cosmos DB account ${label:resource_name} \
36
+ in ${label:resource_group} (${label:region}). \
37
+ High values indicate approaching provisioned throughput limit and risk of throttling
38
+ to: dba
39
+
40
+ template: am_cosmos_db_storage_utilization
41
+ on: azure_monitor.cosmos_db.storage
42
+ class: Utilization
43
+ type: Database
44
+component: Cosmos DB
45
+ calc: ($quota > 0) ? (($data + $index) * 100 / $quota) : (0)
46
+ units: %
47
+ every: 5m
48
+ warn: $this > (($status >= $WARNING) ? (70) : (80))
49
+ crit: $this > (($status == $CRITICAL) ? (80) : (90))
50
+ delay: down 5m multiplier 1.5 max 1h
51
+ summary: Cosmos DB storage utilization on ${label:resource_name}
52
+ info: Data and index storage as a percentage of document quota on Cosmos DB account ${label:resource_name} \
53
+ in ${label:resource_group} (${label:region})
54
+ to: dba
55
+
56
+# --- Latency ---
57
+
58
+ template: am_cosmos_db_server_side_latency_direct
59
+ on: azure_monitor.cosmos_db.server_side_latency
60
+ class: Latency
61
+ type: Database
62
+component: Cosmos DB
63
+ lookup: average -5m unaligned of direct
64
+ units: milliseconds
65
+ every: 1m
66
+ warn: $this != nan AND $this > (($status >= $WARNING) ? (8) : (10))
67
+ crit: $this != nan AND $this > (($status == $CRITICAL) ? (10) : (15))
68
+ delay: down 5m multiplier 1.5 max 1h
69
+ summary: Cosmos DB direct latency on ${label:resource_name}
70
+ info: Average server-side latency for direct connections on Cosmos DB account ${label:resource_name} \
71
+ in ${label:resource_group} (${label:region})
72
+ to: dba
73
+
74
+ template: am_cosmos_db_server_side_latency_gateway
75
+ on: azure_monitor.cosmos_db.server_side_latency
76
+ class: Latency
77
+ type: Database
78
+component: Cosmos DB
79
+ lookup: average -5m unaligned of gateway
80
+ units: milliseconds
81
+ every: 1m
82
+ warn: $this != nan AND $this > (($status >= $WARNING) ? (40) : (50))
83
+ crit: $this != nan AND $this > (($status == $CRITICAL) ? (60) : (80))
84
+ delay: down 5m multiplier 1.5 max 1h
85
+ summary: Cosmos DB gateway latency on ${label:resource_name}
86
+ info: Average server-side latency for gateway connections on Cosmos DB account ${label:resource_name} \
87
+ in ${label:resource_group} (${label:region})
88
+ to: dba
89
+
90
+ template: am_cosmos_db_replication_latency
91
+ on: azure_monitor.cosmos_db.replication_latency
92
+ class: Latency
93
+ type: Database
94
+component: Cosmos DB
95
+ lookup: average -5m unaligned of average
96
+ units: milliseconds
97
+ every: 1m
98
+ warn: $this != nan AND $this > (($status >= $WARNING) ? (100) : (200))
99
+ crit: $this != nan AND $this > (($status == $CRITICAL) ? (200) : (500))
100
+ delay: down 5m multiplier 1.5 max 1h
101
+ summary: Cosmos DB replication latency on ${label:resource_name}
102
+ info: Average geo-replication latency (P99) on Cosmos DB account ${label:resource_name} \
103
+ in ${label:resource_group} (${label:region}). \
104
+ Only relevant when multi-region writes are configured
105
+ to: dba
106
+
107
+# --- Dedicated Gateway ---
108
+
109
+ template: am_cosmos_db_dedicated_gateway_cpu
110
+ on: azure_monitor.cosmos_db.dedicated_gateway_cpu
111
+ class: Utilization
112
+ type: Database
113
+component: Cosmos DB
114
+ lookup: average -5m unaligned of average
115
+ units: percentage
116
+ every: 1m
117
+ warn: $this != nan AND $this > (($status >= $WARNING) ? (75) : (85))
118
+ crit: $this != nan AND $this > (($status == $CRITICAL) ? (85) : (95))
119
+ delay: down 5m multiplier 1.5 max 1h
120
+ summary: Cosmos DB dedicated gateway CPU on ${label:resource_name}
121
+ info: CPU utilization of the dedicated gateway on Cosmos DB account ${label:resource_name} \
122
+ in ${label:resource_group} (${label:region})
123
+ to: dba
124
+
125
+# --- Integrated Cache ---
126
+
127
+ template: am_cosmos_db_integrated_cache_item_hit_rate
128
+ on: azure_monitor.cosmos_db.integrated_cache_hit_rate
129
+ class: Utilization
130
+ type: Database
131
+component: Cosmos DB
132
+ lookup: average -10m unaligned of item
133
+ units: percentage
134
+ every: 5m
135
+ warn: $this != nan AND $this < (($status >= $WARNING) ? (60) : (50))
136
+ delay: down 5m multiplier 1.5 max 1h
137
+ summary: Cosmos DB cache item hit rate on ${label:resource_name}
138
+ info: Integrated cache item hit rate on Cosmos DB account ${label:resource_name} \
139
+ in ${label:resource_group} (${label:region}). \
140
+ Low hit rates indicate cache is not effectively reducing RU consumption
141
+ to: dba
142
+
143
+ template: am_cosmos_db_integrated_cache_query_hit_rate
144
+ on: azure_monitor.cosmos_db.integrated_cache_hit_rate
145
+ class: Utilization
146
+ type: Database
147
+component: Cosmos DB
148
+ lookup: average -10m unaligned of query
149
+ units: percentage
150
+ every: 5m
151
+ warn: $this != nan AND $this < (($status >= $WARNING) ? (60) : (50))
152
+ delay: down 5m multiplier 1.5 max 1h
153
+ summary: Cosmos DB cache query hit rate on ${label:resource_name}
154
+ info: Integrated cache query hit rate on Cosmos DB account ${label:resource_name} \
155
+ in ${label:resource_group} (${label:region}). \
156
+ Low hit rates indicate cache is not effectively reducing RU consumption
157
+ to: dba
158
+
159
+# --- Cassandra API ---
160
+
161
+ template: am_cosmos_db_cassandra_connection_closures
162
+ on: azure_monitor.cosmos_db.cassandra_connections
163
+ class: Errors
164
+ type: Database
165
+component: Cosmos DB
166
+ lookup: average -5m unaligned of total
167
+ units: connections/s
168
+ every: 1m
169
+ warn: $this != nan AND $this > (($status >= $WARNING) ? (5) : (10))
170
+ delay: down 5m multiplier 1.5 max 1h
171
+ summary: Cosmos DB Cassandra connection closures on ${label:resource_name}
172
+ info: Rate of Cassandra connection closures on Cosmos DB account ${label:resource_name} \
173
+ in ${label:resource_group} (${label:region}). \
174
+ Only relevant for accounts using the Cassandra API
175
+ to: dba
src/health/health.d/azure_monitor_data_explorer.conf
new
+365
@@ -0,0 +1,365 @@
1
+# you can disable an alarm notification by setting the 'to' line to: silent
2
+
3
+# --- Cluster Health ---
4
+
5
+ template: am_data_explorer_keep_alive
6
+ on: azure_monitor.data_explorer.keep_alive
7
+ class: Availability
8
+ type: Database
9
+component: Data Explorer
10
+ lookup: average -5m unaligned of average
11
+ units: count
12
+ every: 1m
13
+ crit: $this < (($status == $CRITICAL) ? (1) : (0.5))
14
+ delay: down 5m multiplier 1.5 max 1h
15
+ summary: Data Explorer keep alive on ${label:resource_name}
16
+ info: Cluster keep-alive health signal for Azure Data Explorer cluster ${label:resource_name} \
17
+ in ${label:resource_group} (${label:region}). \
18
+ A value below 1 indicates the cluster is not responding properly.
19
+ to: sysadmin
20
+
21
+ template: am_data_explorer_cpu
22
+ on: azure_monitor.data_explorer.cpu_utilization
23
+ class: Utilization
24
+ type: Database
25
+component: Data Explorer
26
+ lookup: average -5m unaligned of average
27
+ units: percentage
28
+ every: 1m
29
+ warn: $this > (($status >= $WARNING) ? (70) : (80))
30
+ crit: $this > (($status == $CRITICAL) ? (80) : (95))
31
+ delay: down 5m multiplier 1.5 max 1h
32
+ summary: Data Explorer CPU on ${label:resource_name}
33
+ info: Average CPU utilization of Azure Data Explorer cluster ${label:resource_name} \
34
+ in ${label:resource_group} (${label:region})
35
+ to: sysadmin
36
+
37
+ template: am_data_explorer_ingestion_utilization
38
+ on: azure_monitor.data_explorer.utilization
39
+ class: Utilization
40
+ type: Database
41
+component: Data Explorer
42
+ lookup: average -5m unaligned of ingestion
43
+ units: percentage
44
+ every: 1m
45
+ warn: $this > (($status >= $WARNING) ? (70) : (80))
46
+ crit: $this > (($status == $CRITICAL) ? (80) : (95))
47
+ delay: down 5m multiplier 1.5 max 1h
48
+ summary: Data Explorer ingestion utilization on ${label:resource_name}
49
+ info: Average ingestion utilization of Azure Data Explorer cluster ${label:resource_name} \
50
+ in ${label:resource_group} (${label:region}). \
51
+ High utilization indicates the cluster is approaching ingestion capacity.
52
+ to: sysadmin
53
+
54
+ template: am_data_explorer_cache_utilization
55
+ on: azure_monitor.data_explorer.utilization
56
+ class: Utilization
57
+ type: Database
58
+component: Data Explorer
59
+ lookup: average -5m unaligned of cache
60
+ units: percentage
61
+ every: 1m
62
+ warn: $this > (($status >= $WARNING) ? (75) : (80))
63
+ crit: $this > (($status == $CRITICAL) ? (85) : (95))
64
+ delay: down 5m multiplier 1.5 max 1h
65
+ summary: Data Explorer cache utilization on ${label:resource_name}
66
+ info: Average cache utilization factor of Azure Data Explorer cluster ${label:resource_name} \
67
+ in ${label:resource_group} (${label:region}). \
68
+ High cache utilization may cause queries to read from cold storage.
69
+ to: sysadmin
70
+
71
+ template: am_data_explorer_throttled_commands
72
+ on: azure_monitor.data_explorer.throttled_commands
73
+ class: Errors
74
+ type: Database
75
+component: Data Explorer
76
+ lookup: average -5m unaligned of total
77
+ units: commands/s
78
+ every: 1m
79
+ warn: $this > (($status >= $WARNING) ? (1) : (5))
80
+ crit: $this > (($status == $CRITICAL) ? (5) : (20))
81
+ delay: down 5m multiplier 1.5 max 1h
82
+ summary: Data Explorer throttled commands on ${label:resource_name}
83
+ info: Rate of throttled commands on Azure Data Explorer cluster ${label:resource_name} \
84
+ in ${label:resource_group} (${label:region}). \
85
+ Throttling indicates the cluster is overloaded.
86
+ to: sysadmin
87
+
88
+# --- Query Performance ---
89
+
90
+ template: am_data_explorer_query_duration
91
+ on: azure_monitor.data_explorer.query_duration
92
+ class: Latency
93
+ type: Database
94
+component: Data Explorer
95
+ lookup: average -5m unaligned of average
96
+ units: milliseconds
97
+ every: 1m
98
+ warn: $this > (($status >= $WARNING) ? (15000) : (30000))
99
+ crit: $this > (($status == $CRITICAL) ? (30000) : (60000))
100
+ delay: down 5m multiplier 1.5 max 1h
101
+ summary: Data Explorer query duration on ${label:resource_name}
102
+ info: Average query duration on Azure Data Explorer cluster ${label:resource_name} \
103
+ in ${label:resource_group} (${label:region})
104
+ to: sysadmin
105
+
106
+ template: am_data_explorer_throttled_queries
107
+ on: azure_monitor.data_explorer.throttled_queries
108
+ class: Errors
109
+ type: Database
110
+component: Data Explorer
111
+ lookup: average -5m unaligned of total
112
+ units: queries/s
113
+ every: 1m
114
+ warn: $this > (($status >= $WARNING) ? (1) : (5))
115
+ crit: $this > (($status == $CRITICAL) ? (5) : (20))
116
+ delay: down 5m multiplier 1.5 max 1h
117
+ summary: Data Explorer throttled queries on ${label:resource_name}
118
+ info: Rate of throttled queries on Azure Data Explorer cluster ${label:resource_name} \
119
+ in ${label:resource_group} (${label:region}). \
120
+ Throttling indicates insufficient query capacity.
121
+ to: sysadmin
122
+
123
+# --- Ingestion Health ---
124
+
125
+ template: am_data_explorer_ingestion_latency
126
+ on: azure_monitor.data_explorer.ingestion_latency
127
+ class: Latency
128
+ type: Database
129
+component: Data Explorer
130
+ lookup: average -5m unaligned of average
131
+ units: seconds
132
+ every: 1m
133
+ warn: $this > (($status >= $WARNING) ? (300) : (600))
134
+ crit: $this > (($status == $CRITICAL) ? (600) : (1800))
135
+ delay: down 5m multiplier 1.5 max 1h
136
+ summary: Data Explorer ingestion latency on ${label:resource_name}
137
+ info: Average ingestion latency on Azure Data Explorer cluster ${label:resource_name} \
138
+ in ${label:resource_group} (${label:region}). \
139
+ High latency means data takes longer to become queryable.
140
+ to: sysadmin
141
+
142
+ template: am_data_explorer_events_dropped
143
+ on: azure_monitor.data_explorer.events
144
+ class: Errors
145
+ type: Database
146
+component: Data Explorer
147
+ lookup: average -5m unaligned of dropped
148
+ units: events/s
149
+ every: 1m
150
+ warn: $this > (($status >= $WARNING) ? (0) : (1))
151
+ crit: $this > (($status == $CRITICAL) ? (1) : (10))
152
+ delay: down 5m multiplier 1.5 max 1h
153
+ summary: Data Explorer events dropped on ${label:resource_name}
154
+ info: Rate of dropped ingestion events on Azure Data Explorer cluster ${label:resource_name} \
155
+ in ${label:resource_group} (${label:region}). \
156
+ Dropped events indicate data loss during ingestion.
157
+ to: sysadmin
158
+
159
+ template: am_data_explorer_blobs_dropped
160
+ on: azure_monitor.data_explorer.blobs
161
+ class: Errors
162
+ type: Database
163
+component: Data Explorer
164
+ lookup: average -5m unaligned of dropped
165
+ units: blobs/s
166
+ every: 1m
167
+ warn: $this > (($status >= $WARNING) ? (0) : (1))
168
+ crit: $this > (($status == $CRITICAL) ? (1) : (10))
169
+ delay: down 5m multiplier 1.5 max 1h
170
+ summary: Data Explorer blobs dropped on ${label:resource_name}
171
+ info: Rate of dropped blobs during ingestion on Azure Data Explorer cluster ${label:resource_name} \
172
+ in ${label:resource_group} (${label:region}). \
173
+ Dropped blobs indicate data loss during ingestion.
174
+ to: sysadmin
175
+
176
+ template: am_data_explorer_ingestion_queue_length
177
+ on: azure_monitor.data_explorer.ingestion_queue
178
+ class: Workload
179
+ type: Database
180
+component: Data Explorer
181
+ lookup: average -5m unaligned of length
182
+ units: messages
183
+ every: 1m
184
+ warn: $this > (($status >= $WARNING) ? (500) : (1000))
185
+ crit: $this > (($status == $CRITICAL) ? (1000) : (5000))
186
+ delay: down 5m multiplier 1.5 max 1h
187
+ summary: Data Explorer ingestion queue on ${label:resource_name}
188
+ info: Average ingestion queue length on Azure Data Explorer cluster ${label:resource_name} \
189
+ in ${label:resource_group} (${label:region}). \
190
+ A growing queue indicates ingestion is not keeping up with incoming data.
191
+ to: sysadmin
192
+
193
+ template: am_data_explorer_queue_oldest_message
194
+ on: azure_monitor.data_explorer.queue_oldest_message
195
+ class: Latency
196
+ type: Database
197
+component: Data Explorer
198
+ lookup: average -5m unaligned of age
199
+ units: seconds
200
+ every: 1m
201
+ warn: $this > (($status >= $WARNING) ? (300) : (600))
202
+ crit: $this > (($status == $CRITICAL) ? (600) : (1800))
203
+ delay: down 5m multiplier 1.5 max 1h
204
+ summary: Data Explorer queue oldest message age on ${label:resource_name}
205
+ info: Age of the oldest message in the ingestion queue of Azure Data Explorer cluster ${label:resource_name} \
206
+ in ${label:resource_group} (${label:region}). \
207
+ Old messages indicate a significant ingestion backlog.
208
+ to: sysadmin
209
+
210
+# --- Export Health ---
211
+
212
+ template: am_data_explorer_export_utilization
213
+ on: azure_monitor.data_explorer.export_utilization
214
+ class: Utilization
215
+ type: Database
216
+component: Data Explorer
217
+ lookup: average -5m unaligned of maximum
218
+ units: percentage
219
+ every: 1m
220
+ warn: $this > (($status >= $WARNING) ? (70) : (80))
221
+ crit: $this > (($status == $CRITICAL) ? (80) : (95))
222
+ delay: down 5m multiplier 1.5 max 1h
223
+ summary: Data Explorer export utilization on ${label:resource_name}
224
+ info: Export utilization of Azure Data Explorer cluster ${label:resource_name} \
225
+ in ${label:resource_group} (${label:region}). \
226
+ High export utilization may cause export jobs to be delayed or fail.
227
+ to: sysadmin
228
+
229
+ template: am_data_explorer_continuous_export_pending
230
+ on: azure_monitor.data_explorer.continuous_export_pending
231
+ class: Workload
232
+ type: Database
233
+component: Data Explorer
234
+ lookup: average -5m unaligned of maximum
235
+ units: jobs
236
+ every: 1m
237
+ warn: $this != nan AND $this > (($status >= $WARNING) ? (5) : (10))
238
+ crit: $this != nan AND $this > (($status == $CRITICAL) ? (10) : (50))
239
+ delay: down 5m multiplier 1.5 max 1h
240
+ summary: Data Explorer continuous export pending on ${label:resource_name}
241
+ info: Number of pending continuous export jobs on Azure Data Explorer cluster ${label:resource_name} \
242
+ in ${label:resource_group} (${label:region})
243
+ to: sysadmin
244
+
245
+ template: am_data_explorer_continuous_export_lateness
246
+ on: azure_monitor.data_explorer.continuous_export_lateness
247
+ class: Latency
248
+ type: Database
249
+component: Data Explorer
250
+ lookup: average -5m unaligned of maximum
251
+ units: minutes
252
+ every: 1m
253
+ warn: $this != nan AND $this > (($status >= $WARNING) ? (10) : (30))
254
+ crit: $this != nan AND $this > (($status == $CRITICAL) ? (30) : (60))
255
+ delay: down 5m multiplier 1.5 max 1h
256
+ summary: Data Explorer continuous export lateness on ${label:resource_name}
257
+ info: Maximum continuous export lateness on Azure Data Explorer cluster ${label:resource_name} \
258
+ in ${label:resource_group} (${label:region}). \
259
+ High lateness means exported data is significantly behind real-time.
260
+ to: sysadmin
261
+
262
+# --- Streaming Ingest ---
263
+
264
+ template: am_data_explorer_streaming_ingest_utilization
265
+ on: azure_monitor.data_explorer.streaming_ingest_utilization
266
+ class: Utilization
267
+ type: Database
268
+component: Data Explorer
269
+ lookup: average -5m unaligned of average
270
+ units: percentage
271
+ every: 1m
272
+ warn: $this != nan AND $this > (($status >= $WARNING) ? (70) : (80))
273
+ crit: $this != nan AND $this > (($status == $CRITICAL) ? (80) : (95))
274
+ delay: down 5m multiplier 1.5 max 1h
275
+ summary: Data Explorer streaming ingest utilization on ${label:resource_name}
276
+ info: Average streaming ingest utilization on Azure Data Explorer cluster ${label:resource_name} \
277
+ in ${label:resource_group} (${label:region}). \
278
+ High utilization indicates the cluster is approaching streaming ingest capacity.
279
+ to: sysadmin
280
+
281
+ template: am_data_explorer_streaming_ingest_duration
282
+ on: azure_monitor.data_explorer.streaming_ingest_duration
283
+ class: Latency
284
+ type: Database
285
+component: Data Explorer
286
+ lookup: average -5m unaligned of average
287
+ units: milliseconds
288
+ every: 1m
289
+ warn: $this != nan AND $this > (($status >= $WARNING) ? (500) : (1000))
290
+ crit: $this != nan AND $this > (($status == $CRITICAL) ? (1000) : (5000))
291
+ delay: down 5m multiplier 1.5 max 1h
292
+ summary: Data Explorer streaming ingest duration on ${label:resource_name}
293
+ info: Average streaming ingest duration on Azure Data Explorer cluster ${label:resource_name} \
294
+ in ${label:resource_group} (${label:region})
295
+ to: sysadmin
296
+
297
+# --- Materialized Views ---
298
+
299
+ template: am_data_explorer_materialized_view_health
300
+ on: azure_monitor.data_explorer.materialized_view_health
301
+ class: Availability
302
+ type: Database
303
+component: Data Explorer
304
+ lookup: average -5m unaligned of health
305
+ units: status
306
+ every: 1m
307
+ crit: $this != nan AND $this < 1
308
+ delay: down 5m multiplier 1.5 max 1h
309
+ summary: Data Explorer materialized view health on ${label:resource_name}
310
+ info: Materialized view health status on Azure Data Explorer cluster ${label:resource_name} \
311
+ in ${label:resource_group} (${label:region}). \
312
+ A value below 1 indicates the materialized view is unhealthy.
313
+ to: sysadmin
314
+
315
+ template: am_data_explorer_materialized_view_age
316
+ on: azure_monitor.data_explorer.materialized_view_age
317
+ class: Latency
318
+ type: Database
319
+component: Data Explorer
320
+ lookup: average -5m unaligned of minutes
321
+ units: minutes
322
+ every: 1m
323
+ warn: $this != nan AND $this > (($status >= $WARNING) ? (30) : (60))
324
+ crit: $this != nan AND $this > (($status == $CRITICAL) ? (60) : (120))
325
+ delay: down 5m multiplier 1.5 max 1h
326
+ summary: Data Explorer materialized view age on ${label:resource_name}
327
+ info: Age of the materialized view on Azure Data Explorer cluster ${label:resource_name} \
328
+ in ${label:resource_group} (${label:region}). \
329
+ High age means the view is significantly behind the source data.
330
+ to: sysadmin
331
+
332
+ template: am_data_explorer_materialized_view_data_loss
333
+ on: azure_monitor.data_explorer.materialized_view_data_loss
334
+ class: Errors
335
+ type: Database
336
+component: Data Explorer
337
+ lookup: max -5m unaligned of maximum
338
+ units: status
339
+ every: 1m
340
+ crit: $this != nan AND $this > 0
341
+ delay: down 5m multiplier 1.5 max 1h
342
+ summary: Data Explorer materialized view data loss on ${label:resource_name}
343
+ info: Materialized view is reporting data loss on Azure Data Explorer cluster ${label:resource_name} \
344
+ in ${label:resource_group} (${label:region}). \
345
+ This indicates potential data inconsistency in the view.
346
+ to: sysadmin
347
+
348
+# --- Follower Latency ---
349
+
350
+ template: am_data_explorer_follower_latency
351
+ on: azure_monitor.data_explorer.follower_latency
352
+ class: Latency
353
+ type: Database
354
+component: Data Explorer
355
+ lookup: average -5m unaligned of average
356
+ units: milliseconds
357
+ every: 1m
358
+ warn: $this != nan AND $this > (($status >= $WARNING) ? (30000) : (60000))
359
+ crit: $this != nan AND $this > (($status == $CRITICAL) ? (60000) : (300000))
360
+ delay: down 5m multiplier 1.5 max 1h
361
+ summary: Data Explorer follower latency on ${label:resource_name}
362
+ info: Average follower replication latency on Azure Data Explorer cluster ${label:resource_name} \
363
+ in ${label:resource_group} (${label:region}). \
364
+ High latency means follower databases are behind the leader.
365
+ to: sysadmin
src/health/health.d/azure_monitor_data_factory.conf
new
+442
@@ -0,0 +1,442 @@
1
+# you can disable an alarm notification by setting the 'to' line to: silent
2
+
3
+# --- Pipeline Runs ---
4
+
5
+ template: am_data_factory_pipeline_failed_runs
6
+ on: azure_monitor.data_factory.pipeline_runs
7
+ class: Errors
8
+ type: Other
9
+component: Azure Data Factory
10
+ lookup: sum -5m unaligned of failed
11
+ units: runs
12
+ every: 1m
13
+ warn: $this > (($status >= $WARNING) ? (0) : (5))
14
+ delay: down 5m multiplier 1.5 max 1h
15
+ summary: Data Factory pipeline failures on ${label:resource_name}
16
+ info: Failed pipeline runs on Data Factory ${label:resource_name} \
17
+ in ${label:resource_group} (${label:region}) over the last 5 minutes
18
+ to: sysadmin
19
+
20
+ template: am_data_factory_pipeline_cancelled_runs
21
+ on: azure_monitor.data_factory.pipeline_runs
22
+ class: Errors
23
+ type: Other
24
+component: Azure Data Factory
25
+ lookup: sum -10m unaligned of cancelled
26
+ units: runs
27
+ every: 1m
28
+ warn: $this > (($status >= $WARNING) ? (5) : (10))
29
+ delay: down 5m multiplier 1.5 max 1h
30
+ summary: Data Factory pipeline cancellations on ${label:resource_name}
31
+ info: Cancelled pipeline runs on Data Factory ${label:resource_name} \
32
+ in ${label:resource_group} (${label:region}) over the last 10 minutes. \
33
+ Frequent cancellations may indicate configuration or dependency issues
34
+ to: sysadmin
35
+
36
+# --- Activity Runs ---
37
+
38
+ template: am_data_factory_activity_failed_runs
39
+ on: azure_monitor.data_factory.activity_runs
40
+ class: Errors
41
+ type: Other
42
+component: Azure Data Factory
43
+ lookup: sum -5m unaligned of failed
44
+ units: runs
45
+ every: 1m
46
+ warn: $this > (($status >= $WARNING) ? (0) : (5))
47
+ delay: down 5m multiplier 1.5 max 1h
48
+ summary: Data Factory activity failures on ${label:resource_name}
49
+ info: Failed activity runs on Data Factory ${label:resource_name} \
50
+ in ${label:resource_group} (${label:region}) over the last 5 minutes
51
+ to: sysadmin
52
+
53
+# --- Trigger Runs ---
54
+
55
+ template: am_data_factory_trigger_failed_runs
56
+ on: azure_monitor.data_factory.trigger_runs
57
+ class: Errors
58
+ type: Other
59
+component: Azure Data Factory
60
+ lookup: sum -5m unaligned of failed
61
+ units: runs
62
+ every: 1m
63
+ warn: $this > (($status >= $WARNING) ? (0) : (5))
64
+ delay: down 5m multiplier 1.5 max 1h
65
+ summary: Data Factory trigger failures on ${label:resource_name}
66
+ info: Failed trigger runs on Data Factory ${label:resource_name} \
67
+ in ${label:resource_group} (${label:region}) over the last 5 minutes
68
+ to: sysadmin
69
+
70
+# --- SSIS Integration Runtime ---
71
+
72
+ template: am_data_factory_ssis_ir_start_failures
73
+ on: azure_monitor.data_factory.ssis_ir_starts
74
+ class: Errors
75
+ type: Other
76
+component: Azure Data Factory
77
+ lookup: sum -5m unaligned of failed
78
+ units: runs
79
+ every: 1m
80
+ warn: $this != nan AND $this > (($status >= $WARNING) ? (0) : (1))
81
+ delay: down 5m multiplier 1.5 max 1h
82
+ summary: Data Factory SSIS IR start failures on ${label:resource_name}
83
+ info: Failed SSIS Integration Runtime start operations on Data Factory \
84
+ ${label:resource_name} in ${label:resource_group} (${label:region})
85
+ to: sysadmin
86
+
87
+ template: am_data_factory_ssis_ir_stop_stuck
88
+ on: azure_monitor.data_factory.ssis_ir_stops
89
+ class: Errors
90
+ type: Other
91
+component: Azure Data Factory
92
+ lookup: sum -5m unaligned of stuck
93
+ units: runs
94
+ every: 1m
95
+ warn: $this != nan AND $this > 0
96
+ delay: down 5m multiplier 1.5 max 1h
97
+ summary: Data Factory SSIS IR stuck stops on ${label:resource_name}
98
+ info: SSIS Integration Runtime stop operations stuck on Data Factory \
99
+ ${label:resource_name} in ${label:resource_group} (${label:region})
100
+ to: sysadmin
101
+
102
+ template: am_data_factory_ssis_package_failures
103
+ on: azure_monitor.data_factory.ssis_package_executions
104
+ class: Errors
105
+ type: Other
106
+component: Azure Data Factory
107
+ lookup: sum -5m unaligned of failed
108
+ units: executions
109
+ every: 1m
110
+ warn: $this != nan AND $this > (($status >= $WARNING) ? (0) : (1))
111
+ delay: down 5m multiplier 1.5 max 1h
112
+ summary: Data Factory SSIS package failures on ${label:resource_name}
113
+ info: Failed SSIS package executions on Data Factory ${label:resource_name} \
114
+ in ${label:resource_group} (${label:region})
115
+ to: sysadmin
116
+
117
+# --- Integration Runtime Resources ---
118
+
119
+ template: am_data_factory_ir_cpu
120
+ on: azure_monitor.data_factory.ir_cpu
121
+ class: Utilization
122
+ type: Other
123
+component: Azure Data Factory
124
+ lookup: average -5m unaligned of average
125
+ units: percentage
126
+ every: 1m
127
+ warn: $this > (($status >= $WARNING) ? (75) : (85))
128
+ crit: $this > (($status == $CRITICAL) ? (85) : (95))
129
+ delay: down 5m multiplier 1.5 max 1h
130
+ summary: Data Factory IR CPU on ${label:resource_name}
131
+ info: Integration Runtime CPU utilization on Data Factory ${label:resource_name} \
132
+ in ${label:resource_group} (${label:region})
133
+ to: sysadmin
134
+
135
+ template: am_data_factory_ir_queue_length
136
+ on: azure_monitor.data_factory.ir_queue
137
+ class: Workload
138
+ type: Other
139
+component: Azure Data Factory
140
+ lookup: average -5m unaligned of queue_length
141
+ units: tasks
142
+ every: 1m
143
+ warn: $this > (($status >= $WARNING) ? (10) : (20))
144
+ crit: $this > (($status == $CRITICAL) ? (20) : (50))
145
+ delay: down 5m multiplier 1.5 max 1h
146
+ summary: Data Factory IR queue depth on ${label:resource_name}
147
+ info: Integration Runtime queue length on Data Factory ${label:resource_name} \
148
+ in ${label:resource_group} (${label:region}). \
149
+ Growing queues indicate the runtime cannot keep up with submitted work
150
+ to: sysadmin
151
+
152
+ template: am_data_factory_ir_task_pickup_delay
153
+ on: azure_monitor.data_factory.ir_task_pickup_delay
154
+ class: Latency
155
+ type: Other
156
+component: Azure Data Factory
157
+ lookup: average -5m unaligned of average
158
+ units: seconds
159
+ every: 1m
160
+ warn: $this > (($status >= $WARNING) ? (30) : (60))
161
+ crit: $this > (($status == $CRITICAL) ? (60) : (120))
162
+ delay: down 5m multiplier 1.5 max 1h
163
+ summary: Data Factory IR task pickup delay on ${label:resource_name}
164
+ info: Average task pickup delay for Integration Runtime on Data Factory \
165
+ ${label:resource_name} in ${label:resource_group} (${label:region}). \
166
+ High delay indicates insufficient runtime capacity
167
+ to: sysadmin
168
+
169
+# --- Factory Capacity ---
170
+
171
+ template: am_data_factory_size_utilization
172
+ on: azure_monitor.data_factory.factory_size
173
+ class: Utilization
174
+ type: Other
175
+component: Azure Data Factory
176
+ calc: ($max_allowed > 0) ? ($current * 100 / $max_allowed) : (0)
177
+ units: %
178
+ every: 5m
179
+ warn: $this > (($status >= $WARNING) ? (70) : (80))
180
+ crit: $this > (($status == $CRITICAL) ? (80) : (90))
181
+ delay: down 5m multiplier 1.5 max 1h
182
+ summary: Data Factory size utilization on ${label:resource_name}
183
+ info: Factory size as percentage of maximum allowed on Data Factory \
184
+ ${label:resource_name} in ${label:resource_group} (${label:region})
185
+ to: sysadmin
186
+
187
+ template: am_data_factory_entity_utilization
188
+ on: azure_monitor.data_factory.entity_count
189
+ class: Utilization
190
+ type: Other
191
+component: Azure Data Factory
192
+ calc: ($max_allowed > 0) ? ($current * 100 / $max_allowed) : (0)
193
+ units: %
194
+ every: 5m
195
+ warn: $this > (($status >= $WARNING) ? (70) : (80))
196
+ crit: $this > (($status == $CRITICAL) ? (80) : (90))
197
+ delay: down 5m multiplier 1.5 max 1h
198
+ summary: Data Factory entity count on ${label:resource_name}
199
+ info: Entity count (pipelines, datasets, etc.) as percentage of maximum allowed \
200
+ on Data Factory ${label:resource_name} in ${label:resource_group} (${label:region})
201
+ to: sysadmin
202
+
203
+# --- MVNet IR Capacity ---
204
+
205
+ template: am_data_factory_mvnet_ir_copy_utilization
206
+ on: azure_monitor.data_factory.mvnet_ir_copy_capacity
207
+ class: Utilization
208
+ type: Other
209
+component: Azure Data Factory
210
+ lookup: average -5m unaligned of utilization
211
+ units: percentage
212
+ every: 1m
213
+ warn: $this != nan AND $this > (($status >= $WARNING) ? (70) : (80))
214
+ crit: $this != nan AND $this > (($status == $CRITICAL) ? (80) : (90))
215
+ delay: down 5m multiplier 1.5 max 1h
216
+ summary: Data Factory MVNet IR copy utilization on ${label:resource_name}
217
+ info: Managed VNet Integration Runtime copy capacity utilization on Data Factory \
218
+ ${label:resource_name} in ${label:resource_group} (${label:region})
219
+ to: sysadmin
220
+
221
+ template: am_data_factory_mvnet_ir_external_utilization
222
+ on: azure_monitor.data_factory.mvnet_ir_external_capacity
223
+ class: Utilization
224
+ type: Other
225
+component: Azure Data Factory
226
+ lookup: average -5m unaligned of utilization
227
+ units: percentage
228
+ every: 1m
229
+ warn: $this != nan AND $this > (($status >= $WARNING) ? (70) : (80))
230
+ crit: $this != nan AND $this > (($status == $CRITICAL) ? (80) : (90))
231
+ delay: down 5m multiplier 1.5 max 1h
232
+ summary: Data Factory MVNet IR external utilization on ${label:resource_name}
233
+ info: Managed VNet Integration Runtime external activity capacity utilization \
234
+ on Data Factory ${label:resource_name} in ${label:resource_group} (${label:region})
235
+ to: sysadmin
236
+
237
+ template: am_data_factory_mvnet_ir_pipeline_utilization
238
+ on: azure_monitor.data_factory.mvnet_ir_pipeline_capacity
239
+ class: Utilization
240
+ type: Other
241
+component: Azure Data Factory
242
+ lookup: average -5m unaligned of utilization
243
+ units: percentage
244
+ every: 1m
245
+ warn: $this != nan AND $this > (($status >= $WARNING) ? (70) : (80))
246
+ crit: $this != nan AND $this > (($status == $CRITICAL) ? (80) : (90))
247
+ delay: down 5m multiplier 1.5 max 1h
248
+ summary: Data Factory MVNet IR pipeline utilization on ${label:resource_name}
249
+ info: Managed VNet Integration Runtime pipeline capacity utilization \
250
+ on Data Factory ${label:resource_name} in ${label:resource_group} (${label:region})
251
+ to: sysadmin
252
+
253
+# --- Airflow IR Resources ---
254
+
255
+ template: am_data_factory_airflow_ir_cpu
256
+ on: azure_monitor.data_factory.airflow_ir_cpu
257
+ class: Utilization
258
+ type: Other
259
+component: Azure Data Factory
260
+ lookup: average -5m unaligned of percentage
261
+ units: percentage
262
+ every: 1m
263
+ warn: $this != nan AND $this > (($status >= $WARNING) ? (75) : (85))
264
+ crit: $this != nan AND $this > (($status == $CRITICAL) ? (85) : (95))
265
+ delay: down 5m multiplier 1.5 max 1h
266
+ summary: Data Factory Airflow IR CPU on ${label:resource_name}
267
+ info: Airflow Integration Runtime CPU utilization on Data Factory \
268
+ ${label:resource_name} in ${label:resource_group} (${label:region})
269
+ to: sysadmin
270
+
271
+ template: am_data_factory_airflow_ir_memory
272
+ on: azure_monitor.data_factory.airflow_ir_memory
273
+ class: Utilization
274
+ type: Other
275
+component: Azure Data Factory
276
+ lookup: average -5m unaligned of percentage
277
+ units: percentage
278
+ every: 1m
279
+ warn: $this != nan AND $this > (($status >= $WARNING) ? (75) : (85))
280
+ crit: $this != nan AND $this > (($status == $CRITICAL) ? (85) : (95))
281
+ delay: down 5m multiplier 1.5 max 1h
282
+ summary: Data Factory Airflow IR memory on ${label:resource_name}
283
+ info: Airflow Integration Runtime memory utilization on Data Factory \
284
+ ${label:resource_name} in ${label:resource_group} (${label:region})
285
+ to: sysadmin
286
+
287
+# --- Airflow IR DAG Errors ---
288
+
289
+ template: am_data_factory_airflow_ir_dag_errors
