4 ms·

I'm evaluating Graylog as a piece in our monitoring infrastructure. Does anybody have some experience using it in production?

whiskykilo 12y ago
We have been using it in production, it rocks! Very powerful tool and the company behind it is full of great, helpful folks.
gtirloni 12y ago
+1 The solution seems neat. It'd be nice to know who is using it in production, how big is their environment, etc. I couldn't find much information online.
- whiskykilo 12y ago
  We're receiving roughly 200 msgs/s in our environment. We have it set up in an active/active environment across two data centers. It's been rock solid for us. It takes a little bit of time to get certain applications to send messages properly, but once you do, it's pure gold. We are using NXLog on our Windows servers to send event log messages in GELF format. This allows us to truly delve in and search event logs so much easier than what we normally would be able to in Windows.
acamilo 12y ago
we are using it in production and works very well. ~200 clients sending events with a total of 63,996,350 events.
druiid 12y ago
Yep! We do about 5k events/sec and it holds up pretty well as long as you throw enough memory at it (It's a java app). Make sure you have a cluster though if you're going to be doing those kinds of levels. Feel free to respond if you have any other questions. I'll be testing out the 1.0 release myself today.
nirvdrum 12y ago
I've used it and have colleagues that have used it a few companies. I would suggest to get the most out of it, you should set up some sort of tagged logging. In Ruby, there's log4r + log4r-gelf to add additional context (e.g., Rails request GUID), that way you can easily and quickly link related messages. If you lack that flexibility, Graylog's extractors work rather nicely too. It's just a lot harder to manage, IMHO. It's really helpful being able to pull up all requests for a single user across the cluster. Or track the status of all components of a Sidekiq job. Or see which API requests are most popular. Etc.
exabrial 12y ago
Yes. We've been using it in production for about 1.5 years to gather all of our syslog and our application logs. No problems at all, and we're up to about 20 shards of data now. Honestly, I have no idea what we did before we started using it. It's an absolutely essential tool.

whiskykilo 12y ago

We have been using it in production, it rocks! Very powerful tool and the company behind it is full of great, helpful folks.

gtirloni 12y ago

+1 The solution seems neat. It'd be nice to know who is using it in production, how big is their environment, etc. I couldn't find much information online.

whiskykilo 12y ago
We're receiving roughly 200 msgs/s in our environment. We have it set up in an active/active environment across two data centers. It's been rock solid for us. It takes a little bit of time to get certain applications to send messages properly, but once you do, it's pure gold. We are using NXLog on our Windows servers to send event log messages in GELF format. This allows us to truly delve in and search event logs so much easier than what we normally would be able to in Windows.

acamilo 12y ago

we are using it in production and works very well. ~200 clients sending events with a total of 63,996,350 events.

druiid 12y ago

Yep! We do about 5k events/sec and it holds up pretty well as long as you throw enough memory at it (It's a java app). Make sure you have a cluster though if you're going to be doing those kinds of levels. Feel free to respond if you have any other questions. I'll be testing out the 1.0 release myself today.

nirvdrum 12y ago

I've used it and have colleagues that have used it a few companies. I would suggest to get the most out of it, you should set up some sort of tagged logging. In Ruby, there's log4r + log4r-gelf to add additional context (e.g., Rails request GUID), that way you can easily and quickly link related messages. If you lack that flexibility, Graylog's extractors work rather nicely too. It's just a lot harder to manage, IMHO. It's really helpful being able to pull up all requests for a single user across the cluster. Or track the status of all components of a Sidekiq job. Or see which API requests are most popular. Etc.

exabrial 12y ago

Yes. We've been using it in production for about 1.5 years to gather all of our syslog and our application logs. No problems at all, and we're up to about 20 shards of data now. Honestly, I have no idea what we did before we started using it. It's an absolutely essential tool.