observability-analyze-session-logs
Compare original and translation side by side
🇺🇸
Original
English🇨🇳
Translation
ChineseAnalyze Session Logs
分析会话日志
IMPORTANT DISTINCTION: This skill analyzes Claude Code session transcripts (what Claude saw and thought), NOT application/production logs (what code executed). For application logs, use the analyze-logs skill instead.
重要区别:本技能分析的是Claude Code会话记录(Claude所见和所想的内容),而非应用/生产日志(代码执行的内容)。若要分析应用日志,请使用analyze-logs技能。
Quick Start
快速开始
Most common usage (list all messages):
bash
python3 .claude/tools/utils/view_session_context.py <session-file.jsonl> --listView context at specific point (by message index):
bash
python3 .claude/tools/utils/view_session_context.py <session-file.jsonl> --message-index 10View context at specific message (by UUID from logs/errors):
bash
python3 .claude/tools/utils/view_session_context.py <session-file.jsonl> --uuid "3c8467d6-..."最常用方式(列出所有消息):
bash
python3 .claude/tools/utils/view_session_context.py <session-file.jsonl> --list查看特定节点的上下文(按消息索引):
bash
python3 .claude/tools/utils/view_session_context.py <session-file.jsonl> --message-index 10查看特定消息的上下文(按日志/错误中的UUID):
bash
python3 .claude/tools/utils/view_session_context.py <session-file.jsonl> --uuid "3c8467d6-..."When to Use This Skill
适用场景
Invoke this skill when users mention:
- "why did Claude do X?"
- "what was in the context window?"
- "analyze session" / "check session logs"
- "debug Claude behavior"
- "token usage investigation"
- "context window exhaustion"
- "track agent delegation"
- Any mention of session files
.jsonl
Use cases:
- Debugging decisions - "Why did Claude choose approach X?" → View context at decision point
- Token analysis - "Where are tokens being used?" → Track cache creation vs cache read
- Agent tracking - "How are agents being delegated?" → Follow sidechain messages
- Context exhaustion - "Why did Claude lose context?" → See context window growth
- Performance issues - "Why is Claude slow?" → Identify cache thrashing
当用户提及以下内容时调用本技能:
- "为什么Claude会做X?"
- "上下文窗口里有什么?"
- "分析会话" / "检查会话日志"
- "调试Claude行为"
- "令牌使用调查"
- "上下文窗口耗尽"
- "跟踪Agent委托"
- 任何提及会话文件的场景
.jsonl
使用案例:
- 决策调试 - "为什么Claude选择方案X?" → 查看决策节点的上下文
- 令牌分析 - "令牌都用在哪里了?" → 跟踪缓存创建与缓存读取情况
- Agent跟踪 - "Agent是如何被委托的?" → 跟踪侧链消息
- 上下文耗尽 - "为什么Claude丢失了上下文?" → 查看上下文窗口的增长情况
- 性能问题 - "为什么Claude反应慢?" → 识别缓存抖动问题
What This Skill Does
技能功能
Analyzes Claude Code session transcripts to provide forensic visibility into Claude's internal state, decision-making process, context window content, and token usage patterns.
