System Design Fundamentals

0% completed

Monitoring and Observability

On This Page

Metrics

Logging

Distributed Tracing

Alerting and Anomaly Detection

Visualization and Dashboards

Using the Signals Together

Key Takeaways

Practice Questions

At 2 PM, the support team gets messages from users: "Checkout is not working." The engineers look at their servers. All 40 servers are running, and CPU use looks normal.

So where do they start? One request passes through many services on many machines. No single machine has all the information.

This lesson answers two questions. How does a team learn that something is wrong? And how does it find out why?

Monitoring and Observability

The two words are often used as if they mean the same thing. They do not.

Monitoring means watching predefined metrics and limits, so the team learns that something is wrong. For example, the error rate went above a limit, or a disk is almost full. Monitoring answers the questions the team knew to ask in advance.

Observability is a property of the system. It describes how well the system's outputs let you explain a problem that nobody expected. Those outputs are mainly metrics, logs, and traces.

Here is the difference in one example. A monitored system tells you that 6 percent of checkouts are failing. An observable system also lets you follow one failing request, step by step, and find out why it failed.

Monitoring is something you do. Observability is something the system has. Metrics and alerts give you monitoring. Adding traces and central logs gives you observability: the ability to ask new questions without writing and deploying new code first.

The work splits into five parts. Three of them are signals that the system produces. The other two are tools that use those signals.

Metrics, traces, and logs are the signals a system produces, and alerts and dashboards are the tools that use them

Metrics

Metrics are numbers that measure the performance, health, and behavior of a system. The most common ones are latency, throughput, error rate, and resource use, like CPU and memory.

A metric is stored as a time series, which is the same measurement recorded again and again over time. For example, the system records the checkout error rate every 10 seconds. Graphs of these values show trends, like errors slowly rising after a release.

There are three common types of metrics.

Counter. A number that only goes up, like the total number of requests since the service started. The rate of change gives useful values, like requests per second.
Gauge. A number that goes up and down, like memory in use or the number of jobs waiting in a queue.
Histogram. A count of values in ranges, like how many requests took 0 to 100 ms, 100 to 250 ms, and so on. A histogram lets you calculate percentiles, like the p99 latency.

A useful starting set is called the four golden signals. It comes from Google's guidance on running large systems.

Latency. How long requests take.
Traffic. How many requests arrive, for example per second.
Errors. How many requests fail.
Saturation. How full the system is, like CPU at 90 percent or a queue that keeps growing.

Common tools to collect, store, and query metrics are Prometheus, Graphite, and InfluxDB.

Metrics show how the system is doing, but not why. A metric is a summary of many requests. It tells you the error rate went up. It does not tell you which request failed, or what happened inside it.

One warning about metrics: do not add a label (a tag attached to each measurement) with too many values, like a user ID. Each label value creates a separate time series. A metric labeled with 10 million user IDs becomes 10 million time series, and the metrics system can slow down or fail.

Logging

Logs are records of events that the parts of a system write while they run. They give a detailed view of what actually happened.

Each log line usually has a time, a log level, and a message. The level shows how important the event is, like DEBUG, INFO, WARN, or ERROR.

Logs are much easier to search when they are structured. This means each line is written as fields, often in JSON, instead of free text. Here is an example.

{"time": "14:02:17", "level": "ERROR", "service": "payment", "trace_id": "a1b2c3", "message": "card provider timeout", "duration_ms": 5003}

With fields like service and trace_id, an engineer can search for every error from the payment service, or every line that belongs to one request.

Logs are useful only when they are collected in one place. Logs spread across 50 machines are almost impossible to search during a problem. Centralized logging sends every log line to one system, where engineers can search all of them at once. Common tools are the ELK stack (Elasticsearch, Logstash, and Kibana) and Graylog.

Logs have costs too. A busy system writes a very large amount of log data, and storing it costs money. So teams keep detailed logs for a limited time, like 14 days. Also, never write passwords, card numbers, or other private data into logs.

Distributed Tracing

Distributed tracing tracks a request as it moves through a distributed system. It shows the end-to-end performance of the request, and it shows which part caused a problem.

Here is how it works.

When a request enters the system, it gets a unique trace ID.
Every service passes the trace ID to the next service, usually in a request header.
Each service records a span, which is one timed step of work. A span has the service name, a start time, and a duration.
A tracing system collects all the spans with the same trace ID and shows them together as one trace.

Here is an example. A checkout request takes 2,300 ms in total. The trace shows these spans.

The order service takes 40 ms.
The payment service takes 2,200 ms. Inside it, the call to the card provider takes 2,150 ms.
The email service takes 30 ms.

