2026-06-17 07:26:46.259146 | Job console starting 2026-06-17 07:26:46.294458 | Updating git repos 2026-06-17 07:26:46.382673 | Cloning repos into workspace 2026-06-17 07:26:46.512406 | Restoring repo states 2026-06-17 07:26:46.531020 | Merging changes 2026-06-17 07:26:47.383158 | Checking out repos 2026-06-17 07:26:47.455928 | Preparing playbooks 2026-06-17 07:26:48.355283 | Running Ansible setup 2026-06-17 07:26:54.502399 | PRE-RUN START: [trusted : github.com/osism/zuul-config/playbooks/base/pre.yaml@main] 2026-06-17 07:26:55.429191 | 2026-06-17 07:26:55.429412 | PLAY [Base pre] 2026-06-17 07:26:55.474097 | 2026-06-17 07:26:55.474344 | TASK [Setup log path fact] 2026-06-17 07:26:55.508428 | debian-bookworm | ok 2026-06-17 07:26:55.537319 | 2026-06-17 07:26:55.537524 | TASK [set-zuul-log-path-fact : Set log path for a build] 2026-06-17 07:26:55.568640 | debian-bookworm | ok 2026-06-17 07:26:55.583266 | 2026-06-17 07:26:55.583431 | TASK [emit-job-header : Print job information] 2026-06-17 07:26:55.658883 | # Job Information 2026-06-17 07:26:55.659244 | Ansible Version: 2.16.14 2026-06-17 07:26:55.659299 | Job: ansible-collection-services-molecule-auditd 2026-06-17 07:26:55.659337 | Pipeline: check 2026-06-17 07:26:55.659361 | Executor: 521e9411259a 2026-06-17 07:26:55.659383 | Triggered by: https://github.com/osism/ansible-collection-services/pull/2090 2026-06-17 07:26:55.659407 | Event ID: bedd0e30-6a1d-11f1-8c3b-8e0342590aa4 2026-06-17 07:26:55.668271 | 2026-06-17 07:26:55.668429 | LOOP [emit-job-header : Print node information] 2026-06-17 07:26:55.804845 | debian-bookworm | ok: 2026-06-17 07:26:55.805258 | debian-bookworm | # Node Information 2026-06-17 07:26:55.805306 | debian-bookworm | Inventory Hostname: debian-bookworm 2026-06-17 07:26:55.805333 | debian-bookworm | Hostname: debian 2026-06-17 07:26:55.805356 | debian-bookworm | Username: zuul 2026-06-17 07:26:55.805378 | debian-bookworm | Distro: Debian 12.14 2026-06-17 07:26:55.805402 | debian-bookworm | Provider: regiocloud-a 2026-06-17 07:26:55.805423 | debian-bookworm | Region: 2026-06-17 07:26:55.805445 | debian-bookworm | Label: debian-bookworm 2026-06-17 07:26:55.805464 | debian-bookworm | Product Name: OpenStack Nova 2026-06-17 07:26:55.805484 | debian-bookworm | Interface IP: 2a13:1a81:8000:3124:f816:3eff:fe36:8ab8 2026-06-17 07:26:55.874404 | debian-bookworm | ok: 2026-06-17 07:26:55.874545 | debian-bookworm | # Node Information 2026-06-17 07:26:55.874576 | debian-bookworm | Inventory Hostname: ubuntu-noble 2026-06-17 07:26:55.874601 | debian-bookworm | Hostname: ubuntu 2026-06-17 07:26:55.874626 | debian-bookworm | Username: zuul 2026-06-17 07:26:55.874648 | debian-bookworm | Distro: Ubuntu 24.04 2026-06-17 07:26:55.874668 | debian-bookworm | Provider: regiocloud-a 2026-06-17 07:26:55.874687 | debian-bookworm | Region: 2026-06-17 07:26:55.874707 | debian-bookworm | Label: ubuntu-noble 2026-06-17 07:26:55.874726 | debian-bookworm | Product Name: OpenStack Nova 2026-06-17 07:26:55.874744 | debian-bookworm | Interface IP: 2a13:1a81:8000:3124:f816:3eff:fe56:e9c4 2026-06-17 07:26:55.892901 | 2026-06-17 07:26:55.893064 | TASK [log-inventory : Ensure Zuul Ansible directory exists] 2026-06-17 07:26:56.541492 | debian-bookworm -> localhost | changed 2026-06-17 07:26:56.567360 | 2026-06-17 07:26:56.567741 | TASK [log-inventory : Copy ansible inventory to logs dir] 2026-06-17 07:26:58.137060 | ubuntu-noble -> localhost | changed 2026-06-17 07:26:58.250340 | debian-bookworm -> localhost | ok 2026-06-17 07:26:58.276243 | 2026-06-17 07:26:58.276446 | TASK [add-build-sshkey : Check to see if ssh key was already created for this build] 2026-06-17 07:26:58.705151 | debian-bookworm -> localhost | ok 2026-06-17 07:26:58.712414 | 2026-06-17 07:26:58.712561 | TASK [add-build-sshkey : Create a new key in workspace based on build UUID] 2026-06-17 07:26:58.751688 | debian-bookworm | ok 2026-06-17 07:26:58.756263 | ubuntu-noble | ok 2026-06-17 07:26:58.777229 | debian-bookworm | included: /var/lib/zuul/builds/19c697b6ccd84cbe82711b4ab4f02a9d/trusted/project_1/github.com/osism/openinfra-zuul-jobs/roles/add-build-sshkey/tasks/create-key-and-replace.yaml 2026-06-17 07:26:58.777493 | ubuntu-noble | included: /var/lib/zuul/builds/19c697b6ccd84cbe82711b4ab4f02a9d/trusted/project_1/github.com/osism/openinfra-zuul-jobs/roles/add-build-sshkey/tasks/create-key-and-replace.yaml 2026-06-17 07:26:58.784864 | 2026-06-17 07:26:58.784982 | TASK [add-build-sshkey : Create Temp SSH key] 2026-06-17 07:27:00.774521 | debian-bookworm -> localhost | Generating public/private rsa key pair. 2026-06-17 07:27:00.774925 | debian-bookworm -> localhost | Your identification has been saved in /var/lib/zuul/builds/19c697b6ccd84cbe82711b4ab4f02a9d/work/19c697b6ccd84cbe82711b4ab4f02a9d_id_rsa 2026-06-17 07:27:00.774972 | debian-bookworm -> localhost | Your public key has been saved in /var/lib/zuul/builds/19c697b6ccd84cbe82711b4ab4f02a9d/work/19c697b6ccd84cbe82711b4ab4f02a9d_id_rsa.pub 2026-06-17 07:27:00.775000 | debian-bookworm -> localhost | The key fingerprint is: 2026-06-17 07:27:00.775028 | debian-bookworm -> localhost | SHA256:656dpwXIuCjCicKJZs9bd8w1MBzERZq1RfUKkPFzKe8 zuul-build-sshkey 2026-06-17 07:27:00.775054 | debian-bookworm -> localhost | The key's randomart image is: 2026-06-17 07:27:00.775083 | debian-bookworm -> localhost | +---[RSA 3072]----+ 2026-06-17 07:27:00.775107 | debian-bookworm -> localhost | | oo=*.o.. | 2026-06-17 07:27:00.775132 | debian-bookworm -> localhost | | ..*oo ..| 2026-06-17 07:27:00.775174 | debian-bookworm -> localhost | | * .= o .| 2026-06-17 07:27:00.775199 | debian-bookworm -> localhost | | o .o * . | 2026-06-17 07:27:00.775221 | debian-bookworm -> localhost | | . S .o o | 2026-06-17 07:27:00.775242 | debian-bookworm -> localhost | |= o . .o..... | 2026-06-17 07:27:00.775264 | debian-bookworm -> localhost | |=B. .....+ . E | 2026-06-17 07:27:00.775286 | debian-bookworm -> localhost | |+.o.. ...o o. | 2026-06-17 07:27:00.775307 | debian-bookworm -> localhost | | +. .+ +o | 2026-06-17 07:27:00.775329 | debian-bookworm -> localhost | +----[SHA256]-----+ 2026-06-17 07:27:00.775505 | debian-bookworm -> localhost | ok: Runtime: 0:00:01.403055 2026-06-17 07:27:00.787470 | 2026-06-17 07:27:00.787703 | TASK [add-build-sshkey : Remote setup ssh keys (linux)] 2026-06-17 07:27:00.862227 | debian-bookworm | ok 2026-06-17 07:27:00.870751 | ubuntu-noble | ok 2026-06-17 07:27:00.895686 | debian-bookworm | included: /var/lib/zuul/builds/19c697b6ccd84cbe82711b4ab4f02a9d/trusted/project_1/github.com/osism/openinfra-zuul-jobs/roles/add-build-sshkey/tasks/remote-linux.yaml 2026-06-17 07:27:00.895815 | ubuntu-noble | included: /var/lib/zuul/builds/19c697b6ccd84cbe82711b4ab4f02a9d/trusted/project_1/github.com/osism/openinfra-zuul-jobs/roles/add-build-sshkey/tasks/remote-linux.yaml 2026-06-17 07:27:00.913212 | 2026-06-17 07:27:00.913439 | TASK [add-build-sshkey : Remove previously added zuul-build-sshkey] 2026-06-17 07:27:00.972721 | ubuntu-noble | skipping: Conditional result was False 2026-06-17 07:27:00.973402 | debian-bookworm | skipping: Conditional result was False 2026-06-17 07:27:00.985896 | 2026-06-17 07:27:00.986041 | TASK [add-build-sshkey : Enable access via build key on all nodes] 2026-06-17 07:27:01.924115 | debian-bookworm | changed 2026-06-17 07:27:01.981377 | ubuntu-noble | changed 2026-06-17 07:27:01.988914 | 2026-06-17 07:27:01.989068 | TASK [add-build-sshkey : Make sure user has a .ssh] 2026-06-17 07:27:02.303402 | debian-bookworm | ok 2026-06-17 07:27:02.312347 | ubuntu-noble | ok 2026-06-17 07:27:02.318862 | 2026-06-17 07:27:02.318984 | TASK [add-build-sshkey : Install build private key as SSH key on all nodes] 2026-06-17 07:27:03.015825 | debian-bookworm | changed 2026-06-17 07:27:03.116500 | ubuntu-noble | changed 2026-06-17 07:27:03.125712 | 2026-06-17 07:27:03.125898 | TASK [add-build-sshkey : Install build public key as SSH key on all nodes] 2026-06-17 07:27:03.967230 | debian-bookworm | changed 2026-06-17 07:27:03.975080 | ubuntu-noble | changed 2026-06-17 07:27:03.983797 | 2026-06-17 07:27:03.983935 | TASK [add-build-sshkey : Remote setup ssh keys (windows)] 2026-06-17 07:27:04.007413 | debian-bookworm | skipping: Conditional result was False 2026-06-17 07:27:04.029372 | ubuntu-noble | skipping: Conditional result was False 2026-06-17 07:27:04.044422 | 2026-06-17 07:27:04.044592 | TASK [remove-zuul-sshkey : Remove master key from local agent] 2026-06-17 07:27:04.460899 | debian-bookworm -> localhost | changed 2026-06-17 07:27:04.485622 | 2026-06-17 07:27:04.485771 | TASK [add-build-sshkey : Add back temp key] 2026-06-17 07:27:04.869403 | debian-bookworm -> localhost | Identity added: /var/lib/zuul/builds/19c697b6ccd84cbe82711b4ab4f02a9d/work/19c697b6ccd84cbe82711b4ab4f02a9d_id_rsa (zuul-build-sshkey) 2026-06-17 07:27:04.869958 | debian-bookworm -> localhost | ok: Runtime: 0:00:00.028744 2026-06-17 07:27:04.881947 | 2026-06-17 07:27:04.882098 | TASK [add-build-sshkey : Verify we can still SSH to all nodes] 2026-06-17 07:27:05.264970 | debian-bookworm | ok 2026-06-17 07:27:05.290628 | ubuntu-noble | ok 2026-06-17 07:27:05.296197 | 2026-06-17 07:27:05.296331 | TASK [add-build-sshkey : Verify we can still SSH to all nodes (windows)] 2026-06-17 07:27:05.323103 | debian-bookworm | skipping: Conditional result was False 2026-06-17 07:27:05.344503 | ubuntu-noble | skipping: Conditional result was False 2026-06-17 07:27:05.368023 | 2026-06-17 07:27:05.368297 | TASK [start-zuul-console : Start zuul_console daemon.] 2026-06-17 07:27:05.841131 | debian-bookworm | ok 2026-06-17 07:27:05.851375 | ubuntu-noble | ok 2026-06-17 07:27:05.870433 | 2026-06-17 07:27:05.870576 | TASK [validate-host : Define zuul_info_dir fact] 2026-06-17 07:27:05.926442 | ubuntu-noble | ok 2026-06-17 07:27:05.934198 | debian-bookworm | ok 2026-06-17 07:27:05.939756 | 2026-06-17 07:27:05.939869 | TASK [validate-host : Ensure Zuul Ansible directory exists] 2026-06-17 07:27:06.244668 | debian-bookworm -> localhost | ok 2026-06-17 07:27:06.260078 | 2026-06-17 07:27:06.260290 | TASK [validate-host : Collect information about the host] 2026-06-17 07:27:07.500724 | debian-bookworm | ok 2026-06-17 07:27:07.527447 | ubuntu-noble | ok 2026-06-17 07:27:07.538696 | 2026-06-17 07:27:07.538853 | TASK [validate-host : Sanitize hostname] 2026-06-17 07:27:07.621710 | debian-bookworm | ok 2026-06-17 07:27:07.630163 | ubuntu-noble | ok 2026-06-17 07:27:07.636588 | 2026-06-17 07:27:07.636717 | TASK [validate-host : Write out all ansible variables/facts known for each host] 2026-06-17 07:27:08.254548 | debian-bookworm -> localhost | changed 2026-06-17 07:27:08.257618 | ubuntu-noble -> localhost | changed 2026-06-17 07:27:08.269695 | 2026-06-17 07:27:08.269860 | TASK [validate-host : Collect information about zuul worker] 2026-06-17 07:27:08.791872 | debian-bookworm | ok 2026-06-17 07:27:08.807080 | ubuntu-noble | ok 2026-06-17 07:27:08.812330 | 2026-06-17 07:27:08.812464 | TASK [validate-host : Write out all zuul information for each host] 2026-06-17 07:27:09.405782 | ubuntu-noble -> localhost | changed 2026-06-17 07:27:09.437837 | debian-bookworm -> localhost | changed 2026-06-17 07:27:09.458282 | 2026-06-17 07:27:09.458457 | TASK [prepare-workspace-log : Start zuul_console daemon.] 2026-06-17 07:27:09.746946 | debian-bookworm | ok 2026-06-17 07:27:09.802294 | ubuntu-noble | ok 2026-06-17 07:27:09.816653 | 2026-06-17 07:27:09.816817 | TASK [prepare-workspace-log : Synchronize src repos to workspace directory.] 2026-06-17 07:27:11.219421 | debian-bookworm | changed: 2026-06-17 07:27:11.219787 | debian-bookworm | cd+++++++++ src/ 2026-06-17 07:27:11.219825 | debian-bookworm | cd+++++++++ src/github.com/ 2026-06-17 07:27:11.219850 | debian-bookworm | cd+++++++++ src/github.com/osism/ 2026-06-17 07:27:11.219872 | debian-bookworm | cd+++++++++ src/github.com/osism/ansible-collection-services/ 2026-06-17 07:27:11.219893 | debian-bookworm | config] provisioner.env found in /home/zuul/src/github.com/osism/ansible-collection-services/molecule/delegated/molecule.yml, this can be defined in ansible.env 2026-06-17 07:28:57.172485 | debian-bookworm | WARNING Molecule scenarios should migrate to 'extensions/molecule' 2026-06-17 07:28:57.200638 | debian-bookworm | DEBUG [unknown > config] provisioner.env found in /home/zuul/src/github.com/osism/ansible-collection-services/molecule/delegated/molecule.yml, this can be defined in ansible.env 2026-06-17 07:28:57.850923 | ubuntu-noble | DEBUG [unknown > config] provisioner.env found in /home/zuul/src/github.com/osism/ansible-collection-services/molecule/delegated/molecule.yml, this can be defined in ansible.env 2026-06-17 07:28:57.851567 | ubuntu-noble | DEBUG [delegated > validate] Validating schema /home/zuul/src/github.com/osism/ansible-collection-services/molecule/delegated/molecule.yml. 2026-06-17 07:28:57.876237 | ubuntu-noble | DEBUG [default > validate] Validating schema /home/zuul/src/github.com/osism/ansible-collection-services/molecule/default/molecule.yml. 2026-06-17 07:28:57.882115 | ubuntu-noble | INFO [delegated > discovery] scenario test matrix: dependency 2026-06-17 07:28:57.882182 | ubuntu-noble | INFO [delegated > prerun] Performing prerun with role_name_check=0... 2026-06-17 07:28:57.767890 | debian-bookworm | DEBUG [unknown > config] provisioner.env found in /home/zuul/src/github.com/osism/ansible-collection-services/molecule/delegated/molecule.yml, this can be defined in ansible.env 2026-06-17 07:28:57.768533 | debian-bookworm | DEBUG [delegated > validate] Validating schema /home/zuul/src/github.com/osism/ansible-collection-services/molecule/delegated/molecule.yml. 2026-06-17 07:28:57.788437 | debian-bookworm | DEBUG [default > validate] Validating schema /home/zuul/src/github.com/osism/ansible-collection-services/molecule/default/molecule.yml. 2026-06-17 07:28:57.793912 | debian-bookworm | INFO [delegated > discovery] scenario test matrix: dependency 2026-06-17 07:28:57.794014 | debian-bookworm | INFO [delegated > prerun] Performing prerun with role_name_check=0... 2026-06-17 07:28:58.954241 | debian-bookworm | INFO [delegated > dependency] Executing 2026-06-17 07:28:58.954586 | debian-bookworm | WARNING [delegated > dependency] Missing roles requirements file: requirements.yml 2026-06-17 07:28:59.212488 | ubuntu-noble | INFO [delegated > dependency] Executing 2026-06-17 07:28:59.212990 | ubuntu-noble | WARNING [delegated > dependency] Missing roles requirements file: requirements.yml 2026-06-17 07:28:59.286285 | debian-bookworm | ansible-galaxy [core 2.18.17] 2026-06-17 07:28:59.286770 | debian-bookworm | config file = None 2026-06-17 07:28:59.287162 | debian-bookworm | configured module search path = ['/home/zuul/src/github.com/osism/ansible-collection-services/plugins/modules', '/home/zuul/.ansible/plugins/modules', '/usr/share/ansible/plugins/modules'] 2026-06-17 07:28:59.287590 | debian-bookworm | ansible python module location = /home/zuul/venv/lib/python3.11/site-packages/ansible 2026-06-17 07:28:59.287990 | debian-bookworm | ansible collection location = /home/zuul/.ansible/collections:/usr/share/ansible/collections:/home/zuul/venv/lib/python3.11/site-packages:/home/zuul/venv/lib/python3.11/dist-packages:/home/zuul/venv/lib/python3/dist-packages:/home/zuul/venv/local/lib/python3.11/dist-packages 2026-06-17 07:28:59.288384 | debian-bookworm | executable location = /home/zuul/venv/bin/ansible-galaxy 2026-06-17 07:28:59.288747 | debian-bookworm | python version = 3.11.2 (main, Apr 8 2026, 01:58:00) [GCC 12.2.0] (/home/zuul/venv/bin/python3) 2026-06-17 07:28:59.289101 | debian-bookworm | jinja version = 3.1.6 2026-06-17 07:28:59.289396 | debian-bookworm | libyaml = True 2026-06-17 07:28:59.289700 | debian-bookworm | No config file found; using defaults 2026-06-17 07:28:59.290161 | debian-bookworm | Reading requirement file at '/home/zuul/src/github.com/osism/ansible-collection-services/molecule/delegated/collections.yml' 2026-06-17 07:28:59.291173 | debian-bookworm | Loading collection osism.services from /home/zuul/.ansible/collections/ansible_collections/osism/services 2026-06-17 07:28:59.291576 | debian-bookworm | Found installed collection osism.services:999.0.0 at '/home/zuul/.ansible/collections/ansible_collections/osism/services' 2026-06-17 07:28:59.298945 | debian-bookworm | Loading collection community.aws from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/aws 2026-06-17 07:28:59.299334 | debian-bookworm | Found installed collection community.aws:9.3.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/aws' 2026-06-17 07:28:59.299782 | debian-bookworm | Loading collection cisco.ise from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/cisco/ise 2026-06-17 07:28:59.300164 | debian-bookworm | Found installed collection cisco.ise:2.10.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/cisco/ise' 2026-06-17 07:28:59.303535 | debian-bookworm | Loading collection fortinet.fortios from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/fortinet/fortios 2026-06-17 07:28:59.304096 | debian-bookworm | Found installed collection fortinet.fortios:2.4.2 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/fortinet/fortios' 2026-06-17 07:28:59.304442 | debian-bookworm | Loading collection ibm.qradar from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/ibm/qradar 2026-06-17 07:28:59.304885 | debian-bookworm | Found installed collection ibm.qradar:4.0.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/ibm/qradar' 2026-06-17 07:28:59.305193 | debian-bookworm | Loading collection community.hashi_vault from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/hashi_vault 2026-06-17 07:28:59.305477 | debian-bookworm | Found installed collection community.hashi_vault:6.2.1 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/hashi_vault' 2026-06-17 07:28:59.305891 | debian-bookworm | Loading collection ravendb.ravendb from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/ravendb/ravendb 2026-06-17 07:28:59.306176 | debian-bookworm | Found installed collection ravendb.ravendb:1.0.4 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/ravendb/ravendb' 2026-06-17 07:28:59.306450 | debian-bookworm | Loading collection community.postgresql from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/postgresql 2026-06-17 07:28:59.306871 | debian-bookworm | Found installed collection community.postgresql:3.14.2 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/postgresql' 2026-06-17 07:28:59.307155 | debian-bookworm | Loading collection kaytus.ksmanage from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/kaytus/ksmanage 2026-06-17 07:28:59.307433 | debian-bookworm | Found installed collection kaytus.ksmanage:2.0.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/kaytus/ksmanage' 2026-06-17 07:28:59.307832 | debian-bookworm | Loading collection arista.eos from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/arista/eos 2026-06-17 07:28:59.308149 | debian-bookworm | Found installed collection arista.eos:10.1.1 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/arista/eos' 2026-06-17 07:28:59.308535 | debian-bookworm | Loading collection containers.podman from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/containers/podman 2026-06-17 07:28:59.308843 | debian-bookworm | Found installed collection containers.podman:1.18.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/containers/podman' 2026-06-17 07:28:59.310116 | debian-bookworm | Loading collection theforeman.foreman from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/theforeman/foreman 2026-06-17 07:28:59.310453 | debian-bookworm | Found installed collection theforeman.foreman:4.2.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/theforeman/foreman' 2026-06-17 07:28:59.310979 | debian-bookworm | Loading collection ngine_io.cloudstack from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/ngine_io/cloudstack 2026-06-17 07:28:59.311305 | debian-bookworm | Found installed collection ngine_io.cloudstack:2.5.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/ngine_io/cloudstack' 2026-06-17 07:28:59.312274 | debian-bookworm | Loading collection ansible.netcommon from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/ansible/netcommon 2026-06-17 07:28:59.312608 | debian-bookworm | Found installed collection ansible.netcommon:7.2.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/ansible/netcommon' 2026-06-17 07:28:59.312957 | debian-bookworm | Loading collection community.okd from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/okd 2026-06-17 07:28:59.313287 | debian-bookworm | Found installed collection community.okd:4.0.2 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/okd' 2026-06-17 07:28:59.313614 | debian-bookworm | Loading collection cisco.asa from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/cisco/asa 2026-06-17 07:28:59.313880 | debian-bookworm | Found installed collection cisco.asa:6.1.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/cisco/asa' 2026-06-17 07:28:59.314213 | debian-bookworm | Loading collection telekom_mms.icinga_director from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/telekom_mms/icinga_director 2026-06-17 07:28:59.314541 | debian-bookworm | Found installed collection telekom_mms.icinga_director:2.4.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/telekom_mms/icinga_director' 2026-06-17 07:28:59.315247 | debian-bookworm | Loading collection google.cloud from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/google/cloud 2026-06-17 07:28:59.315523 | debian-bookworm | Found installed collection google.cloud:1.9.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/google/cloud' 2026-06-17 07:28:59.317828 | debian-bookworm | Loading collection awx.awx from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/awx/awx 2026-06-17 07:28:59.318093 | debian-bookworm | Found installed collection awx.awx:24.6.1 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/awx/awx' 2026-06-17 07:28:59.318853 | debian-bookworm | Loading collection dellemc.unity from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/dellemc/unity 2026-06-17 07:28:59.319428 | debian-bookworm | Found installed collection dellemc.unity:2.1.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/dellemc/unity' 2026-06-17 07:28:59.319765 | debian-bookworm | Loading collection cyberark.conjur from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/cyberark/conjur 2026-06-17 07:28:59.319985 | debian-bookworm | Found installed collection cyberark.conjur:1.3.8 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/cyberark/conjur' 2026-06-17 07:28:59.322476 | debian-bookworm | Loading collection vmware.vmware_rest from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/vmware/vmware_rest 2026-06-17 07:28:59.322974 | debian-bookworm | Found installed collection vmware.vmware_rest:4.9.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/vmware/vmware_rest' 2026-06-17 07:28:59.323286 | debian-bookworm | Loading collection ieisystem.inmanage from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/ieisystem/inmanage 2026-06-17 07:28:59.323576 | debian-bookworm | Found installed collection ieisystem.inmanage:3.0.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/ieisystem/inmanage' 2026-06-17 07:28:59.323989 | debian-bookworm | Loading collection microsoft.ad from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/microsoft/ad 2026-06-17 07:28:59.324319 | debian-bookworm | Found installed collection microsoft.ad:1.9.2 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/microsoft/ad' 2026-06-17 07:28:59.324604 | debian-bookworm | Loading collection infinidat.infinibox from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/infinidat/infinibox 2026-06-17 07:28:59.324942 | debian-bookworm | Found installed collection infinidat.infinibox:1.6.3 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/infinidat/infinibox' 2026-06-17 07:28:59.325330 | debian-bookworm | Loading collection community.docker from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/docker 2026-06-17 07:28:59.325624 | debian-bookworm | Found installed collection community.docker:4.8.2 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/docker' 2026-06-17 07:28:59.325974 | debian-bookworm | Loading collection kubevirt.core from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/kubevirt/core 2026-06-17 07:28:59.326260 | debian-bookworm | Found installed collection kubevirt.core:2.2.3 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/kubevirt/core' 2026-06-17 07:28:59.326647 | debian-bookworm | Loading collection netbox.netbox from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/netbox/netbox 2026-06-17 07:28:59.326948 | debian-bookworm | Found installed collection netbox.netbox:3.21.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/netbox/netbox' 2026-06-17 07:28:59.327224 | debian-bookworm | Loading collection ansible.posix from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/ansible/posix 2026-06-17 07:28:59.327521 | debian-bookworm | Found installed collection ansible.posix:1.6.2 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/ansible/posix' 2026-06-17 07:28:59.327915 | debian-bookworm | Loading collection community.windows from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/windows 2026-06-17 07:28:59.328272 | debian-bookworm | Found installed collection community.windows:2.4.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/windows' 2026-06-17 07:28:59.328551 | debian-bookworm | Loading collection kubernetes.core from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/kubernetes/core 2026-06-17 07:28:59.328896 | debian-bookworm | Found installed collection kubernetes.core:5.4.1 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/kubernetes/core' 2026-06-17 07:28:59.329323 | debian-bookworm | Loading collection community.library_inventory_filtering_v1 from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/library_inventory_filtering_v1 2026-06-17 07:28:59.329587 | debian-bookworm | Found installed collection community.library_inventory_filtering_v1:1.1.5 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/library_inventory_filtering_v1' 2026-06-17 07:28:59.329856 | debian-bookworm | Loading collection ovirt.ovirt from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/ovirt/ovirt 2026-06-17 07:28:59.330122 | debian-bookworm | Found installed collection ovirt.ovirt:3.2.1 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/ovirt/ovirt' 2026-06-17 07:28:59.330467 | debian-bookworm | Loading collection dellemc.powerflex from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/dellemc/powerflex 2026-06-17 07:28:59.330738 | debian-bookworm | Found installed collection dellemc.powerflex:2.6.1 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/dellemc/powerflex' 2026-06-17 07:28:59.330980 | debian-bookworm | Loading collection cloud.common from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/cloud/common 2026-06-17 07:28:59.331225 | debian-bookworm | Found installed collection cloud.common:4.2.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/cloud/common' 2026-06-17 07:28:59.331588 | debian-bookworm | Loading collection community.rabbitmq from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/rabbitmq 2026-06-17 07:28:59.332053 | debian-bookworm | Found installed collection community.rabbitmq:1.6.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/rabbitmq' 2026-06-17 07:28:59.332309 | debian-bookworm | Loading collection community.sops from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/sops 2026-06-17 07:28:59.332539 | debian-bookworm | Found installed collection community.sops:2.2.7 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/sops' 2026-06-17 07:28:59.332765 | debian-bookworm | Loading collection ansible.utils from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/ansible/utils 2026-06-17 07:28:59.333030 | debian-bookworm | Found installed collection ansible.utils:5.1.2 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/ansible/utils' 2026-06-17 07:28:59.333294 | debian-bookworm | Loading collection openstack.cloud from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/openstack/cloud 2026-06-17 07:28:59.333502 | debian-bookworm | Found installed collection openstack.cloud:2.5.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/openstack/cloud' 2026-06-17 07:28:59.333746 | debian-bookworm | Loading collection cisco.intersight from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/cisco/intersight 2026-06-17 07:28:59.333951 | debian-bookworm | Found installed collection cisco.intersight:2.7.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/cisco/intersight' 2026-06-17 07:28:59.334151 | debian-bookworm | Loading collection lowlydba.sqlserver from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/lowlydba/sqlserver 2026-06-17 07:28:59.334441 | debian-bookworm | Found installed collection lowlydba.sqlserver:2.7.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/lowlydba/sqlserver' 2026-06-17 07:28:59.334650 | debian-bookworm | Loading collection vultr.cloud from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/vultr/cloud 2026-06-17 07:28:59.334872 | debian-bookworm | Found installed collection vultr.cloud:1.13.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/vultr/cloud' 2026-06-17 07:28:59.335150 | debian-bookworm | Loading collection cisco.iosxr from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/cisco/iosxr 2026-06-17 07:28:59.335357 | debian-bookworm | Found installed collection cisco.iosxr:10.3.1 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/cisco/iosxr' 2026-06-17 07:28:59.335632 | debian-bookworm | Loading collection f5networks.f5_modules from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/f5networks/f5_modules 2026-06-17 07:28:59.335918 | debian-bookworm | Found installed collection f5networks.f5_modules:1.39.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/f5networks/f5_modules' 2026-06-17 07:28:59.336434 | debian-bookworm | Loading collection dellemc.enterprise_sonic from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/dellemc/enterprise_sonic 2026-06-17 07:28:59.336732 | debian-bookworm | Found installed collection dellemc.enterprise_sonic:2.5.1 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/dellemc/enterprise_sonic' 2026-06-17 07:28:59.338240 | debian-bookworm | Loading collection cisco.aci from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/cisco/aci 2026-06-17 07:28:59.338508 | debian-bookworm | Found installed collection cisco.aci:2.12.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/cisco/aci' 2026-06-17 07:28:59.338796 | debian-bookworm | Loading collection community.zabbix from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/zabbix 2026-06-17 07:28:59.339070 | debian-bookworm | Found installed collection community.zabbix:3.3.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/zabbix' 2026-06-17 07:28:59.339336 | debian-bookworm | Loading collection cisco.ucs from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/cisco/ucs 2026-06-17 07:28:59.339603 | debian-bookworm | Found installed collection cisco.ucs:1.16.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/cisco/ucs' 2026-06-17 07:28:59.340486 | debian-bookworm | Loading collection junipernetworks.junos from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/junipernetworks/junos 2026-06-17 07:28:59.340782 | debian-bookworm | Found installed collection junipernetworks.junos:9.1.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/junipernetworks/junos' 2026-06-17 07:28:59.341384 | debian-bookworm | Loading collection splunk.es from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/splunk/es 2026-06-17 07:28:59.341697 | debian-bookworm | Found installed collection splunk.es:4.0.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/splunk/es' 2026-06-17 07:28:59.342424 | debian-bookworm | Loading collection vyos.vyos from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/vyos/vyos 2026-06-17 07:28:59.342712 | debian-bookworm | Found installed collection vyos.vyos:5.0.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/vyos/vyos' 2026-06-17 07:28:59.342982 | debian-bookworm | Loading collection cyberark.pas from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/cyberark/pas 2026-06-17 07:28:59.343262 | debian-bookworm | Found installed collection cyberark.pas:1.0.36 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/cyberark/pas' 2026-06-17 07:28:59.343525 | debian-bookworm | Loading collection chocolatey.chocolatey from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/chocolatey/chocolatey 2026-06-17 07:28:59.343742 | debian-bookworm | Found installed collection chocolatey.chocolatey:1.5.3 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/chocolatey/chocolatey' 2026-06-17 07:28:59.344016 | debian-bookworm | Loading collection purestorage.flasharray from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/purestorage/flasharray 2026-06-17 07:28:59.344338 | debian-bookworm | Found installed collection purestorage.flasharray:1.39.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/purestorage/flasharray' 2026-06-17 07:28:59.344541 | debian-bookworm | Loading collection sensu.sensu_go from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/sensu/sensu_go 2026-06-17 07:28:59.344838 | debian-bookworm | Found installed collection sensu.sensu_go:1.14.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/sensu/sensu_go' 2026-06-17 07:28:59.345047 | debian-bookworm | Loading collection microsoft.iis from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/microsoft/iis 2026-06-17 07:28:59.345320 | debian-bookworm | Found installed collection microsoft.iis:1.0.3 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/microsoft/iis' 2026-06-17 07:28:59.345521 | debian-bookworm | Loading collection inspur.ispim from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/inspur/ispim 2026-06-17 07:28:59.345837 | debian-bookworm | Found installed collection inspur.ispim:2.2.3 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/inspur/ispim' 2026-06-17 07:28:59.346253 | debian-bookworm | Loading collection cloudscale_ch.cloud from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/cloudscale_ch/cloud 2026-06-17 07:28:59.346478 | debian-bookworm | Found installed collection cloudscale_ch.cloud:2.5.2 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/cloudscale_ch/cloud' 2026-06-17 07:28:59.346978 | debian-bookworm | Loading collection hitachivantara.vspone_block from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/hitachivantara/vspone_block 2026-06-17 07:28:59.347209 | debian-bookworm | Found installed collection hitachivantara.vspone_block:3.5.1 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/hitachivantara/vspone_block' 2026-06-17 07:28:59.347638 | debian-bookworm | Loading collection check_point.mgmt from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/check_point/mgmt 2026-06-17 07:28:59.347867 | debian-bookworm | Found installed collection check_point.mgmt:6.6.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/check_point/mgmt' 2026-06-17 07:28:59.348912 | debian-bookworm | Loading collection community.digitalocean from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/digitalocean 2026-06-17 07:28:59.349170 | debian-bookworm | Found installed collection community.digitalocean:1.27.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/digitalocean' 2026-06-17 07:28:59.349574 | debian-bookworm | Loading collection netapp.storagegrid from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/netapp/storagegrid 2026-06-17 07:28:59.349806 | debian-bookworm | Found installed collection netapp.storagegrid:21.14.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/netapp/storagegrid' 2026-06-17 07:28:59.351605 | debian-bookworm | Loading collection azure.azcollection from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/azure/azcollection 2026-06-17 07:28:59.351934 | debian-bookworm | Found installed collection azure.azcollection:3.10.1 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/azure/azcollection' 2026-06-17 07:28:59.352264 | debian-bookworm | Loading collection community.dns from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/dns 2026-06-17 07:28:59.352482 | debian-bookworm | Found installed collection community.dns:3.4.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/dns' 2026-06-17 07:28:59.352730 | debian-bookworm | Loading collection community.proxysql from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/proxysql 2026-06-17 07:28:59.352988 | debian-bookworm | Found installed collection community.proxysql:1.7.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/proxysql' 2026-06-17 07:28:59.353236 | debian-bookworm | Loading collection netapp_eseries.santricity from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/netapp_eseries/santricity 2026-06-17 07:28:59.353452 | debian-bookworm | Found installed collection netapp_eseries.santricity:1.4.1 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/netapp_eseries/santricity' 2026-06-17 07:28:59.353760 | debian-bookworm | Loading collection infoblox.nios_modules from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/infoblox/nios_modules 2026-06-17 07:28:59.353974 | debian-bookworm | Found installed collection infoblox.nios_modules:1.8.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/infoblox/nios_modules' 2026-06-17 07:28:59.354743 | debian-bookworm | Loading collection cisco.ios from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/cisco/ios 2026-06-17 07:28:59.355323 | debian-bookworm | Found installed collection cisco.ios:9.2.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/cisco/ios' 2026-06-17 07:28:59.355728 | debian-bookworm | Loading collection vmware.vmware from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/vmware/vmware 2026-06-17 07:28:59.356029 | debian-bookworm | Found installed collection vmware.vmware:1.11.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/vmware/vmware' 2026-06-17 07:28:59.356405 | debian-bookworm | Loading collection dellemc.openmanage from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/dellemc/openmanage 2026-06-17 07:28:59.356821 | debian-bookworm | Found installed collection dellemc.openmanage:9.12.3 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/dellemc/openmanage' 2026-06-17 07:28:59.390714 | debian-bookworm | Loading collection community.network from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/network 2026-06-17 07:28:59.394147 | debian-bookworm | Found installed collection community.network:5.1.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/network' 2026-06-17 07:28:59.395987 | debian-bookworm | Loading collection community.mysql from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/mysql 2026-06-17 07:28:59.396000 | debian-bookworm | Found installed collection community.mysql:3.16.1 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/mysql' 2026-06-17 07:28:59.396005 | debian-bookworm | Loading collection community.libvirt from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/libvirt 2026-06-17 07:28:59.396014 | debian-bookworm | Found installed collection community.libvirt:1.4.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/libvirt' 2026-06-17 07:28:59.396019 | debian-bookworm | Loading collection amazon.aws from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/amazon/aws 2026-06-17 07:28:59.396121 | debian-bookworm | Found installed collection amazon.aws:9.5.2 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/amazon/aws' 2026-06-17 07:28:59.397266 | debian-bookworm | Loading collection community.vmware from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/vmware 2026-06-17 07:28:59.397550 | debian-bookworm | Found installed collection community.vmware:5.10.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/vmware' 2026-06-17 07:28:59.397822 | debian-bookworm | Loading collection ibm.storage_virtualize from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/ibm/storage_virtualize 2026-06-17 07:28:59.398070 | debian-bookworm | Found installed collection ibm.storage_virtualize:2.7.4 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/ibm/storage_virtualize' 2026-06-17 07:28:59.398418 | debian-bookworm | Loading collection cisco.meraki from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/cisco/meraki 2026-06-17 07:28:59.398683 | debian-bookworm | Found installed collection cisco.meraki:2.21.8 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/cisco/meraki' 2026-06-17 07:28:59.398928 | debian-bookworm | Loading collection cisco.dnac from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/cisco/dnac 2026-06-17 07:28:59.399179 | debian-bookworm | Found installed collection cisco.dnac:6.31.3 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/cisco/dnac' 2026-06-17 07:28:59.399425 | debian-bookworm | Loading collection community.ciscosmb from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/ciscosmb 2026-06-17 07:28:59.399692 | debian-bookworm | Found installed collection community.ciscosmb:1.0.11 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/ciscosmb' 2026-06-17 07:28:59.399938 | debian-bookworm | Loading collection purestorage.flashblade from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/purestorage/flashblade 2026-06-17 07:28:59.400239 | debian-bookworm | Found installed collection purestorage.flashblade:1.22.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/purestorage/flashblade' 2026-06-17 07:28:59.400595 | debian-bookworm | Loading collection hetzner.hcloud from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/hetzner/hcloud 2026-06-17 07:28:59.400888 | debian-bookworm | Found installed collection hetzner.hcloud:4.3.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/hetzner/hcloud' 2026-06-17 07:28:59.401134 | debian-bookworm | Loading collection grafana.grafana from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/grafana/grafana 2026-06-17 07:28:59.401352 | debian-bookworm | Found installed collection grafana.grafana:5.7.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/grafana/grafana' 2026-06-17 07:28:59.401554 | debian-bookworm | Loading collection ibm.spectrum_virtualize from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/ibm/spectrum_virtualize 2026-06-17 07:28:59.401831 | debian-bookworm | Found installed collection ibm.spectrum_virtualize:2.0.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/ibm/spectrum_virtualize' 2026-06-17 07:28:59.406292 | debian-bookworm | Loading collection fortinet.fortimanager from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/fortinet/fortimanager 2026-06-17 07:28:59.406537 | debian-bookworm | Found installed collection fortinet.fortimanager:2.11.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/fortinet/fortimanager' 2026-06-17 07:28:59.407047 | debian-bookworm | Loading collection community.crypto from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/crypto 2026-06-17 07:28:59.407288 | debian-bookworm | Found installed collection community.crypto:2.26.6 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/crypto' 2026-06-17 07:28:59.407627 | debian-bookworm | Loading collection ansible.windows from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/ansible/windows 2026-06-17 07:28:59.407892 | debian-bookworm | Found installed collection ansible.windows:2.8.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/ansible/windows' 2026-06-17 07:28:59.409754 | debian-bookworm | Loading collection cisco.nxos from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/cisco/nxos 2026-06-17 07:28:59.410004 | debian-bookworm | Found installed collection cisco.nxos:9.4.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/cisco/nxos' 2026-06-17 07:28:59.411041 | debian-bookworm | Loading collection netapp.ontap from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/netapp/ontap 2026-06-17 07:28:59.411510 | debian-bookworm | Found installed collection netapp.ontap:22.14.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/netapp/ontap' 2026-06-17 07:28:59.411922 | debian-bookworm | Loading collection wti.remote from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/wti/remote 2026-06-17 07:28:59.412270 | debian-bookworm | Found installed collection wti.remote:1.0.10 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/wti/remote' 2026-06-17 07:28:59.412682 | debian-bookworm | Loading collection community.sap_libs from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/sap_libs 2026-06-17 07:28:59.412974 | debian-bookworm | Found installed collection community.sap_libs:1.5.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/sap_libs' 2026-06-17 07:28:59.413361 | debian-bookworm | Loading collection community.proxmox from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/proxmox 2026-06-17 07:28:59.413702 | debian-bookworm | Found installed collection community.proxmox:1.4.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/proxmox' 2026-06-17 07:28:59.414004 | debian-bookworm | Loading collection netapp.cloudmanager from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/netapp/cloudmanager 2026-06-17 07:28:59.414309 | debian-bookworm | Found installed collection netapp.cloudmanager:21.24.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/netapp/cloudmanager' 2026-06-17 07:28:59.422673 | debian-bookworm | Loading collection community.general from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/general 2026-06-17 07:28:59.422914 | debian-bookworm | Found installed collection community.general:10.7.6 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/general' 2026-06-17 07:28:59.423096 | debian-bookworm | Loading collection community.routeros from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/routeros 2026-06-17 07:28:59.423344 | debian-bookworm | Found installed collection community.routeros:3.13.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/routeros' 2026-06-17 07:28:59.423579 | debian-bookworm | Loading collection community.mongodb from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/mongodb 2026-06-17 07:28:59.423789 | debian-bookworm | Found installed collection community.mongodb:1.7.10 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/mongodb' 2026-06-17 07:28:59.423959 | debian-bookworm | Loading collection hitachivantara.vspone_object from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/hitachivantara/vspone_object 2026-06-17 07:28:59.424177 | debian-bookworm | Found installed collection hitachivantara.vspone_object:1.0.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/hitachivantara/vspone_object' 2026-06-17 07:28:59.425030 | debian-bookworm | Loading collection cisco.mso from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/cisco/mso 2026-06-17 07:28:59.425260 | debian-bookworm | Found installed collection cisco.mso:2.11.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/cisco/mso' 2026-06-17 07:28:59.425596 | debian-bookworm | Loading collection community.grafana from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/grafana 2026-06-17 07:28:59.425925 | debian-bookworm | Found installed collection community.grafana:2.3.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/grafana' 2026-06-17 07:28:59.426186 | debian-bookworm | Loading collection community.hrobot from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/hrobot 2026-06-17 07:28:59.426431 | debian-bookworm | Found installed collection community.hrobot:2.7.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/hrobot' 2026-06-17 07:28:59.429988 | debian-bookworm | Initial connection to galaxy_server: https://galaxy.ansible.com 2026-06-17 07:28:59.430235 | debian-bookworm | Created /home/zuul/.ansible/galaxy_token 2026-06-17 07:28:59.430417 | debian-bookworm | Calling Galaxy at https://galaxy.ansible.com/api/ 2026-06-17 07:28:59.600097 | ubuntu-noble | ansible-galaxy [core 2.18.17] 2026-06-17 07:28:59.601623 | ubuntu-noble | config file = None 2026-06-17 07:28:59.601664 | ubuntu-noble | configured module search path = ['/home/zuul/src/github.com/osism/ansible-collection-services/plugins/modules', '/home/zuul/.ansible/plugins/modules', '/usr/share/ansible/plugins/modules'] 2026-06-17 07:28:59.601671 | ubuntu-noble | ansible python module location = /home/zuul/venv/lib/python3.12/site-packages/ansible 2026-06-17 07:28:59.601682 | ubuntu-noble | ansible collection location = /home/zuul/.ansible/collections:/usr/share/ansible/collections:/home/zuul/venv/lib/python3.12/site-packages:/home/zuul/venv/lib/python3.12/dist-packages:/home/zuul/venv/lib/python3/dist-packages:/home/zuul/venv/local/lib/python3.12/dist-packages 2026-06-17 07:28:59.601690 | ubuntu-noble | executable location = /home/zuul/venv/bin/ansible-galaxy 2026-06-17 07:28:59.601695 | ubuntu-noble | python version = 3.12.3 (main, Mar 23 2026, 19:04:32) [GCC 13.3.0] (/home/zuul/venv/bin/python3) 2026-06-17 07:28:59.601699 | ubuntu-noble | jinja version = 3.1.6 2026-06-17 07:28:59.601703 | ubuntu-noble | libyaml = True 2026-06-17 07:28:59.601706 | ubuntu-noble | No config file found; using defaults 2026-06-17 07:28:59.601711 | ubuntu-noble | Reading requirement file at '/home/zuul/src/github.com/osism/ansible-collection-services/molecule/delegated/collections.yml' 2026-06-17 07:28:59.613555 | ubuntu-noble | Loading collection dellemc.enterprise_sonic from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/dellemc/enterprise_sonic 2026-06-17 07:28:59.613606 | ubuntu-noble | Found installed collection dellemc.enterprise_sonic:2.5.1 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/dellemc/enterprise_sonic' 2026-06-17 07:28:59.613615 | ubuntu-noble | Loading collection lowlydba.sqlserver from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/lowlydba/sqlserver 2026-06-17 07:28:59.614327 | ubuntu-noble | Found installed collection lowlydba.sqlserver:2.7.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/lowlydba/sqlserver' 2026-06-17 07:28:59.614847 | ubuntu-noble | Loading collection community.dns from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/dns 2026-06-17 07:28:59.615132 | ubuntu-noble | Found installed collection community.dns:3.4.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/dns' 2026-06-17 07:28:59.615985 | ubuntu-noble | Loading collection community.hashi_vault from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/hashi_vault 2026-06-17 07:28:59.616014 | ubuntu-noble | Found installed collection community.hashi_vault:6.2.1 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/hashi_vault' 2026-06-17 07:28:59.616022 | ubuntu-noble | Loading collection community.library_inventory_filtering_v1 from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/library_inventory_filtering_v1 2026-06-17 07:28:59.616286 | ubuntu-noble | Found installed collection community.library_inventory_filtering_v1:1.1.5 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/library_inventory_filtering_v1' 2026-06-17 07:28:59.617812 | ubuntu-noble | Loading collection amazon.aws from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/amazon/aws 2026-06-17 07:28:59.618083 | ubuntu-noble | Found installed collection amazon.aws:9.5.2 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/amazon/aws' 2026-06-17 07:28:59.618496 | ubuntu-noble | Loading collection cisco.asa from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/cisco/asa 2026-06-17 07:28:59.618790 | ubuntu-noble | Found installed collection cisco.asa:6.1.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/cisco/asa' 2026-06-17 07:28:59.619738 | ubuntu-noble | Loading collection netbox.netbox from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/netbox/netbox 2026-06-17 07:28:59.620025 | ubuntu-noble | Found installed collection netbox.netbox:3.21.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/netbox/netbox' 2026-06-17 07:28:59.620314 | ubuntu-noble | Loading collection microsoft.ad from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/microsoft/ad 2026-06-17 07:28:59.620607 | ubuntu-noble | Found installed collection microsoft.ad:1.9.2 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/microsoft/ad' 2026-06-17 07:28:59.626978 | ubuntu-noble | Loading collection fortinet.fortimanager from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/fortinet/fortimanager 2026-06-17 07:28:59.627295 | ubuntu-noble | Found installed collection fortinet.fortimanager:2.11.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/fortinet/fortimanager' 2026-06-17 07:28:59.627772 | ubuntu-noble | Loading collection check_point.mgmt from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/check_point/mgmt 2026-06-17 07:28:59.628043 | ubuntu-noble | Found installed collection check_point.mgmt:6.6.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/check_point/mgmt' 2026-06-17 07:28:59.628908 | ubuntu-noble | Loading collection hitachivantara.vspone_block from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/hitachivantara/vspone_block 2026-06-17 07:28:59.628943 | ubuntu-noble | Found installed collection hitachivantara.vspone_block:3.5.1 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/hitachivantara/vspone_block' 2026-06-17 07:28:59.629191 | ubuntu-noble | Loading collection purestorage.flashblade from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/purestorage/flashblade 2026-06-17 07:28:59.629540 | ubuntu-noble | Found installed collection purestorage.flashblade:1.22.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/purestorage/flashblade' 2026-06-17 07:28:59.629938 | ubuntu-noble | Loading collection telekom_mms.icinga_director from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/telekom_mms/icinga_director 2026-06-17 07:28:59.630195 | ubuntu-noble | Found installed collection telekom_mms.icinga_director:2.4.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/telekom_mms/icinga_director' 2026-06-17 07:28:59.651710 | ubuntu-noble | Loading collection cisco.meraki from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/cisco/meraki 2026-06-17 07:28:59.652270 | ubuntu-noble | Found installed collection cisco.meraki:2.21.8 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/cisco/meraki' 2026-06-17 07:28:59.652286 | ubuntu-noble | Loading collection sensu.sensu_go from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/sensu/sensu_go 2026-06-17 07:28:59.654595 | ubuntu-noble | Found installed collection sensu.sensu_go:1.14.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/sensu/sensu_go' 2026-06-17 07:28:59.654667 | ubuntu-noble | Loading collection hetzner.hcloud from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/hetzner/hcloud 2026-06-17 07:28:59.654682 | ubuntu-noble | Found installed collection hetzner.hcloud:4.3.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/hetzner/hcloud' 2026-06-17 07:28:59.655258 | ubuntu-noble | Loading collection dellemc.powerflex from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/dellemc/powerflex 2026-06-17 07:28:59.655740 | ubuntu-noble | Found installed collection dellemc.powerflex:2.6.1 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/dellemc/powerflex' 2026-06-17 07:28:59.656247 | ubuntu-noble | Loading collection cyberark.conjur from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/cyberark/conjur 2026-06-17 07:28:59.657092 | ubuntu-noble | Found installed collection cyberark.conjur:1.3.8 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/cyberark/conjur' 2026-06-17 07:28:59.657738 | ubuntu-noble | Loading collection vyos.vyos from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/vyos/vyos 2026-06-17 07:28:59.658132 | ubuntu-noble | Found installed collection vyos.vyos:5.0.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/vyos/vyos' 2026-06-17 07:28:59.658677 | ubuntu-noble | Loading collection cloud.common from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/cloud/common 2026-06-17 07:28:59.659072 | ubuntu-noble | Found installed collection cloud.common:4.2.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/cloud/common' 2026-06-17 07:28:59.659501 | ubuntu-noble | Loading collection netapp.storagegrid from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/netapp/storagegrid 2026-06-17 07:28:59.659993 | ubuntu-noble | Found installed collection netapp.storagegrid:21.14.