Monitoring Applications Using Spring Boot Actuator

Course: Advanced Java Training

Topic: Monitoring Applications Using Spring Boot Actuator

Course Link: Advanced Java Training – JustAcademy

Demo Link: Register for a Course Demo

Website: JustAcademy Official Website

1. Introduction to Spring Boot Actuator

Spring Boot Actuator is a Spring Boot module that provides production-ready features for monitoring and managing applications. It allows developers to inspect application health, metrics, configuration information, logging levels, and other operational details.

In real-world Java applications, it is important to know whether the application is running correctly, whether database connections are available, how much memory is being consumed, and whether HTTP requests are responding efficiently. Spring Boot Actuator simplifies these tasks by providing predefined monitoring endpoints.

Objectives of Application Monitoring

• Monitor application health and availability.
• Measure application performance and resource consumption.
• Identify errors and diagnose operational problems.
• Monitor application dependencies such as databases and external services.
• Support production deployments and infrastructure monitoring.
• Improve application reliability and troubleshooting efficiency.

2. What Is Spring Boot Actuator?

Spring Boot Actuator integrates with Spring Boot applications to provide endpoints for monitoring and management. These endpoints expose selected operational information through HTTP or supported management interfaces such as JMX.

Important Actuator Features

3. Adding Spring Boot Actuator to a Project

To enable Actuator features, add the Spring Boot Actuator starter to your project. Use the dependency management associated with your Spring Boot version.

Maven Dependency

<dependency>
    <groupId>org.springframework.boot</groupId>
    <artifactId>spring-boot-starter-actuator</artifactId>
</dependency>

Gradle Dependency

dependencies {
    implementation("org.springframework.boot:spring-boot-starter-actuator")
}

How Actuator Works

1. Add the Actuator dependency to the application.
2. Spring Boot configures supported monitoring features through auto-configuration.
3. Configure the endpoints that should be exposed.
4. Apply authentication and authorization where necessary.
5. Access the endpoints through HTTP or integrate them with monitoring tools.

4. Configuring Actuator Endpoints

Actuator endpoints provide access to application monitoring information. By default, only a limited set of endpoints is exposed over HTTP. Other endpoints must be explicitly enabled or exposed when required.

Configure Selected Endpoints

Add the following property to application.properties for a development environment:

management.endpoints.web.exposure.include=health,info,metrics

This configuration exposes the selected endpoints over HTTP, subject to endpoint availability and security rules.

Common Endpoint URLs

For an application running locally on port 8080, the health endpoint is typically available at http://localhost:8080/actuator/health. The URL may differ if you configure a different port, context path, or management base path.

5. Monitoring Application Health

The health endpoint reports the application's overall health and can include information from configured health indicators. These indicators can check the application and supported dependencies such as databases, messaging systems, and external services.

Common Health Statuses

Example Health Response

{
  "status": "UP"
}

This is a simplified response. Additional component details may appear depending on the configured health indicators and health-detail visibility settings.

Configuring Health Details

management.endpoint.health.show-details=when_authorized

This setting allows detailed health information to be displayed to authorized users when the application's security configuration supports the required authorization. Avoid exposing internal infrastructure details publicly.

Benefits of Health Monitoring

• Detect application availability problems.
• Identify failures in configured dependencies.
• Support load balancer and orchestration health checks.
• Help developers investigate deployment-related issues.
• Improve operational reliability.

6. Monitoring Application Metrics

Metrics are numerical measurements used to understand application behavior, performance, and resource consumption. Spring Boot Actuator integrates with Micrometer to expose metrics from supported application components and the Java Virtual Machine.

Common Metrics

Accessing Metrics

To list the available metric names, open:

http://localhost:8080/actuator/metrics

To inspect a specific metric, use its name in the endpoint URL:

http://localhost:8080/actuator/metrics/jvm.memory.used

Metric availability depends on the Spring Boot version, dependencies, instrumentation, and runtime environment.

Best Practices for Metrics

• Observe metric trends over time rather than relying on one measurement.
• Compare CPU and memory usage with incoming request volume.
• Monitor response latency and error rates for important APIs.
• Investigate sudden changes following application deployments.
• Use dashboards and alerts to identify abnormal behavior.

