Luca BertonObservability Is a Compliance Requirement
Observability isn't optional in regulated environments. DORA Articles 10 and 13 require continuous monitoring and logging of ICT systems. NIS2 Article 21(2)(b) requires incident detection capabilities. The question isn't whether to implement observability — it's how to build it with compliance in mind from day one.
The Grafana LGTM stack (Loki, Grafana, Tempo, Mimir) provides a complete, open-source observability platform that gives you full control over your data — critical for data sovereignty requirements.
The LGTM Stack
Metrics: Grafana Mimir (or Prometheus)
- Prometheus: Industry-standard metrics collection via pull-based scraping
- Grafana Mimir: Horizontally scalable, long-term Prometheus storage. Supports multi-tenancy.
- Compliance relevance: SLO monitoring, resource utilisation, error rates, latency — the quantitative evidence that systems are performing within acceptable parameters
- Retention: Configure retention per tenant — regulatory data kept longer than operational data
Logs: Grafana Loki
- Log aggregation: Collect and query logs from all services, infrastructure, and security systems
- Label-based indexing: Cost-effective at scale (doesn't index full text like Elasticsearch)
- Compliance relevance: Audit logs, access logs, application logs, security events — all queryable from one place
- Multi-tenancy: Isolate log data by team, environment, or compliance boundary
- Retention policies: Per-tenant retention — security logs retained for 1+ year, debug logs for 30 days
Traces: Grafana Tempo
- Distributed tracing: Follow a request across microservices — identify where failures and latency originate
- OpenTelemetry native: Accepts traces via OTLP, Jaeger, Zipkin protocols
- Compliance relevance: Incident investigation (DORA Art. 17-23) — trace the exact path of a failed transaction
- Cost-effective: Stores traces in object storage (S3, GCS, Azure Blob) — 10x cheaper than Elasticsearch-based tracing
Compliance-Ready Alerting
Grafana Alerting (unified alerting) enables compliance-relevant alerts:
- SLO-based alerts: Alert when error budget is burning too fast (not just when thresholds are crossed)
- Incident detection: Automated detection of anomalies in security logs, access patterns, and system behaviour
- Multi-channel routing: PagerDuty for P1, Slack for P2, email for P3 — with escalation policies
- Alert history: Full history of fired alerts with annotations — evidence for incident reporting
- Silence and inhibition: Managed with audit trail — no silent suppression of alerts without documentation
Kubernetes Recipes
Practical guide for container orchestration and deployment — hands-on patterns you can use today.
View on Amazon →Grafana Stack vs Datadog
| Dimension | Grafana LGTM | Datadog |
|---|---|---|
| Data sovereignty | Full control (self-hosted) | SaaS (US-based, EU regions available) |
| Cost at scale | Infrastructure cost only (predictable) | Per-host + per-GB pricing (can spike) |
| Operational burden | High (self-managed) or Grafana Cloud | Low (fully managed SaaS) |
| Customisation | Unlimited (open source) | Feature-rich but constrained |
| Vendor lock-in | Low (open standards, OpenTelemetry) | High (proprietary query language, agents) |
See our detailed comparison: Datadog vs Grafana Observability Comparison.
Implementation Roadmap
- Week 1-2: Deploy Prometheus + Grafana. Instrument all Kubernetes clusters with kube-prometheus-stack.
- Week 3-4: Deploy Loki for log aggregation. Migrate from ELK or start fresh with structured logging.
- Month 2: Add Tempo for distributed tracing. Instrument critical services with OpenTelemetry SDK.
- Month 3: Build compliance dashboards — SLO tracking, security event monitoring, audit log analysis.
- Ongoing: Configure retention policies per data type and regulatory requirement. Automate report generation.
Automating IT Infrastructure with Ansible
Learn Ansible to automate IT operations and enhance system reliability.
Start on Udemy →