observability-analyze-session-logs

Compare original and translation side by side

🇺🇸

Original

English
🇨🇳

Translation

Chinese

Analyze Session Logs

分析会话日志

IMPORTANT DISTINCTION: This skill analyzes Claude Code session transcripts (what Claude saw and thought), NOT application/production logs (what code executed). For application logs, use the analyze-logs skill instead.
重要区别:本技能分析的是Claude Code会话记录(Claude所见和所想的内容),而非应用/生产日志(代码执行的内容)。若要分析应用日志,请使用analyze-logs技能。

Quick Start

快速开始

Most common usage (list all messages):
bash
python3 .claude/tools/utils/view_session_context.py <session-file.jsonl> --list
View context at specific point (by message index):
bash
python3 .claude/tools/utils/view_session_context.py <session-file.jsonl> --message-index 10
View context at specific message (by UUID from logs/errors):
bash
python3 .claude/tools/utils/view_session_context.py <session-file.jsonl> --uuid "3c8467d6-..."
最常用方式(列出所有消息):
bash
python3 .claude/tools/utils/view_session_context.py <session-file.jsonl> --list
查看特定节点的上下文(按消息索引):
bash
python3 .claude/tools/utils/view_session_context.py <session-file.jsonl> --message-index 10
查看特定消息的上下文(按日志/错误中的UUID):
bash
python3 .claude/tools/utils/view_session_context.py <session-file.jsonl> --uuid "3c8467d6-..."

When to Use This Skill

适用场景

Invoke this skill when users mention:
  • "why did Claude do X?"
  • "what was in the context window?"
  • "analyze session" / "check session logs"
  • "debug Claude behavior"
  • "token usage investigation"
  • "context window exhaustion"
  • "track agent delegation"
  • Any mention of
    .jsonl
    session files
Use cases:
  1. Debugging decisions - "Why did Claude choose approach X?" → View context at decision point
  2. Token analysis - "Where are tokens being used?" → Track cache creation vs cache read
  3. Agent tracking - "How are agents being delegated?" → Follow sidechain messages
  4. Context exhaustion - "Why did Claude lose context?" → See context window growth
  5. Performance issues - "Why is Claude slow?" → Identify cache thrashing
当用户提及以下内容时调用本技能:
  • "为什么Claude会做X?"
  • "上下文窗口里有什么?"
  • "分析会话" / "检查会话日志"
  • "调试Claude行为"
  • "令牌使用调查"
  • "上下文窗口耗尽"
  • "跟踪Agent委托"
  • 任何提及
    .jsonl
    会话文件的场景
使用案例:
  1. 决策调试 - "为什么Claude选择方案X?" → 查看决策节点的上下文
  2. 令牌分析 - "令牌都用在哪里了?" → 跟踪缓存创建与缓存读取情况
  3. Agent跟踪 - "Agent是如何被委托的?" → 跟踪侧链消息
  4. 上下文耗尽 - "为什么Claude丢失了上下文?" → 查看上下文窗口的增长情况
  5. 性能问题 - "为什么Claude反应慢?" → 识别缓存抖动问题

What This Skill Does

技能功能

Analyzes Claude Code session transcripts to provide forensic visibility into Claude's internal state, decision-making process, context window content, and token usage patterns.
What it reveals:
  • Context window content at any point in conversation
  • Token usage breakdown (input, cache creation, cache read, output)
  • Message chains (parent-child relationships)
  • Agent delegation patterns (sidechain vs main thread)
  • Context window growth over time
  • Thinking blocks (Claude's internal reasoning)
  • Tool calls with parameters and results
Key Distinction:
  • This skill: Analyzes Claude's session transcripts → Shows "what Claude saw and thought"
  • analyze-logs skill: Analyzes OpenTelemetry application logs → Shows "what code executed"
  • Use both together for complete debugging
分析Claude Code会话记录,深入了解Claude的内部状态、决策过程、上下文窗口内容和令牌使用模式。
可揭示的信息:
  • 对话中任意节点的上下文窗口内容
  • 令牌使用明细(输入、缓存创建、缓存读取、输出)
  • 消息链(父子关系)
  • Agent委托模式(侧链 vs 主线程)
  • 上下文窗口随时间的增长情况
  • 思考块(Claude的内部推理过程)
  • 工具调用的参数和结果
核心区别:
  • 本技能:分析Claude的会话记录 → 展示“Claude所见和所想”
  • analyze-logs技能:分析OpenTelemetry应用日志 → 展示“代码执行情况”
  • 结合使用两者以完成完整调试

