Non-production SQL VMs moving under 1 GiB of network traffic in 30 days

1 GiB in a month is the whole bar

The fire trigger is combined VMNetworkIn plus VMNetworkOut under 1 GiB cumulative across a 30-day window, an average of roughly 0.4 KiB per second. Any live SQL workload’s heartbeat traffic, AlwaysOn synchronization, or even idle ODBC probes sit above that, which is the point: the threshold is set so a quiet-but-used warehouse does not trip it. Because a SQL VM resource has no platform metrics of its own, the aggregator harvests these series from the paired compute VM (readable with Monitoring Reader), and the gate is computed from the full collection window, so a VM busy three weeks ago but quiet lately is not flagged.

Only positively-identified non-prod machines qualify

Low network alone cannot distinguish an abandoned box from a standby replica, so RC-269 requires a positive non-production signal: a dev/test environment tag, a dev/test name, or a dev/test resource group. A production env tag vetoes absolutely. An earlier revision fired on the mere absence of a prod signal, which meant a production SQL VM with a neutral name got a park recommendation; the current gate fails closed instead. A VM with a known recurring schedule already in place, or one whose uptime shows it is already mostly off, is also skipped as redundant.

The lever is a schedule, and the dollars are measured

A one-shot deallocate on a running VM is an outage, not a saving, so the recommendation is a recurring off-hours start/stop schedule. The dollar figure comes exclusively from the aggregator’s heatmap-derived idle measurement for this specific VM: savings = monthly cost × measured idle fraction. No heatmap data, or a zero idle fraction, means the rule abstains. An earlier fabricated flat 0.67 multiplier was removed on principle. Missing pricing also abstains. Note that managed-disk storage keeps billing while the VM is stopped; only compute pauses. Applying the schedule uses the Zopnight Write Access custom role (start/action and deallocate/action on the VM).

Pull the same traffic numbers

az monitor metrics list --resource <vm-resource-id> \
  --metric "Network In Total" "Network Out Total" \
  --aggregation Total --interval PT24H --offset 30d \
  --query "value[].timeseries[].data[].total" -o tsv

Sum the two columns; under 1,073,741,824 bytes total reproduces the rule’s verdict.

Everything that makes it stay silent

Abstains: metrics absent (rollout gap or permissions), zero total bytes (a deallocated VM, which other rules own), traffic at or above 1 GiB, no positive non-prod signal, an existing schedule, long-off uptime, missing pricing, or missing schedule data. Low severity is deliberate: network quiet is a weak idle proxy, and the remediation asks you to check connection and query activity before parking anything.