diff --git a/docs/integrations/amazon-aws/dynamodb.md b/docs/integrations/amazon-aws/dynamodb.md index d993d33efd..aa0e3b542e 100644 --- a/docs/integrations/amazon-aws/dynamodb.md +++ b/docs/integrations/amazon-aws/dynamodb.md @@ -222,4 +222,4 @@ Use this dashboard to: * Identify malicious IPs performing operations on DynamoDB tables using Sumo Logic Threat Intel. -Amazon DynamoDB +Amazon DynamoDB \ No newline at end of file diff --git a/docs/integrations/databases/cassandra.md b/docs/integrations/databases/cassandra.md index 1dd12df004..821b7556cc 100644 --- a/docs/integrations/databases/cassandra.md +++ b/docs/integrations/databases/cassandra.md @@ -13,7 +13,7 @@ import TabItem from '@theme/TabItem'; The Cassandra app is a unified logs and metrics app that helps you monitor the availability, performance, health, and resource utilization of your Cassandra clusters. Preconfigured dashboards provide insight into cluster health, resource utilization, cache/Gossip/Memtable statistics, compaction, garbage collection, thread pools, and write paths. -## Log types +## Log types and Metrics The app supports Logs and Metrics from the open-source version of Cassandra. The app is tested on the 3.11.10 version of Cassandra. @@ -27,46 +27,7 @@ The Sumo Logic app for Cassandra supports metrics generated by the [Jolokia2 plu This section provides instructions for configuring log and metric collection for the Sumo Logic app for Cassandra. -### Step 1: Configure Fields in Sumo Logic - -Create the following Fields in Sumo Logic prior to configuring collection. This ensures that your logs and metrics are tagged with relevant metadata, which is required by the app dashboards. For information on setting up fields, see [Sumo Logic Fields](/docs/manage/fields). - - - - - -If you're using Cassandra in a Kubernetes environment, create the fields: -* `pod_labels_component` -* `pod_labels_environment` -* `pod_labels_db_system` -* `pod_labels_db_cluster` -* `pod_labels_db_cluster_address` -* `pod_labels_db_cluster_port` - - - - - -If you're using Cassandra in a non-Kubernetes environment, create the fields: -* `component` -* `environment` -* `db_system` -* `db_cluster` -* `pod` -* `db_cluster_address` -* `db_cluster_port` - - - - - -### Step 2: Configure Collection for Cassandra +### Configure Collection for Cassandra Logs > Field Extraction Rules**.
[**New UI**](/docs/get-started/sumo-logic-ui). In the top menu select **Configuration**, and then under **Logs** select **Field Extraction Rules**. You can also click the **Go To...** menu at the top of the screen and select **Field Extraction Rules**. - 2. Click the **+ Add** button on the top right of the table. - 3. The **Add Field Extraction Rule** form will appear: -4. Enter the following options: - * **Rule Name**. Enter the name as **App Observability - Database**. - * **Applied At.** Choose **Ingest Time** - * **Scope**. Select **Specific Data** - * **Scope**: Enter the following keyword search expression: - ```sql - pod_labels_environment=* pod_labels_component=database pod_labels_db_system=* pod_labels_db_cluster=* - ``` - * **Parse Expression**. Enter the following parse expression: - ```sql - if (!isEmpty(pod_labels_environment), pod_labels_environment, "") as environment - | pod_labels_component as component - | pod_labels_db_system as db_system - | if (!isEmpty(pod_labels_db_cluster), pod_labels_db_cluster, null) as db_cluster - ``` -5. Click **Save** to create the rule. + +
**FER to normalize the fields in Kubernetes environments.** Labels created in Kubernetes environments automatically are prefixed with pod_labels. To normalize these for our app to work, a Field Extraction Rule named **AppObservabilityCassandraDatabaseFER** is automatically created for Database Application Components. +
@@ -305,7 +249,7 @@ We use the Telegraf operator for Cassandra metric collection and Sumo Logic Inst non k8s -#### Configure Metrics Collection +### Configure Metrics Collection This section provides instructions for configuring metrics collection for the Sumo Logic app for Cassandra. @@ -424,7 +368,7 @@ Pivoting to Tracing data from Entity Inspector is possible only for “Cassandra Once you have finalized your telegraf.conf file, you can start or reload the telegraf service using instructions from the [doc](https://docs.influxdata.com/telegraf/v1.17/introduction/getting-started/#start-telegraf-service). At this point, Cassandra metrics should start flowing into Sumo Logic. -#### Configure Logs Collection +### Configure Logs Collection This section provides instructions for configuring log collection for Cassandra running on a non-Kubernetes environment. @@ -522,91 +466,7 @@ At this point, Cassandra metrics and logs should start flowing into Sumo Logic. -## Installing Cassandra Monitors - -:::note -This step is not needed if you are using the [Application Components Solution](/docs/observability/application-components) Terraform script. -::: - -To install these monitors, you must have the **Manage Monitors** role capability. You can install monitors by importing a JSON file or using a Terraform script. - -Sumo Logic has provided pre-packaged alerts available through [Sumo Logic monitors](/docs/alerts/monitors) to help you proactively determine if a Cassandra cluster is available and performing as expected. These monitors are based on metric and log data and include pre-set thresholds that reflect industry best practices and recommendations. For more information about individual alerts, see [Cassandra Alerts](#cassandra-alerts). - -There are limits to how many alerts can be enabled. For more information, see [Monitors](/docs/alerts/monitors/create-monitor) for details. - -### Method A: Importing a JSON file - -1. Download the [JSON file](https://github.com/SumoLogic/terraform-sumologic-sumo-logic-monitor/blob/main/monitor_packages/Memcached/Memcached.json) that describes the monitors. -2. The [JSON](https://github.com/SumoLogic/terraform-sumologic-sumo-logic-monitor/blob/main/monitor_packages/Memcached/Memcached.json) contains the alerts that are based on Sumo Logic searches that do not have any scope filters and therefore will be applicable to all Cassandra clusters, the data for which has been collected via the instructions in the previous sections. - However, if you would like to restrict these alerts to specific clusters or environments, update the JSON file by replacing the text `db_cluster=*` with ``. Custom filter examples: - * For alerts applicable only to a specific cluster, your custom filter would be: `db_cluster=dev-cassandra-01`. - * For alerts applicable to all clusters that start with `cassandra-prod`, your custom filter would be: `db_cluster=cassandra-prod*`. - * For alerts applicable to specific clusters, within a production environment, your custom filter would be:`db_cluster=dev-cassandra-01` AND `environment=prod`. This assumes you have set the optional environment tag while configuring collection. -3. [**Classic UI**](/docs/get-started/sumo-logic-ui-classic). In the main Sumo Logic menu, select **Manage Data > Monitoring > Monitors**.
[**New UI**](/docs/get-started/sumo-logic-ui). In the main Sumo Logic menu, select **Alerts > Monitors**. You can also click the **Go To...** menu at the top of the screen and select **Monitors**. -4. Click **Add**. -5. Click **Import**. -6. On the **Import Content popup**, enter **Cassandra** in the Name field, paste the JSON into the popup, and click **Import**. -7. The monitors are created in a "Cassandra" folder. The monitors are disabled by default. See the [Monitors](/docs/alerts/monitors) topic for information about enabling monitors and configuring notifications or connections. - -### Method B: Using a Terraform script - -1. Generate an access key and access ID for a user that has the **Manage Monitors** role capability. For instructions, see [Access Keys](/docs/manage/security/access-keys). -2. Download [Terraform 0.13](https://www.terraform.io/downloads.html) or later and install it. -3. Download the Sumo Logic Terraform package for Cassandra monitors. The alerts package is available in the Sumo Logic GitHub [repository](https://github.com/SumoLogic/terraform-sumologic-sumo-logic-monitor/tree/main/monitor_packages/Memcached). You can either download it using the git clone command or as a zip file. -4. Alert Configuration. After extracting the package, navigate to the `terraform-sumologic-sumo-logic-monitor/monitor_packages/Cassandra/` directory. -5. Edit the Cassandra.auto.tfvars file and add the Sumo Logic Access Key and Access ID from Step 1 and your Sumo Logic deployment. If you're not sure of your deployment, see [Sumo Logic Endpoints and Firewall Security](/docs/api/getting-started#sumo-logic-endpoints-by-deployment-and-firewall-security). -```bash -access_id = "" -access_key = "" -environment = "" -``` -6. The Terraform script installs the alerts without any scope filters, if you would like to restrict the alerts to specific clusters or environments, update the `cassandra_data_source` variable. For example: - * To configure alerts for a specific cluster, set `cassandra_data_source` to something like `db_cluster=cassandra.prod.01` - * To configure alerts for all clusters in an environment, set `cassandra_data_source` to something like `environment=prod` - * To configure alerts for multiple clusters using a wildcard, set `cassandra_data_source` to something like `db_cluster=cassandra-prod*` - * To configure alerts for...A specific clusters within a specific environment, set `cassandra_data_source` to something like `db_cluster=cassandra-1` and `environment=prod`. This assumes you have configured and applied Fields as described [Configure Fields in Sumo Logic](#step-1-configure-fields-in-sumo-logic) step. - -All monitors are disabled by default on installation. To enable all of the monitors, set the `monitors_disabled` parameter to `false`. By default, the monitors will be located in a "Cassandra" folder on the **Monitors** page. To change the name of the folder, update the monitor folder name in the folder variable in the `Cassandra.auto.tfvars` file. - -7. If you want your alerts to send email or connection notifications, edit the `Cassandra_notifications.auto.tfvars` file to populate the `connection_notifications` and `email_notifications` sections. Examples are provided below. - - In the variable definition below, replace `` with the connection ID of the Webhook connection. You can obtain the Webhook connection ID by calling the [Monitors API](https://api.sumologic.com/docs/#operation/listConnections). - -```bash title="Pagerduty connection example" -connection_notifications = [ - { - connection_type = "PagerDuty", - connection_id = "", - payload_override = "{\"service_key\": \"your_pagerduty_api_integration_key\",\"event_type\": \"trigger\",\"description\": \"Alert: Triggered {{TriggerType}} for Monitor {{Name}}\",\"client\": \"Sumo Logic\",\"client_url\": \"{{QueryUrl}}\"}", - run_for_trigger_types = ["Critical", "ResolvedCritical"] - }, - { - connection_type = "Webhook", - connection_id = "", - payload_override = "", - run_for_trigger_types = ["Critical", "ResolvedCritical"] - } - ] -``` - -For information about overriding the payload for different connection types, see [Set Up Webhook Connections](/docs/alerts/webhook-connections/set-up-webhook-connections). -```bash title="Email notifications example" -email_notifications = [ - { - connection_type = "Email", - recipients = ["abc@example.com"], - subject = "Monitor Alert: {{TriggerType}} on {{Name}}", - time_zone = "PST", - message_body = "Triggered {{TriggerType}} Alert on {{Name}}: {{QueryURL}}", - run_for_trigger_types = ["Critical", "ResolvedCritical"] - } - ] -``` - -8. To install the Monitors, navigate to the `terraform-sumologic-sumo-logic-monitor/monitor_packages/Cassandra/` directory and run `terraform init`. This will initialize Terraform and download the required components. -9. Run `terraform plan` to view the monitors that Terraform will create or modify. -10. Run `terraform apply`. ## Installing the Cassandra app @@ -614,17 +474,38 @@ email_notifications = [ This step is not needed if you are using the [Application Components Solution](/docs/observability/application-components) Terraform script. ::: -This section demonstrates how to install the Cassandra app. +import AppInstall2 from '../../reuse/apps/app-install-only-k8s.md'; -import AppInstall from '../../reuse/apps/app-install.md'; + - +As part of the app installation process, the following fields will be created by default: +* `component` +* `environment` +* `db_system` +* `db_cluster` +* `pod` +* `db_cluster_address` +* `db_cluster_port` + +Additionally, if you're using Cassandra in the Kubernetes environment, the following additional fields will be created by default during the app installation process: +* `pod_labels_component` +* `pod_labels_environment` +* `pod_labels_db_system` +* `pod_labels_db_cluster` +* `pod_labels_db_cluster_address` +* `pod_labels_db_cluster_port` + +For information on setting up fields, see [Fields](/docs/manage/fields). ## Viewing Cassandra dashboards +import ViewDashboards from '../../reuse/apps/view-dashboards.md'; + + + ### Overview -The **Cassandra - Overview** dashboard provides an at-a-glance view of Cassandra backend and frontend HTTP error codes percentage, visitor location, URLs, and clients causing errors. +The **Cassandra (Classic) - Overview** dashboard provides an at-a-glance view of Cassandra backend and frontend HTTP error codes percentage, visitor location, URLs, and clients causing errors. Use this dashboard to: * Identify Frontend and Backend Sessions percentage usage to understand active sessions. This can help you increase the session limit. @@ -636,7 +517,7 @@ Use this dashboard to: ### Cache Stats -The **Cassandra - Cache Stats** dashboard provides insight into the database cache status, schedule, and items. +The **Cassandra (Classic) - Cache Stats** dashboard provides insight into the database cache status, schedule, and items. Use this dashboard to: * Monitor Cache performance. @@ -646,7 +527,7 @@ Use this dashboard to: ### Errors and Warnings -The **Cassandra - Errors and Warnings** dashboard provides details of the database errors and warnings. +The **Cassandra (Classic) - Errors and Warnings** dashboard provides details of the database errors and warnings. Use this dashboard to: * Review errors and warnings generated by the server. @@ -656,7 +537,7 @@ Use this dashboard to: ### Gossip -The **Cassandra - Gossip** dashboard provides details about communication between various cassandra nodes. +The **Cassandra (Classic) - Gossip** dashboard provides details about communication between various cassandra nodes. Use this dashboard to: * Determine nodes with errors resulting in failures. @@ -666,7 +547,7 @@ Use this dashboard to: ### Memtable -The **Cassandra - Memtable** dashboard provides insights into memtable statistics. +The **Cassandra (Classic) - Memtable** dashboard provides insights into memtable statistics. Use this dashboard to: * Review flush activity and memtable status. @@ -675,7 +556,7 @@ Use this dashboard to: ### Resource Usage -The **Cassandra - Resource Usage** dashboard provides details of resource utilization across Cassandra clusters. +The **Cassandra (Classic) - Resource Usage** dashboard provides details of resource utilization across Cassandra clusters. Use this dashboard to: * Identify resource utilization. This can help you to determine whether are resources over- or under-allocated. @@ -684,7 +565,7 @@ Use this dashboard to: ### Compactions -The **Cassandra - Compactions** dashboard provides details of compactions. +The **Cassandra (Classic) - Compactions** dashboard provides details of compactions. Use this dashboard to: * Review pending/completed compactions and flushes. @@ -693,7 +574,7 @@ Use this dashboard to: ### Garbage Collection -The **Cassandra - Garbage Collection** dashboard shows key Garbage Collector statistics like the duration of the last GC run, objects collected, threads used, and memory cleared in the last GC run. +The **Cassandra (Classic) - Garbage Collection** dashboard shows key Garbage Collector statistics like the duration of the last GC run, objects collected, threads used, and memory cleared in the last GC run. Use this dashboard to: * Understand the garbage collection time. If the time keeps on increasing, you may have more CPU usage. @@ -703,7 +584,7 @@ Use this dashboard to: ### Read Path -The **Cassandra - Read Path** dashboard shows read operation statistics. +The **Cassandra (Classic) - Read Path** dashboard shows read operation statistics. Use this dashboard to: * Gather insights into read operations, cache statistics, Tombstone, and SSTTables summary. @@ -713,7 +594,7 @@ Use this dashboard to: ### Resource Usage -The **Cassandra - Resource Usage** dashboard provides details of resource utilization across Cassandra clusters. +The **Cassandra (Classic) - Resource Usage** dashboard provides details of resource utilization across Cassandra clusters. Use this dashboard to: * Identify resource utilization. This can help you to determine resources over or under allocation. @@ -722,7 +603,7 @@ Use this dashboard to: ### Thread Pool -The **Cassandra - Thread Pool** dashboard shows thread pool statistics. +The **Cassandra (Classic) - Thread Pool** dashboard shows thread pool statistics. Use this dashboard to: * Review thread pool usage and statistics for different kinds of operations. @@ -731,7 +612,7 @@ Use this dashboard to: ### Write Path -The **Cassandra - Write Path** dashboard shows write operation statistics. +The **Cassandra (Classic) - Write Path** dashboard shows write operation statistics. Use this dashboard to: * Gather insights into write operations, cache statistics, Tombstone, and SSTTables summary. @@ -739,20 +620,25 @@ Use this dashboard to: Cassandra dashboards -## Cassandra Alerts +## Create monitors for Cassandra app + +import CreateMonitors from '../../reuse/apps/create-monitors.md'; + + + +### Cassandra Alerts -Sumo Logic has provided out-of-the-box alerts available via [Sumo Logic monitors](/docs/alerts/monitors) to help you quickly determine if the Cassandra cluster is available and performing as expected. | Alert Name | Alert Description | Alert Condition | Recover Condition | |:-----------|:--------------|:-----------|:------------| -| Cassandra - Increase in Authentication Failures | This alert fires when there is an increase of Cassandra authentication failures. | >5 | `<=` 5 | -| Cassandra - Cache Hit Rate below 85 Percent | This alert fires when the cache key hit rate is below 85%. | `<`85 | `>=` 85 | -| Cassandra - High Commitlog Pending Tasks | This alert fires when there are more than 15 Commitlog tasks that are pending. | >15 | `<=` 15 | -| Cassandra - High Number of Compaction Executor Blocked Tasks | This alert fires when there are more than 15 compaction executor tasks blocked for more than 5 minutes. | >15 | `<=` 15 | -| Cassandra - Compaction Task Pending | This alert fires when there are many Cassandra compaction tasks that are pending. You might need to increase I/O capacity by adding nodes to the cluster. | >100 | `<=` 100 | -| Cassandra - High Number of Flush Writer Blocked Tasks | This alert fires when there is a high number of flush writer tasks which are blocked. | >15 | `<=` 15 | -| Cassandra - Many Compaction Tasks Are Pending | Many Cassandra compaction tasks are pending | >100 | `<=` 100 | -| Cassandra - Node Down | This alert fires when one or more Cassandra nodes are down | >0 | `<=` 0 | -| Cassandra - Blocked Repair Tasks | This alert fires when the repair tasks are blocked | >2 | `<=` 2 | -| Cassandra - Repair Tasks Pending | This alert fires when repair tasks are pending. | >2 | `<=` 2 | -| Cassandra - High Tombstone Scanning | This alert fires when tombstone scanning is very high (>1000 99th Percentile) in queries. | >1000 | `<=` 1000 | +| Cassandra (Classic) - Increase in Authentication Failures | This alert fires when there is an increase of Cassandra authentication failures. | >5 | `<=` 5 | +| Cassandra (Classic) - Cache Hit Rate below 85 Percent | This alert fires when the cache key hit rate is below 85%. | `<`85 | `>=` 85 | +| Cassandra (Classic) - High Commitlog Pending Tasks | This alert fires when there are more than 15 Commitlog tasks that are pending. | >15 | `<=` 15 | +| Cassandra (Classic) - High Number of Compaction Executor Blocked Tasks | This alert fires when there are more than 15 compaction executor tasks blocked for more than 5 minutes. | >15 | `<=` 15 | +| Cassandra (Classic) - Compaction Task Pending | This alert fires when there are many Cassandra compaction tasks that are pending. You might need to increase I/O capacity by adding nodes to the cluster. | >100 | `<=` 100 | +| Cassandra (Classic) - High Number of Flush Writer Blocked Tasks | This alert fires when there is a high number of flush writer tasks which are blocked. | >15 | `<=` 15 | +| Cassandra (Classic) - Many Compaction Tasks Are Pending | Many Cassandra compaction tasks are pending | >100 | `<=` 100 | +| Cassandra (Classic) - Node Down | This alert fires when one or more Cassandra nodes are down | >0 | `<=` 0 | +| Cassandra (Classic) - Blocked Repair Tasks | This alert fires when the repair tasks are blocked | >2 | `<=` 2 | +| Cassandra (Classic) - Repair Tasks Pending | This alert fires when repair tasks are pending. | >2 | `<=` 2 | +| Cassandra (Classic) - High Tombstone Scanning | This alert fires when tombstone scanning is very high (>1000 99th Percentile) in queries. | >1000 | `<=` 1000 | diff --git a/docs/integrations/databases/couchbase.md b/docs/integrations/databases/couchbase.md index 16a8ae1b30..7984dd038e 100644 --- a/docs/integrations/databases/couchbase.md +++ b/docs/integrations/databases/couchbase.md @@ -27,42 +27,7 @@ Telegraf 1.14 default of Kubernetes Collection will not work. This section provides instructions for configuring log and metric collection for the Sumo Logic app for Couchbase. -### Step 1: Configure Fields in Sumo Logic - -Create the following Fields in Sumo Logic prior to configuring the collection. This ensures that your logs and metrics are tagged with relevant metadata, which is required by the app dashboards. For information on setting up fields, see [Sumo Logic Fields](/docs/manage/fields). - - - - - -If you're using Couchbase in a Kubernetes environment, create the fields: - -* `pod_labels_component` -* `pod_labels_environment` -* `pod_labels_db_system` -* `pod_labels_db_cluster` - - - - -If you're using Couchbase in a non-Kubernetes environment, create the fields: - -* `component` -* `environment` -* `db_system` -* `db_cluster` -* `pod` - - - - -### Step 2: Configure Collection for Couchbase +### Configure Collection for Couchbase Sumo Logic supports the collection of logs and metrics data from Couchbase in both Kubernetes and non-Kubernetes environments. Click on the appropriate tab below based on the environment where your Couchbase clusters are hosted. @@ -199,28 +164,9 @@ This section explains the steps to collect Couchbase logs from a Kubernetes envi ``` 5. Sumo Logic Kubernetes collection will automatically start collecting logs from the pods having the annotations defined above. 6. Verify logs in Sumo Logic. -3. **Add a FER to normalize the fields in Kubernetes environments**. This step is not needed if using application components solution terraform script. Labels created in Kubernetes environments automatically are prefixed with pod_labels. To normalize these for our app to work, we need to create a Field Extraction Rule if not already created for Proxy Application Components. To do so: - 1. [**Classic UI**](/docs/get-started/sumo-logic-ui-classic). In the main Sumo Logic menu, select **Manage Data > Logs > Field Extraction Rules**.