Session File Locations

会话文件位置

User-level session files (Claude Code transcripts):
~/.claude/projects/-Users-{username}-{project-path}/{session-uuid}.jsonl
Find recent sessions:
bash
ls -lt ~/.claude/projects/-Users-$(whoami)-*/*.jsonl | head -5
用户级会话文件(Claude Code记录):
~/.claude/projects/-Users-{username}-{project-path}/{session-uuid}.jsonl
查找最近的会话:
bash
ls -lt ~/.claude/projects/-Users-$(whoami)-*/*.jsonl | head -5

Instructions

操作步骤

Follow this workflow to analyze Claude Code session logs:
  1. Locate session file - Find .jsonl file in ~/.claude/projects/
  2. Choose analysis mode - List messages, view context at index, or view at UUID
  3. Execute analysis - Run view_session_context.py with appropriate flags
  4. Interpret results - Examine context window, token usage, and decision points
  5. Report findings - Explain Claude's behavior with evidence from context
遵循以下工作流分析Claude Code会话日志:
  1. 定位会话文件 - 在~/.claude/projects/目录下找到.jsonl文件
  2. 选择分析模式 - 列出消息、按索引查看上下文或按UUID查看
  3. 执行分析 - 使用相应参数运行view_session_context.py
  4. 解读结果 - 检查上下文窗口、令牌使用情况和决策节点
  5. 报告发现 - 结合上下文证据解释Claude的行为

Analysis Workflow

分析工作流

Step 1: Locate Session File

步骤1:定位会话文件

bash
undefined
bash
undefined

Find most recent session file

查找最近的会话文件

ls -lt ~/.claude/projects/-Users-$(whoami)-/.jsonl | head -5
ls -lt ~/.claude/projects/-Users-$(whoami)-/.jsonl | head -5

Or search by UUID from error messages

或根据错误消息中的UUID搜索

grep -r "uuid" ~/.claude/projects/*/
undefined
grep -r "uuid" ~/.claude/projects/*/
undefined

Step 2: Choose Analysis Mode

步骤2:选择分析模式

Mode 1: List All Messages (Overview)
bash
python3 .claude/tools/utils/view_session_context.py <session.jsonl> --list
Use when: Initial investigation, finding specific messages, tracking token usage
Mode 2: Context Window at Specific Point
bash
python3 .claude/tools/utils/view_session_context.py <session.jsonl> --message-index 10
Use when: Debugging specific decision, understanding available context, seeing thinking blocks
Mode 3: View Specific Message by UUID
bash
python3 .claude/tools/utils/view_session_context.py <session.jsonl> --uuid "3c8467d6-..."
Use when: Error logs reference specific message UUID
Mode 4: View Raw JSON
bash
python3 .claude/tools/utils/view_session_context.py <session.jsonl> --message-index 10 --raw
Use when: Need exact JSON structure, programmatic analysis
模式1:列出所有消息(概览)
bash
python3 .claude/tools/utils/view_session_context.py <session.jsonl> --list
适用场景:初步调查、查找特定消息、跟踪令牌使用情况
模式2:查看特定节点的上下文窗口
bash
python3 .claude/tools/utils/view_session_context.py <session.jsonl> --message-index 10
适用场景:调试特定决策、了解可用上下文、查看思考块
模式3:按UUID查看特定消息
bash
python3 .claude/tools/utils/view_session_context.py <session.jsonl> --uuid "3c8467d6-..."
适用场景:错误日志中引用了特定消息UUID
模式4:查看原始JSON
bash
python3 .claude/tools/utils/view_session_context.py <session.jsonl> --message-index 10 --raw
适用场景:需要精确的JSON结构、程序化分析

Step 3: Execute Analysis

步骤3:执行分析

Run the appropriate command using the Bash tool:
bash
python3 .claude/tools/utils/view_session_context.py ~/.claude/projects/-Users-*/abc123.jsonl --list
使用Bash工具运行相应命令:
bash
python3 .claude/tools/utils/view_session_context.py ~/.claude/projects/-Users-*/abc123.jsonl --list

