2026-06-02 13:33:10.865857 | Job console starting 2026-06-02 13:33:10.905880 | Updating git repos 2026-06-02 13:33:10.998855 | Cloning repos into workspace 2026-06-02 13:33:11.106081 | Restoring repo states 2026-06-02 13:33:11.144853 | Merging changes 2026-06-02 13:33:12.024250 | Checking out repos 2026-06-02 13:33:12.131501 | Preparing playbooks 2026-06-02 13:33:13.110388 | Running Ansible setup 2026-06-02 13:33:18.717601 | PRE-RUN START: [trusted : github.com/osism/zuul-config/playbooks/base/pre.yaml@main] 2026-06-02 13:33:19.512463 | 2026-06-02 13:33:19.512717 | PLAY [Base pre] 2026-06-02 13:33:19.537477 | 2026-06-02 13:33:19.537626 | TASK [Setup log path fact] 2026-06-02 13:33:19.570820 | debian-bookworm | ok 2026-06-02 13:33:19.590576 | 2026-06-02 13:33:19.590787 | TASK [set-zuul-log-path-fact : Set log path for a build] 2026-06-02 13:33:19.621311 | debian-bookworm | ok 2026-06-02 13:33:19.632856 | 2026-06-02 13:33:19.632991 | TASK [emit-job-header : Print job information] 2026-06-02 13:33:19.691240 | # Job Information 2026-06-02 13:33:19.691571 | Ansible Version: 2.16.14 2026-06-02 13:33:19.691638 | Job: ansible-collection-services-molecule-auditd 2026-06-02 13:33:19.691767 | Pipeline: check 2026-06-02 13:33:19.691814 | Executor: 521e9411259a 2026-06-02 13:33:19.691853 | Triggered by: https://github.com/osism/ansible-collection-services/pull/2090 2026-06-02 13:33:19.691893 | Event ID: 7db7cef0-5e87-11f1-844c-661a41d23767 2026-06-02 13:33:19.702159 | 2026-06-02 13:33:19.702324 | LOOP [emit-job-header : Print node information] 2026-06-02 13:33:19.822226 | debian-bookworm | ok: 2026-06-02 13:33:19.822754 | debian-bookworm | # Node Information 2026-06-02 13:33:19.822878 | debian-bookworm | Inventory Hostname: debian-bookworm 2026-06-02 13:33:19.823001 | debian-bookworm | Hostname: debian 2026-06-02 13:33:19.823054 | debian-bookworm | Username: zuul 2026-06-02 13:33:19.823105 | debian-bookworm | Distro: Debian 12.14 2026-06-02 13:33:19.823175 | debian-bookworm | Provider: regiocloud-a 2026-06-02 13:33:19.823238 | debian-bookworm | Region: 2026-06-02 13:33:19.823286 | debian-bookworm | Label: debian-bookworm 2026-06-02 13:33:19.823332 | debian-bookworm | Product Name: OpenStack Nova 2026-06-02 13:33:19.823378 | debian-bookworm | Interface IP: 2a13:1a81:8000:3124:f816:3eff:febf:e1be 2026-06-02 13:33:19.870496 | debian-bookworm | ok: 2026-06-02 13:33:19.870658 | debian-bookworm | # Node Information 2026-06-02 13:33:19.870776 | debian-bookworm | Inventory Hostname: ubuntu-noble 2026-06-02 13:33:19.870818 | debian-bookworm | Hostname: ubuntu 2026-06-02 13:33:19.870912 | debian-bookworm | Username: zuul 2026-06-02 13:33:19.871014 | debian-bookworm | Distro: Ubuntu 24.04 2026-06-02 13:33:19.871050 | debian-bookworm | Provider: regiocloud-a 2026-06-02 13:33:19.871086 | debian-bookworm | Region: 2026-06-02 13:33:19.871118 | debian-bookworm | Label: ubuntu-noble 2026-06-02 13:33:19.871149 | debian-bookworm | Product Name: OpenStack Nova 2026-06-02 13:33:19.871180 | debian-bookworm | Interface IP: 2a13:1a81:8000:3124:f816:3eff:fe8f:1672 2026-06-02 13:33:19.892018 | 2026-06-02 13:33:19.892169 | TASK [log-inventory : Ensure Zuul Ansible directory exists] 2026-06-02 13:33:20.415305 | debian-bookworm -> localhost | changed 2026-06-02 13:33:20.429285 | 2026-06-02 13:33:20.429443 | TASK [log-inventory : Copy ansible inventory to logs dir] 2026-06-02 13:33:21.565698 | ubuntu-noble -> localhost | changed 2026-06-02 13:33:21.589740 | debian-bookworm -> localhost | ok 2026-06-02 13:33:21.616347 | 2026-06-02 13:33:21.616495 | TASK [add-build-sshkey : Check to see if ssh key was already created for this build] 2026-06-02 13:33:21.924881 | debian-bookworm -> localhost | ok 2026-06-02 13:33:21.931889 | 2026-06-02 13:33:21.932017 | TASK [add-build-sshkey : Create a new key in workspace based on build UUID] 2026-06-02 13:33:21.965168 | debian-bookworm | ok 2026-06-02 13:33:21.979954 | ubuntu-noble | ok 2026-06-02 13:33:22.013200 | debian-bookworm | included: /var/lib/zuul/builds/289bcbed15f346aa938a30f6511b3f95/trusted/project_1/github.com/osism/openinfra-zuul-jobs/roles/add-build-sshkey/tasks/create-key-and-replace.yaml 2026-06-02 13:33:22.013334 | ubuntu-noble | included: /var/lib/zuul/builds/289bcbed15f346aa938a30f6511b3f95/trusted/project_1/github.com/osism/openinfra-zuul-jobs/roles/add-build-sshkey/tasks/create-key-and-replace.yaml 2026-06-02 13:33:22.021711 | 2026-06-02 13:33:22.021823 | TASK [add-build-sshkey : Create Temp SSH key] 2026-06-02 13:33:23.275457 | debian-bookworm -> localhost | Generating public/private rsa key pair. 2026-06-02 13:33:23.275726 | debian-bookworm -> localhost | Your identification has been saved in /var/lib/zuul/builds/289bcbed15f346aa938a30f6511b3f95/work/289bcbed15f346aa938a30f6511b3f95_id_rsa 2026-06-02 13:33:23.275766 | debian-bookworm -> localhost | Your public key has been saved in /var/lib/zuul/builds/289bcbed15f346aa938a30f6511b3f95/work/289bcbed15f346aa938a30f6511b3f95_id_rsa.pub 2026-06-02 13:33:23.275792 | debian-bookworm -> localhost | The key fingerprint is: 2026-06-02 13:33:23.275819 | debian-bookworm -> localhost | SHA256:v7h5IaUlorUE6nWeOw78xrWLyhyKO7d//0jZyQUMvYA zuul-build-sshkey 2026-06-02 13:33:23.275843 | debian-bookworm -> localhost | The key's randomart image is: 2026-06-02 13:33:23.275869 | debian-bookworm -> localhost | +---[RSA 3072]----+ 2026-06-02 13:33:23.275939 | debian-bookworm -> localhost | | ... | 2026-06-02 13:33:23.275964 | debian-bookworm -> localhost | | . E .o. | 2026-06-02 13:33:23.275985 | debian-bookworm -> localhost | | . . .o. | 2026-06-02 13:33:23.276006 | debian-bookworm -> localhost | | . . = . +. | 2026-06-02 13:33:23.276026 | debian-bookworm -> localhost | | . . * +S= . | 2026-06-02 13:33:23.276047 | debian-bookworm -> localhost | | ... + +=.o | 2026-06-02 13:33:23.276067 | debian-bookworm -> localhost | | +. ooo=. | 2026-06-02 13:33:23.276087 | debian-bookworm -> localhost | |...+ +*o.+.. | 2026-06-02 13:33:23.276107 | debian-bookworm -> localhost | |o+oo==+oB=o | 2026-06-02 13:33:23.276127 | debian-bookworm -> localhost | +----[SHA256]-----+ 2026-06-02 13:33:23.276181 | debian-bookworm -> localhost | ok: Runtime: 0:00:00.731595 2026-06-02 13:33:23.283070 | 2026-06-02 13:33:23.283191 | TASK [add-build-sshkey : Remote setup ssh keys (linux)] 2026-06-02 13:33:23.306898 | debian-bookworm | ok 2026-06-02 13:33:23.321705 | ubuntu-noble | ok 2026-06-02 13:33:23.336149 | debian-bookworm | included: /var/lib/zuul/builds/289bcbed15f346aa938a30f6511b3f95/trusted/project_1/github.com/osism/openinfra-zuul-jobs/roles/add-build-sshkey/tasks/remote-linux.yaml 2026-06-02 13:33:23.336254 | ubuntu-noble | included: /var/lib/zuul/builds/289bcbed15f346aa938a30f6511b3f95/trusted/project_1/github.com/osism/openinfra-zuul-jobs/roles/add-build-sshkey/tasks/remote-linux.yaml 2026-06-02 13:33:23.347838 | 2026-06-02 13:33:23.347961 | TASK [add-build-sshkey : Remove previously added zuul-build-sshkey] 2026-06-02 13:33:23.374199 | debian-bookworm | skipping: Conditional result was False 2026-06-02 13:33:23.385217 | ubuntu-noble | skipping: Conditional result was False 2026-06-02 13:33:23.398876 | 2026-06-02 13:33:23.398989 | TASK [add-build-sshkey : Enable access via build key on all nodes] 2026-06-02 13:33:24.069364 | debian-bookworm | changed 2026-06-02 13:33:24.156152 | ubuntu-noble | changed 2026-06-02 13:33:24.168009 | 2026-06-02 13:33:24.168196 | TASK [add-build-sshkey : Make sure user has a .ssh] 2026-06-02 13:33:24.416158 | debian-bookworm | ok 2026-06-02 13:33:24.500304 | ubuntu-noble | ok 2026-06-02 13:33:24.509928 | 2026-06-02 13:33:24.510087 | TASK [add-build-sshkey : Install build private key as SSH key on all nodes] 2026-06-02 13:33:25.188739 | debian-bookworm | changed 2026-06-02 13:33:25.316942 | ubuntu-noble | changed 2026-06-02 13:33:25.328827 | 2026-06-02 13:33:25.329128 | TASK [add-build-sshkey : Install build public key as SSH key on all nodes] 2026-06-02 13:33:25.987939 | debian-bookworm | changed 2026-06-02 13:33:26.118264 | ubuntu-noble | changed 2026-06-02 13:33:26.125104 | 2026-06-02 13:33:26.125228 | TASK [add-build-sshkey : Remote setup ssh keys (windows)] 2026-06-02 13:33:26.162932 | debian-bookworm | skipping: Conditional result was False 2026-06-02 13:33:26.163480 | ubuntu-noble | skipping: Conditional result was False 2026-06-02 13:33:26.171322 | 2026-06-02 13:33:26.171454 | TASK [remove-zuul-sshkey : Remove master key from local agent] 2026-06-02 13:33:26.731689 | debian-bookworm -> localhost | changed 2026-06-02 13:33:26.749062 | 2026-06-02 13:33:26.749199 | TASK [add-build-sshkey : Add back temp key] 2026-06-02 13:33:27.175130 | debian-bookworm -> localhost | Identity added: /var/lib/zuul/builds/289bcbed15f346aa938a30f6511b3f95/work/289bcbed15f346aa938a30f6511b3f95_id_rsa (zuul-build-sshkey) 2026-06-02 13:33:27.175375 | debian-bookworm -> localhost | ok: Runtime: 0:00:00.015897 2026-06-02 13:33:27.182416 | 2026-06-02 13:33:27.182535 | TASK [add-build-sshkey : Verify we can still SSH to all nodes] 2026-06-02 13:33:27.567253 | debian-bookworm | ok 2026-06-02 13:33:27.602747 | ubuntu-noble | ok 2026-06-02 13:33:27.611340 | 2026-06-02 13:33:27.611481 | TASK [add-build-sshkey : Verify we can still SSH to all nodes (windows)] 2026-06-02 13:33:27.648614 | debian-bookworm | skipping: Conditional result was False 2026-06-02 13:33:27.691120 | ubuntu-noble | skipping: Conditional result was False 2026-06-02 13:33:27.710417 | 2026-06-02 13:33:27.710559 | TASK [start-zuul-console : Start zuul_console daemon.] 