{"slug": "claude-cowork-monitoring-with-opentelemetry-and-signoz", "title": "Claude Cowork Monitoring with OpenTelemetry and SigNoz", "summary": "Anthropic's Claude Cowork now exports an OpenTelemetry log event for every user prompt, model response, API request, tool decision and tool result, and organization admins can route all of it to a single OTLP endpoint configured in Claude's Admin settings, per a SigNoz integration guide. The setup requires a Claude Team or Enterprise plan, Claude Desktop 1.1.4173 or newer for on-device Cowork sessions or 1.22209.3 or newer for cloud sessions, and a SigNoz Cloud or self-hosted instance, with events sent over http/protobuf to https://ingest.<region>.signoz.cloud:443. Once connected, admins can filter SigNoz's Logs Explorer on service.name = 'cowork' and body = 'claude_code.api_request' to see per-request model, cost_usd, input_tokens, output_tokens, cache_read_tokens, cache_creation_tokens, ttft_ms and duration_ms, or follow a single prompt by its prompt.id.", "body_md": "## Overview\n\n[Claude Cowork](https://claude.com/docs/cowork/monitoring) exports an OpenTelemetry log event for each user prompt, model response, API request, tool decision, and tool result. An organization admin sets one OTLP endpoint in the Claude admin settings, and every Cowork session in the organization sends its events there. Send those events to SigNoz to see the cost and token use of each user and model, the API latency and errors, and the tools that each prompt ran.\n\n## Prerequisites\n\n- A Claude Team or Enterprise plan, and an admin role that can open the organization's **Admin settings** .\n- Claude Desktop 1.1.4173 or newer for Cowork sessions on the user's computer, and 1.22209.3 or newer for Cowork in the cloud. See [Monitor Claude Cowork activity with OpenTelemetry](https://support.claude.com/en/articles/14477985-monitor-claude-cowork-activity-with-opentelemetry) .\n- An instance of SigNoz (either [Cloud](https://signoz.io/teams/) or[Self-Hosted](https://signoz.io/docs/install/self-host/) ).\n\n## Send Cowork Events to SigNoz\n\n### Step 1. Open the monitoring settings\n\nIn Claude, open **Admin settings > Data and privacy**, then go to the **Monitoring** section. Expand **Cowork, Cowork in the cloud, and unified chat and Cowork**.\n\n### Step 2. Enter the SigNoz endpoint\n\nFill in the four fields:\n\n| Field | Value | \n|---|---|\n| **OTLP endpoint** | `https://ingest.<region>.signoz.cloud:443` | \n| **OTLP protocol** | `http/protobuf` | \n| **OTLP headers** | `signoz-ingestion-key=<your-ingestion-key>` | \n| **Resource attributes** | Optional, for example `deployment.environment=production` | \n\nVerify these values:\n\n- `<region>` : your SigNoz Cloud[region](https://signoz.io/docs/ingestion/signoz-cloud/overview/#endpoint) .\n- `<your-ingestion-key>` : your SigNoz[ingestion key](https://signoz.io/docs/ingestion/signoz-cloud/keys/) .\n\nEnter the endpoint without a path. Cowork adds `/v1/logs` to it.\n\n### Step 3. Save and start a new session\n\nSave the settings. Cowork reads them when a session starts, so start a new Cowork session to send events.\n\n## Validate\n\n1. Run a prompt in a new Cowork session, then wait a few minutes.\n2. Open the [Logs Explorer](https://signoz.io/docs/userguide/logs_query_builder/) and filter on`service.name = 'cowork'` .\n3. Filter on `body = 'claude_code.api_request'` to see the model,`cost_usd` , and the token counts of each request. To follow one prompt, filter on its`prompt.id` .\n\n## ## Events Cowork Sends\n\nEach event is a log record. The log `body` holds the event name with a `claude_code.` prefix, and the `event.name` attribute holds it without the prefix, for example `api_request`. The event data is in the log attributes.