Introduction
What are the differences (and similarities) between monitoring and observability? There's some definite cross-over between the two, and often we might use one in place of the other, so what's the difference? In this article we talk over the differences and similarities, and the things to look out for in any platform you might choose to adopt.
Monitoring
The concept of 'monitoring' is probably nearly as old as running computer systems. The ultimate aim of monitoring is to have a computer tell you if there's a problem somewhere in your estate. This is usually done by periodically checking a number of details of each component of the network and looking for anything that doesn't work. If any problems are found, then apply some rules and work out if an alert needs to be sent to someone. The act of checking was (and still is) typically polling of some sort. This allows the monitoring platform to know very quickly if a component has failed because if it doesn't answer, there must be a problem.
This all sound straight forward enough, and sufficed for many years. After a while though, people wanted to know about problems before they happened, and so monitoring platforms started to collect some metrics as well as more binary "it works" or "it doesn't work". Now "problems" could be because a metric was trending upwards for too long, indicating something serious was likely to happen in the near future.
To summarise then, the major features of monitoring platform typically are:
- Server-active polling, scanning, pinging etc
- Prompt detection of components that are completely 'down'
- Has 'binary' concepts such as "up/down", "working/not working"
- May have some metric gathering capability
- Can send alerts if binary states change, or possibly if metric trends indicate a likely future binary change
Observability
Observability generally starts with a notion of "graph everything that moves, and if it doesn't move, graph it in case it moves". That is, for every possibly quantity of a system, collect instantaneous values of it and present these in graph form in a User Interface somewhere. Observability also tends to "look inside" things, so is less concerned about what processes are running on a server as they are about the internals of some of those processes (eg. how many requests they are serving, how quickly they can use the database, etc).
Observability platforms are usually numerically based (rather than binary based). That is, every quantity has a numeric value, and can be presented as a graph. Many platforms allow some mathematical calculation too, so can present the maximum, minimum or mean average of a quantity.
Most observability platforms work on a "push" model. That is, the monitored device pushes metrics to the platform at some frequency. If no metrics are pushed, then the platform typically "leaves a gap" in the metric history (which can optionally be filled in during graph presentation). Indeed, some metric systems (eg. Statsd) are specifically designed to drop metrics if there are issues in the collection.
Many observability platforms also offer some alerting capability. This often comes with trend analysis and sometimes other more complex mathematical processing. Alerts if a component is completely unavailable are usually possible after a fixed amount of time with no updates from that component (eg. "send an alert if we do not receive any updates after 5 minutes").
The major features of observability platforms typically include:
- A "push" model to get metrics from a monitored device to the platform server
- Numerically based (ie. every measurement has a numeric value)
- Pseudo-binary possibly available (eg. "if a component has not updated in 5 minutes", or "if value is 1 then... else if value is 0 then...")
- Alerting on thresholds, or often with trend analysis or more complex statistical computations
Monitoring Versus Observability
Given both types of platform have so many similarities, what's the difference? Truthfully there are probably not firm rules here, but here's our take on things...
Monitoring if what you need for on-call teams, whereas observability is what you need for developers.