[**New UI**](/docs/get-started/sumo-logic-ui). In the top menu select **Configuration**, and then under **Logs** select **Field Extraction Rules**. You can also click the **Go To...** menu at the top of the screen and select **Field Extraction Rules**. - 2. Click the **+ Add Rule** button on the top right of the table. - 3. The **Add Field Extraction Rule** form will appear: - 4. Enter the following options: - * **Rule Name**. Enter the name as **App Observability - Proxy**. - * **Applied At.** Choose **Ingest Time** - * **Scope**. Select **Specific Data** - * **Scope**: Enter the following keyword search expression: - ```sql - pod_labels_environment=* pod_labels_component=database \ - pod_labels_db_cluster=* pod_labels_db_system=* - ``` - * **Parse Expression**. Enter the following parse expression: - ```sql - if (!isEmpty(pod_labels_environment), pod_labels_environment, "") as environment - | pod_labels_component as component - | pod_labels_db_system as db_system - | pod_labels_db_cluster as db_cluster - | if (!isEmpty(pod_labels_db_cluster), pod_labels_db_cluster, null) as db_cluster - ``` - 5. Click **Save** to create the rule. + +
**FER to normalize the fields in Kubernetes environments.** Labels created in Kubernetes environments automatically are prefixed with pod_labels. To normalize these for our app to work, a Field Extraction Rule named **AppObservabilityCouchbaseDatabaseFER** is automatically created for Database Application Components. +
@@ -378,131 +324,39 @@ At this point, Telegraf should start collecting the Couchbase metrics and forwar - -## Installing Couchbase Monitors - -The next sections provides instructions for installing the Couchbase app, as well as examples of each of the app dashboards. These instructions assume you have already set up the collection as described in the **Collecting Logs and Metrics for the Couchbase app** section. - -#### Pre-Packaged Alerts - -Sumo Logic has provided out-of-the-box alerts available through [Sumo Logic monitors](/docs/alerts/monitors) to help you monitor your Couchbase clusters. These alerts are built based on metrics and logs datasets and include preset thresholds based on industry best practices and recommendations. - -For details on the individual alerts, see [Couchbase Alerts](#couchbase-alerts). -* To install these alerts, you need to have the Manage Monitors role capability. -* Alerts can be installed by either importing a JSON file or a Terraform script. - -There are limits to how many alerts can be enabled - see the [Alerts FAQ](/docs/alerts/monitors/monitor-faq) for details. - - -### Method A: Importing a JSON file - -1. Download the [JSON file](https://github.com/SumoLogic/terraform-sumologic-sumo-logic-monitor/blob/main/monitor_packages/Couchbase/couchbase.json) that describes the monitors. -2. The [JSON](https://github.com/SumoLogic/terraform-sumologic-sumo-logic-monitor/blob/main/monitor_packages/Couchbase/couchbase.json) contains the alerts that are based on Sumo Logic searches that do not have any scope filters and therefore will be applicable to all Couchbase clusters, the data for which has been collected via the instructions in the previous sections. However, if you would like to restrict these alerts to specific clusters or environments, update the JSON file by replacing the text `db_system=couchbase` with ``. Custom filter examples: - 1. For alerts applicable only to a specific cluster, your custom filter would be `'db_cluster=couchbase-standalone.01'`. - 2. For alerts applicable to all cluster that start with couchbase-standalone, your custom filter would be,`db_cluster=couchbase-standalone*`. - 3. For alerts applicable to a specific cluster within a production environment, your custom filter would be `db_cluster=couchbase-1` and `environment=standalone` (This assumes you have set the optional environment tag while configuring collection). -3. [**Classic UI**](/docs/get-started/sumo-logic-ui-classic). In the main Sumo Logic menu, select **Manage Data > Monitoring > Monitors**.
[**New UI**](/docs/get-started/sumo-logic-ui). In the main Sumo Logic menu, select **Alerts > Monitors**. You can also click the **Go To...** menu at the top of the screen and select **Monitors**. -4. Click **Add**: -5. Click **Import** and then copy-paste the above JSON to import monitors. -6. The monitors are disabled by default. Once you have installed the alerts using this method, navigate to the Couchbase folder under **Monitors** to configure them. See [Monitor Settings](/docs/alerts/monitors/settings) to learn how to enable monitors to send notifications to teams or connections. See the instructions detailed in [Create a Monitor](/docs/alerts/monitors/create-monitor). - -### Method B: Using a Terraform script method - -1. **Generate a Sumo Logic access key and ID**. Generate an access key and access ID for a user that has the Manage Monitors role capability in Sumo Logic using instructions in [Access Keys](/docs/manage/security/access-keys). Identify which deployment your Sumo Logic account is in using this [link](/docs/api/getting-started#sumo-logic-endpoints-by-deployment-and-firewall-security). -2. **[Download and install Terraform 0.13](https://www.terraform.io/downloads.html) or later**. -3. **Download the Sumo Logic Terraform package for Couchbase alerts**. The alerts package is available in the Sumo Logic GitHub [repository](https://github.com/SumoLogic/terraform-sumologic-sumo-logic-monitor/tree/main/monitor_packages/SquidProxy). You can either download it through the “git clone” command or as a zip file. -4. **Alert Configuration**. After the package has been extracted, navigate to the package directory `terraform-sumologic-sumo-logic-monitor/monitor_packages/Couchbase/` -5. Edit the **couchbase.auto.tfvars** file and add the Sumo Logic Access Key, Access Id, and Deployment from Step 1. -```bash -access_id = "" -access_key = "" -environment = "" -``` - -The Terraform script installs the alerts without any scope filters, if you would like to restrict the alerts to specific farms or environments, update the variable `couchbase_data_source`. Custom filter examples: - * A specific cluster `db_cluster=couchbase.standalone.01`. - * All clusters in an environment `environment=standalone`. - * For alerts applicable to all clusters that start with `couchbase-standalone`, your custom filter would be: `db_cluster=couchbase-standalone`. - * For alerts applicable to a specific cluster within a production environment, your custom filter would be: `db_system=couchbase` and `environment=standalone`. This assumes you have set the optional environment tag while configuring collection. - -All monitors are disabled by default on installation. If you would like to enable all the monitors, set the parameter `monitors_disabled` to `false` in this file. - -By default, the monitors are configured in a monitor folder called “Couchbase”. If you would like to change the name of the folder, update the monitor folder name in “folder” key at `couchbase.auto.tfvars` file. - -If you would like the alerts to send email or connection notifications, configure these in the file `couchbase_notifications.auto.tfvars`. For configuration examples, refer to the next section. - -6. **Email and Connection Notification Configuration Examples**. Modify the file **couchbase_notifications.auto.tfvars** and populate `connection_notifications` and `email_notifications` as per below examples. - -```bash title="Pagerduty Connection Example" -connection_notifications = [ - { - connection_type = "PagerDuty", - connection_id = "", - payload_override = "{\"service_key\": \"your_pagerduty_api_integration_key\",\"event_type\": \"trigger\",\"description\": \"Alert: Triggered {{TriggerType}} for Monitor {{Name}}\",\"client\": \"Sumo Logic\",\"client_url\": \"{{QueryUrl}}\"}", - run_for_trigger_types = ["Critical", "ResolvedCritical"] - }, - { - connection_type = "Webhook", - connection_id = "", - payload_override = "", - run_for_trigger_types = ["Critical", "ResolvedCritical"] - } - ] -``` - -Replace `` with the connection id of the webhook connection. The webhook connection id can be retrieved by calling the [Monitors API](https://api.sumologic.com/docs/#operation/listConnections). - -For overriding payload for different connection types, refer to this [document](/docs/alerts/webhook-connections/set-up-webhook-connections). - -```bash title="Email Notifications Example" -email_notifications = [ - { - connection_type = "Email", - recipients = ["abc@example.com"], - subject = "Monitor Alert: {{TriggerType}} on {{Name}}", - time_zone = "PST", - message_body = "Triggered {{TriggerType}} Alert on {{Name}}: {{QueryURL}}", - run_for_trigger_types = ["Critical", "ResolvedCritical"] - } - ] -``` - -7. **Install the Alerts**. Navigate to the package directory `terraform-sumologic-sumo-logic-monitor/monitor_packages/Couchbase/` and run `terraform init`. This will initialize Terraform and will download the required components. -8. Run `terraform plan` to view the monitors which will be created/modified by Terraform. -9. Run `terraform apply`. -10. **Post Installation**. If you haven’t enabled alerts and/or configured notifications through the Terraform procedure outlined above, we highly recommend enabling alerts of interest and configuring each enabled alert to send notifications to other users or services. This is detailed in Step 4 of [this document](/docs/alerts/monitors/create-monitor). There are limits to how many alerts can be enabled - see the [Alerts FAQ](/docs/alerts/monitors/monitor-faq.md). - - ## Installing the Couchbase app This section demonstrates how to install the Couchbase app. -Locate and install the app you need from the **App Catalog**. If you want to see a preview of the dashboards included with the app before installing, click **Preview Dashboards**. +import AppInstall2 from '../../reuse/apps/app-install-only-k8s.md'; -1. From the **App Catalog**, search and select the app. -2. Select the version of the service you're using and click **Add to Library**. - :::note - Version selection is not available for all apps. - ::: -3. To install the app, complete the following fields. - 1. **App Name.** You can retain the existing name, or enter a name of your choice for the app. - 2. **Data Source.** - * Choose **Enter a Custom Data Filter**, and enter a custom Couchbase cluster filter. Examples: - 1. For all Couchbase clusters `db_cluster=*` - 2. For a specific cluster: `db_cluster=couchbase.dev.01` - 3. Clusters within a specific environment: `db_cluster=couchbase.dev.01` and `environment=prod`. This assumes you have set the optional environment tag while configuring collection. - 3. **Advanced**. Select the **Location in the Library** (the default is the Personal folder in the library), or click **New Folder** to add a new folder. -4. Click **Add to Library**. + -Once an app is installed, it will appear in your **Personal** folder, or another folder that you specified. From here, you can share it with your organization. -Panels will start to fill automatically. It's important to note that each panel slowly fills with data matching the time range query and received since the panel was created. Results won't immediately be available, but with a bit of time, you'll see full graphs and maps. +As part of the app installation process, the following fields will be created by default: +* `component` +* `environment` +* `db_system` +* `db_cluster` +* `pod` +* `db_cluster_address` +* `db_cluster_port` + +Additionally, if you're using Couchbase in the Kubernetes environment, the following additional fields will be created by default during the app installation process: +* `pod_labels_component` +* `pod_labels_environment` +* `pod_labels_db_system` +* `pod_labels_db_cluster` +* `pod_labels_db_cluster_address` +* `pod_labels_db_cluster_port` + +For information on setting up fields, see [Fields](/docs/manage/fields). ## Viewing Couchbase Dashboards -:::tip Filter with template variables -Template variables provide dynamic dashboards that can rescope data on the fly. As you apply variables to troubleshoot through your dashboard, you view dynamic changes to the data for a quicker resolution to the root cause. You can use template variables to drill down and examine the data on a granular level. For more information, see [Filter with template variables](/docs/dashboards/filter-template-variables.md). -::: +import ViewDashboards from '../../reuse/apps/view-dashboards.md'; + + ### Overview @@ -589,7 +443,7 @@ The **Couchbase - Events** dashboard provides insights into events from couchba Use this dashboard to: * To audit the activities happening in the cluster. This helps to determine what activities have occurred in the system, helping to control system security. -Cassandra dashboards +Couchbase dashboards ### HTTP Access @@ -598,11 +452,15 @@ The **Couchbase - HTTP Access** dashboard provides insights into HTTP Rest API Use this dashboard to: * To understand user behavior accessing clusters and servers through Rest API. -Cassandra dashboards +Couchbase dashboards + +## Create monitors for Couchbase app + +import CreateMonitors from '../../reuse/apps/create-monitors.md'; -## Couchbase Alerts + -Sumo Logic has provided out-of-the-box alerts available via[ Sumo Logic monitors](/docs/alerts/monitors) to help you quickly determine if the Couchbase database cluster is available and performing as expected. +### Couchbase alerts diff --git a/docs/integrations/databases/elasticsearch.md b/docs/integrations/databases/elasticsearch.md index 593dec59a2..7feecb27c4 100644 --- a/docs/integrations/databases/elasticsearch.md +++ b/docs/integrations/databases/elasticsearch.md @@ -62,42 +62,8 @@ The Elasticsearch app is a unified logs and metrics app that helps you monitor t Configuring log and metric collection for the Elasticsearch app includes the following tasks. -### Step 1: Configure Fields in Sumo Logic -Create the following Fields in Sumo Logic before configuring the collection. This ensures that your logs and metrics are tagged with relevant metadata required by the app dashboards. For information on setting up fields, see [Sumo Logic Fields](/docs/manage/fields). - - - - - -If you're using Elasticsearch in a Kubernetes environment, create the fields: - -* `pod_labels_component` -* `pod_labels_environment` -* `pod_labels_db_system` -* `pod_labels_db_cluster` - - - - -If you're using Elasticsearch in a non-Kubernetes environment, create the fields: - -* `component` -* `environment` -* `db_system` -* `db_cluster` -* `pod` - - - - -### Step 2: Configure Collection for Elasticsearch +### Configure Collection for Elasticsearch -## Installing Elasticsearch Monitors - -Sumo Logic has provided pre-packaged alerts available through [Sumo Logic monitors](/docs/alerts/monitors) to help you proactively determine if an Elasticsearch cluster is available and performing as expected. These monitors are based on metric and log data and include pre-set thresholds that reflect industry best practices and recommendations. For more information about individual alerts, see [Elasticsearch Alerts](#elasticsearch-alerts). - -To install these monitors, you must have the **Manage Monitors** role capability. You can install monitors by importing a JSON file or using a Terraform script. There are limits to how many alerts can be enabled. For more information, see [Monitors](/docs/alerts/monitors/create-monitor) for details. - -### Method 1: Importing a JSON file - -1. Download the [JSON file](https://github.com/SumoLogic/terraform-sumologic-sumo-logic-monitor/blob/main/monitor_packages/Elasticsearch/Elasticsearch.json) that describes the monitors. -2. The [JSON](https://github.com/SumoLogic/terraform-sumologic-sumo-logic-monitor/blob/main/monitor_packages/Elasticsearch/Elasticsearch.json) contains the alerts that are based on Sumo Logic searches that do not have any scope filters, and therefore will be applicable to all Elasticsearch clusters, the data for which has been collected via the instructions in the previous sections. However, if you would like to restrict these alerts to specific clusters or environments, update the JSON file by replacing the text `db_cluster=*` with ``. Custom filter examples: - * For alerts applicable only to a specific cluster, your custom filter would be: `db_cluster=dev-elasticsearch-01` - * For alerts applicable to all clusters that start with `elasticsearch-prod`, your custom filter would be: `db_cluster=elasticsearch-prod*` - * For alerts applicable to a specific clusters, within a production environment, your custom filter would be: `db_cluster=dev-elasticsearch-01` AND `environment=prod`. This assumes you have set the optional environment tag while configuring collection. -3. [**Classic UI**](/docs/get-started/sumo-logic-ui-classic). In the main Sumo Logic menu, select **Manage Data > Monitoring > Monitors**.
