These cookies are required for the website to function properly. They ensure security, enable basic features like page navigation, and store user session data. You cannot disable these cookies.
- Log Management & Analysis
- Who it's for
- Online service teams
Online service teams
Online service teams may operate many application endpoints for a small set of named services. A source stream belongs to the service whose behavior it helps explain. The service owner can review alerts in the context of service criticality, while the responder records the particular incident, affected asset and response times.
How Log Management & Analysis is set up for you
Source context
Register the endpoint and retention days with the correct service before assessing query alerts.
Alert review
Compare the query window and match count, then acknowledge a signal when triage begins.
Response ownership
Assign an incident to a named person and keep updates with the investigation.
Controlled repair
Review a change's risk, planned window and rollback plan before implementation.
Online service teams may operate many application endpoints for a small set of named services. A source stream belongs to the service whose behavior it helps explain. The service owner can review alerts in the context of service criticality, while the responder records the particular incident, affected asset and response times.
Begin with one important service and one source stream. Confirm its owner, current status and criticality. Have the Log Operator capture an alert with a known query window; then ask the Incident Responder to open an incident with the right asset and assignee. The team should be able to see when the incident was acknowledged, what was observed during investigation and when service response was resolved.
A recurring pattern may justify a problem record for the same service. The Service Owner can record the statement and root cause while the current incident continues. If repair requires a change, the approver reviews its schedule and rollback plan. This sequence lets the team work from the alert's evidence through the service decision without making the alert itself stand in for an incident.
Agree where query execution and raw logs live in the observability stack. Use the stream source endpoint to connect that stack to the operating records. Review the stream registration receipt by external event identifier when processing needs examination.
Features to start with
Roles on the team
- Service Owner
- Owns service context and reviews incidents, alerts and problems affecting that service.
- Log Operator
- Registers streams, reviews alerts and examines inbound processing outcomes.
- Incident Responder
- Acknowledges assigned incidents and records investigation updates.
- Change Approver
- Reviews the risk, window and rollback plan before authorizing a change.
Set up Log Management & Analysis your way.
Start free, then use Proto to change fields, steps and approvals before your team goes live.