This the multi-page printable view of this section. Click here to print.

Return to the regular view of this page.

  • 1:
    • 2:

      Subscription

      Try all of Sysdig’s features for free; when you are ready to upgrade, contact Sysdig sales.

      See also: Getting Started with Sysdig Monitor and Getting Started with Sysdig Secure.Getting Started with Sysdig Monitor

      Subscription Types

      Free Tier

      With Free Tier, use *Sysdig Secure for cloud *functions free forever:

      • For one single account in one cloud region (AWS for v1)

      • Manage cloud posture with a daily run of CIS Benchmarks

      • Detect threats with out-of-the-box CloudTrail detection rules based on Falco

      • Scan containers (ECR/Fargate) automatically and within your cloud environment for up to 250 images a month

      30-Day Trial

      Test all the features of Sysdig Monitor and/or Sysdig Secure with the free 30-day trial.

      After 30 days, your account will be disabled and you can contact Sysdig sales to upgrade to an Enterprise license.

      Enterprise Tier

      You can license Sysdig Secure, Sysdig Monitor, or both (Sysdig Platform). For details, see https://sysdig.com/pricing/.

      Review Current Subscription

      1. Log on as Administrator to Sysdig Monitor or Sysdig Secure.

      2. From the Selector button in the left-hand navigation, choose Settings > Subscription.

        Your current plan details are displayed.

      You can license each of these elements independently:  

      • Sysdig agents (host agents)

      • Cloud accounts (Secure only, see also: Data Sources)

      • Fargate tasks/serverless agents  (Secure only, see also Serverless Agents)

      The number of licenses purchased has the following effects on how Sysdig is used:

      • The agent count defines the maximum number of connected host agents you can deploy. E.g if you purchase 100 licenses, you can install 100 agents.

        • In AWS Service Monitoring powered by Cloudwatch, it also determines the number of AWS objects that can be viewed in the Sysdig Monitor Dashboards (unrelated to the number of agents actually installed). In other words, if you have 100 licenses purchased, you can only see 100 AWS objects per region, per service type.
      • **Fargate Tasks using Sysdig Serverless Agents: ** Defines the number of serverless agents connected to Sysdig backend.

      • Cloud accounts- licensed number: Number of cloud accounts you can connect to Sysdig backend.

      About Host Agent Licenses

      Reserved vs On-Demand Agents

      The distinction between reserved and on-demand agents is financial, not technical; when on-demand agents are used they perform exactly like reserved agents.

      Reserved Agents

      Reserved agents are dedicated agents that are provisioned for a user regardless of usage. You can purchase reserved agents on a monthly or annual basis. As a Sysdig SaaS account administrator, you can increase your reserved agents at any time from within the Sysdig application.

      On-Demand Agents

      On-demand agents are for short-term use and you pay only for what you use at an hourly rate. You have the ability to add and control on-demand agents. For example, an organization might schedule scale testing for two days and license an extra 500 on-demand agents for that time frame.

       In the Sysdig application, use the Customize Your Plan > Enable On-demand Agents option on the Subscription page to add or remove agents. There is a hard limit of 500 agents for any account. If the total of reserved and on-demand exceeds this limit, you will not be able to purchase additional agents. On-demand agents are available only in Sysdig SaaS applications.

      Connect Agents to the Backend

      The Sysdig platform uses a concurrent licensing model in determining when to allow an installed agent to connect to the back-end servers and report on host metrics. This means you can install Sysdig agents onto any number of instances. However, only the licensed number of agents will be allowed to connect and send metrics for recording and reporting.

      Agents connect on a “first-come, first-served” basis and in the event of an over-subscription (more agents wanting to communicate than are licensed) they will attempt to reconnect on a periodic basis. Once an existing communicating instance goes down and disconnects, the next agent attempting to connect will be allowed in.

      To avoid having agents refused connection due to over-subscription, monitor the number of established and allowed connections. To see how many licenses are in use, see the Settings > Subscription page. Use this information to either purchase additional license capacity from the UI, or to shut down lower-priority agents via normal orchestration and system administration means.

      Technical Details

      Multiple Installs: An agent is essentially an “install” of the software. If your system changes external IP addresses, or if you shut down a VM image and bring it back up elsewhere, this will remain the same agent connection. However, identical installs that are simultaneously sending data (usually an accident) will be considered two connections. A MAC address is used to identify a host for licensing purposes.

      Time Lag for License Release: When shutting down a host for any reason, the agent’s license will not be immediately released. This permits the agent to retain its licensing slot for short outages or a reboot. The time-out interval can take up to 20 minutes, and if the connection has not been re-established within the interval the license will be released for use by the next host waiting to connect.

      1 -

      Time Series Billing

      Sysdig Monitor allows you to consume custom metrics through a flexible and cost-effective Time Series Billing model aligned with your usage. With the enhanced billing experience, you can view your time-series consumption at a glance, analyze trends, and change subscription plans if need be.

      Use the Sysdig Subscription page to control your licensing, and thereby usage and spending. Based on your current subscription tier, time-series usage, and the number of active agents, you can estimate the bill and take further actions.

