LLM Observability: What to Trace and Why
What to trace and log in a production LLM app: prompts, retrieved context, tool calls, tokens, cost and latency, with sampling, privacy and alerting guidance.
Topics:AI platform engineering
Illustrative scenario: a customer reports that the assistant gave them the wrong refund policy. The team opens the logs and finds the final answer and a timestamp. They cannot see which documents were retrieved, which prompt version ran, which model served the request or whether a tool call failed along the way. Fixing the bug starts with guessing. Observability is what turns that guess into a lookup.
TL;DR
Observability for an LLM application means being able to reconstruct any request: what the user asked, what was retrieved, what prompt was assembled, which model and tools were used, what each step cost and how long it took, and what came back. Record that as a trace with one span per stage. Log identifiers and metrics by default, capture full prompt and response text deliberately and with care for privacy, sample live traffic for evaluation, and alert on changes in cost, latency, refusals and retrieval quality. The aim is that "why was this answer wrong?" takes minutes to answer.
Why ordinary monitoring is not enough
Conventional monitoring tells you whether a service is up, how fast it responds and how often it errors. An LLM application can pass all of those checks and still give wrong answers, because the failure is in the content, not the infrastructure. A fast, error-free response that cites the wrong policy looks perfect on a normal dashboard.
Without tracing
- Only the final answer and a timestamp are logged
- The team cannot tell whether retrieval, the prompt or the model was at fault
- Fixes are guesses, and regressions are noticed by users
With tracing
- Each stage is recorded with its inputs, outputs, cost and latency
- A wrong answer can be traced to the stage that lost the evidence
- Fixes are targeted, and changes can be compared before and after
The why good retrieval still produces bad answers post shows why this matters: you need to know which documents were retrieved and which actually reached the prompt before you can tell where an answer went wrong.
What a trace should contain
Think of one request as a tree of steps. A trace is the record of that tree, and each step is a span with its own timing and attributes.
Step 1: Receive
Request id, caller or tenant, and the user input (or a reference to it)
Step 2: Retrieve
The query used, the ids and scores of the documents returned, and the filters applied
Step 3: Assemble
The prompt version, which retrieved items made it into the context and the total input tokens
Step 4: Call the model
Model name and version, parameters, input and output tokens, latency and any error or retry
Step 5: Use tools
Each tool call with its name, arguments, result status and duration
Step 6: Respond
The final output, any refusal, and the validation or guardrail results
Add cost to each model span by multiplying tokens by the price you pay, and roll it up per request, per feature and per team. Note which version of each prompt, model and index served the request, because without versions you cannot compare before and after a change.
Use standard conventions
You do not need to invent attribute names. OpenTelemetry, an open standard for traces and metrics, maintains semantic conventions for generative AI covering spans, metrics and events, in a dedicated GenAI conventions repository (read on 11 October 2026). The repository's README does not state a stability level, and its content has moved before, so check the current status and attribute names before you build on them, and plan to update when they change. Following a standard means your traces work with more tools and your team does not maintain a private vocabulary.
What to log, and what to be careful with
The most useful data is also the most sensitive. A full prompt may contain customer data and a full response may repeat it. Decide deliberately what to keep.
If
Identifiers, versions, token counts, cost and latency
Choose
Always capture
Because
They are low risk and answer most operational questions
If
Retrieved document ids and scores
Choose
Always capture
Because
They show where evidence was lost, without copying the text
If
Full prompt and response text
Choose
Capture deliberately, on a sample or on opt-in, with redaction
Because
Valuable for debugging, but may contain personal or confidential data
If
Sensitive fields such as personal data
Choose
Redact before storage
Because
Avoid creating a second uncontrolled store of private data
If
Retention
Choose
Set a defined period and access controls
Because
Debug data should not live forever or be visible to everyone
Treat trace storage with the same permissions and retention rules as the underlying data. If you cannot store full text, store ids and hashes and keep a reproducible way to rebuild the prompt from versioned inputs.
