> ## Documentation Index > Fetch the complete documentation index at: https://tonelloandco.mintlify.site/llms.txt > Use this file to discover all available pages before exploring further. # Subscription > The Subscription page in Sysdig Secure or Monitor presents information about your current subscription. It shows what options are enabled and provides insight into your usage for the month to date. To access the Subscription page: 1. Log in as administrator to Sysdig Monitor or Sysdig Secure. 2. Select **Settings** > **Subscription** via the user menu in the bottom left corner. Your current subscription information is displayed. ## Subscription Details Under **Subscription Details**, you can find: * Your product: Sysdig Monitor, or Sysdig Platform (Sysdig Secure and Sysdig Monitor). * Your tier. * The contract billing cycle. * The type and number of reserved and on-demand resources included in your Sysdig subscription. ## Usage Under the **Subscription Details** section, you can find the usage for each resource included in your subscription, depending on the product. Platform subscriptions will have **Monitor** and **Secure** resources in their entitlement. **Monitor** and **Secure** resources (related to both, depending on the **Product** and **Tier**): * **Host Agents**: Reserved and on-demand host agents. See [Host Agent Licenses](https://docs.sysdig.com/en/administration/subscription/#host-agents). * **Active host agents deployment type overview**: Currently connected agents breakdown per deployment type. See [Active host agents deployment type overview](https://docs.sysdig.com/en/administration/subscription/#active-host-agents-deployment-type-overview). * **Host Agents - Previous Hour**: Reserved and on-demand for the previous hour. **Monitor** resources: * **Time Series - Previous Hour**: Applicable to Monitor only. See [Time Series Billing](https://docs.sysdig.com/en/time-series-billing). **Secure** resources: * **Units**: Number of units connected. See [Units](https://docs.sysdig.com/en/subscription-secure#units). * **Compute Resources**: Number of Compute Resources across all Cloud accounts. See [Compute Resources](https://docs.sysdig.com/en/subscription-secure#compute-resources). * **Sysdig Sage**: Number of used interactions for the current month, over the entitlement. For more details, see [Sysdig Sage](https://docs.sysdig.com/en/sysdig-sage/). * **Cloud Logs - Month to Date**: Number of analyzed log events per month. See [Cloud Logs](https://docs.sysdig.com/en/subscription-secure#cloud-logs). * **Container as a Service usage**: Container as a Service (CaaS) usage month to date (AWS Fargate, Google Cloud Run, and Azure Container Apps). Applicable to Secure only. See [CaaS usage](https://docs.sysdig.com/en/subscription-secure#container-as-a-service-usage). * **Sysdig Sage**: Number of prompts submitted for the current month, over the available entitlement. For more details, see [Sysdig Sage](https://docs.sysdig.com/en/subscription-secure#sysdig-sage). ## Host Agents Host agents entitlement and usage is reported in two sections: * Host Agents - Current Usage * Active host agents deployment type overview ### Current Usage The section displays the number of currently connected agents, compared to the entitlement. * The bar on the left represents the agents included in the subscription, showing you how many slots you're currently using, compared to those that are available. * On the right, the on-demand bar shows you how many additional agents you can connect, on top of the reserved entitlement. If your contract doesn't include on-demand usage, this will be disabled, meaning that you can only fill the reserved available slots, after which, additional connections will be refused. ### Active Host Agents Deployment Type Overview This bar breaks down the currently deployed agents into different types: * **Containerised**: The number of agents running in a containerized environment. * **Non-containerised** - The number of agents running in a non-containerised environment. * **Unspecified** - The number of agents running in an unknown environment. Update Sysdig Agent to version 12.18.0 or later to receive environment information. ### Agent Connections Agents connect on a first-come, first-served basis. In the event of an over-subscription (more agents wanting to communicate than are licensed), they will attempt to reconnect on a periodic basis. Once an existing communicating instance goes down and disconnects, the next agent in the queue will connect. When shutting down a host for any reason, the agent's license will not be immediately released. This permits the agent to retain its licensing slot for short outages or a reboot. The time-out interval can take up to 20 minutes, and if the connection has not been re-established within the interval the license will be released for use by the next host waiting to connect. The distinction between reserved and on-demand agents is financial, not technical; when on-demand agents are used they perform exactly like reserved agents. ## Secure Subscription The **Subscription** page in Sysdig Secure presents information about your current subscription. It shows what options are enabled and provides insight into your usage for the month to date. To access the Subscription page: 1. Log in as administrator to Sysdig Secure. 