{ "api_version": "1", "kind": "dse_post", "self": "https://update.dsesecurity.com/api/v1/posts/choose-opentelemetry-sampling-from-when-the-decision-must-be-made/", "item": { "id": "https://update.dsesecurity.com/updates/choose-opentelemetry-sampling-from-when-the-decision-must-be-made/", "slug": "choose-opentelemetry-sampling-from-when-the-decision-must-be-made", "url": "https://update.dsesecurity.com/updates/choose-opentelemetry-sampling-from-when-the-decision-must-be-made/", "alternate_urls": { "markdown": "https://update.dsesecurity.com/updates/choose-opentelemetry-sampling-from-when-the-decision-must-be-made.md", "json": "https://update.dsesecurity.com/api/v1/posts/choose-opentelemetry-sampling-from-when-the-decision-must-be-made/" }, "title": "Choose OpenTelemetry sampling from when the decision must be made", "summary": "Head sampling does not inspect the whole trace; tail sampling can select traces using error or latency criteria.", "format": { "slug": "guide", "name": "Guide" }, "priority": { "slug": "info", "name": "Information" }, "featured": false, "image": { "theme": "network-infrastructure", "label": "Networks & infrastructure", "alt": "Resilient network core with engineered blue and gold data paths.", "card_url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-card.webp?v=1.8.20", "hero_url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-hero.webp?v=1.8.20", "social_url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-social-v2.jpg?v=1.8.20", "width": 2400, "height": 1350 }, "topics": [ { "slug": "it", "name": "IT", "url": "https://update.dsesecurity.com/topic/it/" }, { "slug": "networks-infrastructure", "name": "Networks & Infrastructure", "url": "https://update.dsesecurity.com/topic/networks-infrastructure/" } ], "author": { "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/#editorial-team", "type": "Organization" }, "publisher": { "name": "Detection Systems & Engineering", "url": "https://dsesecurity.com/" }, "published_at": "2026-10-20T18:15:50+00:00", "modified_at": "2026-10-20T18:34:34+00:00", "reviewed_on": "2026-10-20", "reading_minutes": 2, "word_count": 255, "potentially_affected": "Review trace-sampling timing, selection criteria and combined head/tail processing in the OpenTelemetry guide.", "dse_recommendation": "DSE recommends defining which investigations must retain complete traces before selecting a sampling policy.", "primary_source": { "name": "OpenTelemetry documentation — Sampling", "url": "https://opentelemetry.io/docs/concepts/sampling/", "published_on": null, "authority": "opentelemetry.io" }, "publishing_principles": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/", "usage_info": "https://update.dsesecurity.com/usage/", "copyright_notice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.", "content_html": "

Head sampling does not inspect the whole trace; tail sampling can select traces using error or latency criteria.

\n

Source facts

\n

OpenTelemetry head sampling decides as early as possible without examining the whole trace. Tail sampling considers all or most spans. It can use criteria such as errors or overall latency. Head and tail sampling can be combined, with head sampling first retaining a small percentage and tail sampling making later decisions.

\n

Source: OpenTelemetry documentation — Sampling.

\n

Applicability

\n

Review trace-sampling timing, selection criteria and combined head/tail processing in the OpenTelemetry guide.

\n

DSE recommendation

\n

DSE recommends defining which investigations must retain complete traces before selecting a sampling policy. Separate cost reduction from the requirement to observe rare errors or slow operations. Document what an early drop means for later analysis, and keep all necessary spans together for tail-based decisions. Monitor sampling and export behavior so an unexpectedly low trace count is not automatically attributed to the application. Keep metrics for overall request volume separate from the retained trace sample where the operational question needs population-level counts.

\n

Verification

\n

In a test application, produce normal, slow, and late-error traces and inspect which are retained under the intended policy. Confirm distributed spans reach the required processing stage. Compare observed retention with the written selection criteria and document the information intentionally lost. Retain the expected trace selection table and the actual retained trace identifiers. Have the application owner identify the late-error case and confirm the chosen policy supplies the investigation context that justified it.

\n

Official reference

\n

OpenTelemetry documentation — Sampling. Reviewed October 20, 2026.

