Azure Virtual Network monitoring data reference
This article contains all the monitoring reference information for this service.
See Monitor Azure Virtual Network for details on the data you can collect for Virtual Network and how to use it.
Metrics
This section lists all the automatically collected platform metrics for this service. These metrics are also part of the global list of all platform metrics supported in Azure Monitor.
For information on metric retention, see Azure Monitor Metrics overview.
Supported metrics for Microsoft.Network/virtualNetworks
The following table lists the metrics available for the Microsoft.Network/virtualNetworks resource type.
- All columns might not be present in every table.
- Some columns might be beyond the viewing area of the page. Select Expand table to view all available columns.
Table headings
- Category - The metrics group or classification.
- Metric - The metric display name as it appears in the Azure portal.
- Name in REST API - The metric name as referred to in the REST API.
- Unit - Unit of measure.
- Aggregation - The default aggregation type. Valid values: Average (Avg), Minimum (Min), Maximum (Max), Total (Sum), Count.
- Dimensions - Dimensions available for the metric.
- Time Grains - Intervals at which the metric is sampled. For example,
PT1Mindicates that the metric is sampled every minute,PT30Mevery 30 minutes,PT1Hevery hour, and so on. - DS Export- Whether the metric is exportable to Azure Monitor Logs via diagnostic settings. For information on exporting metrics, see Create diagnostic settings in Azure Monitor.
| Metric | Name in REST API | Unit | Aggregation | Dimensions | Time Grains | DS Export |
|---|---|---|---|---|---|---|
| Inbound bytes dropped DDoS Inbound bytes dropped DDoS |
BytesDroppedDDoS |
BytesPerSecond | Maximum | ProtectedIPAddress |
PT1M | Yes |
| Inbound bytes forwarded DDoS Inbound bytes forwarded DDoS |
BytesForwardedDDoS |
BytesPerSecond | Maximum | ProtectedIPAddress |
PT1M | Yes |
| Inbound bytes DDoS Inbound bytes DDoS |
BytesInDDoS |
BytesPerSecond | Maximum | ProtectedIPAddress |
PT1M | Yes |
| Inbound SYN packets to trigger DDoS mitigation Inbound SYN packets to trigger DDoS mitigation |
DDoSTriggerSYNPackets |
CountPerSecond | Maximum | ProtectedIPAddress |
PT1M | Yes |
| Inbound TCP packets to trigger DDoS mitigation Inbound TCP packets to trigger DDoS mitigation |
DDoSTriggerTCPPackets |
CountPerSecond | Maximum | ProtectedIPAddress |
PT1M | Yes |
| Inbound UDP packets to trigger DDoS mitigation Inbound UDP packets to trigger DDoS mitigation |
DDoSTriggerUDPPackets |
CountPerSecond | Maximum | ProtectedIPAddress |
PT1M | Yes |
| Under DDoS attack or not Under DDoS attack or not |
IfUnderDDoSAttack |
Count | Maximum | ProtectedIPAddress |
PT1M | Yes |
| Inbound packets dropped DDoS Inbound packets dropped DDoS |
PacketsDroppedDDoS |
CountPerSecond | Maximum | ProtectedIPAddress |
PT1M | Yes |
| Inbound packets forwarded DDoS Inbound packets forwarded DDoS |
PacketsForwardedDDoS |
CountPerSecond | Maximum | ProtectedIPAddress |
PT1M | Yes |
| Inbound packets DDoS Inbound packets DDoS |
PacketsInDDoS |
CountPerSecond | Maximum | ProtectedIPAddress |
PT1M | Yes |
