Sumo Logic Cheatsheet¶

generieren

Sumo Logic ist eine Cloud-native Maschinendatenanalyseplattform, die Echtzeit-Einsichten in Anwendungs-, Infrastruktur- und Sicherheitsdaten liefert. Als Software-as-a-Service (SaaS)-Lösung ermöglicht Sumo Logic Unternehmen die Erfassung, Suche und Analyse von massiven Mengen strukturierter und unstrukturierter Daten über ihren gesamten Technologiestapel hinweg und bietet umfassende Sichtbarkeit für operative Intelligenz, Sicherheitsüberwachung und Business Analytics.

Überblick¶

Kernarchitektur¶

Sumo Logic arbeitet auf einer multi-tenanten, cloud-nativen Architektur, die für massive Skala und Echtzeit-Verarbeitung konzipiert ist. Die Plattform besteht aus mehreren Schlüsselkomponenten, die zusammenarbeiten, um umfassende Datenanalysefähigkeiten bereitzustellen.

Die Datenerfassungsschicht nutzt leichte Kollektoren, die als installierte Kollektoren auf einzelnen Systemen oder gehosteten Kollektoren eingesetzt werden können, die über HTTP-Endpunkte Daten empfangen. Diese Kollektoren unterstützen eine Vielzahl von Datenquellen einschließlich Log-Dateien, Metriken, Spuren und benutzerdefinierte Anwendungen durch APIs und Webhooks.

Die Datenverarbeitungsmaschine führt Echtzeitparsing, Anreicherung und Indexierung eingehender Datenströme durch. Die proprietäre Suchtechnologie von Sumo Logic ermöglicht eine Sub-Sekunden-Abfrageleistung über Datenblätter hinweg, während maschinelle Lernalgorithmen Muster, Anomalien und Trends in den Daten automatisch erkennen.

Schlüsselmerkmale¶

```bash

Core Platform Capabilities¶

Real-time log analytics and search
Metrics monitoring and alerting
Security information and event management (SIEM)
Application performance monitoring (APM)
Infrastructure monitoring
Compliance and audit reporting
Machine learning and predictive analytics
Custom dashboards and visualizations ```_

Datenerhebung und -quellen¶

Installierte Sammler¶

```bash

Download and install collector (Linux)¶

wget https://collectors.sumologic.com/rest/download/linux/64 -O SumoCollector.sh sudo bash SumoCollector.sh -q -Vsumo.accessid= -Vsumo.accesskey=

Install as service¶

sudo /opt/SumoCollector/collector install sudo /opt/SumoCollector/collector start

Check collector status¶

sudo /opt/SumoCollector/collector status

View collector logs¶

tail -f /opt/SumoCollector/logs/collector.log ```_

Gehostete Sammler¶

```bash

Create HTTP source endpoint¶

curl -X POST https://api.sumologic.com/api/v1/collectors//sources \ -H "Authorization: Basic " \ -H "Content-Type: application/json" \ -d '\\{ "source": \\{ "name": "HTTP Source", "category": "prod/web/access", "hostName": "web-server-01", "sourceType": "HTTP" \\} \\}'

Send data to HTTP endpoint¶

curl -X POST https://endpoint.collection.sumologic.com/receiver/v1/http/ \ -H "Content-Type: application/json" \ -d '\\{"timestamp": "2023-01-01T12:00:00Z", "level": "INFO", "message": "Application started"\\}' ```_

Datensammlung¶

```bash

Configure local file source¶

\\{ "source": \\{ "name": "Application Logs", "category": "prod/app/logs", "pathExpression": "/var/log/myapp/*.log", "sourceType": "LocalFile", "multilineProcessingEnabled": true, "useAutolineMatching": true \\} \\}

Configure remote file source¶

\\{ "source": \\{ "name": "Remote Syslog", "category": "prod/system/syslog", "protocol": "UDP", "port": 514, "sourceType": "Syslog" \\} \\} ```_

Suche Sprache und Abfragen¶

Grundlegende Suche Syntax¶

```bash

Simple keyword search¶

error

Field-based search¶

_sourceCategory=prod/web/access

Time range search¶

_sourceCategory=prod/web/access|where _messageTime > now() - 1h

Boolean operators¶

error AND (database OR connection) error NOT timeout (status_code=500 OR status_code=404)

Wildcard searches¶

error* connection user_id=12345* ```_

Erweiterte Suche Operationen¶

