Storage account anormal high Transactions Problem

Question

Storage account anormal high Transactions Problem

rui dias 21

We only use file share cifs on a Linux server at Microsoft, we can't see or prove that there are reads or writes occurring to the file storage via Linux or Azure, we tripled the bill due to anomalous transactions and we can't see how.

Deleted

This comment has been deleted due to a violation of our Code of Conduct. The comment was manually reported or identified through automated detection before action was taken. Please refer to our Code of Conduct for more information.
Hari Babu Vattepally 1,820 Reputation points Microsoft External Staff

2025-03-03T14:36:35.4233333+00:00

Hi @rui dias,

I understand that there is an anomalous high transaction in your Storage account, which are not able to see how it is happening.

There could be multiple factors in high transaction problems.

It could be due to background process on the Linux server, Misconfigured applications causing excessive read/write operations.

It could also be due to Monitoring and logging tools which frequently accessing the storage and Network issue may also lead to multiple transaction attempts.

I would suggest you to please enable Diagnostic Settings for your Storage account.

Navigate to your Storage account in Portal and Under Monitoring Select Diagnostic Setting and enable logging for file service.

Follow the document below for more information in enabling Diagnostic Setting.

Diagnostic settings in Azure Monitor.

Setting up the Azure Monitor to track metrics and logs related to your Azure File Share and analyze the logs to identify any anomalous transactions.

Also, please review your Azure billing details to identify the specific services or transactions that contributed to the increased costs. However, we can also use Azure Cost Management tool to review spending trends and please check for any unusual resource usage or sudden spikes in transactions.

I would recommend contacting, Billing and Subscription team would be the best to provide more insight and guidance on this scenario based on your region, subscription and data. It's the best choice for you. https://azure.microsoft.com/en-us/support/options/

I would also recommend you to please additional details of the issue by elaborating the scenarios which helps us in the clearing the bottle necks and we can be able to provide more insights in resolving the issue.

I hope this helps! Please let us know in comments sections if there are any further questions. We will be glad to assist you closely.

Please do consider to “up-vote” wherever the information provided helps you, this can be beneficial to other community members.
Deleted

This comment has been deleted due to a violation of our Code of Conduct. The comment was manually reported or identified through automated detection before action was taken. Please refer to our Code of Conduct for more information.
rui dias 21 Reputation points

2025-03-03T14:54:47.0833333+00:00

We enabled diagnostic settings on the file storage account from the beginning.

The question is how we see what was written or is being written by Azure Logs.

We were billed as LRS Write Operations.

in linux whit monitoring tools in real time cant see or prove..
Hari Babu Vattepally 1,820 Reputation points Microsoft External Staff

2025-03-03T17:19:24.6+00:00

Hi @rui dias,

Thanks for giving additional details of the issue.

As you said that diagnostic settings have already begin enabled on the file storage account. You can access resource logs either as a blob in a storage account, as event data, or through Log Analytics queries. For information about how to send resource logs to different destinations, Azure resource logs.

Here, requests made by the Azure Files service itself, such as log creation or deletion, aren't logged.

Please use the Kusto quires where you can analyze monitoring data in the Azure Monitor Logs / Log Analytics store by using the Kusto query language (KQL).

https://learn.microsoft.com/en-us/azure/storage/files/storage-files-monitoring#kusto-queries

Please let me know if the issue is resolved by following the above or still persists. We would like to assist you more with the solution.
Deleted

This comment has been deleted due to a violation of our Code of Conduct. The comment was manually reported or identified through automated detection before action was taken. Please refer to our Code of Conduct for more information.
rui dias 21 Reputation points

2025-03-04T11:08:57.6266667+00:00
rui dias 21 Reputation points

2025-03-04T13:33:09.7633333+00:00

no results on the Kusto query
Hari Babu Vattepally 1,820 Reputation points Microsoft External Staff

2025-03-06T10:20:54.65+00:00

Hi @rui dias,

Just checking in to see if the above answer helped. If this answers your query, do click Accept Answer and Yes for was this answer helpful. And, if you have any further query do let us know.
rui dias 21 Reputation points

2025-03-06T15:22:04.3666667+00:00

Good afternoon

Thank you for your attention and help

container named $logs Overview says "No results"

We are still unable to verify/prove the existence of these recordings in the Linux vm, the only place where this unit is mounted, developers say they have no code pointing to that unit.

The question is, how in Azure can we check what was billed to us?

We know that we were billed for recording and we see in the graphs that this recording is happening, we know on which days it happened, thats fine
But where are these files, which files were these files in which folders were they recorded???

I have activated diagnostics in the storage since the beginning, as you can see in the in the previous image,

and I am aware of the Queries hub, but it does not return results...

will we have to have a "Log Analytics workspaces" active??? for Queries hub

If so, what will the cost be for our 600GB storage?

If this is the case, it is also strange to have a cost extra to the service just to check if what was written in the storage corresponds to what was billed

i have a tiket open for Billing, whit the sames questions , lets see ...
Hari Babu Vattepally 1,820 Reputation points Microsoft External Staff

2025-03-07T07:59:40.6033333+00:00

Hi rui dias,

Greetings!

Thanks for providing more details and raising a support ticket with the Billing team. I hope they will be helping out more information related to the issue.

However, The Queries hub in Azure Monitor depends on data stored in a Log Analytics workspace. If your diagnostics are not linked to a Log Analytics workspace, the Queries hub will not return results. This is likely the reason you cannot retrieve the information you need.

