Facing challenges with a suppression rule that isn't working as expected for a couple of servers, despite following Microsoft's configuration suggestions

AnuragSingh-MSFT 21,076 Reputation points
2024-06-27T16:32:47.8266667+00:00

How do you troubleshoot a suppression rule, if it does not work for a couple of servers?

PS - Based on the issues that we have seen from multiple customers and sources, we are posting these questions to help the Azure community.

Azure Monitor
Azure Monitor
An Azure service that is used to collect, analyze, and act on telemetry data from Azure and on-premises environments.
2,960 questions
0 comments

1 answer

Sort by: Most helpful
Most helpful Newest Oldest
  1. Monalla-MSFT 12,761 Reputation points
    2024-06-27T17:48:11.9066667+00:00

    @AnuragSingh-MSFT - Thanks for reaching out to us.

    1. Verify the scope of the suppression rule is correctly set to the Log Analytics Workspace.
    2. Add three specific filters to the rule:
    3. Ensure the alert condition is set to 'Fired'.
    4. Use the 'contains' operator in the alert context (payload) filter.
    5. Apply the 'contains' operator for the alert rule ID filter. These steps should correct the suppression rule's functionality for the servers in question.

    Hope this helps. and please feel free to reach out if you have any further questions.

    Please don't forget to "Accept as Answer" and click "Yes" if the above response is helpful, so it can be beneficial to the community.

    0 comments