Azure Application Gateway

A Discovery task runs the plugin with a stored Microsoft Entra credential and lists the Application Gateways of the subscription, or of a single Resource Group when discovery is narrowed to one, through the Microsoft Azure Network API. The plugin then reads their metrics from Azure Monitor and returns the generated agents and modules for the Discovery task to create.

With per-Application-Gateway creation enabled, each discovered resource becomes an agent named with the Application Gateway name and an optional prefix. When it is disabled, every module is attached to a single target agent and the Application Gateway name is prepended to each module name. Each agent always carries a reachability module, and one module per enabled metric family is added on top.

The metric families are enabled independently: performance, requests, backend health, latency, traffic, security, capacity, WAF and WebSocket activity, together with an Application Gateway count. Capacity metrics and new connections per second are collected only for v2 SKUs, and WAF metrics only for WAF SKUs; the plugin asks Azure Monitor which metrics are available for the resource and skips the rest.

A task-scoped cache holds the discovered Application Gateways between runs, and a gateway that is no longer discoverable keeps its connection module at 0 until the cache is rebuilt. Allow and deny regular expressions filter the final module names, and agents can be created in autodisable mode. The plugin only reads Application Gateway metrics and never changes the Microsoft Azure configuration.

What it allows you to do

- Create Pandora FMS agents for Azure Application Gateway resources through a Discovery task.
- Monitor performance, request and backend health counters per Application Gateway.
- Monitor latency, traffic, security and capacity metrics.
- Monitor WAF and WebSocket activity, and the Application Gateway count.
- Choose between one agent per Application Gateway and a single consolidated agent.

What it monitors

- Application Gateway reachability
- Performance and connection counts
- Request counters and backend HTTP status
- Backend host health
- Latency and client round-trip counters
- Traffic sent and received
- Security, capacity, WAF and WebSocket metrics
- Application Gateway count

How it works
A Discovery task runs the plugin with a Microsoft Entra service principal credential retrieved from the Pandora FMS credential store. The plugin lists the Application Gateways of the subscription, or of the selected Resource Group, through the Microsoft Azure Network API and reads their Azure Monitor metrics. With per-Application-Gateway creation enabled, each discovered resource becomes an agent named with an optional prefix; when it is disabled, every module is attached to a single target agent with the Application Gateway name prepended to the module names. A task-scoped cache of the discovered Application Gateways is reused between runs, and a gateway that is no longer discoverable keeps its connection module at 0 until the cache is rebuilt. The generated agents and modules are returned for the Discovery task to create them.

Benefits

- Application Gateway state, traffic and backend health become visible in the same platform as the rest of the monitored infrastructure.
- Removes the manual creation and maintenance of agents and modules for each Application Gateway.
- Newly discovered Application Gateways are incorporated on the next task run without reconfiguring the task.
- Performance, latency, traffic and WAF data are consolidated into one view per Application Gateway.

Use cases

- Network and cloud operations teams that monitor the health and traffic of Application Gateways in Microsoft Azure.
- Environments where Azure application delivery is watched alongside other cloud and on-premise infrastructure.
- Teams that need to detect unhealthy backends, latency growth or WAF blocks before they affect users.

Requirements

- A Pandora FMS server with Discovery enabled and a console to define the task.
- A Microsoft Azure subscription containing the Application Gateways to monitor.
- A Microsoft Entra service principal stored as an Azure credential in the Pandora FMS credential store, with read access to the Application Gateways and their Azure Monitor metrics.
- A target agent group whose identifier is greater than 0; the All group cannot be used.
- A monitoring interval for the generated agents.

Compatibility
Plugin version 1.0. Communicates with the Microsoft Azure Network and Azure Monitor APIs. Distributed as a self-contained Discovery application, so no additional runtime has to be installed for a normal run. Compatible with Pandora FMS NG 784 and later, according to the Marketplace compatibility statement.

Limitations

- Capacity metrics and new connections per second are collected only for v2 SKUs, and WAF metrics only for WAF SKUs.
- Metrics that Azure Monitor does not report for the resource are skipped and counted as unsupported instead of failing the run.
- Allow and deny regular expressions are matched against the final module name, which in consolidated mode includes the Application Gateway name.
- A gateway that is no longer discoverable keeps its agent and reports its connection module as 0 until the entity cache is rebuilt.
- Sovereign or custom Microsoft Azure clouds are not validated; the plugin uses the public Azure endpoints.
- No host operating system compatibility has been validated.
- The plugin only reads Application Gateway metrics and does not change the Microsoft Azure configuration.