| 1 | # you can disable an alarm notification by setting the 'to' line to: silent |
| 2 | |
| 3 | # Health check status (0-100%). Low is bad. |
| 4 | # AMBA: HealthCheckStatus < 100 is Sev1 (critical) |
| 5 | |
| 6 | template: am_app_service_health_check |
| 7 | on: azure_monitor.app_service.health |
| 8 | class: Availability |
| 9 | type: Web Server |
| 10 | component: App Service |
| 11 | lookup: average -5m unaligned of average |
| 12 | units: percentage |
| 13 | every: 1m |
| 14 | warn: $this < (($status >= $WARNING) ? (100) : (80)) |
| 15 | crit: $this < (($status == $CRITICAL) ? (80) : (50)) |
| 16 | delay: down 5m multiplier 1.5 max 1h |
| 17 | summary: App Service health on ${label:resource_name} |
| 18 | info: Health check status of App Service ${label:resource_name} \ |
| 19 | in ${label:resource_group} (${label:region}) |
| 20 | to: sysadmin |
| 21 | |
| 22 | # HTTP 5xx server errors (rate). |
| 23 | # AMBA: Http5xx > 10 is Sev1 |
| 24 | |
| 25 | template: am_app_service_http_5xx_rate |
| 26 | on: azure_monitor.app_service.http_status |
| 27 | class: Errors |
| 28 | type: Web Server |
| 29 | component: App Service |
| 30 | lookup: average -5m unaligned of 5xx |
| 31 | units: responses/s |
| 32 | every: 1m |
| 33 | warn: $this > (($status >= $WARNING) ? (5) : (10)) |
| 34 | crit: $this > (($status == $CRITICAL) ? (10) : (25)) |
| 35 | delay: down 5m multiplier 1.5 max 1h |
| 36 | summary: App Service 5xx errors on ${label:resource_name} |
| 37 | info: HTTP 5xx server error rate on App Service ${label:resource_name} \ |
| 38 | in ${label:resource_group} (${label:region}) |
| 39 | to: sysadmin |
| 40 | |
| 41 | # HTTP response time (seconds). High is bad. |
| 42 | # AMBA: HttpResponseTime average > 5s is Sev2 |
| 43 | |
| 44 | template: am_app_service_response_time |
| 45 | on: azure_monitor.app_service.response_time |
| 46 | class: Latency |
| 47 | type: Web Server |
| 48 | component: App Service |
| 49 | lookup: average -5m unaligned of average |
| 50 | units: seconds |
| 51 | every: 1m |
| 52 | warn: $this > (($status >= $WARNING) ? (3) : (5)) |
| 53 | crit: $this > (($status == $CRITICAL) ? (5) : (10)) |
| 54 | delay: down 5m multiplier 1.5 max 1h |
| 55 | summary: App Service response time on ${label:resource_name} |
| 56 | info: Average HTTP response time of App Service ${label:resource_name} \ |
| 57 | in ${label:resource_group} (${label:region}) |
| 58 | to: sysadmin |
| 59 | |
| 60 | # CPU utilization (percentage). High is bad. |
| 61 | # AMBA: CpuPercentage > 90 is Sev2 |
| 62 | |
| 63 | template: am_app_service_cpu_utilization |
| 64 | on: azure_monitor.app_service.cpu |
| 65 | class: Utilization |
| 66 | type: Web Server |
| 67 | component: App Service |
| 68 | lookup: average -5m unaligned of average |
| 69 | units: percentage |
| 70 | every: 1m |
| 71 | warn: $this > (($status >= $WARNING) ? (75) : (85)) |
| 72 | crit: $this > (($status == $CRITICAL) ? (85) : (95)) |
| 73 | delay: down 5m multiplier 1.5 max 1h |
| 74 | summary: App Service CPU on ${label:resource_name} |
| 75 | info: CPU utilization of App Service ${label:resource_name} \ |
| 76 | in ${label:resource_group} (${label:region}) |
| 77 | to: sysadmin |
| 78 | |
| 79 | # Request queue depth (absolute). High means saturation. |
| 80 | # AMBA: RequestsInApplicationQueue > 10 is Sev2 |
| 81 | |
| 82 | template: am_app_service_request_queue |
| 83 | on: azure_monitor.app_service.request_queue |
| 84 | class: Workload |
| 85 | type: Web Server |
| 86 | component: App Service |
| 87 | lookup: average -5m unaligned of queued |
| 88 | units: requests |
| 89 | every: 1m |
| 90 | warn: $this > (($status >= $WARNING) ? (10) : (25)) |
| 91 | crit: $this > (($status == $CRITICAL) ? (25) : (100)) |
| 92 | delay: down 5m multiplier 1.5 max 1h |
| 93 | summary: App Service request queue on ${label:resource_name} |
| 94 | info: Requests queued in application queue of App Service ${label:resource_name} \ |
| 95 | in ${label:resource_group} (${label:region}) |
| 96 | to: sysadmin |
| 97 | |
| 98 | # HTTP 4xx client errors (rate). Sustained high rates may indicate |
| 99 | # broken clients, missing endpoints, or auth problems. |
| 100 | |
| 101 | template: am_app_service_http_4xx_rate |
| 102 | on: azure_monitor.app_service.http_status |
| 103 | class: Errors |
| 104 | type: Web Server |
| 105 | component: App Service |
| 106 | lookup: average -5m unaligned of 4xx |
| 107 | units: responses/s |
| 108 | every: 1m |
| 109 | warn: $this > (($status >= $WARNING) ? (50) : (100)) |
| 110 | delay: down 5m multiplier 1.5 max 1h |
| 111 | summary: App Service 4xx errors on ${label:resource_name} |
| 112 | info: HTTP 4xx client error rate on App Service ${label:resource_name} \ |
| 113 | in ${label:resource_group} (${label:region}) |
| 114 | to: sysadmin |
| 115 | |
| 116 | # HTTP 403 Forbidden spikes — may indicate WAF blocks or permission issues |
| 117 | |
| 118 | template: am_app_service_http_403_rate |
| 119 | on: azure_monitor.app_service.http_error_detail |
| 120 | class: Errors |
| 121 | type: Web Server |
| 122 | component: App Service |
| 123 | lookup: average -5m unaligned of 403_forbidden |
| 124 | units: responses/s |
| 125 | every: 1m |
| 126 | warn: $this > (($status >= $WARNING) ? (10) : (25)) |
| 127 | delay: down 5m multiplier 1.5 max 1h |
| 128 | summary: App Service 403 forbidden on ${label:resource_name} |
| 129 | info: HTTP 403 Forbidden response rate on App Service ${label:resource_name} \ |
| 130 | in ${label:resource_group} (${label:region}) |
| 131 | to: sysadmin |
| 132 | |
| 133 | # HTTP 401 Unauthorized spikes — may indicate auth service failures |
| 134 | |
| 135 | template: am_app_service_http_401_rate |
| 136 | on: azure_monitor.app_service.http_error_detail |
| 137 | class: Errors |
| 138 | type: Web Server |
| 139 | component: App Service |
| 140 | lookup: average -5m unaligned of 401_unauthorized |
| 141 | units: responses/s |
| 142 | every: 1m |
| 143 | warn: $this > (($status >= $WARNING) ? (10) : (25)) |
| 144 | delay: down 5m multiplier 1.5 max 1h |
| 145 | summary: App Service 401 unauthorized on ${label:resource_name} |
| 146 | info: HTTP 401 Unauthorized response rate on App Service ${label:resource_name} \ |
| 147 | in ${label:resource_group} (${label:region}) |
| 148 | to: sysadmin |