Sample live traffic for evaluation
Traces are also the raw material for evaluation. Sample a small share of live requests, score them with the same checks and judge you use offline and review the failures by hand. Failures worth fixing become new test cases. LLM evaluation fundamentals explains the offline half, and the online evaluation chapter covers sampling and drift. For agents, record every step so trajectory checks are possible.
Alert on what actually goes wrong
Cost per request and per feature
Good: Tracked, with an alert on a sharp change
Red flag: The first sign of a problem is the monthly invoice
Latency by stage
Good: Time to first token and per-stage time are visible
Red flag: Only total latency is recorded
Refusal and error rates
Good: Watched over time, with alerts on shifts
Red flag: A model update changes refusals unnoticed
Retrieval quality
Good: Scores and recall on sampled traffic are tracked
Red flag: Retrieval failures only surface as user complaints
Guardrail and policy denials
Good: Counted and reviewed, so spikes get investigated
Red flag: Denials are logged but nobody looks
A sudden change in any of these can mean a provider changed behaviour, an index went stale, a prompt was edited or someone is probing the system. The cost blowup challenge starts from a bill that rose far faster than traffic, and finding the leak depends on per-request cost data.
Getting started
Week 1
Add a request id and log versions, tokens, cost and latency for every model call
Week 2
Add spans for retrieval and tool calls, with ids and scores rather than full text
Week 3
Decide and document the policy for capturing, redacting and retaining prompt and response text
Week 4
Start sampling live traffic for review, and set alerts on cost, latency and refusal rate
Do not wait for a perfect setup. A request id, versions and cost per call already answer many debugging questions, and you can add richer detail as you learn what you need. Platform teams usually own this shared plumbing, as described in what an AI platform engineer actually owns, so product teams get tracing by default.
Frequently asked questions
What is LLM observability? The ability to reconstruct and understand any request to an LLM application: the input, retrieved context, assembled prompt, model and tool calls, output, tokens, cost and latency. It goes beyond uptime and error rates to the content and quality of what the system did.
What should I trace in an LLM application? One span per stage: receive, retrieve, assemble the prompt, call the model, use tools and respond. Record identifiers, versions, token counts, cost, latency and the ids and scores of retrieved documents, and capture full prompt and response text only deliberately.
Should I log full prompts and responses? Only with care. They are very useful for debugging but may contain personal or confidential data. Capture them on a sample or opt-in basis, redact sensitive fields, set a retention period and restrict access.
Is there a standard for tracing LLM calls? OpenTelemetry maintains semantic conventions for generative AI covering spans, metrics and events. Check the current status and attribute names before building on them, since they may change.
How is LLM monitoring different from normal application monitoring? Normal monitoring shows whether the service is up, fast and error-free. An LLM application can pass those checks and still give wrong answers, so you also need visibility into retrieval, prompts, model behaviour, cost and output quality.
What should I alert on? Sharp changes in cost per request, latency by stage, refusal and error rates, retrieval scores and guardrail denials. Such changes can mean a provider changed behaviour, an index went stale, a prompt was edited or the system is being probed.
How do traces help with evaluation? Sample a small share of live traces, score them with the same checks and judge you use offline, review the failures and add the worthwhile ones to your evaluation set. Over time the set grows to match real usage.
Related
Sources
- OpenTelemetry semantic conventions for generative AI (OpenTelemetry), read on 11 October 2026: the repository defines conventions for GenAI spans, metrics and events and does not state a stability level in its README
AI platform engineering
Your next step
Reading is the start. Turn it into skill: read the chapter, practise on something real, check the numbers, then follow a path.
More on AI platform engineering
- LLM Gateways: What They Do and How to Choose OneWhat an LLM gateway does, when you need one and how to choose: authentication, routing, budgets, caching, logging and policy, with a vendor-neutral scorecard.
- What an AI Platform Engineer Actually OwnsWhat an AI platform team builds and runs: gateway, serving, evaluation pipelines, observability, cost and security, and where product teams take over.
- API or Local Models: Where the Cost Break-Even SitsWhen does running a model yourself beat paying for an API? A total-cost framework, an illustrative break-even calculation and the non-cost factors that decide.
Discuss this article
Got a question, a counter-example or a correction? Bring it to the community.
Prefer a feed reader? Follow by RSS.