I want to get a list of all requests that are taking longer then 2 seconds and I think this is correct as the timeTaken_d
appears to be a floating point and would seem to be in seconds.
AzureDiagnostics
| where ResourceType == "APPLICATIONGATEWAYS" and OperationName == "ApplicationGatewayAccess" and timeTaken_d > 2
| project TimeGenerated, host_s, requestUri_s, httpStatus_d, backendPoolName_s, serverRouted_s, timeTaken_d
| order by TimeGenerated desc
However, I have seen elsewhere that this measure is in milliseconds.
Does anyone know for sure? Better still, can someone point me at the docs?
It's in milliseconds, as per this document.
The time in timeTaken_d field is measured in milliseconds.
The requested info is under "analyzing the Logs" section in below document -
https://cbeveridge.co.uk/2020/03/07/troubleshooting-azure-gateway-web-application-firewall-waf-logs/
I had the same question as Mark and found the documentation provided by Sam helpful. However I wanted to point out that timeTaken_d is reported in different units for WAF_v1 (milliseconds) and WAF_v2 (seconds). In Azure Portal you can see what tier you're on by looking at the Configuration section of your Application Gateway.
https://docs.microsoft.com/en-us/azure/application-gateway/application-gateway-diagnostics#for-application-gateway-and-waf-v2-sku