Simple Log Service:Collect AI Agent observability logs (AgentSight)

Prerequisites

• The server operating system kernel version is Linux 5.10 or later.

  The plugin relies on eBPF for system-level observation. Kernels earlier than 5.10 do not support the required eBPF features and cannot perform collection.

  Verified supported environments include:

  • Alibaba Cloud Linux 3

  • Ubuntu 22.04

  • Ubuntu 24.04

  Run the following command to check your current kernel version:

  uname -r

• LoongCollector v3.3.9 or later is installed on the server.

  The AgentSight collection capability requires a recent version of LoongCollector. Upgrade to the latest version before configuring this plugin.

• The target AI Agent (such as OpenClaw or Hermes) is deployed and running on the server.

• ACK container environment: To collect LLM logs from Agent Pods in a Container Service for Kubernetes (ACK) cluster, make sure that the following requirements are met:

  • LoongCollector is upgraded to v3.3.10 or later.

  • The enableEBPF switch is enabled on the Component Management page of the ACK console.

  After these requirements are met, you can create an AgentSight Logtail collection configuration in Simple Log Service to collect Agent LLM logs. The configuration applies to the same machine group as other LoongCollector configurations.

How it works

Traditional application instrumentation cannot keep up with the rapid iteration and highly customized nature of AI Agents, nor can it trace through tool calling chains to identify actual Agent behavior. The input_agentsight plugin attaches SSL/TLS probes and process observers at the kernel level through eBPF, capturing TLS-encrypted requests and responses between Agent processes and LLM services. This achieves end-to-end observability without modifying Agent code.

Features

• Collects complete interaction data between AI Agents and LLMs: request messages, response messages, model name, token usage, latency, status codes, and more.

• Identifies processes that access LLM APIs based on a domain whitelist with built-in common LLM API domains.

Procedure

1. Log on to the Simple Log Service console.

2. In the Data Import section, select the LoongCollector collection configuration entry, and then select the target Project and Logstore.

3. On the Machine Group Configuration page, configure and apply the target machine group.

   Important

   If you apply the machine group immediately after creating it, the heartbeat status may display as FAIL because the connection has not taken effect. Click Automatic Retry to resolve this issue.

4. On the Data Source Settings tab, specify a Configuration Name and enter the plugin configuration. The plugin type is fixed as input_agentsight.

   Choose a configuration pattern based on your scenario:

   • Use minimal configuration when your Agent and LLM provider are covered by built-in defaults.

   • Use custom domain whitelist when your Agent connects to a non-default LLM endpoint.

   • Use custom command line whitelist when your Agent process is not matched by built-in rules.

   • Use raw HTTP traffic reporting when you need to inspect traffic that AgentSight cannot parse into GenAI semantics.

   Minimal configuration

   Minimal configuration: Specify only the plugin type. All settings use default values (built-in default command line whitelist and domain list are injected).

   {
       "inputs": [
           {
               "type": "input_agentsight"
           }
       ]
   }

   Custom domain whitelist: Specify custom HTTPS domains to monitor.

   {
       "inputs": [
           {
               "detail": {
                   "ProbeConfig": {
                       "Https": [
                           "api.openai.com",
                           "api.anthropic.com",
                           "dashscope-intl.aliyuncs.com",
                           "dashscope.aliyuncs.com"
                       ]
                   }
               },
               "type": "input_agentsight"
           }
       ]
   }

   Custom command line whitelist: Filter target Agents by process command line and tag their type.

   {
       "inputs": [
           {
               "detail": {
                   "ProbeConfig": {
                       "CmdlineWhitelist": [
                           {
                               "AgentType": "openclaw",
                               "Args": ["node*", "*openclaw*"]
                           },
                           {
                               "AgentType": "claude-code",
                               "Args": ["node*", "*claude*"]
                           }
                       ]
                   }
               },
               "type": "input_agentsight"
           }
       ]
   }

   Report unknown protocols as raw HTTP traffic: When ProbeConfig.RawHttpsFallback is enabled, traffic that AgentSight cannot parse into GenAI semantics (unknown API paths or non-standard bodies) is no longer discarded. Instead, it is reported as raw HTTP traffic. Create a field index for the raw HTTP events, and then use the LogStore query and analysis feature to inspect them.

   {
       "inputs": [
           {
               "detail": {
                   "ProbeConfig": {
                       "RawHttpsFallback": true
                   }
               },
               "type": "input_agentsight"
           }
       ]
   }

   Note

   Note the following behavior:

   • Raw HTTP logs produced by RawHttpsFallback: true are generated only when AgentSight cannot resolve traffic into GenAI semantics. They are mutually exclusive with gen_ai.* logs: a single request produces at most one of the two.

   • Raw HTTP traffic is reported with the event names event.name=http.request and event.name=http.response.

   • This feature is supported only in LoongCollector v3.3.10 and later.

5. Create indexes and preview data. You can manually create field indexes based on the collected fields, or click Auto Generate Index.

6. After the configuration is complete, wait approximately 1 minute for the index to take effect. You can then view the collected logs on the Logstore query and analysis page.

   You should see log entries containing fields such as gen_ai.agent.type, gen_ai.model.request, and gen_ai.model.response. The presence of these fields confirms that collection is working correctly.

Configuration parameters

Limits and troubleshooting

• No data on the preview or query page: Verify that the server kernel version is 5.10 or later (uname -r) and that LoongCollector is upgraded to v3.3.9 or later. Then verify that the target process command line matches a CmdlineWhitelist rule, or that the domains it accesses are in the Https list. Run the following command on the server to view the actual command line of a process before writing glob rules:

  tr '\0' ' ' < /proc/<PID>/cmdline; echo

  Technical appendix for eBPF hook compatibility limitations that may prevent collection for certain Agent binaries.

• For additional troubleshooting guidance, see Troubleshoot Logtail log collection failures.

• This feature is currently in canary release and is available in the following regions: US (Virginia), US (Silicon Valley), Malaysia (Kuala Lumpur), Indonesia (Jakarta), South Korea (Seoul), and others.

Technical appendix

The input_agentsight plugin uses eBPF for collection. Whether it can capture HTTPS encrypted traffic from a given Agent depends on whether eBPF can locate the SSL send/receive functions in the Agent's executable. Use the following table to determine support: