Troubleshooting Scenario Questions

Azure Network Watcher.

Why it fails: Azure Network Watcher diagnoses network connectivity, latency and traffic flows between endpoints, not disk throughput. It is tempting because latency is the symptom, but confirming storage IOPS limits requires VM-level metrics such as Azure Monitor's disk performance counters for the virtual machine.

Azure Resource Graph Explorer.

Why it fails: Azure Resource Graph Explorer queries resource configuration and metadata across subscriptions, returning inventory-style results rather than live performance telemetry. It is tempting for auditing deployed resources, but storage IOPS metrics require Azure Monitor metrics or VM diagnostics, which record actual disk read/write operations per second.

Application Insights Dependency logs.

Why it fails: Application Insights Dependency logs record outbound calls made by instrumented application code, not hypervisor-level disk throughput, so they cannot expose the VM's storage IOPS ceiling. It is tempting because dependency telemetry does surface latency, but that reflects application-to-service calls; host storage metrics require Azure Monitor VM diagnostics or Metrics Explorer.

Azure Bastion audit logs.

Why it fails: Azure Bastion audit logs record RDP and SSH sessions to virtual machines, not application requests, dependencies or model inference telemetry, so they cannot diagnose the AI web app's failures. They are tempting because Bastion logging is genuinely useful when investigating suspicious administrative access to jump-host VMs.

Azure Firewall packet capture PCAP files.

Why it fails: Azure Firewall PCAP capture is a network forensics tool, not an application telemetry source, and captures must be enabled per-flow. It is tempting when diagnosing connectivity faults, but AI application troubleshooting needs application logs, traces and metrics instead.

Verify the AMQP listener port 5671 firewall rules on the function app.

Why it fails: Event Grid delivers events over HTTPS webhooks, not AMQP, so port 5671 firewall rules are irrelevant to event delivery. It is tempting because AMQP 5671 is the standard port for Service Bus and Event Hubs, and verifying it would be correct when troubleshooting those AMQP-based services.

Review Service Bus session lock renewal logs.

Why it fails: Service Bus session lock renewal logs relate to Service Bus queues, not Event Grid subscriptions, so they reveal nothing about event delivery. It is tempting because session locks are a genuine troubleshooting area, and reviewing them would be correct when diagnosing a Service Bus-triggered function with session-enabled queues.

Check Event Hubs consumer group checkpoint offset status.

Why it fails: Event Hubs consumer group checkpoints track offset progress for Event Hubs streams, not Event Grid subscriptions, so this reveals nothing about the failing trigger. It is tempting because checkpoint lag genuinely diagnoses missed events — but only when Event Hubs, not Event Grid, delivers them.

Execute az aks browse to open the Kubernetes dashboard.

Why it fails: Azure Container Apps does not expose a Kubernetes API, so az aks browse has no cluster to connect to and returns an authentication or connection failure. It is tempting because Container Apps runs on Kubernetes underneath, but the dashboard would be correct when troubleshooting an AKS cluster directly.

Use kubectl describe pod to inspect Kubernetes events.

Why it fails: Container Apps abstracts the underlying Kubernetes control plane, so no pod objects are exposed and kubectl describe pod cannot reach the environment. It is tempting because the platform is Kubernetes-based, but kubectl describe pod would be correct when diagnosing pods in an AKS cluster you administer.

Disable the Application Insights telemetry client entirely in production to save bandwidth.

Why it fails: Disabling the telemetry client removes the very error and request data the scenario requires, so failures go unrecorded. It is tempting when bandwidth or ingestion cost is the concern, and disabling telemetry would suit an offline or air-gapped workload where no Application Insights resource exists.

Route all application logs exclusively to local text files on ephemeral container storage.

Why it fails: Ephemeral container storage is destroyed on restart, so logs vanish before troubleshooting and never reach Application Insights. Local file logging is tempting for low-latency debugging on a developer workstation, but the scenario requires centralised, queryable telemetry across instances.

Store plain-text passwords in telemetry custom dimensions.

Why it fails: Custom dimensions are transmitted to Application Insights and readable by anyone with access, so plain-text passwords become a credential leak. Storing secrets in telemetry is tempting for correlating authentication failures, but secrets belong in Azure Key Vault, referenced by identifier rather than logged.

