trace-id missing in analytics records tags in error responses

[lvielhauer]

Description

In PR #7402 , trace ID support was added to analytics records via SuccessHandler.addTraceIDTag(). This appends a trace-id-{traceID} tag to analytics records for successful requests.

However, error responses (e.g. 401 authentication failures) are recorded through a separate handler ErrorHandler.HandleError() in handler_error.go, which never calls addTraceIDTag(). As a result, analytics records for failed requests are missing the trace-id tag entirely, even when OpenTelemetry is enabled.

Steps to reproduce:

1. Enable OpenTelemetry in tyk.conf
2. Make a request that triggers a 401 (e.g. missing or invalid Authorization header) or other error that will be handled by handler_error.go
3. Inspect the analytics record where the tags array has no trace-id-* entry

Expected: trace-id-{traceID} tag present in analytics records for all requests regardless of response code
Actual: trace-id-{traceID} tag only present in analytics records for successful requests (2xx)

Motivation and Context

Having the trace-id tag on analytics records provides a direct correlation between a specific request logged by Tyk and its corresponding distributed trace. This of course is especially important when investigating requests that resulted in an error. So adding the tag to error responses as well improves the ability to quickly debug any issues.

Suggested fix

Move addTraceIDTag from a method on SuccessHandler to a package-level function, and call it from ErrorHandler.HandleError() after the tags are built in the same way it is called in SuccessHandler.RecordHit().

[probelabs]

Thank You and Confirmation

Hi @lvielhauer. Thank you for this excellent and well-researched bug report. Your analysis appears to be spot on.

You've correctly identified that the trace-id tag is added to analytics records for successful requests in SuccessHandler.RecordHit but is missing from error-handling paths.

Analysis

I've reviewed the code, and your findings are confirmed:

• The addTraceIDTag method is defined on the SuccessHandler and called within its RecordHit method.
• The ErrorHandler.HandleError method in gateway/handler_error.go is responsible for recording analytics for failed requests but does not call addTraceIDTag, leading to the missing tag.

This is a clear gap in our distributed tracing instrumentation, and your suggested fix to refactor addTraceIDTag into a shared, package-level function that can be called from both the success and error handlers is a logical and sound approach.

We've labeled this as a bug. The team will review this for inclusion in a future release.

References

• gateway/handler_success.go – Location of addTraceIDTag and SuccessHandler.RecordHit.
• gateway/handler_error.go – Location of ErrorHandler.HandleError where the call is missing.

---

Powered by Visor from Probelabs

💡 TIP: You can chat with Visor using /visor ask <your question>

[lvielhauer]

Hey, first time contribution from my end, so please let me know if anything is missing. The fix for this seems relatively straightforward, so I implemented it and opened a PR #7929.