Observability
Auto-instrumentation and manual spans: the 80/20 of OTel
Auto-instrumentation tells you “this HTTP request took 800 ms and made 5 DB queries.” Manual instrumentation tells you “the slow part was the fraud-check loop, which fanned out to 12 calls on the rules engine, of which 3 timed out.” Both are necessary. Neither alone is enough.
Auto-instrumentation: the 70-80% you get for free
Most production traffic flows through a small set of frameworks — HTTP servers, HTTP clients, database drivers, message queue clients — that OTel’s contrib libraries instrument out of the box.
Java: The OTel Java Agent (-javaagent JAR) rewrites bytecode at JVM startup and instruments ~200 libraries automatically — no code changes required. Add one -javaagent flag to the JVM arguments, set OTEL_SERVICE_NAME and OTEL_EXPORTER_OTLP_ENDPOINT env vars, and every HTTP request, JDBC query, and Kafka message is traced.
Python: opentelemetry-instrument wraps the process and monkey-patches common libraries (Flask, Django, FastAPI, SQLAlchemy, Redis, Celery, etc.).
Node.js: @opentelemetry/sdk-node plus a set of instrumentations (express, http, pg, redis, kafkajs) registered before any other require hook framework methods automatically.
Go: Auto-instrumentation is less mature because Go has no monkey-patching. eBPF-based auto-instrumentation (using uprobes) is the emerging approach; the Go OTel contrib libraries require explicit middleware setup per framework.
| Language | Auto-instrumentation mechanism | Coverage |
|---|---|---|
| Java | -javaagent JAR, bytecode rewriting at startup | ~200 libraries, HTTP + DB + queues + caches |
| Python | opentelemetry-instrument, monkey-patching | Flask, Django, FastAPI, SQLAlchemy, Redis, Celery |
| Node.js | require hook before other imports | express, http, pg, redis, kafkajs, grpc |
| Go | Middleware setup per framework (no monkey-patching) | net/http, gRPC, database/sql — requires manual wiring |
The 70-80% is the easy part: HTTP routes, DB queries, cache calls, queue interactions. Auto-instrumentation tells you what happened. Manual instrumentation tells you why.
Manual instrumentation: the value bridge
The remaining 20-30% — business-specific spans, custom attributes, and cross-cutting concerns — is where the real diagnostic value lives, because it is where the business questions live.
Pattern: open a span around a business operation, attach attributes that describe the operation, emit span events for noteworthy moments.
const span = tracer.startSpan("fraud.check", {
attributes: {
"customer.segment": customer.segment,
"order.value_cents": order.valueCents,
"feature_flag.fraud_model": flags.fraudModel,
},
});
try {
for (const rule of rules) {
const result = await rules.engine.evaluate(rule, order);
span.addEvent("rule.evaluated", {
"rule.id": rule.id,
"rule.result": result.outcome,
"rule.latency_ms": result.latencyMs,
});
}
} catch (err) {
span.recordException(err);
span.setStatus({ code: SpanStatusCode.ERROR });
} finally {
span.end();
}This span tells you customer segment, order value, the feature flag state of the fraud model, and the result of every rule evaluation — data that auto-instrumentation cannot see because it does not know your business domain.
The platform wrapper pattern
Manual instrumentation is the same pattern in every service, so platform teams publish a thin helper library that wraps the OTel API with org-specific conventions:
- Typed business attributes — pre-defined attribute names for common concepts (customer segment, feature flag state, batch size) so teams cannot misspell them.
- Redaction helpers — strip PII before attaching to spans (email → hash, SSN → masked).
- Span event helpers — typed helpers for common events (cache miss, retry, fallback).
- Resource pre-configuration — service name, version, and deployment environment from a standardised env var set.
New services import the wrapper; CI lint rejects raw OTel SDK usage in new code (to prevent ungoverned attribute naming). Override hooks let teams add service-specific attributes without modifying the wrapper.
Why this works
Why not one span per function? Every span has overhead: the SDK allocates the span struct, records attributes, runs the sampler, and when the span ends, runs the batch processor, serializes to OTLP, and possibly queues for the exporter. At ~1-5 μs per span, 100 spans per request at 10k RPS is 1-5 ms of CPU overhead per core per second. More importantly, a flat list of 100 function-level spans is harder to read than 8 spans at the right abstraction level. The guideline: one span per service-boundary crossing plus one per significant subsystem call (one span for the fraud check, one for the DB query inside it, not one span per method inside the fraud check).
