Adding example queries

Azure Services/API Management services/Alerts/README

@@ -0,0 +1 @@
+Put alerts in this folder

Azure Services/API Management services/Queries/Diagnostics/Cache hit ratio.txt

@@ -0,0 +1,12 @@
+// Author: Microsoft Azure
+// Display name: Cache hit ratio
+// Description: Statistics of Cache hit/miss ratio.
+// Categories: ['resources']
+// Resource types: ['API Management services']
+// Topic: Diagnostics
+ApiManagementGatewayLogs
+| where TimeGenerated > ago(1d)
+| summarize Cache_Miss=countif(Cache  == "miss"), Cache_Hit=countif(Cache == "hit") by bin(TimeGenerated, 15m)
+| extend Ratio=Cache_Hit / (Cache_Hit + Cache_Miss)
+| project-away Cache_Hit , Cache_Miss 
+| render timechart 

Azure Services/API Management services/Queries/Diagnostics/Client TLS versions.txt

@@ -0,0 +1,9 @@
+// Author: Microsoft Azure
+// Display name: Client TLS versions
+// Description: Breakdown of client TLS versions in the last 24 hours.
+// Categories: ['resources']
+// Resource types: ['API Management services']
+// Topic: Diagnostics
+ApiManagementGatewayLogs
+| where TimeGenerated > ago(1d)
+| summarize count(CorrelationId) by ClientTlsVersion, _ResourceId 

Azure Services/API Management services/Queries/Errors/Error reasons breakdown.txt

@@ -0,0 +1,10 @@
+// Author: Microsoft Azure
+// Display name: Error reasons breakdown
+// Description: Breakdown of all error reasons in the last 24 hours.
+// Categories: ['resources']
+// Resource types: ['API Management services']
+// Topic: Errors
+ApiManagementGatewayLogs
+| where TimeGenerated > ago(1d)
+| where IsRequestSuccess == false
+| summarize count(CorrelationId) by LastErrorReason, _ResourceId  

Azure Services/API Management services/Queries/Errors/Get failed requests due to issues not related to the backend.txt

@@ -0,0 +1,11 @@
+// Author: Microsoft Azure
+// Display name: Get failed requests due to issues not related to the backend
+// Description: Get the logs of failed requests due to issues not related to the backend (e.g., API Mangement policies configuration, rate limit exceeded, client disconnection).
+// Categories: ['resources']
+// Resource types: ['API Management services']
+// Topic: Errors
+ApiManagementGatewayLogs
+| where TimeGenerated > ago(1d)
+| where IsRequestSuccess == false
+| where isnull(BackendResponseCode) or BackendResponseCode < 400
+| where ResponseCode >= 400

Azure Services/API Management services/Queries/Errors/Get failed requests due to issues related to the backend.txt

@@ -0,0 +1,10 @@
+// Author: Microsoft Azure
+// Display name: Get failed requests due to issues related to the backend
+// Description: Get the logs of failed requests due to backend issues.
+// Categories: ['resources']
+// Resource types: ['API Management services']
+// Topic: Errors
+ApiManagementGatewayLogs
+| where TimeGenerated > ago(1d)
+| where IsRequestSuccess == false
+| where BackendResponseCode >= 400

Azure Services/API Management services/Queries/Errors/Last 100 failed requests.txt

@@ -0,0 +1,10 @@
+// Author: Microsoft Azure
+// Display name: Last 100 failed requests
+// Description: Get the logs of the last 100 failed requests.
+// Categories: ['resources']
+// Resource types: ['API Management services']
+// Topic: Errors
+ApiManagementGatewayLogs
+| where TimeGenerated > ago(1d)
+| where IsRequestSuccess == false
+| top 100 by TimeGenerated desc| where ResponseCode >= 400

Azure Services/API Management services/Queries/Latency/Backend latency.txt

@@ -0,0 +1,10 @@
+// Author: Microsoft Azure
+// Display name: Backend latency
+// Description: Statistics of time (in miliseconds) spent in backend IO.
+// Categories: ['resources']
+// Resource types: ['API Management services']
+// Topic: Latency
+ApiManagementGatewayLogs
+| where TimeGenerated > ago(1d)
+| summarize Average=avg(BackendTime), Median=percentile(BackendTime, 50), 90th_Percentile=percentile(BackendTime, 90) by bin(TimeGenerated, 15m) 
+| render timechart 