Log Analytics workspaces generate costs based on the amount of data ingested and retained. For 600GB, the cost depends on the region and pricing tier, with Azure Monitor Logs charging for both data ingestion and retention. You can find the detailed pricing information here.

As you have raised ticket with Billing team, once we have an update it will be helpful to narrow down the case. We will wait for the response from billing team.

1 answer

Your answer

Deleted

This comment has been deleted due to a violation of our Code of Conduct. The comment was manually reported or identified through automated detection before action was taken. Please refer to our Code of Conduct for more information.
rui dias 21 Reputation points

2025-03-03T14:54:47.0833333+00:00

We enabled diagnostic settings on the file storage account from the beginning.

The question is how we see what was written or is being written by Azure Logs.

We were billed as LRS Write Operations.

in linux whit monitoring tools in real time cant see or prove..
Hari Babu Vattepally 1,820 Reputation points Microsoft External Staff

2025-03-03T17:19:24.6+00:00

Hi @rui dias,

Thanks for giving additional details of the issue.

As you said that diagnostic settings have already begin enabled on the file storage account. You can access resource logs either as a blob in a storage account, as event data, or through Log Analytics queries. For information about how to send resource logs to different destinations, Azure resource logs.

Here, requests made by the Azure Files service itself, such as log creation or deletion, aren't logged.

Please use the Kusto quires where you can analyze monitoring data in the Azure Monitor Logs / Log Analytics store by using the Kusto query language (KQL).

https://learn.microsoft.com/en-us/azure/storage/files/storage-files-monitoring#kusto-queries

Please let me know if the issue is resolved by following the above or still persists. We would like to assist you more with the solution.
Deleted

This comment has been deleted due to a violation of our Code of Conduct. The comment was manually reported or identified through automated detection before action was taken. Please refer to our Code of Conduct for more information.
rui dias 21 Reputation points

2025-03-04T11:08:57.6266667+00:00
rui dias 21 Reputation points

2025-03-04T13:33:09.7633333+00:00

no results on the Kusto query
Hari Babu Vattepally 1,820 Reputation points Microsoft External Staff

2025-03-06T10:20:54.65+00:00

Hi @rui dias,

Just checking in to see if the above answer helped. If this answers your query, do click Accept Answer and Yes for was this answer helpful. And, if you have any further query do let us know.
rui dias 21 Reputation points

2025-03-06T15:22:04.3666667+00:00

Good afternoon

Thank you for your attention and help

container named $logs Overview says "No results"

We are still unable to verify/prove the existence of these recordings in the Linux vm, the only place where this unit is mounted, developers say they have no code pointing to that unit.

The question is, how in Azure can we check what was billed to us?

We know that we were billed for recording and we see in the graphs that this recording is happening, we know on which days it happened, thats fine
But where are these files, which files were these files in which folders were they recorded???

I have activated diagnostics in the storage since the beginning, as you can see in the in the previous image,

and I am aware of the Queries hub, but it does not return results...

will we have to have a "Log Analytics workspaces" active??? for Queries hub

If so, what will the cost be for our 600GB storage?

If this is the case, it is also strange to have a cost extra to the service just to check if what was written in the storage corresponds to what was billed

i have a tiket open for Billing, whit the sames questions , lets see ...
Hari Babu Vattepally 1,820 Reputation points Microsoft External Staff

2025-03-07T07:59:40.6033333+00:00

Hi rui dias,

Greetings!

Thanks for providing more details and raising a support ticket with the Billing team. I hope they will be helping out more information related to the issue.

However, The Queries hub in Azure Monitor depends on data stored in a Log Analytics workspace. If your diagnostics are not linked to a Log Analytics workspace, the Queries hub will not return results. This is likely the reason you cannot retrieve the information you need.

Log Analytics workspaces generate costs based on the amount of data ingested and retained. For 600GB, the cost depends on the region and pricing tier, with Azure Monitor Logs charging for both data ingestion and retention. You can find the detailed pricing information here.

As you have raised ticket with Billing team, once we have an update it will be helpful to narrow down the case. We will wait for the response from billing team.

Answer 1

Hi @rui dias

Apologies for delay in replay, As per your findings since there is no output on the kusto query which you tried, please make sure that they are correctly targeting the logs from your file storage account. Please check and adjust your quires to capture the specific data you are looking for.

However, as you mentioned that you are using Monitoring tools in Linux, please make sure that they are configured to capture all relevant operations. It will be also helpful to check Azure Monitor for any Alerts or Metrics that could indicate unusual activity.

Also, please try checking for the logs that are stored in a container named $logs within your storage account. You can access these logs using the Blob service API. They will contain entries for each transaction, which will help you identify the operations being performed.

Please check in the Metric of your Storage account, in Metric Namespace select your File share, as shown in the below image. Here, you can find transactions, egress, ingress metrics.

User's image If you are still not able to find the transactions, I would recommend contacting, Billing and Subscription team would be the best to provide more insight and guidance on this scenario based on your region, subscription and data. It's the best choice for you. https://azure.microsoft.com/en-us/support/options/

They will do their best to help you, regarding expenses incurred. You can follow the steps described to create the support request: https://learn.microsoft.com/en-us/azure/azure-portal/supportability/how-to-create-azure-support-request#open-a-support-request-from-the-global-header

Please select 'billing' in the Issue Type, as shown below:

User's image

I hope this helps! Please let us know if you have any further quires, we will be glad to assist you closely.

Please do consider to “up-vote” wherever the information provided helps you, this can be beneficial to other community members.

Share via

Storage account anormal high Transactions Problem

1 answer

Your answer