Topic starter
08/06/2026 5:00 pm
TL;DR: Metrics, logs, and traces together improve system visibility, but each pillar breaks down under microservices sprawl, high-cardinality data, and sampling limits, according to StrongDM. For IAM and NHI teams, the real lesson is that observability data is only useful when identity and access events are centralized enough to explain who touched what, when, and through which path.
Editorial analysis by NHI Mgmt Group, based on content published by StrongDM: “Three Pillars of Observability Explained: Metrics, Logs, Traces”.
Key questions
A: Security teams should use metrics to detect anomalies, logs to reconstruct the identity trail, and traces to understand request flow across services.
Q: Why do metrics, logs, and traces still leave gaps in microservices environments?
A: Because each pillar answers a different question and each breaks down differently at scale.
Q: What are the signs that an observability platform is not giving teams enough visibility?
A: Common signs include slow root cause analysis, repeated manual correlation across tools, blind spots between services, and difficulty understanding transaction flows.
Practitioner guidance
- Centralise access telemetry Send logs, metrics, and traces into a shared analysis layer so distributed access events can be correlated across services.
- Define identity-linked observability objectives Tie the data you retain to specific questions about access, such as which identity touched which service, when, and through what path.
- Reduce high-cardinality noise Limit tag explosion and only retain the dimensions needed to explain access paths, anomalies, and service ownership.
Bottom line: Metrics, logs, and traces each contribute useful visibility, but none of them alone gives a complete picture of distributed access in modern systems.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 4 days ago by NHI Mgmt Group
08/06/2026 6:57 pm
Distributed observability fails when identity evidence is fragmented across systems: The article shows that metrics, logs, and traces each lose value when a modern stack spans many services. That is not just a monitoring issue. It is an identity governance issue because access evidence becomes scattered across tools, formats, and retention models, making accountability harder to prove after the fact. Practitioners should read this as a reminder that visibility only matters when access data can be correlated end to end.
A question worth separating out:
Q: When should organisations prioritise centralised telemetry over collecting more data?
A: They should prioritise centralisation when distributed services make it difficult to answer basic investigation questions or when volume and cardinality are making storage and analysis cost-prohibitive. Centralised, structured evidence is more valuable than additional raw telemetry that cannot be queried or correlated effectively.
👉 Read our full editorial: Observability’s three pillars expose access gaps in distributed systems
This post was modified 4 days ago by NHI Mgmt Group