Slide 1
Slide 1 text
Metrics and an application log: Your
new best friend
Michael Heap (@mheap)
Presented at FOSDEM, February 2017
Slide 2
Slide 2 text
Me!
I’m Michael
I’m @mheap
Freelance @ Intechrity
Slide 3
Slide 3 text
Logging
Slide 4
Slide 4 text
1. Logging
2. Getting started
3. The ELK stack
4. Logs and dashboards
5. Log management
6. Supporting tools
7. Conclusion
Slide 5
Slide 5 text
1. Logging
2. Getting started
3. The ELK stack
4. Logs and dashboards
5. Log management
6. Supporting tools
7. Conclusion
Slide 6
Slide 6 text
1. Logging
2. Getting started
3. The ELK stack
4. Logs and dashboards
5. Log management
6. Supporting tools
7. Conclusion
Slide 7
Slide 7 text
1. Logging
2. Getting started
3. The ELK stack
4. Logs and dashboards
5. Log management
6. Supporting tools
7. Conclusion
Slide 8
Slide 8 text
1. Logging
2. Getting started
3. The ELK stack
4. Logs and dashboards
5. Log management
6. Supporting tools
7. Conclusion
Slide 9
Slide 9 text
1. Logging
2. Getting started
3. The ELK stack
4. Logs and dashboards
5. Log management
6. Supporting tools
7. Conclusion
Slide 10
Slide 10 text
1. Logging
2. Getting started
3. The ELK stack
4. Logs and dashboards
5. Log management
6. Supporting tools
7. Conclusion
Slide 11
Slide 11 text
1. Logging
2. Getting started
3. The ELK stack
4. Logs and dashboards
5. Log management
6. Supporting tools
7. Conclusion
Slide 12
Slide 12 text
Sound good?
Slide 13
Slide 13 text
Good!
Slide 14
Slide 14 text
1. Logging
2. Getting started
3. The ELK stack
4. Logs and dashboards
5. Log management
6. Supporting tools
7. Conclusion
Slide 15
Slide 15 text
Why log?
Slide 16
Slide 16 text
What went wrong?
(Error log)
Slide 17
Slide 17 text
Who visited us?
(Access log)
Slide 18
Slide 18 text
Who enabled ?
(Audit log)
Slide 19
Slide 19 text
Runtime documentation
(Application log)
Slide 20
Slide 20 text
I’m sold!
Slide 21
Slide 21 text
Can I have it for free?
Slide 22
Slide 22 text
Actually, yes!
Slide 23
Slide 23 text
(And more)
Slide 24
Slide 24 text
But that doesn’t help
my application
Slide 25
Slide 25 text
Two types of log
Slide 26
Slide 26 text
Human readable
Slide 27
Slide 27 text
Machine readable
Slide 28
Slide 28 text
Two types of log
Slide 29
Slide 29 text
One type of log
Slide 30
Slide 30 text
Machine and Human
readable
Slide 31
Slide 31 text
JSON / logfmt
Slide 32
Slide 32 text
What is an application log?
Slide 33
Slide 33 text
Debug information
Slide 34
Slide 34 text
Narrative information
Slide 35
Slide 35 text
Business information
Slide 36
Slide 36 text
“An application log
signposts every twist and
turn through the code”
Slide 37
Slide 37 text
1. Logging
2. Getting started
3. The ELK stack
4. Logs and dashboards
5. Log management
6. Supporting tools
7. Conclusion
Slide 38
Slide 38 text
Four W’s
Slide 39
Slide 39 text
When?
Slide 40
Slide 40 text
Who?
Slide 41
Slide 41 text
Where?
Slide 42
Slide 42 text
Why?
Slide 43
Slide 43 text
Getting started
Slide 44
Slide 44 text
error_log()
Slide 45
Slide 45 text
Slide 46
Slide 46 text
Slide 47
Slide 47 text
Slide 48
Slide 48 text
Pros
✴ It’s built in
Slide 49
Slide 49 text
Cons
✴ Is it semantically correct?
