Notes on observability without a budget
You do not need a vendor to know what your machines are doing. Three pieces cover most of it.
Metrics
A small agent on every host, scraping CPU, memory, disk and network. One central collector with a retention window measured in weeks, not months. If the dashboard takes more than a second to load, the query is wrong.
# roughly what I keep
up{job="node"}
node_memory_MemAvailable_bytes
node_filesystem_avail_bytes
node_network_transmit_bytes_totalLogs
Structured logs, shipped to one place, rotated at 50 MB. The value is not in the logs you read today; it is in the log from three weeks ago when the disk filled up.
Alerts
Three alerts are enough to start: disk under 15%, a service that fails two health checks in a row, and a backup that has not completed in 26 hours. Everything else is noise until proven otherwise.
What I stopped measuring
Per-process metrics. They look precise and answer no question. The service either responds or it does not.