Implement an instrumentation strategy
Telemetry Analysis and KQL
CoreUse resource metrics, application telemetry, distributed traces, and basic KQL to isolate performance and reliability changes with the right time, dimension, and correlation scope.
Aligned to AZ-400 skills measured as of July 27, 2026; guide and product behavior verified September 25, 2026.
Why this matters
One average or one error record rarely proves cause. Expert analysis aligns time windows, release markers, instance dimensions, request context, dependency spans, and resource saturation.
Must Know
- Inspect CPU, memory, disk latency and throughput, and network rate or errors together; the constrained resource might not be CPU.
- Application usage and performance analysis should segment by operation, result, region, version, instance, and time when those dimensions can change the conclusion.
- Application Insights distributed tracing follows correlated requests and dependencies across instrumented services.
- Broken trace continuity commonly points to missing instrumentation, incompatible context propagation, sampling, or an uninstrumented hop.
- A basic KQL query starts with a scoped table, uses `where` to filter, `summarize` for aggregation, `bin()` for time buckets, `project` for columns, and `sort` or `top` for order.
- KQL identifiers and string comparison behavior matter; table-first queries are normally clearer and more efficient than broad search.
- Correlate telemetry with deployment identifiers before attributing a change to a release.
Compare and Distinguish
- `where` filters rows; `project` selects or creates columns; `summarize` aggregates rows; `extend` adds calculated columns while retaining existing ones.
- `take` returns an arbitrary sample; `top` returns ordered highest or lowest values.
- A metric alert evaluates a numeric series; a log query can correlate richer event records.
Scenario examples
- Scenario: Latency rises while CPU is low. Think: compare memory, disk, network, dependency, and per-instance signals in the same window.
- Scenario: Find hourly average memory by computer. Think: filter the performance counter and summarize average by computer and one-hour bin.
Exam traps
- A global average can hide one failing region or instance.
- `take 10` does not mean the latest ten records.
- A trace cannot cross a service that does not propagate compatible context.
Key takeaways
- Match the query operator to the analytical question.
- Preserve dimensions until you know they do not affect the result.
- Use traces for causality paths and metrics for trend and alert efficiency.
How it works
- KQL transforms tabular telemetry in pipeline order, normally narrowing time and rows before grouping or projecting the output.
- Application Insights records requests and dependencies with operation identifiers that reconstruct the end-to-end transaction view.
Objects and administrative surfaces
- Azure Monitor Metrics Explorer, Log Analytics, KQL mode, workbooks, alert rules, and resource Insights.
- Application Insights application map, transaction search, failures, performance, users, sessions, and end-to-end transaction details.
When to use it
- Use distributed tracing when a user operation crosses service boundaries and aggregate metrics cannot identify the slow dependency.
Security and governance implications
- Limit access to detailed logs, avoid sensitive dimensions, and retain only the telemetry needed for operational and audit purposes.
Troubleshooting signals
- For an empty KQL result, validate table, time field, ingestion range, case-sensitive values, data type, and each pipe one step at a time.
More detail
- Compare CPU, memory, disk, and network evidence over the same interval before assigning infrastructure cause.
- Use KQL where to filter rows, summarize with bin for time aggregation, order or top for ranking, and project for final columns.
- Verify trace-context injection, extraction, instrumentation compatibility, and sampling when a transaction splits across services.
Ready for the quiz?
- Which KQL operator selects output columns?
- How do you create hourly buckets?
- What evidence identifies one slow downstream dependency?
Related objectives
- D5.2.S1 — Inspect infrastructure performance indicators, including CPU, memory, disk, and network
- D5.2.S2 — Analyze metrics by using collected telemetry, including usage and application performance
- D5.2.S3 — Inspect distributed tracing by using Azure Monitor Application Insights
- D5.2.S4 — Interrogate logs using basic Kusto Query Language (KQL) queries