Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Show HN: My Single-File Python Script I Used to Replace Splunk in My Startup

github.com

Post reply on HN
Print view View original

71–80 of 82 posts

Re: Show HN: My Single-File Python Script I Used to Replace Splunk in My Startup

#71

Post by eigenvalue »

hjvalente wrote: post #68
eigenvalue wrote: post #38

Earlier quoted context omitted.

I considered doing it the way you described, but then you need to deploy software on every single one of your machines and make sure it's running, that it's not accidentally using up 99% of your CPU (I've had bad experiences with the monitoring agents for Splunk and Netdata misbehaving and slowing down the machines and causing problems), etc. Whereas with the "pull" approach I used in my tool, you don't need to deplo…

having a Netdata agent taking your machine's CPU to 99% shouldn't happen, not sure when was the list time you tried it but a lot of recent improvements have been done on the Netdata Agent also, with Netdata you can achieve the same architecture design using a Netdata Parent that could be your "control node" and to where you stream the metrics of the nodes you want to keep running with as less load as possible - you c…

I hear you, but once something like that burns me, I am very loathe to risk it again if the cost/benefit ratio seems unfavorable to me. While it's nice to have the pretty dashboards for Netdata, it's not worth even a small risk of it breaking or degrading my systems.

Re: Show HN: My Single-File Python Script I Used to Replace Splunk in My Startup

#72

Post by johnthescott »

xorcist wrote: post #31

Fetching logs regularly sounds hard? Wouldn't you need to keep track of the position of all files, with heuristics around file rotations? And if something catastrophic happens, the most interesting data would be in that last block which couldn't be polled? Normally you'd avoid all that complexity by shipping logs the other way, sending from each machine. That way you can keep state locally should you need to. All uni…

> Wouldn't you need to keep track of the position of all files

rsync --append is your friend.

Re: Show HN: My Single-File Python Script I Used to Replace Splunk in My Startup

#73

Post by oblvious-earth »

knowsuchagency wrote: post #69
oblvious-earth wrote: post #63

Earlier quoted context omitted.

> I don't think globals are so awful for certain things. I prefer a more functional approach where you have simple composable standalone functions instead of classes. Obviously classes have a role, but I find they sometimes overly complicate things and make the logic harder to follow and debug. But "globals" and "composable standalone functions" are contradictory, if you're mutating global state your function is neit…

It's a single script. Globals are fine--they're even marked as such.

> It's a single script

It's over 1200 lines of code, it's not like it's 100 lines of code and can fit on a single screen

> Globals are fine--they're even marked as such

I would argue that globals in this context are not fine from a code maintainability point of view.

By using globals here it's hard to know from a function call if it's going to mutate global state or not. If all the functions were methods of the same class instance, and other functions were just functions or part of some other class, then it gives you a clear grouping of calls which are related to mutating that state.

In general I would argue if you are ever in the situation of "I have more than two or three functions that are related to each other and they all need to mutate the same state so I use a mutable global" or "I pass around the mutable state via arguments" then make a class! It creates an obvious semantic grouping of callables.

Re: Show HN: My Single-File Python Script I Used to Replace Splunk in My Startup

#74

Post by mercer »

CliffStoll wrote: post #21

Oh, how I wish I had your scripts (and insights!) when I was analyzing Unix logs in 1986, looking for the footprints of an intruder...

I was about to ask you to get around the campfire and tell the story again, but I see other commenters got ahead of me :). I'll be getting another Klein bottle soon for a gift, if you still do those :).

Hope you're doing well!

Re: Show HN: My Single-File Python Script I Used to Replace Splunk in My Startup

#75

Post by xorcist »

johnthescott wrote: post #72
xorcist wrote: post #31

Fetching logs regularly sounds hard? Wouldn't you need to keep track of the position of all files, with heuristics around file rotations? And if something catastrophic happens, the most interesting data would be in that last block which couldn't be polled? Normally you'd avoid all that complexity by shipping logs the other way, sending from each machine. That way you can keep state locally should you need to. All uni…

> Wouldn't you need to keep track of the position of all files rsync --append is your friend.

That doesn't take neither rotated nor truncated log files into account. The easiest way, and what most log shippers do, is following inodes.

