Observability

Logs are the only signal this service emits today. Metrics are defined in code but never recorded, and no traces are exported. Plan your monitoring around logs, the two probes, and the audit records the block writes to its own tables.

Logging

Key	Default	Effect
log.level	error	Sets both the service logger and the root logger, so the bridged standard-library logger matches
datacenter	default	Deployment identity tag — appears as a log field and scopes service discovery
cluster	default	The same, on the cluster axis

The -l flag does not change the log level

The -l / --loglevel flag is applied before the service reads its configuration, and the configuration is applied second — so log.level wins. Its default is error, which means a boot configuration that omits the key silences everything above error even when you pass -l info. The flag value lands under a key nothing reads.

Set log.level in the boot configuration. Treat the flag as inert.

Because the default is error, a service that boots and serves normally logs almost nothing. That is expected, not a sign that logging is broken.

Per-request debugging

With realtimedebug enabled in cluster configuration, a single request can raise its own log level without changing the service:

POST /auth/login?_debug_log_=true
X-Debug-Log: true

Either the query parameter or the header turns on debug logging for that request alone — the switch is generic, so it works on any route. With realtimedebug off — the default — both are ignored.

This is the practical way to investigate one failing tenant or one failing login on a service whose level is error.

Health and readiness

Route	Healthy	Unhealthy
GET /health	200 with {"healthy": true, "dependencies": {…}, "memstats": {…}, "version": ""}	500
GET /ready	200, body ready:true	500, body ready:false

Both are registered before any other route and are exempt from tenancy — they need none of the four CPET headers and no token.

Both probes report the process, not the service

Neither probe consults the configuration client, the database, or any tenant. They flip to true when the listener starts and stay true. A service whose database credentials are wrong, whose configuration source is unreachable, or whose tenants all fail to build will answer 200 on both.

Per-tenant resources are built lazily on the first request naming a customer, product, environment and tenant, so a clean boot proves only that the process is listening. The first sign of a bad credential or an unreachable host is a 500 on a request, not a boot failure. Alert on request errors, not on the probes.

Metrics

There are none to scrape.

The service defines seven instruments — kis.iam.login.count, kis.iam.login.duration, kis.iam.jwt.generated.count, kis.iam.token.refresh.count, kis.iam.token.validation.count, kis.iam.logout.count and kis.iam.login_abuse.count — in a package that has no importers. Nothing increments them and nothing exports them.

telemetry.enabled appears in the shipped full-fleet profile and is inert on this service: nothing on this boot path initialises telemetry, so there is no export of metrics, logs or traces regardless of the value. The same is true of enablecache, which appears in four shipped profiles and is read by nothing.

If you need login volume or failure rates today, derive them from request logs or from the block’s own audit records.

Audit records

Authentication and authorization events are recorded by the block itself rather than emitted as telemetry. See Identity entities for the tables that hold them and what each row carries, and Impersonation for what an operator-initiated session records.

Shutdown

Shutdown does not drain in-flight requests

Stopping the service closes the listener without calling the HTTP server’s shutdown path, so requests in flight are cut rather than allowed to finish. Every stop also prints error: svr is nil in shutdown — that line is the normal shutdown path, not a fault.

Drain at the load balancer before stopping an instance.

Continue with

To do this	Go to
Set log level, ports and boot keys	Configuration
Diagnose a specific failure	Troubleshooting
Understand lazy per-tenant construction	Tenancy