An Azure real-time data ingestion service.
On Standard, Event Hubs cannot attribute throttling to a specific producer or consumer process from built-in logs. The metric exposes only EntityName and OperationResult, and dimensions are not exported through diagnostic settings. Runtime Audit and Application Metric logs, which provide richer client data, require Premium or Dedicated.
At namespace level, split Throttled Requests by EntityName and OperationResult, then correlate each one-minute spike with Incoming or Outgoing Bytes, Incoming or Outgoing Messages, and Incoming Requests. Standard capacity is limited by both event count and bytes and is shared across the namespace, so low average counts can still hide bursts or large payloads.
For exact attribution, instrument every client with a stable process name, event hub, operation, batch size, payload bytes, latency, and ServerBusy or QuotaExceeded exceptions. Query those application logs over the spike window. A distinct Entra application or SAS policy for each workload also makes future audit correlation easier.