Welcome!

Microservices Expo Authors: Elizabeth White, Pat Romanski, Reinhard Brandstädter, Liz McMillan, Cynthia Dunlop

Related Topics: Microservices Expo, Java IoT, Agile Computing

Microservices Expo: Blog Post

Why Creating Real-time Dashboards from Your Log Data Is a No-Brainer

Using log data visualizations to understand performance and usage

I recently came across a blog post on OpenOpsIQ asking the question: "With the introduction of real-time logging, why cant we have a single solution for monitoring the entire stack?" In my opinion, you can! As we have seen lately from a survey we carried out across a sample of the Logentries' 25,000+ user base, organizations are starting to apply logs for a wider range of use cases. So why would you do this, and why does using log data to create real-time dashboards for different views into your system make so much sense?

Here's a few reasons why I think creating dashboards from your logs is what I like to call a ‘no-brainer':

  • Logs already contain valuable data on your systems. Before you add any log events from your applications, your system components (operating systems, web servers, application servers, databases, load balancers, routers, firewalls etc.) already produce log data that contain valuable information on performance, response time, who is accessing your system & from where etc. Adding your own log events into the mix from your software applications can give you the entire picture, but there's already a lot for free that you should really take advantage of.
  • Adding new log events is easy peasy - i.e. they scale if you need to add more data, and adding them doesn't require some complex library integration. Simply add a few well structured log events to your logs to get more insights into your system, e.g. add a new feature, then add some log events that capture its usage at an individual user level for example. Then simply track these events to understand if, when and how that new feature is being used after its release. Some tips on how to better structure your log events can be found in this great post by Ryan Daigle entitled "5 steps to better application logging."
  • Logs are decoupled from your system: One of the beautiful simplicities of using yourlogs as data, is that your system does not end up being tightly coupled with your APM tool or web analytics solution. What do I mean by tightly coupled? Well if you are using an APM tool for example you generally have to integrate their monitoring libraries or agents into your system so that it is instrumented and the APM tool can start to capture some system traces, performance metrics and resource usage information for example. This can not only impact your application performance but also means that your application is essentially locked into using this solution unless you are prepared to rip out the library from your application code. With logs, this isn't the case. You simply log your events to disk, or syslog for example, and then you can use a log management solution to extract and visualize the important data. If you decide you don't like your logging provider you can simply send your logs to another service or solution, without the need to rip out any libraires or interfere with your application source code.
  • Logs can visualize whatever data you add into them: With log data you are only really limited by your imagination - what you use them for really depends on what you put into them. Internally at Logentries, a few things we use our logs for include tracking user sign-ups and feature usage, identifying performance threshold breaches, understanding system resource usage, tracking marketing campaigns via pixel tracking, visualizing total $$$ sales per day ... the list goes on...
  • Logs can be generated from every component and device in your stack: Logs can be used to give a complete end-to-end view of your system and are generally produced by every component in all layers of your stack. I recently wrote a blog post on how logs are particularly useful when trying to get visibility into cloud components that can otherwise be considered as black boxes - in short, the blog outlines how cloud services, that you can not instrument with traditional APM solutions, produce log data that you can be used to get visibility into those cloud components and services. Furthermore, you can now also capture logs from your users' web browsers, or mobile devices in real time that give true end-to-end visibility of your application from the client device, though your middleware components and all the way to the database - so that you can also track events through complex stacks.
  • Logs maintain the evidence: Finally, and most important of all in my opinion, is that dashboards based on log data have an important property that does not exist when creating dashboards with many other approaches - i.e. your logs maintain the evidence! This means that if there is a spike in the number of signups or an increase in your customers' using a particular feature, you can quickly validate what caused that change. Validating your data is something that can be particularly painstaking when using APM, web analytics tools or home grown metrics dashboards.

When trying to validate metrics with other monitoring approaches the process usually goes as follows:

  1. you see a sudden spike in one of your metrics, for example signups are up 200% from yesterday.
  2. knowing that there is no such thing as a free lunch, and the fact you didn't kick off any new marketing campaigns recently, you wonder how signups could have increased in this way?
  3. you ask one of your developers, who is responsible for building your home grown metrics dashboard, to check this out and figure out what was responsible for the change.
  4. the developer is pretty busy and comes back a day or two later, after checking the code and one or two databases, explaining that you've been spammed and that the increase in signups was a result of some spammer signing up for a bunch of accounts
  5. you knew there was no such thing as a free lunch :) but it's two days later and you feel a little frustrated having to wait so long for an answer

If you've created your dashboard from your logs the process looks more like this:

