So, the results of my 3rd poll are ready: live results are here, picture is also in this post. This sure was fun!
First, this poll way more popular than my previous "why" poll. Yes, it seems like people do hate to wonder "why" :-)
Second, what are the two choices, that are by far the most popular? They are:
- Store raw logs on a server (23%)
- Search raw logs (grep) when needed (24%)
Yes, this is the "state of the art" of logging: collection of raw logs and "as needed" grep aka "slow and painful" search. In fact, the above answers might not even be given by the same people: some might be grepping logs on the individual servers, while others collect them on syslog servers and never touch them. That is why being in log management business is such a great thing: you have nearly the whole world to evangelize about the value of logs and log management tools.
Third, what's the next most popular idea of analyzing logs? It is "Run my own log analysis tool" at 10% of the respondents. Indeed, the movement started by the "enlightened" Leopold von Sacher-Masoch still lives and thrives: people choose the Build->Suffer approach to log management often enough ...
Fourth, next come my somewhat self-inflicted surprise: apart from commercial log management (at 4%) and rolling one's own (discussed above at 10%), I added the option of "Use other log analysis tools" which captured 7% of the vote. But what does that mean? I have no idea!
Fifth, I am NOT surprised by the lack of popularity of the rule-based correlation tools, such as SIEM (at 2%). When I made my decision to join LogLogic, I had to ponder this one really, really hard. Sorry to use this post to rant, but my conclusion at the time (which is also valid now) was that "SIEM is for some, log management is for everybody." This poll confirms this further.
Finally, all my logging polls and analysis are here. Next one is coming up!
No comments:
Post a Comment