Repair a persistently failing log-alert query before restoring its rule

Source facts

Azure Monitor automatically disables a log-search alert rule when its query fails evaluation continuously for a week. An initially valid query can later fail because a referenced resource moved or was deleted, a custom table has not received its first data, or the language requirements changed. Resource Health exposes the rule’s evaluation health, and the documentation shows an Activity log disable event identifying the system action. Microsoft Learn.

Applicability

Use this check when a rule stops evaluating or appears disabled without an intended operator change. Separate query execution, condition matching and notification delivery so investigation starts at the failed stage.

DSE recommendation

Inspect rule health and repair its query dependencies before treating the disabled rule as a notification-delivery problem. Preserve the disable event and failed query details. Have the query owner verify referenced resources, available tables and current syntax, then agree how to restore the rule after the underlying failure is corrected. Do not repeatedly reenable an unchanged failing query.

Verification

Run the corrected query against the intended scope and compare its results with a known test condition. After approved restoration, inspect rule health and confirm that scheduled evaluations succeed. Rehearse the alert condition separately from delivery checks, recording each outcome. Keep any period without valid evaluation visible in the monitoring record rather than interpreting silence during that period as evidence of normal service.

Official references

Microsoft Learn: Troubleshooting log-search alerts. Source reviewed September 9, 2026.