The observe instrumentation audit command checks every application in a project against OpenTelemetry's support for its runtime and libraries. For each application it reports:

• Whether the runtime and its version are supported by OpenTelemetry
• Whether zero-code instrumentation is available, or the runtime needs the OpenTelemetry SDK in code
• Which libraries are instrumented, which versions fall outside the instrumented range, and which need to be enabled or wired in manually

Each finding comes with a fix. The audit reads build metadata only: manifests, lockfiles, and project files. It never builds, runs, or installs anything, needs no credentials, and sends nothing over the network, so you can run it on any checkout or in CI.

Prerequisites

Install the Observe by Snowflake CLI:

curl -fsSL https://raw.githubusercontent.com/observeinc/cli/main/install.sh | bash

The audit is an experimental command. Set OBSERVE_CLI_EXPERIMENTAL=1 in your shell before running it:

export OBSERVE_CLI_EXPERIMENTAL=1

If observe instrumentation audit is not recognized, upgrade the CLI with observe cli upgrade.

Run the audit

Run the audit from your project directory, or pass the directory to scan:

observe instrumentation audit ~/src/contoso-retail

The audit detects each deployable application in the directory, including every service in a monorepo. Test projects, class libraries, and build logic are skipped. The output groups applications by runtime and ends with every finding and its fix:

OpenTelemetry instrumentation audit  ~/src/contoso-retail
manifest 2026-10-27 · 81eb8a0c9452 · bundled
4 applications  · 4 dotnet · 9 findings (1 error · 3 warning · 5 info)
dotnet net8.0  (supported)  ● zero-code instrumentation available
  SDK traces stable · metrics stable · logs stable · profiles none · runtime metrics available
FINDINGS                                           LIBRARIES                                     APPLICATION (use with --app)
OTEL010 (warning), OTEL016 (info), OTEL031 (info)  Azure.Storage.Blobs, Confluent.Kafka +4 more  dotnet/catalog-api
dotnet v4.5  (unsupported)  ● zero-code instrumentation available
  SDK traces stable · metrics stable · logs stable · profiles none · runtime metrics available
FINDINGS                         LIBRARIES                                      APPLICATION (use with --app)
OTEL002 (error), OTEL031 (info)  Microsoft.AspNet.Mvc, Microsoft.AspNet.WebApi  dotnet/loyalty-portal
dotnet net48  (supported)  ● zero-code instrumentation available
  SDK traces stable · metrics stable · logs stable · profiles none · runtime metrics available
FINDINGS                           LIBRARIES                                       APPLICATION (use with --app)
OTEL010 (warning), OTEL031 (info)  log4net, Microsoft.EntityFrameworkCore +3 more  dotnet/order-processor
…
9 findings  1 error · 3 warning · 5 info
  ✗ OTEL002  dotnet v4.5 is below the version range OpenTelemetry supports [dotnet/loyalty-portal]
      Upgrade the dotnet runtime
  ⚠ OTEL010  MySql.Data is not instrumented on dotnet net48; its instrumentation needs dotnet >=8.0.0 [dotnet/order-processor]
      Instrument MySql.Data manually, or move the application to dotnet >=8.0.0
  …

Inspect one application

Pass an application ID from the APPLICATION column to see each library's status. An ID is the application's directory relative to the scanned path, followed by the target name for Bazel and CMake binaries, for example cmd/encoder:encoder.

