Recent Linux kernel releases are coming weaponized with built-in instrumentation framework that has its roots in what historically was approached as BPF (Berkeley Packet Filter) – a very efficient network packet filtering mechanism which aims to avoid unnecessary user space allocations and operate on packet’s data directly in kernel land. The most familiar application of BPF powers is related to filter expressions used in tcpdump tool.
Today we’ve announced that we’ve officially added eBPF instrumentation to extend container observability with Sysdig monitoring, security and forensics solutions. eBPF – extended Berkeley Packet Filter – is a Linux-native in-kernel virtual machine that enables secure, low-overhead tracing for application performance and event observability and analysis.
Observing modern applications is challenging. Microservices allow for applications that are not only more distributed but are made up of a number of different languages, frameworks, and backend services. DevOps teams have far greater flexibility in where and how they deploy applications,but when it comes time to collect logs, this flexibility can quickly become a hurdle.
What should one pay for observability? How much observability is enough? How much is too much, or is there such a thing? Is it better to pay for one product that claims (dubiously) to do everything, or twenty products that are each optimized to do a different part of the problem super well? It’s almost enough to make a busy engineer say “Screw it, I’m spinning up Nagios”. (Hey, I said almost.)
Sematext provides a single pane of glass and machine learning powered alerts for logs, metrics, traces and user experience data. Sematext Cloud provides advanced monitoring, logging and tracing for all Docker platforms such as Docker EE, Kubernetes, GKE, AWS ECS, and IBM Cloud. Sematext’s new monitoring agent leverages the powerful eBPF Linux kernel observability functionality and uses the Kubernetes API to enrich the container and cluster level metrics.
You probably know that Honeycomb is the most flexible observability tool around. Its powerful high-cardinality search makes working with real raw data quick and easy. But as you may have learned through hard experience, fetching those dots can still be quite a challenge.
Boston and Tel Aviv — August 22, 2018 — Logz.io, the leader in AI-powered log analysis, releases Alice, a new Slack-based ChatOps solution that empowers DevOps teams to easily accelerate collaboration and data exploration in a manner that is flexible and accessible on-the-go. The tool enables DevOps teams to implement a ChatOps approach to logging and monitoring directly within Slack and remain connected regardless of their location.
If you’re feeling too busy or overwhelmed to instrument your code, we are here for you. We’ve talked many times about the value of instrumentation, and how it’s necessary to instrument your code properly to have access to the kind of data you need to get real observability. Instrumenting your code can mean a lot of things, but in particular it means you have to augment it in many different places, which is time-consuming.
It’s amazing. It’s brand new. Everyone needs it. It is “the next best thing”. Only half of these statements are true, it is not new and it is not the next best thing. It is branding an existing paradigm that many companies use and rely on—but—it is amazing and everyone should want it. If you’re new to the concept, what does observability really mean and how can it help transform your operations?
If you think about it, mobile apps are among the production services most in need of real observability: nearly countless hardware platforms and operating systems in combination with your app’s code result in a dizzying matrix of possible sources for any given issue, which means you need the power of true high-cardinality search to solve your problems.