", "content_text": "Head sampling does not inspect the whole trace; tail sampling can select traces using error or latency criteria.\nSource facts\nOpenTelemetry head sampling decides as early as possible without examining the whole trace. Tail sampling considers all or most spans. It can use criteria such as errors or overall latency. Head and tail sampling can be combined, with head sampling first retaining a small percentage and tail sampling making later decisions.\nSource: OpenTelemetry documentation — Sampling.\nApplicability\nReview trace-sampling timing, selection criteria and combined head/tail processing in the OpenTelemetry guide.\nDSE recommendation\nDSE recommends defining which investigations must retain complete traces before selecting a sampling policy. Separate cost reduction from the requirement to observe rare errors or slow operations. Document what an early drop means for later analysis, and keep all necessary spans together for tail-based decisions. Monitor sampling and export behavior so an unexpectedly low trace count is not automatically attributed to the application. Keep metrics for overall request volume separate from the retained trace sample where the operational question needs population-level counts.\nVerification\nIn a test application, produce normal, slow, and late-error traces and inspect which are retained under the intended policy. Confirm distributed spans reach the required processing stage. Compare observed retention with the written selection criteria and document the information intentionally lost. Retain the expected trace selection table and the actual retained trace identifiers. Have the application owner identify the late-error case and confirm the chosen policy supplies the investigation context that justified it.\nOfficial reference\nOpenTelemetry documentation — Sampling. Reviewed October 20, 2026.", "content_markdown": "Head sampling does not inspect the whole trace; tail sampling can select traces using error or latency criteria.\n\n## Source facts\n\nOpenTelemetry head sampling decides as early as possible without examining the whole trace. Tail sampling considers all or most spans. It can use criteria such as errors or overall latency. Head and tail sampling can be combined, with head sampling first retaining a small percentage and tail sampling making later decisions.\n\nSource: [OpenTelemetry documentation — Sampling](https://opentelemetry.io/docs/concepts/sampling/).\n\n## Applicability\n\nReview trace-sampling timing, selection criteria and combined head/tail processing in the OpenTelemetry guide.\n\n## DSE recommendation\n\nDSE recommends defining which investigations must retain complete traces before selecting a sampling policy. Separate cost reduction from the requirement to observe rare errors or slow operations. Document what an early drop means for later analysis, and keep all necessary spans together for tail-based decisions. Monitor sampling and export behavior so an unexpectedly low trace count is not automatically attributed to the application. Keep metrics for overall request volume separate from the retained trace sample where the operational question needs population-level counts.\n\n## Verification\n\nIn a test application, produce normal, slow, and late-error traces and inspect which are retained under the intended policy. Confirm distributed spans reach the required processing stage. Compare observed retention with the written selection criteria and document the information intentionally lost. Retain the expected trace selection table and the actual retained trace identifiers. Have the application owner identify the late-error case and confirm the chosen policy supplies the investigation context that justified it.\n\n## Official reference\n\n[OpenTelemetry documentation — Sampling](https://opentelemetry.io/docs/concepts/sampling/). Reviewed October 20, 2026." }, "json_ld": { "@context": "https://schema.org", "@graph": [ { "@type": "Organization", "@id": "https://dsesecurity.com/#organization", "name": "Detection Systems & Engineering", "alternateName": "DSE Security", "url": "https://dsesecurity.com/", "logo": { "@type": "ImageObject", "url": "https://update.dsesecurity.com/assets/dse-logo-20260812.png?v=1.8.20" } }, { "@type": "Organization", "@id": "https://update.dsesecurity.com/#editorial-team", "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/", "parentOrganization": { "@id": "https://dsesecurity.com/#organization" } }, { "@type": "WebSite", "@id": "https://update.dsesecurity.com/#website", "name": "DSE Updates", "alternateName": "DSE Security Knowledge Hub", "url": "https://update.dsesecurity.com/", "inLanguage": "en-US", "publisher": { "@id": "https://dsesecurity.com/#organization" }, "potentialAction": { "@type": "SearchAction", "target": { "@type": "EntryPoint", "urlTemplate": "https://update.dsesecurity.com/?q={search_term_string}" }, "query-input": "required