✴ Errors mixed with informational logs
✴ It’s not very powerful
Slide 50
Slide 50 text
Logging frameworks
Slide 51
Slide 51 text
1) Monolog
2) Everything else
Slide 52
Slide 52 text
pushHandler(new Monolog\Handler\StreamHandler('/tmp/app.log',
Monolog\Logger::DEBUG));
function countConsonants($str, $log){
$c = strlen(str_replace(['a','e','i','o','u'],'', $str));
$log->info("Consonants in {$str}: {$c}");
return $c;
}
echo countConsonants("Michael", $log);
Slide 53
Slide 53 text
pushHandler(new Monolog\Handler\StreamHandler('/tmp/app.log',
Monolog\Logger::DEBUG));
function countConsonants($str, $log){
$c = strlen(str_replace(['a','e','i','o','u'],'', $str));
$log->info("Consonants in {$str}: {$c}");
return $c;
}
echo countConsonants("Michael", $log);
Slide 54
Slide 54 text
pushHandler(new Monolog\Handler\StreamHandler('/tmp/app.log',
Monolog\Logger::DEBUG));
function countConsonants($str, $log){
$c = strlen(str_replace(['a','e','i','o','u'],'', $str));
$log->info("Consonants in {$str}: {$c}");
return $c;
}
echo countConsonants("Michael", $log);
Slide 55
Slide 55 text
pushHandler(new Monolog\Handler\StreamHandler('/tmp/app.log',
Monolog\Logger::DEBUG));
function countConsonants($str, $log){
$c = strlen(str_replace(['a','e','i','o','u'],'', $str));
$log->info("Consonants in {$str}: {$c}");
return $c;
}
echo countConsonants("Michael", $log);
Slide 56
Slide 56 text
pushHandler(new Monolog\Handler\StreamHandler('/tmp/app.log',
Monolog\Logger::DEBUG));
function countConsonants($str, $log){
$c = strlen(str_replace(['a','e','i','o','u'],'', $str));
$log->info("Consonants in {$str}: {$c}");
return $c;
}
echo countConsonants("Michael", $log);
Slide 57
Slide 57 text
[2016-05-25 03:56:01] my-app.INFO: Consonants in Michael: 4 [] []
Slide 58
Slide 58 text
FingersCrossedHandler
Slide 59
Slide 59 text
$log = new Monolog\Logger('my-app');
$streamHandler = new Monolog\Handler\StreamHandler('/tmp/app.log',
Monolog\Logger::DEBUG);
$fcHandler = new Monolog\Handler\FingersCrossedHandler($streamHandler,
Monolog\Logger::ERROR);
$log->pushHandler($fcHandler);
function countConsonants($str, $log){
$c = strlen(str_replace(['a','e','i','o','u'],'', $str));
$log->info("Consonants in {$str}: {$c}");
return $c;
}
echo countConsonants("Michael", $log);
Slide 60
Slide 60 text
$log = new Monolog\Logger('my-app');
$streamHandler = new Monolog\Handler\StreamHandler('/tmp/app.log',
Monolog\Logger::DEBUG);
$fcHandler = new Monolog\Handler\FingersCrossedHandler($streamHandler,
Monolog\Logger::ERROR);
$log->pushHandler($fcHandler);
function countConsonants($str, $log){
$c = strlen(str_replace(['a','e','i','o','u'],'', $str));
$log->info("Consonants in {$str}: {$c}");
return $c;
}
echo countConsonants("Michael", $log);
Slide 61
Slide 61 text
$log = new Monolog\Logger('my-app');
$streamHandler = new Monolog\Handler\StreamHandler('/tmp/app.log',
Monolog\Logger::DEBUG);
$fcHandler = new Monolog\Handler\FingersCrossedHandler($streamHandler,
Monolog\Logger::ERROR);
$log->pushHandler($fcHandler);
function countConsonants($str, $log){
$c = strlen(str_replace(['a','e','i','o','u'],'', $str));
