Distributed tracing overview

Preview

This product or feature is subject to the "Pre-GA Offerings Terms" in the General Service Terms section of the Service Specific Terms. Pre-GA products and features are available "as is" and might have limited support. For more information, see the launch stage descriptions.

Distributed tracing for Secure Web Proxy provides end-to-end request visibility for outbound web traffic that passes through your proxy gateways to external APIs and third-party services.

Secure Web Proxy integrates with Cloud Trace to capture detailed timing insights and request attributes for each outbound connection. This information helps you detect latency bottlenecks and troubleshoot connectivity errors.

Key benefits

Distributed tracing with Trace provides the following key benefits:

• End-to-end request lifecycle visibility: track outbound requests from internal workloads through Secure Web Proxy to external endpoints.
• Decoupled telemetry policies: define trace sampling rates in independent TelemetryPolicy resources without modifying proxy routing or security rules.
• Cross-telemetry correlation: correlate Trace with Secure Web Proxy proxy transaction logs and Cloud Monitoring metrics by using unified trace IDs.

Architecture of telemetry policies

Distributed tracing for Secure Web Proxy is managed by using TelemetryPolicy resources in the Network Services API.

The key architectural principles include the following:

• Regional policy management: telemetry policies for Secure Web Proxy are regional resources and are created and managed in the same region as the target gateways.
• Independent lifecycle: telemetry policies are separate from gateway security policies and rules. You can create, modify, or delete telemetry policies without affecting how the gateway handles traffic or security.
• Multi-gateway targeting: a single telemetry policy can target multiple Secure Web Proxy gateways within the same region, ensuring consistent tracing standards across several regional deployments.

Parent-based sampling

Parent-based sampling provides dynamic control over trace collection based on upstream sampling decisions. When you enable parent-based sampling, Secure Web Proxy automatically samples requests if the incoming trace context indicates that the upstream client or microservice has already decided to sample the trace.

For requests that don't carry upstream trace context, Secure Web Proxy applies the baseline samplingRate configured in the telemetry policy.

What's next

• Trace outbound traffic with Cloud Trace
• Troubleshoot distributed tracing errors