What Azure storage service has the User-Agent tag of 'services_xstore_transport_HTTP2/1.0'

Question

What Azure storage service has the User-Agent tag of 'services_xstore_transport_HTTP2/1.0'

Kif F 0

Does anyone know what service is generating these logs on a GRS storage account? I'm assuming this is Azure backend replication, but these events only started happening less than 48 hours ago.

I've been looking at logs and this has been alerting due to coming from an unknown private IP address, based on key authentication, accessing what should be a restricted file share.

Below is the KQL query on the storage account logs

StorageFileLogs
| order by TimeGenerated desc
| where CallerIpAddress !contains "<Internal CIDR>"
| where AuthenticationHash !contains 'system-1'
| project TimeGenerated, AuthenticationType, StatusCode, CallerIpAddress, UserAgentHeader

These are the results, across a range of IPs. This screenshot shows 100.75.x.y, but there have also been 10.x.y.z IP addresses which don't belong to our internal network environment (either in Azure or otherwise).

Screenshot 2025-12-12 111805

Venkatesan S 1,165 Reputation points Microsoft External Staff Moderator

2025-12-12T01:36:00.0233333+00:00
Hi Kif F,

Thanks for posting question in Microsoft Q&A forum,

Could you please extend your KQL query to include OperationName and StatusText fields?

StorageFileLogs | order by TimeGenerated desc | where CallerIpAddress !contains "<Internal CIDR>" | where AuthenticationHash !contains "system-1" | project TimeGenerated, OperationName, StatusText, AuthenticationType, StatusCode, CallerIpAddress, UserAgentHeader

Once you run it, could you also share the OperationNameandStatusText value that appears in your environment?

Your answer

Venkatesan S 1,165 Reputation points Microsoft External Staff Moderator

2025-12-12T01:36:00.0233333+00:00

Hi Kif F,

Thanks for posting question in Microsoft Q&A forum,

Could you please extend your KQL query to include OperationName and StatusText fields?

StorageFileLogs | order by TimeGenerated desc | where CallerIpAddress !contains "<Internal CIDR>" | where AuthenticationHash !contains "system-1" | project TimeGenerated, OperationName, StatusText, AuthenticationType, StatusCode, CallerIpAddress, UserAgentHeader

Once you run it, could you also share the OperationNameandStatusText value that appears in your environment?

Share via

What Azure storage service has the User-Agent tag of 'services_xstore_transport_HTTP2/1.0'

Your answer