{"licence":{"name":"CC BY-SA 4.0","spdx":"CC-BY-SA-4.0","url":"https://creativecommons.org/licenses/by-sa/4.0/","attribution":"Atlas, a bilingual technical dictionary (https://cmaintz.github.io/tech-atlas/)"},"id":"platform/monitoring","url":{"en":"https://cmaintz.github.io/tech-atlas/en/terms/platform/monitoring/","da":"https://cmaintz.github.io/tech-atlas/da/terms/platform/monitoring/"},"term":{"en":"Monitoring","da":"Overvågning (monitoring)"},"aka":{"en":[],"da":["monitorering"]},"domain":["platform"],"cluster":"observability","layer":"observability","status":"current","summary":{"en":"Watching a set of chosen measurements on systems over time and warning people when one moves outside its normal range.","da":"At holde øje med en række udvalgte målinger på systemer over tid og advare folk, når en af dem bevæger sig uden for det normale."},"body":{"formal":{"en":"The ongoing collection and display of known measures of a system's health, such as whether it answers, how busy it is and how often it fails, checked against set limits so that known kinds of trouble raise an alarm.","da":"Løbende indsamling af kendte mål for et systems sundhed, fx om det svarer, hvor meget det har at lave, og hvor ofte det fejler, som vises og holdes op mod faste grænser, så kendte typer af problemer udløser en alarm."},"plain":{"en":"Like the warning lights on a car's dashboard; they tell you quickly that the oil is low, but not why the engine is making a strange noise.","da":"Som advarselslamperne på en bils instrumentbræt; de fortæller hurtigt, at olien er lav, men ikke hvorfor motoren laver en underlig lyd."},"inPractice":{"en":"A screen in a water utility's control room shows memory use, response times and error counts for the servers that run its pumping stations, and turns red when one of them stops answering.","da":"En skærm i vandværkets kontrolrum viser hukommelsesforbrug, svartider og antal fejl for de servere, der styrer pumpestationerne, og bliver rød, når en af dem holder op med at svare."},"whyItMatters":{"en":"It keeps services available by catching known problems before users notice, and it is often the first place an attack shows up as odd load or failures.","da":"Den holder tjenester tilgængelige ved at fange kendte problemer, før brugerne mærker dem, og det er ofte her, et angreb først viser sig som usædvanlig belastning eller fejl."}},"deepDive":{"en":"The Google SRE book frames monitoring as collecting, processing, aggregating and displaying real-time quantitative data about a system, and draws a key line between black-box and white-box monitoring. Black-box monitoring tests externally visible behaviour the way a user would, with synthetic HTTP requests, DNS lookups or scripted login journeys from several locations; it detects symptoms that are happening now but says nothing about causes or imminent failure. White-box monitoring relies on internals exposed by the system itself (metrics endpoints, logs, runtime statistics) and can reveal a queue that is filling or retries masking errors before users are hurt. Real user monitoring, which collects timings from actual browsers or apps, complements both.\n\nArchitecturally, monitoring has evolved from check-based systems to time-series systems. Nagios (released in 1999 as NetSaint) and its descendants run plugins that return OK, WARNING, CRITICAL or UNKNOWN per host and service, while SNMP polling and traps remain common for network gear and appliances. Prometheus, started at SoundCloud in 2012 and accepted into the CNCF in 2016 as its second project after Kubernetes, popularised pulling labelled metrics into a time-series database and expressing both dashboards and alert conditions as queries over it, with service discovery keeping the target list in step with dynamic infrastructure. Dashboards (Grafana being the common front end) serve humans; alert rules serve machines, and the two should not be confused with each other.\n\nFrequent failure modes include monitoring the monitoring system from within the same failure domain, so a network or cluster outage takes out both the service and the system meant to report on it; stale targets after infrastructure changes, which silently stop producing data; thresholds copied from defaults rather than derived from user impact; and dashboards with hundreds of panels that nobody can interpret during an incident. A meta-monitoring check from an independent location and an always-firing watchdog alert address the first two.