vossiewulf: Splunk is useful for troubleshooting production issues by allowing server-crushing complex log queries without affecting production servers, but its licensing model based on data size rather than seats gets real expensive very quickly.
Lsherm: vossiewulf: Splunk is useful for troubleshooting production issues by allowing server-crushing complex log queries without affecting production servers, but its licensing model based on data size rather than seats gets real expensive very quickly.Real expensive, but once they have you by the balls, it's all over. Our Security team won't let us drop it because they are constantly running queries against data up to a month old, and our sysadmins won't drop it because they use the alert feature to alert on errors that don't affect production but could if ignored long enough. Everyone uses it if they're lazy. Our "shadow" networking team, which only handles the enterprise firewalls, has failed for so many years to document how the firewalls are configured that they have to search our Splunk logs to find out if one of their devices is blocking traffic.But fark, once you start sending any and all logging data from 800+ servers and devices to it, it gets crazy expensive, and unwieldy, too. Our storage team spent months engineering an agreeable solution for everybody because we didn't have enough space to keep everything online at once.
vossiewulf: We gave up and started exporting for display in Nagios.
If you like these links, you'll love
Total accessTotal knowledgeTotal Fark
Sign up for the Fark NotNewsletter!
Links are submitted by members of the Fark community.
When community members submit a link, they also write a custom headline for the story.
Other Farkers comment on the links. This is the number of comments. Click here to read them.
You need to create an account to submit links or post comments.
Click here to submit a link.
Also on Fark
Submit a Link »
Copyright © 1999 - 2018 Fark, Inc | Last updated: Apr 20 2018 20:39:30
Runtime: 0.206 sec (205 ms)