$log->info("Consonants in {$str}: {$c}");
return $c;
}
echo countConsonants("Michael", $log);
Slide 62
Slide 62 text
No content
Slide 63
Slide 63 text
$log = new Monolog\Logger('my-app');
$streamHandler = new Monolog\Handler\StreamHandler('/tmp/app.log',
Monolog\Logger::DEBUG);
$fcHandler = new Monolog\Handler\FingersCrossedHandler($streamHandler,
Monolog\Logger::ERROR);
$log->pushHandler($fcHandler);
function countConsonants($str, $log){
$c = strlen(str_replace(['a','e','i','o','u'],'', $str));
$log->info("Consonants in {$str}: {$c}");
$log->error("Something bad happened");
return $c;
}
echo countConsonants("Michael", $log);
Slide 64
Slide 64 text
[2016-05-25 03:56:01] my-app.INFO: Consonants in Michael: 4 [] []
[2016-05-25 03:56:01] my-app.ERROR: Something bad happened [] []
Slide 65
Slide 65 text
Pros
✴ It’s an object! Dependency injection FTW
✴ Supports multiple log writers
✴ Log level support
Slide 66
Slide 66 text
Cons
✴ Instantiating an instance can be complicated
Slide 67
Slide 67 text
Error Levels
Slide 68
Slide 68 text
0. Emergency System is unusable
1. Alert Should be corrected immediately
2. Critical Critical conditions
3. Error Error conditions
4. Warning May indicate that an error will occur if action is not taken.
5. Notice Events that are unusual, but not error conditions.
6. Informational Normal operational messages that require no action.
7. Debug Information useful to developers for debugging the application.
Syslog (RFC 5424)
Slide 69
Slide 69 text
0. Emergency System is unusable
1. Alert Should be corrected immediately
2. Critical Critical conditions
3. Error Error conditions
4. Warning May indicate that an error will occur if action is not taken.
5. Notice Events that are unusual, but not error conditions.
6. Informational Normal operational messages that require no action.
7. Debug Information useful to developers for debugging the application.
PSR-3
Slide 70
Slide 70 text
1. Logging
2. Getting started
3. The ELK stack
4. Logs and dashboards
5. Log management
6. Supporting tools
7. Conclusion
Slide 71
Slide 71 text
Everything is on fire
Slide 72
Slide 72 text
The ELK Stack
Slide 73
Slide 73 text
Elasticsearch
Logstash
Kibana
Slide 74
Slide 74 text
Logstash
Elasticsearch
Kibana
Slide 75
Slide 75 text
Logstash
Slide 76
Slide 76 text
Beats
CouchDB_Changes
Drupal_DBLog
Elasticsearch
Exec
Event log
File
Ganglia
Gelf
Generator
Graphite
Github
Heartbeat
Heroku
HTTP
HTTP_Poller
IRC
IMAP
JDBC
JMX
Kafka
Log4J
Lumberjack
Meetup
Pipe
Puppet_Facter
Relp
RSS
Backspace
RabbitMQ
Redis
Salesforce
SNMPTrap
Stdin
sqlite
S3
SQS
Stomp
Syslog
TCP
Twitter
Unix
UDP
Varnishlog
WMI
Web socket
XMPP
Zenoss
ZeroMQ
Inputs
Slide 77
Slide 77 text
Filters
Slide 78
Slide 78 text
filter {
json {
source => "message"
add_field => [ “my_field", “mheap_%{host}” ]
}
}
Slide 79
Slide 79 text
filter {
kv {
default_keys => [ "from", "[email protected]",
"to", "[email protected]" ]
}
}
Slide 80
Slide 80 text
Accepted publickey for root from 172.14.183.11 port 22 ssh2
Slide 81
Slide 81 text
Accepted publickey for root from 172.14.183.11 port 22 ssh2
