services/OperationalInsights/workspaces/alerts.yaml

- name: Activity Log LA Workspace Delete
  description: Activity Log LA Workspace Delete
  type: ActivityLog
  verified: false
  visible: true
  tags:
  - alz
  properties:
    category: Administrative
    operationName: Microsoft.OperationalInsights/workspaces/delete
    status:
    - succeeded
  references:
  - name: Activity Log Service Notifications
    url: https://learn.microsoft.com/azure/service-health/alerts-activity-log-service-notifications-portal
  - name: Best practices for setting up service health alerts
    url: https://www.microsoft.com/videoplayer/embed/RE2OtUa
  deployments:
  - name: Deploy Activity Log LA Workspace Delete Alert
    template: Deploy-ActivityLog-LAWorkspace-Del.json
    type: Policy
    tags:
    - alz
    properties:
      scope: Subscription
      policyScope: managementGroup
      documented: false
      alertName: ActivityLAWorkspaceDelete
      enabled: true
  guid: 63cdfaa7-f029-4c4b-8f34-fff71fe401af
- name: Activity Log LA Workspace Regenerate Key
  description: Activity Log Alert for LA Workspace Regenerate Key
  type: ActivityLog
  verified: false
  visible: true
  tags:
  - alz
  properties:
    category: Administrative
    operationName: Microsoft.OperationalInsights/workspaces/regeneratesharedkey/action
    status:
    - succeeded
  references:
  - name: Activity Log Service Notifications
    url: https://learn.microsoft.com/azure/service-health/alerts-activity-log-service-notifications-portal
  - name: Best practices for setting up service health alerts
    url: https://www.microsoft.com/videoplayer/embed/RE2OtUa
  deployments:
  - name: Deploy Activity Log LA Workspace Regenerate Key Alert
    template: Deploy-ActivityLog-LAWorkspace-KeyRegen.json
    type: Policy
    tags:
    - alz
    properties:
      scope: Subscription
      policyScope: managementGroup
      documented: false
      alertName: ActivityLAWorkspaceRegenKey
      enabled: true
  guid: 04a98577-458a-4a5d-88b2-22b2d140f9f3
- name: Average_% Free Space
  description: 'Average_% Free Space. Supported for: Linux, Windows. Part of [metric
    alerts for logs feature](https://aka.ms/am-log-to-metric).'
  type: Metric
  verified: false
  visible: true
  tags:
  - auto-generated
  - agc-11826
  properties:
    metricName: Average_% Free Space
    metricNamespace: Microsoft.OperationalInsights/workspaces
    severity: 3
    windowSize: PT5M
    evaluationFrequency: PT1M
    timeAggregation: Average
    operator: LessThan
    criterionType: StaticThresholdCriterion
    dimensions:
    - operator: include
      name: computer
      values:
      - '*'
    threshold: 10.0
    enabled: true
  guid: db621663-ec0a-4fa3-82a7-b6b110726568
- name: Average_% Processor Time
  description: 'Average_% Processor Time. Supported for: Linux, Windows. Part of [metric
    alerts for logs feature](https://aka.ms/am-log-to-metric).'
  type: Metric
  verified: false
  visible: true
  tags:
  - auto-generated
  - agc-6523
  properties:
    metricName: Average_% Processor Time
    metricNamespace: Microsoft.OperationalInsights/workspaces
    severity: 3
    windowSize: PT5M
    evaluationFrequency: PT1M
    timeAggregation: Average
    operator: GreaterThan
    criterionType: StaticThresholdCriterion
    dimensions:
    - operator: include
      name: computer
      values:
      - '*'
    threshold: 90.0
    enabled: true
  guid: 0c416177-e7ce-40d5-8f15-8566b3d7c03c
- name: Average_% Committed Bytes In Use
  description: 'Average_% Committed Bytes In Use. Supported for: Windows. Part of
    [metric alerts for logs feature](https://aka.ms/am-log-to-metric).'
