Claude Cowork Monitoring with OpenTelemetry and SigNoz

Anthropic's Claude Cowork now exports an OpenTelemetry log event for every user prompt, model response, API request, tool decision and tool result, and organization admins can route all of it to a single OTLP endpoint configured in Claude's Admin settings, per a SigNoz integration guide. The setup requires a Claude Team or Enterprise plan, Claude Desktop 1.1.4173 or newer for on-device Cowork sessions or 1.22209.3 or newer for cloud sessions, and a SigNoz Cloud or self-hosted instance, with events sent over http/protobuf to https://ingest.<region>.signoz.cloud:443. Once connected, admins can filter SigNoz's Logs Explorer on service.name = 'cowork' and body = 'claude_code.api_request' to see per-request model, cost_usd, input_tokens, output_tokens, cache_read_tokens, cache_creation_tokens, ttft_ms and duration_ms, or follow a single prompt by its prompt.id.

Overview Claude Cowork https://claude.com/docs/cowork/monitoring exports an OpenTelemetry log event for each user prompt, model response, API request, tool decision, and tool result. An organization admin sets one OTLP endpoint in the Claude admin settings, and every Cowork session in the organization sends its events there. Send those events to SigNoz to see the cost and token use of each user and model, the API latency and errors, and the tools that each prompt ran. Prerequisites - A Claude Team or Enterprise plan, and an admin role that can open the organization's Admin settings . - Claude Desktop 1.1.4173 or newer for Cowork sessions on the user's computer, and 1.22209.3 or newer for Cowork in the cloud. See Monitor Claude Cowork activity with OpenTelemetry https://support.claude.com/en/articles/14477985-monitor-claude-cowork-activity-with-opentelemetry . - An instance of SigNoz either Cloud https://signoz.io/teams/ or Self-Hosted https://signoz.io/docs/install/self-host/ . Send Cowork Events to SigNoz Step 1. Open the monitoring settings In Claude, open Admin settings Data and privacy , then go to the Monitoring section. Expand Cowork, Cowork in the cloud, and unified chat and Cowork . Step 2. Enter the SigNoz endpoint Fill in the four fields: | Field | Value | |---|---| | OTLP endpoint | https://ingest.<region .signoz.cloud:443 | | OTLP protocol | http/protobuf | | OTLP headers | signoz-ingestion-key=<your-ingestion-key | | Resource attributes | Optional, for example deployment.environment=production | Verify these values: - <region : your SigNoz Cloud region https://signoz.io/docs/ingestion/signoz-cloud/overview/ endpoint . - <your-ingestion-key : your SigNoz ingestion key https://signoz.io/docs/ingestion/signoz-cloud/keys/ . Enter the endpoint without a path. Cowork adds /v1/logs to it. Step 3. Save and start a new session Save the settings. Cowork reads them when a session starts, so start a new Cowork session to send events. Validate 1. Run a prompt in a new Cowork session, then wait a few minutes. 2. Open the Logs Explorer https://signoz.io/docs/userguide/logs query builder/ and filter on service.name = 'cowork' . 3. Filter on body = 'claude code.api request' to see the model, cost usd , and the token counts of each request. To follow one prompt, filter on its prompt.id . Events Cowork Sends Each event is a log record. The log body holds the event name with a claude code. prefix, and the event.name attribute holds it without the prefix, for example api request . The event data is in the log attributes. | body | When | Main attributes | |---|---|---| | claude code.user prompt | A user sends a prompt | prompt length , prompt | | claude code.api request | Cowork calls the Claude API | model , cost usd , duration ms , input tokens , output tokens , cache read tokens , cache creation tokens , ttft ms , speed | | claude code.api error | A Claude API call fails | model , error , status code , attempt | | claude code.tool decision | A tool is approved or rejected | tool name , decision , source | | claude code.tool result | A tool finishes | tool name , success , duration ms , tool result size bytes | | claude code.assistant response | The model replies with text Claude Desktop 1.17377 or newer | model , response length , response | Cowork also sends setup events, such as claude code.mcp server connection and claude code.plugin loaded . Every event carries session.id and prompt.id . All the events from one prompt share one prompt.id . On first-party deployments, every event also carries user.email and user.account uuid . On third-party deployments, those account attributes are absent, and the enduser.id resource attribute identifies the user. tool result size bytes arrives as a string. The resource attributes include service.name = cowork and any attributes you set in the Resource attributes field. Cowork runs each session in a Linux virtual machine, so os.type and host.arch describe that machine, not the user's computer. For the full attribute list, see the Cowork monitoring reference https://claude.com/docs/cowork/monitoring events . Prompt and Response Content When the otlpContentCapture managed configuration key is not set, current versions of Claude Desktop send metadata only. The prompt and response attributes carry the value <REDACTED , and prompt length and response