Announcing Graylog v1.0 GA • Hacker News Board

Re: Announcing Graylog v1.0 GA

#21

Post by lennartkoopmann » Thu, Feb 19, 2015, 2:52 PM UTC

NextPerception wrote: post #17

I looked around a little bit on the web page but the answer to my two questions was not immediately apparent to me. (Note: I might just be blind) 1. Can I set up a second Graylog Server as a failover with automated recovery and log syncing when both nodes come back up? 2. Can I run it on any cheap cheap embedded platforms like a raspberry pi or beagleboard?

Yes, you can set up as many Graylog servers as you want and put them behind a load balancer or integrate any kind of failover you want.

We do not recommend it running on extremely small platforms like a raspberry pi, but a very small VM (we have OVAs and other virtual appliances ready) is able to process a lot of messages already.

Re: Announcing Graylog v1.0 GA

#22

Post by jMyles » Thu, Feb 19, 2015, 2:57 PM UTC

lennartkoopmann wrote: post #6

aerialcombat wrote: post #5

So what is it exactly?

A log management tool: You send all your local log messages/files to a central place (Graylog) and have unified searching, filtering, monitoring, alerting, forwarding, ... All open source.

So is it similar to Sentry?

Re: Announcing Graylog v1.0 GA

#23

Post by gtirloni » Thu, Feb 19, 2015, 2:58 PM UTC

gbrindisi wrote: post #7

I'm evaluating Graylog as a piece in our monitoring infrastructure. Does anybody have some experience using it in production?

+1

The solution seems neat. It'd be nice to know who is using it in production, how big is their environment, etc. I couldn't find much information online.

Re: Announcing Graylog v1.0 GA

#24

Post by real_joschi » Thu, Feb 19, 2015, 2:58 PM UTC

tbdr wrote: post #11

koliber wrote: post #2

"Users who tested the beta and release candidate versions of v1.0 reported huge improvements in performance and stability. Some of them were unable to crash the system no matter how hard they tried." This statement from the page makes me conclude that others were indeed able to crash the system, perhaps without even trying too hard. My guess is that the statement should be re-worded.

I was able to crash the system without even trying. After waiting for a 500MB something docker image download and running the container halted the host OSX machine while looping with errors (failed API connections, failed to load SIGAR, ...) The screenshots looked great but the first steps experience were a deal breaker.

We've tested the Docker image on Mac OS X with boot2docker but of course there are always things that can go wrong.

It would be awesome if you could help us improve the Docker image by creating an issue at https://github.com/Graylog2/graylog2-images/issues with the error messages you've encountered when starting the container.

Re: Announcing Graylog v1.0 GA

#25

Post by acamilo » Thu, Feb 19, 2015, 3:11 PM UTC

gbrindisi wrote: post #7

I'm evaluating Graylog as a piece in our monitoring infrastructure. Does anybody have some experience using it in production?

we are using it in production and works very well. ~200 clients sending events with a total of 63,996,350 events.

Re: Announcing Graylog v1.0 GA

#26

Post by lennartkoopmann » Thu, Feb 19, 2015, 3:19 PM UTC

jMyles wrote: post #22

lennartkoopmann wrote: post #6

Earlier quoted context omitted.

A log management tool: You send all your local log messages/files to a central place (Graylog) and have unified searching, filtering, monitoring, alerting, forwarding, ... All open source.

So is it similar to Sentry?

Sentry is for monitoring exceptions and errors on your platform. While Graylog can do that, too (without the aggregation though) it is also capable of monitoring any log messages out there and not only errors.

Re: Announcing Graylog v1.0 GA

#27

Post by boothead » Thu, Feb 19, 2015, 3:25 PM UTC

Could anyone give an executive summary of the differences with the ELK stack?

Re: Announcing Graylog v1.0 GA

#28

Post by lennartkoopmann » Thu, Feb 19, 2015, 3:28 PM UTC

boothead wrote: post #27

Could anyone give an executive summary of the differences with the ELK stack?

This might help: http://docs.graylog.org/en/1.0/pages/ideas_explained.html

Re: Announcing Graylog v1.0 GA

#29

Post by jMyles » Thu, Feb 19, 2015, 3:30 PM UTC

lennartkoopmann wrote: post #26

jMyles wrote: post #22

Earlier quoted context omitted.

So is it similar to Sentry?

Sentry is for monitoring exceptions and errors on your platform. While Graylog can do that, too (without the aggregation though) it is also capable of monitoring any log messages out there and not only errors.

Huh?

Sentry is great for monitoring all sorts of log emissions.

Re: Announcing Graylog v1.0 GA

#30

Post by peterstjohn » Thu, Feb 19, 2015, 3:32 PM UTC

Hurrah - good to see that the Elasticsearch dependency is no longer locked to a rather old version (that bit me a few times when setting up a cluster last year). I'm still a bit wary about having to spin up MongoDB for it as well, though…