Most SaaS vs. self-hosted monitoring cost comparisons start with two numbers that are both wrong: the SaaS vendor's list price and the $0 license fee on the open-source stack. One startup's Datadog bill peaked at $6,780 a month against $2,100 of AWS infrastructure because a logging.level.root=DEBUG flag sat in production for six months in a debug flag incident. Prometheus costs nothing to license, and third-party estimates put the engineering overhead of running a scaled Prometheus stack at $20,000-$60,000 a year.
The comparison matters most between roughly 50 and 2,000 hosts. Below that range, per-host SaaS fees stay small enough that self-hosting overhead is prohibitive. Above it, ingest-based pricing tends to grow faster than the infrastructure and labor needed to replace it. Platform teams sitting inside that band are the ones doing this math, usually after their first surprise invoice.
SaaS vs. self-hosted monitoring at a glance
Before the rate cards, here is who carries each cost in the two models:
How total cost of ownership breaks down
A TCO model based only on list price misses most of what either model costs at scale. SaaS TCO adds overage multipliers and per-signal meters to the subscription. Self-hosted TCO adds infrastructure and labor to the free license. Each layer has published numbers.
How SaaS monitoring vendors price their platforms
SaaS vendors meter four different ways, and the metering model determines what triggers a spike.
Datadog stacks meters. Datadog bills Infrastructure Pro at $15 per host per month on annual contracts. APM adds $31-$40 per host. Log ingest costs $0.10/GB plus $1.70 per million indexed events. Exceeding a committed log volume bills at the annual price plus 50%.
Custom metrics are the sharpest edge. Wolt found a single metric had exploded into nearly 2 million unique time series after an entity_id tag combined with three Kubernetes cluster tags; cleanup cut custom metrics volume 39% and modeled monthly cost from roughly $457,500 to $123,500.
At the far extreme, JPMorgan analyst Mark Murphy calculated one Datadog customer's upfront Q1 2022 bill at approximately $65 million; Gergely Orosz identified the customer as Coinbase, which has neither confirmed nor denied it.
The other three vendors meter differently:
- New Relic (per-GB plus per-seat): Ingest beyond the free 100 GB/month costs $0.40/GB on Original data or $0.60/GB on Data Plus, and full platform users cost $349 per user per month on Pro when billed annually. The per-GB rate has climbed in steps: $0.30/$0.50 on the April 2024 datasheet, $0.35/$0.55 by November 2024, $0.40/$0.60 today. Buyers who signed at earlier rates face step-ups at renewal.
- Honeycomb (per-event): Pro costs $150 per 50 million events up to 750 million events per month, with unlimited seats, querying, and scale on all plans.
- Dynatrace (consumption against a commitment): Full-Stack Monitoring runs $58 per month per 8 GiB host. Dynatrace meters logs three separate times: $0.20/GiB to ingest, $0.0007/GiB-day to retain on pay-per-query, and $0.0035 per GiB scanned at query time. Exceeding the annual commitment continues on-demand at the same rates rather than penalty pricing.
Self-hosted infrastructure costs
Public worked models price a realistic mid-size load: 100 GB of logs per day plus metrics from a 100-node cluster.
For logs, a production Loki deployment on AWS handling 100 GB/day costs about $500 a month in infrastructure: $69 for 3 TB of S3 at 30-day retention, $360 for three 4 vCPU/16 GB Kubernetes nodes, roughly $50 in S3 requests and transfer, and $20 of EBS for the index. For metrics, a worked model runs about $801 a month in infrastructure for a Prometheus + Grafana + Thanos setup on a 100-node cluster ($552 in HA compute, $16 EBS, $83 S3 at 12-month retention, $100 in S3 API requests, $50 in cross-region egress); the same analysis adds $1,875 for 15 hours of monthly engineering time, for a $2,676 total. In an annualized model at 100 GB/day, Thanos lands around $21,400/year, Mimir at $33,000-$35,000, and Cortex at $45,000-$47,000.
Component resource profiles drive those numbers:
- VictoriaMetrics vs. Prometheus: In a 7-day benchmark ingesting ~80,000 samples/second, VictoriaMetrics used 33 GiB of disk to Prometheus's 83.5 GiB, 1.7x less memory, and served median reads 16x faster.
- ClickHouse: ClickHouse recommends planning sustained ingest at 1 vCPU per 10 MB/s and a conservative 10x compression ratio for logs and traces; a ClickHouse benchmark stores 5 billion rows (1.5 TiB raw) on a 4 CPU/16 GiB instance in under 100 GiB.
