Structured logs, correlation and distributed tracing

Seeing what happens in production: logs, metrics and traces.

UnderstandStudy an examplePractise

Understand the concept

Observability has three basic signals. Logs describe individual events: ‘message stored’, ‘sign-in failed’. Metrics measure numbers over time: requests per second, error rate, response time percentiles. Traces show one request’s journey across all services with timings.

Logs should be structured. Instead of concatenated text such as ‘User 42 deleted post 7’, use a template and fields: logger.LogInformation("User {UserId} deleted post {PostId}", userId, postId). The log system can then search and group by field. Choose levels meaningfully: Information for normal events, Warning for unexpected but tolerated situations, Error for failed operations.

In a distributed system the records of one request arise in different services. The W3C traceparent header and .NET’s Activity infrastructure carry the same trace id from Next.js to the API and the database. OpenTelemetry collects this data in a standard form and ships it to a tracing system. Passwords, tokens and personal data are never written to logs.

WHEN TO USE IT

You cannot fix what you cannot see; production has no debugger, only signals.

COMMON PITFALL

Logging by string concatenation or logging request bodies (passwords included) as they are.

01 / PRACTICE

One topic. Three levels of depth.

Illustrative example

// ✗ aranamaz metin
logger.LogInformation("Post " + id + " published by " + user);
// ✓ yapılandırılmış
logger.LogInformation("Post {PostId} published by {UserId}", id, userId);

Template fields can be queried individually in the log system.

This page connects to no real server or database. Code samples are illustrative for .NET 8, Next.js and SQL Server; timings are example values in the simulation, not measurements. Try samples only in your own development environment; never share real connection strings, tokens or passwords.

02 / YOUR TURN

Try it yourself first.

Average response time is 120 ms but users say ‘sometimes it’s very slow’. Which metric do you check and why is the average misleading?

Show the solution and explanation

Worked solution

p95 / p99 yanıt süresi (yüzdelikler).
Ör. p50 = 80 ms, p99 = 4.2 s → her 100 istekten biri 4 saniyeden uzun.
Ortalama, nadir ama çok yavaş istekleri gizler.

The worst cases shape user experience; percentiles reveal the slow tail.

RasimAtaberkŞahin

Understand the concept

One topic. Three levels of depth.

Try it yourself first.