Introducing Live Tail

At observIQ, we pride ourselves on delivering simple log management solutions with powerful functionalities. We’re excited to announce the addition of Live Tail to the observIQ feature suite. Live Tail emulates the terminal experience, allowing you to analyze, visualize, and debug live – all in a single place. Never worry about the outcome of your deployment. Live Tail lets you troubleshoot, react, and assess real-time issues across your deployments. Watch your logs stream as they are ingested; quickly narrow down the results with a simple search and dynamic filter options. Read on for a deep dive into this fantastic new addition and see how you can make the most of it.

How Does Live Tail Work?

• You can view logs as they are ingested. With the ability to stream, pause, or stop streaming logs at the click of a button, you don’t have to be at the edge to respond to an event of concern. No separate terminals and no toggling between interfaces – you do it all within your observIQ account on a single interface.
• You can search and isolate logs of events that interest you, such as errors, processing failures, access denials, etc. Use simple Lucene queries or the various filter options to find specific logs. Alternatively, you can highlight search terms on logs as they are ingested to isolate and identify logs.
• Scroll up or down and have the play/pause options automatically mirror your actions, with scrolling up pausing the stream and scrolling down continuing to play the stream.
• Please look at the rate at which your logs are being ingested and streamed.
• Collaborate with your engineering team, allowing them to troubleshoot application, deployment, and production issues without disrupting performance.
• Navigate to Live Tail based on your search and filter options from “Discover” or choose to live tail logs from a specific agent under Fleet.

What Can You Do with Live Tail?

• Collaborate. As a DevOps engineer managing a deployment, you’ll feel better with the power and autonomy to control your deployment as it happens instead of reacting after a breakdown occurs. Give your engineering, IT, and DevOps teams access to Live Tail to see how real-time deployments pan out across all your machines.
• Gauge the efficiency of hardware additions to your network through Live Tail.
• If you notice an event that is out of the ordinary occurring at specific times, use Live Tail to see what’s causing it.
• Get an aggregated view of all the events in your Kubernetes applications, making it easier to narrow down to the root causes for errors in your applications, which could impact performance for the rest of your cluster.
• Collaboration for real-time troubleshooting between an application engineer and a DevOps engineer has always been challenging. Both users access a single console and view a single instance of the live stream of logs from the application without any communication delays or disconnects.
• Isolate application requests from a complete application stack or the entire pipeline.

Live Tailing Kubernetes, a quick shoutout.

Open Source Tools

At observIQ, we love and run on Kubernetes ourselves. Before implementing Live Tail, we utilized several open-source tools to help simplify tailing in Kubernetes. Tailing logs from multiple pods, containers, and deployments can be challenging without one of these tools. Here’s a quick list of tools that we would recommend checking out:

Open Sources Tools

Kail:

https://github.com/boz/kail

Kubetail:

https://github.com/johanhaleby/kubetail

Stern:

https://github.com/wercker/stern

Live Tailing Kubernetes with observIQ

observIQ makes streaming logs from single or multiple deployments, namespaces, containers, pods (and more) straightforward with dynamic filters. An example of this would be, for an updated service deployment and to trigger a rolling update with Live Tail, you can see that:

• The new replica set indicates a successful deployment and the time at which the deployment was completed.
• The new replica set's pods are successfully created and started.
• The health (liveness and readiness probes) failed before the pod became “healthy.”
• The old replica set is removed.

Doing all this tracking on the command line would have needed to be more convenient.

https://observiq.com/wp-content/uploads/2021/06/Kubernetes-pod-deletion.mp4

In the screen capture below, you can see that while updating the checkout service, the health checks failed enough times to trigger a restart of the replica set; this means that the old replica set failed to be deleted because the new deployment failed. This is captured very vividly in Live Tail.

https://observiq.com/wp-content/uploads/2021/06/failedtodeploy.mp4

In observIQ, Live Tail is for everyone.

Every observIQ user has access to Live Tail. Like all other observIQ features, such as built-in Dashboards, Alerts, and Sources, Live Tail is available in all our plans, free and paid. If you’re an existing observIQ, Live Tail is available now. Head to the ‘Live Tail’ page to start streaming your logs immediately. Don’t have an observIQ account yet? Head over to our signup page and sign up for a free trial. If you have any questions, reach out to our well-informed support team, which has answers to all of your log management questions.