Logs are a way to inject metrics into your measurement system — they satisfy the "build custom metrics" requirement. Nearly everything (web servers, databases, mail servers, load balancers, firewalls, syslog) can log, and that log stream is a time series waiting to be counted. Two concrete uses: - **Spike forensics** — when a graph shows a resource jump, drill into access/error logs to find the exact moment and cause. Logs make problem identification easier. - **Derived metrics** — databases can log queries over a time threshold (find slow queries); at Flickr they counted web-server error and access log lines per minute and fed those counts into Ganglia graphs. The principle: a log isn't just a debugging artifact, it's a record of past behavior you can turn into a measured metric and trend. --- *Source: [[The Art of Capacity Planning]] (John Allspaw, O'Reilly 2008) — Ch 3 — Measurement: Units of Capacity*