290
+ on: azure_monitor.data_factory.airflow_ir_dag_errors
291
+ class: Errors
292
+ type: Other
293
+component: Azure Data Factory
294
+ lookup: sum -5m unaligned of callback_exceptions,file_refresh,import
295
+ units: errors
296
+ every: 1m
297
+ warn: $this != nan AND $this > (($status >= $WARNING) ? (0) : (5))
298
+ delay: down 5m multiplier 1.5 max 1h
299
+ summary: Data Factory Airflow DAG errors on ${label:resource_name}
300
+ info: DAG processing errors (callback exceptions, file refresh errors, import errors) \
301
+ on Airflow IR of Data Factory ${label:resource_name} \
302
+ in ${label:resource_group} (${label:region})
303
+ to: sysadmin
304
+
305
+# --- Airflow IR Operators ---
306
+
307
+ template: am_data_factory_airflow_ir_operator_failures
308
+ on: azure_monitor.data_factory.airflow_ir_operators
309
+ class: Errors
310
+ type: Other
311
+component: Azure Data Factory
312
+ lookup: sum -5m unaligned of failures
313
+ units: operations
314
+ every: 1m
315
+ warn: $this != nan AND $this > (($status >= $WARNING) ? (0) : (5))
316
+ delay: down 5m multiplier 1.5 max 1h
317
+ summary: Data Factory Airflow operator failures on ${label:resource_name}
318
+ info: Failed Airflow operator executions on Data Factory ${label:resource_name} \
319
+ in ${label:resource_group} (${label:region})
320
+ to: sysadmin
321
+
322
+# --- Airflow IR Jobs ---
323
+
324
+ template: am_data_factory_airflow_ir_job_heartbeat_failures
325
+ on: azure_monitor.data_factory.airflow_ir_jobs
326
+ class: Errors
327
+ type: Other
328
+component: Azure Data Factory
329
+ lookup: sum -5m unaligned of heartbeat_failures
330
+ units: failures
331
+ every: 1m
332
+ warn: $this != nan AND $this > (($status >= $WARNING) ? (0) : (1))
333
+ delay: down 5m multiplier 1.5 max 1h
334
+ summary: Data Factory Airflow job heartbeat failures on ${label:resource_name}
335
+ info: Airflow job heartbeat failures on Data Factory ${label:resource_name} \
336
+ in ${label:resource_group} (${label:region}). \
337
+ Heartbeat failures indicate scheduler or worker health issues
338
+ to: sysadmin
339
+
340
+# --- Airflow IR Pool Starvation ---
341
+
342
+ template: am_data_factory_airflow_ir_pool_starving
343
+ on: azure_monitor.data_factory.airflow_ir_pool_starving
344
+ class: Workload
345
+ type: Other
346
+component: Azure Data Factory
347
+ lookup: sum -5m unaligned of starving
348
+ units: tasks
349
+ every: 1m
350
+ warn: $this != nan AND $this > (($status >= $WARNING) ? (0) : (5))
351
+ delay: down 5m multiplier 1.5 max 1h
352
+ summary: Data Factory Airflow pool starvation on ${label:resource_name}
353
+ info: Starving tasks in Airflow pool on Data Factory ${label:resource_name} \
354
+ in ${label:resource_group} (${label:region}). \
355
+ Tasks are waiting for pool slots, consider increasing pool size
356
+ to: sysadmin
357
+
358
+# --- Airflow IR Scheduler Tasks ---
359
+
360
+ template: am_data_factory_airflow_ir_tasks_killed_externally
361
+ on: azure_monitor.data_factory.airflow_ir_scheduler_tasks
362
+ class: Errors
363
+ type: Other
364
+component: Azure Data Factory
365
+ lookup: sum -5m unaligned of killed_externally
366
+ units: tasks
367
+ every: 1m
368
+ warn: $this != nan AND $this > (($status >= $WARNING) ? (0) : (3))
369
+ delay: down 5m multiplier 1.5 max 1h
370
+ summary: Data Factory Airflow tasks killed externally on ${label:resource_name}
371
+ info: Tasks killed externally by the Airflow scheduler on Data Factory \
372
+ ${label:resource_name} in ${label:resource_group} (${label:region}). \
373
+ May indicate OOM kills or infrastructure issues
374
+ to: sysadmin
375
+
376
+ template: am_data_factory_airflow_ir_tasks_starving
377
+ on: azure_monitor.data_factory.airflow_ir_scheduler_tasks
378
+ class: Workload
379
+ type: Other
380
+component: Azure Data Factory
381
+ lookup: sum -5m unaligned of starving
382
+ units: tasks
383
+ every: 1m
384
+ warn: $this != nan AND $this > (($status >= $WARNING) ? (0) : (10))
385
+ delay: down 5m multiplier 1.5 max 1h
386
+ summary: Data Factory Airflow scheduler starving tasks on ${label:resource_name}
387
+ info: Starving tasks reported by Airflow scheduler on Data Factory \
388
+ ${label:resource_name} in ${label:resource_group} (${label:region}). \
389
+ Tasks cannot be scheduled due to resource constraints
390
+ to: sysadmin
391
+
392
+# --- Airflow IR Task Instances ---
393
+
394
+ template: am_data_factory_airflow_ir_task_instance_failures
395
+ on: azure_monitor.data_factory.airflow_ir_task_instances
396
+ class: Errors
397
+ type: Other
398
+component: Azure Data Factory
399
+ lookup: sum -5m unaligned of failed
400
+ units: instances
401
+ every: 1m
402
+ warn: $this != nan AND $this > (($status >= $WARNING) ? (0) : (5))
403
+ delay: down 5m multiplier 1.5 max 1h
404
+ summary: Data Factory Airflow task failures on ${label:resource_name}
405
+ info: Failed Airflow task instances on Data Factory ${label:resource_name} \
406
+ in ${label:resource_group} (${label:region})
407
+ to: sysadmin
408
+
409
+# --- Airflow IR Trigger Issues ---
410
+
411
+ template: am_data_factory_airflow_ir_trigger_issues
412
+ on: azure_monitor.data_factory.airflow_ir_trigger_issues
413
+ class: Errors
414
+ type: Other
415
+component: Azure Data Factory
416
+ lookup: sum -5m unaligned of blocked_main_thread,celery_timeout_errors
417
+ units: events
418
+ every: 1m
419
+ warn: $this != nan AND $this > (($status >= $WARNING) ? (0) : (3))
420
+ delay: down 5m multiplier 1.5 max 1h
421
+ summary: Data Factory Airflow trigger issues on ${label:resource_name}
422
+ info: Trigger issues (blocked main thread, Celery timeouts) on Airflow IR \
423
+ of Data Factory ${label:resource_name} in ${label:resource_group} (${label:region})
424
+ to: sysadmin
425
+
426
+# --- Airflow IR Zombies ---
427
+
428
+ template: am_data_factory_airflow_ir_zombies
429
+ on: azure_monitor.data_factory.airflow_ir_zombies
430
+ class: Errors
431
+ type: Other
432
+component: Azure Data Factory
433
+ lookup: sum -5m unaligned of killed
434
+ units: tasks
435
+ every: 1m
436
+ warn: $this != nan AND $this > (($status >= $WARNING) ? (0) : (3))
437
+ delay: down 5m multiplier 1.5 max 1h
438
+ summary: Data Factory Airflow zombie tasks on ${label:resource_name}
439
+ info: Zombie tasks killed by Airflow on Data Factory ${label:resource_name} \
440
+ in ${label:resource_group} (${label:region}). \
441
+ Zombies occur when tasks are marked running but no process is executing them
442
+ to: sysadmin
src/health/health.d/azure_monitor_event_grid.conf
new
+110
@@ -0,0 +1,110 @@
1
+# you can disable an alarm notification by setting the 'to' line to: silent
2
+
3
+# --- Publish Failures ---
4
+
5
+ template: am_event_grid_publish_failures
6
+ on: azure_monitor.event_grid.publish_rate
7
+ class: Errors
8
+ type: Messaging
9
+component: Event Grid
10
+ lookup: average -5m unaligned of failed
11
+ units: events/s
12
+ every: 1m
13
+ warn: $this > (($status >= $WARNING) ? (0) : (5))
14
+ delay: down 5m multiplier 1.5 max 1h
15
+ summary: Event Grid publish failures on ${label:resource_name}
16
+ info: Rate of failed event publish operations on Event Grid topic ${label:resource_name} \
17
+ in ${label:resource_group} (${label:region}). \
18
+ Failed publishes indicate authentication, authorization, or schema validation errors
19
+ to: sysadmin
20
+
21
+# --- Delivery Failures ---
22
+
23
+ template: am_event_grid_delivery_failures
24
+ on: azure_monitor.event_grid.delivery
25
+ class: Errors
26
+ type: Messaging
27
+component: Event Grid
28
+ lookup: average -5m unaligned of failed
29
+ units: events/s
30
+ every: 1m
31
+ warn: $this > (($status >= $WARNING) ? (0) : (5))
32
+ crit: $this > (($status == $CRITICAL) ? (5) : (50))
33
+ delay: down 5m multiplier 1.5 max 1h
34
+ summary: Event Grid delivery failures on ${label:resource_name}
35
+ info: Rate of failed event delivery attempts on Event Grid topic ${label:resource_name} \
36
+ in ${label:resource_group} (${label:region}). \
37
+ Persistent delivery failures indicate subscriber endpoint issues
38
+ to: sysadmin
39
+
40
+ template: am_event_grid_dropped_events
41
+ on: azure_monitor.event_grid.delivery
42
+ class: Errors
43
+ type: Messaging
44
+component: Event Grid
45
+ lookup: average -5m unaligned of dropped
46
+ units: events/s
47
+ every: 1m
48
+ warn: $this > (($status >= $WARNING) ? (0) : (1))
49
+ crit: $this > (($status == $CRITICAL) ? (1) : (10))
50
+ delay: down 5m multiplier 1.5 max 1h
51
+ summary: Event Grid dropped events on ${label:resource_name}
52
+ info: Rate of dropped events on Event Grid topic ${label:resource_name} \
53
+ in ${label:resource_group} (${label:region}). \
54
+ Dropped events are permanently lost and indicate exhausted retry attempts \
55
+ without a dead-letter destination configured
56
+ to: sysadmin
57
+
58
+ template: am_event_grid_dead_lettered_events
59
+ on: azure_monitor.event_grid.delivery
60
+ class: Errors
61
+ type: Messaging
62
+component: Event Grid
63
+ lookup: average -5m unaligned of dead_lettered
64
+ units: events/s
65
+ every: 1m
66
+ warn: $this > (($status >= $WARNING) ? (0) : (1))
67
+ crit: $this > (($status == $CRITICAL) ? (1) : (10))
68
+ delay: down 5m multiplier 1.5 max 1h
69
+ summary: Event Grid dead-lettered events on ${label:resource_name}
70
+ info: Rate of events sent to the dead-letter destination on Event Grid topic ${label:resource_name} \
71
+ in ${label:resource_group} (${label:region}). \
72
+ Dead-lettered events failed all delivery retries and require manual investigation
73
+ to: sysadmin
74
+
75
+# --- Routing ---
76
+
77
+ template: am_event_grid_unmatched_events
78
+ on: azure_monitor.event_grid.routing
79
+ class: Errors
80
+ type: Messaging
81
+component: Event Grid
82
+ lookup: average -5m unaligned of unmatched
83
+ units: events/s
84
+ every: 1m
85
+ warn: $this > (($status >= $WARNING) ? (0) : (10))
86
+ delay: down 5m multiplier 1.5 max 1h
87
+ summary: Event Grid unmatched events on ${label:resource_name}
88
+ info: Rate of events that did not match any subscription on Event Grid topic ${label:resource_name} \
89
+ in ${label:resource_group} (${label:region}). \
90
+ Unmatched events indicate missing or misconfigured event subscriptions
91
+ to: sysadmin
92
+
93
+# --- Latency ---
94
+
95
+ template: am_event_grid_destination_processing_duration
96
+ on: azure_monitor.event_grid.destination_processing_duration
97
+ class: Latency
98
+ type: Messaging
99
+component: Event Grid
100
+ lookup: average -5m unaligned of average
101
+ units: milliseconds
102
+ every: 1m
103
+ warn: $this != nan AND $this > (($status >= $WARNING) ? (3000) : (5000))
104
+ crit: $this != nan AND $this > (($status == $CRITICAL) ? (5000) : (10000))
105
+ delay: down 5m multiplier 1.5 max 1h
106
+ summary: Event Grid destination processing duration on ${label:resource_name}
107
+ info: Average time taken by the subscriber endpoint to process events from Event Grid topic ${label:resource_name} \
108
+ in ${label:resource_group} (${label:region}). \
109
+ High processing duration indicates slow or overloaded event subscribers
110
+ to: sysadmin
src/health/health.d/azure_monitor_event_hubs.conf
new
+185
@@ -0,0 +1,185 @@
1
+# you can disable an alarm notification by setting the 'to' line to: silent
2
+
3
+# --- Errors ---
4
+
5
+ template: am_event_hubs_server_errors
6
+ on: azure_monitor.event_hubs.errors
7
+ class: Errors
8
+ type: Messaging
9
+component: Azure Event Hubs
10
+ lookup: average -5m unaligned of server
11
+ units: errors/s
12
+ every: 1m
13
+ warn: $this > (($status >= $WARNING) ? (1) : (5))
14
+ crit: $this > (($status == $CRITICAL) ? (5) : (10))
15
+ delay: down 5m multiplier 1.5 max 1h
16
+ summary: Event Hubs server errors on ${label:resource_name}
17
+ info: Server-side errors on Event Hubs namespace ${label:resource_name} \
18
+ in ${label:resource_group} (${label:region})
19
+ to: sysadmin
20
+
21
+ template: am_event_hubs_throttled_requests
22
+ on: azure_monitor.event_hubs.errors
23
+ class: Errors
24
+ type: Messaging
25
+component: Azure Event Hubs
26
+ lookup: average -5m unaligned of throttled
27
+ units: errors/s
28
+ every: 1m
29
+ warn: $this > (($status >= $WARNING) ? (0) : (1))
30
+ crit: $this > (($status == $CRITICAL) ? (5) : (10))
31
+ delay: down 5m multiplier 1.5 max 1h
32
+ summary: Event Hubs throttled requests on ${label:resource_name}
33
+ info: Requests being throttled on Event Hubs namespace ${label:resource_name} \
34
+ in ${label:resource_group} (${label:region})
35
+ to: sysadmin
36
+
37
+ template: am_event_hubs_quota_exceeded
38
+ on: azure_monitor.event_hubs.errors
39
+ class: Errors
40
+ type: Messaging
41
+component: Azure Event Hubs
42
+ lookup: average -5m unaligned of quota_exceeded
43
+ units: errors/s
44
+ every: 1m
45
+ warn: $this > (($status >= $WARNING) ? (0) : (1))
46
+ crit: $this > (($status == $CRITICAL) ? (1) : (5))
47
+ delay: down 5m multiplier 1.5 max 1h
48
+ summary: Event Hubs quota exceeded on ${label:resource_name}
49
+ info: Quota exceeded errors on Event Hubs namespace ${label:resource_name} \
50
+ in ${label:resource_group} (${label:region}). \
51
+ Quota errors indicate the namespace has exceeded its throughput unit limits
52
+ to: sysadmin
53
+
54
+# User errors (400-class) at sustained high rate may indicate
55
+# client misconfiguration or malformed messages.
56
+
57
+ template: am_event_hubs_user_errors
58
+ on: azure_monitor.event_hubs.errors
59
+ class: Errors
60
+ type: Messaging
61
+component: Azure Event Hubs
62
+ lookup: average -5m unaligned of user
63
+ units: errors/s
64
+ every: 1m
65
+ warn: $this > (($status >= $WARNING) ? (10) : (25))
66
+ delay: down 5m multiplier 1.5 max 1h
67
+ summary: Event Hubs user errors on ${label:resource_name}
68
+ info: Rate of user (client-side) errors on Event Hubs namespace ${label:resource_name} \
69
+ in ${label:resource_group} (${label:region})
70
+ to: sysadmin
71
+
72
+# --- Request Success Rate ---
73
+
74
+ template: am_event_hubs_incoming_requests
75
+ on: azure_monitor.event_hubs.requests
76
+ class: Workload
77
+ type: Messaging
78
+component: Azure Event Hubs
79
+ lookup: sum -5m unaligned of incoming
80
+ units: requests/s
81
+ every: 1m
82
+ info: Total incoming requests to Event Hubs namespace ${label:resource_name}
83
+
84
+ template: am_event_hubs_success_rate
85
+ on: azure_monitor.event_hubs.requests
86
+ class: Errors
87
+ type: Messaging
88
+component: Azure Event Hubs
89
+ lookup: sum -5m unaligned of successful
90
+ calc: ($am_event_hubs_incoming_requests > 0) ? ($this * 100 / $am_event_hubs_incoming_requests) : (100)
91
+ units: %
92
+ every: 1m
93
+ warn: ($am_event_hubs_incoming_requests > 120) ? ($this < (($status >= $WARNING) ? (99) : (95))) : (0)
94
+ crit: ($am_event_hubs_incoming_requests > 120) ? ($this < (($status == $CRITICAL) ? (95) : (85))) : (0)
95
+ delay: down 5m multiplier 1.5 max 1h
96
+ summary: Event Hubs request success rate on ${label:resource_name}
97
+ info: Percentage of successful requests on Event Hubs namespace ${label:resource_name} \
98
+ in ${label:resource_group} (${label:region})
99
+ to: sysadmin
100
+
101
+# --- Utilization (Premium tier) ---
102
+
103
+ template: am_event_hubs_namespace_cpu
104
+ on: azure_monitor.event_hubs.namespace_resources
105
+ class: Utilization
106
+ type: Messaging
107
+component: Azure Event Hubs
108
+ lookup: average -5m unaligned of cpu
109
+ units: percentage
110
+ every: 1m
111
+ warn: $this != nan AND $this > (($status >= $WARNING) ? (70) : (80))
112
+ crit: $this != nan AND $this > (($status == $CRITICAL) ? (80) : (90))
113
+ delay: down 5m multiplier 1.5 max 1h
114
+ summary: Event Hubs namespace CPU on ${label:resource_name}
115
+ info: CPU utilization of Event Hubs Premium namespace ${label:resource_name} \
116
+ in ${label:resource_group} (${label:region})
117
+ to: sysadmin
118
+
119
+ template: am_event_hubs_namespace_memory
120
+ on: azure_monitor.event_hubs.namespace_resources
121
+ class: Utilization
122
+ type: Messaging
123
+component: Azure Event Hubs
124
+ lookup: average -5m unaligned of memory
125
+ units: percentage
126
+ every: 1m
127
+ warn: $this != nan AND $this > (($status >= $WARNING) ? (70) : (80))
128
+ crit: $this != nan AND $this > (($status == $CRITICAL) ? (80) : (90))
129
+ delay: down 5m multiplier 1.5 max 1h
130
+ summary: Event Hubs namespace memory on ${label:resource_name}
131
+ info: Memory utilization of Event Hubs Premium namespace ${label:resource_name} \
132
+ in ${label:resource_group} (${label:region})
133
+ to: sysadmin
134
+
135
+# --- Capture ---
136
+
137
+ template: am_event_hubs_capture_backlog
138
+ on: azure_monitor.event_hubs.capture_backlog
139
+ class: Workload
140
+ type: Messaging
141
+component: Azure Event Hubs
142
+ lookup: average -5m unaligned of backlog
143
+ units: messages
144
+ every: 1m
145
+ warn: $this != nan AND $this > (($status >= $WARNING) ? (500000) : (1000000))
146
+ crit: $this != nan AND $this > (($status == $CRITICAL) ? (1000000) : (5000000))
147
+ delay: down 5m multiplier 1.5 max 1h
148
+ summary: Event Hubs capture backlog on ${label:resource_name}
149
+ info: Messages waiting to be captured on Event Hubs namespace ${label:resource_name} \
150
+ in ${label:resource_group} (${label:region})
151
+ to: sysadmin
152
+
153
+# --- Geo-Replication ---
154
+
155
+ template: am_event_hubs_replication_lag
156
+ on: azure_monitor.event_hubs.replication_lag
157
+ class: Latency
158
+ type: Messaging
159
+component: Azure Event Hubs
160
+ lookup: average -5m unaligned of messages
161
+ units: messages
162
+ every: 1m
163
+ warn: $this != nan AND $this > (($status >= $WARNING) ? (100) : (500))
164
+ crit: $this != nan AND $this > (($status == $CRITICAL) ? (500) : (1000))
165
+ delay: down 5m multiplier 1.5 max 1h
166
+ summary: Event Hubs replication lag on ${label:resource_name}
167
+ info: Geo-replication message lag on Event Hubs namespace ${label:resource_name} \
168
+ in ${label:resource_group} (${label:region})
169
+ to: sysadmin
170
+
171
+ template: am_event_hubs_replication_lag_duration
172
+ on: azure_monitor.event_hubs.replication_lag_duration
173
+ class: Latency
174
+ type: Messaging
175
+component: Azure Event Hubs
176
+ lookup: average -5m unaligned of duration
177
+ units: seconds
178
+ every: 1m
179
+ warn: $this != nan AND $this > (($status >= $WARNING) ? (30) : (60))
180
+ crit: $this != nan AND $this > (($status == $CRITICAL) ? (60) : (120))
181
+ delay: down 5m multiplier 1.5 max 1h
182
+ summary: Event Hubs replication lag duration on ${label:resource_name}
183
+ info: Geo-replication time lag on Event Hubs namespace ${label:resource_name} \
184
+ in ${label:resource_group} (${label:region})
185
+ to: sysadmin
src/health/health.d/azure_monitor_express_route_circuit.conf
new
+109
@@ -0,0 +1,109 @@
1
+# you can disable an alarm notification by setting the 'to' line to: silent
2
+
3
+# --- Availability ---
4
+
5
+ template: am_express_route_circuit_arp_availability
6
+ on: azure_monitor.express_route_circuit.arp_availability
7
+ class: Availability
8
+ type: Other
9
+component: ExpressRoute
10
+ lookup: average -5m unaligned of average
11
+ units: percentage
12
+ every: 1m
13
+ warn: $this < (($status >= $WARNING) ? (99) : (95))
14
+ crit: $this < (($status == $CRITICAL) ? (95) : (90))
15
+ delay: down 5m multiplier 1.5 max 1h
16
+ summary: ExpressRoute ARP availability on ${label:resource_name}
17
+ info: ARP availability of ExpressRoute circuit ${label:resource_name} \
18
+ in ${label:resource_group} (${label:region}). \
19
+ Low ARP availability indicates layer 2 connectivity problems between \
20
+ the Microsoft edge and the provider/customer edge
21
+ to: sysadmin
22
+
23
+ template: am_express_route_circuit_bgp_availability
24
+ on: azure_monitor.express_route_circuit.bgp_availability
25
+ class: Availability
26
+ type: Other
27
+component: ExpressRoute
28
+ lookup: average -5m unaligned of average
29
+ units: percentage
30
+ every: 1m
31
+ warn: $this < (($status >= $WARNING) ? (99) : (95))
32
+ crit: $this < (($status == $CRITICAL) ? (95) : (90))
33
+ delay: down 5m multiplier 1.5 max 1h
34
+ summary: ExpressRoute BGP availability on ${label:resource_name}
35
+ info: BGP availability of ExpressRoute circuit ${label:resource_name} \
36
+ in ${label:resource_group} (${label:region}). \
37
+ Low BGP availability indicates routing session problems that can \
38
+ cause traffic disruption
39
+ to: sysadmin
40
+
41
+# --- Bandwidth Utilization ---
42
+
43
+ template: am_express_route_circuit_ingress_bandwidth_utilization
44
+ on: azure_monitor.express_route_circuit.bandwidth_utilization
45
+ class: Utilization
46
+ type: Other
47
+component: ExpressRoute
48
+ lookup: average -5m unaligned of ingress
49
+ units: percentage
50
+ every: 1m
51
+ warn: $this > (($status >= $WARNING) ? (70) : (80))
52
+ crit: $this > (($status == $CRITICAL) ? (80) : (90))
53
+ delay: down 5m multiplier 1.5 max 1h
54
+ summary: ExpressRoute ingress bandwidth on ${label:resource_name}
55
+ info: Ingress bandwidth utilization of ExpressRoute circuit ${label:resource_name} \
56
+ in ${label:resource_group} (${label:region}). \
57
+ High utilization can cause packet drops and increased latency
58
+ to: sysadmin
59
+
60
+ template: am_express_route_circuit_egress_bandwidth_utilization
61
+ on: azure_monitor.express_route_circuit.bandwidth_utilization
62
+ class: Utilization
63
+ type: Other
64
+component: ExpressRoute
65
+ lookup: average -5m unaligned of egress
66
+ units: percentage
67
+ every: 1m
68
+ warn: $this > (($status >= $WARNING) ? (70) : (80))
69
+ crit: $this > (($status == $CRITICAL) ? (80) : (90))
70
+ delay: down 5m multiplier 1.5 max 1h
71
+ summary: ExpressRoute egress bandwidth on ${label:resource_name}
72
+ info: Egress bandwidth utilization of ExpressRoute circuit ${label:resource_name} \
73
+ in ${label:resource_group} (${label:region}). \
74
+ High utilization can cause packet drops and increased latency
75
+ to: sysadmin
76
+
77
+# --- QoS Drops ---
78
+
79
+ template: am_express_route_circuit_qos_drop_in
80
+ on: azure_monitor.express_route_circuit.qos_dropped_bits
81
+ class: Errors
82
+ type: Other
83
+component: ExpressRoute
84
+ lookup: average -5m unaligned of in
85
+ units: bits/s
86
+ every: 1m
87
+ warn: $this > (($status >= $WARNING) ? (0) : (1000))
88
+ delay: down 5m multiplier 1.5 max 1h
89
+ summary: ExpressRoute QoS ingress drops on ${label:resource_name}
90
+ info: Rate of QoS-dropped ingress bits on ExpressRoute circuit ${label:resource_name} \
91
+ in ${label:resource_group} (${label:region}). \
92
+ Non-zero QoS drops indicate traffic is exceeding configured QoS policies
93
+ to: sysadmin
94
+
95
+ template: am_express_route_circuit_qos_drop_out
96
+ on: azure_monitor.express_route_circuit.qos_dropped_bits
97
+ class: Errors
98
+ type: Other
99
+component: ExpressRoute
100
+ lookup: average -5m unaligned of out
101
+ units: bits/s
102
+ every: 1m
103
+ warn: $this > (($status >= $WARNING) ? (0) : (1000))
104
+ delay: down 5m multiplier 1.5 max 1h
105
+ summary: ExpressRoute QoS egress drops on ${label:resource_name}
106
+ info: Rate of QoS-dropped egress bits on ExpressRoute circuit ${label:resource_name} \
107
+ in ${label:resource_group} (${label:region}). \
108
+ Non-zero QoS drops indicate traffic is exceeding configured QoS policies
109
+ to: sysadmin
src/health/health.d/azure_monitor_express_route_gateway.conf
new
+174
@@ -0,0 +1,174 @@
1
+# you can disable an alarm notification by setting the 'to' line to: silent
2
+
3
+# --- CPU Utilization ---
4
+
5
+ template: am_express_route_gateway_cpu
6
+ on: azure_monitor.express_route_gateway.cpu_utilization
7
+ class: Utilization
8
+ type: Other
9
+component: ExpressRoute Gateway
10
+ lookup: average -5m unaligned of average
11
+ units: percentage
12
+ every: 1m
13
+ warn: $this > (($status >= $WARNING) ? (70) : (80))
14
+ crit: $this > (($status == $CRITICAL) ? (80) : (90))
15
+ delay: down 5m multiplier 1.5 max 1h
16
+ summary: ExpressRoute GW CPU on ${label:resource_name}
17
+ info: Average CPU utilization of ExpressRoute Gateway ${label:resource_name} \
18
+ in ${label:resource_group} (${label:region}). \
19
+ High CPU may cause degraded forwarding performance
20
+ to: sysadmin
21
+
22
+# --- Gateway Throughput ---
23
+
24
+ template: am_express_route_gateway_throughput
25
+ on: azure_monitor.express_route_gateway.gateway_throughput
26
+ class: Workload
27
+ type: Other
28
+component: ExpressRoute Gateway
29
+ lookup: average -5m unaligned of average
30
+ units: bits/s
31
+ every: 1m
32
+ info: Average throughput of ExpressRoute Gateway ${label:resource_name} \
33
+ in ${label:resource_group} (${label:region})
34
+ to: silent
35
+
36
+# --- Connection Throughput ---
37
+
38
+ template: am_express_route_gateway_connection_in
39
+ on: azure_monitor.express_route_gateway.connection_throughput
40
+ class: Workload
41
+ type: Other
42
+component: ExpressRoute Gateway
43
+ lookup: average -5m unaligned of in
44
+ units: bits/s
45
+ every: 1m
46
+ info: Average inbound connection throughput of ExpressRoute Gateway ${label:resource_name} \
47
+ in ${label:resource_group} (${label:region})
48
+ to: silent
49
+
50
+ template: am_express_route_gateway_connection_out
51
+ on: azure_monitor.express_route_gateway.connection_throughput
52
+ class: Workload
53
+ type: Other
54
+component: ExpressRoute Gateway
55
+ lookup: average -5m unaligned of out
56
+ units: bits/s
57
+ every: 1m
58
+ info: Average outbound connection throughput of ExpressRoute Gateway ${label:resource_name} \
59
+ in ${label:resource_group} (${label:region})
60
+ to: silent
61
+
62
+# --- Packets ---
63
+
64
+ template: am_express_route_gateway_packets
65
+ on: azure_monitor.express_route_gateway.packets
66
+ class: Workload
67
+ type: Other
68
+component: ExpressRoute Gateway
69
+ lookup: average -5m unaligned of average
70
+ units: packets/s
71
+ every: 1m
72
+ info: Average packet rate through ExpressRoute Gateway ${label:resource_name} \
73
+ in ${label:resource_group} (${label:region})
74
+ to: silent
75
+
76
+# --- Active Flows ---
77
+
78
+ template: am_express_route_gateway_active_flows
79
+ on: azure_monitor.express_route_gateway.active_flows
80
+ class: Workload
81
+ type: Other
82
+component: ExpressRoute Gateway
83
+ lookup: average -5m unaligned of average
84
+ units: flows
85
+ every: 1m
86
+ warn: $this > (($status >= $WARNING) ? (200000) : (250000))
87
+ delay: down 5m multiplier 1.5 max 1h
88
+ summary: ExpressRoute GW active flows on ${label:resource_name}
89
+ info: Average number of active flows on ExpressRoute Gateway ${label:resource_name} \
90
+ in ${label:resource_group} (${label:region}). \
91
+ High flow counts may indicate approaching scalability limits
92
+ to: sysadmin
93
+
94
+# --- Route Changes ---
95
+
96
+ template: am_express_route_gateway_route_changes
97
+ on: azure_monitor.express_route_gateway.route_changes
98
+ class: Errors
99
+ type: Other
100
+component: ExpressRoute Gateway
101
+ lookup: average -5m unaligned of total
102
+ units: changes/s
103
+ every: 1m
104
+ warn: $this > (($status >= $WARNING) ? (5) : (10))
105
+ delay: down 5m multiplier 1.5 max 1h
106
+ summary: ExpressRoute GW route churn on ${label:resource_name}
107
+ info: Rate of BGP route changes on ExpressRoute Gateway ${label:resource_name} \
108
+ in ${label:resource_group} (${label:region}). \
109
+ Frequent route changes may indicate BGP instability
110
+ to: sysadmin
111
+
112
+# --- Routes Advertised ---
113
+
114
+ template: am_express_route_gateway_routes_advertised
115
+ on: azure_monitor.express_route_gateway.routes_advertised
116
+ class: Workload
117
+ type: Other
118
+component: ExpressRoute Gateway
119
+ lookup: average -5m unaligned of maximum
120
+ units: routes
121
+ every: 1m
122
+ warn: $this > (($status >= $WARNING) ? (900) : (950))
123
+ delay: down 5m multiplier 1.5 max 1h
124
+ summary: ExpressRoute GW routes advertised on ${label:resource_name}
125
+ info: Number of routes advertised to peer by ExpressRoute Gateway ${label:resource_name} \
126
+ in ${label:resource_group} (${label:region}). \
127
+ Azure limits advertised routes to 1000 per peering
128
+ to: sysadmin
129
+
130
+# --- Routes Learned ---
131
+
132
+ template: am_express_route_gateway_routes_learned
133
+ on: azure_monitor.express_route_gateway.routes_learned
134
+ class: Workload
135
+ type: Other
136
+component: ExpressRoute Gateway
137
+ lookup: average -5m unaligned of maximum
138
+ units: routes
139
+ every: 1m
140
+ warn: $this > (($status >= $WARNING) ? (3800) : (3900))
141
+ delay: down 5m multiplier 1.5 max 1h
142
+ summary: ExpressRoute GW routes learned on ${label:resource_name}
143
+ info: Number of routes learned from peer by ExpressRoute Gateway ${label:resource_name} \
144
+ in ${label:resource_group} (${label:region}). \
145
+ Azure limits learned routes to 4000 per peering
146
+ to: sysadmin
147
+
148
+# --- Max Flow Creation Rate ---
149
+
150
+ template: am_express_route_gateway_flow_creation_rate
151
+ on: azure_monitor.express_route_gateway.max_flows_creation_rate
152
+ class: Workload
153
+ type: Other
154
+component: ExpressRoute Gateway
155
+ lookup: average -5m unaligned of maximum
156
+ units: flows/s
157
+ every: 1m
158
+ info: Maximum flow creation rate on ExpressRoute Gateway ${label:resource_name} \
159
+ in ${label:resource_group} (${label:region})
160
+ to: silent
161
+
162
+# --- VMs in VNet ---
163
+
164
+ template: am_express_route_gateway_vm_count
165
+ on: azure_monitor.express_route_gateway.vm_count
166
+ class: Workload
167
+ type: Other
168
+component: ExpressRoute Gateway
169
+ lookup: average -5m unaligned of maximum
170
+ units: VMs
171
+ every: 1m
172
+ info: Number of VMs in the VNet behind ExpressRoute Gateway ${label:resource_name} \
173
+ in ${label:resource_group} (${label:region})
174
+ to: silent
src/health/health.d/azure_monitor_firewall.conf
new
+58
@@ -0,0 +1,58 @@
1
+# you can disable an alarm notification by setting the 'to' line to: silent
2
+
3
+# --- Health ---
4
+
5
+ template: am_firewall_health
6
+ on: azure_monitor.firewall.health
7
+ class: Availability
8
+ type: Other
9
+component: Azure Firewall
10
+ lookup: average -5m unaligned of average
11
+ units: percentage
12
+ every: 1m
13
+ warn: $this < (($status >= $WARNING) ? (99) : (90))
14
+ crit: $this < (($status == $CRITICAL) ? (90) : (80))
15
+ delay: down 5m multiplier 1.5 max 1h
16
+ summary: Firewall health on ${label:resource_name}
17
+ info: Health state of Azure Firewall ${label:resource_name} \
18
+ in ${label:resource_group} (${label:region}). \
19
+ AMBA threshold is 90%. Values below 100% indicate partial degradation
20
+ to: sysadmin
21
+
22
+# --- Latency ---
23
+
24
+ template: am_firewall_latency
25
+ on: azure_monitor.firewall.latency
26
+ class: Latency
27
+ type: Other
28
+component: Azure Firewall
29
+ lookup: average -5m unaligned of average
30
+ units: milliseconds
31
+ every: 1m
32
+ warn: $this > (($status >= $WARNING) ? (10) : (20))
33
+ crit: $this > (($status == $CRITICAL) ? (20) : (50))
34
+ delay: down 5m multiplier 1.5 max 1h
35
+ summary: Firewall latency on ${label:resource_name}
36
+ info: Average latency probe of Azure Firewall ${label:resource_name} \
37
+ in ${label:resource_group} (${label:region}). \
38
+ High latency indicates firewall processing delays
39
+ to: sysadmin
40
+
41
+# --- SNAT Port Utilization ---
42
+
43
+ template: am_firewall_snat_port_utilization
44
+ on: azure_monitor.firewall.snat_port_utilization
45
+ class: Utilization
46
+ type: Other
47
+component: Azure Firewall
48
+ lookup: average -5m unaligned of average
49
+ units: percentage
50
+ every: 1m
51
+ warn: $this > (($status >= $WARNING) ? (60) : (80))
52
+ crit: $this > (($status == $CRITICAL) ? (80) : (95))
53
+ delay: down 5m multiplier 1.5 max 1h
54
+ summary: Firewall SNAT port utilization on ${label:resource_name}
55
+ info: SNAT port utilization of Azure Firewall ${label:resource_name} \
56
+ in ${label:resource_group} (${label:region}). \
57
+ AMBA threshold is 80%. Exhaustion causes outbound connection failures
58
+ to: sysadmin
src/health/health.d/azure_monitor_front_door.conf
new
+129
@@ -0,0 +1,129 @@
1
+# you can disable an alarm notification by setting the 'to' line to: silent
2
+
3
+# --- Origin Health ---
4
+
5
+ template: am_front_door_origin_health
6
+ on: azure_monitor.front_door.origin_health
7
+ class: Availability
8
+ type: Web Server
9
+component: Azure Front Door
10
+ lookup: average -5m unaligned of health
11
+ units: percentage
12
+ every: 1m
13
+ warn: $this < (($status >= $WARNING) ? (99) : (95))
14
+ crit: $this < (($status == $CRITICAL) ? (95) : (90))
15
+ delay: down 5m multiplier 1.5 max 1h
16
+ summary: Front Door origin health on ${label:resource_name}
17
+ info: Origin health percentage for Azure Front Door ${label:resource_name} \
18
+ in ${label:resource_group} (${label:region}). \
19
+ Low origin health indicates backends are failing health probes
20
+ to: sysadmin
21
+
22
+# --- Latency ---
23
+
24
+ template: am_front_door_total_latency
25
+ on: azure_monitor.front_door.latency
26
+ class: Latency
27
+ type: Web Server
28
+component: Azure Front Door
29
+ lookup: average -5m unaligned of total
30
+ units: milliseconds
31
+ every: 1m
32
+ warn: $this > (($status >= $WARNING) ? (3000) : (4000))
33
+ crit: $this > (($status == $CRITICAL) ? (5000) : (8000))
34
+ delay: down 5m multiplier 1.5 max 1h
35
+ summary: Front Door total latency on ${label:resource_name}
36
+ info: Average total request latency (client to Front Door to origin and back) \
37
+ for Azure Front Door ${label:resource_name} \
38
+ in ${label:resource_group} (${label:region})
39
