2
votes

I am trying to build an ALERT for a condition where in a timespan of 15mins if the number of FailedRequests were Greater than 99% of the requests received I want to raise the Alert. I have written a KQL Query but unfortunately it just fires of even without real issues happening i.e. without really getting the condition of greater than 99%. following is the query and I am sure I am making some silly mistake in it any help?

Any help in fixing above query so it really gives results only when it is crictical i.e. when all of the requests received are failing.

requests 
| where cloud_RoleName == 'ABCDEF_cloudRName' and resultCode != '404' 
| summarize FailedPercent=((countif(success == false))/count() by timestamp, cloud_RoleName, appName)*100 
| where FailedPercent > 99 
| project RelatedCI='XYZZZ',AlarmTime=timestamp,Category="Cloud-Azure-Monitor",SubCategory="Application",Object=appName ,"Value of Metric","Percentage Failed Requests"," is ", FailedPercent
1

1 Answers

3
votes

Here is an similar issue for sending alert when failed percentage is greater than xx%.

I simply write a query, please feel free to modify it if it does not meet your need:

requests
| where resultCode != "404" and success == "False" 
| summarize exceptionsCount =count()
| extend a = "a"
| join
(
    requests
    | where resultCode != "404" 
    | summarize requestsCount =count()
    | extend a = "a"
)
on a
| project isFail = 1.0 * exceptionsCount / requestsCount > 0.99 //check if the failed percentage is greater than 99%.
| project rr=iff(isFail, "Fail","Pass" ) 
| where rr=="Fail"

After the query code is ready, you can create a query-based alert following the steps in the issue above.