Server reboot on Linux VM - Alert rule

Question

I'm looking to create an alert rule in Azure Monitor to detect server reboots on Linux VMs. I have one for server reboots on Windows VMs, but I cannot find how to detect this on Linux.

I tried searching on the signals available but could not find anything. It seems as the only possibility is a log query.

Answer 1

I'm looking to create an alert rule in Azure Monitor to detect server reboots on Linux VMs.

To create an alert when the Linux server restarts, you can follow the steps below.

1. Go to Azure Monitor > Logs > execute the below KQL query

    AzureActivity
    | where ResourceProvider == "Microsoft.Compute" 
    | where OperationName == "Restart Virtual Machine" and ActivityStatus == "Succeeded"
    | extend VMName = extract("([^/]+$)", 1, tostring(ResourceId))
    | join kind=inner (
        Heartbeat
        | where OSType contains "Linux"
        | extend ComputerName = tostring(split(Computer, ".")[0])
        | project ComputerName, OSType
    ) on $left.VMName == $right.ComputerName
    | project TimeGenerated,OSType,VMName,OperationName,ActivityStatus,ResourceGroup,Caller

Response:

2. Click on New Alert rule > create an alert rule

3. Create an action group, or select an existing one if it has already been created.

4. Configure the alert rule as per your requirement.

5. You will receive an alert when the Linux server restarts.