5 ms·

A distributed and coordination-free log management system

100 points by avitzurel 10y ago

treve 10y ago
'Coordination' in English ;)
- sagichmal 10y ago
  Coördination is proper English also :)
- jihadjihad 10y ago
  yeah, I guess the oklog folks have drunk the kool-aid put out by the New Yorker: http://www.newyorker.com/culture/culture-desk/the-curse-of-the-diaeresis http://www.newyorker.com/culture/culture-desk/the-curse-of-t...
  - rspeer 10y ago
    Diaeresis: a typographical accent used to remind you that you are reading the New Yorker.
- jagger27 10y ago
  I'm not offended by co-ordination either.
- solidsnack9000 10y ago
  The diaeresis and the umlaut both are two dots; but are different. The diaeresis indicates hiatus -- a pause between vowels, resulting in two syllables where we might otherwise be inclined to use one. This is the classical (and rare) use of this marker in English.
sagichmal 10y ago
Here's the blog post describing the system https://peter.bourgon.org/ok-log/ https://peter.bourgon.org/ok-log/ And the original HN post https://news.ycombinator.com/item?id=13418125 https://news.ycombinator.com/item?id=13418125
thisisananth 10y ago
The thought process that went into the design is very enlightening. Thanks for writing that up.
packetized 10y ago
While super-interesting (and something that I wish I had time to really evaluate against Elasticsearch/Solr), I feel like it's missing one of the most useful things about Loggly/ES/Solr - the ability to quickly visualize log trends. And despite the statement that it's a "distributed and coördination-free log management system for big ol' clusters", I'm confused why you would want a "big ol' cluster" without visualization or field searches more complex (and less computationally expensive) than regexes. Am I missing something? e: To be fair, I'm not attempting at all to defend Elasticsearch/Solr, just slightly confused about the actual use cases in prod.
- sagichmal 10y ago
  What does "the ability to quickly visualize log trends" mean concretely?
  - packetized 10y ago
    In my mind, some sort of graphical user interface that would allow you to query data and have the log system return results that are easily parsed. At the very least, have some sort of API that allows you to do this. The /query endpoint exists, but doesn't seem to return anything that's really fundamentally useful from a large-scale perspective.
    - benley 10y ago
      I agree that the nice graphical tools available for Elasticsearch are super useful, but it seems to me that those are not a feature of the logs storage or query interface, but rather one of an external app (e.g. kibana) that queries the system. It would actually be somewhat concerning to me if a system like Oklog had all those graphing and visualization features built-in; that would be quite some scope creep for a distributed storage engine :-P
      - dstroot 10y ago
        TL;DR So, can I run Kibana against OKlog? Totally agree on the separation of concerns: visualization vs storage and management.
solidsnack9000 10y ago
There is actual a fair amount of coordination in this logging system -- with the combination of redirects and gossip to handle them -- but it does seem to be the right kind of coordination.
kordless 10y ago
This looks pretty slick. There's a well done explanation of the architecture process in the blog.
_dark_matter_ 10y ago
He describes Heka (built by Mozilla) as abandoned. This is true, but we have a re-write in C that is significantly faster and in active development [0]. [0] https://github.com/mozilla-services/hindsight https://github.com/mozilla-services/hindsight
- sagichmal 10y ago
  Isn't it irresponsible to be writing infrastructure software like this in C nowadays?
  - aleksei 10y ago
    On HN: yes. In the real world: no.
    - floatboth 10y ago
      Regardless, it's weird coming from literally the company behind Rust…
  - viraptor 10y ago
    Irresponsible: no. A curious decision: definitely. I mean, there are many other options in the middle. Mixing go and c modules is possible. Unless it was just the case of not having go experience. Without much more info, it's silly to speculate though.
- akavel 10y ago
  Wow! Is it possible you could do some write-up on what was behind switching from Go to C for you? Also, whether you evaluated Rust in the meantime? Or just a short HN reply with a summary? From the readme I assume some performance arguments, but how did you predict that C will be faster, what were the pain points with Go in Heka?

