Skip to content

Commit f1d696f

Browse files
TimShererWithAquentTimShererWithAquent
committed
Fix warnings and reorg metrics sections.
1 parent 977f27e commit f1d696f

File tree

4 files changed

+54
-71
lines changed

4 files changed

+54
-71
lines changed

‎articles/application-gateway/monitor-application-gateway-reference.md

Lines changed: 50 additions & 69 deletions
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
---
22
title: Monitoring data reference for Azure Application Gateway
33
description: This article contains important reference material you need when you monitor Azure Application Gateway.
4-
ms.date: 06/04/2024
4+
ms.date: 06/17/2024
55
ms.custom: horz-monitor, subject-monitoring
66
ms.topic: reference
77
author: greg-lindsay
@@ -25,19 +25,21 @@ The following table lists the all metrics available for the Microsoft.Network/ap
2525

2626
[!INCLUDE[Microsoft.Network/applicationgateways](~/reusable-content/ce-skilling/azure/includes/azure-monitor/reference/metrics/microsoft-network-applicationgateways-metrics-include.md)]
2727

28-
### Timing metrics
28+
For available Web Application Firewall (WAF) metrics, see [Application Gateway WAF v2 metrics](../web-application-firewall/ag/application-gateway-waf-metrics.md#application-gateway-waf-v2-metrics) and [Application Gateway WAF v1 metrics](../web-application-firewall/ag/application-gateway-waf-metrics.md#application-gateway-waf-v1-metrics).
2929

30-
Application Gateway provides many built‑in timing metrics related to the request and response, which are all measured in milliseconds. What follows is an expanded description of the timing metrics already listed in the previous metrics table [metrics table](#supported-metrics-for-microsoftnetworkapplicationgateways).
30+
### Timing metrics for Application Gateway v2 SKU
31+
32+
Application Gateway v2 SKU provides many built‑in timing metrics related to the request and response, which are all measured in milliseconds. What follows is expanded descriptions of the timing metrics already listed in the previous [metrics table](#supported-metrics-for-microsoftnetworkapplicationgateways).
3133

3234
- **Backend connect time**. This value includes the network latency and the time taken by the backend server's TCP stack to establish new connections. For TLS, it also includes the time spent on handshake.
3335
- **Backend first byte response time**. This value approximates the sum of *Backend connect time*, time taken by the request to reach the backend from Application Gateway, time taken by backend application to respond, which is the time the server takes to generate content and potentially fetch database queries, and the time taken by first byte of the response to reach the Application Gateway from the backend.
3436
- **Backend last byte response time**. This value approximates the sum of backend first byte response time and data transfer time. This number varies greatly depending on the size of objects requested and the latency of the server network.
3537
- **Application gateway total time**. This interval is the time from Application Gateway receives the first byte of the HTTP request to the time when the last response byte was sent to the client.
3638
- **Client RTT**. Average round-trip time between clients and Application Gateway.
3739

38-
### Application Gateway metrics
40+
### Metrics for Application Gateway v2 SKU
3941

40-
For Application Gateway, the following metrics are available. For details, see the [metrics table](#supported-metrics-for-microsoftnetworkapplicationgateways).
42+
For Application Gateway v2 SKU, the following metrics are available. What follows is expanded descriptions of the metrics already listed in the previous [metrics table](#supported-metrics-for-microsoftnetworkapplicationgateways).
4143

4244
- **Bytes received**. This metric accounts for only the Request content size observed by the Application Gateway. It doesn't include data transfers such as TLS header negotiations, TCP/IP packet headers, or retransmissions.
4345
- **Bytes sent**. This metric accounts for only the Response Content size served by the Application Gateway. It doesn't include data transfers such as TCP/IP packet headers or retransmissions.
@@ -53,18 +55,18 @@ For Application Gateway, the following metrics are available. For details, see t
5355
- **Throughput**. This metric accounts for only the Content size served by the Application Gateway. It doesn't include data transfers such as TLS header negotiations, TCP/IP packet headers, or retransmissions.
5456
- **Total Requests**. Successful requests that Application Gateway served. The request count can be filtered to show count per each/specific backend pool-http setting combination.
5557