2. Select **Settings** > **Subscription** via the user menu in the bottom left corner. Your current subscription information is displayed. If you also have access to Sysdig Monitor, you can see its subscription details by clicking the **Go to Monitor** button on the top right. Read about the content of that page in [Monitor Subscription](https://docs.sysdig.com/en/subscription-monitor). ## Subscription Details Under **Subscription Details**, you can find: * Your product: Sysdig Monitor, or Sysdig Platform (Sysdig Secure and Sysdig Monitor). * Your tier. * The contract billing cycle. * The number of reserved and on-demand resources included in your Sysdig subscription. Specifically regarding the Secure product: * Units * Host Agents (alternative to Units) * Serverless agents (alternative to Units) * Sysdig Sage prompts * Runtime Data Retention ## Download Usage On the Subscription page, click **Download Usage** to download usage history for: * The current month to date. * The current month to date & the previous month. * The current month to date & the previous two months. * The current month to date & the previous six months. This information is formatted as a comma-separated values (CSV) file. Details about the content are available in [Reference: Usage report content](https://docs.sysdig.com/en/docs/administration/subscription/secure-sub/#reference-usage-report-content). ## Usage Under the **Subscription Details** section, you can find the usage for each resource included in your subscription, depending on the product. Platform subscriptions will have **Monitor** and **Secure** resources in their entitlement. **Monitor** and **Secure** resources (related to both, depending on the **Product** and **Tier**): * **Host Agents**: Reserved and on-demand host agents. See [Host Agent Licenses](https://docs.sysdig.com/en/docs/administration/subscription/secure-sub/#host-agent-licenses). * **Active host agents deployment type overview**: Currently connected agents breakdown per deployment type. See [Active host agents deployment type overview](https://docs.sysdig.com/en/docs/administration/subscription/secure-sub/#active-host-agents-deployment-type-overview). * **Host Agents - Previous Hour**: Reserved and on-demand for the previous hour. **Monitor** resources: * **Time Series - Previous Hour**: Applicable to Monitor only. See [Time Series Billing](https://docs.sysdig.com/en/time-series-billing). **Secure** resources: * **Units**: Number of units connected. See [Units](https://docs.sysdig.com/en/docs/administration/subscription/secure-sub/#units). * **Compute Resources**: Number of Compute Resources across all Cloud accounts. See [Compute Resources](https://docs.sysdig.com/en/docs/administration/subscription/secure-sub/#compute-resources). * **Cloud Logs - Month to Date**: Number of analyzed log events per month. See [Cloud Logs](https://docs.sysdig.com/en/docs/administration/subscription/secure-sub/#cloud-logs). * **Container as a Service usage**: Container as a Service (CaaS) usage month to date (AWS Fargate, Google Cloud Run, and Azure Container Apps). Applicable to Secure only. See [CaaS usage](https://docs.sysdig.com/en/docs/administration/subscription/secure-sub/#container-as-a-service-usage). * **Sysdig Sage**: Number of prompts submitted for the current month, over the available entitlement. For more details, see [Sysdig Sage](https://docs.sysdig.com/en/docs/administration/subscription/secure-sub/#sysdig-sage). ## Units Depending on your subscription tier, the **Unit** section may be visible. Here, you can compare Unit usage and entitlement. * The bar on the left shows the connected Units over those reserved. * The bar on the right shows the on-demand Units, if included in the subscription. Units exceeding the reserved entitlement will show up as On-demand Units being used. * The bottom left displays a resource breakdown. Use this to learn how the Units are allocated across the different resource types in the environment: Hosts, Serverless Container instances and Serverless Functions * The bottom right illustrates a further break down where you can see how units are connected for each different resource type. This helps you get