Azure Monitor Alert Rule
Does ZopNight manage Azure Monitor Alert Rule?
Azure Monitor alert rules bill per rule, and log alerts add a charge per evaluation. A query that runs every 5 minutes is billed whether or not it ever fires. ZopNight inventories every rule via Resource Graph with its type and state, so disabled, orphaned, and duplicate rules surface for cleanup.
Rules that fire on Azure Monitor Alert Rule
At a glance
| Field | Value |
|---|---|
| Scheduling notes | discovery only. |
Alert rules evaluate metrics and logs to trigger notifications, billed per rule and per evaluation for log alerts. Hundreds of stale log alerts each running frequent queries add up.
Metric rules and log rules charge differently
The two rule families meter on different principles. A metric alert bills as a monitored time series, a flat presence charge that scales with how many dimensions the rule watches. A log alert bills for its evaluations: the scheduled query behind it executes at its configured frequency around the clock, and each execution is chargeable regardless of outcome. The bill therefore rewards infrequent, targeted log queries and punishes tight evaluation intervals copied from a template. Neither family charges anything extra for actually firing; the cost is entirely in the watching.
Rule hygiene ZopNight makes visible
Discovered via Azure Resource Graph with rule type and state, supporting cleanup of disabled, orphaned, or duplicate alert rules. There is nothing to schedule, since a rule is configuration rather than compute, so the value of discovery is the inventory itself: every rule across every subscription in one queryable list, with enough state detail to separate the rules a team relies on from the ones nobody remembers creating.
How alert sprawl accumulates
Alert estates grow monotonically because deleting a rule feels riskier than ignoring it. Orphaned rules outlive their target: the VM or app they watched is gone, but the scheduled query keeps executing against nothing. Duplicates arrive with every copied ARM template or recreated environment, doubling evaluation charges for identical coverage. And disabled rules, switched off during an incident and never revisited, cost nothing but bury the live rules that matter, which is an operational cost even where it is not a billed one.
Auditing the full rule inventory
Azure portal → Monitor → Alerts → Alert rules lists every rule in scope with its type, target, evaluation frequency, and enabled state. Sorting by target resource is the quickest way to spot rules pointing at resources that no longer exist.