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/netapp/storagegrid' 2026-06-17 07:28:59.660359 | ubuntu-noble | Loading collection ieisystem.inmanage from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/ieisystem/inmanage 2026-06-17 07:28:59.660707 | ubuntu-noble | Found installed collection ieisystem.inmanage:3.0.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/ieisystem/inmanage' 2026-06-17 07:28:59.661050 | ubuntu-noble | Loading collection hitachivantara.vspone_object from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/hitachivantara/vspone_object 2026-06-17 07:28:59.661453 | ubuntu-noble | Found installed collection hitachivantara.vspone_object:1.0.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/hitachivantara/vspone_object' 2026-06-17 07:28:59.661849 | ubuntu-noble | Loading collection cisco.ucs from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/cisco/ucs 2026-06-17 07:28:59.662128 | ubuntu-noble | Found installed collection cisco.ucs:1.16.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/cisco/ucs' 2026-06-17 07:28:59.662474 | ubuntu-noble | Loading collection grafana.grafana from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/grafana/grafana 2026-06-17 07:28:59.662769 | ubuntu-noble | Found installed collection grafana.grafana:5.7.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/grafana/grafana' 2026-06-17 07:28:59.663045 | ubuntu-noble | Loading collection infinidat.infinibox from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/infinidat/infinibox 2026-06-17 07:28:59.663551 | ubuntu-noble | Found installed collection infinidat.infinibox:1.6.3 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/infinidat/infinibox' 2026-06-17 07:28:59.663717 | ubuntu-noble | Loading collection community.proxmox from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/proxmox 2026-06-17 07:28:59.663978 | ubuntu-noble | Found installed collection community.proxmox:1.4.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/proxmox' 2026-06-17 07:28:59.664282 | ubuntu-noble | Loading collection cisco.ios from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/cisco/ios 2026-06-17 07:28:59.665559 | ubuntu-noble | Found installed collection cisco.ios:9.2.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/cisco/ios' 2026-06-17 07:28:59.665586 | ubuntu-noble | Loading collection cisco.nxos from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/cisco/nxos 2026-06-17 07:28:59.665594 | ubuntu-noble | Found installed collection cisco.nxos:9.4.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/cisco/nxos' 2026-06-17 07:28:59.665600 | ubuntu-noble | Loading collection openstack.cloud from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/openstack/cloud 2026-06-17 07:28:59.665666 | ubuntu-noble | Found installed collection openstack.cloud:2.5.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/openstack/cloud' 2026-06-17 07:28:59.665893 | ubuntu-noble | Loading collection chocolatey.chocolatey from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/chocolatey/chocolatey 2026-06-17 07:28:59.666165 | ubuntu-noble | Found installed collection chocolatey.chocolatey:1.5.3 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/chocolatey/chocolatey' 2026-06-17 07:28:59.667635 | ubuntu-noble | Loading collection theforeman.foreman from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/theforeman/foreman 2026-06-17 07:28:59.667922 | ubuntu-noble | Found installed collection theforeman.foreman:4.2.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/theforeman/foreman' 2026-06-17 07:28:59.668191 | ubuntu-noble | Loading collection netapp_eseries.santricity from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/netapp_eseries/santricity 2026-06-17 07:28:59.668471 | ubuntu-noble | Found installed collection netapp_eseries.santricity:1.4.1 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/netapp_eseries/santricity' 2026-06-17 07:28:59.668746 | ubuntu-noble | Loading collection inspur.ispim from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/inspur/ispim 2026-06-17 07:28:59.669003 | ubuntu-noble | Found installed collection inspur.ispim:2.2.3 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/inspur/ispim' 2026-06-17 07:28:59.669274 | ubuntu-noble | Loading collection community.zabbix from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/zabbix 2026-06-17 07:28:59.669562 | ubuntu-noble | Found installed collection community.zabbix:3.3.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/zabbix' 2026-06-17 07:28:59.670166 | ubuntu-noble | Loading collection kubernetes.core from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/kubernetes/core 2026-06-17 07:28:59.670478 | ubuntu-noble | Found installed collection kubernetes.core:5.4.1 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/kubernetes/core' 2026-06-17 07:28:59.671426 | ubuntu-noble | Loading collection community.digitalocean from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/digitalocean 2026-06-17 07:28:59.671738 | ubuntu-noble | Found installed collection community.digitalocean:1.27.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/digitalocean' 2026-06-17 07:28:59.673092 | ubuntu-noble | Loading collection junipernetworks.junos from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/junipernetworks/junos 2026-06-17 07:28:59.673763 | ubuntu-noble | Found installed collection junipernetworks.junos:9.1.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/junipernetworks/junos' 2026-06-17 07:28:59.674205 | ubuntu-noble | Loading collection cisco.intersight from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/cisco/intersight 2026-06-17 07:28:59.674676 | ubuntu-noble | Found installed collection cisco.intersight:2.7.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/cisco/intersight' 2026-06-17 07:28:59.675203 | ubuntu-noble | Loading collection community.crypto from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/crypto 2026-06-17 07:28:59.675635 | ubuntu-noble | Found installed collection community.crypto:2.26.6 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/crypto' 2026-06-17 07:28:59.677563 | ubuntu-noble | Loading collection ravendb.ravendb from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/ravendb/ravendb 2026-06-17 07:28:59.677597 | ubuntu-noble | Found installed collection ravendb.ravendb:1.0.4 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/ravendb/ravendb' 2026-06-17 07:28:59.677611 | ubuntu-noble | Loading collection kaytus.ksmanage from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/kaytus/ksmanage 2026-06-17 07:28:59.677624 | ubuntu-noble | Found installed collection kaytus.ksmanage:2.0.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/kaytus/ksmanage' 2026-06-17 07:28:59.677668 | ubuntu-noble | Loading collection community.hrobot from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/hrobot 2026-06-17 07:28:59.677883 | ubuntu-noble | Found installed collection community.hrobot:2.7.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/hrobot' 2026-06-17 07:28:59.678319 | ubuntu-noble | Loading collection netapp.cloudmanager from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/netapp/cloudmanager 2026-06-17 07:28:59.678767 | ubuntu-noble | Found installed collection netapp.cloudmanager:21.24.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/netapp/cloudmanager' 2026-06-17 07:28:59.679170 | ubuntu-noble | Loading collection ansible.windows from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/ansible/windows 2026-06-17 07:28:59.679628 | ubuntu-noble | Found installed collection ansible.windows:2.8.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/ansible/windows' 2026-06-17 07:28:59.680132 | ubuntu-noble | Loading collection community.ciscosmb from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/ciscosmb 2026-06-17 07:28:59.680560 | ubuntu-noble | Found installed collection community.ciscosmb:1.0.11 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/ciscosmb' 2026-06-17 07:28:59.680941 | ubuntu-noble | Loading collection community.rabbitmq from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/rabbitmq 2026-06-17 07:28:59.681394 | ubuntu-noble | Found installed collection community.rabbitmq:1.6.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/rabbitmq' 2026-06-17 07:28:59.681827 | ubuntu-noble | Loading collection cyberark.pas from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/cyberark/pas 2026-06-17 07:28:59.682237 | ubuntu-noble | Found installed collection cyberark.pas:1.0.36 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/cyberark/pas' 2026-06-17 07:28:59.682664 | ubuntu-noble | Loading collection netapp.ontap from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/netapp/ontap 2026-06-17 07:28:59.682906 | ubuntu-noble | Found installed collection netapp.ontap:22.14.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/netapp/ontap' 2026-06-17 07:28:59.689635 | ubuntu-noble | Loading collection community.general from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/general 2026-06-17 07:28:59.690110 | ubuntu-noble | Found installed collection community.general:10.7.6 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/general' 2026-06-17 07:28:59.690497 | ubuntu-noble | Loading collection f5networks.f5_modules from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/f5networks/f5_modules 2026-06-17 07:28:59.690723 | ubuntu-noble | Found installed collection f5networks.f5_modules:1.39.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/f5networks/f5_modules' 2026-06-17 07:28:59.690966 | ubuntu-noble | Loading collection ansible.utils from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/ansible/utils 2026-06-17 07:28:59.691154 | ubuntu-noble | Found installed collection ansible.utils:5.1.2 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/ansible/utils' 2026-06-17 07:28:59.692891 | ubuntu-noble | Loading collection azure.azcollection from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/azure/azcollection 2026-06-17 07:28:59.693131 | ubuntu-noble | Found installed collection azure.azcollection:3.10.1 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/azure/azcollection' 2026-06-17 07:28:59.693828 | ubuntu-noble | Loading collection dellemc.unity from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/dellemc/unity 2026-06-17 07:28:59.694059 | ubuntu-noble | Found installed collection dellemc.unity:2.1.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/dellemc/unity' 2026-06-17 07:28:59.694310 | ubuntu-noble | Loading collection cisco.ise from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/cisco/ise 2026-06-17 07:28:59.694546 | ubuntu-noble | Found installed collection cisco.ise:2.10.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/cisco/ise' 2026-06-17 07:28:59.694785 | ubuntu-noble | Loading collection cisco.dnac from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/cisco/dnac 2026-06-17 07:28:59.695000 | ubuntu-noble | Found installed collection cisco.dnac:6.31.3 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/cisco/dnac' 2026-06-17 07:28:59.698831 | ubuntu-noble | Loading collection community.aws from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/aws 2026-06-17 07:28:59.699160 | ubuntu-noble | Found installed collection community.aws:9.3.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/aws' 2026-06-17 07:28:59.699443 | ubuntu-noble | Loading collection wti.remote from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/wti/remote 2026-06-17 07:28:59.700447 | ubuntu-noble | Found installed collection wti.remote:1.0.10 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/wti/remote' 2026-06-17 07:28:59.700484 | ubuntu-noble | Loading collection kubevirt.core from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/kubevirt/core 2026-06-17 07:28:59.700495 | ubuntu-noble | Found installed collection kubevirt.core:2.2.3 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/kubevirt/core' 2026-06-17 07:28:59.702050 | ubuntu-noble | Loading collection community.vmware from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/vmware 2026-06-17 07:28:59.702078 | ubuntu-noble | Found installed collection community.vmware:5.10.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/vmware' 2026-06-17 07:28:59.702084 | ubuntu-noble | Loading collection purestorage.flasharray from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/purestorage/flasharray 2026-06-17 07:28:59.702392 | ubuntu-noble | Found installed collection purestorage.flasharray:1.39.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/purestorage/flasharray' 2026-06-17 07:28:59.702887 | ubuntu-noble | Loading collection ansible.posix from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/ansible/posix 2026-06-17 07:28:59.702909 | ubuntu-noble | Found installed collection ansible.posix:1.6.2 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/ansible/posix' 2026-06-17 07:28:59.703800 | ubuntu-noble | Loading collection community.grafana from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/grafana 2026-06-17 07:28:59.703822 | ubuntu-noble | Found installed collection community.grafana:2.3.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/grafana' 2026-06-17 07:28:59.703827 | ubuntu-noble | Loading collection community.sops from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/sops 2026-06-17 07:28:59.703832 | ubuntu-noble | Found installed collection community.sops:2.2.7 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/sops' 2026-06-17 07:28:59.706598 | ubuntu-noble | Loading collection awx.awx from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/awx/awx 2026-06-17 07:28:59.706841 | ubuntu-noble | Found installed collection awx.awx:24.6.1 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/awx/awx' 2026-06-17 07:28:59.708114 | ubuntu-noble | Loading collection community.postgresql from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/postgresql 2026-06-17 07:28:59.708146 | ubuntu-noble | Found installed collection community.postgresql:3.14.2 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/postgresql' 2026-06-17 07:28:59.708156 | ubuntu-noble | Loading collection microsoft.iis from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/microsoft/iis 2026-06-17 07:28:59.708164 | ubuntu-noble | Found installed collection microsoft.iis:1.0.3 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/microsoft/iis' 2026-06-17 07:28:59.710566 | ubuntu-noble | Loading collection community.windows from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/windows 2026-06-17 07:28:59.710604 | ubuntu-noble | Found installed collection community.windows:2.4.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/windows' 2026-06-17 07:28:59.710615 | ubuntu-noble | Loading collection community.libvirt from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/libvirt 2026-06-17 07:28:59.710657 | ubuntu-noble | Found installed collection community.libvirt:1.4.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/libvirt' 2026-06-17 07:28:59.710667 | ubuntu-noble | Loading collection vmware.vmware from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/vmware/vmware 2026-06-17 07:28:59.710674 | ubuntu-noble | Found installed collection vmware.vmware:1.11.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/vmware/vmware' 2026-06-17 07:28:59.710681 | ubuntu-noble | Loading collection community.routeros from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/routeros 2026-06-17 07:28:59.710768 | ubuntu-noble | Found installed collection community.routeros:3.13.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/routeros' 2026-06-17 07:28:59.711120 | ubuntu-noble | Loading collection ibm.storage_virtualize from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/ibm/storage_virtualize 2026-06-17 07:28:59.711420 | ubuntu-noble | Found installed collection ibm.storage_virtualize:2.7.4 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/ibm/storage_virtualize' 2026-06-17 07:28:59.711774 | ubuntu-noble | Loading collection splunk.es from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/splunk/es 2026-06-17 07:28:59.712014 | ubuntu-noble | Found installed collection splunk.es:4.0.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/splunk/es' 2026-06-17 07:28:59.712251 | ubuntu-noble | Loading collection community.proxysql from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/proxysql 2026-06-17 07:28:59.712446 | ubuntu-noble | Found installed collection community.proxysql:1.7.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/proxysql' 2026-06-17 07:28:59.712716 | ubuntu-noble | Loading collection community.sap_libs from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/sap_libs 2026-06-17 07:28:59.712966 | ubuntu-noble | Found installed collection community.sap_libs:1.5.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/sap_libs' 2026-06-17 07:28:59.713312 | ubuntu-noble | Loading collection community.mysql from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/mysql 2026-06-17 07:28:59.713571 | ubuntu-noble | Found installed collection community.mysql:3.16.1 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/mysql' 2026-06-17 07:28:59.713904 | ubuntu-noble | Loading collection vultr.cloud from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/vultr/cloud 2026-06-17 07:28:59.714166 | ubuntu-noble | Found installed collection vultr.cloud:1.13.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/vultr/cloud' 2026-06-17 07:28:59.753261 | ubuntu-noble | Loading collection community.network from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/network 2026-06-17 07:28:59.753678 | ubuntu-noble | Found installed collection community.network:5.1.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/network' 2026-06-17 07:28:59.755272 | ubuntu-noble | Loading collection cisco.aci from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/cisco/aci 2026-06-17 07:28:59.755588 | ubuntu-noble | Found installed collection cisco.aci:2.12.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/cisco/aci' 2026-06-17 07:28:59.755913 | ubuntu-noble | Loading collection containers.podman from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/containers/podman 2026-06-17 07:28:59.756164 | ubuntu-noble | Found installed collection containers.podman:1.18.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/containers/podman' 2026-06-17 07:28:59.757697 | ubuntu-noble | Loading collection cisco.mso from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/cisco/mso 2026-06-17 07:28:59.757942 | ubuntu-noble | Found installed collection cisco.mso:2.11.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/cisco/mso' 2026-06-17 07:28:59.758617 | ubuntu-noble | Loading collection dellemc.openmanage from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/dellemc/openmanage 2026-06-17 07:28:59.758872 | ubuntu-noble | Found installed collection dellemc.openmanage:9.12.3 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/dellemc/openmanage' 2026-06-17 07:28:59.759313 | ubuntu-noble | Loading collection community.okd from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/okd 2026-06-17 07:28:59.759566 | ubuntu-noble | Found installed collection community.okd:4.0.2 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/okd' 2026-06-17 07:28:59.760245 | ubuntu-noble | Loading collection ngine_io.cloudstack from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/ngine_io/cloudstack 2026-06-17 07:28:59.760481 | ubuntu-noble | Found installed collection ngine_io.cloudstack:2.5.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/ngine_io/cloudstack' 2026-06-17 07:28:59.760998 | ubuntu-noble | Loading collection ibm.qradar from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/ibm/qradar 2026-06-17 07:28:59.761281 | ubuntu-noble | Found installed collection ibm.qradar:4.0.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/ibm/qradar' 2026-06-17 07:28:59.764828 | ubuntu-noble | Loading collection fortinet.fortios from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/fortinet/fortios 2026-06-17 07:28:59.765069 | ubuntu-noble | Found installed collection fortinet.fortios:2.4.2 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/fortinet/fortios' 2026-06-17 07:28:59.765927 | ubuntu-noble | Loading collection arista.eos from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/arista/eos 2026-06-17 07:28:59.766161 | ubuntu-noble | Found installed collection arista.eos:10.1.1 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/arista/eos' 2026-06-17 07:28:59.766947 | ubuntu-noble | Loading collection cloudscale_ch.cloud from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/cloudscale_ch/cloud 2026-06-17 07:28:59.767178 | ubuntu-noble | Found installed collection cloudscale_ch.cloud:2.5.2 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/cloudscale_ch/cloud' 2026-06-17 07:28:59.767664 | ubuntu-noble | Loading collection community.docker from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/docker 2026-06-17 07:28:59.767898 | ubuntu-noble | Found installed collection community.docker:4.8.2 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/docker' 2026-06-17 07:28:59.768155 | ubuntu-noble | Loading collection infoblox.nios_modules from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/infoblox/nios_modules 2026-06-17 07:28:59.768404 | ubuntu-noble | Found installed collection infoblox.nios_modules:1.8.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/infoblox/nios_modules' 2026-06-17 07:28:59.769566 | ubuntu-noble | Loading collection ansible.netcommon from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/ansible/netcommon 2026-06-17 07:28:59.769809 | ubuntu-noble | Found installed collection ansible.netcommon:7.2.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/ansible/netcommon' 2026-06-17 07:28:59.770045 | ubuntu-noble | Loading collection ibm.spectrum_virtualize from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/ibm/spectrum_virtualize 2026-06-17 07:28:59.770301 | ubuntu-noble | Found installed collection ibm.spectrum_virtualize:2.0.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/ibm/spectrum_virtualize' 2026-06-17 07:28:59.771262 | ubuntu-noble | Loading collection google.cloud from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/google/cloud 2026-06-17 07:28:59.771536 | ubuntu-noble | Found installed collection google.cloud:1.9.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/google/cloud' 2026-06-17 07:28:59.771876 | ubuntu-noble | Loading collection community.mongodb from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/mongodb 2026-06-17 07:28:59.772205 | ubuntu-noble | Found installed collection community.mongodb:1.7.10 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/mongodb' 2026-06-17 07:28:59.775125 | ubuntu-noble | Loading collection vmware.vmware_rest from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/vmware/vmware_rest 2026-06-17 07:28:59.775432 | ubuntu-noble | Found installed collection vmware.vmware_rest:4.9.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/vmware/vmware_rest' 2026-06-17 07:28:59.776123 | ubuntu-noble | Loading collection cisco.iosxr from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/cisco/iosxr 2026-06-17 07:28:59.776421 | ubuntu-noble | Found installed collection cisco.iosxr:10.3.1 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/cisco/iosxr' 2026-06-17 07:28:59.777180 | ubuntu-noble | Loading collection ovirt.ovirt from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/ovirt/ovirt 2026-06-17 07:28:59.777203 | ubuntu-noble | Found installed collection ovirt.ovirt:3.2.1 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/ovirt/ovirt' 2026-06-17 07:28:59.790337 | ubuntu-noble | Loading collection osism.services from /home/zuul/.ansible/collections/ansible_collections/osism/services 2026-06-17 07:28:59.790373 | ubuntu-noble | Found installed collection osism.services:999.0.0 at '/home/zuul/.ansible/collections/ansible_collections/osism/services' 2026-06-17 07:28:59.795589 | ubuntu-noble | Initial connection to galaxy_server: https://galaxy.ansible.com 2026-06-17 07:28:59.795650 | ubuntu-noble | Created /home/zuul/.ansible/galaxy_token 2026-06-17 07:28:59.796064 | ubuntu-noble | Calling Galaxy at https://galaxy.ansible.com/api/ 2026-06-17 07:28:59.627354 | debian-bookworm | Found API version 'v3, pulp-v3, v1' with Galaxy server default (https://galaxy.ansible.com/api/) 2026-06-17 07:28:59.627803 | debian-bookworm | Calling Galaxy at https://galaxy.ansible.com/api/v3/collections/osism/commons/ 2026-06-17 07:29:00.237110 | ubuntu-noble | Found API version 'v3, pulp-v3, v1' with Galaxy server default (https://galaxy.ansible.com/api/) 2026-06-17 07:29:00.238032 | ubuntu-noble | Calling Galaxy at https://galaxy.ansible.com/api/v3/collections/osism/commons/ 2026-06-17 07:29:00.225058 | debian-bookworm | Calling Galaxy at https://galaxy.ansible.com/api/v3/collections/osism/commons/versions/?limit=100 2026-06-17 07:29:00.814824 | ubuntu-noble | Calling Galaxy at https://galaxy.ansible.com/api/v3/collections/osism/commons/versions/?limit=100 2026-06-17 07:29:00.945681 | debian-bookworm | Calling Galaxy at https://galaxy.ansible.com/api/v3/collections/osism/commons/versions/0.20260601.0/ 2026-06-17 07:29:01.588734 | ubuntu-noble | Calling Galaxy at https://galaxy.ansible.com/api/v3/collections/osism/commons/versions/0.20260601.0/ 2026-06-17 07:29:01.885676 | debian-bookworm | Server https://galaxy.ansible.com/api/ has not signed osism.commons:0.20260601.0 2026-06-17 07:29:01.885894 | debian-bookworm | Fetching a collection tarball for 'osism.commons:0.20260601.0' from Ansible Galaxy 2026-06-17 07:29:02.611635 | ubuntu-noble | Server https://galaxy.ansible.com/api/ has not signed osism.commons:0.20260601.0 2026-06-17 07:29:02.612268 | ubuntu-noble | Fetching a collection tarball for 'osism.commons:0.20260601.0' from Ansible Galaxy 2026-06-17 07:29:03.234286 | debian-bookworm | Validating downloaded file hash 1d41d3b5d145afda8cce7ec8515d5495c0afe9a3787ce4d2ea101956f5f7e2b1 with expected hash 1d41d3b5d145afda8cce7ec8515d5495c0afe9a3787ce4d2ea101956f5f7e2b1 2026-06-17 07:29:03.234460 | debian-bookworm | Collection 'osism.commons:0.20260601.0' obtained from server default https://galaxy.ansible.com/api/ 2026-06-17 07:29:03.402763 | debian-bookworm | Starting galaxy collection install process 2026-06-17 07:29:03.403089 | debian-bookworm | Process install dependency map 2026-06-17 07:29:03.403388 | debian-bookworm | Starting collection install process 2026-06-17 07:29:03.403711 | debian-bookworm | 'ansible.posix:1.6.2' is already installed, skipping. 2026-06-17 07:29:03.404003 | debian-bookworm | 'community.docker:4.8.2' is already installed, skipping. 2026-06-17 07:29:03.404330 | debian-bookworm | 'community.general:10.7.6' is already installed, skipping. 2026-06-17 07:29:03.404643 | debian-bookworm | 'community.library_inventory_filtering_v1:1.1.5' is already installed, skipping. 2026-06-17 07:29:03.404942 | debian-bookworm | Downloading https://galaxy.ansible.com/api/v3/plugin/ansible/content/published/collections/artifacts/osism-commons-0.20260601.0.tar.gz to /home/zuul/.ansible/tmp/ansible-local-19500_r285iq/tmp_tmz_i7g/osism-commons-0.20260601.0-yowf3mgt 2026-06-17 07:29:03.405223 | debian-bookworm | Installing 'osism.commons:0.20260601.0' to '/home/zuul/.ansible/collections/ansible_collections/osism/commons' 2026-06-17 07:29:03.405495 | debian-bookworm | osism.commons:0.20260601.0 was installed successfully 2026-06-17 07:29:03.461127 | debian-bookworm | INFO [delegated > dependency] Dependency completed successfully. 2026-06-17 07:29:03.461218 | debian-bookworm | WARNING [delegated > dependency] Executed: Missing roles requirements file: requirements.yml (Remove from dependency_sequence to suppress) 2026-06-17 07:29:03.461525 | debian-bookworm | WARNING Molecule executed 1 scenario (1 missing files) 2026-06-17 07:29:03.590082 | debian-bookworm | ok: Runtime: 0:00:06.662077 2026-06-17 07:29:03.817724 | ubuntu-noble | Validating downloaded file hash 1d41d3b5d145afda8cce7ec8515d5495c0afe9a3787ce4d2ea101956f5f7e2b1 with expected hash 1d41d3b5d145afda8cce7ec8515d5495c0afe9a3787ce4d2ea101956f5f7e2b1 2026-06-17 07:29:03.820316 | ubuntu-noble | Collection 'osism.commons:0.20260601.0' obtained from server default https://galaxy.ansible.com/api/ 2026-06-17 07:29:04.017043 | ubuntu-noble | Starting galaxy collection install process 2026-06-17 07:29:04.017156 | ubuntu-noble | Process install dependency map 2026-06-17 07:29:04.017206 | ubuntu-noble | Starting collection install process 2026-06-17 07:29:04.017320 | ubuntu-noble | 'ansible.posix:1.6.2' is already installed, skipping. 2026-06-17 07:29:04.017431 | ubuntu-noble | 'community.docker:4.8.2' is already installed, skipping. 2026-06-17 07:29:04.017566 | ubuntu-noble | 'community.general:10.7.6' is already installed, skipping. 2026-06-17 07:29:04.018621 | ubuntu-noble | 'community.library_inventory_filtering_v1:1.1.5' is already installed, skipping. 2026-06-17 07:29:04.018653 | ubuntu-noble | Downloading https://galaxy.ansible.com/api/v3/plugin/ansible/content/published/collections/artifacts/osism-commons-0.20260601.0.tar.gz to /home/zuul/.ansible/tmp/ansible-local-1768yqaqib7x/tmpymdqhx0z/osism-commons-0.20260601.0-n_p68w2b 2026-06-17 07:29:04.018665 | ubuntu-noble | Installing 'osism.commons:0.20260601.0' to '/home/zuul/.ansible/collections/ansible_collections/osism/commons' 2026-06-17 07:29:04.018670 | ubuntu-noble | osism.commons:0.20260601.0 was installed successfully 2026-06-17 07:29:04.258248 | ubuntu-noble | ok: Runtime: 0:00:07.306262 2026-06-17 07:29:04.268027 | 2026-06-17 07:29:04.268190 | TASK [ansible-molecule : Run molecule create action with scenario delegated] 2026-06-17 07:29:04.113611 | ubuntu-noble | INFO [delegated > dependency] Dependency completed successfully. 2026-06-17 07:29:04.113670 | ubuntu-noble | WARNING [delegated > dependency] Executed: Missing roles requirements file: requirements.yml (Remove from dependency_sequence to suppress) 2026-06-17 07:29:04.113677 | ubuntu-noble | WARNING Molecule executed 1 scenario (1 missing files) 2026-06-17 07:29:04.833906 | debian-bookworm | skipping: Conditional result was False 2026-06-17 07:29:04.837988 | ubuntu-noble | skipping: Conditional result was False 2026-06-17 07:29:04.849347 | 2026-06-17 07:29:04.849516 | TASK [ansible-molecule : Run molecule prepare action with scenario delegated] 2026-06-17 07:29:05.585596 | ubuntu-noble | WARNING Molecule scenarios should migrate to 'extensions/molecule' 2026-06-17 07:29:05.596678 | ubuntu-noble | DEBUG [unknown > config] provisioner.env found in /home/zuul/src/github.com/osism/ansible-collection-services/molecule/delegated/molecule.yml, this can be defined in ansible.env 2026-06-17 07:29:05.443698 | debian-bookworm | WARNING Molecule scenarios should migrate to 'extensions/molecule' 2026-06-17 07:29:05.453005 | debian-bookworm | DEBUG [unknown > config] provisioner.env found in /home/zuul/src/github.com/osism/ansible-collection-services/molecule/delegated/molecule.yml, this can be defined in ansible.env 2026-06-17 07:29:05.856801 | debian-bookworm | DEBUG [unknown > config] provisioner.env found in /home/zuul/src/github.com/osism/ansible-collection-services/molecule/delegated/molecule.yml, this can be defined in ansible.env 2026-06-17 07:29:05.857363 | debian-bookworm | DEBUG [delegated > validate] Validating schema /home/zuul/src/github.com/osism/ansible-collection-services/molecule/delegated/molecule.yml. 2026-06-17 07:29:05.875909 | debian-bookworm | DEBUG [default > validate] Validating schema /home/zuul/src/github.com/osism/ansible-collection-services/molecule/default/molecule.yml. 2026-06-17 07:29:05.881331 | debian-bookworm | INFO [delegated > discovery] scenario test matrix: prepare 2026-06-17 07:29:05.881428 | debian-bookworm | INFO [delegated > prerun] Performing prerun with role_name_check=0... 2026-06-17 07:29:06.140081 | ubuntu-noble | DEBUG [unknown > config] provisioner.env found in /home/zuul/src/github.com/osism/ansible-collection-services/molecule/delegated/molecule.yml, this can be defined in ansible.env 2026-06-17 07:29:06.140760 | ubuntu-noble | DEBUG [delegated > validate] Validating schema /home/zuul/src/github.com/osism/ansible-collection-services/molecule/delegated/molecule.yml. 2026-06-17 07:29:06.164737 | ubuntu-noble | DEBUG [default > validate] Validating schema /home/zuul/src/github.com/osism/ansible-collection-services/molecule/default/molecule.yml. 2026-06-17 07:29:06.171366 | ubuntu-noble | INFO [delegated > discovery] scenario test matrix: prepare 2026-06-17 07:29:06.171458 | ubuntu-noble | INFO [delegated > prerun] Performing prerun with role_name_check=0... 2026-06-17 07:29:06.935168 | debian-bookworm | INFO [delegated > prepare] Executing 2026-06-17 07:29:07.208095 | debian-bookworm | DEBUG [delegated > prepare] ansible-playbook version: ansible-playbook 2026-06-17 07:29:07.208139 | debian-bookworm | config file = None 2026-06-17 07:29:07.208154 | debian-bookworm | configured module search path = 2026-06-17 07:29:07.208159 | debian-bookworm | ansible python module location = /home/zuul/venv/lib/python3.11/site-packages/ansible 2026-06-17 07:29:07.208166 | debian-bookworm | ansible collection location = /home/zuul/.ansible/collections:/usr/share/ansible/collections 2026-06-17 07:29:07.208170 | debian-bookworm | executable location = /home/zuul/venv/bin/ansible-playbook 2026-06-17 07:29:07.208174 | debian-bookworm | python version = 3.11.2 (main, Apr 8 2026, 01:58:00) (/home/zuul/venv/bin/python3) 2026-06-17 07:29:07.208178 | debian-bookworm | jinja version = 3.1.6 2026-06-17 07:29:07.208182 | debian-bookworm | libyaml = True 2026-06-17 07:29:07.208355 | debian-bookworm | DEBUG ANSIBLE ENVIRONMENT: 2026-06-17 07:29:07.208362 | debian-bookworm | ANSIBLE_COLLECTIONS_PATH: /home/zuul/venv/.ansible/collections:/home/zuul/.ansible/collections 2026-06-17 07:29:07.208366 | debian-bookworm | ANSIBLE_CONFIG: /home/zuul/.ansible/tmp/molecule.oWZD.delegated/ansible.cfg 2026-06-17 07:29:07.208370 | debian-bookworm | ANSIBLE_LIBRARY: ../../plugins 2026-06-17 07:29:07.208374 | debian-bookworm | ANSIBLE_PYTHON_INTERPRETER: /home/zuul/venv/bin/python 2026-06-17 07:29:07.208378 | debian-bookworm | ANSIBLE_ROLE: auditd 2026-06-17 07:29:07.208382 | debian-bookworm | ANSIBLE_ROLES_PATH: ../../roles 2026-06-17 07:29:07.208386 | debian-bookworm | ANSIBLE_VERBOSITY: 1 2026-06-17 07:29:07.208390 | debian-bookworm | 2026-06-17 07:29:07.208574 | debian-bookworm | DEBUG MOLECULE ENVIRONMENT: 2026-06-17 07:29:07.208580 | debian-bookworm | MOLECULE_DEBUG: True 2026-06-17 07:29:07.208584 | debian-bookworm | MOLECULE_DEPENDENCY_NAME: galaxy 2026-06-17 07:29:07.208588 | debian-bookworm | MOLECULE_DRIVER_NAME: default 2026-06-17 07:29:07.208592 | debian-bookworm | MOLECULE_ENV_FILE: /home/zuul/src/github.com/osism/ansible-collection-services/.env.yml 2026-06-17 07:29:07.208595 | debian-bookworm | MOLECULE_EPHEMERAL_DIRECTORY: /home/zuul/.ansible/tmp/molecule.oWZD.delegated 2026-06-17 07:29:07.208599 | debian-bookworm | MOLECULE_FILE: /home/zuul/.ansible/tmp/molecule.oWZD.delegated/molecule.yml 2026-06-17 07:29:07.208604 | debian-bookworm | MOLECULE_INSTANCE_CONFIG: /home/zuul/.ansible/tmp/molecule.oWZD.delegated/instance_config.yml 2026-06-17 07:29:07.208607 | debian-bookworm | MOLECULE_INVENTORY_FILE: /home/zuul/.ansible/tmp/molecule.oWZD.delegated/inventory/ansible_inventory.yml 2026-06-17 07:29:07.208612 | debian-bookworm | MOLECULE_PROJECT_DIRECTORY: /home/zuul/src/github.com/osism/ansible-collection-services 2026-06-17 07:29:07.208616 | debian-bookworm | MOLECULE_PROVISIONER_NAME: ansible 2026-06-17 07:29:07.208620 | debian-bookworm | MOLECULE_SCENARIO_DIRECTORY: /home/zuul/src/github.com/osism/ansible-collection-services/molecule/delegated 2026-06-17 07:29:07.208624 | debian-bookworm | MOLECULE_SCENARIO_NAME: delegated 2026-06-17 07:29:07.208627 | debian-bookworm | MOLECULE_STATE_FILE: /home/zuul/.ansible/tmp/molecule.oWZD.delegated/state.yml 2026-06-17 07:29:07.208631 | debian-bookworm | MOLECULE_VERIFIER_NAME: testinfra 2026-06-17 07:29:07.208635 | debian-bookworm | MOLECULE_VERIFIER_TEST_DIRECTORY: /home/zuul/src/github.com/osism/ansible-collection-services/molecule/delegated/tests 2026-06-17 07:29:07.208639 | debian-bookworm | 2026-06-17 07:29:07.208884 | debian-bookworm | DEBUG SHELL REPLAY: ANSIBLE_COLLECTIONS_PATH=/home/zuul/venv/.ansible/collections:/home/zuul/.ansible/collections ANSIBLE_CONFIG=/home/zuul/.ansible/tmp/molecule.oWZD.delegated/ansible.cfg ANSIBLE_LIBRARY=../../plugins ANSIBLE_PYTHON_INTERPRETER=/home/zuul/venv/bin/python ANSIBLE_ROLE=auditd ANSIBLE_ROLES_PATH=../../roles ANSIBLE_VERBOSITY=1 MOLECULE_DEBUG=True MOLECULE_DEPENDENCY_NAME=galaxy MOLECULE_DRIVER_NAME=default MOLECULE_ENV_FILE=/home/zuul/src/github.com/osism/ansible-collection-services/.env.yml MOLECULE_EPHEMERAL_DIRECTORY=/home/zuul/.ansible/tmp/molecule.oWZD.delegated MOLECULE_FILE=/home/zuul/.ansible/tmp/molecule.oWZD.delegated/molecule.yml MOLECULE_INSTANCE_CONFIG=/home/zuul/.ansible/tmp/molecule.oWZD.delegated/instance_config.yml MOLECULE_INVENTORY_FILE=/home/zuul/.ansible/tmp/molecule.oWZD.delegated/inventory/ansible_inventory.yml MOLECULE_PROJECT_DIRECTORY=/home/zuul/src/github.com/osism/ansible-collection-services MOLECULE_PROVISIONER_NAME=ansible MOLECULE_SCENARIO_DIRECTORY=/home/zuul/src/github.com/osism/ansible-collection-services/molecule/delegated MOLECULE_SCENARIO_NAME=delegated MOLECULE_STATE_FILE=/home/zuul/.ansible/tmp/molecule.oWZD.delegated/state.yml MOLECULE_VERIFIER_NAME=testinfra MOLECULE_VERIFIER_TEST_DIRECTORY=/home/zuul/src/github.com/osism/ansible-collection-services/molecule/delegated/tests 2026-06-17 07:29:07.641821 | ubuntu-noble | INFO [delegated > prepare] Executing 2026-06-17 07:29:07.447454 | debian-bookworm | Using /home/zuul/.ansible/tmp/molecule.oWZD.delegated/ansible.cfg as config file 2026-06-17 07:29:07.673445 | debian-bookworm | 2026-06-17 07:29:07.673699 | debian-bookworm | PLAY [Prepare] ***************************************************************** 2026-06-17 07:29:07.673926 | debian-bookworm | 2026-06-17 07:29:07.674168 | debian-bookworm | TASK [Gathering Facts] ********************************************************* 2026-06-17 07:29:08.008108 | ubuntu-noble | DEBUG [delegated > prepare] ansible-playbook version: ansible-playbook 2026-06-17 07:29:08.008172 | ubuntu-noble | config file = None 2026-06-17 07:29:08.008189 | ubuntu-noble | configured module search path = 2026-06-17 07:29:08.008195 | ubuntu-noble | ansible python module location = /home/zuul/venv/lib/python3.12/site-packages/ansible 2026-06-17 07:29:08.008201 | ubuntu-noble | ansible collection location = /home/zuul/.ansible/collections:/usr/share/ansible/collections 2026-06-17 07:29:08.008205 | ubuntu-noble | executable location = /home/zuul/venv/bin/ansible-playbook 2026-06-17 07:29:08.008210 | ubuntu-noble | python version = 3.12.3 (main, Mar 23 2026, 19:04:32) (/home/zuul/venv/bin/python3) 2026-06-17 07:29:08.008213 | ubuntu-noble | jinja version = 3.1.6 2026-06-17 07:29:08.008217 | ubuntu-noble | libyaml = True 2026-06-17 07:29:08.008500 | ubuntu-noble | DEBUG ANSIBLE ENVIRONMENT: 2026-06-17 07:29:08.008506 | ubuntu-noble | ANSIBLE_COLLECTIONS_PATH: /home/zuul/venv/.ansible/collections:/home/zuul/.ansible/collections 2026-06-17 07:29:08.008510 | ubuntu-noble | ANSIBLE_CONFIG: /home/zuul/.ansible/tmp/molecule.oWZD.delegated/ansible.cfg 2026-06-17 07:29:08.008528 | ubuntu-noble | ANSIBLE_LIBRARY: ../../plugins 2026-06-17 07:29:08.008535 | ubuntu-noble | ANSIBLE_PYTHON_INTERPRETER: /home/zuul/venv/bin/python 2026-06-17 07:29:08.008539 | ubuntu-noble | ANSIBLE_ROLE: auditd 2026-06-17 07:29:08.008542 | ubuntu-noble | ANSIBLE_ROLES_PATH: ../../roles 2026-06-17 07:29:08.008546 | ubuntu-noble | ANSIBLE_VERBOSITY: 1 2026-06-17 07:29:08.008550 | ubuntu-noble | 2026-06-17 07:29:08.008819 | ubuntu-noble | DEBUG MOLECULE ENVIRONMENT: 2026-06-17 07:29:08.008825 | ubuntu-noble | MOLECULE_DEBUG: True 2026-06-17 07:29:08.008828 | ubuntu-noble | MOLECULE_DEPENDENCY_NAME: galaxy 2026-06-17 07:29:08.008832 | ubuntu-noble | MOLECULE_DRIVER_NAME: default 2026-06-17 07:29:08.008836 | ubuntu-noble | MOLECULE_ENV_FILE: /home/zuul/src/github.com/osism/ansible-collection-services/.env.yml 2026-06-17 07:29:08.008839 | ubuntu-noble | MOLECULE_EPHEMERAL_DIRECTORY: /home/zuul/.ansible/tmp/molecule.oWZD.delegated 2026-06-17 07:29:08.008843 | ubuntu-noble | MOLECULE_FILE: /home/zuul/.ansible/tmp/molecule.oWZD.delegated/molecule.yml 2026-06-17 07:29:08.008847 | ubuntu-noble | MOLECULE_INSTANCE_CONFIG: /home/zuul/.ansible/tmp/molecule.oWZD.delegated/instance_config.yml 2026-06-17 07:29:08.008851 | ubuntu-noble | MOLECULE_INVENTORY_FILE: /home/zuul/.ansible/tmp/molecule.oWZD.delegated/inventory/ansible_inventory.yml 2026-06-17 07:29:08.008855 | ubuntu-noble | MOLECULE_PROJECT_DIRECTORY: /home/zuul/src/github.com/osism/ansible-collection-services 2026-06-17 07:29:08.008858 | ubuntu-noble | MOLECULE_PROVISIONER_NAME: ansible 2026-06-17 07:29:08.008862 | ubuntu-noble | MOLECULE_SCENARIO_DIRECTORY: /home/zuul/src/github.com/osism/ansible-collection-services/molecule/delegated 2026-06-17 07:29:08.008865 | ubuntu-noble | MOLECULE_SCENARIO_NAME: delegated 2026-06-17 07:29:08.008869 | ubuntu-noble | MOLECULE_STATE_FILE: /home/zuul/.ansible/tmp/molecule.oWZD.delegated/state.yml 2026-06-17 07:29:08.008872 | ubuntu-noble | MOLECULE_VERIFIER_NAME: testinfra 2026-06-17 07:29:08.008876 | ubuntu-noble | MOLECULE_VERIFIER_TEST_DIRECTORY: /home/zuul/src/github.com/osism/ansible-collection-services/molecule/delegated/tests 2026-06-17 07:29:08.008880 | ubuntu-noble | 2026-06-17 07:29:08.009310 | ubuntu-noble | DEBUG SHELL REPLAY: ANSIBLE_COLLECTIONS_PATH=/home/zuul/venv/.ansible/collections:/home/zuul/.ansible/collections ANSIBLE_CONFIG=/home/zuul/.ansible/tmp/molecule.oWZD.delegated/ansible.cfg ANSIBLE_LIBRARY=../../plugins ANSIBLE_PYTHON_INTERPRETER=/home/zuul/venv/bin/python ANSIBLE_ROLE=auditd ANSIBLE_ROLES_PATH=../../roles ANSIBLE_VERBOSITY=1 MOLECULE_DEBUG=True MOLECULE_DEPENDENCY_NAME=galaxy MOLECULE_DRIVER_NAME=default MOLECULE_ENV_FILE=/home/zuul/src/github.com/osism/ansible-collection-services/.env.yml MOLECULE_EPHEMERAL_DIRECTORY=/home/zuul/.ansible/tmp/molecule.oWZD.delegated MOLECULE_FILE=/home/zuul/.ansible/tmp/molecule.oWZD.delegated/molecule.yml MOLECULE_INSTANCE_CONFIG=/home/zuul/.ansible/tmp/molecule.oWZD.delegated/instance_config.yml MOLECULE_INVENTORY_FILE=/home/zuul/.ansible/tmp/molecule.oWZD.delegated/inventory/ansible_inventory.yml MOLECULE_PROJECT_DIRECTORY=/home/zuul/src/github.com/osism/ansible-collection-services MOLECULE_PROVISIONER_NAME=ansible MOLECULE_SCENARIO_DIRECTORY=/home/zuul/src/github.com/osism/ansible-collection-services/molecule/delegated MOLECULE_SCENARIO_NAME=delegated MOLECULE_STATE_FILE=/home/zuul/.ansible/tmp/molecule.oWZD.delegated/state.yml MOLECULE_VERIFIER_NAME=testinfra MOLECULE_VERIFIER_TEST_DIRECTORY=/home/zuul/src/github.com/osism/ansible-collection-services/molecule/delegated/tests 2026-06-17 07:29:08.318580 | ubuntu-noble | Using /home/zuul/.ansible/tmp/molecule.oWZD.delegated/ansible.cfg as config file 2026-06-17 07:29:08.613437 | ubuntu-noble | 2026-06-17 07:29:08.614171 | ubuntu-noble | PLAY [Prepare] ***************************************************************** 2026-06-17 07:29:08.614699 | ubuntu-noble | 2026-06-17 07:29:08.615295 | ubuntu-noble | TASK [Gathering Facts] ********************************************************* 2026-06-17 07:29:08.650643 | debian-bookworm | ok: [molecule-auditd] 2026-06-17 07:29:08.650767 | debian-bookworm | 2026-06-17 07:29:08.650933 | debian-bookworm | TASK [Install packages in venv] ************************************************ 2026-06-17 07:29:09.901586 | ubuntu-noble | ok: [molecule-auditd] 2026-06-17 07:29:09.901648 | ubuntu-noble | 2026-06-17 07:29:09.901656 | ubuntu-noble | TASK [Install packages in venv] ************************************************ 2026-06-17 07:29:12.601778 | debian-bookworm | changed: [molecule-auditd] => (item=docker) => {"ansible_loop_var": "item", "changed": true, "cmd": ["/home/zuul/venv/bin/pip3", "install", "docker"], "item": "docker", "name": ["docker"], "requirements": null, "state": "present", "stderr": "", "stderr_lines": [], "stdout": "Collecting docker\n Downloading docker-7.1.0-py3-none-any.whl (147 kB)\n ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ 147.8/147.8 kB 4.3 MB/s eta 0:00:00\nRequirement already satisfied: requests>=2.26.0 in /home/zuul/venv/lib/python3.11/site-packages (from docker) (2.34.2)\nRequirement already satisfied: urllib3>=1.26.0 in /home/zuul/venv/lib/python3.11/site-packages (from docker) (2.7.0)\nRequirement already satisfied: charset_normalizer<4,>=2 in /home/zuul/venv/lib/python3.11/site-packages (from requests>=2.26.0->docker) (3.4.7)\nRequirement already satisfied: idna<4,>=2.5 in /home/zuul/venv/lib/python3.11/site-packages (from requests>=2.26.0->docker) (3.18)\nRequirement already satisfied: certifi>=2023.5.7 in /home/zuul/venv/lib/python3.11/site-packages (from requests>=2.26.0->docker) (2026.5.20)\nInstalling collected packages: docker\nSuccessfully installed docker-7.1.0\n", "stdout_lines": ["Collecting docker", " Downloading docker-7.1.0-py3-none-any.whl (147 kB)", " ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ 147.8/147.8 kB 4.3 MB/s eta 0:00:00", "Requirement already satisfied: requests>=2.26.0 in /home/zuul/venv/lib/python3.11/site-packages (from docker) (2.34.2)", "Requirement already satisfied: urllib3>=1.26.0 in /home/zuul/venv/lib/python3.11/site-packages (from docker) (2.7.0)", "Requirement already satisfied: charset_normalizer<4,>=2 in /home/zuul/venv/lib/python3.11/site-packages (from requests>=2.26.0->docker) (3.4.7)", "Requirement already satisfied: idna<4,>=2.5 in /home/zuul/venv/lib/python3.11/site-packages (from requests>=2.26.0->docker) (3.18)", "Requirement already satisfied: certifi>=2023.5.7 in /home/zuul/venv/lib/python3.11/site-packages (from requests>=2.26.0->docker) (2026.5.20)", "Installing collected packages: docker", "Successfully installed docker-7.1.0"], "version": null, "virtualenv": "/home/zuul/venv"} 2026-06-17 07:29:12.601909 | debian-bookworm | changed: [molecule-auditd] => (item=netaddr) => {"ansible_loop_var": "item", "changed": true, "cmd": ["/home/zuul/venv/bin/pip3", "install", "netaddr"], "item": "netaddr", "name": ["netaddr"], "requirements": null, "state": "present", "stderr": "", "stderr_lines": [], "stdout": "Collecting netaddr\n Downloading netaddr-1.3.0-py3-none-any.whl (2.3 MB)\n ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ 2.3/2.3 MB 13.7 MB/s eta 0:00:00\nInstalling collected packages: netaddr\nSuccessfully installed netaddr-1.3.0\n", "stdout_lines": ["Collecting netaddr", " Downloading netaddr-1.3.0-py3-none-any.whl (2.3 MB)", " ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ 2.3/2.3 MB 13.7 MB/s eta 0:00:00", "Installing collected packages: netaddr", "Successfully installed netaddr-1.3.0"], "version": null, "virtualenv": "/home/zuul/venv"} 2026-06-17 07:29:12.602039 | debian-bookworm | ok: [molecule-auditd] => (item=requests) => {"ansible_loop_var": "item", "changed": false, "cmd": ["/home/zuul/venv/bin/pip3", "install", "requests"], "item": "requests", "name": ["requests"], "requirements": null, "state": "present", "stderr": "", "stderr_lines": [], "stdout": "Requirement already satisfied: requests in /home/zuul/venv/lib/python3.11/site-packages (2.34.2)\nRequirement already satisfied: charset_normalizer<4,>=2 in /home/zuul/venv/lib/python3.11/site-packages (from requests) (3.4.7)\nRequirement already satisfied: idna<4,>=2.5 in /home/zuul/venv/lib/python3.11/site-packages (from requests) (3.18)\nRequirement already satisfied: urllib3<3,>=1.26 in /home/zuul/venv/lib/python3.11/site-packages (from requests) (2.7.0)\nRequirement already satisfied: certifi>=2023.5.7 in /home/zuul/venv/lib/python3.11/site-packages (from requests) (2026.5.20)\n", "stdout_lines": ["Requirement already satisfied: requests in /home/zuul/venv/lib/python3.11/site-packages (2.34.2)", "Requirement already satisfied: charset_normalizer<4,>=2 in /home/zuul/venv/lib/python3.11/site-packages (from requests) (3.4.7)", "Requirement already satisfied: idna<4,>=2.5 in /home/zuul/venv/lib/python3.11/site-packages (from requests) (3.18)", "Requirement already satisfied: urllib3<3,>=1.26 in /home/zuul/venv/lib/python3.11/site-packages (from requests) (2.7.0)", "Requirement already satisfied: certifi>=2023.5.7 in /home/zuul/venv/lib/python3.11/site-packages (from requests) (2026.5.20)"], "version": null, "virtualenv": "/home/zuul/venv"} 2026-06-17 07:29:12.602135 | debian-bookworm | 2026-06-17 07:29:12.602236 | debian-bookworm | TASK [Include required prepare tasks] ****************************************** 2026-06-17 07:29:12.624640 | debian-bookworm | included: /home/zuul/src/github.com/osism/ansible-collection-services/molecule/delegated/prepare/auditd.yml for molecule-auditd 2026-06-17 07:29:12.624815 | debian-bookworm | 2026-06-17 07:29:12.625003 | debian-bookworm | PLAY RECAP ********************************************************************* 2026-06-17 07:29:12.625188 | debian-bookworm | molecule-auditd : ok=3 changed=1 unreachable=0 failed=0 skipped=0 rescued=0 ignored=0 2026-06-17 07:29:12.625347 | debian-bookworm | 2026-06-17 07:29:12.686199 | debian-bookworm | INFO [delegated > prepare] Executed: Successful 2026-06-17 07:29:12.686475 | debian-bookworm | INFO Molecule executed 1 scenario (1 successful) 2026-06-17 07:29:12.914342 | debian-bookworm | ok: Runtime: 0:00:07.573010 2026-06-17 07:29:15.189502 | ubuntu-noble | ok: Runtime: 0:00:09.928285 2026-06-17 07:29:15.195830 | 2026-06-17 07:29:15.195966 | TASK [ansible-molecule : Reset connection] 2026-06-17 07:29:15.229944 | 2026-06-17 07:29:15.230096 | TASK [ansible-molecule : Reset connection] 2026-06-17 07:29:15.268515 | 2026-06-17 07:29:15.268731 | TASK [ansible-molecule : Run molecule converge action with scenario delegated] 2026-06-17 07:29:14.918878 | ubuntu-noble | changed: [molecule-auditd] => (item=docker) => {"ansible_loop_var": "item", "changed": true, "cmd": ["/home/zuul/venv/bin/pip3", "install", "docker"], "item": "docker", "name": ["docker"], "requirements": null, "state": "present", "stderr": "", "stderr_lines": [], "stdout": "Collecting docker\n Downloading docker-7.1.0-py3-none-any.whl.metadata (3.8 kB)\nRequirement already satisfied: requests>=2.26.0 in /home/zuul/venv/lib/python3.12/site-packages (from docker) (2.34.2)\nRequirement already satisfied: urllib3>=1.26.0 in /home/zuul/venv/lib/python3.12/site-packages (from docker) (2.7.0)\nRequirement already satisfied: charset_normalizer<4,>=2 in /home/zuul/venv/lib/python3.12/site-packages (from requests>=2.26.0->docker) (3.4.7)\nRequirement already satisfied: idna<4,>=2.5 in /home/zuul/venv/lib/python3.12/site-packages (from requests>=2.26.0->docker) (3.18)\nRequirement already satisfied: certifi>=2023.5.7 in /home/zuul/venv/lib/python3.12/site-packages (from requests>=2.26.0->docker) (2026.5.20)\nDownloading docker-7.1.0-py3-none-any.whl (147 kB)\n ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ 147.8/147.8 kB 3.6 MB/s eta 0:00:00\nInstalling collected packages: docker\nSuccessfully installed docker-7.1.0\n", "stdout_lines": ["Collecting docker", " Downloading docker-7.1.0-py3-none-any.whl.metadata (3.8 kB)", "Requirement already satisfied: requests>=2.26.0 in /home/zuul/venv/lib/python3.12/site-packages (from docker) (2.34.2)", "Requirement already satisfied: urllib3>=1.26.0 in /home/zuul/venv/lib/python3.12/site-packages (from docker) (2.7.0)", "Requirement already satisfied: charset_normalizer<4,>=2 in /home/zuul/venv/lib/python3.12/site-packages (from requests>=2.26.0->docker) (3.4.7)", "Requirement already satisfied: idna<4,>=2.5 in /home/zuul/venv/lib/python3.12/site-packages (from requests>=2.26.0->docker) (3.18)", "Requirement already satisfied: certifi>=2023.5.7 in /home/zuul/venv/lib/python3.12/site-packages (from requests>=2.26.0->docker) (2026.5.20)", "Downloading docker-7.1.0-py3-none-any.whl (147 kB)", " ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ 147.8/147.8 kB 3.6 MB/s eta 0:00:00", "Installing collected packages: docker", "Successfully installed docker-7.1.0"], "version": null, "virtualenv": "/home/zuul/venv"} 2026-06-17 07:29:14.920582 | ubuntu-noble | changed: [molecule-auditd] => (item=netaddr) => {"ansible_loop_var": "item", "changed": true, "cmd": ["/home/zuul/venv/bin/pip3", "install", "netaddr"], "item": "netaddr", "name": ["netaddr"], "requirements": null, "state": "present", "stderr": "", "stderr_lines": [], "stdout": "Collecting netaddr\n Downloading netaddr-1.3.0-py3-none-any.whl.metadata (5.0 kB)\nDownloading netaddr-1.3.0-py3-none-any.whl (2.3 MB)\n ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ 2.3/2.3 MB 12.9 MB/s eta 0:00:00\nInstalling collected packages: netaddr\nSuccessfully installed netaddr-1.3.0\n", "stdout_lines": ["Collecting netaddr", " Downloading netaddr-1.3.0-py3-none-any.whl.metadata (5.0 kB)", "Downloading netaddr-1.3.0-py3-none-any.whl (2.3 MB)", " ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ 2.3/2.3 MB 12.9 MB/s eta 0:00:00", "Installing collected packages: netaddr", "Successfully installed netaddr-1.3.0"], "version": null, "virtualenv": "/home/zuul/venv"} 2026-06-17 07:29:14.920617 | ubuntu-noble | ok: [molecule-auditd] => (item=requests) => {"ansible_loop_var": "item", "changed": false, "cmd": ["/home/zuul/venv/bin/pip3", "install", "requests"], "item": "requests", "name": ["requests"], "requirements": null, "state": "present", "stderr": "", "stderr_lines": [], "stdout": "Requirement already satisfied: requests in /home/zuul/venv/lib/python3.12/site-packages (2.34.2)\nRequirement already satisfied: charset_normalizer<4,>=2 in /home/zuul/venv/lib/python3.12/site-packages (from requests) (3.4.7)\nRequirement already satisfied: idna<4,>=2.5 in /home/zuul/venv/lib/python3.12/site-packages (from requests) (3.18)\nRequirement already satisfied: urllib3<3,>=1.26 in /home/zuul/venv/lib/python3.12/site-packages (from requests) (2.7.0)\nRequirement already satisfied: certifi>=2023.5.7 in /home/zuul/venv/lib/python3.12/site-packages (from requests) (2026.5.20)\n", "stdout_lines": ["Requirement already satisfied: requests in /home/zuul/venv/lib/python3.12/site-packages (2.34.2)", "Requirement already satisfied: charset_normalizer<4,>=2 in /home/zuul/venv/lib/python3.12/site-packages (from requests) (3.4.7)", "Requirement already satisfied: idna<4,>=2.5 in /home/zuul/venv/lib/python3.12/site-packages (from requests) (3.18)", "Requirement already satisfied: urllib3<3,>=1.26 in /home/zuul/venv/lib/python3.12/site-packages (from requests) (2.7.0)", "Requirement already satisfied: certifi>=2023.5.7 in /home/zuul/venv/lib/python3.12/site-packages (from requests) (2026.5.20)"], "version": null, "virtualenv": "/home/zuul/venv"} 2026-06-17 07:29:14.920625 | ubuntu-noble | 2026-06-17 07:29:14.920633 | ubuntu-noble | TASK [Include required prepare tasks] ****************************************** 2026-06-17 07:29:14.942227 | ubuntu-noble | included: /home/zuul/src/github.com/osism/ansible-collection-services/molecule/delegated/prepare/auditd.yml for molecule-auditd 2026-06-17 07:29:14.942405 | ubuntu-noble | 2026-06-17 07:29:14.942629 | ubuntu-noble | PLAY RECAP ********************************************************************* 2026-06-17 07:29:14.942907 | ubuntu-noble | molecule-auditd : ok=3 changed=1 unreachable=0 failed=0 skipped=0 rescued=0 ignored=0 2026-06-17 07:29:14.943064 | ubuntu-noble | 2026-06-17 07:29:15.065174 | ubuntu-noble | INFO [delegated > prepare] Executed: Successful 2026-06-17 07:29:15.066094 | ubuntu-noble | INFO Molecule executed 1 scenario (1 successful) 2026-06-17 07:29:16.250042 | ubuntu-noble | WARNING Molecule scenarios should migrate to 'extensions/molecule' 2026-06-17 07:29:16.262319 | ubuntu-noble | DEBUG [unknown > config] provisioner.env found in /home/zuul/src/github.com/osism/ansible-collection-services/molecule/delegated/molecule.yml, this can be defined in ansible.env 2026-06-17 07:29:16.062864 | debian-bookworm | WARNING Molecule scenarios should migrate to 'extensions/molecule' 2026-06-17 07:29:16.072931 | debian-bookworm | DEBUG [unknown > config] provisioner.env found in /home/zuul/src/github.com/osism/ansible-collection-services/molecule/delegated/molecule.yml, this can be defined in ansible.env 2026-06-17 07:29:16.519877 | debian-bookworm | DEBUG [unknown > config] provisioner.env found in /home/zuul/src/github.com/osism/ansible-collection-services/molecule/delegated/molecule.yml, this can be defined in ansible.env 2026-06-17 07:29:16.520493 | debian-bookworm | DEBUG [delegated > validate] Validating schema /home/zuul/src/github.com/osism/ansible-collection-services/molecule/delegated/molecule.yml. 2026-06-17 07:29:16.540287 | debian-bookworm | DEBUG [default > validate] Validating schema /home/zuul/src/github.com/osism/ansible-collection-services/molecule/default/molecule.yml. 2026-06-17 07:29:16.545744 | debian-bookworm | INFO [delegated > discovery] scenario test matrix: dependency, create, prepare, converge 2026-06-17 07:29:16.545848 | debian-bookworm | INFO [delegated > prerun] Performing prerun with role_name_check=0... 