What it reveals:
- Context window content at any point in conversation
- Token usage breakdown (input, cache creation, cache read, output)
- Message chains (parent-child relationships)
- Agent delegation patterns (sidechain vs main thread)
- Context window growth over time
- Thinking blocks (Claude's internal reasoning)
- Tool calls with parameters and results
Key Distinction:
- This skill: Analyzes Claude's session transcripts → Shows "what Claude saw and thought"
- analyze-logs skill: Analyzes OpenTelemetry application logs → Shows "what code executed"
- Use both together for complete debugging
分析Claude Code会话记录,深入了解Claude的内部状态、决策过程、上下文窗口内容和令牌使用模式。
可揭示的信息:
- 对话中任意节点的上下文窗口内容
- 令牌使用明细(输入、缓存创建、缓存读取、输出)
- 消息链(父子关系)
- Agent委托模式(侧链 vs 主线程)
- 上下文窗口随时间的增长情况
- 思考块(Claude的内部推理过程)
- 工具调用的参数和结果
核心区别:
- 本技能:分析Claude的会话记录 → 展示“Claude所见和所想”
- analyze-logs技能:分析OpenTelemetry应用日志 → 展示“代码执行情况”
- 结合使用两者以完成完整调试
Session File Locations
会话文件位置
User-level session files (Claude Code transcripts):
~/.claude/projects/-Users-{username}-{project-path}/{session-uuid}.jsonlFind recent sessions:
bash
ls -lt ~/.claude/projects/-Users-$(whoami)-*/*.jsonl | head -5用户级会话文件(Claude Code记录):
~/.claude/projects/-Users-{username}-{project-path}/{session-uuid}.jsonl查找最近的会话:
bash
ls -lt ~/.claude/projects/-Users-$(whoami)-*/*.jsonl | head -5Instructions
操作步骤
Follow this workflow to analyze Claude Code session logs:
- Locate session file - Find .jsonl file in ~/.claude/projects/
- Choose analysis mode - List messages, view context at index, or view at UUID
- Execute analysis - Run view_session_context.py with appropriate flags
- Interpret results - Examine context window, token usage, and decision points
- Report findings - Explain Claude's behavior with evidence from context
遵循以下工作流分析Claude Code会话日志:
- 定位会话文件 - 在~/.claude/projects/目录下找到.jsonl文件
- 选择分析模式 - 列出消息、按索引查看上下文或按UUID查看
- 执行分析 - 使用相应参数运行view_session_context.py
- 解读结果 - 检查上下文窗口、令牌使用情况和决策节点
- 报告发现 - 结合上下文证据解释Claude的行为
Analysis Workflow
分析工作流
Step 1: Locate Session File
步骤1:定位会话文件
bash
undefinedbash
undefinedFind most recent session file
查找最近的会话文件
ls -lt ~/.claude/projects/-Users-$(whoami)-/.jsonl | head -5
ls -lt ~/.claude/projects/-Users-$(whoami)-/.jsonl | head -5
Or search by UUID from error messages
或根据错误消息中的UUID搜索
grep -r "uuid" ~/.claude/projects/*/
undefinedgrep -r "uuid" ~/.claude/projects/*/
undefinedStep 2: Choose Analysis Mode
步骤2:选择分析模式
Mode 1: List All Messages (Overview)
bash
python3 .claude/tools/utils/view_session_context.py <session.jsonl> --listUse when: Initial investigation, finding specific messages, tracking token usage
Mode 2: Context Window at Specific Point
bash
python3 .claude/tools/utils/view_session_context.py <session.jsonl> --message-index 10Use when: Debugging specific decision, understanding available context, seeing thinking blocks
Mode 3: View Specific Message by UUID
bash
python3 .claude/tools/utils/view_session_context.py <session.jsonl> --uuid "3c8467d6-..."Use when: Error logs reference specific message UUID
Mode 4: View Raw JSON
bash
python3 .claude/tools/utils/view_session_context.py <session.jsonl> --message-index 10 --rawUse when: Need exact JSON structure, programmatic analysis
模式1:列出所有消息(概览)
bash
python3 .claude/tools/utils/view_session_context.py <session.jsonl> --list适用场景:初步调查、查找特定消息、跟踪令牌使用情况
模式2:查看特定节点的上下文窗口
bash
python3 .claude/tools/utils/view_session_context.py <session.jsonl> --message-index 10适用场景:调试特定决策、了解可用上下文、查看思考块
模式3:按UUID查看特定消息
bash
python3 .claude/tools/utils/view_session_context.py <session.jsonl> --uuid "3c8467d6-..."适用场景:错误日志中引用了特定消息UUID
模式4:查看原始JSON
bash
python3 .claude/tools/utils/view_session_context.py <session.jsonl> --message-index 10 --raw适用场景:需要精确的JSON结构、程序化分析
Step 3: Execute Analysis
步骤3:执行分析
Run the appropriate command using the Bash tool:
bash
python3 .claude/tools/utils/view_session_context.py ~/.claude/projects/-Users-*/abc123.jsonl --list使用Bash工具运行相应命令:
bash
python3 .claude/tools/utils/view_session_context.py ~/.claude/projects/-Users-*/abc123.jsonl --listStep 4: Interpret Results
步骤4:解读结果
For List Output:
- Check message count - How long was the session?
