[General workload issue]: Action Group Missing from Alert Rules

[vivsri]

Check for previous/existing GitHub issues

• [x] I have checked for previous/existing GitHub issues

Issue Type?

Question

Description

Hi Team, I was able to deploy the AMBA for ALZ pattern successfully. On further exploring I realized the alerts do get immediately created for the respected resources but they don't have an action group associated to them. Also in the param file, there's no option to supply the name of the AG. I used the BYOAction group & now they are associated in the policies for Deploy Azure Monitor Baseline Alerts for Service Health && Deploy Azure Monitor Baseline Alerts - Notification Assets

There's no such param for the policies/initiative creating Alert rules for other resources like a storage account.

[Brunoga-MS]

Hello @vivsri, thanks for your feedback. Alert, with the exception of Service Health and Resource Health alerts, are not configured with Action Group. They are forwarded/notified using Alert Processing Rules which will allow for notification configuration at scale. This is the reason why you do not see action groups configured as part of the alert configuration. As far as the name goes, we do not offer the ability to specify the name. we use some algorithm to prefix the action groups based on the type, since you might have more than one. The action groups created during the deployment are then associated to the abovementioned APR. If you need to use your notification assets (action groups and alert processing rules) then you need to go BYO. You can read more at Bring Your Own Notifications

Let me know if this bring some clarity.

Thanks, Bruno.

[vivsri]

Hi @Brunoga-MS, Thanks a lot for the updates. I read the documentation & it looks like the APR is not getting created either, nor the action group. I made a APR from the portal & used an existing AG & then the alerts started to come in. If i wish to skip these two steps, is there a possibility to make it happen from the code we run. Also my pipeline is green all the times :)

[Brunoga-MS]

As you got, APR and Action Groups are created as part of the Deploy Azure Monitor Baseline Alerts - Notification Assets policy initiative. If both the deployment and the remediation for the above initiative were green, APR should be there together with the action groups. Bear in mind that action groups are created even if you do not specify any email, webhook, LA and so on. In this case, an empty action group associated to an APR will be created. With that said, could you please investigate if deployment and remediation were good?

[vivsri]

I'll give it a fresh try & see how it behaves on a set of new Management group structure. Let's say i have an empty MG str, devoid of any subs, can i use a sub present in some other MG str or the old MG str, if I supply the sub ID the policy won't take effect right as we don't hv a sub underneath it. I'll move the only Management Sub under the new MG str & run the pipelines again. Pls Let me know if my approach makes sense.

[Brunoga-MS]

Unfortunately, MGs should have subscriptions for the remediations to happen. You can move subs from one MG to another, but cannot have the same sub in 2 MGs

[vivsri]

Yes that part i understand, I think initially i ran the pipeline when the sub was not under the new MG. I'll move only one sub & test it out, the one I'm planning to move is the management Sub. It will work with just one sub too right. Pls confirm. Thus it will create an Ag & APR.

[Brunoga-MS]

Confirmed and sorry for not have understood you

[vivsri]

Hey @Brunoga-MS , The deployment succeeded. The e-mail address was provided. The params are blank for
"BYOActionGroup": { "value": [] }, "BYOAlertProcessingRule": { "value": "" },

The RG & the Managed Identity are in place.

The status is non compliant as below

I don't see any AG & APR in place under the Monitoring Section.

Shall I try to run the remediation & check, or something s wrong as we don't see the AG & APRs.

[Brunoga-MS]

Yes, you need to run the remediation using the method documented at Remediate Policies.

[vivsri]

I just found the reason I believe, but it looks like a problem in the code.

{"code":"DeploymentFailed","message":"At least one resource deployment operation failed. Please list deployment operations for details. Please see https://aka.ms/arm-deployment-operations for usage details.","details":[{"code":"InvalidTemplate","message":"Deployment template validation failed: 'The template resource 'ag-AMBA-HSO TT ISM Management (Dev/Test)-001' for type 'Microsoft.Insights/actionGroups' at line '1' and column '721' has incorrect segment lengths. A nested resource type must have identical number of segments as its resource name. A root resource type must have segment length one greater than its resource name. Please see https://aka.ms/arm-syntax-resources for usage details.'."}]}

[vivsri]

{"code":"DeploymentFailed","message":"At least one resource deployment operation failed. Please list deployment operations for details. Please see https://aka.ms/arm-deployment-operations for usage details.","details":[{"code":"InvalidTemplate","message":"Deployment template validation failed: 'The template resource 'apr-AMBA-HSO TT ISM Management (Dev/Test)-002' for type 'Microsoft.AlertsManagement/actionRules' at line '1' and column '306' has incorrect segment lengths. A nested resource type must have identical number of segments as its resource name. A root resource type must have segment length one greater than its resource name. Please see https://aka.ms/arm-syntax-resources for usage details.'."}]}

[Brunoga-MS]

That part of the code has not been touched since months ... could you please double check the parameter file format making sure the values are written correctly?

[vivsri]

Sure, which one should i be looking for. As I left the BYOAG &BYOAPR as blank.

[Brunoga-MS]

the one about email address(es)

[vivsri]

**"ALZMonitorActionGroupEmail": {
  "value": ["testemail@abc.com"]**

Using the above format with a working e-mail address

[Brunoga-MS]

looks correct and very similar to mine:

Moreover, take a look at the known issues when using not-allowed characters for Azure resources at:

• Failed to deploy action group(s) and/or alert processing rule(s)
• Failed to edit action group(s)

I suspect something similar to what documented there

[vivsri]

Yes I checked them out but I don't believe they apply to our scenario. So if you run your code you will get to see the AG & APR's under the Monitor In our case there's none, due to template nesting etc. Is there a different branch I can try to run my pipeline from.

[Brunoga-MS]

Which deployment method are you using? Azure pipeline? Try to point the pipeline to release 2024-11-01

[vivsri]

The pipeline came out green but during remediation it fails for creation of AG with the release 2024-11-01 too.

Deployment template validation failed: 'The template resource 'ag-AMBA-SH-HSO TT ISM Management (Dev/Test)-001' for type 'Microsoft.Insights/actionGroups' at line '1' and column '721' has incorrect segment lengths. A nested resource type must have identical number of segments as its resource name. A root resource type must have segment length one greater than its resource name.

[vivsri]

Finally i guess :)

[Brunoga-MS]

Great :) What was the problem? did you run the remediation script or?

[vivsri]

I was the problem as usual, so as the error message in the known issues say At least one resource name segment is invalid according to the Resource Provider specification. (Code: InvalidResourceNameFormat)

I was sure, it can't be the name etc, but looking at the error message again & again something inside me said the name of the AG looks weird as my sub name has dashes slashes & spaces, so I simply renamed my sub to Management as u can see in the screenshot & now the remediation worked & the policies got deployed resulting in the AG & APRs.

Thanks for your time & patience, I really appreciate it.

[Brunoga-MS]

Thanks to you :-). Given your feedback I am going to close this issue as resolved.

Feel free to reopen it or to create a new one should it be the case.

Thanks, Bruno.