APM, observability and SRE glossary

A

Admission controller

A piece of code in the Kubernetes API server that inspects requests after authentication and authorization, before the object is stored. Controllers can change an object, reject it or both. Some are compiled in, such as resource quota enforcement. Others run externally as webhooks, which is how many policy and instrumentation tools hook into pod creation.

Admission webhook

An HTTPS service that the Kubernetes API server calls during admission. A mutating webhook can modify an object, while a validating webhook can only allow or deny it. Its failurePolicy decides what happens when it is unreachable, so a badly configured one can block pod starts. Our admission webhooks guide covers safe settings.

AIOps

The use of statistics and machine learning in IT operations, typically for grouping alerts, detecting anomalies and suggesting likely causes. Its value depends on data quality and on whether a person can check the reasoning. It complements sound instrumentation and alert design but does not replace them. See what AIOps is for a practical view of the term.

Alert fatigue

The dulling of response that follows from too many alerts, particularly ones requiring no action. Responders begin to ignore or delay their reaction, and real incidents get treated like noise. The cure is usually to remove and group alerts rather than to add more. Our alert fatigue guide shows how to audit a month of pages.

Anomaly detection

Automatically flagging behaviour that differs from what is expected for a signal. Methods range from simple comparisons with historical ranges to statistical and machine learning models. Seasonal patterns make naive methods noisy, since Monday morning does not resemble Sunday night. Baselines and anomaly detection explains how hour-of-week comparison handles such rhythm.

Apdex

An open standard that condenses response times into one score from 0 to 1. Given a target time T, requests at or under T count as satisfied, those up to 4T as tolerating at half weight, and slower ones as frustrated. The formula is simple, but one score hides the shape of a latency distribution, so read it with percentiles.

APM

Application performance monitoring: the practice and tooling for measuring how applications behave in production, usually through request rates, errors, latency, traces and dependency maps. Modern APM generally overlaps with observability. For a full introduction to what it covers and when you need it, read what APM is.

Auto-instrumentation

Collecting telemetry without changing application source code, usually by attaching an agent or hooking into common libraries at runtime. It gives broad coverage quickly, though business-specific detail may still require manual spans. In Kubernetes, the OpenTelemetry operator can inject language agents into pods through annotations and an admission webhook.

Availability

The proportion of time or of requests for which a service works as intended. A request-based measure is often more honest than uptime, since a service can be "up" while failing many calls. As an example, 99.9% over 30 days allows about 43 minutes of downtime (720 hours × 60 × 0.001 = 43.2).

B

Baseline

The normal range of a signal, learned from its own history and used as a comparison for current values. Good baselines reflect seasonality, such as the hour of the week, and they are kept separately per endpoint or method. A value is then judged against what is usual at that time, not against a fixed threshold set once by hand.

Black-box monitoring

Testing a system from the outside, as a user or client would, with no knowledge of its internals. HTTP checks and TCP probes are common examples. It confirms what users can actually reach, but says little about why something failed. It pairs well with white-box monitoring, and synthetic monitoring is its usual form in practice.

Burn rate

How fast a service consumes its error budget, relative to the rate that would use exactly all of it over the SLO window. A burn rate of 1 finishes the budget exactly at the end of the window, while 14.4 over a 30-day window uses 2% of the budget in one hour. Our burn-rate guide shows how to alert on it.

C

Cardinality

The number of unique combinations of label values on a metric. Each combination becomes its own time series, so a label like user ID or full URL can multiply series counts and costs dramatically. Keep unbounded values out of metric labels, and put them on traces or logs instead, where high-cardinality detail is easier to store and query.

Change correlation

Lining up deployments, configuration edits and restarts against latency and error spikes to find likely causes. Correlation provides candidates, not proof, so blast radius and rollback results have to confirm them. Read what changed for a practical routine, including why ConfigMap edits are so frequently missed in incident investigations.

