Monitoring usually starts from conditions you already know to watch: latency above a threshold, an error-rate spike, a failed health check, or a saturated resource. Observability is the evidence available when you need to explain why the system reached that state.
Metrics show how behavior changes over time, logs preserve event detail, and traces connect one request across components. None of the three is sufficient for every incident; correlation between them shortens the path from symptom to cause.
Operationally, the sequence is usually:
- Identify the affected service and time window from the symptom.
- Inspect metrics for the scale and duration of the change.
- Follow traces or request IDs into the relevant logs.
- Confirm the failing component or dependency against that evidence.
In this chapter
- Metrics, logs, and tracesUse each signal for the questions it answers best and correlate them through request/context identifiers.
- Observability, explainability, traceability and auditabilityCompare the evidence required for pipelines, predictions and agent actions.