Examkin

Question

Difficulty: Very hardLog Analytics Workspaces and KQL Queries

Your organization uses an Azure Application Gateway v2 to route traffic for a web application. You enable diagnostic logging for the Application Gateway and route the logs to a Log Analytics workspace. The logs are collected in the resource-specific AGWAccessLogs table.

You need to write a Kusto Query Language (KQL) query to identify the top 55 request URIs that experienced the highest average backend response time for requests resulting in server-side errors (HTTP status codes in the 5xx5\text{xx} range) over the last 2424 hours.

Which of the following KQL queries will return the correct results? (Select two.)

  1. AGWAccessLogs
    | where TimeGenerated > ago(24h)
    | where toint(httpStatus) >= 500 and toint(httpStatus) < 600
    | summarize AvgResponseTime = avg(backendResponseTime) by requestUri
    | top 5 by AvgResponseTime desc    Answer
  2. B
    AGWAccessLogs
    | where TimeGenerated > ago(24h)
    | where httpStatus >= 500 and httpStatus < 600
    | summarize AvgResponseTime = avg(backendResponseTime) by requestUri
    | top 5 by AvgResponseTime desc
  3. AGWAccessLogs
    | where TimeGenerated > ago(1d)
    | where httpStatus startswith "5"
    | summarize AvgResponseTime = avg(backendResponseTime) by requestUri
    | order by AvgResponseTime desc
    | take 5    Answer
  4. D
    AGWAccessLogs
    | where TimeGenerated > ago(24h)
    | where toint(httpStatus) between (500 .. 599)
    | summarize AvgResponseTime = avg(backendResponseTime)
    | top 5 by AvgResponseTime desc
  5. E
    AGWAccessLogs
    | where TimeGenerated > ago(24h)
    | where httpStatus startswith "5"
    | group requestUri by avg(backendResponseTime)
    | limit 5

Answer

The KQL queries that cast httpStatus to an integer before comparison or use string prefix matching with startswith, and correctly group by requestUri before sorting and taking the top 55 records.
To retrieve the requested data, the query must account for the string data type of httpStatus in the AGWAccessLogs table. This is achieved either by casting the status code to an integer using toint() or by using the startswith operator. Furthermore, to find the slowest URIs, the query must group the average backend response time by requestUri and then sort the results in descending order, returning the top 55 records using either top or take.

Step-by-Step Solution

1
Analyze the table schema requirements.
Identify that the httpStatus field in AGWAccessLogs is a string type, while backendResponseTime is a numerical type.
This determines how type conversion or matching must be handled for filtering and aggregation.
2
Filter for the time window and server errors.
Use TimeGenerated > ago(24h) or ago(1d). Filter HTTP 5xx errors by either casting httpStatus to integer using toint() and evaluating if it is between 500 and 599, or checking if the string starts with '5'.
Direct comparison of string fields with integer literals will fail to execute in KQL.
3
Aggregate and group the backend response time.
Use summarize AvgResponseTime = avg(backendResponseTime) by requestUri.
Grouping by requestUri is necessary to calculate the average response time per unique URI instead of a single global average.
4
Sort and retrieve the top results.
Apply 'top 5 by AvgResponseTime desc' or combine 'order by AvgResponseTime desc' with 'take 5'.
This retrieves exactly the top 5 URIs with the highest average response times.

Key Concept

Querying resource-specific logs using KQL, understanding column types (string vs. numerical), performing aggregations with summarize, and limiting results using top or take.
Rate this question

Topics

Log Analytics Workspaces and KQL Queries

More questions from this topic