2026-06-02 13:33:28.100503 | debian-bookworm | ok 2026-06-02 13:33:28.176881 | ubuntu-noble | ok 2026-06-02 13:33:28.205582 | 2026-06-02 13:33:28.205740 | TASK [validate-host : Define zuul_info_dir fact] 2026-06-02 13:33:28.296116 | debian-bookworm | ok 2026-06-02 13:33:28.329857 | ubuntu-noble | ok 2026-06-02 13:33:28.338717 | 2026-06-02 13:33:28.350940 | TASK [validate-host : Ensure Zuul Ansible directory exists] 2026-06-02 13:33:28.857860 | debian-bookworm -> localhost | ok 2026-06-02 13:33:28.873228 | 2026-06-02 13:33:28.873396 | TASK [validate-host : Collect information about the host] 2026-06-02 13:33:29.966356 | debian-bookworm | ok 2026-06-02 13:33:30.106473 | ubuntu-noble | ok 2026-06-02 13:33:30.133115 | 2026-06-02 13:33:30.133266 | TASK [validate-host : Sanitize hostname] 2026-06-02 13:33:30.249126 | debian-bookworm | ok 2026-06-02 13:33:30.257855 | ubuntu-noble | ok 2026-06-02 13:33:30.267790 | 2026-06-02 13:33:30.267947 | TASK [validate-host : Write out all ansible variables/facts known for each host] 2026-06-02 13:33:31.371361 | debian-bookworm -> localhost | changed 2026-06-02 13:33:31.443580 | ubuntu-noble -> localhost | changed 2026-06-02 13:33:31.449807 | 2026-06-02 13:33:31.449932 | TASK [validate-host : Collect information about zuul worker] 2026-06-02 13:33:32.084268 | debian-bookworm | ok 2026-06-02 13:33:32.142739 | ubuntu-noble | ok 2026-06-02 13:33:32.149998 | 2026-06-02 13:33:32.150147 | TASK [validate-host : Write out all zuul information for each host] 2026-06-02 13:33:32.734277 | debian-bookworm -> localhost | changed 2026-06-02 13:33:32.776143 | ubuntu-noble -> localhost | changed 2026-06-02 13:33:32.789428 | 2026-06-02 13:33:32.789549 | TASK [prepare-workspace-log : Start zuul_console daemon.] 2026-06-02 13:33:33.034405 | debian-bookworm | ok 2026-06-02 13:33:33.069764 | ubuntu-noble | ok 2026-06-02 13:33:33.075458 | 2026-06-02 13:33:33.075570 | TASK [prepare-workspace-log : Synchronize src repos to workspace directory.] 2026-06-02 13:33:34.260576 | debian-bookworm | changed: 2026-06-02 13:33:34.260866 | debian-bookworm | cd+++++++++ src/ 2026-06-02 13:33:34.260905 | debian-bookworm | cd+++++++++ src/github.com/ 2026-06-02 13:33:34.260929 | debian-bookworm | cd+++++++++ src/github.com/osism/ 2026-06-02 13:33:34.260951 | debian-bookworm | cd+++++++++ src/github.com/osism/ansible-collection-services/ 2026-06-02 13:33:34.260972 | debian-bookworm | config] provisioner.env found in /home/zuul/src/github.com/osism/ansible-collection-services/molecule/delegated/molecule.yml, this can be defined in ansible.env 2026-06-02 13:34:58.771089 | ubuntu-noble | WARNING Molecule scenarios should migrate to 'extensions/molecule' 2026-06-02 13:34:58.809066 | ubuntu-noble | DEBUG [unknown > config] provisioner.env found in /home/zuul/src/github.com/osism/ansible-collection-services/molecule/delegated/molecule.yml, this can be defined in ansible.env 2026-06-02 13:34:59.198342 | debian-bookworm | DEBUG [unknown > config] provisioner.env found in /home/zuul/src/github.com/osism/ansible-collection-services/molecule/delegated/molecule.yml, this can be defined in ansible.env 2026-06-02 13:34:59.198919 | debian-bookworm | DEBUG [delegated > validate] Validating schema /home/zuul/src/github.com/osism/ansible-collection-services/molecule/delegated/molecule.yml. 2026-06-02 13:34:59.218905 | debian-bookworm | DEBUG [default > validate] Validating schema /home/zuul/src/github.com/osism/ansible-collection-services/molecule/default/molecule.yml. 2026-06-02 13:34:59.224257 | debian-bookworm | INFO [delegated > discovery] scenario test matrix: dependency 2026-06-02 13:34:59.224355 | debian-bookworm | INFO [delegated > prerun] Performing prerun with role_name_check=0... 2026-06-02 13:34:59.366036 | ubuntu-noble | DEBUG [unknown > config] provisioner.env found in /home/zuul/src/github.com/osism/ansible-collection-services/molecule/delegated/molecule.yml, this can be defined in ansible.env 2026-06-02 13:34:59.366824 | ubuntu-noble | DEBUG [delegated > validate] Validating schema /home/zuul/src/github.com/osism/ansible-collection-services/molecule/delegated/molecule.yml. 2026-06-02 13:34:59.387526 | ubuntu-noble | DEBUG [default > validate] Validating schema /home/zuul/src/github.com/osism/ansible-collection-services/molecule/default/molecule.yml. 2026-06-02 13:34:59.393493 | ubuntu-noble | INFO [delegated > discovery] scenario test matrix: dependency 2026-06-02 13:34:59.393547 | ubuntu-noble | INFO [delegated > prerun] Performing prerun with role_name_check=0... 2026-06-02 13:35:00.381216 | debian-bookworm | INFO [delegated > dependency] Executing 2026-06-02 13:35:00.381445 | debian-bookworm | WARNING [delegated > dependency] Missing roles requirements file: requirements.yml 2026-06-02 13:35:00.726338 | debian-bookworm | ansible-galaxy [core 2.18.17] 2026-06-02 13:35:00.726812 | debian-bookworm | config file = None 2026-06-02 13:35:00.727278 | debian-bookworm | configured module search path = ['/home/zuul/src/github.com/osism/ansible-collection-services/plugins/modules', '/home/zuul/.ansible/plugins/modules', '/usr/share/ansible/plugins/modules'] 2026-06-02 13:35:00.727758 | debian-bookworm | ansible python module location = /home/zuul/venv/lib/python3.11/site-packages/ansible 2026-06-02 13:35:00.728153 | debian-bookworm | ansible collection location = /home/zuul/.ansible/collections:/usr/share/ansible/collections:/home/zuul/venv/lib/python3.11/site-packages:/home/zuul/venv/lib/python3.11/dist-packages:/home/zuul/venv/lib/python3/dist-packages:/home/zuul/venv/local/lib/python3.11/dist-packages 2026-06-02 13:35:00.728482 | debian-bookworm | executable location = /home/zuul/venv/bin/ansible-galaxy 2026-06-02 13:35:00.728825 | debian-bookworm | python version = 3.11.2 (main, Apr 8 2026, 01:58:00) [GCC 12.2.0] (/home/zuul/venv/bin/python3) 2026-06-02 13:35:00.729174 | debian-bookworm | jinja version = 3.1.6 2026-06-02 13:35:00.729475 | debian-bookworm | libyaml = True 2026-06-02 13:35:00.729814 | debian-bookworm | No config file found; using defaults 2026-06-02 13:35:00.730293 | debian-bookworm | Reading requirement file at '/home/zuul/src/github.com/osism/ansible-collection-services/molecule/delegated/collections.yml' 2026-06-02 13:35:00.731461 | debian-bookworm | Loading collection osism.services from /home/zuul/.ansible/collections/ansible_collections/osism/services 2026-06-02 13:35:00.731864 | debian-bookworm | Found installed collection osism.services:999.0.0 at '/home/zuul/.ansible/collections/ansible_collections/osism/services' 2026-06-02 13:35:00.736559 | debian-bookworm | Loading collection ansible.windows from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/ansible/windows 2026-06-02 13:35:00.736931 | debian-bookworm | Found installed collection ansible.windows:2.8.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/ansible/windows' 2026-06-02 13:35:00.738682 | debian-bookworm | Loading collection theforeman.foreman from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/theforeman/foreman 2026-06-02 13:35:00.739694 | debian-bookworm | Found installed collection theforeman.foreman:4.2.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/theforeman/foreman' 2026-06-02 13:35:00.740181 | debian-bookworm | Loading collection netapp.storagegrid from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/netapp/storagegrid 2026-06-02 13:35:00.740522 | debian-bookworm | Found installed collection netapp.storagegrid:21.14.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/netapp/storagegrid' 2026-06-02 13:35:00.741533 | debian-bookworm | Loading collection amazon.aws from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/amazon/aws 2026-06-02 13:35:00.742024 | debian-bookworm | Found installed collection amazon.aws:9.5.2 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/amazon/aws' 2026-06-02 13:35:00.742330 | debian-bookworm | Loading collection cloud.common from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/cloud/common 2026-06-02 13:35:00.742750 | debian-bookworm | Found installed collection cloud.common:4.2.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/cloud/common' 2026-06-02 13:35:00.743128 | debian-bookworm | Loading collection ibm.qradar from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/ibm/qradar 2026-06-02 13:35:00.743585 | debian-bookworm | Found installed collection ibm.qradar:4.0.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/ibm/qradar' 2026-06-02 13:35:00.743895 | debian-bookworm | Loading collection purestorage.flashblade from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/purestorage/flashblade 2026-06-02 13:35:00.744267 | debian-bookworm | Found installed collection purestorage.flashblade:1.22.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/purestorage/flashblade' 2026-06-02 13:35:00.745984 | debian-bookworm | Loading collection cisco.meraki from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/cisco/meraki 2026-06-02 13:35:00.746357 | debian-bookworm | Found installed collection cisco.meraki:2.21.8 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/cisco/meraki' 2026-06-02 13:35:00.747699 | debian-bookworm | Loading collection google.cloud from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/google/cloud 2026-06-02 13:35:00.748143 | debian-bookworm | Found installed collection google.cloud:1.9.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/google/cloud' 2026-06-02 13:35:00.748431 | debian-bookworm | Loading collection cisco.ucs from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/cisco/ucs 2026-06-02 13:35:00.748753 | debian-bookworm | Found installed collection cisco.ucs:1.16.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/cisco/ucs' 2026-06-02 13:35:00.749144 | debian-bookworm | Loading collection infinidat.infinibox from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/infinidat/infinibox 2026-06-02 13:35:00.749431 | debian-bookworm | Found installed collection infinidat.infinibox:1.6.3 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/infinidat/infinibox' 2026-06-02 13:35:00.749829 | debian-bookworm | Loading collection kubernetes.core from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/kubernetes/core 2026-06-02 13:35:00.750104 | debian-bookworm | Found installed collection kubernetes.core:5.4.1 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/kubernetes/core' 2026-06-02 13:35:00.750383 | debian-bookworm | Loading collection sensu.sensu_go from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/sensu/sensu_go 2026-06-02 13:35:00.750828 | debian-bookworm | Found installed collection sensu.sensu_go:1.14.