none
Heartbeat Alert

    Question

  • I'm trying to create an alert that would activate upon the detection of a failed heartbeat. Working on tracking about 300 servers. I created a group and tried running the following but am only receiving the count. 

    Heartbeat
    | where Computer in (ComputerGroup)
    | summarize LastCall = max(TimeGenerated) by Computer
    | where LastCall < ago(1h)
    | project Computer , LastCall
    | count

    This only generated the result of a count of 1. I need this to display the affected computer when it detects the heartbeat is missing for over 5 minutes.

    I attempted the same thing by generating the alert through the metrics window. I setup the metric with a condition of Less than a Maximum of 1. However, when I test the functionality by shutting down the server no alert is generated. I confirmed through log analytics that the affected server does populate in the search results, however the heartbeat result does not drop.

    Any suggestions?

    Wednesday, February 6, 2019 6:29 PM