Circuit breaker

A pattern that stops calls to a failing dependency for a period after errors cross a limit, then lets a few trial requests through to test for recovery. It stops threads and connections from piling up on a dead service, and gives that service room to recover. Callers should have a defined fallback or a clear error for the open state.

CLS

Cumulative Layout Shift, the Core Web Vital for visual stability. It sums unexpected layout shifts within the worst burst of a page's lifetime. A score of 0.1 or less is good, and above 0.25 is poor, assessed at the 75th percentile. Common causes are images without set dimensions and injected banners. See our Core Web Vitals guide.

Collector

In OpenTelemetry, a vendor-neutral service that receives, processes and exports telemetry through configured pipelines of receivers, processors and exporters. It can run as an agent on each node or as a central gateway. Common jobs are batching, attribute enrichment and sampling. Read how to deploy the Collector on Kubernetes for the usual patterns.

ConfigMap

A Kubernetes object that stores non-confidential configuration as key-value pairs, for use as environment variables or mounted files. Editing one neither restarts pods nor creates a new Deployment revision, and environment variables keep old values until the container is recreated. That gap means a bad edit can lie dormant for days before it causes a failure.

Connection pool

A set of reusable database or network connections shared by an application's threads. Pooling avoids repeated setup costs, and it limits load on the server. When connections are held longer than usual, the pool empties and requests queue. Our guide to pool exhaustion explains how to diagnose this and how to size a pool with Little's law.

Context propagation

Passing trace identifiers between services, usually through request headers or message metadata, so that their spans join a single trace. If any hop drops the context, the trace breaks into pieces. Common gaps include message queues, thread handoffs and proxies that strip headers. The W3C standard defines the format most tools now share, covered in our Trace Context guide.

Core Web Vitals

Three browser metrics that describe user experience on web pages: Largest Contentful Paint for loading, Interaction to Next Paint for responsiveness, and Cumulative Layout Shift for stability. Each is assessed at the 75th percentile of page loads. They are best collected from real users. See monitoring Core Web Vitals for how to collect and read them.

CrashLoopBackOff

A Kubernetes pod status meaning a container keeps exiting and the kubelet is waiting longer between restarts, with a delay that grows exponentially up to a cap. It is a symptom, not a cause. Check kubectl logs --previous and the exit code in kubectl describe pod. Frequent causes are bad configuration, missing dependencies and failing liveness probes.

D

Dependency map

A visual graph of services and the calls between them, usually derived from trace data. It answers questions such as what calls this service and what breaks if it fails. A map generated from live traffic stays current, unlike a hand-drawn diagram, though it shows only paths that have carried traffic and that are instrumented.

Deployment

A Kubernetes object that declares a desired pod template and replica count, then manages rollouts through ReplicaSets. Changing the template creates a new revision and a rolling update, and kubectl rollout undo reverts to an earlier one. Note that changes to referenced ConfigMaps or Secrets do not create revisions, which can hide a real change from kubectl rollout history.

Distributed tracing

Recording the path of a single request as it crosses services, with timing for each step. The result shows where the time went and which dependency failed, which metrics alone cannot tell you. It relies on context propagation between services. Start with what distributed tracing is for a full introduction and how to read a trace.

E

eBPF

A Linux kernel technology for running verified, sandboxed programs in response to kernel events without changing kernel source or loading a kernel module. Observability tools use it to capture network, process and system data with little application change. It generally needs elevated privileges, which can conflict with least-privilege security policies, and the kernel version limits what's available.

Error budget

The amount of unreliability an SLO allows over its window, calculated as 100% minus the target. A 99.9% SLO has a 0.1% budget, which is 1,000 failures per million requests. Teams can spend the budget on risk such as faster releases. An error budget policy sets out what happens when it runs out.

Exemplar

A sample trace reference attached to a metric data point, usually a histogram bucket. It lets you jump from "p99 went up at 14:32" straight to an actual slow request from that moment. OpenTelemetry's metrics data model includes exemplars, though both the SDK and the backend have to support them for this link to work.

