ff-oce-kusto

# Fluid Framework Kusto Reference This skill provides a comprehensive reference for Fluid Framework telemetry investigation in Kusto. Load it whenever a Kusto query needs to be written, interpreted, or run against the Office Fluid database. > **VPN required.** The Office Fluid Kusto cluster (`https://kusto.aria.microsoft.com`) is only reachable on the Microsoft internal network. If a query fails to connect or returns no results unexpectedly, remind the user to check that their VPN is on before troubleshooting further. ## Cluster & Access - **Cluster:** `https://kusto.aria.microsoft.com` - **Primary database:** `Office Fluid` - **Database ID:** `6a8929bcfc6d44e9b13fee392ada9cf0` (use this, not the pretty name, as the `database` parameter in `kusto_query`) - **Automation/stress test database:** `Office Fluid Test` - **Database ID:** `742fa5a288b045e5beab1a2b8e445a71` — contains `office_fluid_ffautomation_*` tables used for stress test / pipeline telemetry. **These tables are NOT in the primary "Office Fluid" database.** - **Retention:** ~28 days - **VPN:** Required (Microsoft internal network) - **Access requirement:** M365HeartbeatTenantUsers group membership ## Quick Orientation The primary tables are: - `Office_Fluid_FluidRuntime_Error` — all errors (first stop) - `Office_Fluid_FluidRuntime_Performance` — timing events - `Office_Fluid_FluidRuntime_Generic` — everything else - `union Office_Fluid_FluidRuntime_*` — all three at once - `OwhLoads` (stored function) — denominator for ICE/ACE error rate queries Key correlation ID hierarchy: `Session_Id`/`Data_hostCorrelationId` → `Data_pageCorrelationId` → `Data_docId` → `Data_containerId` Key deployment ring field: `Loop_Audience` (FluidRuntime tables), `Release_AudienceGroup` (OWH/QoS tables) ## Using the Full Reference Before writing any non-trivial Kusto query, read the full reference file: **`references/kusto-query-reference.md`** This reference contains: - **Part 1** — All tables, fields, correlation IDs, version fields, stored functions, partner database schemas (OneNote, OWA, Loop FFX, Video, Scriptor, HostTracker, automation) - **Part 2** — Query Cookbook with ~20 sections of ready-to-use queries (session lookup, error timecharts, breadth assessment, version correlation, ICE rate calculations, EU global queries, ODSP flight changes, etc.) - **Part 3** — Investigation playbook patterns (incoming partner incident, dataCorruptionError triage, ICE error rate, important notes) - **Part 4** — Additional query sections: FF bump tracking (5 queries), render reliability, Scriptor errors, Video telemetry (10+ queries), container reconnects / `WhyIsTheContainerStuck()`, stress test automation (`FindBuildErrors`, `DidSummarizerRecover`, `SummarizerView`) ## Key Reminders - Always use **absolute timestamps** in IcM notes (not `ago()`) so queries remain reproducible - Always filter `Data_stack !has '.goskope.com'` and `Data_channelFactoryType !has '.myshn.net'` in corruption queries to exclude known reverse proxies - The `hll()` / `dcount_hll(hll_merge(...))` pattern is required for EU-compliant distinct user counts across clusters - For EU data, use `macro-expand force_remote = true officefluid_global as X (...) | summarize ...` - `Loop_Audience` (FluidRuntime) and `Release_AudienceGroup` (OWH/QoS) are the same concept; filter `== "Production"` to exclude dogfood noise