Graylog

Traffic on the highway clears up with no visible cause. APM investigations often feel the same way.
When containers and services disappear in minutes, root cause analysis turns into reconstruction instead of live inspection. That's the core challenge of cloud-native APM: telemetry volume outpacing budget, tool sprawl, alert fatigue, and evidence that vanishes before anyone can look at it.

We put together a guide covering what APM actually is, how it differs from monitoring and observability, and the direct and hidden costs of getting it wrong (lost transactions, on-call burnout, delayed roadmaps, reputational risk).

It also covers five best practices for cloud-native environments:
- Centralizing logs before scaling the stack
- Standardizing log structure early
- Correlating logs with metrics and traces
- Tying alert thresholds to business impact, and
- Revisiting observability spend regularly.

Read the full guide:

What Is Application Performance Management? A Cloud-Native Guide for Engineering Leaders A practical guide to application performance management for VPs of Engineering: real costs, cloud-native challenges, and proven best practices.

Linux syslog looks simple until you're managing it across a mixed fleet. Ubuntu writes to /var/log/syslog. RHEL uses /var/log/messages. Debian 12+ dropped rsyslog as a default. Arch relies on journald alone. Add in permission issues, log rotation wiping out evidence of slow-burn incidents, and inconsistent formats across applications, and root cause analysis takes far longer than it should.

Our new guide breaks down the daemons behind syslog (syslogd, rsyslog, syslog-ng, journald), where to find logs on each major distro, the most common challenges teams run into, and practical steps for configuring, centralizing, and retaining log data properly.
Read it here:
https://graylog.info/4io5QtV

Kubernetes troubleshooting is hard because the system is distributed by design. A single symptom, a pod stuck in CrashLoopBackOff, a service nobody can reach, can trace back to the pod, the node, the network layer, or the control plane. Finding the root cause means searching in multiple places at once.

Our new guide breaks down the errors DevOps teams hit most often: CrashLoopBackOff, ImagePullBackOff, OOMKilled, Node Not Ready, stuck rollouts, DNS failures inside pods, and more.

Each one includes the likely causes and the exact commands to start diagnosing it.

It also covers the three pillars of effective troubleshooting: understanding the root cause, managing the fix without triggering new disruption, and preventing the issue from recurring. Plus practical steps for centralizing logs, structuring them for search, and building alerts that catch failure patterns before they become incidents.

Read the full guide to cut your mean time to recovery:

Kubernetes Troubleshooting: The Complete Guide Troubleshoot CrashLoopBackOff, ImagePullBackOff, OOMKilled, and other common Kubernetes errors with step-by-step fixes for pods, nodes, and clusters.

An audit trail is only useful if nothing quietly alters it and only authorized people can view it. Lose integrity and you lose non-repudiation and defensible evidence. Lose confidentiality and you expose PII, financial data, and a roadmap attackers can use for reconnaissance.

Our new post breaks down what separates audit logs from audit trails, the seven types of audit trails, and a seven-step framework for building a system that protects both principles at once, from scope definition through ongoing review.

Read it here: https://graylog.info/4x6cHvR

Getting logs into Graylog does not require a PhD in syslog or any other log source.
Join us September 23rd at 10AM EDT for the next session in the Getting the Most out of Graylog Open series. We are covering the full Inputs framework: what input types are available, when to use each one, and how the Input Wizard gets new sources connected faster.

We will also walk through the revamped Inputs page and show you how to validate that your data is arriving clean. Make sure you are running the latest version of Graylog Open before the session.
20 minutes of content. 10 minutes of live Q&A.
Register now and bring your questions.

Link: https://graylog.info/4qNC3wL

Check out free Graylog Academy.

Whether you are standing up your first Graylog deployment or looking to sharpen your skills on pipeline rules, dashboards, or log source onboarding, Graylog Academy gives you self-paced training built by the people who build the product.

No catch. Just practical, hands-on lessons you can apply directly to your environment.
Start learning today:

Graylog Academy: Free On-Demand Training Available Go to the Graylog Academy and sign up for on demand free training. Learn the analyst fundamentals of Graylog!

Did you miss the webinar Zero to Logs with Graylog?
- Installing Graylog in a Docker container
- Getting logs into Graylog
- Routing logs into dedicated streams

Check out the replay here: https://graylog.info/4y45nlk

Host-based intrusion detection often gets less attention than firewall or EDR data, but OSSEC HIDS has been watching file integrity, authentication events, and active responses on Unix, Linux, and Windows systems for years.

The OSSEC HIDS Content Pack for Graylog parses that data into GIM-mapped fields and ships with an Illuminate spotlight dashboard. Instead of a wall of raw alert text, your team gets structured visibility into authentication events, file and registry integrity, and active response actions like IP blocking.

The pack covers all four OSSEC log files (JSON alerts, service logs, active responses, and firewall actions) and maps SIDs to categories spanning authentication, IAM, registry, and detection.

This pack also supports audit requirements under SOC 2, PCI DSS, and CIS Controls.
Read how it works and how to get OSSEC logs into Graylog: https://graylog.info/4zskvu7

You downloaded Graylog Open. Now what?
Join us for Zero to Logs: Graylog Open Running Under an Hour, part of the Getting the Most out of Graylog Open series.

This session walks you through a real installation from scratch. Choosing your deployment on Linux or Docker. Connecting your first data source. Running your first search.

No slides, (well maybe a few) no theory. Just a live terminal and a working Graylog instance by the end of the session. Whether you are spinning up a home lab or eventually standing up a production node, this is your starting line.

20 minutes of content. 10 minutes of live Q&A. Presented by Jeff Darrington.
Wednesday, August 26th at 10AM EDT.
Register now to save your spot: https://graylog.info/4gjoYGG