- Identify MAIN vs SIDE - SIDE indicates agent delegation
- Spot token patterns:
- High Cache Create = New context being cached
- High Cache Read = Good cache utilization
- High Cache Create repeatedly = Cache thrashing
- Find interesting points - Large output tokens, sudden cache creation, sidechains
- Note message indices for deeper investigation
For Context Window Output:
- Review message chain - Understand conversation flow
- Read THINKING blocks - See Claude's internal reasoning
- Check TOOL calls - What tools were invoked and why
- Examine token breakdown (input, cache creation, cache read, output)
- Check total context size - Is it approaching 200k limit?
For Token Usage:
- Cache creation spike = Context changed significantly
- High cache read = Good utilization (cost effective)
- Low cache read = Cache misses (investigate why)
- Growing total context = Approaching 200k limit
列表输出解读:
- 检查消息数量 - 会话持续了多久?
- 识别MAIN vs SIDE - SIDE表示Agent委托
- 发现令牌模式:
- 高Cache Create = 新上下文被缓存
- 高Cache Read = 缓存利用率良好
- 重复高Cache Create = 缓存抖动
- 定位关键点 - 大量输出令牌、突然的缓存创建、侧链
- 记录需要深入调查的消息索引
上下文窗口输出解读:
- 查看消息链 - 理解对话流程
- 阅读THINKING块 - 了解Claude的内部推理
- 检查TOOL调用 - 调用了哪些工具以及原因
- 分析令牌明细(输入、缓存创建、缓存读取、输出)
- 检查总上下文大小 - 是否接近200k的限制?
令牌使用解读:
- 缓存创建峰值 = 上下文发生显著变化
- 高缓存读取 = 利用率良好(成本优化)
- 低缓存读取 = 缓存未命中(调查原因)
- 总上下文持续增长 = 接近200k限制
Step 5: Report Findings
步骤5:报告发现
Always provide:
- Summary - Session length, main vs sidechain messages, total tokens
- Key insights - What explains the behavior?
- Specific examples - Quote relevant thinking blocks, tool calls
- Context evidence - Show what Claude had access to
- Suggested next steps - Additional investigation or fixes
Example response format:
Analyzed session abc123.jsonl (42 messages):
Key Findings:
1. Agent delegation at message 15 (→ unit-tester)
- Context window at that point: 24,059 tokens
- Thinking: "Need comprehensive test coverage for new service"
- Agent had access to service implementation but not architectural context
2. Cache thrashing at messages 28-35
- Cache creation spiked to 18k tokens each message
- Context kept changing due to repeated file edits
- Suggestion: Batch edits to reduce cache invalidation
3. Context exhaustion at message 40
- Total context: 189,234 tokens (approaching 200k limit)
- Claude started summarizing instead of quoting full code
To investigate further:
- View agent delegation context: --message-index 15
- Examine cache thrashing: --message-index 30需包含以下内容:
- 摘要 - 会话长度、主线程与侧链消息数量、总令牌数
- 关键洞察 - 什么解释了该行为?
