Centralized Logging With Rsyslog

Post by johnmark » Fri, Oct 08, 2010, 9:56 PM UTC

mmt wrote: post #13

js2 wrote: post #5

Earlier quoted context omitted.

Protip: look at rsyslog, syslog-ng, and splunk and decide what is right for your environment.

The "pro" that I am is sysadmin, and I'm asserting that evaluating all three is a waste of time. Splunk, given its cost and complexity, is almost never right for startups. Non-ng syslog is, on the other hand, so simplistic that it's not worth the effort of fancy configuration. Is there some kind of compelling advantage that I've been overlooking? I never quite understood the conceit that every environment is a precio…

"Splunk, given its cost and complexity, is almost never right for startups."

Many, many startups would disagree with you. If cost is a factor, we're starting a program for startups. Feel free to ping me for more info.

We'll also have a new developer license for our next release, which will make it easier for cash-strapped developers to use Splunk.

And finally, I would just point out that using rsyslog, syslog, and syslog-ng do not preclude you from using something like Splunk. Many of our users use Splunk with a log manager, such as syslog-NG, because they like our analytics engine and reporting tools. YMMV.

Now back to your regularly scheduled discussion :)

-John Mark Splunk Community Guy

Post by mmt » Tue, Oct 12, 2010, 7:29 PM UTC

johnmark wrote: post #21

mmt wrote: post #13

Earlier quoted context omitted.

The "pro" that I am is sysadmin, and I'm asserting that evaluating all three is a waste of time. Splunk, given its cost and complexity, is almost never right for startups. Non-ng syslog is, on the other hand, so simplistic that it's not worth the effort of fancy configuration. Is there some kind of compelling advantage that I've been overlooking? I never quite understood the conceit that every environment is a precio…

"Splunk, given its cost and complexity, is almost never right for startups." Many, many startups would disagree with you. If cost is a factor, we're starting a program for startups. Feel free to ping me for more info. We'll also have a new developer license for our next release, which will make it easier for cash-strapped developers to use Splunk. And finally, I would just point out that using rsyslog, syslog, and sy…

Many, many startups would disagree with you. If cost is a factor, we're starting a program for startups. Feel free to ping me for more info.

Thanks for the reply. Admittedly, my statement is better qualified by "early" and "web scale."

Cost is very much a factor, as $500/mo buys a lot of ramen, and, even for a slightly larger company, is still a noticeable expense, for something where the value is unknown[1] ahead of time.

Even just the nomenclature "enterprise" implies pricing that's optimized to pay for the sales process or other hand-holding, rather than something technical. Such inference is further bolstered by the fact that a full price list isn't published.

If cost is a factor, we're starting a program for startups. Feel free to ping me for more info.

The companies I work for, in general, have neither the free time nor the inclination to pay for such a sales process. The program I'd want to see is one where I can order online with a credit card.

Time is a portion of cost, not just cash.

[1] Perhaps even unknowable, since, if the output isn't consumed, it's all potential value.

Re: Centralized Logging With Rsyslog

Re: Centralized Logging With Rsyslog