Examkin

Soru

Zorluk: OrtaLog Analytics Workspaces and KQL Queries

An administrator is troubleshooting a web application hosted on an Azure App Service plan. The Web Server logging feature is enabled and configured to send logs to a Log Analytics workspace. The administrator needs to identify the client IP addresses that experienced server-side errors (HTTP status codes 500500 through 599599) over the past 2424 hours. The results must show each client IP address and the total number of failed requests, sorted in descending order of the request count. Which Kusto Query Language (KQL) query should the administrator run?

  1. AppServiceHTTPLogs
    | where TimeGenerated > ago(24h)
    | where ScStatus >= 500 and ScStatus < 600
    | summarize RequestCount = count() by CiIP
    | sort by RequestCount desc    Cevap
  2. B
    AppServiceHTTPLogs
    | summarize RequestCount = count() by CiIP, ScStatus
    | sort by RequestCount desc
    | where TimeGenerated > ago(24h) and ScStatus >= 500 and ScStatus < 600
  3. C
    AppServiceHTTPLogs
    | where TimeGenerated > ago(24h) and ScStatus between (500 .. 599)
    | group by CiIP
    | order by count() desc
  4. D
    AppServiceHTTPLogs
    | where TimeGenerated > ago(24h)
    | where ScStatus == "5*"
    | summarize RequestCount = count() by CiIP
    | sort by RequestCount desc

Cevap

The query that filters AppServiceHTTPLogs by TimeGenerated and ScStatus, summarizes by client IP, and then sorts by count in descending order.
The correct query follows the KQL pipeline structure. It first filters the AppServiceHTTPLogs table to the specified time window of 2424 hours and HTTP status range (500500 to 599599). Next, it uses the summarize operator to group by the client IP address and calculate the total count of matching logs. Finally, it sorts the results in descending order by the aggregated request count.

Adım Adım Çözüm

1
Apply initial time filtering to reduce the dataset.
Filtered the AppServiceHTTPLogs table to include only records from the last 2424 hours using `where TimeGenerated > ago(24h)`.
Filtering early in the query pipeline is a best practice in KQL to optimize performance and resource utilization.
2
Filter for HTTP status codes in the range 500500 to 599599.
Added a filter using `where ScStatus >= 500 and ScStatus < 600`.
This captures all server-side error status codes (5xx5\text{xx}) required by the scenario.
3
Group by the client IP address and calculate the request count.
Used the summarize operator: `summarize RequestCount = count() by CiIP`.
This groups the remaining records by the Client IP (`CiIP`) column and assigns the count to a new column named `RequestCount`.
4
Sort the aggregated results.
Added the final pipeline stage: `sort by RequestCount desc`.
This organizes the output in descending order of the calculated request count as specified.

Anahtar Kavram

KQL Query Construction and Table Schema Filtering
Bu soruyu puanla

Konular

Log Analytics Workspaces and KQL Queries

Bu konudan daha fazla soru