KQL Search

Query Details

APIM AI Gateway - Availability pressure by caller

APIM Availability Pressure

Query

AppRequests
| where SDKVersion startswith "apim:" or tostring(Properties["Service Type"]) =~ "API Management"
| extend Caller=coalesce(UserAuthenticatedId, UserId, ClientIP, "unknown"), APIName=tostring(Properties["API Name"]), Code=toint(ResultCode)
| summarize TotalRequests=count(), Throttled=countif(Code == 429), ServerErrors=countif(Code between (500 .. 599)), Timeouts=countif(Code in (408, 504)), FirstSeen=min(TimeGenerated), LastSeen=max(TimeGenerated), Models=make_set(tostring(Properties["Backend Method"]), 10) by bin(TimeGenerated, 5m), Caller, APIName, Name
| extend PressureEvents=Throttled + ServerErrors, FailureRate=round(100.0 * todouble(Throttled + ServerErrors) / todouble(TotalRequests), 2)
| where Throttled >= 10 or ServerErrors >= 10 or (TotalRequests >= 20 and FailureRate >= 70.0)
| extend Signal=case(ServerErrors >= 10, "BACKEND AVAILABILITY IMPACT", Throttled >= 10, "RATE OR TOKEN LIMIT PRESSURE", "HIGH FAILURE CONCENTRATION")
| project TimeGenerated, Signal, Caller, APIName, Name, TotalRequests, Throttled, ServerErrors, Timeouts, FailureRate, Models, FirstSeen, LastSeen
| order by TimeGenerated desc

Explanation

This query is designed to monitor and detect issues related to the availability and performance of an API Management (APIM) AI Gateway. Here's a simplified breakdown of what it does:

  1. Purpose: It identifies situations where a single caller is causing a high number of throttling events (HTTP 429 errors) or server errors (HTTP 5xx errors) within a five-minute window. This could indicate issues like exceeding rate limits or backend server problems.

  2. Data Source: The query uses data from Application Insights, specifically focusing on application requests (AppRequests).

  3. Frequency and Duration: The query runs every 15 minutes and looks at data from the past hour.

  4. Detection Logic:

    • It filters requests related to API Management.
    • It groups the data by caller and API name, summarizing the number of total requests, throttled requests, server errors, and timeouts.
    • It calculates the failure rate and identifies if there are significant issues based on predefined thresholds (e.g., at least 10 throttled or server errors, or a failure rate of 70% or more with at least 20 total requests).

  5. Alerts: If the conditions are met, it generates an alert indicating the type of issue:

    • "BACKEND AVAILABILITY IMPACT" for server errors.
    • "RATE OR TOKEN LIMIT PRESSURE" for throttling.
    • "HIGH FAILURE CONCENTRATION" for a high failure rate.

  6. Output: The query outputs details like the time of the event, type of signal, caller, API name, and various metrics related to the requests.

  7. Incident Management: If an alert is triggered, it creates an incident and groups related alerts to manage them effectively.

  8. Severity and Tactics: The severity level is set to Medium, and it is associated with the "Impact" tactic, referencing a specific technique (T1499) related to denial of service.

Overall, this query helps in proactively identifying and managing potential issues with API availability and performance, allowing for timely investigation and resolution.