Metrics can be configured by using Admin Console or Asadmin commands.
Using the Admin Console
To configure the Metrics in the Admin Console, go to Configuration → [instance-configuration (like server-config)] → MicroProfile → Metrics:

Using Asadmin Commands
set-metrics-configuration
- Usage
asadmin> set-metrics-configuration
        [--enabled=true|false]
        [--securityenabled=true|false]
        [--roles=<role-list>]
        [--dynamic=true|false]
        [--endpoint=<context-root[default:metrics]>]
        [--target=<instance-name[default:server]>]
        [--virtualservers=<virtualserver-list>]
- Aim
- 
Provides a way to set the configuration of the metrics service of the targeted config. 
Command Options
| Option | Type | Description | Default | Mandatory | 
|---|---|---|---|---|
| 
 | Boolean | Enables or disables the metrics service. | true | No | 
| 
 | Boolean | Whether or not secure access to the metrics endpoint is enabled. | false | No | 
| 
 | String | If defined, the endpoint will be assigned to a list of the role specified as a comma-separated. | 
 | No | 
| 
 | String | The context root used to expose the metrics endpoint. | 
 | No | 
| 
 | Boolean | If set to  | true | No | 
| 
 | String | The target server/instance configuration. | 
 | No | 
| 
 | String | If defined, the endpoint will be assigned to a list of virtual servers specified as a comma-separated list of names. Otherwise, the endpoint will be assigned to all virtual servers available. | - | No | 
get-metrics-configuration
- Usage
asadmin> get-metrics-configuration [--target <instance-name>]
- Aim
- 
Returns the current configuration options for the metrics service on the targeted configuration. 
Security Configuration
By default, the OpenAPI endpoint binds to the root context application which is the default-web-module (also known as docroot) system application and the default-web-module application, which is secured under the default realm (file) of the server.
If a user application is deployed in the empty context-root, then the security configuration of this application will be shared by the OpenAPI endpoint, so exert extreme caution when making these changes.