How to Choose an APM Tool for Engineering Teams: Features, Pricing & Deployment

An application performance monitoring (APM) tool measures how your services behave in production. APM tools measure request latency, error rates, throughput, and the infrastructure conditions underneath them. The tool you pick shapes two outcomes that pull against each other: your MTTR when an incident hits, and how predictable your observability bill stays.

Vendors that bill on data volume penalize complete collection. Teams that ration collection to control spend trade cost risk for blind spots during incidents.

What follows: definitions; baseline capabilities and metrics; a six-tool comparison; pricing; deployment; Kubernetes collection; AIOps; a selection framework; and an FAQ.

What is an APM tool (and how it differs from observability)

APM ties application behavior to business outcomes: whether a checkout completes, how long a user waits, which service caused the error. Gartner defined APM in 2022 as software that “enables the observation of application behavior and its infrastructure dependencies, users and business key performance indicators (KPIs) throughout the application’s life cycle.”

Observability is the broader property. Gartner renamed its Magic Quadrant to “Observability Platforms” in 2024, explaining that “observability platforms convert telemetry into insight and action using analytics, visualization, automation and increasingly, AI. Most include application performance monitoring capabilities, but APM is not enough.” The CNCF TAG Observability whitepaper draws the same line: monitoring detects known unknowns, while observability lets you reason about unknown unknowns using traces together with log and metric data.

Infrastructure monitoring is narrower still. It captures the health and resource utilization of servers, containers, network devices, and storage, but stops short of tracing requests through application code. A practical APM evaluation should test whether a tool covers application traces and infrastructure context while connecting the observability signals between them.

Core features every APM tool should cover

Six capabilities form the baseline for any APM tool evaluation. Missing any one of them pushes the work back onto engineers during an incident.

• Real user monitoring (RUM): Captures actual browser and mobile sessions in production, including page load times and user interactions.
• Synthetic monitoring: Runs scripted checks against endpoints and workflows from managed locations, before and after release.
• Distributed tracing: Follows a single request across every service it touches, exposing inter-service latency.
• Error tracking: Groups exceptions, surfaces new error types, and links them to the deploy that introduced them.
• Infrastructure monitoring: Connects host and container metrics to the application symptoms above them.
• Anomaly detection: Flags deviations from baseline behavior without hand-tuned thresholds.

Real user monitoring vs synthetic monitoring

RUM records real-user experience; synthetic monitoring tests availability and performance under controlled conditions before users encounter a failure. RUM instruments the browser and answers questions like “which region saw slow checkouts last night.”

Synthetic tests run scripted API and browser checks, including complete workflow checks, on a schedule, so you catch a broken login flow at 3 AM before a customer does. You need both: RUM cannot alert on a page nobody has visited yet, and synthetic checks cannot reveal how a real session degraded under load.

Distributed tracing and infrastructure monitoring

An engineer can use distributed tracing to map a latency complaint to a specific span and service. eBPF-based approaches like groundcover’s Flora sensor capture requests at the kernel with no per-service instrumentation.

Infrastructure monitoring becomes diagnostic only when it links host-level metrics to application symptoms. In Kubernetes, that means knowing which node’s memory pressure caused which pod eviction, which caused which trace to fail. groundcover attaches Kubernetes topology to every signal natively.

Key metrics to track

Four metric families form the evaluation baseline for APM tools. Percentile granularity and retention length also set the cost side, since vendors price resolution and history separately.

• Response time and latency: Measure at the percentile level, not the average. Granularity matters: CloudWatch retains sub-60-second data for only 3 hours before rollup.
• Error rates: Track by service and by deploy, so a regression maps to a change.
• Throughput: Requests per second per service establishes the baseline that anomaly detection works against.
• CPU and resource usage: Includes the observability tooling itself; agents compete with production workloads for node resources.

Retention and cardinality carry cost consequences. Datadog bills custom metrics at $5.00 per 100 per month, where every unique tag combination counts as a new metric.

Leading APM tools at a glance

The table below compares the six tools on deployment, pricing, and collection architecture:

Four of the six include data-volume meters. groundcover’s flat per-node rate and AppDynamics’ per-vCPU rate instead tie their primary billing units to infrastructure size.

How the top APM tools compare

The six tools split along two axes: how they collect telemetry through language agents or cloud-native collection, including eBPF, and how they bill through consumption, ingest plus seats, modular usage, or flat per node. Collection determines instrumentation effort and coverage gaps; billing determines whether costs scale with data volume or with infrastructure size.