Slide 82
Slide 82 text
filter {
grok {
match => { "message" => "Accepted
%{WORD:auth_method} for %{USER:username} from
%{IP:src_ip} port %{INT:src_port} ssh2" }
}
}
Accepted publickey for root from 172.14.183.11 port 22 ssh2
Slide 83
Slide 83 text
filter {
grok {
match => { "message" => "Accepted
%{WORD:auth_method} for %{USER:username} from
%{IP:src_ip} port %{INT:src_port} ssh2" }
}
}
Accepted publickey for root from 172.14.183.11 port 22 ssh2
Slide 84
Slide 84 text
http://grokdebug.herokuapp.com/
Slide 85
Slide 85 text
Boundary
Circus
CSV
Cloud watch
Datadog
Datadog_Metrics
Email
Elastic search
Exec
File
Google BigQuery
Google Cloud Storage
Ganglia
Gelf
Graphtastic
Graphite
Hipchat
HTTP
IRC
InfluxDB
Juggernaut
Jira
Kafka
Lumberjack
Librato
Loggly
MongoDB
MetricCatcher
Nagios
Null
OpenTSDB
Pagerduty
Pipe
Riemann
Redmine
Rackspace
RabbitMQ
Redis
Riak
S3
SQS
Stomp
StatsD
Solr
SNS
Syslog
Stdout
TCP
UDP
WebHDFS
Websocket
XMPP
Outputs
Zabbix
ZeroMQ
Slide 86
Slide 86 text
Input -> Filter -> Output
Slide 87
Slide 87 text
Logstash is slow(ish)
Slide 88
Slide 88 text
Elasticsearch
Slide 89
Slide 89 text
Kibana
Slide 90
Slide 90 text
1. Logging
2. Getting started
3. The ELK stack
4. Logs and dashboards
5. Log management
6. Supporting tools
7. Conclusion
Slide 91
Slide 91 text
No content
Slide 92
Slide 92 text
No content
Slide 93
Slide 93 text
No content
Slide 94
Slide 94 text
No content
Slide 95
Slide 95 text
1. Logging
2. Getting started
3. The ELK stack
4. Logs and dashboards
5. Log management
6. Supporting tools
7. Conclusion
Slide 96
Slide 96 text
Asimov’s Law
Slide 97
Slide 97 text
“A robot may not injure a human being
or, through inaction, allow a human being
to come to harm.”
Slide 98
Slide 98 text
@mheap’s Law
Slide 99
Slide 99 text
“An application log may not injure a an
application’s performance or readability”
Slide 100
Slide 100 text
Plan for bursts of data
Slide 101
Slide 101 text
Disk space
Slide 102
Slide 102 text
Index management
Slide 103
Slide 103 text
Ship what’s relevant
Slide 104
Slide 104 text
Devs create dashboards
Slide 105
Slide 105 text
Unique request IDs
Slide 106
Slide 106 text
Normalise timezones
Slide 107
Slide 107 text
No really.
Normalise timezones
Slide 108
Slide 108 text
1. Logging
2. Getting started
3. The ELK stack
4. Logs and dashboards
5. Log management
6. Supporting tools
7. Conclusion
Slide 109
Slide 109 text
Filebeat
Slide 110
Slide 110 text
Graphite / Grafana
Slide 111
Slide 111 text
No content
Slide 112
Slide 112 text
No content
Slide 113
Slide 113 text
No content
Slide 114
Slide 114 text
Pagerduty
Slide 115
Slide 115 text
411
Slide 116
Slide 116 text
1. Logging
2. Getting started
3. The ELK stack
4. Logs and dashboards
5. Log management
6. Supporting tools
7. Conclusion
Slide 117
Slide 117 text
Logging is required
Slide 118
Slide 118 text
Developers are empowered
Slide 119
Slide 119 text
Logging isn’t free
Slide 120
Slide 120 text
“Would you rather fly slowly
or fly blind?”
Slide 121
Slide 121 text
Thanks!
I’ve been @mheap, you’ve been awesome.
Any questions?
https://joind.in/talk/54183