Graylog, headquartered in Houston, offers their eponymous platform for centralized log management that helps users find meaning in data faster so as to take action immediately. Graylog is available via Enterprise and Cloud plans, but also has a Small Business Plan, and an Open (free) plan with limited features.
N/A
SolarWinds Papertrail
Score 8.9 out of 10
N/A
Austin based SolarWinds acquired log management tool Papertrail in April, 2015.
N/A
vRealize Operations (discontinued)
Score 9.1 out of 10
N/A
vRealize Operations, or Aria Operations, provided simplified and automated IT Operations Management across private, hybrid, and multi-cloud environments, and visibility into the entire tech stack, including all physical, virtual, and cloud infrastructure components. The product is no longer available for sale.
For small companies, Graylog is the best solution possible. It's easy to configure and "just works." Above everything else, it's free. The only thing I hold against it is the fact that it's Linux-based. [This] makes sense because Elasticsearch is Linux-based. But Linux adds a layer of complexity that we don't need for something basic as a logging server. I'm pretty sure that we would have had a logging server years earlier if I had to convince quite a few decision-making people to go ahead with it anyway.
As a 3rd party endpoint, SolarWinds Papertrail did exactly what it needed to. My hesitation is on the technical aptitude of the colleague receiving the recommendation, as the overall level of command line skill/understanding would have to be high. Web applications are a great solution here, but MOST of them already provide some sort of logging output. The scenario would definitely be in the situation where logging wasn't readily available in the current solution space. IF something like SolarWinds Papertrail was needed, it's probably the de facto thing that I would recommend.
With the introduction of API-based event alerts, there is no need for a proxy, which is a good option. Its ability to manage infra on a real-time basis is a good option that helps monitor, administer and troubleshoot virtual machines.
Graylog does a great job of its core function: log aggregation, retention, and searching.
Graylog has a very flexible configuration. The backend for storage is Elasticsearch and MongoDB is used to store the configuration. You have to option to make your configuration as simple as possible by storing everything on one box, or you can scale everything out horizontally by using a cluster of Elasticsearch nodes and MongoDB servers with several Graylog servers pointed to all the necessary nodes.
Graylog does a good job of abstracting away a fair portion of Elasticsearch index management (sharding, creation, deletion, rotation, etc).
Graylog is easy to deploy. The tricky part is to configure all hosts that are going to send their log data to Graylog, considering the retention period of this data, it will need a lot of disk space to store it. Its rotation works fine. It is very simple to navigate and explore the data you send to it, and very easy to filter and export them too.
It's extremely easy to use. I and new colleagues have never had any issues configuring this tool or setting it up, it works almost out of the box with very simple instructions to follow to configure it to our own environment. I would highly recommend it on that ability alone.
It has a good GUI to monitor real-time logs for cloud applications. This is quite a useful tool and preferred over most of the competitive applications in the market.
Community support does not give simple straightforward answers; simply search up Graylog Issues and look at some of the responses on the forums. The documentation is your only hope if you are on the free version, as you can NOT purchase only support. The few times I have worked with Graylog Enterprise support they were great though.
I honestly have never had the need to use the support team, as we have not run into any issues so far. If we did however, judging from how the tool itself works, I don't doubt that the team would provide excellent support for any issues that we may possibly run into.
The support is pretty good however some of the KB articles still reference different versions of the product so it can be hard to find answers to common questions
In terms of log aggregation, the free product fully stacks up with the competitors listed. Full control over the data ingests for flexible configuration. Graylog even better on that front than AlienVault USM because you cannot configure the variable mapping. We haven't used the threat exchange stuff or correlation. But with regex searches, we have created function dashboards that show threat theater pictures of our network based on logs from our firewall.
CloudWatch, by itself, is terrible at search. CloudWatch Insights works great and has powerful search capabilities, but it's more difficult to set up alerts. Also, because Insights charges per search, you have the potential to accumulate a large bill if you need to do many searches. I like that SolarWinds Papertrail has a known monthly cost.
SCOM was quite overwhelming when we first set up a POC for it. There was just too much for one person to handle. With vROPs I can manage the product and provide the support needed for my environment. We also have a Solarwinds environment that provides us with a level of detail and alerting we have come to rely upon. vROPS takes it to another level because it links directly into vCenter to provide you with a complete picture of your virtual environment.
We believe that the ability to preplan deployments with vRealize has proven its return on investments.
Our troubleshooting time has been reduced with vrealize because its constantly collecting performance data. typically vrealize will tell us cause of fault before we can determine it ourselves.
