Taking Automatic Remediation Action on Azure VM Alert Generation

Using a new feature in Azure, now you can easily configure to trigger an Azure Automation Runbook when an Alert is triggered on an Azure Virtual Machine to take a remediation action. To leverage this feature all you need to do is link the alert on Azure VM to an already existing Azure Automation Runbook.

Note: This feature is supported only for the V2 Virtual Machines, i.e. the VMs created using ARM portal.

To access this feature open your Virtual Machine. Then go to the Manage alerts section in the Settings:

Then open an existing alert or click on "Add alert" to create a new one. Specify the criteria for the alert. Scroll down to the bottom and you can view the new section to link the alert to an Automation Runbook.

Under the hood

The alert will send data to your Runbook in a special format. Your Runbook should be expecting this. Under the hood this happens via WebHooks. The alert data is passed via a HTTP POST request. The Automation webhook service extracts the alert data from the POST request and passes it to the runbook in a parameter called "WebhookData". The Runbook will look like below:

[OutputType("PSAzureOperationResponse")]

param ( [object] $WebhookData )

if ($WebhookData)
{
    # Get the data object from WebhookData
    $WebhookBody = (ConvertFrom-Json -InputObject $WebhookData.RequestBody)

    #Rest of the script comes here
}

In Nutshell, now you can now trigger Azure Automation Runbooks to take remediation actions on Virtual Machines in case an alert is triggered.

Reference with complete Runbook sample: Azure Automation solution - remediate Azure VM alerts