Skip to main content

Log Settings

Log Settings controls what Willow writes to your logs, how long it keeps the payloads, and where it forwards them.

Log Settings

This page covers the settings themselves. To read and search the logs, see Logs under Monitor.

What you can do​

  • Choose whether captured content, responses, and admin actions are written to logs
  • Forward logs to external providers
  • Set audit log data retention
  • Import or sync Claude conversations through Claude Compliance Sync
  • Delete synced conversation logs by date range

Log settings​

Open Settings in the admin sidebar, then expand Log Settings.

SettingWhat it controls
Log ContentOne switch for every place Willow captures content: MCP tool call arguments, agent prompts and transcripts (telemetry and Claude Compliance Sync), and the text guards scan in hook and Prompt Guard evaluations. When it is off, only metadata is stored — who, when, which tool or guard, and the verdict.
Log ResponsesAlso stores what came back: MCP tool responses, assistant replies, and tool result bodies. Requires Log Content.
Log Passed EvaluationsRecords a message in Monitor → Messages for every guard evaluation — IDE guard hooks and browser Prompt Guard alike — even when nothing is triggered. Off means only flagged evaluations (block, warn, ask, redact) are logged. Passing evaluations never send alerts.
Log Admin ActionsIncludes admin action events in logs.
Log ProvidersAdds external log destinations such as Splunk, Grafana Loki, Coralogix, CrowdStrike, Panther, Google SecOps, AWS S3, or a webhook.
Audit Log Data RetentionPurges tool call arguments and response data from audit logs older than the selected period. Metadata such as who, when, which tool, and status is preserved.
Claude Compliance SyncImports chats and messages from the Claude Compliance API or a one-off claude.ai data export.

After changing settings, select Save Changes.

Content logging is one org-wide decision​

Log Content applies to every collection surface, so there is no per-feature content toggle to keep in sync. New organizations start with it on. While it is off, Guard Hooks, Prompt Guard, agent telemetry, and Claude Compliance Sync all show a notice explaining that the content they would display is not being stored — detections, verdicts, token counts, and thread structure are recorded either way, so those features keep working on metadata alone.

Log Passed Evaluations works the same way: it is a single decision about audit volume that every guard surface obeys, rather than a toggle on each guard page. The guard pages link back here and note when only flagged evaluations are being recorded.

Audit log data retention​

Use Audit Log Data Retention to automatically purge tool call arguments and response data after a selected period. Set Retain data for to Always if your organization needs to keep full audit log payloads indefinitely.

Retention affects stored argument and response data. Audit metadata remains available for review and reporting.

Log providers​

You can forward application logs to an external provider for centralized observability. Each provider has its own page covering prerequisites, configuration fields, and troubleshooting:

ProviderUse it when
Splunk (HEC)You run Splunk and can enable the HTTP Event Collector.
Grafana LokiYou query logs with LogQL in Grafana.
CoralogixYou use Coralogix for full-stack observability.
CrowdStrikeYou run Falcon LogScale or NG-SIEM.
PantherYou use Panther and ingest via an HTTP log source.
Google SecOpsYou use Google Security Operations (Chronicle).
AWS S3Your SIEM reads from a bucket you own, including Panther's S3 data transport.
WebhookNo native provider fits, and you want a custom pipeline.

To add one, open Admin > Settings > Log Settings, then select Add Provider. Choose the provider type and fill in its required fields.

Anonymous Mode​

Available on all providers. When enabled, only aggregated and statistical data is forwarded: sensitive fields such as request data and user details are excluded from the payload.

Use this if you need basic operational telemetry without exposing PII.

Combine Anonymous Mode with provider-side redaction rules for defense in depth.

Best practices​

  • Use least-privilege credentials for any outbound log sink.
  • Add provider-side retention and lifecycle rules to control storage costs.
  • Tag logs with env (for example production or staging) to separate flows.
  • Validate network egress and firewall rules from your deployment to the provider.
  • Test provider connectivity before relying on it for compliance.
  • Use Anonymous Mode when forwarding to less-trusted or shared environments.

Troubleshooting​

  • No logs appearing: verify the provider credentials and URL, and confirm outbound egress is allowed. See the provider's own page for specific checks.
  • Errors when saving: ensure every required field is filled for the selected provider, and that URLs include the protocol (https://).
  • Timeout errors: webhook and Coralogix requests time out after 5 seconds. Ensure your endpoint or region is reachable with low latency.
On this page