Rediger

Azure Virtual Network monitoring data reference

This article contains all the monitoring reference information for this service.

See Monitor Azure Virtual Network for details on the data you can collect for Virtual Network and how to use it.

Metrics

This section lists all the automatically collected platform metrics for this service. These metrics are also part of the global list of all platform metrics supported in Azure Monitor.

For information on metric retention, see Azure Monitor Metrics overview.

Supported metrics for Microsoft.Network/virtualNetworks

The following table lists the metrics available for the Microsoft.Network/virtualNetworks resource type.

  • All columns might not be present in every table.
  • Some columns might be beyond the viewing area of the page. Select Expand table to view all available columns.

Table headings

  • Category - The metrics group or classification.
  • Metric - The metric display name as it appears in the Azure portal.
  • Name in REST API - The metric name as referred to in the REST API.
  • Unit - Unit of measure.
  • Aggregation - The default aggregation type. Valid values: Average (Avg), Minimum (Min), Maximum (Max), Total (Sum), Count.
  • Dimensions - Dimensions available for the metric.
  • Time Grains - Intervals at which the metric is sampled. For example, PT1M indicates that the metric is sampled every minute, PT30M every 30 minutes, PT1H every hour, and so on.
  • DS Export- Whether the metric is exportable to Azure Monitor Logs via diagnostic settings. For information on exporting metrics, see Create diagnostic settings in Azure Monitor.
Metric Name in REST API Advanced platform metrics Unit Aggregation Dimensions Time Grains DS Export
Inbound bytes dropped DDoS

Inbound bytes dropped DDoS
BytesDroppedDDoS No BytesPerSecond Maximum ProtectedIPAddress PT1M Yes
Inbound bytes forwarded DDoS

Inbound bytes forwarded DDoS
BytesForwardedDDoS No BytesPerSecond Maximum ProtectedIPAddress PT1M Yes
Inbound bytes DDoS

Inbound bytes DDoS
BytesInDDoS No BytesPerSecond Maximum ProtectedIPAddress PT1M Yes
Inbound SYN packets to trigger DDoS mitigation

Inbound SYN packets to trigger DDoS mitigation
DDoSTriggerSYNPackets No CountPerSecond Maximum ProtectedIPAddress PT1M Yes
Inbound TCP packets to trigger DDoS mitigation

Inbound TCP packets to trigger DDoS mitigation
DDoSTriggerTCPPackets No CountPerSecond Maximum ProtectedIPAddress PT1M Yes
Inbound UDP packets to trigger DDoS mitigation

Inbound UDP packets to trigger DDoS mitigation
DDoSTriggerUDPPackets No CountPerSecond Maximum ProtectedIPAddress PT1M Yes
Under DDoS attack or not

Under DDoS attack or not
IfUnderDDoSAttack No Count Maximum ProtectedIPAddress PT1M Yes
Inbound packets dropped DDoS

Inbound packets dropped DDoS
PacketsDroppedDDoS No CountPerSecond Maximum ProtectedIPAddress PT1M Yes
Inbound packets forwarded DDoS

Inbound packets forwarded DDoS
PacketsForwardedDDoS No CountPerSecond Maximum ProtectedIPAddress PT1M Yes
Inbound packets DDoS

Inbound packets DDoS
PacketsInDDoS No CountPerSecond Maximum ProtectedIPAddress PT1M Yes
Round trip time for Pings to a VM

Round trip time for Pings sent to a destination VM
PingMeshAverageRoundtripMs No MilliSeconds Average SourceCustomerAddress, DestinationCustomerAddress PT1M, PT1H Yes
Failed Pings to a VM

Percent of number of failed Pings to total sent Pings of a destination VM
PingMeshProbesFailedPercent No Percent Average SourceCustomerAddress, DestinationCustomerAddress PT1M, PT1H Yes
Inbound TCP bytes dropped DDoS

Inbound TCP bytes dropped DDoS
TCPBytesDroppedDDoS No BytesPerSecond Maximum ProtectedIPAddress PT1M Yes
Inbound TCP bytes forwarded DDoS

