Skip to content

Command Palette

Search for a command to run...

BLOG / PRODUCTION AIIntermediate

LLM Observability: What to Trace and Why

What to trace and log in a production LLM app: prompts, retrieved context, tool calls, tokens, cost and latency, with sampling, privacy and alerting guidance.

Bhavin Mistry October 11, 2026 9 min readLast reviewed

Topics:AI platform engineering

Illustrative scenario: a customer reports that the assistant gave them the wrong refund policy. The team opens the logs and finds the final answer and a timestamp. They cannot see which documents were retrieved, which prompt version ran, which model served the request or whether a tool call failed along the way. Fixing the bug starts with guessing. Observability is what turns that guess into a lookup.

TL;DR

Observability for an LLM application means being able to reconstruct any request: what the user asked, what was retrieved, what prompt was assembled, which model and tools were used, what each step cost and how long it took, and what came back. Record that as a trace with one span per stage. Log identifiers and metrics by default, capture full prompt and response text deliberately and with care for privacy, sample live traffic for evaluation, and alert on changes in cost, latency, refusals and retrieval quality. The aim is that "why was this answer wrong?" takes minutes to answer.

Why ordinary monitoring is not enough

Conventional monitoring tells you whether a service is up, how fast it responds and how often it errors. An LLM application can pass all of those checks and still give wrong answers, because the failure is in the content, not the infrastructure. A fast, error-free response that cites the wrong policy looks perfect on a normal dashboard.

Without tracing

  • Only the final answer and a timestamp are logged
  • The team cannot tell whether retrieval, the prompt or the model was at fault
  • Fixes are guesses, and regressions are noticed by users

With tracing

  • Each stage is recorded with its inputs, outputs, cost and latency
  • A wrong answer can be traced to the stage that lost the evidence
  • Fixes are targeted, and changes can be compared before and after
Debugging a wrong answer with and without tracing

The why good retrieval still produces bad answers post shows why this matters: you need to know which documents were retrieved and which actually reached the prompt before you can tell where an answer went wrong.

What a trace should contain

Think of one request as a tree of steps. A trace is the record of that tree, and each step is a span with its own timing and attributes.

  1. Step 1: Receive

    Request id, caller or tenant, and the user input (or a reference to it)

  2. Step 2: Retrieve

    The query used, the ids and scores of the documents returned, and the filters applied

  3. Step 3: Assemble

    The prompt version, which retrieved items made it into the context and the total input tokens

  4. Step 4: Call the model

    Model name and version, parameters, input and output tokens, latency and any error or retry

  5. Step 5: Use tools

    Each tool call with its name, arguments, result status and duration

  6. Step 6: Respond

    The final output, any refusal, and the validation or guardrail results

One traced request, stage by stage

Add cost to each model span by multiplying tokens by the price you pay, and roll it up per request, per feature and per team. Note which version of each prompt, model and index served the request, because without versions you cannot compare before and after a change.

Use standard conventions

You do not need to invent attribute names. OpenTelemetry, an open standard for traces and metrics, maintains semantic conventions for generative AI covering spans, metrics and events, in a dedicated GenAI conventions repository (read on 11 October 2026). The repository's README does not state a stability level, and its content has moved before, so check the current status and attribute names before you build on them, and plan to update when they change. Following a standard means your traces work with more tools and your team does not maintain a private vocabulary.

What to log, and what to be careful with

The most useful data is also the most sensitive. A full prompt may contain customer data and a full response may repeat it. Decide deliberately what to keep.

  • If

    Identifiers, versions, token counts, cost and latency

    Choose

    Always capture

    Because

    They are low risk and answer most operational questions

  • If

    Retrieved document ids and scores

    Choose

    Always capture

    Because

    They show where evidence was lost, without copying the text

  • If

    Full prompt and response text

    Choose

    Capture deliberately, on a sample or on opt-in, with redaction

    Because

    Valuable for debugging, but may contain personal or confidential data

  • If

    Sensitive fields such as personal data

    Choose

    Redact before storage

    Because

    Avoid creating a second uncontrolled store of private data

  • If

    Retention

    Choose

    Set a defined period and access controls

    Because

    Debug data should not live forever or be visible to everyone

Choosing what to capture

Treat trace storage with the same permissions and retention rules as the underlying data. If you cannot store full text, store ids and hashes and keep a reproducible way to rebuild the prompt from versioned inputs.