  type: Metric
  verified: false
  visible: true
  tags:
  - auto-generated
  - agc-4970
  properties:
    metricName: Average_% Committed Bytes In Use
    metricNamespace: Microsoft.OperationalInsights/workspaces
    severity: 3
    windowSize: PT5M
    evaluationFrequency: PT1M
    timeAggregation: Average
    operator: GreaterThan
    criterionType: StaticThresholdCriterion
    dimensions:
    - operator: include
      name: computer
      values:
      - '*'
    threshold: 90.0
    enabled: true
  guid: a70e406c-a0ae-4e0f-99cd-8b0836812c59
- name: Average_% Used Memory
  description: 'Average_% Used Memory. Supported for: Linux. Part of [metric alerts
    for logs feature](https://aka.ms/am-log-to-metric).'
  type: Metric
  verified: false
  visible: true
  tags:
  - auto-generated
  - agc-4355
  properties:
    metricName: Average_% Used Memory
    metricNamespace: Microsoft.OperationalInsights/workspaces
    severity: 3
    windowSize: PT5M
    evaluationFrequency: PT1M
    timeAggregation: Average
    operator: GreaterThan
    criterionType: StaticThresholdCriterion
    dimensions:
    - operator: include
      name: computer
      values:
      - '*'
    threshold: 90.0
    enabled: true
  guid: 171e5b5c-78cc-44a1-b7fb-7d750914ed5e
- name: Heartbeat
  description: 'Heartbeat. Supported for: Linux, Windows. Part of [metric alerts for
    logs feature](https://aka.ms/am-log-to-metric).'
  type: Metric
  verified: false
  visible: true
  tags:
  - auto-generated
  - agc-4322
  properties:
    metricName: Heartbeat
    metricNamespace: Microsoft.OperationalInsights/workspaces
    severity: 1
    windowSize: PT5M
    evaluationFrequency: PT1M
    timeAggregation: Total
    operator: LessThanOrEqual
    criterionType: StaticThresholdCriterion
    dimensions:
    - operator: include
      name: computer
      values:
      - '*'
    threshold: 0.0
    enabled: true
  guid: 83703f70-9ea8-44aa-b88a-a8e56eb42858
- name: Average_% Used Space
  description: 'Average_% Used Space. Supported for: Linux. Part of [metric alerts
    for logs feature](https://aka.ms/am-log-to-metric).'
  type: Metric
  verified: false
  visible: true
  tags:
  - auto-generated
  - agc-3695
  properties:
    metricName: Average_% Used Space
    metricNamespace: Microsoft.OperationalInsights/workspaces
    severity: 3
    windowSize: PT5M
    evaluationFrequency: PT1M
    timeAggregation: Average
    operator: GreaterThan
    criterionType: StaticThresholdCriterion
    dimensions:
    - operator: include
      name: computer
      values:
      - '*'
    threshold: 95.0
    enabled: true
  guid: 49ba0df7-18bf-4b3e-9d0f-f8c055762fd5
- name: Average_Available MBytes
  description: 'Average_Available MBytes. Supported for: Windows. Part of [metric
    alerts for logs feature](https://aka.ms/am-log-to-metric).'
  type: Metric
  verified: false
  visible: true
  tags:
  - auto-generated
  - agc-2430
  properties:
    metricName: Average_Available MBytes
    metricNamespace: Microsoft.OperationalInsights/workspaces
    severity: 3
    windowSize: PT5M
    evaluationFrequency: PT1M
    timeAggregation: Average
    operator: LessThan
    criterionType: StaticThresholdCriterion
    dimensions:
    - operator: include
      name: computer
      values:
      - '*'
    threshold: 512.0
    enabled: true
  guid: b0c5e86f-eb2d-41ea-a4a0-9819ad841c70
- name: Average_Disk Transfers/sec
  description: 'Average_Disk Transfers/sec. Supported for: Linux, Windows. Part of
    [metric alerts for logs feature](https://aka.ms/am-log-to-metric).'