56-
### Backend metrics
58+
### Backend metrics for Application Gateway v2 SKU
5759

58-
The following backend metrics are available. What follows is a list and expanded descriptions of the backend metrics already listed in the previous [metrics table](#supported-metrics-for-microsoftnetworkapplicationgateways).
60+
For Application Gateway v2 SKU, the following backend metrics are available. What follows is expanded descriptions of the backend metrics already listed in the previous [metrics table](#supported-metrics-for-microsoftnetworkapplicationgateways).
5961

6062
- **Backend response status**. Count of HTTP response status codes returned by the backends, not including any response codes generated by the Application Gateway. The response status code distribution can be categorized to show responses in 2xx, 3xx, 4xx, and 5xx categories.|
6163
- **Healthy host count**. The number of hosts that are determined healthy by the health probe. You can filter on a per backend pool basis to show the number of healthy hosts in a specific backend pool.
6264
- **Unhealthy host count**. The number of hosts that are determined unhealthy by the health probe. You can filter on a per backend pool basis to show the number of unhealthy hosts in a specific backend pool.
6365
- **Requests per minute per Healthy Host**. The average number of requests received by each healthy member in a backend pool in a minute. Specify the backend pool using the *BackendPool HttpSettings* dimension.
6466

65-
### Application Gateway metrics for Application Gateway V1 SKU
67+
### Metrics for Application Gateway v1 SKU
6668

67-
For Application Gateway V1 SKU, the following metrics are available:
69+
For Application Gateway v1 SKU, the following metrics are available. What follows is expanded descriptions of the metrics already listed in the previous [metrics table](#supported-metrics-for-microsoftnetworkapplicationgateways).
6870

6971
- **CPU Utilization**. Displays the utilization of the CPUs allocated to the Application Gateway. Under normal conditions, CPU usage should not regularly exceed 90%, as this may cause latency in the websites hosted behind the Application Gateway and disrupt the client experience. You can indirectly control or improve CPU utilization by modifying the configuration of the Application Gateway by increasing the instance count or by moving to a larger SKU size, or doing both.
7072

@@ -78,9 +80,9 @@ For Application Gateway V1 SKU, the following metrics are available:
7880

7981
- **Total Requests**. Count of successful requests that Application Gateway has served. The request count can be further filtered to show count per each/specific backend pool-http setting combination.
8082

81-
### Backend metrics for Application Gateway V1 SKU
83+
### Backend metrics for Application Gateway v1 SKU
8284

83-
The following metrics are available:
85+
For Application Gateway v1 SKU, the following backend metrics are available. What follows is expanded descriptions of the backend metrics already listed in the previous [metrics table](#supported-metrics-for-microsoftnetworkapplicationgateways).
8486

8587
- **Healthy host count**. The number of backends that are determined healthy by the health probe. You can filter on a per backend pool basis to show the number of healthy hosts in a specific backend pool.
8688

