Graylog, headquartered in Houston, offers their eponymous platform for centralized log management that helps users find meaning in data faster so as to take action immediately. Graylog is available via Enterprise and Cloud plans, but also has a Small Business Plan, and an Open (free) plan with limited features.
N/A
LogDNA
Score 9.0 out of 10
N/A
LogDNA headquartered in Mountain View offers their eponymous cloud log management or on-prem/self-hosted log management solution.
For small companies, Graylog is the best solution possible. It's easy to configure and "just works." Above everything else, it's free. The only thing I hold against it is the fact that it's Linux-based. [This] makes sense because Elasticsearch is Linux-based. But Linux adds a layer of complexity that we don't need for something basic as a logging server. I'm pretty sure that we would have had a logging server years earlier if I had to convince quite a few decision-making people to go ahead with it anyway.
Anytime we need to make any kind of log on any platform that we use, LogDNA is well suited. It is primarily used for logging errors on our server but also used for checking issues within our iOS apps when we need to identify a critical issue that is occurring. The search feature is very very good!
Graylog does a great job of its core function: log aggregation, retention, and searching.
Graylog has a very flexible configuration. The backend for storage is Elasticsearch and MongoDB is used to store the configuration. You have to option to make your configuration as simple as possible by storing everything on one box, or you can scale everything out horizontally by using a cluster of Elasticsearch nodes and MongoDB servers with several Graylog servers pointed to all the necessary nodes.
Graylog does a good job of abstracting away a fair portion of Elasticsearch index management (sharding, creation, deletion, rotation, etc).
Graylog is easy to deploy. The tricky part is to configure all hosts that are going to send their log data to Graylog, considering the retention period of this data, it will need a lot of disk space to store it. Its rotation works fine. It is very simple to navigate and explore the data you send to it, and very easy to filter and export them too.
It's really easy to use and powerful. But at a few times, the UI may feel sluggish, which is a bit expected, since it's displaying live stream of heavy data.
Community support does not give simple straightforward answers; simply search up Graylog Issues and look at some of the responses on the forums. The documentation is your only hope if you are on the free version, as you can NOT purchase only support. The few times I have worked with Graylog Enterprise support they were great though.
It is very very good. They are responsive and very helpful. They also take the time to walk you through the issues you are having. But honestly, it is so straightforward that you rarely need to get support from their team. They are very helpful when you do need their support though.
In terms of log aggregation, the free product fully stacks up with the competitors listed. Full control over the data ingests for flexible configuration. Graylog even better on that front than AlienVault USM because you cannot configure the variable mapping. We haven't used the threat exchange stuff or correlation. But with regex searches, we have created function dashboards that show threat theater pictures of our network based on logs from our firewall.
LogDNA was already setup when I started and it is offered through Heroku so that's why it was chosen. It's also cheaper I believe. Compared to Logentries, it does the same thing.
