Subscription
Try all of Sysdig’s features for free; when you are ready to upgrade,
contact Sysdig sales.
See also: Getting Started with Sysdig
Monitor
and Getting Started with Sysdig
Secure.Getting
Started with Sysdig Monitor
Subscription Types
Free Tier
With Free Tier, use *Sysdig Secure for cloud
*functions free forever:
For one single account in one cloud region (AWS for v1)
Manage cloud posture with a daily run of CIS Benchmarks
Detect threats with out-of-the-box CloudTrail detection rules based
on Falco
Scan containers (ECR/Fargate) automatically and within your cloud
environment for up to 250 images a month
30-Day Trial
Test all the features of Sysdig Monitor and/or Sysdig Secure with the
free 30-day trial.
After 30 days, your account will be disabled and you can contact Sysdig
sales to upgrade to an Enterprise license.
Enterprise Tier
You can license Sysdig Secure, Sysdig Monitor, or both (Sysdig
Platform). For details, see https://sysdig.com/pricing/.
Review Current Subscription
Log on as Administrator to Sysdig Monitor or Sysdig Secure.
From the Selector button in the left-hand navigation, choose
Settings > Subscription
.
Your current plan details are displayed.

You can license each of these elements independently:
Sysdig agents (host agents)
Cloud accounts (Secure only, see also: Data
Sources)
Fargate tasks/serverless agents (Secure only, see also
Serverless Agents)
The number of licenses purchased has the following effects on how Sysdig
is used:
The agent count defines the maximum number of connected host
agents you can deploy. E.g if you purchase 100 licenses, you can
install 100 agents.
- In AWS Service Monitoring powered by Cloudwatch, it also
determines the number of AWS objects that can be viewed in the
Sysdig Monitor Dashboards (unrelated to the number of agents
actually installed). In other words, if you have 100 licenses
purchased, you can only see 100 AWS objects per region, per
service type.
**Fargate Tasks using Sysdig Serverless Agents: ** Defines the
number of serverless agents connected to Sysdig backend.
Cloud accounts- licensed number: Number of cloud accounts you
can connect to Sysdig backend.
About Host Agent Licenses
Reserved vs On-Demand Agents
The distinction between reserved and on-demand agents is financial, not
technical; when on-demand agents are used they perform exactly like
reserved agents.
Reserved Agents
Reserved agents are dedicated agents that are provisioned for a user
regardless of usage. You can purchase reserved agents on a monthly or
annual basis. As a Sysdig SaaS account administrator, you can increase
your reserved agents at any time from within the Sysdig application.
On-Demand Agents
On-demand agents are for short-term use and you pay only for what you
use at an hourly rate. You have the ability to add and control on-demand
agents. For example, an organization might schedule scale testing for
two days and license an extra 500 on-demand agents for that time frame.
In the Sysdig application, use the Customize Your Plan >
Enable On-demand Agents option on the
Subscription page to add
or remove agents. There is a hard limit of 500 agents for any account.
If the total of reserved and on-demand exceeds this limit, you will not
be able to purchase additional agents. On-demand agents are available
only in Sysdig SaaS applications.
Connect Agents to the Backend
The Sysdig platform uses a concurrent licensing model in determining
when to allow an installed agent to connect to the back-end servers and
report on host metrics. This means you can install Sysdig agents onto
any number of instances. However, only the licensed number of agents
will be allowed to connect and send metrics for recording and reporting.
Agents connect on a “first-come, first-served” basis and in the event of
an over-subscription (more agents wanting to communicate than are
licensed) they will attempt to reconnect on a periodic basis. Once an
existing communicating instance goes down and disconnects, the next
agent attempting to connect will be allowed in.
To avoid having agents refused connection due to over-subscription,
monitor the number of established and allowed connections. To see how
many licenses are in use, see the Settings > Subscription page.
Use this information to either purchase additional license capacity from
the UI, or to shut down lower-priority agents via normal orchestration
and system administration means.
Technical Details
Multiple Installs: An agent is essentially an “install” of the
software. If your system changes external IP addresses, or if you shut
down a VM image and bring it back up elsewhere, this will remain the
same agent connection. However, identical installs that are
simultaneously sending data (usually an accident) will be considered two
connections. A MAC address is used to identify a host for licensing
purposes.
Time Lag for License Release: When shutting down a host for any
reason, the agent’s license will not be immediately released. This
permits the agent to retain its licensing slot for short outages or a
reboot. The time-out interval can take up to 20 minutes, and if the
connection has not been re-established within the interval the license
will be released for use by the next host waiting to connect.
1 -
Time Series Billing
Sysdig Monitor allows you to consume custom metrics through a flexible
and cost-effective Time Series Billing model aligned with your usage.
With the enhanced billing experience, you can view your time-series
consumption at a glance, analyze trends, and change subscription plans
if need be.
