Claude Cowork Monitoring with OpenTelemetry and SigNoz

Each event is a log record. The log body holds the event name with a claude_code. prefix, and the event.name attribute holds it without the prefix, for example api_request. The event data is in the log attributes.

Cowork also sends setup events, such as claude_code.mcp_server_connection and claude_code.plugin_loaded.

Every event carries session.id and prompt.id. All the events from one prompt share one prompt.id. On first-party deployments, every event also carries user.email and user.account_uuid. On third-party deployments, those account attributes are absent, and the enduser.id resource attribute identifies the user. tool_result_size_bytes arrives as a string.

The resource attributes include service.name = cowork and any attributes you set in the Resource attributes field. Cowork runs each session in a Linux virtual machine, so os.type and host.arch describe that machine, not the user's computer.

For the full attribute list, see the Cowork monitoring reference.

When the otlpContentCapture managed configuration key is not set, current versions of Claude Desktop send metadata only. The prompt and response attributes carry the value <REDACTED>, and prompt_length and response_length carry the size. Some older versions send prompt text, response text, and tool inputs when the key is not set. To make sure that every device sends metadata only, set otlpContentCapture to [] on each device.

To send the text, set the key to a list of content categories. The key takes effect after Claude Desktop restarts. It applies to Cowork sessions that start from Claude Desktop, on the user's computer or in the cloud. It does not apply to scheduled cloud tasks or to chats moved to the cloud, and web and mobile sessions send metadata only. For the categories and the device configuration, see Content capture.

Cowork sends workspace.host_paths when a user connects a folder. On first-party deployments, it also always sends user.email. The otlpContentCapture key does not remove either attribute. To drop them before they reach SigNoz, run a separate OpenTelemetry Collector for Cowork. The collector checks a bearer token, deletes the two attributes, and forwards the events to SigNoz.

The file below is the complete configuration for that new collector. Do not merge it into an existing collector configuration. Run it with the contrib distribution, otelcol-contrib or the otel/opentelemetry-collector-contrib image, which includes the bearertokenauth extension and the attributes processor.

extensions:
  bearertokenauth:
    token: "<your-collector-token>"
 
receivers:
  otlp:
    protocols:
      http:
        endpoint: 0.0.0.0:4318
        auth:
          authenticator: bearertokenauth
 
processors:
  attributes/redact:
    actions:
      - key: user.email
        action: delete
      - key: workspace.host_paths
        action: delete
  batch: {}
 
exporters:
  # On Collector v0.144.0 and newer, use "otlp_http" to avoid a deprecation warning.
  otlphttp:
    endpoint: "https://ingest.<region>.signoz.cloud:443"
    headers:
      signoz-ingestion-key: "<your-ingestion-key>"
 
service:
  extensions: [bearertokenauth]
  pipelines:
    logs:
      receivers: [otlp]
      processors: [attributes/redact, batch]
      exporters: [otlphttp]

Verify these values:

• <your-collector-token>: a long random string. Cowork must send it to the collector.
• <region> and <your-ingestion-key>: your SigNoz Cloud region and ingestion key.

Expose port 4318 of the collector at an HTTPS URL that the internet can reach, because Cowork in the cloud runs on Anthropic servers. Then change two fields from Step 2:

• OTLP endpoint: the collector URL, without a path.
• OTLP headers: Authorization=Bearer <your-collector-token>.

The collector rejects requests without the token with a 401 status.

Events keep user.account_uuid, so you can still group cost and usage by user on first-party deployments.

No events arrive

• Start a new Cowork session. Sessions that started before you saved the settings do not send events.
• Wait a few minutes. The first events can take that long to show in the Logs Explorer.
• Make sure that the endpoint has no path, such as /v1/logs, and that the protocol is http/protobuf or http/json.

Events arrive from some users only

Each user needs Claude Desktop 1.1.4173 or newer for sessions on their computer, and 1.22209.3 or newer for Cowork in the cloud. Ask the users who are missing to update the app.

os.type shows linux on a Mac

Cowork runs each session in a Linux virtual machine. To identify the user, use user.account_uuid or user.email on first-party deployments, or enduser.id on third-party deployments.

• Cowork sends events as logs. It does not send metrics.
• The settings apply to every Cowork session in the organization. You cannot turn monitoring on for some users only.
• The settings do not cover Code tab sessions in Claude Desktop. To monitor those, see Claude Code monitoring.