What does auto-instrumentation cover that manual instrumentation cannot, and what does manual instrumentation cover that auto-instrumentation cannot?
Why does a platform team publish a per-language wrapper around the OTel SDK instead of letting application teams call the OTel SDK directly?
Order the steps to add a well-instrumented business span to a service:
- 1 Open a span with a descriptive operation name (e.g., fraud.check)
- 2 Attach structured attributes: customer segment, order value, feature flag state
- 3 Execute the business logic
- 4 Emit span events for significant moments: cache miss, retry, rule evaluation result
- 5 On error: call span.recordException(err) and set status to ERROR
- 6 Always call span.end() in a finally block to ensure the span is flushed
- 01Why is the OTel Java Agent the most powerful auto-instrumentation option across languages?
- 02What is the right granularity for manual spans, and why?
- 03What does the platform wrapper pattern solve, and what does it cost?
Auto-instrumentation instruments 70-80% of production traffic for free: the OTel Java Agent rewrites bytecode to cover ~200 libraries; Python’s opentelemetry-instrument monkey-patches common frameworks; Node.js uses a require-hook before other imports. Go requires manual middleware setup (no monkey-patching). The remaining 20-30% is manual spans: open a span around a business operation, attach typed attributes (customer segment, feature flag state, batch size), emit span events for noteworthy moments, record exceptions with span.recordException(). The overhead is ~1-5 μs per span — keep granularity at the business-operation level, not the function level. Platform teams publish a per-language wrapper that enforces Semantic Conventions, redaction, and resource configuration, so application teams can add business spans without inventing new attribute names.
- Vendor neutrality, eBPF instrumentation, the Operator, and browser/serverless OTelsenior
- Operating the OTel Collector: reliability, version skew, failure modes, and governancesenior
- OTel: build a vendor-neutral pipelinesenior
- OTel: multiple-choice reviewsenior
- OTel: config and trace readingsenior
- OTel: free-recall reviewsenior
appears again in167
- The journey of a request: seven stops from socket to responsejunior
- Accept and parse: from kernel queue to a typed requestmiddle
- Routing and middleware: choosing what runs, and in what ordermiddle
- Handler and response: from business logic to bytes on the wiremiddle
- Streaming and backpressure: when the client reads slower than you writesenior
- Timeouts and tail latency: budgets, deadlines, and the fan-out trapsenior
- Middleware and DI: the two patterns that shape every backendjunior
- Writing middleware: signatures, next(), and the three framework modelsmiddle
- Inversion of control: how dependencies reach a classmiddle
- DI scopes and lifecycles: singleton, request, transientmiddle
- DI as a testing seam: fakes, mocks, and the boundary that matterssenior
- DI containers in production: resolution graphs, circular deps, and when not tosenior
- Blocking vs non-blocking I/O: two ways to waitjunior
- The event loop: one thread, ordered phasesmiddle
- What blocks the loop: CPU work and sync callsmiddle
- Offloading CPU work: worker threads and the libuv poolmiddle
- Backpressure and bounded concurrencysenior
- Throughput under load: tail latency and saturationsenior
- Why pool: the cost of creating a connectionjunior
- Pool sizing: why bigger is not fastermiddle
- Acquisition and timeouts: the wait queue is the real latency dialmiddle
- Retry strategies: backoff, jitter, and thundering herdmiddle
- Observability, production failures, and global-scale designsenior
- Tasks, microtasks, and scheduler.yield()middle
- Timer accuracy, throttling, and idle workmiddle
- Node.js event loop: phases, nextTick, and loop lagsenior
- Rendering strategies: SSG, SSR, ISR, streaming, and hydrationjunior
- SSG, SSR, ISR, streaming, and RSC — how each worksmiddle
- Hydration cost: selective, progressive, islands, resumabilitymiddle
- Core Web Vitals: what LCP, INP, and CLS measurejunior