Convert all vector fields to Edm.String

Why it fails: Edm.String cannot hold vector embeddings, so indexers would fail to populate vector fields and the timeout would persist. Converting to string is tempting when troubleshooting field-type mismatches, and it would be correct if the index schema wrongly declared vector data as text rather than the indexer exceeding its scheduled window on large PDFs.

Switch the search service to the Free tier

Why it fails: The Free tier caps index size, document counts and indexer runtime, so it would worsen the timeout rather than resolve it. Downgrading is tempting when reducing cost, and it would be correct if the workload fitted free-tier limits, but large PDF processing needs the higher throughput and quotas of a paid tier.

Delete all semantic configurations from the index

Why it fails: Semantic configurations affect query ranking at search time, not indexer document-processing throughput, so removing them leaves the timeout unchanged. Deleting them is tempting when trimming index complexity, and it would be correct if semantic reranking were causing slow queries rather than the indexer failing to finish within its scheduled window.

Enable Duplicate Detection with a history window of 5 attempts.

Why it fails: Duplicate detection discards messages whose MessageId matches one already in the history window; it never counts delivery attempts or routes exhausted messages to a dead-letter queue. It is tempting because it also removes messages, but it exists to suppress publisher retries, not to handle repeated processing failures.

Set the AutoDeleteOnIdle property on the queue to 5 minutes.

Why it fails: AutoDeleteOnIdle deletes an entire queue once it has had no activity for the specified interval; it does not track per-message delivery counts or preserve failed messages. It is tempting because it also removes things automatically, but it is designed for cleaning up unused queues, not dead-lettering.

Implement Event Grid dead-lettering pointing to an Azure Blob Storage container.

Why it fails: Event Grid dead-lettering applies to Event Grid subscriptions, not Service Bus queues, so it cannot capture abandoned queue messages. Service Bus provides its own dead-letter queue, enabled by default, which preserves messages after maximum delivery count is exceeded for manual inspection.

Azure Cost Management recommendation advisor for server resizing.

Why it fails: Cost Management recommendations address spending and resource sizing, not HTTP error rates or request latency, so they expose no telemetry about the surge. It is tempting because resizing can indirectly affect performance, and it would be correct when reducing Azure expenditure is the actual objective.

Azure Bastion diagnostic logs for RDP login failures.

Why it fails: Bastion diagnostic logs record RDP and SSH session activity through the bastion host, which is unrelated to HTTP errors or latency in Azure OpenAI and Azure AI Search. It is tempting because Bastion is a genuine diagnostic surface, and it would be correct when troubleshooting failed remote administrative logins.

Replace all vector fields with standard ASCII folding tokenizers

Why it fails: ASCII folding tokenisers are lexical text analysers applied to searchable string fields; they cannot represent vector embeddings, so replacing vector fields destroys similarity search. It is tempting because tokeniser tuning genuinely improves keyword query latency, and it would be correct for optimising a lexical text index rather than a vector workload.

Configure the index to use exhaustive KNN exclusively for high-QPS production workloads

Why it fails: Exhaustive KNN scans the entire vector index per query, so latency and cost scale linearly with index size, capping throughput under high QPS. It is tempting because exhaustive search maximises recall, and it would be correct for low-volume workloads where accuracy outweighs latency.

In the Azure Container Registry webhook configuration

Why it fails: Registry webhooks fire notifications on image push, pull or delete events; they carry no runtime resource settings, so memory cannot be adjusted there. It is tempting because the image itself lives in the registry, but container CPU and memory allocations are configured in the Container App's container resource definition.

In the Azure Virtual Network route table settings

Why it fails: Route tables control packet forwarding between subnets and appliances; they hold no container resource settings, so memory cannot be adjusted there. It is tempting because networking is configured per Container App environment, but CPU and memory allocations belong in the Container App's container resource definition.

In the Azure Monitor diagnostic settings export destination

Why it fails: Diagnostic settings export platform logs and metrics to destinations such as Log Analytics; they hold no container resource configuration, so memory cannot be set there. It is tempting because Azure Monitor surfaces the OOM evidence, but allocations belong in the Container App's container resource definition (CPU and memory per container).

Enable Geo-Disaster Recovery to force the secondary region to sync historical logs.