[**New UI**](/docs/get-started/sumo-logic-ui). In the main Sumo Logic menu, select **Alerts > Monitors**. You can also click the **Go To...** menu at the top of the screen and select **Monitors**. -4. Click **Add**. -5. Click **Import**. -6. On the **Import Content popup**, enter **Elasticsearch** in the Name field, paste in the JSON into the popup, and click **Import**. -7. The monitors are created in a **Elasticsearch** folder. The monitors are disabled by default. See the [Monitors](/docs/alerts/monitors) topic for information about enabling monitors and configuring notifications or connections. -### Method 2: Using a Terraform script +## Installing the Elasticsearch app -1. Generate a Sumo Logic access key and ID for a user that has the **Manage Monitors** role capability. For instructions, see [Access Keys](/docs/manage/security/access-keys). -2. Download [Terraform 0.13](https://www.terraform.io/downloads.html) or later, and install it. -3. Download the Sumo Logic Terraform package for Elasticsearch monitors. The alerts package is available in the Sumo Logic GitHub [repository](https://github.com/SumoLogic/terraform-sumologic-sumo-logic-monitor/tree/main/monitor_packages/Elasticsearch). You can either download it using the git clone command or as a zip file. -4. Alert Configuration. After extracting the package, navigate to the `terraform-sumologic-sumo-logic-monitor/monitor_packages/Elasticsearch/` directory. - * Edit the `Elasticsearch.auto.tfvars` file and add the Sumo Logic Access Key and Access ID from Step 1 and your Sumo Logic deployment. If you're not sure of your deployment, see [Sumo Logic Endpoints and Firewall Security](/docs/api/getting-started#sumo-logic-endpoints-by-deployment-and-firewall-security). - ```bash - access_id = "" - access_key = "" - environment = "" - ``` - * The Terraform script installs the alerts without any scope filters. If you would like to restrict the alerts to specific clusters or environments, update the `elasticsearch_data_source` variable. For example: - * To configure alerts for a specific cluster, set `elasticsearch_data_source` to something like `db_cluster=elasticsearch.prod.01` - * To configure alerts for all clusters in an environment, set `elasticsearch_data_source` to something like `environment=prod` - * To configure alerts for multiple clusters using a wildcard, set `elasticsearch_data_source` to something like `db_cluster=elasticsearch-prod*` - * To configure alerts for a specific clusters within a specific environment, set `elasticsearch_data_source` to something like `db_cluster=elasticsearch-1` and `environment=prod`. This assumes you have configured and applied Fields as described in [Configure Sumo Logic Fields](#step-1-configure-fields-in-sumo-logic). - - All monitors are disabled by default on installation. To enable all of the monitors, set the `monitors_disabled` parameter to `false`. By default, the monitors will be located in a "Elasticsearch" folder on the **Monitors** page. To change the name of the folder, update the monitor folder name in the folder variable in the `Elasticsearch.auto.tfvars` file. -5. If you want your alerts to send email or connection notifications, edit the `Elasticsearch_notifications.auto.tfvars` file to populate the `connection_notifications` and `email_notifications` sections. Examples are provided below. In the variable definition below, replace `` with the connection ID of the Webhook connection. You can obtain the Webhook connection ID by calling the [Monitors API](https://api.sumologic.com/docs/#operation/listConnections). -```bash title="Pagerduty connection example" -connection_notifications = [ - { - connection_type = "PagerDuty", - connection_id = "", - payload_override = "{\"service_key\": \"your_pagerduty_api_integration_key\",\"event_type\": \"trigger\",\"description\": \"Alert: Triggered {{TriggerType}} for Monitor {{Name}}\",\"client\": \"Sumo Logic\",\"client_url\": \"{{QueryUrl}}\"}", - run_for_trigger_types = ["Critical", "ResolvedCritical"] - }, - { - connection_type = "Webhook", - connection_id = "", - payload_override = "", - run_for_trigger_types = ["Critical", "ResolvedCritical"] - } - ] -``` +import AppInstall2 from '../../reuse/apps/app-install-only-k8s.md'; -For information about overriding the payload for different connection types, see [Set Up Webhook Connections](/docs/alerts/webhook-connections/set-up-webhook-connections). - -```bash title="Email notifications example" -email_notifications = [ - { - connection_type = "Email", - recipients = ["abc@example.com"], - subject = "Monitor Alert: {{TriggerType}} on {{Name}}", - time_zone = "PST", - message_body = "Triggered {{TriggerType}} Alert on {{Name}}: {{QueryURL}}", - run_for_trigger_types = ["Critical", "ResolvedCritical"] - } - ] -``` -6. Installation. - 1. Navigate to the `terraform-sumologic-sumo-logic-monitor/monitor_packages/Elasticsearch/` directory and run terraform init. This will initialize Terraform and download the required components. - 2. Run `terraform plan` to view the monitors that Terraform will create or modify. - 3. Run `terraform apply`. + -## Installing the Elasticsearch app +As part of the app installation process, the following fields will be created by default: +* `component` +* `environment` +* `db_system` +* `db_cluster` +* `pod` +* `db_cluster_address` +* `db_cluster_port` -import AppInstall from '../../reuse/apps/app-install.md'; +Additionally, if you're using Elasticsearch in the Kubernetes environment, the following additional fields will be created by default during the app installation process: +* `pod_labels_component` +* `pod_labels_environment` +* `pod_labels_db_system` +* `pod_labels_db_cluster` +* `pod_labels_db_cluster_address` +* `pod_labels_db_cluster_port` - +For information on setting up fields, see [Fields](/docs/manage/fields). ## Viewing Elasticsearch dashboards -:::tip Filter with template variables -Template variables provide dynamic dashboards that can rescope data on the fly. As you apply variables to troubleshoot through your dashboard, you view dynamic changes to the data for a quicker resolution to the root cause. You can use template variables to drill down and examine the data on a granular level. For more information, see [Filter with template variables](/docs/dashboards/filter-template-variables.md). -::: +import ViewDashboards from '../../reuse/apps/view-dashboards.md'; + + ### Overview @@ -533,9 +444,13 @@ The **ElasticSearch - Queries** dashboard shows Elasticsearch provides analytics elasticsearch dashboards -## Elasticsearch Alerts +## Create monitors for Elasticsearch app + +import CreateMonitors from '../../reuse/apps/create-monitors.md'; + + -Sumo Logic has provided out-of-the-box alerts available via[ Sumo Logic monitors](/docs/alerts/monitors) to help you quickly determine if the Elasticsearch database cluster is available and performing as expected. +### Elasticsearch Alerts | Alert Type (Metrics/Logs) | Alert Name | Alert Description | Trigger Type (Critical / Warning) | Alert Condition | Recover Condition | |---|---|---|---|---|---| diff --git a/docs/integrations/databases/mariadb.md b/docs/integrations/databases/mariadb.md index 9abb1c08ff..6882dea99f 100644 --- a/docs/integrations/databases/mariadb.md +++ b/docs/integrations/databases/mariadb.md @@ -22,45 +22,8 @@ This app is tested with the following MariaDB versions: Configuring log and metric collection for the MariaDB app includes the following tasks. -### Step 1: Configure Fields in Sumo Logic -Create the following fields in Sumo Logic before configuring the collection to ensure that your logs and metrics are tagged with relevant metadata, which is required by the app dashboards. For information on setting up fields, see [Sumo Logic Fields](/docs/manage/fields). - - - - - -If you're using MariaDB in a Kubernetes environment, create the fields: -* `pod_labels_component` -* `pod_labels_environment` -* `pod_labels_db_system` -* `pod_labels_db_cluster` -* `pod_labels_db_cluster_address` -* `pod_labels_db_cluster_port` - - - - - -If you're using MariaDB in a non-Kubernetes environment, create the fields: -* `component` -* `environment` -* `db_system` -* `db_cluster` -* `db_cluster_address` -* `db_cluster_port` - - - - - -### Step 2: Configure Collection +### Configure Collection Sumo Logic supports the collection of logs and metrics data from MariaDB in both Kubernetes and non-Kubernetes environments. Click on the appropriate links below based on the environment where your MariaDB clusters are hosted. @@ -200,29 +163,11 @@ This section explains the steps to collect MariaDB logs from a Kubernetes enviro ``` 5. Sumo Logic Kubernetes collection will automatically start collecting logs from the pods having the annotations defined above. 6. Verify logs in Sumo Logic. -3. **Add an FER to normalize the fields in Kubernetes environments**. This step is not needed if using application components solution terraform script. Labels created in Kubernetes environments automatically are prefixed with pod_labels. To normalize these for our app to work, we need to create a Field Extraction Rule if not already created for Proxy Application Components: - 1. [**Classic UI**](/docs/get-started/sumo-logic-ui-classic). In the main Sumo Logic menu, select **Manage Data > Logs > Field Extraction Rules**.
[**New UI**](/docs/get-started/sumo-logic-ui). In the top menu select **Configuration**, and then under **Logs** select **Field Extraction Rules**. You can also click the **Go To...** menu at the top of the screen and select **Field Extraction Rules**. - 2. Click the **+ Add** button on the top right of the table. - 3. The **Add Field Extraction Rule** form will appear: - 4. Enter the following options: - * **Rule Name**. Enter the name as **App Observability - database**. - * **Applied At.** Choose **Ingest Time** - * **Scope**. Select **Specific Data** - * **Scope**. Enter the following keyword search expression: - ```sql - pod_labels_environment=* pod_labels_component=database - pod_labels_db_cluster=* pod_labels_db_system=* - ``` - * **Parse Expression**. Enter the following parse expression: - ```sql - if (!isEmpty(pod_labels_environment), pod_labels_environment, "") as environment - | pod_labels_component as component - | pod_labels_db_system as db_system - | if (!isEmpty(pod_labels_db_cluster), pod_labels_db_cluster, null) as db_cluster - ``` - 5. Click **Save** to create the rule. +
**FER to normalize the fields in Kubernetes environments.** Labels created in Kubernetes environments automatically are prefixed with pod_labels. To normalize these for our app to work, a Field Extraction Rule named **AppObservabilityMariaDBDatabaseFER** is automatically created for Database Application Components. +
+ @@ -429,121 +374,38 @@ At this point, Telegraf should start collecting the MariaDB metrics and forward - -## Installing the MariaDB Monitors - -The next few sections provide instructions for installing the MariaDB Monitors app, as well as examples of each of the app dashboards. These instructions assume you have already set up the collection as described in the Collect Logs and Metrics for the MariaDB app page. - -#### Pre-Packaged Alerts - -Sumo Logic has provided out-of-the-box alerts available through [Sumo Logic monitors](/docs/alerts/monitors) to help you monitor your MariaDB clusters. These alerts are built based on metrics and logs datasets and include preset thresholds based on industry best practices and recommendations. See [Alerts](#mariadb-alerts) for more information. -* To install these alerts, you need to have the Manage Monitors role capability. -* Alerts can be installed by either importing a JSON file or a Terraform script. -* There are limits to how many alerts can be enabled - see the [Alerts FAQ](/docs/alerts/monitors/monitor-faq) for details. - -### Method A: Importing a JSON file - -1. Download the [JSON file](https://github.com/SumoLogic/terraform-sumologic-sumo-logic-monitor/blob/main/monitor_packages/MariaDB/MariaDB.json) that describes the monitors. -2. The [JSON](https://github.com/SumoLogic/terraform-sumologic-sumo-logic-monitor/blob/main/monitor_packages/MariaDB/MariaDB.json) contains the alerts that are based on Sumo Logic searches that do not have any scope filters and therefore will be applicable to all MariaDB clusters, the data for which has been collected via the instructions in the previous sections. However, if you would like to restrict these alerts to specific clusters or environments, update the JSON file by replacing the text `db_system=mariadb` with ``. Custom filter examples: - * For alerts applicable only to a specific cluster, your custom filter would be `db_cluster=mariadb-prod.01`. - * For alerts applicable to all clusters that start with Kafka-prod, your custom filter would be `db_cluster=mariadb-prod*`. - * For alerts applicable to a specific cluster within a production environment, your custom filter would be `db_cluster=mariadb-1` and `environment=prod`. This assumes you have set the optional environment tag while configuring collection. -3. [**Classic UI**](/docs/get-started/sumo-logic-ui-classic). In the main Sumo Logic menu, select **Manage Data > Monitoring > Monitors**.
[**New UI**](/docs/get-started/sumo-logic-ui). In the main Sumo Logic menu, select **Alerts > Monitors**. You can also click the **Go To...** menu at the top of the screen and select **Monitors**. -4. Click **Add**. -5. Click Import and then copy-paste the above JSON to import monitors. -6. The monitors are disabled by default. Once you have installed the alerts using this method, navigate to the MariaDB folder under **Monitors** to configure them. See [this](/docs/alerts/monitors) document to enable monitors to send notifications to teams or connections. See the instructions detailed in [Add a Monitor](/docs/alerts/monitors/create-monitor). - -### Method B: Using a Terraform script - -1. **Generate a Sumo Logic access key and ID.** Generate an access key and access ID for a user that has the Manage Monitors role capability in Sumo Logic using instructions in [Access Keys](/docs/manage/security/access-keys). Identify which deployment your Sumo Logic account is in, using this [link](/docs/api/getting-started#sumo-logic-endpoints-by-deployment-and-firewall-security) -2. **[Download and install Terraform 0.13](https://www.terraform.io/downloads.html)** or later. -3. **Download the Sumo Logic Terraform package for MariaDB alerts.** The alerts package is available in the Sumo Logic GitHub [repository](https://github.com/SumoLogic/terraform-sumologic-sumo-logic-monitor/tree/main/monitor_packages/MariaDB). You can either download it through the “git clone” command or as a zip file. -4. **Alert Configuration.** After the package has been extracted, navigate to the package directory `terraform-sumologic-sumo-logic-monitor/monitor_packages/MariaDB/`. Edit the **MariaDB.auto.tfvars** file and add the Sumo Logic Access Key, Access Id, and Deployment from Step 1. - ```bash - access_id = "" - access_key = "" - environment = "" - ``` - The Terraform script installs the alerts without any scope filters, if you would like to restrict the alerts to specific clusters or environments, update the variable `mariadb_data_source`. Custom filter examples: - * For a specific cluster, your custom filter would be `db_cluster=mariadb.prod.01` - * For all clusters in an environment, your custom filter would be `environment=prod` - * For alerts applicable to all clusters that start with `mariadb-prod`, your custom filter would be `db_cluster=mariadb-prod*` - * For alerts applicable to a specific cluster within a production environment, your custom filter would be `db_cluster=mariadb-1` and `environment=prod`. This assumes you have set the optional environment tag while configuring collection. - - All monitors are disabled by default on installation. If you would like to enable all the monitors, set the parameter `monitors_disabled` to `false` in this file. - - By default, the monitors are configured in a monitor folder called “MariaDB”. If you would like to change the name of the folder, update the monitor folder name in “folder” key at `MariaDB.auto.tfvars` file. If you would like the alerts to send email or connection notifications, configure these in the file `MariaDB_notifications.auto.tfvars`. For configuration examples, refer to the next section. - -5. **Email and Connection Notification Configuration Examples**. Modify the file `MariaDB_notifications.auto.tfvars` and populate `connection_notifications` and `email_notifications` as per below examples. -```sql title="Pagerduty Connection Example" -connection_notifications = [ - { - connection_type = "PagerDuty", - connection_id = "", - payload_override = "{\"service_key\": \"your_pagerduty_api_integration_key\",\"event_type\": \"trigger\",\"description\": \"Alert: Triggered {{TriggerType}} for Monitor {{Name}}\",\"client\": \"Sumo Logic\",\"client_url\": \"{{QueryUrl}}\"}", - run_for_trigger_types = ["Critical", "ResolvedCritical"] - }, - { - connection_type = "Webhook", - connection_id = "", - payload_override = "", - run_for_trigger_types = ["Critical", "ResolvedCritical"] - } - ] -``` - -Replace `` with the connection id of the webhook connection. The webhook connection id can be retrieved by calling the [Monitors API](https://api.sumologic.com/docs/#operation/listConnections). - -For overriding payload for different connection types, refer to this [document](/docs/alerts/webhook-connections/set-up-webhook-connections). - -```sql title="Email Notifications Example" -email_notifications = [ - { - connection_type = "Email", - recipients = ["abc@example.com"], - subject = "Monitor Alert: {{TriggerType}} on {{Name}}", - time_zone = "PST", - message_body = "Triggered {{TriggerType}} Alert on {{Name}}: {{QueryURL}}", - run_for_trigger_types = ["Critical", "ResolvedCritical"] - } - ] -``` - -6. **Install the Alerts**. Navigate to the package directory terraform-sumologic-sumo-logic-monitor/monitor_packages/**MariaDB** and run `terraform init`. This will initialize Terraform and will download the required components. - 1. Run `terraform plan` to view the monitors which will be created/modified by Terraform. - 2. Run `terraform apply`. -7. **Post Installation**. If you haven’t enabled alerts and/or configured notifications through the Terraform procedure outlined above, we highly recommend enabling alerts of interest and configuring each enabled alert to send notifications to other users or services. This is detailed in Step 4 of [this document](/docs/alerts/monitors/create-monitor). - ## Installing the MariaDB app This section demonstrates how to install the MariaDB app. To install the app: -Locate and install the app you need from the **App Catalog**. If you want to see a preview of the dashboards included with the app before installing, click **Preview Dashboards**. +import AppInstall2 from '../../reuse/apps/app-install-only-k8s.md'; -1. From the **App Catalog**, search for and select the app. -2. Select the version of the service you're using and click **Add to Library**. -:::note -Version selection is not available for all apps. -::: -3. To install the app, complete the following fields. - 1. **App Name.** You can retain the existing name, or enter a name of your choice for the app. - 2. **Data Source.** - * Choose **Enter a Custom Data Filter**, and enter a custom MariaDB cluster filter. Examples; - 1. For all MariaDB clusters, `db_cluster=*`. - 2. For a specific cluster, `db_cluster=mariadb.dev.01`. - 3. Clusters within a specific environment `db_cluster=mariadb.dev.01` and `environment=prod`. This assumes you have set the optional environment tag while configuring collection. - 3. **Advanced**. Select the **Location in Library** (the default is the Personal folder in the library), or click **New Folder** to add a new folder. -4. Click **Add to Library**. + -Once an app is installed, it will appear in your **Personal** folder, or another folder that you specified. From here, you can share it with your organization. +As part of the app installation process, the following fields will be created by default: +* `component` +* `environment` +* `db_system` +* `db_cluster` +* `db_cluster_address` +* `db_cluster_port` + +Additionally, if you are using MariaDB in the Kubernetes environment, the following additional fields will be created by default during the app installation process: +* `pod_labels_component` +* `pod_labels_environment` +* `pod_labels_db_system` +* `pod_labels_db_cluster` +* `pod_labels_db_cluster_address` +* `pod_labels_db_cluster_port` -Panels will start to fill automatically. It's important to note that each panel slowly fills with data matching the time range query and received since the panel was created. Results won't immediately be available, but with a bit of time, you'll see full graphs and maps. + +For information on setting up fields, see [Fields](/docs/manage/fields). ## Viewing MariaDB Dashboards -:::tip Filter with template variables -Template variables provide dynamic dashboards that can rescope data on the fly. As you apply variables to troubleshoot through your dashboard, you view dynamic changes to the data for a quicker resolution to the root cause. You can use template variables to drill down and examine the data on a granular level. For more information, see [Filter with template variables](/docs/dashboards/filter-template-variables). -::: +import ViewDashboards from '../../reuse/apps/view-dashboards.md'; + + ### Overview @@ -646,11 +508,13 @@ Use this dashboard to: mariadb dashboards -## MariaDB Alerts +## Create monitors for MariaDB app + +import CreateMonitors from '../../reuse/apps/create-monitors.md'; -Sumo Logic has provided out-of-the-box alerts available through [Sumo Logic monitors](/docs/alerts/monitors) to help you quickly determine if the MariaDB Database are available and performing as expected. These alerts are built based on logs and metrics datasets and have preset thresholds based on industry best practices and recommendations. + -Sumo Logic provides the following out-of-the-box alerts: +### MariaDB alerts | Alert Type (Metrics/Logs) | Alert Name | Alert Description | Trigger Type (Critical / Warning) | Alert Condition | Recover Condition | |:---------------------------|:------------------------------------------------------|:----------------------------------------------------------------------------------------------------------------------------------------------------------|:-----------------------------------|:-----------------|:-------------------| diff --git a/docs/integrations/databases/memcached.md b/docs/integrations/databases/memcached.md index f2c984678f..a0010f0891 100644 --- a/docs/integrations/databases/memcached.md +++ b/docs/integrations/databases/memcached.md @@ -53,41 +53,7 @@ Jun 23 07:35:01 node03 memcached: \ Configuring log and metric collection for the Memcached app includes the following tasks. -### Step 1: Configure Fields in Sumo Logic - -Create the following Fields in Sumo Logic before configuring the collection. This ensures that your logs and metrics are tagged with relevant metadata required by the app dashboards. For information on setting up fields, see [Sumo Logic Fields](/docs/manage/fields). - - - - - -If you're using Memcached in a Kubernetes environment, create the fields: -* `pod_labels_component` -* `pod_labels_environment` -* `pod_labels_db_system` -* `pod_labels_db_cluster` - - - - -If you're using Memcached in a non-Kubernetes environment, create the fields: -* `component` -* `environment` -* `db_system` -* `db_cluster` -* `pod` - - - - - -### Step 2: Configure Logs and Metrics Collection for Memcached +### Configure Logs and Metrics Collection for Memcached ``` 4. Sumo Logic Kubernetes collection will automatically start collecting logs from the pods having the annotations defined above. -3. **Add a FER to normalize the fields in Kubernetes environments**. This step is not needed if one is using application components solution terraform script. Labels created in Kubernetes environments automatically are prefixed with pod_labels. To normalize these for our app to work, we need to create a Field Extraction Rule if not already created for Proxy Application Components. To do so: - 1. [**Classic UI**](/docs/get-started/sumo-logic-ui-classic). In the main Sumo Logic menu, select **Manage Data > Logs > Field Extraction Rules**.
