Telemetry, KQL and Agent Logs: Follow the Evidence Across Services
Correlate infrastructure, application and distributed-trace evidence, verify natural-language KQL, and manage sensitive Copilot session logs.
Read the instruments together
A car can have a warm engine and still move slowly because a wheel is stuck. High CPU can accompany a slow application without causing its slowdown. Correlate infrastructure and application evidence before choosing a repair.
| Signal | Possible question | Avoid assuming |
|---|---|---|
| CPU | Is compute saturated or a process looping? | Every latency spike is CPU-bound |
| Memory | Is working set growing, pressure high, or GC expensive? | Low free memory alone proves a leak |
| Disk | Is latency/IOPS/throughput limiting work? | Capacity and performance are the same metric |
| Network | Are latency, loss, connections, or throughput abnormal? | All dashboards measure the same traffic scope |
| Requests/dependencies | Which operation or downstream call is slow/failing? | A service-wide average identifies the affected path |
Check units, aggregation, sampling interval, host population, and time zone. VM overview network billing metrics and guest/VM insights telemetry can describe different traffic scopes. Align the time window before comparing graphs.
Instrument the application boundary
Application Insights supports OpenTelemetry-based application instrumentation. Use meaningful service names, request/dependency correlation, and the supported SDK/exporter setup for your runtime.
A distributed trace follows an operation across instrumented services. Inspect the slow request, child dependencies, errors, and component map. A gap can mean missing instrumentation or propagation, not proof that an unobserved service is healthy.
Sampling and retention affect what you can see. A trace view with no event does not automatically mean the request never happened. State the actual evidence scope.
Start with a real table and a small query
Workspace-based Application Insights can expose request data in AppRequests. In a Log Analytics workspace containing that table, this query summarizes recent request duration and failures:
AppRequests
| where TimeGenerated > ago(1h)
| summarize
Requests = count(),
Failures = countif(Success == false),
P95DurationMs = percentile(DurationMs, 95)
by bin(TimeGenerated, 5m), AppRoleName
| order by TimeGenerated ascInspect the schema and selected scope first. Application Insights resource-context queries may use different table/column names such as requests, timestamp, and duration. Do not paste one schema into another and explain away an empty result.
This sample counts stored rows. If telemetry is sampled, row count is not automatically total request volume; inspect the sampling-related fields and appropriate aggregation for your data. A percentile over retained rows also needs careful interpretation.
For a selected correlated operation, inspect the actual operation identifier and related dependency records using the schema available in your scope. Never invent a trace ID and present a fictional result as a measured incident.
Use natural language to draft, then inspect KQL
A bounded request to an authorized assistant or supported observability agent:
In this sandbox workspace, draft a query for failed booking requests
in the last hour. Show table, time filter, service filter and grouping.
Run only read operations. Explain sampling and missing-data limits.
Link the query/results; do not infer a root cause from counts alone.Review table names, where filters, joins, grouping, time bins, and null handling. Run the query interactively and inspect several actual rows. Verify that “failed” means the intended application outcome, not only an HTTP status or a text match.
If an agent reports a database bottleneck, compare request/dependency timing, resource metrics, and relevant logs. The conclusion should survive a different plausible explanation, such as a retry storm or deployment-related configuration change.
Manage Copilot session evidence
GitHub’s agents panel exposes session progress, logs, token usage, and session length for supported sessions. Session logs show tool activity and validation; cloud-agent commits link back to session evidence. Use the actual commit/run/session chain during review.
Do not assume every client writes logs to the same local folder or that archiving a cloud session deletes its evidence. Follow the retention and deletion behavior documented for the specific surface.
For enterprise collection, the 2 July 2026 public-preview announcement describes Copilot session streaming for GitHub Enterprise Cloud customers with enterprise managed users. It requires enabling the relevant Usage Records Streaming/API controls. It supports a configured collector/SIEM path, with Microsoft Purview described as a preview option. The on-demand API covers the last 48 hours according to that announcement; verify current API documentation before implementing collection.
This is not a universal feature for every personal subscription. A local session view and enterprise streaming are different capabilities.
Prompts, responses, tool calls, source context, and diagnostics can contain sensitive data. Limit collection audience, protect transport/storage, define retention and access review, and avoid sending session data to an unapproved endpoint. An exported log is a new copy with its own lifecycle.
An AI-generated KQL query returns zero rows. What is the strongest next step?
Try it: inspect one query and one session
Prerequisites: read access to a sandbox Application Insights/Log Analytics resource and, optionally, your own supported Copilot session. Query/ingestion/AI usage can be billed.
Inspect the table schema, adapt the sample query, and compare several returned rows with the chart. Record one limitation such as sampling or missing service propagation. Open a session log and trace a visible tool/test action to the related commit or artifact, if available.
Expected observation: the query uses actual fields and the log proves only the actions it records. Neither a generated summary nor a missing row becomes an invented successful result.
Cleanup: remove saved exercise queries/exports if unneeded under your data policy. Do not delete shared telemetry or export real confidential prompts to public storage.
Decision check: CPU and latency rise together
Correlation suggests a hypothesis, not a cause. Inspect which requests, dependencies, processes, and changes share the interval before choosing scaling or a code fix.