Sumo Logic - More than just log aggregation
November 14, 2017
Sumo Logic - More than just log aggregation
Score 10 out of 10
Vetted Review
Verified User
Overall Satisfaction with Sumo Logic
Sumo Logic is used mostly for analysis in gaps where other monitoring tools fall short. Specifically, log aggregation and even more importantly than the aggregation is that it uses intelligent (and customizable) heuristics to analyze logs for specific event information and sorting.
We use sumo logic primarily for historical analysis but it is very reliable and customizable. For example, for errors that show symptoms directly in their log files (which we already piped to sumo logic for historical analysis) we have used this to generate alerts. This is ideal as log errors often occur before a service fully crashes and has reduced our response time to these types of incidents.
Finally, we have turned some of these into dashboards for certain business users. I don't think there is much helpful use to technical needs, but it can help quickly satisfy business users by providing simple and quick insights into the IT infrastructure. This is a common type of request for internal IT and it is nice to be able to actually fulfill those tickets instead of declining them (without a good tool, it might not be practical to fulfill such small impact requests).
We use sumo logic primarily for historical analysis but it is very reliable and customizable. For example, for errors that show symptoms directly in their log files (which we already piped to sumo logic for historical analysis) we have used this to generate alerts. This is ideal as log errors often occur before a service fully crashes and has reduced our response time to these types of incidents.
Finally, we have turned some of these into dashboards for certain business users. I don't think there is much helpful use to technical needs, but it can help quickly satisfy business users by providing simple and quick insights into the IT infrastructure. This is a common type of request for internal IT and it is nice to be able to actually fulfill those tickets instead of declining them (without a good tool, it might not be practical to fulfill such small impact requests).
- Log Aggregation and uploading. The architecture for Sumo Logic makes a great deal of sense and works very well.
- Automated analysis. It still impresses me how well a newly uploaded log can be broken into intelligent parts, then searched and sorted using their tools.
- Dashboards. It might not be what YOU will need as an IT admin, but you can give access to these dashboards easily to business users who love that kind of stuff. Most other types of (monitoring / alerting) tools, for no apparent reason, lack this feature.
- Reporting, monitoring, and graphing. Given, you need to have useful log generation for an application or service as a prerequisite for sumo logic to be able to gain use, once it has it is an amazingly powerful tool.
- I do not think, as I remember, Sumo Logic works well with things that don't generate as a 'standard' of log. Therefore, sumo logics natural limitation is that it works best with pre-existing logs and doesn't do well to monitor a system for other types of events that don't reach a flat file or standardized log format. If you develop mostly internal applications and like to rely on sumo logic, you may find yourselves begging the developers for more useful and cleaner logs.
- Sumo Logic helps meet audit points fairly well, as we see it, it is a secondary control for many events as it is hard to hide from sumo logic. Sumo Logic sends things quickly to the cloud service.
- Sumo Logic is not very expensive compared to suites with similar feature sets or the cost per data processed.
- Unexpectedly we were able to use this product to give business insights into the infrastructure. It turned out to be an excellent tool for this use case. Business users and C Levels love this kind of insight.
- Reporting was more useful than expected. This was the first log collector most of us have used and we are impressed with the reports we can drive from it. It gives a lot of information about the business with little effort. Again, our initial purchase was more for the need of historical data.
We felt the features were comparable and Sumo Logic offered a better price. This was our first log aggregation tool so we don't have a lot of insight for competing products. I speak with many others specifically regarding Splunk and it seems to be comparable in many ways except price. I encourage others to try sumo for that reason.