session-log-analyzer

name	session-log-analyzer
description	Parse Claude Code JSONL session logs from ~/.claude/projects/ for tool call inventory, token costs, error detection, subagent traces, and compaction detection
version	1.1.0
model	sonnet
invoked_by	both
user_invocable	true
tools	["Read","Bash","Grep","Glob","TaskUpdate"]
agents	["developer","qa","architect"]
category	Memory & Context
tags	["session-analysis","observability","debugging","token-usage","jsonl-parsing"]
best_practices	["Always use line-by-line streaming for large JSONL files","Estimate tokens as chars/4 (Claude tokenizer approximation)","Never load entire session file into memory — use grep + head/tail"]
error_handling	graceful
streaming	supported
source	builtin
trust_score	100
provenance_sha	7d5ff1504fb773e1

Session Log Analyzer

Parse Claude Code JSONL session logs to understand what happened during a session — tool calls, token usage, errors, subagent trees, and compaction events.

Based on patterns from claude-devtools session parsing engine.

When to Invoke

Skill({ skill: 'session-log-analyzer' });

Use when: debugging failed sessions, analyzing cost/token usage, understanding which tools consumed the most context, tracing subagent execution, detecting where compaction occurred.

Workflow

Step 1: Locate Session Logs

Session logs live at ~/.claude/projects/{encoded-path}/*.jsonl where {encoded-path} is the project directory with / replaced by -.

# List all project session directories
ls ~/.claude/projects/

# Find the most recent session for current project
ls -lt ~/.claude/projects/$(pwd | sed 's|/|-|g; s|^-||')/*.jsonl | head -5

# Or search by date
find ~/.claude/projects/ -name "*.jsonl" -newer /tmp/yesterday -type f

Step 2: Parse and Classify Messages

Each line in the JSONL is a JSON object with a type field:

# Count message types in a session
grep -o '"type":"[^"]*"' SESSION.jsonl | sort | uniq -c | sort -rn

# Extract only assistant messages
grep '"type":"assistant"' SESSION.jsonl | head -5

Message types: user, assistant, system, progress (hook output)

Step 3: Extract Tool Call Inventory

Tool calls appear as tool_use content blocks in assistant messages, results as in user messages: