Captured task logs

What it is

Every task (discover_network, proxy_http, future kinds) builds a per-task log buffer during execution. Timestamped progress lines, error messages, scope-check refusals: all captured into an in-memory buffer (up to 64 KB) and shipped back inside the task result. The dashboard surfaces them inline.

What it produces

A result_logs TEXT column on agent_tasks. Sample for a discover_network run:

11:43:49.834Z agent v0.3.0 claimed task #27 kind=discover_network
11:43:49.834Z discover_network: 127.0.0.1/32 × 3 port(s), 1 IP(s), concurrency=256
11:43:49.834Z discover_network: scan complete: 1 host(s) with 1 open port(s)
11:43:49.849Z task #27 finished status=done

And for a proxy_http run:

12:02:14.611Z proxy_http: GET https://10.0.0.5:8443/admin (timeout=8s, follow=false)
12:02:14.842Z proxy_http: HTTP 401, 1602 bytes, 231ms
12:02:14.842Z task #43 finished status=done

What to use it for

• Debugging a misbehaving scan from the dashboard without SSH-ing to the agent host
• Auditing what the agent actually did during an exploit relay (matches the audit_log + the cinematic replay)
• Catching scope-check refusals on misconfigured targets

Why it matters

When an installed binary misbehaves on a customer’s host, the operator’s first instinct is to SSH in and tail -f /var/log/.... That’s a long round trip: credentials, jump host, log rotation, the actual log line is from 4 hours ago. Server-side log capture collapses that to one click in the dashboard.

Why it’s valuable

• No SSH required. The customer doesn’t have to grant Umbra jumpbox access to debug a task.
• Same buffer the operator sees. Lines are ALSO mirrored to stdout so journald / docker logs catch them, but the dashboard copy is the authoritative one.
• Bounded. 64 KB max means a runaway loop can’t fill the DB column.

How to use it

On any task row in the Agents page’s task table:

1. Status must be done / error (logs ship with result; queued/running tasks have nothing yet).
2. Click Logs. An inline pane expands with the captured buffer.
3. Click again to collapse.

Via REST API:

GET /api/agents/tasks/{id}/logs
→ {"task_id": 27, "kind": "discover_network",
   "status": "done", "logs": "..."}