- 具体示例 - 引用相关的思考块、工具调用
- 上下文证据 - 展示Claude可访问的内容
- 建议下一步 - 进一步调查或修复方案
回复格式示例:
已分析会话abc123.jsonl(共42条消息):
关键发现:
1. 消息15处的Agent委托(→ unit-tester)
- 当时的上下文窗口:24,059个令牌
- 思考过程:"需要为新服务提供全面的测试覆盖"
- Agent可访问服务实现,但无法访问架构上下文
2. 消息28-35处的缓存抖动
- 缓存创建峰值达到每条消息18k令牌
- 因重复文件编辑导致上下文持续变化
- 建议:批量编辑以减少缓存失效
3. 消息40处的上下文耗尽
- 总上下文:189,234个令牌(接近200k限制)
- Claude开始总结内容而非引用完整代码
进一步调查建议:
- 查看Agent委托上下文:--message-index 15
- 检查缓存抖动:--message-index 30Best Practices
最佳实践
- Start with List Mode - Always get the overview first to identify interesting points
- Identify Patterns - Look for high cache creation (10k+ tokens), SIDE messages, large outputs
- Use Message Index for Deep Dives - From list output, drill down to specific points
- Follow Agent Delegation Chains - When you see [SIDE], trace back to parent in main thread
- Track Token Usage - Good: high cache read (80%+), Bad: repeated cache creation (thrashing)
- Compare Before/After - When debugging changes, analyze sessions before and after fix
- Correlate with Code Execution Logs - Session logs show "what Claude thought", OpenTelemetry logs show "what code executed"
- Save Important Sessions - Archive critical sessions to for future reference
.claude/artifacts/
- 从列表模式开始 - 先获取概览以定位关键点
- 识别模式 - 关注高缓存创建(10k+令牌)、SIDE消息、大量输出
- 使用消息索引进行深入调查 - 从列表输出中定位到特定节点进行深挖
- 跟踪Agent委托链 - 当看到[SIDE]时,追溯到主线程中的父消息
- 监控令牌使用 - 良好:高缓存读取(80%+),不良:重复缓存创建(抖动)
- 对比前后情况 - 调试变更时,分析修复前后的会话
- 与代码执行日志关联 - 会话日志展示“Claude的想法”,OpenTelemetry日志展示“代码执行情况”
- 保存重要会话 - 将关键会话归档到以备未来参考
.claude/artifacts/
Common Scenarios
常见场景
"Why did Claude do X?"
"为什么Claude会做X?"
- Find session file → List messages ()
--list - Identify message where decision was made
- View context at that point ()
--message-index N - Read THINKING blocks to see reasoning
- Explain: "Claude did X because context included Y but not Z"
- 找到会话文件 → 列出消息()
--list - 定位做出决策的消息
- 查看该节点的上下文()
--message-index N - 阅读THINKING块了解推理过程
- 解释:"Claude做X是因为上下文包含Y但不包含Z"
Token Usage Investigation
令牌使用调查
- List messages to see token breakdown
- Identify spikes in cache_creation_input_tokens
- View context at spike points
- Determine what caused cache invalidation
- Suggest optimizations (batch edits, cache earlier)
- 列出消息查看令牌明细
- 识别cache_creation_input_tokens的峰值
- 查看峰值节点的上下文
- 确定导致缓存失效的原因
- 建议优化方案(批量编辑、提前缓存)
Agent Delegation Analysis
Agent委托分析
- List messages to find sidechains ([SIDE])
- View sidechain message context
- Trace back to parent in main thread
- Compare context available in main vs sidechain
- Explain what agent could/couldn't see
- 列出消息找到侧链([SIDE])
- 查看侧链消息的上下文
- 追溯到主线程中的父消息
- 对比主线程与侧链的可用上下文
- 解释Agent能/不能访问的内容
Context Window Exhaustion
上下文窗口耗尽
- List messages to track context growth
- Identify where total context approaches 200k
- View context at exhaustion point
- Analyze what's consuming space
- Suggest context optimization (new session, prune messages)
- 列出消息跟踪上下文增长
- 定位总上下文接近200k的节点
- 查看耗尽节点的上下文
- 分析占用空间的内容
- 建议上下文优化(新建会话、精简消息)
Integration with Other Skills
与其他技能的集成
- analyze-logs - Combine session logs (what Claude thought) with execution logs (what code did)
- debug-test-failures - See what context was available when tests were written
- orchestrate-agents - Track actual delegation patterns vs expected
- check-progress-status - Understand how tasks were completed (decision points, delegations)
- analyze-logs - 将会话日志(Claude的想法)与执行日志(代码行为)结合
- debug-test-failures - 查看编写测试时的可用上下文
- orchestrate-agents - 跟踪实际委托模式与预期的差异