Inbound TCP bytes forwarded DDoS
TCPBytesForwardedDDoS No BytesPerSecond Maximum ProtectedIPAddress PT1M Yes
Inbound TCP bytes DDoS

Inbound TCP bytes DDoS
TCPBytesInDDoS No BytesPerSecond Maximum ProtectedIPAddress PT1M Yes
Inbound TCP packets dropped DDoS

Inbound TCP packets dropped DDoS
TCPPacketsDroppedDDoS No CountPerSecond Maximum ProtectedIPAddress PT1M Yes
Inbound TCP packets forwarded DDoS

Inbound TCP packets forwarded DDoS
TCPPacketsForwardedDDoS No CountPerSecond Maximum ProtectedIPAddress PT1M Yes
Inbound TCP packets DDoS

Inbound TCP packets DDoS
TCPPacketsInDDoS No CountPerSecond Maximum ProtectedIPAddress PT1M Yes
Inbound UDP bytes dropped DDoS

Inbound UDP bytes dropped DDoS
UDPBytesDroppedDDoS No BytesPerSecond Maximum ProtectedIPAddress PT1M Yes
Inbound UDP bytes forwarded DDoS

Inbound UDP bytes forwarded DDoS
UDPBytesForwardedDDoS No BytesPerSecond Maximum ProtectedIPAddress PT1M Yes
Inbound UDP bytes DDoS

Inbound UDP bytes DDoS
UDPBytesInDDoS No BytesPerSecond Maximum ProtectedIPAddress PT1M Yes
Inbound UDP packets dropped DDoS

Inbound UDP packets dropped DDoS
UDPPacketsDroppedDDoS No CountPerSecond Maximum ProtectedIPAddress PT1M Yes
Inbound UDP packets forwarded DDoS

Inbound UDP packets forwarded DDoS
UDPPacketsForwardedDDoS No CountPerSecond Maximum ProtectedIPAddress PT1M Yes
Inbound UDP packets DDoS

Inbound UDP packets DDoS
UDPPacketsInDDoS No CountPerSecond Maximum ProtectedIPAddress PT1M Yes

Supported metrics for Microsoft.Network/networkInterfaces

The following table lists the metrics available for the Microsoft.Network/networkInterfaces resource type.

  • All columns might not be present in every table.
  • Some columns might be beyond the viewing area of the page. Select Expand table to view all available columns.

Table headings

  • Category - The metrics group or classification.
  • Metric - The metric display name as it appears in the Azure portal.
  • Name in REST API - The metric name as referred to in the REST API.
  • Unit - Unit of measure.
  • Aggregation - The default aggregation type. Valid values: Average (Avg), Minimum (Min), Maximum (Max), Total (Sum), Count.
  • Dimensions - Dimensions available for the metric.
  • Time Grains - Intervals at which the metric is sampled. For example, PT1M indicates that the metric is sampled every minute, PT30M every 30 minutes, PT1H every hour, and so on.
  • DS Export- Whether the metric is exportable to Azure Monitor Logs via diagnostic settings. For information on exporting metrics, see Create diagnostic settings in Azure Monitor.
Metric Name in REST API Advanced platform metrics Unit Aggregation Dimensions Time Grains DS Export
Bytes Received

Number of bytes the Network Interface received
BytesReceived No Bytes Total (Sum) <none> PT1M No
Bytes Received

Number of bytes the Network Interface received
BytesReceivedRate No Bytes Total (Sum) <none> PT1M Yes
Bytes Sent

Number of bytes the Network Interface sent
BytesSent No Bytes Total (Sum) <none> PT1M No
Bytes Sent

Number of bytes the Network Interface sent
BytesSentRate No Bytes Total (Sum) <none> PT1M Yes
Inbound Flows Maximum Creation Rate

The maximum creation rate of inbound flows (traffic going into the NIC)
CreationRateMaxTotalFlowsIn No CountPerSecond Average <none> PT1M No
Outbound Flows Maximum Creation Rate