the most of your licensing, ensuring all the resources have the full coverage. Units round up to the nearest whole number. ### Historical At the bottom of the **Units** section, you can review how unit consumption has evolved over time to monitor trends, evaluate changes in entitlement, or forecast future needs. * View daily usage for the last 30 days or monthly usage for the last 6 months. * Analyze usage by resource type, for example, **Hosts**, **Serverless Containers**, and **Serverless Functions**. You can also switch the view to **by integration** type to compare **Shield** and **Agentless** Unit consumption. * By Resource * By Integration ## Host Agents Host agents entitlement and usage is reported in two sections: * Host Agents - Current Usage * Active host agents deployment type overview ### Current Usage The section displays the number of currently connected agents, compared to the entitlement. * The bar on the left represents the agents included in the subscription, showing you how many slots you're currently using, compared to those that are available. * On the right, the on-demand bar shows you how many additional agents you can connect, on top of the reserved entitlement. If your contract doesn't include on-demand usage, this will be disabled, meaning that you can only fill the reserved available slots, after which, additional connections will be refused. ### Active Host Agents Deployment Type Overview This bar breaks down the currently deployed agents into different types: * **Containerised**: The number of agents running in a containerized environment. * **Non-containerised** - The number of agents running in a non-containerised environment. * **Unspecified** - The number of agents running in an unknown environment. Update Sysdig Agent to version 12.18.0 or later to receive environment information. ### Agent Connections Agents connect on a first-come, first-served basis. In the event of an over-subscription (more agents wanting to communicate than are licensed), they will attempt to reconnect on a periodic basis. Once an existing communicating instance goes down and disconnects, the next agent in the queue will connect. When shutting down a host for any reason, the agent's license will not be immediately released. This permits the agent to retain its licensing slot for short outages or a reboot. The time-out interval can take up to 20 minutes, and if the connection has not been re-established within the interval the license will be released for use by the next host waiting to connect. The distinction between reserved and on-demand agents is financial, not technical; when on-demand agents are used they perform exactly like reserved agents. ## Compute Resources The Compute Resources bar displays the number of compute instances in the connected Cloud accounts and the Compute Resources in your entitlement. This amount is regularly refreshed and based on the resources in [Inventory](https://docs.sysdig.com/en/sysdig-secure/inventory-resources/). ## Cloud Logs The Cloud Logs section displays the amount of logs processed based on your entitlement and the integrations enabled in your environment. Depending on your subscription, you can view different indicators: * **Month to Date**: Shows the logs processed in the current month compared to your total entitlement. * **Monthly Trend**: Shows how log usage has evolved across different cloud providers over the last 6 months. * Month to Date * Monthly Trend The amount this entitlement refers to is the number of log entries the customer sends from their environment to Sysdig for processing. This therefore doesn’t include anything processed locally by components such as the Sysdig Shield. Using the three-dots menu on the right, you can download a 6-month usage report, including the data up to the current month-to-date. For more details about the content available, see [Reference: Usage report content](https://docs.sysdig.com/en/docs/administration/subscription/secure-sub/#reference-cloud-logs-report-content). ## Container as a Service usage The Container as a Service (CaaS) usage bars display the individual usage of each CaaS type, and the remaining availability, for the current month to date. Three types of CaaS are supported by Sysdig: 1. AWS ECS Fargate, metered per Task 2. Google Cloud Run Container-type Services, metered per instance 3. Azure Container Apps, metered per replica Sysdig only displays the types that are applicable to you, for which we have recorded usage. The entitlement is provided in instances-hours for the month. Each instance connected consumes this availability, with minute-level granularity: * 2 instances connected for 60 minutes count as 2-instances-hour * 2 instances, connected for a total of 30 minutes during the