Merge pull request #203674 from cebundy/add-la-table-observability

Add system logs to observability doc

Author: 19BMG00

articles/container-apps/media/observability/log-analytics-query-page.png

@@ -6,7 +6,7 @@ author: cebundy
 ms.service: container-apps
 ms.custom: event-tier1-build-2022
 ms.topic: conceptual
-ms.date: 05/02/2022
+ms.date: 07/05/2022
 ms.author: v-bcatherine
 ---
 
@@ -16,11 +16,11 @@ Azure Container Apps provides several built-in observability features that give
 
 These features include:
 
-- Log streaming
-- Container console
-- Azure Monitor metrics
-- Azure Monitor Log Analytics
-- Azure Monitor alerts
+- [Log streaming](#log-streaming)
+- [Container console](#container-console)
+- [Azure Monitor metrics](#azure-monitor-metrics)
+- [Azure Monitor Log Analytics](#azure-monitor-log-analytics)
+- [Azure Monitor alerts](#azure-monitor-alerts)
 
 >[!NOTE]
 > While not a built-in feature, [Azure Monitor's Application Insights](../azure-monitor/app/app-insights-overview.md) is a powerful tool to monitor your web and background applications.
@@ -250,55 +250,115 @@ You can add more scopes to view metrics across multiple container apps.
 
 ## Azure Monitor Log Analytics
 
+Azure Container Apps is integrated with Azure Monitor Log Analytics to monitor and analyze your container app's logs.  Each Container Apps environment includes a Log Analytics workspace that provides a common place to store the system and application log data from all container apps running in the environment.  
+
+Log entries are accessible by querying Log Analytics tables through the Azure portal or a command shell using the [Azure CLI](/cli/azure/monitor/log-analytics).
+
+<!--
 Azure Monitor collects application logs and stores them in a Log Analytics workspace.  Each Container Apps environment includes a Log Analytics workspace that provides a common place to store the application log data from all containers running in the environment.  
+-->
+
+There are two types of logs for Container Apps.  
+
+1. Console logs, which are emitted by your app.
+1. System logs, which are emitted by the Container Apps service.
+
+
+### Container Apps System Logs
 
-Application logs consist of messages written to each container's `stdout` and `stderr`.  Additionally, if your container app is using Dapr, log entries from the Dapr sidecar are also collected.  
+The Container Apps service provides system log messages at the container app level.  System logs emits the following messages:
 
-Azure Monitor stores Container Apps log data in the `ContainerAppConsoleLogs_CL` table. Create queries using this table to view your container app log data.  
+| Source | Type | Message |
+|---------|------|---------|
+| Dapr | info | Successfully created dapr component \<component-name\> with scope \<dapr-component-scope\> |
+| Dapr | info | Successfully updated dapr component \<component-name\> with scope \<component-type\> |
+| Dapr | error | Error creating dapr component \<component-name\> |
+| Volume Mounts | info | Successfully mounted volume \<volume-name\> for revision \<revision-scope\> |
+| Volume Mounts | error | Error mounting volume \<volume-name\> |
+| Domain Binding | info | Successfully bound Domain \<domain\> to the container app \<container app name\> |
+| Authentication | info | Auth enabled on app. Creating authentication config |
+| Authentication | info | Auth config created successfully |
+| Traffic weight | info | Setting a traffic weight of \<percentage>% for revision \<revision-name\\> |
+| Revision Provisioning | info | Creating a new revision: \<revision-name\> |
+| Revision Provisioning | info | Successfully provisioned revision \<name\> |
+| Revision Provisioning | info| Deactivating Old revisions since 'ActiveRevisionsMode=Single' |
+| Revision Provisioning | error | Error provisioning revision \<revision-name>. ErrorCode: \<[ErrImagePull]\|[Timeout]\|[ContainerCrashing]\> |
 
-You can create and run queries using Log Analytics in the Azure portal or run queries using Azure CLI commands.
+The system log data is accessible by querying the `ContainerAppSystemlogs_CL` table. The most used Container Apps specific columns in the table are:
 
-The most used columns in ContainerAppConsoleLogs_CL include:
+| Column  | Description |
+|---|---|
+| `ContainerAppName_s` | Container app name |
+| `EnvironmentName_s` | Container Apps environment name |
+| `Log_s` | Log message |
+| `RevisionName_s` | Revision name |
+
+### Container Apps Console Logs
+
+Console logs originate from the `stderr` and `stdout` messages from the containers in your container app and Dapr sidecars.  You can view console logs by querying the `ContainerAppConsolelogs_CL` table.
+
+> [!TIP]
+> Instrumenting your code with well-defined log messages can help you to understand how your code is performing and to debug issues.  To learn more about best practices refer to [Design for operations](/azure/architecture/guide/design-principles/design-for-operations).
+
+The most commonly used Container Apps specific columns in ContainerAppConsoleLogs_CL include:
 
 |Column  |Description |
 |---------|---------|
-| `ContainerAppName_s` | container app name |
-| `ContainerGroupName_g` | replica name |
-| `ContainerId` | container identifier |
-| `ContainerImage_s` | container image name |
+| `ContainerAppName_s` | Container app name |
+| `ContainerGroupName_g` | Replica name |
+| `ContainerId_s` | Container identifier |
+| `ContainerImage_s` | Container image name |
 | `EnvironmentName_s` | Container Apps environment name |
-| `Message` | log message |
-| `RevisionName_s` | revision name |
+| `Log_s` | Log message |
+| `RevisionName_s` | Revision name |
 
