Azure Virtual Machines monitoring data reference

This article contains all the monitoring reference information for this service.

See Monitor Azure Virtual Machines for details on the data you can collect for Azure Virtual Machines and how to use it.

Metrics

This section lists all the automatically collected platform metrics for this service. These metrics are also part of the global list of all platform metrics supported in Azure Monitor.

For information on metric retention, see Azure Monitor Metrics overview.

Important

Metrics for the guest operating system (guest OS) that runs in a virtual machine (VM) aren't listed here. Guest OS metrics must be collected through one or more agents that run on or as part of the guest operating system. Guest OS metrics include performance counters that track guest CPU percentage or memory usage, both of which are frequently used for autoscaling or alerting.

Host OS metrics are available and listed in the following tables. Host OS metrics relate to the Hyper-V session that's hosting your guest OS session. For more information, see Guest OS and host OS metrics.

Supported metrics for Microsoft.Compute/virtualMachines

The following table lists the metrics available for the Microsoft.Compute/virtualMachines resource type.

  • All columns might not be present in every table.
  • Some columns might be beyond the viewing area of the page. Select Expand table to view all available columns.

Table headings

  • Category - The metrics group or classification.
  • Metric - The metric display name as it appears in the Azure portal.
  • Name in REST API - The metric name as referred to in the REST API.
  • Unit - Unit of measure.
  • Aggregation - The default aggregation type. Valid values: Average (Avg), Minimum (Min), Maximum (Max), Total (Sum), Count.
  • Dimensions - Dimensions available for the metric.
  • Time Grains - Intervals at which the metric is sampled. For example, PT1M indicates that the metric is sampled every minute, PT30M every 30 minutes, PT1H every hour, and so on.
  • DS Export- Whether the metric is exportable to Azure Monitor Logs via diagnostic settings. For information on exporting metrics, see Create diagnostic settings in Azure Monitor.
Metric Name in REST API Unit Aggregation Dimensions Time Grains DS Export
Available Memory Bytes (Preview)

Amount of physical memory, in bytes, immediately available for allocation to a process or for system use in the Virtual Machine
Available Memory Bytes Bytes Average <none> PT1M Yes
CPU Credits Consumed

Total number of credits consumed by the Virtual Machine. Only available on B-series burstable VMs
CPU Credits Consumed Count Average <none> PT1M Yes
CPU Credits Remaining

Total number of credits available to burst. Only available on B-series burstable VMs
CPU Credits Remaining Count Average <none> PT1M Yes
Data Disk Bandwidth Consumed Percentage

Percentage of data disk bandwidth consumed per minute. Only available on VM series that support premium storage.
Data Disk Bandwidth Consumed Percentage Percent Average LUN PT1M Yes
Data Disk IOPS Consumed Percentage

Percentage of data disk I/Os consumed per minute. Only available on VM series that support premium storage.
Data Disk IOPS Consumed Percentage Percent Average LUN PT1M Yes
Data Disk Latency (Preview)

Average time to complete each IO during monitoring period for Data Disk. Values are in milliseconds.
Data Disk Latency Milliseconds Average LUN PT1M Yes
Data Disk Max Burst Bandwidth

Maximum bytes per second throughput Data Disk can achieve with bursting
Data Disk Max Burst Bandwidth Count Average LUN PT1M Yes
Data Disk Max Burst IOPS

Maximum IOPS Data Disk can achieve with bursting
Data Disk Max Burst IOPS Count Average LUN PT1M Yes
Data Disk Queue Depth

Data Disk Queue Depth(or Queue Length)
Data Disk Queue Depth Count Average LUN PT1M Yes
Data Disk Read Bytes/Sec

Bytes/Sec read from a single disk during monitoring period
Data Disk Read Bytes/sec BytesPerSecond Average LUN PT1M Yes
Data Disk Read Operations/Sec

Read IOPS from a single disk during monitoring period
Data Disk Read Operations/Sec CountPerSecond Average LUN PT1M Yes
Data Disk Target Bandwidth

Baseline bytes per second throughput Data Disk can achieve without bursting
Data Disk Target Bandwidth Count Average LUN PT1M Yes
Data Disk Target IOPS

