Before choosing anything, establish which of four different requirements is actually in force, because they have different scopes and are usually enforced as one blanket rule.
The four, and what each really covers
A statutory or sector rule applies to specific categories of data, not to everything an organisation holds. Telemetry about request latency is rarely the data such a rule concerns; monitoring data about identifiable people frequently is.
A contract with a customer applies to that customer's data for the term of that contract. It is negotiable and it expires.
A network with no route out applies to a location. This is the strongest and simplest constraint, and it settles the question without argument.
And a preference expressed as a policy, which applies to whatever nobody has questioned. This one is worth identifying honestly, because it carries the same cost as the others and none of their necessity.
Establishing which one applies usually narrows the scope considerably, and a narrower scope allows a hybrid rather than a wholesale commitment to running everything yourself.
The cost you are accepting
The article on self-hosting sets it out: capacity, upgrades, availability, backups that have been restored, and an on-call rotation for the monitoring system itself. In-house is a decision to employ that work, and where it is required it is required.
The version of this that goes wrong is a team that took the requirement seriously, ran the stack for a year, and never rehearsed restoring it.
Ask what may leave, not only what must stay
Requirements are usually written as prohibitions, and prohibitions scope badly. The productive question inverts it: what is permitted to leave the boundary.
Frequently the answer allows more than the blanket rule suggested. Aggregate counts with no identifiers. Alert notifications containing a service name and a severity. A heartbeat carrying nothing but the fact that a system is alive. Each of those can usually be sent to an external service without engaging the rule at all, and each removes a real weakness from an in-house arrangement.
Getting that written down, with the person who owns the requirement agreeing to it, converts an assumed total prohibition into a specific one and is generally an hour's conversation nobody has had.
Self-hosted metrics and dashboards
- Best forThe common baseline where data must not leave
- PricingFree to license; the cost is storage, machines and the person who understands them
- StandoutMature, well documented, and the ecosystem most other tools assume
- Watch out forLong-term storage and high availability are separate problems that arrive later and suddenly
Self-hosted log search
- Best forInvestigation and audit obligations that cannot be met externally
- PricingFree tiers of commercial products exist; resource usage is the real cost
- StandoutKeeps the material that answers unanticipated questions inside the boundary
- Watch out forIt is the heaviest component to operate, and index growth is what will surprise you
A vendor's on-premises or private deployment
- Best forRegulated buyers who want a supported product inside their own boundary
- PricingLicensed, usually annually, and priced above the hosted equivalent
- StandoutSupport and a roadmap without the data leaving
- Watch out forYou now operate their software and hold the breach liability, which is what you were avoiding
A hybrid: bulk local, summary out
- Best forRequirements scoped to specific data rather than to all telemetry
- PricingMixed, and usually the cheapest total
- StandoutSatisfies a scoped rule while keeping the operational burden small
- Watch out forTwo systems, and nobody remembers which is authoritative during an incident
Rehearse the restore, or it does not exist
An in-house monitoring stack holds the evidence of everything that has gone wrong, and it is backed up by whoever set it up, once, in a way nobody has tested. The rehearsal is a morning and it is the difference between a backup and a belief.
Watch the watcher from outside
The requirement to keep data in-house does not extend to keeping the availability check in-house. A small external probe that fires when the internal stack goes silent is compatible with almost every version of the rule, because it carries no data at all, and it is the one component that solves the failure mode this arrangement creates.
What we cannot verify
Legal and contractual requirements are jurisdictional and fact-specific and nothing here is advice; the applicable scope is a question for counsel and for the contract. Licensing terms and resource requirements are published by the vendors and change. We name no product and rank nothing.
The short version
- Four different requirements are usually enforced as one blanket rule.
- Statute covers categories of data; contracts cover a customer and expire.
- A preference expressed as policy costs the same and lacks the necessity.
- Narrowing the scope usually permits a hybrid rather than a wholesale commitment.
- An untested backup of the monitoring stack is a belief, not a backup.
- An external probe carries no data and solves the silence this arrangement creates.