Overview #
Claude Cowork exports an OpenTelemetry log event for each user prompt, model response, API request, tool decision, and tool result. An organization admin sets one OTLP endpoint in the Claude admin settings, and every Cowork session in the organization sends its events there. Send those events to SigNoz to see the cost and token use of each user and model, the API latency and errors, and the tools that each prompt ran.
Prerequisites #
- A Claude Team or Enterprise plan, and an admin role that can open the organization's Admin settings .
- Claude Desktop 1.1.4173 or newer for Cowork sessions on the user's computer, and 1.22209.3 or newer for Cowork in the cloud. See Monitor Claude Cowork activity with OpenTelemetry .
- An instance of SigNoz (either Cloud orSelf-Hosted ).
Send Cowork Events to SigNoz #
Step 1. Open the monitoring settings
In Claude, open Admin settings > Data and privacy, then go to the Monitoring section. Expand Cowork, Cowork in the cloud, and unified chat and Cowork.
Step 2. Enter the SigNoz endpoint
Fill in the four fields:
| Field | Value |
|---|---|
| OTLP endpoint | https://ingest.<region>.signoz.cloud:443 |
| OTLP protocol | http/protobuf |
| OTLP headers | signoz-ingestion-key=<your-ingestion-key> |
| Resource attributes | Optional, for example deployment.environment=production |
Verify these values:
<region>: your SigNoz Cloudregion .<your-ingestion-key>: your SigNozingestion key .
Enter the endpoint without a path. Cowork adds /v1/logs to it.
Step 3. Save and start a new session
Save the settings. Cowork reads them when a session starts, so start a new Cowork session to send events.
Validate #
- Run a prompt in a new Cowork session, then wait a few minutes.
- Open the Logs Explorer and filter on
service.name = 'cowork'. - Filter on
body = 'claude_code.api_request'to see the model,cost_usd, and the token counts of each request. To follow one prompt, filter on itsprompt.id.
## Events Cowork Sends #
Each event is a log record. The log body holds the event name with a claude_code. prefix, and the event.name attribute holds it without the prefix, for example api_request. The event data is in the log attributes.
body |
When | Main attributes |
|---|---|---|
claude_code.user_prompt |
A user sends a prompt | prompt_length ,prompt |
claude_code.api_request |
Cowork calls the Claude API | model ,cost_usd ,duration_ms ,input_tokens ,output_tokens ,cache_read_tokens ,cache_creation_tokens ,ttft_ms ,speed |
claude_code.api_error |
A Claude API call fails | model ,error ,status_code ,attempt |
claude_code.tool_decision |
A tool is approved or rejected | tool_name ,decision ,source |
claude_code.tool_result |
A tool finishes | tool_name ,success ,duration_ms ,tool_result_size_bytes |
claude_code.assistant_response |
The model replies with text (Claude Desktop 1.17377 or newer) | model ,response_length ,response |
Cowork also sends setup events, such as claude_code.mcp_server_connection and claude_code.plugin_loaded.
Every event carries session.id and prompt.id. All the events from one prompt share one prompt.id. On first-party deployments, every event also carries user.email and user.account_uuid. On third-party deployments, those account attributes are absent, and the enduser.id resource attribute identifies the user. tool_result_size_bytes arrives as a string.
The resource attributes include service.name = cowork and any attributes you set in the Resource attributes field. Cowork runs each session in a Linux virtual machine, so os.type and host.arch describe that machine, not the user's computer.
For the full attribute list, see the Cowork monitoring reference.
## Prompt and Response Content #
When the otlpContentCapture managed configuration key is not set, current versions of Claude Desktop send metadata only. The prompt and response attributes carry the value <REDACTED>, and prompt_length and response_length carry the size. Some older versions send prompt text, response text, and tool inputs when the key is not set. To make sure that every device sends metadata only, set otlpContentCapture to [] on each device.