 ### Use Log Analytics to query logs
 
-Log Analytics is a tool in the Azure portal that you can use to view and analyze log data. Using Log Analytics, you can write simple or advanced queries and then sort, filter, and visualize the results in charts to spot trends and identify issues. You can work interactively with the query results or use them with other features such as alerts, dashboards, and workbooks.
+Log Analytics is a tool in the Azure portal that you can use to view and analyze log data. Using Log Analytics, you can write Kusto queries and then sort, filter, and visualize the results in charts to spot trends and identify issues. You can work interactively with the query results or use them with other features such as alerts, dashboards, and workbooks.
 
 Start Log Analytics from **Logs** in the sidebar menu on your container app page.  You can also start Log Analytics from **Monitor>Logs**.  
 
-You can query the logs using the columns listed in the **CustomLogs > ContainerAppConsoleLogs_CL** table in the **Tables** tab.
+You can query the logs using the tables listed in the **CustomLogs** category **Tables** tab.  The tables in this category are the `ContainerAppSystemlogs_CL` and `ContainerAppConsolelogs_CL` tables.
 
-:::image type="content" source="media/observability/log-analytics-query-page.png" alt-text="Screenshot of the Log Analytics query editor.":::
+:::image type="content" source="media/observability/log-analytics-query-page.png" alt-text="Screenshot of the Log Analytics custom log tables.":::
 
-Below is a simple query that displays log entries for the container app named *album-api*. 
+Below is a Kusto query that displays console log entries for the container app named *album-api*. 
 
 ```kusto
 ContainerAppConsoleLogs_CL
 | where ContainerAppName_s == 'album-api'
-| project Time=TimeGenerated, AppName=ContainerAppName_s, Revision=RevisionName_s, Container=ContainerName_s, Message=Message
+| project Time=TimeGenerated, AppName=ContainerAppName_s, Revision=RevisionName_s, Container=ContainerName_s, Message=Log_s
+| take 100
+```
+
+Below is a Kusto query that displays system log entries for the container app named *album-api*. 
+
+```kusto
+ContainerAppSystemLogs_CL
+| where ContainerAppName_s == 'album-api'
+| project Time=TimeGenerated, EnvName=EnvironmentName_s, AppName=ContainerAppName_s, Revision=RevisionName_s, Message=Log_s
 | take 100
 ```
 
 For more information regarding Log Analytics and log queries, see the [Log Analytics tutorial](../azure-monitor/logs/log-analytics-tutorial.md).
 
-### Query logs via the Azure CLI and PowerShell
+### Query logs via the Azure CLI
 
 Container Apps logs can be queried using the [Azure CLI](/cli/azure/monitor/log-analytics).  
 
-Here's an example Azure CLI query to output a table containing five log records with the container app name "album-api".  The table columns are specified by the parameters after the project operator.  The $WORKSPACE_CUSTOMER_ID variable contains the GUID of the Log Analytics workspace.
+These example Azure CLI queries output a table containing log records for the container app name **album-api**.  The table columns are specified by the parameters after the `project` operator.  The `$WORKSPACE_CUSTOMER_ID` variable contains the GUID of the Log Analytics workspace.
+
+
+This example queries the `ContainerAppConsoleLogs_CL` table:
+
+```azurecli
+az monitor log-analytics query --workspace $WORKSPACE_CUSTOMER_ID --analytics-query "ContainerAppConsoleLogs_CL | where ContainerAppName_s == 'album-api' | project Time=TimeGenerated, AppName=ContainerAppName_s, Revision=RevisionName_s, Container=ContainerName_s, Message=Log_s, LogLevel_s | take 5" --out table
+```
+
+This example queries the `ContainerAppSystemLogs_CL` table:
 
 ```azurecli
-az monitor log-analytics query --workspace $WORKSPACE_CUSTOMER_ID --analytics-query "ContainerAppConsoleLogs_CL | where ContainerAppName_s == 'album-api' | project Time=TimeGenerated, AppName=ContainerAppName_s, Revision=RevisionName_s, Container=ContainerName_s, Message=Message, LogLevel_s | take 5" --out table
+az monitor log-analytics query --workspace $WORKSPACE_CUSTOMER_ID --analytics-query "ContainerAppSystemLogs_CL | where ContainerAppName_s == 'album-api' | project Time=TimeGenerated, AppName=ContainerAppName_s, Revision=RevisionName_s, Message=Log_s, LogLevel_s | take 5" --out table
 ```
 
 For more information about using Azure CLI to view container app logs, see [Viewing Logs](monitor.md#viewing-logs).