Microsoft discourages Count aggregation for NAT Gateway metrics because it counts reported metric values instead of adding their contents. Its guidance uses Sum for connection, byte and packet counts, and Average for datapath availability. The documentation also notes that platform health-check connections can appear in the SNAT connection metric. Microsoft Learn.
\nReview saved charts, alert definitions and exported evidence that use NAT Gateway metrics. Identify the exact metric, selected dimensions, aggregation and time interval before comparing totals or interpreting a small amount of unexplained traffic.
\nDSE recommends including chart configuration alongside any reported measurement. Have the monitoring owner check whether the chosen aggregation answers the operational question. Correct misleading saved views and revisit conclusions that depended on them. Keep application-generated test traffic distinct from the background observations rather than labeling every connection as a user transaction.
\nFor a fixed observation interval, compare the approved chart with the same metric values using the documented aggregation. Preserve metric name, filters, interval and configuration with the result. Exercise a small authorized traffic test and check that the chart responds as expected. If numbers still disagree, inspect dimension selection before adjusting capacity or security controls.
\n