Use the Sysdig Subscription page to control your licensing, and
thereby usage and spending. Based on your current subscription tier,
time-series usage, and the number of active agents, you can estimate the
bill and take further actions.
Time Series Billing works only in SaaS environments and is not currently
available in on-prem environments.
Benefits of Time Series Billing
You consume more than the per-agent limit because Time Series
Billing accounts for the following:
See Use
Cases
for more details.
Previously, the technical limit was 10K, no PAYG and metrics packs
mechanisms, no system in place to bill metrics collected outside
agents.
Validate what you are being charged on, understand and control
metric usage, and drop the data that is not required, either by
metric or by the scope of the metric. See Control Time Series
Ingestion.
Pay as you go and metric pack.
Consume Time Series
Time series consumption is calculated by using the reserved time
series
included in the subscription. The basic plan includes 2000 time series
per agent, and you can purchase more by adding on-demand
agents
or metric
packs.
Sysdig meters and bills only custom metrics.
Prometheus
JMX
StatsD
App checks
Reserved Time Series
The number of time series included with the subscription. The value is
calculated as
(the number of reserved agents + the number of connected on-demand agents) * the number of time series per agent
.
Time series consumed beyond your subscription limit will be charged and
is aggregated across all agents running in your environment. What it
means is that you can consume 3000 metrics on an agent and 1000 on
another without incurring additional charges.
Contact Sales to purchase beyond your subscription limit.
Time Series Billing limit of 2000 is applicable only to custom metrics,
while Sysdig and Sysdig KSM are included at no additional charges.
Metric Pack
A metric pack includes 1000 time series and is charged per month.
View Your Subscription
Time Series Visualization
To help you so, Sysdig provides an at-a-glance visualization of the
following:

Time Series Usage
Reserved: See Reserved Time
Series.
Overage: Time series ingested beyond Reserved time series is
Overage.
Ingested: The time series that are collected, analyzed,
processed for storage.
Time Series Usage Dashboard
Reserved and On-Demand Agents
Agent Usage Dashboard
Usage history in CSV format
Edit Subscription
On the Subscription page, under Subscription Details , click
the three dots.
Click Edit Subscription.
The Subscription Plan page gives you the directions to change the
subscription plan.
Monitor Time Series Usage
Time Series Metrics
To help you identify the usage trends that are important to you, Sysdig
provides the following metrics:
sysdig_ts_usage
: The metric reports the number of time series
ingested for a user in a 20-minutes interval. The dashboard reports
the 1-hour usage, which is the sum of the maximum of three
20-minute sysdig_ts_usage
measurements taken in an hour. This
metric can be segmented on metric categories as well.
sysdig_ts_usage_10s
: The metric reports the number of time series
ingested for a user in every 10-seconds window, per host (agent),
and per metric category.
Download Usage
You can download the usage report in a CSV file. On the Subscription
page, under Subscription Details, click Download Usage to
download a copy of the usage report. You can view the following:
User ID
Time
Number of Reserved Agents
Number of Connected On-Demand Agents
Time Series included per agent
Total used time series
The ratio of used and reserved time series
Time Series Usage Dashboard

Sysdig provides a Time Series Usage Dashboard with insight into the
usage data. You can view time series ingestion at a glance and discover
and analyze trends. The dashboard shows the average number of active
time series per host; current ingestion rate; churn percentage; and so
on.
Access the Time Series Dashboard
On the Subscription page, under Usage, click Time Series
Dashboard. You can view the following:
Current 1 Hour Ingestion
Current Ingestion from Agents
Churn Percentage
The average number of time series per host
The number of time series ingested per category
Host-level ingestion
Calculate Time Series Usage
Time series usage is calculated by using the sysdig_ts_usage
metric.
The metric reports the number of time series ingested for a user in an
hour (sum of the maximum of three 20-minutes). For each hour, the number
of time series ingested is calculated, and then the value is deducted
from the number of reserved time series. This value is stored as the
usage record.
An hour period is considered in order to take the
churn
into account. Sysdig uses the sysdig_ts_usage_10s
metric to calculate
the spikes caused by
churns
and provides you the churn percentage in the dashboard.
Sysdig uses the 95th percentile to calculate the exceeding cost of
usage. At the end of the month, the 95th percentile of the total number
of active series ingested per hour is calculated. Calculating the 95th
percentile reduces the chances of billing you for unexpected spikes
causes by churns.
Churn Rate
When a time series stops receiving new data points, it becomes inactive.
This event is called time series churn. It occurs more often during an
upgrade in a Kubernetes cluster or when containers are replaced by new
ones. Restarts, redeploys, dynamic workloads also cause churn and
generate additional time series.
In such cases, the container_id
label in a container metric changes,
and subsequently, all the existing time series are replaced by new time
series (with the new container_id
value).
