2

I want to get a list of all requests that are taking longer then 2 seconds and I think this is correct as the timeTaken_d appears to be a floating point and would seem to be in seconds.

AzureDiagnostics
| where ResourceType == "APPLICATIONGATEWAYS" and OperationName == "ApplicationGatewayAccess" and timeTaken_d  > 2
| project TimeGenerated, host_s, requestUri_s, httpStatus_d, backendPoolName_s, serverRouted_s, timeTaken_d 
| order by TimeGenerated desc

However, I have seen elsewhere that this measure is in milliseconds.

Does anyone know for sure? Better still, can someone point me at the docs?

tshepang
  • 377
  • 2
  • 12
Mark
  • 189
  • 6

3 Answers3

1

It's in milliseconds, as per this document.

timeTaken: Length of time (in milliseconds) that it takes for a request to be processed and its response to be sent. This is calculated as the interval from the time when Application Gateway receives the first byte of an HTTP request to the time when the response send operation finishes. It's important to note that the Time-Taken field usually includes the time that the request and response packets are traveling over the network.

Sam Cogan
  • 38,736
  • 6
  • 78
  • 114
  • Thing is... this is not what we're actually seeing for timeTaken_d when compared to the IIS logs - we're seeing floating values which are much nearer seconds - e.g. 2.34 from azure and >2000 in IIS logs for seemingly same request - although it's hard to tie it down 100% One thing is for sure... if Azure if reporting milliseconds then it's not at all representative of the time IIS thinks it's taking to serve requests. – Mark Jun 17 '21 at 14:22
1

I had the same question as Mark and found the documentation provided by Sam helpful. However I wanted to point out that timeTaken_d is reported in different units for WAF_v1 (milliseconds) and WAF_v2 (seconds). In Azure Portal you can see what tier you're on by looking at the Configuration section of your Application Gateway.

https://docs.microsoft.com/en-us/azure/application-gateway/application-gateway-diagnostics#for-application-gateway-and-waf-v2-sku

Alex
  • 11
  • 2
0

The time in timeTaken_d field is measured in milliseconds.

The requested info is under "analyzing the Logs" section in below document -

https://cbeveridge.co.uk/2020/03/07/troubleshooting-azure-gateway-web-application-firewall-waf-logs/

Anant Swaraj
  • 169
  • 4
  • In that article it looks to be milliseconds.... however we're seeing (for IIS requests), floating point numbers which are much closer to IIS's own log number / 1000 – Mark Jun 17 '21 at 14:24