Question

A company collects verbose application and system logs from 200 Azure VMs into a single Log Analytics workspace using the Azure Monitor Agent. Compliance requires that security-relevant events be retained, but the operations team reports that ingesting all raw logs is driving costs too high. Approximately 60% of the ingested log volume is low-value debug and informational entries that are never queried. The architect must reduce ingestion cost while keeping the required security events and continuing to use the Azure Monitor Agent. What should the architect recommend?

Accepted Answer

Configure a Data Collection Rule (DCR) with an ingestion-time transformation that filters out the low-value log entries before they are ingested into the workspace.

Answer

Switch the affected tables to the Basic logs plan and set a shorter interactive retention period on the workspace.

Answer

Create a diagnostic setting to route all VM logs to a storage account instead of the Log Analytics workspace.

Answer

Enable a daily ingestion cap on the Log Analytics workspace so ingestion stops once the volume threshold is reached.