# Tracing one call

Follow one agent request end to end by its correlation ID.

"The agent got a wrong answer at 14:32" is only debuggable if one identifier connects everything that request touched. In Zato that identifier is the CID - the correlation ID assigned when a request arrives and passed through every layer it crosses. The trace below follows one agent request end to end: the audit event, the server log, the tool's own logging, the response shaping trace and the LLM call the tool made along the way.

**Prerequisites.** An [MCP gateway](https://zato.io/docs/ai/mcp/index.html) with its audit log on and a tool that itself [invokes an LLM](https://zato.io/docs/ai/llm/invoke.html) - a summarization tool is used here, but the steps apply to any tool.

## The report {#the-report}

An agent called the `example.docs.summarize` tool and the user reports the summary looked cut short. The five artifacts below share one CID.

## The audit event {#the-audit-event}

The Dashboard's MCP audit page, filtered to the gateway around 14:32, has the request:

| Time | CID | Event | Tool | Caller | Outcome | Size |
| --- | --- | --- | --- | --- | --- | --- |
| 14:32:11 | `9f0da4306ffd7e6a341bce60` | `mcp-tools-call` | `example.docs.summarize` | `docs.agent.key` | `ok` | 4102 |

The [audit log](https://zato.io/docs/ai/mcp/audit-log.html) already answers half the report - the call succeeded and took the time `duration_ms` in its `data` document records. The CID connects everything else below.

## The shaping trace {#the-shaping-trace}

The same event's `data` document holds the trace of what [response shaping](https://zato.io/docs/ai/mcp/response-controls.html) did to this one response - one key per finding, with nothing written for stages that did nothing:

```json
{
    "method": "tools/call",
    "duration_ms": 2140.4,
    "request_size": 388,
    "pii_removed": 2,
    "tokens_before": 4680,
    "tokens_after": 1000,
    "was_truncated": true
}
```

This answers the report - the tool produced an estimated 4680 tokens, the gateway's size cap truncated the response to its 1000-token limit, and two pieces of PII were replaced on the way. Since untouched stages write nothing, what is listed is exactly what happened.

## The server log {#the-server-log}

The same CID finds every line the request produced in the server's log:

```bash
grep 9f0da4306ffd7e6a341bce60 ~/env/qs-1/server1/logs/server.log
```

Every line a service logs through `self.logger` includes the request's CID automatically, so the tool's own logging is already part of the trace with no code written for it - and anything downstream the service invoked logged under the same CID too.

## The LLM call {#the-llm-call}

The summarization tool called a model to do its work, and that call is an event of its own in the [LLM audit trail](https://zato.io/docs/ai/llm/connections.html#the-audit-trail) - the connection, the provider's endpoint, the outcome and how long the provider took, under the same CID. Comparing its duration with the MCP event's `duration_ms` splits the 2140 ms into the provider's share and the platform's share - whether the time was spent in the platform or in the model is answered by subtraction.

## Other entry points {#other-entry-points}

The trace also runs backwards. When the starting point is the agent's user, the response the agent received is the only artifact without the CID on it - which is why the timestamp, the gateway and the tool name are enough: the audit page narrows those three to the event, and the event has the CID.

## Failure behavior {#failure-behavior}

A request that fails authentication has the shortest trace - an `auth-failed` audit event and a rejection line in the server log, both with the CID. There are no other entries, because no other layer ran. A trace that stops early shows where the request stopped - the deepest layer with the CID is the layer that refused it.

## See also {#see-also}

- [MCP audit log](https://zato.io/docs/ai/mcp/audit-log.html) - The event schema the trace starts from
- [Response controls](https://zato.io/docs/ai/mcp/response-controls.html) - The shaping whose trace the audit event records