What is a "node" in OMS/Log Analytics?

Question

I am currently evaluating OMS & Log Analytics and the cost is always given as "per node" but I am not really sure what a node is.
For example if I have an SQL-Server with 5 databases and I go into the Azure portal and add logging to the OMS workspace, does it cost one unit or 5 (for each database)?
Same goes for App Services etc. Is one node 1 app service plan or each deplyed website?

Is there any documentation I missed that clarifies those questions?

PS: Could someone with the necessary privilge create the tag "operations-management-suit" or "log-analytics" ?

Answer 1

This is a somewhat complicated and off-topic question and the answer varies depending on the license you purchased. I suggest you read this article.

Official reference:
https://www.microsoft.com/en-us/cloud-platform/operations-management-suite-pricing

ps. I might be wrong, but nodes are VMs only, everything else isn't a node. but dont quote me on that.

Answer 2

A node can be a virtual machine, a physical server, a network device or other instance. You can buy additional nodes either upfront through a suite or by purchasing a pay-as-you-go plan. Examples of nodes include the following:

Insight & Analytics

• Windows and Linux computers with one of the OMS agents installed

• Azure classic cloud service web and worker role instances

• Azure service fabric cluster nodes

• Data sent through the data collector API with the “Computer” field populated

• Each device sending logs via a syslog forwarder

Automation & Control

• Computers with the Configuration Management agent installed

• Computers with an OMS agent collecting Change Tracking data

• Computers with an OMS agent collecting Update Management data

• Computers with Automation Hybrid Worker installed

Security & Compliance

• Windows computers sending Security Event logs

• Linux computers sending security/authorization syslog events

• Azure resources monitored by Security Center. Note that currently, only virtual machines are counted (each Azure VM counts as one node), but as more security monitoring capabilities are enabled for other types of services, like Azure Cloud Services or SQL databases, we may begin counting these resources as well.

• Computers sending antimalware information

• Devices sending Security logs, including:

o Windows computers sending Security Event logs

o Linux computers sending security/authorization syslog events

o Devices, such as network devices, sending Common Event Format (CEF) logs

o Devices, such as network devices, sending Cisco Adaptive Security Appliance (ASA) logs

o Each device sending the above log types through a syslog forwarde

Answer 3

OMS FAQ: What is a node? Can I add nodes during the annual subscription?

A node can be a virtual machine, a physical server, a network device or other instance. You can buy additional nodes either upfront through a suite or by purchasing a pay-as-you-go plan.