![Helping Non-Security Stakeholders Understand ATT&CK in 10 Minutes or Less [VIDEO]](https://assets.crowdstrike.com/is/image/crowdstrikeinc/video-ATTCK2-1)
![Qatar’s Commercial Bank Chooses CrowdStrike Falcon®: A Partnership Based on Trust [VIDEO]](https://assets.crowdstrike.com/is/image/crowdstrikeinc/Edward-Gonam-Qatar-Blog2-1)
![Endpoint Protection and Threat Intelligence: The Way Forward [VIDEO]](https://assets.crowdstrike.com/is/image/crowdstrikeinc/GK-Blog_Images-1)
This blog was originally published May 4, 2021 on humio.com. Humio is a CrowdStrike Company.
The concept of observability goes back many, many years. Engineers used observability to understand the complex analog systems that were built to send rockets into space and to predict and understand failures. Today, DevOps, ITOps, and SecOps use observability in much the same way—to predict and understand system failures. Still, observability is a complex concept that can be difficult to grasp.
In Session Five of our Advanced Log Management Course, we take a
deep dive into complete system observability through log data. I offer a number of ways to think about observability. Here they are, along with some additional resources for further learning.
1. Observability is the knowledge of how your users, systems and applications are interacting at a given period of time.
Gone are the days when we had a CGI application running on one of five Apache web servers in the data center down the hall. Today’s systems are highly complex. I have containers running inside Kubernetes, for example, and my Kubernetes setup has 500 servers in the cloud. I don’t necessarily care about one server’s CPU or memory usage. I care about the overall system and how any one component may affect my application. I need to understand what’s going on across the system at any given period of time.2. Observability is an attribute of a system that encompasses many others, such as: functionality, performance, testability, maintainability and monitorability.
Each of these areas require specific attention and will be different for every business. Products should be built from the beginning with these attributes in mind and the implementation be standardized across the organization. Humio CEO Geeta Schmidt along with Mirko Novakovic, CEO of Instana, and Steve Newson, CTO of Starling Bank, share some insights on these various attributes in an executive roundtableblog post
and
on-demand webinar.
3. Observability is the ability to react to problems and have the context to respond based on outside observations.
It’s important to have contextual information to understand what is going on with an application. It’s no longer about just the application itself. There are many other signals you need to be aware of. Understanding context requires collecting more data and understanding the relationships between them. You can learn more about the need to collect all data forobservability and security in our blog post on proactive detection.
4. Observability is a practice focused on the consumer of your service that starts with empathy for the user.
It all comes down to the user experience. Users don’t care how many servers you have or how you do deployments. All they care about is whether the application is working. To understand and remediate issues for a particular user, you need to correlate a lot of different data that provides that observability.5. Observability is adopting the right systems and implementation to know how your system is feeling about any request for any user.
Observability doesn’t just happen. You need to architect your environment to enable observability into the user’s interactions with the system. This includes adopting the tools that enable observability, such as a log management solution that can collect and stream log data in real time. Learn more aboutchoosing observability tools to maximize value.
6. Observability is having the ability to know why the needle is oriented a particular way in the haystack.
Making your systems observable will provide you with the contextual data to determine and remediate the complex issues that arise when running ephemeral distributed systems. These insights can help you avoid new problems when troubleshooting and understanding issues in the future.7. Observability is a cultural facet of your organization — not something that’s restricted to the engineering or infrastructure departments.
Observability’s value goes beyond SecOps, DevOps, and ITOps. A lot of the data you collect to achieve observability isn’t just valuable for monitoring. It’s also valuable for the business as well. Humio’s CEO Geeta Schmidt dives further into this in her blog,The top five ways logging everything will change your organization. If you’re interested in learning more about logging everything to achieve observability, you can view the session of our Advanced Log Management Course,
Cost vs. Scale – The Industry Has it Wrong,
on demand now.
