Why is this Alert not working as expected

 Hello Mark Pearson,

Follow below steps and let us know if it works

1. Validate Query in Logs Run the query in Log Analytics and confirm it returns rows for the target VM.
2. Adjust Threshold or Logic Lower threshold or remove the uptime filter temporarily to test.
3. Check Data Ingestion  Verify that the VM is sending heartbeat data to the workspace.
4. Expand Scope Remove where Computer == "<server-name>" for testing.
5. Increase Evaluation Period Initially try with lower evaluation period and see if it works later consider a longer evaluation window (e.g., 30 minutes). Check and let us know if you have further questions?

1. Validate Query in Logs Run the query in Log Analytics and confirm it returns rows for the target VM.

I am seeing results come back when ran against the logs.

1. Adjust Threshold or Logic Lower threshold or remove the uptime filter temporarily to test.

I set both the Alert Logic frequency of evaluation and Aggregation Granularity to 5 mins, still alert not firing (even after changing "let threshold to = 15".

1. Check Data Ingestion  Verify that the VM is sending heartbeat data to the workspace.

Heartbeat data is coming back.

1. Expand Scope Remove where Computer == "<server-name>" for testing.

Removed the scope, currently testing this now.

1. Increase Evaluation Period Initially try with lower evaluation period and see if it works later consider a longer evaluation window (e.g., 30 minutes). Check and let us know if you have further questions?

Adjusted the Evaluation period to 15 mins, still no alert.

Hello Mark Pearson,

Kindly try below options and let us know if it works?

Option 1 (Using Total Rows):

let thresholdMinutes = 180;
let lookback = 1d;
Heartbeat
| where TimeGenerated > ago(lookback)
| summarize FirstSeen = min(TimeGenerated) by Computer
| extend UptimeMinutes = datetime_diff('minute', now(), FirstSeen)
| where UptimeMinutes >= thresholdMinutes
| project Computer, FirstSeen, UptimeMinutes

 Alert configuration (Condition tab):

• Signal type: Custom log search → Aggregated logs
• Measurement mode: Table Rows
• Alert logic: Operator Greater than or equal to, Threshold 1
• Frequency of evaluation: 15 minutes
• Split by dimensions: optional (if you want one alert per VM, split on Computer)

 Option 2 (Metric Measurement):

let thresholdMinutes = 180;
let lookback = 1d; // make sure this covers the possible uptime periods
Heartbeat
| where TimeGenerated > ago(lookback)
| summarize FirstSeen = min(TimeGenerated) by Computer
| extend UptimeMinutes = datetime_diff('minute', now(), FirstSeen)
| project TimeGenerated = now(), Computer, UptimeMinutes
// Create a time series so Metric measurement can aggregate over the evaluation window
| summarize UptimeMinutes = max(UptimeMinutes) by Computer, bin(TimeGenerated, 15m)

Alert configuration (Condition tab):

• Signal type: Custom log search → Aggregated logs
• Measure: UptimeMinutes
• Aggregation type: Max (or Average; Max is fine since we project one value)
• Aggregation granularity: 15 minutes (matches the bin in the query)
• Split by dimensions: Computer = your VM name (you can leave * to monitor all, but to replicate the single-VM case, set the exact name)
• Alert logic: Operator Greater than or equal to, Threshold 180
• Frequency of evaluation: 15 minutes
• Evaluation time range: 15 minutes–1 hour (any window that includes the bin will work; 15m keeps it tight)

Option 1 was the solution that worked for me here.

Thanks for all of your help on this, greatfully appreciated.

Hello Mark Pearson,

Please do not forget to "Accept Answer" and upvote as this may help other community members to refer the info if facing a similar issue. Your contribution to the Microsoft Q&A community is highly appreciated.

Hi Siva,

It appears that this is still not resolved.

It looks like it's taking the firstseen value as the start time, then calculating that time until now as the total uptimeminutes value, as opposed to tracking it's actual total uptime....

So even if i set the lookback value to 6 hours, because it first turned on at 8am, it's firing the alert, even though it's total uptime is only around 1 hour (Accross various start-stops)

Hello Mark Pearson,

Kindly check below answer and see if it helps.

• Signal type: Custom log search → Aggregated logs
• Measurement mode: Table Rows
• Alert logic: Operator Greater than or equal to, Threshold 1
• Frequency of evaluation: 15 minutes

Heartbeat
| where TimeGenerated > ago(4h)            // Look back 4 hours
| where Computer == "<VMName>"             // Replace with your VM name or use a dynamic parameter
| summarize LastHeartbeat = max(TimeGenerated) by Computer
| where LastHeartbeat < ago(3h)            // No heartbeat for 3 hours

Hello Mark Pearson,

Kindly please let us know did the response provided by Siva addressed your issue do let me know if you have any questions on it.

Appologies, I have been away from work on holiday, and also from illness, will try these out soon and report back by early next week.