| Round trip time for Pings to a VM Round trip time for Pings sent to a destination VM |
PingMeshAverageRoundtripMs |
MilliSeconds | Average | SourceCustomerAddress, DestinationCustomerAddress |
PT1M, PT1H | Yes |
| Failed Pings to a VM Percent of number of failed Pings to total sent Pings of a destination VM |
PingMeshProbesFailedPercent |
Percent | Average | SourceCustomerAddress, DestinationCustomerAddress |
PT1M, PT1H | Yes |
| Inbound TCP bytes dropped DDoS Inbound TCP bytes dropped DDoS |
TCPBytesDroppedDDoS |
BytesPerSecond | Maximum | ProtectedIPAddress |
PT1M | Yes |
| Inbound TCP bytes forwarded DDoS Inbound TCP bytes forwarded DDoS |
TCPBytesForwardedDDoS |
BytesPerSecond | Maximum | ProtectedIPAddress |
PT1M | Yes |
| Inbound TCP bytes DDoS Inbound TCP bytes DDoS |
TCPBytesInDDoS |
BytesPerSecond | Maximum | ProtectedIPAddress |
PT1M | Yes |
| Inbound TCP packets dropped DDoS Inbound TCP packets dropped DDoS |
TCPPacketsDroppedDDoS |
CountPerSecond | Maximum | ProtectedIPAddress |
PT1M | Yes |
| Inbound TCP packets forwarded DDoS Inbound TCP packets forwarded DDoS |
TCPPacketsForwardedDDoS |
CountPerSecond | Maximum | ProtectedIPAddress |
PT1M | Yes |
| Inbound TCP packets DDoS Inbound TCP packets DDoS |
TCPPacketsInDDoS |
CountPerSecond | Maximum | ProtectedIPAddress |
PT1M | Yes |
| Inbound UDP bytes dropped DDoS Inbound UDP bytes dropped DDoS |
UDPBytesDroppedDDoS |
BytesPerSecond | Maximum | ProtectedIPAddress |
PT1M | Yes |
| Inbound UDP bytes forwarded DDoS Inbound UDP bytes forwarded DDoS |
UDPBytesForwardedDDoS |
BytesPerSecond | Maximum | ProtectedIPAddress |
PT1M | Yes |
| Inbound UDP bytes DDoS Inbound UDP bytes DDoS |
UDPBytesInDDoS |
BytesPerSecond | Maximum | ProtectedIPAddress |
PT1M | Yes |
| Inbound UDP packets dropped DDoS Inbound UDP packets dropped DDoS |
UDPPacketsDroppedDDoS |
CountPerSecond | Maximum | ProtectedIPAddress |
PT1M | Yes |
| Inbound UDP packets forwarded DDoS Inbound UDP packets forwarded DDoS |
UDPPacketsForwardedDDoS |
CountPerSecond | Maximum | ProtectedIPAddress |
PT1M | Yes |
| Inbound UDP packets DDoS Inbound UDP packets DDoS |
UDPPacketsInDDoS |
CountPerSecond | Maximum | ProtectedIPAddress |
PT1M | Yes |
Supported metrics for Microsoft.Network/networkInterfaces
The following table lists the metrics available for the Microsoft.Network/networkInterfaces resource type.
- All columns might not be present in every table.
- Some columns might be beyond the viewing area of the page. Select Expand table to view all available columns.
Table headings
- Category - The metrics group or classification.
- Metric - The metric display name as it appears in the Azure portal.
- Name in REST API - The metric name as referred to in the REST API.
- Unit - Unit of measure.
- Aggregation - The default aggregation type. Valid values: Average (Avg), Minimum (Min), Maximum (Max), Total (Sum), Count.
- Dimensions - Dimensions available for the metric.
- Time Grains - Intervals at which the metric is sampled. For example,
PT1Mindicates that the metric is sampled every minute,PT30Mevery 30 minutes,PT1Hevery hour, and so on. - DS Export- Whether the metric is exportable to Azure Monitor Logs via diagnostic settings. For information on exporting metrics, see Create diagnostic settings in Azure Monitor.