  type: Metric
  verified: false
  visible: true
  tags:
  - auto-generated
  - agc-1799
  properties:
    metricName: Average_Disk Transfers/sec
    metricNamespace: Microsoft.OperationalInsights/workspaces
    severity: 3
    windowSize: PT5M
    evaluationFrequency: PT1M
    timeAggregation: Average
    operator: GreaterThan
    criterionType: StaticThresholdCriterion
    dimensions:
    - operator: include
      name: computer
      values:
      - '*'
    threshold: 100.0
    enabled: true
  guid: 30b462dd-d026-4122-9bcf-3a114517e04c
- name: Average_Available MBytes Memory
  description: 'Average_Available MBytes Memory. Supported for: Linux. Part of [metric
    alerts for logs feature](https://aka.ms/am-log-to-metric).'
  type: Metric
  verified: false
  visible: true
  tags:
  - auto-generated
  - agc-1426
  properties:
    metricName: Average_Available MBytes Memory
    metricNamespace: Microsoft.OperationalInsights/workspaces
    severity: 3
    windowSize: PT5M
    evaluationFrequency: PT1M
    timeAggregation: Average
    operator: LessThan
    criterionType: StaticThresholdCriterion
    dimensions:
    - operator: include
      name: computer
      values:
      - '*'
    threshold: 1.0
    enabled: true
  guid: 99ba0b14-4b3c-49b5-8763-3161b9aae538
- name: Average_% Available Memory
  description: 'Average_% Available Memory. Supported for: Linux. Part of [metric
    alerts for logs feature](https://aka.ms/am-log-to-metric).'
  type: Metric
  verified: false
  visible: true
  tags:
  - auto-generated
  - agc-737
  properties:
    metricName: Average_% Available Memory
    metricNamespace: Microsoft.OperationalInsights/workspaces
    severity: 3
    windowSize: PT5M
    evaluationFrequency: PT5M
    timeAggregation: Average
    operator: LessThan
    criterionType: StaticThresholdCriterion
    dimensions:
    - operator: include
      name: computer
      values:
      - '*'
    threshold: 10.0
    enabled: true
  guid: 91044c16-83bc-457f-80a9-360bad5dedb4
- name: Average_% Used Inodes
  description: 'Average_% Used Inodes. Supported for: Linux. Part of [metric alerts
    for logs feature](https://aka.ms/am-log-to-metric).'
  type: Metric
  verified: false
  visible: true
  tags:
  - auto-generated
  - agc-719
  properties:
    metricName: Average_% Used Inodes
    metricNamespace: Microsoft.OperationalInsights/workspaces
    severity: 0
    windowSize: PT5M
    evaluationFrequency: PT5M
    timeAggregation: Average
    operator: GreaterThan
    criterionType: StaticThresholdCriterion
    dimensions:
    - operator: include
      name: computer
      values:
      - '*'
    threshold: 80.0
    enabled: true
  guid: af5d055f-0e1f-4c48-808a-d21f8268357d
- name: Average_Free Megabytes
  description: 'Average_Free Megabytes. Supported for: Linux, Windows. Part of [metric
    alerts for logs feature](https://aka.ms/am-log-to-metric).'
  type: Metric
  verified: false
  visible: true
  tags:
  - auto-generated
  - agc-680
  properties:
    metricName: Average_Free Megabytes
    metricNamespace: Microsoft.OperationalInsights/workspaces
    severity: 2
    windowSize: PT5M
    evaluationFrequency: PT5M
    timeAggregation: Average
    operator: LessThan
    criterionType: StaticThresholdCriterion
    dimensions:
    - operator: include
      name: computer
      values:
      - '*'
    - operator: include
      name: instancename
      values:
      - 'c:'
      - /
    threshold: 10240.0
    enabled: true
  guid: 969677fe-d1e0-42f6-92af-c9269780411b
- name: Average_% Used Swap Space
  description: 'Average_% Used Swap Space. Supported for: Linux. Part of [metric alerts
    for logs feature](https://aka.ms/am-log-to-metric).'
