| title | Monitoring data reference for Azure ExpressRoute |
|---|---|
| description | This article contains important reference material you need when you monitor Azure ExpressRoute by using Azure Monitor. |
| ms.date | 03/12/2026 |
| ms.custom | horz-monitor, subject-monitoring |
| ms.topic | reference |
| author | duongau |
| ms.author | duau |
| ms.service | azure-expressroute |
[!INCLUDE horz-monitor-ref-intro]
For details about the data you can collect for ExpressRoute and how to use it, see Monitor Azure ExpressRoute.
[!INCLUDE horz-monitor-ref-metrics-intro]
Note
You can see the GlobalGlobalReachBitsInPerSecond and GlobalGlobalReachBitsOutPerSecond metrics only if at least one Global Reach connection is established.
The following table lists the metrics available for the Microsoft.Network/expressRouteCircuits resource type.
[!INCLUDE horz-monitor-ref-metrics-tableheader] [!INCLUDE Microsoft.Network/expressRouteCircuits]
The following table lists the metrics available for the Microsoft.Network/expressRouteCircuits/peerings resource type.
[!INCLUDE horz-monitor-ref-metrics-tableheader] [!INCLUDE Microsoft.Network/expressRouteCircuits/peerings]
The following table lists the metrics available for the microsoft.network/expressroutegateways resource type.
[!INCLUDE horz-monitor-ref-metrics-tableheader] [!INCLUDE <ResourceType/namespace>]
The following table lists the metrics available for the Microsoft.Network/expressRoutePorts resource type.
[!INCLUDE horz-monitor-ref-metrics-tableheader] [!INCLUDE <ResourceType/namespace>]
For more information about metrics from the preceding tables, see the following links.
ExpressRoute circuits metrics:
- ARP Availability
- BGP Availability
- BitsInPerSecond
- BitsOutPerSecond
- DroppedInBitsPerSecond
- DroppedOutBitsPerSecond
- GlobalReachBitsInPerSecond
- GlobalReachBitsOutPerSecond
- FastPathRoutesCount
Note
You can see GlobalReachBitsInPerSecond and GlobalReachBitsOutPerSecond only if at least one Global Reach connection is established.
ExpressRoute gateways metrics:
- Bits received per second
- CPU utilization
- Packets per second
- Count of routes advertised to peer
- Count of routes learned from peer
- Frequency of routes changed
- Number of VMs in virtual network
- Active flows
- Max flows created per second
ExpressRoute gateway connections metrics:
ExpressRoute Direct metrics:
- BitsInPerSecond
- BitsOutPerSecond
- DroppedInBitsPerSecond
- DroppedOutBitsPerSecond
- AdminState
- LineProtocol
- RxLightLevel
- TxLightLevel
- FastPathRoutesCount
ExpressRoute Traffic Collector metrics:
Aggregation type: Avg
You can view near real-time availability of ARP (Layer-2 connectivity) across peerings and peers (Primary and Secondary ExpressRoute routers). This dashboard shows the Private Peering ARP session status is up across both peers, but down for Microsoft peering for both peers. The dashboard uses the default aggregation (Average) across both peers.
:::image type="content" source="./media/expressroute-monitoring-metrics-alerts/erArpAvailabilityMetrics.jpg" alt-text="Screenshot shows ARP availability per peer.":::
Aggregation type: Avg
You can view near real-time availability of BGP (Layer-3 connectivity) across peerings and peers (Primary and Secondary ExpressRoute routers). This dashboard shows the Primary BGP session status is up for private peering and the Second BGP session status is down for private peering.
:::image type="content" source="./media/expressroute-monitoring-metrics-alerts/erBgpAvailabilityMetrics.jpg" alt-text="Screenshot shows BGP availability per peer.":::
Note
During maintenance between the Microsoft Edge and core network, BGP availability appears down even if the BGP session between the customer edge and Microsoft Edge remains up. For information about maintenance between the Microsoft Edge and core network, see turn on and configure maintenance alerts.
Aggregation type: Avg
You can view metrics across all peerings on a given ExpressRoute circuit.
:::image type="content" source="./media/expressroute-monitoring-metrics-alerts/ermetricspeering.jpg" alt-text="Screenshot shows circuit metrics in the Azure portal.":::
Aggregation type: Avg
You can view metrics for private, public, and Microsoft peering in bits per second.
:::image type="content" source="./media/expressroute-monitoring-metrics-alerts/erpeeringmetrics.jpg" alt-text="Screenshot shows metrics per peering in the Azure portal.":::
Aggregation type: Max
This metric shows the number of FastPath routes configured on a circuit. Set an alert for when the number of FastPath routes on a circuit goes beyond the threshold limit. For more information, see ExpressRoute FastPath limits.
