| 1 | # you can disable an alarm notification by setting the 'to' line to: silent |
| 2 | |
| 3 | # --- Errors: Tunnel Packet Drops --- |
| 4 | |
| 5 | template: am_vpn_gateway_tunnel_packet_drops |
| 6 | on: azure_monitor.vpn_gateway.tunnel_packet_drops |
| 7 | class: Errors |
| 8 | type: Other |
| 9 | component: Azure VPN Gateway |
| 10 | lookup: average -5m unaligned of egress ingress |
| 11 | units: packets/s |
| 12 | every: 1m |
| 13 | warn: $this > (($status >= $WARNING) ? (10) : (50)) |
| 14 | crit: $this > (($status == $CRITICAL) ? (50) : (200)) |
| 15 | delay: down 5m multiplier 1.5 max 1h |
| 16 | summary: VPN Gateway tunnel packet drops on ${label:resource_name} |
| 17 | info: Packets being dropped across VPN tunnels on ${label:resource_name} \ |
| 18 | in ${label:resource_group} (${label:region}). \ |
| 19 | Drops indicate tunnel instability or capacity issues |
| 20 | to: sysadmin |
| 21 | |
| 22 | # --- Errors: Tunnel TS Mismatch Drops --- |
| 23 | |
| 24 | template: am_vpn_gateway_tunnel_ts_mismatch_drops |
| 25 | on: azure_monitor.vpn_gateway.tunnel_ts_mismatch_drops |
| 26 | class: Errors |
| 27 | type: Other |
| 28 | component: Azure VPN Gateway |
| 29 | lookup: average -5m unaligned of egress ingress |
| 30 | units: packets/s |
| 31 | every: 1m |
| 32 | warn: $this > (($status >= $WARNING) ? (1) : (10)) |
| 33 | crit: $this > (($status == $CRITICAL) ? (10) : (50)) |
| 34 | delay: down 5m multiplier 1.5 max 1h |
| 35 | summary: VPN Gateway TS mismatch drops on ${label:resource_name} |
| 36 | info: Packets dropped due to traffic selector mismatch on ${label:resource_name} \ |
| 37 | in ${label:resource_group} (${label:region}). \ |
| 38 | This typically indicates IPsec policy misconfiguration |
| 39 | to: sysadmin |
| 40 | |
| 41 | # --- Errors: Tunnel NAT Packet Drops --- |
| 42 | |
| 43 | template: am_vpn_gateway_tunnel_nat_packet_drops |
| 44 | on: azure_monitor.vpn_gateway.tunnel_nat_packet_drops |
| 45 | class: Errors |
| 46 | type: Other |
| 47 | component: Azure VPN Gateway |
| 48 | lookup: average -5m unaligned of total |
| 49 | units: packets/s |
| 50 | every: 1m |
| 51 | warn: $this != nan AND $this > (($status >= $WARNING) ? (1) : (10)) |
| 52 | crit: $this != nan AND $this > (($status == $CRITICAL) ? (10) : (50)) |
| 53 | delay: down 5m multiplier 1.5 max 1h |
| 54 | summary: VPN Gateway NAT packet drops on ${label:resource_name} |
| 55 | info: NAT-related packet drops on VPN Gateway ${label:resource_name} \ |
| 56 | in ${label:resource_group} (${label:region}). \ |
| 57 | May indicate NAT rule misconfiguration or address exhaustion |
| 58 | to: sysadmin |
| 59 | |
| 60 | # --- Routing: BGP Peer Status --- |
| 61 | # BGP is optional; metrics return NaN when BGP is not configured |
| 62 | |
| 63 | template: am_vpn_gateway_bgp_peer_status |
| 64 | on: azure_monitor.vpn_gateway.bgp_peer_status |
| 65 | class: Availability |
| 66 | type: Other |
| 67 | component: Azure VPN Gateway |
| 68 | lookup: average -5m unaligned of average |
| 69 | units: status |
| 70 | every: 1m |
| 71 | crit: $this != nan AND $this < 1 |
| 72 | delay: down 5m multiplier 1.5 max 1h |
| 73 | summary: VPN Gateway BGP peer down on ${label:resource_name} |
| 74 | info: BGP peer status on VPN Gateway ${label:resource_name} \ |
| 75 | in ${label:resource_group} (${label:region}). \ |
| 76 | Value below 1 indicates a BGP peer session is down |
| 77 | to: sysadmin |
| 78 | |
| 79 | # --- Utilization: ExpressRoute Gateway CPU --- |
| 80 | |
| 81 | template: am_vpn_gateway_er_gateway_cpu |