7. Configuring Application Information

The info endpoint displays application metadata that has been configured or supplied by supported integrations. It does not automatically expose every detail about the application.

Example Configuration

management.endpoints.web.exposure.include=health,info,metrics
management.info.env.enabled=true

info.app.name=Employee Management System
info.app.description=Spring Boot REST API
info.app.version=1.0.0

After exposing the endpoint, visit /actuator/info to view the configured metadata.

Example Response

{
  "app": {
    "name": "Employee Management System",
    "description": "Spring Boot REST API",
    "version": "1.0.0"
  }
}

Use application information to help identify deployments and versions. Never place passwords, API keys, access tokens, or confidential information in application metadata.

8. Monitoring Environment and Configuration

The environment endpoint provides information about application properties and configuration sources. It can help developers investigate active profiles, property resolution, and configuration issues.

Example Configuration

spring.profiles.active=dev
management.endpoints.web.exposure.include=health,info,env

This example activates the dev profile and exposes the environment endpoint over HTTP. Since environment information may reveal internal configuration, access must be restricted.

Common Uses

• Investigating active Spring profiles.
• Checking whether expected configuration properties are available.
• Diagnosing unexpected property values.
• Comparing development, testing, and production configurations.

Security Note: Property sanitization does not replace proper access control. Do not assume all environment information is safe to expose.

9. Managing Logging Levels with Actuator

The loggers endpoint allows authorized users to inspect logger configurations and, where supported, change logging levels at runtime. This feature can help diagnose problems without immediately rebuilding or redeploying an application.

Expose the Loggers Endpoint

management.endpoints.web.exposure.include=health,info,loggers

Inspect Logger Information

http://localhost:8080/actuator/loggers

To inspect a particular package logger, use its fully qualified package name:

http://localhost:8080/actuator/loggers/com.example.service

Change a Logger Level

When the endpoint is enabled, exposed, and protected by appropriate authorization, a request such as the following can set a logger to DEBUG:

curl -X POST \
  http://localhost:8080/actuator/loggers/com.example.service \
  -H "Content-Type: application/json" \
  -d '{"configuredLevel":"DEBUG"}'

Use DEBUG or TRACE logging carefully because these levels can produce large volumes of output and may reveal sensitive information. Restore the intended logging level after troubleshooting.

10. Creating Custom Health Indicators

Spring Boot Actuator allows developers to create custom health indicators for application-specific dependencies. For example, an application may need to monitor the availability of a payment service or another critical component.

Example Custom Health Indicator

package com.example.monitoring;

import org.springframework.boot.actuate.health.Health;
import org.springframework.boot.actuate.health.HealthIndicator;
import org.springframework.stereotype.Component;

@Component
public class PaymentServiceHealthIndicator
        implements HealthIndicator {

    @Override
    public Health health() {
        boolean serviceAvailable = checkPaymentService();

        if (serviceAvailable) {
            return Health.up()
                    .withDetail("service", "Payment service available")
                    .build();
        }

        return Health.down()
                .withDetail("service", "Payment service unavailable")
                .build();
    }

    private boolean checkPaymentService() {
        // Replace with a real connectivity or health check.
        return true;
    }
}

This example demonstrates the structure of a custom health indicator. The checkPaymentService() method is a placeholder, not an actual network check. In production, implement a real check with appropriate timeouts, error handling, and resource limits.

Advantages of Custom Health Indicators

• Monitor business-critical dependencies.
• Represent application-specific health requirements.
• Improve diagnosis of dependency failures.
• Integrate custom checks into the overall health response.

11. Integrating Spring Boot Actuator with Prometheus

Prometheus is a monitoring system that collects time-series metrics from configured targets. Spring Boot applications can expose metrics for Prometheus by using the appropriate Micrometer registry dependency.

