Establish and Document the Application's Monitoring, Observability, and Runbooks

This chapter explains how to establish and document how an Application’s health is observed, what it logs, how alerts are handled, and how operational tasks are performed.

Establish Monitoring and Observability

Establish, with the Operations and Support Team(s) and the IT Application Owner:

• What is monitored: availability, performance, errors, resource usage, Integration health, scheduled job outcomes, and business-level indicators such as transaction volumes.

• Alerts: the thresholds that trigger alerts, their severity, and who receives them.

• Dashboards: where the Application’s health can be seen at a glance.

• Observability: the metrics, logs, and traces that allow problems to be diagnosed, not only detected.

Establish Logging and Audit Trails

Establish what the Application logs and how logs are managed:

• Operational logging: what events are logged to support diagnosis, and at what level of detail.

• Audit logging: the recording of security-relevant and sensitive operations, such as logins, access changes, and changes to critical data, in a form that supports investigation and audit.

• Log retention: how long each kind of log is kept, consistent with the Application’s retention rules and regulatory obligations.

• No sensitive data in logs: Security Secrets and sensitive personal or regulated data must not be written to logs unless they are masked.

Establish Runbooks

Create runbooks for the operational tasks the Application requires:

• Routine tasks, such as starting and stopping the Application or running scheduled processes.

• Alert responses, explaining for each alert what it means, how to diagnose it, and how to resolve or escalate it.

Document and Share Monitoring, Logging, and Runbooks

Record the design of the Application’s monitoring, alerting, logging, and audit trails in the Operational section of the Application Documentation, and publish its runbooks there, linked wherever possible from the alerts they address. Record Instance differences, such as reduced monitoring in non-production environments. Update monitoring and runbooks with every Release that changes the Application’s behavior, and after every incident that reveals a gap.

Best Practice: Establish and Document the Application’s Monitoring, Observability, and Runbooks

It is a best practice to both establish and document the solution for observing and operating an Application: define what is monitored and alerted on, how it is logged and audited, and how each alert and routine task is handled, and link runbooks directly to the alerts they address.

Benefits: Good monitoring and observability detect problems before users do and make their causes diagnosable, while runbooks let any trained operator respond correctly at any hour. Proper audit logging, with no sensitive data in logs, supports investigations and audits without creating new security exposure.

Connections to Related IF4IT Practices and Inventories

The IT Operating Environments Best Practices addresses monitoring and observing all governed environments. The Service Management Best Practices addresses event and incident management.