Azure Services/API Management services/Queries/Latency/Client latency.txt

@@ -0,0 +1,10 @@
+// Author: Microsoft Azure
+// Display name: Client latency
+// Description: Statistics of time (in miliseconds) spent in client IO.
+// Categories: ['resources']
+// Resource types: ['API Management services']
+// Topic: Latency
+ApiManagementGatewayLogs
+| where TimeGenerated > ago(1d)
+| summarize Average=avg(ClientTime), Median=percentile(ClientTime, 50), 90th_Percentile=percentile(ClientTime, 90) by bin(TimeGenerated, 15m) 
+| render timechart 

Azure Services/API Management services/Queries/Latency/Overall latency.txt

@@ -0,0 +1,10 @@
+// Author: Microsoft Azure
+// Display name: Overall latency
+// Description: Statistics of overall latency (in miliseconds) between the time API Mangement starts receiving a request and the time API Management finishes sending the response back to the client.
+// Categories: ['resources']
+// Resource types: ['API Management services']
+// Topic: Latency
+ApiManagementGatewayLogs
+| where TimeGenerated > ago(1d)
+| summarize Average=avg(TotalTime), Median=percentile(TotalTime, 50), 90th_Percentile=percentile(TotalTime, 90) by bin(TimeGenerated, 15m) 
+| render timechart 

Azure Services/API Management services/Queries/Performance/Bandwidth consumed.txt

@@ -0,0 +1,11 @@
+// Author: Microsoft Azure
+// Display name: Bandwidth consumed
+// Description: Total bandwidth consumed in the last 24 hours.
+// Categories: ['resources']
+// Resource types: ['API Management services']
+// Topic: Performance
+ApiManagementGatewayLogs
+| where TimeGenerated > ago(1d)
+| extend bandwidth = RequestSize + ResponseSize 
+| summarize sum(bandwidth) by bin(TimeGenerated, 1m), _ResourceId 
+| render timechart 

Azure Services/API Management services/Queries/README

@@ -0,0 +1 @@
+Put queries in this folder

Azure Services/API Management services/Queries/Usage/Logs of the last 100 calls.txt

@@ -0,0 +1,8 @@
+// Author: Microsoft Azure
+// Display name: Logs of the last 100 calls
+// Description: Get the logs of the most recent 100 calls in the last 24 hours.
+// Categories: ['resources']
+// Resource types: ['API Management services']
+// Topic: Usage
+ApiManagementGatewayLogs
+| top 100 by TimeGenerated desc 

Azure Services/API Management services/Queries/Usage/Number of calls by APIs.txt

@@ -0,0 +1,10 @@
+// Author: Microsoft Azure
+// Display name: Number of calls by APIs
+// Description: View the number of calls per API in the last 24 hours.
+// Categories: ['resources']
+// Resource types: ['API Management services']
+// Topic: Usage
+//Calls by API ID
+ApiManagementGatewayLogs
+| where TimeGenerated > ago(1d)
+| summarize count(CorrelationId) by ApiId

Azure Services/API Management services/Queries/Usage/Number of requests.txt

@@ -0,0 +1,10 @@
+// Author: Microsoft Azure
+// Display name: Number of requests
+// Description: Count the total number of calls across all APIs in the last 24 hours.
+// Categories: ['resources']
+// Resource types: ['API Management services']
+// Topic: Usage
+//Total number of call per resource
+ApiManagementGatewayLogs
+| where TimeGenerated > ago(1d)
+| summarize count(CorrelationId) by _ResourceId 

Azure Services/API Management services/Queries/Usage/Request sizes.txt

@@ -0,0 +1,10 @@
+// Author: Microsoft Azure
+// Display name: Request sizes
+// Description: Statistics of request sizes in the last 24 hours.
+// Categories: ['resources']
+// Resource types: ['API Management services']
+// Topic: Usage
+ApiManagementGatewayLogs
+| where TimeGenerated > ago(1d)
+| summarize Average=avg(RequestSize), Median=percentile(RequestSize, 50), 90th_Percentile=percentile(RequestSize, 90) by bin(TimeGenerated, 1m) 
+| render timechart 

Azure Services/API Management services/Queries/Usage/Response sizes.txt

@@ -0,0 +1,10 @@
+// Author: Microsoft Azure
+// Display name: Response sizes
+// Description: Statistics of response sizes in the last 24 hours.
+// Categories: ['resources']
+// Resource types: ['API Management services']
+// Topic: Usage
+ApiManagementGatewayLogs
+| where TimeGenerated > ago(1d)
+| summarize Average=avg(ResponseSize), Median=percentile(ResponseSize, 50), 90th_Percentile=percentile(ResponseSize, 90) by bin(TimeGenerated, 1m) 
+| render timechart 