:::image type="content" source="./media/expressroute-monitoring-metrics-alerts/fastpath-routes-count-circuit.png" alt-text="Screenshot of FastPath routes count at circuit level metric.":::
Aggregation type: Avg
When you deploy an ExpressRoute gateway, Azure manages the compute and functions of your gateway. To better understand the performance of your gateway, use these metrics:
- Bits received per second
- CPU utilization
- Packets per second
- Count of routes advertised to peers
- Count of routes learned from peers
- Frequency of routes changed
- Number of VMs in the virtual network
- Active flows
- Max flows created per second
Set alerts for each of these metrics so that you're aware of when your gateway might be experiencing performance problems.
Aggregation type: Avg
This metric captures inbound bandwidth utilization on the ExpressRoute virtual network gateway instances. Set an alert for how often the bandwidth utilization exceeds a certain threshold. If you need more bandwidth, increase the size of the ExpressRoute virtual network gateway.
:::image type="content" source="./media/expressroute-monitoring-metrics-alerts/inbound-gateway.png" alt-text="Screenshot of inbound bit per second - split metrics.":::
Aggregation type: Avg
You can view the CPU utilization of each gateway instance. The CPU utilization might spike briefly during routine host maintenance but prolonged high CPU utilization could indicate your gateway is reaching a performance bottleneck. Increasing the size of the ExpressRoute gateway might resolve this issue. Set an alert for how often the CPU utilization exceeds a certain threshold.
:::image type="content" source="./media/expressroute-monitoring-metrics-alerts/cpu-split.jpg" alt-text="Screenshot of CPU utilization - split metrics.":::
Aggregation type: Avg
This metric captures the number of inbound packets traversing the ExpressRoute gateway. You should expect to see a consistent stream of data here if your gateway is receiving traffic from your on-premises network. Set an alert for when the number of packets per second drops below a threshold indicating that your gateway is no longer receiving traffic.
:::image type="content" source="./media/expressroute-monitoring-metrics-alerts/pps-split.jpg" alt-text="Screenshot of packets per second - split metrics.":::
Aggregation type: Max
This metric shows the number of routes the ExpressRoute gateway is advertising to the circuit. The address spaces might include virtual networks that are connected using virtual network peering and uses remote ExpressRoute gateway. You should expect the number of routes to remain consistent unless there are frequent changes to the virtual network address spaces. Set an alert for when the number of advertised routes drops below the threshold for the number of virtual network address spaces you expect.
:::image type="content" source="./media/expressroute-monitoring-metrics-alerts/count-of-routes-advertised-to-peer.png" alt-text="Screenshot of count of routes advertised to peer.":::
Aggregation type: Max
This metric shows the number of routes the ExpressRoute gateway is learning from peers connected to the ExpressRoute circuit. These routes can be either from another virtual network connected to the same circuit or learned from on-premises. Set an alert for when the number of learned routes drops below a certain threshold. This metric can indicate either the gateway is seeing a performance problem or remote peers are no longer advertising routes to the ExpressRoute circuit.
:::image type="content" source="./media/expressroute-monitoring-metrics-alerts/count-of-routes-learned-from-peer.png" alt-text="Screenshot of count of routes learned from peer.":::
Aggregation type: Sum
This metric shows how often routes come from or go to remote peers. First, check your on-premises devices to see why the network changes so often. If routes change frequently, it might mean there's a performance problem with the ExpressRoute gateway. You can fix this problem by scaling up the gateway SKU. Set an alert for a frequency threshold so you know when your ExpressRoute gateway has unusual route changes.
:::image type="content" source="./media/expressroute-monitoring-metrics-alerts/frequency-of-routes-changed.png" alt-text="Screenshot of frequency of routes changed metric.":::
Aggregation type: Max
This metric shows the number of virtual machines that use the ExpressRoute gateway. The number of virtual machines might include VMs from peered virtual networks that use the same ExpressRoute gateway. Set an alert for this metric if the number of VMs goes above a certain threshold that could affect the gateway performance.
:::image type="content" source="./media/expressroute-monitoring-metrics-alerts/number-of-virtual-machines-virtual-network.png" alt-text="Screenshot of number of virtual machines in the virtual network metric.":::
Note
To maintain reliability of the service, Microsoft often performs platform or OS maintenance on the gateway service. During this time, this metric might fluctuate and report inaccurately.
Aggregation type: Avg
Split by: Gateway Instance
This metric shows the total number of active flows on the ExpressRoute Gateway. It only includes inbound traffic from on-premises for active flows. By using split at instance level, you can see active flow count for each gateway instance. For more information, see understand network flow limits.
