# Ansible host level interceptors

**URL:** <https://forum.ansible.com/t/ansible-host-level-interceptors/24217>\
**Category:** Ansible Project\
**Created:** [April 13, 2017, 11:20am UTC](https://forum.ansible.com/t/ansible-host-level-interceptors/24217 "2017-04-13T11:20:36Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![ishan\_jain](https://avatars.discourse-cdn.com/v4/letter/i/dc4da7/32.png) [@ishan\_jain](https://forum.ansible.com/u/ishan_jain)\
**Post date:** [April 13, 2017, 11:20am UTC](https://forum.ansible.com/t/ansible-host-level-interceptors/24217/1 "2017-04-13T11:20:36Z")

</div>

Is there a way in Ansible to create a host level interceptor which does ‘something’ in case ansible-playbook command is invoked ?  
What i am trying to do here is to get informed periodically about ‘ansible-playbook’ command invocations anywhere on my host. There are a large number of users and playbooks on my host now and as any of them are capable of changing my target machines, i need to know/track all ansible-playbook triggers. Parsing the logs can get tedious. I was thinking maybe there is a way in Ansible to record all commands invoked in a file that i can then read and know only what playbooks are executed.

---

<div class="post-metadata">

**Author:** ![Benjamin\_Redling](https://avatars.discourse-cdn.com/v4/letter/b/47e85d/32.png) [@Benjamin\_Redling](https://forum.ansible.com/u/Benjamin_Redling)\
**Post date:** [April 13, 2017, 1:43pm UTC](https://forum.ansible.com/t/ansible-host-level-interceptors/24217/2 "2017-04-13T13:43:40Z")

</div>

Hi,

> Is there a way in Ansible to create a host level interceptor which does  
> 'something' in case ansible-playbook command is invoked ?  
> What i am trying to do here is to get informed periodically about  
> 'ansible-playbook' command invocations anywhere on my host. There are a  
> large number of users and playbooks on my host now and as any of them  
> are capable of changing my target machines,

Sorry but that approach sounds dubious.  
Solution: don't let everybody, anytime change your "target machines".  
(Welcome to the world of change management.)

> i need to know/track all  
> ansible-playbook triggers. Parsing the logs can get tedious. I was  
> thinking maybe there is a way in Ansible to record all commands invoked  
> in a file that i can then read and know only what playbooks are executed.

If you want audits and RBAC:  
primary choice, obviously, look at Ansible Tower -- if you have only 10  
hosts or less; or enough money.  
secondary choices, if your budget is restricted but you have enough time  
to fiddle yourself have a look at Openstack Ara and/or Rundeck and/or  
Jenkins

Regards,  
Benjamin

---

<div class="post-metadata">

**Author:** ![ishan\_jain](https://avatars.discourse-cdn.com/v4/letter/i/dc4da7/32.png) [@ishan\_jain](https://forum.ansible.com/u/ishan_jain)\
**Post date:** [April 18, 2017, 12:59pm UTC](https://forum.ansible.com/t/ansible-host-level-interceptors/24217/3 "2017-04-18T12:59:54Z")

</div>

Thanks for suggesting ARA. It looks interesting. I am now trying it.