May 2020 Summaries

Google Cloud Platform (GCP) provides audit logs that record the who, where, and when of activity within an environment, enabling administrators to monitor access and detect potential threats across resources such as storage buckets, databases, service accounts, and virtual machines. GCP collects audit logs from all services, providing context for security analysis. The Google Cloud hierarchy organizes resources by organization, project, and folder, which is essential for interpreting audit logs. Best practices include granting access to resources using Cloud IAM policies and understanding the roles of individual users and services within the hierarchy. The three types of audit logs are Admin Activity, System Event, and Data Access, each recording different levels of activity. Data Access logs require explicit enablement due to their potentially large volume. Understanding how to interpret audit log entries is crucial for monitoring GCP security and detecting potential vulnerabilities. Critical log events include unauthorized access attempts, new service account creation, and modifications to sinks or Pub/Sub topics. Monitoring these logs can help identify security threats and ensure compliance with frameworks such as CIS Benchmarks. The Cloud Logging API and the `gcloud` command-line tool can be used to export audit logs to external monitoring services like Datadog. Datadog provides turnkey integrations for GCP and Google Workspace, automatically parsing audit logs and enriching them with contextual information. Users can build custom dashboards to get a high-level view of log activity and use Datadog's built-in threat detection rules to identify critical security issues in their environments.

Datadog has enhanced its integration with Microsoft Azure, a cloud computing platform, by introducing new tags and metrics that provide users with improved visibility and insights into their Azure environments. This includes over 40 Datadog-generated metrics and new tags for Azure services like App Services, Azure Functions, and Azure SQL Databases, among others. The integration now features out-of-the-box dashboards that incorporate these enhancements, offering users richer insights without additional configuration. Specific improvements include better tracking of Azure App Services, visibility into geo-replication link states for Azure SQL Databases, and a new metric for counting hosts in Azure Load Balancer backend pools. Additionally, Datadog now tracks Azure resource limits and quotas, allowing users to monitor consumption and avoid provisioning failures. New metrics have also been introduced for resource counts, helping users track and visualize the status of their Azure resources. These enhancements are immediately available to Datadog customers, with additional information accessible through their documentation or a free trial for new users.

Datadog's saved views feature allows users to save sets of frequently used template variables for easy access and visualization of specific data on dashboards. This helps teams within an organization filter dashboard graphs based on their needs, such as viewing the health of particular services in certain regions. Saved views can also be used to map metric metadata into a more human-readable format. To create a saved view, users set template variables and save them with a name. Managing saved views involves editing or deleting sets through the "Manage views" option. This feature enhances data accessibility for all teams within an organization as it evolves.

Datadog dashboards provide immediate visibility into environments by allowing users to filter graphs on the fly using template variables. Saved views enable users to save frequently used sets of template variables, making it easy for anyone in the organization to access specific data with just a few clicks. This feature is particularly useful for teams that have specific combinations of template variables they use to view commonly viewed data. By creating and sharing saved views, organizations can ensure that all teams have immediate access to the same datasets, even as the organization evolves.

Logs provide valuable insights into system issues but can consume significant resources. To manage this effectively, organizations should establish log management policies that address storage solutions, retention periods, and the value of logs in different situations. Key questions to consider include determining the most appropriate storage solution, how long logs should spend in different kinds of storage, identifying logs needed only at certain times, and determining if aggregates or samples are sufficient. Datadog's Logging without Limits™ can help streamline these policies by allowing dynamic routing of logs to hot and cold storage, enabling teams to query the logs they need while staying within budget.

Pierre Cariou and Paul Gottschling discuss the challenges of managing large volumes of logs in systems that consume significant resources, leading to higher costs. To address these challenges, they recommend implementing log management policies with teams, defining four key questions: what is the most appropriate storage solution, how long should logs spend in different kinds of storage, are there logs that you only need at certain times, and are there logs that you need only as aggregates or samples. The authors explain how to prepare organizations to adopt sustainable log management policies by centralizing logs and setting up log management budgets with teams. They also discuss two approaches for implementing log management policies: excluding all logs from hot storage by default and including all logs in hot storage by default. Datadog's Logging without Limits feature helps streamline log management policies and empowers teams to change these policies on the fly, enabling them to dynamically route logs to hot and cold storage based on their usage.

The latest version of Datadog Operator (0.2.0) has been released to simplify the process of monitoring Kubernetes clusters. It introduces support for APM, Logs, and Process Agents, as well as the System Probe for Network Performance Monitoring data collection. The Operator keeps Agents up-to-date with configurations and makes it easy to track their current status. Additionally, it has received Red Hat OpenShift Operator Certification, ensuring compatibility and security. Datadog Operator allows users to manage all of their Agents from a single configuration file, making Kubernetes monitoring more efficient and streamlined.

The Datadog Operator is a Kubernetes operator designed to automate the deployment and management of Datadog Agents in Kubernetes clusters. It simplifies the process of monitoring Kubernetes clusters by providing a single source of truth for Agent configuration, automatically keeping Agents up-to-date with your configuration, and tracking the current status of each Agent. The Operator also enables seamless integration with Cluster Checks Runners to optimize resource utilization. With its open-source nature, the Datadog Operator allows users to manage all their Agents from one configuration file, making it easier to collect data from Kubernetes clusters.