\n\nMonitoring also has a compliance role. ISO/IEC 27001:2022 Annex A control 8.16, Monitoring activities, expects networks, systems and applications to be monitored for anomalous behaviour, and security teams typically consume the same telemetry through a SIEM. Compared with observability, monitoring is the narrower practice of watching predefined signals for known failure modes; observability is the system property that allows new questions to be asked during novel incidents. In practice the two share pipelines, and mature teams still rely on monitoring for alerting while using high-dimensional data for investigation.","da":"Googles SRE-bog beskriver overvågning som indsamling, behandling, aggregering og visning af kvantitative realtidsdata om et system og trækker en vigtig skillelinje mellem black-box- og white-box-overvågning. Black-box-overvågning tester den udefra synlige adfærd, som en bruger ville opleve den, med syntetiske HTTP-forespørgsler, DNS-opslag eller scriptede login-forløb fra flere lokationer; den opdager symptomer, der sker nu, men siger intet om årsager eller forestående fejl. White-box-overvågning bygger på indre data, som systemet selv udstiller (metrik-endpoints, logs, runtime-statistik), og kan afsløre en kø, der fyldes op, eller genforsøg, der skjuler fejl, før brugerne rammes. Real user monitoring, der indsamler tidsmålinger fra rigtige browsere eller apps, supplerer begge.\n\nArkitektonisk har overvågning udviklet sig fra tjekbaserede systemer til tidsseriesystemer. Nagios (udgivet i 1999 som NetSaint) og dets efterfølgere kører plugins, der returnerer OK, WARNING, CRITICAL eller UNKNOWN pr. host og tjeneste, mens SNMP-polling og traps stadig er udbredt til netværksudstyr og appliances. Prometheus, der blev startet hos SoundCloud i 2012 og optaget i CNCF i 2016 som projekt nummer to efter Kubernetes, gjorde det udbredt at hente metrikker med labels ind i en tidsseriedatabase og udtrykke både dashboards og alarmbetingelser som forespørgsler mod den, mens service discovery holder listen over targets i takt med en dynamisk infrastruktur. Dashboards (typisk med Grafana som frontend) er til mennesker; alarmregler er til maskiner, og de to bør ikke forveksles.\n\nHyppige fejl er at overvåge selve overvågningssystemet inde fra samme fejldomæne, så et netværks- eller klyngenedbrud tager både tjenesten og det system, der skulle rapportere om den; forældede targets efter ændringer i infrastrukturen, som lydløst holder op med at levere data; tærskler kopieret fra standardværdier i stedet for udledt af brugerpåvirkning; og dashboards med hundredvis af paneler, som ingen kan tolke under en hændelse. Et meta-overvågningstjek fra en uafhængig lokation og en watchdog-alarm, der altid fyrer, adresserer de to første.\n\nOvervågning har også en compliance-rolle. ISO/IEC 27001:2022 Annex A kontrol 8.16, Monitoring activities, forventer, at netværk, systemer og applikationer overvåges for unormal adfærd, og sikkerhedsteams bruger typisk den samme telemetri via et SIEM. Sammenlignet med observerbarhed er overvågning den snævrere praksis at holde øje med foruddefinerede signaler for kendte fejltyper; observerbarhed er den egenskab ved systemet, der gør det muligt at stille nye spørgsmål under uventede hændelser. I praksis deler de to pipelines, og modne teams bruger fortsat overvågning til alarmering og højdimensionelle data til undersøgelse."},"edges":[{"type":"requires","to":"platform/metrics","confidence":"high","strength":"normal"},{"type":"contrasts-with","to":"platform/observability","why":{"en":"Monitoring answers questions you chose in advance; observability lets you ask new questions about problems you did not expect.","da":"Overvågning besvarer spørgsmål, man har valgt på forhånd; observerbarhed lader en stille nye spørgsmål om problemer, man ikke forventede."},"confidence":"high","strength":"primary"}],"depth":1,"sources":[{"title":"Google SRE book - Chapter 6, Monitoring Distributed Systems","url":"https://sre.google/sre-book/monitoring-distributed-systems/","tier":"reference","publisher":"Google"}],"draft":true}