Monitoring with Spring Boot Actuator

1. What is Spring Boot Actuator?

Spring Boot Actuator is a sub-project of Spring Boot that adds production-ready features to your application. When you include the Actuator starter, your application automatically gets a series of built-in "endpoints" that can be exposed over HTTP or JMX. These endpoints provide a wealth of information, from application health to detailed metrics and environment properties.

To get started, you simply add the spring-boot-starter-actuator dependency to your project.

Once the dependency is added and the application is running, Actuator exposes a discovery page at the /actuator path.

As mentioned in the video, security is paramount. By default, only a minimal set of endpoints are exposed over HTTP to prevent accidental leakage of sensitive information.

To expose more endpoints for monitoring, you need to explicitly configure it in your application.yml or application.properties file.

management:
  endpoints:
    web:
      exposure:



        # Use '*' to expose all, or a comma-separated list
        # For production, be explicit: health,info,prometheus,metrics
        include: "*"

The article below provides a good overview of the most common endpoints and how to enable them.

2. The Health Endpoint: The Heartbeat of Your Service

The /actuator/health endpoint is arguably the most critical part of Actuator. It provides a simple status (UP or DOWN) that automated systems can use to determine if the application is functioning correctly. This is the primary mechanism used by load balancers and container orchestrators to perform health checks.

Spring Boot automatically provides several HealthIndicators that contribute to the overall health status. For instance:

• If spring-boot-starter-data-jpa is on the classpath, a DataSourceHealthIndicator checks the connection to your database.
• If you use Redis, a RedisHealthIndicator checks connectivity to the Redis server.
• A DiskSpaceHealthIndicator checks for adequate free disk space.

If any of these essential checks fail, the main health endpoint will report DOWN.

By default, the /health endpoint just returns the status. For debugging, you can configure it to show details from all contributing health indicators.

Custom Health Indicators

For a comprehensive health check, you often need to verify the status of dependencies that are specific to your application, such as a downstream microservice or a third-party payment gateway. You can achieve this by creating your own HealthIndicator.

A custom HealthIndicator is a Spring bean that implements the HealthIndicator interface and its health() method. This is a common requirement in microservice development and a great topic to discuss in an LLD interview.

3. Health Checks in a Containerized World: Liveness vs. Readiness

Your experience with Kubernetes is highly relevant here. Kubernetes uses two primary types of probes to manage container lifecycles, and Actuator integrates with them perfectly.

• Liveness Probe: Answers the question, "Is the application running correctly?" If this probe fails, Kubernetes assumes the application is in an unrecoverable state (e.g., deadlocked) and restarts the container.
• Readiness Probe: Answers the question, "Is the application ready to accept new traffic?" If this probe fails, Kubernetes keeps the container running but removes it from the service's load-balancing pool.

A common mistake is to put a database health check in a liveness probe. If the database goes down, all application instances will fail their liveness checks and be restarted by Kubernetes, leading to a "crash loop" that doesn't solve the underlying database issue. The correct approach is to put the database check in the readiness probe. This way, if the database is down, the instances are marked as "not ready," traffic is halted, and they are given a chance to recover once the database is back online.

Spring Boot Actuator supports this distinction through Health Groups. You can configure separate groups for liveness and readiness, including only the relevant health indicators in each.

4. Other Essential Endpoints for Monitoring

While the health endpoint is for automated checks, other endpoints are invaluable for human operators and monitoring systems.

5. Securing Actuator Endpoints

Actuator endpoints can expose sensitive operational data. Securing them is not optional.

1. Run on a Separate Port: The most effective security measure is to run the Actuator endpoints on a different port than your main application traffic. This management port can then be firewalled off from public access, allowing only internal systems (like your monitoring tools or Kubernetes's kubelet) to access it.

   management:
     server:
       port: 8081 # Separate from server.port=8080
   

2. Use Spring Security: In addition to a separate port, you should always use Spring Security to protect the endpoints. A common pattern is to permit anonymous access to the main /health endpoint (and the liveness/readiness groups) while requiring an authenticated user with a specific role (e.g., ACTUATOR_ADMIN) for all other endpoints.

Conclusion

In this lesson, we've seen how Spring Boot Actuator provides the essential tools for making an application production-ready. You are now prepared to discuss how to monitor a Spring Boot microservice, a key competency for any senior engineering role.

Here are the key takeaways for your interviews:

• Actuator's Role: It provides production-ready features for monitoring and managing applications through a series of endpoints.
• Health Checks: The /health endpoint is the cornerstone of automated health monitoring, used by load balancers and container orchestrators.
• Liveness vs. Readiness: Use Actuator's Health Groups to create distinct liveness and readiness probes, a critical pattern for reliable operation in Kubernetes.
• Custom Indicators: Implement custom HealthIndicator beans to integrate application-specific dependencies into the health status.
• Key Monitoring Endpoints: Beyond health, endpoints like /metrics, /env, and /loggers are vital for performance monitoring, configuration debugging, and live troubleshooting.
• Security is Paramount: Always secure Actuator endpoints, preferably by running them on a separate, non-public management port and using Spring Security for fine-grained access control.

In our next lesson, we will shift our focus to application security. We'll take a deep dive into the OAuth2 Authorization Code grant flow, understanding how modern applications delegate authentication and authorization to trusted providers.