Container Insights - Data collection Frequency doubt

Question

I have a doubt about Container Insights: a customer is asking me about how the data collection frequency works in Container Insights' 'cost saving' mode.

From the documentation, I see that increasing the collection frequency to 5 minutes should mean that the agent receives data every 5 minutes. However, upon analyzing the logs of a container with the 5-minute option already active, it appears that the collection frequency isn't actually 5 minutes but the logs are collected at normal interval.

For me is not clear how it works: does the agent send ALL the data every 5 minutes (and if so, I don't understand how this saves on ingestion), or does it work differently?

Thanks in advance!

Answer 1

Hi,

Usually, you have two types of data that you can collect - event based logs and metrics. Even based logs are those logs that are created when there is an event. Metrics are those that are created as specific frequency. For even based logs if you set interval 1min or 5 min does not matter much as for the time of one hour the amount of logs collected and sent to Log Analytics will be the same for both frequencies. For metrics there will be difference as if you have 1m and 5 m frequencies, the latter will collect 5 times less data compared to the first one. So, configuring the frequency provides cost saving for the metrics. I think in Container Insights you also had some logs that are like inventory and in that case these inventory logs act similar like metrics ones. So, there is saving on those as well. You can save on event-based logs by excluding specific logs that you do not need to collect. I think in your case you were looking at event-based logs and making a comparison for them. Note also that TimeGenerated column shows the time the log was generated on the system not when it was collected and send to Log Analytics. You can check the hidden column _TimeReceived that is available for every record to see when the log appeared in Log Analytics.

Please "Accept the answer" if the information helped you. This will help us and others in the community as well.