Azure Alert - referenced object - (Properties.condition.datasource)

[crshnbrn66]

Cmdlet(s)

Set-AzureRmContext, get-AzureRmResource, get-azurermalertrule

PowerShell Version

Instructions: to get PowerShell version, type $PSVersionTable and look for the value associated with PSVersion 5.0.10586.494

Module Version

Microsoft.Azure.Commands.Insights 3.2.0

OS Version

Instructions: to get OS version, type $PSversionTable and look for value associated with BuildVersion

Description

When querying using a custom set of functions for "orphaned alerts" and running that against Classic resources it appears that the Data source for those alert types is not valid when calling Get-azurermresource.

For instance I have some alerts setup in one of my subscriptions that has a resource type of: /providers/Microsoft.ClassicStorage/storageAccounts/bwpprod/services/blob

The monitor is watching this blob but if you call Get-azurermresource and look at the objects properties for Properties.condition.datasource it comes back as invalid. The value of the resource id in almost every other case points to a valid object in the portal that you can test with get-azurermresource from that value in properties.condition.datasource.

Also have noticed that some alert resources are there but the underlying link that the alert is watching, if you query for it with get-azurermresource it comes back with an invalid url.
Valid url: subscriptions/xxxxx/resourceGroups/mygroup/providers/Microsoft.Sql/servers/webServer/databases/WebDatabase url that the alert object returns: subscriptions/xxxxx/resourceGroups/mygroup/providers/Microsoft.Sql/servers/webServer/databases/webDatabase

In the case above the w is changed to uppercase and now get-azurermresource works just fine.

Could I be possibly be looking at the wrong property in the object? For instance we have some monitors thatare setup to watch a database and some of it's counters but when I look at the (properties.condition.datasource) the value for the alert that I'm looking at when used with get-azurermresource comes up invalid. Is it perhaps that the monitored alert source has been changed and the value for the alert wasn't updated with the new alert? Also have seen where alerts that are referencing a data source that has had one item in the name's case changed become invalid as well.

To see my scripting that I'm speaking of please see this gist https://gist.github.com/crshnbrn66/4bb4670d36f56e98efe35d2ad29ebd01 and these functions: (Get-PAzureOrphanedAlerts,Test-PAzureAlertSource,

Debug Output

Debug doesn't apply in this condition just need clarity on where alerts are kept.

Script/Steps for Reproduction

When querying using a custom set of functions for "orphaned alerts" and running that against Classic resources it appears that the Data source for those alert types is not valid when calling Get-azurermresource.

For instance I have some alerts setup in one of my subscriptions that has a resource type of: /providers/Microsoft.ClassicStorage/storageAccounts/bwpprod/services/blob

The monitor is watching this blob but if you call Get-azurermresource and look at the objects properties for Properties.condition.datasource it comes back as invalid. The value of the resource id in almost every other case points to a valid object in the portal that you can test with get-azurermresource from that value in properties.condition.datasource.

Also have noticed that some alert resources are there but the underlying link that the alert is watching if you query for it with get-azurermresource it comes back with an invalid url.

Could I be possibly be looking at the wrong property in the object? For instance we have some monitors thatare setup to watch a database and some of it's counters but when I look at the (properties.condition.datasource) the value for the alert that I'm looking at when used with get-azurermresource comes up invalid. Is it perhaps that the monitored alert source has been changed and the value for the alert wasn't updated with the new alert? Also have seen where alerts that are referencing a data source that has had one item in the name's case changed become invalid as well.

to see my scripting that I'm speaking of please see this gist https://gist.github.com/crshnbrn66/4bb4670d36f56e98efe35d2ad29ebd01 and these functions: (Get-PAzureOrphanedAlerts,Test-PAzureAlertSource,

[cormacpayne]

@gucalder Hey Guillermo, would you mind taking a look at this issue?

[crshnbrn66]

Any Feedback?

[gucalder]

Just it see if I understand the issue correctly:

The call at line 493 of the script referenced above cannot find the resource, i.e. fails, because this uri $targetResourceId.properties.condition.datasource.resourceuri contains one or more letters with incorrect casing. For instance a 'w' instead of a 'W'. Right? If yes, the call get-azurermalertrule at line 488 is returning an alert rule object with an apparently invalid uri.

In general, AMR resources uris should be case-insensitive, but there is at least one exception to this rule: Microsoft.Sql, one of the examples given above. I cannot say if SQL is the only exception though. When creating the alert rule the uri can be given in any case and there should be no issue with that, except for SQL. If the uri was given with a 'w' that would explain the issue observed with the SQL examples.

The case with this resource type /providers/Microsoft.ClassicStorage/storageAccounts/bwpprod/services/blob needs some clarification. What has /providers/Microsoft.ClassicStorage/storageAccounts/bwpprod/services/blob as resource type? The alert rule? Is that the resource the alert is monitoring? So properties.condition.datasource.resourceuri equals or must equal /providers/Microsoft.ClassicStorage/storageAccounts/bwpprod/services/blob?

How is this one failing? Or which call is failing? Is the resourceuri null, empty, or in a different casing, does it still exist?

[crshnbrn66]

WE are still using these accounts / storage. not really that it's failing it's that the url for what the monitor is watching is invalid