Log Analytics Workspace
Does ZopNight manage Log Analytics Workspace?
Log Analytics workspaces bill per GB ingested plus a separate retention surcharge on data kept beyond the included window. ZopNight discovers each workspace with its retention and SKU settings, then harvests the actual billed retention cost from Cost Management. Retained GB has no Azure metric, so only the bill is authoritative.
Rules that fire on Log Analytics Workspace
At a glance
| Field | Value |
|---|---|
| Scheduling notes | discovery and cost visibility only. |
Log Analytics workspaces ingest and retain telemetry for Azure Monitor, billed per GB ingested and per GB retained beyond the free window. Verbose diagnostic settings routinely make log ingestion a top-ten Azure line item.
Ingestion and retention meter separately
A workspace charges on two independent axes. Ingestion bills every GB written into the workspace, driven entirely by what diagnostic settings, agents, and Application Insights components send at it. Retention bills the data held past the included period, on dedicated Cost Management meters: “Pay-as-you-go Data Retention” (renamed “Analytics Logs Retention”) and the archive meter “Data Archive” (now “Long-term Retention”). Those are distinct from the ingestion meters on the same workspace. Trimming a long interactive-retention window removes exactly that surcharge without touching what gets collected.
Why ZopNight prices retention from the bill, not from metrics
Azure publishes no retained-GB metric for a workspace: the Usage metric measures ingested bytes, and nothing reports the cumulative volume currently held. Estimating the retention charge from ingestion would be fabrication, so ZopNight instead harvests the workspace’s actual billed retention cost from Cost Management, isolating the retention meters from ingestion on the same resource, and stamps the figure onto the workspace only when it is greater than zero. Its retention recommendation fires against workspaces holding data well beyond the 90-day baseline, priced from that real billed cost, and abstains entirely when no retention charge exists.
Discovery and the commitment-tier review
Discovered via Azure Resource Graph with retention and SKU configuration. Cost Management billing attributes ingestion and retention spend, and high-ingestion workspaces surface for commitment-tier and retention review. Steady large-volume estates often pay pay-as-you-go rates a commitment tier would undercut.
The quiet ways a workspace inflates
Diagnostic settings that forward every category from every resource, sprawl of one-workspace-per-team each below any commitment tier, and retention set to the maximum on day one and never revisited are the recurring patterns worth auditing first.
Inspecting usage inside the portal
Azure portal → Log Analytics workspaces, then a workspace’s Usage and estimated costs blade, shows ingestion volume by solution and the current retention setting side by side.