Azure Functon: Azure Monitor captures 401 and Application Insights does not.

Question

question

BrandonBoone-1932 asked Feb 17, '22 AnuragSingh-MSFT commented Feb 21, '22

Azure Functon: Azure Monitor captures 401 and Application Insights does not.

I'm using Azure functions and Application Insights together (C# .NET Core 3.1). When passing an incorrect function key value, using the x-functions-key header, a 401 is returned as expected, however, this is not logged in Application Insights and only shows in Azure Monitor. All other requests after authentication are logged as expected (500, 200, etc.). As I primarily use Application Insights for setting up alerts and notifications, is there a way to have the 401s logged there as well or will I need to do this separately in Azure Monitor?

azure-functions azure-monitor

5 |1600 characters needed characters left characters exceeded

Attachments: Up to 10 attachments (including images) can be used with a maximum of 3.0 MiB each and 30.0 MiB total.

Answer 1 · 2022-02-18T10:54:01.953Z

AnuragSingh-MSFT answered Feb 18, '22 AnuragSingh-MSFT commented Feb 21, '22

Hi @BrandonBoone-1932,

Welcome to Microsoft Q&A! Thanks for posting the question.

I see that you are trying to get the 401 errors to log in Azure Application Insights to take reactive measures based on it. Please note that 401 (and other 4XX) errors fall under Client error category, i.e., it indicates that the error has occurred, and the client browser/application appears to be at fault (in current case, the client has supplied the incorrect function key).

In case you would like to track these errors as well, you can use:
Client Side monitoring, if the request comes from a web page, OR
ApplicationInsights SDK for tracking them from your application.

Please let us know if you have any questions.

Please 'Accept as answer' if it helped so that it can help others in the community looking for help on similar topics.

· 2

5 |1600 characters needed characters left characters exceeded

Attachments: Up to 10 attachments (including images) can be used with a maximum of 3.0 MiB each and 30.0 MiB total.

BrandonBoone-1932 · Feb 18 at 01:48 PM

@AnuragSingh-MSFT thank you for the information.

As I'm already integrated with ApplicationInsights within my Function App and successfully tracking various events, my question is more on how to capture the 401 events themselves and forward them onto ApplicationInsights. I understand that that cause of a 401 originates from the client, but the server is what is returning 401s in response to a failed authentication attempt. It is important to me to track these failed authentication attempts for the propose of monitoring the activities of potentially bad actors. I also know Azure is capturing them as they do appear in the Monitor section (Monitoring -> Metrics) of my Function App in the Azure Portal.

It seems like authorization via the x-functions-key header is taking place before my function is actually invoked as this feature is managed and controlled by Azure itself within the Azure Portal as part the Function App, and seemingly not within my Function's code / setup, etc. but this is just a guess on my part.

I know I can also implement my own custom Authentication/Authorization within the Function App which would achieve my goal as well, but I would like to avoid this if at all possible.

0 ·

AnuragSingh-MSFT BrandonBoone-1932 · Feb 21 at 09:48 AM

@BrandonBoone-1932, thank you for the reply. The Azure Metric being collected can also be forwarded to the same Log Analytics workspace, which is also the workspace for the Application Insight resource. This can be done by using the Diagnostic Settings option under the Azure Function's Monitoring. This can be queried in Log Analytics workspace from AzureMetrics table. Ref: Diagnostic Settings to send metrics and logs.

However, this may introduce further delay between the counter values (here HTTP 401) being reported and they appearing in the workspace. Since your main requirement is to be alerted for these errors, I would suggest using Alert rule based on Azure Metric as shown below:

Please refer to Create, view, and manage metric alerts using Azure Monitor for mode details.

Please 'Accept as answer' if it helped so that it can help others in the community looking for help on similar topics.

1 ·

image.png (38.9 KiB)

question