- LCP: four phases, one dominant costmiddle
- INP: input delay, processing, presentationmiddle
- Lab vs field: why the two disagree and how to use eachmiddle
- Metric tradeoffs, RUM attribution, and the CI+field loopsenior
- The full picture: URL to LCP to INP as a relay racejunior
- Eight layers traced: from the service worker to the second navigationmiddle
- Five canonical breaks: where production reliably diessenior
- The three-track method: reading traces and building a monitored systemsenior
- What an index is and how it speeds up queriesjunior
- The leading-column rule and composite index designmiddle
- Partial, expression, and covering indexesmiddle
- Index types: GIN, GiST, BRIN, Hash, Bloom, and HOT updatesmiddle
- Index-only scans, the Visibility Map, and INCLUDEsenior
- Production failure modes and the index audit playbooksenior
- Index design exercise: full-text search strategysenior
- EXPLAIN and execution plans: what the planner decides and whyjunior
- Scan types: Seq, Index, Bitmap, Index-Onlymiddle
- Join algorithms and the row-estimate cascademiddle
- pg_statistic, ANALYZE, and production observabilitymiddle
- Extended statistics: fixing correlated-column estimate failuressenior
- Plan cache, cost-constant tuning, and planner internalssenior
- Production failure modes and plan stabilitysenior
- Connection pools: amortising the cost of a Postgres backendjunior
- PgBouncer session, transaction, and statement modesmiddle
- Pool sizing: the (cores × 2) + spindles formula and the two-layer stackmiddle
- Pool exhaustion and idle-in-transaction: the 3 AM failure modemiddle
- Migrating to transaction mode: rollout playbook and PgBouncer 1.21 prepared statementsmiddle
- The Postgres process model and why raising max_connections degrades throughputsenior
- Pooler landscape 2026, serverless connection storms, and the full failure-mode taxonomysenior
- ADD COLUMN: instant in PG 11+ vs rewrite in older Postgresjunior
- The lock-queue failure mode: why instant DDL can freeze the databasemiddle
- Safe DDL patterns: NOT VALID, CONCURRENTLY, and unsafe-op fixesmiddle
- Migration failure taxonomy and production disciplinesenior
- Shard-key selection: hash, range, list, and directory strategiesmiddle
- Co-location and Citus: the invariant that makes sharding usablemiddle
- The hot-shard failure mode: detection, isolation, and durable policymiddle
- Online resharding, 2PC, and the operational cost of shardingsenior
- The seven acts: from CREATE TABLE to Citusjunior
- Acts 1–3 in depth: schema, indexes, and planner statisticsmiddle
- Acts 4–6 in depth: MVCC bloat, connection pooling, and safe migrationsmiddle
- Act 7 in depth: sharding, co-location, and the seven-tier tradeoff cascademiddle
- Observability, anti-patterns, and production triagesenior
- Bits on the wirejunior
- Latency mathmiddle
- Bufferbloat and congestionsenior
- The physical frontiersenior
- Sequence numbers and connection statemiddle
- Flow control and congestion controlmiddle
- BBR, production observability, and beyond TCPsenior
- CDN: putting content next doorjunior
- Anycast and GeoDNS: routing to the nearest edgemiddle
- Tiered cache and Cache-Controlmiddle
- Vary header and cache keysmiddle
- Stale-while-revalidate and cache stampedesenior
- Edge workers and edge-side compositionsenior
- CDN operations and observabilitysenior
- WebSocket: the HTTP upgrade handshakejunior
- WebSocket vs SSE vs long-polling: choosing the right transportmiddle
- WebSocket backpressure: when clients can''''t keep upmiddle
- Reconnection: jittered backoff, thundering herd, message resumptionsenior
- WebSocket at scale: HTTP/2 multiplexing, permessage-deflate, C10Msenior
- WebSocket in production: proxies, security, and distributed architecturesenior
- What reverse proxies dojunior
- Balancing algorithms: round-robin to power-of-two-choicesmiddle
- L4 vs L7 load balancing and client-IP preservationmiddle
- Health checks, connection draining, and slow startmiddle
- Retry storms, circuit breakers, and load sheddingsenior
- Resilient LB architecture: anycast, zone-aware routing, and observabilitysenior
