I had what I thought was a common DevOps problem. My data collection agents had a centralized config registry but couldn't update their own configs. This was a nightmare for my dynamic environments where one-off deployments were common. Unable to find something that fit my needs, LogSail was born.
My solution is an autonomous logging and monitoring platform that provides a reactive log layer. Once an agent deploys, it defines collection sources and starts reporting. The agent decides on its own what to check, as well as when and how to do it. It even works in the face of anomalies and other problems. Part of the logic lives in the agent, but I ended up designing a protocol for the agents to be more robust. This could make it useful for some scenarios where connectivity is iffy, too.
By design, the log collection layer has started out agnostic of other upstream logging platforms. It turns out, this work also reduces centralized logging storage costs, network traffic, and enhances data quality. In early prototypes, my first customer saw a 30% drop in their Datadog bill. LogSail isn’t designed to replace the likes of Datadog or Splunk, but it lets you optimize your dollars with them. As an added bonus, real time control over agents via web-based console or API makes integration a snap.
For my own needs, it was enough to store log data in a secure archive. The archive design had multi-tenancy and security in mind. Now that I have a few customers, they have all asked for event forwarding to Datadog, SumoLogic, and Splunk.
At the link, I’ve included a quick video showing what agents are capable of finding, as well as the ease of deployment. Please feel free to try it out. There’s a free tier to make that easier and I welcome any feedback.
Even if you don’t try it, I’d appreciate an opportunity to get your feedback about the idea and any pointers you might have based on your own experiences.