```bash

Parse and extract fields¶

_sourceCategory=prod/web/access |parse "* * * [] \" * \" * * \"\" \"*\"" as src_ip, ident, user, timestamp, method, url, protocol, status_code, size, referer, user_agent

Regular expression parsing¶

_sourceCategory=prod/app/logs |parse regex "(?\d\\{4\\}-\d\\{2\\}-\d\\{2\\} \d\\{2\\}:\d\\{2\\}:\d\\{2\\}) [(?\w+)] (?.*)"

JSON parsing¶

_sourceCategory=prod/api/logs |json field=_raw "user_id" as user_id |json field=_raw "action" as action |json field=_raw "timestamp" as event_time

CSV parsing¶

sourceCategory=prod/data/csv |csv _raw extract 1 as user_id, 2 as action, 3 as timestamp ```

Aggregation und Statistik¶

```bash

Count operations¶

_sourceCategory=prod/web/access |parse "* * * [] \" * *\" * *" as src_ip, ident, user, timestamp, method, url, protocol, status_code, size |count by status_code

Sum and average¶

_sourceCategory=prod/web/access |parse "* * * [] \" * *\" * *" as src_ip, ident, user, timestamp, method, url, protocol, status_code, size |sum(size) as total_bytes, avg(size) as avg_bytes by src_ip

Timeslice aggregation¶

_sourceCategory=prod/web/access |parse "* * * [] \" * *\" * *" as src_ip, ident, user, timestamp, method, url, protocol, status_code, size |timeslice 1m |count by _timeslice, status_code

Percentile calculations¶

sourceCategory=prod/app/performance |parse "response_time=*" as response_time |pct(response_time, 50, 90, 95, 99) by service_name ```

Datentransformation¶

```bash

Field manipulation¶

_sourceCategory=prod/web/access |parse "* * * [] \" * \" * *" as src_ip, ident, user, timestamp, method, url, protocol, status_code, size |if(status_code matches "2", "success", "error") as result_type |if(size > 1000000, "large", "normal") as file_size_category

String operations¶

_sourceCategory=prod/app/logs |parse "user=*" as user_id |toUpperCase(user_id) as user_id_upper |toLowerCase(user_id) as user_id_lower |substring(user_id, 0, 3) as user_prefix

Date and time operations¶

sourceCategory=prod/app/logs |parse "timestamp=*" as event_time |parseDate(event_time, "yyyy-MM-dd HHss") as parsed_time |formatDate(parsed_time, "yyyy-MM-dd") as date_only |formatDate(parsed_time, "HHss") as time_only ```

Metriken und Überwachung¶

Sammlung von Metriken¶

```bash

Host metrics collection¶

\\{ "source": \\{ "name": "Host Metrics", "category": "prod/infrastructure/metrics", "sourceType": "SystemStats", "interval": 60000, "hostName": "web-server-01" \\} \\}

Custom metrics via HTTP¶

curl -X POST https://endpoint.collection.sumologic.com/receiver/v1/http/ \ -H "Content-Type: application/vnd.sumologic.carbon2" \ -d "metric=cpu.usage.percent host=web-01 service=nginx 85.2 1640995200"

Application metrics¶

curl -X POST https://endpoint.collection.sumologic.com/receiver/v1/http/ \ -H "Content-Type: application/vnd.sumologic.prometheus" \ -d "# HELP http_requests_total Total HTTP requests

TYPE http_requests_total counter¶

http_requests_total\\{method=\"GET\",status=\"200\"\\} 1234 http_requests_total\\{method=\"POST\",status=\"201\"\\} 567" ```_

Metrics Queries¶

```bash

Basic metrics query¶

metric=cpu.usage.percent host=web-01|avg by host

Time series aggregation¶

metric=memory.usage.percent |avg by host |timeslice 5m

Multiple metrics correlation¶

(metric=cpu.usage.percent OR metric=memory.usage.percent) host=web-01 |avg by metric, host |timeslice 1m

Metrics with thresholds¶

metric=disk.usage.percent |where %"disk.usage.percent" > 80 |max by host, mount_point ```_