| 82 | on: azure_monitor.vpn_gateway.er_gateway_cpu |
| 83 | class: Utilization |
| 84 | type: Other |
| 85 | component: Azure VPN Gateway |
| 86 | lookup: average -5m unaligned of average |
| 87 | units: percentage |
| 88 | every: 1m |
| 89 | warn: $this != nan AND $this > (($status >= $WARNING) ? (70) : (80)) |
| 90 | crit: $this != nan AND $this > (($status == $CRITICAL) ? (80) : (90)) |
| 91 | delay: down 5m multiplier 1.5 max 1h |
| 92 | summary: VPN GW ExpressRoute CPU on ${label:resource_name} |
| 93 | info: CPU utilization of ExpressRoute Gateway on ${label:resource_name} \ |
| 94 | in ${label:resource_group} (${label:region}). \ |
| 95 | High CPU may degrade forwarding performance |
| 96 | to: sysadmin |
| 97 | |
| 98 | # --- Workload: ExpressRoute Gateway Active Flows --- |
| 99 | |
| 100 | template: am_vpn_gateway_er_gateway_active_flows |
| 101 | on: azure_monitor.vpn_gateway.er_gateway_active_flows |
| 102 | class: Workload |
| 103 | type: Other |
| 104 | component: Azure VPN Gateway |
| 105 | lookup: average -5m unaligned of average |
| 106 | units: flows |
| 107 | every: 1m |
| 108 | warn: $this != nan AND $this > (($status >= $WARNING) ? (200000) : (250000)) |
| 109 | delay: down 5m multiplier 1.5 max 1h |
| 110 | summary: VPN GW ExpressRoute active flows on ${label:resource_name} |
| 111 | info: Active flows on ExpressRoute Gateway ${label:resource_name} \ |
| 112 | in ${label:resource_group} (${label:region}). \ |
| 113 | High flow counts may indicate approaching scalability limits |
| 114 | to: sysadmin |
| 115 | |
| 116 | # --- Errors: ExpressRoute Gateway Route Changes --- |
| 117 | |
| 118 | template: am_vpn_gateway_er_gateway_route_changes |
| 119 | on: azure_monitor.vpn_gateway.er_gateway_route_changes |
| 120 | class: Errors |
| 121 | type: Other |
| 122 | component: Azure VPN Gateway |
| 123 | lookup: average -5m unaligned of total |
| 124 | units: changes/s |
| 125 | every: 1m |
| 126 | warn: $this != nan AND $this > (($status >= $WARNING) ? (5) : (10)) |
| 127 | delay: down 5m multiplier 1.5 max 1h |
| 128 | summary: VPN GW ExpressRoute route churn on ${label:resource_name} |
| 129 | info: Rate of BGP route changes on ExpressRoute Gateway ${label:resource_name} \ |
| 130 | in ${label:resource_group} (${label:region}). \ |
| 131 | Frequent route changes may indicate BGP instability |
| 132 | to: sysadmin |
| 133 | |
| 134 | # --- Workload: ExpressRoute Routes Advertised --- |
| 135 | |
| 136 | template: am_vpn_gateway_er_gateway_routes_advertised |
| 137 | on: azure_monitor.vpn_gateway.er_gateway_routes_advertised |
| 138 | class: Workload |
| 139 | type: Other |
| 140 | component: Azure VPN Gateway |
| 141 | lookup: average -5m unaligned of maximum |
| 142 | units: routes |
| 143 | every: 1m |
| 144 | warn: $this != nan AND $this > (($status >= $WARNING) ? (900) : (950)) |
| 145 | delay: down 5m multiplier 1.5 max 1h |
| 146 | summary: VPN GW ExpressRoute routes advertised on ${label:resource_name} |
| 147 | info: Routes advertised to peer by ExpressRoute Gateway on ${label:resource_name} \ |
| 148 | in ${label:resource_group} (${label:region}). \ |
| 149 | Azure limits advertised routes to 1000 per peering |
| 150 | to: sysadmin |
| 151 | |
| 152 | # --- Workload: ExpressRoute Routes Learned --- |
| 153 | |
| 154 | template: am_vpn_gateway_er_gateway_routes_learned |
| 155 | on: azure_monitor.vpn_gateway.er_gateway_routes_learned |
| 156 | class: Workload |
| 157 | type: Other |
| 158 | component: Azure VPN Gateway |
