Skip to content

Scheduled Query Alert is configured to use a high frequency query#

Cost Optimization · Azure Monitor Alerts · Rule · 2025_06 · Important

High frequency scheduled queries are changed as a higher rate than low frequency queries.

Description#

Azure Monitor scheduled query rules are used to monitor logs by running queries against log data. Scheduled query rules can be configured to run at different frequencies such as:

  • Every 1 minute.
  • Every 5 minutes.
  • Every 10 minutes.
  • Every 15 minutes.

In many cases, a lower frequency such as 5 or 10 minutes intervals is sufficient for monitoring logs. Using a high frequency query, such as every 1 minute, can lead to increased costs and may not provide additional value.

For logs to be queryable, they must first be ingested into Azure Monitor, however the average latency to ingest log data is between 20 seconds and 3 minutes.

This rule identifies scheduled query rules that are configured to run every 1 minute.

Recommendation#

Consider using a lower frequency for scheduled queries or use metric alerts to reduce costs for operational monitoring.

Examples#

Configure with Bicep#

To deploy scheduled query rules that pass this rule:

  • Set the properties.evaluationFrequency property to a value greater than 1 minute, such as PT5M or PT10M.

For example:

Azure Bicep snippet
resource alertHealthCPUUsage 'Microsoft.Insights/scheduledQueryRules@2023-12-01' = {
  name: 'Virtual Machine Health - High CPU Usage'
  location: location
  properties: {
    description: 'Monitor virtual machines for high CPU usage over an extended period.'
    severity: 2
    enabled: true
    autoMitigate: true
    scopes: [
      resourceId
    ]
    evaluationFrequency: 'PT10M'
    windowSize: 'PT1H'
    criteria: {
      allOf: [
        {
          query: 'Perf | where ObjectName == "Processor" and CounterName == "% Processor Time"'
          metricMeasureColumn: 'AggregatedValue'
          resourceIdColumn: resourceIdColumn
          dimensions: []
          operator: 'GreaterThan'
          threshold: 90
          timeAggregation: 'Average'
          failingPeriods: {
            numberOfEvaluationPeriods: 1
            minFailingPeriodsToAlert: 1
          }
        }
      ]
    }
    checkWorkspaceAlertsStorageConfigured: false
    actions: {
      actionGroups: [
        actionGroupId
      ]
      customProperties: {
        key1: 'value1'
        key2: 'value2'
      }
    }
  }
}

Configure with Azure Verified Modules

A pre-validated module supported by Microsoft is available from the Azure Bicep public registry. To reference the module, please use the following syntax:

br/public:avm/res/insights/scheduled-query-rule:<version>

To use the latest version:

br/public:avm/res/insights/scheduled-query-rule:0.5.1

Configure with Azure template#

To deploy scheduled query rules that pass this rule:

  • Set the properties.evaluationFrequency property to a value greater than 1 minute, such as PT5M or PT10M.

For example:

Azure Template snippet
{
  "type": "Microsoft.Insights/scheduledQueryRules",
  "apiVersion": "2023-12-01",
  "name": "Virtual Machine Health - High CPU Usage",
  "location": "[parameters('location')]",
  "properties": {
    "description": "Monitor virtual machines for high CPU usage over an extended period.",
    "severity": 2,
    "enabled": true,
    "autoMitigate": true,
    "scopes": [
      "[parameters('resourceId')]"
    ],
    "evaluationFrequency": "PT10M",
    "windowSize": "PT1H",
    "criteria": {
      "allOf": [
        {
          "query": "Perf | where ObjectName == \"Processor\" and CounterName == \"% Processor Time\"",
          "metricMeasureColumn": "AggregatedValue",
          "resourceIdColumn": "[variables('resourceIdColumn')]",
          "dimensions": [],
          "operator": "GreaterThan",
          "threshold": 90,
          "timeAggregation": "Average",
          "failingPeriods": {
            "numberOfEvaluationPeriods": 1,
            "minFailingPeriodsToAlert": 1
          }
        }
      ]
    },
    "checkWorkspaceAlertsStorageConfigured": false,
    "actions": {
      "actionGroups": [
        "[parameters('actionGroupId')]"
      ],
      "customProperties": {
        "key1": "value1",
        "key2": "value2"
      }
    }
  }
}

Comments