Dynatrace

Dynatrace bills through the Dynatrace Platform Subscription (DPS), a consumption model that meters each capability separately. Vendor-stated pricing puts Full-Stack Monitoring at $0.01 per memory GiB-hour, roughly $58 per month for an 8 GiB host; log ingest adds $0.20/GiB with separate retain and query charges; Dynatrace rounds usage up to the nearest 15 minutes. One useful Kubernetes exception: pods on Full-Stack monitored hosts with OneAgent v1.301+ incur no additional pod-hour charge.

DPS requires capability-level usage modeling, which makes quarterly forecasting harder than a fixed per-node model. One practitioner noted, “we cannot know before instrumenting the application, how much this will cost.” Model consumption per capability before signing.

New Relic

New Relic charges on two meters: data and people. Vendor-stated ingest costs are $0.40/GB for Original Data or $0.60/GB for Data Plus beyond 100 GB free per month, and full platform users cost $349/user/month on annual Pro terms or $418.80 month-to-month, with Core users at $49. Data Plus has climbed from $0.50/GB at its June 2022 launch to $0.60/GB today. Collection spans language agents and native OTLP, with Pixie eBPF for Kubernetes; the APM and OpenTelemetry convergence reached GA on July 21, 2025 with “100% native OTLP support with no proprietary agent/SDK requirements.”

Dual meters mean both data growth and headcount growth raise the bill. New Relic delivers platform breadth; teams must model both billing dimensions to forecast spend.

Datadog

Datadog prices each product as a separate module. Vendor-stated APM pricing runs $31–$40 per host per month annually, or $36–$48 month-to-month, depending on tier, plus $0.10/GB for ingested spans beyond the 150 GB per-host allotment and $1.27–$2.50 per million indexed spans on annual terms, by retention window. Custom metrics, log ingestion, log indexing, RUM sessions, and synthetic runs all meter separately, and Datadog counts billable hosts with a high-watermark plan that takes the maximum of the lower 99% of hourly readings. Collection requires language-specific APM agents; Datadog uses eBPF in Universal Service Monitoring, Network Monitoring, and security products rather than for universal telemetry.

Two external analyses document the cost outcomes at scale. Datadog’s Q1 2023 earnings call confirmed a $65 million bill from a cryptocurrency customer that reporters later identified as Coinbase, and a Redress Compliance analysis of 20–25 contracts found custom metrics and log indexing account for 30–50% of total spend.

Datadog fits teams that need one vendor across infrastructure and application monitoring, including security, provided they staff ongoing billing governance. Without it, cardinality and indexing decisions made by individual engineers become budget decisions.

AppDynamics

Cisco’s roadmap positions AppDynamics for traditional three-tier applications and Splunk Observability Cloud for microservices. AppDynamics is now Splunk AppDynamics, following Cisco’s $28 billion Splunk acquisition in March 2024, and a Combined Agent supports AppD-only, dual, and Splunk-only modes to ease migration between the two.

Vendor-stated pricing is per vCPU per month, billed annually: $6 for Infrastructure Edition, $33 for Infrastructure plus APM (Premium), and $50 for Enterprise with Business Analytics. Deployment options include SaaS and two on-premises models, including a Kubernetes-based virtual appliance; collection is agent-based with language-specific instrumentation.

AppDynamics fits estates with existing Cisco enterprise agreements and traditional self-managed applications, and the on-premises option matters for regulated environments. Cisco routes Kubernetes-first teams toward Splunk Observability Cloud, so evaluate that product rather than AppDynamics for microservices.

CloudWatch

Default X-Ray sampling records the first request each second plus 5% of additional requests, and AWS acknowledges that “static sampling does not react to runtime anomalies and can result in missing traces during short-lived failures.” AWS retains X-Ray traces for 30 days and does not let customers change that period, and segment documents cap at 64 KB.

AWS put the X-Ray SDKs into maintenance mode on February 25, 2026, and recommends a transition to OpenTelemetry.

CloudWatch is the default for AWS-native workloads because it requires no additional vendor relationship. Vendor-stated APM pricing includes Application Signals ingestion at $0.35/GB for the first 10 TB, X-Ray traces at $5.00 per million recorded, custom metrics from $0.30 down to $0.02 each by volume, and log ingestion at $0.50/GB standard.

CloudWatch is a sound baseline for AWS-only estates and mandatory for AWS service metrics regardless of your APM choice. The sampling defaults, fixed retention, and absence of cross-cloud depth mean most engineering teams run it alongside a purpose-built APM tool rather than instead of one.

groundcover

groundcover changes both axes at once. The eBPF sensor deploys as a single Kubernetes DaemonSet, one pod per node, and captures logs, metrics, traces, Kubernetes events, network calls, and HTTP requests directly from the Linux kernel. No SDKs, no language-specific agents, no application restarts. OpenTelemetry is a first-class data source alongside the eBPF signals, so existing OTel instrumentation coexists with eBPF-captured data in one interface.

