az monitor activity-log alert show --ids "$vm_id" --query 'condition'