[**New UI**](/docs/get-started/sumo-logic-ui). In the top menu select **Configuration**, and then under **Logs** select **Field Extraction Rules**. You can also click the **Go To...** menu at the top of the screen and select **Field Extraction Rules**. - 2. Click the + Add button on the top right of the table. - 3. The **Add Field Extraction Rule** form will appear: - 4. Enter the following options: - * **Rule Name**. Enter the name as **App Observability - Database**. - * **Applied At**. Choose **Ingest Time** - * **Scope**. Select **Specific Data** - * **Scope**: Enter the following keyword search expression: - ```sql - pod_labels_environment=* pod_labels_component=database \ - pod_labels_db_system=* pod_labels_db_cluster=* - ``` - * **Parse Expression**. Enter the following parse expression: - ```sql - if (!isEmpty(pod_labels_environment), pod_labels_environment, "") as environment - | pod_labels_component as component - | pod_labels_db_system as db_system - | if (!isEmpty(pod_labels_db_cluster), pod_labels_db_cluster, null) as db_cluster - ``` - 5. Click **Save** to create the rule. +
**FER to normalize the fields in Kubernetes environments.** Labels created in Kubernetes environments automatically are prefixed with pod_labels. To normalize these for our app to work, a Field Extraction Rule named **AppObservabilityMemcachedDatabaseFER** is automatically created for Database Application Components. +
@@ -353,107 +300,39 @@ At this point, Memcached logs should start flowing into Sumo Logic. +## Installing the Memcached app -## Installing Memcached Monitors - -Sumo Logic has provided pre-packaged alerts available through [Sumo Logic monitors](/docs/alerts/monitors) to help you proactively determine if a Memcached cluster is available and performing as expected. These monitors are based on metric and log data and include pre-set thresholds that reflect industry best practices and recommendations. For more information about individual alerts, see [Memcached Alerts](#memcached-alerts). - -To install these monitors, you must have the **Manage Monitors** role capability. - -You can install monitors by importing a JSON file or using a Terraform script. - -There are limits to how many alerts can be enabled. For more information, see [Monitors](/docs/alerts/monitors/create-monitor) for details. - - -### Method A: Importing a JSON file - -1. Download the [JSON file](https://github.com/SumoLogic/terraform-sumologic-sumo-logic-monitor/blob/main/monitor_packages/Memcached/Memcached.json) that describes the monitors. -2. The [JSON](https://github.com/SumoLogic/terraform-sumologic-sumo-logic-monitor/blob/main/monitor_packages/Memcached/Memcached.json) contains alerts from Sumo Logic searches that do not have any scope filters and, therefore, will apply to all Memcached clusters, the data for which has been collected via the instructions in the previous sections. However, if you would like to restrict these alerts to specific clusters or environments, update the JSON file by replacing the `text db_cluster=* `with ``. Custom filter examples: - * For alerts applicable only to a specific cluster, your custom filter would be: `db_cluster=dev-memcached-01` - * For alerts applicable to all clusters that start with `memcached-prod`, your custom filter would be: `db_cluster=memcachedt-prod*` - * For alerts applicable to specific clusters within a production environment, your custom filter would be: `db_cluster=dev-memcached-01` AND `environment=prod`. This assumes you have set the optional environment tag while configuring collection. -3. [**Classic UI**](/docs/get-started/sumo-logic-ui-classic). In the main Sumo Logic menu, select **Manage Data > Monitoring > Monitors**.
[**New UI**](/docs/get-started/sumo-logic-ui). In the main Sumo Logic menu, select **Alerts > Monitors**. You can also click the **Go To...** menu at the top of the screen and select **Monitors**. -4. Click **Add**. -4. Click **Import**. -6. On the **Import Content popup**, enter **Memcached** in the Name field, paste the JSON into the popup, and click **Import**. -7. The monitors are created in "Memcached" folder. The monitors are disabled by default. See the [Monitors](/docs/alerts/monitors) topic for information about enabling monitors and configuring notifications or connections. - - -### Method B: Using a Terraform script - -1. Generate a Sumo Logic access key and ID for a user that has the **Manage Monitors** role capability. For instructions, see [Access Keys](/docs/manage/security/access-keys). -2. Download [Terraform 0.13](https://www.terraform.io/downloads.html) or later, and install. -3. Download the Sumo Logic Terraform package for Memcached monitors. The alerts package is available in the Sumo Logic GitHub [repository](https://github.com/SumoLogic/terraform-sumologic-sumo-logic-monitor/tree/main/monitor_packages/Memcached). You can either download it using the git clone command or as a zip file. -4. Alert Configuration. After extracting the package, navigate to the `terraform-sumologic-sumo-logic-monitor/monitor_packages/Memcached/` directory. -5. Edit the `Memcached.auto.tfvars` file and add the Sumo Logic Access Key and Access ID from Step 1 and your Sumo Logic deployment. If you're not sure of your deployment, see [Sumo Logic Endpoints and Firewall Security](/docs/api/getting-started#sumo-logic-endpoints-by-deployment-and-firewall-security). - ```bash - access_id = "" - access_key = "" - environment = "" - ``` -6. The Terraform script installs the alerts without any scope filters. If you would like to restrict the alerts to specific clusters or environments, update the `memcached_data_source` variable. For example: - * To configure alerts for a specific clusters, set `memcached_data_source` to something like: `db_cluster=memcached.prod.01` - * To configure alerts for All clusters in an environment, set `memcached_data_source` to something like: `environment=prod` - * To configure alerts for Multiple clusters using a wildcard, set `memcached_data_source` to something like: `db_cluster=memcached-prod*` - * To configure alerts for specific clusters within a specific environment, set `memcached_data_source` to something like: `db_cluster=memcached-1 and environment=prod`. This assumes you have configured and applied Fields as described in Step 1: Configure Fields of the Sumo Logic of the Collect Logs and Metrics for Memcached topic. - - All monitors are disabled by default on installation. To enable all of the monitors, set the `monitors_disabled` parameter to `false`. - - By default, the monitors will be located in a "Memcached" folder on the **Monitors** page. To change the name of the folder, update the monitor folder name in the folder variable in the `Memcached.auto.tfvars` file. - -7. If you want the alerts to send email or connection notifications, edit the `Memcached_notifications.auto.tfvars` file to populate the `connection_notifications` and `email_notifications` sections. Examples are provided below. - * In the variable definition below, replace `` with the connection ID of the Webhook connection. You can obtain the Webhook connection ID by calling the [Monitors API](https://api.sumologic.com/docs/#operation/listConnections). - -```bash title="Pagerduty connection example" -connection_notifications = [ - { - connection_type = "PagerDuty", - connection_id = "", - payload_override = "{\"service_key\": \"your_pagerduty_api_integration_key\",\"event_type\": \"trigger\",\"description\": \"Alert: Triggered {{TriggerType}} for Monitor {{Name}}\",\"client\": \"Sumo Logic\",\"client_url\": \"{{QueryUrl}}\"}", - run_for_trigger_types = ["Critical", "ResolvedCritical"] - }, - { - connection_type = "Webhook", - connection_id = "", - payload_override = "", - run_for_trigger_types = ["Critical", "ResolvedCritical"] - } - ] -``` -For information about overriding the payload for different connection types, see [Set Up Webhook Connections](/docs/alerts/webhook-connections/set-up-webhook-connections). - -```bash title="Email notifications example" -email_notifications = [ - { - connection_type = "Email", - recipients = ["abc@example.com"], - subject = "Monitor Alert: {{TriggerType}} on {{Name}}", - time_zone = "PST", - message_body = "Triggered {{TriggerType}} Alert on {{Name}}: {{QueryURL}}", - run_for_trigger_types = ["Critical", "ResolvedCritical"] - } - ] -``` +This section demonstrates how to install the Memcached app. -7. Install Monitors. - 1. Navigate to the terraform-sumologic-sumo-logic-monitor/monitor_packages/Memcached/ directory and run `terraform init`. This will initialize Terraform and download the required components. - 2. Run `terraform plan` to view the monitors that Terraform will create or modify. - 3. Run `terraform apply`. +import AppInstall2 from '../../reuse/apps/app-install-only-k8s.md'; + -## Installing the Memcached app +As part of the app installation process, the following fields will be created by default: +* `component` +* `environment` +* `db_system` +* `db_cluster` +* `pod` +* `db_cluster_address` +* `db_cluster_port` -This section demonstrates how to install the Memcached app. +Additionally, if you're using Memcached in the Kubernetes environment, the following additional fields will be created by default during the app installation process: +* `pod_labels_component` +* `pod_labels_environment` +* `pod_labels_db_system` +* `pod_labels_db_cluster` +* `pod_labels_db_cluster_address` +* `pod_labels_db_cluster_port` -import AppInstall from '../../reuse/apps/app-install.md'; - +For information on setting up fields, see [Fields](/docs/manage/fields). ## Viewing Memcached Dashboards -:::tip Filter with template variables -Template variables provide dynamic dashboards that can rescope data on the fly. As you apply variables to troubleshoot through your dashboard, you view dynamic changes to the data for a quicker resolution to the root cause. You can use template variables to drill down and examine the data on a granular level. For more information, see [Filter with template variables](/docs/dashboards/filter-template-variables.md). -::: +import ViewDashboards from '../../reuse/apps/view-dashboards.md'; + + ### Overview @@ -485,10 +364,13 @@ The **Memcached - Logs** dashboard helps you quickly analyze your Memcached erro Memcached dashboards -## Memcached Alerts +## Create monitors for Memcached app + +import CreateMonitors from '../../reuse/apps/create-monitors.md'; -Sumo Logic has provided out-of-the-box alerts available via [Sumo Logic monitors](/docs/alerts/monitors) to help you quickly determine if the Memcached database cluster is available and performing as expected. + +### Memcached alerts
diff --git a/docs/integrations/databases/mongodb.md b/docs/integrations/databases/mongodb.md index 233b3da29d..5c9b666951 100644 --- a/docs/integrations/databases/mongodb.md +++ b/docs/integrations/databases/mongodb.md @@ -71,42 +71,7 @@ environment=* db_cluster=* db_system=mongodb | json "log" as _rawlog nodrop This section provides instructions for configuring log and metric collection for the Sumo Logic app for MongoDB. -### Step 1: Configure Fields in Sumo Logic - -Create the following Fields in Sumo Logic prior to configuring collection. This ensures that your logs and metrics are tagged with relevant metadata, which is required by the app dashboards. For information on setting up fields, see [Sumo Logic Fields](/docs/manage/fields). - - - - - -If you're using MongoDB in a Kubernetes environment, create the fields: - -* `pod_labels_component` -* `pod_labels_environment` -* `pod_labels_db_system` -* `pod_labels_db_cluster` - - - - -If you're using MongoDB in a non-Kubernetes environment, create the fields: - -* `component` -* `environment` -* `db_system` -* `db_cluster` - - - - - -### Step 2: Configure Collection for MongoDB +### Configure Collection for MongoDB ``` 5. Sumo Logic Kubernetes collection will automatically start collecting logs from the pods having the annotations defined above. -3. **Add an FER to normalize the fields in Kubernetes environments**. This step is not needed if one is using application components solution terraform script. Labels created in Kubernetes environments automatically are prefixed with `pod_labels`. To normalize these for our app to work, we need to create a Field Extraction Rule if not already created for Database Application Components. To do so: - 1. [**Classic UI**](/docs/get-started/sumo-logic-ui-classic). In the main Sumo Logic menu, select **Manage Data > Logs > Field Extraction Rules**.
[**New UI**](/docs/get-started/sumo-logic-ui). In the top menu select **Configuration**, and then under **Logs** select **Field Extraction Rules**. You can also click the **Go To...** menu at the top of the screen and select **Field Extraction Rules**. - 2. Click the + Add button on the top right of the table. - 3. The **Add Field Extraction Rule** form will appear: - 4. Enter the following options: - * **Rule Name**. Enter the name as **App Observability - Database**. - * **Applied At**. Choose **Ingest Time** - * **Scope**. Select **Specific Data** - * **Scope**: Enter the following keyword search expression: - ```sql - pod_labels_environment=* pod_labels_component=database \ - pod_labels_db_system=* pod_labels_db_cluster=* - ``` - * **Parse Expression**.Enter the following parse expression: - ```sql - | if (!isEmpty(pod_labels_environment), pod_labels_environment, "") as environment - | pod_labels_component as component - | pod_labels_db_system as db_system - | pod_labels_db_cluster as db_cluster - ``` -4. Click **Save** to create the rule. + +
**FER to normalize the fields in Kubernetes environments.** Labels created in Kubernetes environments automatically are prefixed with pod_labels. To normalize these for our app to work, a Field Extraction Rule named **AppObservabilityMongoDBDatabaseFER** is automatically created for Database Application Components. +
@@ -410,99 +357,35 @@ At this point, MongoDB logs should start flowing into Sumo Logic. - -## Installing MongoDB Monitors - -The next few sections have instructions for installing Sumo Logic Monitors for MongoDB, the app, and descriptions of each of the app dashboards. These instructions assume you have already set up collection as described in the [Collecting Logs and Metrics for MongoDB](#collecting-logs-and-metrics-for-mongodb). - -Sumo Logic has provided pre-packaged alerts available through [Sumo Logic monitors](/docs/alerts/monitors) to help you proactively determine if a MongoDB cluster is available and performing as expected. These monitors are based on metric and log data and include pre-set thresholds that reflect industry best practices and recommendations. For more information about individual alerts, see [MongoDB Alerts](#mongodb-alerts). - -To install these monitors, you must have the **Manage Monitors** role capability. - -You can install monitors by importing a JSON file or using a Terraform script. - -There are limits to how many alerts can be enabled. For more information, see [Monitors](/docs/alerts/monitors/overview/#rules) for details. - -### Method A: Importing a JSON file - -1. Download the [JSON file](https://github.com/SumoLogic/terraform-sumologic-sumo-logic-monitor/blob/main/monitor_packages/MongoDB/MongoDB.json) that describes the monitors. -2. Replace `$$mongodb_data_source` with a custom source filter. To configure alerts for a specific database cluster, use a filter like `db_system=mongodb` or `db_cluster=dev-mongodb`. To configure the alerts for all of your clusters, set `$$mongodb_data_source` to blank (`""`). -3. [**Classic UI**](/docs/get-started/sumo-logic-ui-classic). In the main Sumo Logic menu, select **Manage Data > Monitoring > Monitors**.
