Skip to content

Restarts vs Latency

Scenario: Determine whether restart events align with latency degradation windows. Data Source: AppServiceHTTPLogs and AppServicePlatformLogs Purpose: Combines latency and restart-event signals in a single timeline using union.

graph TD
    A[AppServiceHTTPLogs] --> B[Avg Latency Series]
    C[AppServicePlatformLogs] --> D[Restart Count Series]
    B --> E[Union Timechart]
    D --> E

Run It in the Portal

The query builds LatencySeries and RestartSeries with let, unions them, and renders a single timechart. Set the blade-level Time range to a six-hour window so it matches the ago(6h) filter in each subquery; otherwise the bin(TimeGenerated, 5m) bucketing spans a wider range than the interpretation notes assume.

Query

let LatencySeries =
    AppServiceHTTPLogs
    | where TimeGenerated > ago(6h)
    | summarize Value=avg(TimeTaken) by bin(TimeGenerated, 5m)
    | project TimeGenerated, Metric="AvgLatencyMs", Value=todouble(Value);
let RestartSeries =
    AppServicePlatformLogs
    | where TimeGenerated > ago(6h)
    | where OperationName has_any ("restart", "Restart", "ContainerRestart")
    | summarize Value=count() by bin(TimeGenerated, 5m)
    | project TimeGenerated, Metric="RestartEvents", Value=todouble(Value);
union LatencySeries, RestartSeries
| order by TimeGenerated asc
| render timechart

Interpretation Notes

  • Normal: restart events are rare and latency remains stable before/after isolated events.
  • Abnormal: restart-event bins coincide with or immediately precede sustained latency increases.
  • Reading tip: treat repeated restart-event clusters with simultaneous latency rise as strong instability signal.

Limitations

  • Metric scales differ (milliseconds vs event counts) and may require separate visualization for precision.
  • Near-real-time ingestion delays can briefly misalign restart and latency points.
  • This query cannot prove causation; correlated events may share a third underlying cause.

See Also

Sources