Azure Virtual Network monitoring data reference

This article contains all the monitoring reference information for this service.

See Monitor Azure Virtual Network for details on the data you can collect for Virtual Network and how to use it.

Metrics

This section lists all the automatically collected platform metrics for this service. These metrics are also part of the global list of all platform metrics supported in Azure Monitor.

For information on metric retention, see Azure Monitor Metrics overview.

Supported metrics for Microsoft.Network/virtualNetworks

The following table lists the metrics available for the Microsoft.Network/virtualNetworks resource type.

  • All columns might not be present in every table.
  • Some columns might be beyond the viewing area of the page. Select Expand table to view all available columns.

Table headings

  • Category - The metrics group or classification.
  • Metric - The metric display name as it appears in the Azure portal.
  • Name in REST API - The metric name as referred to in the REST API.
  • Unit - Unit of measure.
  • Aggregation - The default aggregation type. Valid values: Average (Avg), Minimum (Min), Maximum (Max), Total (Sum), Count.
  • Dimensions - Dimensions available for the metric.
  • Time Grains - Intervals at which the metric is sampled. For example, PT1M indicates that the metric is sampled every minute, PT30M every 30 minutes, PT1H every hour, and so on.
  • DS Export- Whether the metric is exportable to Azure Monitor Logs via diagnostic settings. For information on exporting metrics, see Create diagnostic settings in Azure Monitor.
Metric Name in REST API Unit Aggregation Dimensions Time Grains DS Export
Inbound bytes dropped DDoS

Inbound bytes dropped DDoS
BytesDroppedDDoS BytesPerSecond Maximum ProtectedIPAddress PT1M Yes
Inbound bytes forwarded DDoS

Inbound bytes forwarded DDoS
BytesForwardedDDoS BytesPerSecond Maximum ProtectedIPAddress PT1M Yes
Inbound bytes DDoS

Inbound bytes DDoS
BytesInDDoS BytesPerSecond Maximum ProtectedIPAddress PT1M Yes
Inbound SYN packets to trigger DDoS mitigation

Inbound SYN packets to trigger DDoS mitigation
DDoSTriggerSYNPackets CountPerSecond Maximum ProtectedIPAddress PT1M Yes
Inbound TCP packets to trigger DDoS mitigation

Inbound TCP packets to trigger DDoS mitigation
DDoSTriggerTCPPackets CountPerSecond Maximum ProtectedIPAddress PT1M Yes
Inbound UDP packets to trigger DDoS mitigation

Inbound UDP packets to trigger DDoS mitigation
DDoSTriggerUDPPackets CountPerSecond Maximum ProtectedIPAddress PT1M Yes
Under DDoS attack or not

Under DDoS attack or not
IfUnderDDoSAttack Count Maximum ProtectedIPAddress PT1M Yes
Inbound packets dropped DDoS

Inbound packets dropped DDoS
PacketsDroppedDDoS CountPerSecond Maximum ProtectedIPAddress PT1M Yes
Inbound packets forwarded DDoS

Inbound packets forwarded DDoS
PacketsForwardedDDoS CountPerSecond Maximum ProtectedIPAddress PT1M Yes
Inbound packets DDoS

Inbound packets DDoS
PacketsInDDoS CountPerSecond Maximum ProtectedIPAddress PT1M Yes
Round trip time for Pings to a VM

Round trip time for Pings sent to a destination VM
PingMeshAverageRoundtripMs MilliSeconds Average SourceCustomerAddress, DestinationCustomerAddress PT1M, PT1H Yes
Failed Pings to a VM

Percent of number of failed Pings to total sent Pings of a destination VM
PingMeshProbesFailedPercent Percent Average SourceCustomerAddress, DestinationCustomerAddress PT1M, PT1H Yes
Inbound TCP bytes dropped DDoS

Inbound TCP bytes dropped DDoS
TCPBytesDroppedDDoS BytesPerSecond Maximum ProtectedIPAddress PT1M Yes
Inbound TCP bytes forwarded DDoS

Inbound TCP bytes forwarded DDoS
TCPBytesForwardedDDoS BytesPerSecond Maximum ProtectedIPAddress PT1M Yes
Inbound TCP bytes DDoS

Inbound TCP bytes DDoS
TCPBytesInDDoS BytesPerSecond Maximum ProtectedIPAddress PT1M Yes
Inbound TCP packets dropped DDoS

Inbound TCP packets dropped DDoS
TCPPacketsDroppedDDoS CountPerSecond Maximum ProtectedIPAddress PT1M Yes
Inbound TCP packets forwarded DDoS

