Front Door Log Analytics Workspace Cost

Casey 0

Hi,

I have a question about Diagnostic Settings in Azure Front Door Premium.

Currently the Azure Front Door Premium resource has Diagnostic Settings configured to use Log Analytic Workspace and its costing nearly one third of our total Azure spend. So I need to see what options I have I reduce this cost.

We only require a 30 day retention period. Nearly, if not all our log checking is done via the "Logs" option under "Front Door and CDN profile" -> "Monitoring" -> "Logs" (We are not directly opening the Log Analytic Workspace.

As we only retain the data for 30 days, we don't have any storage charges, however we do have very high Analytics Logs data ingestion charge. While Basic Logs data ingestion is far cheaper per GB but is at 0 usage. Is there another option available so we only use Basic Ingestion?

To give you an idea of how the data is being used.

Alert threshold when we exceed XX amount of requests.
Queries on resource providers:
- ResourceProvider == "MICROSOFT.CDN" and Category == "FrontDoorAccessLog"
- where ResourceProvider == "MICROSOFT.CDN" and Category == "FrontDoorWebApplicationFirewallLog

I feel there is a configuration error around the logging, purely due to its costs.

hossein jalilian 6,520 Reputation points

2024-09-13T16:21:16.1766667+00:00
Hello Casey,

Thanks for posting your question in the Microsoft Q&A forum.

There are a few options you can consider to reduce the costs:

Ensure you're only collecting the necessary logs and metrics, consider disabling or reducing the frequency of logs that aren't critical for your operations.

Implement data collection rules to filter and aggregate logs before ingestion, potentially reducing the volume of data sent to Log Analytics

For certain types of logs, you may be able to use Basic logs instead of Analytics logs, which are significantly cheaper

Instead of sending all logs to Log Analytics, consider archiving them to Azure Storage, which is generally less expensive, you can still query these logs when needed, albeit with some additional steps.

Please don't forget to close up the thread here by upvoting and accept it as an answer if it is helpful
Sai Prasanna Sinde (Quadrant Resource LLC) 100 Reputation points Microsoft Vendor

2024-09-18T08:06:22.3733333+00:00

Hello Casey,

Welcome to Microsoft Q&A Platform. Thank you for reaching out & hope you are doing well.

Adding to the points provided by @hossein jalilian,

To effectively manage your data costs, it’s recommended to set the immediatePurgeDataOn30Days property to true. This ensures that any data exceeding retention limits is promptly removed.

For your reference: https://learn.microsoft.com/en-us/azure/azure-monitor/logs/data-retention-configure?tabs=portal-3%2Cportal-1%2Cportal-2#:~:text=Workspaces%20with%2030,Update%20API.
Sai Prasanna Sinde (Quadrant Resource LLC) 100 Reputation points Microsoft Vendor

2024-09-19T09:38:11.5633333+00:00

Hi @Casey,

Hope you are having a great day!

Following up to see if the above suggestion was helpful. And, if you have any further query do let us know.

We are happy to assist you.

Thanks,

Sai Prasanna.

1 answer

Casey 0 Reputation points

2024-09-19T09:58:14.5566667+00:00

Hi,

The suggestions above all make sense and already in practise.

I suppose my question is more aimed at, if we are only using 30 days worth of logs, which is included within the default scope. Do we need to ingest these logs into Workspace or Storage at all?
Please sign in to rate this answer.

0 comments No comments
Sign in to comment

Use comments to ask for clarification, additional information, or improvements to the question.

Share via

Front Door Log Analytics Workspace Cost

1 answer

Your answer