① Journal · Syncsort (Precisely)
Ironstream solves a real problem: it makes the mainframe visible to the Splunk and ServiceNow dashboards the rest of the enterprise lives in. But its capacity based licensing rides your mainframe peaks, and the downstream platform bills again on ingest. Two meters, one data stream, and a renewal worth preparing for.
Observability is a feature buyers want. The meter underneath it is a cost they forget.
Ironstream, the forwarding product from Syncsort (Precisely), exists to close a visibility gap. It streams mainframe and IBM i machine data, SMF records, logs, and events, into the observability and IT operations platforms the wider enterprise already runs: Splunk, ServiceNow, Elastic, Kafka, and others. For a CIO trying to bring the mainframe into a single operational view, it is genuinely useful. The trouble starts not with the value but with the licensing, because the way Ironstream is metered is easy to lose track of once the integration is live and quietly working.
Ironstream is commonly licensed on a capacity basis tied to the mainframe environment it instruments, not on the volume of data it forwards. That means the cost tracks the capacity of the systems under observation, and it can climb with the box on a z17 era upgrade even when the observability use case itself has not grown. Meanwhile the downstream platform, Splunk in particular, often charges again on data ingested or workload. You are paying two meters to move one stream of data, and optimizing either in isolation leaves money on the table. Read this alongside our guide on Ironstream renewal scope and capacity levers and the Syncsort (Precisely) hub.
Ironstream cost drivers · what each is and the buyer side lever on it
| Driver | What it is | Buyer side lever |
|---|---|---|
| Instrumented capacity | The mainframe capacity the license is measured against | Scope to systems genuinely observed, not the whole estate |
| Capacity creep | Cost rising with a hardware upgrade, not with use | Treat a box upgrade as a baseline event to negotiate |
| Target platforms | Editions or connectors for Splunk, ServiceNow, Elastic, Kafka | License only the targets actually in production |
| Downstream ingest | The platform charging again on data volume or workload | Model Ironstream and platform cost as one combined meter |
The capacity basis is the pattern we commonly observe; the exact metric follows your specific Precisely entitlement and should be read from the contract. Downstream platform pricing is set by that platform's own terms, which is precisely why the two need modeling together.
Observability does not require instrumenting every LPAR. License the capacity of the systems genuinely under observation, not the whole estate by default. Where Ironstream was scoped wide during a rollout and never trimmed, the renewal is the moment to true it to the systems that actually feed the dashboards.
Instrument what you watch, not what you own.
A capacity based meter rises when the mainframe grows, even when the observability use case is flat. A z17 era upgrade should not silently lift the Ironstream bill. Treat any capacity increase as a baseline event to negotiate at renewal, decoupling the observability cost from hardware decisions made for other reasons entirely.
A bigger box should not mean a bigger observability bill.
Ironstream charges on capacity; the downstream platform often charges on ingest. The total cost of mainframe observability is the sum of the two, and tuning one without the other can simply shift spend. Model the combined meter, decide which data genuinely needs to flow, and negotiate the Ironstream renewal with the platform bill in full view.
One data stream, two meters, one budget.
④ Where the observability bill is won
Ironstream earns its place on value. Its capacity meter rides peaks you can scope. Scope the stream, then negotiate the meter.
Typical reduction negotiated on renewal spend
Mainframe spend negotiated on the buyer side
Engagements delivered since 2019
A forwarding product from Syncsort (Precisely) that streams mainframe and IBM i machine data, logs, SMF records, and events into observability and IT operations platforms such as Splunk, ServiceNow, Elastic, and Kafka. It is part of the former Syncsort portfolio now owned by Precisely. It does not run the workload; it makes the mainframe visible to the enterprise's existing tools.
Commonly on a capacity basis tied to the mainframe environment it instruments, not on data volume forwarded. So the cost tracks the capacity of the systems under observation and can rise with a hardware upgrade even when use is flat. The exact metric follows your Precisely entitlement; read it from the contract.
Scope the systems genuinely observed rather than the whole estate, reconcile licensed capacity against what is instrumented, and treat capacity growth as a baseline event to negotiate. Where the downstream platform charges on ingest, model both meters together. See Ironstream renewal scope and capacity levers.
Other paths exist for moving mainframe data into observability tools, but they carry their own integration and support cost, so the alternative only matters once the scope and capacity are reconciled. The strongest Ironstream renewals are won on a tight scope and a negotiated capacity step. Our license negotiation service runs the renewal and the platform bill together.
Related: Ironstream renewal levers · Syncsort (Precisely) hub · who owns what now · license negotiation · Syncsort audit defense
Audit notice or renewal under 18 months out? We mobilize within 48 hours.
Get expert help →