F

Fail-open

A design where a component's failure lets traffic or work proceed without it. A fail-open admission webhook lets pods start uninstrumented if the webhook is down. This is the right choice when the component adds value but isn't essential. Security controls usually fail closed. The webhook guide explains how to choose for your case.

Flame graph

A visualisation of sampled stack traces, where each box is a function and its width shows how much of the samples include it. Wide boxes near the top reveal where time is directly spent. It answers "where did the time go?" quickly. A CPU flame graph shows work, while a wall-clock one also shows waiting, and the two can look quite different.

G

Garbage collection

Automatic reclamation of unused memory in managed runtimes such as Java and .NET. Collections can pause application threads, so GC appears in latency analysis, but it is blamed more often than it deserves. Compare GC pause logs against latency spikes first. Our Java and .NET guides show how to confirm or rule it out.

Golden signals

Four service-level measures from the SRE literature: latency, traffic, errors and saturation. They give a compact starting point for any service, and they suit dashboards and symptom-based alerts. Latency should be split between successful and failed requests, since fast errors can flatter the average. See golden signals, RED and USE for how they compare.

H

Head-based sampling

A trace sampling method that decides whether to keep a trace at its start, before knowing how it will turn out. It is cheap and simple, and propagating the decision keeps traces complete. The trade-off is that it can discard rare slow or failed traces. Tail-based sampling makes the decision later, and the two are often combined.

Helm

A package manager for Kubernetes. A chart bundles templated manifests with default values, and a release is an installed instance of that chart. Commands such as helm install, helm upgrade and helm rollback manage the lifecycle. Charts can work in closed networks provided you also mirror the images, as our air-gapped Helm guide describes.

Histogram

A metric type that counts observations into value buckets, which allows percentile estimates to be computed and aggregated across instances. Percentiles from pre-calculated summaries generally cannot be combined correctly. Accuracy depends on bucket layout, because a percentile can only be estimated within a bucket. Exponential histograms adjust their bucket boundaries automatically to reduce this problem.

HPA

The HorizontalPodAutoscaler, a Kubernetes controller that changes a workload's replica count according to metrics such as CPU utilisation or custom metrics. CPU-based scaling relies on correct CPU requests, because utilisation is calculated against them. Scaling out is not always helpful: when a database is the bottleneck, added replicas can make things worse by opening more connections.

I

INP

Interaction to Next Paint, the Core Web Vital for responsiveness. It measures the delay from a click, tap or key press until the next frame is painted, reflecting one of the slowest interactions in a visit. At or below 200 ms is good, and above 500 ms is poor. It replaced First Input Delay in March 2024.

Instrumentation

Code or tooling that produces telemetry from an application, such as spans, metrics and logs. It may be manual, through an API, or automatic, through agents and library hooks. Good instrumentation records useful context with bounded attribute values. The OpenTelemetry getting started guide shows how to add it in a vendor-neutral way.

J

Java Flight Recorder

A low-overhead event recorder built into the JVM, used for production diagnostics. It captures method samples, lock contention, GC, socket I/O and more into a file you can analyse later, and jcmd can start it on a running process. A rolling recording gives you evidence after an incident has passed. See our Java latency guide.

K

Kubernetes event

A short-lived API object that records something happening to a resource, such as a failed scheduling attempt, an image pull problem or a container kill. Events are often the first clue in pod trouble. The default retention is one hour, so they should be exported if you want them available for incident reviews after the fact.

L

LCP

Largest Contentful Paint, the Core Web Vital for loading. It reports when the largest visible image or text block renders. At or below 2.5 seconds is good, and above 4 seconds is poor, assessed at the 75th percentile. LCP breaks down into server response, load delay, load time and render delay, which point to different owners.

LDAP

Lightweight Directory Access Protocol, used for querying and authenticating against a directory of users and groups. Internal tools often use it to sync team membership. Use LDAPS or StartTLS, a read-only service account and paged queries. Our guide on OIDC, PKCE and LDAP covers group mapping and common traps such as nested groups.