      Time Series Billing works only in SaaS environments and is not currently available in on-prem environments.

      Benefits of Time Series Billing

      • You consume more than the per-agent limit because Time Series Billing accounts for the following:

        • Time series through Monitoring Integrations

          • Instrumented natively

            For example, Kubernetes Control plane, Persistent Volume Claim, and Istio.

          • Using Exporter and AppCheck

            For example, Nginx and Redis.

        • Time series through Prometheus Remote Write

        • Time series through optional Pay as you Go (PAYG) and metric packs.

        See Use Cases for more details.

        Previously, the technical limit was 10K, no PAYG and metrics packs mechanisms, no system in place to bill metrics collected outside agents.

      • Validate what you are being charged on, understand and control metric usage, and drop the data that is not required, either by metric or by the scope of the metric. See Control Time Series Ingestion.

      • Pay as you go and metric pack.

      Consume Time Series

      Time series consumption is calculated by using the reserved time series included in the subscription. The basic plan includes 2000 time series per agent, and you can purchase more by adding on-demand agents or metric packs.

      Sysdig meters and bills only custom metrics.

      • Prometheus

      • JMX

      • StatsD

      • App checks

      Reserved Time Series

      The number of time series included with the subscription. The value is calculated as (the number of reserved agents + the number of connected on-demand agents) * the number of time series per agent. Time series consumed beyond your subscription limit will be charged and is aggregated across all agents running in your environment. What it means is that you can consume 3000 metrics on an agent and 1000 on another without incurring additional charges.

      Contact Sales to purchase beyond your subscription limit.

      Time Series Billing limit of 2000 is applicable only to custom metrics, while Sysdig and Sysdig KSM are included at no additional charges.

      Metric Pack

      A metric pack includes 1000 time series and is charged per month.

      View Your Subscription

      Time Series Visualization

      To help you so, Sysdig provides an at-a-glance visualization of the following:

      • Time Series Usage

        • Reserved: See Reserved Time Series.

        • Overage: Time series ingested beyond Reserved time series is Overage.

        • Ingested: The time series that are collected, analyzed, processed for storage.

      • Time Series Usage Dashboard

      • Reserved and On-Demand Agents

      • Agent Usage Dashboard

      • Usage history in CSV format

      Edit Subscription

      1. On the Subscription page, under Subscription Details , click the three dots.

      2. Click Edit Subscription.

        The Subscription Plan page gives you the directions to change the subscription plan.

      Monitor Time Series Usage

      Time Series Metrics

      To help you identify the usage trends that are important to you, Sysdig provides the following metrics:

      • sysdig_ts_usage: The metric reports the number of time series ingested for a user in a 20-minutes interval. The dashboard reports the 1-hour usage, which is the sum of the maximum of three 20-minute sysdig_ts_usage measurements taken in an hour. This metric can be segmented on metric categories as well.

      • sysdig_ts_usage_10s: The metric reports the number of time series ingested for a user in every 10-seconds window, per host (agent), and per metric category.

      Download Usage

      You can download the usage report in a CSV file. On the Subscription page, under Subscription Details, click Download Usage to download a copy of the usage report. You can view the following:

      • User ID

      • Time

      • Number of Reserved Agents

      • Number of Connected On-Demand Agents

      • Time Series included per agent

      • Total used time series

      • The ratio of used and reserved time series

      Time Series Usage Dashboard

      Sysdig provides a Time Series Usage Dashboard with insight into the usage data. You can view time series ingestion at a glance and discover and analyze trends. The dashboard shows the average number of active time series per host; current ingestion rate; churn percentage; and so on.

      Access the Time Series Dashboard

      On the Subscription page, under Usage, click Time Series Dashboard. You can view the following:

      • Current 1 Hour Ingestion

      • Current Ingestion from Agents

      • Churn Percentage

      • The average number of time series per host

      • The number of time series ingested per category

      • Host-level ingestion

      Calculate Time Series Usage

      Time series usage is calculated by using the sysdig_ts_usage metric. The metric reports the number of time series ingested for a user in an hour (sum of the maximum of three 20-minutes). For each hour, the number of time series ingested is calculated, and then the value is deducted from the number of reserved time series. This value is stored as the usage record.

      An hour period is considered in order to take the churn into account. Sysdig uses the sysdig_ts_usage_10s metric to calculate the spikes caused by churns and provides you the churn percentage in the dashboard.

      Sysdig uses the 95th percentile to calculate the exceeding cost of usage. At the end of the month, the 95th percentile of the total number of active series ingested per hour is calculated. Calculating the 95th percentile reduces the chances of billing you for unexpected spikes causes by churns.

      Churn Rate

      When a time series stops receiving new data points, it becomes inactive. This event is called time series churn. It occurs more often during an upgrade in a Kubernetes cluster or when containers are replaced by new ones. Restarts, redeploys, dynamic workloads also cause churn and generate additional time series.

      In such cases, the container_id label in a container metric changes, and subsequently, all the existing time series are replaced by new time series (with the new container_id value).