- OpenTelemetry Collector: Budget roughly collector capacity at 1 CPU core and 1 GiB RAM per 10,000 events/second.
- Grafana Mimir: Ingesters need 1 core, 2.5 GB RAM, and 5 GB disk per 300,000 active series, and production plans run with 50% headroom for traffic peaks.
Egress rounds out the bill. Telemetry kept intra-region on private endpoints transfers free; pushing 100 GB/day to the internet from AWS us-east-1 costs about $270 a month at $0.09/GB. At the small end, a TinyFish stack with VictoriaMetrics, VictoriaLogs, and Tempo on three t3.medium instances handles 5 billion samples a month for $200-$300.
Engineering time: the cost teams forget to budget
People are self-hosting's largest cost line. Glassdoor puts median total pay for a senior SRE at $185,000 (range $149K-$233K), and fully loaded cost runs 1.25-1.4x base for payroll taxes and benefits, or 1.5-1.7x including recruiting, equity, and overhead: roughly $290,000-$335,600 in year one for a $180,000 base.
Ongoing maintenance demand scales with host count:
Team maturity shifts the bands. Mature platform teams keep a Prometheus/Loki/Jaeger stack running on 0.25-0.5 FTE; teams new to the stack need 1.0-1.5 FTE plus roughly 45 hours of training per engineer. Initial setup takes 2-4 weeks of engineering time.
Labor usually exceeds the hardware. OneUptime's model puts a 0.5 FTE at $6,250/month against $2,290/month of infrastructure, a 2.7x ratio. Honeycomb tells buyers to include engineering time: “People who claim they pay less than 15% usually fail to include the cost of engineers.” SaaS still consumes labor: agent upkeep and dashboard hygiene take roughly 0.25 FTE even on a fully managed platform.
Maintenance and operational overhead
Ownership of the unglamorous work is the structural difference between the models. In SaaS, the vendor owns backend upgrades, patching, HA, storage durability, and health checks. You own agent versions and integration configs. Self-hosted, every one of those lines lands on your team:
- Upgrades and deprecations: Version changes across Mimir, Grafana dashboards, exporters, and collectors become sprint items on your board.
- Backups and durability: Local storage, WAL behavior, remote-write paths, and object-store retention all become platform responsibilities.
- HA replication: Doubling ingest paths doubles compute; the $552/month compute line in the 100-node model above already reflects 2x HA replicas.
- Failure modes of the stack itself: High cardinality raises memory and disk pressure, so the capacity plans above use headroom rather than sizing only for steady state.
- Component count: An LGTM stack means version, schema, exporter compatibility, and config drift across Prometheus, Loki, Tempo, and the collector layer at once.
The break-even point: when self-hosting gets cheaper
Practitioners usually place the crossover by monthly SaaS spend. Below about $8,000/month, migration economics rarely pay back the engineering investment. Between $15,000 and $200,000/month is the payoff zone: one 100-host migration model estimates $60,000-$80,000 of engineering time to execute, recovered in 2-4 months at roughly $32,000/month in savings. One migration rule compresses the calculation: “Migrate when the Datadog bill is bigger than the cost of a half-time engineer, and you have the half-time engineer.”
By data volume, 100-500 GB/day is an inflection zone where managed alternatives like Grafana Cloud undercut Datadog by 40-60% but self-hosting is not yet clearly superior; above 500 GB/day, a self-hosted Grafana stack pays back in 6-9 months. By host count, host-count models put self-hosting overhead as prohibitive below 50 hosts and place the typical crossover range at 50-200 hosts.
jslet.com built its synthetic model on a $150/hr SRE rate and 12-22 maintenance hours per month (illustrative, not observed spend), and prices three scales side by side:
At 30 hosts, managed SaaS is the cheapest option in the model. At 200 hosts, self-built LGTM costs about an eighth of Datadog's price. At 1,200 hosts the gap approaches 9x, and even Grafana Cloud costs more than double the self-built stack.
The unpriced term is organizational. A Hacker News commenter described leaving Datadog as an organizational migration: teams must rebuild on-call runbooks, alert routing, team muscle memory, and incident-response habits.
Compliance and data residency as cost drivers
Self-hosting turns compliance certifications from a vendor checkbox into your own budget line. Grafana's documentation states it directly: “Self-hosting makes achieving and maintaining certifications the user's responsibility, while Grafana Cloud comes with out-of-the-box certifications including SOC 2, ISO 27001, PCI DSS, GDPR, and CSA.”
