Missing Application Telemetry¶

1. Summary¶

Application Insights telemetry is missing, partial, or delayed even though the application is deployed and serving requests. This playbook applies when requests, dependencies, traces, exceptions, or custom events fail to appear in a workspace-based Application Insights resource or when one telemetry type is missing while others still arrive.

Microsoft Learn guidance frames this issue as a pipeline problem with several checkpoints: SDK configuration, connection string, sampling, network reachability, and ingestion visibility. In workspace-based Application Insights, teams often misread the symptom because the data lands in Log Analytics tables instead of a separate legacy store. Use this playbook when you need to prove whether the break is in instrumentation, transport, sampling, or query interpretation.

Typical incident window: 10-20 minutes from deployment or connectivity drift to visible telemetry gaps in App tables. Time to resolution*: 30 minutes to 2 hours depending on whether the break is connection string, SDK path, sampling, or endpoint reachability.

Use it when:

• requests, dependencies, traces, or exceptions are empty or stale.
• One service in a multi-service application stopped reporting while others still send.
• Data appears in Live Metrics but not in long-term queries.
• A release, firewall change, or SDK configuration change aligned with the telemetry gap.

flowchart TD
    A[Missing application telemetry] --> B{Any telemetry type still arriving?}
    B -->|No| C[Check connection string and endpoint access]
    B -->|Yes| D[Check missing telemetry type and sampling]
    C --> E{Workspace-based component correct?}
    E -->|No| F[Fix resource connection]
    E -->|Yes| G[Check network or auth failures]
    D --> H{Only traces or dependencies missing?}
    H -->|Yes| I[Check SDK modules and configuration]
    H -->|No| J[Check ingestion delay or broad sampling]

2. Common Misreadings¶

3. Competing Hypotheses¶

4. What to Check First¶

1. Show the Application Insights component and workspace linkage

   az monitor app-insights component show \
       --app $APP_INSIGHTS_NAME \
       --resource-group $RG \
       --query "{name:name,workspaceResourceId:workspaceResourceId,connectionString:connectionString,applicationType:applicationType}"
   

2. Confirm the host still has the expected connection string setting

   az webapp config appsettings list \
       --resource-group $RG \
       --name $APP_NAME \
       --query "[?name=='APPLICATIONINSIGHTS_CONNECTION_STRING' || name=='APPINSIGHTS_INSTRUMENTATIONKEY']"
   

3. Run a control query against AppRequests in the workspace

   az monitor log-analytics query \
       --workspace $WORKSPACE_ID \
       --analytics-query "AppRequests | where TimeGenerated > ago(15m) | summarize Count=sum(ItemCount), LastSeen=max(TimeGenerated) by AppRoleName" \
       --timespan "PT15M"
   

4. Confirm the component is workspace-based and points to the intended workspace

   az monitor app-insights component show \
       --app $APP_INSIGHTS_NAME \
       --resource-group $RG \
       --query "{workspaceResourceId:workspaceResourceId,connectionString:connectionString}"
   

5. Capture current component-level sampling configuration

   az monitor app-insights component show \
       --app $APP_INSIGHTS_NAME \
       --resource-group $RG \
       --query "{samplingPercentage:samplingPercentage}"
   

6. Capture workspace identity for direct KQL validation

   az monitor log-analytics workspace show \
       --resource-group $RG \
       --workspace-name $WORKSPACE_NAME \
       --query "{id:id,customerId:customerId}"
   

5. Evidence to Collect¶

5.1 KQL Queries¶

// Telemetry volume by type in the last 24 hours
union AppRequests, AppDependencies, AppTraces, AppExceptions
| where TimeGenerated > ago(24h)
| summarize Items=sum(ItemCount), Rows=count() by Type, AppRoleName
| order by Items desc

// Detect ingestion delay across major telemetry types
union AppRequests, AppDependencies, AppTraces, AppExceptions
| where TimeGenerated > ago(6h)
| extend DelayMinutes = datetime_diff('minute', ingestion_time(), TimeGenerated)
| summarize AvgDelay=avg(DelayMinutes), P95Delay=percentile(DelayMinutes, 95), MaxDelay=max(DelayMinutes) by Type
| order by P95Delay desc

