Event Grid–triggered Functions for emergency notifications show intermittent failures. What should KQL highlight first?

When Event Grid–triggered Functions for emergency notifications show intermittent failures, the first KQL priority is to make the failure mode obvious: highlight an anomalous spike in 5xx responses from the Function over a short time window. Emergency notification paths are latency- and reliability-sensitive; a burst of server errors is the clearest signal that the Function path—not merely a downstream chart—is unhealthy and needs immediate triage for municipal public safety messaging.

Charting only successful 200 responses so failures never appear hides the incident by construction. Cosmos RU charts that are unrelated to the Function HTTP failures may be useful later for dependency diagnosis but should not be the first highlight when the symptom is Function response errors. Key Vault certificate thumbprints with no correlation to the Function errors add noise and delay response during an emergency notification event.

Exam caveat: Event Grid delivery failures, Function host exceptions, and downstream 5xx from dependencies can all surface differently. Distinguish Function invocation failures from Event Grid dead-lettering and retry storms. Sampling and aggregation granularity matter—short windows catch intermittent bursts that daily rollups smear out. HTTP status alone may not capture non-HTTP trigger failures; include exception and trigger failure tables as needed.

Operational check: Maintain a KQL alert or workbook tile on 5xx (and failure) rates for the emergency notification Function with a tight evaluation window, correlate spikes to Event Grid delivery metrics and recent deploys, and verify runbooks list rollback or failover contacts. After remediation, confirm the 5xx spike clears and that test notifications complete end-to-end without elevated retries.