Baseline IOPS Data Disk can achieve without bursting
Data Disk Target IOPS Count Average LUN PT1M Yes
Data Disk Used Burst BPS Credits Percentage

Percentage of Data Disk burst bandwidth credits used so far
Data Disk Used Burst BPS Credits Percentage Percent Average LUN PT1M Yes
Data Disk Used Burst IO Credits Percentage

Percentage of Data Disk burst I/O credits used so far
Data Disk Used Burst IO Credits Percentage Percent Average LUN PT1M Yes
Data Disk Write Bytes/Sec

Bytes/Sec written to a single disk during monitoring period
Data Disk Write Bytes/sec BytesPerSecond Average LUN PT1M Yes
Data Disk Write Operations/Sec

Write IOPS from a single disk during monitoring period
Data Disk Write Operations/Sec CountPerSecond Average LUN PT1M Yes
Disk Read Bytes

Bytes read from disk during monitoring period
Disk Read Bytes Bytes Total (Sum) <none> PT1M Yes
Disk Read Operations/Sec

Disk Read IOPS
Disk Read Operations/Sec CountPerSecond Average <none> PT1M Yes
Disk Write Bytes

Bytes written to disk during monitoring period
Disk Write Bytes Bytes Total (Sum) <none> PT1M Yes
Disk Write Operations/Sec

Disk Write IOPS
Disk Write Operations/Sec CountPerSecond Average <none> PT1M Yes
Inbound Flows

Inbound Flows are number of current flows in the inbound direction (traffic going into the VM)
Inbound Flows Count Average <none> PT1M Yes
Inbound Flows Maximum Creation Rate

The maximum creation rate of inbound flows (traffic going into the VM)
Inbound Flows Maximum Creation Rate CountPerSecond Average <none> PT1M Yes
Network In Billable (Deprecated)

The number of billable bytes received on all network interfaces by the Virtual Machine(s) (Incoming Traffic) (Deprecated)
Network In Bytes Total (Sum) <none> PT1M Yes
Network In Total

The number of bytes received on all network interfaces by the Virtual Machine(s) (Incoming Traffic)
Network In Total Bytes Total (Sum) <none> PT1M Yes
Network Out Billable (Deprecated)

The number of billable bytes out on all network interfaces by the Virtual Machine(s) (Outgoing Traffic) (Deprecated)
Network Out Bytes Total (Sum) <none> PT1M Yes
Network Out Total

The number of bytes out on all network interfaces by the Virtual Machine(s) (Outgoing Traffic)
Network Out Total Bytes Total (Sum) <none> PT1M Yes
OS Disk Bandwidth Consumed Percentage

Percentage of operating system disk bandwidth consumed per minute. Only available on VM series that support premium storage.
OS Disk Bandwidth Consumed Percentage Percent Average LUN PT1M Yes
OS Disk IOPS Consumed Percentage

Percentage of operating system disk I/Os consumed per minute. Only available on VM series that support premium storage.
OS Disk IOPS Consumed Percentage Percent Average LUN PT1M Yes
OS Disk Latency (Preview)

Average time to complete each IO during monitoring period for OS Disk. Values are in milliseconds.
OS Disk Latency Milliseconds Average <none> PT1M Yes
OS Disk Max Burst Bandwidth

Maximum bytes per second throughput OS Disk can achieve with bursting
OS Disk Max Burst Bandwidth Count Average LUN PT1M Yes
OS Disk Max Burst IOPS

Maximum IOPS OS Disk can achieve with bursting
OS Disk Max Burst IOPS Count Average LUN PT1M Yes
OS Disk Queue Depth

OS Disk Queue Depth(or Queue Length)
OS Disk Queue Depth Count Average <none> PT1M Yes
OS Disk Read Bytes/Sec

Bytes/Sec read from a single disk during monitoring period for OS disk
OS Disk Read Bytes/sec BytesPerSecond Average <none> PT1M Yes
OS Disk Read Operations/Sec

Read IOPS from a single disk during monitoring period for OS disk
OS Disk Read Operations/Sec CountPerSecond Average <none> PT1M Yes
OS Disk Target Bandwidth

