# Claude Cowork Monitoring with OpenTelemetry and SigNoz

> Source: <https://signoz.io/docs/claude-cowork-monitoring>
> Published: 2026-11-05 00:00:00+00:00

## Overview

[Claude Cowork](https://claude.com/docs/cowork/monitoring) exports an OpenTelemetry log event for each user prompt, model response, API request, tool decision, and tool result. An organization admin sets one OTLP endpoint in the Claude admin settings, and every Cowork session in the organization sends its events there. Send those events to SigNoz to see the cost and token use of each user and model, the API latency and errors, and the tools that each prompt ran.

## Prerequisites

- A Claude Team or Enterprise plan, and an admin role that can open the organization's **Admin settings** .
- Claude Desktop 1.1.4173 or newer for Cowork sessions on the user's computer, and 1.22209.3 or newer for Cowork in the cloud. See [Monitor Claude Cowork activity with OpenTelemetry](https://support.claude.com/en/articles/14477985-monitor-claude-cowork-activity-with-opentelemetry) .
- An instance of SigNoz (either [Cloud](https://signoz.io/teams/) or[Self-Hosted](https://signoz.io/docs/install/self-host/) ).

## Send Cowork Events to SigNoz

### Step 1. Open the monitoring settings

In Claude, open **Admin settings > Data and privacy**, then go to the **Monitoring** section. Expand **Cowork, Cowork in the cloud, and unified chat and Cowork**.

### Step 2. Enter the SigNoz endpoint

Fill in the four fields:

| Field | Value | 
|---|---|
| **OTLP endpoint** | `https://ingest.<region>.signoz.cloud:443` | 
| **OTLP protocol** | `http/protobuf` | 
| **OTLP headers** | `signoz-ingestion-key=<your-ingestion-key>` | 
| **Resource attributes** | Optional, for example `deployment.environment=production` | 

Verify these values:

- `<region>` : your SigNoz Cloud[region](https://signoz.io/docs/ingestion/signoz-cloud/overview/#endpoint) .
- `<your-ingestion-key>` : your SigNoz[ingestion key](https://signoz.io/docs/ingestion/signoz-cloud/keys/) .

Enter the endpoint without a path. Cowork adds `/v1/logs` to it.

### Step 3. Save and start a new session

Save the settings. Cowork reads them when a session starts, so start a new Cowork session to send events.

## Validate

1. Run a prompt in a new Cowork session, then wait a few minutes.
2. Open the [Logs Explorer](https://signoz.io/docs/userguide/logs_query_builder/) and filter on`service.name = 'cowork'` .
3. Filter on `body = 'claude_code.api_request'` to see the model,`cost_usd` , and the token counts of each request. To follow one prompt, filter on its`prompt.id` .

## ## Events Cowork Sends

Each event is a log record. The log `body` holds the event name with a `claude_code.` prefix, and the `event.name` attribute holds it without the prefix, for example `api_request`. The event data is in the log attributes.

| `body` | When | Main attributes | 
|---|---|---|
| `claude_code.user_prompt` | A user sends a prompt | `prompt_length` ,`prompt` | 
| `claude_code.api_request` | Cowork calls the Claude API | `model` ,`cost_usd` ,`duration_ms` ,`input_tokens` ,`output_tokens` ,`cache_read_tokens` ,`cache_creation_tokens` ,`ttft_ms` ,`speed` | 
| `claude_code.api_error` | A Claude API call fails | `model` ,`error` ,`status_code` ,`attempt` | 
| `claude_code.tool_decision` | A tool is approved or rejected | `tool_name` ,`decision` ,`source` | 
| `claude_code.tool_result` | A tool finishes | `tool_name` ,`success` ,`duration_ms` ,`tool_result_size_bytes` | 
| `claude_code.assistant_response` | The model replies with text (Claude Desktop 1.17377 or newer) | `model` ,`response_length` ,`response` | 

Cowork also sends setup events, such as `claude_code.mcp_server_connection` and `claude_code.plugin_loaded`.

Every event carries `session.id` and `prompt.id`. All the events from one prompt share one `prompt.id`. On first-party deployments, every event also carries `user.email` and `user.account_uuid`. On third-party deployments, those account attributes are absent, and the `enduser.id` resource attribute identifies the user. `tool_result_size_bytes` arrives as a string.

The resource attributes include `service.name = cowork` and any attributes you set in the **Resource attributes** field. Cowork runs each session in a Linux virtual machine, so `os.type` and `host.arch` describe that machine, not the user's computer.

For the full attribute list, see the [Cowork monitoring reference](https://claude.com/docs/cowork/monitoring#events).

## ## Prompt and Response Content

When the `otlpContentCapture` managed configuration key is not set, current versions of Claude Desktop send metadata only. The `prompt` and `response` attributes carry the value `<REDACTED>`, and `prompt_length` and `response_length` carry the size. Some older versions send prompt text, response text, and tool inputs when the key is not set. To make sure that every device sends metadata only, set `otlpContentCapture` to `[]` on each device.

