{
    "api_version": "1",
    "kind": "dse_post",
    "self": "https://update.dsesecurity.com/api/v1/posts/dse-20260909-444-repair-a-persistently-failing-log-alert-query-before-restoring-its-rule/",
    "item": {
        "id": "https://update.dsesecurity.com/updates/dse-20260909-444-repair-a-persistently-failing-log-alert-query-before-restoring-its-rule/",
        "slug": "dse-20260909-444-repair-a-persistently-failing-log-alert-query-before-restoring-its-rule",
        "url": "https://update.dsesecurity.com/updates/dse-20260909-444-repair-a-persistently-failing-log-alert-query-before-restoring-its-rule/",
        "alternate_urls": {
            "markdown": "https://update.dsesecurity.com/updates/dse-20260909-444-repair-a-persistently-failing-log-alert-query-before-restoring-its-rule.md",
            "json": "https://update.dsesecurity.com/api/v1/posts/dse-20260909-444-repair-a-persistently-failing-log-alert-query-before-restoring-its-rule/"
        },
        "title": "Repair a persistently failing log-alert query before restoring its rule",
        "summary": "Can Azure Monitor automatically disable a log-search alert whose query keeps failing?",
        "format": {
            "slug": "guide",
            "name": "Guide"
        },
        "priority": {
            "slug": "info",
            "name": "Information"
        },
        "featured": false,
        "image": {
            "theme": "continuity-recovery",
            "label": "Continuity & recovery",
            "alt": "Paired infrastructure paths converging on a stable recovered service.",
            "card_url": "https://update.dsesecurity.com/assets/editorial/continuity-recovery-card.webp?v=1.8.20",
            "hero_url": "https://update.dsesecurity.com/assets/editorial/continuity-recovery-hero.webp?v=1.8.20",
            "social_url": "https://update.dsesecurity.com/assets/editorial/continuity-recovery-social-v2.jpg?v=1.8.20",
            "width": 2400,
            "height": 1350
        },
        "topics": [
            {
                "slug": "business-continuity",
                "name": "Business Continuity",
                "url": "https://update.dsesecurity.com/topic/business-continuity/"
            },
            {
                "slug": "it",
                "name": "IT",
                "url": "https://update.dsesecurity.com/topic/it/"
            }
        ],
        "author": {
            "name": "DSE Security Editorial Team",
            "url": "https://update.dsesecurity.com/#editorial-team",
            "type": "Organization"
        },
        "publisher": {
            "name": "Detection Systems & Engineering",
            "url": "https://dsesecurity.com/"
        },
        "published_at": "2026-09-10T00:24:32+00:00",
        "modified_at": "2026-09-10T02:04:58+00:00",
        "reviewed_on": "2026-09-09",
        "reading_minutes": 2,
        "word_count": 236,
        "potentially_affected": "Azure Monitor log-search alert rules with persistent evaluation failures.",
        "dse_recommendation": "Inspect rule health and repair its query dependencies before treating the disabled rule as a notification-delivery problem.",
        "primary_source": {
            "name": "Troubleshoot log alerts in Azure Monitor - Azure Monitor | Microsoft Learn",
            "url": "https://learn.microsoft.com/en-us/azure/azure-monitor/alerts/alerts-troubleshoot-log",
            "published_on": null,
            "authority": "Microsoft Learn"
        },
        "publishing_principles": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/",
        "usage_info": "https://update.dsesecurity.com/usage/",
        "copyright_notice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.",
        "content_html": "<h2>Source facts</h2>\n<p>Azure Monitor automatically disables a log-search alert rule when its query fails evaluation continuously for a week. An initially valid query can later fail because a referenced resource moved or was deleted, a custom table has not received its first data, or the language requirements changed. Resource Health exposes the rule&#8217;s evaluation health, and the documentation shows an Activity log disable event identifying the system action. <a href=\"https://learn.microsoft.com/en-us/azure/azure-monitor/alerts/alerts-troubleshoot-log\" target=\"_blank\" rel=\"noopener noreferrer\">Microsoft Learn</a>.</p>\n<h2>Applicability</h2>\n<p>Use this check when a rule stops evaluating or appears disabled without an intended operator change. Separate query execution, condition matching and notification delivery so investigation starts at the failed stage.</p>\n<h2>DSE recommendation</h2>\n<p>Inspect rule health and repair its query dependencies before treating the disabled rule as a notification-delivery problem. Preserve the disable event and failed query details. Have the query owner verify referenced resources, available tables and current syntax, then agree how to restore the rule after the underlying failure is corrected. Do not repeatedly reenable an unchanged failing query.</p>\n<h2>Verification</h2>\n<p>Run the corrected query against the intended scope and compare its results with a known test condition. After approved restoration, inspect rule health and confirm that scheduled evaluations succeed. Rehearse the alert condition separately from delivery checks, recording each outcome. Keep any period without valid evaluation visible in the monitoring record rather than interpreting silence during that period as evidence of normal service.</p>\n<h2>Official references</h2>\n<p><a href=\"https://learn.microsoft.com/en-us/azure/azure-monitor/alerts/alerts-troubleshoot-log\" target=\"_blank\" rel=\"noopener noreferrer\">Microsoft Learn: Troubleshooting log-search alerts</a>. Source reviewed September 9, 2026.</p>",
