ff-oce-kusto

Name: ff-oce-kusto
Author: microsoft

Query Kusto and investigate Fluid Framework telemetry, errors, and deployments.

Stars

★ 4,934

Source

GitHub

Updated

2026-07-19

// securityLow risk

Prompt only, no code
Open source
Community-trusted· 4.9k

Running security audit…

Credentials
Network egress
Code execution
Data access
Supply chain

// install

Copy the install command and let the AI configure it · recommended for beginners

Please install the "ff-oce-kusto" skill from askskill:
1. Download https://raw.githubusercontent.com/microsoft/FluidFramework/main/.agency/plugins/ff-oce/skills/ff-oce-kusto/SKILL.md
2. Save it as ~/.claude/skills/ff-oce-kusto/SKILL.md
3. Reload skills and tell me it's ready

// download

Download SKILL.mdInstall manifest ↗

// examples

Investigate a session issue

Prompt

Help me investigate this Fluid Framework Session_Id. Write a Kusto query against Office_Fluid_FluidRuntime_* tables to inspect error types, failure timeline, and related docId.

Expected

Provides runnable Kusto queries and explains how to identify the session errors and impact scope.

Monitor release impact

Prompt

Help me monitor the impact of this FF bump after partner ring deployment. Query render reliability, Scriptor error rate, and major exception trends, and suggest comparison methods.

Expected

Returns Kusto queries for release monitoring and analysis guidance for before-and-after metric comparisons.

Analyze a specific error type

Prompt

I want to investigate DeltaConnectionFailureToConnect errors in Loop/Whiteboard telemetry. Generate Kusto queries grouped by time, platform, and document, and identify high-frequency failure scenarios.

Expected

Outputs targeted queries and grouped analysis for the error, plus likely high-risk scenarios.

// docs

Fluid Framework Kusto Reference

This skill provides a comprehensive reference for Fluid Framework telemetry investigation in Kusto. Load it whenever a Kusto query needs to be written, interpreted, or run against the Office Fluid database.

VPN required. The Office Fluid Kusto cluster (https://kusto.aria.microsoft.com) is only reachable on the Microsoft internal network. If a query fails to connect or returns no results unexpectedly, remind the user to check that their VPN is on before troubleshooting further.

Cluster & Access

Cluster: https://kusto.aria.microsoft.com
Primary database: Office Fluid
Database ID: 6a8929bcfc6d44e9b13fee392ada9cf0 (use this, not the pretty name, as the database parameter in kusto_query)
Automation/stress test database: Office Fluid Test
Database ID: 742fa5a288b045e5beab1a2b8e445a71 — contains office_fluid_ffautomation_* tables used for stress test / pipeline telemetry. These tables are NOT in the primary "Office Fluid" database.
Retention: ~28 days
VPN: Required (Microsoft internal network)
Access requirement: M365HeartbeatTenantUsers group membership

Quick Orientation

The primary tables are:

Office_Fluid_FluidRuntime_Error — all errors (first stop)
Office_Fluid_FluidRuntime_Performance — timing events
Office_Fluid_FluidRuntime_Generic — everything else
union Office_Fluid_FluidRuntime_* — all three at once
OwhLoads (stored function) — denominator for ICE/ACE error rate queries

Key correlation ID hierarchy: Session_Id/Data_hostCorrelationId → Data_pageCorrelationId → Data_docId → Data_containerId

Key deployment ring field: Loop_Audience (FluidRuntime tables), Release_AudienceGroup (OWH/QoS tables)

Using the Full Reference

Before writing any non-trivial Kusto query, read the full reference file:

references/kusto-query-reference.md

This reference contains:

Part 1 — All tables, fields, correlation IDs, version fields, stored functions, partner database schemas (OneNote, OWA, Loop FFX, Video, Scriptor, HostTracker, automation)
Part 2 — Query Cookbook with ~20 sections of ready-to-use queries (session lookup, error timecharts, breadth assessment, version correlation, ICE rate calculations, EU global queries, ODSP flight changes, etc.)
Part 3 — Investigation playbook patterns (incoming partner incident, dataCorruptionError triage, ICE error rate, important notes)
Part 4 — Additional query sections: FF bump tracking (5 queries), render reliability, Scriptor errors, Video telemetry (10+ queries), container reconnects / WhyIsTheContainerStuck(), stress test automation (FindBuildErrors, DidSummarizerRecover, SummarizerView)

Key Reminders

Always use absolute timestamps in IcM notes (not ago()) so queries remain reproducible
Always filter Data_stack !has '.goskope.com' and Data_channelFactoryType !has '.myshn.net' in corruption queries to exclude known reverse proxies
The hll() / dcount_hll(hll_merge(...)) pattern is required for EU-compliant distinct user counts across clusters
For EU data, use macro-expand force_remote = true officefluid_global as X (...) | summarize ...
Loop_Audience (FluidRuntime) and Release_AudienceGroup (OWH/QoS) are the same concept; filter == "Production" to exclude dogfood noise