Actuator and Observability

Introduction

When an app runs in production, you need to know whether it is healthy, how it is performing and what it is doing. Spring Boot Actuator adds production-ready endpoints for this. Add the Actuator dependency (spring-boot-starter-actuator). This lesson is written for Spring Boot 4.1.2. Property names and defaults mentioned were checked in that release's metadata, but the code was not run here.

The health endpoint

After adding Actuator, you can call:

curl http://localhost:8080/actuator/health

and receive JSON whose main field is status, for example {"status":"UP"}. By default only the health endpoint is exposed over HTTP, and details are hidden (management.endpoint.health.show-details defaults to never).

Health combines indicators: database connection, disk space and others. If one is down, the overall status becomes DOWN, and the HTTP status is 503. Load balancers and orchestrators use this.

Exposing more endpoints

management.endpoints.web.exposure.include=health,info,metrics

Useful endpoints:

Be careful: endpoints like env, heapdump and loggers can leak secrets or give attackers control. Expose only what you need, never use a wildcard (*) in production without protection, and secure Actuator behind authentication, or put it on a separate management port that is not reachable from the internet:

management.server.port=9091

Liveness and readiness

Container platforms ask two questions:

• Liveness: is the app alive, or should it be restarted?
• Readiness: is the app ready to receive traffic?

Spring Boot provides health groups for both, at /actuator/health/liveness and /actuator/health/readiness. In Boot 4.1.2 the property management.endpoint.health.probes.enabled has a default of true, so they are available. Use readiness to take an instance out of rotation during start-up or shutdown, and keep liveness simple, so a slow database does not cause endless restarts.

Metrics

Micrometer records metrics such as JVM memory, garbage collection, thread counts and HTTP request durations. View a metric:

curl http://localhost:8080/actuator/metrics/jvm.memory.used

Metrics are normally sent to a monitoring system (such as Prometheus, a cloud provider's service or a commercial tool) by adding the matching Micrometer registry dependency. Add your own metrics with MeterRegistry:

import io.micrometer.core.instrument.MeterRegistry;

@Service
public class BorrowService {

    private final MeterRegistry registry;

    public BorrowService(MeterRegistry registry) { this.registry = registry; }

    public void borrow(long bookId) {
        // ... business logic
        registry.counter("library.borrowed").increment();
    }
}

Watch: error rates, latency (especially the slow tail), traffic and saturation such as pool usage and memory. Alert on symptoms users feel.

Logging

Spring Boot logs to the console using Logback by default.

logging.level.root=INFO
logging.level.com.example=DEBUG

• Use SLF4J in code (LoggerFactory.getLogger(...)), with placeholders: log.info("Borrowed book {}", id).
• Choose levels carefully: ERROR for failures, WARN for odd situations, INFO for key events, DEBUG for detail.
• Never log passwords, tokens or personal data.
• In production, write logs to standard output and let the platform collect them.
• Boot supports structured (JSON) logging through the logging.structured.format.console property (its existence was checked in the 4.1.2 metadata). Structured logs are easier for tools to search. Check the reference for the supported format names.
• Add a correlation or request ID to follow one request across logs.

Tracing

For systems with several services, distributed tracing shows how one request flows between them. Spring Boot integrates with Micrometer Tracing and OpenTelemetry. It is a larger topic, and worth adding once you have more than one service.

Try it yourself

Add Actuator, expose health and metrics, and call both. Move Actuator to its own port. Add a counter metric to one service method and find it under /actuator/metrics.

Summary

• Actuator exposes health, metrics and other endpoints, and by default only health is exposed with details hidden.
• Expose the minimum, secure or isolate Actuator, and use liveness and readiness probes for orchestrators.
• Use metrics, careful structured logs without secrets, and tracing for multi-service systems.