| 159 | lookup: average -5m unaligned of maximum |
| 160 | units: routes |
| 161 | every: 1m |
| 162 | warn: $this != nan AND $this > (($status >= $WARNING) ? (3800) : (3900)) |
| 163 | delay: down 5m multiplier 1.5 max 1h |
| 164 | summary: VPN GW ExpressRoute routes learned on ${label:resource_name} |
| 165 | info: Routes learned from peer by ExpressRoute Gateway on ${label:resource_name} \ |
| 166 | in ${label:resource_group} (${label:region}). \ |
| 167 | Default Azure limit is 4000 routes per peering (varies by gateway SKU) |
| 168 | to: sysadmin |
| 169 | |
| 170 | # --- Utilization: Scalable ExpressRoute Gateway CPU --- |
| 171 | |
| 172 | template: am_vpn_gateway_scalable_er_cpu |
| 173 | on: azure_monitor.vpn_gateway.scalable_er_cpu |
| 174 | class: Utilization |
| 175 | type: Other |
| 176 | component: Azure VPN Gateway |
| 177 | lookup: average -5m unaligned of average |
| 178 | units: percentage |
| 179 | every: 1m |
| 180 | warn: $this != nan AND $this > (($status >= $WARNING) ? (70) : (80)) |
| 181 | crit: $this != nan AND $this > (($status == $CRITICAL) ? (80) : (90)) |
| 182 | delay: down 5m multiplier 1.5 max 1h |
| 183 | summary: VPN GW Scalable ER CPU on ${label:resource_name} |
| 184 | info: CPU utilization of Scalable ExpressRoute Gateway on ${label:resource_name} \ |
| 185 | in ${label:resource_group} (${label:region}). \ |
| 186 | High CPU may degrade forwarding performance |
| 187 | to: sysadmin |
| 188 | |
| 189 | # --- Workload: Scalable ExpressRoute Gateway Active Flows --- |
| 190 | |
| 191 | template: am_vpn_gateway_scalable_er_active_flows |
| 192 | on: azure_monitor.vpn_gateway.scalable_er_active_flows |
| 193 | class: Workload |
| 194 | type: Other |
| 195 | component: Azure VPN Gateway |
| 196 | lookup: average -5m unaligned of average |
| 197 | units: flows |
| 198 | every: 1m |
| 199 | warn: $this != nan AND $this > (($status >= $WARNING) ? (200000) : (250000)) |
| 200 | delay: down 5m multiplier 1.5 max 1h |
| 201 | summary: VPN GW Scalable ER active flows on ${label:resource_name} |
| 202 | info: Active flows on Scalable ExpressRoute Gateway ${label:resource_name} \ |
| 203 | in ${label:resource_group} (${label:region}). \ |
| 204 | High flow counts may indicate approaching scalability limits |
| 205 | to: sysadmin |
| 206 | |
| 207 | # --- Errors: Scalable ExpressRoute Gateway Route Changes --- |
| 208 | |
| 209 | template: am_vpn_gateway_scalable_er_route_changes |
| 210 | on: azure_monitor.vpn_gateway.scalable_er_route_changes |
| 211 | class: Errors |
| 212 | type: Other |
| 213 | component: Azure VPN Gateway |
| 214 | lookup: average -5m unaligned of total |
| 215 | units: changes/s |
| 216 | every: 1m |
| 217 | warn: $this != nan AND $this > (($status >= $WARNING) ? (5) : (10)) |
| 218 | delay: down 5m multiplier 1.5 max 1h |
| 219 | summary: VPN GW Scalable ER route churn on ${label:resource_name} |
| 220 | info: Rate of BGP route changes on Scalable ExpressRoute Gateway ${label:resource_name} \ |
| 221 | in ${label:resource_group} (${label:region}). \ |
| 222 | Frequent route changes may indicate BGP instability |
| 223 | to: sysadmin |
| 224 | |
| 225 | # --- Workload: Scalable ExpressRoute Routes Advertised --- |
| 226 | |
| 227 | template: am_vpn_gateway_scalable_er_routes_advertised |
| 228 | on: azure_monitor.vpn_gateway.scalable_er_routes_advertised |
| 229 | class: Workload |
| 230 | type: Other |
| 231 | component: Azure VPN Gateway |
| 232 | lookup: average -5m unaligned of maximum |
| 233 | units: routes |
| 234 | every: 1m |
