Blog Post

Core Infrastructure and Security Blog
4 MIN READ

Optimize Azure Log Costs: Split Tables and Use the Auxiliary Tier with DCR

absharan's avatar
absharan
Icon for Microsoft rankMicrosoft
Aug 04, 2025

In this blog, learn how to reduce Azure Log Analytics ingestion costs by using Data Collection Rule (DCR) transformations to split high-volume logs into multiple tables and route low-fidelity logs to the cost-effective Auxiliary tier. I'll walk through a practical example of splitting the Syslog table, using a PowerShell script to create a custom table, and configuring transformation rules to direct "Informational" logs to the Auxiliary table.

This blog is continuation of my previous blog where I discussed about saving ingestion costs by splitting logs into multiple tables and opting for the basic tier! Now that the transformation featur...
Updated Aug 04, 2025
Version 5.0
AbhishekSharan
Auxiliary Logs
azure monitor
Cost Optimization
DCR Transformation
microsoft sentinel
SocInABox's avatar
SocInABox
Iron Contributor
Aug 04, 2025

I would have taken this approach 3 months ago, but now with Data Lake available in Sentinel I'm thinking that will replace much of what I would have used aux logs for, yes?

The DCR will still play a key role in redirecting logs to the data lake like for AWS CloudTrail.

 

absharan's avatar
absharan
Icon for Microsoft rankMicrosoft
Aug 04, 2025

Yes, Microsoft Sentinel’s Data Lake integration can now replace Auxiliary logs for many scenarios, particularly those involving long-term, low-frequency access. However, DCR transformation remain essential for intelligently routing logs. If Microsoft Sentinel is not enabled on a workspace, the Auxiliary tier continues to be the appropriate and cost-effective option for storing logs such as AWS CloudTrail.