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/sensu/sensu_go' 2026-06-02 13:35:00.751105 | debian-bookworm | Loading collection openstack.cloud from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/openstack/cloud 2026-06-02 13:35:00.751500 | debian-bookworm | Found installed collection openstack.cloud:2.5.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/openstack/cloud' 2026-06-02 13:35:00.753673 | debian-bookworm | Loading collection vmware.vmware_rest from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/vmware/vmware_rest 2026-06-02 13:35:00.754013 | debian-bookworm | Found installed collection vmware.vmware_rest:4.9.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/vmware/vmware_rest' 2026-06-02 13:35:00.755082 | debian-bookworm | Loading collection community.digitalocean from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/digitalocean 2026-06-02 13:35:00.755440 | debian-bookworm | Found installed collection community.digitalocean:1.27.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/digitalocean' 2026-06-02 13:35:00.755797 | debian-bookworm | Loading collection community.mysql from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/mysql 2026-06-02 13:35:00.756139 | debian-bookworm | Found installed collection community.mysql:3.16.1 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/mysql' 2026-06-02 13:35:00.756853 | debian-bookworm | Loading collection dellemc.unity from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/dellemc/unity 2026-06-02 13:35:00.757190 | debian-bookworm | Found installed collection dellemc.unity:2.1.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/dellemc/unity' 2026-06-02 13:35:00.757519 | debian-bookworm | Loading collection community.routeros from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/routeros 2026-06-02 13:35:00.757872 | debian-bookworm | Found installed collection community.routeros:3.13.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/routeros' 2026-06-02 13:35:00.758370 | debian-bookworm | Loading collection dellemc.openmanage from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/dellemc/openmanage 2026-06-02 13:35:00.758754 | debian-bookworm | Found installed collection dellemc.openmanage:9.12.3 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/dellemc/openmanage' 2026-06-02 13:35:00.759455 | debian-bookworm | Loading collection netbox.netbox from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/netbox/netbox 2026-06-02 13:35:00.759756 | debian-bookworm | Found installed collection netbox.netbox:3.21.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/netbox/netbox' 2026-06-02 13:35:00.760248 | debian-bookworm | Loading collection community.windows from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/windows 2026-06-02 13:35:00.760521 | debian-bookworm | Found installed collection community.windows:2.4.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/windows' 2026-06-02 13:35:00.761009 | debian-bookworm | Loading collection community.crypto from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/crypto 2026-06-02 13:35:00.761280 | debian-bookworm | Found installed collection community.crypto:2.26.6 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/crypto' 2026-06-02 13:35:00.761550 | debian-bookworm | Loading collection infoblox.nios_modules from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/infoblox/nios_modules 2026-06-02 13:35:00.761877 | debian-bookworm | Found installed collection infoblox.nios_modules:1.8.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/infoblox/nios_modules' 2026-06-02 13:35:00.762153 | debian-bookworm | Loading collection community.sops from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/sops 2026-06-02 13:35:00.762432 | debian-bookworm | Found installed collection community.sops:2.2.7 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/sops' 2026-06-02 13:35:00.762713 | debian-bookworm | Loading collection ansible.utils from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/ansible/utils 2026-06-02 13:35:00.762940 | debian-bookworm | Found installed collection ansible.utils:5.1.2 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/ansible/utils' 2026-06-02 13:35:00.763240 | debian-bookworm | Loading collection netapp.cloudmanager from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/netapp/cloudmanager 2026-06-02 13:35:00.763522 | debian-bookworm | Found installed collection netapp.cloudmanager:21.24.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/netapp/cloudmanager' 2026-06-02 13:35:00.766031 | debian-bookworm | Loading collection cisco.nxos from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/cisco/nxos 2026-06-02 13:35:00.766374 | debian-bookworm | Found installed collection cisco.nxos:9.4.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/cisco/nxos' 2026-06-02 13:35:00.767122 | debian-bookworm | Loading collection splunk.es from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/splunk/es 2026-06-02 13:35:00.767430 | debian-bookworm | Found installed collection splunk.es:4.0.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/splunk/es' 2026-06-02 13:35:00.767866 | debian-bookworm | Loading collection community.zabbix from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/zabbix 2026-06-02 13:35:00.768238 | debian-bookworm | Found installed collection community.zabbix:3.3.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/zabbix' 2026-06-02 13:35:00.768506 | debian-bookworm | Loading collection inspur.ispim from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/inspur/ispim 2026-06-02 13:35:00.769143 | debian-bookworm | Found installed collection inspur.ispim:2.2.3 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/inspur/ispim' 2026-06-02 13:35:00.772356 | debian-bookworm | Loading collection fortinet.fortios from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/fortinet/fortios 2026-06-02 13:35:00.772780 | debian-bookworm | Found installed collection fortinet.fortios:2.4.2 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/fortinet/fortios' 2026-06-02 13:35:00.773180 | debian-bookworm | Loading collection cisco.dnac from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/cisco/dnac 2026-06-02 13:35:00.773508 | debian-bookworm | Found installed collection cisco.dnac:6.31.3 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/cisco/dnac' 2026-06-02 13:35:00.778714 | debian-bookworm | Loading collection fortinet.fortimanager from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/fortinet/fortimanager 2026-06-02 13:35:00.778985 | debian-bookworm | Found installed collection fortinet.fortimanager:2.11.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/fortinet/fortimanager' 2026-06-02 13:35:00.781257 | debian-bookworm | Loading collection awx.awx from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/awx/awx 2026-06-02 13:35:00.781969 | debian-bookworm | Found installed collection awx.awx:24.6.1 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/awx/awx' 2026-06-02 13:35:00.785104 | debian-bookworm | Loading collection community.aws from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/aws 2026-06-02 13:35:00.785472 | debian-bookworm | Found installed collection community.aws:9.3.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/aws' 2026-06-02 13:35:00.786294 | debian-bookworm | Loading collection arista.eos from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/arista/eos 2026-06-02 13:35:00.786685 | debian-bookworm | Found installed collection arista.eos:10.1.1 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/arista/eos' 2026-06-02 13:35:00.787063 | debian-bookworm | Loading collection community.docker from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/docker 2026-06-02 13:35:00.787481 | debian-bookworm | Found installed collection community.docker:4.8.2 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/docker' 2026-06-02 13:35:00.787927 | debian-bookworm | Loading collection community.hrobot from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/hrobot 2026-06-02 13:35:00.788259 | debian-bookworm | Found installed collection community.hrobot:2.7.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/hrobot' 2026-06-02 13:35:00.796381 | debian-bookworm | Loading collection community.general from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/general 2026-06-02 13:35:00.796673 | debian-bookworm | Found installed collection community.general:10.7.6 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/general' 2026-06-02 13:35:00.796955 | debian-bookworm | Loading collection ibm.spectrum_virtualize from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/ibm/spectrum_virtualize 2026-06-02 13:35:00.797226 | debian-bookworm | Found installed collection ibm.spectrum_virtualize:2.0.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/ibm/spectrum_virtualize' 2026-06-02 13:35:00.798603 | debian-bookworm | Loading collection cisco.mso from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/cisco/mso 2026-06-02 13:35:00.798889 | debian-bookworm | Found installed collection cisco.mso:2.11.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/cisco/mso' 2026-06-02 13:35:00.799651 | debian-bookworm | Loading collection dellemc.enterprise_sonic from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/dellemc/enterprise_sonic 2026-06-02 13:35:00.799924 | debian-bookworm | Found installed collection dellemc.enterprise_sonic:2.5.1 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/dellemc/enterprise_sonic' 2026-06-02 13:35:00.800285 | debian-bookworm | Loading collection kaytus.ksmanage from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/kaytus/ksmanage 2026-06-02 13:35:00.800549 | debian-bookworm | Found installed collection kaytus.ksmanage:2.0.