Azure Services/API Management services/Workbooks/README

@@ -0,0 +1 @@
+Put workbooks in this folder

Azure Services/App Services/Alerts/README

@@ -0,0 +1 @@
+Put alerts in this folder

Azure Services/App Services/Queries/App Logs/App logs for each App Service.txt

@@ -0,0 +1,9 @@
+// Author: Microsoft Azure
+// Display name: App logs for each App Service
+// Description: Breakdown of log levels for each App Service.
+// Categories: ['resources']
+// Resource types: ['App Services']
+// Topic: App Logs
+AppServiceAppLogs 
+| project AppName = extract("(/[A-Z0-9-]+$)", 0, _ResourceId ), CustomLevel 
+| summarize count() by CustomLevel, AppName

Azure Services/App Services/Queries/App Logs/Count app logs by severity.txt

@@ -0,0 +1,9 @@
+// Author: Microsoft Azure
+// Display name: Count app logs by severity
+// Description: Bar chart of app log severities over time.
+// Categories: ['resources']
+// Resource types: ['App Services']
+// Topic: App Logs
+AppServiceAppLogs 
+| summarize count()  by CustomLevel, bin(TimeGenerated, 1h) 
+| render barchart 

Azure Services/App Services/Queries/Audit Logs/Audit Logs relating to unexpected users.txt

@@ -0,0 +1,8 @@
+// Author: Microsoft Azure
+// Display name: Audit Logs relating to unexpected users
+// Description: List Audit Logs for users who logged in that aren't a listed user.
+// Categories: ['resources']
+// Resource types: ['App Services']
+// Topic: Audit Logs
+AppServiceAuditLogs
+| where UserDisplayName != "[email protected]"

Azure Services/App Services/Queries/Audit Logs/File Audit Logs relating to a Delete operation.txt

@@ -0,0 +1,8 @@
+// Author: Microsoft Azure
+// Display name: File Audit Logs relating to a "Delete" operation
+// Description: List File Audit Logs that has a "Delete" operation.
+// Categories: ['resources']
+// Resource types: ['App Services']
+// Topic: Audit Logs
+AppServiceFileAuditLogs
+| where OperationName == "Delete"

Azure Services/App Services/Queries/Azure Metrics/Line chart of response times.txt

@@ -0,0 +1,11 @@
+// Author: Microsoft Azure
+// Display name: Line chart of response times
+// Description: Time series of mean response time (over 5 minute intervals).
+// Categories: ['resources']
+// Resource types: ['App Services']
+// Topic: Azure Metrics
+AzureMetrics 
+| extend timeBin = bin(TimeGenerated, 5m) 
+| summarize ResponseTime = sumif(Average, MetricName=="AverageResponseTime") by timeBin, bin(TimeGenerated, 1h) 
+| sort by TimeGenerated desc 
+| render timechart

Azure Services/App Services/Queries/Azure Metrics/Pie chart of HTTP response codes.txt

@@ -0,0 +1,11 @@
+// Author: Microsoft Azure
+// Display name: Pie chart of HTTP response codes
+// Description: Breakdown of response codes for each metric, over the last 12 hours.
+// Categories: ['resources']
+// Resource types: ['App Services']
+// Topic: Azure Metrics
+AzureMetrics 
+| where TimeGenerated > ago(12h)  
+| where MetricName in ("Http2xx", "Http3xx", "Http4xx", "Http5xx") 
+| summarize sum(Total) by MetricName  
+| render piechart

Azure Services/App Services/Queries/Console logs/Find console logs relating to application startup.txt

@@ -0,0 +1,8 @@
+// Author: Microsoft Azure
+// Display name: Find console logs relating to application startup
+// Description: List console logs that contain the term "starting".
+// Categories: ['resources']
+// Resource types: ['App Services']
+// Topic: Console logs
+AppServiceConsoleLogs 
+| where tolower(ResultDescription) contains "starting"

Azure Services/App Services/Queries/README

@@ -0,0 +1 @@
+Put queries in this folder

Azure Services/App Services/Workbooks/README

@@ -0,0 +1 @@
+Put workbooks in this folder

Azure Services/Application Insights/Alerts/README

@@ -0,0 +1 @@
+Put alerts in this folder

Azure Services/Application Insights/Queries/Browsing data/Page views trend.txt

@@ -0,0 +1,10 @@
+// Author: Microsoft Azure
+// Display name: Page views trend
+// Description: Chart the page views count, during the last day.
+// Categories: ['applications']
+// Resource types: ['Application Insights']
+// Topic: Browsing data
+pageViews
+| where client_Type == 'Browser'
+| summarize count_sum = sum(itemCount) by bin(timestamp,30m)
+| render timechart

