# Log the actual playbook contents?

**URL:** <https://forum.ansible.com/t/log-the-actual-playbook-contents/18127>\
**Category:** Ansible Project\
**Created:** [April 29, 2015, 3:56pm UTC](https://forum.ansible.com/t/log-the-actual-playbook-contents/18127 "2015-04-29T15:56:25Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![Mark\_Felder](https://avatars.discourse-cdn.com/v4/letter/m/41988e/32.png) [@Mark\_Felder](https://forum.ansible.com/u/Mark_Felder)\
**Post date:** [April 29, 2015, 3:56pm UTC](https://forum.ansible.com/t/log-the-actual-playbook-contents/18127/1 "2015-04-29T15:56:25Z")

</div>

Hello,

I'm working with ansible in some environments rather sensitive to  
security/auditing and we have some significant controls designed around  
playbooks working their way up to QA/Prod environments, but our test  
environment of course needs to have some looser controls while we work  
the kinks out of our playbooks.

I'm looking for a way to not only log the playbook run itself, but the  
entire contents of the playbook so if an event somehow occurs and  
something unsavory works its way into the dev environment we can see  
what the playbook contents were at the exact time of the playbook run.

I may also consider settling for good, readable command line output of  
exactly what was run; the playbook stdout is simply not sufficient.

Does anyone have any suggestions on how I could achieve this?

Thanks!

---

<div class="post-metadata">

**Author:** ![Martin2](https://avatars.discourse-cdn.com/v4/letter/m/9de053/32.png) [@Martin2](https://forum.ansible.com/u/Martin2)\
**Post date:** [April 29, 2015, 4:22pm UTC](https://forum.ansible.com/t/log-the-actual-playbook-contents/18127/2 "2015-04-29T16:22:56Z")

</div>

Hi,

how about doing something like this:

1. wrap the actual playbook run
2. run only thru wrapper!!
3. tag in version control

You might want to swap steps 2 and 3 depending on your requirements. Basically it resembles a rather basic CI environment where any build (regardless of outcome) triggers a tag in your preferred SCM.

regards,  
Martin

---

<div class="post-metadata">

**Author:** ![Mark\_Felder](https://avatars.discourse-cdn.com/v4/letter/m/41988e/32.png) [@Mark\_Felder](https://forum.ansible.com/u/Mark_Felder)\
**Post date:** [April 29, 2015, 4:38pm UTC](https://forum.ansible.com/t/log-the-actual-playbook-contents/18127/3 "2015-04-29T16:38:54Z")

</div>

It gets really hard to draw the line; at some point you have to say "we  
trust the person with access to run the playbook is not malicious"  
because if you require a wrapper (ours will be Tower) someone with ssh  
access could run without Tower to get around it... and if they can do  
that, why couldn't they disable the additional logging, modules, etc?  
There will always be someone with access to bypass these controls, so  
I'd like to not add too much complication to the design. I'm also a  
little concerned about the insane amount of noise introduced into the  
VCS with automatic commits like that, but it's something I've also been  
thinking about.

If I can show that the log indicates the run results and what the  
playbook looked like it will pacify those with concerns, so that's the  
current goal.

Thanks for the idea, though.

---

<div class="post-metadata">

**Author:** ![vaida.dan](https://avatars.discourse-cdn.com/v4/letter/v/5daacb/32.png) [@vaida.dan](https://forum.ansible.com/u/vaida.dan)\
**Post date:** [June 19, 2015, 10:26am UTC](https://forum.ansible.com/t/log-the-actual-playbook-contents/18127/4 "2015-06-19T10:26:42Z")

</div>

Hi Mark,

One of the talks that were at our first Ansible meetups here in Berlin was about this very topic more or less. The guys were using an Ansible callback plugin to save the playbook run output in Elasticsearch.  
I’m not sure if they managed to opensource their work yet but here’s another plugin doing that: [https://gist.github.com/metmajer/7da2f9599c2d75d80ee5](https://gist.github.com/metmajer/7da2f9599c2d75d80ee5)  
I wouldn’t go for a wrapper. Callback plugins are so much more elegant.

Cheers,  
Dan.

---

<div class="post-metadata">

**Author:** ![Mark\_Felder](https://avatars.discourse-cdn.com/v4/letter/m/41988e/32.png) [@Mark\_Felder](https://forum.ansible.com/u/Mark_Felder)\
**Post date:** [July 9, 2015, 6:21pm UTC](https://forum.ansible.com/t/log-the-actual-playbook-contents/18127/5 "2015-07-09T18:21:33Z")

</div>

I'm not sure this is the same thing. I'm trying to log things that  
Ansible does not currently expose at any logging level.

[https://github.com/ansible/ansible/pull/11004](https://github.com/ansible/ansible/pull/11004)