Monitor and maintain Internet NAT gateways - NAT Gateway

You can use CloudMonitor to monitor Internet NAT gateways. CloudMonitor collects real-time metrics and generates visual time-series charts in the Internet NAT Gateway console, allowing you to monitor gateway performance and track inbound and outbound traffic.

Metric monitoring data

Internet NAT gateway monitoring

Go to the Internet NAT Gateway console. In the top navigation bar, select the region of the Internet NAT gateway.
In the Monitor column, click the icon for the target Internet NAT gateway.

Category	Metric	Description
Session statistics	Concurrent connections / Port allocation failures (count)	SessionActiveConnection: the maximum number of concurrent TCP and UDP connections per minute that are supported by the NAT gateway. Port allocation failures: The number of times the NAT gateway fails to allocate a TCP or UDP port because the number of concurrent connections to a destination address is too high. A single elastic IP address (EIP) provides a limited number of ports for SNAT. If too many sessions access the same destination address and an insufficient number of EIPs are configured in the SNAT entries, port allocation fails. If the port allocation failure count continues to increase, add more EIPs to the SNAT entries.
	Dropped concurrent connection rate (count/s)	The rate of concurrent connections that are dropped due to the limit of concurrent connections to the NAT gateway.
	New connection rate / Dropped new connection rate (count/s)	SessionNewConnection: the number of new TCP and UDP connections that are established to the NAT gateway per second. SessionNewLimitDropConnection: the number of new connections that are dropped per second due to the limit of new connections that can be established to the NAT gateway per second.
	Concurrent connection usage / New connection usage (%)	SessionNewConnectionWater: the percentage of established connections to the upper limit of connections. SessionNewLimitDropConnectionWater: the percentage of established new connections to the upper limit of new connections. Note Each NAT gateway supports 100,000 new connections per second and 2,000,000 concurrent connections per minute. If your service triggers a scale-up, the adjustment typically takes effect within 10 minutes.
Inbound traffic statistics	Inbound traffic rate (bps)	The amount of inbound traffic per second, including the following two metrics: BWRateInFromOutside: the amount of traffic per second from the Internet to the NAT gateway. BWRateOutToInside: the amount of traffic per second from the NAT gateway to the VPC.
	Inbound traffic volume (bytes)	The total amount of inbound traffic, including the following two metrics: BytesInFromOutside: the amount of traffic from the Internet to the NAT gateway. BytesOutToInside: the amount of traffic from the NAT gateway to the VPC.
	Inbound packet rate (pps)	The number of inbound packets per second, including the following two metrics: PPSRateInFromOutside: the number of packets per second from the Internet to the NAT gateway. PPSRateOutToInside: the number of packets per second from the NAT gateway to the VPC.
	Inbound packet volume (packets)	The total number of inbound packets, including the following two metrics: PacketsInFromOutside: the number of packets from the Internet to the NAT gateway. PacketsOutToInside: the number of packets from the NAT gateway to the VPC.
Outbound traffic statistics	Outbound traffic rate (bps)	The amount of outbound traffic per second, including the following two metrics: BWRateOutToOutside: the amount of traffic per second from the NAT gateway to the Internet. BWRateInFromInside: the amount of traffic per second from the VPC to the NAT gateway.
	Outbound traffic volume (bytes)	The total amount of outbound traffic, including the following two metrics: BytesOutToOutside: the amount of traffic from the NAT gateway to the Internet. BytesInFromInside: the amount of traffic from the VPC to the NAT gateway.
	Outbound packet rate (pps)	The number of outbound packets per second, including the following two metrics: PPSRateOutToOutside: the number of packets per second from the NAT gateway to the Internet. PPSRateInFromInside: the number of packets per second from the VPC to the NAT gateway.
	Outbound packet volume (packets)	The number of outbound packets, including the following two metrics: PacketsOutToOutside: the number of packets from the NAT gateway to the Internet. PacketsInFromInside: the number of packets from the VPC to the NAT gateway.

View traffic monitoring data of Internet NAT gateways

Abnormal traffic from an ECS instance can affect how other ECS instances access the internet through SNAT. You can enable traffic monitoring to view SNAT traffic data, quickly identify the ECS instances that consume the most traffic, and apply traffic control policies. This lets you quickly locate and resolve issues and improve service stability.

