Load Balancer and Application Gateway 502 errors

Keep the gateway running for both breaks, then clean up.

1Break it: a slow report page

Users open a report that takes 90 seconds to build:

curl.exe -s -o NUL -w "status %{http_code} in %{time_total} s" http://$agwIp/slow
az network application-gateway show-backend-health --resource-group rg-saat-l71 --name agw-l71 --query "backendAddressPools[0].backendHttpSettingsCollection[0].servers[].{address:address, health:health, log:healthProbeLog}" -o json

You should see something like this:

status 502 in 30.112 s
[
  {
    "address": "10.71.1.4",
    "health": "Healthy",
    ...

The backend is Healthy and the home page works, yet /slow returns 502 after almost exactly the request timeout. The gateway gave up waiting; the app was still working on the report. That timing is the giveaway.

Fix it: the real fix is to make the report asynchronous or faster. If the business accepts a long wait, raise the request timeout for these settings and test again:

az network application-gateway http-settings update --resource-group rg-saat-l71 --gateway-name agw-l71 --name appGatewayBackendHttpSettings --timeout 120 -o none
curl.exe -s -o NUL -w "status %{http_code} in %{time_total} s" http://$agwIp/slow

You should see status 200 after about 90 seconds.

Long timeouts tie up connections, so in production put slow URLs on their own backend settings with a path-based rule, rather than raising the timeout for the whole site.

2Break it: a health page that needs a login

The app team asks for a proper health probe on /health. Create a custom probe and attach it to the backend settings:

az network application-gateway probe create --resource-group rg-saat-l71 --gateway-name agw-l71 --name probe-health --protocol Http --host localhost --path /health --interval 10 --timeout 5 --threshold 2 -o none
az network application-gateway http-settings update --resource-group rg-saat-l71 --gateway-name agw-l71 --name appGatewayBackendHttpSettings --probe probe-health -o none
curl.exe -s -o NUL -w "status %{http_code} in %{time_total} s" http://$agwIp/
az network application-gateway show-backend-health --resource-group rg-saat-l71 --name agw-l71 --query "backendAddressPools[0].backendHttpSettingsCollection[0].servers[].{address:address, health:health, log:healthProbeLog}" -o json

After a minute you should see something like this:

status 502 in 0.012 s
[
  {
    "address": "10.71.1.4",
    "health": "Unhealthy",
    "log": "Received invalid status code: 401 in the backend server's HTTP response. As per the health probe configuration, 200-399 is the acceptable status code. Either modify probe configuration or resolve backend issues."
  }
]

An instant 502 on every page: no healthy backend. The app is running and answered the probe, but with 401, because /health sits behind the app’s login. The probe log says so plainly.

Fix it: point the probe at a health page that doesn’t need a login, and check:

az network application-gateway probe update --resource-group rg-saat-l71 --gateway-name agw-l71 --name probe-health --path /healthz -o none
az network application-gateway show-backend-health --resource-group rg-saat-l71 --name agw-l71 --query "backendAddressPools[0].backendHttpSettingsCollection[0].servers[].{address:address, health:health, log:healthProbeLog}" -o json
curl.exe -s -o NUL -w "status %{http_code} in %{time_total} s" http://$agwIp/

Health is Healthy with a 200 from /healthz, and the home page returns 200 again.

Accepting 401 in the probe’s status codes would also turn it green, but then the probe would stay green even when the app is broken. A dedicated, anonymous health page that checks the app’s real dependencies is the better design.

3Clean up

Delete the lab resource group (the gateway bills by the hour):

az group delete --name rg-saat-l71 --yes

✅ Checkpoint: You told a timeout 502 from a probe 502 by timing and backend health, and fixed both properly.