hour, each, count as 1-instance-hour See [Linux on Serverless](https://docs.sysdig.com/en/install-serverless-secure) for more information about serverless agents. ## Sysdig Sage Sysdig Sage is metered per prompt. The bar will show the prompts inputted by users over those included in the subscription for the current month. The following chart displays the **Used** vs. **Available** interactions over the last 6 months. You can monitor usage trends and plan for additional add-ons if needed. Learn more about Sysdig Sage [here](https://docs.sysdig.com/en/sysdig-sage). ## Reference: Usage report content The Usage report contains data across all the different meters in the page, therefore being based on what’s included in the entitlement: * [Standard Columns](https://docs.sysdig.com/en/docs/administration/subscription/secure-sub/#standard-columns), available to everyone * [Time Series Billing Columns](https://docs.sysdig.com/en/docs/administration/subscription/secure-sub/#time-series-billing-columns), available when Time Series billing is enabled (Platform customers only) * [Container as a Service Columns](https://docs.sysdig.com/en/docs/administration/subscription/secure-sub/#container-as-a-service-columns), available when Serverless agents are included in the subscription * [Sysdig Sage Columns](https://docs.sysdig.com/en/docs/administration/subscription/secure-sub/#sysdig-sage-columns), available when Sysdig Sage is included in the subscription. The report has one row per hour, sorted from the most to the least recent. ### Standard Columns Every usage history CSV file has the following columns: | Field name | Description | | - | - | | `customer_id` | Internal Customer ID | | `time_from` | Start time for the hourly usage record (UTC) | | `time_to` | End time for the hourly usage record (UTC) | | `units_used` | Units connected, across all resources and integrations | | `reserved_agents` | Agents included in the license base entitlement | | `on_demand_agents_connected` | Connected on-demand agents for the given period | | `total_agents_connected` | Connected agents, either reserved or on-demand | | `on_demand_agents_limit` | Limit of additional on-demand agents that can be connected | | `cloud_logs_used` | Volume of logs ingested since the beginning of the month | | `compute_resource_limit` | Compute resources included in the entitlement. 0 for Unit-based licenses | | `ec2_instances_used` | Number of AWS hosts connected as of the last scan | | `compute_instances_used` | Number of GCP and OCP hosts connected as of the last scan | | `virtual_machines_used` | Number of Azure hosts as of the last scan | | `cspm_total_compute_resource_count` | Total amount of Cloud hosts connected as of the last scan, for Unit-based licenses | | `agentless_ecs_container_count` | Number of ECS Fargate Tasks connected as of the last scan, for Unit-based licenses | | `agentless_cloud_run_container_count` | Number of Google Cloud Run container instances as of the last scan, for Unit-based licenses | | `agentless_azure_container_count` | Number of Azure Container Apps, as of the last scan, for Unit-based licenses | | `agentless_caas_count` | Total number of Container as a Service instances as of the last scan, for Unit-based licenses | | `agentless_lambda_function_count` | Number of FaaS instances in AWS as of the last scan, for Unit-based licenses | | `agentless_cloud_function_count` | Number of FaaS instances in GCP as of the last scan, for Unit-based licenses | | `agentless_azure_function_count` | Number of FaaS instances in Azure as of the last scan, for Unit-based licenses | | `agentless_faas_count` | Total amount of FaaS instances connected as of the last scan, for Unit-based licenses | ### Time Series Billing Columns The following columns are found in the usage history file when time series billing is enabled, in Platform subscriptions: | Field name | Description | | - | - | | `included_timeseries_per_agent` | Time series per hour included in the agent price | | `prepaid_timeseries` | Pre-paid time series per hour | | `total_reserved_timeseries` | Total entitled time series per hour (included in the agent price and pre-paid) | | `total_used_timeseries` | Time series ingested during the hour | | `used_timeseries_over_reserved` | Time series overage (over total entitled) | ### Container as a Service Columns The following columns are available in the usage history file when Container as a Service (CaaS) billing is enabled, for non-Units-based subscriptions: | Field name | Description | | - | - | | `ecs_fargate_agent_usage_minutes` | Sum of all Fargate Agent workload minutes during the hour | | `gcp_run_agent_usage_minutes` | Sum of all Google Cloud Run Agent minutes during the hour | | `aca_agent_usage_minutes` | Sum of all