length carry the size. Some older versions send prompt text, response text, and tool inputs when the key is not set. To make sure that every device sends metadata only, set otlpContentCapture to on each device. To send the text, set the key to a list of content categories. The key takes effect after Claude Desktop restarts. It applies to Cowork sessions that start from Claude Desktop, on the user's computer or in the cloud. It does not apply to scheduled cloud tasks or to chats moved to the cloud, and web and mobile sessions send metadata only. For the categories and the device configuration, see Content capture https://claude.com/docs/cowork/monitoring content-capture . Run a Separate Collector for Cowork Optional Cowork sends workspace.host paths when a user connects a folder. On first-party deployments, it also always sends user.email . The otlpContentCapture key does not remove either attribute. To drop them before they reach SigNoz, run a separate OpenTelemetry Collector https://signoz.io/docs/opentelemetry-collection-agents/opentelemetry-collector/configuration/ for Cowork. The collector checks a bearer token, deletes the two attributes, and forwards the events to SigNoz. The file below is the complete configuration for that new collector. Do not merge it into an existing collector configuration. Run it with the contrib distribution, otelcol-contrib or the otel/opentelemetry-collector-contrib image, which includes the bearertokenauth extension and the attributes processor. otel-collector-config.yaml extensions: bearertokenauth: token: "<your-collector-token " receivers: otlp: protocols: http: endpoint: 0.0.0.0:4318 auth: authenticator: bearertokenauth processors: attributes/redact: actions: - key: user.email action: delete - key: workspace.host paths action: delete batch: {} exporters: On Collector v0.144.0 and newer, use "otlp http" to avoid a deprecation warning. otlphttp: endpoint: "https://ingest.<region .signoz.cloud:443" headers: signoz-ingestion-key: "<your-ingestion-key " service: extensions: bearertokenauth pipelines: logs: receivers: otlp processors: attributes/redact, batch exporters: otlphttp Verify these values: - <your-collector-token : a long random string. Cowork must send it to the collector. - <region and <your-ingestion-key : your SigNoz Cloud region and ingestion key. Expose port 4318 of the collector at an HTTPS URL that the internet can reach, because Cowork in the cloud runs on Anthropic servers. Then change two fields from Step 2: - OTLP endpoint : the collector URL, without a path. - OTLP headers : Authorization=Bearer <your-collector-token . The collector rejects requests without the token with a 401 status. Events keep user.account uuid , so you can still group cost and usage by user on first-party deployments. Troubleshooting No events arrive - Start a new Cowork session. Sessions that started before you saved the settings do not send events. - Wait a few minutes. The first events can take that long to show in the Logs Explorer. - Make sure that the endpoint has no path, such as /v1/logs , and that the protocol is http/protobuf or http/json . Events arrive from some users only Each user needs Claude Desktop 1.1.4173 or newer for sessions on their computer, and 1.22209.3 or newer for Cowork in the cloud. Ask the users who are missing to update the app. os.type shows linux on a Mac Cowork runs each session in a Linux virtual machine. To identify the user, use user.account uuid or user.email on first-party deployments, or enduser.id on third-party deployments. Limitations - Cowork sends events as logs. It does not send metrics. - The settings apply to every Cowork session in the organization. You cannot turn monitoring on for some users only. - The settings do not cover Code tab sessions in Claude Desktop. To monitor those, see Claude Code monitoring https://signoz.io/docs/claude-code-monitoring/ . Next Steps - Create a log-based alert https://signoz.io/docs/alerts-management/log-based-alerts/ on body = 'claude code.api error' to know when Claude API calls start to fail. - Build a dashboard https://signoz.io/docs/userguide/manage-dashboards/ that sums cost usd from claude code.api request events by model and user.account uuid enduser.id on third-party deployments to track Cowork spend. - Explore the logs https://signoz.io/docs/userguide/logs query builder/ by tool name to see which tools fail most often. Related integrations - Monitor Claude Code with OpenTelemetry https://signoz.io/docs/claude-code-monitoring/ - track Claude Code sessions, token use, and cost - Monitor the Claude Agent SDK https://signoz.io/docs/claude-agent-monitoring/ - trace agents that you build on the Claude Agent SDK - Monitor Anthropic API calls https://signoz.io/docs/anthropic-monitoring/ - trace requests from your own code to the Claude API Browse all LLM observability integrations https://signoz.io/docs/llm-observability/ to instrument the rest of your stack. Get Help If you need help with the steps in this topic, please reach out to us on SigNoz Community Slack https://signoz.io/slack/ . If you are a SigNoz Cloud user, please use in product chat support located at the bottom right corner of your SigNoz instance or contact us at cloud-support@signoz.io mailto:cloud-support@signoz.io .