The maximum creation rate of outbound flows (traffic going out of the NIC)
CreationRateMaxTotalFlowsOut No CountPerSecond Average <none> PT1M No
Inbound Flows

Inbound Flows are number of current flows in the inbound direction (traffic going into the NIC)
CurrentTotalFlowsIn No Count Average <none> PT1M No
Outbound Flows

Outbound Flows are number of current flows in the outbound direction (traffic going out of the NIC)
CurrentTotalFlowsOut No Count Average <none> PT1M No
Mirror Bytes Received

Number of mirrored bytes received
MirrorBytesReceived No Bytes Total (Sum) <none> PT1M No
Mirror Bytes Received Skipped

Number of mirrored bytes received skipped
MirrorBytesReceivedSkipped No Bytes Total (Sum) <none> PT1M No
Mirror Bytes Sent

Number of mirrored bytes sent
MirrorBytesSent No Bytes Total (Sum) <none> PT1M No
Mirror Bytes Sent Skipped

Number of mirrored bytes sent skipped
MirrorBytesSentSkipped No Bytes Total (Sum) <none> PT1M No
Mirror Packets Received

Number of mirrored packets received
MirrorPacketsReceived No Count Total (Sum) <none> PT1M No
Mirror Packets Received Skipped

Number of mirrored packets received skipped
MirrorPacketsReceivedSkipped No Count Total (Sum) <none> PT1M No
Mirror Packets Sent

Number of mirrored packets sent
MirrorPacketsSent No Count Total (Sum) <none> PT1M No
Mirror Packets Sent Skipped

Number of mirrored packets sent skipped
MirrorPacketsSentSkipped No Count Total (Sum) <none> PT1M No
Packets Received

Number of packets the Network Interface received
PacketsReceived No Count Total (Sum) <none> PT1M No
Packets Received

Number of packets the Network Interface received
PacketsReceivedRate No Count Total (Sum) <none> PT1M Yes
Packets Sent

Number of packets the Network Interface sent
PacketsSent No Count Total (Sum) <none> PT1M No
Packets Sent

Number of packets the Network Interface sent
PacketsSentRate No Count Total (Sum) <none> PT1M Yes

Supported metrics for Microsoft.Network/publicIPAddresses

The following table lists the metrics available for the Microsoft.Network/publicIPAddresses resource type.

  • All columns might not be present in every table.
  • Some columns might be beyond the viewing area of the page. Select Expand table to view all available columns.

Table headings

  • Category - The metrics group or classification.
  • Metric - The metric display name as it appears in the Azure portal.
  • Name in REST API - The metric name as referred to in the REST API.
  • Unit - Unit of measure.
  • Aggregation - The default aggregation type. Valid values: Average (Avg), Minimum (Min), Maximum (Max), Total (Sum), Count.
  • Dimensions - Dimensions available for the metric.
  • Time Grains - Intervals at which the metric is sampled. For example, PT1M indicates that the metric is sampled every minute, PT30M every 30 minutes, PT1H every hour, and so on.
  • DS Export- Whether the metric is exportable to Azure Monitor Logs via diagnostic settings. For information on exporting metrics, see Create diagnostic settings in Azure Monitor.
Metric Name in REST API Advanced platform metrics Unit Aggregation Dimensions Time Grains DS Export
Byte Count

Total number of Bytes transmitted within time period
ByteCount No Bytes Total (Sum) Port, Direction PT1M Yes
Inbound bytes dropped DDoS

Inbound bytes dropped DDoS
BytesDroppedDDoS No BytesPerSecond Maximum <none> PT1M Yes
Inbound bytes forwarded DDoS

Inbound bytes forwarded DDoS
BytesForwardedDDoS No BytesPerSecond Maximum <none> PT1M Yes
Inbound bytes DDoS

Inbound bytes DDoS
BytesInDDoS No BytesPerSecond Maximum <none> PT1M Yes
Inbound SYN packets to trigger DDoS mitigation

Inbound SYN packets to trigger DDoS mitigation
DDoSTriggerSYNPackets No CountPerSecond Maximum <none> PT1M Yes
Inbound TCP packets to trigger DDoS mitigation

