Monitor Claude Code with Sazabi

Last verified on Nov 8, 2026.

A coding agent makes decisions you never see in a pull request. It reads files, runs shell commands and calls a model dozens of times before it commits anything. Claude Code can export that activity as OpenTelemetry events, and those events are the only record of what a session did and what it cost.

Sazabi, the AI-native observability and security platform, takes those events as a manual log source. Claude Code's own exporter sends them to your Sazabi intake URL. You change environment variables, not your projects.

What Sazabi reads from Claude Code

One method, one direction: Claude Code pushes OTLP log events to Sazabi. Sazabi does not call back into Claude Code.

The Sazabi docs for this source name three event types:

• claude_code.user_prompt: a prompt was submitted.
• claude_code.tool_result: a tool finished running.
• claude_code.api_request: one call to the model, with token counts and cost.

Records carry session.id, user.email, model and, for prompts, prompt. Two opt-in variables add context. OTEL_METRICS_INCLUDE_ENTRYPOINT tags events with app.entrypoint, which says how the session was launched. OTEL_METRICS_INCLUDE_REPOSITORY adds vcs.repository.name, vcs.owner.name and vcs.repository.url.full on Claude Code v2.1.269 or later.

The setup works on three surfaces: the CLI, Claude Code on the web and the Claude Code GitHub Action. Cloud sessions add ccr.session.id. Each surface has its own settings location, so connecting one does not connect the others.

Claude Code's own monitoring page lists more per event. A claude_code.api_request record includes cost_usd, duration_ms, input_tokens, output_tokens, cache_read_tokens and query_source. A claude_code.tool_result record includes tool_name, success, duration_ms and error_type. Prompt text is redacted unless you opt in, and the Sazabi docs warn that enabling it exports raw text typed during sessions.

Questions it answers

• Which repository spent the most on model calls this week?
• Did a GitHub Actions run use far more tokens than the same workflow last month?
• Which tool fails most often, and with what error_type?
• How much of our input comes from the prompt cache?
• Which sessions came from cloud environments rather than laptops?
• What did one developer's session do between the first prompt and the failing build?

A worked example: a workflow that suddenly costs more

Suppose the Claude Code GitHub Action on one repository starts taking twice as long. You have OTEL_METRICS_INCLUDE_REPOSITORY on, so each event names its repository. A single model call looks like this. The values are made up, and the field names come from the two pages above.

{
  "event.name": "api_request",
  "model": "claude-sonnet-5",
  "cost_usd": 0.41,
  "duration_ms": 18250,
  "input_tokens": 1200,
  "output_tokens": 3900,
  "cache_read_tokens": 182000,
  "query_source": "repl_main_thread",
  "session.id": "sess-7d21",
  "app.entrypoint": "github-action",
  "vcs.repository.name": "payments-api",
  "user.email": "ci-bot@example.com"
}

Ask the question from a terminal:

sazabi logs ask "sum cost_usd on claude_code.api_request events by vcs.repository.name for the last 7 days"

One repository with a far larger total narrows the search. Then group that repository's events by session.id and open the most expensive session. Look at its claude_code.tool_result events next. A run of failures with the same error_type, followed by more api_request events, means the agent was retrying a broken step. If so, the cause is in the repository or the workflow, not in the agent settings.

Setting it up without leaking prompts

Keep OTEL_LOG_ASSISTANT_RESPONSES at 0 unless you want model output stored. On the web surface, Claude Code reads server-managed settings, which apply to every member of the organization. The cloud environment also needs your intake hostname in its allowed domains, and the Sazabi docs walk through that. Claude Code exports logs every 5000 ms by default.

How it fits with other integrations

Claude Code is one of several coding agents Sazabi can read. Codex and oh-my-pi send comparable session events, and the coding agents category lists the rest. Because Claude Code speaks OTLP, the OpenTelemetry integration explains the transport. Developer-tool volume counts like any other log volume, so check pricing before you turn on every surface.