Monitoring

Nobody decided to spend this much on monitoring. It just happened.

Datadog, New Relic and Splunk bills multiply quietly, because the things that drive them — custom metrics, log volume, retention windows — are set by engineers who never see the invoice.

FeeFixed, quoted per scope Duration10 business days InputUsage & billing detail VendorsDatadog · New Relic · Splunk · Grafana

Scope

What gets examined

Typically the highest percentage reduction of any audit here, for the simple reason that nobody has ever looked.

Custom metric cardinality — the tag combination that turned one metric into four hundred thousand, and what it costs per month
Log volume by source, with the noisy services identified and the value of each stream questioned
Indexed versus archived logs: what genuinely needs to be searchable in real time, and what does not
Retention windows set at defaults, against what your incident reviews and compliance obligations actually require
Host, container and APM pricing units against what's really being monitored, including hosts that no longer exist
Dashboards, monitors and integrations nobody has opened in six months
Sampling and filtering opportunities at the agent, before data ever becomes billable
Duplicate coverage where two vendors monitor the same thing after a migration that never finished

Deliverable

What you get on day fourteen

A cost breakdown by driver — not by product line, which is how the vendor bills you, but by the specific tag, service or log source responsible. This is the part clients usually describe as the moment it clicked.

A reduction plan that preserves coverage. Each recommendation states what visibility you lose, if any. Cutting observability blindly is how a cost saving turns into an outage, and the report is written to prevent that.

Guardrails: cardinality limits, retention policy, and a review cadence, so the bill doesn't rebuild itself over the next year.

Fit

When this is worth it

Worth it if you're spending over about $5,000 a month on monitoring, or if the bill has grown faster than your infrastructure. The classic trigger is a renewal quote that arrives at double last year's.

Not worth it if you're on a small fixed plan with no usage-based component. There's nothing to find.

Questions

The ones we get asked first

Will we lose visibility?

Not if it's done properly, which is why every recommendation names what you'd stop collecting and why it's safe. A saving that costs you your next incident investigation isn't a saving, and we'll argue against it even if it's the biggest number in the report.

How much can this realistically reduce?

It varies enormously and we won't quote you a percentage before seeing the usage detail. What's consistent is that cardinality and retention are almost always the two largest drivers, and both are usually fixable without losing anything anyone uses.

We're mid-renewal. Is that good or bad timing?

Good. Usage evidence is the strongest position you can be in during a renewal conversation, because it tells you what you actually need before the vendor tells you what to buy.

Can you help us migrate to something cheaper?

Sometimes the answer really is a different tool, and we'll say so. But migration costs engineering time, and in most cases fixing configuration on your current vendor returns more, faster.

Also available

The other audits

Cloud infrastructureCommitments, idle resources, storage and network SaaS & licensingInactive seats, duplicate tools, wrong tiers Data platformsWarehouse sizing, query cost, retention Contracts & vendorsRenewal exposure, licensing position, evidence Essential EightScored maturity assessment and costed roadmap

Next step

When does your monitoring contract renew?

Going into that conversation with usage evidence is worth considerably more than the cost of this audit.

Start a conversation