- Why QUIC and not TCP+TLSjunior
- QUIC streams and head-of-line blockingjunior
- Integrated handshake and 1-RTTmiddle
- Connection IDs and network migrationmiddle
- Loss detection and congestion controlmiddle
- 0-RTT resumption and packet encryptionsenior
- Deployment tradeoffs and CPU costsenior
- DDoS: what it is and why it worksjunior
- Amplification attacks and state exhaustionmiddle
- Rate limiting: algorithms and architecturemiddle
- WAFs, firewalls, mTLS, and HSTSmiddle
- DNS cache poisoning and BGP hijackingsenior
- Defense-in-depth architecture and attack economicssenior
- The twelve layers: one URL, seven actorsjunior
- DNS, TCP, TLS in sequence: where the milliseconds gomiddle
- Critical render path and Core Web Vitalsmiddle
- Proxy intercepts and security gates: rate limiters, WAF, mTLSmiddle
- Alternate paths: QUIC 0-RTT, WebSocket upgrade, connection migrationmiddle
- Observability: distributed traces, USE/RED, and samplingsenior
- Resilience: cascading retries, circuit breakers, and error budgetssenior
- Why profile first: measure where time actually goesjunior
- Amdahl''''s law and self-time: the ceiling on every speedup you can shipmiddle
- The measurement loop: microbench, macrobench, prod profile, observer effectmiddle
- Reading flame graphs: shapes, per-language profilers, and the 60-second scanmiddle
- Statistical baselines: why one run is not a measurementmiddle
- Profiler history and microbenchmark pitfalls: Knuth to GWPsenior
- Hardware counters, cold-start profiles, and profile securitysenior
- Continuous profiling at scale: costs, CI gates, trace correlation, and anti-patternssenior
- What makes a hot path: symptom vs causejunior
- Five shapes of hotspot: CPU, alloc, cache, lock, syscallmiddle
- Reading parent and child chains: where to apply the fixmiddle
- JIT deopt, the fix-and-verify loop, and PR-time profilingmiddle
- Hardware counters and Intel TMA: sub-category diagnosissenior
- False sharing and native-bridge hot pathssenior
- Hot paths in production: security, tail latency, and tooling lineagesenior
- Memory hierarchy: why the same O(N) loop can be 17x slowerjunior
- Row-major vs column-major: access order and the 9x gapjunior
- Branch prediction and branchless codemiddle
- Hardware prefetcher, TLB, and memory-level parallelismsenior
- GC basics: what the runtime taxes you forjunior
- GC algorithms: generational, concurrent, and per-runtimemiddle
- GC tradeoffs: pause, throughput, heap — and object poolingmiddle
- GC tuning: pacing, heap shape, and allocation observabilitymiddle
- GC internals: tri-color invariant, write barriers, and per-runtime deep-divessenior
- GC in production: observability, security, edge cases, and fleet governancesenior
- N+1: one logical operation, many round-tripsjunior
- Fix families: JOIN, IN, preload, and DataLoadermiddle
- Detecting N+1: query logs, APM traces, and CI gatesmiddle
- DataLoader: batching across resolver treesmiddle
- Cross-protocol N+1: HTTP fan-out and Redis MGETmiddle
- N+1 at scale: pool exhaustion, plan changes, and denormalisationsenior
- Batching: amortize fixed cost per operationjunior
- The batching window: size and wait timemiddle
- Batching in Kafka and Postgresmiddle
- io_uring and observability of batchingmiddle
- From Nagle to io_uring: evolution of batchingmiddle
- Backpressure, failure isolation, and batch security in productionsenior
- What a bundle actually costs: download, parse, compile, executejunior
- Core Web Vitals: LCP, INP, and CLSmiddle
- Code splitting: route-level, component-level, vendor splittingmiddle
- Tree shaking and compression: removing what you don''''t usemiddle
- Third-party scripts: the silent budget killermiddle
- CI enforcement and RUM: making budgets stickmiddle
- V8 JIT pipeline, HTTP priorities, and bundle securitysenior
- The performance loop: discipline, not a projectjunior
- Classify and fix: matching bottleneck families to remediesmiddle
- Observability stack and CI gates: catching regressions before they shipmiddle
- Incident to enforcement: SLO burn to verified fix in 35 minutesmiddle
- Culture, economics, and org-scale performancesenior