:::image type="content" source="./media/expressroute-monitoring-metrics-alerts/active-flows.png" alt-text="Screenshot of number of active flows per second metrics dashboard.":::
Aggregation type: Max
Split by: Gateway Instance and Direction (Inbound/Outbound)
This metric shows the highest number of flows created per second on the ExpressRoute Gateway. By using split at instance level and direction, you can see max flow creation rate for each gateway instance and inbound or outbound direction. For more information, see understand network flow limits.
:::image type="content" source="./media/expressroute-monitoring-metrics-alerts/max-flows-per-second.png" alt-text="Screenshot of the maximum number of flows created per second metrics dashboard.":::
Aggregation type: Avg
This metric shows the bits per second for ingress and egress to Azure through the ExpressRoute gateway. You can split this metric further to see specific connections to the ExpressRoute circuit.
:::image type="content" source="./media/expressroute-monitoring-metrics-alerts/erconnections.jpg" alt-text="Screenshot of gateway connection bandwidth usage metric.":::
Aggregation type: Avg
You can view the bits in per second across both links of the ExpressRoute Direct port pair. Monitor this dashboard to compare inbound bandwidth for both links.
:::image type="content" source="./media/expressroute-monitoring-metrics-alerts/bits-in-per-second-per-link.jpg" alt-text="Screenshot shows ER Direct bits in per second in the Azure portal.":::
Aggregation type: Avg
You can also view the bits out per second across both links of the ExpressRoute Direct port pair. Monitor this dashboard to compare outbound bandwidth for both links.
:::image type="content" source="./media/expressroute-monitoring-metrics-alerts/bits-out-per-second-per-link.jpg" alt-text="Screenshot shows the ER Direct bits out per second in the Azure portal.":::
Aggregation type: Avg
You can view the Admin state for each link of the ExpressRoute Direct port pair. The Admin state represents if the physical port is on or off. This state is required to pass traffic across the ExpressRoute Direct connection.
:::image type="content" source="./media/expressroute-monitoring-metrics-alerts/adminstate-per-link.jpg" alt-text="Screenshot shows the ER Direct admin state in the Azure portal.":::
Aggregation type: Avg
You can view the line protocol across each link of the ExpressRoute Direct port pair. The Line Protocol indicates if the physical link is up and running over ExpressRoute Direct. Monitor this dashboard and set alerts to know when the physical connection goes down.
:::image type="content" source="./media/expressroute-monitoring-metrics-alerts/line-protocol-per-link.jpg" alt-text="Screenshot shows the ER Direct line protocol in the Azure portal.":::
Aggregation type: Avg
You can view the Rx light level (the light level that the ExpressRoute Direct port is receiving) for each port. Healthy Rx light levels generally fall within a range of -10 dBm to 0 dBm. Set alerts to be notified if the Rx light level falls outside of the healthy range.
:::image type="content" source="./media/expressroute-monitoring-metrics-alerts/rxlight-level-per-link.jpg" alt-text="Screenshot shows the ER Direct line Rx Light Level in the Azure portal.":::
Note
ExpressRoute Direct connectivity is hosted across different device platforms. Some ExpressRoute Direct connections support a split view for Rx light levels by lane. However, this view isn't supported on all deployments.
Aggregation type: Avg
You can view the Tx light level (the light level that the ExpressRoute Direct port is transmitting) for each port. Healthy Tx light levels generally fall within a range of -10 dBm to 0 dBm. Set alerts to be notified if the Tx light level falls outside of the healthy range.
:::image type="content" source="./media/expressroute-monitoring-metrics-alerts/txlight-level-per-link.jpg" alt-text="Screenshot shows the ER Direct line Tx Light Level in the Azure portal.":::
Note
ExpressRoute Direct connectivity is hosted across different device platforms. Some ExpressRoute Direct connections support a split view for Tx light levels by lane. However, this view isn't supported on all deployments.
Aggregation type: Max
This metric shows the number of FastPath routes configured on an ExpressRoute Direct port.
Guidance: Set an alert for when the number of FastPath routes on the port goes beyond the threshold limit. For more information, see ExpressRoute FastPath limits.
:::image type="content" source="./media/expressroute-monitoring-metrics-alerts/fastpath-routes-count-port.png" alt-text="Screenshot of FastPath routes count at port level metric.":::
Aggregation type: Avg (of percentage of total utilized CPU)
Granularity: 5 min
You can view the CPU utilization of each ExpressRoute Traffic Collector instance. The CPU utilization might spike briefly during routine host maintenance, but prolonged high CPU utilization could indicate your ExpressRoute Traffic Collector is reaching a performance bottleneck.
Guidance: Set an alert for when average CPU utilization exceeds a certain threshold.