Azure Container Apps Agent minutes during the hour | | `agent_caas_minutes` | Sum of all Azure Container Apps Agent minutes during the hour | ### Sysdig Sage Columns The following columns are available in the usage history file when Sysdig Sage is enabled: | Field name | Description | | - | - | | `sage_prompts_limit` | Maximum number of allowed prompts | | `sage_prompts_used` | Used number of prompts | ## Reference: Cloud Logs report content The report contains a row per day, with the sum of cloud logs Sysdig received for that day. The following columns are available in the Cloud Logs usage report: | Field name | Description | | - | - | | `date` | Day the logs refer to | | `cloud_logs_used` | Log volume for `date` across all integrations | # Monitor Subscription The **Subscription** page in Sysdig Monitor presents information about your current subscription. It shows what options are enabled and provides insight into your usage for the month to date. To access the Subscription page: 1. Log in as administrator to Sysdig Monitor. 2. Select **Settings** > **Subscription** via the user menu in the bottom left corner. Your current subscription information is displayed. If you also purchased Sysdig Secure, you will be able to see its subscription details by clicking the “Go to Secure” button on the top right. Read about the content of that page in [Secure Subscription](https://docs.sysdig.com/en/subscription-secure). ## Subscription Details Under **Subscription Details**, you can find: * Your product: Sysdig Monitor, or Sysdig Platform (Sysdig Secure and Sysdig Monitor). * Your tier. * The contract billing cycle. * The type and number of reserved and on-demand resources included in your Sysdig subscription. Specifically regarding the Monitor product: * Host Agents * Time Series ## Usage Under the **Subscription Details** section, you can find the usage for each resource included in your subscription, depending on the product. Platform subscriptions will have **Monitor** and **Secure** resources in their entitlement. **Monitor** and **Secure** resources (related to both, depending on the **Product** and **Tier**): * **Host Agents**: Reserved and on-demand host agents. See [Host Agent Licenses](https://docs.sysdig.com/en/docs/administration/subscription/monitor-sub/#host-agent-licenses). * **Active host agents deployment type overview**: Currently connected agents breakdown per deployment type. See [Active host agents deployment type overview](https://docs.sysdig.com/en/docs/administration/subscription/monitor-sub/#active-host-agents-deployment-type-overview). * **Host Agents - Previous Hour**: Reserved and on-demand for the previous hour. **Monitor** resources: * **Time Series - Previous Hour**: Applicable to Monitor only. See [Time Series Billing](https://docs.sysdig.com/en/time-series-billing). **Secure** resources: * **Compute Resources**: Number of Compute Resources across all Cloud accounts. See [Compute Resources](https://docs.sysdig.com/en/subscription-secure#compute-resources). * **Cloud Logs - Month to Date**: Number of analyzed log events per month. See [Cloud Logs](https://docs.sysdig.com/en/subscription-secure#cloud-logs). * **Container as a Service usage**: Container as a Service (CaaS) usage month to date (AWS Fargate, Google Cloud Run, and Azure Container Apps). Applicable to Secure only. See [CaaS usage](https://docs.sysdig.com/en/subscription-secure#container-as-a-service-usage). * **Sysdig Sage**: Number of prompts submitted for the current month, over the available entitlement. For more details, see [Sysdig Sage](https://docs.sysdig.com/en/subscription-secure#sysdig-sage). ## Host Agents Host agents entitlement and usage is reported in two sections: * Host Agents - Current Usage * Active host agents deployment type overview ### Current Usage The section displays the number of currently connected agents, compared to the entitlement. * The bar on the left represents the agents included in the subscription, showing you how many slots you're currently using, compared to those that are available. * On the right, the on-demand bar shows you how many additional agents you can connect, on top of the reserved entitlement. If your contract doesn't include on-demand usage, this will be disabled, meaning that you can only fill the reserved available slots, after which, additional connections will be refused. ### Active Host Agents Deployment Type Overview This bar breaks down the currently deployed agents into different types: * **Containerised**: The number of agents running in a containerized environment. * **Non-containerised** - The number of agents running in a non-containerised environment. * **Unspecified** - The number of agents running in an unknown environment. Update Sysdig Agent to