AZ-400 Question 306
Single answerYou have configured an Azure DevOps pipeline to send logs to an Azure Log Analytics workspace. The pipeline logs are stored in a table named 'PipelineLogs' with the following columns: 'StageName', 'Result', and 'TimeGenerated'. You need to determine how many pipeline runs failed in each stage over the past 24 hours. Which of the following KQL queries should you use to meet this requirement?
- A
PipelineLogs | where TimeGenerated > ago(24d) | summarize CountOfFailures = count() by StageName | where Result == "Failed"
- B
PipelineLogs | where Result == "Failed" | summarize count() by StageName | take 24
- C
PipelineLogs | where TimeGenerated > ago(24h) | where Result == "Failed" | summarize CountOfFailures = count() by StageName
- D
PipelineLogs | summarize CountOfFailures = countif(Result == "Failed") | where TimeGenerated > ago(24h)
Show answer and explanation
Correct answer: C
Explanation
When querying logs with KQL, you should filter for relevant records (date/time window and failure condition) before using summarize. In this scenario, the correct approach is to (1) filter out records older than 24 hours, (2) filter by 'Result == Failed', and then (3) group by 'StageName' with count(). Option 3 follows these best practices, aligning with official Azure Monitor Logs guidance (Microsoft Docs: https://docs.microsoft.com/azure/azure-monitor/logs/log-query-overview).
- A. Incorrect.
Option 1 filters on the correct table but uses 'ago(24d)' instead of 'ago(24h)' and applies the 'Failed' filter after summarizing, which may include non-failed runs in intermediate steps. The time range is also incorrect (days instead of hours).
- B. Incorrect.
Option 2 filters by failing runs but does not limit the data to the last 24 hours. Using 'take 24' only returns the first 24 rows, not the rows from the last 24 hours, which does not fulfill the requirement to group by stage over the past 24 hours.
- C. Correct.
Option 3 correctly filters by 'TimeGenerated > ago(24h)', filters on 'Result == Failed', and then summarizes the results by stage, giving a count of failed runs for each stage in the last 24 hours.
- D. Incorrect.
Option 4 uses the 'countif' function but attempts to filter by time after summarizing. This can result in an incorrect aggregation because it doesn't properly filter events to the last 24 hours before counting failures. The filter on 'TimeGenerated' needs to occur before the 'summarize' operator.