Alerting und Notifications¶

```bash

Create scheduled search alert¶

\\{ "searchName": "High Error Rate Alert", "searchDescription": "Alert when error rate exceeds 5%", "searchQuery": "sourceCategory=prod/web/access|parse \"* * * [] \\" * \\" * *\" as src_ip, ident, user, timestamp, method, url, protocol, status_code, size|where status_code matches \"5\"|count as error_count|if(error_count > 100, \"CRITICAL\", \"OK\") as alert_level|where alert_level = \"CRITICAL\"", "searchSchedule": \\{ "cronExpression": "0 */5 * * * ? *", "displayableTimeRange": "-5m", "parseableTimeRange": \\{ "type": "BeginBoundedTimeRange", "from": \\{ "type": "RelativeTimeRangeBoundary", "relativeTime": "-5m" \\} \\} \\}, "searchNotification": \\{ "taskType": "EmailSearchNotificationSyncDefinition", "toList": ["admin@company.com"], "subject": "High Error Rate Detected", "includeQuery": true, "includeResultSet": true, "includeHistogram": true \\} \\} ```

Sicherheit und SIEM Fähigkeiten¶

Sicherheitsanalyse¶

```bash

_sourceCategory=prod/security/auth |parse "user=* action=* result=* src_ip=*" as user, action, result, src_ip |where action = "login" and result = "failed" |count by user, src_ip |where _count > 5

Suspicious network activity¶

_sourceCategory=prod/network/firewall |parse "src=* dst=* port=* action=*" as src_ip, dst_ip, dst_port, action |where action = "blocked" |count by src_ip, dst_port |sort by _count desc

Malware detection¶

sourceCategory=prod/security/antivirus |parse "file=* threat=* action=*" as file_path, threat_name, action |where action = "quarantined" |count by threat_name |sort by _count desc ```

Threat Intelligence Integration¶

```bash

IP reputation lookup¶

_sourceCategory=prod/web/access |parse "* * * [] \" * *\" * *" as src_ip, ident, user, timestamp, method, url, protocol, status_code, size |lookup type="ip" input="src_ip" output="reputation", "country", "organization" |where reputation = "malicious"

Domain reputation analysis¶

_sourceCategory=prod/dns/logs |parse "query=* response=*" as domain, ip_address |lookup type="domain" input="domain" output="category", "reputation" |where category contains "malware" or reputation = "suspicious"

File hash analysis¶

sourceCategory=prod/security/endpoint |parse "file_hash=* file_name=*" as file_hash, file_name |lookup type="hash" input="file_hash" output="malware_family", "first_seen" |where isNotNull(malware_family) ```

Compliance und Audit¶

```bash

PCI DSS compliance monitoring¶

_sourceCategory=prod/payment/logs |parse "card_number=* transaction_id=* amount=" as card_number, transaction_id, amount |where card_number matches "****" |count by _timeslice(1h)

_sourceCategory=prod/app/audit |parse "user=* action=* data_type=* record_id=*" as user, action, data_type, record_id |where data_type = "personal_data" and action = "access" |count by user, data_type

SOX financial controls¶

sourceCategory=prod/financial/system |parse "user=* action=* amount=* approval_status=*" as user, action, amount, approval_status |where amount > 10000 and approval_status != "approved" |count by user, action ```

Dashboards und Visualisierungen¶

Dashboard Creation¶

```bash

Create dashboard via API¶

curl -X POST https://api.sumologic.com/api/v1/dashboards \ -H "Authorization: Basic " \ -H "Content-Type: application/json" \ -d '\\{ "title": "Web Application Performance", "description": "Real-time monitoring of web application metrics", "folderId": "000000000000000A", "topologyLabelMap": \\{ "data": \\{\\} \\}, "domain": "app", "panels": [ \\{ "id": "panel1", "key": "panel1", "title": "Request Rate", "visualSettings": "\\{\"general\":\\{\"mode\":\"timeSeries\",\"type\":\"line\"\\}\\}", "keepVisualSettingsConsistentWithParent": true, "panelType": "SumoSearchPanel", "queries": [ \\{ "queryString": "sourceCategory=prod/web/access|timeslice 1m|count by _timeslice", "queryType": "Logs", "queryKey": "A", "metricsQueryMode": null, "metricsQueryData": null, "tracesQueryData": null, "parseMode": "Manual", "timeSource": "Message" \\} ] \\} ] \\}' ```

Diagrammtypen und Konfigurationen¶