version 12.18.0 or later to receive environment information. ### Agent Connections Agents connect on a first-come, first-served basis. In the event of an over-subscription (more agents wanting to communicate than are licensed), they will attempt to reconnect on a periodic basis. Once an existing communicating instance goes down and disconnects, the next agent in the queue will connect. When shutting down a host for any reason, the agent's license will not be immediately released. This permits the agent to retain its licensing slot for short outages or a reboot. The time-out interval can take up to 20 minutes, and if the connection has not been re-established within the interval the license will be released for use by the next host waiting to connect. The distinction between reserved and on-demand agents is financial, not technical; when on-demand agents are used they perform exactly like reserved agents. ## Monitor Time Series Billing Sysdig Monitor offers transparent Time Series billing with detailed visibility into hourly usage. This page covers the key concepts of time series billing, explains how to identify and understand time series overages, and provides guidance on managing these overages. Time Series billing only applies to time series generated by [Custom Metrics](https://docs.sysdig.com/en/sysdig-monitor/filter-custom-metrics/). For more information on controlling metric usage, see [Reduce Metrics Consumption](https://docs.sysdig.com/en/sysdig-monitor/filter-custom-metrics/#reduce-metrics-consumption). ## Custom Time Series Entitlement Entitlement, sometimes referred to as “Reserved Time Series”, is the maximum number of custom time series included in your Sysdig Monitor subscription before incurring additional charges. You can increase your custom time series entitlement by purchasing additional [Sysdig Agents](https://docs.sysdig.com/en/docs/administration/administration-settings/subscription/#reserved-vs-on-demand-agents) or [time series packs](https://docs.sysdig.com/en/administration/timeseries_billing/#time-series-packs). Custom time series consumption is totaled across all agents in your environment. For billing, whether one agent consumes 3000 time series and the other 1000, or if both agents use 2000 each; the total usage is the same. To check your entitlement, see [View Your Subscription](https://docs.sysdig.com/en/administration/timeseries_billing/#view-your-subscription). ## Custom Time Series Billing Sysdig calculates the time series ingestion overage price in the following way: 1. Sysdig meters total custom time series consumption for each hour. 2. Sysdig compares the hourly custom time series consumption to your hourly custom time series entitlement. 3. Any custom time series ingestion exceeding your hourly limit is considered overage for that hour. 4. Sysdig calculates your monthly bill using the 95th percentile of all hourly overage amounts, so you won’t be charged for brief spikes or occasional high usage periods. For a more detailed example, see [Scenarios](https://docs.sysdig.com/en/administration/timeseries_billing/#scenarios). ### Time Series Packs You can purchase time series packs to increase your custom time series entitlements. A time series pack includes 1000 time series and is charged monthly. For example, if the time series entitlement in your account was 30,000, and you purchased 10 time series packs, the time series entitlement in your account would increase to 40,000. ### Understanding the 95th percentile Time Series Billing Infrastructure often scales up during peak usage or deployment phases, leading to temporary spikes in time series data usage. At Sysdig, we bill based on the 95th percentile of time series usage, meaning the top 5% of the highest usage hours are excluded from billing. For example, in a 30-day month (720 hours), you won’t be charged for your 36 highest usage hours. This allows you to temporarily exceed your time series limit without being penalized for short-term spikes. Let’s say you have an entitlement of 40,000 time series. Between Hour 100 and Hour 125, your usage exceeds this entitlement by 10,000. Since the 25 hours of overage fall within the 36-hour grace period, you will not be charged for the overage. | Hour | Time Series Utilization | | - | - | | 1 | 35000 | | 2 | 35000 | | … | 35000 | | 99 | 35000 | | 100 | 50000 | | … | 50000 | | 125 | 50000 | | 126 | 35000 | | … | 35000 | | 720 | 35000 | ## Monitor Time Series Usage ### View Your Subscription To view your custom time series consumption: 1. Log in to Sysdig Secure or Sysdig Monitor as an Admin. 