| Metric | Name in REST API | Unit | Aggregation | Dimensions | Time Grains | DS Export |
|---|---|---|---|---|---|---|
| Bytes Received Number of bytes the Network Interface received |
BytesReceivedRate |
Bytes | Total (Sum) | <none> | PT1M | Yes |
| Bytes Sent Number of bytes the Network Interface sent |
BytesSentRate |
Bytes | Total (Sum) | <none> | PT1M | Yes |
| Inbound Flows Maximum Creation Rate The maximum creation rate of inbound flows (traffic going into the NIC) |
CreationRateMaxTotalFlowsIn |
CountPerSecond | Average | <none> | PT1M | No |
| Outbound Flows Maximum Creation Rate The maximum creation rate of outbound flows (traffic going out of the NIC) |
CreationRateMaxTotalFlowsOut |
CountPerSecond | Average | <none> | PT1M | No |
| Inbound Flows Inbound Flows are number of current flows in the inbound direction (traffic going into the NIC) |
CurrentTotalFlowsIn |
Count | Average | <none> | PT1M | No |
| Outbound Flows Outbound Flows are number of current flows in the outbound direction (traffic going out of the NIC) |
CurrentTotalFlowsOut |
Count | Average | <none> | PT1M | No |
| Packets Received Number of packets the Network Interface received |
PacketsReceivedRate |
Count | Total (Sum) | <none> | PT1M | Yes |
| Packets Sent Number of packets the Network Interface sent |
PacketsSentRate |
Count | Total (Sum) | <none> | PT1M | Yes |
Supported metrics for Microsoft.Network/publicIPAddresses
The following table lists the metrics available for the Microsoft.Network/publicIPAddresses resource type.
- All columns might not be present in every table.
- Some columns might be beyond the viewing area of the page. Select Expand table to view all available columns.
Table headings
- Category - The metrics group or classification.
- Metric - The metric display name as it appears in the Azure portal.
- Name in REST API - The metric name as referred to in the REST API.
- Unit - Unit of measure.
- Aggregation - The default aggregation type. Valid values: Average (Avg), Minimum (Min), Maximum (Max), Total (Sum), Count.
- Dimensions - Dimensions available for the metric.
- Time Grains - Intervals at which the metric is sampled. For example,
PT1Mindicates that the metric is sampled every minute,PT30Mevery 30 minutes,PT1Hevery hour, and so on. - DS Export- Whether the metric is exportable to Azure Monitor Logs via diagnostic settings. For information on exporting metrics, see Create diagnostic settings in Azure Monitor.
| Metric | Name in REST API | Unit | Aggregation | Dimensions | Time Grains | DS Export |
|---|---|---|---|---|---|---|
| Byte Count Total number of Bytes transmitted within time period |
ByteCount |
Bytes | Total (Sum) | Port, Direction |
PT1M | Yes |
| Inbound bytes dropped DDoS Inbound bytes dropped DDoS |
BytesDroppedDDoS |
BytesPerSecond | Maximum | <none> | PT1M | Yes |
| Inbound bytes forwarded DDoS Inbound bytes forwarded DDoS |
BytesForwardedDDoS |
BytesPerSecond | Maximum | <none> | PT1M | Yes |
| Inbound bytes DDoS Inbound bytes DDoS |
BytesInDDoS |
BytesPerSecond | Maximum | <none> | PT1M | Yes |
| Inbound SYN packets to trigger DDoS mitigation Inbound SYN packets to trigger DDoS mitigation |
DDoSTriggerSYNPackets |
CountPerSecond | Maximum | <none> | PT1M | Yes |
| Inbound TCP packets to trigger DDoS mitigation Inbound TCP packets to trigger DDoS mitigation |
DDoSTriggerTCPPackets |
CountPerSecond | Maximum | <none> | PT1M | Yes |
| Inbound UDP packets to trigger DDoS mitigation Inbound UDP packets to trigger DDoS mitigation |
DDoSTriggerUDPPackets |
CountPerSecond | Maximum | <none> | PT1M | Yes |
| Under DDoS attack or not Under DDoS attack or not |
IfUnderDDoSAttack |
Count | Maximum | <none> | PT1M | Yes |
| Packet Count Total number of Packets transmitted within time period |
PacketCount |
Count | Total (Sum) | Port, Direction |
PT1M | Yes |
| Inbound packets dropped DDoS Inbound packets dropped DDoS |
PacketsDroppedDDoS |
CountPerSecond | Maximum | <none> | PT1M | Yes |
| Inbound packets forwarded DDoS Inbound packets forwarded DDoS |
PacketsForwardedDDoS |
CountPerSecond | Maximum | <none> | PT1M | Yes |