2026-06-17 07:29:16.869641 | ubuntu-noble | DEBUG [unknown > config] provisioner.env found in /home/zuul/src/github.com/osism/ansible-collection-services/molecule/delegated/molecule.yml, this can be defined in ansible.env 2026-06-17 07:29:16.869725 | ubuntu-noble | DEBUG [delegated > validate] Validating schema /home/zuul/src/github.com/osism/ansible-collection-services/molecule/delegated/molecule.yml. 2026-06-17 07:29:17.001119 | ubuntu-noble | DEBUG [default > validate] Validating schema /home/zuul/src/github.com/osism/ansible-collection-services/molecule/default/molecule.yml. 2026-06-17 07:29:17.008276 | ubuntu-noble | INFO [delegated > discovery] scenario test matrix: dependency, create, prepare, converge 2026-06-17 07:29:17.008448 | ubuntu-noble | INFO [delegated > prerun] Performing prerun with role_name_check=0... 2026-06-17 07:29:17.711408 | debian-bookworm | INFO [delegated > dependency] Executing 2026-06-17 07:29:17.711705 | debian-bookworm | WARNING [delegated > dependency] Missing roles requirements file: requirements.yml 2026-06-17 07:29:18.066076 | debian-bookworm | ansible-galaxy [core 2.18.17] 2026-06-17 07:29:18.066580 | debian-bookworm | config file = None 2026-06-17 07:29:18.067009 | debian-bookworm | configured module search path = ['/home/zuul/src/github.com/osism/ansible-collection-services/plugins/modules', '/home/zuul/.ansible/plugins/modules', '/usr/share/ansible/plugins/modules'] 2026-06-17 07:29:18.067474 | debian-bookworm | ansible python module location = /home/zuul/venv/lib/python3.11/site-packages/ansible 2026-06-17 07:29:18.067850 | debian-bookworm | ansible collection location = /home/zuul/.ansible/collections:/usr/share/ansible/collections:/home/zuul/venv/lib/python3.11/site-packages:/home/zuul/venv/lib/python3.11/dist-packages:/home/zuul/venv/lib/python3/dist-packages:/home/zuul/venv/local/lib/python3.11/dist-packages 2026-06-17 07:29:18.068213 | debian-bookworm | executable location = /home/zuul/venv/bin/ansible-galaxy 2026-06-17 07:29:18.068595 | debian-bookworm | python version = 3.11.2 (main, Apr 8 2026, 01:58:00) [GCC 12.2.0] (/home/zuul/venv/bin/python3) 2026-06-17 07:29:18.068919 | debian-bookworm | jinja version = 3.1.6 2026-06-17 07:29:18.069188 | debian-bookworm | libyaml = True 2026-06-17 07:29:18.069470 | debian-bookworm | No config file found; using defaults 2026-06-17 07:29:18.069894 | debian-bookworm | Reading requirement file at '/home/zuul/src/github.com/osism/ansible-collection-services/molecule/delegated/collections.yml' 2026-06-17 07:29:18.072475 | debian-bookworm | Loading collection netapp.storagegrid from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/netapp/storagegrid 2026-06-17 07:29:18.072892 | debian-bookworm | Found installed collection netapp.storagegrid:21.14.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/netapp/storagegrid' 2026-06-17 07:29:18.073479 | debian-bookworm | Loading collection community.okd from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/okd 2026-06-17 07:29:18.073886 | debian-bookworm | Found installed collection community.okd:4.0.2 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/okd' 2026-06-17 07:29:18.075702 | debian-bookworm | Loading collection theforeman.foreman from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/theforeman/foreman 2026-06-17 07:29:18.076114 | debian-bookworm | Found installed collection theforeman.foreman:4.2.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/theforeman/foreman' 2026-06-17 07:29:18.076584 | debian-bookworm | Loading collection community.postgresql from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/postgresql 2026-06-17 07:29:18.076868 | debian-bookworm | Found installed collection community.postgresql:3.14.2 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/postgresql' 2026-06-17 07:29:18.077369 | debian-bookworm | Loading collection vultr.cloud from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/vultr/cloud 2026-06-17 07:29:18.077689 | debian-bookworm | Found installed collection vultr.cloud:1.13.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/vultr/cloud' 2026-06-17 07:29:18.078898 | debian-bookworm | Loading collection junipernetworks.junos from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/junipernetworks/junos 2026-06-17 07:29:18.079180 | debian-bookworm | Found installed collection junipernetworks.junos:9.1.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/junipernetworks/junos' 2026-06-17 07:29:18.081633 | debian-bookworm | Loading collection awx.awx from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/awx/awx 2026-06-17 07:29:18.082055 | debian-bookworm | Found installed collection awx.awx:24.6.1 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/awx/awx' 2026-06-17 07:29:18.082638 | debian-bookworm | Loading collection ibm.qradar from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/ibm/qradar 2026-06-17 07:29:18.082936 | debian-bookworm | Found installed collection ibm.qradar:4.0.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/ibm/qradar' 2026-06-17 07:29:18.083239 | debian-bookworm | Loading collection community.mysql from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/mysql 2026-06-17 07:29:18.083562 | debian-bookworm | Found installed collection community.mysql:3.16.1 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/mysql' 2026-06-17 07:29:18.083865 | debian-bookworm | Loading collection ansible.utils from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/ansible/utils 2026-06-17 07:29:18.084210 | debian-bookworm | Found installed collection ansible.utils:5.1.2 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/ansible/utils' 2026-06-17 07:29:18.084544 | debian-bookworm | Loading collection kubevirt.core from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/kubevirt/core 2026-06-17 07:29:18.084844 | debian-bookworm | Found installed collection kubevirt.core:2.2.3 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/kubevirt/core' 2026-06-17 07:29:18.085414 | debian-bookworm | Loading collection ovirt.ovirt from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/ovirt/ovirt 2026-06-17 07:29:18.085718 | debian-bookworm | Found installed collection ovirt.ovirt:3.2.1 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/ovirt/ovirt' 2026-06-17 07:29:18.086238 | debian-bookworm | Loading collection hitachivantara.vspone_block from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/hitachivantara/vspone_block 2026-06-17 07:29:18.086566 | debian-bookworm | Found installed collection hitachivantara.vspone_block:3.5.1 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/hitachivantara/vspone_block' 2026-06-17 07:29:18.086841 | debian-bookworm | Loading collection sensu.sensu_go from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/sensu/sensu_go 2026-06-17 07:29:18.087109 | debian-bookworm | Found installed collection sensu.sensu_go:1.14.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/sensu/sensu_go' 2026-06-17 07:29:18.088001 | debian-bookworm | Loading collection vyos.vyos from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/vyos/vyos 2026-06-17 07:29:18.088324 | debian-bookworm | Found installed collection vyos.vyos:5.0.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/vyos/vyos' 2026-06-17 07:29:18.089966 | debian-bookworm | Loading collection dellemc.enterprise_sonic from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/dellemc/enterprise_sonic 2026-06-17 07:29:18.090464 | debian-bookworm | Found installed collection dellemc.enterprise_sonic:2.5.1 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/dellemc/enterprise_sonic' 2026-06-17 07:29:18.090873 | debian-bookworm | Loading collection community.hashi_vault from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/hashi_vault 2026-06-17 07:29:18.091164 | debian-bookworm | Found installed collection community.hashi_vault:6.2.1 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/hashi_vault' 2026-06-17 07:29:18.092884 | debian-bookworm | Loading collection cisco.nxos from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/cisco/nxos 2026-06-17 07:29:18.093301 | debian-bookworm | Found installed collection cisco.nxos:9.4.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/cisco/nxos' 2026-06-17 07:29:18.093785 | debian-bookworm | Loading collection community.sap_libs from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/sap_libs 2026-06-17 07:29:18.094135 | debian-bookworm | Found installed collection community.sap_libs:1.5.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/sap_libs' 2026-06-17 07:29:18.094991 | debian-bookworm | Loading collection cisco.dnac from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/cisco/dnac 2026-06-17 07:29:18.095408 | debian-bookworm | Found installed collection cisco.dnac:6.31.3 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/cisco/dnac' 2026-06-17 07:29:18.095729 | debian-bookworm | Loading collection ibm.spectrum_virtualize from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/ibm/spectrum_virtualize 2026-06-17 07:29:18.095992 | debian-bookworm | Found installed collection ibm.spectrum_virtualize:2.0.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/ibm/spectrum_virtualize' 2026-06-17 07:29:18.096514 | debian-bookworm | Loading collection community.vmware from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/vmware 2026-06-17 07:29:18.096877 | debian-bookworm | Found installed collection community.vmware:5.10.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/vmware' 2026-06-17 07:29:18.099737 | debian-bookworm | Loading collection vmware.vmware_rest from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/vmware/vmware_rest 2026-06-17 07:29:18.100090 | debian-bookworm | Found installed collection vmware.vmware_rest:4.9.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/vmware/vmware_rest' 2026-06-17 07:29:18.100292 | debian-bookworm | Loading collection community.libvirt from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/libvirt 2026-06-17 07:29:18.100599 | debian-bookworm | Found installed collection community.libvirt:1.4.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/libvirt' 2026-06-17 07:29:18.101156 | debian-bookworm | Loading collection ansible.netcommon from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/ansible/netcommon 2026-06-17 07:29:18.101415 | debian-bookworm | Found installed collection ansible.netcommon:7.2.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/ansible/netcommon' 2026-06-17 07:29:18.102200 | debian-bookworm | Loading collection dellemc.unity from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/dellemc/unity 2026-06-17 07:29:18.102532 | debian-bookworm | Found installed collection dellemc.unity:2.1.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/dellemc/unity' 2026-06-17 07:29:18.102887 | debian-bookworm | Loading collection purestorage.flasharray from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/purestorage/flasharray 2026-06-17 07:29:18.103162 | debian-bookworm | Found installed collection purestorage.flasharray:1.39.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/purestorage/flasharray' 2026-06-17 07:29:18.103472 | debian-bookworm | Loading collection containers.podman from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/containers/podman 2026-06-17 07:29:18.103792 | debian-bookworm | Found installed collection containers.podman:1.18.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/containers/podman' 2026-06-17 07:29:18.105703 | debian-bookworm | Loading collection azure.azcollection from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/azure/azcollection 2026-06-17 07:29:18.105932 | debian-bookworm | Found installed collection azure.azcollection:3.10.1 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/azure/azcollection' 2026-06-17 07:29:18.106164 | debian-bookworm | Loading collection community.sops from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/sops 2026-06-17 07:29:18.106495 | debian-bookworm | Found installed collection community.sops:2.2.7 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/sops' 2026-06-17 07:29:18.107174 | debian-bookworm | Loading collection splunk.es from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/splunk/es 2026-06-17 07:29:18.107511 | debian-bookworm | Found installed collection splunk.es:4.0.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/splunk/es' 2026-06-17 07:29:18.107821 | debian-bookworm | Loading collection ieisystem.inmanage from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/ieisystem/inmanage 2026-06-17 07:29:18.108077 | debian-bookworm | Found installed collection ieisystem.inmanage:3.0.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/ieisystem/inmanage' 2026-06-17 07:29:18.108399 | debian-bookworm | Loading collection netapp_eseries.santricity from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/netapp_eseries/santricity 2026-06-17 07:29:18.108663 | debian-bookworm | Found installed collection netapp_eseries.santricity:1.4.1 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/netapp_eseries/santricity' 2026-06-17 07:29:18.109131 | debian-bookworm | Loading collection community.windows from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/windows 2026-06-17 07:29:18.109362 | debian-bookworm | Found installed collection community.windows:2.4.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/windows' 2026-06-17 07:29:18.109671 | debian-bookworm | Loading collection ansible.posix from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/ansible/posix 2026-06-17 07:29:18.109974 | debian-bookworm | Found installed collection ansible.posix:1.6.2 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/ansible/posix' 2026-06-17 07:29:18.111063 | debian-bookworm | Loading collection community.digitalocean from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/digitalocean 2026-06-17 07:29:18.111379 | debian-bookworm | Found installed collection community.digitalocean:1.27.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/digitalocean' 2026-06-17 07:29:18.111706 | debian-bookworm | Loading collection infoblox.nios_modules from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/infoblox/nios_modules 2026-06-17 07:29:18.112005 | debian-bookworm | Found installed collection infoblox.nios_modules:1.8.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/infoblox/nios_modules' 2026-06-17 07:29:18.112281 | debian-bookworm | Loading collection community.ciscosmb from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/ciscosmb 2026-06-17 07:29:18.112536 | debian-bookworm | Found installed collection community.ciscosmb:1.0.11 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/ciscosmb' 2026-06-17 07:29:18.112772 | debian-bookworm | Loading collection microsoft.iis from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/microsoft/iis 2026-06-17 07:29:18.113049 | debian-bookworm | Found installed collection microsoft.iis:1.0.3 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/microsoft/iis' 2026-06-17 07:29:18.113854 | debian-bookworm | Loading collection netbox.netbox from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/netbox/netbox 2026-06-17 07:29:18.114074 | debian-bookworm | Found installed collection netbox.netbox:3.21.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/netbox/netbox' 2026-06-17 07:29:18.114418 | debian-bookworm | Loading collection grafana.grafana from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/grafana/grafana 2026-06-17 07:29:18.114752 | debian-bookworm | Found installed collection grafana.grafana:5.7.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/grafana/grafana' 2026-06-17 07:29:18.115367 | debian-bookworm | Loading collection dellemc.openmanage from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/dellemc/openmanage 2026-06-17 07:29:18.115693 | debian-bookworm | Found installed collection dellemc.openmanage:9.12.3 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/dellemc/openmanage' 2026-06-17 07:29:18.116373 | debian-bookworm | Loading collection kubernetes.core from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/kubernetes/core 2026-06-17 07:29:18.116720 | debian-bookworm | Found installed collection kubernetes.core:5.4.1 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/kubernetes/core' 2026-06-17 07:29:18.117015 | debian-bookworm | Loading collection cyberark.conjur from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/cyberark/conjur 2026-06-17 07:29:18.117277 | debian-bookworm | Found installed collection cyberark.conjur:1.3.8 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/cyberark/conjur' 2026-06-17 07:29:18.117646 | debian-bookworm | Loading collection community.grafana from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/grafana 2026-06-17 07:29:18.117911 | debian-bookworm | Found installed collection community.grafana:2.3.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/grafana' 2026-06-17 07:29:18.118176 | debian-bookworm | Loading collection cloud.common from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/cloud/common 2026-06-17 07:29:18.118458 | debian-bookworm | Found installed collection cloud.common:4.2.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/cloud/common' 2026-06-17 07:29:18.118759 | debian-bookworm | Loading collection microsoft.ad from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/microsoft/ad 2026-06-17 07:29:18.119011 | debian-bookworm | Found installed collection microsoft.ad:1.9.2 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/microsoft/ad' 2026-06-17 07:29:18.119695 | debian-bookworm | Loading collection openstack.cloud from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/openstack/cloud 2026-06-17 07:29:18.119973 | debian-bookworm | Found installed collection openstack.cloud:2.5.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/openstack/cloud' 2026-06-17 07:29:18.120281 | debian-bookworm | Loading collection chocolatey.chocolatey from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/chocolatey/chocolatey 2026-06-17 07:29:18.120594 | debian-bookworm | Found installed collection chocolatey.chocolatey:1.5.3 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/chocolatey/chocolatey' 2026-06-17 07:29:18.120971 | debian-bookworm | Loading collection ansible.windows from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/ansible/windows 2026-06-17 07:29:18.121239 | debian-bookworm | Found installed collection ansible.windows:2.8.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/ansible/windows' 2026-06-17 07:29:18.157715 | debian-bookworm | Loading collection community.network from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/network 2026-06-17 07:29:18.158179 | debian-bookworm | Found installed collection community.network:5.1.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/network' 2026-06-17 07:29:18.161173 | debian-bookworm | Loading collection fortinet.fortios from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/fortinet/fortios 2026-06-17 07:29:18.161599 | debian-bookworm | Found installed collection fortinet.fortios:2.4.2 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/fortinet/fortios' 2026-06-17 07:29:18.163190 | debian-bookworm | Loading collection cisco.aci from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/cisco/aci 2026-06-17 07:29:18.163613 | debian-bookworm | Found installed collection cisco.aci:2.12.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/cisco/aci' 2026-06-17 07:29:18.164491 | debian-bookworm | Loading collection google.cloud from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/google/cloud 2026-06-17 07:29:18.164884 | debian-bookworm | Found installed collection google.cloud:1.9.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/google/cloud' 2026-06-17 07:29:18.165257 | debian-bookworm | Loading collection lowlydba.sqlserver from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/lowlydba/sqlserver 2026-06-17 07:29:18.165571 | debian-bookworm | Found installed collection lowlydba.sqlserver:2.7.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/lowlydba/sqlserver' 2026-06-17 07:29:18.165952 | debian-bookworm | Loading collection cisco.ucs from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/cisco/ucs 2026-06-17 07:29:18.166227 | debian-bookworm | Found installed collection cisco.ucs:1.16.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/cisco/ucs' 2026-06-17 07:29:18.169189 | debian-bookworm | Loading collection community.aws from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/aws 2026-06-17 07:29:18.169605 | debian-bookworm | Found installed collection community.aws:9.3.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/aws' 2026-06-17 07:29:18.169977 | debian-bookworm | Loading collection cisco.ise from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/cisco/ise 2026-06-17 07:29:18.170254 | debian-bookworm | Found installed collection cisco.ise:2.10.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/cisco/ise' 2026-06-17 07:29:18.170863 | debian-bookworm | Loading collection cisco.ios from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/cisco/ios 2026-06-17 07:29:18.171259 | debian-bookworm | Found installed collection cisco.ios:9.2.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/cisco/ios' 2026-06-17 07:29:18.172071 | debian-bookworm | Loading collection netapp.ontap from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/netapp/ontap 2026-06-17 07:29:18.172485 | debian-bookworm | Found installed collection netapp.ontap:22.14.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/netapp/ontap' 2026-06-17 07:29:18.173806 | debian-bookworm | Loading collection cisco.mso from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/cisco/mso 2026-06-17 07:29:18.174167 | debian-bookworm | Found installed collection cisco.mso:2.11.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/cisco/mso' 2026-06-17 07:29:18.175085 | debian-bookworm | Loading collection hetzner.hcloud from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/hetzner/hcloud 2026-06-17 07:29:18.175494 | debian-bookworm | Found installed collection hetzner.hcloud:4.3.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/hetzner/hcloud' 2026-06-17 07:29:18.175878 | debian-bookworm | Loading collection purestorage.flashblade from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/purestorage/flashblade 2026-06-17 07:29:18.176230 | debian-bookworm | Found installed collection purestorage.flashblade:1.22.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/purestorage/flashblade' 2026-06-17 07:29:18.176644 | debian-bookworm | Loading collection f5networks.f5_modules from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/f5networks/f5_modules 2026-06-17 07:29:18.176933 | debian-bookworm | Found installed collection f5networks.f5_modules:1.39.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/f5networks/f5_modules' 2026-06-17 07:29:18.177309 | debian-bookworm | Loading collection community.hrobot from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/hrobot 2026-06-17 07:29:18.177614 | debian-bookworm | Found installed collection community.hrobot:2.7.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/hrobot' 2026-06-17 07:29:18.178578 | debian-bookworm | Loading collection amazon.aws from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/amazon/aws 2026-06-17 07:29:18.178951 | debian-bookworm | Found installed collection amazon.aws:9.5.2 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/amazon/aws' 2026-06-17 07:29:18.179324 | debian-bookworm | Loading collection community.dns from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/dns 2026-06-17 07:29:18.179721 | debian-bookworm | Found installed collection community.dns:3.4.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/dns' 2026-06-17 07:29:18.180132 | debian-bookworm | Loading collection wti.remote from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/wti/remote 2026-06-17 07:29:18.180514 | debian-bookworm | Found installed collection wti.remote:1.0.10 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/wti/remote' 2026-06-17 07:29:18.180796 | debian-bookworm | Loading collection community.library_inventory_filtering_v1 from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/library_inventory_filtering_v1 2026-06-17 07:29:18.181175 | debian-bookworm | Found installed collection community.library_inventory_filtering_v1:1.1.5 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/library_inventory_filtering_v1' 2026-06-17 07:29:18.181474 | debian-bookworm | Loading collection cyberark.pas from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/cyberark/pas 2026-06-17 07:29:18.181750 | debian-bookworm | Found installed collection cyberark.pas:1.0.36 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/cyberark/pas' 2026-06-17 07:29:18.182115 | debian-bookworm | Loading collection cisco.intersight from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/cisco/intersight 2026-06-17 07:29:18.182397 | debian-bookworm | Found installed collection cisco.intersight:2.7.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/cisco/intersight' 2026-06-17 07:29:18.182692 | debian-bookworm | Loading collection netapp.cloudmanager from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/netapp/cloudmanager 2026-06-17 07:29:18.182964 | debian-bookworm | Found installed collection netapp.cloudmanager:21.24.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/netapp/cloudmanager' 2026-06-17 07:29:18.183342 | debian-bookworm | Loading collection community.proxmox from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/proxmox 2026-06-17 07:29:18.183685 | debian-bookworm | Found installed collection community.proxmox:1.4.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/proxmox' 2026-06-17 07:29:18.184104 | debian-bookworm | Loading collection cloudscale_ch.cloud from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/cloudscale_ch/cloud 2026-06-17 07:29:18.184406 | debian-bookworm | Found installed collection cloudscale_ch.cloud:2.5.2 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/cloudscale_ch/cloud' 2026-06-17 07:29:18.184802 | debian-bookworm | Loading collection ngine_io.cloudstack from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/ngine_io/cloudstack 2026-06-17 07:29:18.185081 | debian-bookworm | Found installed collection ngine_io.cloudstack:2.5.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/ngine_io/cloudstack' 2026-06-17 07:29:18.185537 | debian-bookworm | Loading collection community.docker from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/docker 2026-06-17 07:29:18.185886 | debian-bookworm | Found installed collection community.docker:4.8.2 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/docker' 2026-06-17 07:29:18.186213 | debian-bookworm | Loading collection community.mongodb from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/mongodb 2026-06-17 07:29:18.186476 | debian-bookworm | Found installed collection community.mongodb:1.7.10 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/mongodb' 2026-06-17 07:29:18.186803 | debian-bookworm | Loading collection infinidat.infinibox from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/infinidat/infinibox 2026-06-17 07:29:18.187055 | debian-bookworm | Found installed collection infinidat.infinibox:1.6.3 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/infinidat/infinibox' 2026-06-17 07:29:18.187381 | debian-bookworm | Loading collection vmware.vmware from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/vmware/vmware 2026-06-17 07:29:18.187689 | debian-bookworm | Found installed collection vmware.vmware:1.11.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/vmware/vmware' 2026-06-17 07:29:18.188219 | debian-bookworm | Loading collection cisco.iosxr from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/cisco/iosxr 2026-06-17 07:29:18.188514 | debian-bookworm | Found installed collection cisco.iosxr:10.3.1 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/cisco/iosxr' 2026-06-17 07:29:18.188853 | debian-bookworm | Loading collection inspur.ispim from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/inspur/ispim 2026-06-17 07:29:18.189139 | debian-bookworm | Found installed collection inspur.ispim:2.2.3 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/inspur/ispim' 2026-06-17 07:29:18.189692 | debian-bookworm | Loading collection dellemc.powerflex from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/dellemc/powerflex 2026-06-17 07:29:18.189965 | debian-bookworm | Found installed collection dellemc.powerflex:2.6.1 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/dellemc/powerflex' 2026-06-17 07:29:18.190202 | debian-bookworm | Loading collection ravendb.ravendb from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/ravendb/ravendb 2026-06-17 07:29:18.190452 | debian-bookworm | Found installed collection ravendb.ravendb:1.0.4 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/ravendb/ravendb' 2026-06-17 07:29:18.192436 | debian-bookworm | Loading collection cisco.meraki from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/cisco/meraki 2026-06-17 07:29:18.192785 | debian-bookworm | Found installed collection cisco.meraki:2.21.8 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/cisco/meraki' 2026-06-17 07:29:18.193277 | debian-bookworm | Loading collection community.crypto from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/crypto 2026-06-17 07:29:18.193527 | debian-bookworm | Found installed collection community.crypto:2.26.6 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/crypto' 2026-06-17 07:29:18.193755 | debian-bookworm | Loading collection ibm.storage_virtualize from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/ibm/storage_virtualize 2026-06-17 07:29:18.194061 | debian-bookworm | Found installed collection ibm.storage_virtualize:2.7.4 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/ibm/storage_virtualize' 2026-06-17 07:29:18.194402 | debian-bookworm | Loading collection cisco.asa from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/cisco/asa 2026-06-17 07:29:18.194634 | debian-bookworm | Found installed collection cisco.asa:6.1.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/cisco/asa' 2026-06-17 07:29:18.194935 | debian-bookworm | Loading collection community.routeros from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/routeros 2026-06-17 07:29:18.195183 | debian-bookworm | Found installed collection community.routeros:3.13.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/routeros' 2026-06-17 07:29:18.195406 | debian-bookworm | Loading collection community.proxysql from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/proxysql 2026-06-17 07:29:18.195645 | debian-bookworm | Found installed collection community.proxysql:1.7.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/proxysql' 2026-06-17 07:29:18.196553 | debian-bookworm | Loading collection arista.eos from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/arista/eos 2026-06-17 07:29:18.196833 | debian-bookworm | Found installed collection arista.eos:10.1.1 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/arista/eos' 2026-06-17 07:29:18.197119 | debian-bookworm | Loading collection kaytus.ksmanage from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/kaytus/ksmanage 2026-06-17 07:29:18.197371 | debian-bookworm | Found installed collection kaytus.ksmanage:2.0.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/kaytus/ksmanage' 2026-06-17 07:29:18.197607 | debian-bookworm | Loading collection hitachivantara.vspone_object from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/hitachivantara/vspone_object 2026-06-17 07:29:18.197869 | debian-bookworm | Found installed collection hitachivantara.vspone_object:1.0.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/hitachivantara/vspone_object' 2026-06-17 07:29:18.206882 | debian-bookworm | Loading collection community.general from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/general 2026-06-17 07:29:18.207361 | debian-bookworm | Found installed collection community.general:10.7.6 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/general' 2026-06-17 07:29:18.207710 | debian-bookworm | Loading collection community.zabbix from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/zabbix 2026-06-17 07:29:18.208213 | debian-bookworm | Found installed collection community.zabbix:3.3.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/zabbix' 2026-06-17 07:29:18.208541 | debian-bookworm | Loading collection community.rabbitmq from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/rabbitmq 2026-06-17 07:29:18.208872 | debian-bookworm | Found installed collection community.rabbitmq:1.6.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/rabbitmq' 2026-06-17 07:29:18.209289 | debian-bookworm | Loading collection telekom_mms.icinga_director from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/telekom_mms/icinga_director 2026-06-17 07:29:18.209597 | debian-bookworm | Found installed collection telekom_mms.icinga_director:2.4.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/telekom_mms/icinga_director' 2026-06-17 07:29:18.209879 | debian-bookworm | Loading collection check_point.mgmt from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/check_point/mgmt 2026-06-17 07:29:18.210261 | debian-bookworm | Found installed collection check_point.mgmt:6.6.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/check_point/mgmt' 2026-06-17 07:29:18.215492 | debian-bookworm | Loading collection fortinet.fortimanager from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/fortinet/fortimanager 2026-06-17 07:29:18.215977 | debian-bookworm | Found installed collection fortinet.fortimanager:2.11.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/fortinet/fortimanager' 2026-06-17 07:29:18.220313 | debian-bookworm | Loading collection osism.services from /home/zuul/.ansible/collections/ansible_collections/osism/services 2026-06-17 07:29:18.221127 | debian-bookworm | Found installed collection osism.services:999.0.0 at '/home/zuul/.ansible/collections/ansible_collections/osism/services' 2026-06-17 07:29:18.221451 | debian-bookworm | Loading collection osism.commons from /home/zuul/.ansible/collections/ansible_collections/osism/commons 2026-06-17 07:29:18.222161 | debian-bookworm | Found installed collection osism.commons:0.20260601.0 at '/home/zuul/.ansible/collections/ansible_collections/osism/commons' 2026-06-17 07:29:18.223805 | debian-bookworm | Starting galaxy collection install process 2026-06-17 07:29:18.224149 | debian-bookworm | Nothing to do. All requested collections are already installed. If you want to reinstall them, consider using `--force`. 2026-06-17 07:29:18.289909 | debian-bookworm | INFO [delegated > dependency] Dependency completed successfully. 2026-06-17 07:29:18.290104 | debian-bookworm | WARNING [delegated > dependency] Executed: Missing roles requirements file: requirements.yml (Remove from converge_sequence to suppress) 2026-06-17 07:29:18.298879 | debian-bookworm | INFO [delegated > create] Executing 2026-06-17 07:29:18.300899 | debian-bookworm | WARNING [delegated > create] Executed: Missing playbook (Remove from converge_sequence to suppress) 2026-06-17 07:29:18.308695 | debian-bookworm | INFO [delegated > prepare] Executing 2026-06-17 07:29:18.308820 | debian-bookworm | WARNING [delegated > prepare] Skipping, instances already prepared. 2026-06-17 07:29:18.308921 | debian-bookworm | INFO [delegated > prepare] Executed: Successful 2026-06-17 07:29:18.316689 | debian-bookworm | INFO [delegated > converge] Executing 2026-06-17 07:29:18.509792 | ubuntu-noble | INFO [delegated > dependency] Executing 2026-06-17 07:29:18.510328 | ubuntu-noble | WARNING [delegated > dependency] Missing roles requirements file: requirements.yml 2026-06-17 07:29:18.664159 | debian-bookworm | DEBUG [delegated > converge] ansible-playbook version: ansible-playbook 2026-06-17 07:29:18.664221 | debian-bookworm | config file = None 2026-06-17 07:29:18.664227 | debian-bookworm | configured module search path = 2026-06-17 07:29:18.664232 | debian-bookworm | ansible python module location = /home/zuul/venv/lib/python3.11/site-packages/ansible 2026-06-17 07:29:18.664237 | debian-bookworm | ansible collection location = /home/zuul/.ansible/collections:/usr/share/ansible/collections 2026-06-17 07:29:18.664242 | debian-bookworm | executable location = /home/zuul/venv/bin/ansible-playbook 2026-06-17 07:29:18.664246 | debian-bookworm | python version = 3.11.2 (main, Apr 8 2026, 01:58:00) (/home/zuul/venv/bin/python3) 2026-06-17 07:29:18.664250 | debian-bookworm | jinja version = 3.1.6 2026-06-17 07:29:18.664254 | debian-bookworm | libyaml = True 2026-06-17 07:29:18.664258 | debian-bookworm | DEBUG ANSIBLE ENVIRONMENT: 2026-06-17 07:29:18.664262 | debian-bookworm | ANSIBLE_COLLECTIONS_PATH: /home/zuul/venv/.ansible/collections:/home/zuul/.ansible/collections 2026-06-17 07:29:18.664265 | debian-bookworm | ANSIBLE_CONFIG: /home/zuul/.ansible/tmp/molecule.oWZD.delegated/ansible.cfg 2026-06-17 07:29:18.664269 | debian-bookworm | ANSIBLE_LIBRARY: ../../plugins 2026-06-17 07:29:18.664273 | debian-bookworm | ANSIBLE_PYTHON_INTERPRETER: /home/zuul/venv/bin/python 2026-06-17 07:29:18.664277 | debian-bookworm | ANSIBLE_ROLE: auditd 2026-06-17 07:29:18.664280 | debian-bookworm | ANSIBLE_ROLES_PATH: ../../roles 2026-06-17 07:29:18.664284 | debian-bookworm | ANSIBLE_VERBOSITY: 1 2026-06-17 07:29:18.664288 | debian-bookworm | 2026-06-17 07:29:18.664292 | debian-bookworm | DEBUG MOLECULE ENVIRONMENT: 2026-06-17 07:29:18.664296 | debian-bookworm | MOLECULE_DEBUG: True 2026-06-17 07:29:18.664299 | debian-bookworm | MOLECULE_DEPENDENCY_NAME: galaxy 2026-06-17 07:29:18.664321 | debian-bookworm | MOLECULE_DRIVER_NAME: default 2026-06-17 07:29:18.664325 | debian-bookworm | MOLECULE_ENV_FILE: /home/zuul/src/github.com/osism/ansible-collection-services/.env.yml 2026-06-17 07:29:18.664329 | debian-bookworm | MOLECULE_EPHEMERAL_DIRECTORY: /home/zuul/.ansible/tmp/molecule.oWZD.delegated 2026-06-17 07:29:18.664336 | debian-bookworm | MOLECULE_FILE: /home/zuul/.ansible/tmp/molecule.oWZD.delegated/molecule.yml 2026-06-17 07:29:18.664340 | debian-bookworm | MOLECULE_INSTANCE_CONFIG: /home/zuul/.ansible/tmp/molecule.oWZD.delegated/instance_config.yml 2026-06-17 07:29:18.664345 | debian-bookworm | MOLECULE_INVENTORY_FILE: /home/zuul/.ansible/tmp/molecule.oWZD.delegated/inventory/ansible_inventory.yml 2026-06-17 07:29:18.664350 | debian-bookworm | MOLECULE_PROJECT_DIRECTORY: /home/zuul/src/github.com/osism/ansible-collection-services 2026-06-17 07:29:18.664354 | debian-bookworm | MOLECULE_PROVISIONER_NAME: ansible 2026-06-17 07:29:18.664358 | debian-bookworm | MOLECULE_SCENARIO_DIRECTORY: /home/zuul/src/github.com/osism/ansible-collection-services/molecule/delegated 2026-06-17 07:29:18.664363 | debian-bookworm | MOLECULE_SCENARIO_NAME: delegated 2026-06-17 07:29:18.664366 | debian-bookworm | MOLECULE_STATE_FILE: /home/zuul/.ansible/tmp/molecule.oWZD.delegated/state.yml 2026-06-17 07:29:18.664370 | debian-bookworm | MOLECULE_VERIFIER_NAME: testinfra 2026-06-17 07:29:18.664374 | debian-bookworm | MOLECULE_VERIFIER_TEST_DIRECTORY: /home/zuul/src/github.com/osism/ansible-collection-services/molecule/delegated/tests 2026-06-17 07:29:18.664378 | debian-bookworm | 2026-06-17 07:29:18.664389 | debian-bookworm | DEBUG SHELL REPLAY: ANSIBLE_COLLECTIONS_PATH=/home/zuul/venv/.ansible/collections:/home/zuul/.ansible/collections ANSIBLE_CONFIG=/home/zuul/.ansible/tmp/molecule.oWZD.delegated/ansible.cfg ANSIBLE_LIBRARY=../../plugins ANSIBLE_PYTHON_INTERPRETER=/home/zuul/venv/bin/python ANSIBLE_ROLE=auditd ANSIBLE_ROLES_PATH=../../roles ANSIBLE_VERBOSITY=1 MOLECULE_DEBUG=True MOLECULE_DEPENDENCY_NAME=galaxy MOLECULE_DRIVER_NAME=default MOLECULE_ENV_FILE=/home/zuul/src/github.com/osism/ansible-collection-services/.env.yml MOLECULE_EPHEMERAL_DIRECTORY=/home/zuul/.ansible/tmp/molecule.oWZD.delegated MOLECULE_FILE=/home/zuul/.ansible/tmp/molecule.oWZD.delegated/molecule.yml MOLECULE_INSTANCE_CONFIG=/home/zuul/.ansible/tmp/molecule.oWZD.delegated/instance_config.yml MOLECULE_INVENTORY_FILE=/home/zuul/.ansible/tmp/molecule.oWZD.delegated/inventory/ansible_inventory.yml MOLECULE_PROJECT_DIRECTORY=/home/zuul/src/github.com/osism/ansible-collection-services MOLECULE_PROVISIONER_NAME=ansible MOLECULE_SCENARIO_DIRECTORY=/home/zuul/src/github.com/osism/ansible-collection-services/molecule/delegated MOLECULE_SCENARIO_NAME=delegated MOLECULE_STATE_FILE=/home/zuul/.ansible/tmp/molecule.oWZD.delegated/state.yml MOLECULE_VERIFIER_NAME=testinfra MOLECULE_VERIFIER_TEST_DIRECTORY=/home/zuul/src/github.com/osism/ansible-collection-services/molecule/delegated/tests 2026-06-17 07:29:18.996472 | ubuntu-noble | ansible-galaxy [core 2.18.17] 2026-06-17 07:29:18.997135 | ubuntu-noble | config file = None 2026-06-17 07:29:18.997640 | ubuntu-noble | configured module search path = ['/home/zuul/src/github.com/osism/ansible-collection-services/plugins/modules', '/home/zuul/.ansible/plugins/modules', '/usr/share/ansible/plugins/modules'] 2026-06-17 07:29:18.998032 | ubuntu-noble | ansible python module location = /home/zuul/venv/lib/python3.12/site-packages/ansible 2026-06-17 07:29:19.000619 | ubuntu-noble | ansible collection location = /home/zuul/.ansible/collections:/usr/share/ansible/collections:/home/zuul/venv/lib/python3.12/site-packages:/home/zuul/venv/lib/python3.12/dist-packages:/home/zuul/venv/lib/python3/dist-packages:/home/zuul/venv/local/lib/python3.12/dist-packages 2026-06-17 07:29:19.000673 | ubuntu-noble | executable location = /home/zuul/venv/bin/ansible-galaxy 2026-06-17 07:29:19.000686 | ubuntu-noble | python version = 3.12.3 (main, Mar 23 2026, 19:04:32) [GCC 13.3.0] (/home/zuul/venv/bin/python3) 2026-06-17 07:29:19.000696 | ubuntu-noble | jinja version = 3.1.6 2026-06-17 07:29:19.000707 | ubuntu-noble | libyaml = True 2026-06-17 07:29:19.000717 | ubuntu-noble | No config file found; using defaults 2026-06-17 07:29:19.000728 | ubuntu-noble | Reading requirement file at '/home/zuul/src/github.com/osism/ansible-collection-services/molecule/delegated/collections.yml' 2026-06-17 07:29:19.012228 | ubuntu-noble | Loading collection osism.commons from /home/zuul/.ansible/collections/ansible_collections/osism/commons 2026-06-17 07:29:19.014071 | ubuntu-noble | Found installed collection osism.commons:0.20260601.0 at '/home/zuul/.ansible/collections/ansible_collections/osism/commons' 2026-06-17 07:29:19.015343 | ubuntu-noble | Loading collection osism.services from /home/zuul/.ansible/collections/ansible_collections/osism/services 2026-06-17 07:29:19.015839 | ubuntu-noble | Found installed collection osism.services:999.0.0 at '/home/zuul/.ansible/collections/ansible_collections/osism/services' 2026-06-17 07:29:19.026818 | ubuntu-noble | Loading collection community.ciscosmb from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/ciscosmb 2026-06-17 07:29:19.027302 | ubuntu-noble | Found installed collection community.ciscosmb:1.0.11 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/ciscosmb' 2026-06-17 07:29:19.027806 | ubuntu-noble | Loading collection hitachivantara.vspone_object from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/hitachivantara/vspone_object 2026-06-17 07:29:19.028194 | ubuntu-noble | Found installed collection hitachivantara.vspone_object:1.0.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/hitachivantara/vspone_object' 2026-06-17 07:29:19.028691 | ubuntu-noble | Loading collection community.crypto from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/crypto 2026-06-17 07:29:19.029050 | ubuntu-noble | Found installed collection community.crypto:2.26.6 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/crypto' 2026-06-17 07:29:19.035085 | ubuntu-noble | Loading collection fortinet.fortimanager from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/fortinet/fortimanager 2026-06-17 07:29:19.035383 | ubuntu-noble | Found installed collection fortinet.fortimanager:2.11.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/fortinet/fortimanager' 2026-06-17 07:29:19.035685 | ubuntu-noble | Loading collection grafana.grafana from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/grafana/grafana 2026-06-17 07:29:19.036053 | ubuntu-noble | Found installed collection grafana.grafana:5.7.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/grafana/grafana' 2026-06-17 07:29:19.036432 | ubuntu-noble | Loading collection netapp.storagegrid from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/netapp/storagegrid 2026-06-17 07:29:19.036725 | ubuntu-noble | Found installed collection netapp.storagegrid:21.14.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/netapp/storagegrid' 2026-06-17 07:29:19.037161 | ubuntu-noble | Loading collection ansible.windows from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/ansible/windows 2026-06-17 07:29:19.038109 | ubuntu-noble | Found installed collection ansible.windows:2.8.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/ansible/windows' 2026-06-17 07:29:19.040923 | ubuntu-noble | Loading collection community.vmware from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/vmware 2026-06-17 07:29:19.041451 | ubuntu-noble | Found installed collection community.vmware:5.10.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/vmware' 2026-06-17 07:29:19.042459 | ubuntu-noble | Loading collection netapp.ontap from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/netapp/ontap 2026-06-17 07:29:19.043044 | ubuntu-noble | Found installed collection netapp.ontap:22.14.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/netapp/ontap' 2026-06-17 07:29:19.043474 | ubuntu-noble | Loading collection community.mysql from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/mysql 2026-06-17 07:29:19.043959 | ubuntu-noble | Found installed collection community.mysql:3.16.1 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/mysql' 2026-06-17 07:29:19.044336 | ubuntu-noble | Loading collection kaytus.ksmanage from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/kaytus/ksmanage 2026-06-17 07:29:19.044742 | ubuntu-noble | Found installed collection kaytus.ksmanage:2.0.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/kaytus/ksmanage' 2026-06-17 07:29:19.045195 | ubuntu-noble | Loading collection dellemc.openmanage from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/dellemc/openmanage 2026-06-17 07:29:19.045644 | ubuntu-noble | Found installed collection dellemc.openmanage:9.12.3 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/dellemc/openmanage' 2026-06-17 07:29:19.046010 | ubuntu-noble | Loading collection community.routeros from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/routeros 2026-06-17 07:29:19.046416 | ubuntu-noble | Found installed collection community.routeros:3.13.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/routeros' 2026-06-17 07:29:19.046774 | ubuntu-noble | Loading collection splunk.es from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/splunk/es 2026-06-17 07:29:19.047188 | ubuntu-noble | Found installed collection splunk.es:4.0.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/splunk/es' 2026-06-17 07:29:19.078479 | ubuntu-noble | Loading collection azure.azcollection from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/azure/azcollection 2026-06-17 07:29:19.079073 | ubuntu-noble | Found installed collection azure.azcollection:3.10.1 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/azure/azcollection' 2026-06-17 07:29:19.081638 | ubuntu-noble | Loading collection cyberark.conjur from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/cyberark/conjur 2026-06-17 07:29:19.081688 | ubuntu-noble | Found installed collection cyberark.conjur:1.3.8 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/cyberark/conjur' 2026-06-17 07:29:19.081725 | ubuntu-noble | Loading collection community.hrobot from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/hrobot 2026-06-17 07:29:19.081739 | ubuntu-noble | Found installed collection community.hrobot:2.7.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/hrobot' 2026-06-17 07:29:19.081817 | ubuntu-noble | Loading collection infinidat.infinibox from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/infinidat/infinibox 2026-06-17 07:29:19.082291 | ubuntu-noble | Found installed collection infinidat.infinibox:1.6.3 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/infinidat/infinibox' 2026-06-17 07:29:19.082783 | ubuntu-noble | Loading collection ibm.storage_virtualize from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/ibm/storage_virtualize 2026-06-17 07:29:19.083396 | ubuntu-noble | Found installed collection ibm.storage_virtualize:2.7.4 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/ibm/storage_virtualize' 2026-06-17 07:29:19.083805 | ubuntu-noble | Loading collection community.docker from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/docker 2026-06-17 07:29:19.084137 | ubuntu-noble | Found installed collection community.docker:4.8.2 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/docker' 2026-06-17 07:29:19.084448 | ubuntu-noble | Loading collection community.library_inventory_filtering_v1 from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/library_inventory_filtering_v1 2026-06-17 07:29:19.084870 | ubuntu-noble | Found installed collection community.library_inventory_filtering_v1:1.1.5 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/library_inventory_filtering_v1' 2026-06-17 07:29:19.085194 | ubuntu-noble | Loading collection openstack.cloud from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/openstack/cloud 2026-06-17 07:29:19.085592 | ubuntu-noble | Found installed collection openstack.cloud:2.5.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/openstack/cloud' 2026-06-17 07:29:19.085860 | ubuntu-noble | Loading collection infoblox.nios_modules from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/infoblox/nios_modules 2026-06-17 07:29:19.086138 | ubuntu-noble | Found installed collection infoblox.nios_modules:1.8.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/infoblox/nios_modules' 2026-06-17 07:29:19.086390 | ubuntu-noble | Loading collection ansible.netcommon from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/ansible/netcommon 2026-06-17 07:29:19.086683 | ubuntu-noble | Found installed collection ansible.netcommon:7.2.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/ansible/netcommon' 2026-06-17 07:29:19.087816 | ubuntu-noble | Loading collection cisco.nxos from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/cisco/nxos 2026-06-17 07:29:19.088107 | ubuntu-noble | Found installed collection cisco.nxos:9.4.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/cisco/nxos' 2026-06-17 07:29:19.091996 | ubuntu-noble | Loading collection community.aws from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/aws 2026-06-17 07:29:19.092321 | ubuntu-noble | Found installed collection community.aws:9.3.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/aws' 2026-06-17 07:29:19.093396 | ubuntu-noble | Loading collection kubernetes.core from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/kubernetes/core 2026-06-17 07:29:19.093947 | ubuntu-noble | Found installed collection kubernetes.core:5.4.1 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/kubernetes/core' 2026-06-17 07:29:19.094271 | ubuntu-noble | Loading collection community.rabbitmq from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/rabbitmq 2026-06-17 07:29:19.094606 | ubuntu-noble | Found installed collection community.rabbitmq:1.6.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/rabbitmq' 2026-06-17 07:29:19.094974 | ubuntu-noble | Loading collection community.digitalocean from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/digitalocean 2026-06-17 07:29:19.095346 | ubuntu-noble | Found installed collection community.digitalocean:1.27.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/digitalocean' 2026-06-17 07:29:19.095724 | ubuntu-noble | Loading collection ansible.posix from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/ansible/posix 2026-06-17 07:29:19.095989 | ubuntu-noble | Found installed collection ansible.posix:1.6.2 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/ansible/posix' 2026-06-17 07:29:19.096318 | ubuntu-noble | Loading collection check_point.mgmt from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/check_point/mgmt 2026-06-17 07:29:19.096738 | ubuntu-noble | Found installed collection check_point.mgmt:6.6.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/check_point/mgmt' 2026-06-17 07:29:19.098293 | ubuntu-noble | Loading collection theforeman.foreman from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/theforeman/foreman 2026-06-17 07:29:19.098751 | ubuntu-noble | Found installed collection theforeman.foreman:4.2.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/theforeman/foreman' 2026-06-17 07:29:19.099072 | ubuntu-noble | Loading collection community.sops from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/sops 2026-06-17 07:29:19.099382 | ubuntu-noble | Found installed collection community.sops:2.2.7 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/sops' 2026-06-17 07:29:19.099675 | ubuntu-noble | Loading collection community.okd from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/okd 2026-06-17 07:29:19.100007 | ubuntu-noble | Found installed collection community.okd:4.0.2 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/okd' 2026-06-17 07:29:19.100258 | ubuntu-noble | Loading collection cisco.asa from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/cisco/asa 2026-06-17 07:29:19.100626 | ubuntu-noble | Found installed collection cisco.asa:6.1.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/cisco/asa' 2026-06-17 07:29:19.100884 | ubuntu-noble | Loading collection cloud.common from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/cloud/common 2026-06-17 07:29:19.101201 | ubuntu-noble | Found installed collection cloud.common:4.2.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/cloud/common' 2026-06-17 07:29:19.101510 | ubuntu-noble | Loading collection dellemc.unity from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/dellemc/unity 2026-06-17 07:29:19.101923 | ubuntu-noble | Found installed collection dellemc.unity:2.1.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/dellemc/unity' 2026-06-17 07:29:19.102696 | ubuntu-noble | Loading collection arista.eos from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/arista/eos 2026-06-17 07:29:19.102995 | ubuntu-noble | Found installed collection arista.eos:10.1.1 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/arista/eos' 2026-06-17 07:29:19.103278 | ubuntu-noble | Loading collection netapp_eseries.santricity from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/netapp_eseries/santricity 2026-06-17 07:29:19.104097 | ubuntu-noble | Found installed collection netapp_eseries.santricity:1.4.1 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/netapp_eseries/santricity' 2026-06-17 07:29:19.104119 | ubuntu-noble | Loading collection netapp.cloudmanager from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/netapp/cloudmanager 2026-06-17 07:29:19.104126 | ubuntu-noble | Found installed collection netapp.cloudmanager:21.24.