What is observability?

Observability is the software-based ability to explain any state of a system, based on its external outputs.

Often, the more powerful and capable a system, the more complex it becomes. Unfortunately, with this increased complexity comes increased unpredictability; failures, performance bottlenecks, bugs, etc. occur, and determining the root cause of these occurrences isn’t always a simple matter. With complex modern systems, not only does the likelihood of unexpected failure increase, but so does the number of possible failure modes. To counter this trend, IT, development, and operations teams began to implement monitoring tools capable of seeing into the systems themselves.

But progress moves forward, and the complexity of today’s systems is outpacing traditional monitoring capabilities. Today, the proven strategy for protecting systems against unknown failures isn’t monitoring; it’s making the system more monitorable, with observability.

The distinction between observability and monitoring is a subtle, yet important one. Reviewing the capabilities and objectives of each can help teams better understand this distinction, and get more out of their observability strategies.

Monitoring allows users to watch and interpret a system’s state using a predefined series of metrics and logs. In other words, it empowers you to detect known sets of failure modes. Monitoring is crucial for analyzing trends, building dashboards, and alerting response teams to issues as they arise. It provides information about how your applications are working, how they’re growing, and how they’re being used. However, monitoring depends upon a clear understanding of potential failure modes. In other words, it can help you identify “known unknowns” (risks you are already aware of); it can’t help you deal with unknown unknowns (risks that are completely unexpected, have not been considered, and thus are impossible to fully monitor).

This is problematic, because in most complex systems, the unknown unknowns greatly outnumber the known unknowns that are relatively easy to prepare for. More daunting still is the fact that most of these unknown unknowns - often times referred to as blind spots - are so unlikely that identifying and planning for each would be a colossal waste of effort; it’s only the sheer volume of possible unknown unknowns that makes them a threat. So, because you can’t predict what these problems are going to be or even how to monitor them, you must instead constantly gather as much context as you possibly can from the system itself. Observability provides this context. Observability avoids health checks, and instead digs deeply down into how the software itself works. It measures your understanding of a system’s internal state based on its external outputs, using instruments to help you glean insight and assist monitoring.

Monitoring is what happens after something is observable. Without observability, monitoring is not possible.

Software is growing more and more complex with each passing day. There is a combination of patterns in infrastructure, like microservices, polyglot persistence, and containers that continue to decompose larger containers into complex, smaller systems.

At the same time, the quantity of products is growing, and there are many platforms and ways to allow organizations to do new, innovative things. Environments are also growing more and more complex, and not every organization is addressing the increased number of issues that are arising. Without an observable system, the cause of problems is unknown, and there isn't a standard starting point.


Observability’s primary goal is reliability. An effective IT infrastructure that functions properly and reliably according to customer needs requires a measurement of its performance. Observability tools inform user behavior, system availability, capacity, and network speed to ensure that everything is performing optimally.

Security and compliance

Organizations that are subject to compliance must have observability of their computing environments. Full visibility from observability through event logs allows organizations to detect potential intruders, security threats, attempts at brute force, or possible DDoS attacks.

Revenue growth

The ability to analyze events yields valuable information about behaviors, and how they are possibly affected by variables like application format, speed, etc. All of this data can be analyzed for actionable insights into network and application optimization in order to generate revenue and attract new customers.

Observability is divided into three pillars: logs, metrics, and traces.


This is the record of an event that occurred on a system. Logs are automatically generated, timestamped, and written into a file that is unable to be modified. They offer a complete record of events, including metadata about the state of a system and when the event happened. They may be written in plaintext or structured in a specific format.


Metrics are numerical representations of data measured over time. While event logs gather information about specific events, metrics are measured values derived from overall system performance. They usually provide information about application SLIs.


A record of causally-related events as they occur on a network. The events don’t have to happen within a single application, but they must be part of the same request flow. Trace can be formatted as a list of event logs gathered from separate systems involved in the request fulfillment.

The three pillars of observability help bring together data sources that would otherwise be difficult to draw conclusions from alone. This is because, at its heart, observability depends on two things:

  • High-context telemetry data with a great deal of runtime context.
  • The ability to interact with that data iteratively to glean new insights without deploying code.

When these two factors are in place, businesses have the raw resources they need to improve systems and application observability.

Observability is only as effective as it is feasible; all of the contextualized telemetry data in the world won’t be of any use if teams lack the resources to make it actionable.

Context and topology

Context and topology refers to instrumenting in a way that allows for an understanding of relationships in a dynamic, multi-cloud environment with many interconnected components. Context metadata makes possible real-time topology maps and promotes understanding of causal dependencies through the stack, as well as across services, processes, and hosts.

Continuous automation

IT efforts are shifted away from manual configuration with automatic discovery, instrumentation, and baselining of every system component. Continuous automation adds innovation projects that prioritize understandings of what matters. Observability is scalable, which allows constrained teams to do more with less.


An exhaustive fault-tree analysis, in conjunction with code-level visibility, provides the ability to identify the root cause of anomalies without relying on trial and error, guessing, or correlation. Causation-based AI also detects anything unusual to discover what is unknown.

Open ecosystem

It’s advisable to extend observability to include external data sources. It can provide topology mapping, automated discovery and instrumentation, and actional answers that are needed for observability at scale.

Capabilities that scale with your business

Foresee problems before they arise with ServiceNow.