Inbound TCP packets forwarded DDoS
TCPPacketsForwardedDDoS CountPerSecond Maximum ProtectedIPAddress PT1M Yes
Inbound TCP packets DDoS

Inbound TCP packets DDoS
TCPPacketsInDDoS CountPerSecond Maximum ProtectedIPAddress PT1M Yes
Inbound UDP bytes dropped DDoS

Inbound UDP bytes dropped DDoS
UDPBytesDroppedDDoS BytesPerSecond Maximum ProtectedIPAddress PT1M Yes
Inbound UDP bytes forwarded DDoS

Inbound UDP bytes forwarded DDoS
UDPBytesForwardedDDoS BytesPerSecond Maximum ProtectedIPAddress PT1M Yes
Inbound UDP bytes DDoS

Inbound UDP bytes DDoS
UDPBytesInDDoS BytesPerSecond Maximum ProtectedIPAddress PT1M Yes
Inbound UDP packets dropped DDoS

Inbound UDP packets dropped DDoS
UDPPacketsDroppedDDoS CountPerSecond Maximum ProtectedIPAddress PT1M Yes
Inbound UDP packets forwarded DDoS

Inbound UDP packets forwarded DDoS
UDPPacketsForwardedDDoS CountPerSecond Maximum ProtectedIPAddress PT1M Yes
Inbound UDP packets DDoS

Inbound UDP packets DDoS
UDPPacketsInDDoS CountPerSecond Maximum ProtectedIPAddress PT1M Yes

Supported metrics for Microsoft.Network/networkInterfaces

The following table lists the metrics available for the Microsoft.Network/networkInterfaces resource type.

  • All columns might not be present in every table.
  • Some columns might be beyond the viewing area of the page. Select Expand table to view all available columns.

Table headings

  • Category - The metrics group or classification.
  • Metric - The metric display name as it appears in the Azure portal.
  • Name in REST API - The metric name as referred to in the REST API.
  • Unit - Unit of measure.
  • Aggregation - The default aggregation type. Valid values: Average (Avg), Minimum (Min), Maximum (Max), Total (Sum), Count.
  • Dimensions - Dimensions available for the metric.
  • Time Grains - Intervals at which the metric is sampled. For example, PT1M indicates that the metric is sampled every minute, PT30M every 30 minutes, PT1H every hour, and so on.
  • DS Export- Whether the metric is exportable to Azure Monitor Logs via diagnostic settings. For information on exporting metrics, see Create diagnostic settings in Azure Monitor.
Metric Name in REST API Unit Aggregation Dimensions Time Grains DS Export
Bytes Received

Number of bytes the Network Interface received
BytesReceivedRate Bytes Total (Sum) <none> PT1M Yes
Bytes Sent

Number of bytes the Network Interface sent
BytesSentRate Bytes Total (Sum) <none> PT1M Yes
Inbound Flows Maximum Creation Rate

The maximum creation rate of inbound flows (traffic going into the NIC)
CreationRateMaxTotalFlowsIn CountPerSecond Average <none> PT1M No
Outbound Flows Maximum Creation Rate

The maximum creation rate of outbound flows (traffic going out of the NIC)
CreationRateMaxTotalFlowsOut CountPerSecond Average <none> PT1M No
Inbound Flows

Inbound Flows are number of current flows in the inbound direction (traffic going into the NIC)
CurrentTotalFlowsIn Count Average <none> PT1M No
Outbound Flows

Outbound Flows are number of current flows in the outbound direction (traffic going out of the NIC)
CurrentTotalFlowsOut Count Average <none> PT1M No
Packets Received

Number of packets the Network Interface received
PacketsReceivedRate Count Total (Sum) <none> PT1M Yes
Packets Sent

Number of packets the Network Interface sent
PacketsSentRate Count Total (Sum) <none> PT1M Yes

Supported metrics for Microsoft.Network/publicIPAddresses

The following table lists the metrics available for the Microsoft.Network/publicIPAddresses resource type.

  • All columns might not be present in every table.
  • Some columns might be beyond the viewing area of the page. Select Expand table to view all available columns.

