Stage 3 · Build
Metrics, Health & Profiling
pprof Endpoints
net/http/pprof, CPU profiles, heap profiles, block profiles, and secured debug listeners.
7 min readGo for SREBuild
pprof Setup
pprof endpoints expose profiling data via HTTP. They are the primary tool for diagnosing performance issues in production Go services.
Gopprof-endpoint-setup.go
32 linesLn 1, Col 1Go
Import pprof for default handlers. Create a dedicated mux for the debug port. This separates profiling from your main server. Always bind to localhost only.
CPU Profiles
Gocpu-profile-collection.go
33 linesLn 1, Col 1Go
CPU profiles sample at 100 Hz. The profile shows where CPU time is spent. Use top to find hot functions. Use list for source-level detail. Use web for call graphs. Use flame for flame graphs.
Heap Profiles
Goheap-profile-analysis.go
28 linesLn 1, Col 1Go
Heap profiles show memory allocation. inuse_space shows current usage — use for memory leaks. alloc_space shows total allocations — use for allocation hotspots. ?gc=1 triggers GC before profiling for accurate live heap.
Block Profiles
Goblock-and-mutex-profiles.go
26 linesLn 1, Col 1Go
Block profiles show where goroutines are blocked. Mutex profiles show lock contention. SetBlockProfileRate(1) records all events — use in development. Set to 1000 or higher in production to reduce overhead.
Secured Debug Listener
Gosecured-pprof-listener.go
29 linesLn 1, Col 1Go
Bind to 127.0.0.1 to prevent external access. Use port-forward for remote access. TLS adds encryption. Never expose pprof to the public internet — it leaks sensitive information.
Production pprof
Goproduction-pprof-configuration.go
33 linesLn 1, Col 1Go
Production pprof uses lower sampling rates to minimize overhead. Dedicated port prevents interference with the main server. Document the access procedure for operators. Always use port-forward for remote access.
Never expose pprof publicly
pprof endpoints expose sensitive information: goroutine stacks, memory contents, CPU usage patterns. Always bind to localhost. Use port-forward or VPN for remote access. Firewall the pprof port in production.
Mark this lesson complete to store local progress and unlock a cleaner resume path the next time you visit.