Graylog vs. LogicMonitor

For small companies, Graylog is the best solution possible. It's easy to configure and "just works." Above everything else, it's free. The only thing I hold against it is the fact that it's Linux-based. [This] makes sense because Elasticsearch is Linux-based. But Linux adds a layer of complexity that we don't need for something basic as a logging server. I'm pretty sure that we would have had a logging server years earlier if I had to convince quite a few decision-making people to go ahead with it anyway.

Incentivized

Well Suited to: - MSPs with multiple clients - Network segmentation where a single device can't communicate to everything and collection devices are needed in each environment Not well suited for: - Management functions that would need to change settings on a device - Self contained environments with no outside network access

Incentivized

• Graylog does a great job of its core function: log aggregation, retention, and searching.
• Graylog has a very flexible configuration. The backend for storage is Elasticsearch and MongoDB is used to store the configuration. You have to option to make your configuration as simple as possible by storing everything on one box, or you can scale everything out horizontally by using a cluster of Elasticsearch nodes and MongoDB servers with several Graylog servers pointed to all the necessary nodes.
• Graylog does a good job of abstracting away a fair portion of Elasticsearch index management (sharding, creation, deletion, rotation, etc).

Incentivized

• LogicMonitor is very customizable. We can build whatever modules we need, because it uses standard protocols like HTTPS, SNMP and WMI to gather data and metrics.
• We like that LogicMonitor is an agentless solution for our use case. Not all customers will allow an agent-based approach to 3rd party tools.
• LogicMonitor has thousands of out of the box modules, which work on their own and also act as good baselines for the ones that we will end up customizing more. We are rarely starting at zero when we decide to do something new with LogicMonitor.
• LogicMonitor has great documentation, and support has been helpful in the instances where we've needed them.

Incentivized

• Support for more log sources
• Event alerts/emails - Some cases where unable to separate data from multiple clients, and no easy fix
• API - Limits results to 10,000 and can cause server to lockup on queries that exceed the limit

Incentivized

• Because of the rapid change in technology, maintaining DataSources to the most current level can be time-consuming for staff.
• The network discovery and mapping capabilities are not as robust when compared to other solutions
• While it can back-up configuration files on devices, it does not have the ability to push or modify configuration files back to devices.

Incentivized

This product has met virtually all of our needs. It was easy to implement and has been simple to support. Customization has been intuitive with many options available. They keep adding features and expanding available options. The future of LogicMonitor looks even better than it is today which is very promising. The management and support teams at LogicMonitor are always helpful

Incentivized

Set up is super easy. Just stand up a small Linux or Windows server to act as a collector. There are no agents to install on monitored devices and all you need is SNMP or WMI access. When creating dashboards, all you have to do is find the widget on the device you want to show up and choose the menu option to add it.

Incentivized

Community support does not give simple straightforward answers; simply search up Graylog Issues and look at some of the responses on the forums. The documentation is your only hope if you are on the free version, as you can NOT purchase only support. The few times I have worked with Graylog Enterprise support they were great though.

Incentivized

The sales team support we received was top notch. They worked hand in hand to make sure the product met all expectations. So far we have not really had to work with support that much; we have worked with setup team after purchase to deploy product fully. No issues so far and we are four weeks in.

Incentivized

Add good training

Incentivized

The training is good but room to improve

Incentivized

We found the LogicMonitor documentation and online guides to be up to date and easy to follow. During our pre-sale proof of concept phase, we learned the basics of creating import CSV files and had the bulk of our devices added the first day. After the purchase, we used the professional services to get training on the entire system and help customizing everything to meet our needs. We also made use of the available certification online training courses for our power users to get them comfortable with the system.

Incentivized

In terms of log aggregation, the free product fully stacks up with the competitors listed. Full control over the data ingests for flexible configuration. Graylog even better on that front than AlienVault USM because you cannot configure the variable mapping. We haven't used the threat exchange stuff or correlation. But with regex searches, we have created function dashboards that show threat theater pictures of our network based on logs from our firewall.

Incentivized

During the evaluation process we looked a number of other solutions, a detailed technically analysis was carried out to map functionlity, deployment and scalabilty across the solutions. The primary areas that LogicMonitor succeeded are around the simplicity of deployment, scalability and to a lesser extent cost. Of the alternative products, Datadog is a better solution if your focus is on APM. However it will be harder to manage in a scaling MSP environment.

Pricing seems to be getting more and more aggressive, I worry that it's going to turn into ServiceNow or SAP and everything minor feature will be an extreme cost that prices out us and our customers

Incentivized

Haven't really used it but our initial onboarding PS was disappointing. Felt like we were being told what we needed to cover as opposed to what we wanted to cover. In addition, we were pushed into using the PS in tight time frames and we were not ready to do so.

Incentivized

• Graylog is just less expensive than some other options which meant it fit into our budget otherwise we might not be able to justify a higher cost.
• Being able to track issues that we normally couldn't track using other tools is a bonus to help us know of any issues we have and can fix before an outage or failure that could potentially cost money.
• We have had to spend more time than I would like to understand and customize Graylog which has taken time away from other tasks and projects.

Incentivized

• definitely adds a good amount of cost to any account which is not easy to sell to SMBs
• it does give a piece of mind knowing that everything is monitored and alerts will go out before users know something is not working

Incentivized