Click here to close now.


Microservices Expo Authors: Liz McMillan, Victoria Livschitz, Pat Romanski, Pete Waterhouse, Elizabeth White

Related Topics: Microservices Expo, Java IoT, Agile Computing

Microservices Expo: Blog Post

Why Creating Real-time Dashboards from Your Log Data Is a No-Brainer

Using log data visualizations to understand performance and usage

I recently came across a blog post on OpenOpsIQ asking the question: "With the introduction of real-time logging, why cant we have a single solution for monitoring the entire stack?" In my opinion, you can! As we have seen lately from a survey we carried out across a sample of the Logentries' 25,000+ user base, organizations are starting to apply logs for a wider range of use cases. So why would you do this, and why does using log data to create real-time dashboards for different views into your system make so much sense?

Here's a few reasons why I think creating dashboards from your logs is what I like to call a ‘no-brainer':

  • Logs already contain valuable data on your systems. Before you add any log events from your applications, your system components (operating systems, web servers, application servers, databases, load balancers, routers, firewalls etc.) already produce log data that contain valuable information on performance, response time, who is accessing your system & from where etc. Adding your own log events into the mix from your software applications can give you the entire picture, but there's already a lot for free that you should really take advantage of.
  • Adding new log events is easy peasy - i.e. they scale if you need to add more data, and adding them doesn't require some complex library integration. Simply add a few well structured log events to your logs to get more insights into your system, e.g. add a new feature, then add some log events that capture its usage at an individual user level for example. Then simply track these events to understand if, when and how that new feature is being used after its release. Some tips on how to better structure your log events can be found in this great post by Ryan Daigle entitled "5 steps to better application logging."
  • Logs are decoupled from your system: One of the beautiful simplicities of using yourlogs as data, is that your system does not end up being tightly coupled with your APM tool or web analytics solution. What do I mean by tightly coupled? Well if you are using an APM tool for example you generally have to integrate their monitoring libraries or agents into your system so that it is instrumented and the APM tool can start to capture some system traces, performance metrics and resource usage information for example. This can not only impact your application performance but also means that your application is essentially locked into using this solution unless you are prepared to rip out the library from your application code. With logs, this isn't the case. You simply log your events to disk, or syslog for example, and then you can use a log management solution to extract and visualize the important data. If you decide you don't like your logging provider you can simply send your logs to another service or solution, without the need to rip out any libraires or interfere with your application source code.
  • Logs can visualize whatever data you add into them: With log data you are only really limited by your imagination - what you use them for really depends on what you put into them. Internally at Logentries, a few things we use our logs for include tracking user sign-ups and feature usage, identifying performance threshold breaches, understanding system resource usage, tracking marketing campaigns via pixel tracking, visualizing total $$$ sales per day ... the list goes on...
  • Logs can be generated from every component and device in your stack: Logs can be used to give a complete end-to-end view of your system and are generally produced by every component in all layers of your stack. I recently wrote a blog post on how logs are particularly useful when trying to get visibility into cloud components that can otherwise be considered as black boxes - in short, the blog outlines how cloud services, that you can not instrument with traditional APM solutions, produce log data that you can be used to get visibility into those cloud components and services. Furthermore, you can now also capture logs from your users' web browsers, or mobile devices in real time that give true end-to-end visibility of your application from the client device, though your middleware components and all the way to the database - so that you can also track events through complex stacks.
  • Logs maintain the evidence: Finally, and most important of all in my opinion, is that dashboards based on log data have an important property that does not exist when creating dashboards with many other approaches - i.e. your logs maintain the evidence! This means that if there is a spike in the number of signups or an increase in your customers' using a particular feature, you can quickly validate what caused that change. Validating your data is something that can be particularly painstaking when using APM, web analytics tools or home grown metrics dashboards.

When trying to validate metrics with other monitoring approaches the process usually goes as follows:

  1. you see a sudden spike in one of your metrics, for example signups are up 200% from yesterday.
  2. knowing that there is no such thing as a free lunch, and the fact you didn't kick off any new marketing campaigns recently, you wonder how signups could have increased in this way?
  3. you ask one of your developers, who is responsible for building your home grown metrics dashboard, to check this out and figure out what was responsible for the change.
  4. the developer is pretty busy and comes back a day or two later, after checking the code and one or two databases, explaining that you've been spammed and that the increase in signups was a result of some spammer signing up for a bunch of accounts
  5. you knew there was no such thing as a free lunch :) but it's two days later and you feel a little frustrated having to wait so long for an answer

If you've created your dashboard from your logs the process looks more like this:

  1. you see a sudden spike in one of your metrics, for example signups are up 200% from yesterday
  2. knowing that there is no such thing as a free lunch, and the fact you didn't kick off any new marketing campaigns recently, you click on the spike to drill down into the log data (i.e. the evidence) and look at the list of people who signed up today - and you immediately see the same email address pattern over and over again and you see that someone has been spamming you - QED :)Log Data Insights

