Sumo Logic Observability Reviews

We used it for log observability – log aggregation specifically.

Operational effectiveness with regards to when there's an issue, when there's a reactive issue, people are able to, or as well as proactively, actually, because we use their PagerDuty integrations. We use queries in Sumo Logic to trigger alerts based on logging. That allows us to proactively identify issues as they're happening. 

With those same alerts, obviously, with that platform, you can use it to reactively start looking at troubleshooting issues as they're happening right then and there or incidents. So it's been very, very good for alerting and for troubleshooting issues. 

For predicting issues before they happen, it is not very good. They have a feature called anomaly detection, but I think it's quite premature compared to other stuff out there.

So it's good for alerts and for troubleshooting operational effectiveness. When your operations are down or segregated, it's perfect because it will help you diagnose the issues.

We use Sumo Logic to collect all our logs in one central location. This makes it easier for developers to search for errors in our systems. We also use it to create dashboards for stakeholders. 

We process large amounts of requests, sometimes millions per day, so we want to track things like successful transactions and data volume in queues. Sumo Logic dashboards help us analyze this data quickly and easily.

So, so it's primarily for log aggregation and analysis. 

It's helped us with troubleshooting. For example, we recently had an issue with duplicate logins, which doubled the log volume. Using Sumo Logic, we were able to identify the root cause. It has a field that shows the instance name of the log source, and that helped us pinpoint the culprit in another log. 

This was much faster than using the default search tools. Additionally, Sumo Logic's historical data search is convenient. We can easily find specific events and use that information to understand platform availability and identify bottlenecks. It's very configurable, allowing us to drill down into specific issues and work our way up from there.

It's actually quite agnostic and independent. For example, if you're using a customized collector, you just push a log to an endpoint provided by Sumo Logic, and it does the rest. They have no business with your application; they don't even know it exists. They just get the logs to your specific endpoint and start processing them for you.

I led the security team for the company. We use Sumo Logic Observability for SIEM capabilities, general log storage management, scheduled searches, dashboarding, observability, and visibility. Other application and infrastructure teams, including SRE, used it mainly for logging.

When I joined the organization several years ago, they struggled to maintain their existing logging infrastructure, consuming a significant amount of time and effort from the operations and IT infrastructure engineering teams responsible for keeping the rest of the systems online. They were spending too much time on this critical component. Logging is crucial for two main reasons. Firstly, from a long-term compliance and durability perspective, especially in regulated industries like the medical field, we needed to retain logs for a considerable period. Secondly, from a cybersecurity standpoint, preventing tampering with logs is essential. These factors highlight the importance of focusing on logging. Leveraging Sumo Logic Observability shifted our focus from managing the logging infrastructure to extracting value from our logs. This transition enabled us to concentrate on utilizing our observability data effectively rather than grappling with the complexities of system maintenance and long-term storage.

The product helps to monitor data and alerts when it is triggered. 

The product is easy to learn. 

In my company, the solution is used for logging in our production and applications. Whenever my company's customer reports a bug, we go ahead and just debug it using the trace IDs.

The most valuable feature of the solution stems from the tool allowing you to go back through and do tracing in every single log through a request.

If you're attempting to swiftly navigate through a substantial amount of data you can expand the implementation of Sumo Logic Observability across various organizations, but it is crucial to ensure that you properly analyze all the data being ingested into it. Moreover, comprehending the cost structure and prioritizing specific logs can greatly assist in a security investigation. The manner in which you utilize it can be somewhat subjective, as it can be integrated with other security solutions. For example, I'm currently trying to examine a vast range of data and perform queries, but I'm unsure about searching for email data. Previously, I utilized it to identify particular strings within log data, but I find it somewhat challenging due to the additional effort required. Writing numerous queries consistently can be burdensome, particularly for smaller teams without a full complement of engineers to fully develop the solution. Scaling without substantial resources can be a daunting task. However, if you integrate it effectively within your environment and incorporate tools like a Security Orchestration, Automation, and Response (SOAR) system, you can automate a significant portion of the process. Nevertheless, for companies operating on a limited budget, this may present a significant challenge.

Sumo Logic Observability presents a range of valuable features, including well-crafted dashboards and a diverse selection of helpful apps. However, personally, I don't hold a favorable opinion of the solution. While I don't struggle with writing queries, my main difficulty lies in recruiting competent individuals and ensuring their proficiency in utilizing the solution. This often leads to additional challenges and complexities. From my perspective, when compared to Microsoft Sentinel or even Splunk, Sumo Logic Observability has a steeper learning curve. One contributing factor to this disparity is the solution's long existence in the market compared to Synlogic. Nevertheless, I acknowledge that there are capable and knowledgeable professionals employed at Sumo Logic Observability. The effectiveness of the solution largely depends on how it is integrated into your internal operations and environment. Its utility and benefits can vary significantly. It is worth noting that organizations like the NSA and, I believe, the CIA used it in the past, primarily for rapidly searching and analyzing large volumes of data. To leverage its capabilities effectively, you must determine how to tailor it to your specific needs.