Actuator and health checks

When the application runs on a server, programs watch it: a load balancer, Docker, Kubernetes, a monitoring system. They need a simple way to ask "are you alive?". The Actuator module adds service addresses: application state, version information, metrics. No code is needed for this.

Setup

<!-- pom.xml -->
<dependency>
    <groupId>org.springframework.boot</groupId>
    <artifactId>spring-boot-starter-actuator</artifactId>
</dependency>

The health check

curl -i http://localhost:8080/actuator/health

HTTP/1.1 200
Content-Type: application/vnd.spring-boot.actuator.v3+json
 
{"groups":["liveness","readiness"],"status":"UP"}

UP means the application is working. Actuator checks whatever is connected by itself: for example, whether the database is reachable. If the database goes down, the status becomes DOWN and the response code 503. liveness and readiness are separate "process alive" and "ready for requests" checks for Kubernetes; they live at /actuator/health/liveness and /actuator/health/readiness.

What is exposed

Actuator has many addresses, but over HTTP only health is exposed by default. Others are enabled explicitly:

# src/main/resources/application.yaml
management:
  endpoints:
    web:
      exposure:
        include: health,info
  info:
    env:
      enabled: true
 
info:
  app:
    name: Blog
    version: "1.0"

management.info.env.enabled allows /actuator/info to show everything under the info key:

curl http://localhost:8080/actuator/info

{"app":{"name":"Blog","version":"1.0"}}

Useful addresses

Address	What it shows
`/actuator/health`	The state of the application and its dependencies
`/actuator/info`	Information about the application
`/actuator/metrics`	Metrics: memory, threads, response times
`/actuator/loggers`	Log levels; they can be changed on the fly
`/actuator/env`	All settings — dangerous to expose

Access with security on

The site chain from the security chapter closes everything not explicitly allowed. Monitoring must see the state without a password, so let's open two addresses:

// src/main/java/com/example/blog/SecurityConfig.java
.requestMatchers("/error", "/actuator/health", "/actuator/info").permitAll()

Other Actuator addresses, if you enable them, stay available only after logging in.

Common mistake

It is tempting to write include: "*" and expose everything at once. But /actuator/env and /actuator/configprops show the application's settings, and /actuator/heapdump hands out a memory snapshot with user data. Expose only health and info, and keep the rest behind a password or on a separate internal port (the management.server.port setting).

Thanks for reading!