| 235 | warn: $this != nan AND $this > (($status >= $WARNING) ? (900) : (950)) |
| 236 | delay: down 5m multiplier 1.5 max 1h |
| 237 | summary: VPN GW Scalable ER routes advertised on ${label:resource_name} |
| 238 | info: Routes advertised to peer by Scalable ExpressRoute Gateway on ${label:resource_name} \ |
| 239 | in ${label:resource_group} (${label:region}). \ |
| 240 | Azure limits advertised routes to 1000 per peering |
| 241 | to: sysadmin |
| 242 | |
| 243 | # --- Workload: Scalable ExpressRoute Routes Learned --- |
| 244 | |
| 245 | template: am_vpn_gateway_scalable_er_routes_learned |
| 246 | on: azure_monitor.vpn_gateway.scalable_er_routes_learned |
| 247 | class: Workload |
| 248 | type: Other |
| 249 | component: Azure VPN Gateway |
| 250 | lookup: average -5m unaligned of maximum |
| 251 | units: routes |
| 252 | every: 1m |
| 253 | warn: $this != nan AND $this > (($status >= $WARNING) ? (3800) : (3900)) |
| 254 | delay: down 5m multiplier 1.5 max 1h |
| 255 | summary: VPN GW Scalable ER routes learned on ${label:resource_name} |
| 256 | info: Routes learned from peer by Scalable ExpressRoute Gateway on ${label:resource_name} \ |
| 257 | in ${label:resource_group} (${label:region}). \ |
| 258 | Default Azure limit is 4000 routes per peering (varies by gateway SKU) |
| 259 | to: sysadmin |
| 260 | |
| 261 | # --- Workload: ExpressRoute Gateway Bandwidth (informational) --- |
| 262 | |
| 263 | template: am_vpn_gateway_er_gateway_bandwidth |
| 264 | on: azure_monitor.vpn_gateway.er_gateway_bandwidth |
| 265 | class: Workload |
| 266 | type: Other |
| 267 | component: Azure VPN Gateway |
| 268 | lookup: average -5m unaligned of average |
| 269 | units: bits/s |
| 270 | every: 1m |
| 271 | info: Average throughput of ExpressRoute Gateway on ${label:resource_name} \ |
| 272 | in ${label:resource_group} (${label:region}) |
| 273 | to: silent |
| 274 | |
| 275 | # --- Workload: Scalable ExpressRoute Gateway Bandwidth (informational) --- |
| 276 | |
| 277 | template: am_vpn_gateway_scalable_er_bandwidth |
| 278 | on: azure_monitor.vpn_gateway.scalable_er_bandwidth |
| 279 | class: Workload |
| 280 | type: Other |
| 281 | component: Azure VPN Gateway |
| 282 | lookup: average -5m unaligned of average |
| 283 | units: bits/s |
| 284 | every: 1m |
| 285 | info: Average throughput of Scalable ExpressRoute Gateway on ${label:resource_name} \ |
| 286 | in ${label:resource_group} (${label:region}) |
| 287 | to: silent |
| 288 | |
| 289 | # --- Workload: S2S Bandwidth (informational) --- |
| 290 | |
| 291 | template: am_vpn_gateway_s2s_bandwidth |
| 292 | on: azure_monitor.vpn_gateway.s2s_bandwidth |
| 293 | class: Workload |
| 294 | type: Other |
| 295 | component: Azure VPN Gateway |
| 296 | lookup: average -5m unaligned of average |
| 297 | units: bytes/s |
| 298 | every: 1m |
| 299 | info: Average site-to-site bandwidth on VPN Gateway ${label:resource_name} \ |
| 300 | in ${label:resource_group} (${label:region}) |
| 301 | to: silent |
| 302 | |
| 303 | # --- Workload: Tunnel Bandwidth (informational) --- |
| 304 | |
| 305 | template: am_vpn_gateway_tunnel_bandwidth |
| 306 | on: azure_monitor.vpn_gateway.tunnel_bandwidth |
| 307 | class: Workload |
| 308 | type: Other |
| 309 | component: Azure VPN Gateway |
| 310 | lookup: average -5m unaligned of average |
| 311 | units: bytes/s |
| 312 | every: 1m |
| 313 | info: Average tunnel bandwidth on VPN Gateway ${label:resource_name} \ |
| 314 | in ${label:resource_group} (${label:region}) |
| 315 | to: silent |