Add the Prometheus Dependency

<dependency>
    <groupId>io.micrometer</groupId>
    <artifactId>micrometer-registry-prometheus</artifactId>
</dependency>

Expose the Prometheus Endpoint

management.endpoints.web.exposure.include=health,info,metrics,prometheus

The Prometheus metrics endpoint is typically available at:

http://localhost:8080/actuator/prometheus

Monitoring Workflow

1. Add Actuator and the Prometheus registry to the application.
2. Confirm that the Prometheus endpoint is accessible to the monitoring system.
3. Configure Prometheus to scrape the endpoint at a suitable interval.
4. Create dashboards and alerts from the collected metrics.
5. Analyze trends to identify availability and performance problems.

Production deployments should protect the metrics endpoint and restrict access to trusted monitoring infrastructure.

12. Securing Spring Boot Actuator Endpoints

Actuator endpoints can expose sensitive operational information or provide access to management actions. Proper security configuration is essential, especially in production environments.

Security Best Practices

• Expose only the endpoints required for monitoring and operations.
• Configure authentication and authorization for sensitive endpoints.
• Consider a separate management port or restricted management network.
• Use HTTPS and appropriate network access controls.
• Avoid publicly exposing environment, beans, mappings, or other sensitive information without a clear requirement.
• Never expose secrets through metadata, health details, or metric labels.
• Review endpoint security after framework or dependency upgrades.

Restrict Endpoint Exposure

management.endpoints.web.exposure.include=health,info,metrics

This property limits the endpoints exposed over HTTP. It does not configure authentication or authorization by itself.

Restrict Health Details

management.endpoint.health.show-details=when_authorized

When using Spring Security, define authorization rules appropriate to your application and monitoring requirements. Public health checks should reveal only the minimum necessary information.

13. Using a Separate Management Port

Spring Boot supports configuring a management port separate from the main application port. This can help separate application requests from monitoring traffic when combined with suitable network and security controls.

Example Configuration

server.port=8080
management.server.port=8081
management.endpoints.web.exposure.include=health,info,metrics

In this example, the main application generally uses port 8080, while management endpoints use port 8081.

The health endpoint may then be available at:

http://localhost:8081/actuator/health

Actual reachability depends on the application's network binding, management configuration, and security rules. A separate port is not automatically private or secure.

14. Troubleshooting Common Actuator Problems

Debugging Checklist

1. Confirm that the Actuator starter is included in the project.
2. Review application startup logs for errors.
3. Verify the management port and endpoint base path.
4. Check the endpoint exposure configuration.
5. Confirm authentication and authorization requirements.
6. Inspect available metrics and health indicators.
7. Test the affected dependency independently.
8. Review recent deployment and configuration changes.

15. Best Practices for Production Monitoring

• Monitor essential signals: Track availability, request latency, error rates, traffic, and resource saturation.
• Build actionable alerts: Alert on meaningful symptoms that require investigation.
• Choose realistic thresholds: Base thresholds on service requirements and observed behavior.
• Secure management endpoints: Apply least-privilege access and network restrictions.
• Control metric cardinality: Avoid unbounded labels such as user IDs and arbitrary request URLs.
• Use centralized monitoring: Aggregate metrics and logs with appropriate monitoring tools.
• Test health checks: Ensure checks detect relevant failures without creating excessive load.
• Review trends: Investigate sustained increases in latency, errors, CPU, or memory usage.
• Document incident procedures: Define how the team should respond to alerts and health failures.

16. Practical Example: Employee Management Application

Consider an Employee Management REST API built with Spring Boot and a relational database. The application supports creating, retrieving, updating, and deleting employee records.

Monitoring Requirements

• Check application health.
• Monitor database health when the appropriate integration is configured.
• Inspect HTTP request metrics and JVM resource usage.
• Display the application name and version.
• Allow authorized developers to investigate logging issues.

Example application.properties

spring.application.name=employee-management

management.endpoints.web.exposure.include=health,info,metrics
management.endpoint.health.show-details=when_authorized

management.info.env.enabled=true
info.app.name=Employee Management API
info.app.version=1.0.0

Testing the Application

1. Start the Spring Boot application.
2. Open /actuator/health and check the reported status.
3. Open /actuator/info and verify the configured metadata.
4. Open /actuator/metrics and identify available metrics.
5. Inspect jvm.memory.used if the metric is available.
6. Simulate a controlled dependency failure in a test environment and observe the health response.
7. Verify that unauthorized users cannot access sensitive endpoint details.

