NVA high CPU

Question

Often my team receives alerts for high NVA CPU usage. We do not have a good way to identify what exactly floods our system. Is there a way that we can monitor what the source IP may be, filter by IP? We have a service that comes from our Hub, then to our External NVA, then to another service within Azure. I would like to know is there a way to see that overflow of traffic that floods our external NVA?

Answer 1

@Handy, Frederick

Thank you for getting back and providing requested details.In this scenario, I think using Virtual Network flow logs will be useful to analyze the traffic based on the source IP.

• You can have flow logs captured for NIC of the NVA, you can use this article to configure the VNET flow logs and use the target resource as the NIC of the NVA.
• Then use traffic analytics to view the required data. Traffic analytics examines raw flow logs. It then reduces the log volume by aggregating flows that have a common source IP address, destination IP address, destination port, and protocol.

Hope this helps! Please let me know if you have any question. Thank you!

---

​​Please "Accept the answer" if the information helped you. This will help us and others in the community as well.

Answer 2

You can monitor and filter traffic by source IP using Azure Network Watcher or Azure Monitor. Set up flow logs for your Network Virtual Appliance (NVA) to capture incoming and outgoing traffic details, including source IP addresses. By analyzing these logs, you can identify which IPs are generating high traffic to your NVA. Additionally, you can set up custom alerts for specific thresholds to proactively manage and filter traffic based on source IP. Azure’s Network Security Group (NSG) flow logs and diagnostic settings would also be useful for identifying the overflow of traffic causing high CPU usage.