It's also not as effective as streaming them to their intended target directly. Syslog can write a complementary local copy too should you wish to keep one.

Logs has been a thing since the past forty years. In order to reinvent it, it is good to be acquainted with the standard systems.

Re: Show HN: My Single-File Python Script I Used to Replace Splunk in My Startup

#76

Post by CliffStoll »

h0p3 wrote: post #23
CliffStoll wrote: post #21

Oh, how I wish I had your scripts (and insights!) when I was analyzing Unix logs in 1986, looking for the footprints of an intruder...

I'm kinda glad you didn't; it might have made the book I read as a kid (and again as an adult, and again with my offspring) less interesting somehow.

Uh, yes, h0p3 ... I didn't exactly start on that adventure thinking I'd write a book. Chasing after those hackers was orthogonal to my work in astronomy and the Keck telescope.

Re: Show HN: My Single-File Python Script I Used to Replace Splunk in My Startup

#77

Post by CliffStoll »

mercer wrote: post #74
CliffStoll wrote: post #21

Oh, how I wish I had your scripts (and insights!) when I was analyzing Unix logs in 1986, looking for the footprints of an intruder...

I was about to ask you to get around the campfire and tell the story again, but I see other commenters got ahead of me :). I'll be getting another Klein bottle soon for a gift, if you still do those :). Hope you're doing well!

My smiles to you Mercer: it's fun to look back over my shoulder to a slowly vanishing time, when the Arpanet backbone ran at 4800 baud and a 1 megabyte Unix workstation was hot stuff...

Re: Show HN: My Single-File Python Script I Used to Replace Splunk in My Startup

#78

Post by CliffStoll »

eigenvalue wrote: post #57
CliffStoll wrote: post #21

Oh, how I wish I had your scripts (and insights!) when I was analyzing Unix logs in 1986, looking for the footprints of an intruder...

Thanks for the comment! Going to check out your book now— I somehow hadn’t heard of it before despite it being right down my alley!

Please purchase 30,000 copies of the paperback -- at a nickel royalty per book, it'll help with my kids' tuition this month.

Re: Show HN: My Single-File Python Script I Used to Replace Splunk in My Startup

#79

Post by h0p3 »

CliffStoll wrote: post #76
h0p3 wrote: post #23

Earlier quoted context omitted.

I'm kinda glad you didn't; it might have made the book I read as a kid (and again as an adult, and again with my offspring) less interesting somehow.

Uh, yes, h0p3 ... I didn't exactly start on that adventure thinking I'd write a book. Chasing after those hackers was orthogonal to my work in astronomy and the Keck telescope.

Yes, sir. I appreciate that. I think you made that very clear in the book as well. I'll agree that having OP's tooling back then would likely have been quite useful to you and others. I'm often terrible with words. What I meant to say was: thank you for writing the book. Your story has been an important part of my family's lives for three generations (your work is also mentioned 3 times in my ℍ𝕪𝕡𝕖𝕣𝔱𝔢𝔵𝔱, and, prominently in my record of reaching out to others out of the blue [I've a habit of knocking on doors with low success rates]). Never thought I'd have the chance to say that to you. =D. `/salute`. Thank you, sir.

Re: Show HN: My Single-File Python Script I Used to Replace Splunk in My Startup

#80

Post by CliffStoll »

h0p3 wrote: post #79
CliffStoll wrote: post #76

Earlier quoted context omitted.

Uh, yes, h0p3 ... I didn't exactly start on that adventure thinking I'd write a book. Chasing after those hackers was orthogonal to my work in astronomy and the Keck telescope.

Yes, sir. I appreciate that. I think you made that very clear in the book as well. I'll agree that having OP's tooling back then would likely have been quite useful to you and others. I'm often terrible with words. What I meant to say was: thank you for writing the book. Your story has been an important part of my family's lives for three generations (your work is also mentioned 3 times in my ℍ𝕪𝕡𝕖𝕣𝔱𝔢𝔵𝔱, and,…

Thanks to you for brightening my afternoon -- oh, you brought a smile to my face.

My happy wishes to you and your family!

=Cliff

Post reply on HN