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/kaytus/ksmanage' 2026-06-02 13:35:00.802190 | debian-bookworm | Loading collection cisco.aci from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/cisco/aci 2026-06-02 13:35:00.802455 | debian-bookworm | Found installed collection cisco.aci:2.12.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/cisco/aci' 2026-06-02 13:35:00.802899 | debian-bookworm | Loading collection community.dns from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/dns 2026-06-02 13:35:00.803167 | debian-bookworm | Found installed collection community.dns:3.4.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/dns' 2026-06-02 13:35:00.803465 | debian-bookworm | Loading collection grafana.grafana from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/grafana/grafana 2026-06-02 13:35:00.803816 | debian-bookworm | Found installed collection grafana.grafana:5.7.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/grafana/grafana' 2026-06-02 13:35:00.804081 | debian-bookworm | Loading collection ibm.storage_virtualize from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/ibm/storage_virtualize 2026-06-02 13:35:00.804358 | debian-bookworm | Found installed collection ibm.storage_virtualize:2.7.4 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/ibm/storage_virtualize' 2026-06-02 13:35:00.804676 | debian-bookworm | Loading collection cisco.ise from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/cisco/ise 2026-06-02 13:35:00.804949 | debian-bookworm | Found installed collection cisco.ise:2.10.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/cisco/ise' 2026-06-02 13:35:00.805211 | debian-bookworm | Loading collection ravendb.ravendb from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/ravendb/ravendb 2026-06-02 13:35:00.805444 | debian-bookworm | Found installed collection ravendb.ravendb:1.0.4 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/ravendb/ravendb' 2026-06-02 13:35:00.805679 | debian-bookworm | Loading collection community.ciscosmb from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/ciscosmb 2026-06-02 13:35:00.805903 | debian-bookworm | Found installed collection community.ciscosmb:1.0.11 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/ciscosmb' 2026-06-02 13:35:00.806593 | debian-bookworm | Loading collection cisco.ios from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/cisco/ios 2026-06-02 13:35:00.806924 | debian-bookworm | Found installed collection cisco.ios:9.2.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/cisco/ios' 2026-06-02 13:35:00.807389 | debian-bookworm | Loading collection community.okd from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/okd 2026-06-02 13:35:00.808266 | debian-bookworm | Found installed collection community.okd:4.0.2 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/okd' 2026-06-02 13:35:00.808778 | debian-bookworm | Loading collection check_point.mgmt from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/check_point/mgmt 2026-06-02 13:35:00.809097 | debian-bookworm | Found installed collection check_point.mgmt:6.6.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/check_point/mgmt' 2026-06-02 13:35:00.809516 | debian-bookworm | Loading collection kubevirt.core from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/kubevirt/core 2026-06-02 13:35:00.809839 | debian-bookworm | Found installed collection kubevirt.core:2.2.3 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/kubevirt/core' 2026-06-02 13:35:00.810141 | debian-bookworm | Loading collection containers.podman from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/containers/podman 2026-06-02 13:35:00.810562 | debian-bookworm | Found installed collection containers.podman:1.18.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/containers/podman' 2026-06-02 13:35:00.810921 | debian-bookworm | Loading collection community.libvirt from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/libvirt 2026-06-02 13:35:00.811279 | debian-bookworm | Found installed collection community.libvirt:1.4.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/libvirt' 2026-06-02 13:35:00.811582 | debian-bookworm | Loading collection community.postgresql from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/postgresql 2026-06-02 13:35:00.812008 | debian-bookworm | Found installed collection community.postgresql:3.14.2 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/postgresql' 2026-06-02 13:35:00.812292 | debian-bookworm | Loading collection cloudscale_ch.cloud from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/cloudscale_ch/cloud 2026-06-02 13:35:00.812575 | debian-bookworm | Found installed collection cloudscale_ch.cloud:2.5.2 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/cloudscale_ch/cloud' 2026-06-02 13:35:00.812987 | debian-bookworm | Loading collection microsoft.ad from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/microsoft/ad 2026-06-02 13:35:00.813267 | debian-bookworm | Found installed collection microsoft.ad:1.9.2 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/microsoft/ad' 2026-06-02 13:35:00.813543 | debian-bookworm | Loading collection wti.remote from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/wti/remote 2026-06-02 13:35:00.813965 | debian-bookworm | Found installed collection wti.remote:1.0.10 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/wti/remote' 2026-06-02 13:35:00.814343 | debian-bookworm | Loading collection cisco.iosxr from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/cisco/iosxr 2026-06-02 13:35:00.814690 | debian-bookworm | Found installed collection cisco.iosxr:10.3.1 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/cisco/iosxr' 2026-06-02 13:35:00.815099 | debian-bookworm | Loading collection lowlydba.sqlserver from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/lowlydba/sqlserver 2026-06-02 13:35:00.815425 | debian-bookworm | Found installed collection lowlydba.sqlserver:2.7.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/lowlydba/sqlserver' 2026-06-02 13:35:00.815757 | debian-bookworm | Loading collection purestorage.flasharray from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/purestorage/flasharray 2026-06-02 13:35:00.816085 | debian-bookworm | Found installed collection purestorage.flasharray:1.39.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/purestorage/flasharray' 2026-06-02 13:35:00.816493 | debian-bookworm | Loading collection junipernetworks.junos from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/junipernetworks/junos 2026-06-02 13:35:00.816839 | debian-bookworm | Found installed collection junipernetworks.junos:9.1.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/junipernetworks/junos' 2026-06-02 13:35:00.817176 | debian-bookworm | Loading collection cisco.asa from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/cisco/asa 2026-06-02 13:35:00.817501 | debian-bookworm | Found installed collection cisco.asa:6.1.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/cisco/asa' 2026-06-02 13:35:00.817942 | debian-bookworm | Loading collection dellemc.powerflex from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/dellemc/powerflex 2026-06-02 13:35:00.818232 | debian-bookworm | Found installed collection dellemc.powerflex:2.6.1 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/dellemc/powerflex' 2026-06-02 13:35:00.818502 | debian-bookworm | Loading collection community.library_inventory_filtering_v1 from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/library_inventory_filtering_v1 2026-06-02 13:35:00.818795 | debian-bookworm | Found installed collection community.library_inventory_filtering_v1:1.1.5 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/library_inventory_filtering_v1' 2026-06-02 13:35:00.819062 | debian-bookworm | Loading collection community.sap_libs from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/sap_libs 2026-06-02 13:35:00.819364 | debian-bookworm | Found installed collection community.sap_libs:1.5.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/sap_libs' 2026-06-02 13:35:00.821146 | debian-bookworm | Loading collection azure.azcollection from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/azure/azcollection 2026-06-02 13:35:00.821466 | debian-bookworm | Found installed collection azure.azcollection:3.10.1 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/azure/azcollection' 2026-06-02 13:35:00.821913 | debian-bookworm | Loading collection community.mongodb from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/mongodb 2026-06-02 13:35:00.822344 | debian-bookworm | Found installed collection community.mongodb:1.7.10 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/mongodb' 2026-06-02 13:35:00.822575 | debian-bookworm | Loading collection community.grafana from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/grafana 2026-06-02 13:35:00.822838 | debian-bookworm | Found installed collection community.grafana:2.3.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/grafana' 2026-06-02 13:35:00.823142 | debian-bookworm | Loading collection hitachivantara.vspone_object from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/hitachivantara/vspone_object 2026-06-02 13:35:00.823530 | debian-bookworm | Found installed collection hitachivantara.vspone_object:1.0.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/hitachivantara/vspone_object' 2026-06-02 13:35:00.824526 | debian-bookworm | Loading collection ansible.netcommon from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/ansible/netcommon 2026-06-02 13:35:00.824865 | debian-bookworm | Found installed collection ansible.netcommon:7.2.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/ansible/netcommon' 2026-06-02 13:35:00.825168 | debian-bookworm | Loading collection chocolatey.chocolatey from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/chocolatey/chocolatey 2026-06-02 13:35:00.825455 | debian-bookworm | Found installed collection chocolatey.chocolatey:1.5.3 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/chocolatey/chocolatey' 2026-06-02 13:35:00.826390 | debian-bookworm | Loading collection netapp.ontap from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/netapp/ontap 2026-06-02 13:35:00.826659 | debian-bookworm | Found installed collection netapp.ontap:22.14.