Skanlog

Skanlog
Name	Skanlog
Released	2018
Developer	Nordic Data Systems
Latest release	3.4.1
Programming language	Rust, Python
Operating system	Linux, Windows, macOS
License	Proprietary

Skanlog is a proprietary log analytics and observability platform originating in Northern Europe. It integrates data ingestion, indexing, visualization, alerting and retention within a unified stack intended for large-scale telemetry from distributed systems. The product aims to compete with established logging and monitoring tools by offering low-latency indexing, schema-on-read parsing, and rule-based enrichment for infrastructure and application telemetry.

Overview

Skanlog combines components familiar from Elastic Stack, Splunk, Grafana, Prometheus, and Datadog into an integrated appliance model. The architecture supports ingestion adapters similar to Fluentd, Logstash, and Vector, while offering query primitives influenced by SQL-like DSLs and the Lucene query syntax. Endpoints expose APIs comparable to OpenTelemetry collectors and integrate with identity providers such as Okta, Azure Active Directory, and Google Workspace for access control. Vendors that evaluate Skanlog often compare feature sets against New Relic, Sumo Logic, and Honeycomb in operational observability contexts.

History

Skanlog was founded in 2017 by engineers previously employed at Spotify, Klarna, and the CERN. The initial public release in 2018 targeted enterprises in Scandinavia and the European Union, emphasizing data residency and compliance with GDPR. Later funding rounds included participation from Atomico-backed firms and angel investors with experience at Dropbox, GitHub, and Fastly. Over successive versions, Skanlog added integrations with cloud stacks from Amazon Web Services, Microsoft Azure, and Google Cloud Platform and announced partnerships with managed service providers such as Rackspace and Accenture.

Architecture and Design

Skanlog’s design follows a modular pipeline inspired by the separation of ingestion, storage, indexing, and query layers seen in Hadoop-era architectures and modern observability designs like ClickHouse and Apache Druid. The ingestion layer supports collectors modeled after Beats and Fluent Bit, while the storage backend can run on object stores offered by Amazon S3, Azure Blob Storage, and Google Cloud Storage. Indexing employs techniques reminiscent of Inverted index implementations and columnar structures comparable to Parquet and ORC file formats. Security controls follow standards promoted by ISO/IEC 27001 and integrate with certificate management systems like Let's Encrypt and HashiCorp Vault.

Features and Functionality

Skanlog provides parsing and enrichment pipelines that accept formats used by Syslog, JSON, CEF, and CEF outputs from appliances such as Cisco ASA, Fortinet FortiGate, and Palo Alto Networks firewalls. Its query language mixes features from SQL, Elasticsearch, and PromQL query paradigms, enabling time series aggregation, histogram analysis, and full-text search. Visualization dashboards mirror concepts from Grafana and Kibana, with widgets that support integration with external notification channels like Slack, Microsoft Teams, PagerDuty, and VictorOps. Advanced capabilities include anomaly detection based on models influenced by research from Google DeepMind and OpenAI benchmarking as well as retention policies that align with SOC 2 and NIST SP 800-53 recommendations.

Use Cases and Applications

Operators deploy Skanlog for centralized observability across microservices platforms such as Kubernetes, Docker Swarm, and HashiCorp Nomad. Security teams apply Skanlog for log correlation and detection engineering alongside SIEMs like ArcSight, QRadar, and Splunk Enterprise Security. Financial services and healthcare customers use Skanlog to meet compliance requirements alongside solutions from FIS and Cerner. DevOps and SRE teams integrate Skanlog into CI/CD toolchains using orchestrators and tooling such as Jenkins, GitLab CI, CircleCI, and Spinnaker.

Performance and Evaluation

Independent benchmarks have compared Skanlog to Elasticsearch/OpenSearch clusters and column-store systems like ClickHouse for throughput, latency, and storage efficiency. Performance claims emphasize sub-second query latencies for indexed events and multi-hour batch ingest rates optimized for hundreds of thousands of events per second on clusters sized comparably to deployments of Cassandra or ScyllaDB. Evaluations often cite hardware considerations like NVMe arrays used in Intel-powered nodes and network fabrics from Mellanox or Cisco Nexus switches. Stress tests reported trade-offs in write amplification and compression ratios when contrasted with Parquet-oriented analytics, and independent auditors often reference guidelines from ISO/IEC 27001 and NIST for operational validation.

Adoption and Community

Adoption of Skanlog grew through regional channel partners and systems integrators including Accenture, Capgemini, and Deloitte for enterprise digital transformation projects. The ecosystem includes a marketplace of connectors and parsers contributed by consulting firms with histories at ThoughtWorks, Puppet Labs, and HashiCorp. User education relies on documentation, training programs, and certification paths akin to Linux Foundation and Cloud Native Computing Foundation offerings. Community engagement takes place in forums and conferences alongside tracks at events like KubeCon, AWS re:Invent, Microsoft Ignite, and Google Cloud Next.

Category:Log management software