The deployment architecture is BYOC, Bring Your Own Cloud: the data plane, including ClickHouse for logs, traces, and events and VictoriaMetrics for metrics, runs inside your cloud account. groundcover manages the control plane for the UI and orchestration services, including its APIs.

According to the current vendor profile, pricing is flat per monitored node: Free at $0, Pro at $30, Pro+/Enterprise at $35, and Enterprise On-Premises at $50 per host per month, with all paid capability modules included under the current packaging model. There are no per-GB, per-seat, or per-metric charges, so data volume and user count, including custom metric cardinality, do not change the per-node unit price.

groundcover fits Kubernetes-native teams and regulated industries that need data sovereignty. Its scope is narrow by design: Linux and Kubernetes workloads only, with Kubernetes 1.21+ and kernel 4.16+ required; groundcover supports EKS, AKS, and GKE.

Pricing models and total cost of ownership

Budget owners can use the billing unit to anticipate where costs will grow. Per-host models, including Datadog infrastructure at $15–$27/host and AppDynamics per vCPU, scale with fleet size but meter APM, logs, and metrics separately.

Per-ingestion models, including New Relic per-GB, CloudWatch logs, and Dynatrace log analytics, scale with data volume, which grows faster than infrastructure: telemetry volumes grew an average of 3.7x year over year, and 54% of enterprises saw their data triple in twelve months (Apica/Omdia 2026). Dynatrace DPS meters every capability hourly, precise at the hour, hard to forecast at the quarter. groundcover’s flat per-node pricing scales only with node count.

Retention adds a second cost surface. Datadog keeps traces 15 days by default, X-Ray holds them 30 days with no adjustment, and Dynatrace bills metric retention beyond 15 included months. Under BYOC, retention lives in your own ClickHouse and VictoriaMetrics storage, limited by your storage budget rather than a vendor rate card.

Production case studies show what happens when teams fail to forecast telemetry growth. A 2025 InfoQ Skyscanner case study reported over 90% telemetry cost reduction once teams saw their own storage and collection costs. Gartner-reported figures put logs at more than 50% of observability spend, with 36% of Gartner clients spending over $1 million a year.

Model next year’s bill assuming telemetry doubles, then identify which pricing model remains within your budget. BigBasket cut observability spend 50% while expanding coverage to development and testing environments, because added volume carried no marginal cost.

Deployment models: SaaS, self-hosted, on-premise

Match the deployment model to your compliance constraints before comparing features, because several options eliminate vendors outright:

• SaaS only: New Relic runs exclusively as SaaS in US and EU regions. Datadog is SaaS with BYOC for logs only (CloudPrem, announced June 2025); metrics, traces, and RUM still leave your environment.
• Managed on-premises: Dynatrace Managed runs the full platform in your data center with all monitoring data on your infrastructure.
• Self-managed: Splunk AppDynamics offers classic on-premises and a self-hosted virtual appliance, with no vendor access to collected data.
• BYOC and air-gapped: groundcover’s data plane runs in your cloud account at every tier including free; fully on-premises deployments can also keep sensors, backend services, and authentication inside an air-gapped environment.

For HIPAA and GDPR, check the fine print. New Relic’s HIPAA eligibility requires Enterprise with Data Plus, Dynatrace holds FedRAMP Moderate and has stated its intent to pursue FedRAMP High but has not received authorization, and Datadog achieved FedRAMP High in May 2026. BYOC shifts the question: telemetry containing payloads and PII never leaves your account, so the vendor’s certification scope shrinks to the control plane.

APM for microservices and Kubernetes at scale

Kubernetes amplifies both the collection problem and the billing problem. Pods are ephemeral, so per-pod agents and per-pod billing accumulate with churn; Wolt documented a single metric exploding into nearly 2 million time series from one inadvertent tag, and StepChange traced a 20x Datadog bill increase to GKE Autopilot defaults colliding with Datadog Prometheus defaults.

Collection architecture has three options. Agent-based collection, including Datadog, AppDynamics, and Elastic, requires an SDK or language agent per service, so new microservices go unmonitored until someone instruments them. API and metrics polling with no in-cluster component, the way CloudWatch gathers native AWS service metrics, adds no footprint but stops at the service boundary. eBPF DaemonSet collection runs one pod per node, needs no application restarts or code changes, and covers every service on the node from deployment onward.

Neither approach subsumes the other. The OpenTelemetry eBPF Instrumentation docs put it plainly: reach for language agents when you need custom spans, application-specific attributes, or business events — in-process telemetry that eBPF can’t derive on its own. Platform constraints push in the same direction. GKE Autopilot rejects privileged workloads by default, so a sensor DaemonSet is denied by the GKE Warden admission webhook until a matching WorkloadAllowlist is installed — supplied by an approved partner, or authored by the customer as of GKE 1.35. EKS Fargate is stricter still: no DaemonSets and no host access, which rules out kernel-level collection outright. Telemetry there comes from SDK instrumentation shipped over OTLP, which works — but yields application spans and custom attributes without the protocol-level detail eBPF reads from the kernel.

