Snippets

KQL snippet: isolate Application Gateway 502s to a private backend

A short query to separate unavailable backend, application failure and WAF blocking when Application Gateway returns 502s on a private path.

16 Jun 2026 azureapplication-gatewayprivate-endpointwafkqllogsnetworkingrunbookmonitoring

When Application Gateway returns 502s for a private API, first correlate client status, backend status and possible WAF signals on the same test window.

kusto appgw-private-backend-502.kql

let Window = 2h;
let Host = "api.internal.example.com";
AzureDiagnostics
| where TimeGenerated > ago(Window)
| where ResourceProvider == "MICROSOFT.NETWORK"
| where Category in ("ApplicationGatewayAccessLog", "ApplicationGatewayFirewallLog", "ApplicationGatewayPerformanceLog")
| where host_s has Host or requestUri_s has Host or originalRequestUriWithArgs_s has Host
| project TimeGenerated,
        Category,
        clientIP_s,
        host_s,
        requestUri_s,
        httpStatus_d,
        serverStatus_s,
        backendPoolName_s,
        backendSettingName_s,
        ruleId_s,
        action_s,
        message_s,
        transactionId_g
| order by TimeGenerated desc

Quick read: httpStatus_d at 502 with an empty serverStatus_s points first to health probe, private DNS or backend routing; serverStatus_s in 5xx points to the application; a WAF row with Blocked should be handled as a rule incident, not as a pool problem.