Trace every run and change

Task logs show what a playbook, infrastructure tool or script reported during execution. Audit events describe actions within Semaphore, including authentication, access and configuration changes. Use both during an investigation: the task explains the execution result, while audit events help establish the surrounding sequence of actions. The event reference documents which actions are recorded.

A manually started task can have a human initiator, while documented History rows for scheduled or integration-triggered work do not have a human user. Do not attribute those runs to a person simply because they appear in the same history. Use the execution and integration context your process records to understand the origin. External services should retain their own event-to-task correlation when individual request attribution matters.

Task output shows what the automation process reported, but server or coordination problems may require Semaphore application logs. Server logs go to stdout and are collected through the service, container, or logging setup used by your deployment. Correlate the relevant time and operation with those diagnostics. Keep access and retention intentional so the team can investigate without assuming every application error will appear in the task's tool output.

Yes. Pro forwards audit events using Syslog over TLS or the Splunk HTTP Event Collector protocol. Compatible collectors include Splunk and receivers that support those protocols. Configure the destination and credentials, then verify receipt in your collection system. Audit-event forwarding is separate from collecting the raw command output of tasks.

Pro adds audit-log filters for time, user, project, event kind, result and IP address. Export saves the events matching the filters as CSV or JSON Lines. This is useful for sharing a bounded investigation with another team or retaining a review extract without copying individual rows from the interface.

Yes. Audit logging is off by default. Enable it in the server configuration, set an installation identifier and restart Semaphore. Recording begins after that restart; earlier actions are not backfilled. Administrators can then inspect events in the Audit log. Pro adds filtering, file export and SIEM forwarding to that recorded event stream.

Yes. Project task history brings executions from your configured automation applications into one list. Open an Ansible, Terraform, OpenTofu, Bash, Python or PowerShell task to inspect its recorded output and details. The output format comes from the tool itself; Ansible host summaries are a separate Pro capability.

The server configuration controls task retention. By default, tasks and their logs are retained; a configured maximum per template removes the oldest tasks together with their output when the limit is reached. Set retention for your investigation needs and export records separately when your own policy requires longer storage. Read the retention guide.

The audit-event reference includes sign-in attempts, access denials, account and API-token changes, project membership and template permissions, plus changes to supported automation resources. Events carry an actor and outcome, with request or project context where applicable. Check the documented event kinds when designing a security investigation instead of assuming every external infrastructure action is captured.