\n\n| `body` | When | Main attributes | \n|---|---|---|\n| `claude_code.user_prompt` | A user sends a prompt | `prompt_length` ,`prompt` | \n| `claude_code.api_request` | Cowork calls the Claude API | `model` ,`cost_usd` ,`duration_ms` ,`input_tokens` ,`output_tokens` ,`cache_read_tokens` ,`cache_creation_tokens` ,`ttft_ms` ,`speed` | \n| `claude_code.api_error` | A Claude API call fails | `model` ,`error` ,`status_code` ,`attempt` | \n| `claude_code.tool_decision` | A tool is approved or rejected | `tool_name` ,`decision` ,`source` | \n| `claude_code.tool_result` | A tool finishes | `tool_name` ,`success` ,`duration_ms` ,`tool_result_size_bytes` | \n| `claude_code.assistant_response` | The model replies with text (Claude Desktop 1.17377 or newer) | `model` ,`response_length` ,`response` | \n\nCowork also sends setup events, such as `claude_code.mcp_server_connection` and `claude_code.plugin_loaded`.\n\nEvery event carries `session.id` and `prompt.id`. All the events from one prompt share one `prompt.id`. On first-party deployments, every event also carries `user.email` and `user.account_uuid`. On third-party deployments, those account attributes are absent, and the `enduser.id` resource attribute identifies the user. `tool_result_size_bytes` arrives as a string.\n\nThe resource attributes include `service.name = cowork` and any attributes you set in the **Resource attributes** field. Cowork runs each session in a Linux virtual machine, so `os.type` and `host.arch` describe that machine, not the user's computer.\n\nFor the full attribute list, see the [Cowork monitoring reference](https://claude.com/docs/cowork/monitoring#events).\n\n## ## Prompt and Response Content\n\nWhen the `otlpContentCapture` managed configuration key is not set, current versions of Claude Desktop send metadata only. The `prompt` and `response` attributes carry the value `<REDACTED>`, and `prompt_length` and `response_length` carry the size. Some older versions send prompt text, response text, and tool inputs when the key is not set. To make sure that every device sends metadata only, set `otlpContentCapture` to `[]` on each device.\n\nTo send the text, set the key to a list of content categories. The key takes effect after Claude Desktop restarts. It applies to Cowork sessions that start from Claude Desktop, on the user's computer or in the cloud. It does not apply to scheduled cloud tasks or to chats moved to the cloud, and web and mobile sessions send metadata only. For the categories and the device configuration, see [Content capture](https://claude.com/docs/cowork/monitoring#content-capture).\n\n## ## Run a Separate Collector for Cowork (Optional)\n\nCowork sends `workspace.host_paths` when a user connects a folder. On first-party deployments, it also always sends `user.email`. The `otlpContentCapture` key does not remove either attribute. To drop them before they reach SigNoz, run a separate [OpenTelemetry Collector](https://signoz.io/docs/opentelemetry-collection-agents/opentelemetry-collector/configuration/) for Cowork. The collector checks a bearer token, deletes the two attributes, and forwards the events to SigNoz.\n\nThe file below is the complete configuration for that new collector. Do not merge it into an existing collector configuration. Run it with the contrib distribution, `otelcol-contrib` or the `otel/opentelemetry-collector-contrib` image, which includes the `bearertokenauth` extension and the `attributes` processor.\n\n```\notel-collector-config.yaml\nextensions:\n  bearertokenauth:\n    token: \"<your-collector-token>\"\n \nreceivers:\n  otlp:\n    protocols:\n      http:\n        endpoint: 0.0.0.0:4318\n        auth:\n          authenticator: bearertokenauth\n \nprocessors:\n  attributes/redact:\n    actions:\n      - key: user.email\n        action: delete\n      - key: workspace.host_paths\n        action: delete\n  batch: {}\n \nexporters:\n  # On Collector v0.144.0 and newer, use \"otlp_http\" to avoid a deprecation warning.\n  otlphttp:\n    endpoint: \"https://ingest.<region>.signoz.cloud:443\"\n    headers:\n      signoz-ingestion-key: \"<your-ingestion-key>\"\n \nservice:\n  extensions: [bearertokenauth]\n  pipelines:\n    logs:\n      receivers: [otlp]\n      processors: [attributes/redact, batch]\n      exporters: [otlphttp]\n```\n\nVerify these values:\n\n- `<your-collector-token>` : a long random string. Cowork must send it to the collector.