The churn rate is the number of time series that churn over time. Sysdig
uses the sysdig_ts_usage_10s
metric to analyze these scenarios.
The Time Series Usage Dashboard provides a ratio of time series detected
at 1-hour period and 10-seconds period. This ratio is known as the churn
percentage and it is expressed as this PromQL query:
(sum(sysdig_ts_usage{metric_category!='PROMETHEUS_REMOTE_WRITE'}) - sum(sysdig_ts_usage_10s)) / sum(sysdig_ts_usage{metric_category!='PROMETHEUS_REMOTE_WRITE'}) * 100
The time series collected by Prometheus Remote Write are excluded from
this ratio because they are not collected by the Sysdig agent.
Example
The billing is calculated per month. A basic subscription will provide
you 2000 time series per agent. This limit is applicable only to custom
metrics, while you can continue consuming Sysdig and KSM metrics without
incurring additional costs. Time series consumed beyond your
subscription limit will be charged and is aggregated across all agents
running in your environment.
For example, if you have three agents running with the following
consumption:
Agent 1 collecting 2000 time series per hour
Agent 2 collecting 1000 time series per hour
Agent 3 collecting 4000 time series per hour
Time series billing is calculated as follows:
Total consumption = 7000
Allowed number of time series per hour: 3 * 2000 = 6000
Effectively, you are paying only for (7000 - 6000) = 1000
because the
cost is calculated on the aggregated time series consumed across all the
agents running in your environment.
Control Time Series Ingestion
For more information on controlling metric usage, see the following:
Use Cases
Agent and Remote Write Plan
See the following example with the following configuration:
The billing for the month is calculated as follows:
Time series usage: Total usage - Subscription capacity
(50,000 + 150,00 + 1000) - 2000 = 199,000
If the base price is $7.5 for up to a unit of 1K time series per
month, the total base cost is calculated as follows:
The number of units consumed = (199,000 / 1000) = 199
The total cost = $7.5 * 199 = $1592.50
Agents, Remote Write, and Metric Pack Plan
See the following example with the following configuration:
Two Prometheus Servers
Prometheus Server 1 generates 50,000
time series
Prometheus Server 2 generates 150,000
time series
A Sysdig agent that collects 1000
time series
100
metric pack, which is equivalent to 100000
time series
The billing for the month is calculated as follows:
Total subscription capacity: Total usage - (subscription capacity + time
series from metric pack)
201,000 - (100,000 + 2000) = 99,000
If the base price is $7.5 for up to a unit of 1K time series per
month and $5 for a metric pack of 1K time series, the total base
cost is calculated as follows:
The number of units consumed = (199,000 / 1000) = 199
The total cost = Cost of metric pack + cost of total usage
($7.5 * 199) + (100 * $5) = $2092.50
2 -
About AWS Cloudwatch Licensing
In the Explore
tab or Dashboards
of Sysdig Monitor, the number of
metrics displayed for each AWS service is limited by the number of agent
licenses purchased and/or used, by region.
The license count:
Includes Reserved agents plus On-Demand agents (even if not in use).
Is used to determine how many AWS resources are displayed for each
service in each region.
Is not transferable between different AWS services.
AWS Service Type Priorities and Limits
For each AWS service type, services are displayed in the following
priority:
EC2: Pick instances with agents installed, then instances
belonging to ECS, instance is launched before another,
alphabetically by instance ID, up to license count.
RDS: Pick by creation time, oldest instances first, up to
license count.
ELB: Pick by number of balanced instances (larger ELBs 1st),
then by creation time, oldest first, up to license count.
ElastiCache: Sort by name and display up to license count items.
SQS: Sort queues by name and pick up to license count number of
queues to fetch. Data is shown only for queues that are reporting
metrics.
DynamoDB: Sort by name and display up to license count items.
ALB: Sort by name and display up to license count items.
For more information on AWS metrics, see
AWS in the Metrics
Dictionary.
Sample Use Case
Suppose you have 200 AWS instances, have purchased 100 Sysdig agent
licenses, and have actually installed 50 agents.
The following limits would apply to your views of AWS services, per
region:
EC2: The 50 instances with agents installed would be shown
first, then 50 more instances, first from EC2, then from ECS, then
per uptime.
RDS: 100 RDS listings would be shown, oldest first.
ELB: 100 ELBs would be shown (largest first), then by creation
time, oldest first.
ElastiCache: 100 ElastiCache objects would be shown,
alphabetically by name.
SQS: 100 SQS queues that are reporting metrics would be shown.
DynamoDB: 100 DynamoDBs would be shown, alphabetically by name.
ALB: 100 ALBs would be shown, alphabetically by name.
To increase the limit of items in the AWS Services views, contact
Sysdig Sales to enable additional
resources depending on your license agreement.