Application Gateways with no requests and no client connections
What does ZopNight detect here?
Application Gateway bills per hour plus capacity units even at zero traffic, so ZopNight examines TotalRequests and CurrentConnections over 30 days and flags the gateway when every present series averages 0 with at least 7 days of history behind it. Empty backend pools are the usual root cause.
Signal and threshold
| Field | Value |
|---|---|
| Rule IDs | RC-272 |
| Category | idle |
| Severity | medium |
| Metric | none — pure configuration read |
| Source | appgateway_idle.go |
Where it applies
Layer-7 front doors that nobody walks through
An Application Gateway is typically the paid front door to something, until the something
moves behind Front Door, gets rebuilt on Container Apps, or is simply deleted while the
gateway stays. The hourly charge and provisioned capacity units keep billing either way.
ZopNight reads two Azure Monitor series on the gateway: TotalRequests (traffic served)
and CurrentConnections (clients attached). A positive average on either one proves the
gateway is still in the serving path, and the evaluation stops there.
Both counters at zero, with history to back it
Whichever of the two series are present must average 0, and each present series needs at least 7 days of trustworthy coverage. A gateway whose diagnostics were enabled on Tuesday cannot be condemned by Friday. When neither series exists at all, the rule abstains: no telemetry is a data gap, not evidence.
Reproduce the traffic check
az monitor metrics list \ --resource "/subscriptions/<sub>/resourceGroups/<rg>/providers/Microsoft.Network/applicationGateways/<name>" \ --metric TotalRequests CurrentConnections \ --interval PT1H --offset 30d --aggregation AverageWhile you are there, look at the backend pools; a gateway with zero traffic usually has backends that were deallocated or deleted months ago:
az network application-gateway show -n <name> -g <rg> \ --query "backendAddressPools[].backendAddresses" -o jsonWhat a delete takes with it
Removing the gateway ends the hourly and capacity-unit charges. Its public IP address is a separate resource that survives and keeps billing, so plan to delete or reassign it in the same change, along with WAF policies attached to nothing.
Reasons the rule holds its fire
Any request or connection activity, both metric series missing, shallow coverage on a present series, or an unpriced gateway: each of these means no finding. ZopNight never emits a zero-dollar recommendation for this rule.
Access involved
Reader covers gateway discovery and configuration reads; Monitoring Reader covers both metric series. Removal itself stays manual. A gateway delete rewires ingress, and no automation should make that call from traffic data alone.