+ to: sysadmin
40
+
41
+ template: am_front_door_origin_latency
42
+ on: azure_monitor.front_door.latency
43
+ class: Latency
44
+ type: Web Server
45
+component: Azure Front Door
46
+ lookup: average -5m unaligned of origin
47
+ units: milliseconds
48
+ every: 1m
49
+ warn: $this > (($status >= $WARNING) ? (3000) : (5000))
50
+ crit: $this > (($status == $CRITICAL) ? (5000) : (10000))
51
+ delay: down 5m multiplier 1.5 max 1h
52
+ summary: Front Door origin latency on ${label:resource_name}
53
+ info: Average origin response latency for Azure Front Door ${label:resource_name} \
54
+ in ${label:resource_group} (${label:region}). \
55
+ High origin latency indicates slow backends
56
+ to: sysadmin
57
+
58
+# --- Error Rates ---
59
+
60
+ template: am_front_door_5xx_error_rate
61
+ on: azure_monitor.front_door.error_rate
62
+ class: Errors
63
+ type: Web Server
64
+component: Azure Front Door
65
+ lookup: average -5m unaligned of 5xx
66
+ units: percentage
67
+ every: 1m
68
+ warn: $this > (($status >= $WARNING) ? (3) : (5))
69
+ crit: $this > (($status == $CRITICAL) ? (5) : (10))
70
+ delay: down 5m multiplier 1.5 max 1h
71
+ summary: Front Door 5xx error rate on ${label:resource_name}
72
+ info: Percentage of requests resulting in 5xx server errors \
73
+ for Azure Front Door ${label:resource_name} \
74
+ in ${label:resource_group} (${label:region})
75
+ to: sysadmin
76
+
77
+ template: am_front_door_4xx_error_rate
78
+ on: azure_monitor.front_door.error_rate
79
+ class: Errors
80
+ type: Web Server
81
+component: Azure Front Door
82
+ lookup: average -5m unaligned of 4xx
83
+ units: percentage
84
+ every: 1m
85
+ warn: $this > (($status >= $WARNING) ? (15) : (25))
86
+ delay: down 5m multiplier 1.5 max 1h
87
+ summary: Front Door 4xx error rate on ${label:resource_name}
88
+ info: Percentage of requests resulting in 4xx client errors \
89
+ for Azure Front Door ${label:resource_name} \
90
+ in ${label:resource_group} (${label:region}). \
91
+ Sustained high 4xx rates may indicate misconfigured routing or abusive clients
92
+ to: sysadmin
93
+
94
+# --- Cache Performance ---
95
+
96
+ template: am_front_door_byte_hit_ratio
97
+ on: azure_monitor.front_door.byte_hit_ratio
98
+ class: Utilization
99
+ type: Web Server
100
+component: Azure Front Door
101
+ lookup: average -10m unaligned of hit_ratio
102
+ units: percentage
103
+ every: 1m
104
+ warn: $this != nan AND $this < (($status >= $WARNING) ? (50) : (40))
105
+ delay: down 15m multiplier 1.5 max 1h
106
+ summary: Front Door cache hit ratio on ${label:resource_name}
107
+ info: Byte hit ratio (percentage of bytes served from cache) \
108
+ for Azure Front Door ${label:resource_name} \
109
+ in ${label:resource_group} (${label:region}). \
110
+ Low cache hit ratio means most traffic goes to origin, increasing latency and origin load
111
+ to: sysadmin
112
+
113
+# --- WAF ---
114
+
115
+ template: am_front_door_waf_rate_limited
116
+ on: azure_monitor.front_door.origin_shield_requests
117
+ class: Errors
118
+ type: Web Server
119
+component: Azure Front Door
120
+ lookup: average -5m unaligned of rate_limited
121
+ units: requests/s
122
+ every: 1m
123
+ warn: $this != nan AND $this > (($status >= $WARNING) ? (50) : (100))
124
+ delay: down 5m multiplier 1.5 max 1h
125
+ summary: Front Door origin shield rate limiting on ${label:resource_name}
126
+ info: Rate of origin shield requests being rate limited \
127
+ for Azure Front Door ${label:resource_name} \
128
+ in ${label:resource_group} (${label:region})
129
+ to: sysadmin
src/health/health.d/azure_monitor_iot_hub.conf
new
+313
@@ -0,0 +1,313 @@
1
+# you can disable an alarm notification by setting the 'to' line to: silent
2
+
3
+# --- D2C Telemetry Throttling ---
4
+
5
+ template: am_iot_hub_d2c_telemetry_throttle
6
+ on: azure_monitor.iot_hub.d2c_telemetry_throttle
7
+ class: Errors
8
+ type: Messaging
9
+component: IoT Hub
10
+ lookup: average -5m unaligned of throttled
11
+ units: errors/s
12
+ every: 1m
13
+ warn: $this > (($status >= $WARNING) ? (1) : (5))
14
+ crit: $this > (($status == $CRITICAL) ? (10) : (50))
15
+ delay: down 5m multiplier 1.5 max 1h
16
+ summary: IoT Hub telemetry throttling on ${label:resource_name}
17
+ info: Device-to-cloud telemetry throttling errors on IoT Hub ${label:resource_name} \
18
+ in ${label:resource_group} (${label:region}). \
19
+ Throttling indicates the hub is exceeding its message rate limits
20
+ to: sysadmin
21
+
22
+# --- C2D Messages Expired ---
23
+
24
+ template: am_iot_hub_c2d_messages_expired
25
+ on: azure_monitor.iot_hub.c2d_messages_expired
26
+ class: Errors
27
+ type: Messaging
28
+component: IoT Hub
29
+ lookup: average -5m unaligned of expired
30
+ units: messages/s
31
+ every: 1m
32
+ warn: $this > (($status >= $WARNING) ? (0) : (1))
33
+ crit: $this > (($status == $CRITICAL) ? (5) : (10))
34
+ delay: down 5m multiplier 1.5 max 1h
35
+ summary: IoT Hub C2D messages expiring on ${label:resource_name}
36
+ info: Cloud-to-device messages expiring before delivery on IoT Hub ${label:resource_name} \
37
+ in ${label:resource_group} (${label:region}). \
38
+ Expired messages indicate devices are not receiving commands in time
39
+ to: sysadmin
40
+
41
+# --- C2D Direct Method Failures ---
42
+
43
+ template: am_iot_hub_c2d_methods_failed
44
+ on: azure_monitor.iot_hub.c2d_methods
45
+ class: Errors
46
+ type: Messaging
47
+component: IoT Hub
48
+ lookup: average -5m unaligned of failed
49
+ units: invocations/s
50
+ every: 1m
51
+ warn: $this > (($status >= $WARNING) ? (1) : (5))
52
+ crit: $this > (($status == $CRITICAL) ? (10) : (50))
53
+ delay: down 5m multiplier 1.5 max 1h
54
+ summary: IoT Hub direct method failures on ${label:resource_name}
55
+ info: Failed cloud-to-device direct method invocations on IoT Hub ${label:resource_name} \
56
+ in ${label:resource_group} (${label:region})
57
+ to: sysadmin
58
+
59
+# --- C2D Twin Read Failures ---
60
+
61
+ template: am_iot_hub_c2d_twin_read_failures
62
+ on: azure_monitor.iot_hub.c2d_twin_reads
63
+ class: Errors
64
+ type: Messaging
65
+component: IoT Hub
66
+ lookup: average -5m unaligned of failed
67
+ units: operations/s
68
+ every: 1m
69
+ warn: $this > (($status >= $WARNING) ? (1) : (5))
70
+ crit: $this > (($status == $CRITICAL) ? (10) : (50))
71
+ delay: down 5m multiplier 1.5 max 1h
72
+ summary: IoT Hub backend twin read failures on ${label:resource_name}
73
+ info: Failed backend twin read operations on IoT Hub ${label:resource_name} \
74
+ in ${label:resource_group} (${label:region})
75
+ to: sysadmin
76
+
77
+# --- C2D Twin Update Failures ---
78
+
79
+ template: am_iot_hub_c2d_twin_update_failures
80
+ on: azure_monitor.iot_hub.c2d_twin_updates
81
+ class: Errors
82
+ type: Messaging
83
+component: IoT Hub
84
+ lookup: average -5m unaligned of failed
85
+ units: operations/s
86
+ every: 1m
87
+ warn: $this > (($status >= $WARNING) ? (1) : (5))
88
+ crit: $this > (($status == $CRITICAL) ? (10) : (50))
89
+ delay: down 5m multiplier 1.5 max 1h
90
+ summary: IoT Hub backend twin update failures on ${label:resource_name}
91
+ info: Failed backend twin update operations on IoT Hub ${label:resource_name} \
92
+ in ${label:resource_group} (${label:region})
93
+ to: sysadmin
94
+
95
+# --- D2C Twin Read Failures ---
96
+
97
+ template: am_iot_hub_d2c_twin_read_failures
98
+ on: azure_monitor.iot_hub.d2c_twin_reads
99
+ class: Errors
100
+ type: Messaging
101
+component: IoT Hub
102
+ lookup: average -5m unaligned of failed
103
+ units: operations/s
104
+ every: 1m
105
+ warn: $this > (($status >= $WARNING) ? (1) : (5))
106
+ crit: $this > (($status == $CRITICAL) ? (10) : (50))
107
+ delay: down 5m multiplier 1.5 max 1h
108
+ summary: IoT Hub device twin read failures on ${label:resource_name}
109
+ info: Failed device-initiated twin read operations on IoT Hub ${label:resource_name} \
110
+ in ${label:resource_group} (${label:region})
111
+ to: sysadmin
112
+
113
+# --- D2C Twin Update Failures ---
114
+
115
+ template: am_iot_hub_d2c_twin_update_failures
116
+ on: azure_monitor.iot_hub.d2c_twin_updates
117
+ class: Errors
118
+ type: Messaging
119
+component: IoT Hub
120
+ lookup: average -5m unaligned of failed
121
+ units: operations/s
122
+ every: 1m
123
+ warn: $this > (($status >= $WARNING) ? (1) : (5))
124
+ crit: $this > (($status == $CRITICAL) ? (10) : (50))
125
+ delay: down 5m multiplier 1.5 max 1h
126
+ summary: IoT Hub device twin update failures on ${label:resource_name}
127
+ info: Failed device-initiated twin update operations on IoT Hub ${label:resource_name} \
128
+ in ${label:resource_group} (${label:region})
129
+ to: sysadmin
130
+
131
+# --- Routing Dropped Messages ---
132
+
133
+ template: am_iot_hub_routing_dropped
134
+ on: azure_monitor.iot_hub.routing_deliveries
135
+ class: Errors
136
+ type: Messaging
137
+component: IoT Hub
138
+ lookup: average -5m unaligned of dropped
139
+ units: messages/s
140
+ every: 1m
141
+ warn: $this > (($status >= $WARNING) ? (0) : (1))
142
+ crit: $this > (($status == $CRITICAL) ? (5) : (10))
143
+ delay: down 5m multiplier 1.5 max 1h
144
+ summary: IoT Hub routing dropped messages on ${label:resource_name}
145
+ info: Messages dropped by the routing engine on IoT Hub ${label:resource_name} \
146
+ in ${label:resource_group} (${label:region}). \
147
+ Dropped messages indicate dead endpoints or misconfigured routes
148
+ to: sysadmin
149
+
150
+# --- Routing Orphaned Messages ---
151
+
152
+ template: am_iot_hub_routing_orphaned
153
+ on: azure_monitor.iot_hub.routing_deliveries
154
+ class: Errors
155
+ type: Messaging
156
+component: IoT Hub
157
+ lookup: average -5m unaligned of orphaned
158
+ units: messages/s
159
+ every: 1m
160
+ warn: $this > (($status >= $WARNING) ? (0) : (1))
161
+ crit: $this > (($status == $CRITICAL) ? (5) : (10))
162
+ delay: down 5m multiplier 1.5 max 1h
163
+ summary: IoT Hub routing orphaned messages on ${label:resource_name}
164
+ info: Orphaned messages with no matching routing rule on IoT Hub ${label:resource_name} \
165
+ in ${label:resource_group} (${label:region}). \
166
+ Orphaned messages indicate missing or incomplete routing configuration
167
+ to: sysadmin
168
+
169
+# --- Routing Invalid Messages ---
170
+
171
+ template: am_iot_hub_routing_invalid
172
+ on: azure_monitor.iot_hub.routing_deliveries
173
+ class: Errors
174
+ type: Messaging
175
+component: IoT Hub
176
+ lookup: average -5m unaligned of invalid
177
+ units: messages/s
178
+ every: 1m
179
+ warn: $this > (($status >= $WARNING) ? (0) : (1))
180
+ crit: $this > (($status == $CRITICAL) ? (5) : (10))
181
+ delay: down 5m multiplier 1.5 max 1h
182
+ summary: IoT Hub routing invalid messages on ${label:resource_name}
183
+ info: Invalid messages rejected by the routing engine on IoT Hub ${label:resource_name} \
184
+ in ${label:resource_group} (${label:region})
185
+ to: sysadmin
186
+
187
+# --- Routing Latency ---
188
+
189
+ template: am_iot_hub_routing_latency
190
+ on: azure_monitor.iot_hub.routing_latency
191
+ class: Latency
192
+ type: Messaging
193
+component: IoT Hub
194
+ lookup: max -5m unaligned
195
+ units: milliseconds
196
+ every: 1m
197
+ warn: $this != nan AND $this > (($status >= $WARNING) ? (3000) : (5000))
198
+ crit: $this != nan AND $this > (($status == $CRITICAL) ? (5000) : (10000))
199
+ delay: down 5m multiplier 1.5 max 1h
200
+ summary: IoT Hub routing latency on ${label:resource_name}
201
+ info: Maximum message routing latency across all endpoints on IoT Hub ${label:resource_name} \
202
+ in ${label:resource_group} (${label:region})
203
+ to: sysadmin
204
+
205
+# --- Event Grid Latency ---
206
+
207
+ template: am_iot_hub_event_grid_latency
208
+ on: azure_monitor.iot_hub.event_grid_latency
209
+ class: Latency
210
+ type: Messaging
211
+component: IoT Hub
212
+ lookup: average -5m unaligned of average
213
+ units: milliseconds
214
+ every: 1m
215
+ warn: $this != nan AND $this > (($status >= $WARNING) ? (3000) : (5000))
216
+ crit: $this != nan AND $this > (($status == $CRITICAL) ? (5000) : (10000))
217
+ delay: down 5m multiplier 1.5 max 1h
218
+ summary: IoT Hub Event Grid latency on ${label:resource_name}
219
+ info: Average Event Grid delivery latency on IoT Hub ${label:resource_name} \
220
+ in ${label:resource_group} (${label:region})
221
+ to: sysadmin
222
+
223
+# --- Job Failures ---
224
+
225
+ template: am_iot_hub_jobs_failed
226
+ on: azure_monitor.iot_hub.jobs_status
227
+ class: Errors
228
+ type: Messaging
229
+component: IoT Hub
230
+ lookup: average -5m unaligned of failed
231
+ units: operations/s
232
+ every: 1m
233
+ warn: $this > (($status >= $WARNING) ? (0) : (1))
234
+ crit: $this > (($status == $CRITICAL) ? (5) : (10))
235
+ delay: down 5m multiplier 1.5 max 1h
236
+ summary: IoT Hub job failures on ${label:resource_name}
237
+ info: Failed jobs on IoT Hub ${label:resource_name} \
238
+ in ${label:resource_group} (${label:region})
239
+ to: sysadmin
240
+
241
+# --- Twin Query Failures ---
242
+
243
+ template: am_iot_hub_twin_query_failures
244
+ on: azure_monitor.iot_hub.twin_queries
245
+ class: Errors
246
+ type: Messaging
247
+component: IoT Hub
248
+ lookup: average -5m unaligned of failed
249
+ units: queries/s
250
+ every: 1m
251
+ warn: $this > (($status >= $WARNING) ? (1) : (5))
252
+ crit: $this > (($status == $CRITICAL) ? (10) : (50))
253
+ delay: down 5m multiplier 1.5 max 1h
254
+ summary: IoT Hub twin query failures on ${label:resource_name}
255
+ info: Failed twin queries on IoT Hub ${label:resource_name} \
256
+ in ${label:resource_group} (${label:region})
257
+ to: sysadmin
258
+
259
+# --- C2D Commands Abandoned ---
260
+
261
+ template: am_iot_hub_c2d_commands_abandoned
262
+ on: azure_monitor.iot_hub.c2d_commands
263
+ class: Errors
264
+ type: Messaging
265
+component: IoT Hub
266
+ lookup: average -5m unaligned of abandoned
267
+ units: messages/s
268
+ every: 1m
269
+ warn: $this > (($status >= $WARNING) ? (1) : (5))
270
+ crit: $this > (($status == $CRITICAL) ? (10) : (50))
271
+ delay: down 5m multiplier 1.5 max 1h
272
+ summary: IoT Hub C2D commands abandoned on ${label:resource_name}
273
+ info: Cloud-to-device commands abandoned by devices on IoT Hub ${label:resource_name} \
274
+ in ${label:resource_group} (${label:region}). \
275
+ Abandoned commands indicate devices are not properly handling received messages
276
+ to: sysadmin
277
+
278
+# --- C2D Commands Rejected ---
279
+
280
+ template: am_iot_hub_c2d_commands_rejected
281
+ on: azure_monitor.iot_hub.c2d_commands
282
+ class: Errors
283
+ type: Messaging
284
+component: IoT Hub
285
+ lookup: average -5m unaligned of rejected
286
+ units: messages/s
287
+ every: 1m
288
+ warn: $this > (($status >= $WARNING) ? (1) : (5))
289
+ crit: $this > (($status == $CRITICAL) ? (10) : (50))
290
+ delay: down 5m multiplier 1.5 max 1h
291
+ summary: IoT Hub C2D commands rejected on ${label:resource_name}
292
+ info: Cloud-to-device commands rejected by devices on IoT Hub ${label:resource_name} \
293
+ in ${label:resource_group} (${label:region}). \
294
+ Rejected commands indicate devices are explicitly refusing messages
295
+ to: sysadmin
296
+
297
+# --- Routing Delivery Latency (Preview) ---
298
+
299
+ template: am_iot_hub_routing_delivery_latency_preview
300
+ on: azure_monitor.iot_hub.routing_delivery_latency_preview
301
+ class: Latency
302
+ type: Messaging
303
+component: IoT Hub
304
+ lookup: average -5m unaligned of average
305
+ units: milliseconds
306
+ every: 1m
307
+ warn: $this != nan AND $this > (($status >= $WARNING) ? (3000) : (5000))
308
+ crit: $this != nan AND $this > (($status == $CRITICAL) ? (5000) : (10000))
309
+ delay: down 5m multiplier 1.5 max 1h
310
+ summary: IoT Hub routing delivery latency on ${label:resource_name}
311
+ info: Average routing delivery latency (preview metric) on IoT Hub ${label:resource_name} \
312
+ in ${label:resource_group} (${label:region})
313
+ to: sysadmin
src/health/health.d/azure_monitor_key_vault.conf
new
+58
@@ -0,0 +1,58 @@
1
+# you can disable an alarm notification by setting the 'to' line to: silent
2
+
3
+# --- Availability ---
4
+
5
+ template: am_key_vault_availability
6
+ on: azure_monitor.key_vault.availability
7
+ class: Availability
8
+ type: Certificates
9
+component: Azure Key Vault
10
+ lookup: average -5m unaligned of average
11
+ units: percentage
12
+ every: 1m
13
+ warn: $this < (($status >= $WARNING) ? (99.9) : (99))
14
+ crit: $this < (($status == $CRITICAL) ? (99) : (90))
15
+ delay: down 5m multiplier 1.5 max 1h
16
+ summary: Key Vault availability on ${label:resource_name}
17
+ info: Overall vault availability of Azure Key Vault ${label:resource_name} \
18
+ in ${label:resource_group} (${label:region}). \
19
+ Azure SLA guarantees 99.99% availability
20
+ to: sysadmin
21
+
22
+# --- Latency ---
23
+
24
+ template: am_key_vault_api_latency
25
+ on: azure_monitor.key_vault.api_latency
26
+ class: Latency
27
+ type: Certificates
28
+component: Azure Key Vault
29
+ lookup: average -5m unaligned of average
30
+ units: milliseconds
31
+ every: 1m
32
+ warn: $this > (($status >= $WARNING) ? (500) : (1000))
33
+ crit: $this > (($status == $CRITICAL) ? (1000) : (2000))
34
+ delay: down 5m multiplier 1.5 max 1h
35
+ summary: Key Vault API latency on ${label:resource_name}
36
+ info: Average API latency of Azure Key Vault ${label:resource_name} \
37
+ in ${label:resource_group} (${label:region}). \
38
+ High latency may indicate throttling or service degradation
39
+ to: sysadmin
40
+
41
+# --- Saturation ---
42
+
43
+ template: am_key_vault_saturation
44
+ on: azure_monitor.key_vault.saturation
45
+ class: Utilization
46
+ type: Certificates
47
+component: Azure Key Vault
48
+ lookup: average -5m unaligned of average
49
+ units: percentage
50
+ every: 1m
51
+ warn: $this > (($status >= $WARNING) ? (60) : (75))
52
+ crit: $this > (($status == $CRITICAL) ? (75) : (90))
53
+ delay: down 5m multiplier 1.5 max 1h
54
+ summary: Key Vault saturation on ${label:resource_name}
55
+ info: Vault saturation of Azure Key Vault ${label:resource_name} \
56
+ in ${label:resource_group} (${label:region}). \
57
+ High saturation means the vault is approaching its transaction limits
58
+ to: sysadmin
src/health/health.d/azure_monitor_load_balancers.conf
new
+73
@@ -0,0 +1,73 @@
1
+# you can disable an alarm notification by setting the 'to' line to: silent
2
+
3
+# --- Availability ---
4
+
5
+ template: am_load_balancers_vip_availability
6
+ on: azure_monitor.load_balancers.vip_availability
7
+ class: Availability
8
+ type: Other
9
+component: Azure Load Balancer
10
+ lookup: average -5m unaligned of average
11
+ units: percentage
12
+ every: 1m
13
+ warn: $this < (($status >= $WARNING) ? (99.9) : (99))
14
+ crit: $this < (($status == $CRITICAL) ? (99) : (90))
15
+ delay: down 5m multiplier 1.5 max 1h
16
+ summary: LB data path availability on ${label:resource_name}
17
+ info: Data path availability of Azure Load Balancer ${label:resource_name} \
18
+ in ${label:resource_group} (${label:region}). \
19
+ Low values indicate the load balancer is unable to forward traffic
20
+ to: sysadmin
21
+
22
+ template: am_load_balancers_dip_availability
23
+ on: azure_monitor.load_balancers.dip_availability
24
+ class: Availability
25
+ type: Other
26
+component: Azure Load Balancer
27
+ lookup: average -5m unaligned of average
28
+ units: percentage
29
+ every: 1m
30
+ warn: $this < (($status >= $WARNING) ? (99.9) : (99))
31
+ crit: $this < (($status == $CRITICAL) ? (99) : (90))
32
+ delay: down 5m multiplier 1.5 max 1h
33
+ summary: LB health probe status on ${label:resource_name}
34
+ info: Health probe availability of Azure Load Balancer ${label:resource_name} \
35
+ in ${label:resource_group} (${label:region}). \
36
+ Low values indicate backend instances are failing health probes
37
+ to: sysadmin
38
+
39
+ template: am_load_balancers_global_backend_availability
40
+ on: azure_monitor.load_balancers.global_backend_availability
41
+ class: Availability
42
+ type: Other
43
+component: Azure Load Balancer
44
+ lookup: average -5m unaligned of average
45
+ units: percentage
46
+ every: 1m
47
+ warn: $this != nan AND $this < (($status >= $WARNING) ? (99.9) : (99))
48
+ crit: $this != nan AND $this < (($status == $CRITICAL) ? (99) : (90))
49
+ delay: down 5m multiplier 1.5 max 1h
50
+ summary: LB global backend availability on ${label:resource_name}
51
+ info: Global backend availability of Azure Load Balancer ${label:resource_name} \
52
+ in ${label:resource_group} (${label:region}). \
53
+ Applies to cross-region load balancers only
54
+ to: sysadmin
55
+
56
+# --- SNAT Port Exhaustion ---
57
+
58
+ template: am_load_balancers_snat_port_utilization
59
+ on: azure_monitor.load_balancers.snat_ports
60
+ class: Utilization
61
+ type: Other
62
+component: Azure Load Balancer
63
+ calc: ($allocated > 0) ? ($used * 100 / $allocated) : (0)
64
+ units: %
65
+ every: 1m
66
+ warn: $this > (($status >= $WARNING) ? (70) : (80))
67
+ crit: $this > (($status == $CRITICAL) ? (85) : (95))
68
+ delay: down 5m multiplier 1.5 max 1h
69
+ summary: LB SNAT port utilization on ${label:resource_name}
70
+ info: Percentage of allocated SNAT ports in use on Azure Load Balancer ${label:resource_name} \
71
+ in ${label:resource_group} (${label:region}). \
72
+ SNAT port exhaustion causes outbound connection failures
73
+ to: sysadmin
src/health/health.d/azure_monitor_log_analytics.conf
new
+293
@@ -0,0 +1,293 @@
1
+# you can disable an alarm notification by setting the 'to' line to: silent
2
+
3
+# --- Workspace SLI: Availability ---
4
+
5
+# Query availability (0-100%). Low is bad.
6
+# Azure SLA: 99.9% for Log Analytics queries.
7
+
8
+ template: am_log_analytics_query_availability
9
+ on: azure_monitor.log_analytics.query_availability
10
+ class: Availability
11
+ type: Other
12
+component: Log Analytics
13
+ lookup: average -5m unaligned of availability
14
+ units: percentage
15
+ every: 1m
16
+ warn: $this < (($status >= $WARNING) ? (99.9) : (99))
17
+ crit: $this < (($status == $CRITICAL) ? (99) : (90))
18
+ delay: down 5m multiplier 1.5 max 1h
19
+ summary: Log Analytics query availability on ${label:resource_name}
20
+ info: Query availability of Log Analytics workspace ${label:resource_name} \
21
+ in ${label:resource_group} (${label:region})
22
+ to: sysadmin
23
+
24
+# --- Workspace SLI: Ingestion ---
25
+
26
+# Ingestion latency (seconds). High is bad.
27
+# AMBA: average ingestion latency > 300s (5 min) is concerning.
28
+
29
+ template: am_log_analytics_ingestion_latency
30
+ on: azure_monitor.log_analytics.ingestion_latency
31
+ class: Latency
32
+ type: Other
33
+component: Log Analytics
34
+ lookup: average -5m unaligned of average
35
+ units: seconds
36
+ every: 1m
37
+ warn: $this > (($status >= $WARNING) ? (180) : (300))
38
+ crit: $this > (($status == $CRITICAL) ? (300) : (600))
39
+ delay: down 5m multiplier 1.5 max 1h
40
+ summary: Log Analytics ingestion latency on ${label:resource_name}
41
+ info: Average data ingestion latency for Log Analytics workspace ${label:resource_name} \
42
+ in ${label:resource_group} (${label:region}). \
43
+ High latency means data takes longer to become queryable.
44
+ to: sysadmin
45
+
46
+# --- User Queries: Failures ---
47
+
48
+# Helper: total query count over 5 minutes
49
+ template: am_log_analytics_query_total
50
+ on: azure_monitor.log_analytics.queries
51
+ class: Workload
52
+ type: Other
53
+component: Log Analytics
54
+ lookup: sum -5m unaligned of total
55
+ units: queries
56
+ every: 1m
57
+ info: Total queries on Log Analytics workspace ${label:resource_name} \
58
+ in ${label:resource_group} (${label:region})
59
+
60
+# Query failure rate as percentage of total queries.
61
+# Any sustained query failures indicate workspace or query problems.
62
+
63
+ template: am_log_analytics_query_failure_rate
64
+ on: azure_monitor.log_analytics.queries
65
+ class: Errors
66
+ type: Other
67
+component: Log Analytics
68
+ lookup: sum -5m unaligned of failed
69
+ calc: ($am_log_analytics_query_total > 0) ? ($this * 100 / $am_log_analytics_query_total) : (0)
70
+ units: %
71
+ every: 1m
72
+ warn: $this > (($status >= $WARNING) ? (3) : (5))
73
+ crit: $this > (($status == $CRITICAL) ? (5) : (15))
74
+ delay: down 5m multiplier 1.5 max 1h
75
+ summary: Log Analytics query failures on ${label:resource_name}
76
+ info: Percentage of failed queries on Log Analytics workspace ${label:resource_name} \
77
+ in ${label:resource_group} (${label:region})
78
+ to: sysadmin
79
+
80
+# --- Data Export ---
81
+
82
+# Export failures (rate). Any sustained export failures need attention.
83
+
84
+ template: am_log_analytics_export_failures
85
+ on: azure_monitor.log_analytics.export_failures
86
+ class: Errors
87
+ type: Other
88
+component: Log Analytics
89
+ lookup: average -5m unaligned of failed
90
+ units: exports/s
91
+ every: 1m
92
+ warn: $this != nan AND $this > (($status >= $WARNING) ? (0) : (1))
93
+ crit: $this != nan AND $this > (($status == $CRITICAL) ? (1) : (5))
94
+ delay: down 5m multiplier 1.5 max 1h
95
+ summary: Log Analytics export failures on ${label:resource_name}
96
+ info: Data export failure rate for Log Analytics workspace ${label:resource_name} \
97
+ in ${label:resource_group} (${label:region}). \
98
+ Failures mean exported data is not reaching the destination.
99
+ to: sysadmin
100
+
101
+# --- Legacy Agent: CPU ---
102
+
103
+# CPU utilization from legacy Log Analytics agents.
104
+
105
+ template: am_log_analytics_legacy_cpu
106
+ on: azure_monitor.log_analytics.legacy_cpu_utilization
107
+ class: Utilization
108
+ type: Other
109
+component: Log Analytics
110
+ lookup: average -5m unaligned of processor
111
+ units: percentage
112
+ every: 1m
113
+ warn: $this != nan AND $this > (($status >= $WARNING) ? (80) : (90))
114
+ crit: $this != nan AND $this > (($status == $CRITICAL) ? (90) : (95))
115
+ delay: down 5m multiplier 1.5 max 1h
116
+ summary: Legacy agent CPU on ${label:resource_name}
117
+ info: Processor time reported by legacy Log Analytics agent on ${label:resource_name} \
118
+ in ${label:resource_group} (${label:region})
119
+ to: sysadmin
120
+
121
+# --- Legacy Agent: Memory ---
122
+
123
+# Memory utilization from legacy Log Analytics agents. High is bad.
124
+
125
+ template: am_log_analytics_legacy_memory
126
+ on: azure_monitor.log_analytics.legacy_memory_utilization
127
+ class: Utilization
128
+ type: Other
129
+component: Log Analytics
130
+ lookup: average -5m unaligned of used
131
+ units: percentage
132
+ every: 1m
133
+ warn: $this != nan AND $this > (($status >= $WARNING) ? (80) : (90))
134
+ crit: $this != nan AND $this > (($status == $CRITICAL) ? (90) : (95))
135
+ delay: down 5m multiplier 1.5 max 1h
136
+ summary: Legacy agent memory on ${label:resource_name}
137
+ info: Memory utilization reported by legacy Log Analytics agent on ${label:resource_name} \
138
+ in ${label:resource_group} (${label:region})
139
+ to: sysadmin
140
+
141
+# --- Legacy Agent: Swap ---
142
+
143
+# Swap utilization from legacy Log Analytics agents. High is bad.
144
+
145
+ template: am_log_analytics_legacy_swap
146
+ on: azure_monitor.log_analytics.legacy_swap_utilization
147
+ class: Utilization
148
+ type: Other
149
+component: Log Analytics
150
+ lookup: average -5m unaligned of used
151
+ units: percentage
152
+ every: 1m
153
+ warn: $this != nan AND $this > (($status >= $WARNING) ? (50) : (70))
154
+ crit: $this != nan AND $this > (($status == $CRITICAL) ? (70) : (90))
155
+ delay: down 5m multiplier 1.5 max 1h
156
+ summary: Legacy agent swap usage on ${label:resource_name}
157
+ info: Swap utilization reported by legacy Log Analytics agent on ${label:resource_name} \
158
+ in ${label:resource_group} (${label:region})
159
+ to: sysadmin
160
+
161
+# --- Legacy Agent: Disk Space ---
162
+
163
+# Disk space utilization from legacy Log Analytics agents. High is bad.
164
+
165
+ template: am_log_analytics_legacy_disk_space
166
+ on: azure_monitor.log_analytics.legacy_disk_space_utilization
167
+ class: Utilization
168
+ type: Other
169
+component: Log Analytics
170
+ lookup: average -5m unaligned of used
171
+ units: percentage
172
+ every: 1m
173
+ warn: $this != nan AND $this > (($status >= $WARNING) ? (80) : (85))
174
+ crit: $this != nan AND $this > (($status == $CRITICAL) ? (85) : (95))
175
+ delay: down 5m multiplier 1.5 max 1h
176
+ summary: Legacy agent disk space on ${label:resource_name}
177
+ info: Disk space utilization reported by legacy Log Analytics agent on ${label:resource_name} \
178
+ in ${label:resource_group} (${label:region})
179
+ to: sysadmin
180
+
181
+# --- Legacy Agent: Disk Inodes ---
182
+
183
+# Inode utilization from legacy Log Analytics agents. High is bad.
184
+
185
+ template: am_log_analytics_legacy_disk_inodes
186
+ on: azure_monitor.log_analytics.legacy_disk_inodes
187
+ class: Utilization
188
+ type: Other
189
+component: Log Analytics
190
+ lookup: average -5m unaligned of used
191
+ units: percentage
192
+ every: 1m
193
+ warn: $this != nan AND $this > (($status >= $WARNING) ? (80) : (85))
194
+ crit: $this != nan AND $this > (($status == $CRITICAL) ? (85) : (95))
195
+ delay: down 5m multiplier 1.5 max 1h
196
+ summary: Legacy agent inode usage on ${label:resource_name}
197
+ info: Inode utilization reported by legacy Log Analytics agent on ${label:resource_name} \
198
+ in ${label:resource_group} (${label:region})
199
+ to: sysadmin
200
+
201
+# --- Legacy Agent: Disk I/O Latency ---
202
+
203
+# Disk I/O latency from legacy Log Analytics agents. High is bad.
204
+# Read and write latency in seconds per operation.
205
+
206
+ template: am_log_analytics_legacy_disk_read_latency
207
+ on: azure_monitor.log_analytics.legacy_disk_io_latency
208
+ class: Latency
209
+ type: Other
210
+component: Log Analytics
211
+ lookup: average -5m unaligned of read
212
+ units: seconds
213
+ every: 1m
214
+ warn: $this != nan AND $this > (($status >= $WARNING) ? (0.05) : (0.1))
215
+ crit: $this != nan AND $this > (($status == $CRITICAL) ? (0.1) : (0.5))
216
+ delay: down 5m multiplier 1.5 max 1h
217
+ summary: Legacy agent disk read latency on ${label:resource_name}
218
+ info: Average disk read latency reported by legacy Log Analytics agent on ${label:resource_name} \
219
+ in ${label:resource_group} (${label:region})
220
+ to: sysadmin
221
+
222
+ template: am_log_analytics_legacy_disk_write_latency
223
+ on: azure_monitor.log_analytics.legacy_disk_io_latency
224
+ class: Latency
225
+ type: Other
226
+component: Log Analytics
227
+ lookup: average -5m unaligned of write
228
+ units: seconds
229
+ every: 1m
230
+ warn: $this != nan AND $this > (($status >= $WARNING) ? (0.05) : (0.1))
231
+ crit: $this != nan AND $this > (($status == $CRITICAL) ? (0.1) : (0.5))
232
+ delay: down 5m multiplier 1.5 max 1h
233
+ summary: Legacy agent disk write latency on ${label:resource_name}
234
+ info: Average disk write latency reported by legacy Log Analytics agent on ${label:resource_name} \
235
+ in ${label:resource_group} (${label:region})
236
+ to: sysadmin
237
+
238
+# --- Legacy Agent: Disk Queue ---
239
+
240
+# Disk queue length from legacy Log Analytics agents. High means I/O saturation.
241
+
242
+ template: am_log_analytics_legacy_disk_queue
243
+ on: azure_monitor.log_analytics.legacy_disk_queue
244
+ class: Workload
245
+ type: Other
246
+component: Log Analytics
247
+ lookup: average -5m unaligned of queue_length
248
+ units: operations
249
+ every: 1m
250
+ warn: $this != nan AND $this > (($status >= $WARNING) ? (2) : (5))
251
+ crit: $this != nan AND $this > (($status == $CRITICAL) ? (5) : (10))
252
+ delay: down 5m multiplier 1.5 max 1h
253
+ summary: Legacy agent disk queue on ${label:resource_name}
254
+ info: Current disk queue length reported by legacy Log Analytics agent on ${label:resource_name} \
255
+ in ${label:resource_group} (${label:region}). \
256
+ High queue length indicates I/O saturation.
257
+ to: sysadmin
258
+
259
+# --- Legacy Agent: Network Errors ---
260
+
261
+# Network errors from legacy Log Analytics agents.
262
+
263
+ template: am_log_analytics_legacy_network_rx_errors
264
+ on: azure_monitor.log_analytics.legacy_network_errors
265
+ class: Errors
266
+ type: Other
267
+component: Log Analytics
268
+ lookup: average -5m unaligned of rx
269
+ units: errors
270
+ every: 1m
271
+ warn: $this != nan AND $this > (($status >= $WARNING) ? (5) : (10))
272
+ crit: $this != nan AND $this > (($status == $CRITICAL) ? (10) : (50))
273
+ delay: down 5m multiplier 1.5 max 1h
274
+ summary: Legacy agent network RX errors on ${label:resource_name}
275
+ info: Network receive errors reported by legacy Log Analytics agent on ${label:resource_name} \
276
+ in ${label:resource_group} (${label:region})
277
+ to: sysadmin
278
+
279
+ template: am_log_analytics_legacy_network_tx_errors
280
+ on: azure_monitor.log_analytics.legacy_network_errors
281
+ class: Errors
282
+ type: Other
283
+component: Log Analytics
284
+ lookup: average -5m unaligned of tx
285
+ units: errors
286
+ every: 1m
287
+ warn: $this != nan AND $this > (($status >= $WARNING) ? (5) : (10))
288
+ crit: $this != nan AND $this > (($status == $CRITICAL) ? (10) : (50))
289
+ delay: down 5m multiplier 1.5 max 1h
290
+ summary: Legacy agent network TX errors on ${label:resource_name}
291
+ info: Network transmit errors reported by legacy Log Analytics agent on ${label:resource_name} \
292
+ in ${label:resource_group} (${label:region})
293
+ to: sysadmin
src/health/health.d/azure_monitor_logic_apps.conf
new
+248
@@ -0,0 +1,248 @@
1
+# you can disable an alarm notification by setting the 'to' line to: silent
2
+
3
+# --- Run Failure Rate ---
4
+
5
+# Run failure percentage (0-100%). High is bad.
