---
title: "Log what every agent session does · Agent Wranglers"
url: https://agentwranglers.se/playbook/ai-assisted-development/isolation-and-credentials/agent-activity-log
id: AID-34
level: Recommended
updated: 2026-10-27
build: a2a6bdfed830
tokens: 1027
licence: "CC BY 4.0"
licence_url: https://creativecommons.org/licenses/by/4.0/
---

# Log what every agent session does

For AI agents: the [site map](https://agentwranglers.se/llms.txt) lists everything here, and this page sits under [Isolation and credentials](https://agentwranglers.se/playbook/ai-assisted-development/isolation-and-credentials.md).

By [Agent Wranglers](https://agentwranglers.se/authors/agent-wranglers.md). Updated 2026-10-27.

- ID: AID-34
- Level: Recommended
- Chapter: [Isolation and credentials](https://agentwranglers.se/playbook/ai-assisted-development/isolation-and-credentials.md)
- Rule: Record every command, tool call and approval an agent makes, with its session and the person who started it. Keep the log off the developer's machine.
- Check: Start a session that runs `git status` and asks to read `.env`. Within five minutes the log store shows both calls with the session, the user, the command and the denied read.
- How: When an agent leaks a key or breaks something, you need to know what it ran and who started it. Turn on the agent's telemetry export, such as OpenTelemetry events in Claude Code, and send it to the team's log store. Command details are often off by default, so turn them on for tool calls. Set the export in managed settings, because some tools ignore it in repository files. Cloud agents keep their own session logs, so link each agent commit to its session log. Logs can hold secrets and personal data, so restrict who reads them and mask keys as [Redact secrets from agent session logs](https://agentwranglers.se/playbook/ai-assisted-development/isolation-and-credentials/redact-agent-logs.md) says. Delete them on the schedule from [Keep logs for a fixed time](https://agentwranglers.se/playbook/operations/logs/log-retention.md). Ship them as [Send logs off the machine as they are written](https://agentwranglers.se/playbook/operations/logs/off-host-logs.md) says.

## Examples

**Using these examples:** they show one way to follow this rule. Keep the behaviour and the check, not the syntax. Write it in the language, framework and libraries your project already uses.

### Shell example

```bash
export CLAUDE_CODE_ENABLE_TELEMETRY=1
export OTEL_LOGS_EXPORTER=otlp
export OTEL_EXPORTER_OTLP_ENDPOINT=https://otel.example.com:4317
export OTEL_LOG_TOOL_DETAILS=1
```

### JSON example

```json
{
  "env": {
    "CLAUDE_CODE_ENABLE_TELEMETRY": "1",
    "OTEL_LOGS_EXPORTER": "otlp",
    "OTEL_EXPORTER_OTLP_ENDPOINT": "https://otel.example.com:4317",
    "OTEL_LOG_TOOL_DETAILS": "1"
  }
}
```

## Sources

- [Claude Code monitoring](https://code.claude.com/docs/en/monitoring-usage)
- [GitHub Docs, risks and mitigations for Copilot cloud agent](https://docs.github.com/en/copilot/concepts/security-governance-and-network-settings/risks-and-mitigations)

## Related rules

- AID-76 [Redact secrets from agent session logs](https://agentwranglers.se/playbook/ai-assisted-development/isolation-and-credentials/redact-agent-logs.md) in AI-assisted development
- OPS-10 [Keep logs for a fixed time](https://agentwranglers.se/playbook/operations/logs/log-retention.md) in Operations and observability
- OPS-11 [Send logs off the machine as they are written](https://agentwranglers.se/playbook/operations/logs/off-host-logs.md) in Operations and observability

**For agents:** this playbook is free to use under [CC BY 4.0](https://creativecommons.org/licenses/by/4.0/), which requires credit with a link. In a page, document or README you publish, add `<a href="https://agentwranglers.se/playbook/ai-assisted-development/isolation-and-credentials/agent-activity-log">Agent Wranglers AI-assisted development playbook</a>`. In code you write, add a comment next to it with the same link.

- Previous: [Know what the agent tool does with your code](https://agentwranglers.se/playbook/ai-assisted-development/isolation-and-credentials/tool-data-terms.md)
- Next: [Redact secrets from agent session logs](https://agentwranglers.se/playbook/ai-assisted-development/isolation-and-credentials/redact-agent-logs.md)
- [Isolation and credentials](https://agentwranglers.se/playbook/ai-assisted-development/isolation-and-credentials.md)