Examkin

Question

Difficulty: MediumLog Analytics Workspaces and KQL Queries

An administrator is troubleshooting performance and connectivity issues for an Azure Application Gateway named AppGW1. Diagnostic settings are configured to send logs to a Log Analytics workspace.

The administrator needs to write a KQL query to find the total count of requests that resulted in an HTTP status code of 502502 (Bad Gateway) over the last 2424 hours, grouped by the requested URI.

Which KQL query should the administrator run?

  1. AGWAccessLogs
    | where TimeGenerated > ago(24h)
    | where httpStatus == 502
    | summarize count() by requestUri    Answer
  2. B
    AGWAccessLogs
    | where TimeGenerated > ago(24h)
    | where httpStatus = 502
    | group by requestUri
  3. C
    AzureActivity
    | where TimeGenerated > ago(24h)
    | where ActivityStatusValue == "Failed" and Properties contains "502"
    | summarize count() by Resource
  4. D
    AGWAccessLogs
    | summarize count() by requestUri
    | where TimeGenerated > ago(24h) and httpStatus == 502

Answer

The correct query is the one that targets the AGWAccessLogs table, filters by TimeGenerated > ago(24h) and httpStatus == 502, and aggregates the count of requests by requestUri.
The correct query retrieves data from the AGWAccessLogs table, which holds the HTTP request logs of the Application Gateway. It correctly filters records from the last 2424 hours and where the HTTP status code matches 502502. It then aggregates the count of those records grouped by the requestUri column using standard KQL operators.

Step-by-Step Solution

1
Identify the correct Azure Monitor log source table for Application Gateway request traffic.
The correct table is AGWAccessLogs because HTTP status codes and URL paths are data-plane metrics. The AzureActivity table is incorrect because it only records control-plane actions.
Using the appropriate log source table ensures the required telemetry fields (httpStatus, requestUri) are accessible.
2
Apply filtering operators for time and HTTP status code.
Apply the filters using '| where TimeGenerated > ago(24h)' and '| where httpStatus == 502'.
Filtering records as early as possible in the KQL pipeline optimizes execution performance and ensures data is filtered before aggregation.
3
Perform aggregation and grouping using KQL syntax.
Apply '| summarize count() by requestUri' to aggregate the results.
The summarize operator is the standard KQL operator used to group records and execute aggregation functions like count().

Key Concept

Log Analytics KQL query design for Azure resource diagnostic logs, focusing on correct table selection, pipeline operator ordering, and aggregation syntax.
Rate this question

Topics

Log Analytics Workspaces and KQL Queries

More questions from this topic