@@ -105,13 +107,9 @@ GET
105107
https://management.azure.com/subscriptions/subid/providers/Microsoft.Network/locations/region-name/operationResults/GUID?api-version=2021-08-01
106108
```
107109

108-
### Application Gateway TLS/TCP proxy monitoring
109-
110-
Application Gateway supports TLS/TCP proxy monitoring.
111-
112-
#### TLS/TCP proxy metrics
110+
### TLS/TCP proxy metrics
113111

114-
With layer 4 proxy feature now available with Application Gateway, there are some Common metrics that apply to both layer 7 and layer 4. There are some layer 4 specific metrics. The following list summarizes the metrics are the applicable for layer 4 usage.
112+
Application Gateway supports TLS/TCP proxy monitoring. With layer 4 proxy feature now available with Application Gateway, there are some Common metrics that apply to both layer 7 and layer 4. There are some layer 4 specific metrics. The following list summarizes the metrics are the applicable for layer 4 usage.
115113

116114
- Current Connections
117115
- New Connections per second
@@ -122,70 +120,19 @@ With layer 4 proxy feature now available with Application Gateway, there are som
122120
- Backend Connect Time
123121
- Backend First Byte Response Time. `BackendHttpSetting` dimension includes both layer 7 and layer 4 backend settings.
124122

125-
See [metrics table](#supported-metrics-for-microsoftnetworkapplicationgateways) for details.
123+
For more information, see previous descriptions and the [metrics table](#supported-metrics-for-microsoftnetworkapplicationgateways).
126124

127125
These metrics apply to layer 4 only.
128126

129127
- **Backend Session Duration**. The total time of a backend connection. The average time duration from the start of a new connection to its termination. `BackendHttpSetting` dimension includes both layer 7 and layer 4 backend settings.
130128
- **Connection Lifetime**. The total time of a client connection to application gateway. The average time duration from the start of a new connection to its termination in milliseconds.
131129

132-
#### TLS/TCP proxy logs
133-
134-
Application Gateway’s Layer 4 proxy provides log data through access logs. These logs are only generated and published if they are configured in the diagnostic settings of your gateway. Also see: [Supported categories for Azure Monitor resource logs](/azure/azure-monitor/essentials/resource-logs-categories#microsoftnetworkapplicationgateways).
135-
136-
> [!NOTE]
137-
> The columns with Mutual Authentication details for a TLS listener are currently available only through the [AzureDiagnostics table](/azure/azure-monitor/reference/tables/azurediagnostics).
138-
139-
| Category | Resource log category |
140-
|:--------------|:----------------------------------------------------------------------|
141-
| ResourceGroup | The resource group to which the application gateway resource belongs. |
142-
| SubscriptionId |The subscription ID of the application gateway resource. |
143-
| ResourceProvider |This value is MICROSOFT.NETWORK for application gateway. |
144-
| Resource |The name of the application gateway resource. |
145-
| ResourceType |This value is APPLICATIONGATEWAYS. |
146-
| ruleName |The name of the routing rule that served the connection request. |
147-
| instanceId |Application Gateway instance that served the request. |
148-
| clientIP |Originating IP for the request. |
149-
| receivedBytes |Data received from client to gateway, in bytes. |
150-
| sentBytes |Data sent from gateway to client, in bytes. |
151-
| listenerName |The name of the listener that established the frontend connection with client. |
152-
| backendSettingName |The name of the backend setting used for the backend connection. |
153-
| backendPoolName |The name of the backend pool from which a target server was selected to establish the backend connection. |
154-
| protocol |TCP (Irrespective of it being TCP or TLS, the protocol value is always TCP). |
155-
| sessionTime |session duration, in seconds (this value is for the client->appgw session) |
156-
| upstreamSentBytes |Data sent to backend server, in bytes. |
157-
| upstreamReceivedBytes |Data received from backend server, in bytes. |
158-
| upstreamSessionTime |session duration, in seconds (this value is for the appgw->backend session) |
159-
| sslCipher |Cipher suite being used for TLS communication (for TLS protocol listeners). |
160-
| sslProtocol |SSL/TLS protocol being used (for TLS protocol listeners). |
161-
| serverRouted |The backend server IP and port number to which the traffic was routed. |
162-