  type: Metric
  verified: false
  visible: true
  tags:
  - auto-generated
  - agc-539
  properties:
    metricName: Average_% Used Swap Space
    metricNamespace: Microsoft.OperationalInsights/workspaces
    severity: 1
    windowSize: PT1H
    evaluationFrequency: PT15M
    timeAggregation: Average
    operator: GreaterThan
    criterionType: StaticThresholdCriterion
    dimensions:
    - operator: include
      name: computer
      values:
      - '*'
    - operator: include
      name: objectname
      values:
      - '*'
    - operator: include
      name: instancename
      values:
      - '*'
    threshold: 50.0
    enabled: true
  guid: 04f64694-48a2-48ee-9455-ccce8e59b66f
- name: Average_Pages/sec
  description: 'Average_Pages/sec. Supported for: Linux, Windows. Part of [metric
    alerts for logs feature](https://aka.ms/am-log-to-metric).'
  type: Metric
  verified: false
  visible: true
  tags:
  - auto-generated
  - agc-441
  properties:
    metricName: Average_Pages/sec
    metricNamespace: Microsoft.OperationalInsights/workspaces
    severity: 2
    windowSize: PT15M
    evaluationFrequency: PT5M
    timeAggregation: Average
    operator: GreaterThan
    criterionType: StaticThresholdCriterion
    dimensions:
    - operator: include
      name: computer
      values:
      - '*'
    - operator: include
      name: objectname
      values:
      - memory
    threshold: 5000.0
    enabled: true
  guid: 88b7198b-32a5-4ae2-aaa5-7925066cc08c
- name: Average_Current Disk Queue Length
  description: 'Average_Current Disk Queue Length. Supported for: Windows. Part of
    [metric alerts for logs feature](https://aka.ms/am-log-to-metric).'
  type: Metric
  verified: false
  visible: true
  tags:
  - auto-generated
  - agc-354
  properties:
    metricName: Average_Current Disk Queue Length
    metricNamespace: Microsoft.OperationalInsights/workspaces
    severity: 3
    windowSize: PT5M
    evaluationFrequency: PT1M
    timeAggregation: Average
    operator: GreaterThan
    criterionType: StaticThresholdCriterion
    dimensions:
    - operator: include
      name: computer
      values:
      - '*'
    - operator: include
      name: objectname
      values:
      - '*'
    - operator: include
      name: instancename
      values:
      - '*'
    threshold: 2.0
    enabled: true
  guid: 08a4f049-9bb8-45d0-9dfb-320f385cc71f
- name: Average_Bytes Sent/sec
  description: 'Average_Bytes Sent/sec. Supported for: Windows. Part of [metric alerts
    for logs feature](https://aka.ms/am-log-to-metric).'
  type: Metric
  verified: false
  visible: true
  tags:
  - auto-generated
  - agc-351
  properties:
    metricName: Average_Bytes Sent/sec
    metricNamespace: Microsoft.OperationalInsights/workspaces
    severity: 1
    windowSize: PT5M
    evaluationFrequency: PT1M
    timeAggregation: Average
    operator: GreaterOrLessThan
    criterionType: DynamicThresholdCriterion
    dimensions:
    - operator: include
      name: computer
      values:
      - '*'
    - operator: include
      name: objectname
      values:
      - '*'
    - operator: include
      name: instancename
      values:
      - '*'
    - operator: include
      name: sourcesystem
      values:
      - '*'
    failingPeriods:
      numberOfEvaluationPeriods: 4
      minFailingPeriodsToAlert: 3
    alertSensitivity: Medium
    enabled: true
  guid: de6d5087-bc5a-474f-9319-248a3c03ab44
- name: Average_Bytes Received/sec
  description: 'Average_Bytes Received/sec. Supported for: Windows. Part of [metric
    alerts for logs feature](https://aka.ms/am-log-to-metric).'
