From the audit · FinOps

What the check looks for

Dynatrace prices a Full-Stack host whether or not anything useful is running on it. That is not a flaw — the agent is deployed, the host is monitored, the meter runs. It only becomes a problem when the second half of the sentence stops being true: the host is monitored, and there is nothing on it to monitor.

The check is deliberately narrow. Take every host in Full-Stack monitoring mode, join it to the process groups and services Dynatrace has detected on it, and keep the ones where that join comes back empty over the whole window. Not "low traffic". Not "quiet". Empty.

What it found

On the enterprise tenant in our case study: 140 hosts. Priced on that customer’s own negotiated rate card and annualised, $91,576 a year. It was the single largest line in the entire audit, and it was invisible on every dashboard in the tenant — because a dashboard answers "is what we monitor healthy", and these hosts were perfectly healthy. They were just not monitoring anything.

The distribution was the interesting part. They were not scattered randomly: they clustered in two subnets that had been migrated eighteen months earlier, where the OneAgent rollout had been part of the base image and the workloads that were supposed to follow never did.

Why nobody noticed

Three things have to go wrong together, and all three are normal. The agent deploys automatically, so nobody chooses per host. Consumption is reported in aggregate, so 140 hosts out of several thousand never surface as a line. And no alert exists for "this host is monitored and idle", because from the platform’s point of view nothing is wrong.

The result is a cost that behaves like a fixed cost. It arrives every year, it is never questioned, and the only way to find it is to go looking with a query that nobody has a reason to write.

The shape of the query

Roughly what the check does, in DQL — the logic behind the finding, so it is clear what it rests on:

What to do with the answer

Not all 140 are waste, and the report does not claim they are. Some machines genuinely run nothing between batch windows, and monitoring them in Full-Stack mode is a deliberate choice somebody should be able to point at. The finding exists so that the choice becomes explicit: here are the hosts, here is what they cost, tell us which ones are intentional.

For the rest the remediation is a monitoring-mode change rather than an uninstall — infrastructure mode keeps the host visible and stops the Full-Stack meter. It is reversible, it takes minutes, and on this tenant it was worth more than every other finding in the audit combined.

The finding behind this piece

The takeaway

A licence line with no workload behind it is not a monitoring problem, and nothing in the product will raise it as one. It is only ever found by asking.

More from the series

The Grail bucket nobody chose: 462 days of retention From the audit · Grail 1,617 maintenance windows: how alerting goes quiet without anyone deciding From the audit · Alerting Personal data in logs: 50 sources, about 30.7 million records a day From the audit · Pipelines What actually lands on a DPS invoice From the audit · FinOps

An audit takes one run. The findings take one meeting. What you do with them is up to you.

Certified Dynatrace experts

Send

Obzervability

Privacy Terms of use Accessibility