```bash

Time series chart¶

\\{ "visualSettings": \\{ "general": \\{ "mode": "timeSeries", "type": "line" \\}, "series": \\{ "A": \\{ "color": "#1f77b4" \\} \\} \\} \\}

Bar chart¶

\\{ "visualSettings": \\{ "general": \\{ "mode": "distribution", "type": "bar" \\} \\} \\}

Pie chart¶

\\{ "visualSettings": \\{ "general": \\{ "mode": "distribution", "type": "pie" \\} \\} \\}

Single value display¶

\\{ "visualSettings": \\{ "general": \\{ "mode": "singleValue", "type": "svp" \\} \\} \\} ```_

API Integration und Automatisierung¶

REST API Authentication¶

```bash

Generate access credentials¶

curl -X POST https://api.sumologic.com/api/v1/accessKeys \ -H "Authorization: Basic " \ -H "Content-Type: application/json" \ -d '\\{ "label": "API Integration Key", "corsHeaders": ["*"] \\}'

Use access key for authentication¶

ACCESS_ID="your_access_id" ACCESS_KEY="your_access_key" CREDENTIALS=$(echo -n "$ACCESS_ID:$ACCESS_KEY"|base64)

Test API connection¶

curl -X GET https://api.sumologic.com/api/v1/collectors \ -H "Authorization: Basic $CREDENTIALS" ```_

Suche Job Management¶

```bash

Create search job¶

curl -X POST https://api.sumologic.com/api/v1/search/jobs \ -H "Authorization: Basic " \ -H "Content-Type: application/json" \ -d '\\{ "query": "_sourceCategory=prod/web/access|count by status_code", "from": "2023-01-01T00:00:00Z", "to": "2023-01-01T23:59:59Z", "timeZone": "UTC" \\}'

Check search job status¶

curl -X GET https://api.sumologic.com/api/v1/search/jobs/ \ -H "Authorization: Basic "

Get search results¶

curl -X GET https://api.sumologic.com/api/v1/search/jobs//records \ -H "Authorization: Basic "

Delete search job¶

curl -X DELETE https://api.sumologic.com/api/v1/search/jobs/ \ -H "Authorization: Basic " ```_

Content Management¶

```bash

Export content¶

curl -X POST https://api.sumologic.com/api/v2/content//export \ -H "Authorization: Basic " \ -H "Content-Type: application/json" \ -d '\\{ "isAdminMode": false \\}'

Import content¶

curl -X POST https://api.sumologic.com/api/v2/content/folders//import \ -H "Authorization: Basic " \ -H "Content-Type: application/json" \ -d '\\{ "content": "", "overwrite": false \\}'

List folder contents¶

curl -X GET https://api.sumologic.com/api/v2/content/folders/ \ -H "Authorization: Basic " ```_

Leistungsoptimierung¶

Queroptimierung¶

```bash

Use specific source categories¶

_sourceCategory=prod/web/access # Good * # Avoid - searches all data

Limit time ranges¶

_sourceCategory=prod/web/access|where _messageTime > now() - 1h # Good _sourceCategory=prod/web/access # Avoid - searches all time

Use early filtering¶

_sourceCategory=prod/web/access |where status_code = "500" # Good - filter early |parse "* * * [] \" * *\" * *" as src_ip, ident, user, timestamp, method, url, protocol, status_code, size

Optimize parsing¶

sourceCategory=prod/web/access |parse "* * * [] \" * *\" * *" as src_ip, ident, user, timestamp, method, url, protocol, status_code, size |where status_code = "500" # Less efficient - parse then filter ```

Datenvolumenverwaltung¶

```bash

Monitor data volume¶

_index=sumologic_volume |where _sourceCategory matches "*" |sum(sizeInBytes) as totalBytes by _sourceCategory |sort by totalBytes desc

Set up data volume alerts¶

_index=sumologic_volume |where _sourceCategory = "prod/web/access" |sum(sizeInBytes) as dailyBytes |where dailyBytes > 10000000000 # 10GB threshold

Optimize collection¶

\\{ "source": \\{ "name": "Optimized Log Source", "category": "prod/app/logs", "pathExpression": "/var/log/myapp/.log", "sourceType": "LocalFile", "filters": [ \\{ "filterType": "Exclude", "name": "Exclude Debug Logs", "regexp": ".*DEBUG." \\} ] \\} \\} ```_

Fehlerbehebung und Best Practices¶

Gemeinsame Themen¶