Baseline bytes per second throughput OS Disk can achieve without bursting
OS Disk Target Bandwidth Count Average LUN PT1M Yes
OS Disk Target IOPS

Baseline IOPS OS Disk can achieve without bursting
OS Disk Target IOPS Count Average LUN PT1M Yes
OS Disk Used Burst BPS Credits Percentage

Percentage of OS Disk burst bandwidth credits used so far
OS Disk Used Burst BPS Credits Percentage Percent Average LUN PT1M Yes
OS Disk Used Burst IO Credits Percentage

Percentage of OS Disk burst I/O credits used so far
OS Disk Used Burst IO Credits Percentage Percent Average LUN PT1M Yes
OS Disk Write Bytes/Sec

Bytes/Sec written to a single disk during monitoring period for OS disk
OS Disk Write Bytes/sec BytesPerSecond Average <none> PT1M Yes
OS Disk Write Operations/Sec

Write IOPS from a single disk during monitoring period for OS disk
OS Disk Write Operations/Sec CountPerSecond Average <none> PT1M Yes
Outbound Flows

Outbound Flows are number of current flows in the outbound direction (traffic going out of the VM)
Outbound Flows Count Average <none> PT1M Yes
Outbound Flows Maximum Creation Rate

The maximum creation rate of outbound flows (traffic going out of the VM)
Outbound Flows Maximum Creation Rate CountPerSecond Average <none> PT1M Yes
Percentage CPU

The percentage of allocated compute units that are currently in use by the Virtual Machine(s)
Percentage CPU Percent Average <none> PT1M Yes
Premium Data Disk Cache Read Hit

Premium Data Disk Cache Read Hit
Premium Data Disk Cache Read Hit Percent Average LUN PT1M Yes
Premium Data Disk Cache Read Miss

Premium Data Disk Cache Read Miss
Premium Data Disk Cache Read Miss Percent Average LUN PT1M Yes
Premium OS Disk Cache Read Hit

Premium OS Disk Cache Read Hit
Premium OS Disk Cache Read Hit Percent Average <none> PT1M Yes
Premium OS Disk Cache Read Miss

Premium OS Disk Cache Read Miss
Premium OS Disk Cache Read Miss Percent Average <none> PT1M Yes
Temp Disk Latency (Preview)

Average time to complete each IO during monitoring period for Temp Disk. Values are in milliseconds.
Temp Disk Latency Milliseconds Average <none> PT1M Yes
Temp Disk Queue Depth

Temp Disk Queue Depth(or Queue Length).
Temp Disk Queue Depth Count Average <none> PT1M Yes
Temp Disk Read Bytes/Sec

Bytes/Sec read from a single disk during monitoring period for Temp Disk.
Temp Disk Read Bytes/sec BytesPerSecond Average <none> PT1M Yes
Temp Disk Read Operations/Sec

Read IOPS from a single disk during monitoring period for Temp Disk.
Temp Disk Read Operations/Sec CountPerSecond Average <none> PT1M Yes
Temp Disk Write Bytes/Sec

Bytes/Sec written to a single disk during monitoring period for Temp Disk.
Temp Disk Write Bytes/sec BytesPerSecond Average <none> PT1M Yes
Temp Disk Write Operations/Sec

Write IOPS from a single disk during monitoring period for Temp Disk.
Temp Disk Write Operations/Sec CountPerSecond Average <none> PT1M Yes
VM Cached Bandwidth Consumed Percentage

Percentage of cached disk bandwidth consumed by the VM. Only available on VM series that support premium storage.
VM Cached Bandwidth Consumed Percentage Percent Average <none> PT1M Yes
VM Cached IOPS Consumed Percentage

Percentage of cached disk IOPS consumed by the VM. Only available on VM series that support premium storage.
VM Cached IOPS Consumed Percentage Percent Average <none> PT1M Yes
VM Cached Used Burst BPS Credits Percentage

Percentage of Cached Burst BPS Credits used by the VM.
VM Local Used Burst BPS Credits Percentage Percent Average, Minimum, Maximum <none> PT1M Yes
VM Cached Used Burst IO Credits Percentage

