Share via

On a website hosted on Azure with very little traffic, there was a sudden outbound burst of 500GBs of data,We don't know why.

Richard Oliver 0 Reputation points
2025-12-07T01:18:29.05+00:00

We experienced a massive and unexplained 500 Gigabyte outbound data egress spike over a 36-hour period which ended this morning

Confirmed Data: The spike is confirmed in the Azure Portal Network Out Total Metrics for the time window specified.

Diagnostics Failed: We attempted to identify the source process and destination IP using the Kusto Query Language (VMConnection table) in Log Analytics, and the query returned NO RESULTS, confirming the Dependency Agent was not running.

ACTION REQUIRED: We urgently request that a platform engineer from the Azure Networking or Security team manually check the platform-level Network Security Group (NSG) Flow Logs for this VM's network interface during the specified 36-hour period to identify the Destination IP Address of the 500 GB transfer.

Azure Virtual Network
Azure Virtual Network
An Azure networking service that is used to provision private networks and optionally to connect to on-premises datacenters.
0 comments

1 answer

Sort by: Most helpful
Most helpful Newest Oldest
  1. Thanmayi Godithi 2,460 Reputation points Microsoft External Staff Moderator
    2025-12-08T02:14:58.74+00:00

    Hi @Richard Oliver,

    Thank you for reaching out on Microsoft Q&A forum.

    Is the workload running on an Azure Virtual Machine or an on-premises VM?

    As we discussed earlier, NSG flow logs are not currently enabled on your side, which means we don’t have any logging information available to review or analyze the traffic further.

    Additionally, regarding your question about who reactivated the subscription after it was disabled, hope you are checking with billing team. They would have the necessary visibility into subscription‑level actions and can confirm who performed the reactivation.

    Kindly let us know if the above helps or you need further assistance on this issue.

    If the answer is helpful, please click "Accept Answer" and kindly upvote it. If you have extra questions about this answer, please click "Comment".

    0 comments

Your answer

Answers can be marked as 'Accepted' by the question author and 'Recommended' by moderators, which helps users know the answer solved the author's problem.