Viewing Azure FrontDoor logs for error responses

Question

When I query Frontdoor logs, I see only logs with http status 200 eventhough I had made requests resulting in http status 400 and message of the kind:
"Our services aren't available right now. We're working to restore all services as soon as possible. Please check back soon."
To able to view the failed requests, does my query below need modification?

Answer 1

Hello @KMW-2262 ,

Welcome to Microsoft Q&A Platform. Thank you for reaching out & hope you are doing well.

When you open Azure Monitor Log Analytics, you have access to existing log queries.
https://learn.microsoft.com/en-us/azure/azure-monitor/logs/queries#queries-dialog

For Request errors by host and path, you can run the below existing log query:

AzureDiagnostics
| where ResourceProvider == "MICROSOFT.NETWORK" and Category == "FrontdoorAccessLog"
| where isReceivedFromClient_b == true
| where toint(httpStatusCode_s) >= 400
| extend ParsedUrl = parseurl(requestUri_s)
| summarize RequestCount = count() by Host = tostring(ParsedUrl.Host), Path = tostring(ParsedUrl.Path), StatusCode = httpStatusCode_s, ResourceId
| order by RequestCount desc

Screenshot of the example query from log analytics:

NOTE : Raw logs include logs generated from both CDN edge (child POP) and origin shield. To differentiate the egress or responses from the edge nodes vs. origin shield, you can use the field isReceivedFromClient to get the correct data.
Refer : https://learn.microsoft.com/en-us/azure/frontdoor/front-door-diagnostics#sent-to-origin-shield-deprecation

Kindly let us know if the above helps or you need further assistance on this issue.

----------------------------------------------------------------------------------------------------------------

Please "Accept the answer" if the information helped you. This will help us and others in the community as well.

Answer 2

I have the same results (http 200 only) from both scopes ( frontdoor and log analytics workspace to which I send logs). Is any additional configuration required to see logs for http 4xx responses?

Frontdoor logs for last 24h without any 'where' filter (http 4xx not seen):

Diagnostic settings for frontdoor:

Logs in log analytics workspace for last 24h without any 'where' filter (http 4xx not seen):