What you need to know
Confirm that the gateway produces the records an alert expects to query.
Potentially affected
Review each gateway named by a planned alert, including the actual diagnostic destination and query scope. Keep a visible metric chart separate from evidence that the selected log category is arriving where the alert reads it.
DSE recommendation
DSE recommends making a sample record a prerequisite for alert acceptance.
Source facts
Microsoft distinguishes Virtual WAN gateway metrics from gateway logs. Its site-to-site and point-to-site monitoring guidance says logs require a diagnostic setting; metrics do not establish that such logging exists. A diagnostic setting selects the collected information and its destination. Microsoft therefore places diagnostic configuration before creation of a log-based gateway alert. Microsoft Learn.
Applicability
Review each gateway named by a planned alert, including the actual diagnostic destination and query scope. Keep a visible metric chart separate from evidence that the selected log category is arriving where the alert reads it.
DSE recommendation
DSE recommends making a sample record a prerequisite for alert acceptance. Document the gateway identity, selected category, destination, query and notification owner together. Agree on a harmless event or observation that will exercise the intended condition. Review destination access and retention with the responsible team before collecting operational data.
Verification
Inspect the deployed diagnostic setting, then query a recent interval and confirm the expected resource identifier appears. Exercise the approved alert test and trace it through query evaluation to notification delivery. If no record arrives, investigate collection first. Retain separate evidence for data arrival and for the alert action.
Official references
Review the official source
Monitor Azure Virtual WAN | Microsoft Learn · Verified September 17, 2026
Need help applying this guidance safely?
DSE can help confirm applicability, protect service continuity, and validate the result across physical security and IT systems.
Talk with DSE