# Ansible log user & group ownership

**URL:** <https://forum.ansible.com/t/ansible-log-user-group-ownership/44456>\
**Category:** Get Help\
**Tags:** rhel9\
**Created:** [September 10, 2025, 4:08pm UTC](https://forum.ansible.com/t/ansible-log-user-group-ownership/44456 "2025-09-10T16:08:00Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![mtwest](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/mtwest/32/9395_2.png) [@mtwest](https://forum.ansible.com/u/mtwest)\
**Post date:** [September 10, 2025, 4:08pm UTC](https://forum.ansible.com/t/ansible-log-user-group-ownership/44456/1 "2025-09-10T16:08:00Z")

</div>

I am trying to make the Ansible logs writable by more than one unix user, as we have multiple users who are running playbooks against our machines.

- `log_path=/var/log/ansible/` is set in the `ansible.cfg`
- With `chmod` and `chown` I can tweak ownership & permissions after the logs have been created
- But if anyone else tries to run a playbook, it fails & reports:
  - `ERROR: [Errno 13] Permission denied:`

If its not possible to make a single Ansible log file writable by multiple users, how would you recommend my group handle the logs?

- Each user gets their own logs dir?
- Only have a single account that runs playbooks?
- Remove logging from the config and specify location instead within a playbook?

For some context on my usage of Ansible, see my question on [generating logs for distinct target](https://forum.ansible.com/t/separate-ansible-logs-for-distinct-target-nodes/44406) machines.

---

<div class="post-metadata">

**Author:** ![felixfontein](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/felixfontein/32/7530_2.png) [@felixfontein](https://forum.ansible.com/u/felixfontein)\
**Post date:** [September 10, 2025, 4:27pm UTC](https://forum.ansible.com/t/ansible-log-user-group-ownership/44456/2 "2025-09-10T16:27:20Z")

</div>

Not really an answer, but do you know of [ARA (Ansible Records Ansible)](https://ara.recordsansible.org/)? That might be a better solution than writing logs to a file, especially one shared by different users.

---

<div class="post-metadata">

**Author:** ![mtwest](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/mtwest/32/9395_2.png) [@mtwest](https://forum.ansible.com/u/mtwest)\
**Post date:** [September 10, 2025, 4:35pm UTC](https://forum.ansible.com/t/ansible-log-user-group-ownership/44456/3 "2025-09-10T16:35:26Z")

</div>

An interesting extension but just a level or two of complexity I don’t have the bandwidth for. I already use file logs for a bunch of other services, so it made sense reuse existing tools.

So @felixfontein, you don’t know if

- one can specify ownership & permissions on log files apriori?
- or even if they are permissive, have multiple users write to the same file in series?

---

<div class="post-metadata">

**Author:** ![bcoca](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/bcoca/32/9269_2.png) [@bcoca](https://forum.ansible.com/u/bcoca)\
**Post date:** [September 10, 2025, 5:39pm UTC](https://forum.ansible.com/t/ansible-log-user-group-ownership/44456/4 "2025-09-10T17:39:42Z")

</div>

another option is to use a `syslog` based callback, the ansible.log file is written to directly by the Ansible process, so the ownership cannot change unless you run as root or some similar workaround