“We needed someone who would sit with our administrators and wire the first collectors properly, not hand us a slide deck. The sessions were dense, and we still had to finish two firewall sources ourselves after handoff, but the runbook made that finishable.”
Client stories
Specific notes from administrators and operations leads who used Page Spruceway for log monitoring setup, assessment, or alerting work.
“The coverage map showed we had almost nothing useful from our VPN concentrators. That single finding changed our setup order more than any generic checklist we had tried.”
“Our on-call channel had gone quiet because nobody trusted the noise. After the review we page on fewer rules, and people actually answer them.”
“The half-day walkthrough used our own staging collectors. I left knowing how to confirm a source had gone silent without waiting for a user complaint.”
“Storage sizing was the part I had been guessing at. Their retention schedule matched what we can afford on our object store and still kept three weeks hot for investigations.”
Longer engagements
Regional logistics firm, Cape Winelands
Forty hosts across warehouse and office sites needed a single place to review authentication and application errors.
Discovery showed mixed syslog and file-based application logs with no shared retention. Over three weeks we co-built collection for identity systems and the warehouse application tier, set a three-week hot window, and left a weekly collector checklist with the on-site administrator. Firewall sources were scheduled for a later phase once alert noise settled.
Professional services practice, Breede Valley
A small team had turned on a trial collector and was unsure what was actually covered.
The assessment mapped eight critical gaps, including mail gateway and remote access appliances. A follow-on alerting review reduced page-worthy rules from dozens of noisy warnings to a short administrative set with triage notes. The practice now reviews silent sources every Monday morning.