Limit

A Kubernetes resource setting giving the maximum a container may use. Exceeding a memory limit leads to an OOM kill, while reaching a CPU limit leads to throttling. Limits differ from requests, which are used for scheduling. Setting tight CPU limits can cause latency spikes that averages hide, so right-sizing needs both values to be chosen together.

Little's law

A queueing formula: the average number of items in a system equals the arrival rate multiplied by the average time each spends there. For example, 50 requests per second with 40 ms each means 2 in progress on average (50 × 0.04). It is very useful for sizing thread and connection pools.

Liveness probe

A Kubernetes check that restarts a container when it fails. It should detect only states that a restart can fix, such as a deadlock. Checking a database in a liveness probe is a common mistake: a dependency outage then restarts every pod, which adds load and removes warm caches. Use a readiness probe for dependency checks instead.

Log pattern

A template that represents many log lines from the same message, with variable parts replaced by placeholders, such as User <NUM> logged in. Clustering logs into patterns turns large volumes into a short list, and shows which ones are new or rising. Read how log pattern clustering works, with a working example and common pitfalls.

M

Method-level tracing

Timing individual methods or functions within a service, not just requests and library calls between services. It answers which code inside a slow span took the time. It usually relies on runtime hooks, since manual spans at that level are impractical. Read about method-level tracing for how this works for Java, .NET, Python and Node.js.

Metric

A numeric measurement collected over time, such as a request count or memory usage. Metrics are cheap to store and fast to query, and they suit dashboards and alerts. They are aggregates, so they show that something is wrong far better than why. Common types include counters, gauges and histograms. Traces and logs fill in the detail.

Metrics scraping

A pull-based collection model, where a server periodically requests a metrics endpoint exposed by each target. It makes a target's health visible, because a failed scrape is itself a signal. The opposite is a push model, in which applications send metrics to a receiver, as OTLP does. Short-lived jobs may finish before a scrape reaches them.

MTTD

Mean time to detect: the average time between the start of a problem and its detection. It reflects alert quality and coverage. A good check on it is how often users or the service desk report problems before monitoring does. Measuring it requires an honest estimate of when impact actually began, which is rarely when the alert fired.

MTTR

Usually mean time to recover, but also used for repair, respond and resolve, so define it before you compare figures. Because a single long incident can dominate the mean, report the median as well. The most useful analysis splits incidents into phases, which is the approach we take in how to reduce MTTR.

Multi-window alert

An alert that requires a condition to hold over both a long window and a short one. In SLO alerting, the long window shows significant budget burn, and the short one confirms the problem is still occurring, so the alert resolves soon after recovery. For example, a burn rate of 14.4 across 1 hour and 5 minutes is a common paging rule.

O

Observability

The ability to understand a system's internal state from the telemetry it produces, including for failures nobody predicted. The term is often associated with traces, metrics and logs, but having the three does not by itself make a system observable. The practical test is whether you can answer a new question during an incident without shipping new code.

OIDC

OpenID Connect, an identity layer on top of OAuth 2.0. An application redirects users to an identity provider, which authenticates them and issues a signed ID token with claims about who they are. Tools then never handle passwords. It is the standard choice for single sign-on, as OIDC, PKCE and LDAP for internal tools explains.

On-premise

Software that runs on infrastructure an organisation controls, whether in its own data centre or a private cluster, rather than on a vendor's service. It offers control over data location and network paths, at the cost of operating the software yourself. For an honest weighing of both sides, read on-premise versus SaaS APM.

OOMKilled

A Kubernetes container status meaning the kernel ended the process for exceeding its memory limit, or the node ran out of memory. The exit code is usually 137. A healthy-looking heap does not rule it out, because the limit covers all process memory, including native allocations, thread stacks and buffers. Compare total working set against the runtime's heap usage.

OpenShift

Red Hat's Kubernetes platform, which adds an integrated registry, routes, an operator-managed cluster lifecycle and stricter security defaults such as Security Context Constraints. Workloads that run on upstream Kubernetes may need changes to run under its default restrictions. The OpenShift monitoring guide describes what the platform provides and what you need to add on top.