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/netapp/cloudmanager' 2026-06-17 07:29:19.105488 | ubuntu-noble | Loading collection cisco.mso from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/cisco/mso 2026-06-17 07:29:19.106447 | ubuntu-noble | Found installed collection cisco.mso:2.11.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/cisco/mso' 2026-06-17 07:29:19.106481 | ubuntu-noble | Loading collection inspur.ispim from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/inspur/ispim 2026-06-17 07:29:19.106510 | ubuntu-noble | Found installed collection inspur.ispim:2.2.3 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/inspur/ispim' 2026-06-17 07:29:19.109578 | ubuntu-noble | Loading collection cisco.aci from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/cisco/aci 2026-06-17 07:29:19.109610 | ubuntu-noble | Found installed collection cisco.aci:2.12.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/cisco/aci' 2026-06-17 07:29:19.109618 | ubuntu-noble | Loading collection telekom_mms.icinga_director from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/telekom_mms/icinga_director 2026-06-17 07:29:19.109625 | ubuntu-noble | Found installed collection telekom_mms.icinga_director:2.4.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/telekom_mms/icinga_director' 2026-06-17 07:29:19.109631 | ubuntu-noble | Loading collection community.postgresql from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/postgresql 2026-06-17 07:29:19.109832 | ubuntu-noble | Found installed collection community.postgresql:3.14.2 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/postgresql' 2026-06-17 07:29:19.110884 | ubuntu-noble | Loading collection junipernetworks.junos from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/junipernetworks/junos 2026-06-17 07:29:19.111154 | ubuntu-noble | Found installed collection junipernetworks.junos:9.1.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/junipernetworks/junos' 2026-06-17 07:29:19.111402 | ubuntu-noble | Loading collection containers.podman from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/containers/podman 2026-06-17 07:29:19.111732 | ubuntu-noble | Found installed collection containers.podman:1.18.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/containers/podman' 2026-06-17 07:29:19.115667 | ubuntu-noble | Loading collection fortinet.fortios from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/fortinet/fortios 2026-06-17 07:29:19.115943 | ubuntu-noble | Found installed collection fortinet.fortios:2.4.2 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/fortinet/fortios' 2026-06-17 07:29:19.116234 | ubuntu-noble | Loading collection cisco.intersight from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/cisco/intersight 2026-06-17 07:29:19.116587 | ubuntu-noble | Found installed collection cisco.intersight:2.7.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/cisco/intersight' 2026-06-17 07:29:19.117231 | ubuntu-noble | Loading collection cisco.ios from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/cisco/ios 2026-06-17 07:29:19.117595 | ubuntu-noble | Found installed collection cisco.ios:9.2.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/cisco/ios' 2026-06-17 07:29:19.117880 | ubuntu-noble | Loading collection microsoft.ad from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/microsoft/ad 2026-06-17 07:29:19.118130 | ubuntu-noble | Found installed collection microsoft.ad:1.9.2 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/microsoft/ad' 2026-06-17 07:29:19.119416 | ubuntu-noble | Loading collection f5networks.f5_modules from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/f5networks/f5_modules 2026-06-17 07:29:19.120183 | ubuntu-noble | Found installed collection f5networks.f5_modules:1.39.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/f5networks/f5_modules' 2026-06-17 07:29:19.161290 | ubuntu-noble | Loading collection community.network from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/network 2026-06-17 07:29:19.162057 | ubuntu-noble | Found installed collection community.network:5.1.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/network' 2026-06-17 07:29:19.165083 | ubuntu-noble | Loading collection vmware.vmware_rest from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/vmware/vmware_rest 2026-06-17 07:29:19.165659 | ubuntu-noble | Found installed collection vmware.vmware_rest:4.9.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/vmware/vmware_rest' 2026-06-17 07:29:19.166150 | ubuntu-noble | Loading collection wti.remote from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/wti/remote 2026-06-17 07:29:19.166734 | ubuntu-noble | Found installed collection wti.remote:1.0.10 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/wti/remote' 2026-06-17 07:29:19.167735 | ubuntu-noble | Loading collection chocolatey.chocolatey from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/chocolatey/chocolatey 2026-06-17 07:29:18.940241 | debian-bookworm | Using /home/zuul/.ansible/tmp/molecule.oWZD.delegated/ansible.cfg as config file 2026-06-17 07:29:19.197631 | debian-bookworm | 2026-06-17 07:29:19.197942 | debian-bookworm | PLAY [Converge] **************************************************************** 2026-06-17 07:29:19.198211 | debian-bookworm | 2026-06-17 07:29:19.198523 | debian-bookworm | TASK [Gathering Facts] ********************************************************* 2026-06-17 07:29:19.167775 | ubuntu-noble | Found installed collection chocolatey.chocolatey:1.5.3 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/chocolatey/chocolatey' 2026-06-17 07:29:19.169592 | ubuntu-noble | Loading collection amazon.aws from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/amazon/aws 2026-06-17 07:29:19.169632 | ubuntu-noble | Found installed collection amazon.aws:9.5.2 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/amazon/aws' 2026-06-17 07:29:19.169645 | ubuntu-noble | Loading collection vmware.vmware from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/vmware/vmware 2026-06-17 07:29:19.169877 | ubuntu-noble | Found installed collection vmware.vmware:1.11.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/vmware/vmware' 2026-06-17 07:29:19.170307 | ubuntu-noble | Loading collection cisco.ucs from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/cisco/ucs 2026-06-17 07:29:19.170786 | ubuntu-noble | Found installed collection cisco.ucs:1.16.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/cisco/ucs' 2026-06-17 07:29:19.171163 | ubuntu-noble | Loading collection ieisystem.inmanage from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/ieisystem/inmanage 2026-06-17 07:29:19.171505 | ubuntu-noble | Found installed collection ieisystem.inmanage:3.0.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/ieisystem/inmanage' 2026-06-17 07:29:19.172031 | ubuntu-noble | Loading collection google.cloud from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/google/cloud 2026-06-17 07:29:19.172337 | ubuntu-noble | Found installed collection google.cloud:1.9.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/google/cloud' 2026-06-17 07:29:19.181719 | ubuntu-noble | Loading collection community.general from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/general 2026-06-17 07:29:19.182275 | ubuntu-noble | Found installed collection community.general:10.7.6 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/general' 2026-06-17 07:29:19.182745 | ubuntu-noble | Loading collection lowlydba.sqlserver from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/lowlydba/sqlserver 2026-06-17 07:29:19.183328 | ubuntu-noble | Found installed collection lowlydba.sqlserver:2.7.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/lowlydba/sqlserver' 2026-06-17 07:29:19.183752 | ubuntu-noble | Loading collection dellemc.enterprise_sonic from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/dellemc/enterprise_sonic 2026-06-17 07:29:19.184216 | ubuntu-noble | Found installed collection dellemc.enterprise_sonic:2.5.1 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/dellemc/enterprise_sonic' 2026-06-17 07:29:19.184631 | ubuntu-noble | Loading collection ovirt.ovirt from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/ovirt/ovirt 2026-06-17 07:29:19.185082 | ubuntu-noble | Found installed collection ovirt.ovirt:3.2.1 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/ovirt/ovirt' 2026-06-17 07:29:19.185428 | ubuntu-noble | Loading collection cyberark.pas from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/cyberark/pas 2026-06-17 07:29:19.186007 | ubuntu-noble | Found installed collection cyberark.pas:1.0.36 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/cyberark/pas' 2026-06-17 07:29:19.186461 | ubuntu-noble | Loading collection vultr.cloud from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/vultr/cloud 2026-06-17 07:29:19.188601 | ubuntu-noble | Found installed collection vultr.cloud:1.13.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/vultr/cloud' 2026-06-17 07:29:19.188644 | ubuntu-noble | Loading collection community.windows from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/windows 2026-06-17 07:29:19.188680 | ubuntu-noble | Found installed collection community.windows:2.4.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/windows' 2026-06-17 07:29:19.188690 | ubuntu-noble | Loading collection community.mongodb from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/mongodb 2026-06-17 07:29:19.188896 | ubuntu-noble | Found installed collection community.mongodb:1.7.10 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/mongodb' 2026-06-17 07:29:19.189229 | ubuntu-noble | Loading collection community.libvirt from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/libvirt 2026-06-17 07:29:19.189617 | ubuntu-noble | Found installed collection community.libvirt:1.4.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/libvirt' 2026-06-17 07:29:19.190049 | ubuntu-noble | Loading collection awx.awx from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/awx/awx 2026-06-17 07:29:19.190588 | ubuntu-noble | Found installed collection awx.awx:24.6.1 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/awx/awx' 2026-06-17 07:29:19.191091 | ubuntu-noble | Loading collection community.hashi_vault from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/hashi_vault 2026-06-17 07:29:19.191462 | ubuntu-noble | Found installed collection community.hashi_vault:6.2.1 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/hashi_vault' 2026-06-17 07:29:19.192101 | ubuntu-noble | Loading collection community.zabbix from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/zabbix 2026-06-17 07:29:19.192408 | ubuntu-noble | Found installed collection community.zabbix:3.3.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/zabbix' 2026-06-17 07:29:19.192756 | ubuntu-noble | Loading collection community.proxysql from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/proxysql 2026-06-17 07:29:19.192996 | ubuntu-noble | Found installed collection community.proxysql:1.7.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/proxysql' 2026-06-17 07:29:19.193284 | ubuntu-noble | Loading collection ansible.utils from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/ansible/utils 2026-06-17 07:29:19.193494 | ubuntu-noble | Found installed collection ansible.utils:5.1.2 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/ansible/utils' 2026-06-17 07:29:19.193777 | ubuntu-noble | Loading collection kubevirt.core from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/kubevirt/core 2026-06-17 07:29:19.194107 | ubuntu-noble | Found installed collection kubevirt.core:2.2.3 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/kubevirt/core' 2026-06-17 07:29:19.194419 | ubuntu-noble | Loading collection community.sap_libs from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/sap_libs 2026-06-17 07:29:19.194866 | ubuntu-noble | Found installed collection community.sap_libs:1.5.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/sap_libs' 2026-06-17 07:29:19.195141 | ubuntu-noble | Loading collection cloudscale_ch.cloud from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/cloudscale_ch/cloud 2026-06-17 07:29:19.195354 | ubuntu-noble | Found installed collection cloudscale_ch.cloud:2.5.2 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/cloudscale_ch/cloud' 2026-06-17 07:29:19.195648 | ubuntu-noble | Loading collection purestorage.flasharray from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/purestorage/flasharray 2026-06-17 07:29:19.195963 | ubuntu-noble | Found installed collection purestorage.flasharray:1.39.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/purestorage/flasharray' 2026-06-17 07:29:19.196263 | ubuntu-noble | Loading collection microsoft.iis from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/microsoft/iis 2026-06-17 07:29:19.196560 | ubuntu-noble | Found installed collection microsoft.iis:1.0.3 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/microsoft/iis' 2026-06-17 07:29:19.196782 | ubuntu-noble | Loading collection purestorage.flashblade from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/purestorage/flashblade 2026-06-17 07:29:19.197046 | ubuntu-noble | Found installed collection purestorage.flashblade:1.22.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/purestorage/flashblade' 2026-06-17 07:29:19.197508 | ubuntu-noble | Loading collection sensu.sensu_go from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/sensu/sensu_go 2026-06-17 07:29:19.198147 | ubuntu-noble | Found installed collection sensu.sensu_go:1.14.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/sensu/sensu_go' 2026-06-17 07:29:19.198457 | ubuntu-noble | Loading collection ibm.qradar from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/ibm/qradar 2026-06-17 07:29:19.198752 | ubuntu-noble | Found installed collection ibm.qradar:4.0.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/ibm/qradar' 2026-06-17 07:29:19.199003 | ubuntu-noble | Loading collection community.grafana from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/grafana 2026-06-17 07:29:19.199230 | ubuntu-noble | Found installed collection community.grafana:2.3.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/grafana' 2026-06-17 07:29:19.199402 | ubuntu-noble | Loading collection vyos.vyos from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/vyos/vyos 2026-06-17 07:29:19.200327 | ubuntu-noble | Found installed collection vyos.vyos:5.0.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/vyos/vyos' 2026-06-17 07:29:19.200346 | ubuntu-noble | Loading collection ibm.spectrum_virtualize from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/ibm/spectrum_virtualize 2026-06-17 07:29:19.200352 | ubuntu-noble | Found installed collection ibm.spectrum_virtualize:2.0.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/ibm/spectrum_virtualize' 2026-06-17 07:29:19.200358 | ubuntu-noble | Loading collection community.proxmox from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/proxmox 2026-06-17 07:29:19.200363 | ubuntu-noble | Found installed collection community.proxmox:1.4.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/proxmox' 2026-06-17 07:29:19.202617 | ubuntu-noble | Loading collection ngine_io.cloudstack from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/ngine_io/cloudstack 2026-06-17 07:29:19.202691 | ubuntu-noble | Found installed collection ngine_io.cloudstack:2.5.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/ngine_io/cloudstack' 2026-06-17 07:29:19.202709 | ubuntu-noble | Loading collection hetzner.hcloud from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/hetzner/hcloud 2026-06-17 07:29:19.203108 | ubuntu-noble | Found installed collection hetzner.hcloud:4.3.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/hetzner/hcloud' 2026-06-17 07:29:19.203681 | ubuntu-noble | Loading collection hitachivantara.vspone_block from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/hitachivantara/vspone_block 2026-06-17 07:29:19.204260 | ubuntu-noble | Found installed collection hitachivantara.vspone_block:3.5.1 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/hitachivantara/vspone_block' 2026-06-17 07:29:19.204870 | ubuntu-noble | Loading collection ravendb.ravendb from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/ravendb/ravendb 2026-06-17 07:29:19.205614 | ubuntu-noble | Found installed collection ravendb.ravendb:1.0.4 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/ravendb/ravendb' 2026-06-17 07:29:19.206143 | ubuntu-noble | Loading collection community.dns from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/dns 2026-06-17 07:29:19.206697 | ubuntu-noble | Found installed collection community.dns:3.4.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/dns' 2026-06-17 07:29:19.207168 | ubuntu-noble | Loading collection cisco.dnac from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/cisco/dnac 2026-06-17 07:29:19.207688 | ubuntu-noble | Found installed collection cisco.dnac:6.31.3 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/cisco/dnac' 2026-06-17 07:29:19.208318 | ubuntu-noble | Loading collection netbox.netbox from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/netbox/netbox 2026-06-17 07:29:19.208809 | ubuntu-noble | Found installed collection netbox.netbox:3.21.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/netbox/netbox' 2026-06-17 07:29:19.209261 | ubuntu-noble | Loading collection dellemc.powerflex from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/dellemc/powerflex 2026-06-17 07:29:19.209783 | ubuntu-noble | Found installed collection dellemc.powerflex:2.6.1 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/dellemc/powerflex' 2026-06-17 07:29:19.210201 | ubuntu-noble | Loading collection cisco.iosxr from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/cisco/iosxr 2026-06-17 07:29:19.210680 | ubuntu-noble | Found installed collection cisco.iosxr:10.3.1 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/cisco/iosxr' 2026-06-17 07:29:19.211082 | ubuntu-noble | Loading collection cisco.ise from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/cisco/ise 2026-06-17 07:29:19.211423 | ubuntu-noble | Found installed collection cisco.ise:2.10.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/cisco/ise' 2026-06-17 07:29:19.212728 | ubuntu-noble | Loading collection cisco.meraki from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/cisco/meraki 2026-06-17 07:29:19.212758 | ubuntu-noble | Found installed collection cisco.meraki:2.21.8 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/cisco/meraki' 2026-06-17 07:29:19.212765 | ubuntu-noble | Starting galaxy collection install process 2026-06-17 07:29:19.212772 | ubuntu-noble | Nothing to do. All requested collections are already installed. If you want to reinstall them, consider using `--force`. 2026-06-17 07:29:19.323654 | ubuntu-noble | INFO [delegated > dependency] Dependency completed successfully. 2026-06-17 07:29:19.323725 | ubuntu-noble | WARNING [delegated > dependency] Executed: Missing roles requirements file: requirements.yml (Remove from converge_sequence to suppress) 2026-06-17 07:29:19.338136 | ubuntu-noble | INFO [delegated > create] Executing 2026-06-17 07:29:19.340889 | ubuntu-noble | WARNING [delegated > create] Executed: Missing playbook (Remove from converge_sequence to suppress) 2026-06-17 07:29:19.350502 | ubuntu-noble | INFO [delegated > prepare] Executing 2026-06-17 07:29:19.350716 | ubuntu-noble | WARNING [delegated > prepare] Skipping, instances already prepared. 2026-06-17 07:29:19.350826 | ubuntu-noble | INFO [delegated > prepare] Executed: Successful 2026-06-17 07:29:19.359209 | ubuntu-noble | INFO [delegated > converge] Executing 2026-06-17 07:29:19.842094 | ubuntu-noble | DEBUG [delegated > converge] ansible-playbook version: ansible-playbook 2026-06-17 07:29:19.842173 | ubuntu-noble | config file = None 2026-06-17 07:29:19.842189 | ubuntu-noble | configured module search path = 2026-06-17 07:29:19.842200 | ubuntu-noble | ansible python module location = /home/zuul/venv/lib/python3.12/site-packages/ansible 2026-06-17 07:29:19.842212 | ubuntu-noble | ansible collection location = /home/zuul/.ansible/collections:/usr/share/ansible/collections 2026-06-17 07:29:19.842222 | ubuntu-noble | executable location = /home/zuul/venv/bin/ansible-playbook 2026-06-17 07:29:19.842232 | ubuntu-noble | python version = 3.12.3 (main, Mar 23 2026, 19:04:32) (/home/zuul/venv/bin/python3) 2026-06-17 07:29:19.842242 | ubuntu-noble | jinja version = 3.1.6 2026-06-17 07:29:19.842252 | ubuntu-noble | libyaml = True 2026-06-17 07:29:19.842920 | ubuntu-noble | DEBUG ANSIBLE ENVIRONMENT: 2026-06-17 07:29:19.843003 | ubuntu-noble | ANSIBLE_COLLECTIONS_PATH: /home/zuul/venv/.ansible/collections:/home/zuul/.ansible/collections 2026-06-17 07:29:19.843017 | ubuntu-noble | ANSIBLE_CONFIG: /home/zuul/.ansible/tmp/molecule.oWZD.delegated/ansible.cfg 2026-06-17 07:29:19.843028 | ubuntu-noble | ANSIBLE_LIBRARY: ../../plugins 2026-06-17 07:29:19.843037 | ubuntu-noble | ANSIBLE_PYTHON_INTERPRETER: /home/zuul/venv/bin/python 2026-06-17 07:29:19.843047 | ubuntu-noble | ANSIBLE_ROLE: auditd 2026-06-17 07:29:19.843057 | ubuntu-noble | ANSIBLE_ROLES_PATH: ../../roles 2026-06-17 07:29:19.843067 | ubuntu-noble | ANSIBLE_VERBOSITY: 1 2026-06-17 07:29:19.843081 | ubuntu-noble | 2026-06-17 07:29:19.843477 | ubuntu-noble | DEBUG MOLECULE ENVIRONMENT: 2026-06-17 07:29:19.843598 | ubuntu-noble | MOLECULE_DEBUG: True 2026-06-17 07:29:19.843619 | ubuntu-noble | MOLECULE_DEPENDENCY_NAME: galaxy 2026-06-17 07:29:19.843669 | ubuntu-noble | MOLECULE_DRIVER_NAME: default 2026-06-17 07:29:19.843688 | ubuntu-noble | MOLECULE_ENV_FILE: /home/zuul/src/github.com/osism/ansible-collection-services/.env.yml 2026-06-17 07:29:19.843706 | ubuntu-noble | MOLECULE_EPHEMERAL_DIRECTORY: /home/zuul/.ansible/tmp/molecule.oWZD.delegated 2026-06-17 07:29:19.843725 | ubuntu-noble | MOLECULE_FILE: /home/zuul/.ansible/tmp/molecule.oWZD.delegated/molecule.yml 2026-06-17 07:29:19.843743 | ubuntu-noble | MOLECULE_INSTANCE_CONFIG: /home/zuul/.ansible/tmp/molecule.oWZD.delegated/instance_config.yml 2026-06-17 07:29:19.843760 | ubuntu-noble | MOLECULE_INVENTORY_FILE: /home/zuul/.ansible/tmp/molecule.oWZD.delegated/inventory/ansible_inventory.yml 2026-06-17 07:29:19.843777 | ubuntu-noble | MOLECULE_PROJECT_DIRECTORY: /home/zuul/src/github.com/osism/ansible-collection-services 2026-06-17 07:29:19.843787 | ubuntu-noble | MOLECULE_PROVISIONER_NAME: ansible 2026-06-17 07:29:19.843797 | ubuntu-noble | MOLECULE_SCENARIO_DIRECTORY: /home/zuul/src/github.com/osism/ansible-collection-services/molecule/delegated 2026-06-17 07:29:19.843807 | ubuntu-noble | MOLECULE_SCENARIO_NAME: delegated 2026-06-17 07:29:19.843818 | ubuntu-noble | MOLECULE_STATE_FILE: /home/zuul/.ansible/tmp/molecule.oWZD.delegated/state.yml 2026-06-17 07:29:19.843828 | ubuntu-noble | MOLECULE_VERIFIER_NAME: testinfra 2026-06-17 07:29:19.843838 | ubuntu-noble | MOLECULE_VERIFIER_TEST_DIRECTORY: /home/zuul/src/github.com/osism/ansible-collection-services/molecule/delegated/tests 2026-06-17 07:29:19.843856 | ubuntu-noble | 2026-06-17 07:29:19.844663 | ubuntu-noble | DEBUG SHELL REPLAY: ANSIBLE_COLLECTIONS_PATH=/home/zuul/venv/.ansible/collections:/home/zuul/.ansible/collections ANSIBLE_CONFIG=/home/zuul/.ansible/tmp/molecule.oWZD.delegated/ansible.cfg ANSIBLE_LIBRARY=../../plugins ANSIBLE_PYTHON_INTERPRETER=/home/zuul/venv/bin/python ANSIBLE_ROLE=auditd ANSIBLE_ROLES_PATH=../../roles ANSIBLE_VERBOSITY=1 MOLECULE_DEBUG=True MOLECULE_DEPENDENCY_NAME=galaxy MOLECULE_DRIVER_NAME=default MOLECULE_ENV_FILE=/home/zuul/src/github.com/osism/ansible-collection-services/.env.yml MOLECULE_EPHEMERAL_DIRECTORY=/home/zuul/.ansible/tmp/molecule.oWZD.delegated MOLECULE_FILE=/home/zuul/.ansible/tmp/molecule.oWZD.delegated/molecule.yml MOLECULE_INSTANCE_CONFIG=/home/zuul/.ansible/tmp/molecule.oWZD.delegated/instance_config.yml MOLECULE_INVENTORY_FILE=/home/zuul/.ansible/tmp/molecule.oWZD.delegated/inventory/ansible_inventory.yml MOLECULE_PROJECT_DIRECTORY=/home/zuul/src/github.com/osism/ansible-collection-services MOLECULE_PROVISIONER_NAME=ansible MOLECULE_SCENARIO_DIRECTORY=/home/zuul/src/github.com/osism/ansible-collection-services/molecule/delegated MOLECULE_SCENARIO_NAME=delegated MOLECULE_STATE_FILE=/home/zuul/.ansible/tmp/molecule.oWZD.delegated/state.yml MOLECULE_VERIFIER_NAME=testinfra MOLECULE_VERIFIER_TEST_DIRECTORY=/home/zuul/src/github.com/osism/ansible-collection-services/molecule/delegated/tests 2026-06-17 07:29:20.232267 | ubuntu-noble | Using /home/zuul/.ansible/tmp/molecule.oWZD.delegated/ansible.cfg as config file 2026-06-17 07:29:20.271467 | debian-bookworm | ok: [molecule-auditd] 2026-06-17 07:29:20.271580 | debian-bookworm | 2026-06-17 07:29:20.271707 | debian-bookworm | TASK [Include required variables] ********************************************** 2026-06-17 07:29:20.295696 | debian-bookworm | ok: [molecule-auditd] => {"ansible_facts": {}, "ansible_included_var_files": ["/home/zuul/src/github.com/osism/ansible-collection-services/molecule/delegated/vars/auditd.yml"], "changed": false} 2026-06-17 07:29:20.295757 | debian-bookworm | 2026-06-17 07:29:20.295865 | debian-bookworm | TASK [Include role auditd] ***************************************************** 2026-06-17 07:29:20.331645 | debian-bookworm | included: auditd for molecule-auditd 2026-06-17 07:29:20.331734 | debian-bookworm | 2026-06-17 07:29:20.331858 | debian-bookworm | TASK [auditd : Include distribution specific install tasks] ******************** 2026-06-17 07:29:20.520604 | ubuntu-noble | 2026-06-17 07:29:20.520689 | ubuntu-noble | PLAY [Converge] **************************************************************** 2026-06-17 07:29:20.520706 | ubuntu-noble | 2026-06-17 07:29:20.520781 | ubuntu-noble | TASK [Gathering Facts] ********************************************************* 2026-06-17 07:29:20.356364 | debian-bookworm | included: /home/zuul/src/github.com/osism/ansible-collection-services/roles/auditd/tasks/install-Debian-family.yml for molecule-auditd 2026-06-17 07:29:20.356488 | debian-bookworm | 2026-06-17 07:29:20.356624 | debian-bookworm | TASK [auditd : Install auditd package] ***************************************** 2026-06-17 07:29:21.805292 | ubuntu-noble | ok: [molecule-auditd] 2026-06-17 07:29:21.805900 | ubuntu-noble | 2026-06-17 07:29:21.806312 | ubuntu-noble | TASK [Include required variables] ********************************************** 2026-06-17 07:29:21.851994 | ubuntu-noble | ok: [molecule-auditd] => {"ansible_facts": {}, "ansible_included_var_files": ["/home/zuul/src/github.com/osism/ansible-collection-services/molecule/delegated/vars/auditd.yml"], "changed": false} 2026-06-17 07:29:21.852298 | ubuntu-noble | 2026-06-17 07:29:21.852668 | ubuntu-noble | TASK [Include role auditd] ***************************************************** 2026-06-17 07:29:21.944560 | ubuntu-noble | included: auditd for molecule-auditd 2026-06-17 07:29:21.945446 | ubuntu-noble | 2026-06-17 07:29:21.945484 | ubuntu-noble | TASK [auditd : Include distribution specific install tasks] ******************** 2026-06-17 07:29:21.984236 | ubuntu-noble | included: /home/zuul/src/github.com/osism/ansible-collection-services/roles/auditd/tasks/install-Debian-family.yml for molecule-auditd 2026-06-17 07:29:21.984317 | ubuntu-noble | 2026-06-17 07:29:21.984327 | ubuntu-noble | TASK [auditd : Install auditd package] ***************************************** 2026-06-17 07:29:24.406294 | debian-bookworm | The following additional packages will be installed: 2026-06-17 07:29:24.406544 | debian-bookworm | libauparse0 2026-06-17 07:29:24.406779 | debian-bookworm | Suggested packages: 2026-06-17 07:29:24.407000 | debian-bookworm | audispd-plugins 2026-06-17 07:29:24.407241 | debian-bookworm | The following NEW packages will be installed: 2026-06-17 07:29:24.407480 | debian-bookworm | auditd libauparse0 2026-06-17 07:29:24.407703 | debian-bookworm | 0 upgraded, 2 newly installed, 0 to remove and 0 not upgraded. 2026-06-17 07:29:24.409526 | debian-bookworm | changed: [molecule-auditd] => {"cache_update_time": 1781681267, "cache_updated": false, "changed": true, "stderr": "debconf: delaying package configuration, since apt-utils is not installed\n", "stderr_lines": ["debconf: delaying package configuration, since apt-utils is not installed"], "stdout": "Reading package lists...\nBuilding dependency tree...\nReading state information...\nThe following additional packages will be installed:\n libauparse0\nSuggested packages:\n audispd-plugins\nThe following NEW packages will be installed:\n auditd libauparse0\n0 upgraded, 2 newly installed, 0 to remove and 0 not upgraded.\nNeed to get 279 kB of archives.\nAfter this operation, 934 kB of additional disk space will be used.\nGet:1 http://deb.debian.org/debian bookworm/main amd64 libauparse0 amd64 1:3.0.9-1 [61.9 kB]\nGet:2 http://deb.debian.org/debian bookworm/main amd64 auditd amd64 1:3.0.9-1 [218 kB]\nFetched 279 kB in 0s (3952 kB/s)\nSelecting previously unselected package libauparse0:amd64.\r\n(Reading database ... \r(Reading database ... 5%\r(Reading database ... 10%\r(Reading database ... 15%\r(Reading database ... 20%\r(Reading database ... 25%\r(Reading database ... 30%\r(Reading database ... 35%\r(Reading database ... 40%\r(Reading database ... 45%\r(Reading database ... 50%\r(Reading database ... 55%\r(Reading database ... 60%\r(Reading database ... 65%\r(Reading database ... 70%\r(Reading database ... 75%\r(Reading database ... 80%\r(Reading database ... 85%\r(Reading database ... 90%\r(Reading database ... 95%\r(Reading database ... 100%\r(Reading database ... 28691 files and directories currently installed.)\r\nPreparing to unpack .../libauparse0_1%3a3.0.9-1_amd64.deb ...\r\nUnpacking libauparse0:amd64 (1:3.0.9-1) ...\r\nSelecting previously unselected package auditd.\r\nPreparing to unpack .../auditd_1%3a3.0.9-1_amd64.deb ...\r\nUnpacking auditd (1:3.0.9-1) ...\r\nSetting up libauparse0:amd64 (1:3.0.9-1) ...\r\nSetting up auditd (1:3.0.9-1) ...\r\nCreated symlink /etc/systemd/system/multi-user.target.wants/auditd.service → /lib/systemd/system/auditd.service.\r\r\nProcessing triggers for libc-bin (2.36-9+deb12u14) ...\r\n", "stdout_lines": ["Reading package lists...", "Building dependency tree...", "Reading state information...", "The following additional packages will be installed:", " libauparse0", "Suggested packages:", " audispd-plugins", "The following NEW packages will be installed:", " auditd libauparse0", "0 upgraded, 2 newly installed, 0 to remove and 0 not upgraded.", "Need to get 279 kB of archives.", "After this operation, 934 kB of additional disk space will be used.", "Get:1 http://deb.debian.org/debian bookworm/main amd64 libauparse0 amd64 1:3.0.9-1 [61.9 kB]", "Get:2 http://deb.debian.org/debian bookworm/main amd64 auditd amd64 1:3.0.9-1 [218 kB]", "Fetched 279 kB in 0s (3952 kB/s)", "Selecting previously unselected package libauparse0:amd64.", "(Reading database ... ", "(Reading database ... 5%", "(Reading database ... 10%", "(Reading database ... 15%", "(Reading database ... 20%", "(Reading database ... 25%", "(Reading database ... 30%", "(Reading database ... 35%", "(Reading database ... 40%", "(Reading database ... 45%", "(Reading database ... 50%", "(Reading database ... 55%", "(Reading database ... 60%", "(Reading database ... 65%", "(Reading database ... 70%", "(Reading database ... 75%", "(Reading database ... 80%", "(Reading database ... 85%", "(Reading database ... 90%", "(Reading database ... 95%", "(Reading database ... 100%", "(Reading database ... 28691 files and directories currently installed.)", "Preparing to unpack .../libauparse0_1%3a3.0.9-1_amd64.deb ...", "Unpacking libauparse0:amd64 (1:3.0.9-1) ...", "Selecting previously unselected package auditd.", "Preparing to unpack .../auditd_1%3a3.0.9-1_amd64.deb ...", "Unpacking auditd (1:3.0.9-1) ...", "Setting up libauparse0:amd64 (1:3.0.9-1) ...", "Setting up auditd (1:3.0.9-1) ...", "Created symlink /etc/systemd/system/multi-user.target.wants/auditd.service → /lib/systemd/system/auditd.service.", "", "Processing triggers for libc-bin (2.36-9+deb12u14) ..."]} 2026-06-17 07:29:24.409666 | debian-bookworm | 2026-06-17 07:29:24.409898 | debian-bookworm | TASK [auditd : Install audispd-plugins package] ******************************** 2026-06-17 07:29:27.075605 | ubuntu-noble | The following additional packages will be installed: 2026-06-17 07:29:27.075684 | ubuntu-noble | libauparse0t64 2026-06-17 07:29:27.075698 | ubuntu-noble | Suggested packages: 2026-06-17 07:29:27.075708 | ubuntu-noble | audispd-plugins 2026-06-17 07:29:27.075718 | ubuntu-noble | The following NEW packages will be installed: 2026-06-17 07:29:27.075729 | ubuntu-noble | auditd libauparse0t64 2026-06-17 07:29:27.075738 | ubuntu-noble | 0 upgraded, 2 newly installed, 0 to remove and 0 not upgraded. 2026-06-17 07:29:27.078863 | ubuntu-noble | changed: [molecule-auditd] => {"cache_update_time": 1781681269, "cache_updated": false, "changed": true, "stderr": "debconf: delaying package configuration, since apt-utils is not installed\n", "stderr_lines": ["debconf: delaying package configuration, since apt-utils is not installed"], "stdout": "Reading package lists...\nBuilding dependency tree...\nReading state information...\nThe following additional packages will be installed:\n libauparse0t64\nSuggested packages:\n audispd-plugins\nThe following NEW packages will be installed:\n auditd libauparse0t64\n0 upgraded, 2 newly installed, 0 to remove and 0 not upgraded.\nNeed to get 274 kB of archives.\nAfter this operation, 893 kB of additional disk space will be used.\nGet:1 http://archive.ubuntu.com/ubuntu noble-updates/main amd64 libauparse0t64 amd64 1:3.1.2-2.1build1.1 [58.9 kB]\nGet:2 http://archive.ubuntu.com/ubuntu noble-updates/main amd64 auditd amd64 1:3.1.2-2.1build1.1 [215 kB]\nFetched 274 kB in 0s (2177 kB/s)\nSelecting previously unselected package libauparse0t64:amd64.\r\n(Reading database ... \r(Reading database ... 5%\r(Reading database ... 10%\r(Reading database ... 15%\r(Reading database ... 20%\r(Reading database ... 25%\r(Reading database ... 30%\r(Reading database ... 35%\r(Reading database ... 40%\r(Reading database ... 45%\r(Reading database ... 50%\r(Reading database ... 55%\r(Reading database ... 60%\r(Reading database ... 65%\r(Reading database ... 70%\r(Reading database ... 75%\r(Reading database ... 80%\r(Reading database ... 85%\r(Reading database ... 90%\r(Reading database ... 95%\r(Reading database ... 100%\r(Reading database ... 36085 files and directories currently installed.)\r\nPreparing to unpack .../libauparse0t64_1%3a3.1.2-2.1build1.1_amd64.deb ...\r\nAdding 'diversion of /lib/x86_64-linux-gnu/libauparse.so.0 to /lib/x86_64-linux-gnu/libauparse.so.0.usr-is-merged by libauparse0t64'\r\nAdding 'diversion of /lib/x86_64-linux-gnu/libauparse.so.0.0.0 to /lib/x86_64-linux-gnu/libauparse.so.0.0.0.usr-is-merged by libauparse0t64'\r\nUnpacking libauparse0t64:amd64 (1:3.1.2-2.1build1.1) ...\r\nSelecting previously unselected package auditd.\r\nPreparing to unpack .../auditd_1%3a3.1.2-2.1build1.1_amd64.deb ...\r\nUnpacking auditd (1:3.1.2-2.1build1.1) ...\r\nSetting up libauparse0t64:amd64 (1:3.1.2-2.1build1.1) ...\r\nSetting up auditd (1:3.1.2-2.1build1.1) ...\r\nCreated symlink /etc/systemd/system/multi-user.target.wants/auditd.service → /usr/lib/systemd/system/auditd.service.\r\r\nProcessing triggers for libc-bin (2.39-0ubuntu8.7) ...\r\n", "stdout_lines": ["Reading package lists...", "Building dependency tree...", "Reading state information...", "The following additional packages will be installed:", " libauparse0t64", "Suggested packages:", " audispd-plugins", "The following NEW packages will be installed:", " auditd libauparse0t64", "0 upgraded, 2 newly installed, 0 to remove and 0 not upgraded.", "Need to get 274 kB of archives.", "After this operation, 893 kB of additional disk space will be used.", "Get:1 http://archive.ubuntu.com/ubuntu noble-updates/main amd64 libauparse0t64 amd64 1:3.1.2-2.1build1.1 [58.9 kB]", "Get:2 http://archive.ubuntu.com/ubuntu noble-updates/main amd64 auditd amd64 1:3.1.2-2.1build1.1 [215 kB]", "Fetched 274 kB in 0s (2177 kB/s)", "Selecting previously unselected package libauparse0t64:amd64.", "(Reading database ... ", "(Reading database ... 5%", "(Reading database ... 10%", "(Reading database ... 15%", "(Reading database ... 20%", "(Reading database ... 25%", "(Reading database ... 30%", "(Reading database ... 35%", "(Reading database ... 40%", "(Reading database ... 45%", "(Reading database ... 50%", "(Reading database ... 55%", "(Reading database ... 60%", "(Reading database ... 65%", "(Reading database ... 70%", "(Reading database ... 75%", "(Reading database ... 80%", "(Reading database ... 85%", "(Reading database ... 90%", "(Reading database ... 95%", "(Reading database ... 100%", "(Reading database ... 36085 files and directories currently installed.)", "Preparing to unpack .../libauparse0t64_1%3a3.1.2-2.1build1.1_amd64.deb ...", "Adding 'diversion of /lib/x86_64-linux-gnu/libauparse.so.0 to /lib/x86_64-linux-gnu/libauparse.so.0.usr-is-merged by libauparse0t64'", "Adding 'diversion of /lib/x86_64-linux-gnu/libauparse.so.0.0.0 to /lib/x86_64-linux-gnu/libauparse.so.0.0.0.usr-is-merged by libauparse0t64'", "Unpacking libauparse0t64:amd64 (1:3.1.2-2.1build1.1) ...", "Selecting previously unselected package auditd.", "Preparing to unpack .../auditd_1%3a3.1.2-2.1build1.1_amd64.deb ...", "Unpacking auditd (1:3.1.2-2.1build1.1) ...", "Setting up libauparse0t64:amd64 (1:3.1.2-2.1build1.1) ...", "Setting up auditd (1:3.1.2-2.1build1.1) ...", "Created symlink /etc/systemd/system/multi-user.target.wants/auditd.service → /usr/lib/systemd/system/auditd.service.", "", "Processing triggers for libc-bin (2.39-0ubuntu8.7) ..."]} 2026-06-17 07:29:27.079194 | ubuntu-noble | 2026-06-17 07:29:27.079512 | ubuntu-noble | TASK [auditd : Install audispd-plugins package] ******************************** 2026-06-17 07:29:27.153228 | debian-bookworm | The following NEW packages will be installed: 2026-06-17 07:29:27.153328 | debian-bookworm | audispd-plugins 2026-06-17 07:29:27.153425 | debian-bookworm | 0 upgraded, 1 newly installed, 0 to remove and 0 not upgraded. 2026-06-17 07:29:27.153564 | debian-bookworm | changed: [molecule-auditd] => {"cache_update_time": 1781681267, "cache_updated": false, "changed": true, "stderr": "debconf: delaying package configuration, since apt-utils is not installed\n", "stderr_lines": ["debconf: delaying package configuration, since apt-utils is not installed"], "stdout": "Reading package lists...\nBuilding dependency tree...\nReading state information...\nThe following NEW packages will be installed:\n audispd-plugins\n0 upgraded, 1 newly installed, 0 to remove and 0 not upgraded.\nNeed to get 45.6 kB of archives.\nAfter this operation, 132 kB of additional disk space will be used.\nGet:1 http://deb.debian.org/debian bookworm/main amd64 audispd-plugins amd64 1:3.0.9-1 [45.6 kB]\nFetched 45.6 kB in 0s (934 kB/s)\nSelecting previously unselected package audispd-plugins.\r\n(Reading database ... \r(Reading database ... 5%\r(Reading database ... 10%\r(Reading database ... 15%\r(Reading database ... 20%\r(Reading database ... 25%\r(Reading database ... 30%\r(Reading database ... 35%\r(Reading database ... 40%\r(Reading database ... 45%\r(Reading database ... 50%\r(Reading database ... 55%\r(Reading database ... 60%\r(Reading database ... 65%\r(Reading database ... 70%\r(Reading database ... 75%\r(Reading database ... 80%\r(Reading database ... 85%\r(Reading database ... 90%\r(Reading database ... 95%\r(Reading database ... 100%\r(Reading database ... 28782 files and directories currently installed.)\r\nPreparing to unpack .../audispd-plugins_1%3a3.0.9-1_amd64.deb ...\r\nUnpacking audispd-plugins (1:3.0.9-1) ...\r\nSetting up audispd-plugins (1:3.0.9-1) ...\r\n", "stdout_lines": ["Reading package lists...", "Building dependency tree...", "Reading state information...", "The following NEW packages will be installed:", " audispd-plugins", "0 upgraded, 1 newly installed, 0 to remove and 0 not upgraded.", "Need to get 45.6 kB of archives.", "After this operation, 132 kB of additional disk space will be used.", "Get:1 http://deb.debian.org/debian bookworm/main amd64 audispd-plugins amd64 1:3.0.9-1 [45.6 kB]", "Fetched 45.6 kB in 0s (934 kB/s)", "Selecting previously unselected package audispd-plugins.", "(Reading database ... ", "(Reading database ... 5%", "(Reading database ... 10%", "(Reading database ... 15%", "(Reading database ... 20%", "(Reading database ... 25%", "(Reading database ... 30%", "(Reading database ... 35%", "(Reading database ... 40%", "(Reading database ... 45%", "(Reading database ... 50%", "(Reading database ... 55%", "(Reading database ... 60%", "(Reading database ... 65%", "(Reading database ... 70%", "(Reading database ... 75%", "(Reading database ... 80%", "(Reading database ... 85%", "(Reading database ... 90%", "(Reading database ... 95%", "(Reading database ... 100%", "(Reading database ... 28782 files and directories currently installed.)", "Preparing to unpack .../audispd-plugins_1%3a3.0.9-1_amd64.deb ...", "Unpacking audispd-plugins (1:3.0.9-1) ...", "Setting up audispd-plugins (1:3.0.9-1) ..."]} 2026-06-17 07:29:27.153657 | debian-bookworm | 2026-06-17 07:29:27.153754 | debian-bookworm | TASK [auditd : Copy auditd.conf configuration files] *************************** 2026-06-17 07:29:28.240564 | debian-bookworm | --- before 2026-06-17 07:29:28.240729 | debian-bookworm | +++ after: /home/zuul/.ansible/tmp/ansible-local-2206gh6pxt9e/tmpazf_zrad/auditd.conf.j2 2026-06-17 07:29:28.240874 | debian-bookworm | @@ -0,0 +1,37 @@ 2026-06-17 07:29:28.241010 | debian-bookworm | +# 2026-06-17 07:29:28.241160 | debian-bookworm | +# This file controls the configuration of the audit daemon 2026-06-17 07:29:28.241309 | debian-bookworm | +# 2026-06-17 07:29:28.241449 | debian-bookworm | + 2026-06-17 07:29:28.241588 | debian-bookworm | +local_events = yes 2026-06-17 07:29:28.241732 | debian-bookworm | +write_logs = yes 2026-06-17 07:29:28.241875 | debian-bookworm | +log_file = /var/log/audit/audit.log 2026-06-17 07:29:28.242014 | debian-bookworm | +log_group = adm 2026-06-17 07:29:28.242148 | debian-bookworm | +log_format = RAW 2026-06-17 07:29:28.242286 | debian-bookworm | +flush = INCREMENTAL_ASYNC 2026-06-17 07:29:28.242438 | debian-bookworm | +freq = 50 2026-06-17 07:29:28.242574 | debian-bookworm | +max_log_file = 8 2026-06-17 07:29:28.242709 | debian-bookworm | +num_logs = 5 2026-06-17 07:29:28.242842 | debian-bookworm | +priority_boost = 4 2026-06-17 07:29:28.242978 | debian-bookworm | +disp_qos = lossy 2026-06-17 07:29:28.243113 | debian-bookworm | +dispatcher = /sbin/audispd 2026-06-17 07:29:28.243249 | debian-bookworm | +name_format = NONE 2026-06-17 07:29:28.243394 | debian-bookworm | +##name = mydomain 2026-06-17 07:29:28.243533 | debian-bookworm | +max_log_file_action = ROTATE 2026-06-17 07:29:28.243667 | debian-bookworm | +space_left = 12361 2026-06-17 07:29:28.243805 | debian-bookworm | +space_left_action = email 2026-06-17 07:29:28.243942 | debian-bookworm | +verify_email = yes 2026-06-17 07:29:28.244123 | debian-bookworm | +action_mail_acct = root 2026-06-17 07:29:28.244261 | debian-bookworm | +admin_space_left = 50 2026-06-17 07:29:28.244439 | debian-bookworm | +admin_space_left_action = SUSPEND 2026-06-17 07:29:28.244577 | debian-bookworm | +disk_full_action = SUSPEND 2026-06-17 07:29:28.244712 | debian-bookworm | +disk_error_action = SUSPEND 2026-06-17 07:29:28.244849 | debian-bookworm | +use_libwrap = yes 2026-06-17 07:29:28.244971 | debian-bookworm | +##tcp_listen_port = 60 2026-06-17 07:29:28.245093 | debian-bookworm | +tcp_listen_queue = 5 2026-06-17 07:29:28.245212 | debian-bookworm | +tcp_max_per_addr = 1 2026-06-17 07:29:28.245354 | debian-bookworm | +##tcp_client_ports = 1024-65535 2026-06-17 07:29:28.245475 | debian-bookworm | +tcp_client_max_idle = 0 2026-06-17 07:29:28.245595 | debian-bookworm | +enable_krb5 = no 2026-06-17 07:29:28.245989 | debian-bookworm | +krb5_principal = auditd 2026-06-17 07:29:28.246149 | debian-bookworm | +##krb5_key_file = /etc/audit/audit.key 2026-06-17 07:29:28.246281 | debian-bookworm | +distribute_network = no 2026-06-17 07:29:28.246440 | debian-bookworm | 2026-06-17 07:29:28.246591 | debian-bookworm | changed: [molecule-auditd] => {"changed": true, "checksum": "e902cc6bebf86c17087d153e359a2cc1231672e0", "dest": "/etc/audit/audit.conf", "gid": 0, "group": "root", "md5sum": "69dfd768317bae876a6a78c8aeb5cce1", "mode": "0640", "owner": "root", "size": 806, "src": "/home/zuul/.ansible/tmp/ansible-tmp-1781681367.1763022-2576-248107847376178/.source.conf", "state": "file", "uid": 0} 2026-06-17 07:29:28.246703 | debian-bookworm | 2026-06-17 07:29:28.246834 | debian-bookworm | TASK [auditd : Adjust auditd/audispd configurations] *************************** 2026-06-17 07:29:28.641584 | debian-bookworm | ok: [molecule-auditd] => (item={'parameter': 'active', 'value': 'no', 'config': '/etc/audit/plugins.d/syslog.conf'}) => {"ansible_loop_var": "item", "backup": "", "changed": false, "item": {"config": "/etc/audit/plugins.d/syslog.conf", "parameter": "active", "value": "no"}, "msg": ""} 2026-06-17 07:29:28.641658 | debian-bookworm | 2026-06-17 07:29:28.641759 | debian-bookworm | TASK [auditd : Deploy rules for auditd] **************************************** 2026-06-17 07:29:29.424273 | debian-bookworm | --- before 2026-06-17 07:29:29.424436 | debian-bookworm | +++ after: /home/zuul/.ansible/tmp/ansible-local-2206gh6pxt9e/tmpai36yqq3/20-neo23x0.rules.j2 2026-06-17 07:29:29.424453 | debian-bookworm | @@ -0,0 +1,750 @@ 2026-06-17 07:29:29.424465 | debian-bookworm | +# ___ ___ __ __ 2026-06-17 07:29:29.424477 | debian-bookworm | +# / | __ ______/ (_) /_____/ / 2026-06-17 07:29:29.424488 | debian-bookworm | +# / /| |/ / / / __ / / __/ __ / 2026-06-17 07:29:29.424499 | debian-bookworm | +# / ___ / /_/ / /_/ / / /_/ /_/ / 2026-06-17 07:29:29.424510 | debian-bookworm | +# /_/ |_\__,_/\__,_/_/\__/\__,_/ 2026-06-17 07:29:29.424521 | debian-bookworm | +# 2026-06-17 07:29:29.424533 | debian-bookworm | +# Linux Audit Daemon - Best Practice Configuration 2026-06-17 07:29:29.424544 | debian-bookworm | +# /etc/audit/audit.rules 2026-06-17 07:29:29.424555 | debian-bookworm | +# 2026-06-17 07:29:29.424814 | debian-bookworm | +# Compiled by Florian Roth 2026-06-17 07:29:29.425185 | debian-bookworm | +# 2026-06-17 07:29:29.425547 | debian-bookworm | +# Created : 2017/12/05 2026-06-17 07:29:29.425902 | debian-bookworm | +# Modified : 2023/01/25 2026-06-17 07:29:29.426218 | debian-bookworm | +# 2026-06-17 07:29:29.426760 | debian-bookworm | +# Based on rules published here: 2026-06-17 07:29:29.427045 | debian-bookworm | +# Gov.uk auditd rules 2026-06-17 07:29:29.427702 | debian-bookworm | +# https://github.com/gds-operations/puppet-auditd/pull/1 2026-06-17 07:29:29.428224 | debian-bookworm | +# CentOS 7 hardening 2026-06-17 07:29:29.428634 | debian-bookworm | +# https://highon.coffee/blog/security-harden-centos-7/#auditd---audit-daemon 2026-06-17 07:29:29.428967 | debian-bookworm | +# Linux audit repo 2026-06-17 07:29:29.429345 | debian-bookworm | +# https://github.com/linux-audit/audit-userspace/tree/master/rules 2026-06-17 07:29:29.429692 | debian-bookworm | +# Auditd high performance linux auditing 2026-06-17 07:29:29.430025 | debian-bookworm | +# https://linux-audit.com/tuning-auditd-high-performance-linux-auditing/ 2026-06-17 07:29:29.430263 | debian-bookworm | +# 2026-06-17 07:29:29.430555 | debian-bookworm | +# Further rules 2026-06-17 07:29:29.430888 | debian-bookworm | +# For PCI DSS compliance see: 2026-06-17 07:29:29.431239 | debian-bookworm | +# https://github.com/linux-audit/audit-userspace/blob/master/rules/30-pci-dss-v31.rules 2026-06-17 07:29:29.431581 | debian-bookworm | +# For NISPOM compliance see: 2026-06-17 07:29:29.431906 | debian-bookworm | +# https://github.com/linux-audit/audit-userspace/blob/master/rules/30-nispom.rules 2026-06-17 07:29:29.432188 | debian-bookworm | + 2026-06-17 07:29:29.432490 | debian-bookworm | +# Remove any existing rules 2026-06-17 07:29:29.432723 | debian-bookworm | +-D 2026-06-17 07:29:29.432944 | debian-bookworm | + 2026-06-17 07:29:29.433171 | debian-bookworm | +# Buffer Size 2026-06-17 07:29:29.433428 | debian-bookworm | +## Feel free to increase this if the machine panic's 2026-06-17 07:29:29.433655 | debian-bookworm | +-b 8192 2026-06-17 07:29:29.433884 | debian-bookworm | + 2026-06-17 07:29:29.434115 | debian-bookworm | +# Failure Mode 2026-06-17 07:29:29.434374 | debian-bookworm | +## Possible values: 0 (silent), 1 (printk, print a failure message), 2 (panic, halt the system) 2026-06-17 07:29:29.434607 | debian-bookworm | +-f 1 2026-06-17 07:29:29.434830 | debian-bookworm | + 2026-06-17 07:29:29.435059 | debian-bookworm | +# Ignore errors 2026-06-17 07:29:29.435310 | debian-bookworm | +## e.g. caused by users or files not found in the local environment 2026-06-17 07:29:29.435544 | debian-bookworm | +-i 2026-06-17 07:29:29.435767 | debian-bookworm | + 2026-06-17 07:29:29.435997 | debian-bookworm | +# Self Auditing --------------------------------------------------------------- 2026-06-17 07:29:29.436267 | debian-bookworm | + 2026-06-17 07:29:29.436529 | debian-bookworm | +## Audit the audit logs 2026-06-17 07:29:29.436767 | debian-bookworm | +### Successful and unsuccessful attempts to read information from the audit records 2026-06-17 07:29:29.437000 | debian-bookworm | +-w /var/log/audit/ -p wra -k auditlog 2026-06-17 07:29:29.437232 | debian-bookworm | +-w /var/audit/ -p wra -k auditlog 2026-06-17 07:29:29.437521 | debian-bookworm | + 2026-06-17 07:29:29.437757 | debian-bookworm | +## Auditd configuration 2026-06-17 07:29:29.437999 | debian-bookworm | +### Modifications to audit configuration that occur while the audit collection functions are operating 2026-06-17 07:29:29.438237 | debian-bookworm | +-w /etc/audit/ -p wa -k auditconfig 2026-06-17 07:29:29.438509 | debian-bookworm | +-w /etc/libaudit.conf -p wa -k auditconfig 2026-06-17 07:29:29.438745 | debian-bookworm | +-w /etc/audisp/ -p wa -k audispconfig 2026-06-17 07:29:29.438972 | debian-bookworm | + 2026-06-17 07:29:29.439211 | debian-bookworm | +## Monitor for use of audit management tools 2026-06-17 07:29:29.439474 | debian-bookworm | +-w /sbin/auditctl -p x -k audittools 2026-06-17 07:29:29.439708 | debian-bookworm | +-w /sbin/auditd -p x -k audittools 2026-06-17 07:29:29.439942 | debian-bookworm | +-w /usr/sbin/auditd -p x -k audittools 2026-06-17 07:29:29.440226 | debian-bookworm | +-w /usr/sbin/augenrules -p x -k audittools 2026-06-17 07:29:29.440517 | debian-bookworm | + 2026-06-17 07:29:29.440755 | debian-bookworm | +## Access to all audit trails 2026-06-17 07:29:29.440957 | debian-bookworm | + 2026-06-17 07:29:29.441159 | debian-bookworm | +-a always,exit -F path=/usr/sbin/ausearch -F perm=x -k audittools 2026-06-17 07:29:29.441380 | debian-bookworm | +-a always,exit -F path=/usr/sbin/aureport -F perm=x -k audittools 2026-06-17 07:29:29.441581 | debian-bookworm | +-a always,exit -F path=/usr/sbin/aulast -F perm=x -k audittools 2026-06-17 07:29:29.441788 | debian-bookworm | +-a always,exit -F path=/usr/sbin/aulastlogin -F perm=x -k audittools 2026-06-17 07:29:29.441985 | debian-bookworm | +-a always,exit -F path=/usr/sbin/auvirt -F perm=x -k audittools 2026-06-17 07:29:29.442178 | debian-bookworm | + 2026-06-17 07:29:29.442396 | debian-bookworm | +# Filters --------------------------------------------------------------------- 2026-06-17 07:29:29.442588 | debian-bookworm | + 2026-06-17 07:29:29.442806 | debian-bookworm | +### We put these early because audit is a first match wins system. 2026-06-17 07:29:29.442995 | debian-bookworm | + 2026-06-17 07:29:29.443195 | debian-bookworm | +## Ignore SELinux AVC records 2026-06-17 07:29:29.443448 | debian-bookworm | +-a always,exclude -F msgtype=AVC 2026-06-17 07:29:29.443644 | debian-bookworm | + 2026-06-17 07:29:29.443835 | debian-bookworm | +## Ignore current working directory records 2026-06-17 07:29:29.444023 | debian-bookworm | +-a always,exclude -F msgtype=CWD 2026-06-17 07:29:29.444249 | debian-bookworm | + 2026-06-17 07:29:29.444458 | debian-bookworm | +## Cron jobs fill the logs with stuff we normally don't want (works with SELinux) 2026-06-17 07:29:29.444645 | debian-bookworm | +-a never,user -F subj_type=crond_t 2026-06-17 07:29:29.444833 | debian-bookworm | +-a never,exit -F subj_type=crond_t 2026-06-17 07:29:29.445010 | debian-bookworm | + 2026-06-17 07:29:29.445192 | debian-bookworm | +## This prevents chrony from overwhelming the logs 2026-06-17 07:29:29.445394 | debian-bookworm | +-a never,exit -F arch=b64 -S adjtimex -F auid=-1 -F uid=chrony -F subj_type=chronyd_t 2026-06-17 07:29:29.445573 | debian-bookworm | + 2026-06-17 07:29:29.445757 | debian-bookworm | +## This is not very interesting and wastes a lot of space if the server is public facing 2026-06-17 07:29:29.445948 | debian-bookworm | +-a always,exclude -F msgtype=CRYPTO_KEY_USER 2026-06-17 07:29:29.446123 | debian-bookworm | + 2026-06-17 07:29:29.446315 | debian-bookworm | +## Open VM Tools 2026-06-17 07:29:29.446500 | debian-bookworm | +-a exit,never -F arch=b64 -S all -F exe=/usr/bin/vmtoolsd 2026-06-17 07:29:29.446678 | debian-bookworm | + 2026-06-17 07:29:29.446866 | debian-bookworm | +## High Volume Event Filter (especially on Linux Workstations) 2026-06-17 07:29:29.447049 | debian-bookworm | +-a never,exit -F arch=b64 -F dir=/dev/shm -k sharedmemaccess 2026-06-17 07:29:29.447234 | debian-bookworm | +-a never,exit -F arch=b64 -F dir=/var/lock/lvm -k locklvm 2026-06-17 07:29:29.447460 | debian-bookworm | + 2026-06-17 07:29:29.447649 | debian-bookworm | +## FileBeat 2026-06-17 07:29:29.447824 | debian-bookworm | +-a never,exit -F arch=b64 -F path=/opt/filebeat -k filebeat 2026-06-17 07:29:29.447982 | debian-bookworm | + 2026-06-17 07:29:29.448178 | debian-bookworm | +## More information on how to filter events 2026-06-17 07:29:29.448360 | debian-bookworm | +### https://access.redhat.com/solutions/2482221 2026-06-17 07:29:29.448520 | debian-bookworm | + 2026-06-17 07:29:29.448680 | debian-bookworm | +# Rules ----------------------------------------------------------------------- 2026-06-17 07:29:29.448836 | debian-bookworm | + 2026-06-17 07:29:29.448996 | debian-bookworm | +## Kernel parameters 2026-06-17 07:29:29.449158 | debian-bookworm | +-w /etc/sysctl.conf -p wa -k sysctl 2026-06-17 07:29:29.449333 | debian-bookworm | +-w /etc/sysctl.d -p wa -k sysctl 2026-06-17 07:29:29.449489 | debian-bookworm | + 2026-06-17 07:29:29.449648 | debian-bookworm | +## Kernel module loading and unloading 2026-06-17 07:29:29.449809 | debian-bookworm | +-a always,exit -F perm=x -F auid!=-1 -F path=/sbin/insmod -k modules 2026-06-17 07:29:29.449970 | debian-bookworm | +-a always,exit -F perm=x -F auid!=-1 -F path=/sbin/modprobe -k modules 2026-06-17 07:29:29.450128 | debian-bookworm | +-a always,exit -F perm=x -F auid!=-1 -F path=/sbin/rmmod -k modules 2026-06-17 07:29:29.450301 | debian-bookworm | +-a always,exit -F arch=b64 -S finit_module -S init_module -S delete_module -F auid!=-1 -k modules 2026-06-17 07:29:29.450457 | debian-bookworm | + 2026-06-17 07:29:29.450618 | debian-bookworm | +## Modprobe configuration 2026-06-17 07:29:29.450780 | debian-bookworm | +-w /etc/modprobe.conf -p wa -k modprobe 2026-06-17 07:29:29.450939 | debian-bookworm | +-w /etc/modprobe.d -p wa -k modprobe 2026-06-17 07:29:29.451092 | debian-bookworm | + 2026-06-17 07:29:29.451251 | debian-bookworm | +## KExec usage (all actions) 2026-06-17 07:29:29.451462 | debian-bookworm | +-a always,exit -F arch=b64 -S kexec_load -k KEXEC 2026-06-17 07:29:29.451620 | debian-bookworm | + 2026-06-17 07:29:29.451778 | debian-bookworm | +## Special files 2026-06-17 07:29:29.451930 | debian-bookworm | +-a always,exit -F arch=b64 -S mknod -S mknodat -k specialfiles 2026-06-17 07:29:29.452087 | debian-bookworm | + 2026-06-17 07:29:29.452235 | debian-bookworm | +## Mount operations (only attributable) 2026-06-17 07:29:29.452398 | debian-bookworm | +-a always,exit -F arch=b64 -S mount -S umount2 -F auid!