CODEWITHSUNDEEP
azureazure-resource-managerazure-monitoring
amnezjak
amnezjak

Reputation: 2031

Azure: Failed log alert deployment with ARM template

I'm trying to create log alert rule using ARM template. The template is validated successfully, but deployment fails with quite unhelpful message:

{"status":"Failed","error":{"code":"DeploymentFailed","message":"At least one resource deployment operation failed. Please list deployment operations for details. Please see https://aka.ms/DeployOperations for usage details.","details":[{"code":"InternalServerError","message":"{\r\n  \"error\": {\r\n    \"code\": \"ResourceDeploymentFailure\",\r\n    \"message\": \"The response for resource had empty or invalid content.\"\r\n  }\r\n}"}]}}

I tried with Portal and CLI, both ways result in the same error. This is the template I'm using (stripped of parameters for brevity):

{
    "$schema": "https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#",
    "contentVersion": "1.0.0.0",
    "parameters": {
    },
    "variables": {  },
    "resources": [
        {
            "name": "My new rule",
            "type": "Microsoft.Insights/scheduledQueryRules",
            "location": "germanywestcentral",
            "apiVersion": "2021-08-01",
            "tags": {},
            "properties": {
                "description": "Description",
                "severity": "3",
                "enabled": "true",
                "scopes": ["/subscriptions/###/resourceGroups/###/providers/microsoft.insights/components/###"],
                "evaluationFrequency":"PT5M",
                "windowSize": "PT5M",
                "criteria": {
                    "allOf": [
                        {
                            "query": "union \r\n    traces,\r\n    exceptions\r\n| where severityLevel > 2",
                            "metricMeasureColumn": "",
                            "resourceIdColumn": "",
                            "dimensions":[],
                            "operator": "GreaterThan",
                            "threshold" : "5000",
                            "timeAggregation": "Count",
                            "failingPeriods": {
                                "numberOfEvaluationPeriods": "1",
                                "minFailingPeriodsToAlert": "1"
                            }
                        }
                    ]
                },
                "actions": {
                    "actionGroups": "/subscriptions/###/resourcegroups/persevere/providers/microsoft.insights/actiongroups/my-action-group"
                }
            }
        }
    ]
}

Do you know what could be the failure reason here?

Upvotes: 1

Views: 861

Answers (1)

VenkateshDodda
VenkateshDodda

Reputation: 5546

We have tested this in our local environment it is working fine. Below statements are based on our analysis.

When We have loaded the above shared template in our local environment(VS code), the intellisense of VScode showed couple of syntactical error.

After fixing all those error's we have tried deploying the template it got deployed successfully without any errors.

Here is the ARM template post fixing those syntactical errors:

{
   "$schema":"https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#",
   "contentVersion":"1.0.0.0",
   "parameters":{
      
   },
   "variables":{
      
   },
   "resources":[
      {
         "name":"My new rule",
         "type":"Microsoft.Insights/scheduledQueryRules",
         "location":"germanywestcentral",
         "apiVersion":"2020-05-01-preview",
         "tags":{
            
         },
         "properties":{
            "description":"Description",
            "severity":3,
            "enabled":true,
            "scopes":[
               "/subscriptions/xxxxxxxxx-xxx-xxx/resourceGroups/<RGName>/providers/microsoft.insights/components/<AppInsightsName>"
            ],
            "evaluationFrequency":"PT5M",
            "windowSize":"PT5M",
            "criteria":{
               "allOf":[
                  {
                     "query":"union \r\n traces,\r\n exceptions\r\n| where severityLevel > 2",
                     "metricMeasureColumn":"",
                     "resourceIdColumn":"",
                     "dimensions":[
                        
                     ],
                     "operator":"GreaterThan",
                     "threshold":5000,
                     "timeAggregation":"Count",
                     "failingPeriods":{
                        "numberOfEvaluationPeriods":1,
                        "minFailingPeriodsToAlert":1
                     }
                  }
               ]
            },
            "actions":[
               {
                  "actionGroupId":"/subscriptions/xxxxxxx-xxxx-xxx/resourceGroups/<RGName>/providers/microsoft.insights/actionGroups/<actiongroupName>"
               }
            ]
         }
      }
   ]
}

Here is the sample output Screenshot for reference:

enter image description here

Note: If you are using Visual Studio Code, to develop ARM templates we would suggest you to install the extension ARM Template Viewer which will help you in avoiding syntactical errors.

Upvotes: 2

Related Questions