{
  "alertRules": [
    {
      "name": "CPU-Warning",
      "condition": "cpu_percent > 70",
      "duration": "5 minutes",
      "severity": "Warning",
      "action": "通知のみ"
    },
    {
      "name": "CPU-Critical",
      "condition": "cpu_percent > 85",
      "duration": "2 minutes", 
      "severity": "Critical",
      "action": "即座に対応"
    },
    {
      "name": "CPU-Trend",
      "condition": "cpu_percent > 60 for 30 minutes",
      "severity": "Info",
      "action": "トレンド分析"
    }
  ]
}

// メモリリーク検知クエリ
Perf
| where ObjectName == "Memory" and CounterName == "Available MBytes"
| summarize avg(CounterValue) by bin(TimeGenerated, 1h)
| extend PreviousHour = prev(avg_CounterValue)
| where avg_CounterValue < PreviousHour * 0.95
| project TimeGenerated, MemoryDecline = (PreviousHour - avg_CounterValue)

// ディスク容量トレンド分析
Perf
| where ObjectName == "LogicalDisk" and CounterName == "% Free Space"
| where InstanceName != "_Total"
| summarize avg(CounterValue) by InstanceName, bin(TimeGenerated, 1d)
| extend DailyChange = avg_CounterValue - prev(avg_CounterValue)
| where DailyChange < -2  // 1日で2%以上減少
| project TimeGenerated, InstanceName, FreeSpace = avg_CounterValue, DailyDecrease = abs(DailyChange)

// カスタムメトリクスの送信
const appInsights = require('applicationinsights');
appInsights.setup(process.env.APPINSIGHTS_INSTRUMENTATIONKEY);
const client = appInsights.defaultClient;
function trackResponseTime(operationName, duration) {
    client.trackMetric({
        name: 'ResponseTime',
        value: duration,
        properties: {
            operation: operationName,
            threshold: duration > 1000 ? 'slow' : 'normal'
        }
    });
}

// エラー率の計算と監視
requests
| summarize 
    TotalRequests = count(),
    FailedRequests = countif(success == false)
    by bin(timestamp, 5m)
| extend ErrorRate = (FailedRequests * 100.0) / TotalRequests
| where ErrorRate > 5  // エラー率5%超過でアラート

# PowerShell Runbook for automatic recovery
param(
[string]$ResourceGroupName,
[string]$VMName,
[string]$AppPoolName
)
# VM に接続してアプリケーションプールを再起動
$scriptBlock = {
param($AppPoolName)
Import-Module WebAdministration
if ((Get-WebAppPoolState -Name $AppPoolName).Value -eq 'Stopped') {
Start-WebAppPool -Name $AppPoolName
Write-Output "Application pool $AppPoolName restarted successfully"
}
}
Invoke-AzVMRunCommand -ResourceGroupName $ResourceGroupName -VMName $VMName -CommandId 'RunPowerShellScript' -ScriptBlock $scriptBlock -Parameter @{AppPoolName = $AppPoolName}

-- 接続プール監視と自動調整
DECLARE @ActiveConnections INT
DECLARE @MaxConnections INT
SELECT @ActiveConnections = COUNT(*) FROM sys.dm_exec_sessions WHERE is_user_process = 1
SELECT @MaxConnections = value FROM sys.configurations WHERE name = 'user connections'
IF @ActiveConnections > (@MaxConnections * 0.8)
BEGIN
    -- アラート送信
    EXEC msdb.dbo.sp_send_dbmail
        @profile_name = 'AlertProfile',
        @recipients = 'admin@company.com',
        @subject = 'High Database Connection Usage',
        @body = 'Database connection usage is above 80%'
END

#!/bin/bash
# 自動ログクリーンアップスクリプト
LOG_DIRS=("/var/log/application" "/var/log/system" "/var/log/audit")
RETENTION_DAYS=30
for dir in "${LOG_DIRS[@]}"; do
    if [ -d "$dir" ]; then
        find "$dir" -name "*.log" -mtime +$RETENTION_DAYS -delete
        echo "Cleaned up logs older than $RETENTION_DAYS days in $dir"
    fi
done
# ディスク使用量チェック
DISK_USAGE=$(df / | awk 'NR==2 {print $5}' | sed 's/%//')
if [ $DISK_USAGE -gt 80 ]; then
    echo "Warning: Disk usage is ${DISK_USAGE}%" | mail -s "Disk Usage Alert" admin@company.com
fi

-- 自動インデックス再構築
DECLARE @sql NVARCHAR(MAX) = ''
SELECT @sql = @sql + 'ALTER INDEX ALL ON ' + SCHEMA_NAME(schema_id) + '.' + name + ' REBUILD;' + CHAR(13)
FROM sys.tables
WHERE OBJECTPROPERTY(object_id, 'IsUserTable') = 1
EXEC sp_executesql @sql
-- 統計情報の更新
EXEC sp_updatestats
-- データベースの整合性チェック
DBCC CHECKDB WITH NO_INFOMSGS

// アプリケーション健全性スコア
let HealthScore = 
requests
| where timestamp > ago(1h)
| summarize 
    TotalRequests = count(),
    SuccessfulRequests = countif(success == true),
    AvgDuration = avg(duration)
| extend 
    SuccessRate = (SuccessfulRequests * 100.0) / TotalRequests,
    PerformanceScore = case(
        AvgDuration < 500, 100,
        AvgDuration < 1000, 80,
        AvgDuration < 2000, 60,
        40
    ),
    OverallHealth = (SuccessRate + PerformanceScore) / 2
| project OverallHealth, SuccessRate, PerformanceScore, AvgDuration;
HealthScore

{
  "alertRule": {
    "name": "Critical-System-Alert",
    "actions": [
      {
        "type": "webhook",
        "uri": "https://dev.azure.com/webhook/create-incident",
        "payload": {
          "title": "Critical Alert: {alertname}",
          "description": "{alertdescription}",
          "severity": "1-Critical",
          "assignedTo": "on-call-engineer@company.com"
        }
      }
    ]
  }
}

// 障害時の相関分析
let AlertTime = datetime(2025-01-15T14:30:00);
let TimeWindow = 30m;
union
(Perf | where TimeGenerated between ((AlertTime - TimeWindow) .. (AlertTime + TimeWindow))),
(Event | where TimeGenerated between ((AlertTime - TimeWindow) .. (AlertTime + TimeWindow))),
(requests | where timestamp between ((AlertTime - TimeWindow) .. (AlertTime + TimeWindow)))
| summarize count() by bin(TimeGenerated, 1m), Type
| render timechart