2. Open the User Menu and select **Settings** > **Subscription**. The following details can be seen: * **Subscription Details**: Under **Reserved**, you can see the number of reserved agents and the number of time series included with the agents. * **Host Agents - Current Usage**: The number of agents currently deployed. In Monitor, you can select **Agent Dashboard** to view individual time series consumption by agent, metrics type, and so on. * **Time Series - Previous Hour**: The total number of time series consumed across all agents in the previous hour. You will see the total custom series entitlement and time series usage against your entitled amount, along with any time series overage beyond your entitlement. * In Monitor, you can click **Usage Dashboard** to view details on the total time series consumption for your account. * You can also use the menu to download a Comma-separated values (CSV) file of your hourly usage. See [Download Usage](https://docs.sysdig.com/en/time-series-billing/#download-usage). ### Time Series Usage Dashboard Sysdig Monitor provides a **New Time Series Usage Dashboard** with insight into your time series usage data. You can view time series ingestion at a glance to discover and analyze trends. To help you identify the usage trends that are important to you, Sysdig additionally provides the following metrics: * `sysdig_ts_usage`: The metric reports the number of time series ingested in a 20-minute interval. This metric can be segmented into metric categories as well. * `sysdig_ts_usage_10s`: The metric reports the number of time series ingested in every 10-second window, per host (agent), and per metric category. ### Download Usage You can download the hourly usage report as a CSV file. On the top right of the **Subscription** page, select **Download Usage**. ## Calculate Time Series Usage Time series usage is calculated by using the `sysdig_ts_usage` metric. The metric reports the number of time series ingested in an hour (sum of the maximum of three 20 minutes). For each hour, the number of time series ingested is calculated, and then the value is deducted from the number of reserved time series. This value is stored as the usage record. Sysdig uses the 95th percentile to calculate the exceeding cost of usage. At the end of the month, the 95th percentile of the total number of active series ingested per hour is calculated. Calculating the 95th percentile reduces the chances of billing you for unexpected spikes caused by time series [churns](https://docs.sysdig.com/en/administration/timeseries_billing/#churn-rate). ### Churn Rate When a time series stops receiving new data points, it becomes inactive. This event is called time series churn. It occurs more often during an upgrade in a Kubernetes cluster or when containers are replaced by new ones. Restarts, redeploys, and dynamic workloads also cause churn and generate additional time series. For example, in cases where the `container_id` label in a container metric changes, all the existing time series are subsequently replaced by new time series (with the new `container_id` value). The churn rate is the number of time series that churn over time. Sysdig uses the `sysdig_ts_usage_10s` metric to analyze these scenarios. The **New Time Series Usage Dashboard** provides a ratio of time series detected at 1-hour period and 10-second period. This ratio is known as the churn percentage and it is expressed as this PromQL query: ``` (sum (sysdig_ts_usage{metric_category!='PROMETHEUS_REMOTE_WRITE'}) - sum (sysdig_ts_usage_10s)) / sum (sysdig_ts_usage{metric_category!='PROMETHEUS_REMOTE_WRITE'}) * 100 ``` Time series collected by Prometheus Remote Write are excluded from this ratio because they are not collected by the Sysdig agent. ## Scenarios ### On-Demand Time Series Consumption Let’s say you have a Sysdig Monitor account that primarily consumes metrics from downstream Prometheus servers via Prometheus Remote Write. As such, you have only licensed the account for one Sysdig Agent, which entitles your account to 2,000 time series. Assuming the following volume examples: * Two Prometheus Servers sending metrics to Sysdig via Remote Write * Prometheus Server 1 generates a `50,000` time series consistently every hour during a month * Prometheus Server 2 generates a `150,000` time series consistently every hour during a month * One Sysdig agent which collects `1000` time series consistently every hour during a month The time series billing for the month is calculated as follows: * Time series usage is the same for every hour: **Total custom time series consumed** - **Subscription entitlement** = `(50,000 + 150,000 + 1,000) - 2,000 = 199,000` On-demand time series pricing is measured in blocks of 1000 time series per month. To determine the amount of on-demand time series you will be billed for, divide the total time series usage from the above calculation and divide by 1000: * The number of on-demand