Spring Boot observability

Covers Actuator, Micrometer, the Observation API, tracing, and logging. Details in references/. For JDK-level diagnosis (thread dumps, JFR, heap analysis) see the java-diagnostics skill; for securing endpoints see spring-security.

Safety rules

• Never read or print secrets (.env, credentials, tokens) while inspecting configuration or /actuator/env.
• Never expose heapdump or threaddump over public HTTP. The only exception is a temporary, user-consented window with authentication, TLS and network restriction, removed afterwards (same policy in java-diagnostics).
• Never expose env, configprops, loggers, or shutdown in production without authentication and network restrictions.
• Pin dependency versions via the Boot BOM; do not add explicit versions for Boot-managed artifacts.

Detect first

Check the Boot version (3.x or 4.x) and what is already present (spring-boot-starter-actuator, micrometer-registry-*, tracing/OTel dependencies, logback-spring.xml). Boot 4 modularized observability (spring-boot-micrometer-*, spring-boot-opentelemetry) but starters still bring them in.

Quick start