# Monitoring & Logging

## Health and readiness endpoints

| Endpoint | Purpose |
|---|---|
| `GET /.health` | Full health check, including database and Redis connectivity. |
| `GET /.ready` | Readiness probe — `200` if ready to serve traffic, `503` if not. |
| `GET /.live` | Liveness probe — always `200` if the process is up. |
| `GET /.logs` | Real-time log streaming. Add `?format=json` for JSON output. |
| `GET /.metrics` | Prometheus-format metrics. |

`GET /.health` returns structured status, e.g.:

```json
{
"status": "healthy",
"checks": {
"database": { "ok": true },
"redis": { "ok": true }
}
}
```

`/.ready` and `/.live` return simpler payloads with a timestamp and version.

### Access control

These endpoints are restricted to internal networks by default via `MONITORING_IP_WHITELIST`. To reach them from outside that range, either add your IPs to the whitelist or set `MONITORING_HTTP_CREDENTIALS` (`user:password`) to require HTTP Basic Auth instead. See [ENV Variables](/docs/sentinel/operations/env-variables/#monitoring).

## Prometheus metrics

`GET /.metrics` exposes, among others:

- `sentinel_api_challenges_total` (counter)
- `sentinel_api_verifications_success_total` / `sentinel_api_verifications_failed_total` (counters)
- `sentinel_http_requests_per_minute` (gauge)
- `sentinel_http_status_4xx_total` / `sentinel_http_status_5xx_total` (counters)
- `sentinel_http_request_duration_seconds` (histogram)
- CPU, memory, and resident memory usage (gauges)

## Logs

Sentinel writes logs to stdout for capture by your usual container/log tooling. Control format and verbosity with `LOG_FORMAT` (`json` or `plain`) and `LOG_LEVEL` (`trace` through `fatal`, or `silent`). Request logs are retained for `REQUEST_LOGS_TTL` (default `72h`); disabling `ACCESS_LOG_ENABLED` also disables per-request analytics.

> **Tip:**
>
> Request logging can reduce throughput by up to 50% under load — disable it temporarily if you're [benchmarking](/docs/sentinel/operations/performance-tuning/#benchmarks) your own deployment.

## OpenTelemetry (Enterprise)

For distributed tracing, export to an OpenTelemetry collector:

| Variable | Purpose |
|---|---|
| `OTEL_EXPORTER_OTLP_ENDPOINT` | Collector URL, e.g. `https://localhost:4318`. |
| `OTEL_SERVICE_NAME` | Service name in traces/logs (default `altcha-sentinel`). |
| `OTEL_EXPORTER_OTLP_HEADERS` | Extra headers, e.g. an API key. |
| `OTEL_EXPORTER_OTLP_TIMEOUT` | Timeout in ms (default `10000`). |

## Related

- **[ENV Variables](/docs/sentinel/operations/env-variables/)** — full reference, including logging and monitoring variables.
- **[Clustering](/docs/sentinel/operations/clustering/)** — per-instance metrics in the dashboard when running multiple nodes.
- **[License](/docs/sentinel/security/license/)** — OpenTelemetry requires an Enterprise license.