Inbound TCP packets to trigger DDoS mitigation
DDoSTriggerTCPPackets No CountPerSecond Maximum <none> PT1M Yes
Inbound UDP packets to trigger DDoS mitigation

Inbound UDP packets to trigger DDoS mitigation
DDoSTriggerUDPPackets No CountPerSecond Maximum <none> PT1M Yes
Under DDoS attack or not

Under DDoS attack or not
IfUnderDDoSAttack No Count Maximum <none> PT1M Yes
Packet Count

Total number of Packets transmitted within time period
PacketCount No Count Total (Sum) Port, Direction PT1M Yes
Inbound packets dropped DDoS

Inbound packets dropped DDoS
PacketsDroppedDDoS No CountPerSecond Maximum <none> PT1M Yes
Inbound packets forwarded DDoS

Inbound packets forwarded DDoS
PacketsForwardedDDoS No CountPerSecond Maximum <none> PT1M Yes
Inbound packets DDoS

Inbound packets DDoS
PacketsInDDoS No CountPerSecond Maximum <none> PT1M Yes
SYN Count

Total number of SYN Packets transmitted within time period
SynCount No Count Total (Sum) Port, Direction PT1M Yes
Inbound TCP bytes dropped DDoS

Inbound TCP bytes dropped DDoS
TCPBytesDroppedDDoS No BytesPerSecond Maximum <none> PT1M Yes
Inbound TCP bytes forwarded DDoS

Inbound TCP bytes forwarded DDoS
TCPBytesForwardedDDoS No BytesPerSecond Maximum <none> PT1M Yes
Inbound TCP bytes DDoS

Inbound TCP bytes DDoS
TCPBytesInDDoS No BytesPerSecond Maximum <none> PT1M Yes
Inbound TCP packets dropped DDoS

Inbound TCP packets dropped DDoS
TCPPacketsDroppedDDoS No CountPerSecond Maximum <none> PT1M Yes
Inbound TCP packets forwarded DDoS

Inbound TCP packets forwarded DDoS
TCPPacketsForwardedDDoS No CountPerSecond Maximum <none> PT1M Yes
Inbound TCP packets DDoS

Inbound TCP packets DDoS
TCPPacketsInDDoS No CountPerSecond Maximum <none> PT1M Yes
Inbound UDP bytes dropped DDoS

Inbound UDP bytes dropped DDoS
UDPBytesDroppedDDoS No BytesPerSecond Maximum <none> PT1M Yes
Inbound UDP bytes forwarded DDoS

Inbound UDP bytes forwarded DDoS
UDPBytesForwardedDDoS No BytesPerSecond Maximum <none> PT1M Yes
Inbound UDP bytes DDoS

Inbound UDP bytes DDoS
UDPBytesInDDoS No BytesPerSecond Maximum <none> PT1M Yes
Inbound UDP packets dropped DDoS

Inbound UDP packets dropped DDoS
UDPPacketsDroppedDDoS No CountPerSecond Maximum <none> PT1M Yes
Inbound UDP packets forwarded DDoS

Inbound UDP packets forwarded DDoS
UDPPacketsForwardedDDoS No CountPerSecond Maximum <none> PT1M Yes
Inbound UDP packets DDoS

Inbound UDP packets DDoS
UDPPacketsInDDoS No CountPerSecond Maximum <none> PT1M Yes
Data Path Availability

Average IP Address availability per time duration
VipAvailability No Count Average Port PT1M Yes

Supported metrics for Microsoft.Network/natGateways

The following table lists the metrics available for the Microsoft.Network/natGateways resource type.

  • All columns might not be present in every table.
  • Some columns might be beyond the viewing area of the page. Select Expand table to view all available columns.