[**New UI**](/docs/get-started/sumo-logic-ui). In the main Sumo Logic menu, select **Alerts > Monitors**. You can also click the **Go To...** menu at the top of the screen and select **Monitors**. -4. Click **Add**. -5. Click **Import**. -6. On the **Import Content popup**, enter `MongoDB` in the Name field, paste in the JSON into the the popup, and click **Import**. -7. The monitors are created in a "MongoDB" folder. The monitors are disabled by default. See the [Monitors](/docs/alerts/monitors) topic for information about enabling monitors and configuring notifications or connections. - -### Method B: Using a Terraform script - -1. Generate a Sumo Logic access key and ID for a user that has the **Manage Monitors** role capability. For instructions, see [Access Keys](/docs/manage/security/access-keys). -2. Download [Terraform 0.13](https://www.terraform.io/downloads.html) or later, and install it. -3. Download the Sumo Logic Terraform package for MongoDB monitors. The alerts package is available in the Sumo Logic GitHub [repository](https://github.com/SumoLogic/terraform-sumologic-sumo-logic-monitor/tree/main/monitor_packages/MongoDB). You can either download it using the `git clone` command or as a zip file. -4. Alert Configuration. After extracting the package , navigate to the `terraform-sumologic-sumo-logic-monitor/monitor_packages/MongoDB/` directory. Edit the `MongoDB.auto.tfvars` file and add the Sumo Logic Access Key and Access ID from Step 1 and your Sumo Logic deployment. If you're not sure of your deployment, see [Sumo Logic Endpoints and Firewall Security](/docs/api/getting-started#sumo-logic-endpoints-by-deployment-and-firewall-security). - ```bash - access_id = "" - access_key = "" - environment = "" - ``` - - The Terraform script installs the alerts without any scope filters, if you would like to restrict the alerts to specific clusters or environments, update the `mongodb_data_source` variable. For example: - * To configure alerts for A specific cluster set `mongodb_data_source` to something like `db_cluster = mongodb.prod.01` - * To configure alerts for All clusters in an environment set `mongodb_data_source` to something like `environment = prod` - * To configure alerts for Multiple clusters using a wildcard set `mongodb_data_source` to something like `db_cluster = mongodb-prod*` - * To configure alerts for A specific cluster within a specific environment, set `mongodb_data_source` to something like `db_cluster = mongodb-1` and `environment = prod`. This assumes you have configured and applied Fields as described in [Step 1: Configure Sumo Logic Fields](#step-1-configure-fields-in-sumo-logic). - - All monitors are disabled by default on installation. To enable all of the monitors, set the `monitors_disabled` parameter to `false`. By default, the monitors will be located in a "MongoDB" folder on the **Monitors** page. To change the name of the folder, update the monitor folder name in the `folder` variable in the `MongoDB.auto.tfvars` file. - -5. If you want the alerts to send email or connection notifications, edit the `MongoDB_notifications.auto.tfvars` file to populate the `connection_notifications` and `email_notifications` sections. Examples are provided below. In the variable definition below, replace `` with the connection ID of the Webhook connection. You can obtain the Webhook connection ID by calling the [Monitors API](https://api.sumologic.com/docs/#operation/listConnections). -```bash title="Pagerduty connection example" -connection_notifications = [ - { - connection_type = "PagerDuty", - connection_id = "", - payload_override = "{\"service_key\": \"your_pagerduty_api_integration_key\",\"event_type\": \"trigger\",\"description\": \"Alert: Triggered {{TriggerType}} for Monitor {{Name}}\",\"client\": \"Sumo Logic\",\"client_url\": \"{{QueryUrl}}\"}", - run_for_trigger_types = ["Critical", "ResolvedCritical"] - }, - { - connection_type = "Webhook", - connection_id = "", - payload_override = "", - run_for_trigger_types = ["Critical", "ResolvedCritical"] - } - ] -``` - -For information about overriding the payload for different connection types, see [Set Up Webhook Connections](/docs/alerts/webhook-connections/set-up-webhook-connections). - -```bash title="Email notifications example" -email_notifications = [ - { - connection_type = "Email", - recipients = ["abc@example.com"], - subject = "Monitor Alert: {{TriggerType}} on {{Name}}", - time_zone = "PST", - message_body = "Triggered {{TriggerType}} Alert on {{Name}}: {{QueryURL}}", - run_for_trigger_types = ["Critical", "ResolvedCritical"] - } - ] -``` - -6. Install Monitors - 1. Navigate to the `terraform-sumologic-sumo-logic-monitor/monitor_packages/MongoDB/` directory and run `terraform init`. This will initialize Terraform and download the required components. - 2. Run `terraform plan` to view the monitors that Terraform will create or modify. - 3. Run `terraform apply`. - - ## Installing the MongoDB app -Now that you have set up collection for MongoDB, install the Sumo Logic app for MongoDB to use the preconfigured searches and dashboards to analyze your data. - import AppInstall from '../../reuse/apps/app-install.md'; +As part of the app installation process, the following fields will be created by default: +* `component` +* `environment` +* `db_system` +* `db_cluster` +* `db_cluster_address` +* `db_cluster_port` + +Additionally, if you're using MongoDB in the Kubernetes environment, the following additional fields will be created by default during the app installation process: +* `pod_labels_component` +* `pod_labels_environment` +* `pod_labels_db_system` +* `pod_labels_db_cluster` +* `pod_labels_db_cluster_address` +* `pod_labels_db_cluster_port` + +For information on setting up fields, see [Fields](/docs/manage/fields). + ## Viewing MongoDB Dashboards -If no events have occurred within the time range of the Panel, the Panel will be empty. +import ViewDashboards from '../../reuse/apps/view-dashboards.md'; + + ### Overview @@ -576,9 +459,13 @@ Use this dashboard to: MongoDB dashboards -## MongoDB Alerts +## Create monitors for MongoDB app + +import CreateMonitors from '../../reuse/apps/create-monitors.md'; + + -Sumo Logic provides out-of-the-box alerts available via [Sumo Logic monitors](/docs/alerts/monitors). These alerts are built based on logs and metrics datasets and have preset thresholds based on industry best practices and recommendations. +### MongoDB alerts | Name | Description | Trigger Type | Alert Conditions | Recover Conditions | |:----------------------------------------------|:-----------------------------------------------------------------------------------------------------------------------------------------------------------|:--------------|:------------------|:--------------------| diff --git a/docs/integrations/databases/mysql.md b/docs/integrations/databases/mysql.md index 9be203eb30..0ea22ccb45 100644 --- a/docs/integrations/databases/mysql.md +++ b/docs/integrations/databases/mysql.md @@ -140,45 +140,7 @@ db_system=mysql db_cluster={{db_cluster}} "User@Host" "Query_time" Configuring log and metric collection for the MySQL app includes the following tasks. -### Step 1: Configure Fields in Sumo Logic - -Create the following Fields in Sumo Logic prior to configuring the collection. This ensures that your logs and metrics are tagged with relevant metadata, which is required by the app dashboards. For information on setting up fields, see [Sumo Logic Fields](/docs/manage/fields). - - - - - -If you're using MySQL in a Kubernetes environment, create the fields: - -* `pod_labels_component` -* `pod_labels_environment` -* `pod_labels_db_system` -* `pod_labels_db_cluster` -* `pod_labels_db_cluster_address` -* `pod_labels_db_cluster_port` - - - - -If you're using MySQL in a non-Kubernetes environment, create the fields: - -* `component` -* `environment` -* `db_system` -* `db_cluster` -* `db_cluster_address` -* `db_cluster_port` - - - - -### Step 2: Configure MySQL Logs and Metrics Collection +### Configure MySQL Logs and Metrics Collection -2. **Add an FER to normalize the fields in Kubernetes environments**. This step is not needed if using application components solution terraform script. Labels created in Kubernetes environments are automatically prefixed with pod_labels. To normalize these for our app to work, we'll create a [Field Extraction Rule](/docs/manage/field-extractions/create-field-extraction-rule), Database Application Components, assuming it does not already exist: - 1. [**Classic UI**](/docs/get-started/sumo-logic-ui-classic). In the main Sumo Logic menu, select **Manage Data > Logs > Field Extraction Rules**.
[**New UI**](/docs/get-started/sumo-logic-ui). In the top menu select **Configuration**, and then under **Logs** select **Field Extraction Rules**. You can also click the **Go To...** menu at the top of the screen and select **Field Extraction Rules**. - 2. Click the **+ Add**. - 3. The **Add Field Extraction** pane appears. - 4. **Rule Name.** Enter "App Observability - Database". - 5. **Applied At**. Choose "Ingest Time". - 6. **Scope**. Select "Specific Data". - * **Scope**. Enter the following keyword search expression: - ```sql - pod_labels_environment=* pod_labels_component=database pod_labels_db_system=* pod_labels_db_cluster=* - ``` - * **Parse Expression**. Enter the following parse expression: - ```sql - | if (!isEmpty(pod_labels_environment), pod_labels_environment, "") as environment - | pod_labels_component as component - | pod_labels_db_system as db_system - | if (!isEmpty(pod_labels_db_cluster), pod_labels_db_cluster, null) as db_cluster - ``` - 7. Click **Save** to create the rule. - 8. To verify that logs are flowing into Sumo Logic, run this query: - ```sql - component=database db_system=mysql db_cluster= - ``` +
**FER to normalize the fields in Kubernetes environments.** Labels created in Kubernetes environments automatically are prefixed with pod_labels. To normalize these for our app to work, a Field Extraction Rule named **AppObservabilityMySQLDatabaseFER** is automatically created for Database Application Components. +
@@ -558,104 +499,36 @@ At this point, MySQL slow query logs should start flowing into Sumo Logic. -## Installing MySQL Monitors - -The next few sections provide instructions for installing Sumo Logic Monitors for MySQL, the app and descriptions of each of the app dashboards. These instructions assume you have already set up collection as described in Collecting MySQL Logs and Metrics. - -Sumo Logic has provided pre-packaged alerts available through [Sumo Logic monitors](/docs/alerts/monitors) to help you proactively determine if a MySQL cluster is available and performing as expected. These monitors are based on metric and log data and include pre-set thresholds that reflect industry best practices and recommendations. For more information about individual alerts, see [MySQL Alerts](#mysql-alerts). - -To install these monitors, you must have the **Manage Monitors** role capability. - -You can install monitors by importing a JSON file or using a Terraform script. - -There are limits to how many alerts can be enabled. For more information, see [Monitors](/docs/alerts/monitors/create-monitor) for details. - -### Method A: Install Monitors by importing a JSON file - -1. Download the [JSON file](https://github.com/SumoLogic/terraform-sumologic-sumo-logic-monitor/blob/main/monitor_packages/mysql/mysql.json) that describes the monitors. -2. Replace `$$mysql_data_source` with a custom source filter. To configure alerts for a specific database cluster, use a filter like `db_system=mysql` or `db_cluster=dev-mysql`. To configure the alerts for all of your clusters, set `$$mysql_data_source` to blank (`""`). -3. [**Classic UI**](/docs/get-started/sumo-logic-ui-classic). In the main Sumo Logic menu, select **Manage Data > Monitoring > Monitors**.
[**New UI**](/docs/get-started/sumo-logic-ui). In the main Sumo Logic menu, select **Alerts > Monitors**. You can also click the **Go To...** menu at the top of the screen and select **Monitors**. -4. Click **Add**. -5. Click **Import.** -6. On the **Import Content popup**, enter "MySQL" in the Name field, paste in the JSON into the the popup, and click **Import**. -7. The monitors are created in a "MySQL" folder. The monitors are disabled by default. See the [Monitors](/docs/alerts/monitors) topic for information about enabling monitors and configuring notifications or connections. - - -### Method B: Using a Terraform script - -1. Generate an access key and access ID for a user that has the **Manage Monitors** role capability. For instructions, see [Access Keys](/docs/manage/security/access-keys). -2. Download [Terraform 0.13](https://www.terraform.io/downloads.html) or later, and install it. -3. Download the Sumo Logic Terraform package for MySQL monitors. The alerts package is available in the Sumo Logic GitHub [repository](https://github.com/SumoLogic/terraform-sumologic-sumo-logic-monitor/tree/main/monitor_packages/mysql). You can either download it using the `git clone` command or as a zip file. -4. Alert Configuration: After extracting the package, navigate to the `terraform-sumologic-sumo-logic-monitor/monitor_packages/mysql/` directory. - 1. Edit the `mysql.auto.tfvars` file and add the Sumo Logic Access Key and Access ID from Step 1 and your Sumo Logic deployment. If you're not sure of your deployment, see [Sumo Logic Endpoints and Firewall Security](/docs/api/getting-started#sumo-logic-endpoints-by-deployment-and-firewall-security). - ```sql - access_id = "" - access_key = "" - environment = "" - ``` - 2. The Terraform script installs the alerts without any scope filters. If you would like to restrict the alerts to specific clusters or environments, update the `mysql_data_source` variable. For example: - * To configure alerts for a specific cluster, set `mysql_data_source` to something like `db_cluster=mysql.prod.01` - * To configure alerts for all clusters in an environment Set mysql_data_source to something like `environment=prod` - * To configure alerts for...Multiple clusters using a wildcard, set `mysql_data_source` to something like `db_cluster=mysql-prod*` - * To configure alerts for a specific cluster within a specific environment, set `mysql_data_source` to something like `db_cluster=mysql-1` and `environment=prod`. This assumes you have configured and applied Fields as described in Step 1: Configure Fields of the Sumo Logic of the Collect Logs and Metrics for MySQL topic. - - All monitors are disabled by default on installation. To enable all of the monitors, set the `monitors_disabled` parameter to `false`. By default, the monitors will be located in a "MySQL" folder on the **Monitors** page. To change the name of the folder, update the monitor folder name in the `folder` variable in the `mysql.auto.tfvars` file. - -5. If you want the alerts to send email or connection notifications, edit the `mysql_notifications.auto.tfvars` file to populate the `connection_notifications` and `email_notifications` sections. Examples are provided below. - -In the variable definition below, replace `` with the connection ID of the Webhook connection. You can obtain the Webhook connection ID by calling the [Monitors API](https://api.sumologic.com/docs/#operation/listConnections). - -```sql title="Pagerduty connection example" -connection_notifications = [ - { - connection_type = "PagerDuty", - connection_id = "", - payload_override = "{\"service_key\": \"your_pagerduty_api_integration_key\",\"event_type\": \"trigger\",\"description\": \"Alert: Triggered {{TriggerType}} for Monitor {{Name}}\",\"client\": \"Sumo Logic\",\"client_url\": \"{{QueryUrl}}\"}", - run_for_trigger_types = ["Critical", "ResolvedCritical"] - }, - { - connection_type = "Webhook", - connection_id = "", - payload_override = "", - run_for_trigger_types = ["Critical", "ResolvedCritical"] - } - ] -``` - -For information about overriding the payload for different connection types, see [Set Up Webhook Connections](/docs/alerts/webhook-connections/set-up-webhook-connections). - -```sql title="Email notifications example" -email_notifications = [ - { - connection_type = "Email", - recipients = ["abc@example.com"], - subject = "Monitor Alert: {{TriggerType}} on {{Name}}", - time_zone = "PST", - message_body = "Triggered {{TriggerType}} Alert on {{Name}}: {{QueryURL}}", - run_for_trigger_types = ["Critical", "ResolvedCritical"] - } - ] -``` +## Installing the MySQL app -6. Install Monitors. - 1. Navigate to the `terraform-sumologic-sumo-logic-monitor/monitor_packages/mysql/` directory and run `terraform init`. This will initialize Terraform and download the required components. - 2. Run `terraform plan` to view the monitors that Terraform will create or modify. - 3. Run `terraform apply`. +import AppInstall2 from '../../reuse/apps/app-install-only-k8s.md'; -## Installing the MySQL app + -Now that you have set up collection for MySQL, install the Sumo Logic app for MySQL to use the preconfigured searches and dashboards that provide insight into your data. +As part of the app installation process, the following fields will be created by default: +* `component` +* `environment` +* `db_system` +* `db_cluster` +* `db_cluster_address` +* `db_cluster_port` -import AppInstall from '../../reuse/apps/app-install.md'; +Additionally, if you are using MySQL in the Kubernetes environment, the following additional fields will be created by default during the app installation process: +* `pod_labels_component` +* `pod_labels_environment` +* `pod_labels_db_system` +* `pod_labels_db_cluster` +* `pod_labels_db_cluster_address` +* `pod_labels_db_cluster_port` - +For information on setting up fields, see [Fields](/docs/manage/fields). ## Viewing MySQL dashboards -:::tip Filter with template variables -Template variables provide dynamic dashboards that can rescope data on the fly. As you apply variables to troubleshoot through your dashboard, you view dynamic changes to the data for a quicker resolution to the root cause. You can use template variables to drill down and examine the data on a granular level. For more information, see [Filter with template variables](/docs/dashboards/filter-template-variables.md). -::: +import ViewDashboards from '../../reuse/apps/view-dashboards.md'; + + ### Overview @@ -736,9 +609,14 @@ Use this dashboard to: MySQL dashboard -## MySQL Alerts +## Create monitors for MySQL app + +import CreateMonitors from '../../reuse/apps/create-monitors.md'; + + + -This section describes the monitors provided with the MySQL app. These monitors are built based on logs and metrics datasets and have preset thresholds based on industry best practices and recommendations. +### MySQL alerts | Monitor name | Monitor description | Alert Condition | Recovery Condition | |:------------|:-----------------------------|:----------------|:-------------------| diff --git a/docs/integrations/databases/oracle.md b/docs/integrations/databases/oracle.md index ee930d0487..c46193a429 100644 --- a/docs/integrations/databases/oracle.md +++ b/docs/integrations/databases/oracle.md @@ -26,51 +26,7 @@ This app is tested with the following Oracle versions: This section provides instructions for configuring logs and metrics collection for the Sumo Logic app for the Oracle. -### Step 1: Configure Fields in Sumo Logic - -Create the following Fields in Sumo Logic prior to configuring the collection. This ensures that your logs and metrics are tagged with relevant metadata, which is required by the app dashboards. For information on setting up fields, see [Sumo Logic Fields](/docs/manage/fields). - -:::note -This step is not needed if you are using the application components solution terraform script. -::: - - - - - -If you're using Oracle in a Kubernetes environment, create the fields: - -* `pod_labels_component` -* `pod_labels_environment` -* `pod_labels_db_system` -* `pod_labels_db_cluster` -* `pod_labels_db_cluster_address` -* `pod_labels_db_cluster_port` - - - - - -If you're using Oracle in a non-Kubernetes environment, create the fields: - -* `component` -* `environment` -* `db_system` -* `db_cluster` -* `db_cluster_address` -* `db_cluster_port` - - - - - -### Step 2: Configure Oracle Logs and Metrics Collection +### Configure Oracle Logs and Metrics Collection Sumo Logic supports the collection of logs and metrics data from Oracle in both Kubernetes and non-Kubernetes environments. @@ -252,27 +208,8 @@ annotations: 2. The Sumo Logic Kubernetes collection will automatically start collecting logs from the pods having the annotations defined above. 3. Verify logs in Sumo Logic. -**Add an FER to normalize the fields in Kubernetes environments** - -This step is not needed if you're using application components solution terraform script. Labels created in Kubernetes environments automatically are prefixed with pod_labels. To normalize these for our app to work, we need to create a Field Extraction Rule if not already created for Proxy Application Components. To do so: -1. [**Classic UI**](/docs/get-started/sumo-logic-ui-classic). In the main Sumo Logic menu, select **Manage Data > Logs > Field Extraction Rules**.
