Disable Alerts after 7 days?

[decker78]

I have a question related to behaviour as seen below.

We deploy about 300 alerts for our customers which are mostly based upon log searches.

I gave read that when an alert rule is failing for 7 days it gets disabled automatically.

As I understood the documentation this also happens when the syntax of the query is ok but if the table/column does not yet exist in log analytics.

Since we bootstrap our environments with all these alerts it could obviously be that a customer will not deploy all the resources that have an alert within a 7 day period. It could take months for somebody to actually deploy an AKS cluster for example.

Is the "7 day disable automation by MS" applicable to:

• v1 and v2 alert rules

Is there a way to prevent this from happening?

Did I understand the mechanism correctly?

"alert 123 is disabled by the System due to : Alert has been failing consistently with the same exception for the past week"