Monitoring or Observability? Why Not Both?

Pairing monitoring and observability is beneficial because not all problems identified by monitoring tools require sophisticated investigation.

This past year saw a great rise in interest in observability. Most discussions positioned observability as a type of replacement for monitoring, sort of a new and improved offering. Those discussions were obviously false. The two are distinct offerings designed to address different problems and deliver different benefits. So, rather than framing the discussion as an either-or, it should really be why not use both.

Why both? In general, monitoring focuses on finding problems while observability tries to understand and resolve them.

A simple example makes a case for using the two together. Monitoring might be something as simple as running an agent on a server that tracks CPU and memory utilization. An IT department might decide it wants to know when memory utilization exceeds 90%. When that happens, the IT department gets an alert. In contrast, an observability solution might notice a degradation in an application’s performance and infer that the source of the problem is the high memory utilization on a server.

The problem is nothing is that simple today. The wide-scale use of microservices, cloud instances, API-based applications, and more create many interdependencies, any one of which can impact an application’s performance or a company’s security.

In such environments, monitoring alone becomes a challenge. IT departments and the security operations team quickly become overwhelmed with alerts, logs, and traces from multiple disparate systems that all generate data that theoretically can help identify the root cause of a problem. Ideally, the IT and security teams would love to be able to sort through the data and find the most urgent ones to act on.

In a way, that’s where observability comes in. Observability solutions typically use advanced analytics and artificial intelligence to make inferences about this data. Such solutions can prioritize the incoming data and suggest which needs the most attention.

Many organizations perform analysis on historical monitoring data to look for patterns. An observability solution might take this to a higher level by analyzing real-time data and inferring potential problems in the making.

For example, when used by security teams, the former might recognize elements of a known attack and block it. In contrast, an observability solution might detect anomalies in real time and alert a human operator that something is amiss. Such solutions that make recommendations enter into the realm of AIOps (artificial intelligence for IT operations).

See also: Continuous Intelligence Insights

 Back to basics: Using observability and monitoring together

Monitoring tools can tell you when something goes wrong, and observability tools can help you investigate the issue after you detect a problem.

Pairing monitoring and observability is beneficial because not all problems identified by monitoring tools require sophisticated investigation. Monitoring tools might send an alert telling IT that a server went offline. But if it was part of a planned shutdown, the team does not need to collect and interpret multiple types of data to understand what happened. The team just logs the alert and moves on.

But when serious problems arise that need to be resolved quickly, observability data is crucial. Observability tools ensure that IT and security teams always have the data they need on hand to interpret a complex problem. Many solutions also offer recommendations or automated analyses that can help teams sift through complex observability information and identify root-cause problems more efficiently.