Given the above, I am really pleased to announce our new real-time visualizations that are available out of the box when you use Logentries. Our new Log Insights provide a real-time dashboard with a high level view into important events that are occurring in your system. A few of the benefits include:

  • No Search required: Our new dashboard is available out of the box and requires no setup or requirement to run complex search queries on your data. It gives you an immediate view on important trending events and data volumes from your different systems.
  • Track event volume and identify trends in important events: The dashboards show volume of data from your different components, the distribution of these events over time, as well as how important events you have tagged are trending across your systems.
  • Drill down to view the evidence: The dashboards are completely clickable - so you can drill down into your logs to validate any spikes or trends in your data. Spikes and trends can be easily identified such that you can easily dig into these to better understand their root cause.
  • Share insights across your team(s): Because they have been designed to be easy-to-use and do not require complex search queries to build, the dashboards can be used to easily share insights related to your systems across different teams in your organization such as development, test, support, devops, product...and more. As I said above this is really only limited by what data you capture in your logs.

As always looking forward to your feedback on our latest feature - so do let us know what you think! or hit us up on twitter @logentries.


More Stories By Trevor Parsons

Trevor Parsons is Chief Scientist and Co-founder of Logentries. Trevor has over 10 years experience in enterprise software and, in particular, has specialized in developing enterprise monitoring and performance tools for distributed systems. He is also a research fellow at the Performance Engineering Lab Research Group and was formerly a Scientist at the IBM Center for Advanced Studies. Trevor holds a PhD from University College Dublin, Ireland.