Step 4: Interpret Results

步骤4:解读结果

For List Output:
  1. Check message count - How long was the session?
  2. Identify MAIN vs SIDE - SIDE indicates agent delegation
  3. Spot token patterns:
    • High Cache Create = New context being cached
    • High Cache Read = Good cache utilization
    • High Cache Create repeatedly = Cache thrashing
  4. Find interesting points - Large output tokens, sudden cache creation, sidechains
  5. Note message indices for deeper investigation
For Context Window Output:
  1. Review message chain - Understand conversation flow
  2. Read THINKING blocks - See Claude's internal reasoning
  3. Check TOOL calls - What tools were invoked and why
  4. Examine token breakdown (input, cache creation, cache read, output)
  5. Check total context size - Is it approaching 200k limit?
For Token Usage:
  • Cache creation spike = Context changed significantly
  • High cache read = Good utilization (cost effective)
  • Low cache read = Cache misses (investigate why)
  • Growing total context = Approaching 200k limit
列表输出解读:
  1. 检查消息数量 - 会话持续了多久?
  2. 识别MAIN vs SIDE - SIDE表示Agent委托
  3. 发现令牌模式:
    • 高Cache Create = 新上下文被缓存
    • 高Cache Read = 缓存利用率良好
    • 重复高Cache Create = 缓存抖动
  4. 定位关键点 - 大量输出令牌、突然的缓存创建、侧链
  5. 记录需要深入调查的消息索引
上下文窗口输出解读:
  1. 查看消息链 - 理解对话流程
  2. 阅读THINKING块 - 了解Claude的内部推理
  3. 检查TOOL调用 - 调用了哪些工具以及原因
  4. 分析令牌明细(输入、缓存创建、缓存读取、输出)
  5. 检查总上下文大小 - 是否接近200k的限制?
令牌使用解读:
  • 缓存创建峰值 = 上下文发生显著变化
  • 高缓存读取 = 利用率良好(成本优化)
  • 低缓存读取 = 缓存未命中(调查原因)
  • 总上下文持续增长 = 接近200k限制

Step 5: Report Findings

步骤5:报告发现

Always provide:
  1. Summary - Session length, main vs sidechain messages, total tokens
  2. Key insights - What explains the behavior?
  3. Specific examples - Quote relevant thinking blocks, tool calls
  4. Context evidence - Show what Claude had access to
  5. Suggested next steps - Additional investigation or fixes
Example response format:
Analyzed session abc123.jsonl (42 messages):

Key Findings:
1. Agent delegation at message 15 (→ unit-tester)
   - Context window at that point: 24,059 tokens
   - Thinking: "Need comprehensive test coverage for new service"
   - Agent had access to service implementation but not architectural context

2. Cache thrashing at messages 28-35
   - Cache creation spiked to 18k tokens each message
   - Context kept changing due to repeated file edits
   - Suggestion: Batch edits to reduce cache invalidation

3. Context exhaustion at message 40
   - Total context: 189,234 tokens (approaching 200k limit)
   - Claude started summarizing instead of quoting full code

To investigate further:
- View agent delegation context: --message-index 15
- Examine cache thrashing: --message-index 30
需包含以下内容:
  1. 摘要 - 会话长度、主线程与侧链消息数量、总令牌数
  2. 关键洞察 - 什么解释了该行为?
  3. 具体示例 - 引用相关的思考块、工具调用
  4. 上下文证据 - 展示Claude可访问的内容
  5. 建议下一步 - 进一步调查或修复方案
回复格式示例:
已分析会话abc123.jsonl(共42条消息):

关键发现:
1. 消息15处的Agent委托(→ unit-tester)
   - 当时的上下文窗口:24,059个令牌
   - 思考过程:"需要为新服务提供全面的测试覆盖"
   - Agent可访问服务实现,但无法访问架构上下文

2. 消息28-35处的缓存抖动
   - 缓存创建峰值达到每条消息18k令牌
   - 因重复文件编辑导致上下文持续变化
   - 建议:批量编辑以减少缓存失效