OpenTelemetry resolves the lock-in half of the question. OTel graduated within the CNCF in May 2026 with the second-highest project velocity of any CNCF project behind Kubernetes, and all six tools here ingest OTLP. Datadog documents that OTel-instrumented data cannot be used in some proprietary products such as Continuous Profiler. For Kubernetes teams: use eBPF for baseline coverage, OTel SDKs where you need custom business spans, and a backend that treats both as first-class.

AIOps, anomaly detection, and root cause analysis

Data residency is the question most evaluations skip. For supported AWS deployments, groundcover’s current product context places AI Agent Mode on Amazon Bedrock inside the customer’s AWS account. That architecture keeps investigation across telemetry signals and entities, including logs, traces, metrics, and events, inside the customer’s security boundary. The groundcover MCP Server extends access to compatible AI agents in IDEs and chat interfaces within incident workflows.

How to choose an APM tool: an evaluation framework

Six criteria separate the tools faster than feature checklists do:

• Stack compatibility: Match the tool’s blast radius to yours. groundcover covers Linux and Kubernetes only; Dynatrace reaches VMs, serverless, and mainframe (z/OS); Datadog covers serverless, Windows, and macOS; CloudWatch covers AWS. A Kubernetes-only estate should not pay for mainframe reach.
• Deployment model: If compliance or data sovereignty applies, including HIPAA and GDPR, filter first on BYOC, on-premises, or air-gapped options. That single filter removes New Relic and constrains Datadog to logs-only residency.
• Pricing model: Model the bill at 2x current telemetry volume. Volume-priced models scale with the data; per-node models scale with the fleet.
• Language support: Language agents give deeper in-process semantics for the 10 or so languages vendors support; eBPF gives protocol-layer coverage of every language with no instrumentation work. Polyglot teams with long-tail services favor the latter.
• Integration ecosystem: Datadog leads this comparison set by documented integration count with 1,000+ integrations; check that your notification and engineering workflow tools, including CI/CD, appear on whichever list you evaluate.
• AI capabilities: Ask where the AI processing runs. Vendor-side processing disqualifies the feature for workloads whose compliance rules require telemetry to remain inside your environment.

Run the proof of concept on a production-representative cluster and time two things: hours to full visibility, and minutes from a simulated latency spike to root cause. If you want to validate the architecture on your own cluster, the free plan includes BYOC and requires no credit card. Deploy Flora on one cluster and evaluate full-cluster visibility within hours.

FAQ

These answers summarize the distinctions, capabilities, deployment mechanics, pricing models, and AI trade-offs covered above.

What is the difference between an APM tool and observability?

APM is a capability set focused on application performance: tracing, latency and errors, plus throughput. Observability is the system property of being able to reason about unknown failure modes from traces together with log and metric data. Gartner folded APM into its broader observability platforms category in 2024 on the grounds that APM alone is not enough.

Which features and metrics should an APM tool cover?

At minimum: distributed tracing, RUM, synthetic monitoring, error tracking, infrastructure monitoring, and anomaly detection, measured through latency percentiles, error rates, throughput, and resource usage. Check granularity and retention, since sub-minute resolution and long metric history vary widely by vendor.

How do APM tools handle microservices?

Through distributed tracing plus topology context. The differentiator is coverage mechanics: per-service agents leave new workloads dark until instrumented, while a node-level eBPF sensor sees every service the moment it schedules. Confirm the tool attaches Kubernetes context, including deployment revision and node condition, to application signals automatically.

What is the difference between RUM and synthetic monitoring?

RUM records real user sessions in production; synthetic monitoring executes scripted checks on a schedule from chosen locations. Synthetic catches failures before users hit them. RUM shows what users experienced. Mature teams run both.

How do APM pricing models work?

APM tools bill four ways: per host or vCPU (Datadog infrastructure, AppDynamics), per GB ingested plus per seat (New Relic), consumption metered per capability (Dynatrace DPS, CloudWatch), and flat per node with everything included (groundcover). Volume-linked models are where documented bill shocks concentrate, from the Coinbase-scale Datadog spend to the pre-instrumentation forecasting challenge documented by a Dynatrace practitioner.

What do AIOps and anomaly detection add?

Fewer alerts and faster root cause: correlation engines collapse cascading alerts from a single fault into one problem, and AI investigation traverses signals that an on-call engineer would otherwise query by hand. Before adopting one, confirm where the AI runs; regulated teams need an architecture that keeps telemetry and investigation inside the required security boundary.