units consumed = `(199,000 / 1000) = 199` Assuming an on-demand time series price of \$7.5 for **one unit of 1000 time series**, the total monthly cost for this use case is `$7.5 * 199 = $1592.50` per month. ### Metric Packs Time Series Consumption Extending the above example, you can see how purchasing individual time series packs will extend your time series entitlement. Assume: * Two Prometheus Servers: * Prometheus Server 1 generates `50,000` time series * Prometheus Server 2 generates `150,000` time series * One Sysdig agent that collects `1000` time series * `100` pre-purchased time series packs, which is equivalent to `100,000` time series The billing for the month is calculated as follows: * Total subscription capacity: (**Total time series consumption** - (**time series entitlement from time series pack** + **subscription entitlement**)) = `(50,000 + 150,000 + 1,000) - (100,000 + 2,000) = 99,000` **Pre-purchased time series packs also entitle you to 1000 time series per month per pack**. Assuming the pre-purchase price for time series packs is \$5 (\$2.50 less per 1000 time series than the on-demand usage price), and you’ve purchased 100 packs, that brings your pre-purchase time series entitlement cost to **\$500** per month. To calculate your overall monthly cost, you would determine the total time series entitlement subtracted from the total time series consumed, then include the amount already paid for in pre-paid time series packs. Any resulting time series overage beyond the included entitlement plus the pre-purchased time series pack entitlement would be billed at the on-demand rate (stipulated in your contract) for each 1000 time series block. * Total number of time series consumed = `(50,000 + 150,000 + 1,000) = 201,000` * Total time series entitlement: `(100,000 + 2,000) = 102,000` * Time series overage: `(201,000 - 102,000) = 99,000` * On-demand time series cost: `(99,000 / 1,000) * 7.50 = $742.50` (you would be purchasing 99 1000-packs of on-demand time series as the overage above what is already covered by your entitlement) * Total monthly time series cost = Cost of pre-purchased time series packs + cost of total overage: `($500 + $742.50) =` **\$1,242.50** ## AWS CloudWatch Licensing In the **Explore** and **Dashboards** tabs of Sysdig Monitor, the number of metrics displayed for each Amazon Web Services (AWS) service is limited by the number of agent licenses purchased and/or used, by region. The license count: * Includes Reserved agents plus On-Demand agents (even if not in use). * Is used to determine how many AWS resources are displayed for each service *in each region*. * Is not transferable between different AWS services. ## AWS Service Type Priorities and Limits For each AWS service type, services are displayed in the following priority: * **Elastic Compute Cloud (EC2):** Pick instances with agents installed, then instances belonging to Elastic Container Service (ECS), instance is launched before another, alphabetically by instance ID, up to license count. * **Relational Database Service (RDS):** Pick by creation time, oldest instances first, up to license count. * **Elastic Load Balancer (ELB):** Pick by number of balanced instances (larger ELBs 1st), then by creation time, oldest first, up to license count. * **ElastiCache:** Sort by name and display up to license count items. * **Simple Queue Service (SQS):** Sort queues by name and pick up to license count number of queues to fetch. Data is shown only for queues that are reporting metrics. * **DynamoDB:** Sort by name and display up to license count items. * **Application Load Balancer (ALB):** Sort by name and display up to license count items. For more information on AWS metrics, see [AWS](https://docs.sysdig.com/en/cloud-provider-aws/) in the Metrics Dictionary. ## Sample Use Case Suppose you have 200 AWS instances, have purchased 100 Sysdig agent licenses, and have actually installed 50 agents. The following limits would apply to your views of AWS services, per region: * **EC2:** The 50 instances with agents installed would be shown first, then 50 more instances, first from EC2, then from ECS, then per uptime. * **RDS:** 100 RDS listings would be shown, oldest first. * **ELB:** 100 ELBs would be shown (largest first), then by creation time, oldest first. * **ElastiCache:** 100 ElastiCache objects would be shown, alphabetically by name. * **SQS:** 100 SQS queues that are reporting metrics would be shown. * **DynamoDB:** 100 DynamoDBs would be shown, alphabetically by name. * **ALB:** 100 ALBs would be shown, alphabetically by name. To increase the limit of items in the AWS Services views, contact [Sysdig Sales](https://sysdig.com/contact/) to enable additional resources depending on your license agreement.