A trace of one checkout request shows that the card provider call takes 2,150 of its 2,300 ms

The trace answers the question quickly: the card provider call is slow. A metric would only show that checkout is slow on average. With logs alone, an engineer would have to match lines from every service by hand.

When an engineer needs to see the path of one slow request across many services, tracing is the right tool. It follows that single request across all services and shows the slow part.

Common tracing tools are Jaeger, Zipkin, and OpenTelemetry. OpenTelemetry is also a standard way to produce metrics, logs, and traces from your code.

Busy systems often keep only a sample of traces, like 1 in 100 requests, because storing every trace costs too much. Many systems also keep every trace for requests that failed or were very slow.

Alerting and Anomaly Detection

Alerting watches the system for unusual behavior or performance problems, and it notifies the right team when one happens. The goal is to act before users are affected.

Alerts are created in two ways.

Predefined thresholds. A person sets a rule in advance. For example, send an alert when the error rate stays above 2 percent for 5 minutes. Thresholds catch the problems you expected.
Anomaly detection. A machine learning model learns the normal pattern of a metric, like traffic that rises every weekday morning. It sends an alert when the metric moves far from that pattern. Anomaly detection can catch problems you did not expect.

A threshold rule alerts on a limit someone chose, while an anomaly model alerts when a metric leaves its normal pattern

Common tools are Grafana, PagerDuty, and Sensu. The engineer on duty usually receives the alert as a phone notification, a call, or a chat message.

Good alerts follow a few rules.

Alert on what users feel. High error rates and slow responses hurt users. High CPU alone may not, so it is often better on a dashboard than in an alert.
Every alert should need action. An alert that goes away on its own a minute later only interrupts people for no reason.
Add a time window. "Above 2 percent for 5 minutes" avoids alerts for a short spike that disappears on its own.

When a team receives too many alerts that need no action, engineers start to ignore all alerts. This is called alert fatigue, and it causes teams to miss real problems.

Visualization and Dashboards

Dashboards combine metrics, logs, and traces into graphs and tables on one screen. They show the current state of the system, so a team can decide quickly what to do. Common tools are Grafana, Kibana, and Datadog.

A good dashboard is simple. The top row shows what users feel: traffic, error rate, and latency. Lower rows show the parts that affect those numbers, like each service, the database, and the queues. A good dashboard also marks events like new releases, because many problems start right after a change.

Using the Signals Together

Each signal answers a different question. A real investigation often uses all of them, one after another. Here is the checkout problem from the start of this lesson.

The alert. The team gets an alert: the checkout error rate is 6 percent, and it is normally 0.2 percent.
The dashboard. Errors started at 14:00. Only checkout is affected, and its p99 latency rose from 400 ms to 5 seconds.
The traces. Traces of failed requests show that the payment service waits 5 seconds and then times out.
The logs. The payment service logs for those trace IDs say "connection pool exhausted". A release at 13:58 made the pool of database connections smaller.
The fix. The team rolls back, which means it returns to the previous release. The error rate drops back to 0.2 percent.

An investigation moves from the alert and the dashboard, which show that something is wrong, to traces and logs, which show why

The alert and the dashboard told the team that something was wrong. The traces and logs told the team why. That second part is what observability gives you.

Component	Question it answers	Use it when
Metrics	How is the system doing?	You want trends and totals
Logs	What exactly happened?	You need the details of one event
Tracing	What happened to this one request?	One request is slow, and you do not know where
Alerting	When should someone look?	You want to know before users tell you
Dashboards	What is the state of everything now?	You want one place to see the system

Key Takeaways

Monitoring tells you that something is wrong, using signals chosen in advance. Observability is how well the system's outputs let you explain why.
Metrics are numbers like latency, throughput, error rate, and resource use. Tools include Prometheus, Graphite, and InfluxDB.
Logs record detailed events. Structure them as fields, and collect them in one place with tools like the ELK stack or Graylog.
Distributed tracing follows one request across services with a trace ID and spans. It is the right tool for finding where one slow request spent its time. Tools include Jaeger, Zipkin, and OpenTelemetry.
Alerting uses predefined thresholds or machine-learning anomaly detection, so the team can act before users are affected. Alert on what users feel, and avoid alert fatigue.
Dashboards like Grafana, Kibana, and Datadog show the whole system in one place.

A system that runs on many machines will have problems that nobody predicted. The team that can see inside the system finds and fixes them in minutes instead of hours. The next lesson, Resilience and Error Handling, covers what a system should do when something breaks.

Practice Questions

Try each question first, then open the answer.

1. The p50 latency of checkout is 120 ms and has not changed. But some users say their checkout took 8 seconds, and the average latency graph looks normal. Which tool helps most, and why?