Event Hub alerts, great for detecting drops in connectivity

If we look at the Azure IoT Reference Architecture we see how streaming data is the heart of the IoT platform:


Data arrives at the IoT Hub and can be routed to any Azure resource using eg. the IoT Hub routing, Stream Analytics jobs and Event Hubs.

This gives us the maximum flexibility to divide the data into three major data streams or storage:

  1. Hot path – Event, Alert, Conditions
  2. Warm path – aggregated data, data for reporting
  3. Cold path – the raw data, mainly untouched and available in large quantities; great for data scientists

But there is an often unseen, even ignored forth stream. And that is the stream of data for monitoring.

In my earlier blogs, I wrote several times hoe heartbeats en watchdogs can tell the story about the quality of the data. And I have shown how eg. Azure Functions and notification services can improve the insights about the quality of the communication.

Today I want to add a little gem to that list.

Let’s check out Monitoring Alerts in Event Hubs. It’s part of the overall Monitoring service in Azure.

It is possible to route incoming IoT Hub messages through Event Hubs. I can recommend this because this is a fairly cheap and scalable way to multiple the same message into several streams.

If give you a reasonable insight into the amount of throughput you get:


And you can temporarily disable streams if needed:


Yes, it’s nice to see the data coming in.

But what if the data is not arriving?

Event Hub Monitoring Alerts

When you check out the abilities of the Event Hub Namespace, you will come across the Alerts:

“Alerts proactively notify you when important conditions are found in your monitoring data. They allow you to identify and address issues before the users of your system notice them.”

Sounds nice, doesn’t it? Getting notifications based on rules, that is what we need for monitoring!

But wait, there are a few things you need to know:

  • Alerts are not for free, there is a small fee in place
  • These alerts a based on volume changes (number of messages per hour etc.). You can not add conditions which look inside messages. If you need that, check out IoT Hub routing of Stream analytics and send these messages to an Event Hub.

Alerting on drops in the number of messages received

Here is an example of a rule I added to an Event Hub. It alerts me when I receive no messages anymore for more than five minutes. I tested a couple of times this alert rule:


To add a rule, press the ‘+ New alert rule’ button.

You have to enter the condition. And there are many possibilities of signals to base your condition on:


We go for ‘Incoming messages’.

We have to select our Event Hub namespace:


And we add the rule for the ”warm path’ Event Hub:


We want it to fire if less or equal to zero messages arrive within 5 minutes.

Now we have to decide what must happen once an alert fires.

I go for an email to the admin. I create this action group (for easy reuse for other alerts):


You can mix and match multiple persons and multiple types of actions:


I can recommend Logic Apps if you want to integrate with your company backend. Azure Functions are the most flexible solution.

Just give it a nice description and your Alert is ready:


Do you see that the monthly costs are set to 10 dollar cent a month?


Once the Alert is in place it will check out eventHub. So if all our IoT Hub devices stop sending warm path messages (or something else is going wrong like a wrong route in the IoTHub), we get this email alert:


All rule information is shown, even the dimension.

What I find interesting is that the Alert is in a ‘fired’ state.

Here is an example, the two previous Alerts are already resolved:


And when this Alert is resolved too, we receive another mail:



In our quest for the most prefect monitoring solution we just found a big piece. Using Alerts is a flexible way to check the message streams on a high ‘meta’ level.

There are some costs involved the value of these Alerts are immediately visible and they pay themselves back in no-time.