        "content_text": "Source facts\nAzure Monitor automatically disables a log-search alert rule when its query fails evaluation continuously for a week. An initially valid query can later fail because a referenced resource moved or was deleted, a custom table has not received its first data, or the language requirements changed. Resource Health exposes the rule’s evaluation health, and the documentation shows an Activity log disable event identifying the system action. Microsoft Learn.\nApplicability\nUse this check when a rule stops evaluating or appears disabled without an intended operator change. Separate query execution, condition matching and notification delivery so investigation starts at the failed stage.\nDSE recommendation\nInspect rule health and repair its query dependencies before treating the disabled rule as a notification-delivery problem. Preserve the disable event and failed query details. Have the query owner verify referenced resources, available tables and current syntax, then agree how to restore the rule after the underlying failure is corrected. Do not repeatedly reenable an unchanged failing query.\nVerification\nRun the corrected query against the intended scope and compare its results with a known test condition. After approved restoration, inspect rule health and confirm that scheduled evaluations succeed. Rehearse the alert condition separately from delivery checks, recording each outcome. Keep any period without valid evaluation visible in the monitoring record rather than interpreting silence during that period as evidence of normal service.\nOfficial references\nMicrosoft Learn: Troubleshooting log-search alerts. Source reviewed September 9, 2026.",
        "content_markdown": "## Source facts\n\nAzure Monitor automatically disables a log-search alert rule when its query fails evaluation continuously for a week. An initially valid query can later fail because a referenced resource moved or was deleted, a custom table has not received its first data, or the language requirements changed. Resource Health exposes the rule’s evaluation health, and the documentation shows an Activity log disable event identifying the system action. [Microsoft Learn](https://learn.microsoft.com/en-us/azure/azure-monitor/alerts/alerts-troubleshoot-log).\n\n## Applicability\n\nUse this check when a rule stops evaluating or appears disabled without an intended operator change. Separate query execution, condition matching and notification delivery so investigation starts at the failed stage.\n\n## DSE recommendation\n\nInspect rule health and repair its query dependencies before treating the disabled rule as a notification-delivery problem. Preserve the disable event and failed query details. Have the query owner verify referenced resources, available tables and current syntax, then agree how to restore the rule after the underlying failure is corrected. Do not repeatedly reenable an unchanged failing query.\n\n## Verification\n\nRun the corrected query against the intended scope and compare its results with a known test condition. After approved restoration, inspect rule health and confirm that scheduled evaluations succeed. Rehearse the alert condition separately from delivery checks, recording each outcome. Keep any period without valid evaluation visible in the monitoring record rather than interpreting silence during that period as evidence of normal service.\n\n## Official references\n\n[Microsoft Learn: Troubleshooting log-search alerts](https://learn.microsoft.com/en-us/azure/azure-monitor/alerts/alerts-troubleshoot-log). Source reviewed September 9, 2026."
    },
    "json_ld": {
        "@context": "https://schema.org",
        "@graph": [
            {
                "@type": "Organization",
                "@id": "https://dsesecurity.com/#organization",
                "name": "Detection Systems & Engineering",
                "alternateName": "DSE Security",
                "url": "https://dsesecurity.com/",
                "logo": {
                    "@type": "ImageObject",
                    "url": "https://update.dsesecurity.com/assets/dse-logo-20260812.png?v=1.8.20"
                }
            },
            {
                "@type": "Organization",
                "@id": "https://update.dsesecurity.com/#editorial-team",
                "name": "DSE Security Editorial Team",
                "url": "https://update.dsesecurity.com/",
                "parentOrganization": {
                    "@id": "https://dsesecurity.com/#organization"
                }
            },
            {
                "@type": "WebSite",
                "@id": "https://update.dsesecurity.com/#website",
                "name": "DSE Updates",
                "alternateName": "DSE Security Knowledge Hub",
                "url": "https://update.dsesecurity.com/",
                "inLanguage": "en-US",
                "publisher": {
                    "@id": "https://dsesecurity.com/#organization"
                },
                "potentialAction": {
                    "@type": "SearchAction",
                    "target": {
                        "@type": "EntryPoint",
                        "urlTemplate": "https://update.dsesecurity.com/?q={search_term_string}"
                    },
                    "query-input": "required name=search_term_string"
                }
            },
            {
                "@type": "WebPage",
                "@id": "https://update.dsesecurity.com/updates/dse-20260909-444-repair-a-persistently-failing-log-alert-query-before-restoring-its-rule/",
                "url": "https://update.dsesecurity.com/updates/dse-20260909-444-repair-a-persistently-failing-log-alert-query-before-restoring-its-rule/",
                "isPartOf": {
                    "@id": "https://update.dsesecurity.com/#website"
                },
                "lastReviewed": "2026-09-09"
            },
            {
                "@type": "BreadcrumbList",
                "@id": "https://update.dsesecurity.com/updates/dse-20260909-444-repair-a-persistently-failing-log-alert-query-before-restoring-its-rule/#breadcrumbs",
                "itemListElement": [
                    {
                        "@type": "ListItem",
                        "position": 1,
                        "name": "DSE Updates",
                        "item": "https://update.dsesecurity.com/"
                    },
                    {
