← Back to blog
Solution 4 min read 炬鲸团队

Observability for Bank Core Systems: Tracing a Single Transfer End to End

Banks span decades of tech stacks where failures cascade across systems. A layered collection approach, a real incident showing 10-minute root-cause isolation, and rollout takeaways on alert tiering and compliance.

What's different about finance

A bank's distributed architecture looks nothing like an internet company's. Core systems run on CICS or mainframes, channel systems on x86 clusters, plus a pile of outsourced systems — the tech stack spans decades, and failures cascade across systems. A slow transfer could be the core transaction, or the front gateway, but classic monitoring only shows "CPU is high on some system", not which link is the culprit.

Worse, each bank system has its own log format, time base and monitoring tool. The core has its logs, the channels have theirs, and an incident means every team digs separately and later lines up timelines by hand just to see the whole picture. OBSERVE's deployments across several banks produced a repeatable playbook.

One ingestion path, layered collection

The first layer is the transaction path. A lightweight probe on core CICS transactions collects transaction ID, transaction code and latency, reported as spans that join up with the OpenTelemetry traces from peripheral systems into one complete path from the counter or mobile app to the core. The key is carrying the transaction ID as the unified trace context end to end.

The second layer is infrastructure. Mainframes, Oracle and storage report metrics via exporters into a unified alerting system. Many bank mainframes are still SNMP or out-of-band managed, so they need dedicated collectors — you can't expect them to natively speak the Prometheus protocol.

The third is business logs. Core transaction records and channel message logs feed a single search index, so you can pull up every log line for a transaction by its transaction ID. Once logs are unified, cross-system log comparison goes from "flip through files by hand" to "one SQL query".

A real case

After a city commercial bank went live, mobile transfers jumped from 800ms to 3 seconds. The traditional way — each team digging through its own systems — went nowhere for two days.

With OBSERVE, searching by transaction ID in the tracing view found the root cause in ten minutes: the core system's account-query response had slowed, and drilling down showed a shard's connection pool was exhausted, with connection wait eating 1.8 seconds. The trigger was a batch repayment job that hadn't released its connections. Restarting that batch job brought latency straight back down. The trace made the causality visible in a way no per-system dashboard could — one timeline, one blame line.

The point of this case isn't "tracing is great" — it's that once the transaction ID flows through, investigation shifts from "which system is it" to "which step is slow".

What to focus on

Three practical conclusions for tech leads:

  1. The transaction ID is the linchpin. Linking tracing and log search through the transaction ID is what makes single-transaction forensics possible in finance. Without it, the prettiest topology can't answer "what happened to this one transfer". Bake the transaction ID's generation and propagation into your development standards.
  2. Alerts need tiers. Core failures have huge blast radius, so alerts must be graded: P0 by phone, P1 by SMS, P2 by email. Grade by affected transaction volume, not affected machine count — one flaky core machine can affect more transactions than ten channel machines.
  3. Compliance up front. Financial data collection and storage must meet classification and regulatory requirements. Masking of card numbers, ID numbers and phone numbers has to happen at collection time, not at query time. Confirm the masking policy with your compliance team rather than collecting first and patching later.

Rollout rhythm

Don't try to land all of this at once. The steady order is: tracing plus the transaction-ID link first (fastest payoff), then unified log search once that's stable, and infrastructure metrics with alert tiering last. Each phase delivers value on its own, and the gradual pace gives you room to align the masking policy with compliance and security along the way, rather than bolting it on after the data is already flowing.

Results

Three months after rollout, mean time to detect (MTTD) dropped from two hours to fifteen minutes, and cross-system issues shrank from 30% of incidents to 5%. Those numbers came from production telemetry, not a slide deck.