Share via

Firewall monitoring data not consistent

Michael Oehlert 20 Reputation points
2026-05-22T17:51:19.82+00:00

In Monitoring/Metrics for my Azure firewall I set the chart to look at Latency Probe for the last month [granularity set at 1 minute]. Then I export to Excel. When I did this last month I got a few lines at 108ms or 367ms. So I re-ran the report a few days later and the data was different. The timing on the lines that showed those numbers was different, much different.

Date/Time Latency Probe (Avg)
First Report 04-16-26 21:19 367.5
Second Report 04-16-26 21:19 1.33333333

Why would the data show different timing for the same date/time? Shouldn't the data be the same each time?

Azure Firewall
Azure Firewall

An Azure network security service that is used to protect Azure Virtual Network resources.

0 comments

Answer accepted by question author

Vallepu Venkateswarlu 10,180 Reputation points Microsoft External Staff Moderator
2026-05-26T00:22:05.03+00:00

Hi @ Michael Oehlert,

This is actually expected behavior with how Azure Monitor metrics are aggregated and exported. When you set your chart to “Latency Probe” at a 1-minute granularity and hit Export, the portal re-runs a fresh metrics query each time, and it will:

  • Align its 1-minute buckets relative to when you run the query
  • Potentially shift bucket boundaries slightly (it doesn’t lock each “21:19” bucket to the exact same 60-second window forever)
  • Recompute averages over whatever has been ingested into those buckets (data that might still be settling or that might have been aggregated differently over time)

So even though both exports label the row as “04-16-26 21:19,” the underlying minute window and the aggregated values can differ between the two exports. In your first export that 21:19 row might have spanned, say, 21:18:30–21:19:30; on your second export it might span 21:19:00–21:20:00, hence the drastically different average latencies.

If you need a static snapshot of the exact same buckets:

  • Use the Azure Monitor Metrics REST API (or Azure CLI) and specify absolute startTime/endTime and timeGrain=PT1M so that you lock in the exact intervals you want.
  • Or configure a diagnostic setting to stream your metrics to a Storage account or Log Analytics workspace—then you can query the raw data with Kusto or pull a consistent CSV.

Reference

Azure Firewall metrics overview & time grains

Azure Monitor Metrics REST API (timeGrain, start/endTime)

Export metrics via diagnostic setting

Please210246-screenshot-2021-12-10-121802.pngand “up-vote” wherever the information provided helps you, **this can be beneficial to other community members.

Was this answer helpful?

1 person found this answer helpful.
0 comments

2 additional answers

Sort by: Most helpful
Most helpful Newest Oldest
  1. kagiyama yutaka 3,845 Reputation points
    2026-05-26T03:17:33.7733333+00:00

    I think Azure Monitor exports show the current aggregation for the selected time range and time grain and not a fixed snapshot, so the same timestamp can later appear with a different value.

    Was this answer helpful?

    0 comments

  2. AI answer

    2026-05-22T17:51:40.92+00:00

    The Latency Probe metric can legitimately change for the same time range when exporting at different times because Azure Monitor metrics are processed and aggregated over time, and the chart/export can include partial or updated data points.

    Key behaviors that explain what is seen:

    1. Metrics ingestion latency and partial data
      Azure Monitor can show incomplete (partial) metric values for the most recent minutes while data is still being ingested and processed. For sums and counts this is most visible, but the same ingestion behavior applies generally: the system updates the metric value once all data for that time bucket is available. When exporting at different times, the same timestamp can therefore show different values because:
      • The first export captured a partial or intermediate value.
      • A later export captured the fully processed/updated value for that same minute.
      This is by design: Azure Monitor prefers to show data as soon as it is received, even if incomplete, and then corrects the value when the full set of data arrives.
    2. Granularity and aggregation effects
      Metrics are collected at a minimum granularity of 1 minute, but underlying samples can be more frequent. The Latency Probe metric uses the Average aggregation. When data is reprocessed or additional samples arrive for that minute, the average can change. Exporting at different times can therefore yield different averages for the same minute.
    3. Latency Probe metric characteristics
      The Latency Probe metric (FirewallLatencyPng) measures latency within the Azure Firewall platform and can be affected by transient conditions (for example, ICMP-based Ping Mesh behavior). The documentation notes that intermittent spikes are normal and that metric behavior can vary, especially around infrastructure changes or probe issues. If the probe fails or is interrupted, it can report 0, which may later be corrected when the system reconciles data.
    4. Unexpected dips or changes near the end of the time range
      The Azure Monitor metrics troubleshooting guidance explicitly calls out that apparent drops or unexpected changes in recent data points are often due to partial data for the last few minutes. Charts and exports update once the full data is processed, which can change previously seen values.

    Because of these behaviors, the expectation should be that:

    • Historical values stabilize after ingestion and processing completes.
    • Values for very recent timestamps (especially when using 1-minute granularity) can change between exports.

    To minimize confusion:

    • Avoid drawing conclusions from the last few minutes of data; re-check after some time has passed.
    • When comparing exports, focus on data that is sufficiently in the past so that ingestion and aggregation are complete.

    References:

    AI-generated content may be incorrect. Read our transparency notes for more information.

    Was this answer helpful?

Your answer

Answers can be marked as 'Accepted' by the question author and 'Recommended' by moderators, which helps users know the answer solved the author's problem.