OpenTelemetry for real-time logs and metrics, SIEM log shipping and aggregation

[razakpm]

Add log file for hub-prime java application with monthly iteration and day-wise rollout. Ensure proper environment variable to use in different environments

[razakpm]

Added log file. The file name can be set using an environment variable. Implemented monthly iteration with day-wise rollout.

[shah]

@razakpm reopening this ticket to ensure we're rolling logs into our SIEM as well. Please close once that's done.

[shah]

@razakpm are logs being rolled into a SIEM? Also we need to ensure observability is possible using OpenTelemetry and tools like Jaeger.

[razakpm]

We are evaluating Wazuh (https://wazuh.com/) for SIEM protection. The custom solution they provided is not working for us. We have raised a ticket for it (https://github.com/wazuh/wazuh/issues/24557) and are waiting for a response.

Meanwhile, the team is trying to understand the documentation at https://documentation.wazuh.com/current/user-manual/ruleset/decoders/index.html to see if it will help resolve the issue.

[rinshadka]

As per the community we need to create custom decoders and rules to parse the logs and team in working on the references provided. We will update soon once we successfully parse and fetch the data.

[razakpm]

As wazuh not providing a proper solution for log view. Spring boot project normally using micrometer for observability. For log view Micrometer supports the below different monitoring systems

• Prometheus
• Graphite
• New Relic
• Datadog
• InfluxDB
• AWS CloudWatch
• Google Cloud Monitoring
• JMX
• StatsD
• Elastic (ELK) Stack
• Wavefront
• AppOptics
• VictoriaMetrics
• OpenTelemetry

As we are in AWS it seems AWS CloudWatch is better for Log Monitoring

[razakpm]

It seems Micrometer stopped publishing metrics after migration to Spring Boot 3 (https://stackoverflow.com/questions/76172912/micrometer-stopped-publishing-metrics-after-migration-to-spring-boot-3)

spring-cloud-starter-aws is not mainatained by the Spring team anymore. It is maintained by the community, see here: https://github.com/awspring/spring-cloud-aws

spring-cloud-starter-aws:2.2.6.RELEASE is neither supported nor compatible with Boot 3.x