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/netapp/ontap' 2026-06-02 13:35:00.827042 | debian-bookworm | Loading collection community.hashi_vault from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/hashi_vault 2026-06-02 13:35:00.827352 | debian-bookworm | Found installed collection community.hashi_vault:6.2.1 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/hashi_vault' 2026-06-02 13:35:00.827795 | debian-bookworm | Loading collection vultr.cloud from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/vultr/cloud 2026-06-02 13:35:00.828063 | debian-bookworm | Found installed collection vultr.cloud:1.13.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/vultr/cloud' 2026-06-02 13:35:00.828353 | debian-bookworm | Loading collection ieisystem.inmanage from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/ieisystem/inmanage 2026-06-02 13:35:00.828629 | debian-bookworm | Found installed collection ieisystem.inmanage:3.0.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/ieisystem/inmanage' 2026-06-02 13:35:00.829087 | debian-bookworm | Loading collection vmware.vmware from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/vmware/vmware 2026-06-02 13:35:00.829428 | debian-bookworm | Found installed collection vmware.vmware:1.11.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/vmware/vmware' 2026-06-02 13:35:00.829723 | debian-bookworm | Loading collection ansible.posix from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/ansible/posix 2026-06-02 13:35:00.829998 | debian-bookworm | Found installed collection ansible.posix:1.6.2 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/ansible/posix' 2026-06-02 13:35:00.830790 | debian-bookworm | Loading collection vyos.vyos from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/vyos/vyos 2026-06-02 13:35:00.831077 | debian-bookworm | Found installed collection vyos.vyos:5.0.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/vyos/vyos' 2026-06-02 13:35:00.831754 | debian-bookworm | Loading collection ovirt.ovirt from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/ovirt/ovirt 2026-06-02 13:35:00.832054 | debian-bookworm | Found installed collection ovirt.ovirt:3.2.1 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/ovirt/ovirt' 2026-06-02 13:35:00.832256 | debian-bookworm | Loading collection community.proxysql from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/proxysql 2026-06-02 13:35:00.832553 | debian-bookworm | Found installed collection community.proxysql:1.7.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/proxysql' 2026-06-02 13:35:00.832967 | debian-bookworm | Loading collection f5networks.f5_modules from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/f5networks/f5_modules 2026-06-02 13:35:00.833263 | debian-bookworm | Found installed collection f5networks.f5_modules:1.39.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/f5networks/f5_modules' 2026-06-02 13:35:00.833674 | debian-bookworm | Loading collection community.proxmox from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/proxmox 2026-06-02 13:35:00.833973 | debian-bookworm | Found installed collection community.proxmox:1.4.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/proxmox' 2026-06-02 13:35:00.835558 | debian-bookworm | Loading collection community.vmware from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/vmware 2026-06-02 13:35:00.835897 | debian-bookworm | Found installed collection community.vmware:5.10.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/vmware' 2026-06-02 13:35:00.836113 | debian-bookworm | Loading collection microsoft.iis from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/microsoft/iis 2026-06-02 13:35:00.836395 | debian-bookworm | Found installed collection microsoft.iis:1.0.3 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/microsoft/iis' 2026-06-02 13:35:00.836911 | debian-bookworm | Loading collection hitachivantara.vspone_block from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/hitachivantara/vspone_block 2026-06-02 13:35:00.837204 | debian-bookworm | Found installed collection hitachivantara.vspone_block:3.5.1 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/hitachivantara/vspone_block' 2026-06-02 13:35:00.837504 | debian-bookworm | Loading collection community.rabbitmq from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/rabbitmq 2026-06-02 13:35:00.837823 | debian-bookworm | Found installed collection community.rabbitmq:1.6.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/rabbitmq' 2026-06-02 13:35:00.838017 | debian-bookworm | Loading collection cisco.intersight from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/cisco/intersight 2026-06-02 13:35:00.838243 | debian-bookworm | Found installed collection cisco.intersight:2.7.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/cisco/intersight' 2026-06-02 13:35:00.839327 | debian-bookworm | Loading collection hetzner.hcloud from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/hetzner/hcloud 2026-06-02 13:35:00.839639 | debian-bookworm | Found installed collection hetzner.hcloud:4.3.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/hetzner/hcloud' 2026-06-02 13:35:00.839937 | debian-bookworm | Loading collection cyberark.pas from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/cyberark/pas 2026-06-02 13:35:00.840230 | debian-bookworm | Found installed collection cyberark.pas:1.0.36 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/cyberark/pas' 2026-06-02 13:35:00.875750 | debian-bookworm | Loading collection community.network from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/network 2026-06-02 13:35:00.876000 | debian-bookworm | Found installed collection community.network:5.1.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/network' 2026-06-02 13:35:00.876333 | debian-bookworm | Loading collection cyberark.conjur from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/cyberark/conjur 2026-06-02 13:35:00.876676 | debian-bookworm | Found installed collection cyberark.conjur:1.3.8 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/cyberark/conjur' 2026-06-02 13:35:00.877329 | debian-bookworm | Loading collection ngine_io.cloudstack from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/ngine_io/cloudstack 2026-06-02 13:35:00.877654 | debian-bookworm | Found installed collection ngine_io.cloudstack:2.5.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/ngine_io/cloudstack' 2026-06-02 13:35:00.877971 | debian-bookworm | Loading collection netapp_eseries.santricity from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/netapp_eseries/santricity 2026-06-02 13:35:00.878330 | debian-bookworm | Found installed collection netapp_eseries.santricity:1.4.1 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/netapp_eseries/santricity' 2026-06-02 13:35:00.878822 | debian-bookworm | Loading collection telekom_mms.icinga_director from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/telekom_mms/icinga_director 2026-06-02 13:35:00.879064 | debian-bookworm | Found installed collection telekom_mms.icinga_director:2.4.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/telekom_mms/icinga_director' 2026-06-02 13:35:00.883058 | debian-bookworm | Initial connection to galaxy_server: https://galaxy.ansible.com 2026-06-02 13:35:00.883465 | debian-bookworm | Created /home/zuul/.ansible/galaxy_token 2026-06-02 13:35:00.883715 | debian-bookworm | Calling Galaxy at https://galaxy.ansible.com/api/ 2026-06-02 13:35:00.754723 | ubuntu-noble | INFO [delegated > dependency] Executing 2026-06-02 13:35:00.755404 | ubuntu-noble | WARNING [delegated > dependency] Missing roles requirements file: requirements.yml 2026-06-02 13:35:01.479115 | debian-bookworm | Found API version 'v3, pulp-v3, v1' with Galaxy server default (https://galaxy.ansible.com/api/) 2026-06-02 13:35:01.479527 | debian-bookworm | Calling Galaxy at https://galaxy.ansible.com/api/v3/collections/osism/commons/ 2026-06-02 13:35:01.177431 | ubuntu-noble | ansible-galaxy [core 2.18.17] 2026-06-02 13:35:01.177544 | ubuntu-noble | config file = None 2026-06-02 13:35:01.177605 | ubuntu-noble | configured module search path = ['/home/zuul/src/github.com/osism/ansible-collection-services/plugins/modules', '/home/zuul/.ansible/plugins/modules', '/usr/share/ansible/plugins/modules'] 2026-06-02 13:35:01.177716 | ubuntu-noble | ansible python module location = /home/zuul/venv/lib/python3.12/site-packages/ansible 2026-06-02 13:35:01.177845 | ubuntu-noble | ansible collection location = /home/zuul/.ansible/collections:/usr/share/ansible/collections:/home/zuul/venv/lib/python3.12/site-packages:/home/zuul/venv/lib/python3.12/dist-packages:/home/zuul/venv/lib/python3/dist-packages:/home/zuul/venv/local/lib/python3.12/dist-packages 2026-06-02 13:35:01.177939 | ubuntu-noble | executable location = /home/zuul/venv/bin/ansible-galaxy 2026-06-02 13:35:01.178054 | ubuntu-noble | python version = 3.12.3 (main, Mar 23 2026, 19:04:32) [GCC 13.3.0] (/home/zuul/venv/bin/python3) 2026-06-02 13:35:01.178162 | ubuntu-noble | jinja version = 3.1.6 2026-06-02 13:35:01.178312 | ubuntu-noble | libyaml = True 2026-06-02 13:35:01.179862 | ubuntu-noble | No config file found; using defaults 2026-06-02 13:35:01.179898 | ubuntu-noble | Reading requirement file at '/home/zuul/src/github.com/osism/ansible-collection-services/molecule/delegated/collections.yml' 2026-06-02 13:35:01.193084 | ubuntu-noble | Loading collection osism.services from /home/zuul/.ansible/collections/ansible_collections/osism/services 2026-06-02 13:35:01.193123 | ubuntu-noble | Found installed collection osism.services:999.0.0 at '/home/zuul/.ansible/collections/ansible_collections/osism/services' 2026-06-02 13:35:01.210020 | ubuntu-noble | Loading collection community.aws from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/aws 2026-06-02 13:35:01.210096 | ubuntu-noble | Found installed collection community.aws:9.3.