Log-analytics
From Ilianko
← Back to DP-420 Terminology Reference
Category: Maintenance & Security
Overview
It can save data in:
| Table | Purpose | When to Use | DP-420 Keywords |
| -------------------------------- | ------------------------------------------ | ---------------------------------- | --------------------------------------------------------- |
| **CDBDataPlaneRequests** | Individual requests made against Cosmos DB | Troubleshoot specific operations | Request charge, latency, 429, point read, query |
| **CDBDataPlaneRequests5M** | Aggregated metrics over 5-minute windows | Trend analysis and dashboards | Throughput trends, average latency, request counts |
| **CDBPartitionKeyRUConsumption** | RU consumption per partition key | Find hot partitions | Hot partition, skewed workload, RU distribution |
| **CDBPartitionKeyStatistics** | Statistics about partition key usage | Analyze partitioning effectiveness | Partition cardinality, partition growth, partition design |
| **CDBQueryRuntimeStatistics** | Query execution details | Optimize queries | Index utilization, query performance, scans |
- Send to Log Analytics workspace
- Send to storage account
- Send to event hub
- Send to another Azure Monitor log
- Send to Azure
More Info & Links
- Microsoft Learn: Tutorial - Write KQL queries to monitor Azure Cosmos DB
- Microsoft Learn: Overview of Kusto Query Language (KQL)
- Microsoft Learn: Monitor and troubleshoot Azure Cosmos DB using diagnostic logs
DP-420 Style Practice Questions
Q1. What is the primary role of KQL (Kusto Query Language) in Azure Cosmos DB operations and troubleshooting?
- A. Querying and analyzing diagnostic logs and metrics in Azure Monitor Log Analytics to troubleshoot issues like throttling, hot partitions, and expensive queries
- B. Defining server-side stored procedures and triggers directly in Cosmos DB containers
- C. Querying JSON documents via the Cosmos DB API for NoSQL endpoint
- D. Creating and managing Cosmos DB indexing policies declaratively
Q2. In a KQL query for Azure Cosmos DB logs, what does the pipe (|) operator represent?
- A. It pipes the tabular output of the preceding operator as the input to the next operator in a data-flow pipeline
- B. It performs a logical bitwise OR between two numeric fields
- C. It defines a primary key constraint on the diagnostic table
- D. It separates alternative partition key values in a point read
Q3. Which resource-specific table would you query using KQL to inspect RU charges and HTTP status codes for individual data operations?
- A. CDBDataPlaneRequests
- B. CDBControlPlaneRequests
- C. CDBPartitionKeyStatistics
- D. AzureMetrics
Answer Key
Answers are listed at the very end so you can attempt the questions first.
- Q1 (KQL (Kusto Query Language)): A. Querying and analyzing diagnostic logs and metrics in Azure Monitor Log Analytics to troubleshoot issues like throttling, hot partitions, and expensive queries — KQL is the read-only query language for Azure Monitor Log Analytics used to analyze diagnostic logs like CDBDataPlaneRequests and CDBPartitionKeyRUConsumption.
- Q2 (KQL (Kusto Query Language)): A. It pipes the tabular output of the preceding operator as the input to the next operator in a data-flow pipeline — KQL uses the pipe (|) operator to pass data sequentially from one tabular expression/operator to another (e.g., filtering with where, then aggregating with summarize).
- Q3 (KQL (Kusto Query Language)): A. CDBDataPlaneRequests — CDBDataPlaneRequests logs individual data-plane operations along with RequestCharge, StatusCode, DurationMs, and ActivityId.
DP-420: Designing and Implementing Cloud-Native Applications Using Microsoft Azure Cosmos DB — term detail page
