August 2020 Summaries

In the realm of cloud security, detecting attacks within vast log data is a significant challenge due to the overwhelming volume of information generated. Logz.io Cloud SIEM addresses this by automatically cross-referencing logs with both public and private threat intelligence feeds, which helps identify malicious indicators such as IPs, DNSs, and URLs. This system uses 14 reputable public threat feeds and now includes the option for private feeds, allowing for customized threat detection tailored to specific environments. The Threat Overview Dashboard, leveraging Kibana's visualization capabilities, aids users in prioritizing security events by breaking down attacks according to threat feeds, type of attack, or the security tool that identified the threat. By enabling users to focus on high-priority information, Logz.io's Cloud SIEM enhances the ability of security teams to effectively manage and respond to security incidents in cloud environments.

Java is a widely-used programming language that supports cross-platform software development, exemplified by its role in powering Android and Elasticsearch. Effective log management is crucial for Java applications to ensure operational visibility and facilitate troubleshooting. This tutorial explores using the ELK Stack (Elasticsearch, Logstash, and Kibana) and Logz.io for managing Java logs. It provides guidance on writing logs with the Log4j2 library, configuring Log4j2 for JSON output, and shipping logs to Elasticsearch either directly or via Filebeat, a lightweight log shipper. While direct shipping offers speed, it may affect application performance and risk data loss if the application crashes. Filebeat, on the other hand, provides a more robust solution by offloading log responsibility to disk. Additionally, the tutorial covers sending logs to Logz.io, a managed ELK Stack platform, offering the benefits of ELK without the overhead of infrastructure management. Kibana aids in analyzing logs, providing search, visualization, and dashboard capabilities for efficient troubleshooting, which is increasingly vital in distributed systems and microservices architectures.

Grafana is a widely-used open-source user interface for metrics and infrastructure monitoring, particularly valuable for DevOps teams due to its ability to ingest data from popular time series databases like Prometheus. This tutorial outlines the installation and configuration of Grafana on macOS and Ubuntu, demonstrating how to execute initial metrics shipping, particularly focusing on its compatibility with Prometheus. It highlights how Grafana serves a similar function for metrics as Kibana does for logs, and details the installation process on an Ubuntu EC2 instance, including the use of CLI commands and configuration adjustments in the grafana.ini files. The guide also covers basic and advanced configuration options, logging settings, and the use of queries with various data sources, emphasizing the tool's built-in support for Prometheus and its capability to export metrics from other sources like Graphite and Metricbeat through plugins.

Logz.io has been actively enhancing its Cloud Security Information and Event Management (SIEM) tool throughout 2020 by refining threat intelligence, introducing new dashboards, and improving user experience to better address security challenges faced by organizations. Key updates include a Kibana query preview feature allowing users to simulate rules on existing logs, a customizable date range selector for viewing security-relevant log data, and the addition of new threat intelligence feeds such as PhishTank, REScure, and Bambenek Consulting's IPs. The platform now also supports private threat intelligence feeds, enabling users to securely incorporate custom data into their accounts, and offers the ability to create multiple security accounts, which is particularly beneficial for Managed Security Service Providers (MSSPs) managing multiple clients. Additionally, Logz.io has introduced branded report options, allowing clients to replace the Logz.io logo with their own in reports sent to customers. These enhancements aim to provide greater flexibility, security, and customization for users, with further updates anticipated in the future.

Observability in distributed systems relies on three key pillars: logs, metrics, and traces, with distributed tracing gaining traction through innovations like OpenTelemetry and the Jaeger project. Jaeger, a widely used open-source tool for distributed tracing, provides crucial insights into system performance, especially in complex microservices architectures. Deploying Jaeger in production involves setting up its key components—Agent, Collector, and Query—and choosing appropriate deployment strategies, such as all-in-one, production, or streaming setups, depending on the environment's scale and requirements. Agents can be installed as sidecars or daemonsets in Kubernetes, while Jaeger supports various backend storage solutions like Elasticsearch and Cassandra. Though typically recommended to use Jaeger Agent for data collection, certain scenarios may require direct data submission to the Collector, such as serverless environments or when using Zipkin instrumentation. Installation tools like Kubernetes Operator and Helm Chart aid in deploying Jaeger, with Helm offering package management advantages. Despite its youth, Jaeger's development is supported by a strong community, and services like Logz.io provide managed solutions to simplify its adoption for organizations.

OpenObservability Talks hosted its second episode on July 30th, featuring a discussion about OpenTelemetry with guests such as Paul Bruce, Director of Customer Engineering at Neotys, and Jonah Kowall, CTO of the host platform. The conversation focused on the momentum behind OpenTelemetry, its community's goals, and the anticipated direction of the initiative, highlighting a collaborative spirit among participants despite regional and technological differences. Listeners can access the podcast through platforms like Apple Podcasts and Spotify or view the recorded live stream on Twitch. Upcoming episodes and participation opportunities are also discussed, with details available on the OpenObservability website and social media.

Logz.io offers a streamlined process for migrating from the ELK Stack to its managed log management solution, promising ease for existing ELK users by allowing them to use familiar log shipping methods and Kibana objects. The migration is facilitated by redirecting log shipping to Logz.io, which supports a wide array of log shipping methods across various platforms like AWS, Azure, and Google Cloud, as well as direct integration with programming languages and applications like Kubernetes and Docker. Logz.io provides automatic log parsing for popular sources and offers "Parsing-as-a-service" for custom needs, ensuring that users can maximize the value of their logs. Users can migrate their Kibana objects to Logz.io, preserving their existing dashboards and visualizations, thus avoiding the need to recreate them. Once migrated, users can decommission their internal ELK Stack, as Logz.io's fully managed service handles scaling, parsing, and other maintenance tasks. Additionally, Logz.io enhances the ELK experience with features like real-time alerts, log pattern clustering, cognitive insights, application insights, and prebuilt ELK Apps, while also offering broader observability tools like Cloud SIEM and infrastructure monitoring.

Holler, a messaging technology company known for creating animated stickers to enhance digital conversations, has experienced significant growth, prompting challenges in scaling and managing its technology stack, particularly the ELK stack for log management. Without a fully dedicated operations team, Holler's engineers have had to juggle multiple roles, including DevOps, to maintain service performance. To address these challenges, Holler transitioned to using Logz.io, a managed ELK provider, to alleviate some of the maintenance burden and reduce processing costs by decreasing log volume from over 1 TB to 200 GB per day. The company is also moving towards a microservices architecture, leveraging tools like Amazon's AWS for scalability and efficiency. Throughout its observability journey, Holler has focused on integrating open-source solutions while considering managed services to maintain flexibility and scalability without incurring excessive costs. The company is currently seeking to hire a dedicated SRE/DevOps professional to further enhance its technical capabilities and infrastructure management.