How to catch Recurring Issues faster with In-cluster Log Analysis

Hi, I'm Kunal, Daryl engineer at Randoli. In this particular video, I'm going to quickly show you how Randoli's log analyzers helps you detect a recurring log issues faster and more efficiently. In distributed systems, logs often hold the first sign of failure. But identifying recurring issues across clusters and services can be slow and expensive at the same time. Log analyzers in Randoli helps to solve this. By analyzing and processing the logs inside your cluster, they help you detect recurring log patterns automatically, enabling faster issue detection, reducing ingestion and data transfer costs, all while ensuring full data privacy for you. Let me show you how this works. To create a new log analyzer, head over to the log analyzers page on the dashboard and click on add log analyzer. Now, there are three different configurations that we need in order to configure a log analyzer. Number one is defining the scope of where the log analyzer will run. You can define the specific cluster, select a workload using the workload labels and even define the specific name space which you want the log analyzers to target. Secondly, you need to define the necessary trigger conditions for that specific log analyzer by setting the threshold and the time window within which you wish to track repeated occurrences of that specific log message or a pattern. Lastly, in order to detect specific messages or patterns inside your logs, you have the option to write a simple query expression that matches the condition of those messages or patterns. Let me show you a quick example of an existing log analyzer. Now, here's a log analyzer that we have configured to detect the repeated SLA breach messages inside our logs. This log analyzer is scoped to the EKS demo cluster. We have also targeted a specific name space which is simulation in this case. and the log analyzer will target all the workloads having this specific workload label. Now, as I mentioned, you can use these simple query expressions which matches your specific log message or a pattern that you may wish to track in your logs. Lastly, the trigger condition is set to be fired if this particular message shows up three times within a 10-minute window. And when this particular condition is triggered, Randoli will automatically generate an issue report for us so that you can investigate and troubleshoot the incident further. Now to make your troubleshooting workflow a bit more robust, we also have the ability to link a troubleshooting runbook with an existing log analyzer using certain selectors. For example, here you can see that we have used the log analyzer selector here to select our preconfigured SLA breach log analyzer and then you can define the detailed remediation steps that will help you to troubleshoot the issue when it occurs. Now when a particular log analyzer is triggered according to the condition that you have set, you can head over to the workloads overview page of that specific workload. And here you have the option to view the triggered events by this specific log analyzer in form of a unified timeline. As you can see here, you can also view the triggered log analyzer in the recent events list right here. And here it says the log analyzer query match was found for this specific pod and for this specific workload, which is the order service in this case. You can click on see more info and this will open a detailed issue report which was automatically created by randoli when the log analyzer condition was triggered. This will have all the contextual information that you may need to investigate the issue further. As you can see the name of the issue is a log analyzer issue because that's what triggered this specific issue report. The reason for the issue is essentially the name of the log analyzer and it tells you that the condition was met. If you have set up log management for your cluster in randoli, you also have the ability to view the specific logs of this particular workload as well as you have the ability to view the ondemand telemetry snapshot of this specific workload. So you can gain a bit more deeper insights into how this particular workload was performing during the period of this incident. Apart from this, you get a unified timeline which gives you a good overall view of the recent events related to this particular workload. And lastly, we have the custom runbook which got automatically attached to this specific issue report using the selector matching that we configured while creating this particular runbook. So you have the remediation steps as well right where you need them. So overall with log analyzers, Randoli helps you to detect issues much faster, reduce manual log investigation and helps you to respond to production issues with greater clarity. Thank you so much for watching.