      The churn rate is the number of time series that churn over time. Sysdig uses the sysdig_ts_usage_10s metric to analyze these scenarios.

      The Time Series Usage Dashboard provides a ratio of time series detected at 1-hour period and 10-seconds period. This ratio is known as the churn percentage and it is expressed as this PromQL query:

      (sum(sysdig_ts_usage{metric_category!='PROMETHEUS_REMOTE_WRITE'}) - sum(sysdig_ts_usage_10s)) / sum(sysdig_ts_usage{metric_category!='PROMETHEUS_REMOTE_WRITE'}) * 100
      

      The time series collected by Prometheus Remote Write are excluded from this ratio because they are not collected by the Sysdig agent.

      Example

      The billing is calculated per month. A basic subscription will provide you 2000 time series per agent. This limit is applicable only to custom metrics, while you can continue consuming Sysdig and KSM metrics without incurring additional costs. Time series consumed beyond your subscription limit will be charged and is aggregated across all agents running in your environment.

      For example, if you have three agents running with the following consumption:

      • Agent 1 collecting 2000 time series per hour

      • Agent 2 collecting 1000 time series per hour

      • Agent 3 collecting 4000 time series per hour

      Time series billing is calculated as follows:

      Total consumption = 7000

      Allowed number of time series per hour: 3 * 2000 = 6000

      Effectively, you are paying only for (7000 - 6000) = 1000 because the cost is calculated on the aggregated time series consumed across all the agents running in your environment.

      Control Time Series Ingestion

      For more information on controlling metric usage, see the following:

      Use Cases

      Agent and Remote Write Plan

      See the following example with the following configuration:

      • Two Prometheus Servers

        • Prometheus Server 1 generates 50,000 time series

        • Prometheus Server 2 generates 150,000 time series

      • A Sysdig agent that collects 1000 time series

      • A subscription capacity of 2000 time series

      The billing for the month is calculated as follows:

      Time series usage: Total usage - Subscription capacity

      (50,000 + 150,00 + 1000) - 2000 = 199,000

      If the base price is $7.5 for up to a unit of 1K time series per month, the total base cost is calculated as follows:

      The number of units consumed = (199,000 / 1000) = 199

      The total cost = $7.5 * 199 = $1592.50

      Agents, Remote Write, and Metric Pack Plan

      See the following example with the following configuration:

      • Two Prometheus Servers

        • Prometheus Server 1 generates 50,000 time series

        • Prometheus Server 2 generates 150,000 time series

      • A Sysdig agent that collects 1000 time series

      • 100 metric pack, which is equivalent to 100000 time series

      The billing for the month is calculated as follows:

      Total subscription capacity: Total usage - (subscription capacity + time series from metric pack)

      201,000 - (100,000 + 2000) = 99,000

      If the base price is $7.5 for up to a unit of 1K time series per month and $5 for a metric pack of 1K time series, the total base cost is calculated as follows:

      The number of units consumed = (199,000 / 1000) = 199

      The total cost = Cost of metric pack + cost of total usage

      ($7.5 * 199) + (100 * $5) = $2092.50

      2 -

      About AWS Cloudwatch Licensing

      In the Explore tab or Dashboards of Sysdig Monitor, the number of metrics displayed for each AWS service is limited by the number of agent licenses purchased and/or used, by region.

      The license count:

      • Includes Reserved agents plus On-Demand agents (even if not in use).

      • Is used to determine how many AWS resources are displayed for each service in each region.

      • Is not transferable between different AWS services.

      AWS Service Type Priorities and Limits

      For each AWS service type, services are displayed in the following priority:

      • EC2: Pick instances with agents installed, then instances belonging to ECS, instance is launched before another, alphabetically by instance ID, up to license count.

      • RDS: Pick by creation time, oldest instances first, up to license count.

      • ELB: Pick by number of balanced instances (larger ELBs 1st), then by creation time, oldest first, up to license count.

      • ElastiCache: Sort by name and display up to license count items.

      • SQS: Sort queues by name and pick up to license count number of queues to fetch. Data is shown only for queues that are reporting metrics.

      • DynamoDB: Sort by name and display up to license count items.

      • ALB: Sort by name and display up to license count items.

      For more information on AWS metrics, see AWS in the Metrics Dictionary.

      Sample Use Case

      Suppose you have 200 AWS instances, have purchased 100 Sysdig agent licenses, and have actually installed 50 agents.

      The following limits would apply to your views of AWS services, per region:

      • EC2: The 50 instances with agents installed would be shown first, then 50 more instances, first from EC2, then from ECS, then per uptime.

      • RDS: 100 RDS listings would be shown, oldest first.

      • ELB: 100 ELBs would be shown (largest first), then by creation time, oldest first.

      • ElastiCache: 100 ElastiCache objects would be shown, alphabetically by name.

      • SQS: 100 SQS queues that are reporting metrics would be shown.

      • DynamoDB: 100 DynamoDBs would be shown, alphabetically by name.

      • ALB: 100 ALBs would be shown, alphabetically by name.

      To increase the limit of items in the AWS Services views, contact Sysdig Sales to enable additional resources depending on your license agreement.