I'm looking to set up an Azure Monitor Log Analytics Workspace to send sign-in and audit logs, with the goal of creating email alerts for specific activities. Before I commit to a pay-as-you-go plan, I'm trying to figure out how to estimate the expected costs. Is downloading the last 30 days of user sign-in and audit logs from the portal and checking the size of the CSV file a reliable way to gauge the volume that would be billed? The workspace will have a default retention of 31 days. Additionally, I'd like to know if there's a complimentary log collection volume included before charges start with the pay-as-you-go option. I understand there are extra charges for alerts based on how frequently they trigger (1 minute, 5 minutes, etc.). The alerts I plan to set up won't be triggered every month, but the volume of logs that the workspace will need to handle to monitor specific events could be significant. Ultimately, I'm hoping to get timely email alerts for dormant accounts that sign in and for other infrequent events.
2 Answers
To get a gauge on potential costs, try setting a daily ingestion limit that seems reasonable, one that won’t raise any eyebrows at the office. Then, enable the integration and monitor it for a week. You’ll likely see spikes in log volume during weekday mornings compared to other times. It can take a lot of time to figure out Log Analytics billing specifics, but honestly, you might end up spending more time calculating than just covering the ingestion costs for a single day. If you're anxious about the ingestion costs, just remember, if a day’s volume concerns you, maintaining that level year-round might be an issue.
Right within the Log Analytics groups, you’ll find an estimated cost tab. While I get you’re looking for pre-setup estimates, if your logging rate is steady, after a couple of days of monitoring, you should get a solid idea of your volume and costs.
We know there are pricing calculators, but we’re unsure what volume to input to get a realistic estimate, which makes us hesitant to turn it on in our production environment without knowing the potential costs. We’re looking to avoid any billing surprises during the testing phase.