Azure Monitor log alert firing repeatedly for a single Automation runbook completion event

Hello Bipin Kadam,

Greetings! Thanks for raising this question in Q&A forum.

The reason this is happening is that your Log Search Alert is configured as a stateless alert. This means Azure Monitor does not remember that it already fired for the same condition so every time it evaluates the query (every 5 minutes) and still finds that one matching log record within the lookback window, it fires the alert again. This behavior may have become more consistent due to recent backend changes in Azure Monitor's Scheduled Query Rules engine around June 2026.

Here's how you can fix this:

Step 1: Switch to a Stateful Alert

Go to your Alert Rule in the Azure Portal and edit it. Under the "Alert logic" section, look for the option "Automatically resolve alerts" and enable it. This makes the alert stateful — once it fires, it won't fire again until the condition clears and re-triggers.

Step 2: Adjust the Aggregation Granularity and Evaluation Period

Since your runbook runs twice a day, there's no need to evaluate every 5 minutes. Update the settings like this:

• Aggregation granularity: 15 or 30 minutes
• Evaluation frequency: 15 or 30 minutes
• Evaluation period: 30 minutes

This reduces the chance of the same log record being caught in multiple evaluation windows.

Step 3: Add a Time-Based Filter to Your Query

Narrow the query so it only picks up records from a fresh window. For example, add this line to your KQL query:

| where TimeGenerated >= ago(6m)

This ensures only very recent records are matched, so once the record ages out of that window, the alert stops firing.

Step 4: Use the "Mute actions" (Suppress Alerts) Option

In the Alert Rule, set "Mute actions for" to something like 60 minutes. This prevents repeated notifications even if the alert keeps evaluating as true.

Step 5: Verify the Fix

After saving, wait for the next scheduled runbook execution (08:00 or 20:30 JST) and confirm that only one email notification is received.

To directly answer your questions yes, this is expected behavior for a stateless alert with a short evaluation window. There have been platform-side changes in Azure Monitor's Scheduled Query Rules that can make this more pronounced. The fix is primarily switching to stateful mode and widening your evaluation window.

If this answer helps you kindly accept the answer which will help others who have similar questions.

Best Regards,

Jerald Felix.

Hello Bipin, it looks like your Scheduled Query Alert is working exactly as it’s designed today—it’s stateless, so as long as the query returns ≥1 row in each 5-minute evaluation window, it will fire again, even if it’s the same runbook completion event. Historically you may have only seen one notification because either the record fell outside subsequent windows, or the platform silently suppressed duplicate firings, but under the current behavior every evaluation cycle that sees that single JobLogs record will trigger the action.

Here’s what you can do to get back to just one notification per runbook job:

1. Scope the query to the evaluation window Add an explicit time filter so the query only returns records in the last 5 minutes. For example:

   
      AzureDiagnostics
   
      | where ResourceProvider == "MICROSOFT.AUTOMATION"
   
        and Category == "JobLogs"
   
        and ResultType == "Completed"
   
        and RunbookName_s == "Restart-MyApp-Runbook"
   
        and TimeGenerated > ago(5m)
   
      | summarize Jobs = dcount(JobId_g)
   
   

   Then alert on Jobs >= 1. Because you’re deduplicating by JobId_g and only looking at the recent window, once your runbook’s completion record moves out of that 5-minute bucket, the alert stops firing.
2. Use distinct count instead of raw row count If you leave the built-in aggregation as “Table rows” + Count >= 1, the rule simply checks “is there at least one row?” each cycle. By switching to a Kusto summarize dcount(JobId_g) you ensure each unique job only counts once.
3. Consider a metric alert on Total Jobs Azure Automation emits a “Total Jobs” platform metric with dimensions for RunbookName and Status. Metric alerts on “TotalJobs” = 1 for status “Completed” will fire once per job and resolve automatically when the metric drops back below the threshold.
4. (Optional) Use Alert Processing Rules for suppression If you want to keep your query as-is but suppress duplicate notifications, you can author an Alert Processing Rule to “suppress” actions from firing more than once within a given time span.

To answer your specific questions:

• We’re not aware of any Azure Monitor backend change that would retroactively duplicate log records—but Azure Scheduled Query Alerts have always been stateless, and every cycle that returns a match will fire again.
• Yes, under the default configuration a log alert will keep firing every evaluation interval as long as it sees ≥1 matching record in that period.
• The root cause in your case is the combination of “table rows” + “count ≥ 1” + no dedup/time filter—so once the same completed log exists in each new time window, you get repeat emails.

Give the above tweaks a try, and you should see exactly one alert per runbook run.

Reference list

1. Troubleshoot log alerts firing when they shouldn’t
2. Why an alert’s action or notification happens more than once
3. Monitor runbooks with metric alert
4. Forward Azure Automation diagnostic logs & sample KQL

Hope this helps. If the information was useful, please consider accepting the answer and upvoting. Feel free to reach out if you need any further assistance. Thank you.