Hacker News Reader

Comment by aerialcombat | Hacker News Reader

So what is it exactly?

A log management tool: You send all your local log messages/files to a central place (Graylog) and have unified searching, filtering, monitoring, alerting, forwarding, ...

All open source.

Call me stupid, but I've always learned better from examples than descriptions. So it's a log management tool. I can have my app write logs or files into Graylog, then I can handle the logs/files within Graylog much more easily than, say, if I were to write my own code to make some kind of sense with the log data. Am I understanding this correctly?

So I can maybe tell easily where users had problems with my app, or I can even use it as some kind of analytics program for my app?

I've visited the site and read what I could before, but without knowing what it does, it was pretty cumbersome to read through the entire website to figure out what exactly it does.

I was initially drawn to the fact that it took five and a half years to get to 1.0. God knows how hard it must've been to work on it to perfect it all these years, heck spending five months on an app is tough enough. I would've given up reading about it otherwise if it hadn't been for the five years thing. I just think that, despite all it's capable of, if the descriptions were more in layman's terms it could reach wider audience.

It actually turns out that this is exactly what I was looking for since I'm about to have my app out, and if I hadn't asked the question, I would've just ignored it all together.

While I'm very thankful for the additional explanations, I still think that nice illustration or a simple video of telling how it can solve real world problems will help people understand it better.

Exactly. Think of this search query you could do:

  source:your-app AND http_status_code:>=500

This would give you a list of all HTTP 500s of "your-app".

Or:

  user_id:12346 AND http_status_code:>=500

... to see all errors a user caused after customer care called you, reporting an error the user got. Stacktrace is there immediately without having to find the right log file on the right web server.

I've used SumoLogic to do log management at work, and it's been helpful in specific ways:

- We have a server that runs dozens of websites. When the load spikes, we can quickly get a count of recent log entries for all the sites. The site with the anomalously high number of entries is where we start troubleshooting. This could also be automated as "anomaly detection" that sends us alerts, but we haven't configured that yet--happens rarely.

- One of our servers got hacked. Running log searches helped us pinpoint when it happened, which site was "patient zero," and how the bad guys got in.

- We launched a new site and forgot the Google Analytics code, which we didn't catch right away. We were able to run a report from the server logs to approximate the traffic data that GA missed.

Having all the logs feed into a centralized service made it easier and faster to find the information we needed across a bunch of websites, as opposed to working directly with Apache log files.

We looked at using ELK (Elasticsearch, Logstash, Kibana) to do the same thing "for free," but decided we did not want to manage a complex software stack to help manage a complex software stack. :-) We'll take a look a Graylog I'm sure, but there is something to be said for paying for this as a service--one less thing to worry about.

correct.. its a way for you to index and search through logs and easily pull out where issues might be happening.

Its like splunk but not as poweful

So is it similar to Sentry?

Sentry is for monitoring exceptions and errors on your platform. While Graylog can do that, too (without the aggregation though) it is also capable of monitoring any log messages out there and not only errors.

Huh?

Sentry is great for monitoring all sorts of log emissions.

Ok. I have used Sentry the last time a long time ago and maybe I'm outdated.

I suggest you try out Graylog and let us know about your findings! I'll make sure to look at Sentry again.

Roger. I'll give it a spin next time I'm doing a monitoring setup.

Thanks for the work!

Reply on news.ycombinator.com