Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Show HN: My Single-File Python Script I Used to Replace Splunk in My Startup

github.com

Post reply on HN
Print view View original

41–50 of 82 posts

Re: Show HN: My Single-File Python Script I Used to Replace Splunk in My Startup

#41

Post by diarrhea »

getrealyall wrote: post #18
hliyan wrote: post #5

A long long time ago, I used a series of tail -f's and unix pipes to aggregate logs, and grep, less and awk to analyse them. There were about 20 different services written in C++, each producing over 1GB of logs each day. Managed to debug some fairly complex algorithmic trading bugs. Twenty years later, I still can't fathom why we're spending so much money on Splunk, DataDog an the like.

Financialization and mediocre developers. I haven't worked with too many people I could actually trust to even emit logs correctly, let alone develop a tool to collect and aggregate them. I've also been told, time and again, in no uncertain terms, to "buy as much as possible". We've reached the logical conclusion of SaaS-everything: every company just cobbles together expensive, overcomplicated computers from other e…

Buying everything and SaaSing the whole place up is a true killjoy. I giggle with joy whenever I am allowed to write code. And then a support request comes in that I get assigned to, “thing in SaaS doesn’t work please fix”. And all you have to debug that SaaS is their UI. The checkbox in question is on, you notice, so it can only be a bug on their side. Off to contacting support as the only available avenue. Incredibly boring.

Re: Show HN: My Single-File Python Script I Used to Replace Splunk in My Startup

#42

Post by xorcist »

eigenvalue wrote: post #38
xorcist wrote: post #31

Fetching logs regularly sounds hard? Wouldn't you need to keep track of the position of all files, with heuristics around file rotations? And if something catastrophic happens, the most interesting data would be in that last block which couldn't be polled? Normally you'd avoid all that complexity by shipping logs the other way, sending from each machine. That way you can keep state locally should you need to. All uni…

I considered doing it the way you described, but then you need to deploy software on every single one of your machines and make sure it's running, that it's not accidentally using up 99% of your CPU (I've had bad experiences with the monitoring agents for Splunk and Netdata misbehaving and slowing down the machines and causing problems), etc. Whereas with the "pull" approach I used in my tool, you don't need to deplo…

One way or the other, your hosts are running your application, and you are already deploying software on every single host. But I hear you with some of the agents. That's why I mentioned syslog.

It's already there, it's supported by most logging packages, and it's dead simple. No additional software required. All text. What it doesn't do is structured logging, but analyzing on the log host is often enough.

Agents aren't all that bad however, and you're likely already running some agent like icinga or zabbix for regular monitoring.

Re: Show HN: My Single-File Python Script I Used to Replace Splunk in My Startup

#43

Post by BerislavLopac »

appleaday1 wrote: post #3

Thanks for the share, I still find it hilarious how Python is by default installed on most distros, I was working on some compression tools and by default the os didn't come with the ability zip/unzip toolsets, but the python standard library zipfile did. https://docs.python.org/3/library/zipfile.html

You don't even have to write a custom script around the library:

  python -m zipfile -e monty.zip target-dir/
https://docs.python.org/3/library/zipfile.html#command-line-...

Re: Show HN: My Single-File Python Script I Used to Replace Splunk in My Startup

#44

Post by _aavaa_ »

eigenvalue wrote: post #14
rollcat wrote: post #10

"This simple tool solves X at my org" is probably the most underrated type of project. There's not enough room to overcomplicate something that isn't a core part of the business, it must be practical to maintain, simple&stupid enough so that onboarding is not a hurdle, etc. I encourage everyone to share your "splunk in 1kloc of Python" projects! Some of my own: - https://github.com/rollcat/judo is Ansible without Pyt…

Thanks, based on the dismissive replies to my original comment in the Splunk acquisition discussion, I thought this would get a lot of hostile takes saying that it was dumb, that I reinvented the wheel because I didn't want to spend 2 weeks trying to figure out opentelemetry nonsense and tools X, Y, and Z, that it was trivial, that it wouldn't scale, etc. But people are actually being surprisingly nice and friendly!…

> reinvented the wheel

I hate this meme. It's as if cars, trains, and airplanes all use the same wheels. Or that wheels under my stove, my tiny filing dresser, and my shopping cart are all the same.

