I'm using Azure functions and Application Insights together (C# .NET Core 3.1). When passing an incorrect function key value, using the x-functions-key header, a 401 is returned as expected, however, this is not logged in Application Insights and only shows in Azure Monitor. All other requests after authentication are logged as expected (500, 200, etc.). As I primarily use Application Insights for setting up alerts and notifications, is there a way to have the 401s logged there as well or will I need to do this separately in Azure Monitor?

Hi @Brandon Boone , Welcome to Microsoft Q&A! Thanks for posting the question. I see that you are trying to get the 401 errors to log in Azure Application Insights to take reactive measures based on it. Please note that 401 (and other 4XX) errors fall under Client error category, i.e., it indicates that the error has occurred, and the client browser/application appears to be at fault ( in current case, the client has supplied the incorrect function key ). In case you would like to track these errors as well, you can use: Client Side monitoring , if the request comes from a web page, OR ApplicationInsights SDK for tracking them from your application. Please let us know if you have any questions. --- Please 'Accept as answer' if it helped so that it can help others in the community looking for help on similar topics.

Azure Functon: Azure Monitor captures 401 and Application Insights does not.

Accepted answer

AnuragSingh-MSFT 21,361 Reputation points

2022-02-18T10:54:01.953+00:00

Hi @Brandon Boone ,

Welcome to Microsoft Q&A! Thanks for posting the question.

I see that you are trying to get the 401 errors to log in Azure Application Insights to take reactive measures based on it. Please note that 401 (and other 4XX) errors fall under Client error category, i.e., it indicates that the error has occurred, and the client browser/application appears to be at fault (in current case, the client has supplied the incorrect function key).

In case you would like to track these errors as well, you can use:
Client Side monitoring, if the request comes from a web page, OR
ApplicationInsights SDK for tracking them from your application.

Please let us know if you have any questions.

---
Please 'Accept as answer' if it helped so that it can help others in the community looking for help on similar topics.
Please sign in to rate this answer.
Brandon Boone 31 Reputation points

2022-02-18T13:48:37.237+00:00

@AnuragSingh-MSFT thank you for the information.

As I'm already integrated with ApplicationInsights within my Function App and successfully tracking various events, my question is more on how to capture the 401 events themselves and forward them onto ApplicationInsights. I understand that that cause of a 401 originates from the client, but the server is what is returning 401s in response to a failed authentication attempt. It is important to me to track these failed authentication attempts for the propose of monitoring the activities of potentially bad actors. I also know Azure is capturing them as they do appear in the Monitor section (Monitoring -> Metrics) of my Function App in the Azure Portal.

It seems like authorization via the x-functions-key header is taking place before my function is actually invoked as this feature is managed and controlled by Azure itself within the Azure Portal as part the Function App, and seemingly not within my Function's code / setup, etc. but this is just a guess on my part.

I know I can also implement my own custom Authentication/Authorization within the Function App which would achieve my goal as well, but I would like to avoid this if at all possible.

AnuragSingh-MSFT 21,361 Reputation points

2022-02-21T09:48:25.857+00:00

@Brandon Boone , thank you for the reply. The Azure Metric being collected can also be forwarded to the same Log Analytics workspace, which is also the workspace for the Application Insight resource. This can be done by using the Diagnostic Settings option under the Azure Function's Monitoring. This can be queried in Log Analytics workspace from AzureMetrics table. Ref: Diagnostic Settings to send metrics and logs.

However, this may introduce further delay between the counter values (here HTTP 401) being reported and they appearing in the workspace. Since your main requirement is to be alerted for these errors, I would suggest using Alert rule based on Azure Metric as shown below:

Please refer to Create, view, and manage metric alerts using Azure Monitor for mode details.

---
Please 'Accept as answer' if it helped so that it can help others in the community looking for help on similar topics.
Sign in to comment

Use comments to ask for clarification, additional information, or improvements to the question.

Share via

Azure Functon: Azure Monitor captures 401 and Application Insights does not.

0 additional answers

Your answer