  type: Metric
  verified: false
  visible: true
  tags:
  - auto-generated
  - agc-347
  properties:
    metricName: Average_Bytes Received/sec
    metricNamespace: Microsoft.OperationalInsights/workspaces
    severity: 1
    windowSize: PT5M
    evaluationFrequency: PT1M
    timeAggregation: Average
    operator: GreaterOrLessThan
    criterionType: DynamicThresholdCriterion
    dimensions:
    - operator: include
      name: computer
      values:
      - '*'
    - operator: include
      name: objectname
      values:
      - '*'
    - operator: include
      name: instancename
      values:
      - '*'
    - operator: include
      name: sourcesystem
      values:
      - '*'
    failingPeriods:
      numberOfEvaluationPeriods: 4
      minFailingPeriodsToAlert: 3
    alertSensitivity: Medium
    enabled: true
  guid: 60ec2790-dc83-419c-bdb5-38da9a477c68
- name: Average_Total Bytes Transmitted
  description: 'Average_Total Bytes Transmitted. Supported for: Linux. Part of [metric
    alerts for logs feature](https://aka.ms/am-log-to-metric).'
  type: Metric
  verified: false
  visible: true
  tags:
  - auto-generated
  - agc-345
  properties:
    metricName: Average_Total Bytes Transmitted
    metricNamespace: Microsoft.OperationalInsights/workspaces
    severity: 1
    windowSize: PT5M
    evaluationFrequency: PT1M
    timeAggregation: Average
    operator: GreaterOrLessThan
    criterionType: DynamicThresholdCriterion
    dimensions:
    - operator: include
      name: computer
      values:
      - '*'
    - operator: include
      name: objectname
      values:
      - '*'
    - operator: include
      name: instancename
      values:
      - '*'
    - operator: include
      name: sourcesystem
      values:
      - '*'
    failingPeriods:
      numberOfEvaluationPeriods: 4
      minFailingPeriodsToAlert: 3
    alertSensitivity: Medium
    enabled: true
  guid: 76583e85-8be6-4d02-8e09-aff0ce8574f8
- name: Average_Total Bytes Received
  description: 'Average_Total Bytes Received. Supported for: Linux. Part of [metric
    alerts for logs feature](https://aka.ms/am-log-to-metric).'
  type: Metric
  verified: false
  visible: true
  tags:
  - auto-generated
  - agc-343
  properties:
    metricName: Average_Total Bytes Received
    metricNamespace: Microsoft.OperationalInsights/workspaces
    severity: 1
    windowSize: PT5M
    evaluationFrequency: PT1M
    timeAggregation: Average
    operator: GreaterOrLessThan
    criterionType: DynamicThresholdCriterion
    dimensions:
    - operator: include
      name: computer
      values:
      - '*'
    - operator: include
      name: objectname
      values:
      - '*'
    - operator: include
      name: instancename
      values:
      - '*'
    - operator: include
      name: sourcesystem
      values:
      - '*'
    failingPeriods:
      numberOfEvaluationPeriods: 4
      minFailingPeriodsToAlert: 3
    alertSensitivity: Medium
    enabled: true
  guid: 593b6885-3fb8-4562-89f1-8b0b68649185
- name: Event
  description: 'Event. Supported for: Windows. Part of [metric alerts for logs feature](https://aka.ms/am-log-to-metric).'
  type: Metric
  verified: false
  visible: true
  tags:
  - auto-generated
  - agc-288
  properties:
    metricName: Event
    metricNamespace: Microsoft.OperationalInsights/workspaces
    severity: 1
    windowSize: PT5M
    evaluationFrequency: PT1M
    timeAggregation: Count
    operator: GreaterThan
    criterionType: StaticThresholdCriterion
    dimensions:
    - operator: include
      name: source
      values:
      - service control manager
    - operator: include
      name: eventlog
      values:
      - system
    - operator: include
      name: computer
      values:
      - '*'
    - operator: include
      name: eventid
      values:
      - '7031'
      - '7024'
      - '7034'
    threshold: 0.0
    enabled: true
  guid: 0b608189-b028-4851-8854-9ce1a48c3dd6
- name: Average_Avg. Disk sec/Write
  description: 'Average_Avg. Disk sec/Write. Supported for: Linux, Windows. Part of
    [metric alerts for logs feature](https://aka.ms/am-log-to-metric).'