OpenTelemetry

A CNCF project that provides vendor-neutral APIs, SDKs, a Collector and a wire protocol for traces, metrics and logs. It separates instrumentation from the backend, so changing where data goes does not require changing application code. Its semantic conventions standardise attribute names. Begin with our OpenTelemetry getting started guide for a first working setup.

Operator

A Kubernetes pattern in which a custom controller manages an application using custom resources, encoding what a human administrator would do, such as installs, upgrades and failover. OpenShift uses operators heavily, including for its own components. They reduce manual work, but they add a controller with its own permissions, which you should review like any other privileged component.

OTLP

The OpenTelemetry Protocol, the native wire format for sending traces, metrics and logs. It runs over gRPC or HTTP, with protobuf or JSON payloads. By convention the ports are 4317 for gRPC and 4318 for HTTP, and the HTTP trace path is /v1/traces. Any OpenTelemetry SDK or Collector can send it to a compatible backend.

P

Percentile

The value below which a given share of observations falls. A p95 of 300 ms means 95% of requests took 300 ms or less. Percentiles show tail behaviour that an average hides. They cannot be correctly averaged across instances, so compute them from combined histograms. Be aware that high percentiles need plenty of samples to be stable.

PKCE

Proof Key for Code Exchange, defined in RFC 7636. A client sends a hash of a random secret at the start of an OAuth login, then reveals the secret when exchanging the authorization code, so a stolen code alone is useless. Current guidance recommends it for all clients using the code flow. Our OIDC guide includes a worked example.

Pod

The smallest deployable unit in Kubernetes: one or more containers sharing a network namespace and, optionally, storage. Pods are disposable and are replaced rather than repaired, with a new name and IP each time. That is why monitoring should key on the owning workload as well as the individual pod, since the pod's identity will not last.

Postmortem

A written review after an incident, which covers the timeline, impact, contributing factors and follow-up actions. A blameless one asks what made failure possible and diagnosis hard, not who made a mistake, because people share more when they aren't defending themselves. Its value comes from completed actions, so track those to the end like any other engineering work.

R

RBAC

Role-based access control: permissions granted to roles, and roles granted to users or groups. Kubernetes has its own RBAC using Roles and RoleBindings. Applications often map directory groups onto their own roles, and scoping those roles by team limits who can see which data. Security and access control shows this approach in a monitoring platform.

Readiness probe

A Kubernetes check that decides whether a pod should receive traffic. A failing pod is removed from Service endpoints but is not restarted, which makes this the right place for dependency and warm-up checks. Be careful, though: if every pod fails readiness because of a shared dependency, the service loses all its endpoints at the same moment.

RED method

A service monitoring approach built on three measures: rate, errors and duration of requests. It fits request-driven services and maps closely to what users experience, and it is easy to apply consistently across many services. It works well together with the USE method for resources, as golden signals, RED and USE explains.

ReplicaSet

A Kubernetes controller that keeps a specified number of identical pods running. You rarely manage one directly, since a Deployment creates a new ReplicaSet for each revision. When troubleshooting, it's worth knowing that pod creation errors, including admission failures, appear as FailedCreate events on the ReplicaSet rather than on the Deployment itself.

Requests

The Kubernetes resource setting that tells the scheduler how much CPU and memory a container needs. Pods are placed on nodes according to requests, not actual use. CPU requests also determine relative CPU share under contention. Requests set too high waste capacity, and those set too low cause contention. Our right-sizing guide shows how to choose values.

Resource attributes

In OpenTelemetry, key-value pairs describing the entity producing telemetry, such as service.name, service.version and k8s.pod.name. They apply to all signals from that source, so they are what allow traces, metrics and logs to be joined. Setting them consistently, for instance through OTEL_RESOURCE_ATTRIBUTES, makes grouping and comparison across versions much simpler.

restricted-v2

The default Security Context Constraint for authenticated workloads on recent OpenShift versions. It requires pods to run as a non-root user from the namespace's assigned UID range, drops all capabilities except optionally NET_BIND_SERVICE, and disallows privilege escalation. Some vendor software needs changes to run under it. See our restricted-v2 SCC guide.

