An administrator is troubleshooting performance and connectivity issues for an Azure Application Gateway named AppGW1. Diagnostic settings are configured to send logs to a Log Analytics workspace.
The administrator needs to write a KQL query to find the total count of requests that resulted in an HTTP status code of (Bad Gateway) over the last hours, grouped by the requested URI.
Which KQL query should the administrator run?
- AGWAccessLogs
| where TimeGenerated > ago(24h)
| where httpStatus == 502
| summarize count() by requestUriCevap - BAGWAccessLogs
| where TimeGenerated > ago(24h)
| where httpStatus = 502
| group by requestUri - CAzureActivity
| where TimeGenerated > ago(24h)
| where ActivityStatusValue == "Failed" and Properties contains "502"
| summarize count() by Resource - DAGWAccessLogs
| summarize count() by requestUri
| where TimeGenerated > ago(24h) and httpStatus == 502
Cevap
The correct query is the one that targets the AGWAccessLogs table, filters by TimeGenerated > ago(24h) and httpStatus == 502, and aggregates the count of requests by requestUri.
The correct query retrieves data from the AGWAccessLogs table, which holds the HTTP request logs of the Application Gateway. It correctly filters records from the last hours and where the HTTP status code matches . It then aggregates the count of those records grouped by the requestUri column using standard KQL operators.
Adım Adım Çözüm
Anahtar Kavram
Log Analytics KQL query design for Azure resource diagnostic logs, focusing on correct table selection, pipeline operator ordering, and aggregation syntax.