Actuator, Metrics & Observability

Overview

Spring Boot Actuator exposes ops endpoints (health, metrics, env, beans). Micrometer is the metrics facade — it ships data to Prometheus, OTLP, etc. Spring Boot 3 aligns with Micrometer Observation for unified metrics + tracing.

Official: Production-ready Features.

Table of contents

1. Essential endpoints
2. Health indicators
3. Metrics with Micrometer
4. Tracing & log correlation
5. Securing Actuator
6. Interview questions
7. Summary

1. Essential endpoints

Most endpoints are disabled until you expose them:

management:
  endpoints:
    web:
      exposure:
        include: health, prometheus, info

2. Health indicators

HealthIndicator beans aggregate into a single status: UP, DOWN, OUT_OF_SERVICE, UNKNOWN.

Boot ships indicators for DB, Redis, Kafka, disk space, etc. — auto-detected.

Kubernetes split:

• Liveness — cheap, says “is the process alive?”. Don’t include DB.
• Readiness — “should I receive traffic?”. Include DB and other dependencies.

management:
  endpoint:
    health:
      probes:
        enabled: true

Exposes /actuator/health/liveness and /actuator/health/readiness.

3. Metrics with Micrometer

MeterRegistry is auto-configured. Built-in metrics cover JVM (heap, GC), HTTP (request count, latency), DataSource (pool stats), and more.

@Timed("orders.create")
public Order create(...) { ... }

Add micrometer-registry-prometheus → metrics become available at /actuator/prometheus for Prometheus to scrape.

4. Tracing & log correlation

ObservationRegistry (Boot 3) unifies metrics and tracing. With micrometer-tracing + Brave or OTel:

• Each request gets a traceId and spanId.
• Those IDs are placed in the MDC so they appear in your log lines.
• Downstream HTTP/Kafka calls propagate the same traceId → end-to-end correlation.

See logging/java MDC notes for the logging side.

5. Securing Actuator

management:
  endpoints:
    web:
      exposure:
        include: health, prometheus
  endpoint:
    health:
      show-details: when_authorized
  server:
    port: 9090   # separate port often used

Best practice:

• Run Actuator on a separate management port not exposed externally.
• In Kubernetes, restrict that port via NetworkPolicy.
• Never expose env, beans, configprops, heapdump to the internet.

6. Interview questions

Q: What is Spring Boot Actuator? A: A set of production-ready endpoints for health, metrics, info, and introspection — configurable per environment.

Q: Liveness vs readiness? A: Liveness — should the pod be restarted? Readiness — should it receive traffic? DB checks belong in readiness; liveness stays cheap.

Q: How do metrics reach Prometheus? A: micrometer-registry-prometheus exposes /actuator/prometheus. Prometheus pulls (scrapes) the time series.

Q: Why not expose /actuator/env publicly? A: It leaks every property, including secrets bound to the environment.

7. Summary

Next steps

• Production readiness
• Logging — MDC & trace IDs

Happy Learning

Next: Async, Scheduling & Events