// Identify services with missing request telemetry
AppRequests
| where TimeGenerated > ago(24h)
| summarize LastSeen=max(TimeGenerated), Requests=sum(ItemCount) by AppRoleName
| order by LastSeen asc

// Check if sampling is changing the apparent request count
AppRequests
| where TimeGenerated > ago(24h)
| summarize RecordedRows=count(), EstimatedActual=sum(ItemCount), SampledRows=countif(ItemCount == 1)
| extend EffectiveSamplingPercent = round(100.0 * RecordedRows / iif(EstimatedActual == 0, 1, EstimatedActual), 2)

5.2 CLI Investigation¶

# Inspect the Application Insights component
az monitor app-insights component show \
    --app $APP_INSIGHTS_NAME \
    --resource-group $RG \
    --output json

Sample output:

{
  "applicationType": "web",
  "connectionString": "<connection-string>",
  "name": "appi-prod",
  "samplingPercentage": null,
  "workspaceResourceId": "/subscriptions/<subscription-id>/resourceGroups/rg-monitor/providers/Microsoft.OperationalInsights/workspaces/law-prod"
}

Interpretation:

• workspaceResourceId confirms where workspace-based telemetry should land.
• Missing or wrong connection information explains total absence quickly.
• samplingPercentage helps determine whether sparse data is expected.

# Verify the application setting on App Service
az webapp config appsettings list \
    --resource-group $RG \
    --name $APP_NAME \
    --output json

Sample output:

[
  {
    "name": "APPLICATIONINSIGHTS_CONNECTION_STRING",
    "value": "<connection-string>"
  }
]

Interpretation:

• Missing setting means the SDK has no endpoint or key material.
• Old connection strings after resource replacement are a common drift issue.
• Presence alone is not enough; the application must actually consume the setting at startup.

# Inspect current app runtime configuration at the component level
az monitor app-insights component show \
    --app $APP_INSIGHTS_NAME \
    --resource-group $RG \
    --query "{samplingPercentage:samplingPercentage,workspaceResourceId:workspaceResourceId,applicationType:applicationType}"

Sample output:

{
  "applicationType": "web",
  "samplingPercentage": 100,
  "workspaceResourceId": "/subscriptions/<subscription-id>/resourceGroups/rg-monitor/providers/Microsoft.OperationalInsights/workspaces/law-prod"
}

Interpretation:

• samplingPercentage: 100 indicates no sampling at the component configuration level.
• If data is still sparse, look at SDK-level adaptive sampling or logger filtering.
• Wrong workspace binding explains why the team is querying the wrong destination.

# Capture workspace identity for direct Log Analytics validation
az monitor log-analytics workspace show \
    --resource-group $RG \
    --workspace-name $WORKSPACE_NAME \
    --output json

Sample output:

{
  "customerId": "xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx",
  "id": "/subscriptions/<subscription-id>/resourceGroups/rg-monitor/providers/Microsoft.OperationalInsights/workspaces/law-prod",
  "name": "law-prod"
}

Interpretation:

• This confirms the workspace used for telemetry queries.
• Use it to rule out cases where the app sends correctly but operators inspect the wrong workspace.
• Capture it before escalating to a workspace-side hypothesis.

6. Validation and Disproof by Hypothesis¶

Hypothesis 1: Connection string or resource linkage is wrong¶

Proves if: App settings or component output show missing, stale, or wrong destination values.

Disproves if: The application and component both point to the intended workspace-based resource.

Test with: Section 5.2 CLI commands 1, 2, and 4.

Hypothesis 2: SDK initialization or module configuration is incomplete¶

Proves if: Only one telemetry type is missing or the affected role stopped after a deployment while others remain healthy.

Disproves if: All telemetry types fail equally across the app.

Test with: Section 5.1 Queries 1 and 3, then compare the app startup path and SDK configuration for the missing telemetry type.

Hypothesis 3: Sampling is reducing apparent telemetry too aggressively¶

Proves if: itemCount suggests much larger real volume than raw rows and effective sampling is very low.

Disproves if: RecordedRows and EstimatedActual are nearly identical.