| Inbound packets DDoS Inbound packets DDoS |
PacketsInDDoS |
CountPerSecond | Maximum | <none> | PT1M | Yes |
| SYN Count Total number of SYN Packets transmitted within time period |
SynCount |
Count | Total (Sum) | Port, Direction |
PT1M | Yes |
| Inbound TCP bytes dropped DDoS Inbound TCP bytes dropped DDoS |
TCPBytesDroppedDDoS |
BytesPerSecond | Maximum | <none> | PT1M | Yes |
| Inbound TCP bytes forwarded DDoS Inbound TCP bytes forwarded DDoS |
TCPBytesForwardedDDoS |
BytesPerSecond | Maximum | <none> | PT1M | Yes |
| Inbound TCP bytes DDoS Inbound TCP bytes DDoS |
TCPBytesInDDoS |
BytesPerSecond | Maximum | <none> | PT1M | Yes |
| Inbound TCP packets dropped DDoS Inbound TCP packets dropped DDoS |
TCPPacketsDroppedDDoS |
CountPerSecond | Maximum | <none> | PT1M | Yes |
| Inbound TCP packets forwarded DDoS Inbound TCP packets forwarded DDoS |
TCPPacketsForwardedDDoS |
CountPerSecond | Maximum | <none> | PT1M | Yes |
| Inbound TCP packets DDoS Inbound TCP packets DDoS |
TCPPacketsInDDoS |
CountPerSecond | Maximum | <none> | PT1M | Yes |
| Inbound UDP bytes dropped DDoS Inbound UDP bytes dropped DDoS |
UDPBytesDroppedDDoS |
BytesPerSecond | Maximum | <none> | PT1M | Yes |
| Inbound UDP bytes forwarded DDoS Inbound UDP bytes forwarded DDoS |
UDPBytesForwardedDDoS |
BytesPerSecond | Maximum | <none> | PT1M | Yes |
| Inbound UDP bytes DDoS Inbound UDP bytes DDoS |
UDPBytesInDDoS |
BytesPerSecond | Maximum | <none> | PT1M | Yes |
| Inbound UDP packets dropped DDoS Inbound UDP packets dropped DDoS |
UDPPacketsDroppedDDoS |
CountPerSecond | Maximum | <none> | PT1M | Yes |
| Inbound UDP packets forwarded DDoS Inbound UDP packets forwarded DDoS |
UDPPacketsForwardedDDoS |
CountPerSecond | Maximum | <none> | PT1M | Yes |
| Inbound UDP packets DDoS Inbound UDP packets DDoS |
UDPPacketsInDDoS |
CountPerSecond | Maximum | <none> | PT1M | Yes |
| Data Path Availability Average IP Address availability per time duration |
VipAvailability |
Count | Average | Port |
PT1M | Yes |
Supported metrics for Microsoft.Network/natGateways
The following table lists the metrics available for the Microsoft.Network/natGateways resource type.
- All columns might not be present in every table.
- Some columns might be beyond the viewing area of the page. Select Expand table to view all available columns.
Table headings
- Category - The metrics group or classification.
- Metric - The metric display name as it appears in the Azure portal.
- Name in REST API - The metric name as referred to in the REST API.
- Unit - Unit of measure.
- Aggregation - The default aggregation type. Valid values: Average (Avg), Minimum (Min), Maximum (Max), Total (Sum), Count.
- Dimensions - Dimensions available for the metric.
- Time Grains - Intervals at which the metric is sampled. For example,
PT1Mindicates that the metric is sampled every minute,PT30Mevery 30 minutes,PT1Hevery hour, and so on. - DS Export- Whether the metric is exportable to Azure Monitor Logs via diagnostic settings. For information on exporting metrics, see Create diagnostic settings in Azure Monitor.
| Metric | Name in REST API | Unit | Aggregation | Dimensions | Time Grains | DS Export |
|---|---|---|---|---|---|---|
| Bytes Total number of Bytes transmitted within time period |
ByteCount |
Bytes | Total (Sum) | Protocol, Direction |
PT1M | No |
| Datapath Availability NAT Gateway Datapath Availability |
DatapathAvailability |
Count | Average | <none> | PT1M | No |
| Packets Total number of Packets transmitted within time period |
PacketCount |
Count | Total (Sum) | Protocol, Direction |
PT1M | No |
| Dropped Packets Count of dropped packets |
PacketDropCount |
Count | Total (Sum) | <none> | PT1M | No |
| SNAT Connection Count Total concurrent active connections |
SNATConnectionCount |
Count | Total (Sum) | Protocol, ConnectionState |
PT1M | No |
| Total SNAT Connection Count Total number of active SNAT connections |
TotalConnectionCount |
Count | Total (Sum) | Protocol |
PT1M | No |
Metric dimensions
For information about what metric dimensions are, see Multi-dimensional metrics.
