Telemetry

The word combines the Greek tele (remote) and metron (measure) and originally described instruments that transmitted readings from rockets, aircraft or utility equipment to a ground station. In software it covers any machine-generated signal emitted for later analysis: metrics, logs, traces, profiles, and in security, endpoint and network event streams such as process creation, DNS queries and authentication records. Product or usage telemetry, which reports feature usage and crashes from user devices back to a vendor, is a separate category with its own consent and privacy questions.

OpenTelemetry has become the reference architecture. Code is instrumented through a language API; the SDK attaches a Resource describing the emitting entity (service.name, service.version, host, Kubernetes pod and namespace attributes) and applies sampling, batching and export. Attribute names follow semantic conventions, so an HTTP status code or database system is named identically across languages and vendors. Data travels over OTLP, a protobuf-based protocol carried over gRPC (default port 4317) or HTTP (default port 4318), usually to an OpenTelemetry Collector.

The Collector is configured as pipelines per signal type, each composed of receivers (OTLP, Prometheus scrape, filelog, syslog and many others), processors (memory_limiter, batch, attribute redaction, k8sattributes enrichment, tail sampling) and exporters to one or more backends, with connectors joining pipelines, for example to derive span metrics from traces. Common topologies are an agent on every node or as a sidecar, collecting locally with low latency, forwarding to a horizontally scaled gateway tier that centralises credentials, sampling and routing. Designing this path involves backpressure and loss: when a backend is slow, queues fill and data is dropped, so exporters need retry and persistent queues, and the pipeline itself needs monitoring of dropped and refused items.

Telemetry has security and governance dimensions. It is sensitive data: it often contains IP addresses, user identifiers and occasionally secrets captured in URLs or error messages, so collection should minimise, redact and set retention in line with GDPR, and transport should be encrypted and authenticated, typically with TLS or mTLS between agents and gateways. It is also a target: adversaries disable or tamper with logging and security agents to evade detection, catalogued in MITRE ATT&CK as T1562 Impair Defenses, which is why a sudden silence from a host should itself raise an alert. Finally, telemetry is the raw material and observability the resulting capability; collecting data nobody can query or correlate does not make a system observable.