When you own the certifications, these are the line items:
- SOC 2: A Type II audit from a specialist firm costs $22,000-$50,000; total preparation plus annual maintenance runs $80,000-$350,000 once you add automation tooling ($10,000-$50,000/year), penetration testing, and security upgrades.
- HIPAA: A full HIPAA assessment costs $20,000-$100,000+, with consultants billing $250-$300/hour.
- GDPR: A medium company (50-250 employees) spends EUR 50,000-200,000 annually.
- Observability-specific hardening: Loki ships with no built-in authentication, so multi-tenant isolation requires enforcement at a gateway layer, and tamper resistance requires S3 Object Lock in COMPLIANCE mode plus IAM policies omitting s3:DeleteObject.
Data residency changes the calculation when telemetry must stay inside your environment. groundcover's BYOC architecture keeps the telemetry home. Its BYOC architecture “processes and stores all your observability data within the walls of your own Virtual Private Cloud (VPC),” which answers HIPAA and GDPR residency questions without a vendor data-processing agreement in the critical path. A common misconception here: BYOC means self-hosting the whole product. In groundcover's model, only the data plane (ClickHouse for logs/traces/events; VictoriaMetrics for metrics) runs in your VPC, while the control plane and UI stay managed; fully on-premises and air-gapped modes exist for environments that need them.
Switching costs add the third compliance-adjacent cost. Replacing proprietary agents raises switching costs. OpenTelemetry instrumentation cuts vendor-to-vendor migration from 8-16 weeks of agent replacement to roughly one week, according to a migration analysis, because the instrumentation layer no longer belongs to the backend.
Hybrid and managed options between the two extremes
Tiered stacks split signals by value: SaaS carries critical alerting and the on-call path while a self-hosted cluster absorbs high-volume metrics and log archives. Grafana Cloud's free tier (10K active series, 50 GB of logs and traces, 14-day retention) can hold the alerting side while self-hosted VictoriaMetrics takes the volume.
Managed hosting of open-source components is the second middle ground, removing operational load without abandoning the open data model:
- Grafana Cloud Pro: Metrics at $6.50 per 1,000 active series and logs at $0.05/GB to process plus $0.40/GB to write, with a $19/month platform fee.
- GCP Managed Service for Prometheus: GCP Managed Service charges $0.060 per million samples for the first 50 billion, with two-year metric storage included.
- Chronosphere: A hybrid BYOC split in which the data plane deploys in your environment while the management plane stays hosted; credit pricing is contract-specific.
groundcover's BYOC model is co-managed with a different pricing mechanism. The data plane runs in your VPC, the control plane and UI stay managed, and pricing is a flat per-node rate (Enterprise pricing is $35/host/month) with no per-GB, per-event, or per-seat meters. groundcover calculates pricing on the monthly average node count, so a temporary scaling event doesn't move the bill. Cost decouples from telemetry volume: log and trace growth changes your storage footprint, not your license. The tradeoff runs both ways. A data-heavy team with relatively few nodes benefits from decoupling license price from volume; a team with many nodes running quieter workloads still pays by node. Operationally, onboarding takes 20-30 minutes through the groundcover Console, and the eBPF sensor deploys as a DaemonSet with no credit card required for the Free tier.
Which model should you choose?
The decision turns on scale and engineering capacity. Compliance posture and retention needs decide the edge cases.
Choose SaaS if
- You run fewer than 50 hosts or your monitoring spend sits below the ~$8K/month floor where migration engineering never pays back.
- Your platform team has no spare capacity; the 2-4 week setup and ongoing maintenance FTE bands above are real commitments, not one-time projects.
- You need FedRAMP coverage or another regulated compliance program, such as SOC 2 or HIPAA, faster than you can fund and pass your own audits.
- Your telemetry volume is modest and stable, so per-GB and per-event meters stay predictable.
Choose self-hosted if
- Your SaaS bill already exceeds the half-time-engineer threshold and you have that engineer available.
- You ingest well above the 500 GB/day inflection point, where the payback window compresses to under a year.
- Data residency rules require telemetry to stay inside your VPC or an air-gapped environment.
- You need multi-year retention at volumes where retention meters dominate the SaaS bill; S3 at $0.023/GB-month plus columnar compression is hard for any per-GB-day rate to match.
- Your platform team is mature enough to hold ongoing operations near the low end of the FTE bands.
.svg)
