Telemetry

What Kustodian shares

Kustodian can share two kinds of data, each only if you say yes: Graph compatibility findings, and error reports when Kustodian fails in a way it shouldn’t. Both are off until you opt in, and neither holds your tenant or your data. Separately, you can choose to send a full report for a single error, after you have seen all of it.

This page covers all three: Graph compatibility findings, error reports and full reports. They go to the same place, described below.

Graph compatibility findings: why it helps

Graph doesn’t support every query option on every collection. Some refuse $top=999, some refuse $count, $orderby or $select, some refuse a filter on a nested or multi-valued column, and some won’t list certain columns at all. Kustodian finds out by probing: it sends the request, reads the refusal and tries again without the option. It remembers what it learnt for 7 days, on your machine.

Probing costs time and requests, and some collections, such as sign-in logs, throttle hard. When findings are shared, the ones that hold across tenants can be built into Kustodian, so every user’s queries on those tables skip the probing from the first run.

Kustodian also shares where it falls short: a refusal from Graph it couldn’t work around, a filter it couldn’t send to Graph and ran locally instead, a permission Graph didn’t accept although the schema lists it, and a limit a query hit. Those show which tables, filters and limits to fix first.

Graph compatibility findings: what is sent

One event each time probing finds something new about a table, or a run finds one of the things below. The event is exactly this:

{
  "name": "Microsoft.ApplicationInsights.Event",
  "time": "2026-11-02T12:00:00.0000000+00:00",
  "iKey": "<Kustodian's Application Insights key>",
  "tags": { "ai.application.ver": "0.93.0", "ai.location.ip": "0.0.0.0" },
  "data": {
    "baseType": "EventData",
    "baseData": {
      "ver": 2,
      "name": "GraphProbeFinding",
      "properties": {
        "path": "auditLogs/signIns",
        "finding": "topLimit",
        "detail": "500"
      }
    }
  }
}

Besides path, each kind of event holds only these properties:

Error reports

When Kustodian fails in a way it shouldn’t, it can send one short report so the bug can be found and fixed. That means a bug in Kustodian, not a mistake in your query or a permission you haven’t been given. These send a report:

• the query engine process crashed or sent an answer Kustodian couldn’t read (not running out of memory, timing out or being cancelled, which are the query’s doing)
• a run failed unexpectedly, or an action in the app threw an error Kustodian doesn’t expect
• an unhandled error in the app’s host process or in its web interface

Expected errors, such as a missing permission, a sign-in or consent prompt, a typo in a query or Graph throttling, send nothing. A report is sent at most once for the same problem and at most 20 times each time Kustodian starts.

What an error report is

One event, built by Kustodian itself, of the type Application Insights uses for exceptions. It has the same ai.application.ver and ai.location.ip tags as the events above. This is what it holds:

{
  "name": "Microsoft.ApplicationInsights.Exception",
  "data": {
    "baseType": "ExceptionData",
    "baseData": {
      "ver": 2,
      "exceptions": [{
        "typeName": "System.IO.EndOfStreamException",
        "message": "engine.crash",
        "parsedStack": [
          { "level": 0, "method": "Kustodian.Graph.Engine.GraphEnginePool.RunAsync", "assembly": "Kustodian.Graph" },
          { "level": 1, "method": "<external>", "assembly": "" }
        ]
      }],
      "properties": {
        "reportId": "K7Q2M9XD",
        "kind": "engine.crash",
        "os": "Darwin 25.6.0",
        "arch": "Arm64",
        "runtime": "10.0.0",
        "exitCode": "134",
        "source": "graph",
        "trail": "run.start(graph) +0s; engine.exit(134) +4s"
      }
    }
  }
}

Full reports

Next to every error Kustodian shows, you see a report ID and, in official releases, a Send details link. It opens a window with the whole report as text, so the developer can reproduce the problem. A full report may contain data from your tenant: it can hold your query, values in it, Graph’s error text, user names and IDs. That is why it works differently:

• You see all of it first. The text shown is exactly what is sent.
• Every section has a checkbox, so you can leave it out, and the query is editable, so you can blank out values.
• It is sent only when you click Send. Closing the window sends nothing.
• It does not depend on the error reports setting: each click is your own choice for that one report.

The sections, where the error has them:

It is sent as one event named Kustodian.FullErrorReport, with the same report ID, the error’s kind (when the details are still kept) and one property per section you left ticked. Application Insights allows 8,192 characters per property, so a longer section is cut there and ends in … (cut). Kustodian keeps what a full report needs in memory only: the last 10 unexpected and 20 expected errors, each for 30 minutes. If the details are gone by the time you click, the window says so and offers what the page still has. Nothing is written to disk.

Where it goes and how long it is kept

Everything on this page goes to an Azure Application Insights resource in Azure’s North Europe region (Ireland), owned by the Kustodian maintainer. Microsoft processes it as Azure’s data processor. Application Insights stores the client IP as 0.0.0.0, and Kustodian sends 0.0.0.0 as the location IP too, so no address or location is kept. Events and reports are kept for 90 days, then deleted. They are used only to decide which tables get built-in query settings and to find and fix bugs in Kustodian, and are not sold or shared with anyone.

Opting in and out

The first time you start a version of Kustodian that has these, it asks once about each. If you said yes before Kustodian shared run findings, it asks again and shares nothing until you answer. If you said yes to Graph findings, it still asks about error reports, because that is a different thing. Nothing is shared before you answer, and closing a question without answering shares nothing (it asks again at the next start). To change an answer, open Settings and tick or untick Share Graph compatibility findings or Send error reports. It applies at once. The choices are stored as "telemetry" and "errorReports" in settings.json in Kustodian’s data folder. Full reports have no setting: you choose each one.

Check it yourself

Kustodian is open source. The code that builds and sends the event is AppInsightsTelemetry.cs, and what triggers it is SharedProbeCache.cs and SharedRunFindings.cs. For error reports, ErrorScrubber.cs is the filter that decides what may pass, ErrorTrail.cs keeps the trail and ErrorReporter.cs builds and sends the reports. Questions or concerns: open an issue.