Troubleshooting Mental Model¶

This page provides a classification model for Azure Functions incidents so you can start with the correct evidence source instead of guessing.

Core idea: classify the problem first, then investigate deeply.

Why this model matters¶

Most incident delays come from category mistakes:

• trigger listener failures investigated as application code bugs
• outbound DNS/storage auth failures investigated as CPU problems
• deployment events ignored while symptoms are treated as random instability
• cold start behavior on Consumption plans mistaken for application regression

This classification helps you avoid looking at the wrong logs from the start.

Classification flowchart¶

flowchart TD
    A[Observed symptom] --> B{Primary failure signal}
    B -->|No invocations, zero executions| C[Category 1: Trigger and listener issue]
    B -->|5xx, latency, timeout| D[Category 2: Execution and runtime issue]
    B -->|Degradation over time| E[Category 3: Resource exhaustion]
    B -->|Dependency timeout, DNS, connection reset| F[Category 4: Dependency and outbound issue]
    B -->|Regression after change, restart, config| G[Category 5: Deployment and configuration event]

    C --> C1[Start with trigger listener and host startup evidence]
    D --> D1[Start with requests and exceptions tables]
    E --> E1[Start with memory and cold start progression]
    F --> F1[Start with dependencies and resolver evidence]
    G --> G1[Start with Activity Log and config delta]

Category summary matrix¶

1) Category: Trigger and Listener Issue¶

Trigger issues are failures in the path from event source to function invocation.

Typical symptom patterns¶

• Zero invocations despite active event source
• listener ... unable to start in traces
• Function shows as disabled in portal
• Blob trigger not firing on Flex Consumption (missing Event Grid subscription)

First signal to check¶

let appName = "func-myapp-prod";
traces
| where timestamp > ago(30m)
| where cloud_RoleName =~ appName
| where message has_any ("listener", "disabled", "unable to start", "trigger", "Host started")
| project timestamp, severityLevel, message
| order by timestamp desc

Key differentiation¶

Related playbooks¶

• Functions Not Executing
• Blob Trigger Not Firing
• App Settings Misconfiguration

2) Category: Execution and Runtime Issue¶

Execution issues are failures during function invocation — the function starts but produces errors or exceeds time limits.

Typical symptom patterns¶

• HTTP 5xx responses from function endpoints
• RpcException or application exceptions in logs
• Execution timeout exceeded messages
• High error rate on specific functions while others are healthy

First signal to check¶

let appName = "func-myapp-prod";
requests
| where timestamp > ago(1h)
| where cloud_RoleName =~ appName
| where operation_Name startswith "Functions."
| summarize
    Invocations = count(),
    Failures = countif(success == false),
    FailureRate = round(100.0 * countif(success == false) / count(), 2),
    P95Ms = percentile(duration, 95)
  by FunctionName = operation_Name
| order by Failures desc

Key differentiation¶

Related playbooks¶

• Functions Failing
• High Latency
• Timeout / Execution Limit Exceeded

3) Category: Resource Exhaustion¶

Resource exhaustion issues develop gradually as load increases or memory accumulates over time.

Typical symptom patterns¶

• Increasing latency over hours
• Worker process crashes (OOM)
• Cold start frequency increasing
• System.OutOfMemoryException in exceptions

First signal to check¶

let appName = "func-myapp-prod";
exceptions
| where timestamp > ago(6h)
| where cloud_RoleName =~ appName
| where type has_any ("OutOfMemory", "StackOverflow", "ThreadAbort")
| summarize Count = count() by bin(timestamp, 15m), type
| order by timestamp desc

Key differentiation¶

Related playbooks¶

• Out of Memory / Worker Crash
• Queue Piling Up

4) Category: Dependency and Outbound Issue¶

Dependency issues are failures in outbound calls to external services, storage, databases, or APIs.

Typical symptom patterns¶

• ConnectTimeout or ConnectionRefused in dependency logs
• 401/403 from downstream services (managed identity issues)
• DNS resolution failures in VNet-integrated apps
• SNAT port exhaustion on Consumption plan

First signal to check¶

let appName = "func-myapp-prod";
dependencies
| where timestamp > ago(1h)
| where cloud_RoleName =~ appName
| where success == false
| summarize Count = count(), AvgDuration = avg(duration) by target, resultCode, type
| order by Count desc

Key differentiation¶

Related playbooks¶

• Managed Identity / RBAC Failure
• Deployment Failures

5) Category: Deployment and Configuration Event¶

Configuration issues are failures triggered by recent changes — deployments, setting modifications, identity updates, or platform events.

Typical symptom patterns¶

• Incident starts immediately after deployment or config change
• No job functions found after deploy
• Host startup failure after runtime version change
• Functions disappear after FUNCTIONS_WORKER_RUNTIME change

First signal to check¶

az monitor activity-log list \
  --resource-group "$RG" \
  --offset 2h \
  --status Succeeded \
  --output table

Key differentiation¶

Related playbooks¶

• App Settings Misconfiguration
• Deployment Failures

Using this model during incidents¶

sequenceDiagram
    participant R as Responder
    participant M as Mental Model
    participant E as Evidence
    participant P as Playbook

    R->>M: Observe primary symptom
    M->>R: Classify into category (1-5)
    R->>E: Check first signal for that category
    E->>R: Evidence confirms or eliminates category
    alt Category confirmed
        R->>P: Open category-specific playbook
        P->>R: Follow hypothesis-driven investigation
    else Category eliminated
        R->>M: Re-classify with next likely category
    end

Anti-patterns¶

See Also¶

• Decision Tree
• Troubleshooting Method
• Detector Map
• Architecture
• Evidence Map
• First 10 Minutes

Sources¶

• Azure Functions diagnostics overview
• Monitor Azure Functions
• Troubleshoot Azure Functions