3. 消息40处的上下文耗尽
   - 总上下文:189,234个令牌(接近200k限制)
   - Claude开始总结内容而非引用完整代码

进一步调查建议:
- 查看Agent委托上下文:--message-index 15
- 检查缓存抖动:--message-index 30

Best Practices

最佳实践

  1. Start with List Mode - Always get the overview first to identify interesting points
  2. Identify Patterns - Look for high cache creation (10k+ tokens), SIDE messages, large outputs
  3. Use Message Index for Deep Dives - From list output, drill down to specific points
  4. Follow Agent Delegation Chains - When you see [SIDE], trace back to parent in main thread
  5. Track Token Usage - Good: high cache read (80%+), Bad: repeated cache creation (thrashing)
  6. Compare Before/After - When debugging changes, analyze sessions before and after fix
  7. Correlate with Code Execution Logs - Session logs show "what Claude thought", OpenTelemetry logs show "what code executed"
  8. Save Important Sessions - Archive critical sessions to
    .claude/artifacts/
    for future reference
  1. 从列表模式开始 - 先获取概览以定位关键点
  2. 识别模式 - 关注高缓存创建(10k+令牌)、SIDE消息、大量输出
  3. 使用消息索引进行深入调查 - 从列表输出中定位到特定节点进行深挖
  4. 跟踪Agent委托链 - 当看到[SIDE]时,追溯到主线程中的父消息
  5. 监控令牌使用 - 良好:高缓存读取(80%+),不良:重复缓存创建(抖动)
  6. 对比前后情况 - 调试变更时,分析修复前后的会话
  7. 与代码执行日志关联 - 会话日志展示“Claude的想法”,OpenTelemetry日志展示“代码执行情况”
  8. 保存重要会话 - 将关键会话归档到
    .claude/artifacts/
    以备未来参考

Common Scenarios

常见场景

"Why did Claude do X?"

"为什么Claude会做X?"

  1. Find session file → List messages (
    --list
    )
  2. Identify message where decision was made
  3. View context at that point (
    --message-index N
    )
  4. Read THINKING blocks to see reasoning
  5. Explain: "Claude did X because context included Y but not Z"
  1. 找到会话文件 → 列出消息(
    --list
  2. 定位做出决策的消息
  3. 查看该节点的上下文(
    --message-index N
  4. 阅读THINKING块了解推理过程
  5. 解释:"Claude做X是因为上下文包含Y但不包含Z"

Token Usage Investigation

令牌使用调查

  1. List messages to see token breakdown
  2. Identify spikes in cache_creation_input_tokens
  3. View context at spike points
  4. Determine what caused cache invalidation
  5. Suggest optimizations (batch edits, cache earlier)
  1. 列出消息查看令牌明细
  2. 识别cache_creation_input_tokens的峰值
  3. 查看峰值节点的上下文
  4. 确定导致缓存失效的原因
  5. 建议优化方案(批量编辑、提前缓存)

Agent Delegation Analysis

Agent委托分析

  1. List messages to find sidechains ([SIDE])
  2. View sidechain message context
  3. Trace back to parent in main thread
  4. Compare context available in main vs sidechain
  5. Explain what agent could/couldn't see
  1. 列出消息找到侧链([SIDE])
  2. 查看侧链消息的上下文
  3. 追溯到主线程中的父消息
  4. 对比主线程与侧链的可用上下文
  5. 解释Agent能/不能访问的内容

Context Window Exhaustion

上下文窗口耗尽

  1. List messages to track context growth
  2. Identify where total context approaches 200k
  3. View context at exhaustion point
  4. Analyze what's consuming space
  5. Suggest context optimization (new session, prune messages)
  1. 列出消息跟踪上下文增长
  2. 定位总上下文接近200k的节点
  3. 查看耗尽节点的上下文
  4. 分析占用空间的内容
  5. 建议上下文优化(新建会话、精简消息)

Integration with Other Skills

与其他技能的集成

  • analyze-logs - Combine session logs (what Claude thought) with execution logs (what code did)
  • debug-test-failures - See what context was available when tests were written
  • orchestrate-agents - Track actual delegation patterns vs expected
  • check-progress-status - Understand how tasks were completed (decision points, delegations)
  • analyze-logs - 将会话日志(Claude的想法)与执行日志(代码行为)结合
  • debug-test-failures - 查看编写测试时的可用上下文
  • orchestrate-agents - 跟踪实际委托模式与预期的差异
  • check-progress-status - 了解任务的完成方式(决策节点、委托情况)