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/aws' 2026-06-02 13:35:01.210112 | ubuntu-noble | Loading collection kaytus.ksmanage from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/kaytus/ksmanage 2026-06-02 13:35:01.210248 | ubuntu-noble | Found installed collection kaytus.ksmanage:2.0.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/kaytus/ksmanage' 2026-06-02 13:35:01.210736 | ubuntu-noble | Loading collection arista.eos from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/arista/eos 2026-06-02 13:35:01.211133 | ubuntu-noble | Found installed collection arista.eos:10.1.1 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/arista/eos' 2026-06-02 13:35:01.211674 | ubuntu-noble | Loading collection community.windows from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/windows 2026-06-02 13:35:01.212097 | ubuntu-noble | Found installed collection community.windows:2.4.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/windows' 2026-06-02 13:35:01.212583 | ubuntu-noble | Loading collection microsoft.iis from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/microsoft/iis 2026-06-02 13:35:01.213013 | ubuntu-noble | Found installed collection microsoft.iis:1.0.3 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/microsoft/iis' 2026-06-02 13:35:01.213487 | ubuntu-noble | Loading collection ansible.netcommon from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/ansible/netcommon 2026-06-02 13:35:01.213965 | ubuntu-noble | Found installed collection ansible.netcommon:7.2.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/ansible/netcommon' 2026-06-02 13:35:01.215317 | ubuntu-noble | Loading collection cisco.mso from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/cisco/mso 2026-06-02 13:35:01.215809 | ubuntu-noble | Found installed collection cisco.mso:2.11.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/cisco/mso' 2026-06-02 13:35:01.216324 | ubuntu-noble | Loading collection hitachivantara.vspone_block from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/hitachivantara/vspone_block 2026-06-02 13:35:01.216786 | ubuntu-noble | Found installed collection hitachivantara.vspone_block:3.5.1 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/hitachivantara/vspone_block' 2026-06-02 13:35:01.217191 | ubuntu-noble | Loading collection community.okd from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/okd 2026-06-02 13:35:01.217659 | ubuntu-noble | Found installed collection community.okd:4.0.2 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/okd' 2026-06-02 13:35:01.247499 | ubuntu-noble | Loading collection community.general from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/general 2026-06-02 13:35:01.248344 | ubuntu-noble | Found installed collection community.general:10.7.6 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/general' 2026-06-02 13:35:01.248824 | ubuntu-noble | Loading collection community.proxysql from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/proxysql 2026-06-02 13:35:01.249283 | ubuntu-noble | Found installed collection community.proxysql:1.7.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/proxysql' 2026-06-02 13:35:01.251984 | ubuntu-noble | Loading collection dellemc.enterprise_sonic from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/dellemc/enterprise_sonic 2026-06-02 13:35:01.252027 | ubuntu-noble | Found installed collection dellemc.enterprise_sonic:2.5.1 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/dellemc/enterprise_sonic' 2026-06-02 13:35:01.252040 | ubuntu-noble | Loading collection lowlydba.sqlserver from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/lowlydba/sqlserver 2026-06-02 13:35:01.252050 | ubuntu-noble | Found installed collection lowlydba.sqlserver:2.7.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/lowlydba/sqlserver' 2026-06-02 13:35:01.252060 | ubuntu-noble | Loading collection check_point.mgmt from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/check_point/mgmt 2026-06-02 13:35:01.252070 | ubuntu-noble | Found installed collection check_point.mgmt:6.6.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/check_point/mgmt' 2026-06-02 13:35:01.252152 | ubuntu-noble | Loading collection amazon.aws from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/amazon/aws 2026-06-02 13:35:01.252586 | ubuntu-noble | Found installed collection amazon.aws:9.5.2 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/amazon/aws' 2026-06-02 13:35:01.253010 | ubuntu-noble | Loading collection splunk.es from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/splunk/es 2026-06-02 13:35:01.253485 | ubuntu-noble | Found installed collection splunk.es:4.0.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/splunk/es' 2026-06-02 13:35:01.253767 | ubuntu-noble | Loading collection ansible.posix from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/ansible/posix 2026-06-02 13:35:01.254123 | ubuntu-noble | Found installed collection ansible.posix:1.6.2 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/ansible/posix' 2026-06-02 13:35:01.254458 | ubuntu-noble | Loading collection netapp.storagegrid from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/netapp/storagegrid 2026-06-02 13:35:01.255249 | ubuntu-noble | Found installed collection netapp.storagegrid:21.14.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/netapp/storagegrid' 2026-06-02 13:35:01.255617 | ubuntu-noble | Loading collection dellemc.powerflex from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/dellemc/powerflex 2026-06-02 13:35:01.255965 | ubuntu-noble | Found installed collection dellemc.powerflex:2.6.1 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/dellemc/powerflex' 2026-06-02 13:35:01.256371 | ubuntu-noble | Loading collection junipernetworks.junos from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/junipernetworks/junos 2026-06-02 13:35:01.256714 | ubuntu-noble | Found installed collection junipernetworks.junos:9.1.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/junipernetworks/junos' 2026-06-02 13:35:01.257319 | ubuntu-noble | Loading collection ibm.qradar from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/ibm/qradar 2026-06-02 13:35:01.257621 | ubuntu-noble | Found installed collection ibm.qradar:4.0.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/ibm/qradar' 2026-06-02 13:35:01.258372 | ubuntu-noble | Loading collection cisco.iosxr from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/cisco/iosxr 2026-06-02 13:35:01.258693 | ubuntu-noble | Found installed collection cisco.iosxr:10.3.1 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/cisco/iosxr' 2026-06-02 13:35:01.258994 | ubuntu-noble | Loading collection purestorage.flasharray from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/purestorage/flasharray 2026-06-02 13:35:01.259282 | ubuntu-noble | Found installed collection purestorage.flasharray:1.39.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/purestorage/flasharray' 2026-06-02 13:35:01.259548 | ubuntu-noble | Loading collection ravendb.ravendb from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/ravendb/ravendb 2026-06-02 13:35:01.259810 | ubuntu-noble | Found installed collection ravendb.ravendb:1.0.4 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/ravendb/ravendb' 2026-06-02 13:35:01.260249 | ubuntu-noble | Loading collection wti.remote from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/wti/remote 2026-06-02 13:35:01.260531 | ubuntu-noble | Found installed collection wti.remote:1.0.10 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/wti/remote' 2026-06-02 13:35:01.301856 | ubuntu-noble | Loading collection community.network from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/network 2026-06-02 13:35:01.302643 | ubuntu-noble | Found installed collection community.network:5.1.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/network' 2026-06-02 13:35:01.303124 | ubuntu-noble | Loading collection infinidat.infinibox from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/infinidat/infinibox 2026-06-02 13:35:01.303708 | ubuntu-noble | Found installed collection infinidat.infinibox:1.6.3 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/infinidat/infinibox' 2026-06-02 13:35:01.304331 | ubuntu-noble | Loading collection cisco.ucs from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/cisco/ucs 2026-06-02 13:35:01.304749 | ubuntu-noble | Found installed collection cisco.ucs:1.16.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/cisco/ucs' 2026-06-02 13:35:01.305404 | ubuntu-noble | Loading collection theforeman.foreman from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/theforeman/foreman 2026-06-02 13:35:01.305879 | ubuntu-noble | Found installed collection theforeman.foreman:4.2.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/theforeman/foreman' 2026-06-02 13:35:01.306647 | ubuntu-noble | Loading collection grafana.grafana from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/grafana/grafana 2026-06-02 13:35:01.307041 | ubuntu-noble | Found installed collection grafana.grafana:5.7.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/grafana/grafana' 2026-06-02 13:35:01.307460 | ubuntu-noble | Loading collection cisco.intersight from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/cisco/intersight 2026-06-02 13:35:01.307818 | ubuntu-noble | Found installed collection cisco.intersight:2.7.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/cisco/intersight' 2026-06-02 13:35:01.308345 | ubuntu-noble | Loading collection community.proxmox from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/proxmox 2026-06-02 13:35:01.308726 | ubuntu-noble | Found installed collection community.proxmox:1.4.