关于无法为Azure资源特定事件配置警报的技术咨询

Great question—you’re spot-on about the gap between the old resource-specific event alerts and today’s Activity Log Alerts in Azure, and you haven’t missed any obvious configuration tricks here. Let’s break down what’s going on and the best solutions available right now:

First: Activity Log Alerts don’t support this scenario (you’re not missing anything) #

The current Activity Log Alerts in the Azure Portal are designed for two main use cases:

• Resource management events: Things like deployment status, resource creation/deletion, or policy violations.
• Threshold-based metric alerts: Triggering when a metric (like failure count) crosses a set threshold over a time window.

As you noticed, this leaves a blind spot for one-off operational events like a single failed Data Factory pipeline run—especially for pipelines that only run once a day, where threshold-based alerts will never trigger (since there’s no second failure to hit the count threshold). There’s no built-in option in Activity Log Alerts for targeting individual RunFinished events with a Failed status.

Current working solutions #

1. Azure Monitor Logs (formerly OMS Log Analytics) #

This is the most robust and recommended approach for your scenario:

• First, enable diagnostic settings on your Data Factory to send PipelineRuns logs to a Log Analytics workspace.
• Create a log alert rule in Azure Monitor with a Kusto query that filters for failed runs:

  PipelineRuns
  | where Status == "Failed"
  | where TimeGenerated >= ago(2h) // Adjust this to match your pipeline's run frequency
  

• Set the alert trigger condition to "Number of results greater than 0" and configure your preferred notification method (email, SMS, Logic App, etc.).

This setup will catch every single failed pipeline run, works perfectly for daily-run pipelines, and lets you add more context (like error messages) to your alerts with extended queries.

2. Azure Event Grid (available today, not just future support) #

You might not realize it, but Data Factory already integrates with Event Grid to emit pipeline run events. This is a great option for real-time alerts:

• Go to your Data Factory resource in the portal, navigate to Events > Event Subscriptions.
• Create a new subscription, select "Pipeline run failed" as the event type.
• Choose an endpoint for the event—this could be a Logic App (to send detailed emails), Azure Function (for custom automation), or even a direct email notification via an Azure Event Grid Viewer.

Event Grid delivers events in near-real time, so you’ll get alerted the second a pipeline fails, without any log ingestion delay.

3. Legacy ARM template approach (not recommended long-term) #

As you noted, you can still create the old-style event alerts via ARM templates, but these are legacy "classic" alerts. The Azure Portal no longer supports viewing or managing them, and there’s a risk they’ll be deprecated in the future. This should only be a temporary workaround if the other solutions aren’t feasible for you right now.

Wrap-up #

To recap: You haven’t missed any configuration in Activity Log Alerts—they just don’t cover this use case. For a reliable, supported solution, go with either Azure Monitor Logs (for log analysis and flexibility) or Event Grid (for real-time event-driven alerts).

内容的提问来源于stack exchange，提问作者Alex KeySmith