=-1 -k mount 2026-06-17 07:29:29.452537 | debian-bookworm | + 2026-06-17 07:29:29.452679 | debian-bookworm | +### NFS mount 2026-06-17 07:29:29.452842 | debian-bookworm | +-a always,exit -F path=/sbin/mount.nfs -F perm=x -F auid>=500 -F auid!=4294967295 -k T1078_Valid_Accounts 2026-06-17 07:29:29.453001 | debian-bookworm | +-a always,exit -F path=/usr/sbin/mount.nfs -F perm=x -F auid>=500 -F auid!=4294967295 -k T1078_Valid_Accounts 2026-06-17 07:29:29.453140 | debian-bookworm | + 2026-06-17 07:29:29.453294 | debian-bookworm | +## Change swap (only attributable) 2026-06-17 07:29:29.453444 | debian-bookworm | +-a always,exit -F arch=b64 -S swapon -S swapoff -F auid!=-1 -k swap 2026-06-17 07:29:29.453593 | debian-bookworm | + 2026-06-17 07:29:29.453731 | debian-bookworm | +## Time 2026-06-17 07:29:29.453875 | debian-bookworm | +-a always,exit -F arch=b64 -F uid!=ntp -S adjtimex -S settimeofday -S clock_settime -k time 2026-06-17 07:29:29.454013 | debian-bookworm | +### Local time zone 2026-06-17 07:29:29.454157 | debian-bookworm | +-w /etc/localtime -p wa -k localtime 2026-06-17 07:29:29.454308 | debian-bookworm | + 2026-06-17 07:29:29.454450 | debian-bookworm | +## Stunnel 2026-06-17 07:29:29.454592 | debian-bookworm | +-w /usr/sbin/stunnel -p x -k stunnel 2026-06-17 07:29:29.454732 | debian-bookworm | +-w /usr/bin/stunnel -p x -k stunnel 2026-06-17 07:29:29.454867 | debian-bookworm | + 2026-06-17 07:29:29.455009 | debian-bookworm | +## Cron configuration & scheduled jobs 2026-06-17 07:29:29.455146 | debian-bookworm | +-w /etc/cron.allow -p wa -k cron 2026-06-17 07:29:29.455323 | debian-bookworm | +-w /etc/cron.deny -p wa -k cron 2026-06-17 07:29:29.455468 | debian-bookworm | +-w /etc/cron.d/ -p wa -k cron 2026-06-17 07:29:29.455609 | debian-bookworm | +-w /etc/cron.daily/ -p wa -k cron 2026-06-17 07:29:29.455752 | debian-bookworm | +-w /etc/cron.hourly/ -p wa -k cron 2026-06-17 07:29:29.455890 | debian-bookworm | +-w /etc/cron.monthly/ -p wa -k cron 2026-06-17 07:29:29.456026 | debian-bookworm | +-w /etc/cron.weekly/ -p wa -k cron 2026-06-17 07:29:29.456194 | debian-bookworm | +-w /etc/crontab -p wa -k cron 2026-06-17 07:29:29.456346 | debian-bookworm | +-w /var/spool/cron/ -p wa -k cron 2026-06-17 07:29:29.456480 | debian-bookworm | + 2026-06-17 07:29:29.456615 | debian-bookworm | +## User, group, password databases 2026-06-17 07:29:29.456748 | debian-bookworm | +-w /etc/group -p wa -k etcgroup 2026-06-17 07:29:29.456880 | debian-bookworm | +-w /etc/passwd -p wa -k etcpasswd 2026-06-17 07:29:29.457015 | debian-bookworm | +-w /etc/gshadow -k etcgroup 2026-06-17 07:29:29.457148 | debian-bookworm | +-w /etc/shadow -k etcpasswd 2026-06-17 07:29:29.457324 | debian-bookworm | +-w /etc/security/opasswd -k opasswd 2026-06-17 07:29:29.457463 | debian-bookworm | + 2026-06-17 07:29:29.457600 | debian-bookworm | +## Sudoers file changes 2026-06-17 07:29:29.457720 | debian-bookworm | +-w /etc/sudoers -p wa -k actions 2026-06-17 07:29:29.457839 | debian-bookworm | +-w /etc/sudoers.d/ -p wa -k actions 2026-06-17 07:29:29.457957 | debian-bookworm | + 2026-06-17 07:29:29.458076 | debian-bookworm | +## Passwd 2026-06-17 07:29:29.458201 | debian-bookworm | +-w /usr/bin/passwd -p x -k passwd_modification 2026-06-17 07:29:29.458331 | debian-bookworm | + 2026-06-17 07:29:29.458455 | debian-bookworm | +## Tools to change group identifiers 2026-06-17 07:29:29.458578 | debian-bookworm | +-w /usr/sbin/groupadd -p x -k group_modification 2026-06-17 07:29:29.458699 | debian-bookworm | +-w /usr/sbin/groupmod -p x -k group_modification 2026-06-17 07:29:29.458820 | debian-bookworm | +-w /usr/sbin/addgroup -p x -k group_modification 2026-06-17 07:29:29.458940 | debian-bookworm | +-w /usr/sbin/useradd -p x -k user_modification 2026-06-17 07:29:29.459062 | debian-bookworm | +-w /usr/sbin/userdel -p x -k user_modification 2026-06-17 07:29:29.459185 | debian-bookworm | +-w /usr/sbin/usermod -p x -k user_modification 2026-06-17 07:29:29.459320 | debian-bookworm | +-w /usr/sbin/adduser -p x -k user_modification 2026-06-17 07:29:29.459439 | debian-bookworm | + 2026-06-17 07:29:29.459560 | debian-bookworm | +## Login configuration and information 2026-06-17 07:29:29.459679 | debian-bookworm | +-w /etc/login.defs -p wa -k login 2026-06-17 07:29:29.459797 | debian-bookworm | +-w /etc/securetty -p wa -k login 2026-06-17 07:29:29.459918 | debian-bookworm | +-w /var/log/faillog -p wa -k login 2026-06-17 07:29:29.460054 | debian-bookworm | +-w /var/log/lastlog -p wa -k login 2026-06-17 07:29:29.460197 | debian-bookworm | +-w /var/log/tallylog -p wa -k login 2026-06-17 07:29:29.460356 | debian-bookworm | + 2026-06-17 07:29:29.460481 | debian-bookworm | +## Network Environment 2026-06-17 07:29:29.460602 | debian-bookworm | +### Changes to hostname 2026-06-17 07:29:29.460720 | debian-bookworm | +-a always,exit -F arch=b64 -S sethostname -S setdomainname -k network_modifications 2026-06-17 07:29:29.460827 | debian-bookworm | + 2026-06-17 07:29:29.460937 | debian-bookworm | +### Detect Remote Shell Use 2026-06-17 07:29:29.461051 | debian-bookworm | +-a always,exit -F arch=b64 -F exe=/bin/bash -F success=1 -S connect -k "remote_shell" 2026-06-17 07:29:29.461164 | debian-bookworm | +-a always,exit -F arch=b64 -F exe=/usr/bin/bash -F success=1 -S connect -k "remote_shell" 2026-06-17 07:29:29.461272 | debian-bookworm | + 2026-06-17 07:29:29.461399 | debian-bookworm | +### Successful IPv4 Connections 2026-06-17 07:29:29.461511 | debian-bookworm | +-a always,exit -F arch=b64 -S connect -F a2=16 -F success=1 -F key=network_connect_4 2026-06-17 07:29:29.461616 | debian-bookworm | + 2026-06-17 07:29:29.461726 | debian-bookworm | +### Successful IPv6 Connections 2026-06-17 07:29:29.461837 | debian-bookworm | +-a always,exit -F arch=b64 -S connect -F a2=28 -F success=1 -F key=network_connect_6 2026-06-17 07:29:29.461946 | debian-bookworm | + 2026-06-17 07:29:29.462068 | debian-bookworm | +### Changes to other files 2026-06-17 07:29:29.462181 | debian-bookworm | +-w /etc/hosts -p wa -k network_modifications 2026-06-17 07:29:29.462304 | debian-bookworm | +-w /etc/sysconfig/network -p wa -k network_modifications 2026-06-17 07:29:29.462419 | debian-bookworm | +-w /etc/sysconfig/network-scripts -p w -k network_modifications 2026-06-17 07:29:29.462529 | debian-bookworm | +-w /etc/network/ -p wa -k network 2026-06-17 07:29:29.462643 | debian-bookworm | +-a always,exit -F dir=/etc/NetworkManager/ -F perm=wa -k network_modifications 2026-06-17 07:29:29.462750 | debian-bookworm | + 2026-06-17 07:29:29.462859 | debian-bookworm | +### Changes to issue 2026-06-17 07:29:29.462971 | debian-bookworm | +-w /etc/issue -p wa -k etcissue 2026-06-17 07:29:29.463084 | debian-bookworm | +-w /etc/issue.net -p wa -k etcissue 2026-06-17 07:29:29.463192 | debian-bookworm | + 2026-06-17 07:29:29.463337 | debian-bookworm | +## System startup scripts 2026-06-17 07:29:29.463454 | debian-bookworm | +-w /etc/inittab -p wa -k init 2026-06-17 07:29:29.463565 | debian-bookworm | +-w /etc/init.d/ -p wa -k init 2026-06-17 07:29:29.463675 | debian-bookworm | +-w /etc/init/ -p wa -k init 2026-06-17 07:29:29.463783 | debian-bookworm | + 2026-06-17 07:29:29.463893 | debian-bookworm | +## Library search paths 2026-06-17 07:29:29.464005 | debian-bookworm | +-w /etc/ld.so.conf -p wa -k libpath 2026-06-17 07:29:29.464152 | debian-bookworm | +-w /etc/ld.so.conf.d -p wa -k libpath 2026-06-17 07:29:29.464263 | debian-bookworm | + 2026-06-17 07:29:29.464391 | debian-bookworm | +## Systemwide library preloads (LD_PRELOAD) 2026-06-17 07:29:29.464505 | debian-bookworm | +-w /etc/ld.so.preload -p wa -k systemwide_preloads 2026-06-17 07:29:29.464612 | debian-bookworm | + 2026-06-17 07:29:29.464723 | debian-bookworm | +## Pam configuration 2026-06-17 07:29:29.464834 | debian-bookworm | +-w /etc/pam.d/ -p wa -k pam 2026-06-17 07:29:29.464948 | debian-bookworm | +-w /etc/security/limits.conf -p wa -k pam 2026-06-17 07:29:29.465058 | debian-bookworm | +-w /etc/security/limits.d -p wa -k pam 2026-06-17 07:29:29.465169 | debian-bookworm | +-w /etc/security/pam_env.conf -p wa -k pam 2026-06-17 07:29:29.465311 | debian-bookworm | +-w /etc/security/namespace.conf -p wa -k pam 2026-06-17 07:29:29.465431 | debian-bookworm | +-w /etc/security/namespace.d -p wa -k pam 2026-06-17 07:29:29.465548 | debian-bookworm | +-w /etc/security/namespace.init -p wa -k pam 2026-06-17 07:29:29.465655 | debian-bookworm | + 2026-06-17 07:29:29.465768 | debian-bookworm | +## Mail configuration 2026-06-17 07:29:29.465877 | debian-bookworm | +-w /etc/aliases -p wa -k mail 2026-06-17 07:29:29.465984 | debian-bookworm | +-w /etc/postfix/ -p wa -k mail 2026-06-17 07:29:29.466092 | debian-bookworm | +-w /etc/exim4/ -p wa -k mail 2026-06-17 07:29:29.466201 | debian-bookworm | + 2026-06-17 07:29:29.466326 | debian-bookworm | +## SSH configuration 2026-06-17 07:29:29.466437 | debian-bookworm | +-w /etc/ssh/sshd_config -k sshd 2026-06-17 07:29:29.466546 | debian-bookworm | +-w /etc/ssh/sshd_config.d -k sshd 2026-06-17 07:29:29.466651 | debian-bookworm | + 2026-06-17 07:29:29.466760 | debian-bookworm | +## root ssh key tampering 2026-06-17 07:29:29.466869 | debian-bookworm | +-w /root/.ssh -p wa -k rootkey 2026-06-17 07:29:29.466974 | debian-bookworm | + 2026-06-17 07:29:29.467083 | debian-bookworm | +# Systemd 2026-06-17 07:29:29.467193 | debian-bookworm | +-w /bin/systemctl -p x -k systemd 2026-06-17 07:29:29.467313 | debian-bookworm | +-w /etc/systemd/ -p wa -k systemd 2026-06-17 07:29:29.467425 | debian-bookworm | +-w /usr/lib/systemd -p wa -k systemd 2026-06-17 07:29:29.467535 | debian-bookworm | + 2026-06-17 07:29:29.467647 | debian-bookworm | +## https://systemd.network/systemd.generator.html 2026-06-17 07:29:29.467757 | debian-bookworm | +-w /etc/systemd/system-generators/ -p wa -k systemd_generator 2026-06-17 07:29:29.467866 | debian-bookworm | +-w /usr/local/lib/systemd/system-generators/ -p wa -k systemd_generator 2026-06-17 07:29:29.467977 | debian-bookworm | +-w /usr/lib/systemd/system-generators -p wa -k systemd_generator 2026-06-17 07:29:29.468113 | debian-bookworm | + 2026-06-17 07:29:29.468228 | debian-bookworm | +-w /etc/systemd/user-generators/ -p wa -k systemd_generator 2026-06-17 07:29:29.468377 | debian-bookworm | +-w /usr/local/lib/systemd/user-generators/ -p wa -k systemd_generator 2026-06-17 07:29:29.468491 | debian-bookworm | +-w /lib/systemd/system-generators/ -p wa -k systemd_generator 2026-06-17 07:29:29.468601 | debian-bookworm | + 2026-06-17 07:29:29.468714 | debian-bookworm | +## SELinux events that modify the system's Mandatory Access Controls (MAC) 2026-06-17 07:29:29.468825 | debian-bookworm | +-w /etc/selinux/ -p wa -k mac_policy 2026-06-17 07:29:29.468932 | debian-bookworm | + 2026-06-17 07:29:29.469042 | debian-bookworm | +## Critical elements access failures 2026-06-17 07:29:29.469155 | debian-bookworm | +-a always,exit -F arch=b64 -S open -F dir=/etc -F success=0 -k unauthedfileaccess 2026-06-17 07:29:29.469288 | debian-bookworm | +-a always,exit -F arch=b64 -S open -F dir=/bin -F success=0 -k unauthedfileaccess 2026-06-17 07:29:29.469402 | debian-bookworm | +-a always,exit -F arch=b64 -S open -F dir=/sbin -F success=0 -k unauthedfileaccess 2026-06-17 07:29:29.469521 | debian-bookworm | +-a always,exit -F arch=b64 -S open -F dir=/usr/bin -F success=0 -k unauthedfileaccess 2026-06-17 07:29:29.469635 | debian-bookworm | +-a always,exit -F arch=b64 -S open -F dir=/usr/sbin -F success=0 -k unauthedfileaccess 2026-06-17 07:29:29.469746 | debian-bookworm | +-a always,exit -F arch=b64 -S open -F dir=/var -F success=0 -k unauthedfileaccess 2026-06-17 07:29:29.469859 | debian-bookworm | +-a always,exit -F arch=b64 -S open -F dir=/home -F success=0 -k unauthedfileaccess 2026-06-17 07:29:29.469974 | debian-bookworm | +-a always,exit -F arch=b64 -S open -F dir=/srv -F success=0 -k unauthedfileaccess 2026-06-17 07:29:29.470080 | debian-bookworm | + 2026-06-17 07:29:29.470191 | debian-bookworm | +## Process ID change (switching accounts) applications 2026-06-17 07:29:29.470318 | debian-bookworm | +-w /bin/su -p x -k priv_esc 2026-06-17 07:29:29.470430 | debian-bookworm | +-w /usr/bin/sudo -p x -k priv_esc 2026-06-17 07:29:29.470536 | debian-bookworm | + 2026-06-17 07:29:29.470646 | debian-bookworm | +## Power state 2026-06-17 07:29:29.470756 | debian-bookworm | +-w /sbin/shutdown -p x -k power 2026-06-17 07:29:29.470864 | debian-bookworm | +-w /sbin/poweroff -p x -k power 2026-06-17 07:29:29.470974 | debian-bookworm | +-w /sbin/reboot -p x -k power 2026-06-17 07:29:29.471084 | debian-bookworm | +-w /sbin/halt -p x -k power 2026-06-17 07:29:29.471236 | debian-bookworm | + 2026-06-17 07:29:29.471448 | debian-bookworm | +## Session initiation information 2026-06-17 07:29:29.471615 | debian-bookworm | +-w /var/run/utmp -p wa -k session 2026-06-17 07:29:29.471737 | debian-bookworm | +-w /var/log/btmp -p wa -k session 2026-06-17 07:29:29.471849 | debian-bookworm | +-w /var/log/wtmp -p wa -k session 2026-06-17 07:29:29.471956 | debian-bookworm | + 2026-06-17 07:29:29.472091 | debian-bookworm | +## Discretionary Access Control (DAC) modifications 2026-06-17 07:29:29.472208 | debian-bookworm | +-a always,exit -F arch=b64 -S chmod -F auid>=1000 -F auid!=-1 -k perm_mod 2026-06-17 07:29:29.472341 | debian-bookworm | +-a always,exit -F arch=b64 -S chown -F auid>=1000 -F auid!=-1 -k perm_mod 2026-06-17 07:29:29.472460 | debian-bookworm | +-a always,exit -F arch=b64 -S fchmod -F auid>=1000 -F auid!=-1 -k perm_mod 2026-06-17 07:29:29.472602 | debian-bookworm | +-a always,exit -F arch=b64 -S fchmodat -F auid>=1000 -F auid!=-1 -k perm_mod 2026-06-17 07:29:29.472730 | debian-bookworm | +-a always,exit -F arch=b64 -S fchown -F auid>=1000 -F auid!=-1 -k perm_mod 2026-06-17 07:29:29.472842 | debian-bookworm | +-a always,exit -F arch=b64 -S fchownat -F auid>=1000 -F auid!=-1 -k perm_mod 2026-06-17 07:29:29.472956 | debian-bookworm | +-a always,exit -F arch=b64 -S fremovexattr -F auid>=1000 -F auid!=-1 -k perm_mod 2026-06-17 07:29:29.473068 | debian-bookworm | +-a always,exit -F arch=b64 -S fsetxattr -F auid>=1000 -F auid!=-1 -k perm_mod 2026-06-17 07:29:29.473178 | debian-bookworm | +-a always,exit -F arch=b64 -S lchown -F auid>=1000 -F auid!=-1 -k perm_mod 2026-06-17 07:29:29.473330 | debian-bookworm | +-a always,exit -F arch=b64 -S lremovexattr -F auid>=1000 -F auid!=-1 -k perm_mod 2026-06-17 07:29:29.473449 | debian-bookworm | +-a always,exit -F arch=b64 -S lsetxattr -F auid>=1000 -F auid!=-1 -k perm_mod 2026-06-17 07:29:29.473562 | debian-bookworm | +-a always,exit -F arch=b64 -S removexattr -F auid>=1000 -F auid!=-1 -k perm_mod 2026-06-17 07:29:29.473674 | debian-bookworm | +-a always,exit -F arch=b64 -S setxattr -F auid>=1000 -F auid!=-1 -k perm_mod 2026-06-17 07:29:29.473783 | debian-bookworm | + 2026-06-17 07:29:29.473897 | debian-bookworm | +# Special Rules --------------------------------------------------------------- 2026-06-17 07:29:29.474007 | debian-bookworm | + 2026-06-17 07:29:29.474115 | debian-bookworm | +## Reconnaissance 2026-06-17 07:29:29.474228 | debian-bookworm | +-w /usr/bin/whoami -p x -k recon 2026-06-17 07:29:29.474351 | debian-bookworm | +-w /usr/bin/id -p x -k recon 2026-06-17 07:29:29.474463 | debian-bookworm | +-w /bin/hostname -p x -k recon 2026-06-17 07:29:29.474571 | debian-bookworm | +-w /bin/uname -p x -k recon 2026-06-17 07:29:29.474681 | debian-bookworm | +-w /etc/issue -p r -k recon 2026-06-17 07:29:29.474791 | debian-bookworm | +-w /etc/hostname -p r -k recon 2026-06-17 07:29:29.474897 | debian-bookworm | + 2026-06-17 07:29:29.475005 | debian-bookworm | +## Suspicious activity 2026-06-17 07:29:29.475126 | debian-bookworm | +-w /usr/bin/wget -p x -k susp_activity 2026-06-17 07:29:29.475296 | debian-bookworm | +-w /usr/bin/curl -p x -k susp_activity 2026-06-17 07:29:29.475419 | debian-bookworm | +-w /usr/bin/base64 -p x -k susp_activity 2026-06-17 07:29:29.475533 | debian-bookworm | +-w /bin/nc -p x -k susp_activity 2026-06-17 07:29:29.475643 | debian-bookworm | +-w /bin/netcat -p x -k susp_activity 2026-06-17 07:29:29.475763 | debian-bookworm | +-w /usr/bin/ncat -p x -k susp_activity 2026-06-17 07:29:29.475874 | debian-bookworm | +-w /usr/bin/ss -p x -k susp_activity 2026-06-17 07:29:29.476140 | debian-bookworm | +-w /usr/bin/netstat -p x -k susp_activity 2026-06-17 07:29:29.476269 | debian-bookworm | +-w /usr/bin/ssh -p x -k susp_activity 2026-06-17 07:29:29.476425 | debian-bookworm | +-w /usr/bin/scp -p x -k susp_activity 2026-06-17 07:29:29.476536 | debian-bookworm | +-w /usr/bin/sftp -p x -k susp_activity 2026-06-17 07:29:29.476648 | debian-bookworm | +-w /usr/bin/ftp -p x -k susp_activity 2026-06-17 07:29:29.476758 | debian-bookworm | +-w /usr/bin/socat -p x -k susp_activity 2026-06-17 07:29:29.476868 | debian-bookworm | +-w /usr/bin/wireshark -p x -k susp_activity 2026-06-17 07:29:29.476976 | debian-bookworm | +-w /usr/bin/tshark -p x -k susp_activity 2026-06-17 07:29:29.477083 | debian-bookworm | +-w /usr/bin/rawshark -p x -k susp_activity 2026-06-17 07:29:29.477192 | debian-bookworm | +-w /usr/bin/rdesktop -p x -k susp_activity 2026-06-17 07:29:29.477317 | debian-bookworm | +-w /usr/local/bin/rdesktop -p x -k susp_activity 2026-06-17 07:29:29.477431 | debian-bookworm | +-w /usr/bin/wlfreerdp -p x -k susp_activity 2026-06-17 07:29:29.477540 | debian-bookworm | +-w /usr/bin/xfreerdp -p x -k susp_activity 2026-06-17 07:29:29.477651 | debian-bookworm | +-w /usr/local/bin/xfreerdp -p x -k susp_activity 2026-06-17 07:29:29.477763 | debian-bookworm | +-w /usr/bin/nmap -p x -k susp_activity 2026-06-17 07:29:29.477870 | debian-bookworm | + 2026-06-17 07:29:29.477980 | debian-bookworm | +## sssd 2026-06-17 07:29:29.478105 | debian-bookworm | +-a always,exit -F path=/usr/libexec/sssd/p11_child -F perm=x -F auid>=500 -F auid!=4294967295 -k T1078_Valid_Accounts 2026-06-17 07:29:29.478221 | debian-bookworm | +-a always,exit -F path=/usr/libexec/sssd/krb5_child -F perm=x -F auid>=500 -F auid!=4294967295 -k T1078_Valid_Accounts 2026-06-17 07:29:29.478346 | debian-bookworm | +-a always,exit -F path=/usr/libexec/sssd/ldap_child -F perm=x -F auid>=500 -F auid!=4294967295 -k T1078_Valid_Accounts 2026-06-17 07:29:29.478464 | debian-bookworm | +-a always,exit -F path=/usr/libexec/sssd/selinux_child -F perm=x -F auid>=500 -F auid!=4294967295 -k T1078_Valid_Accounts 2026-06-17 07:29:29.478576 | debian-bookworm | +-a always,exit -F path=/usr/libexec/sssd/proxy_child -F perm=x -F auid>=500 -F auid!=4294967295 -k T1078_Valid_Accounts 2026-06-17 07:29:29.478684 | debian-bookworm | + 2026-06-17 07:29:29.478793 | debian-bookworm | +## T1002 Data Compressed 2026-06-17 07:29:29.478901 | debian-bookworm | + 2026-06-17 07:29:29.479011 | debian-bookworm | +-w /usr/bin/zip -p x -k Data_Compressed 2026-06-17 07:29:29.479122 | debian-bookworm | +-w /usr/bin/gzip -p x -k Data_Compressed 2026-06-17 07:29:29.479232 | debian-bookworm | +-w /usr/bin/tar -p x -k Data_Compressed 2026-06-17 07:29:29.479506 | debian-bookworm | +-w /usr/bin/bzip2 -p x -k Data_Compressed 2026-06-17 07:29:29.479625 | debian-bookworm | + 2026-06-17 07:29:29.479737 | debian-bookworm | +-w /usr/bin/lzip -p x -k Data_Compressed 2026-06-17 07:29:29.479849 | debian-bookworm | +-w /usr/local/bin/lzip -p x -k Data_Compressed 2026-06-17 07:29:29.479957 | debian-bookworm | + 2026-06-17 07:29:29.480098 | debian-bookworm | +-w /usr/bin/lz4 -p x -k Data_Compressed 2026-06-17 07:29:29.480213 | debian-bookworm | +-w /usr/local/bin/lz4 -p x -k Data_Compressed 2026-06-17 07:29:29.480337 | debian-bookworm | + 2026-06-17 07:29:29.480448 | debian-bookworm | +-w /usr/bin/lzop -p x -k Data_Compressed 2026-06-17 07:29:29.480558 | debian-bookworm | +-w /usr/local/bin/lzop -p x -k Data_Compressed 2026-06-17 07:29:29.480667 | debian-bookworm | + 2026-06-17 07:29:29.480779 | debian-bookworm | +-w /usr/bin/plzip -p x -k Data_Compressed 2026-06-17 07:29:29.480890 | debian-bookworm | +-w /usr/local/bin/plzip -p x -k Data_Compressed 2026-06-17 07:29:29.480999 | debian-bookworm | + 2026-06-17 07:29:29.481111 | debian-bookworm | +-w /usr/bin/pbzip2 -p x -k Data_Compressed 2026-06-17 07:29:29.481221 | debian-bookworm | +-w /usr/local/bin/pbzip2 -p x -k Data_Compressed 2026-06-17 07:29:29.481343 | debian-bookworm | + 2026-06-17 07:29:29.481455 | debian-bookworm | +-w /usr/bin/lbzip2 -p x -k Data_Compressed 2026-06-17 07:29:29.481566 | debian-bookworm | +-w /usr/local/bin/lbzip2 -p x -k Data_Compressed 2026-06-17 07:29:29.481672 | debian-bookworm | + 2026-06-17 07:29:29.481783 | debian-bookworm | +-w /usr/bin/pixz -p x -k Data_Compressed 2026-06-17 07:29:29.481893 | debian-bookworm | +-w /usr/local/bin/pixz -p x -k Data_Compressed 2026-06-17 07:29:29.482001 | debian-bookworm | + 2026-06-17 07:29:29.482118 | debian-bookworm | +-w /usr/bin/pigz -p x -k Data_Compressed 2026-06-17 07:29:29.482228 | debian-bookworm | +-w /usr/local/bin/pigz -p x -k Data_Compressed 2026-06-17 07:29:29.482373 | debian-bookworm | +-w /usr/bin/unpigz -p x -k Data_Compressed 2026-06-17 07:29:29.482488 | debian-bookworm | +-w /usr/local/bin/unpigz -p x -k Data_Compressed 2026-06-17 07:29:29.482598 | debian-bookworm | + 2026-06-17 07:29:29.482711 | debian-bookworm | +-w /usr/bin/zstd -p x -k Data_Compressed 2026-06-17 07:29:29.482821 | debian-bookworm | +-w /usr/local/bin/zstd -p x -k Data_Compressed 2026-06-17 07:29:29.482939 | debian-bookworm | + 2026-06-17 07:29:29.483051 | debian-bookworm | +## Added to catch netcat on Ubuntu 2026-06-17 07:29:29.483163 | debian-bookworm | +-w /bin/nc.openbsd -p x -k susp_activity 2026-06-17 07:29:29.483287 | debian-bookworm | +-w /bin/nc.traditional -p x -k susp_activity 2026-06-17 07:29:29.483398 | debian-bookworm | + 2026-06-17 07:29:29.483511 | debian-bookworm | +## Sbin suspicious activity 2026-06-17 07:29:29.483622 | debian-bookworm | +-w /sbin/iptables -p x -k sbin_susp 2026-06-17 07:29:29.483733 | debian-bookworm | +-w /sbin/ip6tables -p x -k sbin_susp 2026-06-17 07:29:29.483842 | debian-bookworm | +-w /sbin/ifconfig -p x -k sbin_susp 2026-06-17 07:29:29.483954 | debian-bookworm | +-w /usr/sbin/arptables -p x -k sbin_susp 2026-06-17 07:29:29.484093 | debian-bookworm | +-w /usr/sbin/ebtables -p x -k sbin_susp 2026-06-17 07:29:29.484216 | debian-bookworm | +-w /sbin/xtables-nft-multi -p x -k sbin_susp 2026-06-17 07:29:29.484362 | debian-bookworm | +-w /usr/sbin/nft -p x -k sbin_susp 2026-06-17 07:29:29.484476 | debian-bookworm | +-w /usr/sbin/tcpdump -p x -k sbin_susp 2026-06-17 07:29:29.484588 | debian-bookworm | +-w /usr/sbin/traceroute -p x -k sbin_susp 2026-06-17 07:29:29.484696 | debian-bookworm | +-w /usr/sbin/ufw -p x -k sbin_susp 2026-06-17 07:29:29.484805 | debian-bookworm | + 2026-06-17 07:29:29.484914 | debian-bookworm | +### kde4 2026-06-17 07:29:29.485034 | debian-bookworm | +-a always,exit -F path=/usr/libexec/kde4/kpac_dhcp_helper -F perm=x -F auid>=1000 -F auid!=4294967295 -k T1078_Valid_Accounts 2026-06-17 07:29:29.485149 | debian-bookworm | +-a always,exit -F path=/usr/libexec/kde4/kdesud -F perm=x -F auid>=1000 -F auid!=4294967295 -k T1078_Valid_Accounts 2026-06-17 07:29:29.485255 | debian-bookworm | + 2026-06-17 07:29:29.485382 | debian-bookworm | +## dbus-send invocation 2026-06-17 07:29:29.485500 | debian-bookworm | +### may indicate privilege escalation CVE-2021-3560 2026-06-17 07:29:29.485613 | debian-bookworm | +-w /usr/bin/dbus-send -p x -k dbus_send 2026-06-17 07:29:29.485724 | debian-bookworm | +-w /usr/bin/gdbus -p x -k gdubs_call 2026-06-17 07:29:29.485835 | debian-bookworm | + 2026-06-17 07:29:29.485946 | debian-bookworm | +## pkexec invocation 2026-06-17 07:29:29.486061 | debian-bookworm | +### may indicate privilege escalation CVE-2021-4034 2026-06-17 07:29:29.486171 | debian-bookworm | +-w /usr/bin/pkexec -p x -k pkexec 2026-06-17 07:29:29.486310 | debian-bookworm | + 2026-06-17 07:29:29.486429 | debian-bookworm | +## Suspicious shells 2026-06-17 07:29:29.486541 | debian-bookworm | +-w /bin/ash -p x -k susp_shell 2026-06-17 07:29:29.486653 | debian-bookworm | +-w /bin/csh -p x -k susp_shell 2026-06-17 07:29:29.486762 | debian-bookworm | +-w /bin/fish -p x -k susp_shell 2026-06-17 07:29:29.486870 | debian-bookworm | +-w /bin/tcsh -p x -k susp_shell 2026-06-17 07:29:29.486978 | debian-bookworm | +-w /bin/tclsh -p x -k susp_shell 2026-06-17 07:29:29.487085 | debian-bookworm | +-w /bin/xonsh -p x -k susp_shell 2026-06-17 07:29:29.487194 | debian-bookworm | +-w /usr/local/bin/xonsh -p x -k susp_shell 2026-06-17 07:29:29.487318 | debian-bookworm | +-w /bin/open -p x -k susp_shell 2026-06-17 07:29:29.487430 | debian-bookworm | +-w /bin/rbash -p x -k susp_shell 2026-06-17 07:29:29.487537 | debian-bookworm | + 2026-06-17 07:29:29.487649 | debian-bookworm | +# Web Server Actvity 2026-06-17 07:29:29.487764 | debian-bookworm | +## Change the number "33" to the ID of your WebServer user. Default: www-data:x:33:33 2026-06-17 07:29:29.487876 | debian-bookworm | +-a always,exit -F arch=b64 -S execve -F euid=33 -k detect_execve_www 2026-06-17 07:29:29.487980 | debian-bookworm | + 2026-06-17 07:29:29.488110 | debian-bookworm | +### https://clustershell.readthedocs.io/ 2026-06-17 07:29:29.488220 | debian-bookworm | +-w /bin/clush -p x -k susp_shell 2026-06-17 07:29:29.488343 | debian-bookworm | +-w /usr/local/bin/clush -p x -k susp_shell 2026-06-17 07:29:29.488456 | debian-bookworm | +-w /etc/clustershell/clush.conf -p x -k susp_shell 2026-06-17 07:29:29.488564 | debian-bookworm | + 2026-06-17 07:29:29.488674 | debian-bookworm | +### https://github.com/tmux/tmux 2026-06-17 07:29:29.488783 | debian-bookworm | +-w /bin/tmux -p x -k susp_shell 2026-06-17 07:29:29.488892 | debian-bookworm | +-w /usr/local/bin/tmux -p x -k susp_shell 2026-06-17 07:29:29.488998 | debian-bookworm | + 2026-06-17 07:29:29.489114 | debian-bookworm | +## Shell/profile configurations 2026-06-17 07:29:29.489225 | debian-bookworm | +-w /etc/profile.d/ -p wa -k shell_profiles 2026-06-17 07:29:29.489364 | debian-bookworm | +-w /etc/profile -p wa -k shell_profiles 2026-06-17 07:29:29.489476 | debian-bookworm | +-w /etc/shells -p wa -k shell_profiles 2026-06-17 07:29:29.489585 | debian-bookworm | +-w /etc/bashrc -p wa -k shell_profiles 2026-06-17 07:29:29.489697 | debian-bookworm | +-w /etc/csh.cshrc -p wa -k shell_profiles 2026-06-17 07:29:29.489809 | debian-bookworm | +-w /etc/csh.login -p wa -k shell_profiles 2026-06-17 07:29:29.489920 | debian-bookworm | +-w /etc/fish/ -p wa -k shell_profiles 2026-06-17 07:29:29.490028 | debian-bookworm | +-w /etc/zsh/ -p wa -k shell_profiles 2026-06-17 07:29:29.490145 | debian-bookworm | + 2026-06-17 07:29:29.490256 | debian-bookworm | +### https://github.com/xxh/xxh 2026-06-17 07:29:29.490384 | debian-bookworm | +-w /usr/local/bin/xxh.bash -p x -k susp_shell 2026-06-17 07:29:29.490498 | debian-bookworm | +-w /usr/local/bin/xxh.xsh -p x -k susp_shell 2026-06-17 07:29:29.490610 | debian-bookworm | +-w /usr/local/bin/xxh.zsh -p x -k susp_shell 2026-06-17 07:29:29.490718 | debian-bookworm | + 2026-06-17 07:29:29.490829 | debian-bookworm | +## Injection 2026-06-17 07:29:29.490943 | debian-bookworm | +### These rules watch for code injection by the ptrace facility. 2026-06-17 07:29:29.491055 | debian-bookworm | +### This could indicate someone trying to do something bad or just debugging 2026-06-17 07:29:29.491166 | debian-bookworm | +-a always,exit -F arch=b64 -S ptrace -F a0=0x4 -k code_injection 2026-06-17 07:29:29.491306 | debian-bookworm | +-a always,exit -F arch=b64 -S ptrace -F a0=0x5 -k data_injection 2026-06-17 07:29:29.491425 | debian-bookworm | +-a always,exit -F arch=b64 -S ptrace -F a0=0x6 -k register_injection 2026-06-17 07:29:29.491537 | debian-bookworm | +-a always,exit -F arch=b64 -S ptrace -k tracing 2026-06-17 07:29:29.491644 | debian-bookworm | + 2026-06-17 07:29:29.491754 | debian-bookworm | +## Anonymous File Creation 2026-06-17 07:29:29.491863 | debian-bookworm | +### These rules watch the use of memfd_create 2026-06-17 07:29:29.491973 | debian-bookworm | +### "memfd_create" creates anonymous file and returns a file descriptor to access it 2026-06-17 07:29:29.492111 | debian-bookworm | +### When combined with "fexecve" can be used to stealthily run binaries in memory without touching disk 2026-06-17 07:29:29.492230 | debian-bookworm | +-a always,exit -F arch=b64 -S memfd_create -F key=anon_file_create 2026-06-17 07:29:29.492350 | debian-bookworm | + 2026-06-17 07:29:29.492460 | debian-bookworm | +## Privilege Abuse 2026-06-17 07:29:29.492576 | debian-bookworm | +### The purpose of this rule is to detect when an admin may be abusing power by looking in user's home dir. 2026-06-17 07:29:29.492696 | debian-bookworm | +-a always,exit -F dir=/home -F uid=0 -F auid>=1000 -F auid!=-1 -C auid!=obj_uid -k power_abuse 2026-06-17 07:29:29.492804 | debian-bookworm | + 2026-06-17 07:29:29.492915 | debian-bookworm | +# Socket Creations 2026-06-17 07:29:29.493025 | debian-bookworm | +# will catch both IPv4 and IPv6 2026-06-17 07:29:29.493133 | debian-bookworm | + 2026-06-17 07:29:29.493247 | debian-bookworm | +-a always,exit -F arch=b32 -S socket -F a0=2 -k network_socket_created 2026-06-17 07:29:29.493372 | debian-bookworm | +-a always,exit -F arch=b64 -S socket -F a0=2 -k network_socket_created 2026-06-17 07:29:29.493479 | debian-bookworm | + 2026-06-17 07:29:29.493589 | debian-bookworm | +-a always,exit -F arch=b32 -S socket -F a0=10 -k network_socket_created 2026-06-17 07:29:29.493701 | debian-bookworm | +-a always,exit -F arch=b64 -S socket -F a0=10 -k network_socket_created 2026-06-17 07:29:29.493807 | debian-bookworm | + 2026-06-17 07:29:29.493916 | debian-bookworm | +# Software Management --------------------------------------------------------- 2026-06-17 07:29:29.494025 | debian-bookworm | + 2026-06-17 07:29:29.494135 | debian-bookworm | +# RPM (Redhat/CentOS) 2026-06-17 07:29:29.494245 | debian-bookworm | +-w /usr/bin/rpm -p x -k software_mgmt 2026-06-17 07:29:29.494387 | debian-bookworm | +-w /usr/bin/yum -p x -k software_mgmt 2026-06-17 07:29:29.494499 | debian-bookworm | + 2026-06-17 07:29:29.494610 | debian-bookworm | +# DNF (Fedora/RedHat 8/CentOS 8) 2026-06-17 07:29:29.494721 | debian-bookworm | +-w /usr/bin/dnf -p x -k software_mgmt 2026-06-17 07:29:29.494830 | debian-bookworm | + 2026-06-17 07:29:29.494941 | debian-bookworm | +# YAST/Zypper/RPM (SuSE) 2026-06-17 07:29:29.495050 | debian-bookworm | +-w /sbin/yast -p x -k software_mgmt 2026-06-17 07:29:29.495161 | debian-bookworm | +-w /sbin/yast2 -p x -k software_mgmt 2026-06-17 07:29:29.495272 | debian-bookworm | +-w /bin/rpm -p x -k software_mgmt 2026-06-17 07:29:29.495406 | debian-bookworm | +-w /usr/bin/zypper -k software_mgmt 2026-06-17 07:29:29.495593 | debian-bookworm | + 2026-06-17 07:29:29.495996 | debian-bookworm | +# DPKG / APT-GET (Debian/Ubuntu) 2026-06-17 07:29:29.496329 | debian-bookworm | +-w /usr/bin/dpkg -p x -k software_mgmt 2026-06-17 07:29:29.496476 | debian-bookworm | +-w /usr/bin/apt -p x -k software_mgmt 2026-06-17 07:29:29.496595 | debian-bookworm | +-w /usr/bin/apt-add-repository -p x -k software_mgmt 2026-06-17 07:29:29.496711 | debian-bookworm | +-w /usr/bin/apt-get -p x -k software_mgmt 2026-06-17 07:29:29.496824 | debian-bookworm | +-w /usr/bin/aptitude -p x -k software_mgmt 2026-06-17 07:29:29.496937 | debian-bookworm | +-w /usr/bin/wajig -p x -k software_mgmt 2026-06-17 07:29:29.497054 | debian-bookworm | +-w /usr/bin/snap -p x -k software_mgmt 2026-06-17 07:29:29.497161 | debian-bookworm | + 2026-06-17 07:29:29.497272 | debian-bookworm | +# PIP(3) (Python installs) 2026-06-17 07:29:29.497424 | debian-bookworm | +-w /usr/bin/pip -p x -k third_party_software_mgmt 2026-06-17 07:29:29.497539 | debian-bookworm | +-w /usr/local/bin/pip -p x -k third_party_software_mgmt 2026-06-17 07:29:29.497660 | debian-bookworm | +-w /usr/bin/pip3 -p x -k third_party_software_mgmt 2026-06-17 07:29:29.497772 | debian-bookworm | +-w /usr/local/bin/pip3 -p x -k third_party_software_mgmt 2026-06-17 07:29:29.497883 | debian-bookworm | +-w /usr/bin/pipx -p x -k third_party_software_mgmt 2026-06-17 07:29:29.497994 | debian-bookworm | +-w /usr/local/bin/pipx -p x -k third_party_software_mgmt 2026-06-17 07:29:29.498104 | debian-bookworm | + 2026-06-17 07:29:29.498216 | debian-bookworm | +# npm 2026-06-17 07:29:29.498342 | debian-bookworm | +## T1072 third party software 2026-06-17 07:29:29.498453 | debian-bookworm | +## https://www.npmjs.com 2026-06-17 07:29:29.498563 | debian-bookworm | +## https://docs.npmjs.com/cli/v6/commands/npm-audit 2026-06-17 07:29:29.498678 | debian-bookworm | +-w /usr/bin/npm -p x -k third_party_software_mgmt 2026-06-17 07:29:29.498785 | debian-bookworm | + 2026-06-17 07:29:29.498899 | debian-bookworm | +# Comprehensive Perl Archive Network (CPAN) (CPAN installs) 2026-06-17 07:29:29.499009 | debian-bookworm | +## T1072 third party software 2026-06-17 07:29:29.499119 | debian-bookworm | +## https://www.cpan.org 2026-06-17 07:29:29.499231 | debian-bookworm | +-w /usr/bin/cpan -p x -k third_party_software_mgmt 2026-06-17 07:29:29.499353 | debian-bookworm | + 2026-06-17 07:29:29.499465 | debian-bookworm | +# Ruby (RubyGems installs) 2026-06-17 07:29:29.499575 | debian-bookworm | +## T1072 third party software 2026-06-17 07:29:29.499686 | debian-bookworm | +## https://rubygems.org 2026-06-17 07:29:29.499797 | debian-bookworm | +-w /usr/bin/gem -p x -k third_party_software_mgmt 2026-06-17 07:29:29.499905 | debian-bookworm | + 2026-06-17 07:29:29.500014 | debian-bookworm | +# LuaRocks (Lua installs) 2026-06-17 07:29:29.500146 | debian-bookworm | +## T1072 third party software 2026-06-17 07:29:29.500256 | debian-bookworm | +## https://luarocks.org 2026-06-17 07:29:29.500382 | debian-bookworm | +-w /usr/bin/luarocks -p x -k third_party_software_mgmt 2026-06-17 07:29:29.500491 | debian-bookworm | + 2026-06-17 07:29:29.500598 | debian-bookworm | +# Pacman (Arch Linux) 2026-06-17 07:29:29.500712 | debian-bookworm | +## https://wiki.archlinux.org/title/Pacman 2026-06-17 07:29:29.500823 | debian-bookworm | +## T1072 third party software 2026-06-17 07:29:29.500940 | debian-bookworm | +-w /etc/pacman.conf -p x -k third_party_software_mgmt 2026-06-17 07:29:29.501053 | debian-bookworm | +-w /etc/pacman.d -p x -k third_party_software_mgmt 2026-06-17 07:29:29.501161 | debian-bookworm | + 2026-06-17 07:29:29.501272 | debian-bookworm | +# Special Software ------------------------------------------------------------ 2026-06-17 07:29:29.501413 | debian-bookworm | + 2026-06-17 07:29:29.501524 | debian-bookworm | +## GDS specific secrets 2026-06-17 07:29:29.501636 | debian-bookworm | +-w /etc/puppet/ssl -p wa -k puppet_ssl 2026-06-17 07:29:29.501744 | debian-bookworm | + 2026-06-17 07:29:29.501851 | debian-bookworm | +## IBM Bigfix BESClient 2026-06-17 07:29:29.501963 | debian-bookworm | +-a always,exit -F arch=b64 -S open -F dir=/opt/BESClient -F success=0 -k soft_besclient 2026-06-17 07:29:29.502074 | debian-bookworm | +-w /var/opt/BESClient/ -p wa -k soft_besclient 2026-06-17 07:29:29.502182 | debian-bookworm | + 2026-06-17 07:29:29.502306 | debian-bookworm | +## CHEF https://www.chef.io/chef/ 2026-06-17 07:29:29.502416 | debian-bookworm | +-w /etc/chef -p wa -k soft_chef 2026-06-17 07:29:29.502524 | debian-bookworm | + 2026-06-17 07:29:29.502632 | debian-bookworm | +## Salt 2026-06-17 07:29:29.502743 | debian-bookworm | +## https://saltproject.io/ 2026-06-17 07:29:29.502858 | debian-bookworm | +## https://docs.saltproject.io/en/latest/ref/configuration/master.html 2026-06-17 07:29:29.502970 | debian-bookworm | +-w /etc/salt -p wa -k soft_salt 2026-06-17 07:29:29.503079 | debian-bookworm | +-w /usr/local/etc/salt -p wa -k soft_salt 2026-06-17 07:29:29.503187 | debian-bookworm | + 2026-06-17 07:29:29.503309 | debian-bookworm | +## Otter 2026-06-17 07:29:29.503422 | debian-bookworm | +## https://inedo.com/otter 2026-06-17 07:29:29.503532 | debian-bookworm | +-w /etc/otter -p wa -k soft_otter 2026-06-17 07:29:29.503638 | debian-bookworm | + 2026-06-17 07:29:29.503747 | debian-bookworm | +## T1081 Credentials In Files 2026-06-17 07:29:29.503856 | debian-bookworm | +-w /usr/bin/grep -p x -k string_search 2026-06-17 07:29:29.503966 | debian-bookworm | +-w /usr/bin/egrep -p x -k string_search 2026-06-17 07:29:29.504097 | debian-bookworm | +-w /usr/bin/ugrep -p x -k string_search 2026-06-17 07:29:29.504209 | debian-bookworm | +### macOS 2026-06-17 07:29:29.504349 | debian-bookworm | +-w /usr/local/bin/grep -p x -k string_search 2026-06-17 07:29:29.504463 | debian-bookworm | +-w /usr/local/bin/egrep -p x -k string_search 2026-06-17 07:29:29.504584 | debian-bookworm | +-w /usr/local/bin/ugrep -p x -k string_search 2026-06-17 07:29:29.504695 | debian-bookworm | + 2026-06-17 07:29:29.504807 | debian-bookworm | +### https://github.com/tmbinc/bgrep 2026-06-17 07:29:29.504918 | debian-bookworm | +-w /usr/bin/bgrep -p x -k string_search 2026-06-17 07:29:29.505027 | debian-bookworm | +### macOS 2026-06-17 07:29:29.505137 | debian-bookworm | +-w /usr/local/bin/bgrep -p x -k string_search 2026-06-17 07:29:29.505253 | debian-bookworm | + 2026-06-17 07:29:29.505385 | debian-bookworm | +### https://github.com/BurntSushi/ripgrep 2026-06-17 07:29:29.505498 | debian-bookworm | +-w /usr/bin/rg -p x -k string_search 2026-06-17 07:29:29.505609 | debian-bookworm | +### macOS 2026-06-17 07:29:29.505720 | debian-bookworm | +-w /usr/local/bin/rg -p x -k string_search 2026-06-17 07:29:29.505826 | debian-bookworm | + 2026-06-17 07:29:29.505935 | debian-bookworm | +### https://github.com/awgn/cgrep 2026-06-17 07:29:29.506042 | debian-bookworm | + 2026-06-17 07:29:29.506152 | debian-bookworm | +-w /usr/bin/cgrep -p x -k string_search 2026-06-17 07:29:29.506261 | debian-bookworm | +### macOS 2026-06-17 07:29:29.506401 | debian-bookworm | +-w /usr/local/bin/cgrep -p x -k string_search 2026-06-17 07:29:29.506509 | debian-bookworm | + 2026-06-17 07:29:29.506619 | debian-bookworm | +### https://github.com/jpr5/ngrep 2026-06-17 07:29:29.506727 | debian-bookworm | +-w /usr/bin/ngrep -p x -k string_search 2026-06-17 07:29:29.506834 | debian-bookworm | +### macOS 2026-06-17 07:29:29.506945 | debian-bookworm | +-w /usr/local/bin/ngrep -p x -k string_search 2026-06-17 07:29:29.507051 | debian-bookworm | + 2026-06-17 07:29:29.507164 | debian-bookworm | +### https://github.com/vrothberg/vgrep 2026-06-17 07:29:29.507286 | debian-bookworm | +-w /usr/bin/vgrep -p x -k string_search 2026-06-17 07:29:29.507398 | debian-bookworm | +### macOS 2026-06-17 07:29:29.507510 | debian-bookworm | +-w /usr/local/bin/vgrep -p x -k string_search 2026-06-17 07:29:29.507618 | debian-bookworm | + 2026-06-17 07:29:29.507732 | debian-bookworm | +### https://github.com/monochromegane/the_platinum_searcher 2026-06-17 07:29:29.507842 | debian-bookworm | +-w /usr/bin/pt -p x -k string_search 2026-06-17 07:29:29.507950 | debian-bookworm | +### macOS 2026-06-17 07:29:29.508078 | debian-bookworm | +-w /usr/local/bin/pt -p x -k string_search 2026-06-17 07:29:29.508192 | debian-bookworm | + 2026-06-17 07:29:29.508328 | debian-bookworm | +### https://github.com/gvansickle/ucg 2026-06-17 07:29:29.508441 | debian-bookworm | +-w /usr/bin/ucg -p x -k string_search 2026-06-17 07:29:29.508550 | debian-bookworm | +### macOS 2026-06-17 07:29:29.508661 | debian-bookworm | +-w /usr/local/bin/ucg -p x -k string_search 2026-06-17 07:29:29.508768 | debian-bookworm | + 2026-06-17 07:29:29.508878 | debian-bookworm | +### https://github.com/ggreer/the_silver_searcher 2026-06-17 07:29:29.508989 | debian-bookworm | +-w /usr/bin/ag -p x -k string_search 2026-06-17 07:29:29.509097 | debian-bookworm | +### macOS 2026-06-17 07:29:29.509215 | debian-bookworm | +-w /usr/local/bin/ag -p x -k string_search 2026-06-17 07:29:29.509335 | debian-bookworm | + 2026-06-17 07:29:29.509447 | debian-bookworm | +### https://github.com/beyondgrep/ack3 2026-06-17 07:29:29.509557 | debian-bookworm | +### https://beyondgrep.com 2026-06-17 07:29:29.509666 | debian-bookworm | +-w /usr/bin/ack -p x -k string_search 2026-06-17 07:29:29.509777 | debian-bookworm | +-w /usr/local/bin/ack -p x -k string_search 2026-06-17 07:29:29.509886 | debian-bookworm | +-w /usr/bin/semgrep -p x -k string_search 2026-06-17 07:29:29.509995 | debian-bookworm | +### macOS 2026-06-17 07:29:29.510105 | debian-bookworm | +-w /usr/local/bin/semgrep -p x -k string_search 2026-06-17 07:29:29.510210 | debian-bookworm | + 2026-06-17 07:29:29.510346 | debian-bookworm | +## Docker 2026-06-17 07:29:29.510459 | debian-bookworm | +-w /usr/bin/dockerd -k docker 2026-06-17 07:29:29.510568 | debian-bookworm | +-w /usr/bin/docker -k docker 2026-06-17 07:29:29.510677 | debian-bookworm | +-w /usr/bin/docker-containerd -k docker 2026-06-17 07:29:29.510785 | debian-bookworm | +-w /usr/bin/docker-runc -k docker 2026-06-17 07:29:29.510929 | debian-bookworm | +-w /var/lib/docker -p wa -k docker 2026-06-17 07:29:29.511090 | debian-bookworm | +-w /etc/docker -k docker 2026-06-17 07:29:29.511212 | debian-bookworm | +-w /etc/sysconfig/docker -k docker 2026-06-17 07:29:29.511340 | debian-bookworm | +-w /etc/sysconfig/docker-storage -k docker 2026-06-17 07:29:29.511455 | debian-bookworm | +-w /usr/lib/systemd/system/docker.service -k docker 2026-06-17 07:29:29.511565 | debian-bookworm | +-w /usr/lib/systemd/system/docker.socket -k docker 2026-06-17 07:29:29.511672 | debian-bookworm | + 2026-06-17 07:29:29.511784 | debian-bookworm | +## Virtualization stuff 2026-06-17 07:29:29.511895 | debian-bookworm | +-w /usr/bin/qemu-system-x86_64 -p x -k qemu-system-x86_64 2026-06-17 07:29:29.512004 | debian-bookworm | +-w /usr/bin/qemu-img -p x -k qemu-img 2026-06-17 07:29:29.512135 | debian-bookworm | +-w /usr/bin/qemu-kvm -p x -k qemu-kvm 2026-06-17 07:29:29.512246 | debian-bookworm | +-w /usr/bin/qemu -p x -k qemu 2026-06-17 07:29:29.512389 | debian-bookworm | +-w /usr/bin/virtualbox -p x -k virtualbox 2026-06-17 07:29:29.512506 | debian-bookworm | +-w /usr/bin/virt-manager -p x -k virt-manager 2026-06-17 07:29:29.512617 | debian-bookworm | +-w /usr/bin/VBoxManage -p x -k VBoxManage 2026-06-17 07:29:29.512724 | debian-bookworm | + 2026-06-17 07:29:29.512837 | debian-bookworm | +#### VirtualBox on macOS 2026-06-17 07:29:29.512946 | debian-bookworm | + 2026-06-17 07:29:29.513058 | debian-bookworm | +-w /usr/local/bin/VirtualBox -p x -k virt_tool 2026-06-17 07:29:29.513180 | debian-bookworm | +-w /usr/local/bin/VirtualBoxVM -p x -k virt_tool 2026-06-17 07:29:29.513308 | debian-bookworm | +-w /usr/local/bin/VBoxManage -p x -k virt_tool 2026-06-17 07:29:29.513421 | debian-bookworm | +-w /usr/local/bin/VBoxVRDP -p x -k virt_tool 2026-06-17 07:29:29.513534 | debian-bookworm | +-w /usr/local/bin/VBoxHeadless -p x -k virt_tool 2026-06-17 07:29:29.513644 | debian-bookworm | +-w /usr/local/bin/vboxwebsrv -p x -k virt_tool 2026-06-17 07:29:29.513754 | debian-bookworm | +-w /usr/local/bin/VBoxBugReport -p x -k virt_tool 2026-06-17 07:29:29.513865 | debian-bookworm | +-w /usr/local/bin/VBoxBalloonCtrl -p x -k virt_tool 2026-06-17 07:29:29.513976 | debian-bookworm | +-w /usr/local/bin/VBoxAutostart -p x -k virt_tool 2026-06-17 07:29:29.514086 | debian-bookworm | +-w /usr/local/bin/VBoxDTrace -p x -k virt_tool 2026-06-17 07:29:29.514197 | debian-bookworm | +-w /usr/local/bin/vbox-img -p x -k virt_tool 2026-06-17 07:29:29.514324 | debian-bookworm | +-w /Library/LaunchDaemons/org.virtualbox.startup.plist -p x -k virt_tool 2026-06-17 07:29:29.514439 | debian-bookworm | +-w /Library/Application Support/VirtualBox/LaunchDaemons/ -p x -k virt_tool 2026-06-17 07:29:29.514550 | debian-bookworm | +-w /Library/Application Support/VirtualBox/VBoxDrv.kext/ -p x -k virt_tool 2026-06-17 07:29:29.514662 | debian-bookworm | +-w /Library/Application Support/VirtualBox/VBoxUSB.kext/ -p x -k virt_tool 2026-06-17 07:29:29.514773 | debian-bookworm | +-w /Library/Application Support/VirtualBox/VBoxNetFlt.kext/ -p x -k virt_tool 2026-06-17 07:29:29.514881 | debian-bookworm | +-w /Library/Application Support/VirtualBox/VBoxNetAdp.kext/ -p x -k virt_tool 2026-06-17 07:29:29.515047 | debian-bookworm | + 2026-06-17 07:29:29.515163 | debian-bookworm | +### Parallels Desktop on macOS 2026-06-17 07:29:29.515269 | debian-bookworm | + 2026-06-17 07:29:29.515411 | debian-bookworm | +-w /usr/local/bin/prl_convert -p x -k virt_tool 2026-06-17 07:29:29.515522 | debian-bookworm | +-w /usr/local/bin/prl_disk_tool -p x -k virt_tool 2026-06-17 07:29:29.515632 | debian-bookworm | +-w /usr/local/bin/prl_perf_ctl -p x -k virt_tool 2026-06-17 07:29:29.515743 | debian-bookworm | +-w /usr/local/bin/prlcore2dmp -p x -k virt_tool 2026-06-17 07:29:29.515863 | debian-bookworm | +-w /usr/local/bin/prlctl -p x -k virt_tool 2026-06-17 07:29:29.515973 | debian-bookworm | +-w /usr/local/bin/prlexec -p x -k virt_tool 2026-06-17 07:29:29.516101 | debian-bookworm | +-w /usr/local/bin/prlsrvctl -p x -k virt_tool 2026-06-17 07:29:29.516215 | debian-bookworm | +-w /Library/Preferences/Parallels -p x -k virt_tool 2026-06-17 07:29:29.516337 | debian-bookworm | + 2026-06-17 07:29:29.516445 | debian-bookworm | +### qemu on macOS 2026-06-17 07:29:29.516553 | debian-bookworm | + 2026-06-17 07:29:29.516662 | debian-bookworm | +-w /usr/local/bin/qemu-edid -p x -k virt_tool 2026-06-17 07:29:29.516774 | debian-bookworm | +-w /usr/local/bin/qemu-img -p x -k virt_tool 2026-06-17 07:29:29.516887 | debian-bookworm | +-w /usr/local/bin/qemu-io -p x -k virt_tool 2026-06-17 07:29:29.516996 | debian-bookworm | +-w /usr/local/bin/qemu-nbd -p x -k virt_tool 2026-06-17 07:29:29.517113 | debian-bookworm | +-w /usr/local/bin/qemu-system-x86_64 -p x -k virt_tool 2026-06-17 07:29:29.517222 | debian-bookworm | + 2026-06-17 07:29:29.517343 | debian-bookworm | +## Kubelet 2026-06-17 07:29:29.517452 | debian-bookworm | +-w /usr/bin/kubelet -k kubelet 2026-06-17 07:29:29.517557 | debian-bookworm | + 2026-06-17 07:29:29.517663 | debian-bookworm | +# ipc system call 2026-06-17 07:29:29.517771 | debian-bookworm | +# /usr/include/linux/ipc.h 2026-06-17 07:29:29.517880 | debian-bookworm | + 2026-06-17 07:29:29.517996 | debian-bookworm | +## msgctl 2026-06-17 07:29:29.518111 | debian-bookworm | +#-a always,exit -S ipc -F a0=14 -k Inter-Process_Communication 2026-06-17 07:29:29.518221 | debian-bookworm | +## msgget 2026-06-17 07:29:29.518348 | debian-bookworm | +#-a always,exit -S ipc -F a0=13 -k Inter-Process_Communication 2026-06-17 07:29:29.518462 | debian-bookworm | +## Use these lines on x86_64, ia64 instead 2026-06-17 07:29:29.518574 | debian-bookworm | +-a always,exit -F arch=b64 -S msgctl -k Inter-Process_Communication 2026-06-17 07:29:29.518685 | debian-bookworm | +-a always,exit -F arch=b64 -S msgget -k Inter-Process_Communication 2026-06-17 07:29:29.518792 | debian-bookworm | + 2026-06-17 07:29:29.518898 | debian-bookworm | +## semctl 2026-06-17 07:29:29.519011 | debian-bookworm | +#-a always,exit -S ipc -F a0=3 -k Inter-Process_Communication 2026-06-17 07:29:29.519120 | debian-bookworm | +## semget 2026-06-17 07:29:29.519232 | debian-bookworm | +#-a always,exit -S ipc -F a0=2 -k Inter-Process_Communication 2026-06-17 07:29:29.519372 | debian-bookworm | +## semop 2026-06-17 07:29:29.519485 | debian-bookworm | +#-a always,exit -S ipc -F a0=1 -k Inter-Process_Communication 2026-06-17 07:29:29.519593 | debian-bookworm | +## semtimedop 2026-06-17 07:29:29.519719 | debian-bookworm | +#-a always,exit -S ipc -F a0=4 -k Inter-Process_Communication 2026-06-17 07:29:29.519871 | debian-bookworm | +## Use these lines on x86_64, ia64 instead 2026-06-17 07:29:29.520002 | debian-bookworm | +-a always,exit -F arch=b64 -S semctl -k Inter-Process_Communication 2026-06-17 07:29:29.520135 | debian-bookworm | +-a always,exit -F arch=b64 -S semget -k Inter-Process_Communication 2026-06-17 07:29:29.520247 | debian-bookworm | +-a always,exit -F arch=b64 -S semop -k Inter-Process_Communication 2026-06-17 07:29:29.520384 | debian-bookworm | +-a always,exit -F arch=b64 -S semtimedop -k Inter-Process_Communication 2026-06-17 07:29:29.520492 | debian-bookworm | + 2026-06-17 07:29:29.520601 | debian-bookworm | +## shmctl 2026-06-17 07:29:29.520712 | debian-bookworm | +#-a always,exit -S ipc -F a0=24 -k Inter-Process_Communication 2026-06-17 07:29:29.520844 | debian-bookworm | +## shmget 2026-06-17 07:29:29.520976 | debian-bookworm | +#-a always,exit -S ipc -F a0=23 -k Inter-Process_Communication 2026-06-17 07:29:29.521090 | debian-bookworm | +## Use these lines on x86_64, ia64 instead 2026-06-17 07:29:29.521202 | debian-bookworm | +-a always,exit -F arch=b64 -S shmctl -k Inter-Process_Communication 2026-06-17 07:29:29.521345 | debian-bookworm | +-a always,exit -F arch=b64 -S shmget -k Inter-Process_Communication 2026-06-17 07:29:29.521457 | debian-bookworm | + 2026-06-17 07:29:29.521568 | debian-bookworm | +# High Volume Events ---------------------------------------------------------- 2026-06-17 07:29:29.521674 | debian-bookworm | + 2026-06-17 07:29:29.521784 | debian-bookworm | +## Disable these rules if they create too many events in your environment 2026-06-17 07:29:29.521890 | debian-bookworm | + 2026-06-17 07:29:29.522000 | debian-bookworm | +## Common Shells 2026-06-17 07:29:29.522110 | debian-bookworm | +-w /bin/bash -p x -k susp_shell 2026-06-17 07:29:29.522221 | debian-bookworm | +-w /bin/dash -p x -k susp_shell 2026-06-17 07:29:29.522350 | debian-bookworm | +-w /bin/busybox -p x -k susp_shell 2026-06-17 07:29:29.522458 | debian-bookworm | +-w /bin/zsh -p x -k susp_shell 2026-06-17 07:29:29.522568 | debian-bookworm | +-w /bin/sh -p x -k susp_shell 2026-06-17 07:29:29.522678 | debian-bookworm | +-w /bin/ksh -p x -k susp_shell 2026-06-17 07:29:29.522787 | debian-bookworm | + 2026-06-17 07:29:29.522900 | debian-bookworm | +## Root command executions 2026-06-17 07:29:29.523015 | debian-bookworm | +-a always,exit -F arch=b64 -F euid=0 -F auid>=1000 -F auid!=-1 -S execve -k rootcmd 2026-06-17 07:29:29.523123 | debian-bookworm | + 2026-06-17 07:29:29.523235 | debian-bookworm | +## File Deletion Events by User 2026-06-17 07:29:29.523365 | debian-bookworm | +-a always,exit -F arch=b64 -S rmdir -S unlink -S unlinkat -S rename -S renameat -F auid>=1000 -F auid!=-1 -k delete 2026-06-17 07:29:29.523473 | debian-bookworm | + 2026-06-17 07:29:29.523581 | debian-bookworm | +## File Access 2026-06-17 07:29:29.523691 | debian-bookworm | +### Unauthorized Access (unsuccessful) 2026-06-17 07:29:29.523810 | debian-bookworm | +-a always,exit -F arch=b64 -S creat -S open -S openat -S open_by_handle_at -S truncate -S ftruncate -F exit=-EACCES -F auid>=1000 -F auid!=-1 -k file_access 2026-06-17 07:29:29.523927 | debian-bookworm | +-a always,exit -F arch=b64 -S creat -S open -S openat -S open_by_handle_at -S truncate -S ftruncate -F exit=-EPERM -F auid>=1000 -F auid!