AWS CloudTrail vs. Splunk Infrastructure Monitoring

It is necessary to enable [AWS] Cloudtrail when using AWS in a production environment, otherwise you will not have any idea what is happening within your accounts. Third party monitoring applications will all require [AWS] CloudTrail to be enabled as well. I would not recommend it solely as a monitoring tool, to get the most out of it you must send the logs elsewhere. Either to Cloudwatch logs or a third party product.

Incentivized

Splunk Infrastructure Monitoring is well suited for any complicated environment where you have apps and servers across multiple clouds and platforms and products. If you have a data centre where all your apps and servers are in one single network, you could probably get away with older solutions. But for any modern, complex, hybrid-cloud microservices environment, Splunk Infrastructure Monitoring is a must-have.

Incentivized

• API Log
• User activity tracking
• Real-time alerts

Incentivized

• SignalFX handles historical metric aggregation exceptionally well, providing a multifaceted approach to event detection based on anomalies.
• SignalFX's cost is incredibly flexible with their pricing model of DPM (data-point per minute) vs the traditional "per host" model that most monitoring SaaS use.
• SignalFX support is responsive and knowledgeable, very eager to help solve your immediate problems.
• SignalFX integrations is vast and constantly growing, making adoption easy even when multiple different open-source technologies are used in your stack.

Incentivized

• [In my experience] Cost can easily get out of control with multiple trails on full logging
• Logs can be difficult to decipher

Incentivized

• Better integration with our clients (native mobile clients SDKs will be great).
• A way to easily tag filters and move them across metrics/formula.
• Alert system to easy false [alarm] and hard to configure.
• Be able to have group more dimensions (and have more values on each).

Incentivized

Good: Stable system with low error rate Easy to use for simple use cases Bad: UI is not very clear for complex usage Mobile view (when logged in from phone) is bad No library for .net

Incentivized

I find that learning the interface can take some time. We need a better show-and-tell on how the Teams pages, Dashboard Groups, Dashboards and charts delay. Advance SignalFlow is sometimes hard to build. Some better samples of advanced SignalFlow would be helpful. For example, Splunk SPL has a vast resource of examples.

Incentivized

I think in the end, CloudTrail has more features and you can dive deeper inside the logs so it depends on your usage and what you expect in the end to make the right choice, I would say that both tools are really useful and bring a lot of benefits to I.T. companies.

Incentivized

They’re not for the same purpose but we’re using NewRelic and Honeycomb for monitoring purposes. NewRelic is used for HTTP client monitoring for system related throughput, error, database and external client monitoring. Honeycomb is used to monitor actual HTTP request/response values. Splunk [Infrastructure Monitoring] is used for real-time application related throughout and error monitoring.

Incentivized

• Allows us to investigate any strange api actions
• Increases security
• Audit trail of changes made in AWS

Incentivized

• Reduced downtime.
• Caused us to get a lot of spam when we redeployed apps and old instances stopped sending metrics. Muting alerts solves this, but people often forget to do it or do it incorrectly.
• Helped us find historical info about instances/apps.

Incentivized