Table headings

  • Category - The metrics group or classification.
  • Metric - The metric display name as it appears in the Azure portal.
  • Name in REST API - The metric name as referred to in the REST API.
  • Unit - Unit of measure.
  • Aggregation - The default aggregation type. Valid values: Average (Avg), Minimum (Min), Maximum (Max), Total (Sum), Count.
  • Dimensions - Dimensions available for the metric.
  • Time Grains - Intervals at which the metric is sampled. For example, PT1M indicates that the metric is sampled every minute, PT30M every 30 minutes, PT1H every hour, and so on.
  • DS Export- Whether the metric is exportable to Azure Monitor Logs via diagnostic settings. For information on exporting metrics, see Create diagnostic settings in Azure Monitor.
Metric Name in REST API Unit Aggregation Dimensions Time Grains DS Export
Byte Count

Total number of Bytes transmitted within time period
ByteCount Bytes Total (Sum) Port, Direction PT1M Yes
Inbound bytes dropped DDoS

Inbound bytes dropped DDoS
BytesDroppedDDoS BytesPerSecond Maximum <none> PT1M Yes
Inbound bytes forwarded DDoS

Inbound bytes forwarded DDoS
BytesForwardedDDoS BytesPerSecond Maximum <none> PT1M Yes
Inbound bytes DDoS

Inbound bytes DDoS
BytesInDDoS BytesPerSecond Maximum <none> PT1M Yes
Inbound SYN packets to trigger DDoS mitigation

Inbound SYN packets to trigger DDoS mitigation
DDoSTriggerSYNPackets CountPerSecond Maximum <none> PT1M Yes
Inbound TCP packets to trigger DDoS mitigation

Inbound TCP packets to trigger DDoS mitigation
DDoSTriggerTCPPackets CountPerSecond Maximum <none> PT1M Yes
Inbound UDP packets to trigger DDoS mitigation

Inbound UDP packets to trigger DDoS mitigation
DDoSTriggerUDPPackets CountPerSecond Maximum <none> PT1M Yes
Under DDoS attack or not

Under DDoS attack or not
IfUnderDDoSAttack Count Maximum <none> PT1M Yes
Packet Count

Total number of Packets transmitted within time period
PacketCount Count Total (Sum) Port, Direction PT1M Yes
Inbound packets dropped DDoS

Inbound packets dropped DDoS
PacketsDroppedDDoS CountPerSecond Maximum <none> PT1M Yes
Inbound packets forwarded DDoS

Inbound packets forwarded DDoS
PacketsForwardedDDoS CountPerSecond Maximum <none> PT1M Yes
Inbound packets DDoS

Inbound packets DDoS
PacketsInDDoS CountPerSecond Maximum <none> PT1M Yes
SYN Count

Total number of SYN Packets transmitted within time period
SynCount Count Total (Sum) Port, Direction PT1M Yes
Inbound TCP bytes dropped DDoS

Inbound TCP bytes dropped DDoS
TCPBytesDroppedDDoS BytesPerSecond Maximum <none> PT1M Yes
Inbound TCP bytes forwarded DDoS

Inbound TCP bytes forwarded DDoS
TCPBytesForwardedDDoS BytesPerSecond Maximum <none> PT1M Yes
Inbound TCP bytes DDoS

Inbound TCP bytes DDoS
TCPBytesInDDoS BytesPerSecond Maximum <none> PT1M Yes
Inbound TCP packets dropped DDoS

Inbound TCP packets dropped DDoS
TCPPacketsDroppedDDoS CountPerSecond Maximum <none> PT1M Yes
Inbound TCP packets forwarded DDoS

Inbound TCP packets forwarded DDoS
TCPPacketsForwardedDDoS CountPerSecond Maximum <none> PT1M Yes
Inbound TCP packets DDoS

Inbound TCP packets DDoS
TCPPacketsInDDoS CountPerSecond Maximum <none> PT1M Yes
Inbound UDP bytes dropped DDoS

Inbound UDP bytes dropped DDoS
UDPBytesDroppedDDoS BytesPerSecond Maximum <none> PT1M Yes
Inbound UDP bytes forwarded DDoS

Inbound UDP bytes forwarded DDoS
UDPBytesForwardedDDoS BytesPerSecond Maximum <none> PT1M Yes
Inbound UDP bytes DDoS

Inbound UDP bytes DDoS
UDPBytesInDDoS BytesPerSecond Maximum <none> PT1M Yes
Inbound UDP packets dropped DDoS

Inbound UDP packets dropped DDoS
UDPPacketsDroppedDDoS CountPerSecond Maximum <none> PT1M Yes
Inbound UDP packets forwarded DDoS

Inbound UDP packets forwarded DDoS
UDPPacketsForwardedDDoS CountPerSecond Maximum <none> PT1M Yes
Inbound UDP packets DDoS

Inbound UDP packets DDoS
UDPPacketsInDDoS CountPerSecond Maximum <none> PT1M Yes
Data Path Availability

Average IP Address availability per time duration
VipAvailability Count Average Port PT1M Yes

Supported metrics for Microsoft.Network/natGateways

The following table lists the metrics available for the Microsoft.Network/natGateways resource type.

  • All columns might not be present in every table.
  • Some columns might be beyond the viewing area of the page. Select Expand table to view all available columns.

