Search code examples
spring-boothealth-monitoring

How is the default configuration of the Spring Boot health endpoint useful

Spring Boot can provide a health endpoint. That is an HTTP URI (/actuator/health, by default) you can GET for health information about the application. Spring Boot enables this functionality by default. Spring Boot also has a configuration property, management.endpoint.health.show-details, for securing whether details are included in the response. The default value of that property is never, so details are not shown. Therefore the default configuration of Spring Boot is to provide the endpoint, but without any details.

But what is the use of a health endpoint without details? What does being able to GET the resource tell you, despite the resource containing no details?

Solution

  • If you use management.endpoint.health.show-details=never, you can still see the aggregated status. This status is an aggregation of all detail statuses. By default, the OrderedHealthAggregator is being used, which results in:

    • If all details are UP, the parent is also UP
    • If one of the details is DOWN, the parent is also DOWN

    This is the relevant part of the documentation:

    By default, the final system state is derived by the HealthAggregator which sorts the statuses from each HealthIndicator based on an ordered list of statuses. The first status in the sorted list is used as the overall health status. If no HealthIndicator returns a status that is known to the HealthAggregator, an UNKNOWN status is used.

    The order can be configured through the management.health.status.order property. By default it contains DOWN, OUT_OF_SERVICE, UNKNOWN, UP.

    The HTTP status also changes depending on the aggregate status. Both UP and UNKNOWN result in a HTTP status 200, while DOWN and OUT_OF_SERVICE result in an HTTP status 503. This is the relevant part of the documentation:

    The HTTP status code in the response reflects the overall health status (for example, UP maps to 200, while OUT_OF_SERVICE and DOWN map to 503).

    You can also configure which HTTP status should be picked, for example by configuring management.health.status.http-mapping.DOWN=418.

    This means that you can still use that piece of information to know whether or not something is wrong. This can be useful for any tool/software that monitors these endpoints (Eureka, Kubernetes, any monitoring tool, ...).

    You may wonder, why not show all detailed information by default? Well, the issue is that this can contain sensitive information, such as how much disk space you have, where your application configuration is stored, what types of database you connect to, ... .