:::image type="content" source="./media/expressroute-monitoring-metrics-alerts/cpu-usage.png" alt-text="Screenshot of CPU usage for ExpressRoute Traffic Collector." lightbox="./media/expressroute-monitoring-metrics-alerts/cpu-usage.png":::
Aggregation type: Avg (of percentage of total utilized Memory)
Granularity: 5 min
You can view the memory utilization of each ExpressRoute Traffic Collector instance. Memory utilization might spike briefly during routine host maintenance, but prolonged high memory utilization could indicate your Azure Traffic Collector is reaching a performance bottleneck.
Guidance: Set an alert for when average memory utilization exceeds a certain threshold.
:::image type="content" source="./media/expressroute-monitoring-metrics-alerts/memory-usage.png" alt-text="Screenshot of memory usage for ExpressRoute Traffic Collector." lightbox="./media/expressroute-monitoring-metrics-alerts/memory-usage.png":::
Aggregation type: Count
Granularity: 5 min
You can view the count of number of flow records processed by ExpressRoute Traffic Collector, aggregated across ExpressRoute Circuits. You can split the metrics across each ExpressRoute Traffic Collector instance or ExpressRoute circuit when multiple circuits are associated to the ExpressRoute Traffic Collector. Monitoring this metric helps you understand if you need to deploy more ExpressRoute Traffic Collector instances or migrate ExpressRoute circuit association from one ExpressRoute Traffic Collector deployment to another.
Guidance: Splitting by circuits is recommended when multiple ExpressRoute circuits are associated with an ExpressRoute Traffic Collector deployment. This metric helps determine the flow count of each ExpressRoute circuit and ExpressRoute Traffic Collector utilization by each ExpressRoute circuit.
:::image type="content" source="./media/expressroute-monitoring-metrics-alerts/flow-records.png" alt-text="Screenshot of average flow records for an ExpressRoute circuit." lightbox="./media/expressroute-monitoring-metrics-alerts/flow-records.png":::
[!INCLUDE horz-monitor-ref-metrics-dimensions-intro]
[!INCLUDE horz-monitor-ref-metrics-dimensions]
Dimension for ExpressRoute circuit:
| Dimension Name | Description |
|---|---|
| PeeringType | The type of peering configured. The supported values are Microsoft and Private peering. |
| Peering | The supported values are Primary and Secondary. |
| DeviceRole | |
| PeeredCircuitSkey | The remote ExpressRoute circuit service key connected using Global Reach. |
Dimension for ExpressRoute gateway:
| Dimension Name | Description |
|---|---|
| BgpPeerAddress | |
| ConnectionName | |
| direction | |
| roleInstance | The gateway instance. Each ExpressRoute gateway is composed of multiple instances. The supported values are GatewayTenantWork_IN_X, where X is a minimum of 0 and a maximum of the number of gateway instances -1. |
Dimension for Express Direct:
| Dimension Name | Description |
|---|---|
| Lane | |
| Link | The physical link. Each ExpressRoute Direct port pair is composed of two physical links for redundancy. Supported values are link1 and link2. |
[!INCLUDE horz-monitor-ref-resource-logs]
[!INCLUDE <ResourceType/namespace>]
[!INCLUDE horz-monitor-ref-logs-tables]
Note
Logs in Azure Log Analytics can take up to 24 hours to appear.
[!INCLUDE horz-monitor-ref-activity-log]
The following table lists the operations related to ExpressRoute that the Activity Log might record.
| Operation | Description |
|---|---|
| All administrative operations | All administrative operations, including creating, updating, and deleting an ExpressRoute circuit. |
| Create or update ExpressRoute circuit | You created or updated an ExpressRoute circuit. |
| Delete ExpressRoute circuit | You deleted an ExpressRoute circuit. |
For more information about the schema of Activity Log entries, see Activity Log schema.
For a detailed description of the top-level diagnostic logs schema, see Supported services, schemas, and categories for Azure Diagnostic Logs.
When you review any metrics through Log Analytics, the output contains the following columns:
| Column | Type | Description |
|---|---|---|
| TimeGrain | string | PT1M (metric values are pushed every minute) |
| Count | real | Usually equal to 2 (each MSEE pushes a single metric value every minute) |
| Minimum | real | The minimum of the two metric values pushed by the two MSEEs |
| Maximum | real | The maximum of the two metric values pushed by the two MSEEs |
| Average | real | Equal to (Minimum + Maximum)/2 |
| Total | real | Sum of the two metric values from both MSEEs (the main value to focus on for the metric queried) |
- For a description of monitoring ExpressRoute, see Monitor Azure ExpressRoute.
- For details on monitoring Azure resources, see Monitor Azure resources with Azure Monitor.