Oh yeah, re-inventing the wheel, what a stupid idea and something we obviously don't frequently do and for good reasons.

This meme is almost as bad as the horrible misquoted "premature optimisation is the root of all evil".

Re: Show HN: My Single-File Python Script I Used to Replace Splunk in My Startup

#45

Post by msto »

oblvious-earth wrote: post #17

Quickly skimming some points that would irratate me if I had to maintain this script: * Importing Paramiko but regularly call `ssh` via subprocess * Unused functions like `execute_network_commands_func` * Sharing state via a global instead of creating a class Overall it's fit for purpose, but makes a lot of assumptions about the host and client machines. As you said in the thread you're running a very small number of…

* barely any comments and not a single docstring in the entire kiloline file

Re: Show HN: My Single-File Python Script I Used to Replace Splunk in My Startup

#46

Post by eigenvalue »

oblvious-earth wrote: post #17

Quickly skimming some points that would irratate me if I had to maintain this script: * Importing Paramiko but regularly call `ssh` via subprocess * Unused functions like `execute_network_commands_func` * Sharing state via a global instead of creating a class Overall it's fit for purpose, but makes a lot of assumptions about the host and client machines. As you said in the thread you're running a very small number of…

Thanks for the feedback. I do use Paramiko for some things. I tried to use it for everything in the project but ran into some weird stuff that wouldn't work reliably for me, which is why I switched some of it over to using SSH directly via subprocess (it was a few months ago so I don't even remember now what it was; I believe it was also performance related, since I'm trying to SSH to tons of machines at the same time concurrently).

I guess I did forget to use the execute_network_commands_func. I'm using the ruff linter extension in VSCode now which would have flagged that to me, but back when I made this I wasn't.

I don't think globals are so awful for certain things. I prefer a more functional approach where you have simple composable standalone functions instead of classes. Obviously classes have a role, but I find they sometimes overly complicate things and make the logic harder to follow and debug.

Anyway, I do appreciate that someone took the time to actually read through the code!

Re: Show HN: My Single-File Python Script I Used to Replace Splunk in My Startup

#48

Post by eigenvalue »

msto wrote: post #45
oblvious-earth wrote: post #17

Quickly skimming some points that would irratate me if I had to maintain this script: * Importing Paramiko but regularly call `ssh` via subprocess * Unused functions like `execute_network_commands_func` * Sharing state via a global instead of creating a class Overall it's fit for purpose, but makes a lot of assumptions about the host and client machines. As you said in the thread you're running a very small number of…

* barely any comments and not a single docstring in the entire kiloline file

I find comments annoying to read and write and distracting. I’d rather fit more code on the screen at once and instead focus on making the variable names and function names really descriptive and clear so you immediately grasp what it’s doing from context alone. Nowadays, if you really need comments to tell you what code is doing, you can just throw it into ChatGPT and get it that way.

Re: Show HN: My Single-File Python Script I Used to Replace Splunk in My Startup

#49

Post by cooper_ganglia »

languagehacker wrote: post #47

Ah, the hubris of the single developer who believes they can replace a battle-tested product from a company with innumerable decades of combined human effort. Glad it works for you!

I mean, it seems like it's working for them. Not every single startup needs the same solutions as a larger company, especially when the solution is as expensive as Splunk!

Re: Show HN: My Single-File Python Script I Used to Replace Splunk in My Startup

#50

Post by nurettin »

candiddevmike wrote: post #29
nurettin wrote: post #12

> If I owned CSCO stock I would sell it-- this deal shows incredibly bad judgment." That may be so, but beware that acquisitions usually increase stock price rather than decrease it.

Is that overtime or immediately after acquisition? https://www.google.com/finance/quote/CSCO:NASDAQ?&window=5D

The results should show up pretty quickly. Maybe that was pricing in the acquisition, or the acquisition is nothing compared to the whole company and that's quarterly earnings. Not sure.
Post reply on HN