Azure Services/Application Insights/Queries/Browsing data/Slowest pages.txt

@@ -0,0 +1,11 @@
+// Author: Microsoft Azure
+// Display name: Slowest pages
+// Description: What are the 3 slowest pages, and how slow are they?
+// Categories: ['applications']
+// Resource types: ['Application Insights']
+// Topic: Browsing data
+pageViews
+| where notempty(duration) and client_Type == 'Browser'
+| extend total_duration=duration*itemCount
+| summarize avg_duration=(sum(total_duration)/sum(itemCount)) by operation_Name
+| top 3 by avg_duration desc

Azure Services/Application Insights/Queries/Browsing data/Top 3 browser exceptions.txt

@@ -0,0 +1,10 @@
+// Author: Microsoft Azure
+// Display name: Top 3 browser exceptions
+// Description: What were the highest reported exceptions today?
+// Categories: ['applications']
+// Resource types: ['Application Insights']
+// Topic: Browsing data
+exceptions
+| where notempty(client_Browser) and client_Type == 'Browser'
+| summarize total_exceptions = sum(itemCount) by problemId
+| top 3 by total_exceptions desc

Azure Services/Application Insights/Queries/Performance/Operations performance.txt

@@ -0,0 +1,9 @@
+// Author: Microsoft Azure
+// Display name: Operations performance
+// Description: Calculate request count and duration by operations.
+// Categories: ['applications']
+// Resource types: ['Application Insights']
+// Topic: Performance
+requests
+| summarize RequestsCount=sum(itemCount), AverageDuration=avg(duration), percentiles(duration, 50, 95, 99) by operation_Name // you can replace 'operation_Name' with another value to segment by a different property
+| order by RequestsCount desc // order from highest to lower (descending)

Azure Services/Application Insights/Queries/Performance/Request count trend.txt

@@ -0,0 +1,9 @@
+// Author: Microsoft Azure
+// Display name: Request count trend
+// Description: Chart Request count over the last day.
+// Categories: ['applications']
+// Resource types: ['Application Insights']
+// Topic: Performance
+requests
+| summarize totalCount=sum(itemCount) by bin(timestamp, 30m)
+| render timechart

Azure Services/Application Insights/Queries/Performance/Response time buckets.txt

@@ -0,0 +1,11 @@
+// Author: Microsoft Azure
+// Display name: Response time buckets
+// Description: Show how many requests are in each performance-bucket.
+// Categories: ['applications']
+// Resource types: ['Application Insights']
+// Topic: Performance
+requests
+| summarize requestCount=sum(itemCount), avgDuration=avg(duration) by performanceBucket
+| order by avgDuration asc // sort by average request duration
+| project-away avgDuration // no need to display avgDuration, we used it only for sorting results
+| render barchart

Azure Services/Application Insights/Queries/Performance/Response time trend.txt

@@ -0,0 +1,10 @@
+// Author: Microsoft Azure
+// Display name: Response time trend
+// Description: Chart request duration over the last 12 hours.
+// Categories: ['applications']
+// Resource types: ['Application Insights']
+// Topic: Performance
+requests
+| where timestamp > ago(12h) 
+| summarize avgRequestDuration=avg(duration) by bin(timestamp, 10m) // use a time grain of 10 minutes
+| render timechart

Azure Services/Application Insights/Queries/Performance/Top 10 countries by traffic.txt

@@ -0,0 +1,10 @@
+// Author: Microsoft Azure
+// Display name: Top 10 countries by traffic
+// Description: Chart the amount of requests from the top 10 countries.
+// Categories: ['applications']
+// Resource types: ['Application Insights']
+// Topic: Performance
+requests
+| summarize CountByCountry=count() by client_CountryOrRegion
+| top 10 by CountByCountry
+| render piechart

Azure Services/Application Insights/Queries/README

@@ -0,0 +1 @@
+Put queries in this folder

Azure Services/Application Insights/Queries/Reports failures/Exceptions causing request failures.txt

@@ -0,0 +1,13 @@
+// Author: Microsoft Azure
+// Display name: Exceptions causing request failures
+// Description: Find which exceptions led to failed requests in the past hour.
+// Categories: ['applications']
+// Resource types: ['Application Insights']
+// Topic: Reports failures
+requests
+| where timestamp > ago(1h) and success == false
+| join kind= inner (
+exceptions
+| where timestamp > ago(1h)
+) on operation_Id
+| project exceptionType = type, failedMethod = method, requestName = name, requestDuration = duration