May 2025 Summaries

The OpenTelemetry Operator for Kubernetes offers a streamlined approach to observability by facilitating the deployment of a full OpenTelemetry pipeline that automatically collects and pushes trace data to Coralogix without the need for custom code or container patching. Using a Helm chart, users can deploy the OpenTelemetry Operator, integrate with Coralogix, and enable auto-instrumentation for supported languages like Java, Python, Node.js, .NET, and Go, which allows trace data to be visible in Coralogix's Traces View. The setup involves creating a local Kubernetes cluster, installing cert-manager, deploying the OpenTelemetry Operator and Coralogix integration with CRD support, and enabling auto-instrumentation via annotations, thereby simplifying the process of collecting telemetry data and enhancing observability in applications.

The article highlights the challenges and costs associated with traditional observability architectures, which often lead to financial strain and reduced visibility, particularly at the network edge where data is most critical. It emphasizes the drawbacks of indexing all data, which can result in escalating costs and necessitate compromises like data sampling or shortening retention times, creating potential vulnerabilities. Coralogix offers an innovative no-index architecture that addresses these issues by optimizing data storage and processing without indexing, ensuring full visibility and predictable costs. The Coralogix system utilizes a TCO Optimizer for efficient data routing, enables instant querying of archived data, and employs Streama Technology for real-time processing, which reduces data volume and costs. This architecture allows organizations to maintain complete data coverage, extended retention, and fast performance without the financial and operational compromises typical of traditional observability solutions. The article underscores the benefits of Coralogix’s approach through a live demo conducted at the AWS User Group in Malta, showcasing significant cost savings and enhanced security insights without data loss.

Mamona is a newly identified strain of commodity ransomware that operates entirely offline, setting itself apart from conventional ransomware-as-a-service models that require network-based command-and-control infrastructure. This ransomware employs custom-built cryptographic routines and allows any threat actor to deploy it independently through builder kits, following its public exposure on the clearnet. It targets Windows systems by encrypting user-accessible files, renaming them with a .HAes extension, and deploying ransom notes throughout directories, all without exfiltrating data or using external libraries. The ransomware also uses techniques like obfuscated delays and self-deletion to evade detection and complicate forensic analysis. While a decryptor tool has been confirmed to restore encrypted files, Mamona's execution disrupts business continuity by causing data loss and workflow interruptions. Enhanced detection and protection measures are recommended, including regular offline backups, endpoint monitoring, user education, and network segmentation to mitigate its impact.

The text emphasizes the importance of cultivating a culture of observability within engineering teams, highlighting that it should be an ingrained mindset rather than a mere tool or checkbox. It argues that neglecting observability leads to costly business consequences, such as longer outages and frustrated teams, while emphasizing the need for developers to take ownership of system reliability. The piece advocates for a cultural shift that encourages proactive problem-solving, reducing guesswork during incidents, and focusing on long-term resilience. It suggests using playful strategies and collaborative events to make the adoption of observability engaging and sustainable. By integrating tools like OpenTelemetry and Coralogix, teams can transition from reactive to proactive system health management, ultimately improving efficiency, morale, and alignment with business goals. The approach encourages personal connections to change and celebrates small wins to foster adoption, thereby making observability a natural part of the team's workflow and identity.

Coralogix has launched Continuous Profiling, a new feature that enhances real-time visibility into application performance without affecting production systems, by integrating seamlessly with Coralogix's existing logs, metrics, and traces. Utilizing eBPF and OpenTelemetry, this capability provides kernel-level insights with minimal overhead, allowing developers to connect CPU utilization to specific application and system processes. This addresses the shortcomings of traditional profiling solutions, which often degrade performance due to their resource-intensive nature. Continuous Profiling enables rapid deployment, performance optimization, and cost efficiency by identifying resource-intensive processes and correlating stack traces with logs and metrics for faster incident resolution. Later in the year, Coralogix plans to expand this capability to include off-CPU profiling and GPU utilization metrics, broadening its comprehensive observability platform, which already includes application performance monitoring and AI observability, among other features.