6
+# AMBA: RunFailurePercentage > 0 is Sev1
7
+
8
+ template: am_logic_apps_run_failure_rate
9
+ on: azure_monitor.logic_apps.run_failure_rate
10
+ class: Errors
11
+ type: Other
12
+component: Logic Apps
13
+ lookup: average -5m unaligned of failure_rate
14
+ units: percentage
15
+ every: 1m
16
+ warn: $this > (($status >= $WARNING) ? (1) : (5))
17
+ crit: $this > (($status == $CRITICAL) ? (5) : (10))
18
+ delay: down 5m multiplier 1.5 max 1h
19
+ summary: Logic Apps run failure rate on ${label:resource_name}
20
+ info: Percentage of workflow runs failing on Logic App ${label:resource_name} \
21
+ in ${label:resource_group} (${label:region})
22
+ to: sysadmin
23
+
24
+# --- Run Failures (absolute count) ---
25
+
26
+# Failed runs rate. Any sustained failures need attention.
27
+
28
+ template: am_logic_apps_runs_failed
29
+ on: azure_monitor.logic_apps.run_lifecycle
30
+ class: Errors
31
+ type: Other
32
+component: Logic Apps
33
+ lookup: average -5m unaligned of failed
34
+ units: runs/s
35
+ every: 1m
36
+ warn: $this > (($status >= $WARNING) ? (0) : (1))
37
+ crit: $this > (($status == $CRITICAL) ? (1) : (5))
38
+ delay: down 5m multiplier 1.5 max 1h
39
+ summary: Logic Apps failed runs on ${label:resource_name}
40
+ info: Rate of failed workflow runs on Logic App ${label:resource_name} \
41
+ in ${label:resource_group} (${label:region})
42
+ to: sysadmin
43
+
44
+# --- Run Latency ---
45
+
46
+# Overall run latency (seconds). High latency indicates slow workflows.
47
+
48
+ template: am_logic_apps_run_latency
49
+ on: azure_monitor.logic_apps.run_latency
50
+ class: Latency
51
+ type: Other
52
+component: Logic Apps
53
+ lookup: average -5m unaligned of all
54
+ units: seconds
55
+ every: 1m
56
+ warn: $this > (($status >= $WARNING) ? (30) : (60))
57
+ crit: $this > (($status == $CRITICAL) ? (60) : (120))
58
+ delay: down 5m multiplier 1.5 max 1h
59
+ summary: Logic Apps run latency on ${label:resource_name}
60
+ info: Average workflow run latency on Logic App ${label:resource_name} \
61
+ in ${label:resource_group} (${label:region})
62
+ to: sysadmin
63
+
64
+# --- Run Throttling ---
65
+
66
+# Throttled run events indicate the workflow is hitting
67
+# Azure rate limits.
68
+
69
+ template: am_logic_apps_run_throttled
70
+ on: azure_monitor.logic_apps.run_throttling
71
+ class: Errors
72
+ type: Other
73
+component: Logic Apps
74
+ lookup: average -5m unaligned
75
+ units: events/s
76
+ every: 1m
77
+ warn: $this > (($status >= $WARNING) ? (0) : (1))
78
+ delay: down 5m multiplier 1.5 max 1h
79
+ summary: Logic Apps run throttling on ${label:resource_name}
80
+ info: Rate of throttled run events on Logic App ${label:resource_name} \
81
+ in ${label:resource_group} (${label:region}). \
82
+ Throttling indicates Azure rate limits are being hit
83
+ to: sysadmin
84
+
85
+# --- Action Failures ---
86
+
87
+# Failed actions rate. Failing actions cause workflow failures.
88
+
89
+ template: am_logic_apps_actions_failed
90
+ on: azure_monitor.logic_apps.action_lifecycle
91
+ class: Errors
92
+ type: Other
93
+component: Logic Apps
94
+ lookup: average -5m unaligned of failed
95
+ units: actions/s
96
+ every: 1m
97
+ warn: $this > (($status >= $WARNING) ? (0) : (1))
98
+ crit: $this > (($status == $CRITICAL) ? (1) : (5))
99
+ delay: down 5m multiplier 1.5 max 1h
100
+ summary: Logic Apps failed actions on ${label:resource_name}
101
+ info: Rate of failed actions on Logic App ${label:resource_name} \
102
+ in ${label:resource_group} (${label:region})
103
+ to: sysadmin
104
+
105
+# --- Action Latency ---
106
+
107
+# Average action latency. High values indicate slow connectors
108
+# or backend dependencies.
109
+
110
+ template: am_logic_apps_action_latency
111
+ on: azure_monitor.logic_apps.action_latency
112
+ class: Latency
113
+ type: Other
114
+component: Logic Apps
115
+ lookup: average -5m unaligned of all
116
+ units: seconds
117
+ every: 1m
118
+ warn: $this > (($status >= $WARNING) ? (15) : (30))
119
+ crit: $this > (($status == $CRITICAL) ? (30) : (60))
120
+ delay: down 5m multiplier 1.5 max 1h
121
+ summary: Logic Apps action latency on ${label:resource_name}
122
+ info: Average action latency on Logic App ${label:resource_name} \
123
+ in ${label:resource_group} (${label:region})
124
+ to: sysadmin
125
+
126
+# --- Action Throttling ---
127
+
128
+# Throttled action events indicate connectors or actions
129
+# are hitting Azure rate limits.
130
+
131
+ template: am_logic_apps_action_throttled
132
+ on: azure_monitor.logic_apps.action_throttling
133
+ class: Errors
134
+ type: Other
135
+component: Logic Apps
136
+ lookup: average -5m unaligned of total
137
+ units: events/s
138
+ every: 1m
139
+ warn: $this > (($status >= $WARNING) ? (0) : (1))
140
+ delay: down 5m multiplier 1.5 max 1h
141
+ summary: Logic Apps action throttling on ${label:resource_name}
142
+ info: Rate of throttled action events on Logic App ${label:resource_name} \
143
+ in ${label:resource_group} (${label:region}). \
144
+ Throttling indicates connector rate limits are being hit
145
+ to: sysadmin
146
+
147
+# --- Trigger Failures ---
148
+
149
+# Failed triggers prevent workflows from starting.
150
+
151
+ template: am_logic_apps_triggers_failed
152
+ on: azure_monitor.logic_apps.trigger_lifecycle
153
+ class: Errors
154
+ type: Other
155
+component: Logic Apps
156
+ lookup: average -5m unaligned of failed
157
+ units: triggers/s
158
+ every: 1m
159
+ warn: $this > (($status >= $WARNING) ? (0) : (1))
160
+ crit: $this > (($status == $CRITICAL) ? (1) : (5))
161
+ delay: down 5m multiplier 1.5 max 1h
162
+ summary: Logic Apps failed triggers on ${label:resource_name}
163
+ info: Rate of failed triggers on Logic App ${label:resource_name} \
164
+ in ${label:resource_group} (${label:region}). \
165
+ Failed triggers prevent workflows from executing
166
+ to: sysadmin
167
+
168
+# --- Trigger Latency ---
169
+
170
+# Overall trigger latency. High values indicate slow polling
171
+# or webhook delays.
172
+
173
+ template: am_logic_apps_trigger_latency
174
+ on: azure_monitor.logic_apps.trigger_latency
175
+ class: Latency
176
+ type: Other
177
+component: Logic Apps
178
+ lookup: average -5m unaligned of all
179
+ units: seconds
180
+ every: 1m
181
+ warn: $this > (($status >= $WARNING) ? (15) : (30))
182
+ crit: $this > (($status == $CRITICAL) ? (30) : (60))
183
+ delay: down 5m multiplier 1.5 max 1h
184
+ summary: Logic Apps trigger latency on ${label:resource_name}
185
+ info: Average trigger latency on Logic App ${label:resource_name} \
186
+ in ${label:resource_group} (${label:region})
187
+ to: sysadmin
188
+
189
+# --- Trigger Throttling ---
190
+
191
+# Throttled trigger events indicate polling or webhook triggers
192
+# are hitting Azure rate limits.
193
+
194
+ template: am_logic_apps_trigger_throttled
195
+ on: azure_monitor.logic_apps.trigger_throttling
196
+ class: Errors
197
+ type: Other
198
+component: Logic Apps
199
+ lookup: average -5m unaligned of total
200
+ units: events/s
201
+ every: 1m
202
+ warn: $this > (($status >= $WARNING) ? (0) : (1))
203
+ delay: down 5m multiplier 1.5 max 1h
204
+ summary: Logic Apps trigger throttling on ${label:resource_name}
205
+ info: Rate of throttled trigger events on Logic App ${label:resource_name} \
206
+ in ${label:resource_group} (${label:region}). \
207
+ Throttling indicates trigger rate limits are being hit
208
+ to: sysadmin
209
+
210
+# --- AI Agent Token Overflow ---
211
+
212
+# Completion token overflow events indicate AI agent responses
213
+# are exceeding token limits (AI-enabled Logic Apps only).
214
+
215
+ template: am_logic_apps_completion_token_overflow
216
+ on: azure_monitor.logic_apps.agent
217
+ class: Errors
218
+ type: Other
219
+component: Logic Apps
220
+ lookup: average -5m unaligned of completion_overflow
221
+ units: events/s
222
+ every: 1m
223
+ warn: $this != nan AND $this > (($status >= $WARNING) ? (0) : (1))
224
+ delay: down 5m multiplier 1.5 max 1h
225
+ summary: Logic Apps completion token overflow on ${label:resource_name}
226
+ info: Rate of completion token overflow events on Logic App ${label:resource_name} \
227
+ in ${label:resource_group} (${label:region}). \
228
+ Indicates AI agent responses are exceeding token limits
229
+ to: sysadmin
230
+
231
+# Prompt token overflow events indicate AI agent prompts
232
+# are exceeding token limits (AI-enabled Logic Apps only).
233
+
234
+ template: am_logic_apps_prompt_token_overflow
235
+ on: azure_monitor.logic_apps.agent
236
+ class: Errors
237
+ type: Other
238
+component: Logic Apps
239
+ lookup: average -5m unaligned of prompt_overflow
240
+ units: events/s
241
+ every: 1m
242
+ warn: $this != nan AND $this > (($status >= $WARNING) ? (0) : (1))
243
+ delay: down 5m multiplier 1.5 max 1h
244
+ summary: Logic Apps prompt token overflow on ${label:resource_name}
245
+ info: Rate of prompt token overflow events on Logic App ${label:resource_name} \
246
+ in ${label:resource_group} (${label:region}). \
247
+ Indicates AI agent prompts are exceeding token limits
248
+ to: sysadmin
src/health/health.d/azure_monitor_machine_learning.conf
new
+284
@@ -0,0 +1,284 @@
1
+# you can disable an alarm notification by setting the 'to' line to: silent
2
+
3
+# --- Quota ---
4
+
5
+ template: am_ml_quota_utilization
6
+ on: azure_monitor.machine_learning.quota_utilization
7
+ class: Utilization
8
+ type: Other
9
+component: Azure ML
10
+ lookup: average -5m unaligned of utilization
11
+ units: percentage
12
+ every: 1m
13
+ warn: $this > (($status >= $WARNING) ? (75) : (85))
14
+ crit: $this > (($status == $CRITICAL) ? (85) : (95))
15
+ delay: down 5m multiplier 1.5 max 1h
16
+ summary: ML quota utilization on ${label:resource_name}
17
+ info: Average compute quota utilization on Azure ML workspace ${label:resource_name} \
18
+ in ${label:resource_group} (${label:region}). \
19
+ High quota utilization may prevent new jobs from starting.
20
+ to: sysadmin
21
+
22
+# --- Cluster Cores ---
23
+
24
+ template: am_ml_unusable_cores
25
+ on: azure_monitor.machine_learning.cluster_cores
26
+ class: Errors
27
+ type: Other
28
+component: Azure ML
29
+ lookup: average -5m unaligned of unusable
30
+ units: cores
31
+ every: 1m
32
+ warn: $this > (($status >= $WARNING) ? (0) : (2))
33
+ crit: $this > (($status == $CRITICAL) ? (2) : (10))
34
+ delay: down 5m multiplier 1.5 max 1h
35
+ summary: ML unusable cores on ${label:resource_name}
36
+ info: Number of unusable compute cores on Azure ML workspace ${label:resource_name} \
37
+ in ${label:resource_group} (${label:region}). \
38
+ Unusable cores indicate hardware or configuration failures.
39
+ to: sysadmin
40
+
41
+ template: am_ml_preempted_cores
42
+ on: azure_monitor.machine_learning.cluster_cores
43
+ class: Workload
44
+ type: Other
45
+component: Azure ML
46
+ lookup: average -5m unaligned of preempted
47
+ units: cores
48
+ every: 1m
49
+ warn: $this > (($status >= $WARNING) ? (5) : (10))
50
+ delay: down 5m multiplier 1.5 max 1h
51
+ summary: ML preempted cores on ${label:resource_name}
52
+ info: Number of preempted compute cores on Azure ML workspace ${label:resource_name} \
53
+ in ${label:resource_group} (${label:region}). \
54
+ Preempted cores may cause training job interruptions.
55
+ to: sysadmin
56
+
57
+# --- Cluster Nodes ---
58
+
59
+ template: am_ml_unusable_nodes
60
+ on: azure_monitor.machine_learning.cluster_nodes
61
+ class: Errors
62
+ type: Other
63
+component: Azure ML
64
+ lookup: average -5m unaligned of unusable
65
+ units: nodes
66
+ every: 1m
67
+ warn: $this > (($status >= $WARNING) ? (0) : (1))
68
+ crit: $this > (($status == $CRITICAL) ? (1) : (5))
69
+ delay: down 5m multiplier 1.5 max 1h
70
+ summary: ML unusable nodes on ${label:resource_name}
71
+ info: Number of unusable compute nodes on Azure ML workspace ${label:resource_name} \
72
+ in ${label:resource_group} (${label:region}). \
73
+ Unusable nodes indicate hardware or configuration failures.
74
+ to: sysadmin
75
+
76
+# --- CPU Utilization ---
77
+
78
+ template: am_ml_cpu_utilization
79
+ on: azure_monitor.machine_learning.cpu_utilization
80
+ class: Utilization
81
+ type: Other
82
+component: Azure ML
83
+ lookup: average -5m unaligned of cluster_cpu
84
+ units: percentage
85
+ every: 1m
86
+ warn: $this > (($status >= $WARNING) ? (80) : (90))
87
+ crit: $this > (($status == $CRITICAL) ? (90) : (95))
88
+ delay: down 5m multiplier 1.5 max 1h
89
+ summary: ML CPU utilization on ${label:resource_name}
90
+ info: Average cluster CPU utilization on Azure ML workspace ${label:resource_name} \
91
+ in ${label:resource_group} (${label:region})
92
+ to: sysadmin
93
+
94
+# --- CPU Memory Utilization ---
95
+
96
+ template: am_ml_cpu_memory_utilization
97
+ on: azure_monitor.machine_learning.cpu_memory_utilization
98
+ class: Utilization
99
+ type: Other
100
+component: Azure ML
101
+ lookup: average -5m unaligned of utilization
102
+ units: percentage
103
+ every: 1m
104
+ warn: $this > (($status >= $WARNING) ? (80) : (90))
105
+ crit: $this > (($status == $CRITICAL) ? (90) : (95))
106
+ delay: down 5m multiplier 1.5 max 1h
107
+ summary: ML CPU memory utilization on ${label:resource_name}
108
+ info: Average CPU memory utilization on Azure ML workspace ${label:resource_name} \
109
+ in ${label:resource_group} (${label:region})
110
+ to: sysadmin
111
+
112
+# --- GPU Utilization ---
113
+
114
+ template: am_ml_gpu_utilization
115
+ on: azure_monitor.machine_learning.gpu_utilization
116
+ class: Utilization
117
+ type: Other
118
+component: Azure ML
119
+ lookup: average -5m unaligned of cluster_gpu
120
+ units: percentage
121
+ every: 1m
122
+ warn: $this > (($status >= $WARNING) ? (85) : (95))
123
+ crit: $this > (($status == $CRITICAL) ? (95) : (99))
124
+ delay: down 5m multiplier 1.5 max 1h
125
+ summary: ML GPU utilization on ${label:resource_name}
126
+ info: Average cluster GPU utilization on Azure ML workspace ${label:resource_name} \
127
+ in ${label:resource_group} (${label:region})
128
+ to: sysadmin
129
+
130
+# --- GPU Memory Utilization ---
131
+
132
+ template: am_ml_gpu_memory_utilization
133
+ on: azure_monitor.machine_learning.gpu_memory_utilization
134
+ class: Utilization
135
+ type: Other
136
+component: Azure ML
137
+ lookup: average -5m unaligned of cluster_gpu_memory
138
+ units: percentage
139
+ every: 1m
140
+ warn: $this > (($status >= $WARNING) ? (80) : (90))
141
+ crit: $this > (($status == $CRITICAL) ? (90) : (95))
142
+ delay: down 5m multiplier 1.5 max 1h
143
+ summary: ML GPU memory utilization on ${label:resource_name}
144
+ info: Average cluster GPU memory utilization on Azure ML workspace ${label:resource_name} \
145
+ in ${label:resource_group} (${label:region}). \
146
+ High GPU memory usage may cause out-of-memory training failures.
147
+ to: sysadmin
148
+
149
+# --- Disk Usage ---
150
+
151
+ template: am_ml_disk_utilization
152
+ on: azure_monitor.machine_learning.disk_usage
153
+ class: Utilization
154
+ type: Other
155
+component: Azure ML
156
+ calc: ($used + $available > 0) ? ($used * 100 / ($used + $available)) : (0)
157
+ units: %
158
+ every: 1m
159
+ warn: $this > (($status >= $WARNING) ? (75) : (85))
160
+ crit: $this > (($status == $CRITICAL) ? (85) : (95))
161
+ delay: down 5m multiplier 1.5 max 1h
162
+ summary: ML disk utilization on ${label:resource_name}
163
+ info: Disk utilization percentage on Azure ML workspace ${label:resource_name} \
164
+ in ${label:resource_group} (${label:region}). \
165
+ High disk usage can cause training job failures.
166
+ to: sysadmin
167
+
168
+# --- Model Deployments ---
169
+
170
+ template: am_ml_model_deploy_failures
171
+ on: azure_monitor.machine_learning.model_deployments
172
+ class: Errors
173
+ type: Other
174
+component: Azure ML
175
+ lookup: sum -5m unaligned of failed
176
+ units: deployments
177
+ every: 1m
178
+ warn: $this > (($status >= $WARNING) ? (0) : (1))
179
+ crit: $this > (($status == $CRITICAL) ? (1) : (5))
180
+ delay: down 5m multiplier 1.5 max 1h
181
+ summary: ML model deployment failures on ${label:resource_name}
182
+ info: Number of failed model deployments over the last 5 minutes on Azure ML workspace ${label:resource_name} \
183
+ in ${label:resource_group} (${label:region})
184
+ to: sysadmin
185
+
186
+# --- Model Registrations ---
187
+
188
+ template: am_ml_model_register_failures
189
+ on: azure_monitor.machine_learning.model_registrations
190
+ class: Errors
191
+ type: Other
192
+component: Azure ML
193
+ lookup: sum -5m unaligned of failed
194
+ units: registrations
195
+ every: 1m
196
+ warn: $this > (($status >= $WARNING) ? (0) : (1))
197
+ crit: $this > (($status == $CRITICAL) ? (1) : (5))
198
+ delay: down 5m multiplier 1.5 max 1h
199
+ summary: ML model registration failures on ${label:resource_name}
200
+ info: Number of failed model registrations over the last 5 minutes on Azure ML workspace ${label:resource_name} \
201
+ in ${label:resource_group} (${label:region})
202
+ to: sysadmin
203
+
204
+# --- Run Completion ---
205
+
206
+ template: am_ml_failed_runs
207
+ on: azure_monitor.machine_learning.run_completion
208
+ class: Errors
209
+ type: Other
210
+component: Azure ML
211
+ lookup: sum -5m unaligned of failed
212
+ units: runs
213
+ every: 1m
214
+ warn: $this > (($status >= $WARNING) ? (0) : (3))
215
+ crit: $this > (($status == $CRITICAL) ? (3) : (10))
216
+ delay: down 5m multiplier 1.5 max 1h
217
+ summary: ML failed runs on ${label:resource_name}
218
+ info: Number of failed training/experiment runs over the last 5 minutes on Azure ML workspace ${label:resource_name} \
219
+ in ${label:resource_group} (${label:region})
220
+ to: sysadmin
221
+
222
+ template: am_ml_not_responding_runs
223
+ on: azure_monitor.machine_learning.run_completion
224
+ class: Availability
225
+ type: Other
226
+component: Azure ML
227
+ lookup: sum -5m unaligned of not_responding
228
+ units: runs
229
+ every: 1m
230
+ warn: $this > (($status >= $WARNING) ? (0) : (1))
231
+ crit: $this > (($status == $CRITICAL) ? (1) : (5))
232
+ delay: down 5m multiplier 1.5 max 1h
233
+ summary: ML not-responding runs on ${label:resource_name}
234
+ info: Number of runs that stopped responding over the last 5 minutes on Azure ML workspace ${label:resource_name} \
235
+ in ${label:resource_group} (${label:region}). \
236
+ Not-responding runs indicate compute or infrastructure issues.
237
+ to: sysadmin
238
+
239
+# --- Run Issues ---
240
+
241
+ template: am_ml_run_errors
242
+ on: azure_monitor.machine_learning.run_issues
243
+ class: Errors
244
+ type: Other
245
+component: Azure ML
246
+ lookup: sum -5m unaligned of errors
247
+ units: errors
248
+ every: 1m
249
+ warn: $this > (($status >= $WARNING) ? (0) : (5))
250
+ crit: $this > (($status == $CRITICAL) ? (5) : (20))
251
+ delay: down 5m multiplier 1.5 max 1h
252
+ summary: ML run errors on ${label:resource_name}
253
+ info: Number of run errors over the last 5 minutes on Azure ML workspace ${label:resource_name} \
254
+ in ${label:resource_group} (${label:region})
255
+ to: sysadmin
256
+
257
+# --- Storage API ---
258
+
259
+ template: am_ml_storage_api_total
260
+ on: azure_monitor.machine_learning.storage_api_calls
261
+ class: Workload
262
+ type: Other
263
+component: Azure ML
264
+ lookup: sum -5m unaligned of success,failure
265
+ units: calls
266
+ every: 1m
267
+ info: Total storage API calls over the last 5 minutes on Azure ML workspace ${label:resource_name}
268
+
269
+ template: am_ml_storage_api_failures
270
+ on: azure_monitor.machine_learning.storage_api_calls
271
+ class: Errors
272
+ type: Other
273
+component: Azure ML
274
+ lookup: sum -5m unaligned of failure
275
+ calc: ($am_ml_storage_api_total > 10) ? ($this * 100 / $am_ml_storage_api_total) : (0)
276
+ units: %
277
+ every: 1m
278
+ warn: $this > (($status >= $WARNING) ? (1) : (5))
279
+ crit: $this > (($status == $CRITICAL) ? (5) : (15))
280
+ delay: down 5m multiplier 1.5 max 1h
281
+ summary: ML storage API failure rate on ${label:resource_name}
282
+ info: Percentage of failed storage API calls over the last 5 minutes on Azure ML workspace ${label:resource_name} \
283
+ in ${label:resource_group} (${label:region})
284
+ to: sysadmin
src/health/health.d/azure_monitor_mysql_flexible.conf
new
+329
@@ -0,0 +1,329 @@
1
+# you can disable an alarm notification by setting the 'to' line to: silent
2
+
3
+# --- Utilization ---
4
+
5
+ template: am_mysql_flexible_cpu
6
+ on: azure_monitor.mysql_flexible.cpu
7
+ class: Utilization
8
+ type: Database
9
+component: Azure MySQL Flexible
10
+ lookup: average -5m unaligned of average
11
+ units: percentage
12
+ every: 1m
13
+ warn: $this > (($status >= $WARNING) ? (75) : (85))
14
+ crit: $this > (($status == $CRITICAL) ? (85) : (95))
15
+ delay: down 5m multiplier 1.5 max 1h
16
+ summary: MySQL Flexible CPU on ${label:resource_name}
17
+ info: Average CPU utilization on Azure MySQL Flexible Server ${label:resource_name} \
18
+ in ${label:resource_group} (${label:region})
19
+ to: dba
20
+
21
+ template: am_mysql_flexible_memory
22
+ on: azure_monitor.mysql_flexible.memory
23
+ class: Utilization
24
+ type: Database
25
+component: Azure MySQL Flexible
26
+ lookup: average -5m unaligned of average
27
+ units: percentage
28
+ every: 1m
29
+ warn: $this > (($status >= $WARNING) ? (75) : (85))
30
+ crit: $this > (($status == $CRITICAL) ? (85) : (95))
31
+ delay: down 5m multiplier 1.5 max 1h
32
+ summary: MySQL Flexible memory on ${label:resource_name}
33
+ info: Average memory utilization on Azure MySQL Flexible Server ${label:resource_name} \
34
+ in ${label:resource_group} (${label:region})
35
+ to: dba
36
+
37
+ template: am_mysql_flexible_io_utilization
38
+ on: azure_monitor.mysql_flexible.io_utilization
39
+ class: Utilization
40
+ type: Database
41
+component: Azure MySQL Flexible
42
+ lookup: average -5m unaligned of average
43
+ units: percentage
44
+ every: 1m
45
+ warn: $this > (($status >= $WARNING) ? (80) : (90))
46
+ crit: $this > (($status == $CRITICAL) ? (90) : (95))
47
+ delay: down 5m multiplier 1.5 max 1h
48
+ summary: MySQL Flexible I/O utilization on ${label:resource_name}
49
+ info: Average storage I/O utilization on Azure MySQL Flexible Server ${label:resource_name} \
50
+ in ${label:resource_group} (${label:region}). \
51
+ Sustained high I/O can cause query performance degradation
52
+ to: dba
53
+
54
+ template: am_mysql_flexible_storage_utilization
55
+ on: azure_monitor.mysql_flexible.storage_utilization
56
+ class: Utilization
57
+ type: Database
58
+component: Azure MySQL Flexible
59
+ lookup: average -5m unaligned of average
60
+ units: percentage
61
+ every: 1m
62
+ warn: $this > (($status >= $WARNING) ? (75) : (80))
63
+ crit: $this > (($status == $CRITICAL) ? (85) : (90))
64
+ delay: down 5m multiplier 1.5 max 1h
65
+ summary: MySQL Flexible storage on ${label:resource_name}
66
+ info: Storage utilization on Azure MySQL Flexible Server ${label:resource_name} \
67
+ in ${label:resource_group} (${label:region}). \
68
+ When storage reaches 100% the server becomes read-only
69
+ to: dba
70
+
71
+ template: am_mysql_flexible_serverlog_storage_utilization
72
+ on: azure_monitor.mysql_flexible.serverlog_storage_utilization
73
+ class: Utilization
74
+ type: Database
75
+component: Azure MySQL Flexible
76
+ lookup: average -5m unaligned of average
77
+ units: percentage
78
+ every: 1m
79
+ warn: $this > (($status >= $WARNING) ? (75) : (85))
80
+ crit: $this > (($status == $CRITICAL) ? (85) : (95))
81
+ delay: down 5m multiplier 1.5 max 1h
82
+ summary: MySQL Flexible server log storage on ${label:resource_name}
83
+ info: Server log storage utilization on Azure MySQL Flexible Server ${label:resource_name} \
84
+ in ${label:resource_group} (${label:region})
85
+ to: dba
86
+
87
+ template: am_mysql_flexible_cpu_credits_remaining
88
+ on: azure_monitor.mysql_flexible.cpu_credits
89
+ class: Utilization
90
+ type: Database
91
+component: Azure MySQL Flexible
92
+ lookup: average -5m unaligned of remaining
93
+ units: credits
94
+ every: 1m
95
+ warn: $this != nan AND $this < (($status >= $WARNING) ? (30) : (20))
96
+ delay: down 5m multiplier 1.5 max 1h
97
+ summary: MySQL Flexible CPU credits low on ${label:resource_name}
98
+ info: Remaining CPU credits on Azure MySQL Flexible Server ${label:resource_name} \
99
+ in ${label:resource_group} (${label:region}). \
100
+ Only applicable to burstable tier; exhaustion causes CPU throttling
101
+ to: dba
102
+
103
+# --- Availability ---
104
+
105
+ template: am_mysql_flexible_ha_io_status
106
+ on: azure_monitor.mysql_flexible.ha_status
107
+ class: Availability
108
+ type: Database
109
+component: Azure MySQL Flexible
110
+ lookup: average -5m unaligned of io
111
+ units: status
112
+ every: 1m
113
+ crit: $this != nan AND $this < 1
114
+ delay: down 5m multiplier 1.5 max 1h
115
+ summary: MySQL Flexible HA IO thread down on ${label:resource_name}
116
+ info: HA replication IO thread is not running on Azure MySQL Flexible Server ${label:resource_name} \
117
+ in ${label:resource_group} (${label:region}). \
118
+ Only relevant when high availability is configured
119
+ to: dba
120
+
121
+ template: am_mysql_flexible_ha_sql_status
122
+ on: azure_monitor.mysql_flexible.ha_status
123
+ class: Availability
124
+ type: Database
125
+component: Azure MySQL Flexible
126
+ lookup: average -5m unaligned of sql
127
+ units: status
128
+ every: 1m
129
+ crit: $this != nan AND $this < 1
130
+ delay: down 5m multiplier 1.5 max 1h
131
+ summary: MySQL Flexible HA SQL thread down on ${label:resource_name}
132
+ info: HA replication SQL thread is not running on Azure MySQL Flexible Server ${label:resource_name} \
133
+ in ${label:resource_group} (${label:region}). \
134
+ Only relevant when high availability is configured
135
+ to: dba
136
+
137
+ template: am_mysql_flexible_replica_io_status
138
+ on: azure_monitor.mysql_flexible.replica_status
139
+ class: Availability
140
+ type: Database
141
+component: Azure MySQL Flexible
142
+ lookup: average -5m unaligned of io
143
+ units: status
144
+ every: 1m
145
+ crit: $this != nan AND $this < 1
146
+ delay: down 5m multiplier 1.5 max 1h
147
+ summary: MySQL Flexible replica IO thread down on ${label:resource_name}
148
+ info: Read replica IO thread is not running on Azure MySQL Flexible Server ${label:resource_name} \
149
+ in ${label:resource_group} (${label:region}). \
150
+ Only relevant when read replicas are configured
151
+ to: dba
152
+
153
+ template: am_mysql_flexible_replica_sql_status
154
+ on: azure_monitor.mysql_flexible.replica_status
155
+ class: Availability
156
+ type: Database
157
+component: Azure MySQL Flexible
158
+ lookup: average -5m unaligned of sql
159
+ units: status
160
+ every: 1m
161
+ crit: $this != nan AND $this < 1
162
+ delay: down 5m multiplier 1.5 max 1h
163
+ summary: MySQL Flexible replica SQL thread down on ${label:resource_name}
164
+ info: Read replica SQL thread is not running on Azure MySQL Flexible Server ${label:resource_name} \
165
+ in ${label:resource_group} (${label:region}). \
166
+ Only relevant when read replicas are configured
167
+ to: dba
168
+
169
+# --- Replication ---
170
+
171
+ template: am_mysql_flexible_replication_lag
172
+ on: azure_monitor.mysql_flexible.replication_lag
173
+ class: Latency
174
+ type: Database
175
+component: Azure MySQL Flexible
176
+ lookup: average -5m unaligned of replica
177
+ units: seconds
178
+ every: 1m
179
+ warn: $this != nan AND $this > (($status >= $WARNING) ? (20) : (30))
180
+ crit: $this != nan AND $this > (($status == $CRITICAL) ? (30) : (60))
181
+ delay: down 5m multiplier 1.5 max 1h
182
+ summary: MySQL Flexible replica lag on ${label:resource_name}
183
+ info: Read replica replication lag on Azure MySQL Flexible Server ${label:resource_name} \
184
+ in ${label:resource_group} (${label:region}). \
185
+ Only relevant when read replicas are configured
186
+ to: dba
187
+
188
+ template: am_mysql_flexible_ha_replication_lag
189
+ on: azure_monitor.mysql_flexible.replication_lag
190
+ class: Latency
191
+ type: Database
192
+component: Azure MySQL Flexible
193
+ lookup: average -5m unaligned of ha
194
+ units: seconds
195
+ every: 1m
196
+ warn: $this != nan AND $this > (($status >= $WARNING) ? (10) : (20))
197
+ crit: $this != nan AND $this > (($status == $CRITICAL) ? (20) : (30))
198
+ delay: down 5m multiplier 1.5 max 1h
199
+ summary: MySQL Flexible HA replication lag on ${label:resource_name}
200
+ info: HA standby replication lag on Azure MySQL Flexible Server ${label:resource_name} \
201
+ in ${label:resource_group} (${label:region}). \
202
+ High lag increases data loss risk during failover. \
203
+ Only relevant when high availability is configured
204
+ to: dba
205
+
206
+# --- Latency / Contention ---
207
+
208
+ template: am_mysql_flexible_innodb_row_lock_time
209
+ on: azure_monitor.mysql_flexible.innodb_row_lock_time
210
+ class: Latency
211
+ type: Database
212
+component: Azure MySQL Flexible
213
+ lookup: average -5m unaligned of average
214
+ units: milliseconds
215
+ every: 1m
216
+ warn: $this > (($status >= $WARNING) ? (200) : (500))
217
+ crit: $this > (($status == $CRITICAL) ? (500) : (1000))
218
+ delay: down 5m multiplier 1.5 max 1h
219
+ summary: MySQL Flexible row lock wait time on ${label:resource_name}
220
+ info: Average InnoDB row lock wait time on Azure MySQL Flexible Server ${label:resource_name} \
221
+ in ${label:resource_group} (${label:region}). \
222
+ High values indicate significant lock contention between transactions
223
+ to: dba
224
+
225
+ template: am_mysql_flexible_lock_deadlocks
226
+ on: azure_monitor.mysql_flexible.lock_deadlocks
227
+ class: Errors
228
+ type: Database
229
+component: Azure MySQL Flexible
230
+ lookup: average -5m unaligned of total
231
+ units: deadlocks/s
232
+ every: 1m
233
+ warn: $this > (($status >= $WARNING) ? (0) : (1))
234
+ crit: $this > (($status == $CRITICAL) ? (1) : (5))
235
+ delay: down 5m multiplier 1.5 max 1h
236
+ summary: MySQL Flexible deadlocks on ${label:resource_name}
237
+ info: Rate of InnoDB deadlocks on Azure MySQL Flexible Server ${label:resource_name} \
238
+ in ${label:resource_group} (${label:region}). \
239
+ Deadlocks cause transactions to be rolled back
240
+ to: dba
241
+
242
+ template: am_mysql_flexible_lock_timeouts
243
+ on: azure_monitor.mysql_flexible.lock_timeouts
244
+ class: Errors
245
+ type: Database
246
+component: Azure MySQL Flexible
247
+ lookup: average -5m unaligned of total
248
+ units: timeouts/s
249
+ every: 1m
250
+ warn: $this > (($status >= $WARNING) ? (0) : (1))
251
+ crit: $this > (($status == $CRITICAL) ? (1) : (5))
252
+ delay: down 5m multiplier 1.5 max 1h
253
+ summary: MySQL Flexible lock timeouts on ${label:resource_name}
254
+ info: Rate of lock wait timeouts on Azure MySQL Flexible Server ${label:resource_name} \
255
+ in ${label:resource_group} (${label:region}). \
256
+ Timeouts indicate long-held locks blocking other transactions
257
+ to: dba
258
+
259
+# --- Errors ---
260
+
261
+ template: am_mysql_flexible_aborted_connections
262
+ on: azure_monitor.mysql_flexible.aborted_connections
263
+ class: Errors
264
+ type: Database
265
+component: Azure MySQL Flexible
266
+ lookup: average -5m unaligned of total
267
+ units: connections/s
268
+ every: 1m
269
+ warn: $this > (($status >= $WARNING) ? (3) : (5))
270
+ crit: $this > (($status == $CRITICAL) ? (10) : (20))
271
+ delay: down 5m multiplier 1.5 max 1h
272
+ summary: MySQL Flexible aborted connections on ${label:resource_name}
273
+ info: Rate of aborted connections on Azure MySQL Flexible Server ${label:resource_name} \
274
+ in ${label:resource_group} (${label:region}). \
275
+ Common causes include authentication failures, connection timeouts, and client errors
276
+ to: dba
277
+
278
+# --- Performance ---
279
+
280
+ template: am_mysql_flexible_slow_queries
281
+ on: azure_monitor.mysql_flexible.queries
282
+ class: Workload
283
+ type: Database
284
+component: Azure MySQL Flexible
285
+ lookup: average -5m unaligned of slow
286
+ units: queries/s
287
+ every: 1m
288
+ warn: $this > (($status >= $WARNING) ? (5) : (10))
289
+ crit: $this > (($status == $CRITICAL) ? (10) : (25))
290
+ delay: down 5m multiplier 1.5 max 1h
291
+ summary: MySQL Flexible slow queries on ${label:resource_name}
292
+ info: Rate of slow queries on Azure MySQL Flexible Server ${label:resource_name} \
293
+ in ${label:resource_group} (${label:region}). \
294
+ Review slow query log for optimization opportunities
295
+ to: dba
296
+
297
+ template: am_mysql_flexible_innodb_row_lock_waits
298
+ on: azure_monitor.mysql_flexible.innodb_row_lock_waits
299
+ class: Latency
300
+ type: Database
301
+component: Azure MySQL Flexible
302
+ lookup: average -5m unaligned of total
303
+ units: waits/s
304
+ every: 1m
305
+ warn: $this > (($status >= $WARNING) ? (50) : (100))
306
+ crit: $this > (($status == $CRITICAL) ? (100) : (200))
307
+ delay: down 5m multiplier 1.5 max 1h
308
+ summary: MySQL Flexible row lock waits on ${label:resource_name}
309
+ info: Rate of InnoDB row lock waits on Azure MySQL Flexible Server ${label:resource_name} \
310
+ in ${label:resource_group} (${label:region}). \
311
+ High lock waits degrade query throughput and increase response times
312
+ to: dba
313
+
314
+ template: am_mysql_flexible_history_list_length
315
+ on: azure_monitor.mysql_flexible.history_list_length
316
+ class: Utilization
317
+ type: Database
318
+component: Azure MySQL Flexible
319
+ lookup: average -5m unaligned of maximum
320
+ units: entries
321
+ every: 1m
322
+ warn: $this > (($status >= $WARNING) ? (50000) : (100000))
323
+ crit: $this > (($status == $CRITICAL) ? (100000) : (1000000))
324
+ delay: down 5m multiplier 1.5 max 1h
325
+ summary: MySQL Flexible history list length on ${label:resource_name}
326
+ info: InnoDB history list length (undo log entries) on Azure MySQL Flexible Server ${label:resource_name} \
327
+ in ${label:resource_group} (${label:region}). \
328
+ A growing history list indicates long-running transactions preventing purge
329
+ to: dba
src/health/health.d/azure_monitor_nat_gateway.conf
new
+86
@@ -0,0 +1,86 @@
1
+# you can disable an alarm notification by setting the 'to' line to: silent
2
+
3
+# --- Availability ---
4
+
5
+# AMBA Sev4: DatapathAvailability < 90% (30m window)
6
+# NAT Gateway datapath availability below 100% means the service is degraded.
