LiteLLM spend logs missing requests? Compare with daily counts

fleetdiff checks, day by day, whether every request in LiteLLM's daily totals also reached the spend log, so you know which days' usage and spend reports are short before you rely on them.

Check your LiteLLM database

1. Install. Linux or macOS; needs curl, gh, shasum and tar. The installer checks the release before unpacking it.

set -eu
curl -fsSLo install-fleetdiff.sh https://raw.githubusercontent.com/llm-measurement/fleetdiff/6089061c931fa19fac876e40b3809fdea4792ab8/scripts/install.sh
sh install-fleetdiff.sh v0.12.0 ./bin
./bin/fleetdiff --version

2. Run it with the connection file from the LiteLLM spend guide:

./bin/fleetdiff investigate --litellm-db --database-url-file ~/.config/litellm-db-url --daily --group-by key

For each UTC day of the last two weeks, you get the rows in the spend log, the requests in LiteLLM's daily totals, and how many are missing. The usual spend comparison follows.

Need database access?

The same read-only login as the LiteLLM spend guide, plus read access to four columns of the daily totals table:

GRANT SELECT (date, api_requests, successful_requests, failed_requests)
  ON TABLE public."LiteLLM_DailyUserSpend" TO fleetdiff_reader;

Already have both exports?

./bin/fleetdiff investigate --litellm-spend ./spend.csv --litellm-daily-spend ./daily.csv --group-by key

Export both with psql instead

Set BEFORE and AFTER to 16 days of RFC3339 UTC midnight bounds; the end is exclusive.

set -eu
umask 077
# Set BEFORE and AFTER to cover 16 days, both at UTC midnight.
# Use RFC3339 bounds, for example 2026-09-23T00:00:00Z to 2026-10-09T00:00:00Z.
# AFTER is exclusive.
mkdir ./coverage-helper
for file in export-coverage.sh export.sql daily-projection.sql; do
  curl -fsSLo "./coverage-helper/$file" \
    "https://raw.githubusercontent.com/llm-measurement/fleetdiff/v0.12.0/examples/litellm-spend/$file"
done
sh ./coverage-helper/export-coverage.sh ./litellm-coverage-export \
  "$BEFORE" \
  "$AFTER"

./bin/fleetdiff investigate \
  --litellm-spend ./litellm-coverage-export/spend.csv \
  --litellm-daily-spend ./litellm-coverage-export/daily.csv --group-by key

Security and access

fleetdiff reads one read-only snapshot. It never writes to your database, and it doesn't read prompts or responses.
Remote databases must use sslmode=verify-full. Only a local socket may skip TLS.
The connection URL comes from an owner-only file or the FLEETDIFF_LITELLM_DATABASE_URL environment variable, never from the command line.
Analysis happens on your machine. Nothing is sent anywhere else. Reports use aliases instead of raw keys.

Full details: security review.

Try the sample

Linux or macOS; needs curl, gh, shasum and tar. The installer checks the release before unpacking it.

set -eu
umask 077
mkdir fleetdiff-row-coverage
curl -fsSLo fleetdiff-v0.12.0.tar.gz \
  https://codeload.github.com/llm-measurement/fleetdiff/tar.gz/refs/tags/v0.12.0
tar -xzf fleetdiff-v0.12.0.tar.gz --strip-components=1 -C fleetdiff-row-coverage
cd fleetdiff-row-coverage
sh scripts/install.sh v0.12.0 ./release
./release/fleetdiff investigate \
  --litellm-spend examples/litellm-spend/coverage_runtime_spend.csv \
  --litellm-daily-spend examples/litellm-spend/coverage_runtime_daily.csv \
  --before-period 2026-10-07 --after-period 2026-10-08

What you'll see

8 exported rows versus 9 daily requests: 1 missing row.

Exact opening output from this synthetic sample; your counts will reflect your exports.

Spend-log row coverage (relative to LiteLLM daily request counts):
  2026-10-07 UTC: 8 exported rows; 9 daily requests (8 successful, 1 failed); 1 missing row.
  2026-10-08 UTC: 1 exported row; 1 daily request (1 successful, 0 failed); counts match.
Token and spend totals below use exported rows only.

The first day has one fewer spend row than daily requests; the next day matches.

Add --format json for per-day counts and status under row_coverage.days.

The sample reproduces a real response-ID collision through LiteLLM's own database writers.

The released spend CSV, daily CSV and verification record come from a synthetic workload through pinned LiteLLM v1.104.0's proxy and database writers.

What the numbers mean

All selected request rows count, including failed records and call types excluded from token analysis. Days follow request startTime in UTC. fleetdiff does not fill in missing tokens, spend or contributor totals.

A missing daily row is unknown, not zero; partial UTC days have no inferred missing-row count. Extra exported rows are a discrepancy to review, not a negative missing count.

A separate report describes spend-log row loss under sustained concurrency; this fixture does not validate detection of that reported under-load failure.

The daily totals are LiteLLM's second record of the same traffic, not an independent count. A request missing from both records can't be seen.
Export completed days only, so both records have finished writing.
Measurement notes