Percentage of Cached Burst IO Credits used by the VM.
VM Local Used Burst IO Credits Percentage Percent Average, Minimum, Maximum <none> PT1M Yes
VM Uncached Used Burst BPS Credits Percentage

Percentage of Uncached Burst BPS Credits used by the VM.
VM Remote Used Burst BPS Credits Percentage Percent Average, Minimum, Maximum <none> PT1M Yes
VM Uncached Used Burst IO Credits Percentage

Percentage of Uncached Burst IO Credits used by the VM.
VM Remote Used Burst IO Credits Percentage Percent Average, Minimum, Maximum <none> PT1M Yes
VM Uncached Bandwidth Consumed Percentage

Percentage of uncached disk bandwidth consumed by the VM. Only available on VM series that support premium storage.
VM Uncached Bandwidth Consumed Percentage Percent Average <none> PT1M Yes
VM Uncached IOPS Consumed Percentage

Percentage of uncached disk IOPS consumed by the VM. Only available on VM series that support premium storage.
VM Uncached IOPS Consumed Percentage Percent Average <none> PT1M Yes
VM Availability Metric (Preview)

Measure of Availability of Virtual machines over time.
VmAvailabilityMetric Count Average, Minimum, Maximum Context PT1M Yes

For an example that shows how to collect the Percentage CPU metric from a VM, see Get virtual machine usage metrics using the REST API.

VM availability metric (preview)

The VM availability metric is currently in public preview. This metric value indicates whether a machine is currently running and available. You can use the metric to trend availability over time and to alert if the machine is stopped. VM availability displays the following values.

To learn how to use the VM availability metric to monitor Azure Virtual Machine availability, see Use Azure Monitor to monitor Azure Virtual Machine availability.

Value Description
1 VM is running and available.
0 VM is unavailable. The VM could be stopped or rebooting. If you shut down a VM from within the VM, it emits this value.
Null (dashed line) State of the VM is unknown. If you stop a VM from the Azure portal, CLI, or PowerShell, it immediately stops emitting the availability metric, and you see null values.

Context dimension informs whether VM availability was influenced due to Azure or user orchestrated activity. It can assume values of Platform, Customer, or Unknown.

Display name Description
Aggregation Average (default aggregation): for prioritized investigations based on extent of downtime incurred.

Min: immediately pinpoints all the times where the VM was unavailable.

Max: immediately pinpoints all the instances where the VM was available.

For more information on chart range, granularity, and data aggregation, see Azure Monitor metrics aggregation and display explained.
Data retention Data for the VM availability metric is stored for 93 days to help trend analysis and historical lookback.
Pricing Refer to the Pricing breakdown, specifically in the Metrics and Alert Rules sections.

Metric dimensions

For information about what metric dimensions are, see Multi-dimensional metrics.

The dimension Logical Unit Number (LUN) is associated with some of the preceding metrics.

Azure Monitor Logs tables

This section lists the Azure Monitor Logs tables relevant to this service, which are available for query by Log Analytics using Kusto queries. The tables contain resource log data and possibly more depending on what is collected and routed to them.

