IIS receives too many requests from the user-agent Edge+Health+Probe

IIS logs each and every request into its log file. You may see excessive amount of requests in this file when there is an increased traffic to your site, an Denial-of-Service (DoS) attack, frequent health probes (such as Edge+Health+Probe) or any other similar causes.

In my case, the server was receiving too many requests caused by Edge+Health+Probe user-agent. Here is the sample IIS log:

2019-03-11 02:26:31 TESTWEBAPP GET / X-ARR-LOG-ID=0d171ca8-3692-4453-b9a6-268ef242d0c6 443 – 147.243.84.201 Edge+Health+Probe – – testwebapp.azurewebsites.net 401 71 2147500037 560 793 15

2019-03-11 02:26:31 TESTWEBAPP GET / X-ARR-LOG-ID=c932aeb2-1a84-4ccc-b61f-fb99d560b494 443 – 147.243.132.12 Edge+Health+Probe – – testwebapp.azurewebsites.net 401 71 2147500037 560 793 15

2019-03-11 02:26:32 TESTWEBAPP GET / X-ARR-LOG-ID=1c3cd4f9-6b9e-4313-9ed4-159411ec0d08 443 – 147.243.3.172 Edge+Health+Probe – – testwebapp.azurewebsites.net 401 71 2147500037 560 791 18

2019-03-11 02:26:32 TESTWEBAPP GET / X-ARR-LOG-ID=2cc8de45-606f-4ce7-88a0-c20cd9c4bef6 443 – 147.243.68.76 Edge+Health+Probe – – testwebapp.azurewebsites.net 401 71 2147500037 560 791 15

Solution for too many requests from Edge+Health+Probe

The issue in my environment was the Front Door service. It has a health probe feature that pings sources and records Edge+Health+Probe in the log. Once I disabled this service that I no longer use, no more Edge+Health+Probe requests were made to my IIS server.

Note: If you want to continue using this service, you may want to configure the health probe frequency.

For more information about Azure Front Door Service, please refer to the official Microsoft documentation.

Are you receiving IDX10311 error while using Azure Active Directory (AD)? Check this post out: IDX10311: RequireNonce is ‘true’ (default) but validationContext.Nonce is null

Other scenarios (Load Balancer and Application Gateway)

Some other Azure services have health probes as well. Depending on the service you use, you may see a different user-agent string in IIS logs. Here are the user-agent strings for load balancer and application gateway probes.

• A load balancer health probe records “Load+Balancer+Agent” in IIS logs (Reference):
  2019-03-08 23:08:15 10.0.0.4 GET / – 80 – 168.63.129.16 Load+Balancer+Agent – 200 0 0 187
• An application gateway health probe records IP address in IIS logs:
  2019-03-11 02:28:31 10.0.0.4 GET / – 80 – 10.2.0.5 – – 200 0 0 31

Seeing 503 error while visiting your site? Here is one of the most common causes and solution: HTTP 503 Service Unavailable (Application pool has been disabled)