Humio at Aruba (HPE): Reducing Costs and Improving Reliability With a Modern Log Management Platform

May 27, 2021

| Humio Staff | Next-Gen SIEM & Log Management

This blog was originally published on humio.com. Humio is a CrowdStrike Company.

"Humio is easier to maintain and deploy than ELK, and it worked beautifully for us right out of the box." Allwyn Lobo, Vice President, Cloud Ops at Aruba-HPE

Aruba Networks (HPE) came to Humio from a difficult situation. Their homegrown ELK stack was beginning to break down after 2 years of use. There were scaling problems, logs were being lost, and the log management solution was experiencing outages. The solution was diverting resources away from Aruba-HPE’s core product and incurring additional costs. "We looked at a lot of providers including DataDog, Splunk and New Relic, and in the end we decided to go with Humio. The primary reasons were reliability and scalability," said Allwyn Lobo, Vice President, Cloud Ops at Aruba-HPE. Because the ELK system was fragmented, application teams had to put in request tickets to get logs from the backend, which led to delays in development. Even worse, the operation teams had to follow the same process, delaying their ability to debug live logs. It was clear Aruba Networks (HPE) needed a more scalable solution that centralized logs and provided better access controls. “Scalability for ELK was not there. The cost to maintain the clusters and the in-house lift to store data, required us to divert resources from production and QA,” Lobo said.

Finding Reliable and Scalable Log Management

With 500 engineers using log management and logging activity topping out at 10 TB a day, Aruba Networks (HPE) needed a solution that operated at industry-leading efficiency. As the second largest producer of wireless LAN access points in the world, as well as a producer of switches, gateways, and network management solutions, Aruba Networks (HPE) generates logs on the largest scale. The enterprise also has demanding requirements for any solution it deploys. “Humio was selected for the fact that it was very tailored for what we were looking for: high compression, excellent management and support. It’s a startup that’s engineering heavy, and the price was right,” Lobo said. Scalability was a deciding factor for Aruba Networks (HPE). They needed scalability in performance and price. Humio offered both by providing advanced compression, which reduced data store costs while accelerating search speeds to 100 gigabytes-a-second. Purpose-built to provide the fastest, least expensive real-time and historical log searches, Humio log management met their needs. “Humio was focused on solving one problem – logging; our biggest pain point at that time,” Lobo said.

Immediate Log Management Benefits

Humio provided immediate value to Aruba Networks (HPE) by delivering improved performance and reduced costs. Using Humio’s default settings, Aruba-HP achieved 25 times compression and reduced their hardware requirements from 100 nodes to 40. Operationally, it removed the burden of self-managing an internal logging system, freeing up engineers to work on other projects. “Humio empowered us so we could focus on our core product, which we can build and deploy and scale versus having to spend time on the logging system, which is not our core competency,” Lobo said.

Benefits of Real-time and Historical Searches

Because Humio doesn’t spend resources on indexing, Aruba Networks (HPE) has virtually unlimited access to live data through a streaming data engine. Real-time data can cause alerts to trigger notifiers on a wide range of platforms from PagerDuty to email, calling the attention of staff in all departments to incidents of interest. Optimized for high speed historical search as well, Humio enables users involved in forensic investigations to run advanced searches and get results in seconds. “Using the live tail from multiple pods/containers helps immensely during an on-call or debugging a scenario with other application teams. Similarly, having alerts in place helps with proactive monitoring in conjunction with our other monitoring stack (Prometheus/Grafana). Logs were key to finding some security bugs on a recent security audit,” Lobo said. Benefits that spread to operations, engineering, and management “Everyone is happy now… Operations is very happy because systems stay up, are reliable, and back-up friendly. Engineering is happy because they can keep all data. Management is happy because Humio reduces costs, running on fewer resources,” Lobo said. Because Humio makes data sharable in real-time with live dashboards, it creates ripple effects as live data-based insights spread to multiple teams. “There are fewer tickets from the application teams to fetch logs from the backend system. There are fewer tickets to get help from the Operations team to access and debug live logs,” Lobo said. By centralizing data, Humio enables Aruba Networks (HPE) to be more scalable. It also improves efficiencies by enabling employees to work with fewer delays. Employees are more effective at their jobs and experience fewer frustrations while working with a responsive user interface that provides search results in seconds rather than minutes. “There were fewer outages and missing log complaints from the application teams. Humio has a vastly better user experience than the ELK solution we were previously using,” Lobo said.

Scaling Log Management for the Future

Humio’s efficiency enabled Aruba Networks (HPE) to change the culture of how they log. Whereas previously cost and performance limits forced Aruba Networks (HPE) to be selective about what they logged, with Humio they can log anything they want. As a result, the teams are better able to find the data points they need and detect and respond to bugs and security issues. In order to expand insight into their data, they’ve continued to add new sources including HTTP Event Collector; ES Bulk API, and CloudWatch. "We increased the scale of our log management strategy tremendously, both in QA and Production, and now we use Humio to log almost everything," Lobo said. Though they are logging up to 10 TB a day, Aruba-HPE will be able to continue increasing their volume of ingested data using Humio for the foreseeable future. Humio is tested to be able to ingest over 100 terabytes a day on only 25 nodes. Combined with Humio’s affordable unlimited ingest plan, Aruba has the freedom to scale up to hundreds of terabytes a day. Learn more about Humio’s scalability by reading the

100 terabyte benchmark.