Right-sizing

Adjusting CPU and memory requests and limits to match real workload needs. It usually means looking at usage distributions, such as p95 and peak, over a representative period, then setting values with an appropriate margin. Sizing on averages tends to under-provision for bursts. See Kubernetes right-sizing for a step-by-step method.

Root cause analysis

The work of finding why an incident happened, not just what broke. Complex failures rarely have a single cause, so many teams prefer to speak of contributing factors. Automated tools can rank candidates from telemetry, but a person should check the evidence. AIOps root cause analysis describes one approach with a visible evidence chain.

RUM

Real user monitoring: collecting performance and error data from actual users' browsers or apps, rather than from scripted tests. It shows how the experience varies by device, location and route, and it can link browser activity to backend traces. Real user monitoring describes this in more detail. Check your privacy obligations for what you collect.

Runbook

A documented procedure for handling a specific alert or task, with its diagnostic steps and remedies. Good ones link directly from the alert, and they are tested and dated, as an unused runbook goes stale. Repeatable steps may be automated later, and our guide to runbook automation with Ansible AWX shows how to do so safely.

S

Sampling

Keeping only a share of traces or events to control cost and volume. It can be head-based, decided at the start of a trace, or tail-based, decided after seeing the whole trace. Metrics calculated from sampled data need to account for the sampling rate, or their counts will be misleading. Errors and slow requests are usually worth keeping at higher rates.

Saturation

How close a resource is to its capacity, often visible as queueing. It is one of the golden signals, and it usually degrades performance before a hard limit is reached. CPU run queue length, disk queue depth, thread pool backlog and connection pool wait counts are all examples. Rising saturation is often the earliest warning of an upcoming failure.

SCC

Security Context Constraints, the OpenShift mechanism that controls which security-related settings a pod may use, such as user ID, capabilities and host access. Service accounts get access to SCCs through RBAC. Requests for a privileged or extra SCC deserve scrutiny during vendor reviews. Our restricted-v2 guide explains the default most workloads should use.

Semantic conventions

OpenTelemetry's standard names and meanings for telemetry attributes, such as http.request.method and db.system.name. They allow dashboards and queries to work across languages and libraries. Conventions have changed names as they have stabilised, so telemetry from different library versions may differ. Check the current specification and your SDK versions when something doesn't line up.

Service level agreement

A contract with customers that defines promised service levels and consequences for missing them, such as credits. An SLA should normally be looser than the internal SLO, which leaves a margin for acting before a breach. Engineers usually track SLOs day to day, while commercial and legal teams own the terms of the SLA.

SLI

Service level indicator: the measurement behind an SLO, commonly the ratio of good events to total events. For example, the share of checkout requests served successfully in under 500 ms. Good SLIs measure what users feel and are taken as near to them as possible. Internal measures such as CPU are poor SLIs, because users do not experience them directly.

SLO

Service level objective: a target for an SLI over a window, such as 99.9% of requests succeeding over 30 days. It defines "reliable enough" and yields an error budget, which helps teams balance reliability work against feature work. SLOs and error budgets shows how this operates, including alerts built from burn rates.

Span

A single timed operation within a trace, such as an incoming request, a database query or an outbound call. It has a name, start and end times, attributes, a status, and a parent span reference. Spans form a tree that shows how a request's time was spent. Long gaps between child spans often mean uninstrumented work or waiting.

Synthetic monitoring

Running scripted checks against a service at regular intervals, whether or not real users are active. Probes can verify HTTP responses, TCP connections and TLS certificate validity. Their advantage is detecting failure during quiet periods, and their weakness is that they test only the paths you scripted. Synthetic monitoring describes probes and the alerts built on them.

T

Tail-based sampling

Deciding whether to keep a trace after its spans have been collected, so that slow or failed traces can be favoured. It needs buffering, and all spans for a trace must reach the same decision point, which adds memory and routing work. Our tail-based sampling guide explains policies and the usual deployment layout.

