如何在Azure防火墙或应用网关日志中查询第三方502失败请求？

Azure 防火墙日志查询 #

Azure 防火墙的拒绝流量不会默认在通用AzureDiagnostics查询中返回，需针对网络规则拒绝日志做定向查询：

1. 先确认诊断设置：确保防火墙的诊断配置中已勾选AzureFirewallNetworkRule日志类别
2. 执行以下Kusto查询筛选被拒绝的443端口流量：

AzureDiagnostics
| where Category == "AzureFirewallNetworkRule"
| where OperationName == "AzureFirewallNetworkRuleLog"
| where dstPort_d == 443
| where action_s == "Deny"
| project TimeGenerated, srcIp_s, dstIp_s, dstPort_d, action_s
| order by TimeGenerated desc

通过srcIp_s字段即可获取第三方当前使用的源IP。

如果后续改用应用层规则管控Webhook，可使用应用规则日志查询：

AzureDiagnostics
| where Category == "AzureFirewallApplicationRule"
| where OperationName == "AzureFirewallApplicationRuleLog"
| where action_s == "Deny"
| where requestUri_s contains "/webhook/"
| project TimeGenerated, srcIp_s, requestUri_s, action_s
| order by TimeGenerated desc

Application Gateway 日志查询 #

若502由Application Gateway返回，需调整查询逻辑，避免因过滤条件过严遗漏记录：

1. 查询所有502响应记录：

AzureDiagnostics
| where Category == "ApplicationGatewayAccessLog"
| where serverStatus_s == "502"
| where TimeGenerated > ago(30d)
| project TimeGenerated, srcIp_s, requestUri_s, serverStatus_s, host_s
| order by TimeGenerated desc

2. 排查后端健康问题导致的502：

AzureDiagnostics
| where Category == "ApplicationGatewayBackendHealthLog"
| where TimeGenerated > ago(30d)
| project TimeGenerated, backendPoolName_s, backendAddress_s, backendHealthStatus_s
| order by TimeGenerated desc

注意：若之前的requestUri_s过滤条件过于严格，可先移除该条件，找到所有502记录后再筛选与Webhook相关的流量。

额外排查提示 #

• 缩小日志时间范围：针对近期的失败请求，将ago(30d)改为ago(1h)或ago(6h)，提升查询效率并避免遗漏
• 检查IP Group配置：确认第三方新IP未被加入允许的IP Group，这类拒绝流量只会出现在防火墙的网络规则日志中
• 验证规则优先级：确保防火墙的允许规则优先级高于拒绝规则，避免合法流量被误拦截

内容的提问来源于stack exchange，提问作者Jeroen