While Application Performance Management (APM) is a vital tool to ensure application availability and performance, analysis of log data can augment APM to monitor, manage and optimize application performance.
From infrastructure, OS and web logs to home grown application logs and 3rd party software logs, you can extract valuable insights – using log analysis technology – that will help you better understand, measure and support your APM strategy.
The following are 5 ways log analysis can deliver results beyond APM tools:
1. Outlining the Steps in the Transaction Flow
The transaction flow of an application service is a set of interactions between the many components that enable that service. When a component fails in the transaction flow, it sets off a chain reaction of failures. This chain reaction can involve multiple steps across the environment, and other clouds, data centers and software components. You need to be able to efficiently analyze all of these many steps – and potential failure points – in the transaction flow, to identify the original component failure.
An ideal log analysis tool will enable you to identify – and even automatically collect – all the log events generated by a specific transaction flow. Once you have identified each log event type, it is very easy to collect all the information and investigate what happened. Each log event can provide insight into exactly what happened. You can see the chain of events, in chronological order, empowering you to track back through history to the root cause problem.
2. Determining the Root Cause of the Bottleneck
Bottlenecks are symptoms of an application performance problem, not the root cause. While APM tools can quickly identify a bottleneck, this is merely an indication that something went wrong. To fix the problem, you need to find the underlying cause of the bottleneck.
Bottlenecks in the transaction flow can be caused by a variety of factors. There are many breaking points where something can go wrong – infrastructure, software or within the application itself. In log files, you can find clues to what actually happened to cause the bottleneck.
If a single component within the transaction flow fails, this can start a bottleneck. When this occurs, a log analysis tool will enable you to see log events either from that specific component or from a component that interfaces with the failed component. These log events indicate where the problem lies.
For example, if a database fails, you will see a variety of bottlenecks across multiple transactions. This will trigger many logs with JDBC exceptions or data source exceptions across multiple sources. If you understand the messages within the logs – such as "database connection failed" or "out of memory exception" – you can determine the root cause of the bottleneck.
3. Detecting Configuration Changes
Configuration changes can have a significant negative impact on an application service. For example, configuration changes can introduce damaging infrastructure faults or application bugs. While a change may manifest as an application performance issue that you can identify, you need to discover the change that triggered this problem.
In these cases, it is challenging for APM tools to uncover the root cause of the problem because a configuration change does not directly create the problem. The change introduces a separate factor that causes the problem.
In order to fix the problem, you need to identify what was changed, and the effects of that change. Using log analysis, you can identify the original configuration change. Logs contain diagnostics information regarding failures and changes that happen during events. Leveraging these vital records, log analysis provides you with visibility into changes that happen on the application, infrastructure and configuration level.
4. Gaining Visibility into Stress
Stress on components in the transaction flow can cause application failures, so it is important to understand the impact of stress. With APM tools, you can see certain levels of load, but measuring load is not enough. You need broader visibility.
You need to look at what the application is doing semantically. Understanding stress is not only the number of threads that a server opens, or the number of transactions that the user is calling. Stress is something that eventually puts a tremendous load on the computation level, on the memory, on infrastructure resources.
A near real-time trend analysis dashboard – delivering valuable data gained from logs – will help you quickly identify potential events and growing trends that will become future problems. The dashboard can provide visibility into the stress on the application, not only from number of transactions, load, calls and logins. It also provides information on the number of complex queries the system is running right now; the average cost of each query; if the system is running a difficult cryptographic computation; the number of cryptographic computations, and so on. This provides visibility into which components are experiencing more stress over time, leading to potential performance issues.
5. Identifying Butterfly Events
Log analysis enables you to proactively search for "butterfly events" – mysterious events caused by an unexpected and complex chain reaction. The original cause of a butterfly event can be anything, and it is not clearly identifiable through traditional APM tools. Butterfly events are hard to find because there are millions of events out there and you don't know what to look for.
The right log analysis solution will show if an event occurred in the past; the first time the event happened; if an event disappeared from the system; and ultimately, if an event has meaning for the system, application or infrastructure. By scanning all log data silos, you can catch obscure events that may ultimately have an impact on the transaction flow. You can be proactive, and find and fix the problem before the chaotic nature of the environment translates into business chaos.
Using log analysis, you will be able to identify log patterns that have an impact on application performance, optimize your APM strategy, and drive better and faster APM results.
Achieving audit compliance within your IT ecosystem can be an iterative process, and it doesn't have to be compressed into the five days before the audit is due. Following is a four-step process I use to guide clients through the process of preparing for and successfully completing IT audits ...
Network performance issues come in all shapes and sizes, and can require vast amounts of time and resources to solve. Here are three examples of painful network performance issues you're likely to encounter this year, and how NPMD solutions can help you overcome them ...
"Scale up" versus "scale out" doesn't just apply to hardware investments, it also has an impact on product features. "Scale up" promotes buying the feature set you think you need now, then adding "feature modules" and licenses as you discover additional feature requirements are needed. Often as networks grow in size they also grow in complexity ...
Network Packet Brokers play a critical role in gaining visibility into new complex networks. They deliver the packet data and information IT and security teams need to identify problems, recognize security issues, and ensure overall network performance. However, not all Packet Brokers are created equal when it comes to scalability. Simply "scaling up" your network infrastructure at every growth point is a more complex and more expensive endeavor over time. Let's explore three ways the "scale up" approach to infrastructure growth impedes NetOps and security professionals (and the business as a whole) ...
Loyal users are the key to your service desk's success. Happy users want to use your services and they recommend your services in the organization. It takes time and effort to exceed user expectations, but doing so means keeping the promises we make to our users and being careful not to do too much without careful consideration for what's best for the organization and users ...
What's the difference between user satisfaction and user loyalty? How can you measure whether your users are satisfied and will keep buying from you? How much effort should you make to offer your users the ultimate experience? If you're a service provider, what matters in the end is whether users will keep coming back to you and will stay loyal ...
What if I said that a 95% reduction in the amount of IT noise, 99% reduction in ticket volume and 99% L1 resolution rate are not only possible, but that some of the largest, most complex enterprises in the world see these metrics in their environments every day, thanks to Artificial Intelligence (AI) and Machine Learning (ML)? Would you dismiss that as belonging to the realm of science fiction? ...
Of those surveyed, 96% of organizations have a digital transformation strategy, with 57% approaching it as an enterprise-wide priority, with a clear emphasis on speed of business, costs, risk, and customer satisfaction, according to IDC’s Aligning IT Strategies and Business Expectations for Digital Transformation Success, sponsored by EasyVista ...
One of my ongoing areas of focus is analytics, AIOps, and the intersection with AI and machine learning more broadly. Within this space, sad to say, semantic confusion surrounding just what these terms mean echoes the confusions surrounding ITSM ...