Hey everyone, I've been looking into Sumo Logic's incident management features. I'm coming from a basic SaaS background, mostly using tools like Trello and spreadsheets for tracking.
I see Sumo Logic can integrate with PagerDuty, but it also has its own alerting and investigation workflows. For those using it, how do you decide what to handle directly in Sumo Logic versus pushing to PagerDuty? Is it just about who gets paged, or are there real differences in the workflow? Curious about the practical split.
Hey there, I'm a platform lead for a mid-sized fintech where I handle our whole observability and on-call setup. We run about 200 services, and in production I've got Sumo Logic ingesting logs from our entire Kubernetes stack and PagerDuty handling the actual pager rotations.
Here's how we split the work, based on some hard lessons:
1. **Alert Origination and Enrichment**: Sumo Logic wins here. You create monitors that can query terabytes of logs in seconds. The key detail is you can attach the exact log query results and a snapshot of a dashboard to the alert payload sent to PagerDuty. That saves our on-call engineer 5-10 minutes of manual digging before they even understand the problem.
2. **Deduplication and Noise Reduction**: PagerDuty is strictly better. Sumo Logic's incident management can group alerts, but PagerDuty's event intelligence rules are more granular. We saw a 40% reduction in duplicate pages after letting PagerDuty handle correlation from multiple Sumo Logic monitors, using fields like the cluster name and error signature.
3. **On-Call Scheduling and Escalations**: This is 100% PagerDuty. Sumo Logic doesn't have a real scheduling calendar, overrides, or escalation policies. For us, that's a non-negotiable requirement for a team of 25 engineers across 3 time zones.
4. **Cost and Licensing Model**: They charge for entirely different things. Sumo Logic costs are based on daily GB ingested (we're in the $1.50/GB range). PagerDuty is per user on the schedule (we pay about $25/user/month for the Business tier). The hidden cost is if you try to use Sumo Logic for human alerting without PagerDuty; you'll burn through your data volume fast with frequent query-based monitors, and you still need a separate scheduling tool.
5. **Post-Incident Workflow**: We use both. The incident is declared and managed in PagerDuty (calls, bridge, status updates). Once resolved, we use a PagerDuty webhook to send the entire incident timeline and final notes back into a Sumo Logic Dashboard as a log event. This ties the operational response directly to the metric/log data for later review.
My pick is to use both, integrated. Sumo Logic is your investigation and diagnostic engine, and PagerDuty is your human coordination and response engine. If you absolutely had to choose one, tell us your monthly log volume and whether you have a formal, tiered on-call schedule with more than 5 people.
buyer beware, but buy smart
Great breakdown. That point about deduplication is huge - we saw similar noise reduction by letting PagerDuty handle correlation based on service tags. Saved our team from alert fatigue big time.
One caveat on your first point: we found that over-enriching the alert payload from Sumo Logic can sometimes backfire. If you're attaching a massive log snapshot, it can slow down the initial PagerDuty mobile notification. We had to learn to be selective, sending just the key error line and a link to the full context in Sumo.
Curious, have you played with using PagerDuty's response plays to automatically create a Sumo Logic investigation note? That's been a game-changer for our post-mortems.
Always A/B test.