100 points by avitzurel 10y ago

treve 10y ago

'Coordination' in English ;)

sagichmal 10y ago
Coördination is proper English also :)
jihadjihad 10y ago
yeah, I guess the oklog folks have drunk the kool-aid put out by the New Yorker: http://www.newyorker.com/culture/culture-desk/the-curse-of-the-diaeresis http://www.newyorker.com/culture/culture-desk/the-curse-of-t...
- rspeer 10y ago
  Diaeresis: a typographical accent used to remind you that you are reading the New Yorker.
jagger27 10y ago
I'm not offended by co-ordination either.
solidsnack9000 10y ago
The diaeresis and the umlaut both are two dots; but are different. The diaeresis indicates hiatus -- a pause between vowels, resulting in two syllables where we might otherwise be inclined to use one. This is the classical (and rare) use of this marker in English.

sagichmal 10y ago

Here's the blog post describing the system https://peter.bourgon.org/ok-log/ https://peter.bourgon.org/ok-log/ And the original HN post https://news.ycombinator.com/item?id=13418125 https://news.ycombinator.com/item?id=13418125

thisisananth 10y ago

The thought process that went into the design is very enlightening. Thanks for writing that up.

packetized 10y ago

While super-interesting (and something that I wish I had time to really evaluate against Elasticsearch/Solr), I feel like it's missing one of the most useful things about Loggly/ES/Solr - the ability to quickly visualize log trends. And despite the statement that it's a "distributed and coördination-free log management system for big ol' clusters", I'm confused why you would want a "big ol' cluster" without visualization or field searches more complex (and less computationally expensive) than regexes. Am I missing something? e: To be fair, I'm not attempting at all to defend Elasticsearch/Solr, just slightly confused about the actual use cases in prod.

sagichmal 10y ago
What does "the ability to quickly visualize log trends" mean concretely?
- packetized 10y ago
  In my mind, some sort of graphical user interface that would allow you to query data and have the log system return results that are easily parsed. At the very least, have some sort of API that allows you to do this. The /query endpoint exists, but doesn't seem to return anything that's really fundamentally useful from a large-scale perspective.
  - benley 10y ago
    I agree that the nice graphical tools available for Elasticsearch are super useful, but it seems to me that those are not a feature of the logs storage or query interface, but rather one of an external app (e.g. kibana) that queries the system. It would actually be somewhat concerning to me if a system like Oklog had all those graphing and visualization features built-in; that would be quite some scope creep for a distributed storage engine :-P
    - dstroot 10y ago
      TL;DR So, can I run Kibana against OKlog? Totally agree on the separation of concerns: visualization vs storage and management.

solidsnack9000 10y ago

There is actual a fair amount of coordination in this logging system -- with the combination of redirects and gossip to handle them -- but it does seem to be the right kind of coordination.

kordless 10y ago

This looks pretty slick. There's a well done explanation of the architecture process in the blog.

_dark_matter_ 10y ago

He describes Heka (built by Mozilla) as abandoned. This is true, but we have a re-write in C that is significantly faster and in active development [0]. [0] https://github.com/mozilla-services/hindsight https://github.com/mozilla-services/hindsight

sagichmal 10y ago
Isn't it irresponsible to be writing infrastructure software like this in C nowadays?
- aleksei 10y ago
  On HN: yes. In the real world: no.
  - floatboth 10y ago
    Regardless, it's weird coming from literally the company behind Rust…
- viraptor 10y ago
  Irresponsible: no. A curious decision: definitely. I mean, there are many other options in the middle. Mixing go and c modules is possible. Unless it was just the case of not having go experience. Without much more info, it's silly to speculate though.
akavel 10y ago
Wow! Is it possible you could do some write-up on what was behind switching from Go to C for you? Also, whether you evaluated Rust in the meantime? Or just a short HN reply with a summary? From the readme I assume some performance arguments, but how did you predict that C will be faster, what were the pain points with Go in Heka?