Supporting Files

支持文件

  • references/reference.md - Technical depth:
    • Session file format specification (JSONL structure)
    • Data models and content block types
    • Parent-child chain reconstruction algorithm
    • Cache token types and pricing details
    • Performance characteristics and limits
    • Tool implementation details
    • Understanding output format (session structure, token breakdown, message chains)
    • Advanced usage patterns (session comparison, pattern detection, metrics)
    • Troubleshooting guide (common errors, solutions)
    • Complete command reference
  • templates/response-template.md - Response formatting:
    • 6 response templates for different contexts
    • List mode summary template
    • Context window analysis template
    • Agent delegation investigation template
    • Token usage spike template
    • Context exhaustion template
  • references/reference.md - 技术深度内容:
    • 会话文件格式规范(JSONL结构)
    • 数据模型和内容块类型
    • 父子链重建算法
    • 缓存令牌类型和定价细节
    • 性能特征和限制
    • 工具实现细节
    • 输出格式解读(会话结构、令牌明细、消息链)
    • 高级使用模式(会话对比、模式检测、指标)
    • 故障排除指南(常见错误、解决方案)
    • 完整命令参考
  • templates/response-template.md - 回复格式模板:
    • 6种不同场景的回复模板
    • 列表模式摘要模板
    • 上下文窗口分析模板
    • Agent委托调查模板
    • 令牌使用峰值模板
    • 上下文耗尽模板

Requirements

环境要求

Tools:
  • Python 3.12+ (already in project)
  • Session viewer:
    .claude/tools/utils/view_session_context.py
    (bundled)
  • jq (optional, for advanced analysis):
    brew install jq
Session files:
  • User-level:
    ~/.claude/projects/-Users-{username}-{project-path}/{session-uuid}.jsonl
  • Generated automatically by Claude Code
Verification:
bash
undefined
工具:
  • Python 3.12+(已在项目中预装)
  • 会话查看器:
    .claude/tools/utils/view_session_context.py
    (已内置)
  • jq(可选,用于高级分析):
    brew install jq
会话文件:
  • 用户级:
    ~/.claude/projects/-Users-{username}-{project-path}/{session-uuid}.jsonl
  • 由Claude Code自动生成
验证步骤:
bash
undefined

Verify tool exists

验证工具是否存在

ls .claude/tools/utils/view_session_context.py
ls .claude/tools/utils/view_session_context.py

Verify session files exist

验证会话文件是否存在

ls -l ~/.claude/projects/-Users-$(whoami)-*/
ls -l ~/.claude/projects/-Users-$(whoami)-*/

Test the tool

测试工具

python3 .claude/tools/utils/view_session_context.py
$(ls -t ~/.claude/projects/-Users-$(whoami)-/.jsonl | head -1) --list
undefined
python3 .claude/tools/utils/view_session_context.py \ $(ls -t ~/.claude/projects/-Users-$(whoami)-/.jsonl | head -1) --list
undefined

Quick Reference

快速参考

GoalCommand
List all messages
python3 .claude/tools/utils/view_session_context.py <session.jsonl> --list
View context at point
python3 .claude/tools/utils/view_session_context.py <session.jsonl> --message-index 10
View by UUID
python3 .claude/tools/utils/view_session_context.py <session.jsonl> --uuid "abc123..."
View raw JSON
python3 .claude/tools/utils/view_session_context.py <session.jsonl> --message-index 10 --raw
Find recent sessions
ls -lt ~/.claude/projects/-Users-$(whoami)-*/*.jsonl | head -5

Key Messages:
  • This skill provides X-ray vision into Claude's decision-making
  • Use when behavior is unexpected or token usage is unclear
  • Complements OpenTelemetry logs (code execution) with context window visibility (what Claude thought)
  • Essential for debugging complex agent orchestration
  • Start with
    --list
    , then drill down with
    --message-index
Remember: Session logs show what Claude had access to and how it reasoned. This is your forensic tool for understanding "why Claude did X."
目标命令
列出所有消息
python3 .claude/tools/utils/view_session_context.py <session.jsonl> --list
查看特定节点的上下文
python3 .claude/tools/utils/view_session_context.py <session.jsonl> --message-index 10
按UUID查看
python3 .claude/tools/utils/view_session_context.py <session.jsonl> --uuid "abc123..."
查看原始JSON
python3 .claude/tools/utils/view_session_context.py <session.jsonl> --message-index 10 --raw
查找最近的会话`ls -lt ~/.claude/projects/-Users-$(whoami)-/.jsonl \

核心要点:
  • 本技能为你提供Claude决策过程的X射线视角
  • 适用于行为异常或令牌使用不明的场景
  • 结合OpenTelemetry日志(代码执行)与上下文窗口可见性(Claude的想法)
  • 是调试复杂Agent编排的必备工具
  • --list
    模式开始,再使用
    --message-index
    进行深入调查
请记住: 会话日志展示了Claude可访问的内容及其推理过程。这是你理解“为什么Claude会做X”的取证工具。",