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/proxmox' 2026-06-02 13:35:01.309229 | ubuntu-noble | Loading collection cloud.common from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/cloud/common 2026-06-02 13:35:01.309588 | ubuntu-noble | Found installed collection cloud.common:4.2.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/cloud/common' 2026-06-02 13:35:01.310962 | ubuntu-noble | Loading collection kubevirt.core from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/kubevirt/core 2026-06-02 13:35:01.310996 | ubuntu-noble | Found installed collection kubevirt.core:2.2.3 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/kubevirt/core' 2026-06-02 13:35:01.311008 | ubuntu-noble | Loading collection cisco.aci from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/cisco/aci 2026-06-02 13:35:01.311142 | ubuntu-noble | Found installed collection cisco.aci:2.12.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/cisco/aci' 2026-06-02 13:35:01.311500 | ubuntu-noble | Loading collection microsoft.ad from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/microsoft/ad 2026-06-02 13:35:01.311759 | ubuntu-noble | Found installed collection microsoft.ad:1.9.2 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/microsoft/ad' 2026-06-02 13:35:01.312136 | ubuntu-noble | Loading collection community.sap_libs from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/sap_libs 2026-06-02 13:35:01.312442 | ubuntu-noble | Found installed collection community.sap_libs:1.5.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/sap_libs' 2026-06-02 13:35:01.312697 | ubuntu-noble | Loading collection sensu.sensu_go from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/sensu/sensu_go 2026-06-02 13:35:01.312977 | ubuntu-noble | Found installed collection sensu.sensu_go:1.14.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/sensu/sensu_go' 2026-06-02 13:35:01.313359 | ubuntu-noble | Loading collection hetzner.hcloud from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/hetzner/hcloud 2026-06-02 13:35:01.313624 | ubuntu-noble | Found installed collection hetzner.hcloud:4.3.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/hetzner/hcloud' 2026-06-02 13:35:01.313881 | ubuntu-noble | Loading collection community.routeros from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/routeros 2026-06-02 13:35:01.314313 | ubuntu-noble | Found installed collection community.routeros:3.13.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/routeros' 2026-06-02 13:35:01.314690 | ubuntu-noble | Loading collection community.hrobot from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/hrobot 2026-06-02 13:35:01.314986 | ubuntu-noble | Found installed collection community.hrobot:2.7.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/hrobot' 2026-06-02 13:35:01.315368 | ubuntu-noble | Loading collection chocolatey.chocolatey from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/chocolatey/chocolatey 2026-06-02 13:35:01.315716 | ubuntu-noble | Found installed collection chocolatey.chocolatey:1.5.3 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/chocolatey/chocolatey' 2026-06-02 13:35:01.316082 | ubuntu-noble | Loading collection ibm.storage_virtualize from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/ibm/storage_virtualize 2026-06-02 13:35:01.316428 | ubuntu-noble | Found installed collection ibm.storage_virtualize:2.7.4 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/ibm/storage_virtualize' 2026-06-02 13:35:01.317237 | ubuntu-noble | Loading collection cisco.nxos from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/cisco/nxos 2026-06-02 13:35:01.317551 | ubuntu-noble | Found installed collection cisco.nxos:9.4.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/cisco/nxos' 2026-06-02 13:35:01.322741 | ubuntu-noble | Loading collection fortinet.fortios from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/fortinet/fortios 2026-06-02 13:35:01.325985 | ubuntu-noble | Found installed collection fortinet.fortios:2.4.2 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/fortinet/fortios' 2026-06-02 13:35:01.326027 | ubuntu-noble | Loading collection community.vmware from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/vmware 2026-06-02 13:35:01.326036 | ubuntu-noble | Found installed collection community.vmware:5.10.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/vmware' 2026-06-02 13:35:01.326043 | ubuntu-noble | Loading collection community.dns from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/dns 2026-06-02 13:35:01.326504 | ubuntu-noble | Found installed collection community.dns:3.4.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/dns' 2026-06-02 13:35:01.326746 | ubuntu-noble | Loading collection community.postgresql from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/postgresql 2026-06-02 13:35:01.326983 | ubuntu-noble | Found installed collection community.postgresql:3.14.2 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/postgresql' 2026-06-02 13:35:01.327230 | ubuntu-noble | Loading collection vultr.cloud from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/vultr/cloud 2026-06-02 13:35:01.327444 | ubuntu-noble | Found installed collection vultr.cloud:1.13.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/vultr/cloud' 2026-06-02 13:35:01.327722 | ubuntu-noble | Loading collection community.sops from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/sops 2026-06-02 13:35:01.327946 | ubuntu-noble | Found installed collection community.sops:2.2.7 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/sops' 2026-06-02 13:35:01.332475 | ubuntu-noble | Loading collection fortinet.fortimanager from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/fortinet/fortimanager 2026-06-02 13:35:01.332718 | ubuntu-noble | Found installed collection fortinet.fortimanager:2.11.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/fortinet/fortimanager' 2026-06-02 13:35:01.333324 | ubuntu-noble | Loading collection community.crypto from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/crypto 2026-06-02 13:35:01.333595 | ubuntu-noble | Found installed collection community.crypto:2.26.6 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/crypto' 2026-06-02 13:35:01.333833 | ubuntu-noble | Loading collection community.ciscosmb from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/ciscosmb 2026-06-02 13:35:01.334124 | ubuntu-noble | Found installed collection community.ciscosmb:1.0.11 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/ciscosmb' 2026-06-02 13:35:01.334407 | ubuntu-noble | Loading collection community.library_inventory_filtering_v1 from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/library_inventory_filtering_v1 2026-06-02 13:35:01.334649 | ubuntu-noble | Found installed collection community.library_inventory_filtering_v1:1.1.5 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/library_inventory_filtering_v1' 2026-06-02 13:35:01.334878 | ubuntu-noble | Loading collection ibm.spectrum_virtualize from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/ibm/spectrum_virtualize 2026-06-02 13:35:01.335148 | ubuntu-noble | Found installed collection ibm.spectrum_virtualize:2.0.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/ibm/spectrum_virtualize' 2026-06-02 13:35:01.335491 | ubuntu-noble | Loading collection community.libvirt from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/libvirt 2026-06-02 13:35:01.335706 | ubuntu-noble | Found installed collection community.libvirt:1.4.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/libvirt' 2026-06-02 13:35:01.335890 | ubuntu-noble | Loading collection cisco.ise from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/cisco/ise 2026-06-02 13:35:01.336153 | ubuntu-noble | Found installed collection cisco.ise:2.10.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/cisco/ise' 2026-06-02 13:35:01.336404 | ubuntu-noble | Loading collection purestorage.flashblade from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/purestorage/flashblade 2026-06-02 13:35:01.336583 | ubuntu-noble | Found installed collection purestorage.flashblade:1.22.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/purestorage/flashblade' 2026-06-02 13:35:01.336814 | ubuntu-noble | Loading collection ansible.utils from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/ansible/utils 2026-06-02 13:35:01.337008 | ubuntu-noble | Found installed collection ansible.utils:5.1.2 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/ansible/utils' 2026-06-02 13:35:01.337258 | ubuntu-noble | Loading collection ansible.windows from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/ansible/windows 2026-06-02 13:35:01.337439 | ubuntu-noble | Found installed collection ansible.windows:2.8.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/ansible/windows' 2026-06-02 13:35:01.337820 | ubuntu-noble | Loading collection openstack.cloud from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/openstack/cloud 2026-06-02 13:35:01.338050 | ubuntu-noble | Found installed collection openstack.cloud:2.5.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/openstack/cloud' 2026-06-02 13:35:01.338389 | ubuntu-noble | Loading collection community.hashi_vault from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/hashi_vault 2026-06-02 13:35:01.338675 | ubuntu-noble | Found installed collection community.hashi_vault:6.2.1 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/hashi_vault' 2026-06-02 13:35:01.339674 | ubuntu-noble | Loading collection vyos.vyos from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/vyos/vyos 2026-06-02 13:35:01.339942 | ubuntu-noble | Found installed collection vyos.vyos:5.0.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/vyos/vyos' 2026-06-02 13:35:01.341954 | ubuntu-noble | Loading collection azure.azcollection from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/azure/azcollection 2026-06-02 13:35:01.342283 | ubuntu-noble | Found installed collection azure.azcollection:3.10.1 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/azure/azcollection' 2026-06-02 13:35:01.343122 | ubuntu-noble | Loading collection netbox.netbox from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/netbox/netbox 2026-06-02 13:35:01.343385 | ubuntu-noble | Found installed collection netbox.netbox:3.21.