@MicroservicesExpo Stories
Apps and devices shouldn't stop working when there's limited or no network connectivity. Learn how to bring data stored in a cloud database to the edge of the network (and back again) whenever an Internet connection is available. In his session at 17th Cloud Expo, Bradley Holt, Developer Advocate at IBM Cloud Data Services, will demonstrate techniques for replicating cloud databases with devices in order to build offline-first mobile or Internet of Things (IoT) apps that can provide a better, ...
DevOps Summit at Cloud Expo 2014 Silicon Valley was a terrific event for us. The Qubell booth was crowded on all three days. We ran demos every 30 minutes with folks lining up to get a seat and usually standing around. It was great to meet and talk to over 500 people! My keynote was well received and so was Stan's joint presentation with RingCentral on Devops for BigData. I also participated in two Power Panels – ‘Women in Technology’ and ‘Why DevOps Is Even More Important than You Think,’ both ...
Clearly the way forward is to move to cloud be it bare metal, VMs or containers. One aspect of the current public clouds that is slowing this cloud migration is cloud lock-in. Every cloud vendor is trying to make it very difficult to move out once a customer has chosen their cloud. In his session at 17th Cloud Expo, Naveen Nimmu, CEO of Clouber, Inc., will advocate that making the inter-cloud migration as simple as changing airlines would help the entire industry to quickly adopt the cloud wit...
“All our customers are looking at the cloud ecosystem as an important part of their overall product strategy. Some see it evolve as a multi-cloud / hybrid cloud strategy, while others are embracing all forms of cloud offerings like PaaS, IaaS and SaaS in their solutions,” noted Suhas Joshi, Vice President – Technology, at Harbinger Group, in this exclusive Q&A with Cloud Expo Conference Chair Roger Strukhoff.
Docker is hot. However, as Docker container use spreads into more mature production pipelines, there can be issues about control of Docker images to ensure they are production-ready. Is a promotion-based model appropriate to control and track the flow of Docker images from development to production? In his session at DevOps Summit, Fred Simon, Co-founder and Chief Architect of JFrog, will demonstrate how to implement a promotion model for Docker images using a binary repository, and then show h...
Jack Welch, the former CEO of GE once said - “If the rate of change on the outside is happening faster than the rate of change on the inside, the end is in sight.” This rings truer than ever – especially because business success is inextricably associated with those organizations who’ve got really good at delivering high-quality software innovations – innovations that disrupt existing markets and carve out new ones. Like the businesses they’ve helped digitally transform, DevOps teams and Conti...
Culture is the most important ingredient of DevOps. The challenge for most organizations is defining and communicating a vision of beneficial DevOps culture for their organizations, and then facilitating the changes needed to achieve that. Often this comes down to an ability to provide true leadership. As a CIO, are your direct reports IT managers or are they IT leaders? The hard truth is that many IT managers have risen through the ranks based on their technical skills, not their leadership ab...
This week, the team assembled in NYC for @Cloud Expo 2015 and @ThingsExpo 2015. For the past four years, this has been a must-attend event for MetraTech. We were happy to once again join industry visionaries, colleagues, customers and even competitors to share and explore the ways in which the Internet of Things (IoT) will impact our industry. Over the course of the show, we discussed the types of challenges we will collectively need to solve to capitalize on the opportunity IoT presents.
SYS-CON Events announced today that Alert Logic, the leading provider of Security-as-a-Service solutions for the cloud, has been named “Bronze Sponsor” of SYS-CON's 17th International Cloud Expo® and DevOps Summit 2015 Silicon Valley, which will take place November 3–5, 2015, at the Santa Clara Convention Center in Santa Clara, CA. Alert Logic provides Security-as-a-Service for on-premises, cloud, and hybrid IT infrastructures, delivering deep security insight and continuous protection for cust...
Application availability is not just the measure of “being up”. Many apps can claim that status. Technically they are running and responding to requests, but at a rate which users would certainly interpret as being down. That’s because excessive load times can (and will be) interpreted as “not available.” That’s why it’s important to view ensuring application availability as requiring attention to all its composite parts: scalability, performance, and security.
SYS-CON Events announced today that HPM Networks will exhibit at the 17th International Cloud Expo®, which will take place on November 3–5, 2015, at the Santa Clara Convention Center in Santa Clara, CA. For 20 years, HPM Networks has been integrating technology solutions that solve complex business challenges. HPM Networks has designed solutions for both SMB and enterprise customers throughout the San Francisco Bay Area.
All we need to do is have our teams self-organize, and behold! Emergent design and/or architecture springs up out of the nothingness! If only it were that easy, right? I follow in the footsteps of so many people who have long wondered at the meanings of such simple words, as though they were dogma from on high. Emerge? Self-organizing? Profound, to be sure. But what do we really make of this sentence?
DevOps is speeding towards the IT world like a freight train and the hype around it is deafening. There is no reason to be afraid of this change as it is the natural reaction to the agile movement that revolutionized development just a few years ago. By definition, DevOps is the natural alignment of IT performance to business profitability. The relevance of this has yet to be quantified but it has been suggested that the route to the CEO’s chair will come from the IT leaders that successfully ma...
Somebody call the buzzword police: we have a serious case of microservices-washing in progress. The term “microservices-washing” is derived from “whitewashing,” meaning to hide some inconvenient truth with bluster and nonsense. We saw plenty of cloudwashing a few years ago, as vendors and enterprises alike pretended what they were doing was cloud, even though it wasn’t. Today, the hype around microservices has led to the same kind of obfuscation, as vendors and enterprise technologists alike ar...
I’ve been thinking a bit about microservices (μServices) recently. My immediate reaction is to think: “Isn’t this just yet another new term for the same stuff, Web Services->SOA->APIs->Microservices?” Followed shortly by the thought, “well yes it is, but there are some important differences/distinguishing factors.” Microservices is an evolutionary paradigm born out of the need for simplicity (i.e., get away from the ESB) and alignment with agile (think DevOps) and scalable (think Containerizati...
The cloud has reached mainstream IT. Those 18.7 million data centers out there (server closets to corporate data centers to colocation deployments) are moving to the cloud. In his session at 17th Cloud Expo, Achim Weiss, CEO & co-founder of ProfitBricks, will share how two companies – one in the U.S. and one in Germany – are achieving their goals with cloud infrastructure. More than a case study, he will share the details of how they prioritized their cloud computing infrastructure deployments ...
Mobile has become standard in the enterprise with smartphones and tablets common in the workplace. Anywhere, anytime access to company systems is expected and systems must work flawlessly on these devices! This demand is requiring that corporate IT departments figure out the best mobile strategy to follow. This eBook looks at how to kick start your mobile application strategy.
Even though you are running an agile development process, that doesn’t necessarily mean that your performance testing is being conducted in a truly agile way. Saving performance testing for a “final sprint” before release still treats it like a waterfall development step, with all the cost and risk that comes with that. In this post, we will show you how to make load testing happen early and often by putting SLAs on the agile task board.
Today, we are in the middle of a paradigm shift as we move from managing applications on VMs and containers to embracing everything that the cloud and XaaS (Everything as a Service) has to offer. In his session at 17th Cloud Expo, Kevin Hoffman, Advisory Solutions Architect at Pivotal Cloud Foundry, will provide an overview of 12-factor apps and migrating enterprise apps to the cloud. Kevin Hoffman is an Advisory Solutions Architect for Pivotal Cloud Foundry, and has spent the past 20 years b...
Go ahead. Name a cloud environment that doesn't include load balancing as the key enabler of elastic scalability. I've got coffee... so it's good, take your time... Exactly. Load balancing - whether implemented as traditional high availability pairs or clustering - provides the means by which applications (and infrastructure, in many cases) scale horizontally. It is load balancing that is at the heart of elastic scalability models, and that provides a means to ensure availability and even imp...