How to Monitor Fastly CDN Logs with Sumo Logic

In the last post, we talked about the different ways to monitor Fastly CDN log and why it’s crucial to get a deeper understanding of your log data through a service like Sumo Logic. In the final post of our Fastly CDN blog series, we will discuss how to use Sumo Logic to get the most insights out of your log data — from how to collect Fastly CDN log data to the various Sumo Logic dashboards for Fastly.

=========

Fastly CDN improves the performance of your web properties by bringing the content closer to your users without exhausting your resources. With the sheer amount of traffic coursing through Fastly’s data centers, there is a wealth of log data you can analyze to give you in-depth insight into the performance of your web properties. It’s said that you can’t improve what you don’t measure, and Sumo Logic helps you do just that with your Fastly logs. Sumo Logic helps you optimize Fastly CDN configurations, and uncover and address sub-optimal performance issues that ruin user experience.

Introduction to Sumo Logic

Sumo Logic is an enterprise-grade cloud-based service that collects, manages, and analyzes all of your log data. With Sumo Logic, you get actionable insights quickly through a simple to use web interface which can be set up in a matter of minutes. You can identify and address performance and security issues in real-time across your IT infrastructure, including web properties delivered through CDNs. Sumo Logic gives you the power to analyze and correlate data in real-time.

Fastly CDN Integration Overview

Sumo Logic gives you the power to analyze Fastly CDN logs and correlate them with origin data in real-time to monitor your apps, identify patterns, and improve security. Here are three benefits of using the Sumo Logic App for Fastly:

• Get the most out of Fastly’s data
  

While Fastly provides a great service, you can only benefit from enhancing it through Sumo Logic by measuring Fastly’s service level, using unified logs and metrics to improve your security posture, and monitoring your WAF.

• Identify patterns, suspicious behavior, and security threats

Sumo Logic’s App for Fastly allows you to track user behavior and easily identify patterns of suspicious activity before they start impacting the experience of your end-users and the performance of your applications.

• Quick data visualization and in-depth insight through dashboards

Sumo Logic’s pre-made dashboards are easy to set up and can give you actionable insights into your Fastly logs--in real-time.

How to Collect Fastly CDN Logs

Fastly makes it very easy to get access to your log data. For Sumo Logic, Fastly delivers log data by submitting HTTPS requests to Sumo Logic. Sumo Logic, in turn, collects the requests as they are pushed from Fastly. Each HTTPS request contains a JSON document that identifies a set of log data as well as describes one or more log entries.

Setting up Sumo Logic’s Hosted Collector for Fastly is very simple. Here are the steps:

Step 1: Add a Sumo Logic Hosted Collector for Fastly to your Sumo Logic Org

1. In Sumo Logic, select Manage Data > Collection > Collection.
2. Choose Add Collector.
3. Choose Hosted Collector.
4. In the Add Collector dialog box, input the Name, Description, Category, and Time Zone for the Hosted Collector.
5. The Assign to a Budget field allows you to assign an ingest budget to the Collector. From the dropdown menu, choose the budget you want the Collector to be assigned to.

After saving, the new Hosted Collector will appear on the Collection page.

Step 2: Configure an HTTP Source for Fastly request logs

1. In Sumo Logic, go to Manage Data > Collection > Collection.
2. In the Collection page, click Add Source next to the Hosted Collector you’ve just created for Fastly.
3. Select HTTP Logs & Metrics.
4. Input a Name for the Source. This will be the name displayed within the Sumo web app. Description is optional.
5. Fill out Source Host and Source Category. Take note of what you set for Source Category because it will be required when you install the Fastly app. Use a descriptive and easy to remember name like fastly.
6. Configure the Advanced settings according to your needs.
7. When done, click Save. A dialog box with the URL associated with the source will be displayed.
8. Keep the HTTP Source URL for the next step.

Step 3: Configure endpoint in Fastly for CDN logs

For this step, you will add Sumo Logic as a logging endpoint in Fastly. This will allow Sumo to receive CDN logs.

1. Log in to Fastly and click the Configure link.
2. From the service menu, select the appropriate service.
3. Go to Configuration > Clone active. The Domains page will appear.
4. Click Logging and a page with logging endpoints will appear.
5. Choose Sumo Logic.

A dialog box named Create a Sumo Logic endpoint will appear.