  1. you see a sudden spike in one of your metrics, for example signups are up 200% from yesterday
  2. knowing that there is no such thing as a free lunch, and the fact you didn't kick off any new marketing campaigns recently, you click on the spike to drill down into the log data (i.e. the evidence) and look at the list of people who signed up today - and you immediately see the same email address pattern over and over again and you see that someone has been spamming you - QED :)Log Data Insights

Given the above, I am really pleased to announce our new real-time visualizations that are available out of the box when you use Logentries. Our new Log Insights provide a real-time dashboard with a high level view into important events that are occurring in your system. A few of the benefits include:

  • No Search required: Our new dashboard is available out of the box and requires no setup or requirement to run complex search queries on your data. It gives you an immediate view on important trending events and data volumes from your different systems.
  • Track event volume and identify trends in important events: The dashboards show volume of data from your different components, the distribution of these events over time, as well as how important events you have tagged are trending across your systems.
  • Drill down to view the evidence: The dashboards are completely clickable - so you can drill down into your logs to validate any spikes or trends in your data. Spikes and trends can be easily identified such that you can easily dig into these to better understand their root cause.
  • Share insights across your team(s): Because they have been designed to be easy-to-use and do not require complex search queries to build, the dashboards can be used to easily share insights related to your systems across different teams in your organization such as development, test, support, devops, product...and more. As I said above this is really only limited by what data you capture in your logs.

As always looking forward to your feedback on our latest feature - so do let us know what you think! or hit us up on twitter @logentries.

 

More Stories By Trevor Parsons

Trevor Parsons is Chief Scientist and Co-founder of Logentries. Trevor has over 10 years experience in enterprise software and, in particular, has specialized in developing enterprise monitoring and performance tools for distributed systems. He is also a research fellow at the Performance Engineering Lab Research Group and was formerly a Scientist at the IBM Center for Advanced Studies. Trevor holds a PhD from University College Dublin, Ireland.

