AutoGineer
Generated banner for Spring Observability
Generated logo for Spring Observability

Spring Observability

GitHubOfficialFirst committed by jduboisDistributed by GitHub

  • Skill
  • Tool integration
  • Software development
  • MIT
  • No issues found
Download ZIP

From the author

Add and review observability in Spring Boot 3/4 apps: Actuator exposure and health probes, Micrometer metrics, Observation API, OpenTelemetry tracing and OTLP/Prometheus export, structured logging with correlation ids, and safe use of heapdump/threaddump. Use when instrumenting, monitoring or troubleshooting a Spring Boot service.
— the description by jdubois

AutoGineer summary

Written by AutoGineer from the skill’s own files, not by the author

This skill provides a structured approach to implementing observability in Spring Boot 3 and 4 services. It covers the configuration of Actuator endpoints, health probes, Micrometer metrics, OpenTelemetry tracing, and structured logging. It emphasizes security best practices, particularly regarding the exposure of sensitive endpoints like heapdump and threaddump, and provides guidance on integrating these tools to monitor and troubleshoot production services effectively.

What it does

  • Configures Spring Boot Actuator endpoints and health probes for Kubernetes and general environments.
  • Sets up Micrometer metrics with Prometheus or OTLP export.
  • Implements OpenTelemetry tracing and the Observation API for distributed request tracking.
  • Enables structured logging with correlation IDs for improved log analysis.
  • Provides security guidelines for exposing and protecting sensitive management endpoints.
  • Offers best practices for safe runtime diagnosis using heap and thread dumps.

When to use it

  • When instrumenting a new Spring Boot service for production monitoring.
  • When configuring health checks and liveness/readiness probes for containerized deployments.
  • When setting up distributed tracing to debug microservice interactions.
  • When auditing existing Spring Boot applications for secure observability configurations.
  • When troubleshooting performance issues using metrics and runtime diagnostics.

Advantages

  • Ensures consistent observability patterns across Spring Boot services.
  • Promotes secure-by-default configurations for sensitive management endpoints.
  • Provides clear guidance on avoiding common pitfalls like high-cardinality metrics.
  • Aligns with modern standards like OpenTelemetry and Micrometer.
  • Helps maintain production stability through proper health probe configuration.

Usage examples

“How do I expose Prometheus metrics in my Spring Boot 3 application?”
The agent provides the necessary dependency configuration and the management.endpoints.web.exposure.include property to safely expose the prometheus endpoint.
“What is the secure way to enable heap dumps for troubleshooting?”
The agent explains the risks of heap dumps, provides the configuration to restrict access to an admin role, and emphasizes using a separate management port.

Install

  1. Download the skill as a ZIP:

    https://mp-staging.autogineer.com/agent-skills/github/spring-observability/download

  2. Unzip it into the cross-client skills folder of your project:

    mkdir -p .agents/skills && unzip spring-observability.zip -d .agents/skills

Documentation by jdubois

Spring Boot observability

Covers Actuator, Micrometer, the Observation API, tracing, and logging. Details in references/. For JDK-level diagnosis (thread dumps, JFR, heap analysis) see the java-diagnostics skill; for securing endpoints see spring-security.

Safety rules

  • Never read or print secrets (.env, credentials, tokens) while inspecting configuration or /actuator/env.

  • Never expose heapdump or threaddump over public HTTP. The only exception is a temporary, user-consented window with authentication, TLS and network restriction, removed afterwards (same policy in java-diagnostics).

  • Never expose env, configprops, loggers, or shutdown in production without authentication and network restrictions.

  • Pin dependency versions via the Boot BOM; do not add explicit versions for Boot-managed artifacts.

Detect first

Check the Boot version (3.x or 4.x) and what is already present (spring-boot-starter-actuator, micrometer-registry-*, tracing/OTel dependencies, logback-spring.xml). Boot 4 modularized observability (spring-boot-micrometer-*, spring-boot-opentelemetry) but starters still bring them in.

Quick start

<dependency>
  <groupId>org.springframework.boot</groupId>
  <artifactId>spring-boot-starter-actuator</artifactId>
</dependency>
management:
  endpoints:
    web:
      exposure:
        include: health,info,prometheus   # allow-list, never "*" in production
  endpoint:
    health:
      probes:
        enabled: true                     # /actuator/health/liveness and /readiness
      show-details: when-authorized

Topics

Checklist

  • [ ] Only needed endpoints exposed and secured; separate management port if possible.

  • [ ] Liveness/readiness probes configured for the platform (Kubernetes); readiness group includes critical dependencies only.

  • [ ] Metrics exported to the chosen backend; common tags (application, env) set; no high-cardinality tags (user ids, URLs with ids).

  • [ ] Tracing sampling probability set deliberately (Boot default 10%).

