From the audit · Grail

A number that was never decided

Retention is a field. You type a number into it, and nothing about the interaction resembles a purchase: no quote, no approval, no line item that appears next month with your name on it. That is why it drifts — and why 462 days is such a recognisable figure. Nobody picks 462. It is the residue of an earlier configuration that survived a migration, rounded by nothing.

On the tenant in our case study it applied to the default metrics bucket, which is to say the bucket that receives what nobody routed anywhere else. The data in it was queried, in practice, over the last fortnight.

Why the cost is a range

The finding reads $22,455–$86,115 a year, and the spread is not hedging. Two contractual rates could plausibly apply to that customer’s storage depending on how a clause about retained versus queried data was read. We priced both, showed both, and said which assumption produced which end.

It would have been easy to publish the larger figure — it makes the finding look more impressive and the audit look more valuable. It would also have made the number unusable in the conversation the customer actually had to have with their finance team, which is the only conversation that matters.

What makes retention different from the other findings

Most audit findings are reversible. Re-enable detection, close a maintenance window, add a tag: if you get it wrong, you undo it. Retention is not like that. Lowering a bucket’s retention discards everything older than the new window, permanently, and no support ticket brings it back.

So this is the one finding the audit deliberately hands to a human rather than to a ticket queue. The report gives the bucket, the retention, the annual cost at both rates, and the query volume against that data over the window — and then stops, because the next step is a data-owner decision, not an engineering one.

The shape of the query

The bucket inventory with its retention, which is where every conversation about storage cost should start:

What good looks like

Not "short retention". Deliberate retention: each bucket’s window matched to what the data in it is for, written down somewhere, and priced. A compliance bucket at three years is fine when someone can say which obligation it serves. A default bucket at 462 days is not fine at any price, because nobody can say anything about it at all.

The customer in this case reduced the default bucket to 90 days and moved two specific data sets into a longer-retention bucket of their own. That decision took six weeks. That is the correct speed for a decision that cannot be undone.

The finding behind this piece

The takeaway

Storage cost hides in a field that looks like a setting rather than a purchase. Ask what each bucket is for, and the ones nobody can answer for are your finding.

More from the series

The $91,576 question: Full-Stack hosts with nothing monitored on them From the audit · FinOps 1,617 maintenance windows: how alerting goes quiet without anyone deciding From the audit · Alerting Personal data in logs: 50 sources, about 30.7 million records a day From the audit · Pipelines What actually lands on a DPS invoice From the audit · FinOps

An audit takes one run. The findings take one meeting. What you do with them is up to you.

Certified Dynatrace experts

Send

Obzervability

Privacy Terms of use Accessibility