[**New UI**](/docs/get-started/sumo-logic-ui). In the top menu select **Configuration**, and then under **Logs** select **Field Extraction Rules**. You can also click the **Go To...** menu at the top of the screen and select **Field Extraction Rules**. -1. Click the **+Add** button on the top right of the table. -1. The **Add Field Extraction Rule** form will appear. Enter the following options: - 1. **Rule Name**. Enter the name as **App Observability - database**. - 2. **Applied At**. Choose **Ingest Time**. - 3. **Scope**. Select **Specific Data**. - 4. **Scope**: Enter the following keyword search expression. - ```sql - pod_labels_environment=* pod_labels_component=database pod_labels_db_cluster=* pod_labels_db_system=* - ``` - 5. **Parse Expression**. Enter the following parse expression. - ```sql - if (!isEmpty(pod_labels_environment), pod_labels_environment, "") as environment - | pod_labels_component as component - | pod_labels_db_system as db_system - | if(!isEmpty(pod_labels_db_cluster), pod_labels_db_cluster, null) as db_cluster - ``` -1. Click **Save** to create the rule. +
**FER to normalize the fields in Kubernetes environments.** Labels created in Kubernetes environments automatically are prefixed with pod_labels. To normalize these for our app to work, a Field Extraction Rule named **AppObservabilityOracleDatabaseFER** is automatically created for Database Application Components. +
@@ -445,121 +382,6 @@ At this point, Telegraf should start collecting the Oracle metrics and forward t -## Oracle Alerts - -Sumo Logic has provided out-of-the-box alerts available through [Sumo Logic monitors](/docs/alerts/monitors) to help you quickly determine if the Oracle databases are available and performing as expected. These alerts are built, based on logs and metrics datasets, have preset thresholds based on industry best practices and recommendations. - -| Alert Type (Metrics/Logs) | Alert Name | Alert Description | Trigger Type (Critical / Warning) | Alert Condition | Recover Condition | -|:------------------|:-------------|:----------------|:-----------------|:-----------------|:-------------------| -| Logs | Oracle - Admin Restricted Command Execution | This alert fires when the Listener is unable to resolve a command. | Warning | > 0 | `<=` 0 | -| Logs | Oracle - Archival Log Creation | This alert fires when there is an archive log creation error. | Warning | > 0 | `<=` 0 | -| Logs | Oracle - Block Corruption | This alert fires when we detect corrupted data blocks. | Warning | > 0 | `<=` 0 | -| Logs | Oracle - Database Crash | This alert fires when the database crashes. | Critical | >0 | `<=` 0 | -| Logs | Oracle - Deadlock | This alert fires when deadlocks are detected. | Warning | >5 | `<=` 0 | -| Logs | Oracle - Fatal NI Connect Error | This alert fires when we detect a "Fatal NI connect error". | Warning | >0 | `<=` 0 | -| Logs | Oracle - Internal Errors | This alert fires when internal errors are detected. | Warning | >0 | `<=` 0 | -| Logs | Oracle - Login Fail | This alert fires when we detect that a user cannot login. | Warning | >0 | `<=` 0 | -| Logs | Oracle - Possible Inappropriate Activity | This alert fires when we detect possible inappropriate activity. | Warning | >0 | `<=` 0 | -| Logs | Oracle - TNS Error | This alert fires when we detect TNS operations errors. | Critical | >0 | `<=` 0 | -| Logs | Oracle - Unable To Extend Tablespace | This alert fires when we detect that we are unable to extend tablespaces. | Warning | >0 | `<=` 0 | -| Logs | Oracle - Unauthorized Command Execution | This alert fires when we detect that a user is not authorized to execute a requested listener command in an Oracle instance. | Warning | >0 | `<=` 0 | -| Metrics | Oracle - Database Down | This alert fires when we detect that the Oracle database is down. | Critical | >0 | `<=` 0 | -| Metrics | Oracle - High CPU Usage | This alert fires when CPU usage on a node in an Oracle cluster is high. | Critical | >=80 | < 80 | -| Metrics | Oracle - Process Limit Critical | This alert fires when process CPU utilization is over 90% | Critical | >=90 | < 90 | -| Metrics | Oracle - Process Limit Warning | This alert fires when processes CPU utilization is over 80% | Warning | >=80 | < 80 | -| Metrics | Oracle - Session Critical | This alert fires when session usage is over 97% | Critical | >=97 | < 97 | -| Metrics | Oracle - Session Warning | This alert fires when session usage is over 90% | Warning | >=90 | < 90 | -| Metrics | Oracle - Tablespaces Out of Space | This alert fires when tablespace disk usage is over 90% | Critical | >=90 | < 90 | -| Metrics | Oracle - Tablespaces Space Low | This alert fires when tablespace disk usage is over 80% | Warning | >=80 | < 80 | -| Metrics | Oracle - User Limit Critical | This alert fires when concurrent user sessions usage is over 90% | Critical | >=90 | < 90 | -| Metrics | Oracle - User Limit Warning | This alert fires when concurrent user sessions usage is over 80% | Warning | >=80 | < 80 | - -## Installing Oracle Monitors - -* To install these alerts, you need to have the **Manage Monitors** role capability. -* Alerts can be installed by either importing a JSON file or a Terraform script. - -There are limits to how many alerts can be enabled - see the [Alerts FAQ](/docs/alerts/monitors/monitor-faq) for details. - -### Method A: Importing a JSON file - -1. Download the [JSON file](https://github.com/SumoLogic/terraform-sumologic-sumo-logic-monitor/blob/main/monitor_packages/Oracle/Oracle.json) that describes the monitors. -2. The [JSON](https://github.com/SumoLogic/terraform-sumologic-sumo-logic-monitor/blob/main/monitor_packages/Oracle/Oracle.json) contains the alerts that are based on Sumo Logic searches that do not have any scope filters and therefore will be applicable to all Oracle clusters, the data for which has been collected via the instructions in the previous sections. However, if you would like to restrict these alerts to specific clusters or environments, update the JSON file by replacing the text `db_system=oracle` with ``. - -Custom filter examples: - -1. For alerts applicable only to a specific cluster, your custom filter would be `db_cluster=oracle-prod.01`. -2. For alerts applicable to all clusters that start with Kafka-prod, your custom filter would be,`db_cluster=oracle-prod*`. -3. For alerts applicable to a specific cluster within a production environment, your custom filter would be: `db_cluster=oracle-1` and `environment=prod` (This assumes you have set the optional environment tag while configuring collection). -4. [**Classic UI**](/docs/get-started/sumo-logic-ui-classic). In the main Sumo Logic menu, select **Manage Data > Monitoring > Monitors**.
[**New UI**](/docs/get-started/sumo-logic-ui). In the main Sumo Logic menu, select **Alerts > Monitors**. You can also click the **Go To...** menu at the top of the screen and select **Monitors**. -5. Click **Add**. -6. Click Import and then copy-paste the above JSON to import monitors. - -The monitors are disabled by default. Once you have installed the alerts using this method, navigate to the Oracle folder under **Monitors** to configure them. See [this](/docs/alerts/monitors) document to enable monitors to send notifications to teams or connections. See the instructions detailed in Step 4 of this [document](/docs/alerts/monitors/create-monitor). - -### Method B: Using a Terraform script - -1. **Generate a Sumo Logic access key and ID**. Generate an access key and access ID for a user that has the Manage Monitors role capability in Sumo Logic using instructions in [Access Keys](/docs/manage/security/access-keys). Identify which deployment your Sumo Logic account is in, using this [link](/docs/api/getting-started#sumo-logic-endpoints-by-deployment-and-firewall-security). -2. **[Download and install Terraform 0.13](https://www.terraform.io/downloads.html) or later**. -3. **Download the Sumo Logic Terraform package for Oracle alerts**. The alerts package is available in the Sumo Logic GitHub [repository](https://github.com/SumoLogic/terraform-sumologic-sumo-logic-monitor/tree/main/monitor_packages/Oracle). You can either download it through the “git clone” command or as a zip file. -4. **Alert Configuration**. After the package has been extracted, navigate to the package directory **terraform-sumologic-sumo-logic-monitor/monitor_packages/Oracle/**. Edit the **Oracle.auto.tfvars** file and add the Sumo Logic Access Key, Access Id and Deployment from Step 1. - ```bash - access_id = "" - access_key = "" - environment = "" - ``` - The Terraform script installs the alerts without any scope filters, if you would like to restrict the alerts to specific clusters or environments, update the variable **’oracle_data_source’**. Custom filter examples: - 1. A specific cluster ‘`db_cluster=oracle.prod.01`’. - 2. All clusters in an environment ‘`environment=prod`’. - 3. For alerts applicable to all clusters that start with oracle-prod, your custom filter would be: ‘`db_cluster=qracle-prod*`’. - 4. For alerts applicable to a specific cluster within a production environment, your custom filter would be `db_cluster=oracle-1` and `environment=prod`. (This assumes you have set the optional environment tag while configuring collection). - - All monitors are disabled by default on installation, if you would like to enable all the monitors, set the parameter `monitors_disabled` to `false` in this file. - - By default, the monitors are configured in a monitor folder called **Oracle**, if you would like to change the name of the folder, update the monitor folder name in “folder” key at `Oracle.auto.tfvars` file. - - If you would like the alerts to send email or connection notifications, configure these in the file `Oracle_notifications.auto.tfvars`. For configuration examples, refer to the next section. -5. **Email and Connection Notification Configuration Examples**. Modify the file **Oracle_notifications.auto.tfvars** and populate `connection_notifications` and `email_notifications` as per below examples. -```bash title="Pagerduty Connection Example" -connection_notifications = [ - { - connection_type = "PagerDuty", - connection_id = "", - payload_override = "{\"service_key\": \"your_pagerduty_api_integration_key\",\"event_type\": \"trigger\",\"description\": \"Alert: Triggered {{TriggerType}} for Monitor {{Name}}\",\"client\": \"Sumo Logic\",\"client_url\": \"{{QueryUrl}}\"}", - run_for_trigger_types = ["Critical", "ResolvedCritical"] - }, - { - connection_type = "Webhook", - connection_id = "", - payload_override = "", - run_for_trigger_types = ["Critical", "ResolvedCritical"] - } - ] -``` - -Replace `` with the connection id of the webhook connection. The webhook connection id can be retrieved by calling the [Monitors API](https://api.sumologic.com/docs/#operation/listConnections). - -For overriding payload for different connection types, refer to this [document](/docs/alerts/webhook-connections/set-up-webhook-connections). - -```bash title="Email Notifications Example" -email_notifications = [ - { - connection_type = "Email", - recipients = ["abc@example.com"], - subject = "Monitor Alert: {{TriggerType}} on {{Name}}", - time_zone = "PST", - message_body = "Triggered {{TriggerType}} Alert on {{Name}}: {{QueryURL}}", - run_for_trigger_types = ["Critical", "ResolvedCritical"] - } - ] -``` -6. **Install the Alerts**. - 1. Navigate to the package directory `terraform-sumologic-sumo-logic-monitor/monitor_packages/Oracle/` and run `terraform init`. This will initialize Terraform and will download the required components. - 2. Run `terraform plan` to view the monitors which will be created/modified by Terraform. - 3. Run `terraform apply`. -7. **Post Installation**. If you haven’t enabled alerts and/or configured notifications through the Terraform procedure outlined above, we highly recommend enabling alerts of interest and configuring each enabled alert to send notifications to other users or services. This is detailed in Step 4 of [this document](/docs/alerts/monitors/create-monitor). - -There are limits to how many alerts can be enabled. See the [Alerts FAQ](/docs/alerts/monitors/monitor-faq). ## Performance Metrics Script Setup @@ -892,18 +714,34 @@ oracle_script/sumooracle>python3 oracle-perf-monitor.py ## Installing the Oracle app -This section demonstrates how to install the Oracle app. +import AppInstall2 from '../../reuse/apps/app-install-only-k8s.md'; + + + +As part of the app installation process, the following fields will be created by default: +* `component` +* `environment` +* `db_system` +* `db_cluster` +* `db_cluster_address` +* `db_cluster_port` -import AppInstall from '../../reuse/apps/app-install.md'; +Additionally, if you are using Oracle in the Kubernetes environment, the following additional fields will be created by default during the app installation process: +* `pod_labels_component` +* `pod_labels_environment` +* `pod_labels_db_system` +* `pod_labels_db_cluster` +* `pod_labels_db_cluster_address` +* `pod_labels_db_cluster_port` - +For information on setting up fields, see [Fields](/docs/manage/fields). ## Viewing Oracle Dashboards -:::tip Filter with template variables +import ViewDashboards from '../../reuse/apps/view-dashboards.md'; + + -Template variables provide dynamic dashboards that can rescope data on the fly. As you apply variables to troubleshoot through your dashboard, you view dynamic changes to the data for a quicker resolution to the root cause. You can use template variables to drill down and examine the data on a granular level. For more information, see [Filter with template variables](/docs/dashboards/filter-template-variables). -::: ### Overview @@ -1176,3 +1014,37 @@ The Oracle - Resource Utilization dashboard performance statistics such as Limit The **Oracle - Parallel Execution** dashboard performance statistics such as Sessions, DDL statements parallelized, PX downgraded, Background services Oracle dashboards + + +## Create monitors for Oracle app + +import CreateMonitors from '../../reuse/apps/create-monitors.md'; + + + +### Oracle alerts + +| Alert Type (Metrics/Logs) | Alert Name | Alert Description | Trigger Type (Critical / Warning) | Alert Condition | Recover Condition | +|:------------------|:-------------|:----------------|:-----------------|:-----------------|:-------------------| +| Logs | Oracle - Admin Restricted Command Execution | This alert fires when the Listener is unable to resolve a command. | Warning | > 0 | `<=` 0 | +| Logs | Oracle - Archival Log Creation | This alert fires when there is an archive log creation error. | Warning | > 0 | `<=` 0 | +| Logs | Oracle - Block Corruption | This alert fires when we detect corrupted data blocks. | Warning | > 0 | `<=` 0 | +| Logs | Oracle - Database Crash | This alert fires when the database crashes. | Critical | >0 | `<=` 0 | +| Logs | Oracle - Deadlock | This alert fires when deadlocks are detected. | Warning | >5 | `<=` 0 | +| Logs | Oracle - Fatal NI Connect Error | This alert fires when we detect a "Fatal NI connect error". | Warning | >0 | `<=` 0 | +| Logs | Oracle - Internal Errors | This alert fires when internal errors are detected. | Warning | >0 | `<=` 0 | +| Logs | Oracle - Login Fail | This alert fires when we detect that a user cannot login. | Warning | >0 | `<=` 0 | +| Logs | Oracle - Possible Inappropriate Activity | This alert fires when we detect possible inappropriate activity. | Warning | >0 | `<=` 0 | +| Logs | Oracle - TNS Error | This alert fires when we detect TNS operations errors. | Critical | >0 | `<=` 0 | +| Logs | Oracle - Unable To Extend Tablespace | This alert fires when we detect that we are unable to extend tablespaces. | Warning | >0 | `<=` 0 | +| Logs | Oracle - Unauthorized Command Execution | This alert fires when we detect that a user is not authorized to execute a requested listener command in an Oracle instance. | Warning | >0 | `<=` 0 | +| Metrics | Oracle - Database Down | This alert fires when we detect that the Oracle database is down. | Critical | >0 | `<=` 0 | +| Metrics | Oracle - High CPU Usage | This alert fires when CPU usage on a node in an Oracle cluster is high. | Critical | >=80 | < 80 | +| Metrics | Oracle - Process Limit Critical | This alert fires when process CPU utilization is over 90% | Critical | >=90 | < 90 | +| Metrics | Oracle - Process Limit Warning | This alert fires when processes CPU utilization is over 80% | Warning | >=80 | < 80 | +| Metrics | Oracle - Session Critical | This alert fires when session usage is over 97% | Critical | >=97 | < 97 | +| Metrics | Oracle - Session Warning | This alert fires when session usage is over 90% | Warning | >=90 | < 90 | +| Metrics | Oracle - Tablespaces Out of Space | This alert fires when tablespace disk usage is over 90% | Critical | >=90 | < 90 | +| Metrics | Oracle - Tablespaces Space Low | This alert fires when tablespace disk usage is over 80% | Warning | >=80 | < 80 | +| Metrics | Oracle - User Limit Critical | This alert fires when concurrent user sessions usage is over 90% | Critical | >=90 | < 90 | +| Metrics | Oracle - User Limit Warning | This alert fires when concurrent user sessions usage is over 80% | Warning | >=80 | < 80 | diff --git a/docs/integrations/databases/postgresql.md b/docs/integrations/databases/postgresql.md index b45514d6c0..63beeff36f 100644 --- a/docs/integrations/databases/postgresql.md +++ b/docs/integrations/databases/postgresql.md @@ -68,41 +68,7 @@ On your PostgreSQL database cluster, create a user that has access to following * `pg_class` -### Step 2: Configure Fields in Sumo Logic - -Create the following Fields in Sumo Logic before configuring collection. This ensures that your logs and metrics are tagged with relevant metadata, which is required by the app dashboards. For information on setting up fields, see [Sumo Logic Fields](/docs/manage/fields). - - - - - -If you're using PostgreSQL in a Kubernetes environment, create the fields: -* `pod_labels_component` -* `pod_labels_environment` -* `pod_labels_db_system` -* `pod_labels_db_cluster` - - - - -If you're using PostgreSQL in a non-Kubernetes environment, create the fields: - -* `component` -* `environment` -* `db_system` -* `db_cluster` -* `pod` - - - - -### Step 3: Configure PostgreSQL Logs and Metrics