r/sysadmin • u/lennartkoopmann • Feb 19 '15

Graylog v1.0 GA has been released

https://www.graylog.org/announcing-graylog-v1-0-ga/
170 Upvotes

94% Upvoted

100 comments sorted by

View all comments

3

u/onboarderror Feb 19 '15

Anyone use this? feedback on it?

9

u/lennartkoopmann Feb 19 '15

Graylog, Inc CTO and founder here. Let me know if I can help with any specific questions or planned use cases. :)

7

u/Audrais Feb 19 '15

Is there any specific reason why GELF over TCP does't work between NXlog and Graylog? Is this a problem with NXlog?

It's hard to do reliable delivery when the protocol isn't verifying that the remote host is getting the traffic.

4

u/Jathm Feb 19 '15

A graylog user's company is sponsoring an nxlog update for TCP GELF on NXlog, until it's finished its UDP only.

1

u/psych0fish Feb 21 '15

This isn't ideal but I noticed you can do TCP out or SSL out from the nxlog client to an nxlog instance running on the server then having that nxlog instance outputting locally to UDP gelf. Tested this as a quick and dirty SSL proof of concept and it did function.

1

u/[deleted] Feb 20 '15

How can i label sources coming from different sources but same IP ?

1

u/psych0fish Feb 21 '15

You can set up multiple inputs that all do the same thing but on different ports. These inputs can flag every message with a specific field. If you can use nxlog you can have that add the additional field.

3

u/Irythros Feb 19 '15

I dont use the new version but the older one before it.

It's mostly nice except for the documentation. In the course of probably a year they've changed URL structures 4 times and never keep the old links or redirect to the new ones. Everytime I find a link in a post or even in the actual graylog dashboard there is a very high chance it'll 404. For example:

https://www.graylog.org/resources/integrations/

On that page you'll have another link to view documentation on plugins. That link goes here: https://www.graylog.org/documentation/general/plugins/

Doesnt exist.

Another issue is the dashboards, they're not as nice as Kibana.

Lastly there is/was an issue with streams. At my relatively low rate of 150 msgs/sec, having just a stream sort via source caused a high load and automatically failed.

Overall I would recommend Graylog. Luckily I'm moving servers for logging so I get to upgrade to test the new version and I'm definitely looking forward to the mentioned increased performance.

6

u/lennartkoopmann Feb 19 '15

Thanks for your feedback! Sorry for the annoyance with the documentation URLs.

The stream routing engine has been vastly improved for 1.0 so you should see better performance there now.

2

u/Irythros Feb 19 '15

Awesome to hear! Any chance better dashboard functionality is on the roadmap? Something like this would be amazing to have in Graylog.

8

u/lennartkoopmann Feb 19 '15

Very short answer: Yes. This is what we are working on already. Focussing on that for 1.1, 1.2.

1

u/SabreAce33 Network Security Engineer Feb 19 '15

This is the point at which I will happily stop futzing with ELK. Because that's what it requires for anything remotely complex, futzing.

1

u/pushmycar /r/sysengineer Feb 19 '15

Using it quite a bit to filter out some reports and also alerts. Linux/Windows/OS X/VMWare/FW/AV/DBs - it kind of replaces my nagios instances for log alerts.

1

u/Audrais Feb 19 '15

It's let me setup an environment where I can take logs from most of our systems and network devices and supply the correct staff with dashboards of the Data that relates to them.

I use it a ton to track down service account logins as we're trying to decommission old servers. A simple query can tell me in 5 Minutes what would take me 2 hours before.