Snippets

KQL snippet: qualify a Storage Queue backlog on a private path

A short query to separate missing consumption, retries, poison messages and access errors on a private Storage Queue.

22 Jun 2026 azurestoragequeueprivate-endpointkqllogsmessagingrunbookmonitoring

When a private Storage Queue accumulates messages, first check whether consumers still read, whether messages become visible again, or whether access is denied.

kusto storage-queue-private-backlog.kql

let Window = 2h;
let QueueName = "orders-in";
StorageQueueLogs
| where TimeGenerated > ago(Window)
| where Uri has QueueName
| where OperationName in ("GetMessages", "DeleteMessage", "PutMessage", "UpdateMessage") or StatusCode >= 400
| summarize Count=count(), Failures=countif(StatusCode >= 400), LastSeen=max(TimeGenerated) by OperationName, StatusCode, AuthenticationType, CallerIpAddress, UserAgentHeader
| order by LastSeen desc

Quick read: many GetMessages without DeleteMessage indicates processing failure or timeout; StatusCode 403/409 points to identity, SAS or concurrency; no reads points to a stopped consumer, private DNS or routing.