Skip to content

Repeated Startup Attempts

Scenario: Suspected start/fail loop where the container repeatedly attempts startup. Data Source: AppServicePlatformLogs Purpose: Shows start/stop/fail operation sequences to detect rapid startup cycling.

graph TD
    A[AppServicePlatformLogs] -->|OperationName Filter| B[start / stop / fail Events]
    B --> C[Sequence by ContainerId]
    C --> D[Detect Startup Loop]

Run It in the Portal

Tighten the blade-level Time range to Last 6 hours so it matches the ago(6h) filter inside the query. The query projects TimeGenerated, OperationName, and ContainerId, so scan the ContainerId column to see whether a rapid loop is producing a new container each cycle or reusing one.

Query

AppServicePlatformLogs
| where TimeGenerated > ago(6h)
| where OperationName has_any ("start", "Start", "stop", "Stop", "fail", "Fail")
| project TimeGenerated, OperationName, ContainerId
| order by TimeGenerated desc

Interpretation Notes

  • Normal: start events are infrequent and not followed by immediate fail/stop patterns.
  • Abnormal: repeated start -> fail/stop loops within short intervals.
  • Reading tip: check whether ContainerId changes each cycle (new container attempts) or remains constant.

Limitations

  • Ingestion delay can make rapid loops appear incomplete in near-real-time.
  • Keyword matching may include non-startup operations that contain similar text.
  • This query cannot show application stack traces causing the failure loop.

See Also

Sources