Sample live traffic for evaluation

Traces are also the raw material for evaluation. Sample a small share of live requests, score them with the same checks and judge you use offline and review the failures by hand. Failures worth fixing become new test cases. LLM evaluation fundamentals explains the offline half, and the online evaluation chapter covers sampling and drift. For agents, record every step so trajectory checks are possible.

Alert on what actually goes wrong

  • Cost per request and per feature

    Good: Tracked, with an alert on a sharp change

    Red flag: The first sign of a problem is the monthly invoice

  • Latency by stage

    Good: Time to first token and per-stage time are visible

    Red flag: Only total latency is recorded

  • Refusal and error rates

    Good: Watched over time, with alerts on shifts

    Red flag: A model update changes refusals unnoticed

  • Retrieval quality

    Good: Scores and recall on sampled traffic are tracked

    Red flag: Retrieval failures only surface as user complaints

  • Guardrail and policy denials

    Good: Counted and reviewed, so spikes get investigated

    Red flag: Denials are logged but nobody looks

A starter set of signals

A sudden change in any of these can mean a provider changed behaviour, an index went stale, a prompt was edited or someone is probing the system. The cost blowup challenge starts from a bill that rose far faster than traffic, and finding the leak depends on per-request cost data.

Getting started

  1. Week 1

    Add a request id and log versions, tokens, cost and latency for every model call

  2. Week 2

    Add spans for retrieval and tool calls, with ids and scores rather than full text

  3. Week 3

    Decide and document the policy for capturing, redacting and retaining prompt and response text

  4. Week 4

    Start sampling live traffic for review, and set alerts on cost, latency and refusal rate

A first month (illustrative)

Do not wait for a perfect setup. A request id, versions and cost per call already answer many debugging questions, and you can add richer detail as you learn what you need. Platform teams usually own this shared plumbing, as described in what an AI platform engineer actually owns, so product teams get tracing by default.

Frequently asked questions

What is LLM observability? The ability to reconstruct and understand any request to an LLM application: the input, retrieved context, assembled prompt, model and tool calls, output, tokens, cost and latency. It goes beyond uptime and error rates to the content and quality of what the system did.

What should I trace in an LLM application? One span per stage: receive, retrieve, assemble the prompt, call the model, use tools and respond. Record identifiers, versions, token counts, cost, latency and the ids and scores of retrieved documents, and capture full prompt and response text only deliberately.

Should I log full prompts and responses? Only with care. They are very useful for debugging but may contain personal or confidential data. Capture them on a sample or opt-in basis, redact sensitive fields, set a retention period and restrict access.

Is there a standard for tracing LLM calls? OpenTelemetry maintains semantic conventions for generative AI covering spans, metrics and events. Check the current status and attribute names before building on them, since they may change.

How is LLM monitoring different from normal application monitoring? Normal monitoring shows whether the service is up, fast and error-free. An LLM application can pass those checks and still give wrong answers, so you also need visibility into retrieval, prompts, model behaviour, cost and output quality.

What should I alert on? Sharp changes in cost per request, latency by stage, refusal and error rates, retrieval scores and guardrail denials. Such changes can mean a provider changed behaviour, an index went stale, a prompt was edited or the system is being probed.

How do traces help with evaluation? Sample a small share of live traces, score them with the same checks and judge you use offline, review the failures and add the worthwhile ones to your evaluation set. Over time the set grows to match real usage.

Sources

AI platform engineering

Your next step

Reading is the start. Turn it into skill: read the chapter, practise on something real, check the numbers, then follow a path.

  1. Read · ChapterLLM Gateways & Routing
  2. Practise · Debug challengeCost Blowup After Launch
  3. Use a free toolAI Cost Calculator
  4. Follow a roadmapAI Platform Engineer roadmap
All articles on AI platform engineering
#LLM observability#tracing#AI platform#OpenTelemetry#monitoring#debugging

Discuss this article

Got a question, a counter-example or a correction? Bring it to the community.

Join the discussion

Email updates

Enjoyed this? Get the next guide by email.

One email when something substantial is published. No digests, no daily drip. Unsubscribe in one click.

We will email you a confirmation link first, then send an occasional email when a substantial guide is published. Unsubscribe in one click. Stored on our own servers, never sold or shared. See the privacy policy.

Prefer a feed reader? Follow by RSS.