observe instrumentation audit ~/src/contoso-retail --app dotnet/order-processor

OpenTelemetry instrumentation audit  ~/src/contoso-retail
manifest 2026-10-27 · 81eb8a0c9452 · bundled
Order.Processor  · dotnet net48 · dotnet  (dotnet/order-processor)
● zero-code instrumentation available
  Runtime                 dotnet net48 (supported)
  SDK stability           traces stable  metrics stable  logs stable  profiles none
  Runtime metrics         available
Libraries  3/5 supported
LIBRARY                  DETECTED  SUPPORTED         ORIGIN  STATUS                 INSTRUMENTATION
------------------------------------------------------------------------------------------------------------------------
log4net                  2.0.15    >=2.0.13 <4.0.0   direct  ✓ supported            OpenTelemetry.AutoInstrumentation
Microsoft.EntityFramew…  3.1.32    >=6.0.12          direct  ✗ not on this runtime  OpenTelemetry.Instrumentation.Ent…
MySql.Data               8.1.0     >=8.1.0           direct  ✗ not on this runtime  OpenTelemetry.AutoInstrumentation
RabbitMQ.Client          6.8.1     >=5.0.0           direct  ✓ supported            OpenTelemetry.AutoInstrumentation
StackExchange.Redis      2.6.122   >=2.6.122 <4.0.0  direct  ✓ supported            OpenTelemetry.Instrumentation.Sta…
3 findings  0 error · 2 warning · 1 info
  ⚠ OTEL010  Microsoft.EntityFrameworkCore is not instrumented on dotnet net48; its instrumentation needs dotnet >=8.0.0
      Instrument Microsoft.EntityFrameworkCore manually, or move the application to dotnet >=8.0.0
  ⚠ OTEL010  MySql.Data is not instrumented on dotnet net48; its instrumentation needs dotnet >=8.0.0
      Instrument MySql.Data manually, or move the application to dotnet >=8.0.0
  • OTEL031  Only declared dependencies were assessed; libraries pulled in transitively were not checked
      Generate a CycloneDX SBOM (npx @cyclonedx/cdxgen -o bom.json) and pass it with --app <id> --sbom bom.json

Supported runtimes

The audit detects applications written in Java, .NET (including .NET Framework), Node.js, Python, Ruby, PHP, Go, Rust, Erlang and Elixir, and C++. Java, .NET, Node.js, Python, Ruby, and PHP have zero-code instrumentation. The other runtimes are instrumented in code with the OpenTelemetry SDK, and the audit reports which of their libraries have instrumentation you can wire in.

Support data comes from a catalog bundled with the CLI. The manifest line in the output shows the catalog's date. Libraries that are not in the catalog are not assessed and produce no finding.

Assess transitive dependencies

Without a dependency graph, the audit checks only the libraries your project declares directly and raises OTEL031. An instrumented library pulled in by another dependency, such as a database driver under an ORM, would go unchecked.

• Node.js: commit a package-lock.json or pnpm-lock.yaml.
• Python: commit a uv.lock.
• Java, .NET, Ruby, and PHP: pass a CycloneDX SBOM with --sbom.

The audit never runs Maven, Gradle, or other build tools itself, because they execute code from the repository. Generate the SBOM with your usual tooling, for example the CycloneDX Maven plugin, the CycloneDX Gradle plugin, the CycloneDX .NET tool, or syft against a container image. Then pass it for one application:

observe instrumentation audit ~/src/contoso-retail \
  --app java/payments-service \
  --sbom payments-service.cdx.json

You can also audit an SBOM on its own, without the source code. The audit infers the runtime from the components' package URLs:

observe instrumentation audit --sbom pricing-function.cdx.json

Run the audit in CI

The audit exits with a code your CI system can act on:

--fail-on defaults to error. Use --fail-on warning to also fail on out-of-range libraries, or --fail-on none to report without failing. Tool errors always exit 2.

The following GitHub Actions workflow runs the audit on every pull request and publishes the findings to GitHub code scanning:

name: OpenTelemetry readiness

on:
  pull_request:
  push:
    branches: [main]

permissions:
  contents: read
  security-events: write

jobs:
  audit:
    runs-on: ubuntu-latest
    env:
      OBSERVE_CLI_EXPERIMENTAL: "1"
    steps:
      - uses: actions/checkout@v4

      - name: Install the Observe by Snowflake CLI
        run: |
          export OBSERVE_INSTALL_DIR="$HOME/.observe/bin"
          curl -fsSL https://raw.githubusercontent.com/observeinc/cli/main/install.sh | bash
          echo "$OBSERVE_INSTALL_DIR" >> "$GITHUB_PATH"

      - name: Audit OpenTelemetry readiness
        run: observe instrumentation audit . --format sarif --fail-on error > otel-readiness.sarif

      - name: Upload findings to code scanning
        if: always()
        uses: github/codeql-action/upload-sarif@v3
        with:
          sarif_file: otel-readiness.sarif
          category: opentelemetry-readiness

To annotate pull requests without code scanning, use --format github and drop the upload step.

Command options

Findings reference

Rule IDs are stable across CLI releases. Severities may change.

Use AI to run the audit

The opentelemetry-readiness-audit skill runs the audit from an agentic coding tool, explains the findings, offers to close gaps with a lockfile or SBOM, and hands off to the instrumentation skills. See Instrument your applications using AI skills.