Collection +### Step 2: Configure PostgreSQL Logs and Metrics Collection Sumo Logic supports collection of logs and metrics data from PostgreSQL in both Kubernetes and non-Kubernetes environments. Click on the appropriate tab below based on the environment where your PostgreSQL clusters are hosted. @@ -403,126 +369,36 @@ At this point, PostgreSQL logs should start flowing into Sumo Logic. -## Installing PostgreSQL Alerts - -This section provides instructions for installing the Sumo app and Alerts for PostgreSQL. These instructions assume you have already set up collection as described in the Collect Logs and Metrics from PostgreSQL app section. - -Sumo Logic has provided out-of-the-box alerts available through [Sumo Logic monitors](/docs/alerts/monitors) to help you monitor your PostgreSQL cluster. These alerts are built based on metrics and logs datasets and include preset thresholds based on industry best practices and recommendations. For details on the individual alerts, please see the [alerts section](#postgresql-alerts). -* To install these alerts, you need to have the Manage Monitors role capability. -* Alerts can be installed by either importing them a JSON or a Terraform script. - -There are limits to how many alerts can be enabled - please see the [Alerts FAQ](/docs/alerts/monitors/monitor-faq.md) for details. - -### Method A: Importing a JSON file - -1. Download the [JSON file](https://github.com/SumoLogic/terraform-sumologic-sumo-logic-monitor/blob/main/monitor_packages/postgresql/postgresql.json) describing all the monitors. - 1. The JSON contains the alerts that are based on Sumo Logic searches that do not have any scope filters and therefore will be applicable to all PostgreSQL clusters, the data for which has been collected via the instructions in the previous sections. However, if you would like to restrict these alerts to specific clusters or environments, update the JSON file by replacing the text `db_system=postgresql` with ` db_system=postgresql`. Custom filter examples: - * For alerts applicable only to a specific cluster, your custom filter would be: `db_cluster=postgresql-prod.01`. - * For alerts applicable to all clusters that start with postgresql-prod, your custom filter would be: `db_cluster=postgresql-prod*`. - * For alerts applicable to a specific cluster within a production environment, your custom filter would be `db_cluster=postgresql-1 and environment=prod`. This assumes you have set the optional environment tag while configuring collection. -2. Go to Manage Data > Alerts > Monitors. -3. Click **Add**: -4. Click Import to import monitors from the JSON above. - -The monitors are disabled by default. Once you have installed the alerts using this method, navigate to the PostgreSQL folder under Monitors to configure them. See [this](/docs/alerts/monitors) document to enable monitors, to configure each monitor, to send notification to teams or connections please see the instructions detailed in step 4 of this [document](/docs/alerts/monitors/create-monitor). - -### Method B: Using a Terraform script - -1. Generate a Sumo Logic access key and ID for a user that has the Manage Monitors role capability in Sumo Logic using instructions in [Access Keys](/docs/manage/security/access-keys). Please identify which deployment your Sumo Logic account is in, using this [ link](/docs/api/getting-started#sumo-logic-endpoints-by-deployment-and-firewall-security). -2. [Download and install Terraform 0.13](https://www.terraform.io/downloads.html) or later. -3. Download the Sumo Logic Terraform package for PostgreSQL alerts: The alerts package is available in the Sumo Logic GitHub [repository](https://github.com/SumoLogic/terraform-sumologic-sumo-logic-monitor/tree/main/monitor_packages/postgresql). You can either download it through the “git clone” command or as a zip file. -4. Alert Configuration: After the package has been extracted, navigate to the package directory terraform-sumologic-sumo-logic-monitor/monitor_packages/**postgresql**/ - -Edit the **postgresql.auto.tfvars** file and add the Sumo Logic Access Key, Access Id and Deployment from Step 1 . -```bash -access_id = "" -access_key = "" -environment = "" -``` - -The Terraform script installs the alerts without any scope filters, if you would like to restrict the alerts to specific clusters or environments, update the variable `postgresql_data_source`. Custom filter examples: -* A specific cluster `db_cluster=postgresql.prod.01` -* All clusters in an environment `environment=prod` -* For alerts applicable only to a specific cluster, your custom filter would be: `db_cluster=postgresql-.prod.01` -* For alerts applicable to all clusters that start with postgresql-prod, your custom filter would be `db_cluster=postgresql-prod*` -* For alerts applicable to a specific cluster within a production environment, your custom filter would be `db_cluster=postgresql-1 and environment=prod`. This assumes you have set the optional environment tag while configuring collection. - -All monitors are disabled by default on installation, if you would like to enable all the monitors, set the parameter **monitors_disabled** to false in this file. - -By default, the monitors are configured in a monitor folder called “PostgreSQL”, if you would like to change the name of the folder, update the monitor folder name in this file. - -If you would like the alerts to send email or connection notifications, configure these in the file **postgresql_notifications.auto.tfvars**. For configuration examples, refer to the next section. - - -5. Email and Connection Notification Configuration Examples. To **configure notifications**, modify the file `postgresql_notifications.auto.tfvars` file and fill in the `connection_notifications` and `email_notifications` sections. See the examples for PagerDuty and email notifications below. See this [document](/docs/alerts/webhook-connections/set-up-webhook-connections) for creating payloads with other connection types. - -```bash title="Pagerduty Connection Example" -connection_notifications = [ - { - connection_type = "PagerDuty", - connection_id = "", - payload_override = "{\"service_key\": \"your_pagerduty_api_integration_key\",\"event_type\": \"trigger\",\"description\": \"Alert: Triggered {{TriggerType}} for Monitor {{Name}}\",\"client\": \"Sumo Logic\",\"client_url\": \"{{QueryUrl}}\"}", - run_for_trigger_types = ["Critical", "ResolvedCritical"] - }, - { - connection_type = "Webhook", - connection_id = "", - payload_override = "", - run_for_trigger_types = ["Critical", "ResolvedCritical"] - } - ] -``` - -Replace `` with the connection id of the webhook connection. The webhook connection id can be retrieved by calling the [Monitors API](https://api.sumologic.com/docs/#operation/listConnections). - -```bash title="Email Notifications Example" -email_notifications = [ - { - connection_type = "Email", - recipients = ["abc@example.com"], - subject = "Monitor Alert: {{TriggerType}} on {{Name}}", - time_zone = "PST", - message_body = "Triggered {{TriggerType}} Alert on {{Name}}: {{QueryURL}}", - run_for_trigger_types = ["Critical", "ResolvedCritical"] - } - ] -``` - -6. Install the Alerts. - 1. Navigate to the package directory terraform-sumologic-sumo-logic-monitor/monitor_packages/**postgresql**/ and run `terraform init`. This will initialize Terraform and will download the required components. - 2. Run **`terraform plan`** to view the monitors which will be created/modified by Terraform. - 3. Run **`terraform apply`**. -7. Post Installation. If you haven’t enabled alerts and/or configured notifications through the Terraform procedure outlined above, we highly recommend enabling alerts of interest and configuring each enabled alert to send notifications to other people or services. This is detailed in [this document](/docs/alerts/monitors/create-monitor). - ## Installing the PostgreSQL app -Now that you have set up log and metric collection for PostgreSQL, you can install the Sumo Logic app for PostgreSQL to use the pre-configured Searches and dashboards. To install the app, do the following: +import AppInstall2 from '../../reuse/apps/app-install-only-k8s.md'; -Locate and install the app you need from the **App Catalog**. If you want to see a preview of the dashboards included with the app before installing, click **Preview Dashboards**. + -1. From the **App Catalog**, search for and select the app. -2. Select the version of the service you're using and click **Add to Library**. -:::note -Version selection is not available for all apps. -::: -3. To install the app, complete the following fields. - * **App Name.** You can retain the existing name, or enter a name of your choice for the app. - * **Data Source.** Choose **Enter a Custom Data Filter**, and enter a custom PostgreSQL cluster filter. Examples: - * For all PostgreSQL clusters: `db_cluster=**` - * For a specific cluster: `db_cluster=postgresql.dev.01`. - * Clusters within a specific environment: `db_cluster=postgresql-1 and environment=prod`. (This assumes you have set the optional environment tag while configuring collection) - * **Advanced**. Select the **Location in Library** (the default is the Personal folder in the library), or click **New Folder** to add a new folder. -4. Click **Add to Library.** +As part of the app installation process, the following fields will be created by default: +* `component` +* `environment` +* `db_system` +* `db_cluster` +* `pod` +* `db_cluster_address` +* `db_cluster_port` -Once an app is installed, it will appear in your **Personal** folder, or other folder that you specified. From here, you can share it with your organization. +Additionally, if you're using Cassandra in the Kubernetes environment, the following additional fields will be created by default during the app installation process: +* `pod_labels_component` +* `pod_labels_environment` +* `pod_labels_db_system` +* `pod_labels_db_cluster` +* `pod_labels_db_cluster_address` +* `pod_labels_db_cluster_port` -Panels will start to fill automatically. It's important to note that each panel slowly fills with data matching the time range query and received since the panel was created. Results won't immediately be available, but with a bit of time, you'll see full graphs and maps. +For information on setting up fields, see [Fields](/docs/manage/fields). ## Viewing PostgreSQL dashboards -:::tip Filter with template variables -Template variables provide dynamic dashboards that can rescope data on the fly. As you apply variables to troubleshoot through your dashboard, you view dynamic changes to the data for a quicker resolution to the root cause. You can use template variables to drill down and examine the data on a granular level. For more information, see [Filter with template variables](/docs/dashboards/filter-template-variables.md). -::: +import ViewDashboards from '../../reuse/apps/view-dashboards.md'; + + ### Overview @@ -617,13 +493,13 @@ Use this dashboard to: -## PostgreSQL Alerts +## Create monitors for PostgreSQL app -Sumo Logic provides out-of-the-box alerts available via [Sumo Logic monitors](/docs/alerts/monitors). These alerts are built based on logs and metrics datasets and have preset thresholds based on industry best practices and recommendations. +import CreateMonitors from '../../reuse/apps/create-monitors.md'; -**Sumo Logic provides the following out-of-the-box alerts for PostgreSQL:** + -The metrics queries are derived as per [Prometheus rules](https://awesome-prometheus-alerts.grep.to/rules.html). +### PostgreSQL Alerts | Alert Name | Alert Description and conditions | Alert Condition | Recover Condition | |:---------------------------------------------------|:---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|:------------------------------------------------------------------------------------------------------------|:-----------------------------------| diff --git a/docs/integrations/databases/redis.md b/docs/integrations/databases/redis.md index d4ced42f44..88be8a06f9 100644 --- a/docs/integrations/databases/redis.md +++ b/docs/integrations/databases/redis.md @@ -71,49 +71,7 @@ This sample Query is from the the **Redis - Logs** dashboard > **Logs** panel. This section provides instructions for configuring log and metric collection for the Sumo Logic app for Redis. Configuring log and metric collection for the Redis ULM app includes the following tasks: -### Step 1: Configure Fields in Sumo Logic - -Create the following Fields in Sumo Logic prior to configuring collection. This ensures that your logs and metrics are tagged with relevant metadata, which is required by the app dashboards. For information on setting up fields, see [Sumo Logic Fields](/docs/manage/fields). - -:::note -This step is not needed if you are using the application components solution terraform script. -::: - - - - - -If you're using Redis in a Kubernetes environment, create the fields: -* `pod_labels_component` -* `pod_labels_environment` -* `pod_labels_db_system` -* `pod_labels_db_cluster` -* `pod_labels_db_cluster_address` -* `pod_labels_db_cluster_port` - - - - - -If you're using Redis in a non-Kubernetes environment, create the fields: -* `component` -* `environment` -* `db_system` -* `db_cluster` -* `db_cluster_address` -* `db_cluster_port` - - - - - -### Step 2: Configure Collection for Redis +### Configure Collection for Redis Sumo Logic supports collection of logs and metrics data from Redis in both Kubernetes and non-Kubernetes environments. Click on the appropriate tab below based on the environment where your Redis clusters are hosted. @@ -244,25 +202,9 @@ This section explains the steps to collect Redis logs from a Kubernetes environm kubectl describe pod ``` 5. Sumo Logic Kubernetes collection will automatically start collecting logs from the pods having the annotations defined above. -3. **Add an FER to normalize the fields in Kubernetes environments**. This step is not needed if using application components solution terraform script. Labels created in Kubernetes environments automatically are prefixed with `pod_labels`. To normalize these for our app to work, we need to create a Field Extraction Rule. To do so: - * [**Classic UI**](/docs/get-started/sumo-logic-ui-classic). In the main Sumo Logic menu, select **Manage Data > Logs > Field Extraction Rules**.
[**New UI**](/docs/get-started/sumo-logic-ui). In the top menu select **Configuration**, and then under **Logs** select **Field Extraction Rules**. You can also click the **Go To...** menu at the top of the screen and select **Field Extraction Rules**. - * Click the + Add button on the top right of the table. - * The **Add Field Extraction Rule** form will appear: - * Enter the following options: - * **Rule Name**. Enter the name as **App Observability - Database**. - * **Applied At**. Choose **Ingest Time**. - * **Scope**. Select **Specific Data**. Enter the following keyword search expression: - ```sql - pod_labels_environment=* pod_labels_component=database pod_labels_db_system=* pod_labels_db_cluster=* - ``` - * **Parse Expression**. Enter the following parse expression: - ```sql - | if (!isEmpty(pod_labels_environment), pod_labels_environment, "") as environment - | pod_labels_component as component - | pod_labels_db_system as db_system - | if (!isEmpty(pod_labels_db_cluster), pod_labels_db_cluster, null) as db_cluster - ``` - * Click **Save** to create the rule. + +
**FER to normalize the fields in Kubernetes environments.** Labels created in Kubernetes environments automatically are prefixed with pod_labels. To normalize these for our app to work, a Field Extraction Rule named **AppObservabilityRedisDatabaseFER** is automatically created for Database Application Components. +
@@ -429,133 +371,38 @@ After determining the location of conf file, modify the **redis.conf** configura -## Installing Redis Monitors/Alerts - -:::note -This step is not needed if you are using the application components solution terraform script. -::: -This section has instructions for installing the Sumo app and Alerts for Redis ULM, as well as descriptions and examples for each of the dashboards. These instructions assume you have already set up collection as described in the **Collecting Logs and Metrics for Redis app** section. - -Sumo Logic has provided out-of-the-box alerting capabilities available via [Sumo Logic monitors](/docs/alerts/monitors) to help you quickly determine if the Redis database cluster is available and performing as expected. These monitors fire alerts (notifications) on top of preset thresholds on metrics data using industry best practices and recommendations. - -For details on the individual monitors, please see [Alerts](#redis-alerts). - -* To install these alerts, you need to have the Manage Monitors role capability. -* Alerts can be installed by either importing them via a JSON or via a Terraform script. - -:::note -There are limits for how many alerts can be enabled - please see the [Alerts FAQ](/docs/alerts/monitors/monitor-faq.md) for details. -::: - -### Method A: Importing a JSON file - -1. Download a [JSON file](https://github.com/SumoLogic/terraform-sumologic-sumo-logic-monitor/tree/main/monitor_packages/redis) that describes the monitors. The JSON contains the alerts that are based on Sumo Logic searches that do not have any scope filters and therefore will be applicable to all Redis clusters, the data for which has been collected via the instructions in the previous sections., However, if you would like to restrict these alerts to specific clusters or environments, update the JSON file by replacing the text `db_system=redis` with ` db_system=redis`. Custom filter examples: - * For alerts applicable only to a specific cluster, your custom filter would be: `db_cluster=redis-.prod.01`. - * For alerts applicable to all clusters that start with `redis-prod`, your custom filter would be: `db_cluster=redis-prod*`. - * For alerts applicable to a specific cluster within a production environment, your custom filter would be: `db_cluster=redis-1 and environment=prod`. This assumes you have set the optional environment tag while configuring collection. -2. [**Classic UI**](/docs/get-started/sumo-logic-ui-classic). In the main Sumo Logic menu, select **Manage Data > Monitoring > Monitors**.
