Spring Boot Actuator: Quick Start, Key Endpoints, Monitoring and Security Integration

When a micro‑service project needed comprehensive monitoring, the author turned to Spring Boot Actuator, a production‑ready module that exposes health checks, metrics, logging information, and control operations via HTTP or JMX.

Quick start : a demo can be generated with the Spring Boot CLI command spring init -d=web,actuator -n=actuator-demo or via Spring Initializr, adding the Maven dependency <dependency> <groupId>org.springframework.boot</groupId> <artifactId>spring-boot-starter-actuator</artifactId> </dependency> (or the equivalent Gradle dependencies { compile "org.springframework.boot:spring-boot-starter-actuator" } ).

Endpoints overview : Actuator provides native endpoints grouped into configuration, metrics and operational categories. Important ones include /actuator/health , /actuator/metrics , /actuator/loggers , /actuator/beans , /actuator/heapdump , /actuator/threaddump and /actuator/shutdown .

Health endpoint : By default it shows only status; the detail level can be set with management.endpoint.health.show-details=always . A custom health indicator can be created by implementing HealthIndicator or extending AbstractHealthIndicator :

@Component
public class CustomHealthIndicator extends AbstractHealthIndicator {
    @Override
    protected void doHealthCheck(Health.Builder builder) throws Exception {
        builder.up().withDetail("app", "this project is healthy");
    }
}

Metrics endpoint : Access /actuator/metrics to list available metric names, then query a specific metric, e.g., /actuator/metrics/jvm.memory.max , optionally filtering by tags.

Loggers endpoint : Shows all logger configurations. The log level of a logger can be changed at runtime by POSTing JSON to /actuator/loggers/{name} , for example:

{"configuredLevel":"DEBUG"}

Info endpoint : Custom information can be added via application.properties using the info.* namespace, which will be returned as JSON from /actuator/info .

Security integration : Adding spring-boot-starter-security enables HTTP basic authentication. A typical security configuration protects actuator endpoints while allowing static resources and the root path:

@Configuration
public class ActuatorSecurityConfig extends WebSecurityConfigurerAdapter {
    @Override
    protected void configure(HttpSecurity http) throws Exception {
        http.authorizeRequests()
            .requestMatchers(EndpointRequest.toAnyEndpoint()).hasRole("ACTUATOR_ADMIN")
            .requestMatchers(PathRequest.toStaticResources().atCommonLocations()).permitAll()
            .antMatchers("/").permitAll()
            .anyRequest().authenticated()
            .and().httpBasic();
    }
}

Corresponding properties define the default user and role, e.g., spring.security.user.name=actuator , spring.security.user.password=actuator , spring.security.user.roles=ACTUATOR_ADMIN .

The article concludes with a link to the full source code on GitHub and encourages readers to try the examples.