=-1 -k file_access 2026-06-17 07:29:29.524061 | debian-bookworm | + 2026-06-17 07:29:29.524181 | debian-bookworm | +### Unsuccessful Creation 2026-06-17 07:29:29.524326 | debian-bookworm | +-a always,exit -F arch=b64 -S mkdir,creat,link,symlink,mknod,mknodat,linkat,symlinkat -F exit=-EACCES -k file_creation 2026-06-17 07:29:29.524445 | debian-bookworm | +-a always,exit -F arch=b64 -S mkdir,link,symlink,mkdirat -F exit=-EPERM -k file_creation 2026-06-17 07:29:29.524553 | debian-bookworm | + 2026-06-17 07:29:29.524663 | debian-bookworm | +### Unsuccessful Modification 2026-06-17 07:29:29.524778 | debian-bookworm | +-a always,exit -F arch=b64 -S rename -S renameat -S truncate -S chmod -S setxattr -S lsetxattr -S removexattr -S lremovexattr -F exit=-EACCES -k file_modification 2026-06-17 07:29:29.524892 | debian-bookworm | +-a always,exit -F arch=b64 -S rename -S renameat -S truncate -S chmod -S setxattr -S lsetxattr -S removexattr -S lremovexattr -F exit=-EPERM -k file_modification 2026-06-17 07:29:29.524999 | debian-bookworm | + 2026-06-17 07:29:29.525110 | debian-bookworm | +## 32bit API Exploitation 2026-06-17 07:29:29.525227 | debian-bookworm | +### If you are on a 64 bit platform, everything _should_ be running 2026-06-17 07:29:29.525353 | debian-bookworm | +### in 64 bit mode. This rule will detect any use of the 32 bit syscalls 2026-06-17 07:29:29.525466 | debian-bookworm | +### because this might be a sign of someone exploiting a hole in the 32 2026-06-17 07:29:29.525575 | debian-bookworm | +### bit API. 2026-06-17 07:29:29.525688 | debian-bookworm | +-a always,exit -F arch=b32 -S all -k 32bit_api 2026-06-17 07:29:29.525793 | debian-bookworm | + 2026-06-17 07:29:29.525905 | debian-bookworm | +# Make The Configuration Immutable -------------------------------------------- 2026-06-17 07:29:29.526023 | debian-bookworm | + 2026-06-17 07:29:29.526131 | debian-bookworm | +##-e 2 2026-06-17 07:29:29.526239 | debian-bookworm | 2026-06-17 07:29:29.526503 | debian-bookworm | changed: [molecule-auditd] => (item=20-neo23x0.rules) => {"ansible_loop_var": "item", "changed": true, "checksum": "9f99ce5c4f891fbf3e2bce06ed4cb97fb9e01f41", "dest": "/etc/audit/rules.d/20-neo23x0.rules", "gid": 0, "group": "root", "item": "20-neo23x0.rules", "md5sum": "6ac57206fd77de34805c3f4d50ef8b1d", "mode": "0644", "owner": "root", "size": 27367, "src": "/home/zuul/.ansible/tmp/ansible-tmp-1781681368.6641777-2654-143540813413601/.source.rules", "state": "file", "uid": 0} 2026-06-17 07:29:29.526617 | debian-bookworm | 2026-06-17 07:29:29.526732 | debian-bookworm | TASK [auditd : Manage auditd service] ****************************************** 2026-06-17 07:29:30.192679 | debian-bookworm | ok: [molecule-auditd] => {"changed": false, "enabled": true, "name": "auditd", "state": "started", "status": {"ActiveEnterTimestamp": "Wed 2026-06-17 07:29:23 UTC", "ActiveEnterTimestampMonotonic": "219723212", "ActiveExitTimestampMonotonic": "0", "ActiveState": "active", "After": "local-fs.target systemd-journald.socket system.slice systemd-tmpfiles-setup.service", "AllowIsolate": "no", "AssertResult": "yes", "AssertTimestamp": "Wed 2026-06-17 07:29:23 UTC", "AssertTimestampMonotonic": "219657636", "Before": "shutdown.target sysinit.target ssh.service systemd-update-utmp.service", "BlockIOAccounting": "no", "BlockIOWeight": "[not set]", "CPUAccounting": "yes", "CPUAffinityFromNUMA": "no", "CPUQuotaPerSecUSec": "infinity", "CPUQuotaPeriodUSec": "infinity", "CPUSchedulingPolicy": "0", "CPUSchedulingPriority": "0", "CPUSchedulingResetOnFork": "no", "CPUShares": "[not set]", "CPUUsageNSec": "50412000", "CPUWeight": "[not set]", "CacheDirectoryMode": "0755", "CanFreeze": "yes", "CanIsolate": "no", "CanReload": "no", "CanStart": "yes", "CanStop": "yes", "CapabilityBoundingSet": "cap_chown cap_dac_override cap_dac_read_search cap_fowner cap_fsetid cap_kill cap_setgid cap_setuid cap_setpcap cap_linux_immutable cap_net_bind_service cap_net_broadcast cap_net_admin cap_net_raw cap_ipc_lock cap_ipc_owner cap_sys_rawio cap_sys_chroot cap_sys_ptrace cap_sys_pacct cap_sys_admin cap_sys_boot cap_sys_nice cap_sys_resource cap_sys_time cap_sys_tty_config cap_mknod cap_lease cap_audit_write cap_audit_control cap_setfcap cap_mac_override cap_mac_admin cap_syslog cap_wake_alarm cap_block_suspend cap_audit_read cap_perfmon cap_bpf cap_checkpoint_restore", "CleanResult": "success", "CollectMode": "inactive", "ConditionResult": "yes", "ConditionTimestamp": "Wed 2026-06-17 07:29:23 UTC", "ConditionTimestampMonotonic": "219657593", "ConfigurationDirectoryMode": "0755", "Conflicts": "shutdown.target", "ControlGroup": "/system.slice/auditd.service", "ControlGroupId": "3328", "ControlPID": "0", "CoredumpFilter": "0x33", "DefaultDependencies": "no", "DefaultMemoryLow": "0", "DefaultMemoryMin": "0", "Delegate": "no", "Description": "Security Auditing Service", "DevicePolicy": "auto", "Documentation": "\"man:auditd(8)\" https://github.com/linux-audit/audit-documentation", "DynamicUser": "no", "ExecMainCode": "0", "ExecMainExitTimestampMonotonic": "0", "ExecMainPID": "2426", "ExecMainStartTimestamp": "Wed 2026-06-17 07:29:23 UTC", "ExecMainStartTimestampMonotonic": "219694370", "ExecMainStatus": "0", "ExecStart": "{ path=/sbin/auditd ; argv[]=/sbin/auditd ; ignore_errors=no ; start_time=[Wed 2026-06-17 07:29:23 UTC] ; stop_time=[Wed 2026-06-17 07:29:23 UTC] ; pid=2425 ; code=exited ; status=0 }", "ExecStartEx": "{ path=/sbin/auditd ; argv[]=/sbin/auditd ; flags= ; start_time=[Wed 2026-06-17 07:29:23 UTC] ; stop_time=[Wed 2026-06-17 07:29:23 UTC] ; pid=2425 ; code=exited ; status=0 }", "ExecStartPost": "{ path=/sbin/augenrules ; argv[]=/sbin/augenrules --load ; ignore_errors=yes ; start_time=[Wed 2026-06-17 07:29:23 UTC] ; stop_time=[Wed 2026-06-17 07:29:23 UTC] ; pid=2429 ; code=exited ; status=0 }", "ExecStartPostEx": "{ path=/sbin/augenrules ; argv[]=/sbin/augenrules --load ; flags=ignore-failure ; start_time=[Wed 2026-06-17 07:29:23 UTC] ; stop_time=[Wed 2026-06-17 07:29:23 UTC] ; pid=2429 ; code=exited ; status=0 }", "ExitType": "main", "FailureAction": "none", "FileDescriptorStoreMax": "0", "FinalKillSignal": "9", "FragmentPath": "/lib/systemd/system/auditd.service", "FreezerState": "running", "GID": "[not set]", "GuessMainPID": "yes", "IOAccounting": "no", "IOReadBytes": "18446744073709551615", "IOReadOperations": "18446744073709551615", "IOSchedulingClass": "2", "IOSchedulingPriority": "4", "IOWeight": "[not set]", "IOWriteBytes": "18446744073709551615", "IOWriteOperations": "18446744073709551615", "IPAccounting": "no", "IPEgressBytes": "[no data]", "IPEgressPackets": "[no data]", "IPIngressBytes": "[no data]", "IPIngressPackets": "[no data]", "Id": "auditd.service", "IgnoreOnIsolate": "no", "IgnoreSIGPIPE": "yes", "InactiveEnterTimestampMonotonic": "0", "InactiveExitTimestamp": "Wed 2026-06-17 07:29:23 UTC", "InactiveExitTimestampMonotonic": "219672913", "InvocationID": "e9d8dcedc67f491495b9dbf193f071fe", "JobRunningTimeoutUSec": "infinity", "JobTimeoutAction": "none", "JobTimeoutUSec": "infinity", "KeyringMode": "private", "KillMode": "control-group", "KillSignal": "15", "LimitAS": "infinity", "LimitASSoft": "infinity", "LimitCORE": "infinity", "LimitCORESoft": "0", "LimitCPU": "infinity", "LimitCPUSoft": "infinity", "LimitDATA": "infinity", "LimitDATASoft": "infinity", "LimitFSIZE": "infinity", "LimitFSIZESoft": "infinity", "LimitLOCKS": "infinity", "LimitLOCKSSoft": "infinity", "LimitMEMLOCK": "8388608", "LimitMEMLOCKSoft": "8388608", "LimitMSGQUEUE": "819200", "LimitMSGQUEUESoft": "819200", "LimitNICE": "0", "LimitNICESoft": "0", "LimitNOFILE": "524288", "LimitNOFILESoft": "1024", "LimitNPROC": "15480", "LimitNPROCSoft": "15480", "LimitRSS": "infinity", "LimitRSSSoft": "infinity", "LimitRTPRIO": "0", "LimitRTPRIOSoft": "0", "LimitRTTIME": "infinity", "LimitRTTIMESoft": "infinity", "LimitSIGPENDING": "15480", "LimitSIGPENDINGSoft": "15480", "LimitSTACK": "infinity", "LimitSTACKSoft": "8388608", "LoadState": "loaded", "LockPersonality": "yes", "LogLevelMax": "-1", "LogRateLimitBurst": "0", "LogRateLimitIntervalUSec": "0", "LogsDirectoryMode": "0755", "MainPID": "2426", "ManagedOOMMemoryPressure": "auto", "ManagedOOMMemoryPressureLimit": "0", "ManagedOOMPreference": "none", "ManagedOOMSwap": "auto", "MemoryAccounting": "yes", "MemoryAvailable": "infinity", "MemoryCurrent": "716800", "MemoryDenyWriteExecute": "yes", "MemoryHigh": "infinity", "MemoryLimit": "infinity", "MemoryLow": "0", "MemoryMax": "infinity", "MemoryMin": "0", "MemorySwapMax": "infinity", "MountAPIVFS": "no", "NFileDescriptorStore": "0", "NRestarts": "0", "NUMAPolicy": "n/a", "Names": "auditd.service", "NeedDaemonReload": "no", "Nice": "0", "NoNewPrivileges": "no", "NonBlocking": "no", "NotifyAccess": "none", "OOMPolicy": "stop", "OOMScoreAdjust": "0", "OnFailureJobMode": "replace", "OnSuccessJobMode": "fail", "PIDFile": "/run/auditd.pid", "Perpetual": "no", "PrivateDevices": "no", "PrivateIPC": "no", "PrivateMounts": "no", "PrivateNetwork": "no", "PrivateTmp": "no", "PrivateUsers": "no", "ProcSubset": "all", "ProtectClock": "no", "ProtectControlGroups": "yes", "ProtectHome": "no", "ProtectHostname": "no", "ProtectKernelLogs": "no", "ProtectKernelModules": "yes", "ProtectKernelTunables": "no", "ProtectProc": "default", "ProtectSystem": "no", "RefuseManualStart": "no", "RefuseManualStop": "no", "ReloadResult": "success", "RemainAfterExit": "no", "RemoveIPC": "no", "Requires": "system.slice", "Restart": "on-failure", "RestartKillSignal": "15", "RestartPreventExitStatus": "2 4 6", "RestartUSec": "100ms", "RestrictNamespaces": "no", "RestrictRealtime": "yes", "RestrictSUIDSGID": "no", "Result": "success", "RootDirectoryStartOnly": "no", "RuntimeDirectoryMode": "0755", "RuntimeDirectoryPreserve": "no", "RuntimeMaxUSec": "infinity", "RuntimeRandomizedExtraUSec": "0", "SameProcessGroup": "no", "SecureBits": "0", "SendSIGHUP": "no", "SendSIGKILL": "yes", "Slice": "system.slice", "StandardError": "inherit", "StandardInput": "null", "StandardOutput": "journal", "StartLimitAction": "none", "StartLimitBurst": "5", "StartLimitIntervalUSec": "10s", "StartupBlockIOWeight": "[not set]", "StartupCPUShares": "[not set]", "StartupCPUWeight": "[not set]", "StartupIOWeight": "[not set]", "StateChangeTimestamp": "Wed 2026-06-17 07:29:23 UTC", "StateChangeTimestampMonotonic": "219723212", "StateDirectoryMode": "0755", "StatusErrno": "0", "StopWhenUnneeded": "no", "SubState": "running", "SuccessAction": "none", "SyslogFacility": "3", "SyslogLevel": "6", "SyslogLevelPrefix": "yes", "SyslogPriority": "30", "SystemCallErrorNumber": "2147483646", "TTYReset": "no", "TTYVHangup": "no", "TTYVTDisallocate": "no", "TasksAccounting": "yes", "TasksCurrent": "2", "TasksMax": "4644", "TimeoutAbortUSec": "1min 30s", "TimeoutCleanUSec": "infinity", "TimeoutStartFailureMode": "terminate", "TimeoutStartUSec": "1min 30s", "TimeoutStopFailureMode": "terminate", "TimeoutStopUSec": "1min 30s", "TimerSlackNSec": "50000", "Transient": "no", "Type": "forking", "UID": "[not set]", "UMask": "0022", "UnitFilePreset": "enabled", "UnitFileState": "enabled", "UtmpMode": "init", "WantedBy": "multi-user.target", "WatchdogSignal": "6", "WatchdogTimestampMonotonic": "0", "WatchdogUSec": "0"}} 2026-06-17 07:29:30.195933 | debian-bookworm | 2026-06-17 07:29:30.195959 | debian-bookworm | TASK [auditd : List existing rules files] ************************************** 2026-06-17 07:29:30.587991 | debian-bookworm | ok: [molecule-auditd] => {"changed": false, "cmd": ["find", "/etc/audit/rules.d", "-type", "f", "-printf", "%f\n"], "delta": "0:00:00.007956", "end": "2026-06-17 07:29:30.540134", "msg": "", "rc": 0, "start": "2026-06-17 07:29:30.532178", "stderr": "", "stderr_lines": [], "stdout": "20-neo23x0.rules\naudit.rules", "stdout_lines": ["20-neo23x0.rules", "audit.rules"]} 2026-06-17 07:29:30.588066 | debian-bookworm | 2026-06-17 07:29:30.588074 | debian-bookworm | TASK [auditd : Remove unmanaged rules files] *********************************** 2026-06-17 07:29:31.040997 | ubuntu-noble | The following NEW packages will be installed: 2026-06-17 07:29:31.043332 | ubuntu-noble | audispd-plugins 2026-06-17 07:29:31.043361 | ubuntu-noble | 0 upgraded, 1 newly installed, 0 to remove and 0 not upgraded. 2026-06-17 07:29:31.043370 | ubuntu-noble | changed: [molecule-auditd] => {"cache_update_time": 1781681269, "cache_updated": false, "changed": true, "stderr": "debconf: delaying package configuration, since apt-utils is not installed\n", "stderr_lines": ["debconf: delaying package configuration, since apt-utils is not installed"], "stdout": "Reading package lists...\nBuilding dependency tree...\nReading state information...\nThe following NEW packages will be installed:\n audispd-plugins\n0 upgraded, 1 newly installed, 0 to remove and 0 not upgraded.\nNeed to get 38.8 kB of archives.\nAfter this operation, 131 kB of additional disk space will be used.\nGet:1 http://archive.ubuntu.com/ubuntu noble-updates/universe amd64 audispd-plugins amd64 1:3.1.2-2.1build1.1 [38.8 kB]\nFetched 38.8 kB in 0s (656 kB/s)\nSelecting previously unselected package audispd-plugins.\r\n(Reading database ... \r(Reading database ... 5%\r(Reading database ... 10%\r(Reading database ... 15%\r(Reading database ... 20%\r(Reading database ... 25%\r(Reading database ... 30%\r(Reading database ... 35%\r(Reading database ... 40%\r(Reading database ... 45%\r(Reading database ... 50%\r(Reading database ... 55%\r(Reading database ... 60%\r(Reading database ... 65%\r(Reading database ... 70%\r(Reading database ... 75%\r(Reading database ... 80%\r(Reading database ... 85%\r(Reading database ... 90%\r(Reading database ... 95%\r(Reading database ... 100%\r(Reading database ... 36181 files and directories currently installed.)\r\nPreparing to unpack .../audispd-plugins_1%3a3.1.2-2.1build1.1_amd64.deb ...\r\nUnpacking audispd-plugins (1:3.1.2-2.1build1.1) ...\r\nSetting up audispd-plugins (1:3.1.2-2.1build1.1) ...\r\n", "stdout_lines": ["Reading package lists...", "Building dependency tree...", "Reading state information...", "The following NEW packages will be installed:", " audispd-plugins", "0 upgraded, 1 newly installed, 0 to remove and 0 not upgraded.", "Need to get 38.8 kB of archives.", "After this operation, 131 kB of additional disk space will be used.", "Get:1 http://archive.ubuntu.com/ubuntu noble-updates/universe amd64 audispd-plugins amd64 1:3.1.2-2.1build1.1 [38.8 kB]", "Fetched 38.8 kB in 0s (656 kB/s)", "Selecting previously unselected package audispd-plugins.", "(Reading database ... ", "(Reading database ... 5%", "(Reading database ... 10%", "(Reading database ... 15%", "(Reading database ... 20%", "(Reading database ... 25%", "(Reading database ... 30%", "(Reading database ... 35%", "(Reading database ... 40%", "(Reading database ... 45%", "(Reading database ... 50%", "(Reading database ... 55%", "(Reading database ... 60%", "(Reading database ... 65%", "(Reading database ... 70%", "(Reading database ... 75%", "(Reading database ... 80%", "(Reading database ... 85%", "(Reading database ... 90%", "(Reading database ... 95%", "(Reading database ... 100%", "(Reading database ... 36181 files and directories currently installed.)", "Preparing to unpack .../audispd-plugins_1%3a3.1.2-2.1build1.1_amd64.deb ...", "Unpacking audispd-plugins (1:3.1.2-2.1build1.1) ...", "Setting up audispd-plugins (1:3.1.2-2.1build1.1) ..."]} 2026-06-17 07:29:31.043391 | ubuntu-noble | 2026-06-17 07:29:31.043395 | ubuntu-noble | TASK [auditd : Copy auditd.conf configuration files] *************************** 2026-06-17 07:29:30.906869 | debian-bookworm | skipping: [molecule-auditd] => (item=20-neo23x0.rules) => {"ansible_loop_var": "item", "changed": false, "false_condition": "item not in auditd_rules_files", "item": "20-neo23x0.rules", "skip_reason": "Conditional result was False"} 2026-06-17 07:29:30.906925 | debian-bookworm | --- before 2026-06-17 07:29:30.906932 | debian-bookworm | +++ after 2026-06-17 07:29:30.906937 | debian-bookworm | @@ -1,4 +1,4 @@ 2026-06-17 07:29:30.906943 | debian-bookworm | { 2026-06-17 07:29:30.906947 | debian-bookworm | "path": "/etc/audit/rules.d/audit.rules", 2026-06-17 07:29:30.906953 | debian-bookworm | - "state": "file" 2026-06-17 07:29:30.906958 | debian-bookworm | + "state": "absent" 2026-06-17 07:29:30.906963 | debian-bookworm | } 2026-06-17 07:29:30.906967 | debian-bookworm | 2026-06-17 07:29:30.906973 | debian-bookworm | changed: [molecule-auditd] => (item=audit.rules) => {"ansible_loop_var": "item", "changed": true, "item": "audit.rules", "path": "/etc/audit/rules.d/audit.rules", "state": "absent"} 2026-06-17 07:29:30.906978 | debian-bookworm | 2026-06-17 07:29:30.906983 | debian-bookworm | RUNNING HANDLER [auditd : Restart auditd service] ****************************** 2026-06-17 07:29:31.596858 | debian-bookworm | changed: [molecule-auditd] => {"changed": true, "name": "auditd", "state": "started", "status": {"ActiveEnterTimestamp": "Wed 2026-06-17 07:29:23 UTC", "ActiveEnterTimestampMonotonic": "219723212", "ActiveExitTimestampMonotonic": "0", "ActiveState": "active", "After": "local-fs.target systemd-journald.socket system.slice systemd-tmpfiles-setup.service", "AllowIsolate": "no", "AssertResult": "yes", "AssertTimestamp": "Wed 2026-06-17 07:29:23 UTC", "AssertTimestampMonotonic": "219657636", "Before": "shutdown.target sysinit.target ssh.service systemd-update-utmp.service", "BlockIOAccounting": "no", "BlockIOWeight": "[not set]", "CPUAccounting": "yes", "CPUAffinityFromNUMA": "no", "CPUQuotaPerSecUSec": "infinity", "CPUQuotaPeriodUSec": "infinity", "CPUSchedulingPolicy": "0", "CPUSchedulingPriority": "0", "CPUSchedulingResetOnFork": "no", "CPUShares": "[not set]", "CPUUsageNSec": "51502000", "CPUWeight": "[not set]", "CacheDirectoryMode": "0755", "CanFreeze": "yes", "CanIsolate": "no", "CanReload": "no", "CanStart": "yes", "CanStop": "yes", "CapabilityBoundingSet": "cap_chown cap_dac_override cap_dac_read_search cap_fowner cap_fsetid cap_kill cap_setgid cap_setuid cap_setpcap cap_linux_immutable cap_net_bind_service cap_net_broadcast cap_net_admin cap_net_raw cap_ipc_lock cap_ipc_owner cap_sys_rawio cap_sys_chroot cap_sys_ptrace cap_sys_pacct cap_sys_admin cap_sys_boot cap_sys_nice cap_sys_resource cap_sys_time cap_sys_tty_config cap_mknod cap_lease cap_audit_write cap_audit_control cap_setfcap cap_mac_override cap_mac_admin cap_syslog cap_wake_alarm cap_block_suspend cap_audit_read cap_perfmon cap_bpf cap_checkpoint_restore", "CleanResult": "success", "CollectMode": "inactive", "ConditionResult": "yes", "ConditionTimestamp": "Wed 2026-06-17 07:29:23 UTC", "ConditionTimestampMonotonic": "219657593", "ConfigurationDirectoryMode": "0755", "Conflicts": "shutdown.target", "ControlGroup": "/system.slice/auditd.service", "ControlGroupId": "3328", "ControlPID": "0", "CoredumpFilter": "0x33", "DefaultDependencies": "no", "DefaultMemoryLow": "0", "DefaultMemoryMin": "0", "Delegate": "no", "Description": "Security Auditing Service", "DevicePolicy": "auto", "Documentation": "\"man:auditd(8)\" https://github.com/linux-audit/audit-documentation", "DynamicUser": "no", "ExecMainCode": "0", "ExecMainExitTimestampMonotonic": "0", "ExecMainPID": "2426", "ExecMainStartTimestamp": "Wed 2026-06-17 07:29:23 UTC", "ExecMainStartTimestampMonotonic": "219694370", "ExecMainStatus": "0", "ExecStart": "{ path=/sbin/auditd ; argv[]=/sbin/auditd ; ignore_errors=no ; start_time=[Wed 2026-06-17 07:29:23 UTC] ; stop_time=[Wed 2026-06-17 07:29:23 UTC] ; pid=2425 ; code=exited ; status=0 }", "ExecStartEx": "{ path=/sbin/auditd ; argv[]=/sbin/auditd ; flags= ; start_time=[Wed 2026-06-17 07:29:23 UTC] ; stop_time=[Wed 2026-06-17 07:29:23 UTC] ; pid=2425 ; code=exited ; status=0 }", "ExecStartPost": "{ path=/sbin/augenrules ; argv[]=/sbin/augenrules --load ; ignore_errors=yes ; start_time=[Wed 2026-06-17 07:29:23 UTC] ; stop_time=[Wed 2026-06-17 07:29:23 UTC] ; pid=2429 ; code=exited ; status=0 }", "ExecStartPostEx": "{ path=/sbin/augenrules ; argv[]=/sbin/augenrules --load ; flags=ignore-failure ; start_time=[Wed 2026-06-17 07:29:23 UTC] ; stop_time=[Wed 2026-06-17 07:29:23 UTC] ; pid=2429 ; code=exited ; status=0 }", "ExitType": "main", "FailureAction": "none", "FileDescriptorStoreMax": "0", "FinalKillSignal": "9", "FragmentPath": "/lib/systemd/system/auditd.service", "FreezerState": "running", "GID": "[not set]", "GuessMainPID": "yes", "IOAccounting": "no", "IOReadBytes": "18446744073709551615", "IOReadOperations": "18446744073709551615", "IOSchedulingClass": "2", "IOSchedulingPriority": "4", "IOWeight": "[not set]", "IOWriteBytes": "18446744073709551615", "IOWriteOperations": "18446744073709551615", "IPAccounting": "no", "IPEgressBytes": "[no data]", "IPEgressPackets": "[no data]", "IPIngressBytes": "[no data]", "IPIngressPackets": "[no data]", "Id": "auditd.service", "IgnoreOnIsolate": "no", "IgnoreSIGPIPE": "yes", "InactiveEnterTimestampMonotonic": "0", "InactiveExitTimestamp": "Wed 2026-06-17 07:29:23 UTC", "InactiveExitTimestampMonotonic": "219672913", "InvocationID": "e9d8dcedc67f491495b9dbf193f071fe", "JobRunningTimeoutUSec": "infinity", "JobTimeoutAction": "none", "JobTimeoutUSec": "infinity", "KeyringMode": "private", "KillMode": "control-group", "KillSignal": "15", "LimitAS": "infinity", "LimitASSoft": "infinity", "LimitCORE": "infinity", "LimitCORESoft": "0", "LimitCPU": "infinity", "LimitCPUSoft": "infinity", "LimitDATA": "infinity", "LimitDATASoft": "infinity", "LimitFSIZE": "infinity", "LimitFSIZESoft": "infinity", "LimitLOCKS": "infinity", "LimitLOCKSSoft": "infinity", "LimitMEMLOCK": "8388608", "LimitMEMLOCKSoft": "8388608", "LimitMSGQUEUE": "819200", "LimitMSGQUEUESoft": "819200", "LimitNICE": "0", "LimitNICESoft": "0", "LimitNOFILE": "524288", "LimitNOFILESoft": "1024", "LimitNPROC": "15480", "LimitNPROCSoft": "15480", "LimitRSS": "infinity", "LimitRSSSoft": "infinity", "LimitRTPRIO": "0", "LimitRTPRIOSoft": "0", "LimitRTTIME": "infinity", "LimitRTTIMESoft": "infinity", "LimitSIGPENDING": "15480", "LimitSIGPENDINGSoft": "15480", "LimitSTACK": "infinity", "LimitSTACKSoft": "8388608", "LoadState": "loaded", "LockPersonality": "yes", "LogLevelMax": "-1", "LogRateLimitBurst": "0", "LogRateLimitIntervalUSec": "0", "LogsDirectoryMode": "0755", "MainPID": "2426", "ManagedOOMMemoryPressure": "auto", "ManagedOOMMemoryPressureLimit": "0", "ManagedOOMPreference": "none", "ManagedOOMSwap": "auto", "MemoryAccounting": "yes", "MemoryAvailable": "infinity", "MemoryCurrent": "724992", "MemoryDenyWriteExecute": "yes", "MemoryHigh": "infinity", "MemoryLimit": "infinity", "MemoryLow": "0", "MemoryMax": "infinity", "MemoryMin": "0", "MemorySwapMax": "infinity", "MountAPIVFS": "no", "NFileDescriptorStore": "0", "NRestarts": "0", "NUMAPolicy": "n/a", "Names": "auditd.service", "NeedDaemonReload": "no", "Nice": "0", "NoNewPrivileges": "no", "NonBlocking": "no", "NotifyAccess": "none", "OOMPolicy": "stop", "OOMScoreAdjust": "0", "OnFailureJobMode": "replace", "OnSuccessJobMode": "fail", "PIDFile": "/run/auditd.pid", "Perpetual": "no", "PrivateDevices": "no", "PrivateIPC": "no", "PrivateMounts": "no", "PrivateNetwork": "no", "PrivateTmp": "no", "PrivateUsers": "no", "ProcSubset": "all", "ProtectClock": "no", "ProtectControlGroups": "yes", "ProtectHome": "no", "ProtectHostname": "no", "ProtectKernelLogs": "no", "ProtectKernelModules": "yes", "ProtectKernelTunables": "no", "ProtectProc": "default", "ProtectSystem": "no", "RefuseManualStart": "no", "RefuseManualStop": "no", "ReloadResult": "success", "RemainAfterExit": "no", "RemoveIPC": "no", "Requires": "system.slice", "Restart": "on-failure", "RestartKillSignal": "15", "RestartPreventExitStatus": "2 4 6", "RestartUSec": "100ms", "RestrictNamespaces": "no", "RestrictRealtime": "yes", "RestrictSUIDSGID": "no", "Result": "success", "RootDirectoryStartOnly": "no", "RuntimeDirectoryMode": "0755", "RuntimeDirectoryPreserve": "no", "RuntimeMaxUSec": "infinity", "RuntimeRandomizedExtraUSec": "0", "SameProcessGroup": "no", "SecureBits": "0", "SendSIGHUP": "no", "SendSIGKILL": "yes", "Slice": "system.slice", "StandardError": "inherit", "StandardInput": "null", "StandardOutput": "journal", "StartLimitAction": "none", "StartLimitBurst": "5", "StartLimitIntervalUSec": "10s", "StartupBlockIOWeight": "[not set]", "StartupCPUShares": "[not set]", "StartupCPUWeight": "[not set]", "StartupIOWeight": "[not set]", "StateChangeTimestamp": "Wed 2026-06-17 07:29:23 UTC", "StateChangeTimestampMonotonic": "219723212", "StateDirectoryMode": "0755", "StatusErrno": "0", "StopWhenUnneeded": "no", "SubState": "running", "SuccessAction": "none", "SyslogFacility": "3", "SyslogLevel": "6", "SyslogLevelPrefix": "yes", "SyslogPriority": "30", "SystemCallErrorNumber": "2147483646", "TTYReset": "no", "TTYVHangup": "no", "TTYVTDisallocate": "no", "TasksAccounting": "yes", "TasksCurrent": "2", "TasksMax": "4644", "TimeoutAbortUSec": "1min 30s", "TimeoutCleanUSec": "infinity", "TimeoutStartFailureMode": "terminate", "TimeoutStartUSec": "1min 30s", "TimeoutStopFailureMode": "terminate", "TimeoutStopUSec": "1min 30s", "TimerSlackNSec": "50000", "Transient": "no", "Type": "forking", "UID": "[not set]", "UMask": "0022", "UnitFilePreset": "enabled", "UnitFileState": "enabled", "UtmpMode": "init", "WantedBy": "multi-user.target", "WatchdogSignal": "6", "WatchdogTimestampMonotonic": "0", "WatchdogUSec": "0"}} 2026-06-17 07:29:31.602830 | debian-bookworm | 2026-06-17 07:29:31.602865 | debian-bookworm | RUNNING HANDLER [auditd : Generate auditd rules] ******************************* 2026-06-17 07:29:32.005042 | debian-bookworm | changed: [molecule-auditd] => {"changed": true, "cmd": ["augenrules", "--load"], "delta": "0:00:00.114994", "end": "2026-06-17 07:29:31.956458", "msg": "", "rc": 0, "start": "2026-06-17 07:29:31.841464", "stderr": "Unknown user: chrony\nThere was an error in line 24 of /etc/audit/audit.rules\nError sending add rule data request (No such file or directory)\nThere was an error in line 28 of /etc/audit/audit.rules\nUnknown user: ntp\nThere was an error in line 44 of /etc/audit/audit.rules\nError sending add rule data request (No such file or directory)\nThere was an error in line 83 of /etc/audit/audit.rules\nError sending add rule data request (No such file or directory)\nThere was an error in line 84 of /etc/audit/audit.rules\nError sending add rule data request (No such file or directory)\nThere was an error in line 112 of /etc/audit/audit.rules\nError sending add rule data request (No such file or directory)\nThere was an error in line 115 of /etc/audit/audit.rules\nError sending add rule data request (No such file or directory)\nThere was an error in line 176 of /etc/audit/audit.rules\nError sending add rule data request (No such file or directory)\nThere was an error in line 177 of /etc/audit/audit.rules\nError sending add rule data request (No such file or directory)\nThere was an error in line 178 of /etc/audit/audit.rules\nError sending add rule data request (No such file or directory)\nThere was an error in line 179 of /etc/audit/audit.rules\nError sending add rule data request (No such file or directory)\nThere was an error in line 180 of /etc/audit/audit.rules\nError sending add rule data request (No such file or directory)\nThere was an error in line 217 of /etc/audit/audit.rules\nError sending add rule data request (No such file or directory)\nThere was an error in line 218 of /etc/audit/audit.rules\nError sending add rule data request (No such file or directory)\nThere was an error in line 234 of /etc/audit/audit.rules\nError sending add rule data request (No such file or directory)\nThere was an error in line 285 of /etc/audit/audit.rules\nError sending add rule data request (No such file or directory)\nThere was an error in line 286 of /etc/audit/audit.rules\nError sending add rule data request (No such file or directory)\nThere was an error in line 324 of /etc/audit/audit.rules\nError sending add rule data request (No such file or directory)\nThere was an error in line 325 of /etc/audit/audit.rules\nError sending add rule data request (No such file or directory)\nThere was an error in line 346 of /etc/audit/audit.rules\nparameter passed without an option given\nThere was an error in line 347 of /etc/audit/audit.rules\nparameter passed without an option given\nThere was an error in line 348 of /etc/audit/audit.rules\nparameter passed without an option given\nThere was an error in line 349 of /etc/audit/audit.rules\nparameter passed without an option given\nThere was an error in line 350 of /etc/audit/audit.rules\nparameter passed without an option given\nThere was an error in line 351 of /etc/audit/audit.rules\nError sending add rule data request (No such file or directory)\nThere was an error in line 359 of /etc/audit/audit.rules", "stderr_lines": ["Unknown user: chrony", "There was an error in line 24 of /etc/audit/audit.rules", "Error sending add rule data request (No such file or directory)", "There was an error in line 28 of /etc/audit/audit.rules", "Unknown user: ntp", "There was an error in line 44 of /etc/audit/audit.rules", "Error sending add rule data request (No such file or directory)", "There was an error in line 83 of /etc/audit/audit.rules", "Error sending add rule data request (No such file or directory)", "There was an error in line 84 of /etc/audit/audit.rules", "Error sending add rule data request (No such file or directory)", "There was an error in line 112 of /etc/audit/audit.rules", "Error sending add rule data request (No such file or directory)", "There was an error in line 115 of /etc/audit/audit.rules", "Error sending add rule data request (No such file or directory)", "There was an error in line 176 of /etc/audit/audit.rules", "Error sending add rule data request (No such file or directory)", "There was an error in line 177 of /etc/audit/audit.rules", "Error sending add rule data request (No such file or directory)", "There was an error in line 178 of /etc/audit/audit.rules", "Error sending add rule data request (No such file or directory)", "There was an error in line 179 of /etc/audit/audit.rules", "Error sending add rule data request (No such file or directory)", "There was an error in line 180 of /etc/audit/audit.rules", "Error sending add rule data request (No such file or directory)", "There was an error in line 217 of /etc/audit/audit.rules", "Error sending add rule data request (No such file or directory)", "There was an error in line 218 of /etc/audit/audit.rules", "Error sending add rule data request (No such file or directory)", "There was an error in line 234 of /etc/audit/audit.rules", "Error sending add rule data request (No such file or directory)", "There was an error in line 285 of /etc/audit/audit.rules", "Error sending add rule data request (No such file or directory)", "There was an error in line 286 of /etc/audit/audit.rules", "Error sending add rule data request (No such file or directory)", "There was an error in line 324 of /etc/audit/audit.rules", "Error sending add rule data request (No such file or directory)", "There was an error in line 325 of /etc/audit/audit.rules", "Error sending add rule data request (No such file or directory)", "There was an error in line 346 of /etc/audit/audit.rules", "parameter passed without an option given", "There was an error in line 347 of /etc/audit/audit.rules", "parameter passed without an option given", "There was an error in line 348 of /etc/audit/audit.rules", "parameter passed without an option given", "There was an error in line 349 of /etc/audit/audit.rules", "parameter passed without an option given", "There was an error in line 350 of /etc/audit/audit.rules", "parameter passed without an option given", "There was an error in line 351 of /etc/audit/audit.rules", "Error sending add rule data request (No such file or directory)", "There was an error in line 359 of /etc/audit/audit.rules"], "stdout": "/usr/sbin/augenrules: No change\nNo rules\nenabled 1\nfailure 1\npid 2815\nrate_limit 0\nbacklog_limit 8192\nlost 0\nbacklog 0\nbacklog_wait_time 60000\nbacklog_wait_time_actual 0\nenabled 1\nfailure 1\npid 2815\nrate_limit 0\nbacklog_limit 8192\nlost 0\nbacklog 4\nbacklog_wait_time 60000\nbacklog_wait_time_actual 0", "stdout_lines": ["/usr/sbin/augenrules: No change", "No rules", "enabled 1", "failure 1", "pid 2815", "rate_limit 0", "backlog_limit 8192", "lost 0", "backlog 0", "backlog_wait_time 60000", "backlog_wait_time_actual 0", "enabled 1", "failure 1", "pid 2815", "rate_limit 0", "backlog_limit 8192", "lost 0", "backlog 4", "backlog_wait_time 60000", "backlog_wait_time_actual 0"]} 2026-06-17 07:29:32.005096 | debian-bookworm | 2026-06-17 07:29:32.005103 | debian-bookworm | RUNNING HANDLER [auditd : Restart auditd service] ****************************** 2026-06-17 07:29:32.503551 | ubuntu-noble | --- before 2026-06-17 07:29:32.503894 | ubuntu-noble | +++ after: /home/zuul/.ansible/tmp/ansible-local-2035hi9kya46/tmp_o_v3m9k/auditd.conf.j2 2026-06-17 07:29:32.504139 | ubuntu-noble | @@ -0,0 +1,37 @@ 2026-06-17 07:29:32.504335 | ubuntu-noble | +# 2026-06-17 07:29:32.504556 | ubuntu-noble | +# This file controls the configuration of the audit daemon 2026-06-17 07:29:32.504747 | ubuntu-noble | +# 2026-06-17 07:29:32.504930 | ubuntu-noble | + 2026-06-17 07:29:32.505144 | ubuntu-noble | +local_events = yes 2026-06-17 07:29:32.505334 | ubuntu-noble | +write_logs = yes 2026-06-17 07:29:32.505552 | ubuntu-noble | +log_file = /var/log/audit/audit.log 2026-06-17 07:29:32.505758 | ubuntu-noble | +log_group = adm 2026-06-17 07:29:32.505980 | ubuntu-noble | +log_format = RAW 2026-06-17 07:29:32.506223 | ubuntu-noble | +flush = INCREMENTAL_ASYNC 2026-06-17 07:29:32.506412 | ubuntu-noble | +freq = 50 2026-06-17 07:29:32.506626 | ubuntu-noble | +max_log_file = 8 2026-06-17 07:29:32.506818 | ubuntu-noble | +num_logs = 5 2026-06-17 07:29:32.507007 | ubuntu-noble | +priority_boost = 4 2026-06-17 07:29:32.507269 | ubuntu-noble | +disp_qos = lossy 2026-06-17 07:29:32.507485 | ubuntu-noble | +dispatcher = /sbin/audispd 2026-06-17 07:29:32.507721 | ubuntu-noble | +name_format = NONE 2026-06-17 07:29:32.507917 | ubuntu-noble | +##name = mydomain 2026-06-17 07:29:32.508127 | ubuntu-noble | +max_log_file_action = ROTATE 2026-06-17 07:29:32.508315 | ubuntu-noble | +space_left = 12361 2026-06-17 07:29:32.508504 | ubuntu-noble | +space_left_action = email 2026-06-17 07:29:32.508718 | ubuntu-noble | +verify_email = yes 2026-06-17 07:29:32.509556 | ubuntu-noble | +action_mail_acct = root 2026-06-17 07:29:32.509573 | ubuntu-noble | +admin_space_left = 50 2026-06-17 07:29:32.509580 | ubuntu-noble | +admin_space_left_action = SUSPEND 2026-06-17 07:29:32.509587 | ubuntu-noble | +disk_full_action = SUSPEND 2026-06-17 07:29:32.509621 | ubuntu-noble | +disk_error_action = SUSPEND 2026-06-17 07:29:32.509789 | ubuntu-noble | +use_libwrap = yes 2026-06-17 07:29:32.509956 | ubuntu-noble | +##tcp_listen_port = 60 2026-06-17 07:29:32.510141 | ubuntu-noble | +tcp_listen_queue = 5 2026-06-17 07:29:32.510307 | ubuntu-noble | +tcp_max_per_addr = 1 2026-06-17 07:29:32.510479 | ubuntu-noble | +##tcp_client_ports = 1024-65535 2026-06-17 07:29:32.510664 | ubuntu-noble | +tcp_client_max_idle = 0 2026-06-17 07:29:32.510829 | ubuntu-noble | +enable_krb5 = no 2026-06-17 07:29:32.510997 | ubuntu-noble | +krb5_principal = auditd 2026-06-17 07:29:32.511181 | ubuntu-noble | +##krb5_key_file = /etc/audit/audit.key 2026-06-17 07:29:32.511348 | ubuntu-noble | +distribute_network = no 2026-06-17 07:29:32.511508 | ubuntu-noble | 2026-06-17 07:29:32.511741 | ubuntu-noble | changed: [molecule-auditd] => {"changed": true, "checksum": "e902cc6bebf86c17087d153e359a2cc1231672e0", "dest": "/etc/audit/audit.conf", "gid": 0, "group": "root", "md5sum": "69dfd768317bae876a6a78c8aeb5cce1", "mode": "0640", "owner": "root", "size": 806, "src": "/home/zuul/.ansible/tmp/ansible-tmp-1781681371.0686796-2432-202500944402398/.source.conf", "state": "file", "uid": 0} 2026-06-17 07:29:32.511905 | ubuntu-noble | 2026-06-17 07:29:32.512378 | ubuntu-noble | TASK [auditd : Adjust auditd/audispd configurations] *************************** 2026-06-17 07:29:32.770589 | debian-bookworm | changed: [molecule-auditd] => {"changed": true, "name": "auditd", "state": "started", "status": {"ActiveEnterTimestamp": "Wed 2026-06-17 07:29:31 UTC", "ActiveEnterTimestampMonotonic": "227613422", "ActiveExitTimestamp": "Wed 2026-06-17 07:29:31 UTC", "ActiveExitTimestampMonotonic": "227406763", "ActiveState": "active", "After": "local-fs.target systemd-journald.socket system.slice systemd-tmpfiles-setup.service", "AllowIsolate": "no", "AssertResult": "yes", "AssertTimestamp": "Wed 2026-06-17 07:29:31 UTC", "AssertTimestampMonotonic": "227455778", "Before": "shutdown.target sysinit.target ssh.service systemd-update-utmp.service", "BlockIOAccounting": "no", "BlockIOWeight": "[not set]", "CPUAccounting": "yes", "CPUAffinityFromNUMA": "no", "CPUQuotaPerSecUSec": "infinity", "CPUQuotaPeriodUSec": "infinity", "CPUSchedulingPolicy": "0", "CPUSchedulingPriority": "0", "CPUSchedulingResetOnFork": "no", "CPUShares": "[not set]", "CPUUsageNSec": "165131000", "CPUWeight": "[not set]", "CacheDirectoryMode": "0755", "CanFreeze": "yes", "CanIsolate": "no", "CanReload": "no", "CanStart": "yes", "CanStop": "yes", "CapabilityBoundingSet": "cap_chown cap_dac_override cap_dac_read_search cap_fowner cap_fsetid cap_kill cap_setgid cap_setuid cap_setpcap cap_linux_immutable cap_net_bind_service cap_net_broadcast cap_net_admin cap_net_raw cap_ipc_lock cap_ipc_owner cap_sys_rawio cap_sys_chroot cap_sys_ptrace cap_sys_pacct cap_sys_admin cap_sys_boot cap_sys_nice cap_sys_resource cap_sys_time cap_sys_tty_config cap_mknod cap_lease cap_audit_write cap_audit_control cap_setfcap cap_mac_override cap_mac_admin cap_syslog cap_wake_alarm cap_block_suspend cap_audit_read cap_perfmon cap_bpf cap_checkpoint_restore", "CleanResult": "success", "CollectMode": "inactive", "ConditionResult": "yes", "ConditionTimestamp": "Wed 2026-06-17 07:29:31 UTC", "ConditionTimestampMonotonic": "227455708", "ConfigurationDirectoryMode": "0755", "Conflicts": "shutdown.target", "ControlGroup": "/system.slice/auditd.service", "ControlGroupId": "3367", "ControlPID": "0", "CoredumpFilter": "0x33", "DefaultDependencies": "no", "DefaultMemoryLow": "0", "DefaultMemoryMin": "0", "Delegate": "no", "Description": "Security Auditing Service", "DevicePolicy": "auto", "Documentation": "\"man:auditd(8)\" https://github.com/linux-audit/audit-documentation", "DynamicUser": "no", "ExecMainCode": "0", "ExecMainExitTimestampMonotonic": "0", "ExecMainPID": "2815", "ExecMainStartTimestamp": "Wed 2026-06-17 07:29:31 UTC", "ExecMainStartTimestampMonotonic": "227506704", "ExecMainStatus": "0", "ExecStart": "{ path=/sbin/auditd ; argv[]=/sbin/auditd ; ignore_errors=no ; start_time=[Wed 2026-06-17 07:29:31 UTC] ; stop_time=[Wed 2026-06-17 07:29:31 UTC] ; pid=2814 ; code=exited ; status=0 }", "ExecStartEx": "{ path=/sbin/auditd ; argv[]=/sbin/auditd ; flags= ; start_time=[Wed 2026-06-17 07:29:31 UTC] ; stop_time=[Wed 2026-06-17 07:29:31 UTC] ; pid=2814 ; code=exited ; status=0 }", "ExecStartPost": "{ path=/sbin/augenrules ; argv[]=/sbin/augenrules --load ; ignore_errors=yes ; start_time=[Wed 2026-06-17 07:29:31 UTC] ; stop_time=[Wed 2026-06-17 07:29:31 UTC] ; pid=2818 ; code=exited ; status=0 }", "ExecStartPostEx": "{ path=/sbin/augenrules ; argv[]=/sbin/augenrules --load ; flags=ignore-failure ; start_time=[Wed 2026-06-17 07:29:31 UTC] ; stop_time=[Wed 2026-06-17 07:29:31 UTC] ; pid=2818 ; code=exited ; status=0 }", "ExitType": "main", "FailureAction": "none", "FileDescriptorStoreMax": "0", "FinalKillSignal": "9", "FragmentPath": "/lib/systemd/system/auditd.service", "FreezerState": "running", "GID": "[not set]", "GuessMainPID": "yes", "IOAccounting": "no", "IOReadBytes": "18446744073709551615", "IOReadOperations": "18446744073709551615", "IOSchedulingClass": "2", "IOSchedulingPriority": "4", "IOWeight": "[not set]", "IOWriteBytes": "18446744073709551615", "IOWriteOperations": "18446744073709551615", "IPAccounting": "no", "IPEgressBytes": "[no data]", "IPEgressPackets": "[no data]", "IPIngressBytes": "[no data]", "IPIngressPackets": "[no data]", "Id": "auditd.service", "IgnoreOnIsolate": "no", "IgnoreSIGPIPE": "yes", "InactiveEnterTimestamp": "Wed 2026-06-17 07:29:31 UTC", "InactiveEnterTimestampMonotonic": "227449372", "InactiveExitTimestamp": "Wed 2026-06-17 07:29:31 UTC", "InactiveExitTimestampMonotonic": "227477150", "InvocationID": "699e0d4313624b80bf08df062566e068", "JobRunningTimeoutUSec": "infinity", "JobTimeoutAction": "none", "JobTimeoutUSec": "infinity", "KeyringMode": "private", "KillMode": "control-group", "KillSignal": "15", "LimitAS": "infinity", "LimitASSoft": "infinity", "LimitCORE": "infinity", "LimitCORESoft": "0", "LimitCPU": "infinity", "LimitCPUSoft": "infinity", "LimitDATA": "infinity", "LimitDATASoft": "infinity", "LimitFSIZE": "infinity", "LimitFSIZESoft": "infinity", "LimitLOCKS": "infinity", "LimitLOCKSSoft": "infinity", "LimitMEMLOCK": "8388608", "LimitMEMLOCKSoft": "8388608", "LimitMSGQUEUE": "819200", "LimitMSGQUEUESoft": "819200", "LimitNICE": "0", "LimitNICESoft": "0", "LimitNOFILE": "524288", "LimitNOFILESoft": "1024", "LimitNPROC": "15480", "LimitNPROCSoft": "15480", "LimitRSS": "infinity", "LimitRSSSoft": "infinity", "LimitRTPRIO": "0", "LimitRTPRIOSoft": "0", "LimitRTTIME": "infinity", "LimitRTTIMESoft": "infinity", "LimitSIGPENDING": "15480", "LimitSIGPENDINGSoft": "15480", "LimitSTACK": "infinity", "LimitSTACKSoft": "8388608", "LoadState": "loaded", "LockPersonality": "yes", "LogLevelMax": "-1", "LogRateLimitBurst": "0", "LogRateLimitIntervalUSec": "0", "LogsDirectoryMode": "0755", "MainPID": "2815", "ManagedOOMMemoryPressure": "auto", "ManagedOOMMemoryPressureLimit": "0", "ManagedOOMPreference": "none", "ManagedOOMSwap": "auto", "MemoryAccounting": "yes", "MemoryAvailable": "infinity", "MemoryCurrent": "2080768", "MemoryDenyWriteExecute": "yes", "MemoryHigh": "infinity", "MemoryLimit": "infinity", "MemoryLow": "0", "MemoryMax": "infinity", "MemoryMin": "0", "MemorySwapMax": "infinity", "MountAPIVFS": "no", "NFileDescriptorStore": "0", "NRestarts": "0", "NUMAPolicy": "n/a", "Names": "auditd.service", "NeedDaemonReload": "no", "Nice": "0", "NoNewPrivileges": "no", "NonBlocking": "no", "NotifyAccess": "none", "OOMPolicy": "stop", "OOMScoreAdjust": "0", "OnFailureJobMode": "replace", "OnSuccessJobMode": "fail", "PIDFile": "/run/auditd.pid", "Perpetual": "no", "PrivateDevices": "no", "PrivateIPC": "no", "PrivateMounts": "no", "PrivateNetwork": "no", "PrivateTmp": "no", "PrivateUsers": "no", "ProcSubset": "all", "ProtectClock": "no", "ProtectControlGroups": "yes", "ProtectHome": "no", "ProtectHostname": "no", "ProtectKernelLogs": "no", "ProtectKernelModules": "yes", "ProtectKernelTunables": "no", "ProtectProc": "default", "ProtectSystem": "no", "RefuseManualStart": "no", "RefuseManualStop": "no", "ReloadResult": "success", "RemainAfterExit": "no", "RemoveIPC": "no", "Requires": "system.slice", "Restart": "on-failure", "RestartKillSignal": "15", "RestartPreventExitStatus": "2 4 6", "RestartUSec": "100ms", "RestrictNamespaces": "no", "RestrictRealtime": "yes", "RestrictSUIDSGID": "no", "Result": "success", "RootDirectoryStartOnly": "no", "RuntimeDirectoryMode": "0755", "RuntimeDirectoryPreserve": "no", "RuntimeMaxUSec": "infinity", "RuntimeRandomizedExtraUSec": "0", "SameProcessGroup": "no", "SecureBits": "0", "SendSIGHUP": "no", "SendSIGKILL": "yes", "Slice": "system.slice", "StandardError": "inherit", "StandardInput": "null", "StandardOutput": "journal", "StartLimitAction": "none", "StartLimitBurst": "5", "StartLimitIntervalUSec": "10s", "StartupBlockIOWeight": "[not set]", "StartupCPUShares": "[not set]", "StartupCPUWeight": "[not set]", "StartupIOWeight": "[not set]", "StateChangeTimestamp": "Wed 2026-06-17 07:29:31 UTC", "StateChangeTimestampMonotonic": "227613422", "StateDirectoryMode": "0755", "StatusErrno": "0", "StopWhenUnneeded": "no", "SubState": "running", "SuccessAction": "none", "SyslogFacility": "3", "SyslogLevel": "6", "SyslogLevelPrefix": "yes", "SyslogPriority": "30", "SystemCallErrorNumber": "2147483646", "TTYReset": "no", "TTYVHangup": "no", "TTYVTDisallocate": "no", "TasksAccounting": "yes", "TasksCurrent": "2", "TasksMax": "4644", "TimeoutAbortUSec": "1min 30s", "TimeoutCleanUSec": "infinity", "TimeoutStartFailureMode": "terminate", "TimeoutStartUSec": "1min 30s", "TimeoutStopFailureMode": "terminate", "TimeoutStopUSec": "1min 30s", "TimerSlackNSec": "50000", "Transient": "no", "Type": "forking", "UID": "[not set]", "UMask": "0022", "UnitFilePreset": "enabled", "UnitFileState": "enabled", "UtmpMode": "init", "WantedBy": "multi-user.target", "WatchdogSignal": "6", "WatchdogTimestampMonotonic": "0", "WatchdogUSec": "0"}} 2026-06-17 07:29:32.772641 | debian-bookworm | 2026-06-17 07:29:32.772752 | debian-bookworm | PLAY RECAP ********************************************************************* 2026-06-17 07:29:32.772865 | debian-bookworm | molecule-auditd : ok=15 changed=8 unreachable=0 failed=0 skipped=0 rescued=0 ignored=0 2026-06-17 07:29:32.772958 | debian-bookworm | 2026-06-17 07:29:33.024305 | ubuntu-noble | ok: [molecule-auditd] => (item={'parameter': 'active', 'value': 'no', 'config': '/etc/audit/plugins.d/syslog.conf'}) => {"ansible_loop_var": "item", "backup": "", "changed": false, "item": {"config": "/etc/audit/plugins.d/syslog.conf", "parameter": "active", "value": "no"}, "msg": ""} 2026-06-17 07:29:33.024680 | ubuntu-noble | 2026-06-17 07:29:33.024962 | ubuntu-noble | TASK [auditd : Deploy rules for auditd] **************************************** 2026-06-17 07:29:32.868729 | debian-bookworm | INFO [delegated > converge] Executed: Successful 2026-06-17 07:29:32.869489 | debian-bookworm | WARNING Molecule executed 1 scenario (1 missing files) 2026-06-17 07:29:33.339599 | debian-bookworm | ok: Runtime: 0:00:17.168685 2026-06-17 07:29:34.026619 | ubuntu-noble | --- before 2026-06-17 07:29:34.026706 | ubuntu-noble | +++ after: /home/zuul/.ansible/tmp/ansible-local-2035hi9kya46/tmpcxt8j4q2/20-neo23x0.rules.j2 2026-06-17 07:29:34.026720 | ubuntu-noble | @@ -0,0 +1,750 @@ 2026-06-17 07:29:34.026731 | ubuntu-noble | +# ___ ___ __ __ 2026-06-17 07:29:34.026741 | ubuntu-noble | +# / | __ ______/ (_) /_____/ / 2026-06-17 07:29:34.026750 | ubuntu-noble | +# / /| |/ / / / __ / / __/ __ / 2026-06-17 07:29:34.027023 | ubuntu-noble | +# / ___ / /_/ / /_/ / / /_/ /_/ / 2026-06-17 07:29:34.027353 | ubuntu-noble | +# /_/ |_\__,_/\__,_/_/\__/\__,_/ 2026-06-17 07:29:34.027680 | ubuntu-noble | +# 2026-06-17 07:29:34.028005 | ubuntu-noble | +# Linux Audit Daemon - Best Practice Configuration 2026-06-17 07:29:34.028327 | ubuntu-noble | +# /etc/audit/audit.rules 2026-06-17 07:29:34.028653 | ubuntu-noble | +# 2026-06-17 07:29:34.028965 | ubuntu-noble | +# Compiled by Florian Roth 2026-06-17 07:29:34.029277 | ubuntu-noble | +# 2026-06-17 07:29:34.029817 | ubuntu-noble | +# Created : 2017/12/05 2026-06-17 07:29:34.030160 | ubuntu-noble | +# Modified : 2023/01/25 2026-06-17 07:29:34.030449 | ubuntu-noble | +# 2026-06-17 07:29:34.030780 | ubuntu-noble | +# Based on rules published here: 2026-06-17 07:29:34.031121 | ubuntu-noble | +# Gov.uk auditd rules 2026-06-17 07:29:34.031850 | ubuntu-noble | +# https://github.com/gds-operations/puppet-auditd/pull/1 2026-06-17 07:29:34.032353 | ubuntu-noble | +# CentOS 7 hardening 2026-06-17 07:29:34.032851 | ubuntu-noble | +# https://highon.coffee/blog/security-harden-centos-7/#auditd---audit-daemon 2026-06-17 07:29:34.033299 | ubuntu-noble | +# Linux audit repo 2026-06-17 07:29:34.033796 | ubuntu-noble | +# https://github.com/linux-audit/audit-userspace/tree/master/rules 2026-06-17 07:29:34.034244 | ubuntu-noble | +# Auditd high performance linux auditing 2026-06-17 07:29:34.034704 | ubuntu-noble | +# https://linux-audit.com/tuning-auditd-high-performance-linux-auditing/ 2026-06-17 07:29:34.035008 | ubuntu-noble | +# 2026-06-17 07:29:34.035342 | ubuntu-noble | +# Further rules 2026-06-17 07:29:34.035707 | ubuntu-noble | +# For PCI DSS compliance see: 2026-06-17 07:29:34.036092 | ubuntu-noble | +# https://github.com/linux-audit/audit-userspace/blob/master/rules/30-pci-dss-v31.rules 2026-06-17 07:29:34.036426 | ubuntu-noble | +# For NISPOM compliance see: 2026-06-17 07:29:34.036825 | ubuntu-noble | +# https://github.com/linux-audit/audit-userspace/blob/master/rules/30-nispom.rules 2026-06-17 07:29:34.037132 | ubuntu-noble | + 2026-06-17 07:29:34.037384 | ubuntu-noble | +# Remove any existing rules 2026-06-17 07:29:34.037618 | ubuntu-noble | +-D 2026-06-17 07:29:34.037822 | ubuntu-noble | + 2026-06-17 07:29:34.038024 | ubuntu-noble | +# Buffer Size 2026-06-17 07:29:34.038247 | ubuntu-noble | +## Feel free to increase this if the machine panic's 2026-06-17 07:29:34.038443 | ubuntu-noble | +-b 8192 2026-06-17 07:29:34.038658 | ubuntu-noble | + 2026-06-17 07:29:34.039546 | ubuntu-noble | +# Failure Mode 2026-06-17 07:29:34.039583 | ubuntu-noble | +## Possible values: 0 (silent), 1 (printk, print a failure message), 2 (panic, halt the system) 2026-06-17 07:29:34.039590 | ubuntu-noble | +-f 1 2026-06-17 07:29:34.039597 | ubuntu-noble | + 2026-06-17 07:29:34.039632 | ubuntu-noble | +# Ignore errors 2026-06-17 07:29:34.039842 | ubuntu-noble | +## e.g. caused by users or files not found in the local environment 2026-06-17 07:29:34.040038 | ubuntu-noble | +-i 2026-06-17 07:29:34.040280 | ubuntu-noble | + 2026-06-17 07:29:34.040478 | ubuntu-noble | +# Self Auditing --------------------------------------------------------------- 2026-06-17 07:29:34.040694 | ubuntu-noble | + 2026-06-17 07:29:34.040887 | ubuntu-noble | +## Audit the audit logs 2026-06-17 07:29:34.041095 | ubuntu-noble | +### Successful and unsuccessful attempts to read information from the audit records 2026-06-17 07:29:34.041286 | ubuntu-noble | +-w /var/log/audit/ -p wra -k auditlog 2026-06-17 07:29:34.041471 | ubuntu-noble | +-w /var/audit/ -p wra -k auditlog 2026-06-17 07:29:34.041684 | ubuntu-noble | + 2026-06-17 07:29:34.041876 | ubuntu-noble | +## Auditd configuration 2026-06-17 07:29:34.042112 | ubuntu-noble | +### Modifications to audit configuration that occur while the audit collection functions are operating 2026-06-17 07:29:34.042311 | ubuntu-noble | +-w /etc/audit/ -p wa -k auditconfig 2026-06-17 07:29:34.042487 | ubuntu-noble | +-w /etc/libaudit.conf -p wa -k auditconfig 2026-06-17 07:29:34.042669 | ubuntu-noble | +-w /etc/audisp/ -p wa -k audispconfig 2026-06-17 07:29:34.042834 | ubuntu-noble | + 2026-06-17 07:29:34.043000 | ubuntu-noble | +## Monitor for use of audit management tools 2026-06-17 07:29:34.043192 | ubuntu-noble | +-w /sbin/auditctl -p x -k audittools 2026-06-17 07:29:34.043355 | ubuntu-noble | +-w /sbin/auditd -p x -k audittools 2026-06-17 07:29:34.043570 | ubuntu-noble | +-w /usr/sbin/auditd -p x -k audittools 2026-06-17 07:29:34.043749 | ubuntu-noble | +-w /usr/sbin/augenrules -p x -k audittools 2026-06-17 07:29:34.043908 | ubuntu-noble | + 2026-06-17 07:29:34.044091 | ubuntu-noble | +## Access to all audit trails 2026-06-17 07:29:34.045541 | ubuntu-noble | + 2026-06-17 07:29:34.045559 | ubuntu-noble | +-a always,exit -F path=/usr/sbin/ausearch -F perm=x -k audittools 2026-06-17 07:29:34.045565 | ubuntu-noble | +-a always,exit -F path=/usr/sbin/aureport -F perm=x -k audittools 2026-06-17 07:29:34.045571 | ubuntu-noble | +-a always,exit -F path=/usr/sbin/aulast -F perm=x -k audittools 2026-06-17 07:29:34.045577 | ubuntu-noble | +-a always,exit -F path=/usr/sbin/aulastlogin -F perm=x -k audittools 2026-06-17 07:29:34.045582 | ubuntu-noble | +-a always,exit -F path=/usr/sbin/auvirt -F perm=x -k audittools 2026-06-17 07:29:34.045588 | ubuntu-noble | + 2026-06-17 07:29:34.045593 | ubuntu-noble | +# Filters --------------------------------------------------------------------- 2026-06-17 07:29:34.045599 | ubuntu-noble | + 2026-06-17 07:29:34.045604 | ubuntu-noble | +### We put these early because audit is a first match wins system. 2026-06-17 07:29:34.045749 | ubuntu-noble | + 2026-06-17 07:29:34.045917 | ubuntu-noble | +## Ignore SELinux AVC records 2026-06-17 07:29:34.046133 | ubuntu-noble | +-a always,exclude -F msgtype=AVC 2026-06-17 07:29:34.046293 | ubuntu-noble | + 2026-06-17 07:29:34.046465 | ubuntu-noble | +## Ignore current working directory records 2026-06-17 07:29:34.046653 | ubuntu-noble | +-a always,exclude -F msgtype=CWD 2026-06-17 07:29:34.046797 | ubuntu-noble | + 2026-06-17 07:29:34.046951 | ubuntu-noble | +## Cron jobs fill the logs with stuff we normally don't want (works with SELinux) 2026-06-17 07:29:34.047120 | ubuntu-noble | +-a never,user -F subj_type=crond_t 2026-06-17 07:29:34.047271 | ubuntu-noble | +-a never,exit -F subj_type=crond_t 2026-06-17 07:29:34.047408 | ubuntu-noble | + 2026-06-17 07:29:34.047577 | ubuntu-noble | +## This prevents chrony from overwhelming the logs 2026-06-17 07:29:34.047732 | ubuntu-noble | +-a never,exit -F arch=b64 -S adjtimex -F auid=-1 -F uid=chrony -F subj_type=chronyd_t 2026-06-17 07:29:34.047870 | ubuntu-noble | + 2026-06-17 07:29:34.048018 | ubuntu-noble | +## This is not very interesting and wastes a lot of space if the server is public facing 2026-06-17 07:29:34.048189 | ubuntu-noble | +-a always,exclude -F msgtype=CRYPTO_KEY_USER 2026-06-17 07:29:34.048326 | ubuntu-noble | + 2026-06-17 07:29:34.048467 | ubuntu-noble | +## Open VM Tools 2026-06-17 07:29:34.048638 | ubuntu-noble | +-a exit,never -F arch=b64 -S all -F exe=/usr/bin/vmtoolsd 2026-06-17 07:29:34.048781 | ubuntu-noble | + 2026-06-17 07:29:34.048934 | ubuntu-noble | +## High Volume Event Filter (especially on Linux Workstations) 2026-06-17 07:29:34.049098 | ubuntu-noble | +-a never,exit -F arch=b64 -F dir=/dev/shm -k sharedmemaccess 2026-06-17 07:29:34.049249 | ubuntu-noble | +-a never,exit -F arch=b64 -F dir=/var/lock/lvm -k locklvm 2026-06-17 07:29:34.049384 | ubuntu-noble | + 2026-06-17 07:29:34.049544 | ubuntu-noble | +## FileBeat 2026-06-17 07:29:34.049700 | ubuntu-noble | +-a never,exit -F arch=b64 -F path=/opt/filebeat -k filebeat 2026-06-17 07:29:34.049837 | ubuntu-noble | + 2026-06-17 07:29:34.049981 | ubuntu-noble | +## More information on how to filter events 2026-06-17 07:29:34.050173 | ubuntu-noble | +### https://access.redhat.com/solutions/2482221 2026-06-17 07:29:34.050319 | ubuntu-noble | + 2026-06-17 07:29:34.050461 | ubuntu-noble | +# Rules ----------------------------------------------------------------------- 2026-06-17 07:29:34.050617 | ubuntu-noble | + 2026-06-17 07:29:34.050758 | ubuntu-noble | +## Kernel parameters 2026-06-17 07:29:34.050897 | ubuntu-noble | +-w /etc/sysctl.conf -p wa -k sysctl 2026-06-17 07:29:34.051032 | ubuntu-noble | +-w /etc/sysctl.d -p wa -k sysctl 2026-06-17 07:29:34.051177 | ubuntu-noble | + 2026-06-17 07:29:34.051317 | ubuntu-noble | +## Kernel module loading and unloading 2026-06-17 07:29:34.051460 | ubuntu-noble | +-a always,exit -F perm=x -F auid!=-1 -F path=/sbin/insmod -k modules 2026-06-17 07:29:34.051620 | ubuntu-noble | +-a always,exit -F perm=x -F auid!=-1 -F path=/sbin/modprobe -k modules 2026-06-17 07:29:34.051765 | ubuntu-noble | +-a always,exit -F perm=x -F auid!=-1 -F path=/sbin/rmmod -k modules 2026-06-17 07:29:34.051906 | ubuntu-noble | +-a always,exit -F arch=b64 -S finit_module -S init_module -S delete_module -F auid!=-1 -k modules 2026-06-17 07:29:34.052032 | ubuntu-noble | + 2026-06-17 07:29:34.052211 | ubuntu-noble | +## Modprobe configuration 2026-06-17 07:29:34.052355 | ubuntu-noble | +-w /etc/modprobe.conf -p wa -k modprobe 2026-06-17 07:29:34.052493 | ubuntu-noble | +-w /etc/modprobe.d -p wa -k modprobe 2026-06-17 07:29:34.052642 | ubuntu-noble | + 2026-06-17 07:29:34.052772 | ubuntu-noble | +## KExec usage (all actions) 2026-06-17 07:29:34.052900 | ubuntu-noble | +-a always,exit -F arch=b64 -S kexec_load -k KEXEC 2026-06-17 07:29:34.053039 | ubuntu-noble | + 2026-06-17 07:29:34.053186 | ubuntu-noble | +## Special files 2026-06-17 07:29:34.053318 | ubuntu-noble | +-a always,exit -F arch=b64 -S mknod -S mknodat -k specialfiles 2026-06-17 07:29:34.053441 | ubuntu-noble | + 2026-06-17 07:29:34.053586 | ubuntu-noble | +## Mount operations (only attributable) 2026-06-17 07:29:34.053722 | ubuntu-noble | +-a always,exit -F arch=b64 -S mount -S umount2 -F auid!=-1 -k mount 2026-06-17 07:29:34.053839 | ubuntu-noble | + 2026-06-17 07:29:34.053963 | ubuntu-noble | +### NFS mount 2026-06-17 07:29:34.054111 | ubuntu-noble | +-a always,exit -F path=/sbin/mount.nfs -F perm=x -F auid>=500 -F auid!=4294967295 -k T1078_Valid_Accounts 2026-06-17 07:29:34.054258 | ubuntu-noble | +-a always,exit -F path=/usr/sbin/mount.nfs -F perm=x -F auid>=500 -F auid!=4294967295 -k T1078_Valid_Accounts 2026-06-17 07:29:34.054379 | ubuntu-noble | + 2026-06-17 07:29:34.054507 | ubuntu-noble | +## Change swap (only attributable) 2026-06-17 07:29:34.054660 | ubuntu-noble | +-a always,exit -F arch=b64 -S swapon -S swapoff -F auid!=-1 -k swap 2026-06-17 07:29:34.054784 | ubuntu-noble | + 2026-06-17 07:29:34.054906 | ubuntu-noble | +## Time 2026-06-17 07:29:34.055038 | ubuntu-noble | +-a always,exit -F arch=b64 -F uid!