[**New UI**](/docs/get-started/sumo-logic-ui). In the main Sumo Logic menu, select **Alerts > Monitors**. You can also click the **Go To...** menu at the top of the screen and select **Monitors**. -3. Click **Add**. -4. Click **Import** to import monitors from the JSON above. - -:::note -Monitors are disabled by default. Once you have installed the alerts via this method, navigate to the Redis folder under **Monitors** to configure them. See [Monitor Settings](/docs/alerts/monitors/settings/#monitor-details) to enable monitors. To send notifications to teams or connections, see the instructions detailed in Step 4 of [Create a Monitor](/docs/alerts/monitors/create-monitor). -::: - -### Method B: Using a Terraform script - -1. Generate a Sumo Logic access key and ID for a user that has the Manage Monitors role capability in Sumo Logic using instructions in [Access Keys](/docs/manage/security/access-keys). Please identify which deployment your Sumo Logic account is in, using [this link](/docs/api/getting-started#sumo-logic-endpoints-by-deployment-and-firewall-security). -2. [Download and install Terraform 0.13](https://www.terraform.io/downloads.html) or later. -3. Download the Sumo Logic Terraform package for Redis alerts. The alerts package is available in the Sumo Logic github [repository](https://github.com/SumoLogic/terraform-sumologic-sumo-logic-monitor/tree/main/monitor_packages/redis). You can either download it via the “git clone” command or as a zip file. -4. Monitor Configuration. After the package has been extracted, navigate to the package directory terraform-sumologic-sumo-logic-monitor/monitor_packages/**redis**/ - -Edit the redis.auto.tfvars file and add the Sumo Logic Access Key, Access Id and Deployment from Step 1. -```bash -access_id = "" -access_key = "" -environment = "" -``` -The Terraform script installs the alerts without any scope filters, if you would like to restrict the alerts to specific clusters or environments, update the variable `redis_cluster_filter`. Custom filter examples: - * For alerts applicable only to a specific cluster, your custom filter would be: `db_cluster=redis-.prod.01`. - * For alerts applicable to all clusters that start with redis-prod, your custom filter would be: `db_cluster=redis-prod*`. - * For alerts applicable to a specific cluster within a production environment, your custom filter would be: `db_cluster=redis-1 and environment=prod`. This assumes you have set the optional environment tag while configuring collection. - - All monitors are disabled by default on installation, if you would like to enable all the monitors, set the parameter `monitors_disabled` to `false` in this file. - - By default, the monitors are configured in a monitor folder called “Redis”, if you would like to change the name of the folder, update the monitor folder name in this file. - - If you would like the alerts to send email or connection notifications, configure these in the file **redis_notifications.auto.tfvars**. For configuration examples, refer to the next section. - -5. Email and Connection Notification Configuration Examples. To configure notifications, modify the file redis_notifications.auto.tfvars file and fill in the connection_notifications See the examples for PagerDuty and email notifications below. See [this document](/docs/alerts/webhook-connections/set-up-webhook-connections) for creating payloads with other connection types. -```bash title="Pagerduty Connection Example" -connection_notifications = [ - { - connection_type = "PagerDuty", - connection_id = "", - payload_override = "{\"service_key\": \"your_pagerduty_api_integration_key\",\"event_type\": \"trigger\",\"description\": \"Alert: Triggered {{TriggerType}} for Monitor {{Name}}\",\"client\": \"Sumo Logic\",\"client_url\": \"{{QueryUrl}}\"}", - run_for_trigger_types = ["Critical", "ResolvedCritical"] - }, - { - connection_type = "Webhook", - connection_id = "", - payload_override = "", - run_for_trigger_types = ["Critical", "ResolvedCritical"] - } - ] -``` - -Replace `` with the connection id of the webhook connection. The webhook connection id can be retrieved via calling the [Monitors API](https://api.sumologic.com/docs/#operation/listConnections). - -For overriding payload for different connection types, refer to [this document](/docs/alerts/webhook-connections/set-up-webhook-connections). - -```bash title="Email Notifications Example" -email_notifications = [ - { - connection_type = "Email", - recipients = ["abc@example.com"], - subject = "Monitor Alert: {{TriggerType}} on {{Name}}", - time_zone = "PST", - message_body = "Triggered {{TriggerType}} Alert on {{Name}}: {{QueryURL}}", - run_for_trigger_types = ["Critical", "ResolvedCritical"] - } - ] -``` - -6. Install the Monitors. - 1. Navigate to the package directory terraform-sumologic-sumo-logic-monitor/monitor_packages/**redis**/ and run **terraform init.** This will initialize Terraform and will download the required components. - 2. Run `terraform plan` to view the monitors which will be created/modified by Terraform. - 3. Run `terraform apply`. +## Installing the Redis app -7. Post Installation. If you haven’t enabled alerts and/or configured notifications via the Terraform procedure outlined above, we highly recommend enabling alerts of interest and configuring each enabled alert to send notifications to other people or services. This is detailed in [Add a Monitor](/docs/alerts/monitors/create-monitor). +import AppInstall2 from '../../reuse/apps/app-install-only-k8s.md'; + -## Installing the Redis app -This section demonstrates how to install the Redis ULM app. +As part of the app installation process, the following fields will be created by default: +* `component` +* `environment` +* `db_system` +* `db_cluster` +* `db_cluster_address` +* `db_cluster_port` -1. From the **App Catalog**, search for and select the app. -2. Select the version of the service you're using and click **Add to Library**. -:::note -Version selection is not available for all apps. -::: -3. To install the app, complete the following fields. - 1. **App Name.** You can retain the existing name, or enter a name of your choice for the app. - 2. **Data Source.** Choose **Enter a Custom Data Filter** and enter a custom Redis cluster filter. Examples: - * For all Redis clusters: `db_cluster=*` - * For a specific cluster: `db_cluster=redis.dev.01` - * Clusters within a specific environment: `db_cluster=redis-1 and environment=prod`. (This assumes you have set the optional environment tag while configuring collection). - 3. **Advanced**. Select the **Location in Library** (the default is the Personal folder in the library), or click **New Folder** to add a new folder. -4. Click **Add to Library**. -Once an app is installed, it will appear in your **Personal** folder, or other folder that you specified. From here, you can share it with your organization. +Additionally, if you are using Redis in the Kubernetes environment, the following additional fields will be created by default during the app installation process: +* `pod_labels_component` +* `pod_labels_environment` +* `pod_labels_db_system` +* `pod_labels_db_cluster` +* `pod_labels_db_cluster_address` +* `pod_labels_db_cluster_port` -Panels will start to fill automatically. It's important to note that each panel slowly fills with data matching the time range query and received since the panel was created. Results won't immediately be available, but with a bit of time, you'll see full graphs and maps. +For information on setting up fields, see [Fields](/docs/manage/fields). ## Viewing Redis dashboards -:::tip Filter with template variables -Template variables provide dynamic dashboards that can rescope data on the fly. As you apply variables to troubleshoot through your dashboard, you view dynamic changes to the data for a quicker resolution to the root cause. You can use template variables to drill down and examine the data on a granular level. For more information, see [Filter with template variables](/docs/dashboards/filter-template-variables.md). -::: +import ViewDashboards from '../../reuse/apps/view-dashboards.md'; + + ### Overview @@ -609,9 +456,13 @@ Use this dashboard to: Redis dashboards -## Redis Alerts +## Create monitors for Redis app + +import CreateMonitors from '../../reuse/apps/create-monitors.md'; + + -Sumo Logic has provided out-of-the-box alerts available via [Sumo Logic monitors](/docs/alerts/monitors) to help you quickly determine if the Redis database cluster is available and performing as expected. +### Redis alerts
Alert Name
diff --git a/docs/integrations/microsoft-azure/sql-server.md b/docs/integrations/microsoft-azure/sql-server.md index f884915632..9923b94b11 100644 --- a/docs/integrations/microsoft-azure/sql-server.md +++ b/docs/integrations/microsoft-azure/sql-server.md @@ -21,43 +21,7 @@ This App has been tested with following SQL Server versions: This section provides instructions for configuring a local file source to collect SQL Server ERRORLOG data, and a script source to collect SQL Server performance metrics. A sample log message is also provided. -### Step 1: Configure Fields in Sumo Logic - -Create the following Fields in Sumo Logic prior to configuring collection. This ensures that your logs and metrics are tagged with relevant metadata, which is required by the app dashboards. For information on setting up fields, see [Sumo Logic Fields](/docs/manage/fields). - - - - - -If you're using SQL Server in a Kubernetes environment, create the fields: -* `pod_labels_component` -* `pod_labels_environment` -* `pod_labels_db_system` -* `pod_labels_db_cluster` -* `pod_labels_db_cluster_address` -* `pod_labels_db_cluster_port` - - - - -If you're using SQL Server in a non-Kubernetes environment, create the fields: -* `component` -* `environment` -* `db_system` -* `db_cluster` -* `db_cluster_address` -* `db_cluster_port` - - - - -### Step 2: Collect Logs and Metrics +### Collect Logs and Metrics Sumo Logic supports collection of logs and metrics data from SQL Server in both Kubernetes and non-Kubernetes environments. Click on the appropriate tabs below based on the environment where your SQL Server clusters are hosted. -## Installing Microsoft SQL Server Monitors - -This section provides instructions for installing the Microsoft SQL Server App, as well as examples of each of the App dashboards. These instructions assume you have already set up collection as described in [Collecting Logs and Metrics for the Microsoft SQL Server](#collecting-logs-and-metrics-for-the-microsoft-sql-server-app). - - -### Pre-Packaged Alerts - -Sumo Logic has provided out-of-the-box alerts available through [Sumo Logic monitors](/docs/alerts/monitors) to help you monitor your SQL Server clusters. These alerts are built based on metrics and logs datasets and include preset thresholds based on industry best practices and recommendations. - -For details on the individual alerts, see [Alerts](#microsoft-sql-server-alerts). - -* To install these alerts, you need to have the Manage Monitors role capability. -* Alerts can be installed by either importing a JSON file or a Terraform script. -* Note: There are limits to how many alerts can be enabled - please see the [Alerts FAQ](/docs/alerts/monitors/monitor-faq.md) for details. - - -### Method A: Importing a JSON file - -1. Download the [JSON file](https://github.com/SumoLogic/terraform-sumologic-sumo-logic-monitor/blob/main/monitor_packages/SQLServer/SQLServer.json) that describes the monitors. -2. The [JSON](https://github.com/SumoLogic/terraform-sumologic-sumo-logic-monitor/blob/main/monitor_packages/SQLServer/SQLServer.json) contains the alerts that are based on Sumo Logic searches that do not have any scope filters and therefore will be applicable to all SQL Server clusters, the data for which has been collected via the instructions in the previous sections. However, if you would like to restrict these alerts to specific clusters or environments, update the JSON file by replacing the text `db_system=sqlserver` with ``. - -Custom filter examples: - -1. For alerts applicable only to a specific cluster, your custom filter would be: ‘`db_cluster=sqlserver-prod.01`‘. -2. For alerts applicable to all clusters that start with Kafka-prod, your custom filter would be: `db_cluster=sql-prod*`. -3. For alerts applicable to a specific cluster within a production environment, your custom filter would be: `db_cluster=sql-1 `AND `environment=prod `(This assumes you have set the optional environment tag while configuring collection). -4. [**Classic UI**](/docs/get-started/sumo-logic-ui-classic). In the main Sumo Logic menu, select **Manage Data > Monitoring > Monitors**.
[**New UI**](/docs/get-started/sumo-logic-ui). In the main Sumo Logic menu, select **Alerts > Monitors**. You can also click the **Go To...** menu at the top of the screen and select **Monitors**. -5. Click **Add**. -6. Click **Import**, then copy paste the above JSON to import monitors. - -The monitors are disabled by default. Once you have installed the alerts using this method, navigate to the MySQL folder under **Monitors** to configure them. See [this](/docs/alerts/monitors) document to enable monitors to send notifications to teams or connections. Please see the instructions detailed in Step 4 of this [document](/docs/alerts/monitors/create-monitor). - -### Method B: Using a Terraform script - -**Step 1: Generate a Sumo Logic access key and ID** - -Generate an access key and access ID for a user that has the Manage Monitors role capability in Sumo Logic using instructions in [Access Keys](/docs/manage/security/access-keys). Please identify which deployment your Sumo Logic account is in, using this [link](/docs/api/getting-started#sumo-logic-endpoints-by-deployment-and-firewall-security). - -**Step 2: [Download and install Terraform 0.13](https://www.terraform.io/downloads.html) or later** - -**Step 3: Download the Sumo Logic Terraform package for SQL Server alerts** - -The alerts package is available in the Sumo Logic GitHub [repository](https://github.com/SumoLogic/terraform-sumologic-sumo-logic-monitor/tree/main/monitor_packages/SQLServer). You can either download it through the “git clone” command or as a zip file. - -**Step 4: Alert Configuration** - -After the package has been extracted, navigate to the package directory **terraform-sumologic-sumo-logic-monitor/monitor_packages/SQLServer/** - -Edit the **SQLServer.auto.tfvars** file and add the Sumo Logic Access Key, Access Id and Deployment from Step 1 . - -```bash -access_id = "" -access_key = "" -environment = "" -``` - -The Terraform script installs the alerts without any scope filters, if you would like to restrict the alerts to specific clusters or environments, update the variable `sqlserver_data_source`. Custom filter examples: - -1. A specific cluster `db_cluster=sqlserver.prod.01`. -2. All clusters in an environment `environment=prod`. -1. For alerts applicable to all clusters that start with sqlserver-prod, your custom filter would be: `db_cluster=sqlserver-prod*`. -2. For alerts applicable to a specific cluster within a production environment, your custom filter would be: - -`db_cluster=sqlserver-1` and `environment=prod` (This assumes you have set the optional environment tag while configuring collection) - -All monitors are disabled by default on installation, if you would like to enable all the monitors, set the parameter **monitors_disabled** to **false** in this file. - -By default, the monitors are configured in a monitor **folder** called “**SQLServer**”, if you would like to change the name of the folder, update the monitor folder name in “folder” key at `SQLServer.auto.tfvars` file. - -If you would like the alerts to send email or connection notifications, configure these in the file `SQLServer_notifications.auto.tfvars`. For configuration examples, refer to the next section. - -**Step 5: Email and Connection Notification Configuration Examples** - -Modify the file **SQLServer_notifications.auto.tfvars** and populate connection_notifications and email_notifications as per below examples. - -```sql title="Pagerduty Connection Example" -connection_notifications = [ - { - connection_type = "PagerDuty", - connection_id = "", - payload_override = "{\"service_key\": \"your_pagerduty_api_integration_key\",\"event_type\": \"trigger\",\"description\": \"Alert: Triggered {{TriggerType}} for Monitor {{Name}}\",\"client\": \"Sumo Logic\",\"client_url\": \"{{QueryUrl}}\"}", - run_for_trigger_types = ["Critical", "ResolvedCritical"] - }, - { - connection_type = "Webhook", - connection_id = "", - payload_override = "", - run_for_trigger_types = ["Critical", "ResolvedCritical"] - } - ] -``` - - -Replace `` with the connection id of the webhook connection. The webhook connection id can be retrieved by calling the [Monitors API](https://api.sumologic.com/docs/#operation/listConnections). - -For overriding payload for different connection types, refer to this [document](/docs/alerts/webhook-connections/set-up-webhook-connections). - -```sql title="Email Notifications Example" -email_notifications = [ - { - connection_type = "Email", - recipients = ["abc@example.com"], - subject = "Monitor Alert: {{TriggerType}} on {{Name}}", - time_zone = "PST", - message_body = "Triggered {{TriggerType}} Alert on {{Name}}: {{QueryURL}}", - run_for_trigger_types = ["Critical", "ResolvedCritical"] - } - ] -``` - - -**Step 6: Install the Alerts** - -1. Navigate to the package directory terraform-sumologic-sumo-logic-monitor/monitor_packages/**SQLServer**/ and run **terraform init.** This will initialize Terraform and will download the required components. -2. Run `terraform plan` to view the monitors which will be created/modified by Terraform. -3. Run `terraform apply`. - -**Step 7: Post Installation** - -If you haven’t enabled alerts and/or configured notifications through the Terraform procedure outlined above, we highly recommend enabling alerts of interest and configuring each enabled alert to send notifications to other users or services. This is detailed in Step 4 of [this document](/docs/alerts/monitors/create-monitor). +## Installing the Microsoft SQL Server app -There are limits to how many alerts can be enabled - please see the [Alerts FAQ](/docs/alerts/monitors/monitor-faq.md). +import AppInstall2 from '../../reuse/apps/app-install-only-k8s.md'; + -## Installing the Microsoft SQL Server app +As part of the app installation process, the following fields will be created by default: +* `component` +* `environment` +* `db_system` +* `db_cluster` +* `db_cluster_address` +* `db_cluster_port` -This section demonstrates how to install the SQL Server App. +Additionally, if you are using SQL Server in the Kubernetes environment, the following additional fields will be created by default during the app installation process: -import AppInstall from '../../reuse/apps/app-install.md'; +* `pod_labels_component` +* `pod_labels_environment` +* `pod_labels_db_system` +* `pod_labels_db_cluster` +* `pod_labels_db_cluster_address` +* `pod_labels_db_cluster_port` - +For information on setting up fields, see [Fields](/docs/manage/fields). ## Viewing Microsoft SQL Server dashboards -:::tip Filter with template variables -Template variables provide dynamic dashboards that can rescope data on the fly. As you apply variables to troubleshoot through your dashboard, you view dynamic changes to the data for a quicker resolution to the root cause. You can use template variables to drill down and examine the data on a granular level. For more information, see [Filter with template variables](/docs/dashboards/filter-template-variables.md). -::: +import ViewDashboards from '../../reuse/apps/view-dashboards.md'; + + ### Overview @@ -638,10 +495,13 @@ The **SQL Server - Backup Restore Mirroring** provides information about: Backup Restore Mirroring -## Microsoft SQL Server Alerts +## Create monitors for Microsoft SQL Server app + +import CreateMonitors from '../../reuse/apps/create-monitors.md'; -Sumo Logic provideds out-of-the-box alerts available via [Sumo Logic monitors](/docs/alerts/monitors). These alerts are built based on logs and metrics datasets and have preset thresholds based on industry best practices and recommendations. + +### Microsoft SQL Server alerts
diff --git a/docs/observability/application-components.md b/docs/observability/application-components.md index c7f64a024e..e233fba420 100644 --- a/docs/observability/application-components.md +++ b/docs/observability/application-components.md @@ -291,4 +291,4 @@ Existing customers have to perform the below steps: 1. Add `db_cluster_address` and `db_cluster` port in their telegraf configuration as mentioned in the respective component’s collection doc. This is for tagging metrics. 2. Add `db_cluster_address` and `db_cluster_port` in the Sumo Logic source for logs as mentioned in the respective component’s collection doc. 3. Import the existing fields using fields.sh script in Step 4 and follow Step 1, 2, 3, and 5 under [Installation](#installation) to deploy the solution. -4. The above step will deploy new dashboards and new monitors, so after migrating your custom content to these new dashboards, you can delete old FERs and dashboards. +4. The above step will deploy new dashboards and new monitors, so after migrating your custom content to these new dashboards, you can delete old FERs and dashboards. \ No newline at end of file