How can I find the source of my Hot LRS Write Operations on Azure Storage Account?

I 've had the exact same problem; after enabling Storage Analytics and inspecting the $logs container I found many log entries that indicate that upon every request towards my Azure Functions, these write operations occur against the following container object:

https://[function-name].blob.core.windows.net:443/azure-webjobs-hosts/locks/linkfunctions/host?comp=lease

In my Azure Functions code I do not explicitly write in any of container or file as such but I have the following two Application Settings configured:

• AzureWebJobsDashboard
• AzureWebJobsStorage

So I filled a support ticker in Azure with the following questions:

1. Are the write operation triggered by these application settings? I believe so but could you please confirm.
2. Will the write operation stop if I delete these application settings?
3. Could you please describe, in high level, in what context these operations occur (e.g. logging? resource locking, other?)

and I got the following answers from Azure support team, respectively:

1. Yes, you are right. According to the logs information, we can see “https://[function-name].blob.core.windows.net:443/azure-webjobs-hosts/locks/linkfunctions/host?comp=lease”. This azure-webjobs-hosts folder is associated with function app and it’s created by default as well as creating function app. When function app is running, it will record these logs in the storage account which is configured with AzureWebJobsStorage.
2. You can’t stop the write operations because these operations record necessary logs to storage account used by Azure Functions runtime. Please do not remove application setting AzureWebJobsStorage. The Azure Functions runtime uses this storage account connection string for all functions except for HTTP triggered functions. Removing this Application Settings will cause your function app unable to start. By the way, you can remove AzureWebJobsDashboard and it will stop Monitor rather than the operation above.
3. These operations is to record runtime logs of function app. These operations will occur when our backend allocates instance for running the function app.

Best place to find information about storage usage is to make use of Storage Analytics especially Storage Analytics Logging.

There's a special blob container called $logs in the same storage account which will have detailed information about every operation performed against that storage account. You can view the blobs in that blob container and find the information.

If you don't see this blob container in your storage account, then you will need to enable storage analytics on your storage account. However considering you can see the metrics data, my guess is that it is already enabled.

Regarding the source of these write operations, have you enabled diagnostics for your Functions and App Service? These write diagnostics logs to blob storage. Also, storage analytics is also writing to the same account and that will also cause these write operations.