App Service Plan - Periodic Spikes

Udayasri Bhushan 25 Reputation points
2026-08-14T08:22:32.32+00:00

Additional Issue – Periodic CPU Spikes on App Service Plan

We are also observing regular periodic CPU spikes on our Azure App Service Plan.

Environment

  • App Service Plan: te*********
  • SKU: P0v3
  • OS: Linux
  • Application Type: Web App for Containers
  • Always On: Disabled
  • Health Check: Not configured
  • Application/API traffic: No API requests are occurring during the observed spikes

Observation

The App Service Plan CPU usage shows a highly recurring/periodic CPU usage pattern.

Under normal conditions, CPU usage is generally around 3–10%, but we are observing periodic spikes, with some spikes reaching approximately 23–24%.

The spikes appear to occur at regular intervals, even when there is no corresponding application/API traffic.

We have verified that:

  • Always On is disabled
  • No Health Check is configured
  • There are no known scheduled jobs or application operations running at the time of the spikes
  • No API requests are hitting the application during the observed spikes

The attached Azure Monitor screenshot shows the recurring CPU pattern over the last hour.

Question

Could you please help us determine the cause of these periodic CPU spikes?

Specifically, we would like to understand:

  1. Could these spikes be caused by Azure App Service platform/system processes, container management, monitoring, worker management, or other platform-level operations?
  2. Does Azure App Service perform any periodic operations that could cause CPU consumption on a Linux Web App for Containers?
  3. Since Always On is disabled, no Health Check is configured, and there is no application/API traffic during these periods, could these spikes be related to container startup, warm-up, recycling, platform health checks, or other App Service platform activity?
  4. Is there a way to identify which process or component is consuming CPU during the exact time of these spikes?
  5. Is this CPU pattern expected behavior for a P0v3 Linux Web App for Containers, or should we investigate this as an application/container-level issue?

We would particularly like to understand why the CPU usage follows such a regular periodic pattern, including spikes up to approximately 23–24%, despite there being no apparent application traffic at those times.

The attached Azure Monitor screenshot shows the CPU Percentage metric for testgen-asp-container over the last hour.

Attached the image for your reference.

Thank you.Screenshot 2026-08-14 124853

Azure App Service
Azure App Service

Azure App Service is a service used to create and deploy scalable, mission-critical web apps.

1 answer

Sort by: Oldest
Most helpful Newest Oldest
  1. Saritha Bandaru 665 Reputation points Microsoft External Staff Moderator
    2026-08-15T04:14:40.19+00:00

    Hello @Udayasri Bhushan Thank you for your patience while we completed the investigation with our backend team.

    To help address the questions raised regarding the periodic CPU spikes, we have summarized the findings below.

    Q: What was causing the recurring CPU spikes observed approximately every 30 minutes?

    A: The backend team identified recurring platform-level activities occurring at approximately 30-minute intervals on the worker instance hosting the App Service Plan. The primary processes observed during these intervals were:

    • ImageManager statistics collection activity (ReportStats), which invokes:
      • du --summarize --block-size=1 /mnt/lwasv2/images/layers
      • Azure Security Monitoring Agent (ASM extension heartbeat)
      • Linux memory management process (kswapd0)

    These activities are part of normal platform operations and were found to be responsible for the short-lived CPU increases observed during the investigation.

    Q: Were the CPU spikes caused by application traffic, scheduled jobs, or container activity?

    A: No. We did not identify any abnormal application workload, API traffic, scheduled customer jobs, container restarts, or unexpected container activity that correlated with the observed CPU peaks.

    The investigation indicates that the recurring pattern was associated with worker-level platform operations rather than application processing.

    Q: Why did Azure Monitor show CPU spikes of approximately 23-24% while the detector analysis showed lower CPU values?

    A: The backend confirmed that the difference is due to how the metrics are calculated.

    The worker involved in the investigation has two CPU cores. Azure Monitor reports CPU utilization at the App Service Plan level, while the detector normalizes CPU consumption across the total available CPU capacity of the worker.

    Because the host has two CPUs (total capacity of 200%), the detector divides the CPU percentage by the number of CPU cores. As a result:

    • ~25% CPU shown in Azure Monitor
    • Corresponds to ~12.5% CPU in the detector view

    Therefore, the App Service Plan metric and the detector data are consistent with each other and reflect the same underlying activity. The difference does not indicate an unidentified workload or additional CPU-consuming process.

    Q: Is this behavior expected?

    A: Based on the investigation, the observed periodic CPU activity appears to be expected operational behavior associated with worker-level platform processes. The CPU increases were transient, short-lived, and were not associated with application performance degradation.

    Additionally, after the worker instance was deallocated from the farm on August 19, the recurring pattern was no longer observed, further supporting the conclusion that the activity was related to the specific worker's platform operations rather than the application itself.

    Q: Is any action required from our side?

    A: At this time, no action is required.

    However, if you continue to observe similar recurring patterns on newly assigned workers, or if you notice any impact on application performance, response times, latency, or availability, please let us know and we will be happy to investigate further.

    We appreciate your cooperation throughout this investigation and please feel free to reach out if you have any additional questions.

    Was this answer helpful?

Your answer

Answers can be marked as 'Accepted' by the question author and 'Recommended' by moderators, which helps users know the answer solved the author's problem.