\n- `<region>` and`<your-ingestion-key>` : your SigNoz Cloud region and ingestion key.\n\nExpose port `4318` of the collector at an HTTPS URL that the internet can reach, because Cowork in the cloud runs on Anthropic servers. Then change two fields from Step 2:\n\n- **OTLP endpoint** : the collector URL, without a path.\n- **OTLP headers** :`Authorization=Bearer <your-collector-token>` .\n\nThe collector rejects requests without the token with a `401` status.\n\nEvents keep `user.account_uuid`, so you can still group cost and usage by user on first-party deployments.\n\n## ## Troubleshooting\n\n### No events arrive\n\n- Start a new Cowork session. Sessions that started before you saved the settings do not send events.\n- Wait a few minutes. The first events can take that long to show in the Logs Explorer.\n- Make sure that the endpoint has no path, such as `/v1/logs` , and that the protocol is`http/protobuf` or`http/json` .\n\n### Events arrive from some users only\n\nEach user needs Claude Desktop 1.1.4173 or newer for sessions on their computer, and 1.22209.3 or newer for Cowork in the cloud. Ask the users who are missing to update the app.\n\n### os.type shows linux on a Mac\n\nCowork runs each session in a Linux virtual machine. To identify the user, use `user.account_uuid` or `user.email` on first-party deployments, or `enduser.id` on third-party deployments.\n\n## ## Limitations\n\n- Cowork sends events as logs. It does not send metrics.\n- The settings apply to every Cowork session in the organization. You cannot turn monitoring on for some users only.\n- The settings do not cover Code tab sessions in Claude Desktop. To monitor those, see [Claude Code monitoring](https://signoz.io/docs/claude-code-monitoring/) .\n\n## Next Steps\n\n- [Create a log-based alert](https://signoz.io/docs/alerts-management/log-based-alerts/) on`body = 'claude_code.api_error'` to know when Claude API calls start to fail.\n- [Build a dashboard](https://signoz.io/docs/userguide/manage-dashboards/) that sums`cost_usd` from`claude_code.api_request` events by`model` and`user.account_uuid` (`enduser.id` on third-party deployments) to track Cowork spend.\n- [Explore the logs](https://signoz.io/docs/userguide/logs_query_builder/) by`tool_name` to see which tools fail most often.\n\n## Related integrations\n\n- [Monitor Claude Code with OpenTelemetry](https://signoz.io/docs/claude-code-monitoring/) - track Claude Code sessions, token use, and cost\n- [Monitor the Claude Agent SDK](https://signoz.io/docs/claude-agent-monitoring/) - trace agents that you build on the Claude Agent SDK\n- [Monitor Anthropic API calls](https://signoz.io/docs/anthropic-monitoring/) - trace requests from your own code to the Claude API\n\nBrowse [all LLM observability integrations](https://signoz.io/docs/llm-observability/) to instrument the rest of your stack.\n\n## Get Help\n\nIf you need help with the steps in this topic, please reach out to us on [SigNoz Community Slack](https://signoz.io/slack/). If you are a SigNoz Cloud user, please use in product chat support located at the bottom right corner of your SigNoz instance or contact us at [cloud-support@signoz.io](mailto:cloud-support@signoz.io).", "url": "https://wpnews.pro/news/claude-cowork-monitoring-with-opentelemetry-and-signoz", "canonical_source": "https://signoz.io/docs/claude-cowork-monitoring", "published_at": "2026-11-05 00:00:00+00:00", "updated_at": "2026-11-05 10:56:51.982840+00:00", "lang": "en", "topics": ["ai-agents", "mlops", "ai-tools", "artificial-intelligence"], "entities": ["Anthropic", "Claude Cowork", "SigNoz", "OpenTelemetry", "Claude Desktop"], "also_reported_by": [], "alternates": {"html": "https://wpnews.pro/news/claude-cowork-monitoring-with-opentelemetry-and-signoz", "markdown": "https://wpnews.pro/news/claude-cowork-monitoring-with-opentelemetry-and-signoz.md", "text": "https://wpnews.pro/news/claude-cowork-monitoring-with-opentelemetry-and-signoz.txt", "jsonld": "https://wpnews.pro/news/claude-cowork-monitoring-with-opentelemetry-and-signoz.jsonld"}}