=ntp -S adjtimex -S settimeofday -S clock_settime -k time 2026-06-17 07:29:34.056537 | ubuntu-noble | +### Local time zone 2026-06-17 07:29:34.056553 | ubuntu-noble | +-w /etc/localtime -p wa -k localtime 2026-06-17 07:29:34.056558 | ubuntu-noble | + 2026-06-17 07:29:34.056562 | ubuntu-noble | +## Stunnel 2026-06-17 07:29:34.056566 | ubuntu-noble | +-w /usr/sbin/stunnel -p x -k stunnel 2026-06-17 07:29:34.056570 | ubuntu-noble | +-w /usr/bin/stunnel -p x -k stunnel 2026-06-17 07:29:34.056574 | ubuntu-noble | + 2026-06-17 07:29:34.056578 | ubuntu-noble | +## Cron configuration & scheduled jobs 2026-06-17 07:29:34.056582 | ubuntu-noble | +-w /etc/cron.allow -p wa -k cron 2026-06-17 07:29:34.056586 | ubuntu-noble | +-w /etc/cron.deny -p wa -k cron 2026-06-17 07:29:34.056590 | ubuntu-noble | +-w /etc/cron.d/ -p wa -k cron 2026-06-17 07:29:34.056594 | ubuntu-noble | +-w /etc/cron.daily/ -p wa -k cron 2026-06-17 07:29:34.056598 | ubuntu-noble | +-w /etc/cron.hourly/ -p wa -k cron 2026-06-17 07:29:34.056602 | ubuntu-noble | +-w /etc/cron.monthly/ -p wa -k cron 2026-06-17 07:29:34.056680 | ubuntu-noble | +-w /etc/cron.weekly/ -p wa -k cron 2026-06-17 07:29:34.056794 | ubuntu-noble | +-w /etc/crontab -p wa -k cron 2026-06-17 07:29:34.056909 | ubuntu-noble | +-w /var/spool/cron/ -p wa -k cron 2026-06-17 07:29:34.057016 | ubuntu-noble | + 2026-06-17 07:29:34.057142 | ubuntu-noble | +## User, group, password databases 2026-06-17 07:29:34.057255 | ubuntu-noble | +-w /etc/group -p wa -k etcgroup 2026-06-17 07:29:34.057366 | ubuntu-noble | +-w /etc/passwd -p wa -k etcpasswd 2026-06-17 07:29:34.057478 | ubuntu-noble | +-w /etc/gshadow -k etcgroup 2026-06-17 07:29:34.057606 | ubuntu-noble | +-w /etc/shadow -k etcpasswd 2026-06-17 07:29:34.057724 | ubuntu-noble | +-w /etc/security/opasswd -k opasswd 2026-06-17 07:29:34.057834 | ubuntu-noble | + 2026-06-17 07:29:34.057949 | ubuntu-noble | +## Sudoers file changes 2026-06-17 07:29:34.058098 | ubuntu-noble | +-w /etc/sudoers -p wa -k actions 2026-06-17 07:29:34.058220 | ubuntu-noble | +-w /etc/sudoers.d/ -p wa -k actions 2026-06-17 07:29:34.058331 | ubuntu-noble | + 2026-06-17 07:29:34.058444 | ubuntu-noble | +## Passwd 2026-06-17 07:29:34.058580 | ubuntu-noble | +-w /usr/bin/passwd -p x -k passwd_modification 2026-06-17 07:29:34.058696 | ubuntu-noble | + 2026-06-17 07:29:34.058815 | ubuntu-noble | +## Tools to change group identifiers 2026-06-17 07:29:34.058935 | ubuntu-noble | +-w /usr/sbin/groupadd -p x -k group_modification 2026-06-17 07:29:34.059067 | ubuntu-noble | +-w /usr/sbin/groupmod -p x -k group_modification 2026-06-17 07:29:34.059186 | ubuntu-noble | +-w /usr/sbin/addgroup -p x -k group_modification 2026-06-17 07:29:34.059304 | ubuntu-noble | +-w /usr/sbin/useradd -p x -k user_modification 2026-06-17 07:29:34.059421 | ubuntu-noble | +-w /usr/sbin/userdel -p x -k user_modification 2026-06-17 07:29:34.059554 | ubuntu-noble | +-w /usr/sbin/usermod -p x -k user_modification 2026-06-17 07:29:34.059677 | ubuntu-noble | +-w /usr/sbin/adduser -p x -k user_modification 2026-06-17 07:29:34.059785 | ubuntu-noble | + 2026-06-17 07:29:34.059900 | ubuntu-noble | +## Login configuration and information 2026-06-17 07:29:34.060013 | ubuntu-noble | +-w /etc/login.defs -p wa -k login 2026-06-17 07:29:34.060164 | ubuntu-noble | +-w /etc/securetty -p wa -k login 2026-06-17 07:29:34.060277 | ubuntu-noble | +-w /var/log/faillog -p wa -k login 2026-06-17 07:29:34.060390 | ubuntu-noble | +-w /var/log/lastlog -p wa -k login 2026-06-17 07:29:34.060505 | ubuntu-noble | +-w /var/log/tallylog -p wa -k login 2026-06-17 07:29:34.060633 | ubuntu-noble | + 2026-06-17 07:29:34.060753 | ubuntu-noble | +## Network Environment 2026-06-17 07:29:34.060864 | ubuntu-noble | +### Changes to hostname 2026-06-17 07:29:34.060996 | ubuntu-noble | +-a always,exit -F arch=b64 -S sethostname -S setdomainname -k network_modifications 2026-06-17 07:29:34.061119 | ubuntu-noble | + 2026-06-17 07:29:34.061231 | ubuntu-noble | +### Detect Remote Shell Use 2026-06-17 07:29:34.061349 | ubuntu-noble | +-a always,exit -F arch=b64 -F exe=/bin/bash -F success=1 -S connect -k "remote_shell" 2026-06-17 07:29:34.061468 | ubuntu-noble | +-a always,exit -F arch=b64 -F exe=/usr/bin/bash -F success=1 -S connect -k "remote_shell" 2026-06-17 07:29:34.061592 | ubuntu-noble | + 2026-06-17 07:29:34.061712 | ubuntu-noble | +### Successful IPv4 Connections 2026-06-17 07:29:34.061830 | ubuntu-noble | +-a always,exit -F arch=b64 -S connect -F a2=16 -F success=1 -F key=network_connect_4 2026-06-17 07:29:34.061936 | ubuntu-noble | + 2026-06-17 07:29:34.062064 | ubuntu-noble | +### Successful IPv6 Connections 2026-06-17 07:29:34.062184 | ubuntu-noble | +-a always,exit -F arch=b64 -S connect -F a2=28 -F success=1 -F key=network_connect_6 2026-06-17 07:29:34.062290 | ubuntu-noble | + 2026-06-17 07:29:34.062403 | ubuntu-noble | +### Changes to other files 2026-06-17 07:29:34.062536 | ubuntu-noble | +-w /etc/hosts -p wa -k network_modifications 2026-06-17 07:29:34.062661 | ubuntu-noble | +-w /etc/sysconfig/network -p wa -k network_modifications 2026-06-17 07:29:34.062776 | ubuntu-noble | +-w /etc/sysconfig/network-scripts -p w -k network_modifications 2026-06-17 07:29:34.062888 | ubuntu-noble | +-w /etc/network/ -p wa -k network 2026-06-17 07:29:34.063015 | ubuntu-noble | +-a always,exit -F dir=/etc/NetworkManager/ -F perm=wa -k network_modifications 2026-06-17 07:29:34.063167 | ubuntu-noble | + 2026-06-17 07:29:34.063286 | ubuntu-noble | +### Changes to issue 2026-06-17 07:29:34.063402 | ubuntu-noble | +-w /etc/issue -p wa -k etcissue 2026-06-17 07:29:34.063533 | ubuntu-noble | +-w /etc/issue.net -p wa -k etcissue 2026-06-17 07:29:34.063651 | ubuntu-noble | + 2026-06-17 07:29:34.063764 | ubuntu-noble | +## System startup scripts 2026-06-17 07:29:34.063879 | ubuntu-noble | +-w /etc/inittab -p wa -k init 2026-06-17 07:29:34.063990 | ubuntu-noble | +-w /etc/init.d/ -p wa -k init 2026-06-17 07:29:34.064116 | ubuntu-noble | +-w /etc/init/ -p wa -k init 2026-06-17 07:29:34.064226 | ubuntu-noble | + 2026-06-17 07:29:34.064337 | ubuntu-noble | +## Library search paths 2026-06-17 07:29:34.064451 | ubuntu-noble | +-w /etc/ld.so.conf -p wa -k libpath 2026-06-17 07:29:34.064585 | ubuntu-noble | +-w /etc/ld.so.conf.d -p wa -k libpath 2026-06-17 07:29:34.064697 | ubuntu-noble | + 2026-06-17 07:29:34.064818 | ubuntu-noble | +## Systemwide library preloads (LD_PRELOAD) 2026-06-17 07:29:34.064934 | ubuntu-noble | +-w /etc/ld.so.preload -p wa -k systemwide_preloads 2026-06-17 07:29:34.065039 | ubuntu-noble | + 2026-06-17 07:29:34.065165 | ubuntu-noble | +## Pam configuration 2026-06-17 07:29:34.065279 | ubuntu-noble | +-w /etc/pam.d/ -p wa -k pam 2026-06-17 07:29:34.065397 | ubuntu-noble | +-w /etc/security/limits.conf -p wa -k pam 2026-06-17 07:29:34.065511 | ubuntu-noble | +-w /etc/security/limits.d -p wa -k pam 2026-06-17 07:29:34.065647 | ubuntu-noble | +-w /etc/security/pam_env.conf -p wa -k pam 2026-06-17 07:29:34.065763 | ubuntu-noble | +-w /etc/security/namespace.conf -p wa -k pam 2026-06-17 07:29:34.066537 | ubuntu-noble | +-w /etc/security/namespace.d -p wa -k pam 2026-06-17 07:29:34.066567 | ubuntu-noble | +-w /etc/security/namespace.init -p wa -k pam 2026-06-17 07:29:34.066572 | ubuntu-noble | + 2026-06-17 07:29:34.066576 | ubuntu-noble | +## Mail configuration 2026-06-17 07:29:34.066580 | ubuntu-noble | +-w /etc/aliases -p wa -k mail 2026-06-17 07:29:34.066584 | ubuntu-noble | +-w /etc/postfix/ -p wa -k mail 2026-06-17 07:29:34.066587 | ubuntu-noble | +-w /etc/exim4/ -p wa -k mail 2026-06-17 07:29:34.066643 | ubuntu-noble | + 2026-06-17 07:29:34.066758 | ubuntu-noble | +## SSH configuration 2026-06-17 07:29:34.066873 | ubuntu-noble | +-w /etc/ssh/sshd_config -k sshd 2026-06-17 07:29:34.066986 | ubuntu-noble | +-w /etc/ssh/sshd_config.d -k sshd 2026-06-17 07:29:34.067108 | ubuntu-noble | + 2026-06-17 07:29:34.067223 | ubuntu-noble | +## root ssh key tampering 2026-06-17 07:29:34.067338 | ubuntu-noble | +-w /root/.ssh -p wa -k rootkey 2026-06-17 07:29:34.067450 | ubuntu-noble | + 2026-06-17 07:29:34.067789 | ubuntu-noble | +# Systemd 2026-06-17 07:29:34.067921 | ubuntu-noble | +-w /bin/systemctl -p x -k systemd 2026-06-17 07:29:34.068035 | ubuntu-noble | +-w /etc/systemd/ -p wa -k systemd 2026-06-17 07:29:34.068167 | ubuntu-noble | +-w /usr/lib/systemd -p wa -k systemd 2026-06-17 07:29:34.068279 | ubuntu-noble | + 2026-06-17 07:29:34.068397 | ubuntu-noble | +## https://systemd.network/systemd.generator.html 2026-06-17 07:29:34.068530 | ubuntu-noble | +-w /etc/systemd/system-generators/ -p wa -k systemd_generator 2026-06-17 07:29:34.068669 | ubuntu-noble | +-w /usr/local/lib/systemd/system-generators/ -p wa -k systemd_generator 2026-06-17 07:29:34.068799 | ubuntu-noble | +-w /usr/lib/systemd/system-generators -p wa -k systemd_generator 2026-06-17 07:29:34.069038 | ubuntu-noble | + 2026-06-17 07:29:34.069218 | ubuntu-noble | +-w /etc/systemd/user-generators/ -p wa -k systemd_generator 2026-06-17 07:29:34.069340 | ubuntu-noble | +-w /usr/local/lib/systemd/user-generators/ -p wa -k systemd_generator 2026-06-17 07:29:34.069460 | ubuntu-noble | +-w /lib/systemd/system-generators/ -p wa -k systemd_generator 2026-06-17 07:29:34.069594 | ubuntu-noble | + 2026-06-17 07:29:34.069723 | ubuntu-noble | +## SELinux events that modify the system's Mandatory Access Controls (MAC) 2026-06-17 07:29:34.069840 | ubuntu-noble | +-w /etc/selinux/ -p wa -k mac_policy 2026-06-17 07:29:34.069949 | ubuntu-noble | + 2026-06-17 07:29:34.070077 | ubuntu-noble | +## Critical elements access failures 2026-06-17 07:29:34.070200 | ubuntu-noble | +-a always,exit -F arch=b64 -S open -F dir=/etc -F success=0 -k unauthedfileaccess 2026-06-17 07:29:34.070321 | ubuntu-noble | +-a always,exit -F arch=b64 -S open -F dir=/bin -F success=0 -k unauthedfileaccess 2026-06-17 07:29:34.070439 | ubuntu-noble | +-a always,exit -F arch=b64 -S open -F dir=/sbin -F success=0 -k unauthedfileaccess 2026-06-17 07:29:34.070585 | ubuntu-noble | +-a always,exit -F arch=b64 -S open -F dir=/usr/bin -F success=0 -k unauthedfileaccess 2026-06-17 07:29:34.070711 | ubuntu-noble | +-a always,exit -F arch=b64 -S open -F dir=/usr/sbin -F success=0 -k unauthedfileaccess 2026-06-17 07:29:34.071680 | ubuntu-noble | +-a always,exit -F arch=b64 -S open -F dir=/var -F success=0 -k unauthedfileaccess 2026-06-17 07:29:34.071744 | ubuntu-noble | +-a always,exit -F arch=b64 -S open -F dir=/home -F success=0 -k unauthedfileaccess 2026-06-17 07:29:34.071757 | ubuntu-noble | +-a always,exit -F arch=b64 -S open -F dir=/srv -F success=0 -k unauthedfileaccess 2026-06-17 07:29:34.071762 | ubuntu-noble | + 2026-06-17 07:29:34.071768 | ubuntu-noble | +## Process ID change (switching accounts) applications 2026-06-17 07:29:34.071772 | ubuntu-noble | +-w /bin/su -p x -k priv_esc 2026-06-17 07:29:34.071776 | ubuntu-noble | +-w /usr/bin/sudo -p x -k priv_esc 2026-06-17 07:29:34.071781 | ubuntu-noble | + 2026-06-17 07:29:34.072707 | ubuntu-noble | +## Power state 2026-06-17 07:29:34.072872 | ubuntu-noble | +-w /sbin/shutdown -p x -k power 2026-06-17 07:29:34.072981 | ubuntu-noble | +-w /sbin/poweroff -p x -k power 2026-06-17 07:29:34.073125 | ubuntu-noble | +-w /sbin/reboot -p x -k power 2026-06-17 07:29:34.073217 | ubuntu-noble | +-w /sbin/halt -p x -k power 2026-06-17 07:29:34.073314 | ubuntu-noble | + 2026-06-17 07:29:34.073425 | ubuntu-noble | +## Session initiation information 2026-06-17 07:29:34.073542 | ubuntu-noble | +-w /var/run/utmp -p wa -k session 2026-06-17 07:29:34.074572 | ubuntu-noble | +-w /var/log/btmp -p wa -k session 2026-06-17 07:29:34.074598 | ubuntu-noble | +-w /var/log/wtmp -p wa -k session 2026-06-17 07:29:34.074602 | ubuntu-noble | + 2026-06-17 07:29:34.074607 | ubuntu-noble | +## Discretionary Access Control (DAC) modifications 2026-06-17 07:29:34.074611 | ubuntu-noble | +-a always,exit -F arch=b64 -S chmod -F auid>=1000 -F auid!=-1 -k perm_mod 2026-06-17 07:29:34.074617 | ubuntu-noble | +-a always,exit -F arch=b64 -S chown -F auid>=1000 -F auid!=-1 -k perm_mod 2026-06-17 07:29:34.074621 | ubuntu-noble | +-a always,exit -F arch=b64 -S fchmod -F auid>=1000 -F auid!=-1 -k perm_mod 2026-06-17 07:29:34.074625 | ubuntu-noble | +-a always,exit -F arch=b64 -S fchmodat -F auid>=1000 -F auid!=-1 -k perm_mod 2026-06-17 07:29:34.074628 | ubuntu-noble | +-a always,exit -F arch=b64 -S fchown -F auid>=1000 -F auid!=-1 -k perm_mod 2026-06-17 07:29:34.075092 | ubuntu-noble | +-a always,exit -F arch=b64 -S fchownat -F auid>=1000 -F auid!=-1 -k perm_mod 2026-06-17 07:29:34.075226 | ubuntu-noble | +-a always,exit -F arch=b64 -S fremovexattr -F auid>=1000 -F auid!=-1 -k perm_mod 2026-06-17 07:29:34.075338 | ubuntu-noble | +-a always,exit -F arch=b64 -S fsetxattr -F auid>=1000 -F auid!=-1 -k perm_mod 2026-06-17 07:29:34.075452 | ubuntu-noble | +-a always,exit -F arch=b64 -S lchown -F auid>=1000 -F auid!=-1 -k perm_mod 2026-06-17 07:29:34.075861 | ubuntu-noble | +-a always,exit -F arch=b64 -S lremovexattr -F auid>=1000 -F auid!=-1 -k perm_mod 2026-06-17 07:29:34.075875 | ubuntu-noble | +-a always,exit -F arch=b64 -S lsetxattr -F auid>=1000 -F auid!=-1 -k perm_mod 2026-06-17 07:29:34.075978 | ubuntu-noble | +-a always,exit -F arch=b64 -S removexattr -F auid>=1000 -F auid!=-1 -k perm_mod 2026-06-17 07:29:34.076095 | ubuntu-noble | +-a always,exit -F arch=b64 -S setxattr -F auid>=1000 -F auid!=-1 -k perm_mod 2026-06-17 07:29:34.076184 | ubuntu-noble | + 2026-06-17 07:29:34.076284 | ubuntu-noble | +# Special Rules --------------------------------------------------------------- 2026-06-17 07:29:34.076379 | ubuntu-noble | + 2026-06-17 07:29:34.076476 | ubuntu-noble | +## Reconnaissance 2026-06-17 07:29:34.078166 | ubuntu-noble | +-w /usr/bin/whoami -p x -k recon 2026-06-17 07:29:34.078288 | ubuntu-noble | +-w /usr/bin/id -p x -k recon 2026-06-17 07:29:34.078402 | ubuntu-noble | +-w /bin/hostname -p x -k recon 2026-06-17 07:29:34.078510 | ubuntu-noble | +-w /bin/uname -p x -k recon 2026-06-17 07:29:34.078962 | ubuntu-noble | +-w /etc/issue -p r -k recon 2026-06-17 07:29:34.079089 | ubuntu-noble | +-w /etc/hostname -p r -k recon 2026-06-17 07:29:34.079186 | ubuntu-noble | + 2026-06-17 07:29:34.079290 | ubuntu-noble | +## Suspicious activity 2026-06-17 07:29:34.079392 | ubuntu-noble | +-w /usr/bin/wget -p x -k susp_activity 2026-06-17 07:29:34.079493 | ubuntu-noble | +-w /usr/bin/curl -p x -k susp_activity 2026-06-17 07:29:34.081182 | ubuntu-noble | +-w /usr/bin/base64 -p x -k susp_activity 2026-06-17 07:29:34.081209 | ubuntu-noble | +-w /bin/nc -p x -k susp_activity 2026-06-17 07:29:34.081214 | ubuntu-noble | +-w /bin/netcat -p x -k susp_activity 2026-06-17 07:29:34.081218 | ubuntu-noble | +-w /usr/bin/ncat -p x -k susp_activity 2026-06-17 07:29:34.081222 | ubuntu-noble | +-w /usr/bin/ss -p x -k susp_activity 2026-06-17 07:29:34.081226 | ubuntu-noble | +-w /usr/bin/netstat -p x -k susp_activity 2026-06-17 07:29:34.081229 | ubuntu-noble | +-w /usr/bin/ssh -p x -k susp_activity 2026-06-17 07:29:34.081233 | ubuntu-noble | +-w /usr/bin/scp -p x -k susp_activity 2026-06-17 07:29:34.081236 | ubuntu-noble | +-w /usr/bin/sftp -p x -k susp_activity 2026-06-17 07:29:34.081240 | ubuntu-noble | +-w /usr/bin/ftp -p x -k susp_activity 2026-06-17 07:29:34.081243 | ubuntu-noble | +-w /usr/bin/socat -p x -k susp_activity 2026-06-17 07:29:34.081247 | ubuntu-noble | +-w /usr/bin/wireshark -p x -k susp_activity 2026-06-17 07:29:34.081250 | ubuntu-noble | +-w /usr/bin/tshark -p x -k susp_activity 2026-06-17 07:29:34.081254 | ubuntu-noble | +-w /usr/bin/rawshark -p x -k susp_activity 2026-06-17 07:29:34.081258 | ubuntu-noble | +-w /usr/bin/rdesktop -p x -k susp_activity 2026-06-17 07:29:34.081265 | ubuntu-noble | +-w /usr/local/bin/rdesktop -p x -k susp_activity 2026-06-17 07:29:34.081434 | ubuntu-noble | +-w /usr/bin/wlfreerdp -p x -k susp_activity 2026-06-17 07:29:34.081442 | ubuntu-noble | +-w /usr/bin/xfreerdp -p x -k susp_activity 2026-06-17 07:29:34.081554 | ubuntu-noble | +-w /usr/local/bin/xfreerdp -p x -k susp_activity 2026-06-17 07:29:34.081643 | ubuntu-noble | +-w /usr/bin/nmap -p x -k susp_activity 2026-06-17 07:29:34.081740 | ubuntu-noble | + 2026-06-17 07:29:34.081836 | ubuntu-noble | +## sssd 2026-06-17 07:29:34.081950 | ubuntu-noble | +-a always,exit -F path=/usr/libexec/sssd/p11_child -F perm=x -F auid>=500 -F auid!=4294967295 -k T1078_Valid_Accounts 2026-06-17 07:29:34.082070 | ubuntu-noble | +-a always,exit -F path=/usr/libexec/sssd/krb5_child -F perm=x -F auid>=500 -F auid!=4294967295 -k T1078_Valid_Accounts 2026-06-17 07:29:34.082184 | ubuntu-noble | +-a always,exit -F path=/usr/libexec/sssd/ldap_child -F perm=x -F auid>=500 -F auid!=4294967295 -k T1078_Valid_Accounts 2026-06-17 07:29:34.082282 | ubuntu-noble | +-a always,exit -F path=/usr/libexec/sssd/selinux_child -F perm=x -F auid>=500 -F auid!=4294967295 -k T1078_Valid_Accounts 2026-06-17 07:29:34.082389 | ubuntu-noble | +-a always,exit -F path=/usr/libexec/sssd/proxy_child -F perm=x -F auid>=500 -F auid!=4294967295 -k T1078_Valid_Accounts 2026-06-17 07:29:34.082483 | ubuntu-noble | + 2026-06-17 07:29:34.083095 | ubuntu-noble | +## T1002 Data Compressed 2026-06-17 07:29:34.083115 | ubuntu-noble | + 2026-06-17 07:29:34.083158 | ubuntu-noble | +-w /usr/bin/zip -p x -k Data_Compressed 2026-06-17 07:29:34.083259 | ubuntu-noble | +-w /usr/bin/gzip -p x -k Data_Compressed 2026-06-17 07:29:34.083366 | ubuntu-noble | +-w /usr/bin/tar -p x -k Data_Compressed 2026-06-17 07:29:34.083467 | ubuntu-noble | +-w /usr/bin/bzip2 -p x -k Data_Compressed 2026-06-17 07:29:34.083595 | ubuntu-noble | + 2026-06-17 07:29:34.083696 | ubuntu-noble | +-w /usr/bin/lzip -p x -k Data_Compressed 2026-06-17 07:29:34.083801 | ubuntu-noble | +-w /usr/local/bin/lzip -p x -k Data_Compressed 2026-06-17 07:29:34.083894 | ubuntu-noble | + 2026-06-17 07:29:34.083996 | ubuntu-noble | +-w /usr/bin/lz4 -p x -k Data_Compressed 2026-06-17 07:29:34.084134 | ubuntu-noble | +-w /usr/local/bin/lz4 -p x -k Data_Compressed 2026-06-17 07:29:34.084229 | ubuntu-noble | + 2026-06-17 07:29:34.084331 | ubuntu-noble | +-w /usr/bin/lzop -p x -k Data_Compressed 2026-06-17 07:29:34.084549 | ubuntu-noble | +-w /usr/local/bin/lzop -p x -k Data_Compressed 2026-06-17 07:29:34.084571 | ubuntu-noble | + 2026-06-17 07:29:34.084889 | ubuntu-noble | +-w /usr/bin/plzip -p x -k Data_Compressed 2026-06-17 07:29:34.084899 | ubuntu-noble | +-w /usr/local/bin/plzip -p x -k Data_Compressed 2026-06-17 07:29:34.084902 | ubuntu-noble | + 2026-06-17 07:29:34.087573 | ubuntu-noble | +-w /usr/bin/pbzip2 -p x -k Data_Compressed 2026-06-17 07:29:34.087614 | ubuntu-noble | +-w /usr/local/bin/pbzip2 -p x -k Data_Compressed 2026-06-17 07:29:34.087618 | ubuntu-noble | + 2026-06-17 07:29:34.087623 | ubuntu-noble | +-w /usr/bin/lbzip2 -p x -k Data_Compressed 2026-06-17 07:29:34.087627 | ubuntu-noble | +-w /usr/local/bin/lbzip2 -p x -k Data_Compressed 2026-06-17 07:29:34.087630 | ubuntu-noble | + 2026-06-17 07:29:34.087634 | ubuntu-noble | +-w /usr/bin/pixz -p x -k Data_Compressed 2026-06-17 07:29:34.087638 | ubuntu-noble | +-w /usr/local/bin/pixz -p x -k Data_Compressed 2026-06-17 07:29:34.087641 | ubuntu-noble | + 2026-06-17 07:29:34.087645 | ubuntu-noble | +-w /usr/bin/pigz -p x -k Data_Compressed 2026-06-17 07:29:34.087649 | ubuntu-noble | +-w /usr/local/bin/pigz -p x -k Data_Compressed 2026-06-17 07:29:34.087652 | ubuntu-noble | +-w /usr/bin/unpigz -p x -k Data_Compressed 2026-06-17 07:29:34.087656 | ubuntu-noble | +-w /usr/local/bin/unpigz -p x -k Data_Compressed 2026-06-17 07:29:34.087660 | ubuntu-noble | + 2026-06-17 07:29:34.087663 | ubuntu-noble | +-w /usr/bin/zstd -p x -k Data_Compressed 2026-06-17 07:29:34.087667 | ubuntu-noble | +-w /usr/local/bin/zstd -p x -k Data_Compressed 2026-06-17 07:29:34.087670 | ubuntu-noble | + 2026-06-17 07:29:34.087674 | ubuntu-noble | +## Added to catch netcat on Ubuntu 2026-06-17 07:29:34.087678 | ubuntu-noble | +-w /bin/nc.openbsd -p x -k susp_activity 2026-06-17 07:29:34.087682 | ubuntu-noble | +-w /bin/nc.traditional -p x -k susp_activity 2026-06-17 07:29:34.087685 | ubuntu-noble | + 2026-06-17 07:29:34.087689 | ubuntu-noble | +## Sbin suspicious activity 2026-06-17 07:29:34.087693 | ubuntu-noble | +-w /sbin/iptables -p x -k sbin_susp 2026-06-17 07:29:34.087696 | ubuntu-noble | +-w /sbin/ip6tables -p x -k sbin_susp 2026-06-17 07:29:34.087704 | ubuntu-noble | +-w /sbin/ifconfig -p x -k sbin_susp 2026-06-17 07:29:34.087755 | ubuntu-noble | +-w /usr/sbin/arptables -p x -k sbin_susp 2026-06-17 07:29:34.087833 | ubuntu-noble | +-w /usr/sbin/ebtables -p x -k sbin_susp 2026-06-17 07:29:34.087931 | ubuntu-noble | +-w /sbin/xtables-nft-multi -p x -k sbin_susp 2026-06-17 07:29:34.088032 | ubuntu-noble | +-w /usr/sbin/nft -p x -k sbin_susp 2026-06-17 07:29:34.088141 | ubuntu-noble | +-w /usr/sbin/tcpdump -p x -k sbin_susp 2026-06-17 07:29:34.088245 | ubuntu-noble | +-w /usr/sbin/traceroute -p x -k sbin_susp 2026-06-17 07:29:34.088339 | ubuntu-noble | +-w /usr/sbin/ufw -p x -k sbin_susp 2026-06-17 07:29:34.088436 | ubuntu-noble | + 2026-06-17 07:29:34.088579 | ubuntu-noble | +### kde4 2026-06-17 07:29:34.088678 | ubuntu-noble | +-a always,exit -F path=/usr/libexec/kde4/kpac_dhcp_helper -F perm=x -F auid>=1000 -F auid!=4294967295 -k T1078_Valid_Accounts 2026-06-17 07:29:34.088785 | ubuntu-noble | +-a always,exit -F path=/usr/libexec/kde4/kdesud -F perm=x -F auid>=1000 -F auid!=4294967295 -k T1078_Valid_Accounts 2026-06-17 07:29:34.088878 | ubuntu-noble | + 2026-06-17 07:29:34.088982 | ubuntu-noble | +## dbus-send invocation 2026-06-17 07:29:34.089117 | ubuntu-noble | +### may indicate privilege escalation CVE-2021-3560 2026-06-17 07:29:34.089214 | ubuntu-noble | +-w /usr/bin/dbus-send -p x -k dbus_send 2026-06-17 07:29:34.089317 | ubuntu-noble | +-w /usr/bin/gdbus -p x -k gdubs_call 2026-06-17 07:29:34.089413 | ubuntu-noble | + 2026-06-17 07:29:34.089509 | ubuntu-noble | +## pkexec invocation 2026-06-17 07:29:34.089659 | ubuntu-noble | +### may indicate privilege escalation CVE-2021-4034 2026-06-17 07:29:34.089758 | ubuntu-noble | +-w /usr/bin/pkexec -p x -k pkexec 2026-06-17 07:29:34.089852 | ubuntu-noble | + 2026-06-17 07:29:34.089950 | ubuntu-noble | +## Suspicious shells 2026-06-17 07:29:34.090070 | ubuntu-noble | +-w /bin/ash -p x -k susp_shell 2026-06-17 07:29:34.090160 | ubuntu-noble | +-w /bin/csh -p x -k susp_shell 2026-06-17 07:29:34.090259 | ubuntu-noble | +-w /bin/fish -p x -k susp_shell 2026-06-17 07:29:34.090358 | ubuntu-noble | +-w /bin/tcsh -p x -k susp_shell 2026-06-17 07:29:34.090454 | ubuntu-noble | +-w /bin/tclsh -p x -k susp_shell 2026-06-17 07:29:34.090574 | ubuntu-noble | +-w /bin/xonsh -p x -k susp_shell 2026-06-17 07:29:34.090674 | ubuntu-noble | +-w /usr/local/bin/xonsh -p x -k susp_shell 2026-06-17 07:29:34.090775 | ubuntu-noble | +-w /bin/open -p x -k susp_shell 2026-06-17 07:29:34.090874 | ubuntu-noble | +-w /bin/rbash -p x -k susp_shell 2026-06-17 07:29:34.090999 | ubuntu-noble | + 2026-06-17 07:29:34.091095 | ubuntu-noble | +# Web Server Actvity 2026-06-17 07:29:34.091189 | ubuntu-noble | +## Change the number "33" to the ID of your WebServer user. Default: www-data:x:33:33 2026-06-17 07:29:34.091292 | ubuntu-noble | +-a always,exit -F arch=b64 -S execve -F euid=33 -k detect_execve_www 2026-06-17 07:29:34.091384 | ubuntu-noble | + 2026-06-17 07:29:34.091487 | ubuntu-noble | +### https://clustershell.readthedocs.io/ 2026-06-17 07:29:34.091601 | ubuntu-noble | +-w /bin/clush -p x -k susp_shell 2026-06-17 07:29:34.091700 | ubuntu-noble | +-w /usr/local/bin/clush -p x -k susp_shell 2026-06-17 07:29:34.091813 | ubuntu-noble | +-w /etc/clustershell/clush.conf -p x -k susp_shell 2026-06-17 07:29:34.091905 | ubuntu-noble | + 2026-06-17 07:29:34.092008 | ubuntu-noble | +### https://github.com/tmux/tmux 2026-06-17 07:29:34.092137 | ubuntu-noble | +-w /bin/tmux -p x -k susp_shell 2026-06-17 07:29:34.092238 | ubuntu-noble | +-w /usr/local/bin/tmux -p x -k susp_shell 2026-06-17 07:29:34.092330 | ubuntu-noble | + 2026-06-17 07:29:34.092431 | ubuntu-noble | +## Shell/profile configurations 2026-06-17 07:29:34.092552 | ubuntu-noble | +-w /etc/profile.d/ -p wa -k shell_profiles 2026-06-17 07:29:34.092665 | ubuntu-noble | +-w /etc/profile -p wa -k shell_profiles 2026-06-17 07:29:34.092763 | ubuntu-noble | +-w /etc/shells -p wa -k shell_profiles 2026-06-17 07:29:34.092862 | ubuntu-noble | +-w /etc/bashrc -p wa -k shell_profiles 2026-06-17 07:29:34.092962 | ubuntu-noble | +-w /etc/csh.cshrc -p wa -k shell_profiles 2026-06-17 07:29:34.093076 | ubuntu-noble | +-w /etc/csh.login -p wa -k shell_profiles 2026-06-17 07:29:34.093187 | ubuntu-noble | +-w /etc/fish/ -p wa -k shell_profiles 2026-06-17 07:29:34.093275 | ubuntu-noble | +-w /etc/zsh/ -p wa -k shell_profiles 2026-06-17 07:29:34.093369 | ubuntu-noble | + 2026-06-17 07:29:34.093471 | ubuntu-noble | +### https://github.com/xxh/xxh 2026-06-17 07:29:34.093592 | ubuntu-noble | +-w /usr/local/bin/xxh.bash -p x -k susp_shell 2026-06-17 07:29:34.093693 | ubuntu-noble | +-w /usr/local/bin/xxh.xsh -p x -k susp_shell 2026-06-17 07:29:34.093795 | ubuntu-noble | +-w /usr/local/bin/xxh.zsh -p x -k susp_shell 2026-06-17 07:29:34.093891 | ubuntu-noble | + 2026-06-17 07:29:34.093992 | ubuntu-noble | +## Injection 2026-06-17 07:29:34.094118 | ubuntu-noble | +### These rules watch for code injection by the ptrace facility. 2026-06-17 07:29:34.094212 | ubuntu-noble | +### This could indicate someone trying to do something bad or just debugging 2026-06-17 07:29:34.094317 | ubuntu-noble | +-a always,exit -F arch=b64 -S ptrace -F a0=0x4 -k code_injection 2026-06-17 07:29:34.094423 | ubuntu-noble | +-a always,exit -F arch=b64 -S ptrace -F a0=0x5 -k data_injection 2026-06-17 07:29:34.094553 | ubuntu-noble | +-a always,exit -F arch=b64 -S ptrace -F a0=0x6 -k register_injection 2026-06-17 07:29:34.094661 | ubuntu-noble | +-a always,exit -F arch=b64 -S ptrace -k tracing 2026-06-17 07:29:34.094755 | ubuntu-noble | + 2026-06-17 07:29:34.094855 | ubuntu-noble | +## Anonymous File Creation 2026-06-17 07:29:34.094956 | ubuntu-noble | +### These rules watch the use of memfd_create 2026-06-17 07:29:34.095072 | ubuntu-noble | +### "memfd_create" creates anonymous file and returns a file descriptor to access it 2026-06-17 07:29:34.095168 | ubuntu-noble | +### When combined with "fexecve" can be used to stealthily run binaries in memory without touching disk 2026-06-17 07:29:34.095272 | ubuntu-noble | +-a always,exit -F arch=b64 -S memfd_create -F key=anon_file_create 2026-06-17 07:29:34.095368 | ubuntu-noble | + 2026-06-17 07:29:34.095469 | ubuntu-noble | +## Privilege Abuse 2026-06-17 07:29:34.095585 | ubuntu-noble | +### The purpose of this rule is to detect when an admin may be abusing power by looking in user's home dir. 2026-06-17 07:29:34.095689 | ubuntu-noble | +-a always,exit -F dir=/home -F uid=0 -F auid>=1000 -F auid!=-1 -C auid!=obj_uid -k power_abuse 2026-06-17 07:29:34.095809 | ubuntu-noble | + 2026-06-17 07:29:34.095881 | ubuntu-noble | +# Socket Creations 2026-06-17 07:29:34.095990 | ubuntu-noble | +# will catch both IPv4 and IPv6 2026-06-17 07:29:34.096105 | ubuntu-noble | + 2026-06-17 07:29:34.096210 | ubuntu-noble | +-a always,exit -F arch=b32 -S socket -F a0=2 -k network_socket_created 2026-06-17 07:29:34.096315 | ubuntu-noble | +-a always,exit -F arch=b64 -S socket -F a0=2 -k network_socket_created 2026-06-17 07:29:34.096410 | ubuntu-noble | + 2026-06-17 07:29:34.096530 | ubuntu-noble | +-a always,exit -F arch=b32 -S socket -F a0=10 -k network_socket_created 2026-06-17 07:29:34.096626 | ubuntu-noble | +-a always,exit -F arch=b64 -S socket -F a0=10 -k network_socket_created 2026-06-17 07:29:34.096722 | ubuntu-noble | + 2026-06-17 07:29:34.096821 | ubuntu-noble | +# Software Management --------------------------------------------------------- 2026-06-17 07:29:34.096915 | ubuntu-noble | + 2026-06-17 07:29:34.097013 | ubuntu-noble | +# RPM (Redhat/CentOS) 2026-06-17 07:29:34.097125 | ubuntu-noble | +-w /usr/bin/rpm -p x -k software_mgmt 2026-06-17 07:29:34.097224 | ubuntu-noble | +-w /usr/bin/yum -p x -k software_mgmt 2026-06-17 07:29:34.097317 | ubuntu-noble | + 2026-06-17 07:29:34.097422 | ubuntu-noble | +# DNF (Fedora/RedHat 8/CentOS 8) 2026-06-17 07:29:34.097540 | ubuntu-noble | +-w /usr/bin/dnf -p x -k software_mgmt 2026-06-17 07:29:34.097627 | ubuntu-noble | + 2026-06-17 07:29:34.097728 | ubuntu-noble | +# YAST/Zypper/RPM (SuSE) 2026-06-17 07:29:34.097832 | ubuntu-noble | +-w /sbin/yast -p x -k software_mgmt 2026-06-17 07:29:34.097931 | ubuntu-noble | +-w /sbin/yast2 -p x -k software_mgmt 2026-06-17 07:29:34.098030 | ubuntu-noble | +-w /bin/rpm -p x -k software_mgmt 2026-06-17 07:29:34.098144 | ubuntu-noble | +-w /usr/bin/zypper -k software_mgmt 2026-06-17 07:29:34.098238 | ubuntu-noble | + 2026-06-17 07:29:34.098338 | ubuntu-noble | +# DPKG / APT-GET (Debian/Ubuntu) 2026-06-17 07:29:34.098439 | ubuntu-noble | +-w /usr/bin/dpkg -p x -k software_mgmt 2026-06-17 07:29:34.098555 | ubuntu-noble | +-w /usr/bin/apt -p x -k software_mgmt 2026-06-17 07:29:34.098668 | ubuntu-noble | +-w /usr/bin/apt-add-repository -p x -k software_mgmt 2026-06-17 07:29:34.098757 | ubuntu-noble | +-w /usr/bin/apt-get -p x -k software_mgmt 2026-06-17 07:29:34.098858 | ubuntu-noble | +-w /usr/bin/aptitude -p x -k software_mgmt 2026-06-17 07:29:34.098956 | ubuntu-noble | +-w /usr/bin/wajig -p x -k software_mgmt 2026-06-17 07:29:34.099106 | ubuntu-noble | +-w /usr/bin/snap -p x -k software_mgmt 2026-06-17 07:29:34.099169 | ubuntu-noble | + 2026-06-17 07:29:34.099268 | ubuntu-noble | +# PIP(3) (Python installs) 2026-06-17 07:29:34.099370 | ubuntu-noble | +-w /usr/bin/pip -p x -k third_party_software_mgmt 2026-06-17 07:29:34.099472 | ubuntu-noble | +-w /usr/local/bin/pip -p x -k third_party_software_mgmt 2026-06-17 07:29:34.099585 | ubuntu-noble | +-w /usr/bin/pip3 -p x -k third_party_software_mgmt 2026-06-17 07:29:34.099691 | ubuntu-noble | +-w /usr/local/bin/pip3 -p x -k third_party_software_mgmt 2026-06-17 07:29:34.099792 | ubuntu-noble | +-w /usr/bin/pipx -p x -k third_party_software_mgmt 2026-06-17 07:29:34.099894 | ubuntu-noble | +-w /usr/local/bin/pipx -p x -k third_party_software_mgmt 2026-06-17 07:29:34.099989 | ubuntu-noble | + 2026-06-17 07:29:34.100097 | ubuntu-noble | +# npm 2026-06-17 07:29:34.100201 | ubuntu-noble | +## T1072 third party software 2026-06-17 07:29:34.100298 | ubuntu-noble | +## https://www.npmjs.com 2026-06-17 07:29:34.100400 | ubuntu-noble | +## https://docs.npmjs.com/cli/v6/commands/npm-audit 2026-06-17 07:29:34.100505 | ubuntu-noble | +-w /usr/bin/npm -p x -k third_party_software_mgmt 2026-06-17 07:29:34.100612 | ubuntu-noble | + 2026-06-17 07:29:34.100716 | ubuntu-noble | +# Comprehensive Perl Archive Network (CPAN) (CPAN installs) 2026-06-17 07:29:34.100827 | ubuntu-noble | +## T1072 third party software 2026-06-17 07:29:34.100917 | ubuntu-noble | +## https://www.cpan.org 2026-06-17 07:29:34.101018 | ubuntu-noble | +-w /usr/bin/cpan -p x -k third_party_software_mgmt 2026-06-17 07:29:34.101137 | ubuntu-noble | + 2026-06-17 07:29:34.101239 | ubuntu-noble | +# Ruby (RubyGems installs) 2026-06-17 07:29:34.101338 | ubuntu-noble | +## T1072 third party software 2026-06-17 07:29:34.101437 | ubuntu-noble | +## https://rubygems.org 2026-06-17 07:29:34.101566 | ubuntu-noble | +-w /usr/bin/gem -p x -k third_party_software_mgmt 2026-06-17 07:29:34.101662 | ubuntu-noble | + 2026-06-17 07:29:34.101759 | ubuntu-noble | +# LuaRocks (Lua installs) 2026-06-17 07:29:34.101859 | ubuntu-noble | +## T1072 third party software 2026-06-17 07:29:34.101960 | ubuntu-noble | +## https://luarocks.org 2026-06-17 07:29:34.102099 | ubuntu-noble | +-w /usr/bin/luarocks -p x -k third_party_software_mgmt 2026-06-17 07:29:34.102164 | ubuntu-noble | + 2026-06-17 07:29:34.102265 | ubuntu-noble | +# Pacman (Arch Linux) 2026-06-17 07:29:34.102366 | ubuntu-noble | +## https://wiki.archlinux.org/title/Pacman 2026-06-17 07:29:34.102466 | ubuntu-noble | +## T1072 third party software 2026-06-17 07:29:34.102658 | ubuntu-noble | +-w /etc/pacman.conf -p x -k third_party_software_mgmt 2026-06-17 07:29:34.102764 | ubuntu-noble | +-w /etc/pacman.d -p x -k third_party_software_mgmt 2026-06-17 07:29:34.102859 | ubuntu-noble | + 2026-06-17 07:29:34.102990 | ubuntu-noble | +# Special Software ------------------------------------------------------------ 2026-06-17 07:29:34.103069 | ubuntu-noble | + 2026-06-17 07:29:34.103159 | ubuntu-noble | +## GDS specific secrets 2026-06-17 07:29:34.103258 | ubuntu-noble | +-w /etc/puppet/ssl -p wa -k puppet_ssl 2026-06-17 07:29:34.103352 | ubuntu-noble | + 2026-06-17 07:29:34.103450 | ubuntu-noble | +## IBM Bigfix BESClient 2026-06-17 07:29:34.103570 | ubuntu-noble | +-a always,exit -F arch=b64 -S open -F dir=/opt/BESClient -F success=0 -k soft_besclient 2026-06-17 07:29:34.103671 | ubuntu-noble | +-w /var/opt/BESClient/ -p wa -k soft_besclient 2026-06-17 07:29:34.103764 | ubuntu-noble | + 2026-06-17 07:29:34.103864 | ubuntu-noble | +## CHEF https://www.chef.io/chef/ 2026-06-17 07:29:34.103964 | ubuntu-noble | +-w /etc/chef -p wa -k soft_chef 2026-06-17 07:29:34.104088 | ubuntu-noble | + 2026-06-17 07:29:34.104182 | ubuntu-noble | +## Salt 2026-06-17 07:29:34.104280 | ubuntu-noble | +## https://saltproject.io/ 2026-06-17 07:29:34.104380 | ubuntu-noble | +## https://docs.saltproject.io/en/latest/ref/configuration/master.html 2026-06-17 07:29:34.104481 | ubuntu-noble | +-w /etc/salt -p wa -k soft_salt 2026-06-17 07:29:34.104593 | ubuntu-noble | +-w /usr/local/etc/salt -p wa -k soft_salt 2026-06-17 07:29:34.104688 | ubuntu-noble | + 2026-06-17 07:29:34.104784 | ubuntu-noble | +## Otter 2026-06-17 07:29:34.104884 | ubuntu-noble | +## https://inedo.com/otter 2026-06-17 07:29:34.105170 | ubuntu-noble | +-w /etc/otter -p wa -k soft_otter 2026-06-17 07:29:34.105179 | ubuntu-noble | + 2026-06-17 07:29:34.105233 | ubuntu-noble | +## T1081 Credentials In Files 2026-06-17 07:29:34.105384 | ubuntu-noble | +-w /usr/bin/grep -p x -k string_search 2026-06-17 07:29:34.105491 | ubuntu-noble | +-w /usr/bin/egrep -p x -k string_search 2026-06-17 07:29:34.105617 | ubuntu-noble | +-w /usr/bin/ugrep -p x -k string_search 2026-06-17 07:29:34.105716 | ubuntu-noble | +### macOS 2026-06-17 07:29:34.105820 | ubuntu-noble | +-w /usr/local/bin/grep -p x -k string_search 2026-06-17 07:29:34.105921 | ubuntu-noble | +-w /usr/local/bin/egrep -p x -k string_search 2026-06-17 07:29:34.106021 | ubuntu-noble | +-w /usr/local/bin/ugrep -p x -k string_search 2026-06-17 07:29:34.106130 | ubuntu-noble | + 2026-06-17 07:29:34.106251 | ubuntu-noble | +### https://github.com/tmbinc/bgrep 2026-06-17 07:29:34.106331 | ubuntu-noble | +-w /usr/bin/bgrep -p x -k string_search 2026-06-17 07:29:34.106430 | ubuntu-noble | +### macOS 2026-06-17 07:29:34.106548 | ubuntu-noble | +-w /usr/local/bin/bgrep -p x -k string_search 2026-06-17 07:29:34.107318 | ubuntu-noble | + 2026-06-17 07:29:34.107335 | ubuntu-noble | +### https://github.com/BurntSushi/ripgrep 2026-06-17 07:29:34.107339 | ubuntu-noble | +-w /usr/bin/rg -p x -k string_search 2026-06-17 07:29:34.107343 | ubuntu-noble | +### macOS 2026-06-17 07:29:34.107346 | ubuntu-noble | +-w /usr/local/bin/rg -p x -k string_search 2026-06-17 07:29:34.107350 | ubuntu-noble | + 2026-06-17 07:29:34.107353 | ubuntu-noble | +### https://github.com/awgn/cgrep 2026-06-17 07:29:34.107357 | ubuntu-noble | + 2026-06-17 07:29:34.107412 | ubuntu-noble | +-w /usr/bin/cgrep -p x -k string_search 2026-06-17 07:29:34.107506 | ubuntu-noble | +### macOS 2026-06-17 07:29:34.107622 | ubuntu-noble | +-w /usr/local/bin/cgrep -p x -k string_search 2026-06-17 07:29:34.107716 | ubuntu-noble | + 2026-06-17 07:29:34.107815 | ubuntu-noble | +### https://github.com/jpr5/ngrep 2026-06-17 07:29:34.107913 | ubuntu-noble | +-w /usr/bin/ngrep -p x -k string_search 2026-06-17 07:29:34.108009 | ubuntu-noble | +### macOS 2026-06-17 07:29:34.108123 | ubuntu-noble | +-w /usr/local/bin/ngrep -p x -k string_search 2026-06-17 07:29:34.108216 | ubuntu-noble | + 2026-06-17 07:29:34.108318 | ubuntu-noble | +### https://github.com/vrothberg/vgrep 2026-06-17 07:29:34.108420 | ubuntu-noble | +-w /usr/bin/vgrep -p x -k string_search 2026-06-17 07:29:34.108535 | ubuntu-noble | +### macOS 2026-06-17 07:29:34.108635 | ubuntu-noble | +-w /usr/local/bin/vgrep -p x -k string_search 2026-06-17 07:29:34.108730 | ubuntu-noble | + 2026-06-17 07:29:34.108837 | ubuntu-noble | +### https://github.com/monochromegane/the_platinum_searcher 2026-06-17 07:29:34.108936 | ubuntu-noble | +-w /usr/bin/pt -p x -k string_search 2026-06-17 07:29:34.109029 | ubuntu-noble | +### macOS 2026-06-17 07:29:34.109192 | ubuntu-noble | +-w /usr/local/bin/pt -p x -k string_search 2026-06-17 07:29:34.109297 | ubuntu-noble | + 2026-06-17 07:29:34.109400 | ubuntu-noble | +### https://github.com/gvansickle/ucg 2026-06-17 07:29:34.109501 | ubuntu-noble | +-w /usr/bin/ucg -p x -k string_search 2026-06-17 07:29:34.109633 | ubuntu-noble | +### macOS 2026-06-17 07:29:34.109734 | ubuntu-noble | +-w /usr/local/bin/ucg -p x -k string_search 2026-06-17 07:29:34.109829 | ubuntu-noble | + 2026-06-17 07:29:34.109932 | ubuntu-noble | +### https://github.com/ggreer/the_silver_searcher 2026-06-17 07:29:34.110035 | ubuntu-noble | +-w /usr/bin/ag -p x -k string_search 2026-06-17 07:29:34.110160 | ubuntu-noble | +### macOS 2026-06-17 07:29:34.110262 | ubuntu-noble | +-w /usr/local/bin/ag -p x -k string_search 2026-06-17 07:29:34.110355 | ubuntu-noble | + 2026-06-17 07:29:34.110457 | ubuntu-noble | +### https://github.com/beyondgrep/ack3 2026-06-17 07:29:34.110576 | ubuntu-noble | +### https://beyondgrep.com 2026-06-17 07:29:34.110677 | ubuntu-noble | +-w /usr/bin/ack -p x -k string_search 2026-06-17 07:29:34.110780 | ubuntu-noble | +-w /usr/local/bin/ack -p x -k string_search 2026-06-17 07:29:34.110880 | ubuntu-noble | +-w /usr/bin/semgrep -p x -k string_search 2026-06-17 07:29:34.110975 | ubuntu-noble | +### macOS 2026-06-17 07:29:34.112556 | ubuntu-noble | +-w /usr/local/bin/semgrep -p x -k string_search 2026-06-17 07:29:34.112580 | ubuntu-noble | + 2026-06-17 07:29:34.112584 | ubuntu-noble | +## Docker 2026-06-17 07:29:34.112588 | ubuntu-noble | +-w /usr/bin/dockerd -k docker 2026-06-17 07:29:34.112592 | ubuntu-noble | +-w /usr/bin/docker -k docker 2026-06-17 07:29:34.112595 | ubuntu-noble | +-w /usr/bin/docker-containerd -k docker 2026-06-17 07:29:34.112599 | ubuntu-noble | +-w /usr/bin/docker-runc -k docker 2026-06-17 07:29:34.112602 | ubuntu-noble | +-w /var/lib/docker -p wa -k docker 2026-06-17 07:29:34.112606 | ubuntu-noble | +-w /etc/docker -k docker 2026-06-17 07:29:34.112610 | ubuntu-noble | +-w /etc/sysconfig/docker -k docker 2026-06-17 07:29:34.112613 | ubuntu-noble | +-w /etc/sysconfig/docker-storage -k docker 2026-06-17 07:29:34.112617 | ubuntu-noble | +-w /usr/lib/systemd/system/docker.service -k docker 2026-06-17 07:29:34.112631 | ubuntu-noble | +-w /usr/lib/systemd/system/docker.socket -k docker 2026-06-17 07:29:34.112635 | ubuntu-noble | + 2026-06-17 07:29:34.112642 | ubuntu-noble | +## Virtualization stuff 2026-06-17 07:29:34.112646 | ubuntu-noble | +-w /usr/bin/qemu-system-x86_64 -p x -k qemu-system-x86_64 2026-06-17 07:29:34.112749 | ubuntu-noble | +-w /usr/bin/qemu-img -p x -k qemu-img 2026-06-17 07:29:34.112848 | ubuntu-noble | +-w /usr/bin/qemu-kvm -p x -k qemu-kvm 2026-06-17 07:29:34.112947 | ubuntu-noble | +-w /usr/bin/qemu -p x -k qemu 2026-06-17 07:29:34.113117 | ubuntu-noble | +-w /usr/bin/virtualbox -p x -k virtualbox 2026-06-17 07:29:34.113158 | ubuntu-noble | +-w /usr/bin/virt-manager -p x -k virt-manager 2026-06-17 07:29:34.113255 | ubuntu-noble | +-w /usr/bin/VBoxManage -p x -k VBoxManage 2026-06-17 07:29:34.113347 | ubuntu-noble | + 2026-06-17 07:29:34.113448 | ubuntu-noble | +#### VirtualBox on macOS 2026-06-17 07:29:34.113554 | ubuntu-noble | + 2026-06-17 07:29:34.113654 | ubuntu-noble | +-w /usr/local/bin/VirtualBox -p x -k virt_tool 2026-06-17 07:29:34.113767 | ubuntu-noble | +-w /usr/local/bin/VirtualBoxVM -p x -k virt_tool 2026-06-17 07:29:34.113856 | ubuntu-noble | +-w /usr/local/bin/VBoxManage -p x -k virt_tool 2026-06-17 07:29:34.113956 | ubuntu-noble | +-w /usr/local/bin/VBoxVRDP -p x -k virt_tool 2026-06-17 07:29:34.114087 | ubuntu-noble | +-w /usr/local/bin/VBoxHeadless -p x -k virt_tool 2026-06-17 07:29:34.114169 | ubuntu-noble | +-w /usr/local/bin/vboxwebsrv -p x -k virt_tool 2026-06-17 07:29:34.114269 | ubuntu-noble | +-w /usr/local/bin/VBoxBugReport -p x -k virt_tool 2026-06-17 07:29:34.114400 | ubuntu-noble | +-w /usr/local/bin/VBoxBalloonCtrl -p x -k virt_tool 2026-06-17 07:29:34.114546 | ubuntu-noble | +-w /usr/local/bin/VBoxAutostart -p x -k virt_tool 2026-06-17 07:29:34.114651 | ubuntu-noble | +-w /usr/local/bin/VBoxDTrace -p x -k virt_tool 2026-06-17 07:29:34.114754 | ubuntu-noble | +-w /usr/local/bin/vbox-img -p x -k virt_tool 2026-06-17 07:29:34.114860 | ubuntu-noble | +-w /Library/LaunchDaemons/org.virtualbox.startup.plist -p x -k virt_tool 2026-06-17 07:29:34.114963 | ubuntu-noble | +-w /Library/Application Support/VirtualBox/LaunchDaemons/ -p x -k virt_tool 2026-06-17 07:29:34.115097 | ubuntu-noble | +-w /Library/Application Support/VirtualBox/VBoxDrv.kext/ -p x -k virt_tool 2026-06-17 07:29:34.115201 | ubuntu-noble | +-w /Library/Application Support/VirtualBox/VBoxUSB.kext/ -p x -k virt_tool 2026-06-17 07:29:34.115303 | ubuntu-noble | +-w /Library/Application Support/VirtualBox/VBoxNetFlt.kext/ -p x -k virt_tool 2026-06-17 07:29:34.115406 | ubuntu-noble | +-w /Library/Application Support/VirtualBox/VBoxNetAdp.kext/ -p x -k virt_tool 2026-06-17 07:29:34.115534 | ubuntu-noble | + 2026-06-17 07:29:34.115678 | ubuntu-noble | +### Parallels Desktop on macOS 2026-06-17 07:29:34.115773 | ubuntu-noble | + 2026-06-17 07:29:34.115875 | ubuntu-noble | +-w /usr/local/bin/prl_convert -p x -k virt_tool 2026-06-17 07:29:34.115977 | ubuntu-noble | +-w /usr/local/bin/prl_disk_tool -p x -k virt_tool 2026-06-17 07:29:34.116096 | ubuntu-noble | +-w /usr/local/bin/prl_perf_ctl -p x -k virt_tool 2026-06-17 07:29:34.116267 | ubuntu-noble | +-w /usr/local/bin/prlcore2dmp -p x -k virt_tool 2026-06-17 07:29:34.116370 | ubuntu-noble | +-w /usr/local/bin/prlctl -p x -k virt_tool 2026-06-17 07:29:34.116469 | ubuntu-noble | +-w /usr/local/bin/prlexec -p x -k virt_tool 2026-06-17 07:29:34.116585 | ubuntu-noble | +-w /usr/local/bin/prlsrvctl -p x -k virt_tool 2026-06-17 07:29:34.116685 | ubuntu-noble | +-w /Library/Preferences/Parallels -p x -k virt_tool 2026-06-17 07:29:34.116779 | ubuntu-noble | + 2026-06-17 07:29:34.116874 | ubuntu-noble | +### qemu on macOS 2026-06-17 07:29:34.116965 | ubuntu-noble | + 2026-06-17 07:29:34.117082 | ubuntu-noble | +-w /usr/local/bin/qemu-edid -p x -k virt_tool 2026-06-17 07:29:34.117208 | ubuntu-noble | +-w /usr/local/bin/qemu-img -p x -k virt_tool 2026-06-17 07:29:34.117312 | ubuntu-noble | +-w /usr/local/bin/qemu-io -p x -k virt_tool 2026-06-17 07:29:34.117414 | ubuntu-noble | +-w /usr/local/bin/qemu-nbd -p x -k virt_tool 2026-06-17 07:29:34.117530 | ubuntu-noble | +-w /usr/local/bin/qemu-system-x86_64 -p x -k virt_tool 2026-06-17 07:29:34.117625 | ubuntu-noble | + 2026-06-17 07:29:34.117724 | ubuntu-noble | +## Kubelet 2026-06-17 07:29:34.117821 | ubuntu-noble | +-w /usr/bin/kubelet -k kubelet 2026-06-17 07:29:34.117914 | ubuntu-noble | + 2026-06-17 07:29:34.118011 | ubuntu-noble | +# ipc system call 2026-06-17 07:29:34.118141 | ubuntu-noble | +# /usr/include/linux/ipc.h 2026-06-17 07:29:34.118236 | ubuntu-noble | + 2026-06-17 07:29:34.118333 | ubuntu-noble | +## msgctl 2026-06-17 07:29:34.118438 | ubuntu-noble | +#-a always,exit -S ipc -F a0=14 -k Inter-Process_Communication 2026-06-17 07:29:34.119174 | ubuntu-noble | +## msgget 2026-06-17 07:29:34.119188 | ubuntu-noble | +#-a always,exit -S ipc -F a0=13 -k Inter-Process_Communication 2026-06-17 07:29:34.119202 | ubuntu-noble | +## Use these lines on x86_64, ia64 instead 2026-06-17 07:29:34.119206 | ubuntu-noble | +-a always,exit -F arch=b64 -S msgctl -k Inter-Process_Communication 2026-06-17 07:29:34.119210 | ubuntu-noble | +-a always,exit -F arch=b64 -S msgget -k Inter-Process_Communication 2026-06-17 07:29:34.119213 | ubuntu-noble | + 2026-06-17 07:29:34.119217 | ubuntu-noble | +## semctl 2026-06-17 07:29:34.119223 | ubuntu-noble | +#-a always,exit -S ipc -F a0=3 -k Inter-Process_Communication 2026-06-17 07:29:34.119321 | ubuntu-noble | +## semget 2026-06-17 07:29:34.119426 | ubuntu-noble | +#-a always,exit -S ipc -F a0=2 -k Inter-Process_Communication 2026-06-17 07:29:34.119536 | ubuntu-noble | +## semop 2026-06-17 07:29:34.119645 | ubuntu-noble | +#-a always,exit -S ipc -F a0=1 -k Inter-Process_Communication 2026-06-17 07:29:34.119736 | ubuntu-noble | +## semtimedop 2026-06-17 07:29:34.119840 | ubuntu-noble | +#-a always,exit -S ipc -F a0=4 -k Inter-Process_Communication 2026-06-17 07:29:34.119940 | ubuntu-noble | +## Use these lines on x86_64, ia64 instead 2026-06-17 07:29:34.120086 | ubuntu-noble | +-a always,exit -F arch=b64 -S semctl -k Inter-Process_Communication 2026-06-17 07:29:34.120158 | ubuntu-noble | +-a always,exit -F arch=b64 -S semget -k Inter-Process_Communication 2026-06-17 07:29:34.120263 | ubuntu-noble | +-a always,exit -F arch=b64 -S semop -k Inter-Process_Communication 2026-06-17 07:29:34.120366 | ubuntu-noble | +-a always,exit -F arch=b64 -S semtimedop -k Inter-Process_Communication 2026-06-17 07:29:34.120459 | ubuntu-noble | + 2026-06-17 07:29:34.120568 | ubuntu-noble | +## shmctl 2026-06-17 07:29:34.120672 | ubuntu-noble | +#-a always,exit -S ipc -F a0=24 -k Inter-Process_Communication 2026-06-17 07:29:34.120767 | ubuntu-noble | +## shmget 2026-06-17 07:29:34.120871 | ubuntu-noble | +#-a always,exit -S ipc -F a0=23 -k Inter-Process_Communication 2026-06-17 07:29:34.120970 | ubuntu-noble | +## Use these lines on x86_64, ia64 instead 2026-06-17 07:29:34.121082 | ubuntu-noble | +-a always,exit -F arch=b64 -S shmctl -k Inter-Process_Communication 2026-06-17 07:29:34.121181 | ubuntu-noble | +-a always,exit -F arch=b64 -S shmget -k Inter-Process_Communication 2026-06-17 07:29:34.121274 | ubuntu-noble | + 2026-06-17 07:29:34.121376 | ubuntu-noble | +# High Volume Events ---------------------------------------------------------- 2026-06-17 07:29:34.121468 | ubuntu-noble | + 2026-06-17 07:29:34.121582 | ubuntu-noble | +## Disable these rules if they create too many events in your environment 2026-06-17 07:29:34.121674 | ubuntu-noble | + 2026-06-17 07:29:34.121769 | ubuntu-noble | +## Common Shells 2026-06-17 07:29:34.121867 | ubuntu-noble | +-w /bin/bash -p x -k susp_shell 2026-06-17 07:29:34.121967 | ubuntu-noble | +-w /bin/dash -p x -k susp_shell 2026-06-17 07:29:34.122096 | ubuntu-noble | +-w /bin/busybox -p x -k susp_shell 2026-06-17 07:29:34.122203 | ubuntu-noble | +-w /bin/zsh -p x -k susp_shell 2026-06-17 07:29:34.122301 | ubuntu-noble | +-w /bin/sh -p x -k susp_shell 2026-06-17 07:29:34.122403 | ubuntu-noble | +-w /bin/ksh -p x -k susp_shell 2026-06-17 07:29:34.122493 | ubuntu-noble | + 2026-06-17 07:29:34.122606 | ubuntu-noble | +## Root command executions 2026-06-17 07:29:34.122727 | ubuntu-noble | +-a always,exit -F arch=b64 -F euid=0 -F auid>=1000 -F auid!=-1 -S execve -k rootcmd 2026-06-17 07:29:34.122803 | ubuntu-noble | + 2026-06-17 07:29:34.123499 | ubuntu-noble | +## File Deletion Events by User 2026-06-17 07:29:34.123544 | ubuntu-noble | +-a always,exit -F arch=b64 -S rmdir -S unlink -S unlinkat -S rename -S renameat -F auid>=1000 -F auid!=-1 -k delete 2026-06-17 07:29:34.123554 | ubuntu-noble | + 2026-06-17 07:29:34.123558 | ubuntu-noble | +## File Access 2026-06-17 07:29:34.123562 | ubuntu-noble | +### Unauthorized Access (unsuccessful) 2026-06-17 07:29:34.123566 | ubuntu-noble | +-a always,exit -F arch=b64 -S creat -S open -S openat -S open_by_handle_at -S truncate -S ftruncate -F exit=-EACCES -F auid>=1000 -F auid!=-1 -k file_access 2026-06-17 07:29:34.123572 | ubuntu-noble | +-a always,exit -F arch=b64 -S creat -S open -S openat -S open_by_handle_at -S truncate -S ftruncate -F exit=-EPERM -F auid>=1000 -F auid!=-1 -k file_access 2026-06-17 07:29:34.123608 | ubuntu-noble | + 2026-06-17 07:29:34.123710 | ubuntu-noble | +### Unsuccessful Creation 2026-06-17 07:29:34.123814 | ubuntu-noble | +-a always,exit -F arch=b64 -S mkdir,creat,link,symlink,mknod,mknodat,linkat,symlinkat -F exit=-EACCES -k file_creation 2026-06-17 07:29:34.123919 | ubuntu-noble | +-a always,exit -F arch=b64 -S mkdir,link,symlink,mkdirat -F exit=-EPERM -k file_creation 2026-06-17 07:29:34.124014 | ubuntu-noble | + 2026-06-17 07:29:34.124125 | ubuntu-noble | +### Unsuccessful Modification 2026-06-17 07:29:34.124230 | ubuntu-noble | +-a always,exit -F arch=b64 -S rename -S renameat -S truncate -S chmod -S setxattr -S lsetxattr -S removexattr -S lremovexattr -F exit=-EACCES -k file_modification 2026-06-17 07:29:34.124335 | ubuntu-noble | +-a always,exit -F arch=b64 -S rename -S renameat -S truncate -S chmod -S setxattr -S lsetxattr -S removexattr -S lremovexattr -F exit=-EPERM -k file_modification 2026-06-17 07:29:34.124427 | ubuntu-noble | + 2026-06-17 07:29:34.124570 | ubuntu-noble | +## 32bit API Exploitation 2026-06-17 07:29:34.124650 | ubuntu-noble | +### If you are on a 64 bit platform, everything _should_ be running 2026-06-17 07:29:34.124802 | ubuntu-noble | +### in 64 bit mode. This rule will detect any use of the 32 bit syscalls 2026-06-17 07:29:34.124913 | ubuntu-noble | +### because this might be a sign of someone exploiting a hole in the 32 2026-06-17 07:29:34.125012 | ubuntu-noble | +### bit API. 2026-06-17 07:29:34.125168 | ubuntu-noble | +-a always,exit -F arch=b32 -S all -k 32bit_api 2026-06-17 07:29:34.125268 | ubuntu-noble | + 2026-06-17 07:29:34.125371 | ubuntu-noble | +# Make The Configuration Immutable -------------------------------------------- 2026-06-17 07:29:34.125465 | ubuntu-noble | + 2026-06-17 07:29:34.125599 | ubuntu-noble | +##-e 2 2026-06-17 07:29:34.125694 | ubuntu-noble | 2026-06-17 07:29:34.125945 | ubuntu-noble | changed: [molecule-auditd] => (item=20-neo23x0.rules) => {"ansible_loop_var": "item", "changed": true, "checksum": "9f99ce5c4f891fbf3e2bce06ed4cb97fb9e01f41", "dest": "/etc/audit/rules.d/20-neo23x0.rules", "gid": 0, "group": "root", "item": "20-neo23x0.rules", "md5sum": "6ac57206fd77de34805c3f4d50ef8b1d", "mode": "0644", "owner": "root", "size": 27367, "src": "/home/zuul/.ansible/tmp/ansible-tmp-1781681373.0617328-2510-104850357654616/.source.rules", "state": "file", "uid": 0} 2026-06-17 07:29:34.126035 | ubuntu-noble | 2026-06-17 07:29:34.126151 | ubuntu-noble | TASK [auditd : Manage auditd service] ****************************************** 2026-06-17 07:29:34.942224 | ubuntu-noble | ok: [molecule-auditd] => {"changed": false, "enabled": true, "name": "auditd", "state": "started", "status": {"ActiveEnterTimestamp": "Wed 2026-06-17 07:29:26 UTC", "ActiveEnterTimestampMonotonic": "180004167", "ActiveExitTimestampMonotonic": "0", "ActiveState": "active", "After": "local-fs.target system.slice systemd-journald.socket systemd-tmpfiles-setup.service", "AllowIsolate": "no", "AssertResult": "yes", "AssertTimestamp": "Wed 2026-06-17 07:29:26 UTC", "AssertTimestampMonotonic": "179939283", "Before": "shutdown.target sysinit.target systemd-update-utmp.service ssh.service", "BlockIOAccounting": "no", "BlockIOWeight": "[not set]", "CPUAccounting": "yes", "CPUAffinityFromNUMA": "no", "CPUQuotaPerSecUSec": "infinity", "CPUQuotaPeriodUSec": "infinity", "CPUSchedulingPolicy": "0", "CPUSchedulingPriority": "0", "CPUSchedulingResetOnFork": "no", "CPUShares": "[not set]", "CPUUsageNSec": "49649000", "CPUWeight": "[not set]", "CacheDirectoryMode": "0755", "CanFreeze": "yes", "CanIsolate": "no", "CanReload": "no", "CanStart": "yes", "CanStop": "yes", "CapabilityBoundingSet": "cap_chown cap_dac_override cap_dac_read_search cap_fowner cap_fsetid cap_kill cap_setgid cap_setuid cap_setpcap cap_linux_immutable cap_net_bind_service cap_net_broadcast cap_net_admin cap_net_raw cap_ipc_lock cap_ipc_owner cap_sys_rawio cap_sys_chroot cap_sys_ptrace cap_sys_pacct cap_sys_admin cap_sys_boot cap_sys_nice cap_sys_resource cap_sys_time cap_sys_tty_config cap_mknod cap_lease cap_audit_write cap_audit_control cap_setfcap cap_mac_override cap_mac_admin cap_syslog cap_wake_alarm cap_block_suspend cap_audit_read cap_perfmon cap_bpf cap_checkpoint_restore", "CleanResult": "success", "CollectMode": "inactive", "ConditionResult": "yes", "ConditionTimestamp": "Wed 2026-06-17 07:29:26 UTC", "ConditionTimestampMonotonic": "179939219", "ConfigurationDirectoryMode": "0755", "Conflicts": "shutdown.target", "ControlGroup": "/system.slice/auditd.service", "ControlGroupId": "3826", "ControlPID": "0", "CoredumpFilter": "0x33", "CoredumpReceive": "no", "DefaultDependencies": "no", "DefaultMemoryLow": "0", "DefaultMemoryMin": "0", "DefaultStartupMemoryLow": "0", "Delegate": "no", "Description": "Security Auditing Service", "DevicePolicy": "auto", "Documentation": "\"man:auditd(8)\" https://github.com/linux-audit/audit-documentation", "DynamicUser": "no", "ExecMainCode": "0", "ExecMainExitTimestampMonotonic": "0", "ExecMainPID": "2279", "ExecMainStartTimestamp": "Wed 2026-06-17 07:29:26 UTC", "ExecMainStartTimestampMonotonic": "179962527", "ExecMainStatus": "0", "ExecStart": "{ path=/sbin/auditd ; argv[]=/sbin/auditd ; ignore_errors=no ; start_time=[Wed 2026-06-17 07:29:26 UTC] ; stop_time=[Wed 2026-06-17 07:29:26 UTC] ; pid=2278 ; code=exited ; status=0 }", "ExecStartEx": "{ path=/sbin/auditd ; argv[]=/sbin/auditd ; flags= ; start_time=[Wed 2026-06-17 07:29:26 UTC] ; stop_time=[Wed 2026-06-17 07:29:26 UTC] ; pid=2278 ; code=exited ; status=0 }", "ExecStartPost": "{ path=/sbin/augenrules ; argv[]=/sbin/augenrules --load ; ignore_errors=yes ; start_time=[Wed 2026-06-17 07:29:26 UTC] ; stop_time=[Wed 2026-06-17 07:29:26 UTC] ; pid=2282 ; code=exited ; status=0 }", "ExecStartPostEx": "{ path=/sbin/augenrules ; argv[]=/sbin/augenrules --load ; flags=ignore-failure ; start_time=[Wed 2026-06-17 07:29:26 UTC] ; stop_time=[Wed 2026-06-17 07:29:26 UTC] ; pid=2282 ; code=exited ; status=0 }", "ExitType": "main", "ExtensionImagePolicy": "root=verity+signed+encrypted+unprotected+absent:usr=verity+signed+encrypted+unprotected+absent:home=encrypted+unprotected+absent:srv=encrypted+unprotected+absent:tmp=encrypted+unprotected+absent:var=encrypted+unprotected+absent", "FailureAction": "none", "FileDescriptorStoreMax": "0", "FileDescriptorStorePreserve": "restart", "FinalKillSignal": "9", "FragmentPath": "/usr/lib/systemd/system/auditd.service", "FreezerState": "running", "GID": "[not set]", "GuessMainPID": "yes", "IOAccounting": "no", "IOReadBytes": "[not set]", "IOReadOperations": "[not set]", "IOSchedulingClass": "2", "IOSchedulingPriority": "4", "IOWeight": "[not set]", "IOWriteBytes": "[not set]", "IOWriteOperations": "[not set]", "IPAccounting": "no", "IPEgressBytes": "[no data]", "IPEgressPackets": "[no data]", "IPIngressBytes": "[no data]", "IPIngressPackets": "[no data]", "Id": "auditd.service", "IgnoreOnIsolate": "no", "IgnoreSIGPIPE": "yes", "InactiveEnterTimestampMonotonic": "0", "InactiveExitTimestamp": "Wed 2026-06-17 07:29:26 UTC", "InactiveExitTimestampMonotonic": "179950404", "InvocationID": "b81338e136c9477a8384a60fc3822745", "JobRunningTimeoutUSec": "infinity", "JobTimeoutAction": "none", "JobTimeoutUSec": "infinity", "KeyringMode": "private", "KillMode": "control-group", "KillSignal": "15", "LimitAS": "infinity", "LimitASSoft": "infinity", "LimitCORE": "infinity", "LimitCORESoft": "0", "LimitCPU": "infinity", "LimitCPUSoft": "infinity", "LimitDATA": "infinity", "LimitDATASoft": "infinity", "LimitFSIZE": "infinity", "LimitFSIZESoft": "infinity", "LimitLOCKS": "infinity", "LimitLOCKSSoft": "infinity", "LimitMEMLOCK": "8388608", "LimitMEMLOCKSoft": "8388608", "LimitMSGQUEUE": "819200", "LimitMSGQUEUESoft": "819200", "LimitNICE": "0", "LimitNICESoft": "0", "LimitNOFILE": "524288", "LimitNOFILESoft": "1024", "LimitNPROC": "15372", "LimitNPROCSoft": "15372", "LimitRSS": "infinity", "LimitRSSSoft": "infinity", "LimitRTPRIO": "0", "LimitRTPRIOSoft": "0", "LimitRTTIME": "infinity", "LimitRTTIMESoft": "infinity", "LimitSIGPENDING": "15372", "LimitSIGPENDINGSoft": "15372", "LimitSTACK": "infinity", "LimitSTACKSoft": "8388608", "LoadState": "loaded", "LockPersonality": "yes", "LogLevelMax": "-1", "LogRateLimitBurst": "0", "LogRateLimitIntervalUSec": "0", "LogsDirectoryMode": "0755", "MainPID": "2279", "ManagedOOMMemoryPressure": "auto", "ManagedOOMMemoryPressureLimit": "0", "ManagedOOMPreference": "none", "ManagedOOMSwap": "auto", "MemoryAccounting": "yes", "MemoryAvailable": "3526189056", "MemoryCurrent": "503808", "MemoryDenyWriteExecute": "yes", "MemoryHigh": "infinity", "MemoryKSM": "no", "MemoryLimit": "infinity", "MemoryLow": "0", "MemoryMax": "infinity", "MemoryMin": "0", "MemoryPeak": "2211840", "MemoryPressureThresholdUSec": "200ms", "MemoryPressureWatch": "auto", "MemorySwapCurrent": "0", "MemorySwapMax": "infinity", "MemorySwapPeak": "0", "MemoryZSwapCurrent": "0", "MemoryZSwapMax": "infinity", "MountAPIVFS": "no", "MountImagePolicy": "root=verity+signed+encrypted+unprotected+absent:usr=verity+signed+encrypted+unprotected+absent:home=encrypted+unprotected+absent:srv=encrypted+unprotected+absent:tmp=encrypted+unprotected+absent:var=encrypted+unprotected+absent", "NFileDescriptorStore": "0", "NRestarts": "0", "NUMAPolicy": "n/a", "Names": "auditd.service", "NeedDaemonReload": "no", "Nice": "0", "NoNewPrivileges": "no", "NonBlocking": "no", "NotifyAccess": "none", "OOMPolicy": "stop", "OOMScoreAdjust": "0", "OnFailureJobMode": "replace", "OnSuccessJobMode": "fail", "PIDFile": "/run/auditd.pid", "Perpetual": "no", "PrivateDevices": "no", "PrivateIPC": "no", "PrivateMounts": "no", "PrivateNetwork": "no", "PrivateTmp": "no", "PrivateUsers": "no", "ProcSubset": "all", "ProtectClock": "no", "ProtectControlGroups": "no", "ProtectHome": "no", "ProtectHostname": "no", "ProtectKernelLogs": "no", "ProtectKernelModules": "yes", "ProtectKernelTunables": "no", "ProtectProc": "default", "ProtectSystem": "no", "RefuseManualStart": "no", "RefuseManualStop": "no", "ReloadResult": "success", "ReloadSignal": "1", "RemainAfterExit": "no", "RemoveIPC": "no", "Requires": "system.slice", "Restart": "on-failure", "RestartKillSignal": "15", "RestartMaxDelayUSec": "infinity", "RestartMode": "normal", "RestartPreventExitStatus": "2 4 6", "RestartSteps": "0", "RestartUSec": "100ms", "RestartUSecNext": "100ms", "RestrictNamespaces": "no", "RestrictRealtime": "yes", "RestrictSUIDSGID": "no", "Result": "success", "RootDirectoryStartOnly": "no", "RootEphemeral": "no", "RootImagePolicy": "root=verity+signed+encrypted+unprotected+absent:usr=verity+signed+encrypted+unprotected+absent:home=encrypted+unprotected+absent:srv=encrypted+unprotected+absent:tmp=encrypted+unprotected+absent:var=encrypted+unprotected+absent", "RuntimeDirectoryMode": "0755", "RuntimeDirectoryPreserve": "no", "RuntimeMaxUSec": "infinity", "RuntimeRandomizedExtraUSec": "0", "SameProcessGroup": "no", "SecureBits": "0", "SendSIGHUP": "no", "SendSIGKILL": "yes", "SetLoginEnvironment": "no", "Slice": "system.slice", "StandardError": "inherit", "StandardInput": "null", "StandardOutput": "journal", "StartLimitAction": "none", "StartLimitBurst": "5", "StartLimitIntervalUSec": "10s", "StartupBlockIOWeight": "[not set]", "StartupCPUShares": "[not set]", "StartupCPUWeight": "[not set]", "StartupIOWeight": "[not set]", "StartupMemoryHigh": "infinity", "StartupMemoryLow": "0", "StartupMemoryMax": "infinity", "StartupMemorySwapMax": "infinity", "StartupMemoryZSwapMax": "infinity", "StateChangeTimestamp": "Wed 2026-06-17 07:29:26 UTC", "StateChangeTimestampMonotonic": "180004167", "StateDirectoryMode": "0755", "StatusErrno": "0", "StopWhenUnneeded": "no", "SubState": "running", "SuccessAction": "none", "SurviveFinalKillSignal": "no", "SyslogFacility": "3", "SyslogLevel": "6", "SyslogLevelPrefix": "yes", "SyslogPriority": "30", "SystemCallErrorNumber": "2147483646", "TTYReset": "no", "TTYVHangup": "no", "TTYVTDisallocate": "no", "TasksAccounting": "yes", "TasksCurrent": "2", "TasksMax": "4611", "TimeoutAbortUSec": "1min 30s", "TimeoutCleanUSec": "infinity", "TimeoutStartFailureMode": "terminate", "TimeoutStartUSec": "1min 30s", "TimeoutStopFailureMode": "terminate", "TimeoutStopUSec": "1min 30s", "TimerSlackNSec": "50000", "Transient": "no", "Type": "forking", "UID": "[not set]", "UMask": "0022", "UnitFilePreset": "enabled", "UnitFileState": "enabled", "UtmpMode": "init", "WantedBy": "multi-user.target", "WatchdogSignal": "6", "WatchdogTimestampMonotonic": "0", "WatchdogUSec": "0"}} 2026-06-17 07:29:34.948873 | ubuntu-noble | 2026-06-17 07:29:34.948950 | ubuntu-noble | TASK [auditd : List existing rules files] ************************************** 2026-06-17 07:29:35.491066 | ubuntu-noble | ok: [molecule-auditd] => {"changed": false, "cmd": ["find", "/etc/audit/rules.d", "-type", "f", "-printf", "%f\n"], "delta": "0:00:00.006618", "end": "2026-06-17 07:29:35.428480", "msg": "", "rc": 0, "start": "2026-06-17 07:29:35.421862", "stderr": "", "stderr_lines": [], "stdout": "audit.rules\n20-neo23x0.rules", "stdout_lines": ["audit.rules", "20-neo23x0.rules"]} 2026-06-17 07:29:35.491171 | ubuntu-noble | 2026-06-17 07:29:35.491328 | ubuntu-noble | TASK [auditd : Remove