  type: Metric
  verified: false
  visible: true
  tags:
  - auto-generated
  - agc-281
  properties:
    metricName: Average_Avg. Disk sec/Write
    metricNamespace: Microsoft.OperationalInsights/workspaces
    severity: 2
    windowSize: PT15M
    evaluationFrequency: PT5M
    timeAggregation: Average
    operator: GreaterThan
    criterionType: StaticThresholdCriterion
    dimensions:
    - operator: include
      name: computer
      values:
      - '*'
    - operator: include
      name: objectname
      values:
      - logicaldisk
    threshold: 0.04
    enabled: true
  guid: aad0e64e-3cda-45bf-b6bd-8cff29ee35e5
- name: Average_Avg. Disk sec/Read
  description: 'Average_Avg. Disk sec/Read. Supported for: Linux, Windows. Part of
    [metric alerts for logs feature](https://aka.ms/am-log-to-metric).'
  type: Metric
  verified: false
  visible: true
  tags:
  - auto-generated
  - agc-273
  properties:
    metricName: Average_Avg. Disk sec/Read
    metricNamespace: Microsoft.OperationalInsights/workspaces
    severity: 2
    windowSize: PT15M
    evaluationFrequency: PT5M
    timeAggregation: Average
    operator: GreaterThan
    criterionType: StaticThresholdCriterion
    dimensions:
    - operator: include
      name: computer
      values:
      - '*'
    - operator: include
      name: objectname
      values:
      - logicaldisk
    threshold: 0.04
    enabled: true
  guid: 8b472051-ff68-4059-9e50-243bfb64bae4
- name: Average_% User Time
  description: 'Average_% User Time. Supported for: Linux, Windows. Part of [metric
    alerts for logs feature](https://aka.ms/am-log-to-metric).'
  type: Metric
  verified: false
  visible: true
  tags:
  - auto-generated
  - agc-269
  properties:
    metricName: Average_% User Time
    metricNamespace: Microsoft.OperationalInsights/workspaces
    severity: 4
    windowSize: PT15M
    evaluationFrequency: PT1M
    timeAggregation: Average
    operator: GreaterThanOrEqual
    criterionType: StaticThresholdCriterion
    dimensions:
    - operator: include
      name: computer
      values:
      - vm-prd-dmzout-k8snodes-001
    threshold: 90.0
    enabled: true
  guid: b8140cdb-5492-4177-881f-8668372947a8
- name: Average_% IO Wait Time
  description: 'Average_% IO Wait Time. Supported for: Linux. Part of [metric alerts
    for logs feature](https://aka.ms/am-log-to-metric).'
  type: Metric
  verified: false
  visible: true
  tags:
  - auto-generated
  - agc-268
  properties:
    metricName: Average_% IO Wait Time
    metricNamespace: Microsoft.OperationalInsights/workspaces
    severity: 4
    windowSize: PT15M
    evaluationFrequency: PT1M
    timeAggregation: Average
    operator: GreaterThanOrEqual
    criterionType: StaticThresholdCriterion
    dimensions:
    - operator: include
      name: computer
      values:
      - vm-prd-dmzout-k8snodes-001
    threshold: 80.0
    enabled: true
  guid: 1116a5eb-9e12-415a-af46-fad552421d36
- name: Average_% Idle Time
  description: 'Average_% Idle Time. Supported for: Linux, Windows. Part of [metric
    alerts for logs feature](https://aka.ms/am-log-to-metric).'
  type: Metric
  verified: false
  visible: true
  tags:
  - auto-generated
  - agc-255
  properties:
    metricName: Average_% Idle Time
    metricNamespace: Microsoft.OperationalInsights/workspaces
    severity: 2
    windowSize: PT15M
    evaluationFrequency: PT5M
    timeAggregation: Average
    operator: LessThan
    criterionType: StaticThresholdCriterion
    dimensions:
    - operator: include
      name: computer
      values:
      - '*'
    - operator: include
      name: objectname
      values:
      - logicaldisk
    threshold: 20.0
    enabled: true
  guid: 732c0a7b-ac17-47cb-bf78-2ebaa839fa0d