Telemetry

Data that a system emits about its own behaviour, typically metrics, logs and traces, and increasingly profiles too. Telemetry can contain sensitive information such as user identifiers in log lines, so where it travels and who can read it matters. Regulated organisations often review this closely. Air-gapped observability covers keeping all of it inside your network.

Thread pool starvation

A condition where all pool threads are busy or blocked, so queued work has to wait, even if CPU is low. A classic .NET cause is blocking on async code with .Result. Latency climbs sharply under moderate load. A growing queue length with modest CPU is the signature, as shown in our .NET troubleshooting guide.

Throttling

A limit on how much of a resource a workload may use over time. In Linux containers, the CFS scheduler stops a process for the rest of a period once it uses up its CPU quota, causing latency spikes that CPU averages can hide. Compare the throttled and total periods from the container's cgroup statistics to detect it.

Time-series database

A database designed for timestamped measurements, optimised for fast appends, range queries, downsampling and retention rules. Metrics stacks commonly store their data in one. Its main scaling constraint is typically the number of active series, which is why high-cardinality labels cause trouble. Long-term retention may be handled by a separate layer with lower resolution.

TLS

Transport Layer Security, the protocol that encrypts and authenticates network connections, using certificates to prove server identity (and client identity for mutual TLS). Expired certificates are a recurring cause of outages. Public certificate lifetimes are getting shorter, so renewal has to be automated. Read our guide on certificate expiry monitoring for what to probe and when to alert.

Toil

The SRE term for manual, repetitive, automatable operational work that scales with service size and produces no lasting value. Restarting a service by hand every week is toil, while designing a fix for the cause isn't. Tracking it makes the case for engineering time, and runbook automation is a common way to remove it.

Trace

The record of one request's journey through a system, made up of spans that share a trace ID. A trace shows the order, nesting and duration of operations across services, making it the natural tool for answering where a request's time went. Because storing every trace is expensive at scale, most systems apply some form of sampling.

traceparent

The HTTP header defined by W3C Trace Context that carries trace identity between services. Its value has four dash-separated fields: version, trace ID, parent span ID and flags, for example 00-<32 hex>-<16 hex>-01. A flag value of 01 signals that the caller sampled the trace. Browsers can send it too, if CORS allows the header.

Tracing backend

The system that stores spans, assembles them into traces, and offers search and visualisation. It may also derive service maps and latency statistics from the span data. OTLP lets many different instrumented applications send to the same backend. Storage cost and query speed at high volume are the main considerations when choosing or operating one.

TTFB

Time to First Byte: the time between a request starting and the first byte of the response arriving. It includes redirects, DNS, connection setup and server processing, so a high value is not always the application's fault. It's the first phase of LCP, which makes it a common link between frontend and backend performance investigations.

U

USE method

A way of checking resources by looking at three things for each: utilisation, saturation and errors. It applies to CPU, memory, disks and network interfaces, and it works well for systematically finding bottlenecks at the host level. It complements the service-oriented RED method. See golden signals, RED and USE for when to use each.

V

VPA

The Vertical Pod Autoscaler, a Kubernetes add-on that recommends or applies CPU and memory requests based on observed usage. In update modes it may evict pods to apply new values, though in-place resizing is changing that. Recommendation-only mode is a low-risk way to gather sizing data. Avoid combining it with an HPA on the same resource metric.

W

W3C Trace Context

A W3C standard that defines the traceparent and tracestate HTTP headers for propagating trace identity. Because it is shared across tools and languages, a trace can cross services instrumented in different ways. It is the default propagation format in OpenTelemetry. The W3C Trace Context guide describes the header format and common ways it breaks.

White-box monitoring

Monitoring based on data from inside a system, such as application metrics, traces, logs and runtime statistics. It explains why something is happening and can reveal problems before users notice them, but only for what has been instrumented. Pairing it with black-box checks covers cases where the application cannot report its own failure.