Master Spring Boot 3 Monitoring with JavaMelody: Real‑World Cases & Config Guide

The author announces a Spring Boot 3 practical case collection (over 90 real‑world articles) and a PDF ebook, available to subscribers along with source code.

1. Introduction

JavaMelody monitors Java, Java EE, or Jakarta EE applications in QA and production environments. It measures actual usage statistics rather than simulating requests, offering response time, execution counts, trends, and root‑cause analysis.

Provides average response time and execution count.

Helps decision‑making when trends degrade.

Optimizes based on worst response times.

Identifies root causes of latency.

Validates the effect of optimizations.

Plugins exist for Spring Boot, Jenkins, JIRA, Confluence, Bamboo, Bitbucket, Liferay, Alfresco, Sonar, Grails, etc.

2. Practical Example

2.1 Environment Setup

<code>&lt;dependency&gt;
  &lt;groupId&gt;net.bull.javamelody&lt;/groupId&gt;
  &lt;artifactId&gt;javamelody-spring-boot-starter&lt;/artifactId&gt;
  &lt;version&gt;2.5.0&lt;/version&gt;
&lt;/dependency&gt;</code>

This dependency supports Spring Boot 3. For Spring Boot 2 use version 1.99.2; Spring Boot 1.x is not supported.

<code>&lt;dependency&gt;
  &lt;groupId&gt;net.bull.javamelody&lt;/groupId&gt;
  &lt;artifactId&gt;javamelody-spring-boot-starter&lt;/artifactId&gt;
  &lt;version&gt;1.99.2&lt;/version&gt;
&lt;/dependency&gt;</code>

2.2 Monitoring Management

After adding the dependency, start the application and open http://localhost:8080/monitoring to view metrics such as HTTP, SQL, and memory charts.

http://localhost:8080/monitoring

Spring beans annotated with @Controller , @RestController , @Service , @Async , @FeignClient , as well as RestTemplate , ElasticsearchOperations , and methods annotated with @Async , @Scheduled are automatically monitored.

<code>@Service
public class AsyncService {
    @Async
    public void task() {
        while (true) {
            System.err.printf("Current thread: %s%n", Thread.currentThread().getName());
            TimeUnit.SECONDS.sleep(2);
        }
    }
}</code>

Custom monitoring can be added with @MonitoredWithSpring :

<code>@Service
public class CustomService {
    @MonitoredWithSpring
    public void run() {
        System.err.println("Custom monitored method...");
        try {
            TimeUnit.MILLISECONDS.sleep(new Random().nextInt(5000));
        } catch (InterruptedException e) {}
    }
}</code>

2.3 Custom Configuration

Configuration properties prefixed with javamelody allow fine‑tuning:

<code>javamelody:
  enabled: true
  excluded-datasources: secretSource,topSecretSource
  spring-monitoring-enabled: true
  init-parameters:
    log: true
    url-exclude-pattern: (/webjars/.*|/css/.*|/images/.*|/fonts/.*|/js/.*)
    # other optional parameters …
    storage-directory: /tmp/javamelody
    monitoring-path: /admin/performance</code>

Data can be persisted to the directory defined by storage-directory .

2.4 Security Management

By default the monitoring page is unsecured, which is risky for production. Basic authentication can be configured via javamelody.init-parameters['authorized-users'] :

<code>javamelody:
  init-parameters:
    authorized-users: admin:123123</code>

For stronger security, integrate Spring Security:

<code>&lt;dependency&gt;
  &lt;groupId&gt;org.springframework.boot&lt;/groupId&gt;
  &lt;artifactId&gt;spring-boot-starter-security&lt;/artifactId&gt;
&lt;/dependency&gt;</code>

<code>@Bean
UserDetailsService userDetailsService() {
    UserDetails admin = User.withUsername("admin")
        .password("123123")
        .roles("admin")
        .build();
    return new InMemoryUserDetailsManager(admin);
}

@Bean
PasswordEncoder passwordEncoder() {
    return new PasswordEncoder() {
        public boolean matches(CharSequence raw, String enc) { return enc.equals(raw); }
        public String encode(CharSequence raw) { return raw.toString(); }
    };
}

@Bean
SecurityFilterChain javamelodySecurityFilter(HttpSecurity http) throws Throwable {
    http.csrf(withDefaults());
    http.formLogin(withDefaults());
    http.authorizeHttpRequests(reg -> {
        reg.requestMatchers("/monitoring").hasRole("admin");
        reg.anyRequest().permitAll();
    });
    return http.build();
}</code>

After applying the security configuration, accessing the monitoring page requires the defined credentials.