                        "@type": "ListItem",
                        "position": 2,
                        "name": "Repair a persistently failing log-alert query before restoring its rule",
                        "item": "https://update.dsesecurity.com/updates/dse-20260909-444-repair-a-persistently-failing-log-alert-query-before-restoring-its-rule/"
                    }
                ]
            },
            {
                "@type": [
                    "Article",
                    "TechArticle"
                ],
                "@id": "https://update.dsesecurity.com/updates/dse-20260909-444-repair-a-persistently-failing-log-alert-query-before-restoring-its-rule/#article",
                "identifier": "https://update.dsesecurity.com/updates/dse-20260909-444-repair-a-persistently-failing-log-alert-query-before-restoring-its-rule/",
                "url": "https://update.dsesecurity.com/updates/dse-20260909-444-repair-a-persistently-failing-log-alert-query-before-restoring-its-rule/",
                "headline": "Repair a persistently failing log-alert query before restoring its rule",
                "description": "Can Azure Monitor automatically disable a log-search alert whose query keeps failing?",
                "abstract": "Can Azure Monitor automatically disable a log-search alert whose query keeps failing?",
                "articleBody": "Source facts\nAzure Monitor automatically disables a log-search alert rule when its query fails evaluation continuously for a week. An initially valid query can later fail because a referenced resource moved or was deleted, a custom table has not received its first data, or the language requirements changed. Resource Health exposes the rule’s evaluation health, and the documentation shows an Activity log disable event identifying the system action. Microsoft Learn.\nApplicability\nUse this check when a rule stops evaluating or appears disabled without an intended operator change. Separate query execution, condition matching and notification delivery so investigation starts at the failed stage.\nDSE recommendation\nInspect rule health and repair its query dependencies before treating the disabled rule as a notification-delivery problem. Preserve the disable event and failed query details. Have the query owner verify referenced resources, available tables and current syntax, then agree how to restore the rule after the underlying failure is corrected. Do not repeatedly reenable an unchanged failing query.\nVerification\nRun the corrected query against the intended scope and compare its results with a known test condition. After approved restoration, inspect rule health and confirm that scheduled evaluations succeed. Rehearse the alert condition separately from delivery checks, recording each outcome. Keep any period without valid evaluation visible in the monitoring record rather than interpreting silence during that period as evidence of normal service.\nOfficial references\nMicrosoft Learn: Troubleshooting log-search alerts. Source reviewed September 9, 2026.",
                "datePublished": "2026-09-10T00:24:32+00:00",
                "dateModified": "2026-09-10T02:04:58+00:00",
                "mainEntityOfPage": {
                    "@id": "https://update.dsesecurity.com/updates/dse-20260909-444-repair-a-persistently-failing-log-alert-query-before-restoring-its-rule/"
                },
                "inLanguage": "en-US",
                "isAccessibleForFree": true,
                "author": {
                    "@type": "Organization",
                    "name": "DSE Security Editorial Team",
                    "url": "https://update.dsesecurity.com/#editorial-team"
                },
                "publisher": {
                    "@id": "https://dsesecurity.com/#organization"
                },
                "image": {
                    "@type": "ImageObject",
                    "@id": "https://update.dsesecurity.com/updates/dse-20260909-444-repair-a-persistently-failing-log-alert-query-before-restoring-its-rule/#primaryimage",
                    "url": "https://update.dsesecurity.com/assets/editorial/continuity-recovery-social-v2.jpg?v=1.8.20",
                    "contentUrl": "https://update.dsesecurity.com/assets/editorial/continuity-recovery-social-v2.jpg?v=1.8.20",
                    "width": 1200,
                    "height": 630,
                    "caption": "Repair a persistently failing log-alert query before restoring its rule"
                },
                "articleSection": [
                    "Business Continuity",
                    "IT"
                ],
                "keywords": [
                    "Business Continuity",
                    "IT",
                    "Guide",
                    "Information priority"
                ],
                "genre": "Guide",
                "about": [
                    {
                        "@type": "Thing",
                        "name": "Business Continuity",
                        "url": "https://update.dsesecurity.com/topic/business-continuity/"
                    },
                    {
                        "@type": "Thing",
                        "name": "IT",
                        "url": "https://update.dsesecurity.com/topic/it/"
                    }
                ],
                "wordCount": 236,
                "timeRequired": "PT2M",
                "publishingPrinciples": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/",
                "usageInfo": "https://update.dsesecurity.com/usage/",
                "copyrightHolder": {
                    "@id": "https://dsesecurity.com/#organization"
                },
                "copyrightNotice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.",
                "citation": {
                    "@type": "CreativeWork",
                    "name": "Troubleshoot log alerts in Azure Monitor - Azure Monitor | Microsoft Learn",
                    "url": "https://learn.microsoft.com/en-us/azure/azure-monitor/alerts/alerts-troubleshoot-log"
                }
            }
        ]
    }
}