# Separate Load Balancer data-path health from application availability

> Check what the infrastructure probe observes and what happens when no backend path exists.

- Canonical URL: https://update.dsesecurity.com/updates/dse-20260909-131-separate-load-balancer-data-path-health-from-application-availability/
- Publisher: Detection Systems & Engineering (DSE Security)
- Author: DSE Security Editorial Team
- Published: 2026-09-10T00:29:45+00:00
- Modified: 2026-09-10T00:52:38+00:00
- Last reviewed by DSE: 2026-09-09
- Resource type: Guide
- DSE priority: Information
- Topics: Cybersecurity, Networks & Infrastructure
- Reading time: 1 minutes

## What you need to know

Check what the infrastructure probe observes and what happens when no backend path exists.

## Potentially affected

Azure Standard Load Balancer monitoring configurations.

## DSE recommendation

Pair data-path monitoring with backend membership checks and an application-level test.

## Article

## Source facts

The data-path availability probe simulates traffic through the load-balancing rule to the host of a backend VM. The host responds; the VM itself does not receive that probe traffic. Its result is therefore different from an application response inside the guest.

When backend pools are empty, there is no valid data path to probe. Microsoft says the metric is then unavailable and configured alerts on that metric do not trigger. [Microsoft Learn](https://learn.microsoft.com/en-us/azure/load-balancer/load-balancer-standard-diagnostics).

## Applicability

Identify the frontend rule, intended backend membership, and the application transaction whose availability matters. Keep infrastructure-path health, backend health-probe state, and a real user transaction distinct in the monitoring design.

## DSE recommendation

DSE recommends writing an acceptance statement for each signal before setting alert thresholds. Explicitly account for an empty backend pool instead of assuming the data-path alert covers it. Assign an owner to membership drift and define an application test that reaches the intended service through the frontend.

## Verification

In a nonproduction load balancer, compare healthy traffic, an application failure, and an empty-pool condition. Record which signal changes in each case and whether the expected notification occurs. Inspect the application response separately from metric presence. Preserve the configured rule and backend list with the observed results before relying on the alert set.

## Official references

[Microsoft Learn: Load Balancer Diagnostics](https://learn.microsoft.com/en-us/azure/load-balancer/load-balancer-standard-diagnostics). Source retrieved September 9, 2026.

## Primary reference

- Name: Load Balancer Diagnostics - Azure Load Balancer | Microsoft Learn
- Authority: Microsoft Learn
- URL: https://learn.microsoft.com/en-us/azure/load-balancer/load-balancer-standard-diagnostics
- Source publication date: Not stated by the source

## Citation and use

Preferred citation: “Separate Load Balancer data-path health from application availability,” DSE Security, https://update.dsesecurity.com/updates/dse-20260909-131-separate-load-balancer-data-path-health-from-application-availability/
Publishing principles: https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/
Usage and citation policy: https://update.dsesecurity.com/usage/
Copyright © 2026 Detection Systems & Engineering. All rights reserved.