To send the text, set the key to a list of content categories. The key takes effect after Claude Desktop restarts. It applies to Cowork sessions that start from Claude Desktop, on the user's computer or in the cloud. It does not apply to scheduled cloud tasks or to chats moved to the cloud, and web and mobile sessions send metadata only. For the categories and the device configuration, see Content capture.
## Run a Separate Collector for Cowork (Optional) #
Cowork sends workspace.host_paths when a user connects a folder. On first-party deployments, it also always sends user.email. The otlpContentCapture key does not remove either attribute. To drop them before they reach SigNoz, run a separate OpenTelemetry Collector for Cowork. The collector checks a bearer token, deletes the two attributes, and forwards the events to SigNoz.
The file below is the complete configuration for that new collector. Do not merge it into an existing collector configuration. Run it with the contrib distribution, otelcol-contrib or the otel/opentelemetry-collector-contrib image, which includes the bearertokenauth extension and the attributes processor.
otel-collector-config.yaml
extensions:
bearertokenauth:
token: "<your-collector-token>"
receivers:
otlp:
protocols:
http:
endpoint: 0.0.0.0:4318
auth:
authenticator: bearertokenauth
processors:
attributes/redact:
actions:
- key: user.email
action: delete
- key: workspace.host_paths
action: delete
batch: {}
exporters:
otlphttp:
endpoint: "https://ingest.<region>.signoz.cloud:443"
headers:
signoz-ingestion-key: "<your-ingestion-key>"
service:
extensions: [bearertokenauth]
pipelines:
logs:
receivers: [otlp]
processors: [attributes/redact, batch]
exporters: [otlphttp]
Verify these values:
<your-collector-token>: a long random string. Cowork must send it to the collector.<region>and<your-ingestion-key>: your SigNoz Cloud region and ingestion key.
Expose port 4318 of the collector at an HTTPS URL that the internet can reach, because Cowork in the cloud runs on Anthropic servers. Then change two fields from Step 2:
- OTLP endpoint : the collector URL, without a path.
- OTLP headers :
Authorization=Bearer <your-collector-token>.
The collector rejects requests without the token with a 401 status.
Events keep user.account_uuid, so you can still group cost and usage by user on first-party deployments.
## Troubleshooting #
No events arrive
- Start a new Cowork session. Sessions that started before you saved the settings do not send events.
- Wait a few minutes. The first events can take that long to show in the Logs Explorer.
- Make sure that the endpoint has no path, such as
/v1/logs, and that the protocol ishttp/protobuforhttp/json.
Events arrive from some users only
Each user needs Claude Desktop 1.1.4173 or newer for sessions on their computer, and 1.22209.3 or newer for Cowork in the cloud. Ask the users who are missing to update the app.
os.type shows linux on a Mac
Cowork runs each session in a Linux virtual machine. To identify the user, use user.account_uuid or user.email on first-party deployments, or enduser.id on third-party deployments.
## Limitations #
- Cowork sends events as logs. It does not send metrics.
- The settings apply to every Cowork session in the organization. You cannot turn monitoring on for some users only.
- The settings do not cover Code tab sessions in Claude Desktop. To monitor those, see Claude Code monitoring .
Next Steps #
- Create a log-based alert on
body = 'claude_code.api_error'to know when Claude API calls start to fail. - Build a dashboard that sums
cost_usdfromclaude_code.api_requestevents bymodelanduser.account_uuid(enduser.idon third-party deployments) to track Cowork spend. - Explore the logs by
tool_nameto see which tools fail most often.
Related integrations #
- Monitor Claude Code with OpenTelemetry - track Claude Code sessions, token use, and cost
- Monitor the Claude Agent SDK - trace agents that you build on the Claude Agent SDK
- Monitor Anthropic API calls - trace requests from your own code to the Claude API
Browse all LLM observability integrations to instrument the rest of your stack.
Get Help #
If you need help with the steps in this topic, please reach out to us on SigNoz Community Slack. If you are a SigNoz Cloud user, please use in product chat support located at the bottom right corner of your SigNoz instance or contact us at cloud-support@signoz.io.