name=search_term_string" } }, { "@type": "WebPage", "@id": "https://update.dsesecurity.com/updates/choose-opentelemetry-sampling-from-when-the-decision-must-be-made/", "url": "https://update.dsesecurity.com/updates/choose-opentelemetry-sampling-from-when-the-decision-must-be-made/", "isPartOf": { "@id": "https://update.dsesecurity.com/#website" }, "lastReviewed": "2026-10-20" }, { "@type": "BreadcrumbList", "@id": "https://update.dsesecurity.com/updates/choose-opentelemetry-sampling-from-when-the-decision-must-be-made/#breadcrumbs", "itemListElement": [ { "@type": "ListItem", "position": 1, "name": "DSE Updates", "item": "https://update.dsesecurity.com/" }, { "@type": "ListItem", "position": 2, "name": "IT", "item": "https://update.dsesecurity.com/topic/it/" }, { "@type": "ListItem", "position": 3, "name": "Choose OpenTelemetry sampling from when the decision must be made", "item": "https://update.dsesecurity.com/updates/choose-opentelemetry-sampling-from-when-the-decision-must-be-made/" } ] }, { "@type": [ "Article", "TechArticle" ], "@id": "https://update.dsesecurity.com/updates/choose-opentelemetry-sampling-from-when-the-decision-must-be-made/#article", "identifier": "https://update.dsesecurity.com/updates/choose-opentelemetry-sampling-from-when-the-decision-must-be-made/", "url": "https://update.dsesecurity.com/updates/choose-opentelemetry-sampling-from-when-the-decision-must-be-made/", "headline": "Choose OpenTelemetry sampling from when the decision must be made", "description": "Head sampling does not inspect the whole trace; tail sampling can select traces using error or latency criteria.", "abstract": "Head sampling does not inspect the whole trace; tail sampling can select traces using error or latency criteria.", "articleBody": "Head sampling does not inspect the whole trace; tail sampling can select traces using error or latency criteria.\nSource facts\nOpenTelemetry head sampling decides as early as possible without examining the whole trace. Tail sampling considers all or most spans. It can use criteria such as errors or overall latency. Head and tail sampling can be combined, with head sampling first retaining a small percentage and tail sampling making later decisions.\nSource: OpenTelemetry documentation — Sampling.\nApplicability\nReview trace-sampling timing, selection criteria and combined head/tail processing in the OpenTelemetry guide.\nDSE recommendation\nDSE recommends defining which investigations must retain complete traces before selecting a sampling policy. Separate cost reduction from the requirement to observe rare errors or slow operations. Document what an early drop means for later analysis, and keep all necessary spans together for tail-based decisions. Monitor sampling and export behavior so an unexpectedly low trace count is not automatically attributed to the application. Keep metrics for overall request volume separate from the retained trace sample where the operational question needs population-level counts.\nVerification\nIn a test application, produce normal, slow, and late-error traces and inspect which are retained under the intended policy. Confirm distributed spans reach the required processing stage. Compare observed retention with the written selection criteria and document the information intentionally lost. Retain the expected trace selection table and the actual retained trace identifiers. Have the application owner identify the late-error case and confirm the chosen policy supplies the investigation context that justified it.\nOfficial reference\nOpenTelemetry documentation — Sampling. Reviewed October 20, 2026.", "datePublished": "2026-10-20T18:15:50+00:00", "dateModified": "2026-10-20T18:34:34+00:00", "mainEntityOfPage": { "@id": "https://update.dsesecurity.com/updates/choose-opentelemetry-sampling-from-when-the-decision-must-be-made/" }, "inLanguage": "en-US", "isAccessibleForFree": true, "author": { "@type": "Organization", "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/#editorial-team" }, "publisher": { "@id": "https://dsesecurity.com/#organization" }, "image": { "@type": "ImageObject", "@id": "https://update.dsesecurity.com/updates/choose-opentelemetry-sampling-from-when-the-decision-must-be-made/#primaryimage", "url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-social-v2.jpg?v=1.8.20", "contentUrl": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-social-v2.jpg?v=1.8.20", "width": 1200, "height": 630, "caption": "Choose OpenTelemetry sampling from when the decision must be made" }, "articleSection": [ "IT", "Networks & Infrastructure" ], "keywords": [ "IT", "Networks & Infrastructure", "Guide", "Information priority" ], "genre": "Guide", "about": [ { "@type": "Thing", "name": "IT", "url": "https://update.dsesecurity.com/topic/it/" }, { "@type": "Thing", "name": "Networks & Infrastructure", "url": "https://update.dsesecurity.com/topic/networks-infrastructure/" } ], "wordCount": 255, "timeRequired": "PT2M", "publishingPrinciples": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/", "usageInfo": "https://update.dsesecurity.com/usage/", "copyrightHolder": { "@id": "https://dsesecurity.com/#organization" }, "copyrightNotice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.", "citation": { "@type": "CreativeWork", "name": "OpenTelemetry documentation — Sampling", "url": "https://opentelemetry.io/docs/concepts/sampling/" } } ] } }