Monitor and troubleshoot logs in real-time with Sumo Logic’s Live Tail

Troubleshooting production logs shouldn’t be a hassle. Developers and IT operations need real-time insights without jumping between tools or manually sifting through endless log files.

Sumo Logic Live Tail simplifies this process. You can instantly search, filter, and troubleshoot log tails in real-time within a single interface to get the data you need without logging into business-critical applications.

The need for Live Tail

DevOps teams usually go by the mantra “release faster and automate more.” But these frequent release cycles often lead to more troubleshooting in production. And troubleshooting applications in production isn’t always easy.

Without Live Tail, developers are often stuck with a slow, manual process:

• Drop into the terminal to access logs
• SSH (Secure shell) into the environment, if they even have access
• Tail a log file, also known as tail -f, to determine the system’s current state
• If the issue isn’t apparent, they’d have to tail -f logs, dump them into a file, and grep through log data for specific patterns

This can be a largely time-consuming process. Combine that with juggling multiple tools — one for live tailing logs and another for log management — switching between different interfaces just to get a full picture of what’s happening becomes inefficient and slows down response times.

Benefits of Sumo Logic Live Tail

With Live Tail, you can:

• Troubleshoot production logs in real-time: Don’t worry about logging into business-critical applications just to diagnose an issue. Use Sumo Logic Live Tail to instantly view and analyze log streams so you can monitor log output, log entries, and log groups in a centralized UI. Plus, seamlessly switch between Live Tail and Search without toggling between tools to troubleshoot faster.
• Save time requesting and exporting log files: Accessing production log files can be a hassle, especially when sensitive data is involved, and admins are reluctant to grant access. Rather than waiting for access or manually exporting logs, Live Tail gives you access to your log files when you need it. You can see your most recent logs, analyze them in context, securely share logs via email during outages, and set up searches based on Live Tail results, all within Sumo Logic.
• Consolidate tools and reduce costs: Using multiple tools for log management, monitoring, and troubleshooting isn’t only inefficient, it’s expensive. Live Tail eliminates the need for multiple solutions by allowing you to troubleshoot logs directly from the Sumo Logic user interface or command line interface without investing into additional software licenses.

Getting started with Live Tail

To start using Live Tail, enter the name of the _sourceCategory, _sourceHost, _sourceName, _source, or _collector of the log you want to tail in Sumo Logic. You can also apply filters to refine your results. Once you’ve entered your criteria, click Run to initiate the search query, which will open a Live Tail session similar to what’s shown below.

A Live Tail session.

To find a specific log message, error, exception, and other key log events within a log stream, filter by keywords. Add your keywords to the Live Tail query and click Run or press Enter. The search will automatically update, highlighting matching keywords in incoming log messages to make them easier to spot. The screen will clear, and new results will scroll in real time.

Using Keyword highlighting to quickly locate items in the log stream.

To highlight specific keywords in your running Live Tail session:

1. Click the A button to open the keyword highlighting dialog.
2. Enter the term you’d like to highlight.
3. To highlight multiple items, separate them with spaces and press Enter after each use.
4. Live Tail will automatically assign different colors to each keyword, making them easy to distinguish in the log stream. You can highlight up to eight keywords at a time, helping you identify critical patterns and log events.

Get a complete view with multi-tail

A single log file often doesn’t tell the whole story. With Live Tail’s multi-tail feature, you can monitor multiple logs simultaneously for a broader and more complete view of system behavior.

For example, after a database reboot, you might need this feature to confirm that the application is querying the database to ensure the reboot was successful. Or, if an error occurs, you can use multi-tail to check multiple servers to determine if the issue is isolated or widespread.

To begin using multi-tail:

1. Start a second Live Tail session from the Sumo Logic Live Tail or Search page. This opens in split-screen mode and streams 300-400 messages per minute.
2. Open or “pop out” a running Live Tail session into a separate browser window to monitor logs on another screen or track activity independently while continuing work in Sumo Logic.

Multi-tailing in split-screen mode

Try Sumo Logic Live Tail today

Reduce the time spent searching for log events and eliminate the need for separate solutions with Sumo Logic Live Tail. Gain real-time visibility, troubleshoot faster, and analyze log data all in one centralized interface.

Start managing your logs more efficiently. Try it now with our 30-day free trial.