Why it fails: Geo-Disaster Recovery performs metadata replication and namespace failover between regions; it does not expose historical events for replay and would redirect consumers entirely. It is the right feature for regional outage resilience, not for rewinding a stream two hours.

Delete the existing consumer group and recreate it with a 2-hour retention limit.

Why it fails: Recreating a consumer group resets its offsets to the stream start or end, and retention is a namespace or event-hub setting, not a per-group limit. This suits deliberately restarting processing from scratch, not temporarily replaying two hours while preserving current offsets.

Purge all messages from the Event Hub using the Azure CLI az eventhubs purge command.

Why it fails: Purging deletes events permanently, so the two-hour-old backlog is destroyed rather than replayed, and it cannot restore offsets. It is tempting as a quick way to clear a stuck queue, and would suit discarding poisoned or expired events when retention is no longer needed.

Kubenet with host-port mapping

Why it fails: Kubenet performs overlay routing with NAT, adding encapsulation hops rather than direct pod-to-pod paths. It is tempting because kubenet with host-port mapping is a supported AKS configuration, but it suits clusters needing simple, low-address-consumption networking, not minimal-hop routing.

Kubenet with basic Linux bridge

Why it fails: Kubenet routes pod traffic through user-defined routes and a Linux bridge, adding the extra hops the scenario seeks to eliminate. It is tempting because kubenet is a simple, long-standing AKS option, and would suit clusters where direct pod-to-pod routing and IP-per-pod addressing are not required.

Azure CNI Overlay

Why it fails: Azure CNI Overlay encapsulates pod traffic in an overlay tunnel, so packets still traverse extra hops rather than routing directly. It is tempting because Overlay conserves VNet IP space for large clusters, and would be correct where address exhaustion, not latency, is the binding constraint.

System Assigned Managed Identity Success Rate

Why it fails: System Assigned Managed Identity Success Rate reports authentication success for a managed identity, not token throughput against Azure OpenAI's tokens-per-minute quota. It is tempting because 429s can stem from authentication issues, but it would be the correct metric when diagnosing managed identity authentication failures.

Virtual Network Gateway Packet Drops

Why it fails: Virtual Network Gateway Packet Drops measures dropped packets on VPN or ExpressRoute gateways, unrelated to Azure OpenAI token consumption. It is tempting because 429s are HTTP errors and network metrics seem diagnostic, but it would be the correct metric when troubleshooting connectivity loss through a gateway.

Data Ingestion Volume (GB)

Why it fails: Data Ingestion Volume (GB) tracks data uploaded into a Log Analytics workspace, not token consumption against an Azure OpenAI deployment's rate limit. It is tempting because it measures data volume, but it would be the correct metric when monitoring workspace ingestion costs or quotas.

The SELECT * FROM command syntax traditionally used in relational SQL databases.

Why it fails: KQL uses pipe-delimited tabular expressions such as SecurityEvent | where TimeGenerated > ago(1h); SELECT * FROM is T-SQL syntax and will not parse in Log Analytics. It is tempting because analysts familiar with relational databases reach for SELECT first, and that syntax would be correct against Azure SQL Database, not KQL.

The DROP TABLE administrative command inside Application Insights log streams.

Why it fails: KQL is read-only query language; DROP TABLE is a data-definition command absent from Log Analytics and Application Insights, which expose no schema-modification surface. It is tempting because administrators used to SQL Server or Synapse expect DDL control over tables, and DROP TABLE would be valid there, but log streams are immutable query targets.

Configuring Vertical Pod Autoscaler.

Why it fails: Vertical Pod Autoscaler adjusts CPU and memory requests based on observed usage, which affects scheduling and runtime resources, not the time taken to start a container. It would be correct if pods were repeatedly evicted or under-resourced during steady-state inference.

Increasing the memory limit for the pod.

Why it fails: Raising the memory limit addresses runtime memory pressure, not the image pull and container initialisation delay that defines cold starts. It would be correct if pods were being OOM-killed or throttled during inference, which the stem's startup-time suspicion does not describe.

Using a smaller base OS distribution.

Why it fails: A smaller base OS reduces image size and pull time, but cold-start latency in AI inference is dominated by model loading and container initialisation, not OS footprint. It would be correct if the bottleneck were image download over a constrained registry link rather than startup processing.