locked
Unexplained Evening Storage Activity RRS feed

  • Question

  • I just recently opened up a trial account and have been playing around with Azure websites and storage.  When I got in this morning, I took a look at my Azure portal and it showed my storage activity suddenly jump at 5pm from zero to ~1K request/hr in table storage and ~300/hr in both blob and queue storage.  This continued for 7 hours straight and then everything dropped back down to zero at 1am.

    My first instinct is to assume this is the Azure service performing routine backups/maintenance, which is fine, and it doesn't appear to be a terribly expensive amount of activity, but a couple things bother me.

    • I never created any queues or tables, and my storage containers are empty, so there is nothing to back up, so what were they doing for 7 hours?
    • When I first saw this activity, I feared somebody had hijacked my account.  How am I supposed to tell the difference between my activity and Azure backend maintenance activity? 
    Wednesday, April 15, 2015 2:10 PM

Answers

  • Okay now I think I know what's been happening.  I reviewed the activity logs and saw that all the unexplained activity was coming from Microsoft IP addresses and they were all requests for service properties.  I think what is happening is that I leave the portal interface open on the storage metrics page and the site is continually pulling metric data to display in the interface.  I can only assume the activity ceased at 1am because that is when my session timed out.

    Thanks again for your assistance Manu.


    Wednesday, April 15, 2015 9:19 PM
  • Hi,

    Please enable Logging in monitoring service of Azure storage account in your management portal.

    The diagnostics logs are saved in a blob container named $logs in your storage account. Please refer the following articles for types of entries that can be logged by enabling logging feature:

    https://msdn.microsoft.com/library/azure/hh343262.aspx?f=255&MSPPError=-2147217396

    https://msdn.microsoft.com/en-us/library/azure/dn782840.aspx

    Regards,

    Manu

    • Marked as answer by Manu Rekhar Thursday, April 16, 2015 12:30 PM
    Wednesday, April 15, 2015 4:46 PM

All replies

  • Hi,

    Please enable Logging in monitoring service of Azure storage account in your management portal.

    The diagnostics logs are saved in a blob container named $logs in your storage account. Please refer the following articles for types of entries that can be logged by enabling logging feature:

    https://msdn.microsoft.com/library/azure/hh343262.aspx?f=255&MSPPError=-2147217396

    https://msdn.microsoft.com/en-us/library/azure/dn782840.aspx

    Regards,

    Manu

    • Marked as answer by Manu Rekhar Thursday, April 16, 2015 12:30 PM
    Wednesday, April 15, 2015 4:46 PM
  • Thanks Manu,

    I looked into this briefly, but it seemed odd to me that I have to write code to enable and review diagnostic logs.  This seems like the kind of thing that should be accessible via the portal right?

    With that said, it may still be my best option to try and get to the bottom of this, so I'll take a swing at it.  Thanks again.

    Wednesday, April 15, 2015 7:33 PM
  • Update:

    It turns out the guidance I was reading on how to enable Storage Logging was out of date.  Indeed it can be enabled right from the portal as I suspected it should be.  :)

    It's enabled now.  I just have to wait for some activity to surface.


    Wednesday, April 15, 2015 8:00 PM
  • Okay now I think I know what's been happening.  I reviewed the activity logs and saw that all the unexplained activity was coming from Microsoft IP addresses and they were all requests for service properties.  I think what is happening is that I leave the portal interface open on the storage metrics page and the site is continually pulling metric data to display in the interface.  I can only assume the activity ceased at 1am because that is when my session timed out.

    Thanks again for your assistance Manu.


    Wednesday, April 15, 2015 9:19 PM
  • Yes, Bob. If you keep the Management Portal open, then there will communication with portal and Azure to display & update the performance metrics which will show up in the activity logs and metrics.  Please logout from the portal when not in use.

    Regards,

    Manu

    Thursday, April 16, 2015 12:30 PM