ProxySQL is a MySQL/MariaDB protocol-compliant load balancer and reverse proxy that supports various backends like ClickHouse, Amazon Aurora, and Amazon RDS. It improves resource management and boosts database performance by efficiently distributing queries to servers and caching results. Datadog's integration with ProxySQL allows users to visualize, monitor, and alert on key metrics such as memory usage and query throughput. The integration also helps track the efficiency of ProxySQL's query cache, correlate cache reads and writes, ensure loads are balanced correctly, verify connections between clients and servers, and monitor the rate of slow queries.

ProxySQL is a MySQL/MariaDB protocol-compliant load balancer and reverse proxy with native support for popular backends like ClickHouse, Amazon Aurora, and Amazon RDS. It efficiently distributes queries to database servers, caches results, and improves resource management and performance. Monitoring ProxySQL carefully is crucial as poor performance can lead to increased latency and degradation across dependent parts of the stack. Datadog's integration provides a range of key metrics, including memory usage, query throughput, and cache efficiency, enabling users to visualize, monitor, and alert on dozens of critical metrics in an out-of-the-box ProxySQL dashboard. This allows for effective tracking of proxy performance, query cache efficiency, correlation of cache reads and writes, balanced loads, client-server connections, and slow queries, ultimately ensuring the smooth operation of ProxySQL and its impact on database performance.

Sidekiq is a Ruby framework used for background job processing to speed up application response times. Datadog's integration with Sidekiq Pro or Enterprise allows developers to monitor job progress and the applications that depend on them in one platform. The out-of-the-box dashboard shows job success rates, failure counts, and queued jobs. Alerts can be set for anomalous spikes in retries or failures. Datadog also supports Redis monitoring to prevent data loss when memory limits are reached. APM auto-instruments Ruby applications for tracing Sidekiq jobs across infrastructure, helping identify long-running tasks that may delay other jobs. Monitoring Sidekiq with Datadog provides comprehensive real-time insights into job processing and performance.

Organizations can now leverage Kubernetes' support for deploying clusters with Windows nodes to automate container provisioning, networking, scaling, and more for their Windows applications. Datadog introduces support for both Windows-based Docker containers and mixed OS clusters in Kubernetes, enabling seamless monitoring of containerized Windows workloads alongside all other applications and services. The partnership with Google Cloud provides native support for Windows containers on Google Kubernetes Engine (GKE), allowing organizations to streamline application deployments, scalability, and performance management on a single cloud platform.

Mallory Mooney and Yair Cohen of Datadog are introducing support for monitoring both Windows-based Docker containers and mixed OS clusters in Kubernetes, enabling organizations to seamlessly monitor containerized Windows workloads alongside their other applications. Datadog is partnering with Google Cloud to provide native support for Windows containers on Google Kubernetes Engine (GKE), allowing organizations to streamline application deployments, scalability, and performance management on a single cloud platform. The Datadog Agent can be easily installed on GKE node pools using Helm charts, and once deployed, it collects logs, metrics, and distributed traces from all Windows containers, providing visibility into the entire container infrastructure. With Autodiscovery, Datadog detects when containers are created or destroyed, automatically collecting data from services running on those containers. The Agent provides a comprehensive view of the state of clusters and deployed applications, enabling organizations to drill down to specific containers within their cluster to investigate issues affecting application performance.

Sidekiq is a Ruby framework that enables developers to asynchronously process computationally intensive tasks, such as bulk email sending and payment processing, to improve application response times. Datadog's integration with Sidekiq Pro or Enterprise provides a single platform for monitoring job progress, applications, and metrics in real-time, allowing users to track the success and failure rates of jobs, set up alerts for potential issues, and troubleshoot congested queues. The integration also includes built-in support for Redis, enabling users to monitor memory usage and correlate it with queued Sidekiq jobs to determine whether job processors are able to keep up with their workload. Additionally, Datadog's APM auto-instruments Ruby applications, allowing users to quickly start tracing long-running Sidekiq jobs and identify potential issues, such as slow job latency or failed retries.

Confluent Platform is an event streaming platform built on Apache Kafka. It simplifies the process of copying data into and out of Kafka, validating the data, and replicating entire Kafka topics. Datadog has partnered with Confluent to create a new integration that provides visibility into various components of the Confluent Platform, including Kafka brokers, producers, consumers, connectors, REST Proxy, Schema Registry, and ksqlDB. This integration helps users quickly pinpoint and fix problems, monitor key metrics, and meet their service level objectives (SLOs) for reading, writing, and replicating data.

Confluent Platform is an event streaming platform built on Apache Kafka that provides a comprehensive integration for monitoring and managing its components, including Kafka Connect, REST Proxy, Schema Registry, and ksqlDB. The new Confluent Platform integration with Datadog offers visibility into Kafka brokers, producers, consumers, connectors, workers, and key components of the Confluent Platform, allowing users to quickly pinpoint and fix problems, meet SLOs for reading, writing, and replicating data, and ensure high availability of their cluster. The dashboard surfaces useful metrics to help understand the health of the environment, while custom tags can be added to represent any subset of the deployment. Datadog also provides monitoring capabilities for connectors and workers, ksqlDB metrics and logs, and the health of Schema Registry, ensuring comprehensive visibility into the Confluent Platform environment.