Workspace audit logs now include the EndShellEvent event type, which indicates that a workspace member closed an active dashboard shell or SSH session to a Render service. Audit logs already included StartShellEvent, which is logged when a shell session starts.
Audit log events also now include source_ip and user_agent properties in their metadata field whenever these values are available:
{
"source_ip": "192.0.2.0",
"user_agent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7)…",
}
Learn more about audit logs in the docs.
Fetched April 11, 2026