Socket logs

The Sockets log records the live messages a chat exchanges with the platform: connections, events, turns, deliveries and the payloads behind them. Use it to follow one conversation's flow, see whether a message reached anyone, or find why one failed. It sits in the Logs tab of Observability, among the log sub-tabs.

Open the socket logs

In the sidebar, open Observability, then click Logs.
Click Sockets.
Set Period, then search or filter the columns.

A sub-tab appears only if your role gives you its permission; a sub-tab that turns out not to be permitted falls back to Audit. You need View Audit Log to open Logs at all. See Audit, sign-in and notification logs for the sub-tab rules.

Read the table

Each row is one message or one step in a connection's life. The default columns are Date & Time, Kind, Event, Direction, User, Outcome, Duration, Reason, Error Message, Conversation ID and Request ID.

Fifteen more columns start hidden: Recipients, Error Code, Turn ID, Connection ID, Rooms, Payload, Payload Size, Handler, Socket ID, Real User, Error Stack, Namespace, IP, User Agent and Row ID. Add them from the column picker; your choice is remembered in this browser.

Kind is the row's place in the story, such as a connection, an event or a delivery. The table shows the value with spaces instead of underscores.
Direction shows whether the message came from the browser or went out from the platform. Lifecycle rows leave it blank.
Outcome reads Success or Failed, and stays blank when the kind has no outcome.
Duration is the time the row covers; hover it for the exact value in milliseconds. A duration of zero is not shown.
Recipients appears only on outbound rows; it counts the sockets reached and shows a zero in amber.
User is empty when the row has no person attached, such as a connection that opened before the user was known.
Identifier cells such as Request ID, Conversation ID, Payload and Error Stack copy when you click them, with a check mark to confirm.

What the row kinds mean

Kind	What it means
connect	A browser opened a socket for the AI chat.
connect rejected	A connection attempt was refused.
disconnect	The socket closed. Reason says who closed it and why.
event start	The platform began handling an event the browser sent.
event end	The handler finished. For sendMessage this covers the whole AI turn, so a long duration is normal.
delivered	A message went out to a room. Counts are per handling process, and a relayed delivery is its own row with the reason relayed.
undelivered	No connected socket was reached. Look for a delivered row with the reason relayed at the same moment; without one, nobody heard it. Often this is just a closed tab.
turn start	An AI turn began for this conversation.
turn end	An AI turn finished normally.
turn error	An AI turn ended with an error.
turn cancelled	An AI turn was stopped before it finished.
tool call	The model called a tool. The duration is the tool call itself.

Colour marks an exception, never a routine result: a refused connection and a failed turn show in red tones, an undelivered message and a cancelled turn in amber, a tool call in an accent colour, and everything else stays neutral.

Note

Only the connection and event kinds are recorded today: connect, connect rejected, disconnect, event start, event end, delivered and undelivered. The turn and tool kinds are defined for the log but are not written, so rows of those kinds may not appear.

Focus on one flow

Right-click any row and pick Focus this flow, or open a row and use Focus flow in its header.
Focusing clears the column filters and the search and sorts the rows oldest first, so the story starts at the top. The bar above the table reads N row(s) · oldest first.
Exit focus restores the filters and sorting you had before. The search stays cleared.

The context menu also copies the row's ids, with an item such as Copy request id for each id the row carries; an id the row does not have is greyed out.

Read one message in detail

Click a row to open its details in a panel on the right; click it again to close. Sections appear only when they fit the row: a connect row carries no payload or delivery section.

Flow lists the row's ids: Request, Conversation, Turn and Connection. An id that was not recorded shows as a dash.
Who lists User, Real user, IP and Agent. Real user is filled only while an administrator acts as another user.
Delivery lists Reached, Rooms and Socket, and opens expanded when the message reached nobody.
Outcome lists the Result (Success or Failed), Reason, Code and Message, and opens expanded when the row failed or carries an error.
Payload shows the sent body as JSON with a Sent size label; the size reads in characters below 1024 and in kilobytes from there. A payload that was cut for storage says Shortened for storage and names the original size, so it never reads as complete.

Empty blocks read Empty, and copy buttons sit next to ids and blocks.

What the log stores

The log keeps the shape of a flow, not what people wrote.

Ids and settings are stored; the text a person typed and the text a model wrote are left out.
Long values are replaced with markers such as <str:512>, and a payload too large to store is flagged as cut.
Typing updates and streamed answer chunks do not become rows.
The rows a query returned are never stored.

Export the socket logs

Export in the toolbar downloads the rows that match your period, column filters, sorting and search. The file is named socket_logs.

Related logs

AI, socket and PII logs follow the AI requests and responses behind a chat.
Audit, sign-in and notification logs cover the request audit, sign-in attempts and notifications.

Permissions

Sockets is a sub-tab of Logs. You need View Audit Log to open Logs at all, and the sub-tab appears only if your role includes it; a sub-tab that turns out not to be permitted falls back to Audit. Which permission opens each sub-tab is listed in the Observability overview and in Audit, sign-in and notification logs.

Periods and limits

Period offers Today, Last 7d, Last 30d and Custom, and starts on Last 7d.
A custom range can span at most one year. A longer range is refused with Date range too large.
Rows per page starts at 50; you can pick 50, 100 or 200.
Your period and column layout are remembered in this browser, not on your account.

Note

If a refresh fails after the table has loaded, the table keeps its rows and shows an error bar with Retry instead of clearing your search. A first load that fails shows Failed to load socket logs with the reason. If it keeps failing, see Observability troubleshooting.

Questions, answered

Why does an undelivered row appear even though the message arrived?

Delivery is counted per handling process. When another process reached the sockets, it writes its own delivered row with the reason relayed for the same event and conversation at the same moment. If you find one, the message was heard. An undelivered row alone means no connected socket was reached, which is often just a closed tab.

Why do I not see rows for turns or tool calls?

Does the log store what someone typed in a chat?

No. Socket payloads keep identifiers and settings; the text a person typed and the text a model wrote are left out, and long values are shortened with markers such as <str:512>. The rows a query returned are never stored.

What does "Shortened for storage" mean?

The stored payload was cut because it was too large; the notice names the original size, so a shortened payload never reads as a complete one. Read the JSON next to the notice for everything the platform kept.

Why is Recipients blank, and what does a zero mean?

Recipients appears only on messages the platform sent out, so other rows leave it blank. A zero means the message reached no socket at that moment and shows in amber. Check for a delivered row with the reason relayed before treating it as lost.

Which columns start hidden?

Recipients, Error Code, Turn ID, Connection ID, Rooms, Payload, Payload Size, Handler, Socket ID, Real User, Error Stack, Namespace, IP, User Agent and Row ID. Add them from the column picker; your choice is remembered.

What happens to my filters when I focus a flow?

Focusing replaces your column filters and clears the search, then sorts oldest first. Exit focus restores the filters and sorting you had before; the search stays cleared.

Why is a duration amber or red?

Most rows turn amber at 1 second and red at 10 seconds. Rows that cover a whole AI turn use a longer scale: amber at 30 seconds and red at 2 minutes, because a long turn is normal.

What does Real User show?

Real User is filled only while an administrator acts as another user, and shows the person actually driving the chat. It stays empty for ordinary sessions.