Azure Storage Throttling Investigation Queries

README.md

Azure Storage Throttling Investigation Queries

This gist contains a set of Kusto queries designed to help investigate issues related to throttling in Azure Storage. By leveraging data from Log Analytics, these queries provide insights into file reads, operations, and potential throttling patterns observed in Azure Storage accounts.

count_of_readfile_operations_by_path.kql

StorageBlobLogs
| where TimeGenerated between (ago(6h) .. now())
| where OperationName == "ReadFile"
| extend UriPathParts = split(parse_url(Uri).Path, "/")
| extend ContainerName = tostring(UriPathParts[1]),
         path_part_1 = tostring(UriPathParts[2]),
         path_part_2 = tostring(UriPathParts[3]),
         path_part_3 = tostring(UriPathParts[4]),
         path_part_4 = iff(UriPathParts[5] contains "%3D" or UriPathParts[5] contains "_", "", tostring(UriPathParts[5])),
         path_part_5 = iff(UriPathParts[6] contains "%3D" or UriPathParts[6] contains "_", "", tostring(UriPathParts[6])),
         path_part_6 = iff(UriPathParts[7] contains "%3D" or UriPathParts[7] contains "_", "", tostring(UriPathParts[7])),
         path_part_7 = iff(UriPathParts[8] contains "%3D" or UriPathParts[8] contains "_", "", tostring(UriPathParts[8])),
         path_part_8 = iff(UriPathParts[9] contains "%3D" or UriPathParts[9] contains "_", "", tostring(UriPathParts[9])),
         path_part_9 = iff(UriPathParts[10] contains "%3D" or UriPathParts[10] contains "_", "", tostring(UriPathParts[10])),
         path_part_10 = iff(UriPathParts[11] contains "%3D" or UriPathParts[11] contains "_", "", tostring(UriPathParts[11]))
| extend TablePath = strcat("/", coalesce(path_part_1, ""), 
                                    iff(path_part_2 != "", strcat("/", path_part_2), ""),
                                    iff(path_part_3 != "", strcat("/", path_part_3), ""),
                                    iff(path_part_4 != "", strcat("/", path_part_4), ""),
                                    iff(path_part_5 != "", strcat("/", path_part_5), ""),
                                    iff(path_part_6 != "", strcat("/", path_part_6), ""),
                                    iff(path_part_7 != "", strcat("/", path_part_7), ""),
                                    iff(path_part_8 != "", strcat("/", path_part_8), ""),
                                    iff(path_part_9 != "", strcat("/", path_part_9), ""),
                                    iff(path_part_10 != "", strcat("/", path_part_10), ""))
| summarize TotalOperations = count() by ContainerName, TablePath, OperationName, StatusText
| order by TotalOperations desc
| limit 50