Table Categories Data collection method Supports basic log plan Queries
ADAssessmentRecommendation
Recommendations generated by AD assessments that are started through a scheduled task. When you schedule the assessment it runs by default every seven days and uploads the data into Azure Log Analytics.
workloads Active Directory On-Demand Assessment No Yes
AzureActivity
Entries from the Azure Activity log that provides insight into any subscription-level or management group level events that have occurred in Azure.
resources, audit, security Export Activity log No Yes
CommonSecurityLog
This table is for collecting events in the Common Event Format, that are most often sent from different security appliances such as Check Point, Palo Alto and more.
security Common Event Format (CEF) via AMA connector for Microsoft Sentinel No Yes
ConfigurationChange
View changes to in-guest configuration data such as Files Software Registry Keys Windows Services and Linux Daemons
management Enable Change Tracking and Inventory No Yes
ConfigurationData
View the last reported state for in-guest configuration data such as Files Software Registry Keys Windows Services and Linux Daemons
management Enable Change Tracking and Inventory No Yes
ContainerLog
Log lines collected from stdout and stderr streams for containers.
container, applications Container Insights No Yes
DnsEvents network Stream and filter data from Windows DNS servers with Azure Monitor Agent No Yes
DnsInventory network Stream and filter data from Windows DNS servers with Azure Monitor Agent No -
Event
Events from Windows Event Log on Windows computers using Azure Monitor Agent Analytics agent.
virtualmachines Collect events with Azure Monitor Agent No Yes
HealthStateChangeEvent
Workload Monitor Health. This data represents state transitions of a health monitor.
undefined VM Insights No -
Heartbeat
Records logged by Azure Monitor Agent once per minute to report on agent health.
virtualmachines, container, management Azure Monitor Agent No Yes
InsightsMetrics
Table that stores metrics. 'Perf' table also stores many metrics and over time they all will converge to InsightsMetrics.
virtualmachines, container, resources VM Insights, Container Insights No Yes
Perf
Performance counters from Windows and Linux agents that provide insight into the performance of hardware components operating systems and applications.
virtualmachines, container Collect performance counters from VMs with Azure Monitor Agent No Yes
ProtectionStatus
Antimalware installation info and security health status of the machine:
security Enable Azure Monitor Agent in Defender for Cloud No Yes
SQLAssessmentRecommendation
Recommendations generated by SQL assessments that are started through a scheduled task. When you schedule the assessment it runs by default every seven days and uploads the data into Azure Log Analytics.
workloads SQL Server On-Demand Assessment No Yes
SecurityBaseline security Enable Azure Monitor Agent in Defender for Cloud No -
SecurityBaselineSummary security Enable Azure Monitor Agent in Defender for Cloud No -
SecurityEvent
Security events collected from windows machines by Azure Security Center or Azure Sentinel.
security Windows Security Events via AMA connector for Microsoft Sentinel No Yes
Syslog
Syslog events on Linux computers using Azure Monitor Agent.
virtualmachines, security Collect Syslog events with Azure Monitor Agent No Yes
Update
Details for update schedule run. Includes information such as which updates where available and which were installed.
management, security Enable Update Management No Yes
UpdateRunProgress
Breaks down each run of your update schedule by the patches available at the time with details on the installation status of each patch.
management Enable Update Management No Yes
UpdateSummary
Summary for each update schedule run. Includes information such as how many updates weren't installed.
virtualmachines Enable Update Management No Yes
VMBoundPort
Traffic for open server ports on the monitored machine.
virtualmachines VM Insights No -
VMComputer
Inventory data for servers collected by the Service Map and VM insights solutions using the Dependency agent and Azure Monitor Agent.
virtualmachines VM Insights No -
VMConnection
Traffic for inbound and outbound connections to and from monitored computers.
virtualmachines VM Insights No -
VMProcess
Process data for servers collected by the Service Map and VM insights solutions using the Dependency agent and Azure Monitor Agent.
virtualmachines VM Insights No -
W3CIISLog
Internet Information Server (IIS) log on Windows computers using Azure Monitor Agent.
management, virtualmachines Collect IIS logs with Azure Monitor Agent No Yes
WindowsFirewall security Enable Azure Monitor Agent in Defender for Cloud No -

Activity log

The linked table lists the operations that can be recorded in the activity log for this service. These operations are a subset of all the possible resource provider operations in the activity log.

For more information on the schema of activity log entries, see Activity Log schema.

The following table lists a few example operations that relate to creating VMs in the activity log. For a complete list of operations, see Microsoft.Compute resource provider operations.

Operation Description
Microsoft.Compute/virtualMachines/start/action Starts the virtual machine
Microsoft.Compute/virtualMachines/restart/action Deletes a managed cluster
Microsoft.Compute/virtualMachines/write Creates a new virtual machine or updates an existing one
Microsoft.Compute/virtualMachines/deallocate/action Powers off the virtual machine and releases the compute resources
Microsoft.Compute/virtualMachines/extensions/write Creates a new virtual machine extension or updates an existing one
Microsoft.Compute/virtualMachineScaleSets/write Starts the instances of the virtual machine scale set