Due Diligence Report: Observability & Telemetry Cost Exposure
A line-by-line audit of what an organization is actually paying to watch its own systems.
Executive Summary
This review reconstructed telemetry and observability spend against actual usage rather than list pricing, to identify whether monitoring tooling had become a cost center disproportionate to the infrastructure it was monitoring.
Findings
Observability tooling accounted for 22 to 28 percent of total cloud spend in the audited period, exceeding the cost of the production databases it was instrumenting.
Recommendation: Rightsize retention windows and cardinality limits before the next contract renewal; renegotiate or consolidate tooling.
A significant share of configured dashboards and alert rules showed no evidence of being referenced during the audit window, suggesting paid-for capacity with no operational use.
Recommendation: Audit alert and dashboard usage quarterly; deprecate unused configuration rather than carrying it forward by default.
Several services were emitting high-cardinality metrics (per-user or per-request labels) that drove a disproportionate share of ingestion cost relative to their diagnostic value.
Recommendation: Restrict high-cardinality labels to sampled or debug-tier logging rather than default production metrics.
Conclusion
Observability spend in this engagement was not a symptom of scale, it was a symptom of unaudited default configuration compounding over time. The identified reductions were achievable without reducing actual incident-response capability.
Frequently Asked
Why does observability spend often exceed expectations?
Unaudited default retention windows, cardinality, and unused dashboards compound over time, independent of actual infrastructure growth, until a direct audit surfaces the gap.