Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Announcing Graylog v1.0 GA

graylog.org

Post reply on HN
Print view View original

31–40 of 67 posts

Re: Announcing Graylog v1.0 GA

#31

Post by lennartkoopmann »

jMyles wrote: post #29
lennartkoopmann wrote: post #26

Earlier quoted context omitted.

Sentry is for monitoring exceptions and errors on your platform. While Graylog can do that, too (without the aggregation though) it is also capable of monitoring any log messages out there and not only errors.

Huh? Sentry is great for monitoring all sorts of log emissions.

Ok. I have used Sentry the last time a long time ago and maybe I'm outdated.

I suggest you try out Graylog and let us know about your findings! I'll make sure to look at Sentry again.

Re: Announcing Graylog v1.0 GA

#33

Post by snowwrestler »

aerialcombat wrote: post #9
lennartkoopmann wrote: post #6

Earlier quoted context omitted.

A log management tool: You send all your local log messages/files to a central place (Graylog) and have unified searching, filtering, monitoring, alerting, forwarding, ... All open source.

Call me stupid, but I've always learned better from examples than descriptions. So it's a log management tool. I can have my app write logs or files into Graylog, then I can handle the logs/files within Graylog much more easily than, say, if I were to write my own code to make some kind of sense with the log data. Am I understanding this correctly? So I can maybe tell easily where users had problems with my app, or I…

I've used SumoLogic to do log management at work, and it's been helpful in specific ways:

- We have a server that runs dozens of websites. When the load spikes, we can quickly get a count of recent log entries for all the sites. The site with the anomalously high number of entries is where we start troubleshooting. This could also be automated as "anomaly detection" that sends us alerts, but we haven't configured that yet--happens rarely.

- One of our servers got hacked. Running log searches helped us pinpoint when it happened, which site was "patient zero," and how the bad guys got in.

- We launched a new site and forgot the Google Analytics code, which we didn't catch right away. We were able to run a report from the server logs to approximate the traffic data that GA missed.

Having all the logs feed into a centralized service made it easier and faster to find the information we needed across a bunch of websites, as opposed to working directly with Apache log files.

We looked at using ELK (Elasticsearch, Logstash, Kibana) to do the same thing "for free," but decided we did not want to manage a complex software stack to help manage a complex software stack. :-) We'll take a look a Graylog I'm sure, but there is something to be said for paying for this as a service--one less thing to worry about.

Re: Announcing Graylog v1.0 GA

#36

Post by jMyles »

lennartkoopmann wrote: post #31
jMyles wrote: post #29

Earlier quoted context omitted.

Huh? Sentry is great for monitoring all sorts of log emissions.

Ok. I have used Sentry the last time a long time ago and maybe I'm outdated. I suggest you try out Graylog and let us know about your findings! I'll make sure to look at Sentry again.

Roger. I'll give it a spin next time I'm doing a monitoring setup.

Thanks for the work!

Re: Announcing Graylog v1.0 GA

#37

Post by nonane »

tbdr wrote: post #11
koliber wrote: post #2

"Users who tested the beta and release candidate versions of v1.0 reported huge improvements in performance and stability. Some of them were unable to crash the system no matter how hard they tried." This statement from the page makes me conclude that others were indeed able to crash the system, perhaps without even trying too hard. My guess is that the statement should be re-worded.

I was able to crash the system without even trying. After waiting for a 500MB something docker image download and running the container halted the host OSX machine while looping with errors (failed API connections, failed to load SIGAR, ...) The screenshots looked great but the first steps experience were a deal breaker.

I just tried this with boot2docker on a OS X machine (Yosemite) and it went very smoothly.

Re: Announcing Graylog v1.0 GA

#38

Post by EvanAnderson »

peterstjohn wrote: post #30

Hurrah - good to see that the Elasticsearch dependency is no longer locked to a rather old version (that bit me a few times when setting up a cluster last year). I'm still a bit wary about having to spin up MongoDB for it as well, though…

The MongoDB requirement gives me pause, too. I've wanted to give ToroDB (https://github.com/torodb/torodb) a try for awhile now, and I think I'm going to see if Graylog will talk to it for grins.

Re: Announcing Graylog v1.0 GA

#39

Post by mrits »

lennartkoopmann wrote: post #20
zantana wrote: post #19

Is Graylog effectively a single product that does the whole thing? My dismay with the ELK stack is you are effectively juggling 3 separate products with different release cycles.

Yes! We have put a lot of effort into making this one thing. The graylog-web-interface connects to the graylog-server REST APIs and that is it. You can manage and monitor the whole system from the graylog-web-interface. Both components are always released together.

Finally, less flexibility!

Re: Announcing Graylog v1.0 GA

#40

Post by druiid »

gbrindisi wrote: post #7

I'm evaluating Graylog as a piece in our monitoring infrastructure. Does anybody have some experience using it in production?

Yep! We do about 5k events/sec and it holds up pretty well as long as you throw enough memory at it (It's a java app). Make sure you have a cluster though if you're going to be doing those kinds of levels. Feel free to respond if you have any other questions. I'll be testing out the 1.0 release myself today.
Post reply on HN