Ein STRACE auf den Prozess zeigt es schnell:
root@AZLX:/# strace -p 1330
strace: Process 1330 attached
select(0, NULL, NULL, NULL, {tv_sec=3, tv_usec=258420}) = 0 (Timeout)
openat(AT_FDCWD, "/var/lib/waagent/events", O_RDONLY|O_Nla	ONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3
fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
getdents(3, /* 2 entries */, 32768)     = 48
getdents(3, /* 0 entries */, 32768)     = 0
close(3)                                = 0
select(0, NULL, NULL, NULL, {tv_sec=60, tv_usec=0}) = 0 (Timeout)
openat(AT_FDCWD, "/var/lib/waagent/events", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3
fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
getdents(3, /* 3 entries */, 32768)     = 88
getdents(3, /* 0 entries */, 32768)     = 0
close(3)                                = 0
openat(AT_FDCWD, "/var/lib/waagent/events/1530888247260138.tld", O_RDONLY|O_CLOEXEC) = 3
fstat(3, {st_mode=S_IFREG|0644, st_size=521, ...}) = 0
ioctl(3, TCGETS, 0x7fc3cd362f10)        = -1 ENOTTY (Inappropriate ioctl for device)
lseek(3, 0, SEEK_CUR)                   = 0
lseek(3, 0, SEEK_CUR)                   = 0
fstat(3, {st_mode=S_IFREG|0644, st_size=521, ...}) = 0
read(3, "{\"eventId\": 1, \"providerId\": \"69"..., 522) = 521
read(3, "", 1)                          = 0
close(3)                                = 0
unlink("/var/lib/waagent/events/1530888247260138.tld") = 0
socket(AF_INET, SOCK_STREAM|SOCK_CLOEXEC, IPPROTO_TCP) = 3
ioctl(3, FIONBIO, [1])                  = 0
connect(3, {sa_family=AF_INET, sin_port=htons(80), sin_addr=inet_addr("168.63.129.16")}, 16) = -1 EINPROGRESS (Operation now in progress)
poll([{fd=3, events=POLLOUT|POLLERR}], 1, 10000) = 1 ([{fd=3, revents=POLLOUT}])
getsockopt(3, SOL_SOCKET, SO_ERROR, [0], [4]) = 0
setsockopt(3, SOL_TCP, TCP_NODELAY, [1], 4) = 0
poll([{fd=3, events=POLLOUT}], 1, 10000) = 1 ([{fd=3, revents=POLLOUT}])
sendto(3, "POST /machine?comp=telemetrydata"..., 210, 0, NULL, 0) = 210
poll([{fd=3, events=POLLOUT}], 1, 10000) = 1 ([{fd=3, revents=POLLOUT}])
sendto(3, "<?xml version=\"1.0\"?><TelemetryD"..., 1325, 0, NULL, 0) = 1325
poll([{fd=3, events=POLLIN}], 1, 10000) = 1 ([{fd=3, revents=POLLIN}])
recvfrom(3, "HTTP/1.1 200 OK\r\nContent-Type: t"..., 8192, 0, NULL, NULL) = 142
getsockname(3, {sa_family=AF_INET, sin_port=htons(41190), sin_addr=inet_addr("10.0.1.4")}, [16]) = 0
getpeername(3, {sa_family=AF_INET, sin_port=htons(80), sin_addr=inet_addr("168.63.129.16")}, [16]) = 0
close(3)                                = 0
select(0, NULL, NULL, NULL, {tv_sec=60, tv_usec=0}^Cstrace: Process 1330 detached
 <detached ...>