7
+# Below 90% indicates significant packet loss through the gateway.
8
+
9
+ template: am_nat_gateway_datapath_availability
10
+ on: azure_monitor.nat_gateway.datapath_availability
11
+ class: Availability
12
+ type: Other
13
+component: Azure NAT Gateway
14
+ lookup: average -5m unaligned of average
15
+ units: percentage
16
+ every: 1m
17
+ warn: $this < (($status >= $WARNING) ? (99) : (95))
18
+ crit: $this < (($status == $CRITICAL) ? (95) : (90))
19
+ delay: down 5m multiplier 1.5 max 1h
20
+ summary: NAT Gateway availability on ${label:resource_name}
21
+ info: Datapath availability of NAT Gateway ${label:resource_name} \
22
+ in ${label:resource_group} (${label:region}). \
23
+ Values below 100% indicate packet loss through the gateway.
24
+ to: sysadmin
25
+
26
+# --- Errors ---
27
+
28
+# AMBA Sev1 (Critical): PacketDropCount > 5 packets/s (5m window)
29
+# Dropped packets indicate SNAT port exhaustion, flow timeouts, or
30
+# exceeding the connection limit of the NAT gateway.
31
+
32
+ template: am_nat_gateway_dropped_packets
33
+ on: azure_monitor.nat_gateway.dropped_packets
34
+ class: Errors
35
+ type: Other
36
+component: Azure NAT Gateway
37
+ lookup: average -5m unaligned of total
38
+ units: packets/s
39
+ every: 1m
40
+ warn: $this > (($status >= $WARNING) ? (0) : (5))
41
+ crit: $this > (($status == $CRITICAL) ? (5) : (50))
42
+ delay: down 5m multiplier 1.5 max 1h
43
+ summary: NAT Gateway packet drops on ${label:resource_name}
44
+ info: Packets being dropped by NAT Gateway ${label:resource_name} \
45
+ in ${label:resource_group} (${label:region}). \
46
+ Drops indicate SNAT port exhaustion or connection limit reached.
47
+ to: sysadmin
48
+
49
+# --- Connections ---
50
+
51
+# Azure NAT Gateway supports up to 2 million total SNAT connections.
52
+# Azure recommends alerting at 80% (1.6M). We warn at 60% (1.2M).
53
+
54
+ template: am_nat_gateway_snat_connections
55
+ on: azure_monitor.nat_gateway.snat_connections
56
+ class: Utilization
57
+ type: Other
58
+component: Azure NAT Gateway
59
+ lookup: average -5m unaligned of total
60
+ units: connections
61
+ every: 1m
62
+ warn: $this > (($status >= $WARNING) ? (1000000) : (1200000))
63
+ crit: $this > (($status == $CRITICAL) ? (1200000) : (1600000))
64
+ delay: down 5m multiplier 1.5 max 1h
65
+ summary: NAT Gateway SNAT connections on ${label:resource_name}
66
+ info: SNAT connection count on NAT Gateway ${label:resource_name} \
67
+ in ${label:resource_group} (${label:region}). \
68
+ Azure limit is 2 million connections per gateway.
69
+ to: sysadmin
70
+
71
+ template: am_nat_gateway_total_connections
72
+ on: azure_monitor.nat_gateway.total_connections
73
+ class: Utilization
74
+ type: Other
75
+component: Azure NAT Gateway
76
+ lookup: average -5m unaligned of total
77
+ units: connections
78
+ every: 1m
79
+ warn: $this > (($status >= $WARNING) ? (1000000) : (1200000))
80
+ crit: $this > (($status == $CRITICAL) ? (1200000) : (1600000))
81
+ delay: down 5m multiplier 1.5 max 1h
82
+ summary: NAT Gateway total connections on ${label:resource_name}
83
+ info: Total SNAT connection count on NAT Gateway ${label:resource_name} \
84
+ in ${label:resource_group} (${label:region}). \
85
+ Azure limit is 2 million connections per gateway.
86
+ to: sysadmin
src/health/health.d/azure_monitor_postgres_flexible.conf
new
+344
@@ -0,0 +1,344 @@
1
+# you can disable an alarm notification by setting the 'to' line to: silent
2
+
3
+# --- Availability ---
4
+
5
+ template: am_postgres_flexible_availability
6
+ on: azure_monitor.postgres_flexible.availability
7
+ class: Availability
8
+ type: Database
9
+component: Azure PostgreSQL Flexible
10
+ lookup: average -5m unaligned of maximum
11
+ units: state
12
+ every: 1m
13
+ crit: $this < 1
14
+ delay: down 5m multiplier 1.5 max 1h
15
+ summary: PostgreSQL Flexible Server down on ${label:resource_name}
16
+ info: Database is not alive on Azure PostgreSQL Flexible Server ${label:resource_name} \
17
+ in ${label:resource_group} (${label:region})
18
+ to: dba
19
+
20
+# --- Utilization ---
21
+
22
+ template: am_postgres_flexible_cpu
23
+ on: azure_monitor.postgres_flexible.cpu
24
+ class: Utilization
25
+ type: Database
26
+component: Azure PostgreSQL Flexible
27
+ lookup: average -5m unaligned of average
28
+ units: percentage
29
+ every: 1m
30
+ warn: $this > (($status >= $WARNING) ? (75) : (85))
31
+ crit: $this > (($status == $CRITICAL) ? (85) : (95))
32
+ delay: down 5m multiplier 1.5 max 1h
33
+ summary: PostgreSQL Flexible CPU on ${label:resource_name}
34
+ info: Average CPU utilization on Azure PostgreSQL Flexible Server ${label:resource_name} \
35
+ in ${label:resource_group} (${label:region})
36
+ to: dba
37
+
38
+ template: am_postgres_flexible_memory
39
+ on: azure_monitor.postgres_flexible.memory
40
+ class: Utilization
41
+ type: Database
42
+component: Azure PostgreSQL Flexible
43
+ lookup: average -5m unaligned of average
44
+ units: percentage
45
+ every: 1m
46
+ warn: $this > (($status >= $WARNING) ? (80) : (90))
47
+ crit: $this > (($status == $CRITICAL) ? (90) : (95))
48
+ delay: down 5m multiplier 1.5 max 1h
49
+ summary: PostgreSQL Flexible memory on ${label:resource_name}
50
+ info: Average memory utilization on Azure PostgreSQL Flexible Server ${label:resource_name} \
51
+ in ${label:resource_group} (${label:region})
52
+ to: dba
53
+
54
+# --- Storage ---
55
+
56
+ template: am_postgres_flexible_storage_utilization
57
+ on: azure_monitor.postgres_flexible.storage_utilization
58
+ class: Utilization
59
+ type: Database
60
+component: Azure PostgreSQL Flexible
61
+ lookup: average -5m unaligned of average
62
+ units: percentage
63
+ every: 1m
64
+ warn: $this > (($status >= $WARNING) ? (75) : (85))
65
+ crit: $this > (($status == $CRITICAL) ? (85) : (95))
66
+ delay: down 5m multiplier 1.5 max 1h
67
+ summary: PostgreSQL Flexible storage on ${label:resource_name}
68
+ info: Storage utilization on Azure PostgreSQL Flexible Server ${label:resource_name} \
69
+ in ${label:resource_group} (${label:region}). \
70
+ Running out of storage causes the server to become read-only
71
+ to: dba
72
+
73
+# --- I/O ---
74
+
75
+ template: am_postgres_flexible_disk_bandwidth_saturation
76
+ on: azure_monitor.postgres_flexible.disk_saturation
77
+ class: Utilization
78
+ type: Database
79
+component: Azure PostgreSQL Flexible
80
+ lookup: average -5m unaligned of bandwidth
81
+ units: percentage
82
+ every: 1m
83
+ warn: $this > (($status >= $WARNING) ? (75) : (85))
84
+ crit: $this > (($status == $CRITICAL) ? (85) : (95))
85
+ delay: down 5m multiplier 1.5 max 1h
86
+ summary: PostgreSQL Flexible disk bandwidth saturation on ${label:resource_name}
87
+ info: Disk bandwidth consumed percentage on Azure PostgreSQL Flexible Server ${label:resource_name} \
88
+ in ${label:resource_group} (${label:region}). \
89
+ Sustained high values indicate I/O throttling
90
+ to: dba
91
+
92
+ template: am_postgres_flexible_disk_iops_saturation
93
+ on: azure_monitor.postgres_flexible.disk_saturation
94
+ class: Utilization
95
+ type: Database
96
+component: Azure PostgreSQL Flexible
97
+ lookup: average -5m unaligned of iops
98
+ units: percentage
99
+ every: 1m
100
+ warn: $this > (($status >= $WARNING) ? (75) : (85))
101
+ crit: $this > (($status == $CRITICAL) ? (85) : (95))
102
+ delay: down 5m multiplier 1.5 max 1h
103
+ summary: PostgreSQL Flexible disk IOPS saturation on ${label:resource_name}
104
+ info: Disk IOPS consumed percentage on Azure PostgreSQL Flexible Server ${label:resource_name} \
105
+ in ${label:resource_group} (${label:region}). \
106
+ Sustained high values indicate I/O throttling
107
+ to: dba
108
+
109
+ template: am_postgres_flexible_disk_queue_depth
110
+ on: azure_monitor.postgres_flexible.disk_queue_depth
111
+ class: Workload
112
+ type: Database
113
+component: Azure PostgreSQL Flexible
114
+ lookup: average -5m unaligned of average
115
+ units: operations
116
+ every: 1m
117
+ warn: $this > (($status >= $WARNING) ? (32) : (64))
118
+ crit: $this > (($status == $CRITICAL) ? (64) : (128))
119
+ delay: down 5m multiplier 1.5 max 1h
120
+ summary: PostgreSQL Flexible disk queue depth on ${label:resource_name}
121
+ info: Disk queue depth on Azure PostgreSQL Flexible Server ${label:resource_name} \
122
+ in ${label:resource_group} (${label:region}). \
123
+ High queue depth indicates I/O subsystem is saturated
124
+ to: dba
125
+
126
+# --- Connections ---
127
+
128
+ template: am_postgres_flexible_failed_connections
129
+ on: azure_monitor.postgres_flexible.connection_rate
130
+ class: Errors
131
+ type: Database
132
+component: Azure PostgreSQL Flexible
133
+ lookup: average -5m unaligned of failed
134
+ units: connections/s
135
+ every: 1m
136
+ warn: $this > (($status >= $WARNING) ? (1) : (5))
137
+ crit: $this > (($status == $CRITICAL) ? (5) : (20))
138
+ delay: down 5m multiplier 1.5 max 1h
139
+ summary: PostgreSQL Flexible failed connections on ${label:resource_name}
140
+ info: Rate of failed connection attempts on Azure PostgreSQL Flexible Server ${label:resource_name} \
141
+ in ${label:resource_group} (${label:region}). \
142
+ May indicate authentication failures, connection limit exhaustion, or network issues
143
+ to: dba
144
+
145
+ template: am_postgres_flexible_tcp_connection_backlog
146
+ on: azure_monitor.postgres_flexible.tcp_connection_backlog
147
+ class: Workload
148
+ type: Database
149
+component: Azure PostgreSQL Flexible
150
+ lookup: average -5m unaligned of maximum
151
+ units: connections
152
+ every: 1m
153
+ warn: $this != nan AND $this > (($status >= $WARNING) ? (50) : (100))
154
+ crit: $this != nan AND $this > (($status == $CRITICAL) ? (100) : (200))
155
+ delay: down 5m multiplier 1.5 max 1h
156
+ summary: PostgreSQL Flexible TCP connection backlog on ${label:resource_name}
157
+ info: TCP connection backlog on Azure PostgreSQL Flexible Server ${label:resource_name} \
158
+ in ${label:resource_group} (${label:region}). \
159
+ High backlog indicates the server cannot accept connections fast enough
160
+ to: dba
161
+
162
+# --- Transactions ---
163
+
164
+ template: am_postgres_flexible_deadlocks
165
+ on: azure_monitor.postgres_flexible.deadlocks
166
+ class: Errors
167
+ type: Database
168
+component: Azure PostgreSQL Flexible
169
+ lookup: average -5m unaligned of total
170
+ units: deadlocks/s
171
+ every: 1m
172
+ warn: $this != nan AND $this > (($status >= $WARNING) ? (0) : (1))
173
+ delay: down 5m multiplier 1.5 max 1h
174
+ summary: PostgreSQL Flexible deadlocks on ${label:resource_name}
175
+ info: Deadlock rate on Azure PostgreSQL Flexible Server ${label:resource_name} \
176
+ in ${label:resource_group} (${label:region}). \
177
+ Deadlocks indicate conflicting lock acquisition patterns in concurrent transactions
178
+ to: dba
179
+
180
+ template: am_postgres_flexible_rollback_ratio
181
+ on: azure_monitor.postgres_flexible.transactions
182
+ class: Errors
183
+ type: Database
184
+component: Azure PostgreSQL Flexible
185
+ lookup: sum -5m unaligned of committed,rolled_back
186
+ calc: ($this > 100) ? ($rolled_back * 100 / $this) : (0)
187
+ units: %
188
+ every: 1m
189
+ warn: $this != nan AND $this > (($status >= $WARNING) ? (3) : (5))
190
+ crit: $this != nan AND $this > (($status == $CRITICAL) ? (10) : (20))
191
+ delay: down 5m multiplier 1.5 max 1h
192
+ summary: PostgreSQL Flexible rollback ratio on ${label:resource_name}
193
+ info: Percentage of rolled back transactions on Azure PostgreSQL Flexible Server ${label:resource_name} \
194
+ in ${label:resource_group} (${label:region}). \
195
+ High rollback rates indicate application errors or excessive contention
196
+ to: dba
197
+
198
+# --- Latency / Long Running ---
199
+
200
+ template: am_postgres_flexible_longest_query
201
+ on: azure_monitor.postgres_flexible.long_running
202
+ class: Latency
203
+ type: Database
204
+component: Azure PostgreSQL Flexible
205
+ lookup: max -5m unaligned of query
206
+ units: seconds
207
+ every: 1m
208
+ warn: $this != nan AND $this > (($status >= $WARNING) ? (300) : (600))
209
+ crit: $this != nan AND $this > (($status == $CRITICAL) ? (600) : (1800))
210
+ delay: down 5m multiplier 1.5 max 1h
211
+ summary: PostgreSQL Flexible long running query on ${label:resource_name}
212
+ info: Longest running query duration on Azure PostgreSQL Flexible Server ${label:resource_name} \
213
+ in ${label:resource_group} (${label:region}). \
214
+ Long running queries can hold locks and bloat WAL
215
+ to: dba
216
+
217
+ template: am_postgres_flexible_longest_transaction
218
+ on: azure_monitor.postgres_flexible.long_running
219
+ class: Latency
220
+ type: Database
221
+component: Azure PostgreSQL Flexible
222
+ lookup: max -5m unaligned of transaction
223
+ units: seconds
224
+ every: 1m
225
+ warn: $this != nan AND $this > (($status >= $WARNING) ? (300) : (600))
226
+ crit: $this != nan AND $this > (($status == $CRITICAL) ? (600) : (1800))
227
+ delay: down 5m multiplier 1.5 max 1h
228
+ summary: PostgreSQL Flexible long running transaction on ${label:resource_name}
229
+ info: Longest running transaction duration on Azure PostgreSQL Flexible Server ${label:resource_name} \
230
+ in ${label:resource_group} (${label:region}). \
231
+ Long running transactions prevent autovacuum from reclaiming dead tuples
232
+ to: dba
233
+
234
+# --- Safety (Transaction ID wraparound) ---
235
+
236
+ template: am_postgres_flexible_xid_usage
237
+ on: azure_monitor.postgres_flexible.xid_usage
238
+ class: Utilization
239
+ type: Database
240
+component: Azure PostgreSQL Flexible
241
+ lookup: average -5m unaligned of max_used
242
+ units: transactions
243
+ every: 1m
244
+ warn: $this > (($status >= $WARNING) ? (500000000) : (1000000000))
245
+ crit: $this > (($status == $CRITICAL) ? (1000000000) : (1500000000))
246
+ delay: down 5m multiplier 1.5 max 1h
247
+ summary: PostgreSQL Flexible transaction ID usage on ${label:resource_name}
248
+ info: Maximum used transaction IDs on Azure PostgreSQL Flexible Server ${label:resource_name} \
249
+ in ${label:resource_group} (${label:region}). \
250
+ PostgreSQL wraps around at ~2.1 billion XIDs. High values require urgent VACUUM FREEZE
251
+ to: dba
252
+
253
+ template: am_postgres_flexible_xmin_age
254
+ on: azure_monitor.postgres_flexible.xmin_age
255
+ class: Utilization
256
+ type: Database
257
+component: Azure PostgreSQL Flexible
258
+ lookup: average -5m unaligned of maximum
259
+ units: transactions
260
+ every: 1m
261
+ warn: $this != nan AND $this > (($status >= $WARNING) ? (200000000) : (500000000))
262
+ crit: $this != nan AND $this > (($status == $CRITICAL) ? (500000000) : (1000000000))
263
+ delay: down 5m multiplier 1.5 max 1h
264
+ summary: PostgreSQL Flexible backend xmin age on ${label:resource_name}
265
+ info: Oldest backend xmin age on Azure PostgreSQL Flexible Server ${label:resource_name} \
266
+ in ${label:resource_group} (${label:region}). \
267
+ A large xmin age prevents autovacuum from cleaning dead tuples and increases XID wraparound risk
268
+ to: dba
269
+
270
+# --- Bloat ---
271
+
272
+ template: am_postgres_flexible_bloat
273
+ on: azure_monitor.postgres_flexible.bloat
274
+ class: Utilization
275
+ type: Database
276
+component: Azure PostgreSQL Flexible
277
+ lookup: average -5m unaligned of maximum
278
+ units: percentage
279
+ every: 1m
280
+ warn: $this != nan AND $this > (($status >= $WARNING) ? (40) : (50))
281
+ crit: $this != nan AND $this > (($status == $CRITICAL) ? (60) : (70))
282
+ delay: down 5m multiplier 1.5 max 1h
283
+ summary: PostgreSQL Flexible table bloat on ${label:resource_name}
284
+ info: Table bloat percentage on Azure PostgreSQL Flexible Server ${label:resource_name} \
285
+ in ${label:resource_group} (${label:region}). \
286
+ High bloat wastes storage and degrades query performance. Consider running VACUUM FULL
287
+ to: dba
288
+
289
+# --- Replication ---
290
+
291
+ template: am_postgres_flexible_replication_lag
292
+ on: azure_monitor.postgres_flexible.replication_lag_time
293
+ class: Latency
294
+ type: Database
295
+component: Azure PostgreSQL Flexible
296
+ lookup: average -5m unaligned of average
297
+ units: seconds
298
+ every: 1m
299
+ warn: $this != nan AND $this > (($status >= $WARNING) ? (10) : (30))
300
+ crit: $this != nan AND $this > (($status == $CRITICAL) ? (30) : (60))
301
+ delay: down 5m multiplier 1.5 max 1h
302
+ summary: PostgreSQL Flexible replication lag on ${label:resource_name}
303
+ info: Physical replication lag on Azure PostgreSQL Flexible Server ${label:resource_name} \
304
+ in ${label:resource_group} (${label:region}). \
305
+ High lag means replicas serve stale data
306
+ to: dba
307
+
308
+# --- CPU Credits (burstable tiers) ---
309
+
310
+ template: am_postgres_flexible_cpu_credits_remaining
311
+ on: azure_monitor.postgres_flexible.cpu_credits
312
+ class: Utilization
313
+ type: Database
314
+component: Azure PostgreSQL Flexible
315
+ lookup: average -5m unaligned of remaining
316
+ units: credits
317
+ every: 1m
318
+ warn: $this != nan AND $this < (($status >= $WARNING) ? (30) : (20))
319
+ crit: $this != nan AND $this < (($status == $CRITICAL) ? (20) : (10))
320
+ delay: down 5m multiplier 1.5 max 1h
321
+ summary: PostgreSQL Flexible CPU credits low on ${label:resource_name}
322
+ info: Remaining CPU credits on Azure PostgreSQL Flexible Server ${label:resource_name} \
323
+ in ${label:resource_group} (${label:region}). \
324
+ Only applicable to burstable tiers. When credits are exhausted, CPU is capped at baseline
325
+ to: dba
326
+
327
+# --- Temp Files ---
328
+
329
+ template: am_postgres_flexible_temp_bytes
330
+ on: azure_monitor.postgres_flexible.temp_bytes
331
+ class: Workload
332
+ type: Database
333
+component: Azure PostgreSQL Flexible
334
+ lookup: average -5m unaligned of total
335
+ units: bytes/s
336
+ every: 1m
337
+ warn: $this != nan AND $this > (($status >= $WARNING) ? (52428800) : (104857600))
338
+ crit: $this != nan AND $this > (($status == $CRITICAL) ? (104857600) : (209715200))
339
+ delay: down 5m multiplier 1.5 max 1h
340
+ summary: PostgreSQL Flexible temp file I/O on ${label:resource_name}
341
+ info: Rate of temporary file bytes written on Azure PostgreSQL Flexible Server ${label:resource_name} \
342
+ in ${label:resource_group} (${label:region}). \
343
+ Excessive temp file usage indicates queries spilling to disk due to insufficient work_mem
344
+ to: dba
src/health/health.d/azure_monitor_redis_cache.conf
new
+206
@@ -0,0 +1,206 @@
1
+# you can disable an alarm notification by setting the 'to' line to: silent
2
+
3
+# --- Server Load ---
4
+
5
+ template: am_redis_cache_server_load
6
+ on: azure_monitor.redis_cache.server_load
7
+ class: Utilization
8
+ type: Database
9
+component: Azure Redis
10
+ lookup: average -5m unaligned of maximum
11
+ units: percentage
12
+ every: 1m
13
+ warn: $this > (($status >= $WARNING) ? (75) : (85))
14
+ crit: $this > (($status == $CRITICAL) ? (85) : (95))
15
+ delay: down 5m multiplier 1.5 max 1h
16
+ summary: Redis server load on ${label:resource_name}
17
+ info: Maximum server load on Azure Cache for Redis ${label:resource_name} \
18
+ in ${label:resource_group} (${label:region}). \
19
+ Sustained high server load causes timeouts and increased latency
20
+ to: dba
21
+
22
+# --- CPU ---
23
+
24
+ template: am_redis_cache_cpu
25
+ on: azure_monitor.redis_cache.cpu
26
+ class: Utilization
27
+ type: Database
28
+component: Azure Redis
29
+ lookup: average -5m unaligned of maximum
30
+ units: percentage
31
+ every: 1m
32
+ warn: $this > (($status >= $WARNING) ? (75) : (85))
33
+ crit: $this > (($status == $CRITICAL) ? (85) : (95))
34
+ delay: down 5m multiplier 1.5 max 1h
35
+ summary: Redis CPU on ${label:resource_name}
36
+ info: Maximum CPU utilization on Azure Cache for Redis ${label:resource_name} \
37
+ in ${label:resource_group} (${label:region})
38
+ to: dba
39
+
40
+# --- Memory Utilization ---
41
+
42
+ template: am_redis_cache_memory_utilization
43
+ on: azure_monitor.redis_cache.memory_utilization
44
+ class: Utilization
45
+ type: Database
46
+component: Azure Redis
47
+ lookup: average -5m unaligned of maximum
48
+ units: percentage
49
+ every: 1m
50
+ warn: $this > (($status >= $WARNING) ? (75) : (85))
51
+ crit: $this > (($status == $CRITICAL) ? (85) : (95))
52
+ delay: down 5m multiplier 1.5 max 1h
53
+ summary: Redis memory utilization on ${label:resource_name}
54
+ info: Maximum memory utilization on Azure Cache for Redis ${label:resource_name} \
55
+ in ${label:resource_group} (${label:region}). \
56
+ High memory causes evictions and potential data loss
57
+ to: dba
58
+
59
+# --- Cache Miss Rate ---
60
+
61
+ template: am_redis_cache_miss_rate
62
+ on: azure_monitor.redis_cache.miss_rate
63
+ class: Utilization
64
+ type: Database
65
+component: Azure Redis
66
+ lookup: average -10m unaligned of miss_rate
67
+ units: percentage
68
+ every: 1m
69
+ warn: $this > (($status >= $WARNING) ? (40) : (50))
70
+ delay: down 5m multiplier 1.5 max 1h
71
+ summary: Redis cache miss rate on ${label:resource_name}
72
+ info: Cache miss rate on Azure Cache for Redis ${label:resource_name} \
73
+ in ${label:resource_group} (${label:region}). \
74
+ High miss rates indicate the cache is not effectively serving requests
75
+ to: dba
76
+
77
+# --- Errors ---
78
+
79
+ template: am_redis_cache_errors
80
+ on: azure_monitor.redis_cache.errors
81
+ class: Errors
82
+ type: Database
83
+component: Azure Redis
84
+ lookup: average -5m unaligned of maximum
85
+ units: errors
86
+ every: 1m
87
+ warn: $this > (($status >= $WARNING) ? (0) : (5))
88
+ crit: $this > (($status == $CRITICAL) ? (5) : (20))
89
+ delay: down 5m multiplier 1.5 max 1h
90
+ summary: Redis errors on ${label:resource_name}
91
+ info: Errors on Azure Cache for Redis ${label:resource_name} \
92
+ in ${label:resource_group} (${label:region}). \
93
+ Includes authentication failures, maxmemory errors, and connection issues
94
+ to: dba
95
+
96
+# --- Latency (average) ---
97
+
98
+ template: am_redis_cache_latency
99
+ on: azure_monitor.redis_cache.latency
100
+ class: Latency
101
+ type: Database
102
+component: Azure Redis
103
+ lookup: average -5m unaligned of average
104
+ units: microseconds
105
+ every: 1m
106
+ warn: $this > (($status >= $WARNING) ? (5000) : (10000))
107
+ crit: $this > (($status == $CRITICAL) ? (10000) : (30000))
108
+ delay: down 5m multiplier 1.5 max 1h
109
+ summary: Redis average latency on ${label:resource_name}
110
+ info: Average cache latency on Azure Cache for Redis ${label:resource_name} \
111
+ in ${label:resource_group} (${label:region})
112
+ to: dba
113
+
114
+# --- Latency P99 ---
115
+
116
+ template: am_redis_cache_latency_p99
117
+ on: azure_monitor.redis_cache.latency_p99
118
+ class: Latency
119
+ type: Database
120
+component: Azure Redis
121
+ lookup: average -5m unaligned of p99
122
+ units: microseconds
123
+ every: 1m
124
+ warn: $this > (($status >= $WARNING) ? (10000) : (20000))
125
+ crit: $this > (($status == $CRITICAL) ? (20000) : (50000))
126
+ delay: down 5m multiplier 1.5 max 1h
127
+ summary: Redis P99 latency on ${label:resource_name}
128
+ info: P99 latency on Azure Cache for Redis ${label:resource_name} \
129
+ in ${label:resource_group} (${label:region}). \
130
+ Tail latency spikes indicate resource pressure or network issues
131
+ to: dba
132
+
133
+# --- Key Evictions ---
134
+
135
+ template: am_redis_cache_evicted_keys
136
+ on: azure_monitor.redis_cache.key_events
137
+ class: Errors
138
+ type: Database
139
+component: Azure Redis
140
+ lookup: average -5m unaligned of evicted
141
+ units: keys/s
142
+ every: 1m
143
+ warn: $this > (($status >= $WARNING) ? (50) : (100))
144
+ crit: $this > (($status == $CRITICAL) ? (100) : (500))
145
+ delay: down 5m multiplier 1.5 max 1h
146
+ summary: Redis key evictions on ${label:resource_name}
147
+ info: Rate of evicted keys on Azure Cache for Redis ${label:resource_name} \
148
+ in ${label:resource_group} (${label:region}). \
149
+ Key evictions indicate the cache is running out of memory
150
+ to: dba
151
+
152
+# --- Geo-Replication Health (optional — only present when geo-replication is configured) ---
153
+
154
+ template: am_redis_cache_geo_replication_health
155
+ on: azure_monitor.redis_cache.geo_replication_health
156
+ class: Availability
157
+ type: Database
158
+component: Azure Redis
159
+ lookup: average -5m unaligned of average
160
+ units: status
161
+ every: 1m
162
+ crit: $this != nan AND $this < 1
163
+ delay: down 5m multiplier 1.5 max 1h
164
+ summary: Redis geo-replication health on ${label:resource_name}
165
+ info: Geo-replication link health on Azure Cache for Redis ${label:resource_name} \
166
+ in ${label:resource_group} (${label:region}). \
167
+ A value below 1 indicates the replication link is unhealthy
168
+ to: dba
169
+
170
+# --- Geo-Replication Lag (optional — only present when geo-replication is configured) ---
171
+
172
+ template: am_redis_cache_geo_replication_lag
173
+ on: azure_monitor.redis_cache.geo_replication_lag
174
+ class: Latency
175
+ type: Database
176
+component: Azure Redis
177
+ lookup: average -5m unaligned of average
178
+ units: seconds
179
+ every: 1m
180
+ warn: $this != nan AND $this > (($status >= $WARNING) ? (5) : (10))
181
+ crit: $this != nan AND $this > (($status == $CRITICAL) ? (10) : (30))
182
+ delay: down 5m multiplier 1.5 max 1h
183
+ summary: Redis geo-replication lag on ${label:resource_name}
184
+ info: Geo-replication connectivity lag on Azure Cache for Redis ${label:resource_name} \
185
+ in ${label:resource_group} (${label:region}). \
186
+ High lag indicates network issues between primary and secondary regions
187
+ to: dba
188
+
189
+# --- Geo-Replication Sync Offset (optional — only present when geo-replication is configured) ---
190
+
191
+ template: am_redis_cache_geo_replication_sync_offset
192
+ on: azure_monitor.redis_cache.geo_replication_sync_offset
193
+ class: Latency
194
+ type: Database
195
+component: Azure Redis
196
+ lookup: average -5m unaligned of average
197
+ units: bytes
198
+ every: 1m
199
+ warn: $this != nan AND $this > (($status >= $WARNING) ? (1048576) : (5242880))
200
+ crit: $this != nan AND $this > (($status == $CRITICAL) ? (5242880) : (52428800))
201
+ delay: down 5m multiplier 1.5 max 1h
202
+ summary: Redis geo-replication sync offset on ${label:resource_name}
203
+ info: Geo-replication data sync offset on Azure Cache for Redis ${label:resource_name} \
204
+ in ${label:resource_group} (${label:region}). \
205
+ Large offset indicates the secondary is falling behind the primary
206
+ to: dba
src/health/health.d/azure_monitor_service_bus.conf
new
+265
@@ -0,0 +1,265 @@
1
+# you can disable an alarm notification by setting the 'to' line to: silent
2
+
3
+# --- Errors ---
4
+
5
+# Server-side errors indicate Service Bus infrastructure problems.
6
+# AMBA: ServerErrors > 0 is Sev1
7
+
8
+ template: am_service_bus_server_errors
9
+ on: azure_monitor.service_bus.errors
10
+ class: Errors
11
+ type: Messaging
12
+component: Azure Service Bus
13
+ lookup: average -5m unaligned of server
14
+ units: errors/s
15
+ every: 1m
16
+ warn: $this > (($status >= $WARNING) ? (0) : (1))
17
+ crit: $this > (($status == $CRITICAL) ? (1) : (5))
18
+ delay: down 5m multiplier 1.5 max 1h
19
+ summary: Service Bus server errors on ${label:resource_name}
20
+ info: Server-side error rate on Service Bus namespace ${label:resource_name} \
21
+ in ${label:resource_group} (${label:region})
22
+ to: sysadmin
23
+
24
+# Throttled requests mean the namespace has exceeded its messaging unit quotas.
25
+# AMBA: ThrottledRequests > 0 is Sev1
26
+
27
+ template: am_service_bus_throttled_requests
28
+ on: azure_monitor.service_bus.errors
29
+ class: Errors
30
+ type: Messaging
31
+component: Azure Service Bus
32
+ lookup: average -5m unaligned of throttled
33
+ units: errors/s
34
+ every: 1m
35
+ warn: $this > (($status >= $WARNING) ? (0) : (1))
36
+ crit: $this > (($status == $CRITICAL) ? (1) : (5))
37
+ delay: down 5m multiplier 1.5 max 1h
38
+ summary: Service Bus throttled requests on ${label:resource_name}
39
+ info: Rate of throttled requests on Service Bus namespace ${label:resource_name} \
40
+ in ${label:resource_group} (${label:region}). \
41
+ Indicates the namespace is exceeding its messaging unit quotas
42
+ to: sysadmin
43
+
44
+# User errors (400-class) at sustained high rate may indicate
45
+# client misconfiguration or malformed messages.
46
+
47
+ template: am_service_bus_user_errors
48
+ on: azure_monitor.service_bus.errors
49
+ class: Errors
50
+ type: Messaging
51
+component: Azure Service Bus
52
+ lookup: average -5m unaligned of user
53
+ units: errors/s
54
+ every: 1m
55
+ warn: $this > (($status >= $WARNING) ? (10) : (25))
56
+ delay: down 5m multiplier 1.5 max 1h
57
+ summary: Service Bus user errors on ${label:resource_name}
58
+ info: Rate of user (client-side) errors on Service Bus namespace ${label:resource_name} \
59
+ in ${label:resource_group} (${label:region})
60
+ to: sysadmin
61
+
62
+# --- Utilization (Premium tier only) ---
63
+
64
+# CPU utilization of Premium namespace messaging units.
65
+# AMBA: NamespaceCpuUsage > 70 is Sev2
66
+
67
+ template: am_service_bus_namespace_cpu
68
+ on: azure_monitor.service_bus.namespace_resources
69
+ class: Utilization
70
+ type: Messaging
71
+component: Azure Service Bus
72
+ lookup: average -5m unaligned of cpu
73
+ units: percentage
74
+ every: 1m
75
+ warn: $this != nan AND $this > (($status >= $WARNING) ? (70) : (80))
76
+ crit: $this != nan AND $this > (($status == $CRITICAL) ? (80) : (95))
77
+ delay: down 5m multiplier 1.5 max 1h
78
+ summary: Service Bus namespace CPU on ${label:resource_name}
79
+ info: CPU utilization of Premium Service Bus namespace ${label:resource_name} \
80
+ in ${label:resource_group} (${label:region}). \
81
+ Only available on Premium tier namespaces
82
+ to: sysadmin
83
+
84
+# Memory utilization of Premium namespace messaging units.
85
+# AMBA: NamespaceMemoryUsage > 70 is Sev2
86
+
87
+ template: am_service_bus_namespace_memory
88
+ on: azure_monitor.service_bus.namespace_resources
89
+ class: Utilization
90
+ type: Messaging
91
+component: Azure Service Bus
92
+ lookup: average -5m unaligned of memory
93
+ units: percentage
94
+ every: 1m
95
+ warn: $this != nan AND $this > (($status >= $WARNING) ? (70) : (80))
96
+ crit: $this != nan AND $this > (($status == $CRITICAL) ? (80) : (95))
97
+ delay: down 5m multiplier 1.5 max 1h
98
+ summary: Service Bus namespace memory on ${label:resource_name}
99
+ info: Memory utilization of Premium Service Bus namespace ${label:resource_name} \
100
+ in ${label:resource_group} (${label:region}). \
101
+ Only available on Premium tier namespaces
102
+ to: sysadmin
103
+
104
+# --- Latency ---
105
+
106
+# Server send latency measures how long Service Bus takes to complete
107
+# send operations. High latency indicates performance degradation.
108
+
109
+ template: am_service_bus_send_latency
110
+ on: azure_monitor.service_bus.send_latency
111
+ class: Latency
112
+ type: Messaging
113
+component: Azure Service Bus
114
+ lookup: average -5m unaligned of average
115
+ units: milliseconds
116
+ every: 1m
117
+ warn: $this > (($status >= $WARNING) ? (500) : (1000))
118
+ crit: $this > (($status == $CRITICAL) ? (1000) : (3000))
119
+ delay: down 5m multiplier 1.5 max 1h
120
+ summary: Service Bus send latency on ${label:resource_name}
121
+ info: Average server send latency on Service Bus namespace ${label:resource_name} \
122
+ in ${label:resource_group} (${label:region})
123
+ to: sysadmin
124
+
125
+# --- Saturation ---
126
+
127
+# Dead-lettered messages accumulate when messages cannot be processed
128
+# after max delivery attempts or when they expire. Growing dead letter
129
+# queues indicate consumer failures or poison messages.
130
+# AMBA: DeadletteredMessages > 0 is Sev2
131
+
132
+ template: am_service_bus_dead_lettered_messages
133
+ on: azure_monitor.service_bus.problem_messages
134
+ class: Errors
135
+ type: Messaging
136
+component: Azure Service Bus
137
+ lookup: average -5m unaligned of dead_lettered
138
+ units: messages
139
+ every: 1m
140
+ warn: $this > (($status >= $WARNING) ? (0) : (1))
141
+ crit: $this > (($status == $CRITICAL) ? (10) : (100))
142
+ delay: down 5m multiplier 1.5 max 1h
143
+ summary: Service Bus dead-lettered messages on ${label:resource_name}
144
+ info: Dead-lettered messages in Service Bus namespace ${label:resource_name} \
145
+ in ${label:resource_group} (${label:region}). \
146
+ Messages land in dead letter queue after exceeding max delivery attempts or expiring
147
+ to: sysadmin
148
+
149
+# Active message queue depth. Sustained growth means consumers
150
+# are not keeping up with producers.