| serverStatus |200 - session completed successfully. 400 - client data couldn't be parsed. 500 - internal server error. 502 - bad gateway. For example, when an upstream server couldn't be reached. 503 - service unavailable. For example, if access is limited by the number of connections. |
163-
| ResourceId |Application Gateway resource URI |
164-
165130
### TLS/TCP proxy backend health
166131

167132
Application Gateway's layer 4 proxy provides the capability to monitor the health of individual members of the backend pools through the portal and REST API.
168133

169134
:::image type="content" source="./media/monitor-application-gateway-reference/backend-health.png" alt-text="Screenshot shows health for individual members of backend pools.":::
170135

171-
### Application Gateway v1 metrics
172-
173-
The following descriptions apply to metrics collected when you are running an Application Gateway v1 instance.
174-
175-
| Metric | Unit | Description|
176-
|:-------|:-----|:------------|
177-
|**CPU Utilization**|Percent|Displays the CPU usage allocated to the Application Gateway. Under normal conditions, CPU usage shouldn't regularly exceed 90%, because this situation might cause latency in the websites hosted behind the Application Gateway and disrupt the client experience. You can indirectly control or improve CPU usage by modifying the configuration of the Application Gateway by increasing the instance count or by moving to a larger SKU size, or doing both.|
178-
|**Current connections**|Count|Count of current connections established with Application Gateway.|
179-
|**Failed Requests**|Count|Number of requests that failed because of connection issues. This count includes requests that failed due to exceeding the *Request time-out* HTTP setting and requests that failed due to connection issues between Application Gateway and the backend. This count doesn't include failures due to no healthy backend being available. 4xx and 5xx responses from the backend are also not considered as part of this metric.|
180-
|**Response Status**|Status code|HTTP response status returned by Application Gateway. The response status code distribution can be further categorized to show responses in 2xx, 3xx, 4xx, and 5xx categories.|
181-
|**Throughput**|Bytes/sec|Number of bytes per second the Application Gateway served.|
182-
|**Total Requests**|Count|Count of successful requests that Application Gateway served. The request count can be further filtered to show count per each/specific backend pool-http setting combination.|
183-
|**Web Application Firewall Blocked Requests Count**|Count|Number of requests blocked by WAF.|
184-
|**Web Application Firewall Blocked Requests Distribution**|Count|Number of requests blocked by WAF filtered to show count per each/specific WAF rule group or WAF rule ID combination.|
185-
|**Web Application Firewall Total Rule Distribution**|Count|Number of requests received per each specific WAF rule group or WAF rule ID combination.|
186-
187-
For more information, see a list of [all platform metrics supported in Azure Monitor](../azure-monitor/essentials/metrics-supported.md).
188-
189136
[!INCLUDE [horz-monitor-ref-metrics-dimensions-intro](~/reusable-content/ce-skilling/azure/includes/azure-monitor/horizontals/horz-monitor-ref-metrics-dimensions-intro.md)]
190137

191138
[!INCLUDE [horz-monitor-ref-metrics-dimensions](~/reusable-content/ce-skilling/azure/includes/azure-monitor/horizontals/horz-monitor-ref-metrics-dimensions.md)]
@@ -508,6 +455,40 @@ Azure Application Gateway uses the [Azure Diagnostics](/azure/azure-monitor/refe
508455
- [AGWFirewallLogs](/azure/azure-monitor/reference/tables/agwfirewalllogs#columns)
509456
- [AzureDiagnostics](/azure/azure-monitor/reference/tables/azurediagnostics#columns)
510457

458+
### TLS/TCP proxy logs
459+
460+
Application Gateway's Layer 4 proxy provides log data through access logs. These logs are only generated and published if they are configured in the diagnostic settings of your gateway. Also see: [Supported categories for Azure Monitor resource logs](/azure/azure-monitor/essentials/resource-logs-categories#microsoftnetworkapplicationgateways).
461+
462+
> [!NOTE]
463+
> The columns with Mutual Authentication details for a TLS listener are currently available only through the [AzureDiagnostics table](/azure/azure-monitor/reference/tables/azurediagnostics).
464+
465+
| Category | Resource log category |
466+
|:--------------|:----------------------------------------------------------------------|
467+