Test with: Section 5.1 Queries 1 and 4 plus Section 5.2 CLI command 3.

Hypothesis 4: Network or firewall rules block ingestion endpoints¶

Proves if: Connection settings are correct but the environment cannot reach the Azure Monitor ingestion endpoints.

Disproves if: Endpoint access is healthy and another hypothesis better fits the evidence.

Test with: Section 5.2 CLI commands 1 and 2 for expected endpoints, then validate outbound connectivity from the runtime environment.

Hypothesis 5: Ingestion delay makes telemetry appear missing¶

Proves if: Delay metrics are high and telemetry later appears without configuration changes.

Disproves if: No data appears even over extended windows.

Test with: Section 5.1 Query 2.

Hypothesis 6: Workspace-based query expectations are wrong¶

Proves if: Data exists in the workspace tables, but teams were looking in the wrong UI or resource context.

Disproves if: The tables are actually empty in the intended workspace.

Test with: Section 5.2 CLI command 4 and Section 5.1 Query 1.

7. Likely Root Cause Patterns¶

Normal vs Abnormal Comparison¶

8. Immediate Mitigations¶

1. Restore or correct the connection string in the host environment.

   az webapp config appsettings set \
       --resource-group $RG \
       --name $APP_NAME \
       --settings APPLICATIONINSIGHTS_CONNECTION_STRING="<connection-string>"
   

2. Confirm the Application Insights component points to the intended workspace.

   az monitor app-insights component show \
       --app $APP_INSIGHTS_NAME \
       --resource-group $RG \
       --query "{workspaceResourceId:workspaceResourceId,connectionString:connectionString}"
   

3. Temporarily reduce sampling only if necessary for a critical investigation.

   az monitor app-insights component show \
       --app $APP_INSIGHTS_NAME \
       --resource-group $RG \
       --query "{samplingPercentage:samplingPercentage}"
   

4. Widen alert or dashboard lookback windows if delay is the primary issue.

   az monitor scheduled-query update \
       --resource-group $RG \
       --name $ALERT_RULE_NAME \
       --evaluation-frequency 5m \
       --window-size 15m
   

5. Restart the application after fixing configuration drift.

   az webapp restart \
       --resource-group $RG \
       --name $APP_NAME
   

9. Prevention¶

Prevent telemetry gaps by making instrumentation part of application release validation, not an afterthought. Microsoft Learn consistently recommends verifying connection strings, understanding sampling, and testing the real data path into workspace-based tables.

Keep application settings under versioned deployment control.

az webapp config appsettings list \
    --resource-group $RG \
    --name $APP_NAME \
    --query "[?name=='APPLICATIONINSIGHTS_CONNECTION_STRING']"

Review workspace linkage during component creation and migration.

az monitor app-insights component show \
    --app $APP_INSIGHTS_NAME \
    --resource-group $RG \
    --query "{workspaceResourceId:workspaceResourceId,applicationType:applicationType}"

Document whether your SDK uses adaptive or fixed sampling and what operators should expect in KQL.

az monitor app-insights component show \
    --app $APP_INSIGHTS_NAME \
    --resource-group $RG \
    --query "{samplingPercentage:samplingPercentage}"

Create a validation query pack for each service so teams can quickly confirm requests, dependencies, traces, and exceptions after deployment.

az monitor log-analytics workspace show \
    --resource-group $RG \
    --workspace-name $WORKSPACE_NAME \
    --query "{customerId:customerId,id:id}"

Finally, test endpoint reachability during network changes. Telemetry is often the first thing blocked and the last thing remembered.

See Also¶

• No Data in Workspace
• Operations: Workspace Management
• KQL: Request Performance
• KQL: Dependency Failures
• KQL: Exception Trends

Sources¶

• Microsoft Learn: Troubleshoot missing application telemetry in Application Insights
• Microsoft Learn: Workspace-based Application Insights resources
• Microsoft Learn: Azure Monitor Application Insights sampling
• Microsoft Learn: IP addresses used by Azure Monitor
• Microsoft Learn: AppRequests table reference
• Microsoft Learn: AppDependencies table reference
• Microsoft Learn: AppTraces table reference
• Microsoft Learn: AppExceptions table reference