- check-progress-status - 了解任务的完成方式(决策节点、委托情况)
Supporting Files
支持文件
-
references/reference.md - Technical depth:
- Session file format specification (JSONL structure)
- Data models and content block types
- Parent-child chain reconstruction algorithm
- Cache token types and pricing details
- Performance characteristics and limits
- Tool implementation details
- Understanding output format (session structure, token breakdown, message chains)
- Advanced usage patterns (session comparison, pattern detection, metrics)
- Troubleshooting guide (common errors, solutions)
- Complete command reference
-
templates/response-template.md - Response formatting:
- 6 response templates for different contexts
- List mode summary template
- Context window analysis template
- Agent delegation investigation template
- Token usage spike template
- Context exhaustion template
-
references/reference.md - 技术深度内容:
- 会话文件格式规范(JSONL结构)
- 数据模型和内容块类型
- 父子链重建算法
- 缓存令牌类型和定价细节
- 性能特征和限制
- 工具实现细节
- 输出格式解读(会话结构、令牌明细、消息链)
- 高级使用模式(会话对比、模式检测、指标)
- 故障排除指南(常见错误、解决方案)
- 完整命令参考
-
templates/response-template.md - 回复格式模板:
- 6种不同场景的回复模板
- 列表模式摘要模板
- 上下文窗口分析模板
- Agent委托调查模板
- 令牌使用峰值模板
- 上下文耗尽模板
Requirements
环境要求
Tools:
- Python 3.12+ (already in project)
- Session viewer: (bundled)
.claude/tools/utils/view_session_context.py - jq (optional, for advanced analysis):
brew install jq
Session files:
- User-level:
~/.claude/projects/-Users-{username}-{project-path}/{session-uuid}.jsonl - Generated automatically by Claude Code
Verification:
bash
undefined工具:
- Python 3.12+(已在项目中预装)
- 会话查看器:(已内置)
.claude/tools/utils/view_session_context.py - jq(可选,用于高级分析):
brew install jq
会话文件:
- 用户级:
~/.claude/projects/-Users-{username}-{project-path}/{session-uuid}.jsonl - 由Claude Code自动生成
验证步骤:
bash
undefinedVerify tool exists
验证工具是否存在
ls .claude/tools/utils/view_session_context.py
ls .claude/tools/utils/view_session_context.py
Verify session files exist
验证会话文件是否存在
ls -l ~/.claude/projects/-Users-$(whoami)-*/
ls -l ~/.claude/projects/-Users-$(whoami)-*/
Test the tool
测试工具
python3 .claude/tools/utils/view_session_context.py
$(ls -t ~/.claude/projects/-Users-$(whoami)-/.jsonl | head -1) --list
$(ls -t ~/.claude/projects/-Users-$(whoami)-/.jsonl | head -1) --list
undefinedpython3 .claude/tools/utils/view_session_context.py \
$(ls -t ~/.claude/projects/-Users-$(whoami)-/.jsonl | head -1) --list
undefinedQuick Reference
快速参考
| Goal | Command |
|---|---|
| List all messages | |
| View context at point | |
| View by UUID | |
| View raw JSON | |
| Find recent sessions | |
Key Messages:
- This skill provides X-ray vision into Claude's decision-making
- Use when behavior is unexpected or token usage is unclear
- Complements OpenTelemetry logs (code execution) with context window visibility (what Claude thought)
- Essential for debugging complex agent orchestration
- Start with , then drill down with
--list--message-index
Remember: Session logs show what Claude had access to and how it reasoned. This is your forensic tool for understanding "why Claude did X."
| 目标 | 命令 |
|---|---|
| 列出所有消息 | |
| 查看特定节点的上下文 | |
| 按UUID查看 | |
| 查看原始JSON | |
| 查找最近的会话 | `ls -lt ~/.claude/projects/-Users-$(whoami)-/.jsonl \ |
核心要点:
- 本技能为你提供Claude决策过程的X射线视角
- 适用于行为异常或令牌使用不明的场景
- 结合OpenTelemetry日志(代码执行)与上下文窗口可见性(Claude的想法)
- 是调试复杂Agent编排的必备工具
- 从模式开始,再使用
--list进行深入调查--message-index
请记住: 会话日志展示了Claude可访问的内容及其推理过程。这是你理解“为什么Claude会做X”的取证工具。",