unmanaged rules files] *********************************** 2026-06-17 07:29:35.873630 | ubuntu-noble | --- before 2026-06-17 07:29:35.873721 | ubuntu-noble | +++ after 2026-06-17 07:29:35.873732 | ubuntu-noble | @@ -1,4 +1,4 @@ 2026-06-17 07:29:35.873742 | ubuntu-noble | { 2026-06-17 07:29:35.873884 | ubuntu-noble | "path": "/etc/audit/rules.d/audit.rules", 2026-06-17 07:29:35.874185 | ubuntu-noble | - "state": "file" 2026-06-17 07:29:35.874446 | ubuntu-noble | + "state": "absent" 2026-06-17 07:29:35.874733 | ubuntu-noble | } 2026-06-17 07:29:35.875109 | ubuntu-noble | 2026-06-17 07:29:35.875577 | ubuntu-noble | changed: [molecule-auditd] => (item=audit.rules) => {"ansible_loop_var": "item", "changed": true, "item": "audit.rules", "path": "/etc/audit/rules.d/audit.rules", "state": "absent"} 2026-06-17 07:29:35.875880 | ubuntu-noble | skipping: [molecule-auditd] => (item=20-neo23x0.rules) => {"ansible_loop_var": "item", "changed": false, "false_condition": "item not in auditd_rules_files", "item": "20-neo23x0.rules", "skip_reason": "Conditional result was False"} 2026-06-17 07:29:35.876180 | ubuntu-noble | 2026-06-17 07:29:35.876449 | ubuntu-noble | RUNNING HANDLER [auditd : Restart auditd service] ****************************** 2026-06-17 07:29:36.628782 | ubuntu-noble | changed: [molecule-auditd] => {"changed": true, "name": "auditd", "state": "started", "status": {"ActiveEnterTimestamp": "Wed 2026-06-17 07:29:26 UTC", "ActiveEnterTimestampMonotonic": "180004167", "ActiveExitTimestampMonotonic": "0", "ActiveState": "active", "After": "local-fs.target system.slice systemd-journald.socket systemd-tmpfiles-setup.service", "AllowIsolate": "no", "AssertResult": "yes", "AssertTimestamp": "Wed 2026-06-17 07:29:26 UTC", "AssertTimestampMonotonic": "179939283", "Before": "shutdown.target sysinit.target systemd-update-utmp.service ssh.service", "BlockIOAccounting": "no", "BlockIOWeight": "[not set]", "CPUAccounting": "yes", "CPUAffinityFromNUMA": "no", "CPUQuotaPerSecUSec": "infinity", "CPUQuotaPeriodUSec": "infinity", "CPUSchedulingPolicy": "0", "CPUSchedulingPriority": "0", "CPUSchedulingResetOnFork": "no", "CPUShares": "[not set]", "CPUUsageNSec": "51248000", "CPUWeight": "[not set]", "CacheDirectoryMode": "0755", "CanFreeze": "yes", "CanIsolate": "no", "CanReload": "no", "CanStart": "yes", "CanStop": "yes", "CapabilityBoundingSet": "cap_chown cap_dac_override cap_dac_read_search cap_fowner cap_fsetid cap_kill cap_setgid cap_setuid cap_setpcap cap_linux_immutable cap_net_bind_service cap_net_broadcast cap_net_admin cap_net_raw cap_ipc_lock cap_ipc_owner cap_sys_rawio cap_sys_chroot cap_sys_ptrace cap_sys_pacct cap_sys_admin cap_sys_boot cap_sys_nice cap_sys_resource cap_sys_time cap_sys_tty_config cap_mknod cap_lease cap_audit_write cap_audit_control cap_setfcap cap_mac_override cap_mac_admin cap_syslog cap_wake_alarm cap_block_suspend cap_audit_read cap_perfmon cap_bpf cap_checkpoint_restore", "CleanResult": "success", "CollectMode": "inactive", "ConditionResult": "yes", "ConditionTimestamp": "Wed 2026-06-17 07:29:26 UTC", "ConditionTimestampMonotonic": "179939219", "ConfigurationDirectoryMode": "0755", "Conflicts": "shutdown.target", "ControlGroup": "/system.slice/auditd.service", "ControlGroupId": "3826", "ControlPID": "0", "CoredumpFilter": "0x33", "CoredumpReceive": "no", "DefaultDependencies": "no", "DefaultMemoryLow": "0", "DefaultMemoryMin": "0", "DefaultStartupMemoryLow": "0", "Delegate": "no", "Description": "Security Auditing Service", "DevicePolicy": "auto", "Documentation": "\"man:auditd(8)\" https://github.com/linux-audit/audit-documentation", "DynamicUser": "no", "ExecMainCode": "0", "ExecMainExitTimestampMonotonic": "0", "ExecMainPID": "2279", "ExecMainStartTimestamp": "Wed 2026-06-17 07:29:26 UTC", "ExecMainStartTimestampMonotonic": "179962527", "ExecMainStatus": "0", "ExecStart": "{ path=/sbin/auditd ; argv[]=/sbin/auditd ; ignore_errors=no ; start_time=[Wed 2026-06-17 07:29:26 UTC] ; stop_time=[Wed 2026-06-17 07:29:26 UTC] ; pid=2278 ; code=exited ; status=0 }", "ExecStartEx": "{ path=/sbin/auditd ; argv[]=/sbin/auditd ; flags= ; start_time=[Wed 2026-06-17 07:29:26 UTC] ; stop_time=[Wed 2026-06-17 07:29:26 UTC] ; pid=2278 ; code=exited ; status=0 }", "ExecStartPost": "{ path=/sbin/augenrules ; argv[]=/sbin/augenrules --load ; ignore_errors=yes ; start_time=[Wed 2026-06-17 07:29:26 UTC] ; stop_time=[Wed 2026-06-17 07:29:26 UTC] ; pid=2282 ; code=exited ; status=0 }", "ExecStartPostEx": "{ path=/sbin/augenrules ; argv[]=/sbin/augenrules --load ; flags=ignore-failure ; start_time=[Wed 2026-06-17 07:29:26 UTC] ; stop_time=[Wed 2026-06-17 07:29:26 UTC] ; pid=2282 ; code=exited ; status=0 }", "ExitType": "main", "ExtensionImagePolicy": "root=verity+signed+encrypted+unprotected+absent:usr=verity+signed+encrypted+unprotected+absent:home=encrypted+unprotected+absent:srv=encrypted+unprotected+absent:tmp=encrypted+unprotected+absent:var=encrypted+unprotected+absent", "FailureAction": "none", "FileDescriptorStoreMax": "0", "FileDescriptorStorePreserve": "restart", "FinalKillSignal": "9", "FragmentPath": "/usr/lib/systemd/system/auditd.service", "FreezerState": "running", "GID": "[not set]", "GuessMainPID": "yes", "IOAccounting": "no", "IOReadBytes": "[not set]", "IOReadOperations": "[not set]", "IOSchedulingClass": "2", "IOSchedulingPriority": "4", "IOWeight": "[not set]", "IOWriteBytes": "[not set]", "IOWriteOperations": "[not set]", "IPAccounting": "no", "IPEgressBytes": "[no data]", "IPEgressPackets": "[no data]", "IPIngressBytes": "[no data]", "IPIngressPackets": "[no data]", "Id": "auditd.service", "IgnoreOnIsolate": "no", "IgnoreSIGPIPE": "yes", "InactiveEnterTimestampMonotonic": "0", "InactiveExitTimestamp": "Wed 2026-06-17 07:29:26 UTC", "InactiveExitTimestampMonotonic": "179950404", "InvocationID": "b81338e136c9477a8384a60fc3822745", "JobRunningTimeoutUSec": "infinity", "JobTimeoutAction": "none", "JobTimeoutUSec": "infinity", "KeyringMode": "private", "KillMode": "control-group", "KillSignal": "15", "LimitAS": "infinity", "LimitASSoft": "infinity", "LimitCORE": "infinity", "LimitCORESoft": "0", "LimitCPU": "infinity", "LimitCPUSoft": "infinity", "LimitDATA": "infinity", "LimitDATASoft": "infinity", "LimitFSIZE": "infinity", "LimitFSIZESoft": "infinity", "LimitLOCKS": "infinity", "LimitLOCKSSoft": "infinity", "LimitMEMLOCK": "8388608", "LimitMEMLOCKSoft": "8388608", "LimitMSGQUEUE": "819200", "LimitMSGQUEUESoft": "819200", "LimitNICE": "0", "LimitNICESoft": "0", "LimitNOFILE": "524288", "LimitNOFILESoft": "1024", "LimitNPROC": "15372", "LimitNPROCSoft": "15372", "LimitRSS": "infinity", "LimitRSSSoft": "infinity", "LimitRTPRIO": "0", "LimitRTPRIOSoft": "0", "LimitRTTIME": "infinity", "LimitRTTIMESoft": "infinity", "LimitSIGPENDING": "15372", "LimitSIGPENDINGSoft": "15372", "LimitSTACK": "infinity", "LimitSTACKSoft": "8388608", "LoadState": "loaded", "LockPersonality": "yes", "LogLevelMax": "-1", "LogRateLimitBurst": "0", "LogRateLimitIntervalUSec": "0", "LogsDirectoryMode": "0755", "MainPID": "2279", "ManagedOOMMemoryPressure": "auto", "ManagedOOMMemoryPressureLimit": "0", "ManagedOOMPreference": "none", "ManagedOOMSwap": "auto", "MemoryAccounting": "yes", "MemoryAvailable": "3529523200", "MemoryCurrent": "512000", "MemoryDenyWriteExecute": "yes", "MemoryHigh": "infinity", "MemoryKSM": "no", "MemoryLimit": "infinity", "MemoryLow": "0", "MemoryMax": "infinity", "MemoryMin": "0", "MemoryPeak": "2211840", "MemoryPressureThresholdUSec": "200ms", "MemoryPressureWatch": "auto", "MemorySwapCurrent": "0", "MemorySwapMax": "infinity", "MemorySwapPeak": "0", "MemoryZSwapCurrent": "0", "MemoryZSwapMax": "infinity", "MountAPIVFS": "no", "MountImagePolicy": "root=verity+signed+encrypted+unprotected+absent:usr=verity+signed+encrypted+unprotected+absent:home=encrypted+unprotected+absent:srv=encrypted+unprotected+absent:tmp=encrypted+unprotected+absent:var=encrypted+unprotected+absent", "NFileDescriptorStore": "0", "NRestarts": "0", "NUMAPolicy": "n/a", "Names": "auditd.service", "NeedDaemonReload": "no", "Nice": "0", "NoNewPrivileges": "no", "NonBlocking": "no", "NotifyAccess": "none", "OOMPolicy": "stop", "OOMScoreAdjust": "0", "OnFailureJobMode": "replace", "OnSuccessJobMode": "fail", "PIDFile": "/run/auditd.pid", "Perpetual": "no", "PrivateDevices": "no", "PrivateIPC": "no", "PrivateMounts": "no", "PrivateNetwork": "no", "PrivateTmp": "no", "PrivateUsers": "no", "ProcSubset": "all", "ProtectClock": "no", "ProtectControlGroups": "no", "ProtectHome": "no", "ProtectHostname": "no", "ProtectKernelLogs": "no", "ProtectKernelModules": "yes", "ProtectKernelTunables": "no", "ProtectProc": "default", "ProtectSystem": "no", "RefuseManualStart": "no", "RefuseManualStop": "no", "ReloadResult": "success", "ReloadSignal": "1", "RemainAfterExit": "no", "RemoveIPC": "no", "Requires": "system.slice", "Restart": "on-failure", "RestartKillSignal": "15", "RestartMaxDelayUSec": "infinity", "RestartMode": "normal", "RestartPreventExitStatus": "2 4 6", "RestartSteps": "0", "RestartUSec": "100ms", "RestartUSecNext": "100ms", "RestrictNamespaces": "no", "RestrictRealtime": "yes", "RestrictSUIDSGID": "no", "Result": "success", "RootDirectoryStartOnly": "no", "RootEphemeral": "no", "RootImagePolicy": "root=verity+signed+encrypted+unprotected+absent:usr=verity+signed+encrypted+unprotected+absent:home=encrypted+unprotected+absent:srv=encrypted+unprotected+absent:tmp=encrypted+unprotected+absent:var=encrypted+unprotected+absent", "RuntimeDirectoryMode": "0755", "RuntimeDirectoryPreserve": "no", "RuntimeMaxUSec": "infinity", "RuntimeRandomizedExtraUSec": "0", "SameProcessGroup": "no", "SecureBits": "0", "SendSIGHUP": "no", "SendSIGKILL": "yes", "SetLoginEnvironment": "no", "Slice": "system.slice", "StandardError": "inherit", "StandardInput": "null", "StandardOutput": "journal", "StartLimitAction": "none", "StartLimitBurst": "5", "StartLimitIntervalUSec": "10s", "StartupBlockIOWeight": "[not set]", "StartupCPUShares": "[not set]", "StartupCPUWeight": "[not set]", "StartupIOWeight": "[not set]", "StartupMemoryHigh": "infinity", "StartupMemoryLow": "0", "StartupMemoryMax": "infinity", "StartupMemorySwapMax": "infinity", "StartupMemoryZSwapMax": "infinity", "StateChangeTimestamp": "Wed 2026-06-17 07:29:26 UTC", "StateChangeTimestampMonotonic": "180004167", "StateDirectoryMode": "0755", "StatusErrno": "0", "StopWhenUnneeded": "no", "SubState": "running", "SuccessAction": "none", "SurviveFinalKillSignal": "no", "SyslogFacility": "3", "SyslogLevel": "6", "SyslogLevelPrefix": "yes", "SyslogPriority": "30", "SystemCallErrorNumber": "2147483646", "TTYReset": "no", "TTYVHangup": "no", "TTYVTDisallocate": "no", "TasksAccounting": "yes", "TasksCurrent": "2", "TasksMax": "4611", "TimeoutAbortUSec": "1min 30s", "TimeoutCleanUSec": "infinity", "TimeoutStartFailureMode": "terminate", "TimeoutStartUSec": "1min 30s", "TimeoutStopFailureMode": "terminate", "TimeoutStopUSec": "1min 30s", "TimerSlackNSec": "50000", "Transient": "no", "Type": "forking", "UID": "[not set]", "UMask": "0022", "UnitFilePreset": "enabled", "UnitFileState": "enabled", "UtmpMode": "init", "WantedBy": "multi-user.target", "WatchdogSignal": "6", "WatchdogTimestampMonotonic": "0", "WatchdogUSec": "0"}} 2026-06-17 07:29:36.643576 | ubuntu-noble | 2026-06-17 07:29:36.643627 | ubuntu-noble | RUNNING HANDLER [auditd : Generate auditd rules] ******************************* 2026-06-17 07:29:37.068172 | ubuntu-noble | changed: [molecule-auditd] => {"changed": true, "cmd": ["augenrules", "--load"], "delta": "0:00:00.060532", "end": "2026-06-17 07:29:37.002405", "msg": "", "rc": 0, "start": "2026-06-17 07:29:36.941873", "stderr": "Unknown user: chrony\nThere was an error in line 24 of /etc/audit/audit.rules\nError sending add rule data request (No such file or directory)\nThere was an error in line 28 of /etc/audit/audit.rules\nUnknown user: ntp\nThere was an error in line 44 of /etc/audit/audit.rules\nError sending add rule data request (No such file or directory)\nThere was an error in line 83 of /etc/audit/audit.rules\nError sending add rule data request (No such file or directory)\nThere was an error in line 84 of /etc/audit/audit.rules\nError sending add rule data request (No such file or directory)\nThere was an error in line 86 of /etc/audit/audit.rules\nError sending add rule data request (No such file or directory)\nThere was an error in line 112 of /etc/audit/audit.rules\nError sending add rule data request (No such file or directory)\nThere was an error in line 115 of /etc/audit/audit.rules\nError sending add rule data request (No such file or directory)\nThere was an error in line 176 of /etc/audit/audit.rules\nError sending add rule data request (No such file or directory)\nThere was an error in line 177 of /etc/audit/audit.rules\nError sending add rule data request (No such file or directory)\nThere was an error in line 178 of /etc/audit/audit.rules\nError sending add rule data request (No such file or directory)\nThere was an error in line 179 of /etc/audit/audit.rules\nError sending add rule data request (No such file or directory)\nThere was an error in line 180 of /etc/audit/audit.rules\nError sending add rule data request (No such file or directory)\nThere was an error in line 217 of /etc/audit/audit.rules\nError sending add rule data request (No such file or directory)\nThere was an error in line 218 of /etc/audit/audit.rules\nError sending add rule data request (No such file or directory)\nThere was an error in line 234 of /etc/audit/audit.rules\nError sending add rule data request (No such file or directory)\nThere was an error in line 285 of /etc/audit/audit.rules\nError sending add rule data request (No such file or directory)\nThere was an error in line 286 of /etc/audit/audit.rules\nError sending add rule data request (No such file or directory)\nThere was an error in line 324 of /etc/audit/audit.rules\nError sending add rule data request (No such file or directory)\nThere was an error in line 325 of /etc/audit/audit.rules\nError sending add rule data request (No such file or directory)\nThere was an error in line 346 of /etc/audit/audit.rules\nparameter passed without an option given\nThere was an error in line 347 of /etc/audit/audit.rules\nparameter passed without an option given\nThere was an error in line 348 of /etc/audit/audit.rules\nparameter passed without an option given\nThere was an error in line 349 of /etc/audit/audit.rules\nparameter passed without an option given\nThere was an error in line 350 of /etc/audit/audit.rules\nparameter passed without an option given\nThere was an error in line 351 of /etc/audit/audit.rules\nError sending add rule data request (No such file or directory)\nThere was an error in line 359 of /etc/audit/audit.rules", "stderr_lines": ["Unknown user: chrony", "There was an error in line 24 of /etc/audit/audit.rules", "Error sending add rule data request (No such file or directory)", "There was an error in line 28 of /etc/audit/audit.rules", "Unknown user: ntp", "There was an error in line 44 of /etc/audit/audit.rules", "Error sending add rule data request (No such file or directory)", "There was an error in line 83 of /etc/audit/audit.rules", "Error sending add rule data request (No such file or directory)", "There was an error in line 84 of /etc/audit/audit.rules", "Error sending add rule data request (No such file or directory)", "There was an error in line 86 of /etc/audit/audit.rules", "Error sending add rule data request (No such file or directory)", "There was an error in line 112 of /etc/audit/audit.rules", "Error sending add rule data request (No such file or directory)", "There was an error in line 115 of /etc/audit/audit.rules", "Error sending add rule data request (No such file or directory)", "There was an error in line 176 of /etc/audit/audit.rules", "Error sending add rule data request (No such file or directory)", "There was an error in line 177 of /etc/audit/audit.rules", "Error sending add rule data request (No such file or directory)", "There was an error in line 178 of /etc/audit/audit.rules", "Error sending add rule data request (No such file or directory)", "There was an error in line 179 of /etc/audit/audit.rules", "Error sending add rule data request (No such file or directory)", "There was an error in line 180 of /etc/audit/audit.rules", "Error sending add rule data request (No such file or directory)", "There was an error in line 217 of /etc/audit/audit.rules", "Error sending add rule data request (No such file or directory)", "There was an error in line 218 of /etc/audit/audit.rules", "Error sending add rule data request (No such file or directory)", "There was an error in line 234 of /etc/audit/audit.rules", "Error sending add rule data request (No such file or directory)", "There was an error in line 285 of /etc/audit/audit.rules", "Error sending add rule data request (No such file or directory)", "There was an error in line 286 of /etc/audit/audit.rules", "Error sending add rule data request (No such file or directory)", "There was an error in line 324 of /etc/audit/audit.rules", "Error sending add rule data request (No such file or directory)", "There was an error in line 325 of /etc/audit/audit.rules", "Error sending add rule data request (No such file or directory)", "There was an error in line 346 of /etc/audit/audit.rules", "parameter passed without an option given", "There was an error in line 347 of /etc/audit/audit.rules", "parameter passed without an option given", "There was an error in line 348 of /etc/audit/audit.rules", "parameter passed without an option given", "There was an error in line 349 of /etc/audit/audit.rules", "parameter passed without an option given", "There was an error in line 350 of /etc/audit/audit.rules", "parameter passed without an option given", "There was an error in line 351 of /etc/audit/audit.rules", "Error sending add rule data request (No such file or directory)", "There was an error in line 359 of /etc/audit/audit.rules"], "stdout": "/usr/sbin/augenrules: No change\nNo rules\nenabled 1\nfailure 1\npid 2671\nrate_limit 0\nbacklog_limit 8192\nlost 0\nbacklog 1075\nbacklog_wait_time 60000\nbacklog_wait_time_actual 0\nenabled 1\nfailure 1\npid 2671\nrate_limit 0\nbacklog_limit 8192\nlost 0\nbacklog 1076\nbacklog_wait_time 60000\nbacklog_wait_time_actual 0", "stdout_lines": ["/usr/sbin/augenrules: No change", "No rules", "enabled 1", "failure 1", "pid 2671", "rate_limit 0", "backlog_limit 8192", "lost 0", "backlog 1075", "backlog_wait_time 60000", "backlog_wait_time_actual 0", "enabled 1", "failure 1", "pid 2671", "rate_limit 0", "backlog_limit 8192", "lost 0", "backlog 1076", "backlog_wait_time 60000", "backlog_wait_time_actual 0"]} 2026-06-17 07:29:37.068395 | ubuntu-noble | 2026-06-17 07:29:37.068564 | ubuntu-noble | RUNNING HANDLER [auditd : Restart auditd service] ****************************** 2026-06-17 07:29:38.197290 | ubuntu-noble | ok: Runtime: 0:00:22.240717 2026-06-17 07:29:38.227093 | 2026-06-17 07:29:38.227268 | TASK [ansible-molecule : Run molecule verify action with scenario delegated] 2026-06-17 07:29:37.865332 | ubuntu-noble | changed: [molecule-auditd] => {"changed": true, "name": "auditd", "state": "started", "status": {"ActiveEnterTimestamp": "Wed 2026-06-17 07:29:36 UTC", "ActiveEnterTimestampMonotonic": "190401248", "ActiveExitTimestamp": "Wed 2026-06-17 07:29:36 UTC", "ActiveExitTimestampMonotonic": "190252717", "ActiveState": "active", "After": "local-fs.target system.slice systemd-journald.socket systemd-tmpfiles-setup.service", "AllowIsolate": "no", "AssertResult": "yes", "AssertTimestamp": "Wed 2026-06-17 07:29:36 UTC", "AssertTimestampMonotonic": "190298366", "Before": "shutdown.target sysinit.target systemd-update-utmp.service ssh.service", "BlockIOAccounting": "no", "BlockIOWeight": "[not set]", "CPUAccounting": "yes", "CPUAffinityFromNUMA": "no", "CPUQuotaPerSecUSec": "infinity", "CPUQuotaPeriodUSec": "infinity", "CPUSchedulingPolicy": "0", "CPUSchedulingPriority": "0", "CPUSchedulingResetOnFork": "no", "CPUShares": "[not set]", "CPUUsageNSec": "155255000", "CPUWeight": "[not set]", "CacheDirectoryMode": "0755", "CanFreeze": "yes", "CanIsolate": "no", "CanReload": "no", "CanStart": "yes", "CanStop": "yes", "CapabilityBoundingSet": "cap_chown cap_dac_override cap_dac_read_search cap_fowner cap_fsetid cap_kill cap_setgid cap_setuid cap_setpcap cap_linux_immutable cap_net_bind_service cap_net_broadcast cap_net_admin cap_net_raw cap_ipc_lock cap_ipc_owner cap_sys_rawio cap_sys_chroot cap_sys_ptrace cap_sys_pacct cap_sys_admin cap_sys_boot cap_sys_nice cap_sys_resource cap_sys_time cap_sys_tty_config cap_mknod cap_lease cap_audit_write cap_audit_control cap_setfcap cap_mac_override cap_mac_admin cap_syslog cap_wake_alarm cap_block_suspend cap_audit_read cap_perfmon cap_bpf cap_checkpoint_restore", "CleanResult": "success", "CollectMode": "inactive", "ConditionResult": "yes", "ConditionTimestamp": "Wed 2026-06-17 07:29:36 UTC", "ConditionTimestampMonotonic": "190298276", "ConfigurationDirectoryMode": "0755", "Conflicts": "shutdown.target", "ControlGroup": "/system.slice/auditd.service", "ControlGroupId": "3868", "ControlPID": "0", "CoredumpFilter": "0x33", "CoredumpReceive": "no", "DefaultDependencies": "no", "DefaultMemoryLow": "0", "DefaultMemoryMin": "0", "DefaultStartupMemoryLow": "0", "Delegate": "no", "Description": "Security Auditing Service", "DevicePolicy": "auto", "Documentation": "\"man:auditd(8)\" https://github.com/linux-audit/audit-documentation", "DynamicUser": "no", "ExecMainCode": "0", "ExecMainExitTimestampMonotonic": "0", "ExecMainPID": "2671", "ExecMainStartTimestamp": "Wed 2026-06-17 07:29:36 UTC", "ExecMainStartTimestampMonotonic": "190324902", "ExecMainStatus": "0", "ExecStart": "{ path=/sbin/auditd ; argv[]=/sbin/auditd ; ignore_errors=no ; start_time=[Wed 2026-06-17 07:29:36 UTC] ; stop_time=[Wed 2026-06-17 07:29:36 UTC] ; pid=2670 ; code=exited ; status=0 }", "ExecStartEx": "{ path=/sbin/auditd ; argv[]=/sbin/auditd ; flags= ; start_time=[Wed 2026-06-17 07:29:36 UTC] ; stop_time=[Wed 2026-06-17 07:29:36 UTC] ; pid=2670 ; code=exited ; status=0 }", "ExecStartPost": "{ path=/sbin/augenrules ; argv[]=/sbin/augenrules --load ; ignore_errors=yes ; start_time=[Wed 2026-06-17 07:29:36 UTC] ; stop_time=[Wed 2026-06-17 07:29:36 UTC] ; pid=2674 ; code=exited ; status=0 }", "ExecStartPostEx": "{ path=/sbin/augenrules ; argv[]=/sbin/augenrules --load ; flags=ignore-failure ; start_time=[Wed 2026-06-17 07:29:36 UTC] ; stop_time=[Wed 2026-06-17 07:29:36 UTC] ; pid=2674 ; code=exited ; status=0 }", "ExitType": "main", "ExtensionImagePolicy": "root=verity+signed+encrypted+unprotected+absent:usr=verity+signed+encrypted+unprotected+absent:home=encrypted+unprotected+absent:srv=encrypted+unprotected+absent:tmp=encrypted+unprotected+absent:var=encrypted+unprotected+absent", "FailureAction": "none", "FileDescriptorStoreMax": "0", "FileDescriptorStorePreserve": "restart", "FinalKillSignal": "9", "FragmentPath": "/usr/lib/systemd/system/auditd.service", "FreezerState": "running", "GID": "[not set]", "GuessMainPID": "yes", "IOAccounting": "no", "IOReadBytes": "[not set]", "IOReadOperations": "[not set]", "IOSchedulingClass": "2", "IOSchedulingPriority": "4", "IOWeight": "[not set]", "IOWriteBytes": "[not set]", "IOWriteOperations": "[not set]", "IPAccounting": "no", "IPEgressBytes": "[no data]", "IPEgressPackets": "[no data]", "IPIngressBytes": "[no data]", "IPIngressPackets": "[no data]", "Id": "auditd.service", "IgnoreOnIsolate": "no", "IgnoreSIGPIPE": "yes", "InactiveEnterTimestamp": "Wed 2026-06-17 07:29:36 UTC", "InactiveEnterTimestampMonotonic": "190296593", "InactiveExitTimestamp": "Wed 2026-06-17 07:29:36 UTC", "InactiveExitTimestampMonotonic": "190304571", "InvocationID": "19e811c8150449a9a4a95b4310b188af", "JobRunningTimeoutUSec": "infinity", "JobTimeoutAction": "none", "JobTimeoutUSec": "infinity", "KeyringMode": "private", "KillMode": "control-group", "KillSignal": "15", "LimitAS": "infinity", "LimitASSoft": "infinity", "LimitCORE": "infinity", "LimitCORESoft": "0", "LimitCPU": "infinity", "LimitCPUSoft": "infinity", "LimitDATA": "infinity", "LimitDATASoft": "infinity", "LimitFSIZE": "infinity", "LimitFSIZESoft": "infinity", "LimitLOCKS": "infinity", "LimitLOCKSSoft": "infinity", "LimitMEMLOCK": "8388608", "LimitMEMLOCKSoft": "8388608", "LimitMSGQUEUE": "819200", "LimitMSGQUEUESoft": "819200", "LimitNICE": "0", "LimitNICESoft": "0", "LimitNOFILE": "524288", "LimitNOFILESoft": "1024", "LimitNPROC": "15372", "LimitNPROCSoft": "15372", "LimitRSS": "infinity", "LimitRSSSoft": "infinity", "LimitRTPRIO": "0", "LimitRTPRIOSoft": "0", "LimitRTTIME": "infinity", "LimitRTTIMESoft": "infinity", "LimitSIGPENDING": "15372", "LimitSIGPENDINGSoft": "15372", "LimitSTACK": "infinity", "LimitSTACKSoft": "8388608", "LoadState": "loaded", "LockPersonality": "yes", "LogLevelMax": "-1", "LogRateLimitBurst": "0", "LogRateLimitIntervalUSec": "0", "LogsDirectoryMode": "0755", "MainPID": "2671", "ManagedOOMMemoryPressure": "auto", "ManagedOOMMemoryPressureLimit": "0", "ManagedOOMPreference": "none", "ManagedOOMSwap": "auto", "MemoryAccounting": "yes", "MemoryAvailable": "3545530368", "MemoryCurrent": "1859584", "MemoryDenyWriteExecute": "yes", "MemoryHigh": "infinity", "MemoryKSM": "no", "MemoryLimit": "infinity", "MemoryLow": "0", "MemoryMax": "infinity", "MemoryMin": "0", "MemoryPeak": "2117632", "MemoryPressureThresholdUSec": "200ms", "MemoryPressureWatch": "auto", "MemorySwapCurrent": "0", "MemorySwapMax": "infinity", "MemorySwapPeak": "0", "MemoryZSwapCurrent": "0", "MemoryZSwapMax": "infinity", "MountAPIVFS": "no", "MountImagePolicy": "root=verity+signed+encrypted+unprotected+absent:usr=verity+signed+encrypted+unprotected+absent:home=encrypted+unprotected+absent:srv=encrypted+unprotected+absent:tmp=encrypted+unprotected+absent:var=encrypted+unprotected+absent", "NFileDescriptorStore": "0", "NRestarts": "0", "NUMAPolicy": "n/a", "Names": "auditd.service", "NeedDaemonReload": "no", "Nice": "0", "NoNewPrivileges": "no", "NonBlocking": "no", "NotifyAccess": "none", "OOMPolicy": "stop", "OOMScoreAdjust": "0", "OnFailureJobMode": "replace", "OnSuccessJobMode": "fail", "PIDFile": "/run/auditd.pid", "Perpetual": "no", "PrivateDevices": "no", "PrivateIPC": "no", "PrivateMounts": "no", "PrivateNetwork": "no", "PrivateTmp": "no", "PrivateUsers": "no", "ProcSubset": "all", "ProtectClock": "no", "ProtectControlGroups": "no", "ProtectHome": "no", "ProtectHostname": "no", "ProtectKernelLogs": "no", "ProtectKernelModules": "yes", "ProtectKernelTunables": "no", "ProtectProc": "default", "ProtectSystem": "no", "RefuseManualStart": "no", "RefuseManualStop": "no", "ReloadResult": "success", "ReloadSignal": "1", "RemainAfterExit": "no", "RemoveIPC": "no", "Requires": "system.slice", "Restart": "on-failure", "RestartKillSignal": "15", "RestartMaxDelayUSec": "infinity", "RestartMode": "normal", "RestartPreventExitStatus": "2 4 6", "RestartSteps": "0", "RestartUSec": "100ms", "RestartUSecNext": "100ms", "RestrictNamespaces": "no", "RestrictRealtime": "yes", "RestrictSUIDSGID": "no", "Result": "success", "RootDirectoryStartOnly": "no", "RootEphemeral": "no", "RootImagePolicy": "root=verity+signed+encrypted+unprotected+absent:usr=verity+signed+encrypted+unprotected+absent:home=encrypted+unprotected+absent:srv=encrypted+unprotected+absent:tmp=encrypted+unprotected+absent:var=encrypted+unprotected+absent", "RuntimeDirectoryMode": "0755", "RuntimeDirectoryPreserve": "no", "RuntimeMaxUSec": "infinity", "RuntimeRandomizedExtraUSec": "0", "SameProcessGroup": "no", "SecureBits": "0", "SendSIGHUP": "no", "SendSIGKILL": "yes", "SetLoginEnvironment": "no", "Slice": "system.slice", "StandardError": "inherit", "StandardInput": "null", "StandardOutput": "journal", "StartLimitAction": "none", "StartLimitBurst": "5", "StartLimitIntervalUSec": "10s", "StartupBlockIOWeight": "[not set]", "StartupCPUShares": "[not set]", "StartupCPUWeight": "[not set]", "StartupIOWeight": "[not set]", "StartupMemoryHigh": "infinity", "StartupMemoryLow": "0", "StartupMemoryMax": "infinity", "StartupMemorySwapMax": "infinity", "StartupMemoryZSwapMax": "infinity", "StateChangeTimestamp": "Wed 2026-06-17 07:29:36 UTC", "StateChangeTimestampMonotonic": "190401248", "StateDirectoryMode": "0755", "StatusErrno": "0", "StopWhenUnneeded": "no", "SubState": "running", "SuccessAction": "none", "SurviveFinalKillSignal": "no", "SyslogFacility": "3", "SyslogLevel": "6", "SyslogLevelPrefix": "yes", "SyslogPriority": "30", "SystemCallErrorNumber": "2147483646", "TTYReset": "no", "TTYVHangup": "no", "TTYVTDisallocate": "no", "TasksAccounting": "yes", "TasksCurrent": "2", "TasksMax": "4611", "TimeoutAbortUSec": "1min 30s", "TimeoutCleanUSec": "infinity", "TimeoutStartFailureMode": "terminate", "TimeoutStartUSec": "1min 30s", "TimeoutStopFailureMode": "terminate", "TimeoutStopUSec": "1min 30s", "TimerSlackNSec": "50000", "Transient": "no", "Type": "forking", "UID": "[not set]", "UMask": "0022", "UnitFilePreset": "enabled", "UnitFileState": "enabled", "UtmpMode": "init", "WantedBy": "multi-user.target", "WatchdogSignal": "6", "WatchdogTimestampMonotonic": "0", "WatchdogUSec": "0"}} 2026-06-17 07:29:37.867434 | ubuntu-noble | 2026-06-17 07:29:37.868043 | ubuntu-noble | PLAY RECAP ********************************************************************* 2026-06-17 07:29:37.868440 | ubuntu-noble | molecule-auditd : ok=15 changed=8 unreachable=0 failed=0 skipped=0 rescued=0 ignored=0 2026-06-17 07:29:37.868763 | ubuntu-noble | 2026-06-17 07:29:38.005200 | ubuntu-noble | INFO [delegated > converge] Executed: Successful 2026-06-17 07:29:38.006458 | ubuntu-noble | WARNING Molecule executed 1 scenario (1 missing files) 2026-06-17 07:29:39.066121 | ubuntu-noble | WARNING Molecule scenarios should migrate to 'extensions/molecule' 2026-06-17 07:29:39.079076 | ubuntu-noble | DEBUG [unknown > config] provisioner.env found in /home/zuul/src/github.com/osism/ansible-collection-services/molecule/delegated/molecule.yml, this can be defined in ansible.env 2026-06-17 07:29:38.925122 | debian-bookworm | WARNING Molecule scenarios should migrate to 'extensions/molecule' 2026-06-17 07:29:38.936400 | debian-bookworm | DEBUG [unknown > config] provisioner.env found in /home/zuul/src/github.com/osism/ansible-collection-services/molecule/delegated/molecule.yml, this can be defined in ansible.env 2026-06-17 07:29:39.631200 | ubuntu-noble | DEBUG [unknown > config] provisioner.env found in /home/zuul/src/github.com/osism/ansible-collection-services/molecule/delegated/molecule.yml, this can be defined in ansible.env 2026-06-17 07:29:39.632097 | ubuntu-noble | DEBUG [delegated > validate] Validating schema /home/zuul/src/github.com/osism/ansible-collection-services/molecule/delegated/molecule.yml. 2026-06-17 07:29:39.657225 | ubuntu-noble | DEBUG [default > validate] Validating schema /home/zuul/src/github.com/osism/ansible-collection-services/molecule/default/molecule.yml. 2026-06-17 07:29:39.663262 | ubuntu-noble | INFO [delegated > discovery] scenario test matrix: verify 2026-06-17 07:29:39.663416 | ubuntu-noble | INFO [delegated > prerun] Performing prerun with role_name_check=0... 2026-06-17 07:29:39.417014 | debian-bookworm | DEBUG [unknown > config] provisioner.env found in /home/zuul/src/github.com/osism/ansible-collection-services/molecule/delegated/molecule.yml, this can be defined in ansible.env 2026-06-17 07:29:39.417629 | debian-bookworm | DEBUG [delegated > validate] Validating schema /home/zuul/src/github.com/osism/ansible-collection-services/molecule/delegated/molecule.yml. 2026-06-17 07:29:39.441313 | debian-bookworm | DEBUG [default > validate] Validating schema /home/zuul/src/github.com/osism/ansible-collection-services/molecule/default/molecule.yml. 2026-06-17 07:29:39.447105 | debian-bookworm | INFO [delegated > discovery] scenario test matrix: verify 2026-06-17 07:29:39.447210 | debian-bookworm | INFO [delegated > prerun] Performing prerun with role_name_check=0... 2026-06-17 07:29:40.973370 | debian-bookworm | INFO [delegated > verify] Executing 2026-06-17 07:29:40.975070 | debian-bookworm | INFO [delegated > verify] Executing Testinfra tests found in /home/zuul/src/github.com/osism/ansible-collection-services/molecule/delegated/tests/... 2026-06-17 07:29:40.976225 | debian-bookworm | DEBUG ANSIBLE ENVIRONMENT: 2026-06-17 07:29:40.976238 | debian-bookworm | ANSIBLE_COLLECTIONS_PATH: /home/zuul/venv/.ansible/collections:/home/zuul/.ansible/collections 2026-06-17 07:29:40.976246 | debian-bookworm | ANSIBLE_CONFIG: /home/zuul/.ansible/tmp/molecule.oWZD.delegated/ansible.cfg 2026-06-17 07:29:40.976253 | debian-bookworm | ANSIBLE_LIBRARY: ../../plugins 2026-06-17 07:29:40.976259 | debian-bookworm | ANSIBLE_PYTHON_INTERPRETER: /home/zuul/venv/bin/python 2026-06-17 07:29:40.976264 | debian-bookworm | ANSIBLE_ROLE: auditd 2026-06-17 07:29:40.976269 | debian-bookworm | ANSIBLE_ROLES_PATH: ../../roles 2026-06-17 07:29:40.976274 | debian-bookworm | ANSIBLE_VERBOSITY: 1 2026-06-17 07:29:40.976279 | debian-bookworm | 2026-06-17 07:29:40.976392 | debian-bookworm | DEBUG MOLECULE ENVIRONMENT: 2026-06-17 07:29:40.976399 | debian-bookworm | MOLECULE_DEBUG: True 2026-06-17 07:29:40.976405 | debian-bookworm | MOLECULE_DEPENDENCY_NAME: galaxy 2026-06-17 07:29:40.976410 | debian-bookworm | MOLECULE_DRIVER_NAME: default 2026-06-17 07:29:40.976415 | debian-bookworm | MOLECULE_ENV_FILE: /home/zuul/src/github.com/osism/ansible-collection-services/.env.yml 2026-06-17 07:29:40.976420 | debian-bookworm | MOLECULE_EPHEMERAL_DIRECTORY: /home/zuul/.ansible/tmp/molecule.oWZD.delegated 2026-06-17 07:29:40.976425 | debian-bookworm | MOLECULE_FILE: /home/zuul/.ansible/tmp/molecule.oWZD.delegated/molecule.yml 2026-06-17 07:29:40.976430 | debian-bookworm | MOLECULE_INSTANCE_CONFIG: /home/zuul/.ansible/tmp/molecule.oWZD.delegated/instance_config.yml 2026-06-17 07:29:40.976435 | debian-bookworm | MOLECULE_INVENTORY_FILE: /home/zuul/.ansible/tmp/molecule.oWZD.delegated/inventory/ansible_inventory.yml 2026-06-17 07:29:40.976441 | debian-bookworm | MOLECULE_PROJECT_DIRECTORY: /home/zuul/src/github.com/osism/ansible-collection-services 2026-06-17 07:29:40.976446 | debian-bookworm | MOLECULE_PROVISIONER_NAME: ansible 2026-06-17 07:29:40.976451 | debian-bookworm | MOLECULE_SCENARIO_DIRECTORY: /home/zuul/src/github.com/osism/ansible-collection-services/molecule/delegated 2026-06-17 07:29:40.976456 | debian-bookworm | MOLECULE_SCENARIO_NAME: delegated 2026-06-17 07:29:40.976461 | debian-bookworm | MOLECULE_STATE_FILE: /home/zuul/.ansible/tmp/molecule.oWZD.delegated/state.yml 2026-06-17 07:29:40.976466 | debian-bookworm | MOLECULE_VERIFIER_NAME: testinfra 2026-06-17 07:29:40.976471 | debian-bookworm | MOLECULE_VERIFIER_TEST_DIRECTORY: /home/zuul/src/github.com/osism/ansible-collection-services/molecule/delegated/tests 2026-06-17 07:29:40.976476 | debian-bookworm | 2026-06-17 07:29:40.976572 | debian-bookworm | DEBUG SHELL REPLAY: ANSIBLE_COLLECTIONS_PATH=/home/zuul/venv/.ansible/collections:/home/zuul/.ansible/collections ANSIBLE_CONFIG=/home/zuul/.ansible/tmp/molecule.oWZD.delegated/ansible.cfg ANSIBLE_LIBRARY=../../plugins ANSIBLE_PYTHON_INTERPRETER=/home/zuul/venv/bin/python ANSIBLE_ROLE=auditd ANSIBLE_ROLES_PATH=../../roles ANSIBLE_VERBOSITY=1 MOLECULE_DEBUG=True MOLECULE_DEPENDENCY_NAME=galaxy MOLECULE_DRIVER_NAME=default MOLECULE_ENV_FILE=/home/zuul/src/github.com/osism/ansible-collection-services/.env.yml MOLECULE_EPHEMERAL_DIRECTORY=/home/zuul/.ansible/tmp/molecule.oWZD.delegated MOLECULE_FILE=/home/zuul/.ansible/tmp/molecule.oWZD.delegated/molecule.yml MOLECULE_INSTANCE_CONFIG=/home/zuul/.ansible/tmp/molecule.oWZD.delegated/instance_config.yml MOLECULE_INVENTORY_FILE=/home/zuul/.ansible/tmp/molecule.oWZD.delegated/inventory/ansible_inventory.yml MOLECULE_PROJECT_DIRECTORY=/home/zuul/src/github.com/osism/ansible-collection-services MOLECULE_PROVISIONER_NAME=ansible MOLECULE_SCENARIO_DIRECTORY=/home/zuul/src/github.com/osism/ansible-collection-services/molecule/delegated MOLECULE_SCENARIO_NAME=delegated MOLECULE_STATE_FILE=/home/zuul/.ansible/tmp/molecule.oWZD.delegated/state.yml MOLECULE_VERIFIER_NAME=testinfra MOLECULE_VERIFIER_TEST_DIRECTORY=/home/zuul/src/github.com/osism/ansible-collection-services/molecule/delegated/tests 2026-06-17 07:29:41.211061 | debian-bookworm | writing pytest debug information to pytestdebug.log 2026-06-17 07:29:41.225118 | debian-bookworm | ============================= test session starts ============================== 2026-06-17 07:29:41.225590 | debian-bookworm | platform linux -- Python 3.11.2, pytest-8.4.2, pluggy-1.6.0 -- /home/zuul/venv/bin/python3 2026-06-17 07:29:41.226052 | debian-bookworm | using: pytest-8.4.2 2026-06-17 07:29:41.226501 | debian-bookworm | registered third-party plugins: 2026-06-17 07:29:41.226807 | debian-bookworm | pytest-testinfra-10.2.2 at /home/zuul/venv/lib/python3.11/site-packages/testinfra/plugin.py 2026-06-17 07:29:41.227090 | debian-bookworm | rootdir: /home/zuul 2026-06-17 07:29:41.227443 | debian-bookworm | plugins: testinfra-10.2.2 2026-06-17 07:29:41.280831 | ubuntu-noble | INFO [delegated > verify] Executing 2026-06-17 07:29:41.283431 | ubuntu-noble | INFO [delegated > verify] Executing Testinfra tests found in /home/zuul/src/github.com/osism/ansible-collection-services/molecule/delegated/tests/... 2026-06-17 07:29:41.285653 | ubuntu-noble | DEBUG ANSIBLE ENVIRONMENT: 2026-06-17 07:29:41.285715 | ubuntu-noble | ANSIBLE_COLLECTIONS_PATH: /home/zuul/venv/.ansible/collections:/home/zuul/.ansible/collections 2026-06-17 07:29:41.285730 | ubuntu-noble | ANSIBLE_CONFIG: /home/zuul/.ansible/tmp/molecule.oWZD.delegated/ansible.cfg 2026-06-17 07:29:41.285740 | ubuntu-noble | ANSIBLE_LIBRARY: ../../plugins 2026-06-17 07:29:41.285748 | ubuntu-noble | ANSIBLE_PYTHON_INTERPRETER: /home/zuul/venv/bin/python 2026-06-17 07:29:41.285756 | ubuntu-noble | ANSIBLE_ROLE: auditd 2026-06-17 07:29:41.285763 | ubuntu-noble | ANSIBLE_ROLES_PATH: ../../roles 2026-06-17 07:29:41.285771 | ubuntu-noble | ANSIBLE_VERBOSITY: 1 2026-06-17 07:29:41.285779 | ubuntu-noble | 2026-06-17 07:29:41.285788 | ubuntu-noble | DEBUG MOLECULE ENVIRONMENT: 2026-06-17 07:29:41.285795 | ubuntu-noble | MOLECULE_DEBUG: True 2026-06-17 07:29:41.285802 | ubuntu-noble | MOLECULE_DEPENDENCY_NAME: galaxy 2026-06-17 07:29:41.285810 | ubuntu-noble | MOLECULE_DRIVER_NAME: default 2026-06-17 07:29:41.285817 | ubuntu-noble | MOLECULE_ENV_FILE: /home/zuul/src/github.com/osism/ansible-collection-services/.env.yml 2026-06-17 07:29:41.285825 | ubuntu-noble | MOLECULE_EPHEMERAL_DIRECTORY: /home/zuul/.ansible/tmp/molecule.oWZD.delegated 2026-06-17 07:29:41.285832 | ubuntu-noble | MOLECULE_FILE: /home/zuul/.ansible/tmp/molecule.oWZD.delegated/molecule.yml 2026-06-17 07:29:41.285865 | ubuntu-noble | MOLECULE_INSTANCE_CONFIG: /home/zuul/.ansible/tmp/molecule.oWZD.delegated/instance_config.yml 2026-06-17 07:29:41.285874 | ubuntu-noble | MOLECULE_INVENTORY_FILE: /home/zuul/.ansible/tmp/molecule.oWZD.delegated/inventory/ansible_inventory.yml 2026-06-17 07:29:41.285882 | ubuntu-noble | MOLECULE_PROJECT_DIRECTORY: /home/zuul/src/github.com/osism/ansible-collection-services 2026-06-17 07:29:41.285890 | ubuntu-noble | MOLECULE_PROVISIONER_NAME: ansible 2026-06-17 07:29:41.285897 | ubuntu-noble | MOLECULE_SCENARIO_DIRECTORY: /home/zuul/src/github.com/osism/ansible-collection-services/molecule/delegated 2026-06-17 07:29:41.285905 | ubuntu-noble | MOLECULE_SCENARIO_NAME: delegated 2026-06-17 07:29:41.285912 | ubuntu-noble | MOLECULE_STATE_FILE: /home/zuul/.ansible/tmp/molecule.oWZD.delegated/state.yml 2026-06-17 07:29:41.285920 | ubuntu-noble | MOLECULE_VERIFIER_NAME: testinfra 2026-06-17 07:29:41.285927 | ubuntu-noble | MOLECULE_VERIFIER_TEST_DIRECTORY: /home/zuul/src/github.com/osism/ansible-collection-services/molecule/delegated/tests 2026-06-17 07:29:41.285935 | ubuntu-noble | 2026-06-17 07:29:41.285961 | ubuntu-noble | DEBUG SHELL REPLAY: ANSIBLE_COLLECTIONS_PATH=/home/zuul/venv/.ansible/collections:/home/zuul/.ansible/collections ANSIBLE_CONFIG=/home/zuul/.ansible/tmp/molecule.oWZD.delegated/ansible.cfg ANSIBLE_LIBRARY=../../plugins ANSIBLE_PYTHON_INTERPRETER=/home/zuul/venv/bin/python ANSIBLE_ROLE=auditd ANSIBLE_ROLES_PATH=../../roles ANSIBLE_VERBOSITY=1 MOLECULE_DEBUG=True MOLECULE_DEPENDENCY_NAME=galaxy MOLECULE_DRIVER_NAME=default MOLECULE_ENV_FILE=/home/zuul/src/github.com/osism/ansible-collection-services/.env.yml MOLECULE_EPHEMERAL_DIRECTORY=/home/zuul/.ansible/tmp/molecule.oWZD.delegated MOLECULE_FILE=/home/zuul/.ansible/tmp/molecule.oWZD.delegated/molecule.yml MOLECULE_INSTANCE_CONFIG=/home/zuul/.ansible/tmp/molecule.oWZD.delegated/instance_config.yml MOLECULE_INVENTORY_FILE=/home/zuul/.ansible/tmp/molecule.oWZD.delegated/inventory/ansible_inventory.yml MOLECULE_PROJECT_DIRECTORY=/home/zuul/src/github.com/osism/ansible-collection-services MOLECULE_PROVISIONER_NAME=ansible MOLECULE_SCENARIO_DIRECTORY=/home/zuul/src/github.com/osism/ansible-collection-services/molecule/delegated MOLECULE_SCENARIO_NAME=delegated MOLECULE_STATE_FILE=/home/zuul/.ansible/tmp/molecule.oWZD.delegated/state.yml MOLECULE_VERIFIER_NAME=testinfra MOLECULE_VERIFIER_TEST_DIRECTORY=/home/zuul/src/github.com/osism/ansible-collection-services/molecule/delegated/tests 2026-06-17 07:29:41.570621 | ubuntu-noble | writing pytest debug information to pytestdebug.log 2026-06-17 07:29:41.593582 | ubuntu-noble | ============================= test session starts ============================== 2026-06-17 07:29:41.594129 | ubuntu-noble | platform linux -- Python 3.12.3, pytest-8.4.2, pluggy-1.6.0 -- /home/zuul/venv/bin/python3 2026-06-17 07:29:41.594459 | ubuntu-noble | using: pytest-8.4.2 2026-06-17 07:29:41.594818 | ubuntu-noble | registered third-party plugins: 2026-06-17 07:29:41.595249 | ubuntu-noble | pytest-testinfra-10.2.2 at /home/zuul/venv/lib/python3.12/site-packages/testinfra/plugin.py 2026-06-17 07:29:41.595614 | ubuntu-noble | rootdir: /home/zuul 2026-06-17 07:29:41.596168 | ubuntu-noble | plugins: testinfra-10.2.2 2026-06-17 07:29:42.219240 | debian-bookworm | collecting ... collected 6 items 2026-06-17 07:29:42.219548 | debian-bookworm | 2026-06-17 07:29:42.850606 | ubuntu-noble | collecting ... collected 6 items 2026-06-17 07:29:42.850677 | ubuntu-noble | 2026-06-17 07:29:46.436481 | debian-bookworm | tests/auditd.py::test_pkg[ansible://molecule-auditd] PASSED [ 16%] 2026-06-17 07:29:46.472914 | debian-bookworm | tests/auditd.py::test_conffile[ansible://molecule-auditd] PASSED [ 33%] 2026-06-17 07:29:47.648140 | ubuntu-noble | tests/auditd.py::test_pkg[ansible://molecule-auditd] PASSED [ 16%] 2026-06-17 07:29:47.686696 | ubuntu-noble | tests/auditd.py::test_conffile[ansible://molecule-auditd] PASSED [ 33%] 2026-06-17 07:29:48.847838 | debian-bookworm | tests/auditd.py::test_adjustment[ansible://molecule-auditd] PASSED [ 50%] 2026-06-17 07:29:50.517124 | ubuntu-noble | tests/auditd.py::test_adjustment[ansible://molecule-auditd] PASSED [ 50%] 2026-06-17 07:29:53.587307 | debian-bookworm | tests/auditd.py::test_rulefiles[ansible://molecule-auditd] PASSED [ 66%] 2026-06-17 07:29:54.802941 | debian-bookworm | tests/auditd.py::test_srv[ansible://molecule-auditd] PASSED [ 83%] 2026-06-17 07:29:54.869220 | debian-bookworm | wrote pytest debug information to pytestdebug.log 2026-06-17 07:29:54.870361 | debian-bookworm | tests/auditd.py::test_function[ansible://molecule-auditd] PASSED [100%] 2026-06-17 07:29:54.870391 | debian-bookworm | 2026-06-17 07:29:54.870398 | debian-bookworm | ============================== 6 passed in 13.61s ============================== 2026-06-17 07:29:54.910888 | debian-bookworm | INFO [delegated > verify] Verifier completed successfully. 2026-06-17 07:29:54.910999 | debian-bookworm | INFO [delegated > verify] Executed: Successful 2026-06-17 07:29:54.911019 | debian-bookworm | INFO Molecule executed 1 scenario (1 successful) 2026-06-17 07:29:55.296280 | debian-bookworm | ok: Runtime: 0:00:16.367137 2026-06-17 07:29:56.075629 | ubuntu-noble | tests/auditd.py::test_rulefiles[ansible://molecule-auditd] PASSED [ 66%] 2026-06-17 07:29:57.562442 | ubuntu-noble | tests/auditd.py::test_srv[ansible://molecule-auditd] PASSED [ 83%] 2026-06-17 07:29:57.648415 | ubuntu-noble | wrote pytest debug information to pytestdebug.log 2026-06-17 07:29:57.648473 | ubuntu-noble | tests/auditd.py::test_function[ansible://molecule-auditd] PASSED [100%] 2026-06-17 07:29:57.648486 | ubuntu-noble | 2026-06-17 07:29:57.648495 | ubuntu-noble | ============================== 6 passed in 16.01s ============================== 2026-06-17 07:29:57.703624 | ubuntu-noble | INFO [delegated > verify] Verifier completed successfully. 2026-06-17 07:29:57.703701 | ubuntu-noble | INFO [delegated > verify] Executed: Successful 2026-06-17 07:29:57.703787 | ubuntu-noble | INFO Molecule executed 1 scenario (1 successful) 2026-06-17 07:29:57.854427 | ubuntu-noble | ok: Runtime: 0:00:19.120635 2026-06-17 07:29:57.860812 | 2026-06-17 07:29:57.860942 | TASK [ansible-molecule : Run molecule destroy action with scenario delegated] 2026-06-17 07:29:58.427647 | debian-bookworm | skipping: Conditional result was False 2026-06-17 07:29:58.429205 | ubuntu-noble | skipping: Conditional result was False 2026-06-17 07:29:58.449135 | 2026-06-17 07:29:58.449280 | PLAY RECAP 2026-06-17 07:29:58.449354 | debian-bookworm | ok: 17 changed: 12 unreachable: 0 failed: 0 skipped: 16 rescued: 0 ignored: 0 2026-06-17 07:29:58.449394 | ubuntu-noble | ok: 17 changed: 12 unreachable: 0 failed: 0 skipped: 16 rescued: 0 ignored: 0 2026-06-17 07:29:58.449419 | 2026-06-17 07:29:58.657150 | RUN END RESULT_NORMAL: [untrusted : github.com/osism/zuul-jobs/playbooks/ansible-molecule/run.yaml@main] 2026-06-17 07:29:58.658754 | POST-RUN START: [untrusted : github.com/osism/ansible-collection-services/playbooks/collect-container-logs.yml@main] 2026-06-17 07:29:59.468050 | 2026-06-17 07:29:59.468240 | PLAY [Collect container logs] 2026-06-17 07:29:59.483379 | 2026-06-17 07:29:59.483534 | TASK [Create container log directory] 2026-06-17 07:30:00.148302 | debian-bookworm | changed 2026-06-17 07:30:00.206828 | ubuntu-noble | changed 2026-06-17 07:30:00.212859 | 2026-06-17 07:30:00.213007 | TASK [Capture container overview] 2026-06-17 07:30:00.809990 | debian-bookworm | ok: Runtime: 0:00:00.006399 2026-06-17 07:30:00.891074 | ubuntu-noble | ok: Runtime: 0:00:00.010121 2026-06-17 07:30:00.899362 | 2026-06-17 07:30:00.899498 | TASK [List containers] 2026-06-17 07:30:01.472621 | debian-bookworm | ok: ERROR (ignored) 2026-06-17 07:30:01.473329 | debian-bookworm | { 2026-06-17 07:30:01.473471 | debian-bookworm | "failed_when_result": false, 2026-06-17 07:30:01.473546 | debian-bookworm | "msg": "[Errno 2] No such file or directory: b'docker'", 2026-06-17 07:30:01.473629 | debian-bookworm | "rc": 2 2026-06-17 07:30:01.473700 | debian-bookworm | } 2026-06-17 07:30:01.491303 | ubuntu-noble | ok: ERROR (ignored) 2026-06-17 07:30:01.491476 | ubuntu-noble | { 2026-06-17 07:30:01.491515 | ubuntu-noble | "failed_when_result": false, 2026-06-17 07:30:01.491540 | ubuntu-noble | "msg": "[Errno 2] No such file or directory: b'docker'", 2026-06-17 07:30:01.491563 | ubuntu-noble | "rc": 2 2026-06-17 07:30:01.491584 | ubuntu-noble | } 2026-06-17 07:30:01.496919 | 2026-06-17 07:30:01.497029 | LOOP [Save per-container logs] 2026-06-17 07:30:01.564383 | 2026-06-17 07:30:01.564667 | LOOP [Save per-container inspect (state and health)] 2026-06-17 07:30:01.630171 | 2026-06-17 07:30:01.630389 | TASK [Open container log permissions] 2026-06-17 07:30:01.906875 | debian-bookworm | ok 2026-06-17 07:30:01.991471 | ubuntu-noble | changed 2026-06-17 07:30:01.994455 | 2026-06-17 07:30:01.994576 | PLAY RECAP 2026-06-17 07:30:01.994666 | debian-bookworm | ok: 4 changed: 1 unreachable: 0 failed: 0 skipped: 2 rescued: 0 ignored: 0 2026-06-17 07:30:01.994713 | ubuntu-noble | ok: 4 changed: 2 unreachable: 0 failed: 0 skipped: 2 rescued: 0 ignored: 0 2026-06-17 07:30:01.994744 | 2026-06-17 07:30:02.180601 | POST-RUN END RESULT_NORMAL: [untrusted : github.com/osism/ansible-collection-services/playbooks/collect-container-logs.yml@main] 2026-06-17 07:30:02.184039 | POST-RUN START: [trusted : github.com/osism/zuul-config/playbooks/base/post-fetch.yaml@main] 2026-06-17 07:30:03.093407 | 2026-06-17 07:30:03.093602 | PLAY [Base post-fetch] 2026-06-17 07:30:03.110312 | 2026-06-17 07:30:03.110470 | TASK [diagnose-network : Ensure log directory exists] 2026-06-17 07:30:03.820375 | debian-bookworm | ok 2026-06-17 07:30:03.864590 | ubuntu-noble | ok 2026-06-17 07:30:03.878054 | 2026-06-17 07:30:03.878288 | TASK [diagnose-network : Snapshot dual-stack network state (post)] 2026-06-17 07:30:21.098818 | debian-bookworm | ok: Runtime: 0:00:15.708546 2026-06-17 07:30:42.415070 | ubuntu-noble | ok: Runtime: 0:00:34.777428 2026-06-17 07:30:42.425996 | 2026-06-17 07:30:42.426179 | TASK [diagnose-network : Snapshot Docker/BuildKit IPv6 config (teardown)] 2026-06-17 07:30:48.462491 | debian-bookworm | ok: Runtime: 0:00:00.011701 2026-06-17 07:30:48.676994 | ubuntu-noble | ok: Runtime: 0:00:00.011448 2026-06-17 07:30:48.686106 | 2026-06-17 07:30:48.686290 | TASK [diagnose-network : Probe container network namespace (teardown)] 2026-06-17 07:30:54.773066 | debian-bookworm | ok: Runtime: 0:00:00.004804 2026-06-17 07:30:54.991152 | ubuntu-noble | ok: Runtime: 0:00:00.007183 2026-06-17 07:30:55.009485 | 2026-06-17 07:30:55.009667 | TASK [fetch-output : Set log path for multiple nodes] 2026-06-17 07:30:55.087595 | debian-bookworm | ok 2026-06-17 07:30:55.094165 | ubuntu-noble | ok 2026-06-17 07:30:55.101093 | 2026-06-17 07:30:55.101231 | TASK [fetch-output : Set log path for single node] 2026-06-17 07:30:55.128701 | debian-bookworm | skipping: Conditional result was False 2026-06-17 07:30:55.149918 | ubuntu-noble | skipping: Conditional result was False 2026-06-17 07:30:55.158107 | 2026-06-17 07:30:55.158274 | LOOP [fetch-output : Ensure local output dirs] 2026-06-17 07:30:55.542463 | ubuntu-noble -> localhost | changed: "/var/lib/zuul/builds/19c697b6ccd84cbe82711b4ab4f02a9d/work/logs/ubuntu-noble" 2026-06-17 07:30:55.564379 | debian-bookworm -> localhost | changed: "/var/lib/zuul/builds/19c697b6ccd84cbe82711b4ab4f02a9d/work/logs/debian-bookworm" 2026-06-17 07:30:55.828657 | ubuntu-noble -> localhost | changed: "/var/lib/zuul/builds/19c697b6ccd84cbe82711b4ab4f02a9d/work/artifacts" 2026-06-17 07:30:55.985670 | debian-bookworm -> localhost | ok: "/var/lib/zuul/builds/19c697b6ccd84cbe82711b4ab4f02a9d/work/artifacts" 2026-06-17 07:30:56.139202 | ubuntu-noble -> localhost | changed: "/var/lib/zuul/builds/19c697b6ccd84cbe82711b4ab4f02a9d/work/docs" 2026-06-17 07:30:56.264381 | debian-bookworm -> localhost | ok: "/var/lib/zuul/builds/19c697b6ccd84cbe82711b4ab4f02a9d/work/docs" 2026-06-17 07:30:56.264562 | debian-bookworm -> localhost | changed: All items complete 2026-06-17 07:30:56.264599 | 2026-06-17 07:30:56.284125 | 2026-06-17 07:30:56.284329 | LOOP [fetch-output : Collect logs, artifacts and docs] 2026-06-17 07:30:57.143872 | debian-bookworm | changed: 2026-06-17 07:30:57.144244 | debian-bookworm | .d..t...... ./ 2026-06-17 07:30:57.144294 | debian-bookworm | >f+++++++++ net-debug.post.txt 2026-06-17 07:30:57.144326 | debian-bookworm | >f+++++++++ net-debug.pre.txt 2026-06-17 07:30:57.144354 | debian-bookworm | >f+++++++++ sudo-debug.txt 2026-06-17 07:30:57.144383 | debian-bookworm | >f+++++++++ sudo-strace.log 2026-06-17 07:30:57.144409 | debian-bookworm | >f+++++++++ sudo-strace.log.time 2026-06-17 07:30:57.144435 | debian-bookworm | cd+++++++++ container-logs/ 2026-06-17 07:30:57.144460 | debian-bookworm | >f+++++++++ container-logs/_overview.txt 2026-06-17 07:30:57.240395 | ubuntu-noble | changed: 2026-06-17 07:30:57.240586 | ubuntu-noble | .d..t...... ./ 2026-06-17 07:30:57.245581 | ubuntu-noble | >f+++++++++ net-debug.post.txt 2026-06-17 07:30:57.246451 | ubuntu-noble | >f+++++++++ net-debug.pre.txt 2026-06-17 07:30:57.246489 | ubuntu-noble | >f+++++++++ sudo-debug.txt 2026-06-17 07:30:57.246515 | ubuntu-noble | >f+++++++++ sudo-strace.log 2026-06-17 07:30:57.246556 | ubuntu-noble | >f+++++++++ sudo-strace.log.time 2026-06-17 07:30:57.246579 | ubuntu-noble | cd+++++++++ container-logs/ 2026-06-17 07:30:57.246601 | ubuntu-noble | >f+++++++++ container-logs/_overview.txt 2026-06-17 07:30:57.843059 | debian-bookworm | changed: .d..t...... ./ 2026-06-17 07:30:57.952158 | ubuntu-noble | ok 2026-06-17 07:30:58.620948 | debian-bookworm | changed: .d..t...... ./ 2026-06-17 07:30:58.670222 | ubuntu-noble | ok 2026-06-17 07:30:58.670420 | ubuntu-noble | changed: All items complete 2026-06-17 07:30:58.670479 | 2026-06-17 07:30:58.697453 | 2026-06-17 07:30:58.697618 | LOOP [merge-output-to-logs : Move artifacts and docs to logs dir] 2026-06-17 07:30:59.078092 | debian-bookworm -> localhost | ok: Item: artifacts Runtime: 0:00:00.007183 2026-06-17 07:30:59.379833 | debian-bookworm -> localhost | ok: Item: docs Runtime: 0:00:00.009851 2026-06-17 07:30:59.410195 | 2026-06-17 07:30:59.410723 | PLAY RECAP 2026-06-17 07:30:59.411017 | debian-bookworm | ok: 8 changed: 3 unreachable: 0 failed: 0 skipped: 1 rescued: 0 ignored: 0 2026-06-17 07:30:59.411101 | ubuntu-noble | ok: 7 changed: 2 unreachable: 0 failed: 0 skipped: 1 rescued: 0 ignored: 0 2026-06-17 07:30:59.411142 | 2026-06-17 07:30:59.594614 | POST-RUN END RESULT_NORMAL: [trusted : github.com/osism/zuul-config/playbooks/base/post-fetch.yaml@main] 2026-06-17 07:30:59.596166 | POST-RUN START: [trusted : github.com/osism/zuul-config/playbooks/base/post.yaml@main] 2026-06-17 07:31:00.468167 | 2026-06-17 07:31:00.468367 | PLAY [Base post] 2026-06-17 07:31:00.488238 | 2026-06-17 07:31:00.488512 | TASK [remove-build-sshkey : Remove the build SSH key from all nodes] 2026-06-17 07:31:01.434464 | debian-bookworm | changed 2026-06-17 07:31:01.468913 | ubuntu-noble | changed 2026-06-17 07:31:01.484379 | 2026-06-17 07:31:01.484519 | PLAY RECAP 2026-06-17 07:31:01.484617 | debian-bookworm | ok: 1 changed: 1 unreachable: 0 failed: 0 skipped: 0 rescued: 0 ignored: 0 2026-06-17 07:31:01.484698 | ubuntu-noble | ok: 1 changed: 1 unreachable: 0 failed: 0 skipped: 0 rescued: 0 ignored: 0 2026-06-17 07:31:01.484724 | 2026-06-17 07:31:01.655962 | POST-RUN END RESULT_NORMAL: [trusted : github.com/osism/zuul-config/playbooks/base/post.yaml@main] 2026-06-17 07:31:01.659769 | POST-RUN START: [trusted : github.com/osism/zuul-config/playbooks/base/post-logs.yaml@main] 2026-06-17 07:31:02.611602 | 2026-06-17 07:31:02.611822 | PLAY [Base post-logs] 2026-06-17 07:31:02.624292 | 2026-06-17 07:31:02.624448 | TASK [generate-zuul-manifest : Generate Zuul manifest] 2026-06-17 07:31:03.120712 | localhost | changed 2026-06-17 07:31:03.137744 | 2026-06-17 07:31:03.137928 | TASK [generate-zuul-manifest : Return Zuul manifest URL to Zuul] 2026-06-17 07:31:03.175428 | localhost | ok 2026-06-17 07:31:03.180654 | 2026-06-17 07:31:03.180782 | TASK [Set zuul-log-path fact] 2026-06-17 07:31:03.198367 | localhost | ok 2026-06-17 07:31:03.209182 | 2026-06-17 07:31:03.209315 | TASK [set-zuul-log-path-fact : Set log path for a build] 2026-06-17 07:31:03.235725 | localhost | ok 2026-06-17 07:31:03.240054 | 2026-06-17 07:31:03.240181 | TASK [upload-logs : Create log directories] 2026-06-17 07:31:03.772519 | localhost | changed 2026-06-17 07:31:03.776469 | 2026-06-17 07:31:03.776596 | TASK [upload-logs : Ensure logs are readable before uploading] 2026-06-17 07:31:04.404273 | localhost -> localhost | ok: Runtime: 0:00:00.021386 2026-06-17 07:31:04.409547 | 2026-06-17 07:31:04.409701 | TASK [upload-logs : Upload logs to log server] 2026-06-17 07:31:05.013421 | localhost | Output suppressed because no_log was given 2026-06-17 07:31:05.015661 | 2026-06-17 07:31:05.015783 | LOOP [upload-logs : Compress console log and json output] 2026-06-17 07:31:05.070699 | localhost | skipping: Conditional result was False 2026-06-17 07:31:05.076202 | localhost | skipping: Conditional result was False 2026-06-17 07:31:05.088936 | 2026-06-17 07:31:05.089159 | LOOP [upload-logs : Upload compressed console log and json output] 2026-06-17 07:31:05.143374 | localhost | skipping: Conditional result was False 2026-06-17 07:31:05.143744 | 2026-06-17 07:31:05.148648 | localhost | skipping: Conditional result was False 2026-06-17 07:31:05.157263 | 2026-06-17 07:31:05.157391 | LOOP [upload-logs : Upload console log and json output]