Query sometimes delivers alerts for services that are running - azure-log-analytics

Question

I am setting up som alerts for windows services. using the code below. But sometimes I am getting an alert for a service that have the state "Running". We can´t se that the service are stopped or restarted under the period. Does any one have an idea what could be wrong? Or should I change the query to something else?
I want an alert every time the service is stopped so the support team can take action.
ConfigurationData
| project Computer, SvcName, SvcDisplayName, SvcState, TimeGenerated
| where (SvcName =~ "W3SVC")
| project Computer, SvcName, SvcDisplayName, SvcState, TimeGenerated
| where SvcState != "Running"

Answer 1

Update:
There is a potential issue in your query, like below:
if the SvcState state is stopped at 2019/09/06 1:00 PM, then you fix the issue by restart it. Let's say it's running again in 2019/09/06 2:00 PM. But in your query, for example, the query runs from 2019/09/06 1:00 PM, it will always return a result to indicate the service is stopped(which is actually an old state in 1:00 pm, but the latest state is running in 2:00 pm)
So you should get the latest SvcState by using top 1 by TimeGenerated, which is ordered by desc in TimeGenerated by default.
Please try the code below:
ConfigurationData
| top 1 by TimeGenerated
| project Computer, SvcName, SvcDisplayName, SvcState, TimeGenerated
| where (SvcName =~ "W3SVC") and SvcState != "Running"