| ResourceGroup | The resource group to which the application gateway resource belongs. |
468+
| SubscriptionId |The subscription ID of the application gateway resource. |
469+
| ResourceProvider |This value is MICROSOFT.NETWORK for application gateway. |
470+
| Resource |The name of the application gateway resource. |
471+
| ResourceType |This value is APPLICATIONGATEWAYS. |
472+
| ruleName |The name of the routing rule that served the connection request. |
473+
| instanceId |Application Gateway instance that served the request. |
474+
| clientIP |Originating IP for the request. |
475+
| receivedBytes |Data received from client to gateway, in bytes. |
476+
| sentBytes |Data sent from gateway to client, in bytes. |
477+
| listenerName |The name of the listener that established the frontend connection with client. |
478+
| backendSettingName |The name of the backend setting used for the backend connection. |
479+
| backendPoolName |The name of the backend pool from which a target server was selected to establish the backend connection. |
480+
| protocol |TCP (Irrespective of it being TCP or TLS, the protocol value is always TCP). |
481+
| sessionTime |session duration, in seconds (this value is for the client->appgw session) |
482+
| upstreamSentBytes |Data sent to backend server, in bytes. |
483+
| upstreamReceivedBytes |Data received from backend server, in bytes. |
484+
| upstreamSessionTime |session duration, in seconds (this value is for the appgw->backend session) |
485+
| sslCipher |Cipher suite being used for TLS communication (for TLS protocol listeners). |
486+
| sslProtocol |SSL/TLS protocol being used (for TLS protocol listeners). |
487+
| serverRouted |The backend server IP and port number to which the traffic was routed. |
488+
| serverStatus |200 - session completed successfully. 400 - client data couldn't be parsed. 500 - internal server error. 502 - bad gateway. For example, when an upstream server couldn't be reached. 503 - service unavailable. For example, if access is limited by the number of connections. |
489+
| ResourceId |Application Gateway resource URI |
490+
491+
511492
[!INCLUDE [horz-monitor-ref-activity-log](~/reusable-content/ce-skilling/azure/includes/azure-monitor/horizontals/horz-monitor-ref-activity-log.md)]
512493

513494
- [applicationGateways resource provider operations](/azure/role-based-access-control/resource-provider-operations#networking)

‎articles/application-gateway/monitor-application-gateway.md

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -55,6 +55,8 @@ The **Overview** page in the Azure portal for each Application Gateway includes
5555

5656
For a list of available metrics for Azure Application Gateway, see [Application Gateway monitoring data reference](monitor-application-gateway-reference.md#metrics).
5757

58+
For available Web Application Firewall (WAF) metrics, see [Application Gateway WAF v2 metrics](../web-application-firewall/ag/application-gateway-waf-metrics.md#application-gateway-waf-v2-metrics) and [Application Gateway WAF v1 metrics](../web-application-firewall/ag/application-gateway-waf-metrics.md#application-gateway-waf-v1-metrics).
59+
5860
[!INCLUDE [horz-monitor-resource-logs](~/reusable-content/ce-skilling/azure/includes/azure-monitor/horizontals/horz-monitor-resource-logs.md)]
5961

6062
Data in Azure Monitor Logs is stored in tables where each table has its own set of unique properties.

‎articles/application-gateway/mutual-authentication-overview.md

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -114,7 +114,7 @@ Azure portal support is currently not available.
114114

115115
---
116116

117-
To verify OCSP revocation status has been evaluated for the client request, [access logs](monitor-application-gateway-reference.md#access-log) will contain a property called "sslClientVerify", with the status of the OCSP response.
117+
To verify OCSP revocation status has been evaluated for the client request, [access logs](monitor-application-gateway-reference.md#access-log-category) will contain a property called "sslClientVerify", with the status of the OCSP response.
118118

119119
It is critical that the OCSP responder is highly available and network connectivity between Application Gateway and the responder is possible. In the event Application Gateway is unable to resolve the fully qualified domain name (FQDN) of the defined responder or network connectivity is blocked to/from the responder, certificate revocation status will fail and Application Gateway will return a 400 HTTP response to the requesting client.
120120

0 commit comments

Comments
 (0)