151
+# AMBA: ActiveMessages > 100 is Sev2
152
+
153
+ template: am_service_bus_active_messages
154
+ on: azure_monitor.service_bus.queue_depth
155
+ class: Workload
156
+ type: Messaging
157
+component: Azure Service Bus
158
+ lookup: average -10m unaligned of active
159
+ units: messages
160
+ every: 1m
161
+ warn: $this > (($status >= $WARNING) ? (5000) : (10000))
162
+ crit: $this > (($status == $CRITICAL) ? (10000) : (50000))
163
+ delay: down 5m multiplier 1.5 max 1h
164
+ summary: Service Bus queue depth on ${label:resource_name}
165
+ info: Active messages queued in Service Bus namespace ${label:resource_name} \
166
+ in ${label:resource_group} (${label:region}). \
167
+ Sustained growth means consumers are not keeping up with producers
168
+ to: sysadmin
169
+
170
+# --- Request Success ---
171
+
172
+# Helper: total incoming requests over 5 minutes (no alarm, just a value)
173
+
174
+ template: am_service_bus_incoming_requests
175
+ on: azure_monitor.service_bus.requests
176
+ class: Workload
177
+ type: Messaging
178
+component: Azure Service Bus
179
+ lookup: sum -5m unaligned of incoming
180
+ units: requests/s
181
+ every: 1m
182
+ info: Total incoming requests on Service Bus namespace ${label:resource_name} \
183
+ in ${label:resource_group} (${label:region})
184
+
185
+# Request success rate. Only fires when there is meaningful traffic
186
+# to avoid false positives during idle periods.
187
+
188
+ template: am_service_bus_request_success_rate
189
+ on: azure_monitor.service_bus.requests
190
+ class: Errors
191
+ type: Messaging
192
+component: Azure Service Bus
193
+ lookup: sum -5m unaligned of successful
194
+ calc: ($am_service_bus_incoming_requests > 0) ? ($this * 100 / $am_service_bus_incoming_requests) : (100)
195
+ units: %
196
+ every: 1m
197
+ warn: ($am_service_bus_incoming_requests > 120) ? ($this < (($status >= $WARNING) ? (99) : (95))) : (0)
198
+ crit: ($am_service_bus_incoming_requests > 120) ? ($this < (($status == $CRITICAL) ? (95) : (80))) : (0)
199
+ delay: down 5m multiplier 1.5 max 1h
200
+ summary: Service Bus request success rate on ${label:resource_name}
201
+ info: Percentage of successful requests on Service Bus namespace ${label:resource_name} \
202
+ in ${label:resource_group} (${label:region})
203
+ to: sysadmin
204
+
205
+# --- Message Operations ---
206
+
207
+# Abandoned messages indicate consumers receiving but not processing messages.
208
+# Sustained abandonment suggests poison messages or consumer failures.
209
+
210
+ template: am_service_bus_abandoned_messages
211
+ on: azure_monitor.service_bus.message_operations
212
+ class: Errors
213
+ type: Messaging
214
+component: Azure Service Bus
215
+ lookup: average -5m unaligned of abandoned
216
+ units: messages/s
217
+ every: 1m
218
+ warn: $this > (($status >= $WARNING) ? (1) : (5))
219
+ delay: down 5m multiplier 1.5 max 1h
220
+ summary: Service Bus abandoned messages on ${label:resource_name}
221
+ info: Rate of abandoned messages on Service Bus namespace ${label:resource_name} \
222
+ in ${label:resource_group} (${label:region}). \
223
+ Consumers are receiving but failing to process messages
224
+ to: sysadmin
225
+
226
+# --- Replication (Geo-DR only) ---
227
+
228
+# Replication lag count measures how many messages are pending replication
229
+# to the secondary namespace. Only relevant with Geo-DR configured.
230
+
231
+ template: am_service_bus_replication_lag
232
+ on: azure_monitor.service_bus.replication_lag
233
+ class: Latency
234
+ type: Messaging
235
+component: Azure Service Bus
236
+ lookup: average -5m unaligned of messages
237
+ units: messages
238
+ every: 1m
239
+ warn: $this != nan AND $this > (($status >= $WARNING) ? (100) : (1000))
240
+ crit: $this != nan AND $this > (($status == $CRITICAL) ? (1000) : (10000))
241
+ delay: down 5m multiplier 1.5 max 1h
242
+ summary: Service Bus replication lag on ${label:resource_name}
243
+ info: Messages pending replication to secondary namespace on Service Bus ${label:resource_name} \
244
+ in ${label:resource_group} (${label:region}). \
245
+ Only relevant when Geo-DR is configured
246
+ to: sysadmin
247
+
248
+# Replication lag duration measures time behind the primary.
249
+
250
+ template: am_service_bus_replication_lag_duration
251
+ on: azure_monitor.service_bus.replication_lag_duration
252
+ class: Latency
253
+ type: Messaging
254
+component: Azure Service Bus
255
+ lookup: average -5m unaligned of duration
256
+ units: seconds
257
+ every: 1m
258
+ warn: $this != nan AND $this > (($status >= $WARNING) ? (30) : (60))
259
+ crit: $this != nan AND $this > (($status == $CRITICAL) ? (60) : (120))
260
+ delay: down 5m multiplier 1.5 max 1h
261
+ summary: Service Bus replication lag duration on ${label:resource_name}
262
+ info: Replication lag duration to secondary namespace on Service Bus ${label:resource_name} \
263
+ in ${label:resource_group} (${label:region}). \
264
+ Only relevant when Geo-DR is configured
265
+ to: sysadmin
src/health/health.d/azure_monitor_sql_database.conf
new
+339
@@ -0,0 +1,339 @@
1
+# you can disable an alarm notification by setting the 'to' line to: silent
2
+
3
+# --- Availability ---
4
+
5
+ template: am_sql_database_availability
6
+ on: azure_monitor.sql_database.availability
7
+ class: Availability
8
+ type: Database
9
+component: Azure SQL
10
+ lookup: average -10m unaligned of average
11
+ units: percentage
12
+ every: 1m
13
+ warn: $this < (($status >= $WARNING) ? (99.99) : (99.9))
14
+ crit: $this < (($status == $CRITICAL) ? (99.9) : (99))
15
+ delay: down 5m multiplier 1.5 max 1h
16
+ summary: SQL Database availability on ${label:resource_name}
17
+ info: Database availability of Azure SQL Database ${label:resource_name} \
18
+ in ${label:resource_group} (${label:region})
19
+ to: dba
20
+
21
+# --- CPU Utilization ---
22
+
23
+ template: am_sql_database_cpu
24
+ on: azure_monitor.sql_database.cpu
25
+ class: Utilization
26
+ type: Database
27
+component: Azure SQL
28
+ lookup: average -5m unaligned of average
29
+ units: percentage
30
+ every: 1m
31
+ warn: $this > (($status >= $WARNING) ? (75) : (85))
32
+ crit: $this > (($status == $CRITICAL) ? (85) : (95))
33
+ delay: down 5m multiplier 1.5 max 1h
34
+ summary: SQL Database CPU on ${label:resource_name}
35
+ info: Average CPU utilization of Azure SQL Database ${label:resource_name} \
36
+ in ${label:resource_group} (${label:region})
37
+ to: dba
38
+
39
+ template: am_sql_database_instance_cpu
40
+ on: azure_monitor.sql_database.instance_cpu
41
+ class: Utilization
42
+ type: Database
43
+component: Azure SQL
44
+ lookup: average -5m unaligned of average
45
+ units: percentage
46
+ every: 1m
47
+ warn: $this > (($status >= $WARNING) ? (75) : (85))
48
+ crit: $this > (($status == $CRITICAL) ? (85) : (95))
49
+ delay: down 5m multiplier 1.5 max 1h
50
+ summary: SQL Database instance CPU on ${label:resource_name}
51
+ info: SQL process CPU utilization (including background tasks) on Azure SQL Database ${label:resource_name} \
52
+ in ${label:resource_group} (${label:region})
53
+ to: dba
54
+
55
+# --- Memory Utilization ---
56
+
57
+ template: am_sql_database_instance_memory
58
+ on: azure_monitor.sql_database.instance_memory
59
+ class: Utilization
60
+ type: Database
61
+component: Azure SQL
62
+ lookup: average -5m unaligned of average
63
+ units: percentage
64
+ every: 1m
65
+ warn: $this > (($status >= $WARNING) ? (80) : (90))
66
+ crit: $this > (($status == $CRITICAL) ? (90) : (95))
67
+ delay: down 5m multiplier 1.5 max 1h
68
+ summary: SQL Database instance memory on ${label:resource_name}
69
+ info: SQL process memory utilization on Azure SQL Database ${label:resource_name} \
70
+ in ${label:resource_group} (${label:region})
71
+ to: dba
72
+
73
+# --- DTU Consumption ---
74
+
75
+ template: am_sql_database_dtu_consumption
76
+ on: azure_monitor.sql_database.dtu_consumption
77
+ class: Utilization
78
+ type: Database
79
+component: Azure SQL
80
+ lookup: average -5m unaligned of average
81
+ units: percentage
82
+ every: 1m
83
+ warn: $this != nan AND $this > (($status >= $WARNING) ? (80) : (90))
84
+ crit: $this != nan AND $this > (($status == $CRITICAL) ? (90) : (95))
85
+ delay: down 5m multiplier 1.5 max 1h
86
+ summary: SQL Database DTU consumption on ${label:resource_name}
87
+ info: DTU consumption on Azure SQL Database ${label:resource_name} \
88
+ in ${label:resource_group} (${label:region}). \
89
+ Only relevant for DTU-based service tiers
90
+ to: dba
91
+
92
+# --- I/O Utilization ---
93
+
94
+ template: am_sql_database_data_io
95
+ on: azure_monitor.sql_database.io_utilization
96
+ class: Utilization
97
+ type: Database
98
+component: Azure SQL
99
+ lookup: average -5m unaligned of data_read
100
+ units: percentage
101
+ every: 1m
102
+ warn: $this > (($status >= $WARNING) ? (80) : (90))
103
+ crit: $this > (($status == $CRITICAL) ? (90) : (95))
104
+ delay: down 5m multiplier 1.5 max 1h
105
+ summary: SQL Database data I/O on ${label:resource_name}
106
+ info: Physical data read I/O utilization on Azure SQL Database ${label:resource_name} \
107
+ in ${label:resource_group} (${label:region})
108
+ to: dba
109
+
110
+ template: am_sql_database_log_write
111
+ on: azure_monitor.sql_database.io_utilization
112
+ class: Utilization
113
+ type: Database
114
+component: Azure SQL
115
+ lookup: average -5m unaligned of log_write
116
+ units: percentage
117
+ every: 1m
118
+ warn: $this > (($status >= $WARNING) ? (80) : (90))
119
+ crit: $this > (($status == $CRITICAL) ? (90) : (95))
120
+ delay: down 5m multiplier 1.5 max 1h
121
+ summary: SQL Database log write I/O on ${label:resource_name}
122
+ info: Transaction log write I/O utilization on Azure SQL Database ${label:resource_name} \
123
+ in ${label:resource_group} (${label:region})
124
+ to: dba
125
+
126
+# --- Resource Limits (Workers / Sessions) ---
127
+
128
+ template: am_sql_database_workers
129
+ on: azure_monitor.sql_database.resource_utilization
130
+ class: Utilization
131
+ type: Database
132
+component: Azure SQL
133
+ lookup: average -5m unaligned of workers
134
+ units: percentage
135
+ every: 1m
136
+ warn: $this > (($status >= $WARNING) ? (70) : (80))
137
+ crit: $this > (($status == $CRITICAL) ? (80) : (90))
138
+ delay: down 5m multiplier 1.5 max 1h
139
+ summary: SQL Database worker utilization on ${label:resource_name}
140
+ info: Worker thread utilization on Azure SQL Database ${label:resource_name} \
141
+ in ${label:resource_group} (${label:region}). \
142
+ Exhausting workers causes query failures
143
+ to: dba
144
+
145
+ template: am_sql_database_sessions
146
+ on: azure_monitor.sql_database.resource_utilization
147
+ class: Utilization
148
+ type: Database
149
+component: Azure SQL
150
+ lookup: average -5m unaligned of sessions
151
+ units: percentage
152
+ every: 1m
153
+ warn: $this > (($status >= $WARNING) ? (70) : (80))
154
+ crit: $this > (($status == $CRITICAL) ? (80) : (90))
155
+ delay: down 5m multiplier 1.5 max 1h
156
+ summary: SQL Database session utilization on ${label:resource_name}
157
+ info: Session utilization on Azure SQL Database ${label:resource_name} \
158
+ in ${label:resource_group} (${label:region}). \
159
+ Exhausting sessions prevents new connections
160
+ to: dba
161
+
162
+# --- Connection Errors ---
163
+
164
+ template: am_sql_database_connection_failures
165
+ on: azure_monitor.sql_database.connections
166
+ class: Errors
167
+ type: Database
168
+component: Azure SQL
169
+ lookup: average -5m unaligned of failed_system
170
+ units: connections/s
171
+ every: 1m
172
+ warn: $this > (($status >= $WARNING) ? (1) : (5))
173
+ delay: down 5m multiplier 1.5 max 1h
174
+ summary: SQL Database system connection failures on ${label:resource_name}
175
+ info: Rate of system-caused connection failures on Azure SQL Database ${label:resource_name} \
176
+ in ${label:resource_group} (${label:region})
177
+ to: dba
178
+
179
+ template: am_sql_database_firewall_blocks
180
+ on: azure_monitor.sql_database.connections
181
+ class: Errors
182
+ type: Database
183
+component: Azure SQL
184
+ lookup: average -5m unaligned of firewall_blocked
185
+ units: connections/s
186
+ every: 1m
187
+ warn: $this > (($status >= $WARNING) ? (1) : (5))
188
+ delay: down 5m multiplier 1.5 max 1h
189
+ summary: SQL Database firewall blocks on ${label:resource_name}
190
+ info: Rate of connections blocked by firewall on Azure SQL Database ${label:resource_name} \
191
+ in ${label:resource_group} (${label:region}). \
192
+ May indicate misconfigured firewall rules or unauthorized access attempts
193
+ to: dba
194
+
195
+# --- Deadlocks ---
196
+
197
+ template: am_sql_database_deadlocks
198
+ on: azure_monitor.sql_database.deadlocks
199
+ class: Errors
200
+ type: Database
201
+component: Azure SQL
202
+ lookup: average -5m unaligned of total
203
+ units: deadlocks/s
204
+ every: 1m
205
+ warn: $this > (($status >= $WARNING) ? (0) : (1))
206
+ delay: down 5m multiplier 1.5 max 1h
207
+ summary: SQL Database deadlocks on ${label:resource_name}
208
+ info: Deadlock rate on Azure SQL Database ${label:resource_name} \
209
+ in ${label:resource_group} (${label:region})
210
+ to: dba
211
+
212
+# --- Storage ---
213
+
214
+ template: am_sql_database_storage_utilization
215
+ on: azure_monitor.sql_database.storage_utilization
216
+ class: Utilization
217
+ type: Database
218
+component: Azure SQL
219
+ lookup: average -5m unaligned of average
220
+ units: percentage
221
+ every: 1m
222
+ warn: $this > (($status >= $WARNING) ? (75) : (85))
223
+ crit: $this > (($status == $CRITICAL) ? (85) : (95))
224
+ delay: down 5m multiplier 1.5 max 1h
225
+ summary: SQL Database storage utilization on ${label:resource_name}
226
+ info: Data storage utilization on Azure SQL Database ${label:resource_name} \
227
+ in ${label:resource_group} (${label:region})
228
+ to: dba
229
+
230
+# --- In-Memory OLTP ---
231
+
232
+ template: am_sql_database_xtp_storage
233
+ on: azure_monitor.sql_database.xtp_storage
234
+ class: Utilization
235
+ type: Database
236
+component: Azure SQL
237
+ lookup: average -5m unaligned of average
238
+ units: percentage
239
+ every: 1m
240
+ warn: $this != nan AND $this > (($status >= $WARNING) ? (70) : (80))
241
+ crit: $this != nan AND $this > (($status == $CRITICAL) ? (80) : (90))
242
+ delay: down 5m multiplier 1.5 max 1h
243
+ summary: SQL Database In-Memory OLTP storage on ${label:resource_name}
244
+ info: In-Memory OLTP storage utilization on Azure SQL Database ${label:resource_name} \
245
+ in ${label:resource_group} (${label:region}). \
246
+ Only relevant when In-Memory OLTP is enabled
247
+ to: dba
248
+
249
+# --- Tempdb ---
250
+
251
+ template: am_sql_database_tempdb_log_utilization
252
+ on: azure_monitor.sql_database.tempdb_log_utilization
253
+ class: Utilization
254
+ type: Database
255
+component: Azure SQL
256
+ lookup: average -5m unaligned of average
257
+ units: percentage
258
+ every: 1m
259
+ warn: $this > (($status >= $WARNING) ? (70) : (80))
260
+ crit: $this > (($status == $CRITICAL) ? (80) : (90))
261
+ delay: down 5m multiplier 1.5 max 1h
262
+ summary: SQL Database tempdb log utilization on ${label:resource_name}
263
+ info: Tempdb transaction log utilization on Azure SQL Database ${label:resource_name} \
264
+ in ${label:resource_group} (${label:region}). \
265
+ High utilization may indicate long-running transactions or excessive version store usage
266
+ to: dba
267
+
268
+# --- Replication ---
269
+
270
+ template: am_sql_database_replication_lag
271
+ on: azure_monitor.sql_database.replication_lag
272
+ class: Latency
273
+ type: Database
274
+component: Azure SQL
275
+ lookup: average -5m unaligned of average
276
+ units: seconds
277
+ every: 1m
278
+ warn: $this != nan AND $this > (($status >= $WARNING) ? (5) : (10))
279
+ crit: $this != nan AND $this > (($status == $CRITICAL) ? (10) : (30))
280
+ delay: down 5m multiplier 1.5 max 1h
281
+ summary: SQL Database replication lag on ${label:resource_name}
282
+ info: Geo-replication lag on Azure SQL Database ${label:resource_name} \
283
+ in ${label:resource_group} (${label:region}). \
284
+ Only relevant when geo-replication is configured
285
+ to: dba
286
+
287
+# --- Serverless ---
288
+
289
+ template: am_sql_database_serverless_cpu
290
+ on: azure_monitor.sql_database.serverless_utilization
291
+ class: Utilization
292
+ type: Database
293
+component: Azure SQL
294
+ lookup: average -5m unaligned of cpu
295
+ units: percentage
296
+ every: 1m
297
+ warn: $this != nan AND $this > (($status >= $WARNING) ? (75) : (85))
298
+ crit: $this != nan AND $this > (($status == $CRITICAL) ? (85) : (95))
299
+ delay: down 5m multiplier 1.5 max 1h
300
+ summary: SQL Database serverless CPU on ${label:resource_name}
301
+ info: App-level CPU utilization on serverless Azure SQL Database ${label:resource_name} \
302
+ in ${label:resource_group} (${label:region}). \
303
+ Only relevant for serverless tier databases
304
+ to: dba
305
+
306
+ template: am_sql_database_serverless_memory
307
+ on: azure_monitor.sql_database.serverless_utilization
308
+ class: Utilization
309
+ type: Database
310
+component: Azure SQL
311
+ lookup: average -5m unaligned of memory
312
+ units: percentage
313
+ every: 1m
314
+ warn: $this != nan AND $this > (($status >= $WARNING) ? (80) : (90))
315
+ crit: $this != nan AND $this > (($status == $CRITICAL) ? (90) : (95))
316
+ delay: down 5m multiplier 1.5 max 1h
317
+ summary: SQL Database serverless memory on ${label:resource_name}
318
+ info: App-level memory utilization on serverless Azure SQL Database ${label:resource_name} \
319
+ in ${label:resource_group} (${label:region}). \
320
+ Only relevant for serverless tier databases
321
+ to: dba
322
+
323
+# --- Ledger ---
324
+
325
+ template: am_sql_database_ledger_digest_failures
326
+ on: azure_monitor.sql_database.ledger_digest
327
+ class: Errors
328
+ type: Database
329
+component: Azure SQL
330
+ lookup: average -5m unaligned of failed
331
+ units: events/s
332
+ every: 1m
333
+ warn: $this != nan AND $this > 0
334
+ delay: down 5m multiplier 1.5 max 1h
335
+ summary: SQL Database ledger digest failures on ${label:resource_name}
336
+ info: Failed ledger digest uploads on Azure SQL Database ${label:resource_name} \
337
+ in ${label:resource_group} (${label:region}). \
338
+ Only relevant when database ledger is enabled
339
+ to: dba
src/health/health.d/azure_monitor_sql_elastic_pool.conf
new
+252
@@ -0,0 +1,252 @@
1
+# you can disable an alarm notification by setting the 'to' line to: silent
2
+
3
+# --- CPU Utilization ---
4
+
5
+ template: am_sql_elastic_pool_cpu
6
+ on: azure_monitor.sql_elastic_pool.cpu
7
+ class: Utilization
8
+ type: Database
9
+component: Azure SQL Elastic Pool
10
+ lookup: average -5m unaligned of average
11
+ units: percentage
12
+ every: 1m
13
+ warn: $this > (($status >= $WARNING) ? (75) : (85))
14
+ crit: $this > (($status == $CRITICAL) ? (85) : (95))
15
+ delay: down 5m multiplier 1.5 max 1h
16
+ summary: SQL Elastic Pool CPU on ${label:resource_name}
17
+ info: Average CPU utilization of SQL Elastic Pool ${label:resource_name} \
18
+ in ${label:resource_group} (${label:region})
19
+ to: dba
20
+
21
+ template: am_sql_elastic_pool_instance_cpu
22
+ on: azure_monitor.sql_elastic_pool.instance_cpu
23
+ class: Utilization
24
+ type: Database
25
+component: Azure SQL Elastic Pool
26
+ lookup: average -5m unaligned of average
27
+ units: percentage
28
+ every: 1m
29
+ warn: $this > (($status >= $WARNING) ? (75) : (85))
30
+ crit: $this > (($status == $CRITICAL) ? (85) : (95))
31
+ delay: down 5m multiplier 1.5 max 1h
32
+ summary: SQL Elastic Pool instance CPU on ${label:resource_name}
33
+ info: SQL instance CPU utilization of SQL Elastic Pool ${label:resource_name} \
34
+ in ${label:resource_group} (${label:region}). \
35
+ Includes overhead beyond user workloads
36
+ to: dba
37
+
38
+# --- Memory Utilization ---
39
+
40
+ template: am_sql_elastic_pool_instance_memory
41
+ on: azure_monitor.sql_elastic_pool.instance_memory
42
+ class: Utilization
43
+ type: Database
44
+component: Azure SQL Elastic Pool
45
+ lookup: average -5m unaligned of average
46
+ units: percentage
47
+ every: 1m
48
+ warn: $this > (($status >= $WARNING) ? (80) : (90))
49
+ crit: $this > (($status == $CRITICAL) ? (90) : (95))
50
+ delay: down 5m multiplier 1.5 max 1h
51
+ summary: SQL Elastic Pool instance memory on ${label:resource_name}
52
+ info: SQL instance memory utilization of SQL Elastic Pool ${label:resource_name} \
53
+ in ${label:resource_group} (${label:region})
54
+ to: dba
55
+
56
+# --- DTU Utilization ---
57
+
58
+ template: am_sql_elastic_pool_dtu_consumption
59
+ on: azure_monitor.sql_elastic_pool.dtu_consumption
60
+ class: Utilization
61
+ type: Database
62
+component: Azure SQL Elastic Pool
63
+ lookup: average -5m unaligned of average
64
+ units: percentage
65
+ every: 1m
66
+ warn: $this > (($status >= $WARNING) ? (75) : (85))
67
+ crit: $this > (($status == $CRITICAL) ? (85) : (95))
68
+ delay: down 5m multiplier 1.5 max 1h
69
+ summary: SQL Elastic Pool DTU consumption on ${label:resource_name}
70
+ info: DTU consumption percentage of SQL Elastic Pool ${label:resource_name} \
71
+ in ${label:resource_group} (${label:region}). \
72
+ High DTU usage indicates approaching the pool performance limit
73
+ to: dba
74
+
75
+# --- I/O Utilization ---
76
+
77
+ template: am_sql_elastic_pool_data_io
78
+ on: azure_monitor.sql_elastic_pool.io_utilization
79
+ class: Utilization
80
+ type: Database
81
+component: Azure SQL Elastic Pool
82
+ lookup: average -5m unaligned of data_read
83
+ units: percentage
84
+ every: 1m
85
+ warn: $this > (($status >= $WARNING) ? (80) : (90))
86
+ crit: $this > (($status == $CRITICAL) ? (90) : (95))
87
+ delay: down 5m multiplier 1.5 max 1h
88
+ summary: SQL Elastic Pool data I/O on ${label:resource_name}
89
+ info: Physical data read I/O utilization of SQL Elastic Pool ${label:resource_name} \
90
+ in ${label:resource_group} (${label:region})
91
+ to: dba
92
+
93
+ template: am_sql_elastic_pool_log_write
94
+ on: azure_monitor.sql_elastic_pool.io_utilization
95
+ class: Utilization
96
+ type: Database
97
+component: Azure SQL Elastic Pool
98
+ lookup: average -5m unaligned of log_write
99
+ units: percentage
100
+ every: 1m
101
+ warn: $this > (($status >= $WARNING) ? (80) : (90))
102
+ crit: $this > (($status == $CRITICAL) ? (90) : (95))
103
+ delay: down 5m multiplier 1.5 max 1h
104
+ summary: SQL Elastic Pool log write on ${label:resource_name}
105
+ info: Transaction log write utilization of SQL Elastic Pool ${label:resource_name} \
106
+ in ${label:resource_group} (${label:region})
107
+ to: dba
108
+
109
+# --- Resource Limits ---
110
+
111
+ template: am_sql_elastic_pool_workers
112
+ on: azure_monitor.sql_elastic_pool.resource_utilization
113
+ class: Utilization
114
+ type: Database
115
+component: Azure SQL Elastic Pool
116
+ lookup: average -5m unaligned of workers
117
+ units: percentage
118
+ every: 1m
119
+ warn: $this > (($status >= $WARNING) ? (70) : (80))
120
+ crit: $this > (($status == $CRITICAL) ? (80) : (90))
121
+ delay: down 5m multiplier 1.5 max 1h
122
+ summary: SQL Elastic Pool workers on ${label:resource_name}
123
+ info: Worker thread utilization of SQL Elastic Pool ${label:resource_name} \
124
+ in ${label:resource_group} (${label:region}). \
125
+ Exhausting workers causes query failures
126
+ to: dba
127
+
128
+ template: am_sql_elastic_pool_sessions
129
+ on: azure_monitor.sql_elastic_pool.resource_utilization
130
+ class: Utilization
131
+ type: Database
132
+component: Azure SQL Elastic Pool
133
+ lookup: average -5m unaligned of sessions
134
+ units: percentage
135
+ every: 1m
136
+ warn: $this > (($status >= $WARNING) ? (70) : (80))
137
+ crit: $this > (($status == $CRITICAL) ? (80) : (90))
138
+ delay: down 5m multiplier 1.5 max 1h
139
+ summary: SQL Elastic Pool sessions on ${label:resource_name}
140
+ info: Session utilization of SQL Elastic Pool ${label:resource_name} \
141
+ in ${label:resource_group} (${label:region}). \
142
+ Exhausting sessions prevents new connections
143
+ to: dba
144
+
145
+# --- Storage Utilization ---
146
+
147
+ template: am_sql_elastic_pool_storage_used
148
+ on: azure_monitor.sql_elastic_pool.storage_utilization
149
+ class: Utilization
150
+ type: Database
151
+component: Azure SQL Elastic Pool
152
+ lookup: average -5m unaligned of used
153
+ units: percentage
154
+ every: 1m
155
+ warn: $this > (($status >= $WARNING) ? (75) : (85))
156
+ crit: $this > (($status == $CRITICAL) ? (85) : (95))
157
+ delay: down 5m multiplier 1.5 max 1h
158
+ summary: SQL Elastic Pool storage used on ${label:resource_name}
159
+ info: Data storage utilization of SQL Elastic Pool ${label:resource_name} \
160
+ in ${label:resource_group} (${label:region}). \
161
+ Reaching the storage limit prevents data inserts and updates
162
+ to: dba
163
+
164
+ template: am_sql_elastic_pool_storage_allocated
165
+ on: azure_monitor.sql_elastic_pool.storage_utilization
166
+ class: Utilization
167
+ type: Database
168
+component: Azure SQL Elastic Pool
169
+ lookup: average -5m unaligned of allocated
170
+ units: percentage
171
+ every: 1m
172
+ warn: $this > (($status >= $WARNING) ? (80) : (90))
173
+ delay: down 5m multiplier 1.5 max 1h
174
+ summary: SQL Elastic Pool storage allocated on ${label:resource_name}
175
+ info: Allocated data storage utilization of SQL Elastic Pool ${label:resource_name} \
176
+ in ${label:resource_group} (${label:region}). \
177
+ Allocated space can exceed used space due to database file growth settings
178
+ to: dba
179
+
180
+# --- In-Memory OLTP ---
181
+
182
+ template: am_sql_elastic_pool_xtp_storage
183
+ on: azure_monitor.sql_elastic_pool.xtp_storage
184
+ class: Utilization
185
+ type: Database
186
+component: Azure SQL Elastic Pool
187
+ lookup: average -5m unaligned of average
188
+ units: percentage
189
+ every: 1m
190
+ warn: $this != nan AND $this > (($status >= $WARNING) ? (70) : (80))
191
+ crit: $this != nan AND $this > (($status == $CRITICAL) ? (80) : (90))
192
+ delay: down 5m multiplier 1.5 max 1h
193
+ summary: SQL Elastic Pool In-Memory OLTP storage on ${label:resource_name}
194
+ info: In-Memory OLTP storage utilization of SQL Elastic Pool ${label:resource_name} \
195
+ in ${label:resource_group} (${label:region}). \
196
+ Only relevant when In-Memory OLTP is enabled
197
+ to: dba
198
+
199
+# --- Tempdb ---
200
+
201
+ template: am_sql_elastic_pool_tempdb_log
202
+ on: azure_monitor.sql_elastic_pool.tempdb_log_utilization
203
+ class: Utilization
204
+ type: Database
205
+component: Azure SQL Elastic Pool
206
+ lookup: average -5m unaligned of average
207
+ units: percentage
208
+ every: 1m
209
+ warn: $this > (($status >= $WARNING) ? (70) : (80))
210
+ crit: $this > (($status == $CRITICAL) ? (80) : (90))
211
+ delay: down 5m multiplier 1.5 max 1h
212
+ summary: SQL Elastic Pool tempdb log on ${label:resource_name}
213
+ info: Tempdb transaction log utilization of SQL Elastic Pool ${label:resource_name} \
214
+ in ${label:resource_group} (${label:region}). \
215
+ High tempdb log usage can block transactions
216
+ to: dba
217
+
218
+# --- Serverless ---
219
+
220
+ template: am_sql_elastic_pool_serverless_cpu
221
+ on: azure_monitor.sql_elastic_pool.serverless_utilization
222
+ class: Utilization
223
+ type: Database
224
+component: Azure SQL Elastic Pool
225
+ lookup: average -5m unaligned of cpu
226
+ units: percentage
227
+ every: 1m
228
+ warn: $this != nan AND $this > (($status >= $WARNING) ? (75) : (85))
229
+ crit: $this != nan AND $this > (($status == $CRITICAL) ? (85) : (95))
230
+ delay: down 5m multiplier 1.5 max 1h
231
+ summary: SQL Elastic Pool serverless CPU on ${label:resource_name}
232
+ info: App CPU utilization of serverless SQL Elastic Pool ${label:resource_name} \
233
+ in ${label:resource_group} (${label:region}). \
234
+ Only relevant for serverless tier elastic pools
235
+ to: dba
236
+
237
+ template: am_sql_elastic_pool_serverless_memory
238
+ on: azure_monitor.sql_elastic_pool.serverless_utilization
239
+ class: Utilization
240
+ type: Database
241
+component: Azure SQL Elastic Pool
242
+ lookup: average -5m unaligned of memory
243
+ units: percentage
244
+ every: 1m
245
+ warn: $this != nan AND $this > (($status >= $WARNING) ? (80) : (90))
246
+ crit: $this != nan AND $this > (($status == $CRITICAL) ? (90) : (95))
247
+ delay: down 5m multiplier 1.5 max 1h
248
+ summary: SQL Elastic Pool serverless memory on ${label:resource_name}
249
+ info: App memory utilization of serverless SQL Elastic Pool ${label:resource_name} \
250
+ in ${label:resource_group} (${label:region}). \
251
+ Only relevant for serverless tier elastic pools
252
+ to: dba
src/health/health.d/azure_monitor_sql_managed_instance.conf
new
+56
@@ -0,0 +1,56 @@
1
+# you can disable an alarm notification by setting the 'to' line to: silent
2
+
3
+# --- Utilization ---
4
+
5
+ template: am_sql_managed_instance_cpu
6
+ on: azure_monitor.sql_managed_instance.cpu
7
+ class: Utilization
8
+ type: Database
9
+component: Azure SQL MI
10
+ lookup: average -5m unaligned of average
11
+ units: percentage
12
+ every: 1m
13
+ warn: $this > (($status >= $WARNING) ? (75) : (85))
14
+ crit: $this > (($status == $CRITICAL) ? (85) : (95))
15
+ delay: down 5m multiplier 1.5 max 1h
16
+ summary: SQL MI CPU utilization on ${label:resource_name}
17
+ info: Average CPU utilization of SQL Managed Instance ${label:resource_name} \
18
+ in ${label:resource_group} (${label:region}). \
19
+ Sustained high CPU indicates insufficient compute tier or query optimization needed
20
+ to: dba
21
+
22
+ template: am_sql_managed_instance_storage_utilization
23
+ on: azure_monitor.sql_managed_instance.storage
24
+ class: Utilization
25
+ type: Database
26
+component: Azure SQL MI
27
+ calc: ($reserved > 0) ? ($used * 100 / $reserved) : (0)
28
+ units: %
29
+ every: 5m
30
+ warn: $this > (($status >= $WARNING) ? (80) : (85))
31
+ crit: $this > (($status == $CRITICAL) ? (85) : (90))
32
+ delay: down 5m multiplier 1.5 max 1h
33
+ summary: SQL MI storage utilization on ${label:resource_name}
34
+ info: Storage used as a percentage of reserved storage on SQL Managed Instance ${label:resource_name} \
35
+ in ${label:resource_group} (${label:region}). \
36
+ Approaching reserved storage limit may cause write failures
37
+ to: dba
38
+
39
+# --- Workload ---
40
+
41
+ template: am_sql_managed_instance_io_requests
42
+ on: azure_monitor.sql_managed_instance.io_requests
43
+ class: Workload
44
+ type: Database
45
+component: Azure SQL MI
46
+ lookup: average -5m unaligned of average
47
+ units: requests/s
48
+ every: 1m
49
+ warn: $this > (($status >= $WARNING) ? (4000) : (5000))
50
+ crit: $this > (($status == $CRITICAL) ? (5000) : (7500))
51
+ delay: down 5m multiplier 1.5 max 1h
52
+ summary: SQL MI I/O requests on ${label:resource_name}
53
+ info: Average I/O requests per second on SQL Managed Instance ${label:resource_name} \
54
+ in ${label:resource_group} (${label:region}). \
55
+ High I/O request rates may indicate I/O bottleneck or unoptimized queries
56
+ to: dba
src/health/health.d/azure_monitor_storage_accounts.conf
new
+104
@@ -0,0 +1,104 @@
1
+# you can disable an alarm notification by setting the 'to' line to: silent
2
+
3
+# --- Availability ---
4
+
5
+# Storage account availability (0-100%). Low is bad.
6
+# Azure SLA guarantees >=99.9% for RA-GRS/RA-GZRS, >=99.9% for most tiers.
7
+# AMBA: Availability < 99% is Sev1 (critical)
8
+
9
+ template: am_storage_accounts_availability
10
+ on: azure_monitor.storage_accounts.availability
11
+ class: Availability
12
+ type: Storage
13
+component: Azure Storage
14
+ lookup: average -5m unaligned of average
15
+ units: percentage
16
+ every: 1m
17
+ warn: $this < (($status >= $WARNING) ? (99.9) : (99))
18
+ crit: $this < (($status == $CRITICAL) ? (99) : (90))
19
+ delay: down 5m multiplier 1.5 max 1h
20
+ summary: Storage availability on ${label:resource_name}
21
+ info: Overall availability of Azure Storage Account ${label:resource_name} \
22
+ in ${label:resource_group} (${label:region}). \
23
+ Azure SLA guarantees 99.9% or higher depending on redundancy tier
24
+ to: sysadmin
25
+
26
+# --- Latency ---
27
+
28
+# End-to-end latency measures the full round-trip including network.
29
+# AMBA: SuccessE2ELatency average > 1000ms is Sev2
30
+
31
+ template: am_storage_accounts_e2e_latency
32
+ on: azure_monitor.storage_accounts.e2e_latency
33
+ class: Latency
34
+ type: Storage
35
+component: Azure Storage
36
+ lookup: average -5m unaligned of average
37
+ units: milliseconds
38
+ every: 1m
39
+ warn: $this > (($status >= $WARNING) ? (500) : (1000))
40
+ crit: $this > (($status == $CRITICAL) ? (1000) : (2000))
41
+ delay: down 5m multiplier 1.5 max 1h
42
+ summary: Storage E2E latency on ${label:resource_name}
43
+ info: Average end-to-end latency of successful requests to Azure Storage Account \
44
+ ${label:resource_name} in ${label:resource_group} (${label:region}). \
45
+ Includes network round-trip time
46
+ to: sysadmin
47
+
48
+# Peak end-to-end latency — catches extreme spikes even when average looks normal.
49
+
50
+ template: am_storage_accounts_e2e_latency_peak
51
+ on: azure_monitor.storage_accounts.e2e_latency
52
+ class: Latency
53
+ type: Storage
54
+component: Azure Storage
55
+ lookup: max -5m unaligned of maximum
56
+ units: milliseconds
57
+ every: 1m
58
+ warn: $this > (($status >= $WARNING) ? (2000) : (5000))
59
+ crit: $this > (($status == $CRITICAL) ? (5000) : (10000))
60
+ delay: down 5m multiplier 1.5 max 1h
61
+ summary: Storage E2E latency peak on ${label:resource_name}
62
+ info: Peak end-to-end latency of successful requests to Azure Storage Account \
63
+ ${label:resource_name} in ${label:resource_group} (${label:region}). \
64
+ Spikes may indicate throttling or network congestion
65
+ to: sysadmin
66
+
67
+# Server-side latency excludes network — pure Azure processing time.