Table headings

  • Category - The metrics group or classification.
  • Metric - The metric display name as it appears in the Azure portal.
  • Name in REST API - The metric name as referred to in the REST API.
  • Unit - Unit of measure.
  • Aggregation - The default aggregation type. Valid values: Average (Avg), Minimum (Min), Maximum (Max), Total (Sum), Count.
  • Dimensions - Dimensions available for the metric.
  • Time Grains - Intervals at which the metric is sampled. For example, PT1M indicates that the metric is sampled every minute, PT30M every 30 minutes, PT1H every hour, and so on.
  • DS Export- Whether the metric is exportable to Azure Monitor Logs via diagnostic settings. For information on exporting metrics, see Create diagnostic settings in Azure Monitor.
Metric Name in REST API Unit Aggregation Dimensions Time Grains DS Export
Bytes

Total number of Bytes transmitted within time period
ByteCount Bytes Total (Sum) Protocol, Direction PT1M No
Datapath Availability

NAT Gateway Datapath Availability
DatapathAvailability Count Average <none> PT1M No
Packets

Total number of Packets transmitted within time period
PacketCount Count Total (Sum) Protocol, Direction PT1M No
Dropped Packets

Count of dropped packets
PacketDropCount Count Total (Sum) <none> PT1M No
SNAT Connection Count

Total concurrent active connections
SNATConnectionCount Count Total (Sum) Protocol, ConnectionState PT1M No
Total SNAT Connection Count

Total number of active SNAT connections
TotalConnectionCount Count Total (Sum) Protocol PT1M No

Metric dimensions

For information about what metric dimensions are, see Multi-dimensional metrics.

This service has the following dimensions associated with its metrics.

Dimensions for Microsoft.Network/virtualNetworks:

Dimension name Description
DestinationCustomerAddress
ProtectedIPAddress
SourceCustomerAddress

Dimensions for Microsoft.Network/networkInterfaces:

None.

Dimensions for Microsoft.Network/publicIPAddresses:

Dimension name Description
Direction
Port

Dimensions for Microsoft.Network/natGateways:

Dimension name Description
Direction The direction of traffic flow. The supported values are In and Out.
Protocol The type of transport protocol. The supported values are TCP and UDP.
ConnectionState

Resource logs

This section lists the types of resource logs you can collect for this service. The section pulls from the list of all resource logs category types supported in Azure Monitor.

Supported resource logs for Microsoft.Network/networksecuritygroups

Category Category display name Log table Supports basic log plan Supports ingestion-time transformation Example queries Costs to export
NetworkSecurityGroupEvent Network Security Group Event AzureDiagnostics

Logs from multiple Azure resources.

No No Queries No
NetworkSecurityGroupFlowEvent Network Security Group Rule Flow Event AzureDiagnostics

Logs from multiple Azure resources.

No No Queries No
NetworkSecurityGroupRuleCounter Network Security Group Rule Counter AzureDiagnostics

Logs from multiple Azure resources.

No No Queries No

Supported resource logs for Microsoft.Network/publicIPAddresses

Category Category display name Log table Supports basic log plan Supports ingestion-time transformation Example queries Costs to export
DDoSMitigationFlowLogs Flow logs of DDoS mitigation decisions AzureDiagnostics

Logs from multiple Azure resources.

No No Queries No
DDoSMitigationReports Reports of DDoS mitigations AzureDiagnostics

Logs from multiple Azure resources.

No No Queries No
DDoSProtectionNotifications DDoS protection notifications AzureDiagnostics

Logs from multiple Azure resources.

No No Queries No

Supported resource logs for Microsoft.Network/virtualNetworks

Category Category display name Log table Supports basic log plan Supports ingestion-time transformation Example queries Costs to export
VMProtectionAlerts VM protection alerts No No No

Azure Monitor Logs tables

This section lists the Azure Monitor Logs tables relevant to this service, which are available for query by Log Analytics using Kusto queries. The tables contain resource log data and possibly more depending on what is collected and routed to them.

Virtual Network Microsoft.Network/virtualNetworks

Virtual Network Microsoft.Network/networkinterfaces

Virtual Network Microsoft.Network/PublicIpAddresses

Activity log

The linked table lists the operations that can be recorded in the activity log for this service. These operations are a subset of all the possible resource provider operations in the activity log.

For more information on the schema of activity log entries, see Activity Log schema.

The following table lists the operations related to Azure virtual network that might be created in the Activity log.

Operation Description
All administrative operations All administrative operations including create, update, and delete of an Azure virtual network.
Create or update virtual network A virtual network was created or updated.
Deletes virtual network A virtual network was deleted.