Mysterious Nightly CPU Spikes on App Service Plans (22:00-10:00) Despite Low Traffic

1. Split Metrics by Instance

Start by analyzing CPU usage per instance in Azure Monitor. Aggregated metrics can hide anomalies. Use short time windows and instance-level views to pinpoint which VM is spiking.

2. Enable Auto-Heal

Configure Auto-Heal in the App Service diagnostics blade. Set rules to trigger on high CPU usage and automatically recycle the app or log a snapshot for deeper analysis.

3. Inspect App Pool Recycling

Check if the App Service Plan is recycling application pools during night hours. This is a common default behavior. Review registry settings like:

• /Configuration/VssHealthAgent/AppPoolRecycling/FromHour
• /Configuration/VssHealthAgent/AppPoolRecycling/ToHour
• /MinimumUptimeInHours

Adjust these if needed to reduce impact.

4. Use Process Explorer and Minidump

Use the Kudu diagnostics suite to inspect running processes during the spike window. The Process Explorer and Minidump API can help identify unexpected background activity.

5. Review Platform-Level Activity

Azure may perform internal maintenance, diagnostics, or load balancing during off-peak hours. These operations can cause CPU spikes even if your apps are idle. While not always visible, contacting Azure support with logs and screenshots can help confirm this.

6. Check for Load Balancer Anomalies

If using scaled-out App Service Plans, uneven CPU distribution across instances may occur due to load balancer behavior. Consider scaling in or rebalancing instances.

Preventive Measures

• Use Managed Identity for secure access and avoid background tasks running unintentionally.
• Apply Network Security Groups (NSGs) to restrict traffic during off-peak hours.
• Enable Application Insights to track anomalies and correlate them with platform events.