While Application Performance Management (APM) is a vital tool to ensure application availability and performance, analysis of log data can augment APM to monitor, manage and optimize application performance.
From infrastructure, OS and web logs to home grown application logs and 3rd party software logs, you can extract valuable insights – using log analysis technology – that will help you better understand, measure and support your APM strategy.
The following are 5 ways log analysis can deliver results beyond APM tools:
1. Outlining the Steps in the Transaction Flow
The transaction flow of an application service is a set of interactions between the many components that enable that service. When a component fails in the transaction flow, it sets off a chain reaction of failures. This chain reaction can involve multiple steps across the environment, and other clouds, data centers and software components. You need to be able to efficiently analyze all of these many steps – and potential failure points – in the transaction flow, to identify the original component failure.
An ideal log analysis tool will enable you to identify – and even automatically collect – all the log events generated by a specific transaction flow. Once you have identified each log event type, it is very easy to collect all the information and investigate what happened. Each log event can provide insight into exactly what happened. You can see the chain of events, in chronological order, empowering you to track back through history to the root cause problem.
2. Determining the Root Cause of the Bottleneck
Bottlenecks are symptoms of an application performance problem, not the root cause. While APM tools can quickly identify a bottleneck, this is merely an indication that something went wrong. To fix the problem, you need to find the underlying cause of the bottleneck.
Bottlenecks in the transaction flow can be caused by a variety of factors. There are many breaking points where something can go wrong – infrastructure, software or within the application itself. In log files, you can find clues to what actually happened to cause the bottleneck.
If a single component within the transaction flow fails, this can start a bottleneck. When this occurs, a log analysis tool will enable you to see log events either from that specific component or from a component that interfaces with the failed component. These log events indicate where the problem lies.
For example, if a database fails, you will see a variety of bottlenecks across multiple transactions. This will trigger many logs with JDBC exceptions or data source exceptions across multiple sources. If you understand the messages within the logs – such as "database connection failed" or "out of memory exception" – you can determine the root cause of the bottleneck.
3. Detecting Configuration Changes
Configuration changes can have a significant negative impact on an application service. For example, configuration changes can introduce damaging infrastructure faults or application bugs. While a change may manifest as an application performance issue that you can identify, you need to discover the change that triggered this problem.
In these cases, it is challenging for APM tools to uncover the root cause of the problem because a configuration change does not directly create the problem. The change introduces a separate factor that causes the problem.
In order to fix the problem, you need to identify what was changed, and the effects of that change. Using log analysis, you can identify the original configuration change. Logs contain diagnostics information regarding failures and changes that happen during events. Leveraging these vital records, log analysis provides you with visibility into changes that happen on the application, infrastructure and configuration level.
4. Gaining Visibility into Stress
Stress on components in the transaction flow can cause application failures, so it is important to understand the impact of stress. With APM tools, you can see certain levels of load, but measuring load is not enough. You need broader visibility.
You need to look at what the application is doing semantically. Understanding stress is not only the number of threads that a server opens, or the number of transactions that the user is calling. Stress is something that eventually puts a tremendous load on the computation level, on the memory, on infrastructure resources.
A near real-time trend analysis dashboard – delivering valuable data gained from logs – will help you quickly identify potential events and growing trends that will become future problems. The dashboard can provide visibility into the stress on the application, not only from number of transactions, load, calls and logins. It also provides information on the number of complex queries the system is running right now; the average cost of each query; if the system is running a difficult cryptographic computation; the number of cryptographic computations, and so on. This provides visibility into which components are experiencing more stress over time, leading to potential performance issues.
5. Identifying Butterfly Events
Log analysis enables you to proactively search for "butterfly events" – mysterious events caused by an unexpected and complex chain reaction. The original cause of a butterfly event can be anything, and it is not clearly identifiable through traditional APM tools. Butterfly events are hard to find because there are millions of events out there and you don't know what to look for.
The right log analysis solution will show if an event occurred in the past; the first time the event happened; if an event disappeared from the system; and ultimately, if an event has meaning for the system, application or infrastructure. By scanning all log data silos, you can catch obscure events that may ultimately have an impact on the transaction flow. You can be proactive, and find and fix the problem before the chaotic nature of the environment translates into business chaos.
Using log analysis, you will be able to identify log patterns that have an impact on application performance, optimize your APM strategy, and drive better and faster APM results.
According to a recent survey, critical IT incidents cost the average organization upwards of $6 million per year. This infographic outlines 4 easy steps to automate incident management, reducing downtime and costs to organizations ...
The essential value resulting from data-driven processes has become progressively linked with analytics. Once considered a desired complement to intuitive decision-making, analytics has developed into a main focus of mission-critical applications across industries for any number of use cases ...
The question of SaaS-based technology over the past decade has quickly changed from "should we?" to "how soon can we?" even for the most customized and regulated of industries. This macro move toward SaaS has also encouraged a series of IT "best practices" that have potential impacts on the employee digital experience, organizational risk and ultimately, productivity ...
Optimization means improving the performance of your human and technology resources while keeping a watchful eye. To accomplish this, we must have clear, crisp visibility into the metrics relevant to the delivery of workspace applications to your end users and to the devices – the endpoints – they use to be productive ...
As tech headlines flash across my email, the CMDB, and its federated equivalent, the CMS, are almost never mentioned. And yet when I do research, dialog with IT, or support our consulting team, the CMDB/CMS many times still remains paramount ...
Given the size and complexity of today's IT networks it can be almost impossible to detect just when and where a security breach or network failure might occur. It's critical, therefore, that businesses have complete visibility over their IT networks, and any applications and services that run on those networks, in order to protect their customers' information, assure uninterrupted service delivery and, of course, comply with the GDPR ...
A new breed of solution has been born that simultaneously provides the precision of packet-based analytics with the speed of flow-based monitoring (at a reasonable cost). Here are more reasons to use these new NPM/APM analytics solutions ...
A new breed of solution has been born that simultaneously provides the precision of packet-based analytics with the speed of flow-based monitoring (at a reasonable cost). Here are 6 reasons to use these new NPM/APM analytics solutions ...
There’s no doubt that digital innovations are transforming industries, and business leaders are left with little or no choice – either embrace digital processes or suffer the consequences and get left behind ...
Looking ahead to the rest of 2018 and beyond, it seems like many of the trends that shaped 2017 are set to continue, with the key difference being in how they evolve and shift as they become mainstream. Five key factors defining the progression of the digital transformation movement are ...