How a Single Bad Account Brought Down a Real-Time Health Connectivity System

In January 2026, a real-time user connectivity system used by hospitals and EMS experienced a sustained traffic crisis lasting nearly four weeks, with heartbeat events surging to eight times normal volume. The root cause turned out to be 507 zombie sessions running stale client code and one user account responsible for a third of all token API traffic. The system's single-partition Azure Event Hub became a critical bottleneck, as it allowed only one processor at a time, causing a growing backlog that made facility status data lag behind reality. Sustained traffic also triggered SNAT port exhaustion on the Consumption plan, creating a self-reinforcing failure loop of retries and further load. The engineering team resolved the crisis by increasing Event Hub partitions, migrating to Azure Container Apps, and adopting KEDA for event-driven autoscaling, while temporarily tripling the client heartbeat interval to reduce incoming load.
This is an AI-generated summary. ShortSingh links to the original source for the complete article.
Discussion (0)
Log in to join the discussion and vote.
Log in