```bash

Check collector connectivity¶

curl -v https://collectors.sumologic.com/receiver/v1/http/

Verify data ingestion¶

_sourceCategory= |count by _sourceHost, _sourceCategory |sort by _count desc

Debug parsing issues¶

_sourceCategory=prod/app/logs |limit 10 |parse "timestamp=*" as event_time |where isNull(event_time)

Monitor search performance¶

index=sumologic_search_usage |where query_user = "your_username" |avg(scan_bytes), avg(execution_time_ms) by query_user ```

Sicherheit Best Practices¶

```bash

Implement role-based access control¶

\\{ "roleName": "Security Analyst", "description": "Read-only access to security logs", "filterPredicate": "_sourceCategory=prod/security/*", "capabilities": [ "viewCollectors", "searchAuditIndex" ] \\}

Set up audit logging¶

_index=sumologic_audit |where event_name = "SearchQueryExecuted" |count by user_name, source_ip |sort by _count desc

Monitor privileged access¶

index=sumologic_audit |where event_name matches "Admin" |count by user_name, event_name |sort by _count desc ```

Leistungsüberwachung¶

```bash

Monitor search performance¶

_index=sumologic_search_usage |avg(scan_bytes) as avg_scan_bytes, avg(execution_time_ms) as avg_execution_time |sort by avg_execution_time desc

Track data ingestion rates¶

_index=sumologic_volume |timeslice 1h |sum(messageCount) as messages_per_hour by _timeslice |sort by _timeslice desc

Monitor collector health¶

sourceCategory=sumo/collector/health |parse "status=*" as collector_status |count by collector_status, _sourceHost |where collector_status != "healthy" ```

Ressourcen¶

Sumo Logic Dokumentation
[Sumo Logic Community](LINK_5__
[Search Query Language Reference](LINK_5_
(LINK_5_)
[Best Practices Guide](LINK_5

Sumo Logic Cheatsheet¶

Überblick¶

Kernarchitektur¶

Schlüsselmerkmale¶

Core Platform Capabilities¶

Datenerhebung und -quellen¶

Installierte Sammler¶

Download and install collector (Linux)¶

Install as service¶

Check collector status¶

View collector logs¶

Gehostete Sammler¶

Create HTTP source endpoint¶

Send data to HTTP endpoint¶

Datensammlung¶

Configure local file source¶

Configure remote file source¶

Suche Sprache und Abfragen¶

Grundlegende Suche Syntax¶

Simple keyword search¶

Field-based search¶

Time range search¶

Boolean operators¶

Wildcard searches¶

Erweiterte Suche Operationen¶

Parse and extract fields¶

Regular expression parsing¶

JSON parsing¶

CSV parsing¶

Aggregation und Statistik¶

Count operations¶

Sum and average¶

Timeslice aggregation¶

Percentile calculations¶

Datentransformation¶

Field manipulation¶

String operations¶

Date and time operations¶

Metriken und Überwachung¶

Sammlung von Metriken¶

Host metrics collection¶

Custom metrics via HTTP¶

Application metrics¶

TYPE http_requests_total counter¶

Metrics Queries¶

Basic metrics query¶

Time series aggregation¶

Multiple metrics correlation¶

Metrics with thresholds¶

Alerting und Notifications¶

Create scheduled search alert¶

Sicherheit und SIEM Fähigkeiten¶

Sicherheitsanalyse¶

Failed login detection¶

Suspicious network activity¶

Malware detection¶

Threat Intelligence Integration¶

IP reputation lookup¶

Domain reputation analysis¶

File hash analysis¶

Compliance und Audit¶

PCI DSS compliance monitoring¶

GDPR data access logging¶

SOX financial controls¶

Dashboards und Visualisierungen¶

Dashboard Creation¶

Create dashboard via API¶

Diagrammtypen und Konfigurationen¶

Time series chart¶

Bar chart¶

Pie chart¶

Single value display¶

API Integration und Automatisierung¶

REST API Authentication¶

Generate access credentials¶

Use access key for authentication¶

Test API connection¶

Suche Job Management¶

Create search job¶

Check search job status¶