During an outage, analysts must find Function failures tied to one Cosmos partition for the health records assistant. What should they use?

During an outage, analysts who must find Function failures tied to one Cosmos partition for the health records assistant should write a KQL query that correlates Function failure telemetry with the specific Cosmos partition. Typical patterns join or filter requests/exceptions/dependencies with Cosmos diagnostics or custom dimensions carrying partition key range ids, status codes (such as 429), and operation names. Correlation turns a vague ‘Functions are failing’ municipal incident into evidence about one hot partition impacting health-record retrieval.

Guessing the failing partition from memory without querying telemetry fails rigor—outages need query evidence, not recollection. Restarting every Function in the subscription before inspecting any logs fails as first response: it adds downtime, destroys in-memory clues, and may not fix a Cosmos partition bottleneck at all. Deleting the Log Analytics workspace to clear noisy failure records fails catastrophically—it erases the forensic data required to locate the partition and violates operational discipline.

Exam caveat: correlation depends on the right fields being logged—ensure Cosmos dependency telemetry or custom properties include partition identifiers; otherwise KQL cannot group what was never emitted. Distinguish throttling (429/RU) from authorization failures and from Function code exceptions that only happen to call Cosmos. Time windows and operation ids further tighten joins.

Operational check: reproduce a partition-hot failure in staging, run KQL grouping Function exceptions by Cosmos partition or dependency target, confirm the suspected partition rises above others, then validate remediation (scale RU, rewrite query, split partition key) against a follow-up query showing reduced failures.