Expected Learning Outcomes

After completing this exercise, learners should be able to add Actuator to a Spring Boot project, configure monitoring endpoints, inspect health and metrics, troubleshoot common errors, and apply essential endpoint security practices.

17. Spring Boot Actuator Interview Questions and Answers

Q1. What is Spring Boot Actuator?

Answer: Spring Boot Actuator provides production-ready monitoring and management features, including health checks, metrics, application information, and operational endpoints.

Q2. What is the purpose of the health endpoint?

Answer: It reports application health and can include the status of configured dependencies such as databases and other supported components.

Q3. What is the default HTTP endpoint base path?

Answer: The default base path is generally /actuator, although it can be customized.

Q4. What is the difference between health and metrics?

Answer: Health reports the operational status of an application or component, while metrics provide numerical measurements for performance and resource analysis.

Q5. How do you expose selected Actuator endpoints?

Answer: Configure management.endpoints.web.exposure.include with the required endpoint IDs and apply appropriate security controls.

Q6. What is Micrometer?

Answer: Micrometer is a metrics instrumentation library that provides a common interface for collecting and exporting measurements to supported monitoring systems.

Q7. How do you integrate Spring Boot with Prometheus?

Answer: Add the Micrometer Prometheus registry dependency, expose the Prometheus endpoint, and configure Prometheus to scrape the application.

Q8. Can Actuator endpoints be secured?

Answer: Yes. Restrict endpoint exposure and configure authentication, authorization, and network controls as appropriate.

Q9. How can high memory usage be investigated?

Answer: Inspect JVM memory metrics, analyze trends and garbage collection behavior, and use profiling or diagnostic tools when necessary.

Q10. What is a custom HealthIndicator?

Answer: It is a custom component that contributes health information for an application-specific dependency or business requirement.

Q11. Why should Actuator endpoints not all be public?

Answer: Some endpoints expose internal configuration or permit management actions, creating security and operational risks when publicly accessible.

Q12. Why configure a separate management port?

Answer: A separate port can help isolate management traffic from application traffic when combined with appropriate network and security controls.

18. Practical Exercises

1. Add Spring Boot Actuator to a new Spring Boot project.
2. Expose the health, info, and metrics endpoints.
3. Configure application name, description, and version metadata.
4. Inspect available JVM metrics and explain their meaning.
5. Create a custom health indicator for a sample dependency.
6. Configure Prometheus metrics and verify the endpoint.
7. Protect management endpoints with an appropriate security policy.
8. Troubleshoot an unavailable endpoint and an unhealthy dependency.
9. Write a short incident-response procedure for a health-check failure.

19. Quick Revision Checklist

• Understand the purpose of Spring Boot Actuator.
• Know how to add the Actuator starter dependency.
• Understand endpoint exposure and management paths.
• Know how to inspect health, info, and metrics.
• Understand the role of Micrometer and Prometheus.
• Know how to create custom health indicators.
• Understand runtime logger management.
• Recognize common 401, 403, and 404 errors.
• Apply authentication, authorization, and network restrictions.
• Follow production monitoring and troubleshooting best practices.

20. Conclusion

Spring Boot Actuator is an essential tool for making Java applications observable and easier to maintain. Its health indicators, metrics, information endpoints, and monitoring integrations help development and operations teams understand application behavior, identify failures, and investigate performance issues.

For production deployments, expose only the endpoints that are needed, protect sensitive information, monitor meaningful metrics, and test health checks against real operational requirements. When combined with monitoring tools such as Prometheus, Actuator provides a strong foundation for monitoring Spring Boot applications.

Learn Advanced Java with JustAcademy

Strengthen your Java and Spring Boot skills with structured learning resources from JustAcademy.

Explore Advanced Java Training

Register for a Course Demo

Visit JustAcademy Official Website