Metrics, Info and Safe Exposure
Members complain that borrowing feels slow on Monday mornings. Is it the database, the memory, or just more people? Guessing is expensive. Actuator's metrics give you numbers, its info endpoint tells you exactly which build is running, and a few careful settings make sure only the right people can see any of it.
The rule
Measure with metrics, label with info, and guard everything that is not health.
Metrics. Actuator uses Micrometer, a measuring library that works like a logging facade for numbers. Boot records many metrics for you: jvm.memory.used, http.server.requests (count and timing per endpoint), hikaricp.connections.active for the database pool, and more.
GET /actuator/metrics/http.server.requests?tag=uri:/books/{id}/borrowTags narrow a metric down, here to one endpoint. You can also count your own events:
@Service
public class LoanService {
private final Counter borrowed;
public LoanService(MeterRegistry registry /*, other dependencies */) {
this.borrowed = Counter.builder("library.loans.created").register(registry);
}
public Loan borrow(long bookId, long memberId) {
// ... create the loan ...
borrowed.increment();
return loan;
}
}In production you rarely read /actuator/metrics by hand. Add a registry such as micrometer-registry-prometheus and a monitoring system collects the numbers from /actuator/prometheus for graphs and alerts.
Info. /actuator/info tells you which build is running. Add the build-info goal of the Boot Maven plugin (or springBoot { buildInfo() } in Gradle) and it shows the version and build time; set management.info.env.enabled=true and any info.* property appears too.
Loggers. /actuator/loggers shows log levels, and a POST can change one while the app runs, for example turning com.example.library up to DEBUG for ten minutes.
Guarding it. Health (without details) is safe to share. Most other endpoints reveal internals: env shows configuration, heapdump contains raw memory, loggers can change behaviour. Expose only what you use, and protect the rest with Spring Security:
http.authorizeHttpRequests(auth -> auth
.requestMatchers(EndpointRequest.to(HealthEndpoint.class)).permitAll()
.requestMatchers(EndpointRequest.toAnyEndpoint()).hasRole("OPS")
.anyRequest().authenticated());The shortcut
For each endpoint, decide who needs it: the platform (health), the monitoring system (prometheus or metrics), or an operator (everything else). Expose only those, and give each audience the least access that works.
List the needs
The platform needs health; monitoring needs prometheus; engineers want info and loggers.
Drills
Answer fast — trust the rule.
Which library does Actuator use to record metrics?
Which metric tells you how long requests to each endpoint take?
Why is exposing /actuator/heapdump to the internet dangerous?
How can an engineer switch com.example.library to DEBUG logging without restarting?
Remember
- Measure with metrics, label with info, and guard everything that is not health.
- For each endpoint ask "who needs it?" and give that audience only what it needs.
- Trap:
env,heapdumpandloggersopen to the world.