To send the text, set the key to a list of content categories. The key takes effect after Claude Desktop restarts. It applies to Cowork sessions that start from Claude Desktop, on the user's computer or in the cloud. It does not apply to scheduled cloud tasks or to chats moved to the cloud, and web and mobile sessions send metadata only. For the categories and the device configuration, see [Content capture](https://claude.com/docs/cowork/monitoring#content-capture).

## ## Run a Separate Collector for Cowork (Optional)

Cowork sends `workspace.host_paths` when a user connects a folder. On first-party deployments, it also always sends `user.email`. The `otlpContentCapture` key does not remove either attribute. To drop them before they reach SigNoz, run a separate [OpenTelemetry Collector](https://signoz.io/docs/opentelemetry-collection-agents/opentelemetry-collector/configuration/) for Cowork. The collector checks a bearer token, deletes the two attributes, and forwards the events to SigNoz.

The file below is the complete configuration for that new collector. Do not merge it into an existing collector configuration. Run it with the contrib distribution, `otelcol-contrib` or the `otel/opentelemetry-collector-contrib` image, which includes the `bearertokenauth` extension and the `attributes` processor.

```
otel-collector-config.yaml
extensions:
  bearertokenauth:
    token: "<your-collector-token>"
 
receivers:
  otlp:
    protocols:
      http:
        endpoint: 0.0.0.0:4318
        auth:
          authenticator: bearertokenauth
 
processors:
  attributes/redact:
    actions:
      - key: user.email
        action: delete
      - key: workspace.host_paths
        action: delete
  batch: {}
 
exporters:
  # On Collector v0.144.0 and newer, use "otlp_http" to avoid a deprecation warning.
  otlphttp:
    endpoint: "https://ingest.<region>.signoz.cloud:443"
    headers:
      signoz-ingestion-key: "<your-ingestion-key>"
 
service:
  extensions: [bearertokenauth]
  pipelines:
    logs:
      receivers: [otlp]
      processors: [attributes/redact, batch]
      exporters: [otlphttp]
```

Verify these values:

- `<your-collector-token>` : a long random string. Cowork must send it to the collector.
- `<region>` and`<your-ingestion-key>` : your SigNoz Cloud region and ingestion key.

Expose port `4318` of the collector at an HTTPS URL that the internet can reach, because Cowork in the cloud runs on Anthropic servers. Then change two fields from Step 2:

- **OTLP endpoint** : the collector URL, without a path.
- **OTLP headers** :`Authorization=Bearer <your-collector-token>` .

The collector rejects requests without the token with a `401` status.

Events keep `user.account_uuid`, so you can still group cost and usage by user on first-party deployments.

## ## Troubleshooting

### No events arrive

- Start a new Cowork session. Sessions that started before you saved the settings do not send events.
- Wait a few minutes. The first events can take that long to show in the Logs Explorer.
- Make sure that the endpoint has no path, such as `/v1/logs` , and that the protocol is`http/protobuf` or`http/json` .

### Events arrive from some users only

Each user needs Claude Desktop 1.1.4173 or newer for sessions on their computer, and 1.22209.3 or newer for Cowork in the cloud. Ask the users who are missing to update the app.

### os.type shows linux on a Mac

Cowork runs each session in a Linux virtual machine. To identify the user, use `user.account_uuid` or `user.email` on first-party deployments, or `enduser.id` on third-party deployments.

## ## Limitations

- Cowork sends events as logs. It does not send metrics.
- The settings apply to every Cowork session in the organization. You cannot turn monitoring on for some users only.
- The settings do not cover Code tab sessions in Claude Desktop. To monitor those, see [Claude Code monitoring](https://signoz.io/docs/claude-code-monitoring/) .

## Next Steps

- [Create a log-based alert](https://signoz.io/docs/alerts-management/log-based-alerts/) on`body = 'claude_code.api_error'` to know when Claude API calls start to fail.
- [Build a dashboard](https://signoz.io/docs/userguide/manage-dashboards/) that sums`cost_usd` from`claude_code.api_request` events by`model` and`user.account_uuid` (`enduser.id` on third-party deployments) to track Cowork spend.
- [Explore the logs](https://signoz.io/docs/userguide/logs_query_builder/) by`tool_name` to see which tools fail most often.

## Related integrations

- [Monitor Claude Code with OpenTelemetry](https://signoz.io/docs/claude-code-monitoring/) - track Claude Code sessions, token use, and cost
- [Monitor the Claude Agent SDK](https://signoz.io/docs/claude-agent-monitoring/) - trace agents that you build on the Claude Agent SDK
- [Monitor Anthropic API calls](https://signoz.io/docs/anthropic-monitoring/) - trace requests from your own code to the Claude API

Browse [all LLM observability integrations](https://signoz.io/docs/llm-observability/) to instrument the rest of your stack.

## Get Help

If you need help with the steps in this topic, please reach out to us on [SigNoz Community Slack](https://signoz.io/slack/). If you are a SigNoz Cloud user, please use in product chat support located at the bottom right corner of your SigNoz instance or contact us at [cloud-support@signoz.io](mailto:cloud-support@signoz.io).