68
+# AMBA: SuccessServerLatency average > 1000ms is Sev2
69
+
70
+ template: am_storage_accounts_server_latency
71
+ on: azure_monitor.storage_accounts.server_latency
72
+ class: Latency
73
+ type: Storage
74
+component: Azure Storage
75
+ lookup: average -5m unaligned of average
76
+ units: milliseconds
77
+ every: 1m
78
+ warn: $this > (($status >= $WARNING) ? (300) : (500))
79
+ crit: $this > (($status == $CRITICAL) ? (500) : (1000))
80
+ delay: down 5m multiplier 1.5 max 1h
81
+ summary: Storage server latency on ${label:resource_name}
82
+ info: Average server-side latency of successful requests to Azure Storage Account \
83
+ ${label:resource_name} in ${label:resource_group} (${label:region}). \
84
+ Excludes network time — high values indicate Azure-side processing delays
85
+ to: sysadmin
86
+
87
+# Peak server-side latency — catches extreme server-side spikes.
88
+
89
+ template: am_storage_accounts_server_latency_peak
90
+ on: azure_monitor.storage_accounts.server_latency
91
+ class: Latency
92
+ type: Storage
93
+component: Azure Storage
94
+ lookup: max -5m unaligned of maximum
95
+ units: milliseconds
96
+ every: 1m
97
+ warn: $this > (($status >= $WARNING) ? (1000) : (2000))
98
+ crit: $this > (($status == $CRITICAL) ? (2000) : (5000))
99
+ delay: down 5m multiplier 1.5 max 1h
100
+ summary: Storage server latency peak on ${label:resource_name}
101
+ info: Peak server-side latency of successful requests to Azure Storage Account \
102
+ ${label:resource_name} in ${label:resource_group} (${label:region}). \
103
+ Spikes may indicate throttling at the storage partition level
104
+ to: sysadmin
src/health/health.d/azure_monitor_stream_analytics.conf
new
+192
@@ -0,0 +1,192 @@
1
+# you can disable an alarm notification by setting the 'to' line to: silent
2
+
3
+# ── Resource Utilization ────────────────────────────────────────────────────
4
+
5
+ template: am_stream_analytics_su_utilization
6
+ on: azure_monitor.stream_analytics.resource_utilization
7
+ class: Utilization
8
+ type: Other
9
+component: Azure Stream Analytics
10
+ lookup: average -5m unaligned of su_memory
11
+ units: percentage
12
+ every: 1m
13
+ warn: $this > (($status >= $WARNING) ? (75) : (80))
14
+ crit: $this > (($status == $CRITICAL) ? (80) : (90))
15
+ delay: down 5m multiplier 1.5 max 1h
16
+ summary: Stream Analytics SU utilization on ${label:resource_name}
17
+ info: Average streaming unit (memory) utilization of Stream Analytics job ${label:resource_name} \
18
+ in ${label:resource_group} (${label:region}). \
19
+ Sustained high SU utilization indicates the job needs more streaming units.
20
+ to: sysadmin
21
+
22
+ template: am_stream_analytics_cpu_utilization
23
+ on: azure_monitor.stream_analytics.resource_utilization
24
+ class: Utilization
25
+ type: Other
26
+component: Azure Stream Analytics
27
+ lookup: average -5m unaligned of cpu
28
+ units: percentage
29
+ every: 1m
30
+ warn: $this > (($status >= $WARNING) ? (75) : (80))
31
+ crit: $this > (($status == $CRITICAL) ? (80) : (90))
32
+ delay: down 5m multiplier 1.5 max 1h
33
+ summary: Stream Analytics CPU on ${label:resource_name}
34
+ info: Average CPU utilization of Stream Analytics job ${label:resource_name} \
35
+ in ${label:resource_group} (${label:region}). \
36
+ High CPU indicates complex query processing or insufficient streaming units.
37
+ to: sysadmin
38
+
39
+# ── Watermark Delay ─────────────────────────────────────────────────────────
40
+
41
+ template: am_stream_analytics_watermark_delay
42
+ on: azure_monitor.stream_analytics.watermark_delay
43
+ class: Latency
44
+ type: Other
45
+component: Azure Stream Analytics
46
+ lookup: average -5m unaligned of delay
47
+ units: seconds
48
+ every: 1m
49
+ warn: $this > (($status >= $WARNING) ? (60) : (120))
50
+ crit: $this > (($status == $CRITICAL) ? (120) : (300))
51
+ delay: down 5m multiplier 1.5 max 1h
52
+ summary: Stream Analytics watermark delay on ${label:resource_name}
53
+ info: Output watermark delay of Stream Analytics job ${label:resource_name} \
54
+ in ${label:resource_group} (${label:region}). \
55
+ Growing delay means the job is falling behind processing input data.
56
+ to: sysadmin
57
+
58
+# ── Errors ──────────────────────────────────────────────────────────────────
59
+
60
+ template: am_stream_analytics_runtime_errors
61
+ on: azure_monitor.stream_analytics.errors
62
+ class: Errors
63
+ type: Other
64
+component: Azure Stream Analytics
65
+ lookup: average -5m unaligned of runtime
66
+ units: errors/s
67
+ every: 1m
68
+ warn: $this > (($status >= $WARNING) ? (0) : (1))
69
+ delay: down 5m multiplier 1.5 max 1h
70
+ summary: Stream Analytics runtime errors on ${label:resource_name}
71
+ info: Runtime errors on Stream Analytics job ${label:resource_name} \
72
+ in ${label:resource_group} (${label:region}). \
73
+ Runtime errors indicate issues with query execution or resource constraints.
74
+ to: sysadmin
75
+
76
+ template: am_stream_analytics_data_conversion_errors
77
+ on: azure_monitor.stream_analytics.errors
78
+ class: Errors
79
+ type: Other
80
+component: Azure Stream Analytics
81
+ lookup: average -5m unaligned of data_conversion
82
+ units: errors/s
83
+ every: 1m
84
+ warn: $this > (($status >= $WARNING) ? (0) : (1))
85
+ delay: down 5m multiplier 1.5 max 1h
86
+ summary: Stream Analytics conversion errors on ${label:resource_name}
87
+ info: Data conversion errors on Stream Analytics job ${label:resource_name} \
88
+ in ${label:resource_group} (${label:region}). \
89
+ These occur when output events cannot be converted to the expected output schema.
90
+ to: sysadmin
91
+
92
+ template: am_stream_analytics_deserialization_errors
93
+ on: azure_monitor.stream_analytics.errors
94
+ class: Errors
95
+ type: Other
96
+component: Azure Stream Analytics
97
+ lookup: average -5m unaligned of deserialization
98
+ units: errors/s
99
+ every: 1m
100
+ warn: $this > (($status >= $WARNING) ? (0) : (1))
101
+ delay: down 5m multiplier 1.5 max 1h
102
+ summary: Stream Analytics deserialization errors on ${label:resource_name}
103
+ info: Input deserialization errors on Stream Analytics job ${label:resource_name} \
104
+ in ${label:resource_group} (${label:region}). \
105
+ These occur when input events cannot be parsed (malformed JSON, CSV, Avro).
106
+ to: sysadmin
107
+
108
+# ── Event Timing ────────────────────────────────────────────────────────────
109
+
110
+ template: am_stream_analytics_out_of_order_events
111
+ on: azure_monitor.stream_analytics.event_timing
112
+ class: Errors
113
+ type: Other
114
+component: Azure Stream Analytics
115
+ lookup: average -5m unaligned of out_of_order
116
+ units: events/s
117
+ every: 1m
118
+ warn: $this > (($status >= $WARNING) ? (5) : (10))
119
+ delay: down 5m multiplier 1.5 max 1h
120
+ summary: Stream Analytics out-of-order events on ${label:resource_name}
121
+ info: Rate of dropped or adjusted out-of-order events on Stream Analytics job \
122
+ ${label:resource_name} in ${label:resource_group} (${label:region}). \
123
+ High rates may indicate clock skew in event sources.
124
+ to: sysadmin
125
+
126
+ template: am_stream_analytics_late_events
127
+ on: azure_monitor.stream_analytics.event_timing
128
+ class: Errors
129
+ type: Other
130
+component: Azure Stream Analytics
131
+ lookup: average -5m unaligned of late
132
+ units: events/s
133
+ every: 1m
134
+ warn: $this > (($status >= $WARNING) ? (5) : (10))
135
+ delay: down 5m multiplier 1.5 max 1h
136
+ summary: Stream Analytics late events on ${label:resource_name}
137
+ info: Rate of late-arriving input events on Stream Analytics job ${label:resource_name} \
138
+ in ${label:resource_group} (${label:region}). \
139
+ Late events arrive after the late arrival tolerance window.
140
+ to: sysadmin
141
+
142
+# ── Backlog ─────────────────────────────────────────────────────────────────
143
+
144
+ template: am_stream_analytics_backlogged_events
145
+ on: azure_monitor.stream_analytics.backlogged_events
146
+ class: Utilization
147
+ type: Other
148
+component: Azure Stream Analytics
149
+ lookup: average -5m unaligned of backlogged
150
+ units: events
151
+ every: 1m
152
+ warn: $this > (($status >= $WARNING) ? (5000) : (10000))
153
+ crit: $this > (($status == $CRITICAL) ? (10000) : (50000))
154
+ delay: down 5m multiplier 1.5 max 1h
155
+ summary: Stream Analytics backlog on ${label:resource_name}
156
+ info: Number of backlogged input events on Stream Analytics job ${label:resource_name} \
157
+ in ${label:resource_group} (${label:region}). \
158
+ A growing backlog means the job cannot keep up with the input rate.
159
+ to: sysadmin
160
+
161
+# ── Function Requests ───────────────────────────────────────────────────────
162
+
163
+# Helper: total ML function request rate (used for minimum-data guard)
164
+ template: am_stream_analytics_function_request_rate
165
+ on: azure_monitor.stream_analytics.function_requests
166
+ class: Workload
167
+ type: Other
168
+component: Azure Stream Analytics
169
+ lookup: average -5m unaligned of total
170
+ units: requests/s
171
+ every: 1m
172
+ summary: Stream Analytics function call rate on ${label:resource_name}
173
+ info: Average Azure ML function call rate for Stream Analytics job ${label:resource_name} \
174
+ in ${label:resource_group} (${label:region})
175
+ to: silent
176
+
177
+ template: am_stream_analytics_function_failures
178
+ on: azure_monitor.stream_analytics.function_requests
179
+ class: Errors
180
+ type: Other
181
+component: Azure Stream Analytics
182
+ lookup: average -5m unaligned of failed
183
+ calc: ($am_stream_analytics_function_request_rate > 0) ? ($this * 100 / $am_stream_analytics_function_request_rate) : (0)
184
+ units: %
185
+ every: 1m
186
+ warn: $this != nan AND ($am_stream_analytics_function_request_rate > 0.5) ? ($this > (($status >= $WARNING) ? (5) : (10))) : (0)
187
+ crit: $this != nan AND ($am_stream_analytics_function_request_rate > 0.5) ? ($this > (($status == $CRITICAL) ? (15) : (25))) : (0)
188
+ delay: down 5m multiplier 1.5 max 1h
189
+ summary: Stream Analytics ML function failures on ${label:resource_name}
190
+ info: Percentage of failed Azure ML function requests for Stream Analytics job \
191
+ ${label:resource_name} in ${label:resource_group} (${label:region})
192
+ to: sysadmin
src/health/health.d/azure_monitor_synapse.conf
new
+143
@@ -0,0 +1,143 @@
1
+# you can disable an alarm notification by setting the 'to' line to: silent
2
+
3
+# ── Streaming Job - Resource Utilization ────────────────────────────────────
4
+
5
+ template: am_synapse_streaming_resource_utilization
6
+ on: azure_monitor.synapse.streaming_resource_utilization
7
+ class: Utilization
8
+ type: Database
9
+component: Azure Synapse
10
+ lookup: average -5m unaligned of utilization
11
+ units: percentage
12
+ every: 1m
13
+ warn: $this > (($status >= $WARNING) ? (75) : (85))
14
+ crit: $this > (($status == $CRITICAL) ? (85) : (95))
15
+ delay: down 5m multiplier 1.5 max 1h
16
+ summary: Synapse streaming SU utilization on ${label:resource_name}
17
+ info: Streaming job resource utilization on Azure Synapse workspace ${label:resource_name} \
18
+ in ${label:resource_group} (${label:region}). \
19
+ High values indicate the streaming job is approaching capacity
20
+ to: sysadmin
21
+
22
+# ── Streaming Job - Errors ──────────────────────────────────────────────────
23
+
24
+ template: am_synapse_streaming_runtime_errors
25
+ on: azure_monitor.synapse.streaming_errors
26
+ class: Errors
27
+ type: Database
28
+component: Azure Synapse
29
+ lookup: average -5m unaligned of runtime
30
+ units: errors/s
31
+ every: 1m
32
+ warn: $this > (($status >= $WARNING) ? (0) : (1))
33
+ crit: $this > (($status == $CRITICAL) ? (1) : (5))
34
+ delay: down 5m multiplier 1.5 max 1h
35
+ summary: Synapse streaming runtime errors on ${label:resource_name}
36
+ info: Streaming job runtime errors on Azure Synapse workspace ${label:resource_name} \
37
+ in ${label:resource_group} (${label:region})
38
+ to: sysadmin
39
+
40
+ template: am_synapse_streaming_data_errors
41
+ on: azure_monitor.synapse.streaming_errors
42
+ class: Errors
43
+ type: Database
44
+component: Azure Synapse
45
+ lookup: average -5m unaligned of data_conversion,deserialization
46
+ units: errors/s
47
+ every: 1m
48
+ warn: $this > (($status >= $WARNING) ? (0) : (1))
49
+ crit: $this > (($status == $CRITICAL) ? (5) : (10))
50
+ delay: down 5m multiplier 1.5 max 1h
51
+ summary: Synapse streaming data errors on ${label:resource_name}
52
+ info: Streaming job data conversion and deserialization errors on Azure Synapse workspace \
53
+ ${label:resource_name} in ${label:resource_group} (${label:region})
54
+ to: sysadmin
55
+
56
+# ── Streaming Job - Watermark Delay ─────────────────────────────────────────
57
+
58
+ template: am_synapse_streaming_watermark_delay
59
+ on: azure_monitor.synapse.streaming_watermark_delay
60
+ class: Latency
61
+ type: Database
62
+component: Azure Synapse
63
+ lookup: average -5m unaligned of delay
64
+ units: seconds
65
+ every: 1m
66
+ warn: $this > (($status >= $WARNING) ? (30) : (60))
67
+ crit: $this > (($status == $CRITICAL) ? (60) : (120))
68
+ delay: down 5m multiplier 1.5 max 1h
69
+ summary: Synapse streaming watermark delay on ${label:resource_name}
70
+ info: Output watermark delay of the streaming job on Azure Synapse workspace ${label:resource_name} \
71
+ in ${label:resource_group} (${label:region}). \
72
+ High delay indicates the streaming job is falling behind real-time processing
73
+ to: sysadmin
74
+
75
+# ── Streaming Job - Event Timing Issues ─────────────────────────────────────
76
+
77
+ template: am_synapse_streaming_late_events
78
+ on: azure_monitor.synapse.streaming_event_timing
79
+ class: Errors
80
+ type: Database
81
+component: Azure Synapse
82
+ lookup: average -5m unaligned of late
83
+ units: events/s
84
+ every: 1m
85
+ warn: $this > (($status >= $WARNING) ? (5) : (10))
86
+ crit: $this > (($status == $CRITICAL) ? (25) : (50))
87
+ delay: down 5m multiplier 1.5 max 1h
88
+ summary: Synapse streaming late events on ${label:resource_name}
89
+ info: Rate of late-arriving input events in the streaming job on Azure Synapse workspace \
90
+ ${label:resource_name} in ${label:resource_group} (${label:region})
91
+ to: sysadmin
92
+
93
+ template: am_synapse_streaming_out_of_order_events
94
+ on: azure_monitor.synapse.streaming_event_timing
95
+ class: Errors
96
+ type: Database
97
+component: Azure Synapse
98
+ lookup: average -5m unaligned of out_of_order
99
+ units: events/s
100
+ every: 1m
101
+ warn: $this > (($status >= $WARNING) ? (5) : (10))
102
+ crit: $this > (($status == $CRITICAL) ? (25) : (50))
103
+ delay: down 5m multiplier 1.5 max 1h
104
+ summary: Synapse streaming out-of-order events on ${label:resource_name}
105
+ info: Rate of out-of-order input events in the streaming job on Azure Synapse workspace \
106
+ ${label:resource_name} in ${label:resource_group} (${label:region})
107
+ to: sysadmin
108
+
109
+ template: am_synapse_streaming_backlogged_events
110
+ on: azure_monitor.synapse.streaming_event_timing
111
+ class: Workload
112
+ type: Database
113
+component: Azure Synapse
114
+ lookup: average -5m unaligned of backlogged
115
+ units: events/s
116
+ every: 1m
117
+ warn: $this > (($status >= $WARNING) ? (50) : (100))
118
+ crit: $this > (($status == $CRITICAL) ? (100) : (500))
119
+ delay: down 5m multiplier 1.5 max 1h
120
+ summary: Synapse streaming backlogged events on ${label:resource_name}
121
+ info: Rate of backlogged input event sources in the streaming job on Azure Synapse workspace \
122
+ ${label:resource_name} in ${label:resource_group} (${label:region}). \
123
+ Backlog growth indicates input rate exceeds processing capacity
124
+ to: sysadmin
125
+
126
+# ── Integration - Link Processing Latency ───────────────────────────────────
127
+
128
+ template: am_synapse_link_processing_latency
129
+ on: azure_monitor.synapse.link_processing_latency
130
+ class: Latency
131
+ type: Database
132
+component: Azure Synapse
133
+ lookup: average -5m unaligned of average
134
+ units: seconds
135
+ every: 1m
136
+ warn: $this != nan AND $this > (($status >= $WARNING) ? (30) : (60))
137
+ crit: $this != nan AND $this > (($status == $CRITICAL) ? (60) : (120))
138
+ delay: down 5m multiplier 1.5 max 1h
139
+ summary: Synapse Link processing latency on ${label:resource_name}
140
+ info: Average Synapse Link processing latency on Azure Synapse workspace ${label:resource_name} \
141
+ in ${label:resource_group} (${label:region}). \
142
+ Only relevant when Synapse Link connections are configured
143
+ to: sysadmin
src/health/health.d/azure_monitor_virtual_machines.conf
new
+446
@@ -0,0 +1,446 @@
1
+# you can disable an alarm notification by setting the 'to' line to: silent
2
+
3
+# --- CPU ---
4
+
5
+ template: am_vm_cpu
6
+ on: azure_monitor.virtual_machines.cpu
7
+ class: Utilization
8
+ type: System
9
+component: Azure VM
10
+ lookup: average -5m unaligned of average
11
+ units: percentage
12
+ every: 1m
13
+ warn: $this > (($status >= $WARNING) ? (85) : (90))
14
+ crit: $this > (($status == $CRITICAL) ? (90) : (95))
15
+ delay: down 5m multiplier 1.5 max 1h
16
+ summary: VM CPU on ${label:resource_name}
17
+ info: Average CPU utilization on Azure VM ${label:resource_name} \
18
+ in ${label:resource_group} (${label:region})
19
+ to: sysadmin
20
+
21
+# CPU credits are only available on burstable B-series VMs.
22
+# NaN guard: remaining is NaN on non-burstable VM sizes.
23
+
24
+ template: am_vm_cpu_credits_remaining
25
+ on: azure_monitor.virtual_machines.cpu_credits
26
+ class: Utilization
27
+ type: System
28
+component: Azure VM
29
+ lookup: average -5m unaligned of remaining
30
+ units: credits
31
+ every: 1m
32
+ warn: $this != nan AND $this < (($status >= $WARNING) ? (30) : (20))
33
+ crit: $this != nan AND $this < (($status == $CRITICAL) ? (20) : (10))
34
+ delay: down 5m multiplier 1.5 max 1h
35
+ summary: VM CPU credits low on ${label:resource_name}
36
+ info: CPU credits remaining on burstable Azure VM ${label:resource_name} \
37
+ in ${label:resource_group} (${label:region}). \
38
+ When credits are exhausted, CPU performance is capped.
39
+ to: sysadmin
40
+
41
+# --- Memory ---
42
+# Available Memory Percentage: low is bad.
43
+
44
+ template: am_vm_memory_available
45
+ on: azure_monitor.virtual_machines.memory_percentage
46
+ class: Utilization
47
+ type: System
48
+component: Azure VM
49
+ lookup: average -5m unaligned of available
50
+ units: percentage
51
+ every: 1m
52
+ warn: $this < (($status >= $WARNING) ? (15) : (10))
53
+ crit: $this < (($status == $CRITICAL) ? (10) : (5))
54
+ delay: down 5m multiplier 1.5 max 1h
55
+ summary: VM available memory on ${label:resource_name}
56
+ info: Available memory percentage on Azure VM ${label:resource_name} \
57
+ in ${label:resource_group} (${label:region})
58
+ to: sysadmin
59
+
60
+# --- Availability ---
61
+# VmAvailabilityMetric: 1 = available, < 1 = degraded/unavailable.
62
+
63
+ template: am_vm_availability
64
+ on: azure_monitor.virtual_machines.availability
65
+ class: Availability
66
+ type: System
67
+component: Azure VM
68
+ lookup: average -5m unaligned of average
69
+ units: state
70
+ every: 1m
71
+ crit: $this < 1
72
+ delay: down 5m multiplier 1.5 max 1h
73
+ summary: VM unavailable ${label:resource_name}
74
+ info: Azure VM ${label:resource_name} in ${label:resource_group} (${label:region}) \
75
+ is reporting degraded or unavailable state
76
+ to: sysadmin
77
+
78
+# --- OS Disk Latency ---
79
+
80
+ template: am_vm_os_disk_latency
81
+ on: azure_monitor.virtual_machines.os_disk_latency
82
+ class: Latency
83
+ type: System
84
+component: Azure VM
85
+ lookup: average -5m unaligned of average
86
+ units: milliseconds
87
+ every: 1m
88
+ warn: $this > (($status >= $WARNING) ? (30) : (50))
89
+ crit: $this > (($status == $CRITICAL) ? (50) : (100))
90
+ delay: down 5m multiplier 1.5 max 1h
91
+ summary: VM OS disk latency on ${label:resource_name}
92
+ info: Average OS disk latency on Azure VM ${label:resource_name} \
93
+ in ${label:resource_group} (${label:region}). \
94
+ High latency indicates disk I/O bottleneck.
95
+ to: sysadmin
96
+
97
+# --- OS Disk Queue Depth ---
98
+
99
+ template: am_vm_os_disk_queue_depth
100
+ on: azure_monitor.virtual_machines.os_disk_queue_depth
101
+ class: Utilization
102
+ type: System
103
+component: Azure VM
104
+ lookup: average -5m unaligned of average
105
+ units: operations
106
+ every: 1m
107
+ warn: $this > (($status >= $WARNING) ? (16) : (32))
108
+ crit: $this > (($status == $CRITICAL) ? (32) : (64))
109
+ delay: down 5m multiplier 1.5 max 1h
110
+ summary: VM OS disk queue depth on ${label:resource_name}
111
+ info: Average OS disk queue depth on Azure VM ${label:resource_name} \
112
+ in ${label:resource_group} (${label:region}). \
113
+ High queue depth indicates I/O saturation.
114
+ to: sysadmin
115
+
116
+# --- OS Disk Throttling ---
117
+# Bandwidth and IOPS consumed percentage. High values mean the disk
118
+# is approaching its provisioned performance limit and may be throttled.
119
+
120
+ template: am_vm_os_disk_bandwidth_throttling
121
+ on: azure_monitor.virtual_machines.os_disk_throttling
122
+ class: Utilization
123
+ type: System
124
+component: Azure VM
125
+ lookup: average -5m unaligned of bandwidth
126
+ units: percentage
127
+ every: 1m
128
+ warn: $this > (($status >= $WARNING) ? (80) : (90))
129
+ crit: $this > (($status == $CRITICAL) ? (90) : (95))
130
+ delay: down 5m multiplier 1.5 max 1h
131
+ summary: VM OS disk bandwidth throttling on ${label:resource_name}
132
+ info: OS disk bandwidth consumed percentage on Azure VM ${label:resource_name} \
133
+ in ${label:resource_group} (${label:region}). \
134
+ Approaching the provisioned bandwidth limit causes throttling.
135
+ to: sysadmin
136
+
137
+ template: am_vm_os_disk_iops_throttling
138
+ on: azure_monitor.virtual_machines.os_disk_throttling
139
+ class: Utilization
140
+ type: System
141
+component: Azure VM
142
+ lookup: average -5m unaligned of iops
143
+ units: percentage
144
+ every: 1m
145
+ warn: $this > (($status >= $WARNING) ? (80) : (90))
146
+ crit: $this > (($status == $CRITICAL) ? (90) : (95))
147
+ delay: down 5m multiplier 1.5 max 1h
148
+ summary: VM OS disk IOPS throttling on ${label:resource_name}
149
+ info: OS disk IOPS consumed percentage on Azure VM ${label:resource_name} \
150
+ in ${label:resource_group} (${label:region}). \
151
+ Approaching the provisioned IOPS limit causes throttling.
152
+ to: sysadmin
153
+
154
+# --- OS Disk Burst Credits ---
155
+# Burst credit usage: high means credits are being depleted.
156
+# NaN guard: burst credits are only available on eligible disk tiers.
157
+
158
+ template: am_vm_os_disk_burst_bps_credits
159
+ on: azure_monitor.virtual_machines.os_disk_burst_credits
160
+ class: Utilization
161
+ type: System
162
+component: Azure VM
163
+ lookup: average -5m unaligned of bandwidth
164
+ units: percentage
165
+ every: 1m
166
+ warn: $this != nan AND $this > (($status >= $WARNING) ? (80) : (90))
167
+ crit: $this != nan AND $this > (($status == $CRITICAL) ? (90) : (95))
168
+ delay: down 5m multiplier 1.5 max 1h
169
+ summary: VM OS disk burst bandwidth credits on ${label:resource_name}
170
+ info: OS disk burst bandwidth credits consumed on Azure VM ${label:resource_name} \
171
+ in ${label:resource_group} (${label:region}). \
172
+ When credits are exhausted, disk throughput drops to baseline.
173
+ to: sysadmin
174
+
175
+ template: am_vm_os_disk_burst_io_credits
176
+ on: azure_monitor.virtual_machines.os_disk_burst_credits
177
+ class: Utilization
178
+ type: System
179
+component: Azure VM
180
+ lookup: average -5m unaligned of io
181
+ units: percentage
182
+ every: 1m
183
+ warn: $this != nan AND $this > (($status >= $WARNING) ? (80) : (90))
184
+ crit: $this != nan AND $this > (($status == $CRITICAL) ? (90) : (95))
185
+ delay: down 5m multiplier 1.5 max 1h
186
+ summary: VM OS disk burst IO credits on ${label:resource_name}
187
+ info: OS disk burst IO credits consumed on Azure VM ${label:resource_name} \
188
+ in ${label:resource_group} (${label:region}). \
189
+ When credits are exhausted, disk IOPS drops to baseline.
190
+ to: sysadmin
191
+
192
+# --- Data Disk Latency ---
193
+
194
+ template: am_vm_data_disk_latency
195
+ on: azure_monitor.virtual_machines.data_disk_latency
196
+ class: Latency
197
+ type: System
198
+component: Azure VM
199
+ lookup: average -5m unaligned of average
200
+ units: milliseconds
201
+ every: 1m
202
+ warn: $this > (($status >= $WARNING) ? (30) : (50))
203
+ crit: $this > (($status == $CRITICAL) ? (50) : (100))
204
+ delay: down 5m multiplier 1.5 max 1h
205
+ summary: VM data disk latency on ${label:resource_name}
206
+ info: Average data disk latency on Azure VM ${label:resource_name} \
207
+ in ${label:resource_group} (${label:region}). \
208
+ High latency indicates disk I/O bottleneck.
209
+ to: sysadmin
210
+
211
+# --- Data Disk Queue Depth ---
212
+
213
+ template: am_vm_data_disk_queue_depth
214
+ on: azure_monitor.virtual_machines.data_disk_queue_depth
215
+ class: Utilization
216
+ type: System
217
+component: Azure VM
218
+ lookup: average -5m unaligned of average
219
+ units: operations
220
+ every: 1m
221
+ warn: $this > (($status >= $WARNING) ? (16) : (32))
222
+ crit: $this > (($status == $CRITICAL) ? (32) : (64))
223
+ delay: down 5m multiplier 1.5 max 1h
224
+ summary: VM data disk queue depth on ${label:resource_name}
225
+ info: Average data disk queue depth on Azure VM ${label:resource_name} \
226
+ in ${label:resource_group} (${label:region}). \
227
+ High queue depth indicates I/O saturation.
228
+ to: sysadmin
229
+
230
+# --- Data Disk Throttling ---
231
+
232
+ template: am_vm_data_disk_bandwidth_throttling
233
+ on: azure_monitor.virtual_machines.data_disk_throttling
234
+ class: Utilization
235
+ type: System
236
+component: Azure VM
237
+ lookup: average -5m unaligned of bandwidth
238
+ units: percentage
239
+ every: 1m
240
+ warn: $this > (($status >= $WARNING) ? (80) : (90))
241
+ crit: $this > (($status == $CRITICAL) ? (90) : (95))
242
+ delay: down 5m multiplier 1.5 max 1h
243
+ summary: VM data disk bandwidth throttling on ${label:resource_name}
244
+ info: Data disk bandwidth consumed percentage on Azure VM ${label:resource_name} \
245
+ in ${label:resource_group} (${label:region}). \
246
+ Approaching the provisioned bandwidth limit causes throttling.
247
+ to: sysadmin
248
+
249
+ template: am_vm_data_disk_iops_throttling
250
+ on: azure_monitor.virtual_machines.data_disk_throttling
251
+ class: Utilization
252
+ type: System
253
+component: Azure VM
254
+ lookup: average -5m unaligned of iops
255
+ units: percentage
256
+ every: 1m
257
+ warn: $this > (($status >= $WARNING) ? (80) : (90))
258
+ crit: $this > (($status == $CRITICAL) ? (90) : (95))
259
+ delay: down 5m multiplier 1.5 max 1h
260
+ summary: VM data disk IOPS throttling on ${label:resource_name}
261
+ info: Data disk IOPS consumed percentage on Azure VM ${label:resource_name} \
262
+ in ${label:resource_group} (${label:region}). \
263
+ Approaching the provisioned IOPS limit causes throttling.
264
+ to: sysadmin
265
+
266
+# --- Data Disk Burst Credits ---
267
+# NaN guard: burst credits are only available on eligible disk tiers.
268
+
269
+ template: am_vm_data_disk_burst_bps_credits
270
+ on: azure_monitor.virtual_machines.data_disk_burst_credits
271
+ class: Utilization
272
+ type: System
273
+component: Azure VM
274
+ lookup: average -5m unaligned of bandwidth
275
+ units: percentage
276
+ every: 1m
277
+ warn: $this != nan AND $this > (($status >= $WARNING) ? (80) : (90))
278
+ crit: $this != nan AND $this > (($status == $CRITICAL) ? (90) : (95))
279
+ delay: down 5m multiplier 1.5 max 1h
280
+ summary: VM data disk burst bandwidth credits on ${label:resource_name}
281
+ info: Data disk burst bandwidth credits consumed on Azure VM ${label:resource_name} \
282
+ in ${label:resource_group} (${label:region}). \
283
+ When credits are exhausted, disk throughput drops to baseline.
284
+ to: sysadmin
285
+
286
+ template: am_vm_data_disk_burst_io_credits
287
+ on: azure_monitor.virtual_machines.data_disk_burst_credits
288
+ class: Utilization
289
+ type: System
290
+component: Azure VM
291
+ lookup: average -5m unaligned of io
292
+ units: percentage
293
+ every: 1m
294
+ warn: $this != nan AND $this > (($status >= $WARNING) ? (80) : (90))
295
+ crit: $this != nan AND $this > (($status == $CRITICAL) ? (90) : (95))
296
+ delay: down 5m multiplier 1.5 max 1h
297
+ summary: VM data disk burst IO credits on ${label:resource_name}
298
+ info: Data disk burst IO credits consumed on Azure VM ${label:resource_name} \
299
+ in ${label:resource_group} (${label:region}). \
300
+ When credits are exhausted, disk IOPS drops to baseline.
301
+ to: sysadmin
302
+
303
+# --- VM-Level Cached IO Throttling ---
304
+# VM-level limits are separate from individual disk limits.
305
+# The VM can be throttled even when individual disks are not.
306
+
307
+ template: am_vm_cached_bandwidth_throttling
308
+ on: azure_monitor.virtual_machines.vm_cached_throttling
309
+ class: Utilization
310
+ type: System
311
+component: Azure VM
312
+ lookup: average -5m unaligned of bandwidth
313
+ units: percentage
314
+ every: 1m
315
+ warn: $this > (($status >= $WARNING) ? (80) : (90))
316
+ crit: $this > (($status == $CRITICAL) ? (90) : (95))
317
+ delay: down 5m multiplier 1.5 max 1h
318
+ summary: VM cached bandwidth throttling on ${label:resource_name}
319
+ info: VM-level cached bandwidth consumed percentage on Azure VM ${label:resource_name} \
320
+ in ${label:resource_group} (${label:region}). \
321
+ VM-level throttling affects all disks on the VM.
322
+ to: sysadmin
323
+
324
+ template: am_vm_cached_iops_throttling
325
+ on: azure_monitor.virtual_machines.vm_cached_throttling
326
+ class: Utilization
327
+ type: System
328
+component: Azure VM
329
+ lookup: average -5m unaligned of iops
330
+ units: percentage
331
+ every: 1m
332
+ warn: $this > (($status >= $WARNING) ? (80) : (90))
333
+ crit: $this > (($status == $CRITICAL) ? (90) : (95))
334
+ delay: down 5m multiplier 1.5 max 1h
335
+ summary: VM cached IOPS throttling on ${label:resource_name}
336
+ info: VM-level cached IOPS consumed percentage on Azure VM ${label:resource_name} \
337
+ in ${label:resource_group} (${label:region}). \
338
+ VM-level throttling affects all disks on the VM.
339
+ to: sysadmin
340
+
341
+# --- VM-Level Uncached IO Throttling ---
342
+
343
+ template: am_vm_uncached_bandwidth_throttling
344
+ on: azure_monitor.virtual_machines.vm_uncached_throttling
345
+ class: Utilization
346
+ type: System
347
+component: Azure VM
348
+ lookup: average -5m unaligned of bandwidth
349
+ units: percentage
350
+ every: 1m
351
+ warn: $this > (($status >= $WARNING) ? (80) : (90))
352
+ crit: $this > (($status == $CRITICAL) ? (90) : (95))
353
+ delay: down 5m multiplier 1.5 max 1h
354
+ summary: VM uncached bandwidth throttling on ${label:resource_name}
355
+ info: VM-level uncached bandwidth consumed percentage on Azure VM ${label:resource_name} \
356
+ in ${label:resource_group} (${label:region}). \
357
+ VM-level throttling affects all disks on the VM.
358
+ to: sysadmin
359
+
360
+ template: am_vm_uncached_iops_throttling
361
+ on: azure_monitor.virtual_machines.vm_uncached_throttling
362
+ class: Utilization
363
+ type: System
364
+component: Azure VM
365
+ lookup: average -5m unaligned of iops
366
+ units: percentage
367
+ every: 1m
368
+ warn: $this > (($status >= $WARNING) ? (80) : (90))
369
+ crit: $this > (($status == $CRITICAL) ? (90) : (95))
370
+ delay: down 5m multiplier 1.5 max 1h
371
+ summary: VM uncached IOPS throttling on ${label:resource_name}
372
+ info: VM-level uncached IOPS consumed percentage on Azure VM ${label:resource_name} \
373
+ in ${label:resource_group} (${label:region}). \
374
+ VM-level throttling affects all disks on the VM.
375
+ to: sysadmin
376
+
377
+# --- VM-Level Burst Credits ---
378
+# NaN guard: burst credits are only available on burstable VM sizes.
379
+
380
+ template: am_vm_cached_burst_bps_credits
381
+ on: azure_monitor.virtual_machines.vm_cached_burst_credits
382
+ class: Utilization
383
+ type: System
384
+component: Azure VM
385
+ lookup: average -5m unaligned of bandwidth
386
+ units: percentage
387
+ every: 1m
388
+ warn: $this != nan AND $this > (($status >= $WARNING) ? (80) : (90))
389
+ crit: $this != nan AND $this > (($status == $CRITICAL) ? (90) : (95))
390
+ delay: down 5m multiplier 1.5 max 1h
391
+ summary: VM cached burst bandwidth credits on ${label:resource_name}
392
+ info: VM-level cached burst bandwidth credits consumed on Azure VM ${label:resource_name} \
393
+ in ${label:resource_group} (${label:region}). \
394
+ When credits are exhausted, cached I/O throughput drops to baseline.
395
+ to: sysadmin
396
+
397
+ template: am_vm_cached_burst_io_credits
398
+ on: azure_monitor.virtual_machines.vm_cached_burst_credits
399
+ class: Utilization
400
+ type: System
401
+component: Azure VM
402
+ lookup: average -5m unaligned of io
403
+ units: percentage
404
+ every: 1m
405
+ warn: $this != nan AND $this > (($status >= $WARNING) ? (80) : (90))
406
+ crit: $this != nan AND $this > (($status == $CRITICAL) ? (90) : (95))
407
+ delay: down 5m multiplier 1.5 max 1h
408
+ summary: VM cached burst IO credits on ${label:resource_name}
409
+ info: VM-level cached burst IO credits consumed on Azure VM ${label:resource_name} \
410
+ in ${label:resource_group} (${label:region}). \
411
+ When credits are exhausted, cached IOPS drops to baseline.
412
+ to: sysadmin
413
+
414
+ template: am_vm_uncached_burst_bps_credits
415
+ on: azure_monitor.virtual_machines.vm_uncached_burst_credits
416
+ class: Utilization
417
+ type: System
418
+component: Azure VM
419
+ lookup: average -5m unaligned of bandwidth
420
+ units: percentage
421
+ every: 1m
422
+ warn: $this != nan AND $this > (($status >= $WARNING) ? (80) : (90))
423
+ crit: $this != nan AND $this > (($status == $CRITICAL) ? (90) : (95))
424
+ delay: down 5m multiplier 1.5 max 1h
425
+ summary: VM uncached burst bandwidth credits on ${label:resource_name}
426
+ info: VM-level uncached burst bandwidth credits consumed on Azure VM ${label:resource_name} \
427
+ in ${label:resource_group} (${label:region}). \
428
+ When credits are exhausted, uncached I/O throughput drops to baseline.
