Observability on Board

Episode 03tracesmetricslogs

Keycloak can trace every login

Since Keycloak 26, OpenTelemetry ships inside the server. A few lines in keycloak.conf export traces, logs and metrics for every login and token grant.

Ship telemetry toUse an OTLP endpoint you already have, from another vendor or your platform team. This one needs a one-time setup step: save your endpoint and the episodes fill it in.Set your endpointRun an OpenTelemetry Collector on your machine and watch telemetry arrive in its terminal. No account needed.More detailsShip straight to Bronto. You need an account and an API key with ingest permission.More details

Switch it on

Add these lines to conf/keycloak.conf and restart. Traces for every request down to the SQL statement, Keycloak’s own logs with trace ids attached, and metrics. Tracing and logs are preview features, metrics experimental.

features=opentelemetry,opentelemetry-logs,opentelemetry-metrics
tracing-enabled=true
telemetry-logs-enabled=true
metrics-enabled=true
telemetry-metrics-enabled=true
telemetry-protocol=http/protobuf
# host only: Keycloak appends /v1/traces, /v1/logs, /v1/metrics itself
telemetry-endpoint=https://ingestion.eu.bronto.io
telemetry-header-x-bronto-api-key=${BRONTO_API_KEY}
telemetry-service-name=sso

Keycloak fills ${BRONTO_API_KEY} from the environment at boot.

features=opentelemetry,opentelemetry-logs,opentelemetry-metrics
tracing-enabled=true
telemetry-logs-enabled=true
metrics-enabled=true
telemetry-metrics-enabled=true
telemetry-protocol=http/protobuf
telemetry-endpoint=http://localhost:4318

This assumes a Collector listening on localhost:4318; the Local Collector setup shows how to start one. From Docker, use http://host.docker.internal:4318.

This uses the endpoint and auth header you saved in the setup guide.

features=opentelemetry,opentelemetry-logs,opentelemetry-metrics
tracing-enabled=true
telemetry-logs-enabled=true
metrics-enabled=true
telemetry-metrics-enabled=true
telemetry-protocol=http/protobuf
# host only: Keycloak appends /v1/traces, /v1/logs, /v1/metrics itself
telemetry-endpoint=YOUR_OTLP_ENDPOINT
telemetry-header-YOUR_AUTH_HEADER=YOUR_AUTH_VALUE