Spike in storage cost for Hot GRS write operation - how to find the source

Question

Spike in storage cost for Hot GRS write operation - how to find the source

High Coffee 0

There is a sudden spike in "Hot GRS write operation" in a storage account. How can you tell what is causing it and how to remove it?

Hari Babu Vattepally 2,640 Reputation points Microsoft External Staff

2025-03-21T14:16:31.12+00:00

Hi @High Coffee ,

I understand that you would like to know what caused a sudden spike in "Hot GRS write operation" in a storage account.

To diagnose the cause of the sudden spike, navigate to the portal of your storage account, under Monitoring, click on Metrics on the left pane and in the Metric, drop select Ingress under Transactions to pinpoint the source of the spike and its timing.

Also, use the Azure Storage Analytics to log all the requests to the storage account. And, then analyze the $logs container to identify the source of the write operations.

However, also review logs of the applications or services which is interacting with the storage account to identify any unusual activity.

To ensure thorough auditing of access to the storage account, utilize diagnostic settings. This will help you identify the specific users or services responsible for the write operations. By implementing these settings, you can gain a comprehensive understanding of who is accessing and modifying the storage account, thereby enhancing security and accountability.

To Mitigate the issue:

To minimize unnecessary writes, consider batching operations or implementing caching mechanisms.

Also, if GRS isn't necessary, I recommend switching to Locally Redundant Storage (LRS) or Zone-Redundant Storage (ZRS) to eliminate replication overhead.

Please make sure to restrict access to storage accounts to only necessary users and services.

Also, please make sure that all services interacting with the storage account are correctly configured to prevent excessive writes.

I hope by following the above steps, you can be able to identify the source of spike.

Please let us know in the comments below, if the issue is resolved or still persists. We will be glad to assist you closely.

Please do consider to “up-vote” wherever the information provided helps you, this can be beneficial to other community members.
Hari Babu Vattepally 2,640 Reputation points Microsoft External Staff

2025-03-24T14:41:29.9433333+00:00

Hi @High Coffee ,

Just checking in to see if the answers helped. If this answers your query, do click Accept Answer and Yes for was this answer helpful. And, if you have any further query do let us know.
Hari Babu Vattepally 2,640 Reputation points Microsoft External Staff

2025-03-25T15:28:22.4733333+00:00

Hi @High Coffee ,

I'm checking in to ensure that the provided solutions addressed your question effectively. If it resolved your issue, we'd appreciate it if you could mark the response as 'Accept Answer' and confirm it was helpful by clicking 'Yes.' If you have any additional concerns or need further clarification, please don't hesitate to reach out. We're here to support you!"

1 answer

Your answer

Hari Babu Vattepally 2,640 Reputation points Microsoft External Staff

2025-03-24T14:41:29.9433333+00:00

Hi @High Coffee ,

Just checking in to see if the answers helped. If this answers your query, do click Accept Answer and Yes for was this answer helpful. And, if you have any further query do let us know.
Hari Babu Vattepally 2,640 Reputation points Microsoft External Staff

2025-03-25T15:28:22.4733333+00:00

Hi @High Coffee ,

I'm checking in to ensure that the provided solutions addressed your question effectively. If it resolved your issue, we'd appreciate it if you could mark the response as 'Accept Answer' and confirm it was helpful by clicking 'Yes.' If you have any additional concerns or need further clarification, please don't hesitate to reach out. We're here to support you!"

Answer 1

Hi High Coffee,

Thanks for reaching out on Q&A Forum

In order to understand the transactions happening on the account, you can navigate to Metrics under Monitoring tab -> Select Account as Namespace -> Select Transactions as the Metric.

Thereafter you can do a split based on the API Name to check for the API's that are hitting the account. You can get a high level idea from here regarding the transaction and it should ideally be some PUT operation that will be hitting the account.

This however will only be providing only high level view. To understand deeper regarding what is the URI, client IP, User Agent etc, that details can be collected via diagnostic logging that shall help tracking back on best effort basis. If the logging isn't available, then it will be tough to backtrack however this can then server as recommendation to review from your side in case of such issues.

https://learn.microsoft.com/en-us/azure/storage/blobs/monitor-blob-storage?tabs=azure-portal

https://learn.microsoft.com/en-us/azure/storage/blobs/blob-storage-monitoring-scenarios

https://techcommunity.microsoft.com/blog/azurepaasblog/leveraging-storage-analytics-logs-to-analyze-who-accessed-the-storage-account/2173539

Hope the above answer helps! Please let us know do you have any further queries.

Please do not forget to "Accept the answer” and “up-vote” wherever the information provided helps you, this can be beneficial to other community members.

Share via

Spike in storage cost for Hot GRS write operation - how to find the source

1 answer

Your answer