Before viewing traffic monitoring data, you must submit a ticket to request the required permissions.

Go to the Internet NAT Gateway console. In the top navigation bar, select the region of the Internet NAT gateway.
In the Actions column, click Manage for the target Internet NAT gateway. On the details page, click the Monitoring and Logging tab.
Click the Traffic Details tab to view gateway traffic monitoring data.

In the time range selector, specify a time to view the data. Data is available at one-minute granularity. For example, if you set the time to 18:30 on July 18, 2024, you can view the traffic monitoring data from 18:30:00 to 18:31:00 on July 18, 2024.

After enabling traffic monitoring, wait 15 minutes for the traffic data to become available.

The displayed traffic monitoring data may be delayed by 3 to 5 minutes. For example, at 18:30 on July 18, 2024, you can view only traffic monitoring data generated before 18:25 and cannot view data generated after 18:25.

The traffic monitoring feature displays traffic information for the top 100 ECS instances that consume the most traffic.

The information displayed in the console takes precedence.

Metric	Unit	Description
Inbound bandwidth	bps	The bandwidth that is used to access ECS instances over the Internet.
Outbound bandwidth	bps	The bandwidth that is used to access the Internet from ECS instances.
Inbound packet rate	Packets/second	The number of packets from the Internet to ECS instances per second.
Outbound packet rate	Packets/second	The number of packets from an ECS instance to the Internet per second.
Concurrent connections	Connections	The number of concurrent connections established by an ECS instance that accesses the Internet through the NAT gateway.
New connections	Packets/second	The number of new connections established per second by an ECS instance that accesses the Internet through the NAT gateway.

View monitoring data of EIPs that are associated with Internet NAT gateways

Go to the Internet NAT Gateway console. In the top navigation bar, select the region of the Internet NAT gateway.
In the Actions column, click Manage for the target Internet NAT gateway. On the details page, click the Monitoring and Logging tab, and then click EIP Monitoring Associated with NAT Service.

Metric	Unit	Description
Outbound bandwidth	bps	The bandwidth of traffic from an ECS instance to the Internet.
Inbound bandwidth	bps	The bandwidth of traffic from the Internet to an ECS instance.
Outbound bandwidth usage (%)	%	The bandwidth utilization for traffic from an ECS instance to the Internet.
Inbound bandwidth usage (%)	%	The bandwidth utilization for traffic from the Internet to an ECS instance.
Outbound packet rate	pps	The number of packets sent from an ECS instance to the Internet per second.
Inbound packet rate	pps	The number of packets sent from the Internet to an ECS instance per second.
Outbound rate-limiting drop rate	pps	The rate at which packets are dropped per second due to outbound rate limiting.
Inbound rate-limiting drop rate	pps	The rate at which packets are dropped per second due to inbound rate limiting.

Create a threshold-triggered alert rule

You can create threshold-triggered alert rules to monitor the status of your Internet NAT Gateway instances in real time and ensure service stability.

Console

Log in to the CloudMonitor console.
In the left-side navigation pane, choose Alerts > Alert Rules, and then click Create Alert Rule. For more information about the other parameters, see Create an alert rule.
- Product: Select enhanced_nat_gateway.
- Resource Range: You cannot change the resource range type after you create the alert rule. Select All Resources to apply the rule to all instances of the selected Product under your account. You can also select Instances and configure Related Resource to apply the rule to specific instances.
- Set the rule conditions that trigger an alert based on monitoring data.
  1. Click Add Rule and select the appropriate metric type from the drop-down list.
  2. In the Configure Rule Description panel, configure the Rule Name, Metric Type, and Metric.
- Mute Period: The interval at which alert notifications are resent if the alert is not resolved.
- Effective Period: The period during which the alert rule is active. The system checks monitoring data for alerts only during this period.
- Alert Contact Group: The contact group to which alert notifications are sent.

API

Call PutResourceMetricRule to set a threshold-triggered alert rule for a metric of a single resource.
Call CreateMetricRuleResources to associate resources with an alert rule.