Table headings

  • Category - The metrics group or classification.
  • Metric - The metric display name as it appears in the Azure portal.
  • Name in REST API - The metric name as referred to in the REST API.
  • Unit - Unit of measure.
  • Aggregation - The default aggregation type. Valid values: Average (Avg), Minimum (Min), Maximum (Max), Total (Sum), Count.
  • Dimensions - Dimensions available for the metric.
  • Time Grains - Intervals at which the metric is sampled. For example, PT1M indicates that the metric is sampled every minute, PT30M every 30 minutes, PT1H every hour, and so on.
  • DS Export- Whether the metric is exportable to Azure Monitor Logs via diagnostic settings. For information on exporting metrics, see Create diagnostic settings in Azure Monitor.
Metric Name in REST API Advanced platform metrics Unit Aggregation Dimensions Time Grains DS Export
Bytes

Total number of Bytes transmitted within time period
ByteCount No Bytes Total (Sum) Protocol, Direction PT1M No
Datapath Availability

NAT Gateway Datapath Availability
DatapathAvailability No Count Average <none> PT1M No
Packets

Total number of Packets transmitted within time period
PacketCount No Count Total (Sum) Protocol, Direction PT1M No
Dropped Packets

Count of dropped packets
PacketDropCount No Count Total (Sum) <none> PT1M No
SNAT Connection Count

Total concurrent active connections
SNATConnectionCount No Count Total (Sum) Protocol, ConnectionState PT1M No
Total SNAT Connection Count

Total number of active SNAT connections
TotalConnectionCount No Count Total (Sum) Protocol PT1M No

Metric dimensions

For information about what metric dimensions are, see Multi-dimensional metrics.

This service has the following dimensions associated with its metrics.

Dimensions for Microsoft.Network/virtualNetworks:

Dimension name Description
DestinationCustomerAddress
ProtectedIPAddress
SourceCustomerAddress

Dimensions for Microsoft.Network/networkInterfaces:

None.

Dimensions for Microsoft.Network/publicIPAddresses:

Dimension name Description
Direction
Port

Dimensions for Microsoft.Network/natGateways:

Dimension name Description
Direction The direction of traffic flow. The supported values are In and Out.
Protocol The type of transport protocol. The supported values are TCP and UDP.
ConnectionState

Resource logs

This section lists the types of resource logs you can collect for this service. The section pulls from the list of all resource logs category types supported in Azure Monitor.

Supported resource logs for Microsoft.Network/networksecuritygroups

Category Costs to export Log table Supports basic log plan Supports ingestion-time transformation Example queries
Network Security Group Event No AzureDiagnostics

Logs from multiple Azure resources.

No No Queries
Network Security Group Rule Flow Event No AzureDiagnostics

Logs from multiple Azure resources.

No No Queries
Network Security Group Rule Counter No AzureDiagnostics

Logs from multiple Azure resources.

No No Queries

Supported resource logs for Microsoft.Network/publicIPAddresses

Category Costs to export Log table Supports basic log plan Supports ingestion-time transformation Example queries
Flow logs of DDoS mitigation decisions No AzureDiagnostics

Logs from multiple Azure resources.

No No Queries
Reports of DDoS mitigations No AzureDiagnostics

Logs from multiple Azure resources.

No No Queries
DDoS protection notifications No AzureDiagnostics

Logs from multiple Azure resources.

No No Queries

Supported resource logs for Microsoft.Network/virtualNetworks

Category Costs to export Log table Supports basic log plan Supports ingestion-time transformation Example queries
VM protection alerts No No No

Azure Monitor Logs tables

This section lists the Azure Monitor Logs tables relevant to this service, which are available for query by Log Analytics using Kusto queries. The tables contain resource log data and possibly more depending on what is collected and routed to them.

Virtual Network Microsoft.Network/virtualNetworks

Virtual Network Microsoft.Network/networkinterfaces

Virtual Network Microsoft.Network/PublicIpAddresses

Activity log

The linked table lists the operations that can be recorded in the activity log for this service. These operations are a subset of all the possible resource provider operations in the activity log.

For more information on the schema of activity log entries, see Activity Log schema.

The following table lists the operations related to Azure virtual network that might be created in the Activity log.

Operation Description
All administrative operations All administrative operations including create, update, and delete of an Azure virtual network.
Create or update virtual network A virtual network was created or updated.
Deletes virtual network A virtual network was deleted.