get /server/rest/info/healthcheck loop

[YiYongHuang]

Recently, these 5 lines repeats every IIS minutes in the IIS logs, the request destination IP and Origination IP numbers are the same.  We are not sure what is happening, it looks like a bot calling itself.  

025-05-12 22:51:30 xyz.xyz.xyz.xyz GET /server/rest/info/healthcheck f=json& 443 - xyz.xyz.xyz.xyz HTTP/1.1 Apache-HttpClient/4.5.13+(Java/11.0.11) - http://www.arcgis.com 200 0 0 536 227 23
2025-05-12 22:51:30 xyz.xyz.xyz.xyz POST /server/admin/data/findItems/ - 443 - xyz.xyz.xyz.xyz HTTP/1.1 Apache-HttpClient/4.5.13+(Java/11.0.11) - http://www.arcgis.com 200 0 0 1496 551 38
2025-05-12 22:51:30 xyz.xyz.xyz.xyz POST /server/admin/data/findItems/ - 443 - xyz.xyz.xyz.xyz HTTP/1.1 Apache-HttpClient/4.5.13+(Java/11.0.11) - http://www.arcgis.com 200 0 0 4027 555 53
2025-05-12 22:51:30 xyz.xyz.xyz.xyz POST /server/admin/data/findItems/ - 443 - xyz.xyz.xyz.xyz HTTP/1.1 Apache-HttpClient/4.5.13+(Java/11.0.11) - http://www.arcgis.com 200 0 0 4027 555 68
2025-05-12 22:51:30 xyz.xyz.xyz.xyz POST /server/admin/data/findItems/ - 443 - xyz.xyz.xyz.xyz HTTP/1.1 Apache-HttpClient/4.5.13+(Java/11.0.11) - http://www.arcgis.com 200 0 0 1496 551 35

[JoshuaBixby]

Although those URLs can be called externally by end-users, they are used extensively by various ArcGIS Enterprise components in any deployment.  ArcGIS Enterprise isn't a piece of software, it is a system made up of many pieces of software, and those pieces are constantly communicating with each other.  I doubt what you are seeing is abnormal, but if you have concerns then open an Esri Support case.

[YiYongHuang]

Thank you JoshuaBixby, We just opened a case with Esri Support.