I am working on a standards document for my team. It will define how best to use Splunk in regards to error handling.
I've started with the Splunk Logging Best Practices. http://dev.splunk.com/view/logging-best-practices/SP-CAAADP6
Is there any other documentation that anyone has created for this purpose? Mine will be directed towards our Java Development team. Although our Application Administrators (DEVOPS) will also be relying on it.
Notifications are a major topic I'm looking for advice on. Today we use some 'Alerts' that send email but they could be improved. Is there a best practice for creating logs that key alerts?
What about severity levels? Is this entirely application specific? Do you use a certain key=value that identifies the type of failure and write Alerts based on this data?
Thanks!
You want :
for severity, you can use the basic syslog DEBUG/INFO/WARN/ERROR/FATAL ...
or use an integers scale (that are easier to filter with a simple condition severity>2)
You want :
for severity, you can use the basic syslog DEBUG/INFO/WARN/ERROR/FATAL ...
or use an integers scale (that are easier to filter with a simple condition severity>2)
Great. These are all helpful items. I'll be adding each to my specification.