@MicroservicesExpo Stories
A strange thing is happening along the way to the Internet of Things, namely far too many devices to work with and manage. It has become clear that we'll need much higher efficiency user experiences that can allow us to more easily and scalably work with the thousands of devices that will soon be in each of our lives. Enter the conversational interface revolution, combining bots we can literally talk with, gesture to, and even direct with our thoughts, with embedded artificial intelligence, wh...
IoT generates lots of temporal data. But how do you unlock its value? How do you coordinate the diverse moving parts that must come together when developing your IoT product? What are the key challenges addressed by Data as a Service? How does cloud computing underlie and connect the notions of Digital and DevOps What is the impact of the API economy? What is the business imperative for Cognitive Computing? Get all these questions and hundreds more like them answered at the 18th Cloud Expo...
Cloud-based NCLC (No-code/low code) application builder platforms empower everyone in the organization to quickly build applications and executable processes that broaden access, deepen collaboration, and enhance transparency for all team members. Line of business owners (LOBO) and operations managers know best their part of the business and their processes. IT departments are beginning to leverage NCLC platforms to empower and enable LOBOs to lead the innovation, transform the organization, an...
@DevOpsSummit taking place June 7-9, 2016 at Javits Center, New York City, and Nov 1-3, 2016, at the Santa Clara Convention Center in Santa Clara, CA, is co-located with the 18th International @CloudExpo and will feature technical sessions from a rock star conference faculty and the leading industry players in the world.
SYS-CON Events announced today the Docker Meets Kubernetes – Intro into the Kubernetes World, being held June 9, 2016, in conjunction with 18th Cloud Expo | @ThingsExpo, at the Javits Center in New York, NY. Register for 'Docker Meets Kubernetes Workshop' Here! This workshop led by Sebastian Scheele, co-founder of Loodse, introduces participants to Kubernetes (container orchestration). Through a combination of instructor-led presentations, demonstrations, and hands-on labs, participants learn ...
Just last week a senior Hybris consultant shared the story of a customer engagement on which he was working. This customer had problems, serious problems. We’re talking about response times far beyond the most liberal acceptable standard. They were unable to solve the issue in their eCommerce platform – specifically Hybris. Although the eCommerce project was delivered by a system integrator / implementation partner, the vendor still gets involved when things go really wrong. After all, the vendo...
The initial debate is over: Any enterprise with a serious commitment to IT is migrating to the cloud. But things are not so simple. There is a complex mix of on-premises, colocated, and public-cloud deployments. In this power panel at 18th Cloud Expo, moderated by Conference Chair Roger Strukhoff, panelists will look at the present state of cloud from the C-level view, and how great companies and rock star executives can use cloud computing to meet their most ambitious and disruptive business ...
Agile teams report the lowest rate of measuring non-functional requirements. What does this mean for the evolution of quality in this era of Continuous Everything? To explore how the rise of SDLC acceleration trends such as Agile, DevOps, and Continuous Delivery are impacting software quality, Parasoft conducted a survey about measuring and monitoring non-functional requirements (NFRs). Here's a glimpse at what we discovered and what it means for the evolution of quality in this era of Continuo...
You might already know them from theagileadmin.com, but let me introduce you to two of the leading minds in the Rugged DevOps movement: James Wickett and Ernest Mueller. Both James and Ernest are active leaders in the DevOps space, in addition to helping organize events such as DevOpsDays Austinand LASCON. Our conversation covered a lot of bases from the founding of Rugged DevOps to aligning organizational silos to lessons learned from W. Edwards Demings.
When I talk about driving innovation with self-organizing teams, I emphasize that such self-organization includes expecting the participants to organize their own teams, give themselves their own goals, and determine for themselves how to measure their success. In contrast, the definition of skunkworks points out that members of such teams are “usually specially selected.” Good thing he added the word usually – because specially selecting such teams throws a wrench in the entire works, limiting...
As AT&Ts VP of Domain 2.0 architecture writes one aspect of their Domain 2.0 strategy is a goal to embrace a Microservices Application Architecture. One page 9 they describe how these envisage them fitting into the ECOMP architecture: "The initial steps of the recipes include a homing and placement task using constraints specified in the requests. ‘Homing and Placement' are micro-services involving orchestration, inventory, and controllers responsible for infrastructure, network, and applicati...
Application development and delivery methods have undergone radical changes in recent years to improve scalability and resiliency. Container images are the new build and deployment artifacts that are used to ship and run software. While startups have long been comfortable experimenting with and embracing new technologies, even large enterprises are now re-architecting their software systems so that they can benefit from container-enabled micro services architectures. With the launch of DC/OS, w...
Many banks and financial institutions are experimenting with containers in development environments, but when will they move into production? Containers are seen as the key to achieving the ultimate in information technology flexibility and agility. Containers work on both public and private clouds, and make it easy to build and deploy applications. The challenge for regulated industries is the cost and complexity of container security compliance. VM security compliance is already challenging, ...
Earlier this week, we hosted a Continuous Discussion (#c9d9) on Continuous Delivery (CD) automation and orchestration, featuring expert panelists Dondee Tan, Test Architect at Alaska Air, Taco Bakker, a LEAN Six Sigma black belt focusing on CD, and our own Sam Fell and Anders Wallgren. During this episode, we discussed the differences between CD automation and orchestration, their challenges with setting up CD pipelines and some of the common chokepoints, as well as some best practices and tips...
SYS-CON Events announced today TechTarget has been named “Media Sponsor” of SYS-CON's 18th International Cloud Expo, which will take place on June 7–9, 2016, at the Javits Center in New York City, NY, and the 19th International Cloud Expo, which will take place on November 1–3, 2016, at the Santa Clara Convention Center in Santa Clara, CA. TechTarget is the Web’s leading destination for serious technology buyers researching and making enterprise technology decisions. Its extensive global networ...
Korean Broadcasting System (KBS) will feature the upcoming 18th Cloud Expo | @ThingsExpo in a New York news documentary about the "New IT for the Future." The documentary will cover how big companies are transmitting or adopting the new IT for the future and will be filmed on the expo floor between June 7-June 9, 2016, at the Javits Center in New York City, New York. KBS has long been a leader in the development of the broadcasting culture of Korea. As the key public service broadcaster of Korea...
Automation is a critical component of DevOps and Continuous Delivery. This morning on #c9d9 we discussed CD Automation and how you can apply Automation to accelerate release cycles, improve quality, safety and governance? What is the difference between Automation and Orchestration? Where should you begin your journey to introduce both?
While there has been much ado about interoperability, there are still no real solutions, same as last year and the year before that. The large EHR vendors who continue to dominate the market still maintain that interoperability is all but solved, still can't connect EHRs across the continuum causing frustration by providers and a disservice to patients. The ONC pays lip service to the problem, but that is about it. It is time for the healthcare industry to consider alternatives like middleware w...
With major technology companies and startups seriously embracing IoT strategies, now is the perfect time to attend @ThingsExpo 2016 in New York and Silicon Valley. Learn what is going on, contribute to the discussions, and ensure that your enterprise is as "IoT-Ready" as it can be! Internet of @ThingsExpo, taking place Nov 3-5, 2015, at the Santa Clara Convention Center in Santa Clara, CA, is co-located with 17th Cloud Expo and will feature technical sessions from a rock star conference faculty ...
Our CTO, Anders Wallgren, recently sat down to take part in the “B2B Nation: IT” podcast — the series dedicated to serving the IT professional community with expert opinions and advice on the world of information technology. Listen to the great conversation, where Anders shares his thoughts on DevOps lessons from large enterprises, the growth of microservices and containers, and more.