Microsoft Azure – Application Gateway Incoming Access Logs

Pre-requisites: Introduction to Microsoft Azure | A cloud computing service

In this article, you will be learning about how to fetch the requests of azure application gateway incoming access logs using azure Kusto query language (KQL). Here in this article, we will be finding the requests of app gateway errors, Non-SSL requests on the Application Gateway, and also the incoming requests of Client IPs, Source Ports, Upstream Source Ports, sent and received bytes, etc.

Implementations:

Step 1. Open Azure Portal and Access Application Gateway 

Step 2. Select your Target Application Gateway which you want to monitor the application traffic logs

Step 3. After you access your application gateway navigate to logs and run the below mentioned KQL log queries to monitor the Incoming Access Logs.

Example 1: Find requests to which Application Gateway responded with an error. 

AzureDiagnostics
| where ResourceType == "APPLICATIONGATEWAYS" 
        and OperationName == "ApplicationGatewayAccess" 
        and httpStatus_d > 399

Output:

this query returns the requests to which Application Gateway responded with an error.

Example 2: Find Non-SSL requests on the Application Gateway.

AzureDiagnostics
| where ResourceType == "APPLICATIONGATEWAYS" 
        and OperationName == "ApplicationGatewayAccess" 
        and sslEnabled_s == "off"

this query returns the Non-SSL requests on the Application Gateway.  

Example 3: Fetch incoming requests on the Application Gateway.

AzureDiagnostics
| where ResourceType == "APPLICATIONGATEWAYS" 
        and OperationName == "ApplicationGatewayAccess"

Output:

this query returns the overall incoming requests on the Application Gateway for the select time.