Skip to main content
idle · azure

Event Hubs namespaces quiet on both the producer and consumer side

resource types
1
rule IDs covered
1
severity
medium

What does ZopNight detect here?

ZopNight flags an Event Hubs namespace only when IncomingMessages and OutgoingMessages both sit below a floor of 1 message (average and peak alike) across 30 days of coverage. Throughput units bill as a fixed fee whether events flow or not, so a silent namespace is a pure standing charge.

Signal and threshold

How ZopNight evaluates Event Hubs namespaces quiet on both the producer and consumer side.
Field Value
Rule IDsRC-1376
Categoryidle
Severitymedium
Metricnone — pure configuration read
Sourceevent_hub_idle.go

Producers can stop while consumers keep draining

Message infrastructure has two independent halves. A producer team can decommission its service while a consumer still drains the backlog; a consumer can poll an empty hub long after producers went quiet. Either half alone looks like activity. ZopNight therefore gates on both axes: IncomingMessages below the floor proves nothing is publishing, OutgoingMessages below the floor proves nothing is reading, and only the two together justify recommending deletion of the namespace.

Why the floor is 1 message and not 0

An Event Hubs namespace registers a faint pulse even with no workload: health probes, the Azure monitoring agent, Capture and diagnostic housekeeping. Gating on exactly zero would abstain forever on genuinely dead namespaces that merely carry that baseline. The floor of 1.0 sits above the platform noise and below any real traffic. Both the average and the maximum on each axis must stay under it: one busy hour anywhere in the window, such as a nightly batch producer, counts as use.

The fixed fee this recovers

A Standard namespace bills its provisioned throughput units hourly whether or not events move; Premium and Dedicated carry flat tier fees. ZopNight prices the finding from that fixed-fee run-rate, so the savings figure is the namespace’s real monthly charge, and the rule abstains entirely when no priced cost is available.

Watch both directions yourself

Terminal window
az monitor metrics list \
--resource "/subscriptions/<sub>/resourceGroups/<rg>/providers/Microsoft.EventHub/namespaces/<name>" \
--metric IncomingMessages OutgoingMessages \
--interval PT1H --offset 30d --aggregation Average Maximum

Every way this rule declines to fire

Missing either metric series, less than 30 days of coverage on either axis, any hour at or above the floor on either side, or an unknown cost. Each of those aborts the evaluation. There is no tag-based fallback path; a label a customer typed can never authorize deleting messaging infrastructure.

Retiring a namespace safely

Capture any events you are contractually required to retain, confirm no connection strings for the namespace remain in application configuration, then delete the namespace. Consumer groups and hubs go with it. Detection uses the Reader and Monitoring Reader roles; ZopNight has no write path to Event Hubs.

See it fire on your bill.

Connect an account read-only. The first findings land in minutes.

417 rule families across 353 resource types on 22 platforms. Every threshold, metric, and IAM action is documented on these pages before you grant anything.

417 rule families documented
353 resource types covered
read-only default access level
Multi-cloud automation· Production-ready in 30 min· SOC 2 · ISO 27001· 20–60% off the bill, first month· 4 platforms · 1 console· Multi-cloud automation· Production-ready in 30 min· SOC 2 · ISO 27001· 20–60% off the bill, first month· 4 platforms · 1 console·