  • [ ] Logs carry trace/span ids; JSON structured logs in production.

  • [ ] Custom observations/metrics have tests.

Local runtime insights (optional)

For a local-only developer console (and an opt-in MCP server) that shows a running Spring Boot or Quarkus app's runtime state, see BootUI: https://github.com/jdubois/boot-ui and https://www.julien-dubois.com/boot-ui/. Its agent skill can be installed with gh skill install jdubois/boot-ui skills/bootui.

  • Ask the user for consent before adding any dependency.

  • Use it only in a dev/local profile (for example a Maven/Gradle profile or developmentOnly configuration); never ship it to production.

  • Follow BootUI's own documentation for coordinates and setup rather than copying them here.

See also: https://docs.spring.io/spring-boot/reference/actuator/observability.html and https://docs.micrometer.io/micrometer/reference/.

Files

references/tracing-observation.md

Observation API and tracing

Observation API

One instrumentation point produces metrics and traces (Micrometer Observation).

@Service
class OrderService {
    private final ObservationRegistry registry;
    OrderService(ObservationRegistry registry) { this.registry = registry; }

    Order place(Order o) {
        return Observation.createNotStarted("order.place", registry)
            .lowCardinalityKeyValue("channel", o.channel())      // metric + span tag
            .highCardinalityKeyValue("order.id", o.id())         // span tag only
            .observe(() -> doPlace(o));
    }
}

Or annotate with @Observed(name = "order.place") and register an ObservedAspect bean (needs spring-boot-starter-aop/AspectJ on the classpath; Boot 4 names it spring-boot-starter-aspectj). Customize via ObservationFilter, ObservationPredicate, and ObservationConvention beans.

Tracing with OpenTelemetry

Boot 3.x (bridge to the OTel SDK):

  • io.micrometer:micrometer-tracing-bridge-otel and io.opentelemetry:opentelemetry-exporter-otlp (versions managed by Boot).

Boot 4.x:

  • org.springframework.boot:spring-boot-starter-opentelemetry (documented as the OpenTelemetry starter for traces, metrics, logs via OTLP). Zipkin: spring-boot-starter-zipkin.

  • Modular artifacts exist (spring-boot-micrometer-tracing-opentelemetry, spring-boot-opentelemetry), but prefer starters. Verify names against your Boot version's reference docs.

management:
  tracing:
    sampling:
      probability: 1.0        # default 0.1; use 1.0 only in dev/test
  # Boot 3.5:
  otlp:
    tracing:
      endpoint: http://localhost:4318/v1/traces
  # Boot 4.0 (replaces the block above):
  # opentelemetry:
  #   tracing:
  #     export:
  #       otlp:
  #         endpoint: http://localhost:4318/v1/traces
spring:
  application:
    name: orders               # becomes service.name

  • Propagation defaults to W3C traceparent; management.tracing.propagation.type can add B3.

  • Auto-instrumented: Spring MVC/WebFlux and RestClient, RestTemplate, WebClient built from the injected builders. JDBC needs additional instrumentation such as datasource-micrometer.

  • Messaging observations require an explicit opt-in. For Kafka, enable both spring.kafka.template.observation-enabled=true and spring.kafka.listener.observation-enabled=true (both default to false) to create producer/listener spans and propagate tracing context. For RabbitMQ or another messaging technology, check its version-specific template/listener observation settings rather than assuming tracing dependencies enable them.

  • Local backends: Zipkin, Jaeger, or Grafana LGTM via Testcontainers/spring-boot-docker-compose in dev only.

  • Do not put PII or secrets in span attributes.

Requirements and compatibility

Written for: GitHub Copilot

Works with: Claude Code, Claude apps, OpenAI Codex, GitHub Copilot, Cursor, Gemini CLI, Kiro, OpenCode, Goose, Amp, Roo Code, JetBrains Junie, Factory Droid, Devin (ex-Windsurf), Mistral Vibe, OpenHands, Letta

“Works with” means the tool reads the open Agent Skills format; a skill written for one tool may use features others lack.

Needs: Needs an MCP server

Security

No issues found by our static scan· No issues found

A static scan is not a guarantee. Skills are third-party content: review a skill before you let an agent use it.

Attribution and licence

First committed by
GitHub avatar of jduboisjdubois
Publisher
GitHub (Official)
Distributed by
GitHub
Source
github/awesome-copilot · skills/spring-observability · commit 797337f
Licence
MIT License (redistribution allowed)
  • LICENSE (added by AutoGineer from LICENSE)
  • ATTRIBUTION.md (written by AutoGineer)
Synced
Contributors
jdubois

AutoGineer is not affiliated with or endorsed by jdubois or GitHub.

Download ZIP

The ZIP holds the skill’s files, its licence files and an ATTRIBUTION.md. Download spring-observability.zip