429
+ to: sysadmin
430
+
431
+ template: am_vm_uncached_burst_io_credits
432
+ on: azure_monitor.virtual_machines.vm_uncached_burst_credits
433
+ class: Utilization
434
+ type: System
435
+component: Azure VM
436
+ lookup: average -5m unaligned of io
437
+ units: percentage
438
+ every: 1m
439
+ warn: $this != nan AND $this > (($status >= $WARNING) ? (80) : (90))
440
+ crit: $this != nan AND $this > (($status == $CRITICAL) ? (90) : (95))
441
+ delay: down 5m multiplier 1.5 max 1h
442
+ summary: VM uncached burst IO credits on ${label:resource_name}
443
+ info: VM-level uncached burst IO credits consumed on Azure VM ${label:resource_name} \
444
+ in ${label:resource_group} (${label:region}). \
445
+ When credits are exhausted, uncached IOPS drops to baseline.
446
+ to: sysadmin
src/health/health.d/azure_monitor_vmss.conf
new
+453
@@ -0,0 +1,453 @@
1
+# you can disable an alarm notification by setting the 'to' line to: silent
2
+
3
+# --- CPU ---
4
+
5
+ template: am_vmss_cpu
6
+ on: azure_monitor.vmss.cpu
7
+ class: Utilization
8
+ type: System
9
+component: Azure VMSS
10
+ lookup: average -5m unaligned of average
11
+ units: percentage
12
+ every: 1m
13
+ warn: $this > (($status >= $WARNING) ? (85) : (90))
14
+ crit: $this > (($status == $CRITICAL) ? (90) : (95))
15
+ delay: down 5m multiplier 1.5 max 1h
16
+ summary: VMSS CPU utilization on ${label:resource_name}
17
+ info: Average CPU utilization of VMSS ${label:resource_name} \
18
+ in ${label:resource_group} (${label:region})
19
+ to: sysadmin
20
+
21
+ template: am_vmss_cpu_credits_remaining
22
+ on: azure_monitor.vmss.cpu_credits
23
+ class: Utilization
24
+ type: System
25
+component: Azure VMSS
26
+ lookup: average -5m unaligned of remaining
27
+ units: credits
28
+ every: 1m
29
+ warn: $this != nan AND $this < (($status >= $WARNING) ? (30) : (20))
30
+ crit: $this != nan AND $this < (($status == $CRITICAL) ? (20) : (10))
31
+ delay: down 5m multiplier 1.5 max 1h
32
+ summary: VMSS CPU credits low on ${label:resource_name}
33
+ info: Remaining CPU credits on burstable VMSS ${label:resource_name} \
34
+ in ${label:resource_group} (${label:region}). \
35
+ Running out of credits will cap performance to baseline.
36
+ to: sysadmin
37
+
38
+# --- Memory ---
39
+
40
+ template: am_vmss_memory_available
41
+ on: azure_monitor.vmss.memory_percentage
42
+ class: Utilization
43
+ type: System
44
+component: Azure VMSS
45
+ lookup: average -5m unaligned of available
46
+ units: percentage
47
+ every: 1m
48
+ warn: $this < (($status >= $WARNING) ? (15) : (10))
49
+ crit: $this < (($status == $CRITICAL) ? (10) : (5))
50
+ delay: down 5m multiplier 1.5 max 1h
51
+ summary: VMSS available memory low on ${label:resource_name}
52
+ info: Average available memory percentage on VMSS ${label:resource_name} \
53
+ in ${label:resource_group} (${label:region})
54
+ to: sysadmin
55
+
56
+# --- Availability ---
57
+
58
+ template: am_vmss_availability
59
+ on: azure_monitor.vmss.availability
60
+ class: Availability
61
+ type: System
62
+component: Azure VMSS
63
+ lookup: average -5m unaligned of average
64
+ units: state
65
+ every: 1m
66
+ crit: $this < 1
67
+ delay: down 5m multiplier 1.5 max 1h
68
+ summary: VMSS availability degraded on ${label:resource_name}
69
+ info: VM availability state on VMSS ${label:resource_name} \
70
+ in ${label:resource_group} (${label:region}). \
71
+ Values below 1 indicate instances are unavailable.
72
+ to: sysadmin
73
+
74
+# --- OS Disk ---
75
+
76
+ template: am_vmss_os_disk_latency
77
+ on: azure_monitor.vmss.os_disk_latency
78
+ class: Latency
79
+ type: System
80
+component: Azure VMSS
81
+ lookup: average -5m unaligned of average
82
+ units: milliseconds
83
+ every: 1m
84
+ warn: $this > (($status >= $WARNING) ? (30) : (50))
85
+ crit: $this > (($status == $CRITICAL) ? (50) : (100))
86
+ delay: down 5m multiplier 1.5 max 1h
87
+ summary: VMSS OS disk latency on ${label:resource_name}
88
+ info: Average OS disk latency on VMSS ${label:resource_name} \
89
+ in ${label:resource_group} (${label:region})
90
+ to: sysadmin
91
+
92
+ template: am_vmss_os_disk_queue_depth
93
+ on: azure_monitor.vmss.os_disk_queue_depth
94
+ class: Utilization
95
+ type: System
96
+component: Azure VMSS
97
+ lookup: average -5m unaligned of average
98
+ units: operations
99
+ every: 1m
100
+ warn: $this > (($status >= $WARNING) ? (16) : (32))
101
+ crit: $this > (($status == $CRITICAL) ? (32) : (64))
102
+ delay: down 5m multiplier 1.5 max 1h
103
+ summary: VMSS OS disk queue depth on ${label:resource_name}
104
+ info: Average OS disk queue depth on VMSS ${label:resource_name} \
105
+ in ${label:resource_group} (${label:region}). \
106
+ High queue depth indicates disk I/O saturation.
107
+ to: sysadmin
108
+
109
+ template: am_vmss_os_disk_bandwidth_throttling
110
+ on: azure_monitor.vmss.os_disk_throttling
111
+ class: Utilization
112
+ type: System
113
+component: Azure VMSS
114
+ lookup: average -5m unaligned of bandwidth
115
+ units: percentage
116
+ every: 1m
117
+ warn: $this > (($status >= $WARNING) ? (80) : (90))
118
+ crit: $this > (($status == $CRITICAL) ? (90) : (95))
119
+ delay: down 5m multiplier 1.5 max 1h
120
+ summary: VMSS OS disk bandwidth consumed on ${label:resource_name}
121
+ info: OS disk bandwidth consumed percentage on VMSS ${label:resource_name} \
122
+ in ${label:resource_group} (${label:region}). \
123
+ Approaching 100% means disk throughput is being throttled.
124
+ to: sysadmin
125
+
126
+ template: am_vmss_os_disk_iops_throttling
127
+ on: azure_monitor.vmss.os_disk_throttling
128
+ class: Utilization
129
+ type: System
130
+component: Azure VMSS
131
+ lookup: average -5m unaligned of iops
132
+ units: percentage
133
+ every: 1m
134
+ warn: $this > (($status >= $WARNING) ? (80) : (90))
135
+ crit: $this > (($status == $CRITICAL) ? (90) : (95))
136
+ delay: down 5m multiplier 1.5 max 1h
137
+ summary: VMSS OS disk IOPS consumed on ${label:resource_name}
138
+ info: OS disk IOPS consumed percentage on VMSS ${label:resource_name} \
139
+ in ${label:resource_group} (${label:region}). \
140
+ Approaching 100% means disk IOPS is being throttled.
141
+ to: sysadmin
142
+
143
+ template: am_vmss_os_disk_burst_bps_credits
144
+ on: azure_monitor.vmss.os_disk_burst_credits
145
+ class: Utilization
146
+ type: System
147
+component: Azure VMSS
148
+ lookup: average -5m unaligned of bandwidth
149
+ units: percentage
150
+ every: 1m
151
+ warn: $this != nan AND $this > (($status >= $WARNING) ? (80) : (90))
152
+ crit: $this != nan AND $this > (($status == $CRITICAL) ? (90) : (95))
153
+ delay: down 5m multiplier 1.5 max 1h
154
+ summary: VMSS OS disk burst BPS credits depleting on ${label:resource_name}
155
+ info: OS disk burst bandwidth credits consumed on VMSS ${label:resource_name} \
156
+ in ${label:resource_group} (${label:region}). \
157
+ Exhausting burst credits will throttle disk throughput to baseline.
158
+ to: sysadmin
159
+
160
+ template: am_vmss_os_disk_burst_io_credits
161
+ on: azure_monitor.vmss.os_disk_burst_credits
162
+ class: Utilization
163
+ type: System
164
+component: Azure VMSS
165
+ lookup: average -5m unaligned of io
166
+ units: percentage
167
+ every: 1m
168
+ warn: $this != nan AND $this > (($status >= $WARNING) ? (80) : (90))
169
+ crit: $this != nan AND $this > (($status == $CRITICAL) ? (90) : (95))
170
+ delay: down 5m multiplier 1.5 max 1h
171
+ summary: VMSS OS disk burst IO credits depleting on ${label:resource_name}
172
+ info: OS disk burst IO credits consumed on VMSS ${label:resource_name} \
173
+ in ${label:resource_group} (${label:region}). \
174
+ Exhausting burst credits will throttle disk IOPS to baseline.
175
+ to: sysadmin
176
+
177
+# --- Data Disk ---
178
+
179
+ template: am_vmss_data_disk_latency
180
+ on: azure_monitor.vmss.data_disk_latency
181
+ class: Latency
182
+ type: System
183
+component: Azure VMSS
184
+ lookup: average -5m unaligned of average
185
+ units: milliseconds
186
+ every: 1m
187
+ warn: $this > (($status >= $WARNING) ? (30) : (50))
188
+ crit: $this > (($status == $CRITICAL) ? (50) : (100))
189
+ delay: down 5m multiplier 1.5 max 1h
190
+ summary: VMSS data disk latency on ${label:resource_name}
191
+ info: Average data disk latency on VMSS ${label:resource_name} \
192
+ in ${label:resource_group} (${label:region})
193
+ to: sysadmin
194
+
195
+ template: am_vmss_data_disk_queue_depth
196
+ on: azure_monitor.vmss.data_disk_queue_depth
197
+ class: Utilization
198
+ type: System
199
+component: Azure VMSS
200
+ lookup: average -5m unaligned of average
201
+ units: operations
202
+ every: 1m
203
+ warn: $this > (($status >= $WARNING) ? (16) : (32))
204
+ crit: $this > (($status == $CRITICAL) ? (32) : (64))
205
+ delay: down 5m multiplier 1.5 max 1h
206
+ summary: VMSS data disk queue depth on ${label:resource_name}
207
+ info: Average data disk queue depth on VMSS ${label:resource_name} \
208
+ in ${label:resource_group} (${label:region}). \
209
+ High queue depth indicates disk I/O saturation.
210
+ to: sysadmin
211
+
212
+ template: am_vmss_data_disk_bandwidth_throttling
213
+ on: azure_monitor.vmss.data_disk_throttling
214
+ class: Utilization
215
+ type: System
216
+component: Azure VMSS
217
+ lookup: average -5m unaligned of bandwidth
218
+ units: percentage
219
+ every: 1m
220
+ warn: $this > (($status >= $WARNING) ? (80) : (90))
221
+ crit: $this > (($status == $CRITICAL) ? (90) : (95))
222
+ delay: down 5m multiplier 1.5 max 1h
223
+ summary: VMSS data disk bandwidth consumed on ${label:resource_name}
224
+ info: Data disk bandwidth consumed percentage on VMSS ${label:resource_name} \
225
+ in ${label:resource_group} (${label:region}). \
226
+ Approaching 100% means disk throughput is being throttled.
227
+ to: sysadmin
228
+
229
+ template: am_vmss_data_disk_iops_throttling
230
+ on: azure_monitor.vmss.data_disk_throttling
231
+ class: Utilization
232
+ type: System
233
+component: Azure VMSS
234
+ lookup: average -5m unaligned of iops
235
+ units: percentage
236
+ every: 1m
237
+ warn: $this > (($status >= $WARNING) ? (80) : (90))
238
+ crit: $this > (($status == $CRITICAL) ? (90) : (95))
239
+ delay: down 5m multiplier 1.5 max 1h
240
+ summary: VMSS data disk IOPS consumed on ${label:resource_name}
241
+ info: Data disk IOPS consumed percentage on VMSS ${label:resource_name} \
242
+ in ${label:resource_group} (${label:region}). \
243
+ Approaching 100% means disk IOPS is being throttled.
244
+ to: sysadmin
245
+
246
+ template: am_vmss_data_disk_burst_bps_credits
247
+ on: azure_monitor.vmss.data_disk_burst_credits
248
+ class: Utilization
249
+ type: System
250
+component: Azure VMSS
251
+ lookup: average -5m unaligned of bandwidth
252
+ units: percentage
253
+ every: 1m
254
+ warn: $this != nan AND $this > (($status >= $WARNING) ? (80) : (90))
255
+ crit: $this != nan AND $this > (($status == $CRITICAL) ? (90) : (95))
256
+ delay: down 5m multiplier 1.5 max 1h
257
+ summary: VMSS data disk burst BPS credits depleting on ${label:resource_name}
258
+ info: Data disk burst bandwidth credits consumed on VMSS ${label:resource_name} \
259
+ in ${label:resource_group} (${label:region}). \
260
+ Exhausting burst credits will throttle disk throughput to baseline.
261
+ to: sysadmin
262
+
263
+ template: am_vmss_data_disk_burst_io_credits
264
+ on: azure_monitor.vmss.data_disk_burst_credits
265
+ class: Utilization
266
+ type: System
267
+component: Azure VMSS
268
+ lookup: average -5m unaligned of io
269
+ units: percentage
270
+ every: 1m
271
+ warn: $this != nan AND $this > (($status >= $WARNING) ? (80) : (90))
272
+ crit: $this != nan AND $this > (($status == $CRITICAL) ? (90) : (95))
273
+ delay: down 5m multiplier 1.5 max 1h
274
+ summary: VMSS data disk burst IO credits depleting on ${label:resource_name}
275
+ info: Data disk burst IO credits consumed on VMSS ${label:resource_name} \
276
+ in ${label:resource_group} (${label:region}). \
277
+ Exhausting burst credits will throttle disk IOPS to baseline.
278
+ to: sysadmin
279
+
280
+# --- Temp Disk ---
281
+
282
+ template: am_vmss_temp_disk_latency
283
+ on: azure_monitor.vmss.temp_disk_latency
284
+ class: Latency
285
+ type: System
286
+component: Azure VMSS
287
+ lookup: average -5m unaligned of average
288
+ units: milliseconds
289
+ every: 1m
290
+ warn: $this > (($status >= $WARNING) ? (30) : (50))
291
+ crit: $this > (($status == $CRITICAL) ? (50) : (100))
292
+ delay: down 5m multiplier 1.5 max 1h
293
+ summary: VMSS temp disk latency on ${label:resource_name}
294
+ info: Average temp disk latency on VMSS ${label:resource_name} \
295
+ in ${label:resource_group} (${label:region})
296
+ to: sysadmin
297
+
298
+ template: am_vmss_temp_disk_queue_depth
299
+ on: azure_monitor.vmss.temp_disk_queue_depth
300
+ class: Utilization
301
+ type: System
302
+component: Azure VMSS
303
+ lookup: average -5m unaligned of average
304
+ units: operations
305
+ every: 1m
306
+ warn: $this > (($status >= $WARNING) ? (16) : (32))
307
+ crit: $this > (($status == $CRITICAL) ? (32) : (64))
308
+ delay: down 5m multiplier 1.5 max 1h
309
+ summary: VMSS temp disk queue depth on ${label:resource_name}
310
+ info: Average temp disk queue depth on VMSS ${label:resource_name} \
311
+ in ${label:resource_group} (${label:region}). \
312
+ High queue depth indicates disk I/O saturation.
313
+ to: sysadmin
314
+
315
+# --- VM-Level IO Throttling ---
316
+
317
+ template: am_vmss_vm_cached_bandwidth_throttling
318
+ on: azure_monitor.vmss.vm_cached_throttling
319
+ class: Utilization
320
+ type: System
321
+component: Azure VMSS
322
+ lookup: average -5m unaligned of bandwidth
323
+ units: percentage
324
+ every: 1m
325
+ warn: $this > (($status >= $WARNING) ? (80) : (90))
326
+ crit: $this > (($status == $CRITICAL) ? (90) : (95))
327
+ delay: down 5m multiplier 1.5 max 1h
328
+ summary: VMSS cached bandwidth consumed on ${label:resource_name}
329
+ info: VM-level cached bandwidth consumed percentage on VMSS ${label:resource_name} \
330
+ in ${label:resource_group} (${label:region}). \
331
+ Approaching 100% means the VM is being throttled at the host level.
332
+ to: sysadmin
333
+
334
+ template: am_vmss_vm_cached_iops_throttling
335
+ on: azure_monitor.vmss.vm_cached_throttling
336
+ class: Utilization
337
+ type: System
338
+component: Azure VMSS
339
+ lookup: average -5m unaligned of iops
340
+ units: percentage
341
+ every: 1m
342
+ warn: $this > (($status >= $WARNING) ? (80) : (90))
343
+ crit: $this > (($status == $CRITICAL) ? (90) : (95))
344
+ delay: down 5m multiplier 1.5 max 1h
345
+ summary: VMSS cached IOPS consumed on ${label:resource_name}
346
+ info: VM-level cached IOPS consumed percentage on VMSS ${label:resource_name} \
347
+ in ${label:resource_group} (${label:region}). \
348
+ Approaching 100% means the VM is being throttled at the host level.
349
+ to: sysadmin
350
+
351
+ template: am_vmss_vm_uncached_bandwidth_throttling
352
+ on: azure_monitor.vmss.vm_uncached_throttling
353
+ class: Utilization
354
+ type: System
355
+component: Azure VMSS
356
+ lookup: average -5m unaligned of bandwidth
357
+ units: percentage
358
+ every: 1m
359
+ warn: $this > (($status >= $WARNING) ? (80) : (90))
360
+ crit: $this > (($status == $CRITICAL) ? (90) : (95))
361
+ delay: down 5m multiplier 1.5 max 1h
362
+ summary: VMSS uncached bandwidth consumed on ${label:resource_name}
363
+ info: VM-level uncached bandwidth consumed percentage on VMSS ${label:resource_name} \
364
+ in ${label:resource_group} (${label:region}). \
365
+ Approaching 100% means the VM is being throttled at the host level.
366
+ to: sysadmin
367
+
368
+ template: am_vmss_vm_uncached_iops_throttling
369
+ on: azure_monitor.vmss.vm_uncached_throttling
370
+ class: Utilization
371
+ type: System
372
+component: Azure VMSS
373
+ lookup: average -5m unaligned of iops
374
+ units: percentage
375
+ every: 1m
376
+ warn: $this > (($status >= $WARNING) ? (80) : (90))
377
+ crit: $this > (($status == $CRITICAL) ? (90) : (95))
378
+ delay: down 5m multiplier 1.5 max 1h
379
+ summary: VMSS uncached IOPS consumed on ${label:resource_name}
380
+ info: VM-level uncached IOPS consumed percentage on VMSS ${label:resource_name} \
381
+ in ${label:resource_group} (${label:region}). \
382
+ Approaching 100% means the VM is being throttled at the host level.
383
+ to: sysadmin
384
+
385
+# --- VM-Level Burst Credits ---
386
+
387
+ template: am_vmss_vm_cached_burst_bps_credits
388
+ on: azure_monitor.vmss.vm_cached_burst_credits
389
+ class: Utilization
390
+ type: System
391
+component: Azure VMSS
392
+ lookup: average -5m unaligned of bandwidth
393
+ units: percentage
394
+ every: 1m
395
+ warn: $this != nan AND $this > (($status >= $WARNING) ? (80) : (90))
396
+ crit: $this != nan AND $this > (($status == $CRITICAL) ? (90) : (95))
397
+ delay: down 5m multiplier 1.5 max 1h
398
+ summary: VMSS cached burst BPS credits depleting on ${label:resource_name}
399
+ info: VM-level cached burst bandwidth credits consumed on VMSS ${label:resource_name} \
400
+ in ${label:resource_group} (${label:region}). \
401
+ Exhausting credits will throttle cached IO throughput to baseline.
402
+ to: sysadmin
403
+
404
+ template: am_vmss_vm_cached_burst_io_credits
405
+ on: azure_monitor.vmss.vm_cached_burst_credits
406
+ class: Utilization
407
+ type: System
408
+component: Azure VMSS
409
+ lookup: average -5m unaligned of io
410
+ units: percentage
411
+ every: 1m
412
+ warn: $this != nan AND $this > (($status >= $WARNING) ? (80) : (90))
413
+ crit: $this != nan AND $this > (($status == $CRITICAL) ? (90) : (95))
414
+ delay: down 5m multiplier 1.5 max 1h
415
+ summary: VMSS cached burst IO credits depleting on ${label:resource_name}
416
+ info: VM-level cached burst IO credits consumed on VMSS ${label:resource_name} \
417
+ in ${label:resource_group} (${label:region}). \
418
+ Exhausting credits will throttle cached IOPS to baseline.
419
+ to: sysadmin
420
+
421
+ template: am_vmss_vm_uncached_burst_bps_credits
422
+ on: azure_monitor.vmss.vm_uncached_burst_credits
423
+ class: Utilization
424
+ type: System
425
+component: Azure VMSS
426
+ lookup: average -5m unaligned of bandwidth
427
+ units: percentage
428
+ every: 1m
429
+ warn: $this != nan AND $this > (($status >= $WARNING) ? (80) : (90))
430
+ crit: $this != nan AND $this > (($status == $CRITICAL) ? (90) : (95))
431
+ delay: down 5m multiplier 1.5 max 1h
432
+ summary: VMSS uncached burst BPS credits depleting on ${label:resource_name}
433
+ info: VM-level uncached burst bandwidth credits consumed on VMSS ${label:resource_name} \
434
+ in ${label:resource_group} (${label:region}). \
435
+ Exhausting credits will throttle uncached IO throughput to baseline.
436
+ to: sysadmin
437
+
438
+ template: am_vmss_vm_uncached_burst_io_credits
439
+ on: azure_monitor.vmss.vm_uncached_burst_credits
440
+ class: Utilization
441
+ type: System
442
+component: Azure VMSS
443
+ lookup: average -5m unaligned of io
444
+ units: percentage
445
+ every: 1m
446
+ warn: $this != nan AND $this > (($status >= $WARNING) ? (80) : (90))
447
+ crit: $this != nan AND $this > (($status == $CRITICAL) ? (90) : (95))
448
+ delay: down 5m multiplier 1.5 max 1h
449
+ summary: VMSS uncached burst IO credits depleting on ${label:resource_name}
450
+ info: VM-level uncached burst IO credits consumed on VMSS ${label:resource_name} \
451
+ in ${label:resource_group} (${label:region}). \
452
+ Exhausting credits will throttle uncached IOPS to baseline.
453
+ to: sysadmin
src/health/health.d/azure_monitor_vpn_gateway.conf
new
+315
@@ -0,0 +1,315 @@
1
+# you can disable an alarm notification by setting the 'to' line to: silent
2
+
3
+# --- Errors: Tunnel Packet Drops ---
4
+
5
+ template: am_vpn_gateway_tunnel_packet_drops
6
+ on: azure_monitor.vpn_gateway.tunnel_packet_drops
7
+ class: Errors
8
+ type: Other
9
+component: Azure VPN Gateway
10
+ lookup: average -5m unaligned of egress ingress
11
+ units: packets/s
12
+ every: 1m
13
+ warn: $this > (($status >= $WARNING) ? (10) : (50))
14
+ crit: $this > (($status == $CRITICAL) ? (50) : (200))
15
+ delay: down 5m multiplier 1.5 max 1h
16
+ summary: VPN Gateway tunnel packet drops on ${label:resource_name}
17
+ info: Packets being dropped across VPN tunnels on ${label:resource_name} \
18
+ in ${label:resource_group} (${label:region}). \
19
+ Drops indicate tunnel instability or capacity issues
20
+ to: sysadmin
21
+
22
+# --- Errors: Tunnel TS Mismatch Drops ---
23
+
24
+ template: am_vpn_gateway_tunnel_ts_mismatch_drops
25
+ on: azure_monitor.vpn_gateway.tunnel_ts_mismatch_drops
26
+ class: Errors
27
+ type: Other
28
+component: Azure VPN Gateway
29
+ lookup: average -5m unaligned of egress ingress
30
+ units: packets/s
31
+ every: 1m
32
+ warn: $this > (($status >= $WARNING) ? (1) : (10))
33
+ crit: $this > (($status == $CRITICAL) ? (10) : (50))
34
+ delay: down 5m multiplier 1.5 max 1h
35
+ summary: VPN Gateway TS mismatch drops on ${label:resource_name}
36
+ info: Packets dropped due to traffic selector mismatch on ${label:resource_name} \
37
+ in ${label:resource_group} (${label:region}). \
38
+ This typically indicates IPsec policy misconfiguration
39
+ to: sysadmin
40
+
41
+# --- Errors: Tunnel NAT Packet Drops ---
42
+
43
+ template: am_vpn_gateway_tunnel_nat_packet_drops
44
+ on: azure_monitor.vpn_gateway.tunnel_nat_packet_drops
45
+ class: Errors
46
+ type: Other
47
+component: Azure VPN Gateway
48
+ lookup: average -5m unaligned of total
49
+ units: packets/s
50
+ every: 1m
51
+ warn: $this != nan AND $this > (($status >= $WARNING) ? (1) : (10))
52
+ crit: $this != nan AND $this > (($status == $CRITICAL) ? (10) : (50))
53
+ delay: down 5m multiplier 1.5 max 1h
54
+ summary: VPN Gateway NAT packet drops on ${label:resource_name}
55
+ info: NAT-related packet drops on VPN Gateway ${label:resource_name} \
56
+ in ${label:resource_group} (${label:region}). \
57
+ May indicate NAT rule misconfiguration or address exhaustion
58
+ to: sysadmin
59
+
60
+# --- Routing: BGP Peer Status ---
61
+# BGP is optional; metrics return NaN when BGP is not configured
62
+
63
+ template: am_vpn_gateway_bgp_peer_status
64
+ on: azure_monitor.vpn_gateway.bgp_peer_status
65
+ class: Availability
66
+ type: Other
67
+component: Azure VPN Gateway
68
+ lookup: average -5m unaligned of average
69
+ units: status
70
+ every: 1m
71
+ crit: $this != nan AND $this < 1
72
+ delay: down 5m multiplier 1.5 max 1h
73
+ summary: VPN Gateway BGP peer down on ${label:resource_name}
74
+ info: BGP peer status on VPN Gateway ${label:resource_name} \
75
+ in ${label:resource_group} (${label:region}). \
76
+ Value below 1 indicates a BGP peer session is down
77
+ to: sysadmin
78
+
79
+# --- Utilization: ExpressRoute Gateway CPU ---
80
+
81
+ template: am_vpn_gateway_er_gateway_cpu
82
+ on: azure_monitor.vpn_gateway.er_gateway_cpu
83
+ class: Utilization
84
+ type: Other
85
+component: Azure VPN Gateway
86
+ lookup: average -5m unaligned of average
87
+ units: percentage
88
+ every: 1m
89
+ warn: $this != nan AND $this > (($status >= $WARNING) ? (70) : (80))
90
+ crit: $this != nan AND $this > (($status == $CRITICAL) ? (80) : (90))
91
+ delay: down 5m multiplier 1.5 max 1h
92
+ summary: VPN GW ExpressRoute CPU on ${label:resource_name}
93
+ info: CPU utilization of ExpressRoute Gateway on ${label:resource_name} \
94
+ in ${label:resource_group} (${label:region}). \
95
+ High CPU may degrade forwarding performance
96
+ to: sysadmin
97
+
98
+# --- Workload: ExpressRoute Gateway Active Flows ---
99
+
100
+ template: am_vpn_gateway_er_gateway_active_flows
101
+ on: azure_monitor.vpn_gateway.er_gateway_active_flows
102
+ class: Workload
103
+ type: Other
104
+component: Azure VPN Gateway
105
+ lookup: average -5m unaligned of average
106
+ units: flows
107
+ every: 1m
108
+ warn: $this != nan AND $this > (($status >= $WARNING) ? (200000) : (250000))
109
+ delay: down 5m multiplier 1.5 max 1h
110
+ summary: VPN GW ExpressRoute active flows on ${label:resource_name}
111
+ info: Active flows on ExpressRoute Gateway ${label:resource_name} \
112
+ in ${label:resource_group} (${label:region}). \
113
+ High flow counts may indicate approaching scalability limits
114
+ to: sysadmin
115
+
116
+# --- Errors: ExpressRoute Gateway Route Changes ---
117
+
118
+ template: am_vpn_gateway_er_gateway_route_changes
119
+ on: azure_monitor.vpn_gateway.er_gateway_route_changes
120
+ class: Errors
121
+ type: Other
122
+component: Azure VPN Gateway
123
+ lookup: average -5m unaligned of total
124
+ units: changes/s
125
+ every: 1m
126
+ warn: $this != nan AND $this > (($status >= $WARNING) ? (5) : (10))
127
+ delay: down 5m multiplier 1.5 max 1h
128
+ summary: VPN GW ExpressRoute route churn on ${label:resource_name}
129
+ info: Rate of BGP route changes on ExpressRoute Gateway ${label:resource_name} \
130
+ in ${label:resource_group} (${label:region}). \
131
+ Frequent route changes may indicate BGP instability
132
+ to: sysadmin
133
+
134
+# --- Workload: ExpressRoute Routes Advertised ---
135
+
136
+ template: am_vpn_gateway_er_gateway_routes_advertised
137
+ on: azure_monitor.vpn_gateway.er_gateway_routes_advertised
138
+ class: Workload
139
+ type: Other
140
+component: Azure VPN Gateway
141
+ lookup: average -5m unaligned of maximum
142
+ units: routes
143
+ every: 1m
144
+ warn: $this != nan AND $this > (($status >= $WARNING) ? (900) : (950))
145
+ delay: down 5m multiplier 1.5 max 1h
146
+ summary: VPN GW ExpressRoute routes advertised on ${label:resource_name}
147
+ info: Routes advertised to peer by ExpressRoute Gateway on ${label:resource_name} \
148
+ in ${label:resource_group} (${label:region}). \
149
+ Azure limits advertised routes to 1000 per peering
150
+ to: sysadmin
151
+
152
+# --- Workload: ExpressRoute Routes Learned ---
153
+
154
+ template: am_vpn_gateway_er_gateway_routes_learned
155
+ on: azure_monitor.vpn_gateway.er_gateway_routes_learned
156
+ class: Workload
157
+ type: Other
158
+component: Azure VPN Gateway
159
+ lookup: average -5m unaligned of maximum
160
+ units: routes
161
+ every: 1m
162
+ warn: $this != nan AND $this > (($status >= $WARNING) ? (3800) : (3900))
163
+ delay: down 5m multiplier 1.5 max 1h
164
+ summary: VPN GW ExpressRoute routes learned on ${label:resource_name}
165
+ info: Routes learned from peer by ExpressRoute Gateway on ${label:resource_name} \
166
+ in ${label:resource_group} (${label:region}). \
167
+ Default Azure limit is 4000 routes per peering (varies by gateway SKU)
168
+ to: sysadmin
169
+
170
+# --- Utilization: Scalable ExpressRoute Gateway CPU ---
171
+
172
+ template: am_vpn_gateway_scalable_er_cpu
173
+ on: azure_monitor.vpn_gateway.scalable_er_cpu
174
+ class: Utilization
175
+ type: Other
176
+component: Azure VPN Gateway
177
+ lookup: average -5m unaligned of average
178
+ units: percentage
179
+ every: 1m
180
+ warn: $this != nan AND $this > (($status >= $WARNING) ? (70) : (80))
181
+ crit: $this != nan AND $this > (($status == $CRITICAL) ? (80) : (90))
182
+ delay: down 5m multiplier 1.5 max 1h
183
+ summary: VPN GW Scalable ER CPU on ${label:resource_name}
184
+ info: CPU utilization of Scalable ExpressRoute Gateway on ${label:resource_name} \
185
+ in ${label:resource_group} (${label:region}). \
186
+ High CPU may degrade forwarding performance
187
+ to: sysadmin
188
+
189
+# --- Workload: Scalable ExpressRoute Gateway Active Flows ---
190
+
191
+ template: am_vpn_gateway_scalable_er_active_flows
192
+ on: azure_monitor.vpn_gateway.scalable_er_active_flows
193
+ class: Workload
194
+ type: Other
195
+component: Azure VPN Gateway
196
+ lookup: average -5m unaligned of average
197
+ units: flows
198
+ every: 1m
199
+ warn: $this != nan AND $this > (($status >= $WARNING) ? (200000) : (250000))
200
+ delay: down 5m multiplier 1.5 max 1h
201
+ summary: VPN GW Scalable ER active flows on ${label:resource_name}
202
+ info: Active flows on Scalable ExpressRoute Gateway ${label:resource_name} \
203
+ in ${label:resource_group} (${label:region}). \
204
+ High flow counts may indicate approaching scalability limits
205
+ to: sysadmin
206
+
207
+# --- Errors: Scalable ExpressRoute Gateway Route Changes ---
208
+
209
+ template: am_vpn_gateway_scalable_er_route_changes
210
+ on: azure_monitor.vpn_gateway.scalable_er_route_changes
211
+ class: Errors
212
+ type: Other
213
+component: Azure VPN Gateway
214
+ lookup: average -5m unaligned of total
215
+ units: changes/s
216
+ every: 1m
217
+ warn: $this != nan AND $this > (($status >= $WARNING) ? (5) : (10))
218
+ delay: down 5m multiplier 1.5 max 1h
219
+ summary: VPN GW Scalable ER route churn on ${label:resource_name}
220
+ info: Rate of BGP route changes on Scalable ExpressRoute Gateway ${label:resource_name} \
221
+ in ${label:resource_group} (${label:region}). \
222
+ Frequent route changes may indicate BGP instability
223
+ to: sysadmin
224
+
225
+# --- Workload: Scalable ExpressRoute Routes Advertised ---
226
+
227
+ template: am_vpn_gateway_scalable_er_routes_advertised
228
+ on: azure_monitor.vpn_gateway.scalable_er_routes_advertised
229
+ class: Workload
230
+ type: Other
231
+component: Azure VPN Gateway
232
+ lookup: average -5m unaligned of maximum
233
+ units: routes
234
+ every: 1m
235
+ warn: $this != nan AND $this > (($status >= $WARNING) ? (900) : (950))
236
+ delay: down 5m multiplier 1.5 max 1h
237
+ summary: VPN GW Scalable ER routes advertised on ${label:resource_name}
238
+ info: Routes advertised to peer by Scalable ExpressRoute Gateway on ${label:resource_name} \
239
+ in ${label:resource_group} (${label:region}). \
240
+ Azure limits advertised routes to 1000 per peering
241
+ to: sysadmin
242
+
243
+# --- Workload: Scalable ExpressRoute Routes Learned ---
244
+
245
+ template: am_vpn_gateway_scalable_er_routes_learned
246
+ on: azure_monitor.vpn_gateway.scalable_er_routes_learned
247
+ class: Workload
248
+ type: Other
249
+component: Azure VPN Gateway
250
+ lookup: average -5m unaligned of maximum
251
+ units: routes
252
+ every: 1m
253
+ warn: $this != nan AND $this > (($status >= $WARNING) ? (3800) : (3900))
254
+ delay: down 5m multiplier 1.5 max 1h
255
+ summary: VPN GW Scalable ER routes learned on ${label:resource_name}
256
+ info: Routes learned from peer by Scalable ExpressRoute Gateway on ${label:resource_name} \
257
+ in ${label:resource_group} (${label:region}). \
258
+ Default Azure limit is 4000 routes per peering (varies by gateway SKU)
259
+ to: sysadmin
260
+
261
+# --- Workload: ExpressRoute Gateway Bandwidth (informational) ---
262
+
263
+ template: am_vpn_gateway_er_gateway_bandwidth
264
+ on: azure_monitor.vpn_gateway.er_gateway_bandwidth
265
+ class: Workload
266
+ type: Other
267
+component: Azure VPN Gateway
268
+ lookup: average -5m unaligned of average
269
+ units: bits/s
270
+ every: 1m
271
+ info: Average throughput of ExpressRoute Gateway on ${label:resource_name} \
272
+ in ${label:resource_group} (${label:region})
273
+ to: silent
274
+
275
+# --- Workload: Scalable ExpressRoute Gateway Bandwidth (informational) ---
276
+
277
+ template: am_vpn_gateway_scalable_er_bandwidth
278
+ on: azure_monitor.vpn_gateway.scalable_er_bandwidth
279
+ class: Workload
280
+ type: Other
281
+component: Azure VPN Gateway
282
+ lookup: average -5m unaligned of average
283
+ units: bits/s
284
+ every: 1m
285
+ info: Average throughput of Scalable ExpressRoute Gateway on ${label:resource_name} \
286
+ in ${label:resource_group} (${label:region})
287
+ to: silent
288
+
289
+# --- Workload: S2S Bandwidth (informational) ---
290
+
291
+ template: am_vpn_gateway_s2s_bandwidth
292
+ on: azure_monitor.vpn_gateway.s2s_bandwidth
293
+ class: Workload
294
+ type: Other
295
+component: Azure VPN Gateway
296
+ lookup: average -5m unaligned of average
297
+ units: bytes/s
298
+ every: 1m
299
+ info: Average site-to-site bandwidth on VPN Gateway ${label:resource_name} \
300
+ in ${label:resource_group} (${label:region})
301
+ to: silent
302
+
303
+# --- Workload: Tunnel Bandwidth (informational) ---
304
+
305
+ template: am_vpn_gateway_tunnel_bandwidth
306
+ on: azure_monitor.vpn_gateway.tunnel_bandwidth
307
+ class: Workload
308
+ type: Other
309
+component: Azure VPN Gateway
310
+ lookup: average -5m unaligned of average
311
+ units: bytes/s
312
+ every: 1m
313
+ info: Average tunnel bandwidth on VPN Gateway ${label:resource_name} \
314
+ in ${label:resource_group} (${label:region})
315
+ to: silent