Observability is an attribute of a system that measures its ease of understanding and diagnosis, whereas traditional monitoring focuses on collecting and analyzing specific predefined metrics and events. To better explain the distinction between the two, let’s break down the key differences.
1. **Granularity**: Observability allows you to inspect all aspects of a system’s behavior rather than just relying on pre-defined metrics and alerts. In contrast, monitoring is a predefined view of your system based on what you have configured to collect and alert.
2. **Exploratory nature**: Observability supports ad-hoc, unspecific queries, allowing you to explore the system’s health as needed. In monitoring, you create instruments to track specific pieces of information, and analysis is limited to those collected metrics.
3. **Failure domain**: Monitoring focuses on detecting failures within a predefined boundary, while observability seeks to uncover issues beyond the known boundaries. Observability enables more proactive debugging when issues arise.
To elaborate on observability, it includes three key components known as the three pillars of observability:
1. **Logs**: Immutable records that store an event’s data and context. Logs capture raw data and offer historical context for analysis.
2. **Metrics**: Time-series data representing aggregated values of a specific variable over a time window. They are numerical values that provide high-level, lightweight system health indicators (e.g., CPU usage, memory consumption, request rate).
3. **Traces**: A record of the end-to-end journey of a single request, including all services and components involved, to understand the latency and flow of a distributed system. Traces are particularly important for microservices-based systems.
In mathematical terms, the equation for observability can be represented as:
Observability = Logs + Metrics + Traces
To visualize the difference between observability and traditional monitoring, consider the following chart:
+-------------------+-----------------+----------------+
| | Monitoring | Observability |
+-------------------+-----------------+----------------+
| Data collection | Pre-defined | Dynamic |
| | metrics & events| |
+-------------------+-----------------+----------------+
| Granularity | Coarser | Finer |
+-------------------+-----------------+----------------+
| Failure domain | Known issues | Beyond known |
| | and boundaries | boundaries |
+-------------------+-----------------+----------------+
| Queries | Specific, known | Ad-hoc, |
| | queries | unspecific |
+-------------------+-----------------+----------------+
| Components | Metrics only | Logs, Metrics, |
| | | Traces |
+-------------------+-----------------+----------------+In summary, observability is a proactive approach to understanding your system’s internal state, while traditional monitoring is a reactive approach based on predefined data collection. Observability focuses on diagnosing complex systems through the combination of logs, metrics, and traces, which allows for a more comprehensive view and understanding of the overall system health.