This service has the following dimensions associated with its metrics.
Dimensions for Microsoft.Network/virtualNetworks:
| Dimension name | Description |
|---|---|
| DestinationCustomerAddress | |
| ProtectedIPAddress | |
| SourceCustomerAddress |
Dimensions for Microsoft.Network/networkInterfaces:
None.
Dimensions for Microsoft.Network/publicIPAddresses:
| Dimension name | Description |
|---|---|
| Direction | |
| Port |
Dimensions for Microsoft.Network/natGateways:
| Dimension name | Description |
|---|---|
| Direction | The direction of traffic flow. The supported values are In and Out. |
| Protocol | The type of transport protocol. The supported values are TCP and UDP. |
| ConnectionState |
Resource logs
This section lists the types of resource logs you can collect for this service. The section pulls from the list of all resource logs category types supported in Azure Monitor.
Supported resource logs for Microsoft.Network/networksecuritygroups
| Category | Category display name | Log table | Supports basic log plan | Supports ingestion-time transformation | Example queries | Costs to export |
|---|---|---|---|---|---|---|
NetworkSecurityGroupEvent |
Network Security Group Event | AzureDiagnostics Logs from multiple Azure resources. |
No | No | Queries | No |
NetworkSecurityGroupFlowEvent |
Network Security Group Rule Flow Event | AzureDiagnostics Logs from multiple Azure resources. |
No | No | Queries | No |
NetworkSecurityGroupRuleCounter |
Network Security Group Rule Counter | AzureDiagnostics Logs from multiple Azure resources. |
No | No | Queries | No |
Supported resource logs for Microsoft.Network/publicIPAddresses
| Category | Category display name | Log table | Supports basic log plan | Supports ingestion-time transformation | Example queries | Costs to export |
|---|---|---|---|---|---|---|
DDoSMitigationFlowLogs |
Flow logs of DDoS mitigation decisions | AzureDiagnostics Logs from multiple Azure resources. |
No | No | Queries | No |
DDoSMitigationReports |
Reports of DDoS mitigations | AzureDiagnostics Logs from multiple Azure resources. |
No | No | Queries | No |
DDoSProtectionNotifications |
DDoS protection notifications | AzureDiagnostics Logs from multiple Azure resources. |
No | No | Queries | No |
Supported resource logs for Microsoft.Network/virtualNetworks
| Category | Category display name | Log table | Supports basic log plan | Supports ingestion-time transformation | Example queries | Costs to export |
|---|---|---|---|---|---|---|
VMProtectionAlerts |
VM protection alerts | No | No | No |
Azure Monitor Logs tables
This section lists the Azure Monitor Logs tables relevant to this service, which are available for query by Log Analytics using Kusto queries. The tables contain resource log data and possibly more depending on what is collected and routed to them.
Virtual Network Microsoft.Network/virtualNetworks
Virtual Network Microsoft.Network/networkinterfaces
Virtual Network Microsoft.Network/PublicIpAddresses
Activity log
The linked table lists the operations that can be recorded in the activity log for this service. These operations are a subset of all the possible resource provider operations in the activity log.
For more information on the schema of activity log entries, see Activity Log schema.
The following table lists the operations related to Azure virtual network that might be created in the Activity log.
| Operation | Description |
|---|---|
| All administrative operations | All administrative operations including create, update, and delete of an Azure virtual network. |
| Create or update virtual network | A virtual network was created or updated. |
| Deletes virtual network | A virtual network was deleted. |
Related content
- See Monitor Azure Virtual Network for a description of monitoring Virtual Network.
- See Monitor Azure resources with Azure Monitor for details on monitoring Azure resources.