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/netbox/netbox' 2026-06-02 13:35:01.343816 | ubuntu-noble | Loading collection f5networks.f5_modules from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/f5networks/f5_modules 2026-06-02 13:35:01.344059 | ubuntu-noble | Found installed collection f5networks.f5_modules:1.39.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/f5networks/f5_modules' 2026-06-02 13:35:01.344572 | ubuntu-noble | Loading collection community.docker from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/docker 2026-06-02 13:35:01.344774 | ubuntu-noble | Found installed collection community.docker:4.8.2 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/docker' 2026-06-02 13:35:01.347376 | ubuntu-noble | Loading collection awx.awx from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/awx/awx 2026-06-02 13:35:01.347595 | ubuntu-noble | Found installed collection awx.awx:24.6.1 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/awx/awx' 2026-06-02 13:35:01.347952 | ubuntu-noble | Loading collection containers.podman from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/containers/podman 2026-06-02 13:35:01.348179 | ubuntu-noble | Found installed collection containers.podman:1.18.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/containers/podman' 2026-06-02 13:35:01.348686 | ubuntu-noble | Loading collection vmware.vmware from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/vmware/vmware 2026-06-02 13:35:01.348890 | ubuntu-noble | Found installed collection vmware.vmware:1.11.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/vmware/vmware' 2026-06-02 13:35:01.349689 | ubuntu-noble | Loading collection ovirt.ovirt from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/ovirt/ovirt 2026-06-02 13:35:01.349952 | ubuntu-noble | Found installed collection ovirt.ovirt:3.2.1 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/ovirt/ovirt' 2026-06-02 13:35:01.352783 | ubuntu-noble | Loading collection vmware.vmware_rest from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/vmware/vmware_rest 2026-06-02 13:35:01.353048 | ubuntu-noble | Found installed collection vmware.vmware_rest:4.9.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/vmware/vmware_rest' 2026-06-02 13:35:01.353474 | ubuntu-noble | Loading collection cisco.asa from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/cisco/asa 2026-06-02 13:35:01.353692 | ubuntu-noble | Found installed collection cisco.asa:6.1.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/cisco/asa' 2026-06-02 13:35:01.354530 | ubuntu-noble | Loading collection cloudscale_ch.cloud from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/cloudscale_ch/cloud 2026-06-02 13:35:01.354879 | ubuntu-noble | Found installed collection cloudscale_ch.cloud:2.5.2 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/cloudscale_ch/cloud' 2026-06-02 13:35:01.356748 | ubuntu-noble | Loading collection cisco.meraki from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/cisco/meraki 2026-06-02 13:35:01.357003 | ubuntu-noble | Found installed collection cisco.meraki:2.21.8 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/cisco/meraki' 2026-06-02 13:35:01.357295 | ubuntu-noble | Loading collection inspur.ispim from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/inspur/ispim 2026-06-02 13:35:01.357525 | ubuntu-noble | Found installed collection inspur.ispim:2.2.3 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/inspur/ispim' 2026-06-02 13:35:01.357731 | ubuntu-noble | Loading collection cisco.dnac from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/cisco/dnac 2026-06-02 13:35:01.357955 | ubuntu-noble | Found installed collection cisco.dnac:6.31.3 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/cisco/dnac' 2026-06-02 13:35:01.358723 | ubuntu-noble | Loading collection dellemc.openmanage from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/dellemc/openmanage 2026-06-02 13:35:01.359013 | ubuntu-noble | Found installed collection dellemc.openmanage:9.12.3 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/dellemc/openmanage' 2026-06-02 13:35:01.359508 | ubuntu-noble | Loading collection netapp.cloudmanager from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/netapp/cloudmanager 2026-06-02 13:35:01.359524 | ubuntu-noble | Found installed collection netapp.cloudmanager:21.24.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/netapp/cloudmanager' 2026-06-02 13:35:01.360246 | ubuntu-noble | Loading collection ngine_io.cloudstack from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/ngine_io/cloudstack 2026-06-02 13:35:01.360267 | ubuntu-noble | Found installed collection ngine_io.cloudstack:2.5.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/ngine_io/cloudstack' 2026-06-02 13:35:01.360633 | ubuntu-noble | Loading collection community.mongodb from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/mongodb 2026-06-02 13:35:01.360828 | ubuntu-noble | Found installed collection community.mongodb:1.7.10 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/mongodb' 2026-06-02 13:35:01.362018 | ubuntu-noble | Loading collection cisco.ios from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/cisco/ios 2026-06-02 13:35:01.362040 | ubuntu-noble | Found installed collection cisco.ios:9.2.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/cisco/ios' 2026-06-02 13:35:01.362529 | ubuntu-noble | Loading collection ieisystem.inmanage from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/ieisystem/inmanage 2026-06-02 13:35:01.362543 | ubuntu-noble | Found installed collection ieisystem.inmanage:3.0.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/ieisystem/inmanage' 2026-06-02 13:35:01.362770 | ubuntu-noble | Loading collection cyberark.conjur from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/cyberark/conjur 2026-06-02 13:35:01.363004 | ubuntu-noble | Found installed collection cyberark.conjur:1.3.8 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/cyberark/conjur' 2026-06-02 13:35:01.363715 | ubuntu-noble | Loading collection kubernetes.core from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/kubernetes/core 2026-06-02 13:35:01.364183 | ubuntu-noble | Found installed collection kubernetes.core:5.4.1 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/kubernetes/core' 2026-06-02 13:35:01.364210 | ubuntu-noble | Loading collection hitachivantara.vspone_object from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/hitachivantara/vspone_object 2026-06-02 13:35:01.364441 | ubuntu-noble | Found installed collection hitachivantara.vspone_object:1.0.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/hitachivantara/vspone_object' 2026-06-02 13:35:01.365520 | ubuntu-noble | Loading collection community.digitalocean from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/digitalocean 2026-06-02 13:35:01.365750 | ubuntu-noble | Found installed collection community.digitalocean:1.27.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/digitalocean' 2026-06-02 13:35:01.366163 | ubuntu-noble | Loading collection community.zabbix from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/zabbix 2026-06-02 13:35:01.366440 | ubuntu-noble | Found installed collection community.zabbix:3.3.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/zabbix' 2026-06-02 13:35:01.366648 | ubuntu-noble | Loading collection cyberark.pas from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/cyberark/pas 2026-06-02 13:35:01.366873 | ubuntu-noble | Found installed collection cyberark.pas:1.0.36 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/cyberark/pas' 2026-06-02 13:35:01.367643 | ubuntu-noble | Loading collection dellemc.unity from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/dellemc/unity 2026-06-02 13:35:01.367862 | ubuntu-noble | Found installed collection dellemc.unity:2.1.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/dellemc/unity' 2026-06-02 13:35:01.369009 | ubuntu-noble | Loading collection google.cloud from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/google/cloud 2026-06-02 13:35:01.369284 | ubuntu-noble | Found installed collection google.cloud:1.9.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/google/cloud' 2026-06-02 13:35:01.369764 | ubuntu-noble | Loading collection community.rabbitmq from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/rabbitmq 2026-06-02 13:35:01.369777 | ubuntu-noble | Found installed collection community.rabbitmq:1.6.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/rabbitmq' 2026-06-02 13:35:01.370024 | ubuntu-noble | Loading collection community.mysql from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/mysql 2026-06-02 13:35:01.370286 | ubuntu-noble | Found installed collection community.mysql:3.16.1 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/mysql' 2026-06-02 13:35:01.370841 | ubuntu-noble | Loading collection community.grafana from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/grafana 2026-06-02 13:35:01.370858 | ubuntu-noble | Found installed collection community.grafana:2.3.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/grafana' 2026-06-02 13:35:01.372110 | ubuntu-noble | Loading collection netapp.ontap from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/netapp/ontap 2026-06-02 13:35:01.372148 | ubuntu-noble | Found installed collection netapp.ontap:22.14.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/netapp/ontap' 2026-06-02 13:35:01.372530 | ubuntu-noble | Loading collection netapp_eseries.santricity from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/netapp_eseries/santricity 2026-06-02 13:35:01.372749 | ubuntu-noble | Found installed collection netapp_eseries.santricity:1.4.1 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/netapp_eseries/santricity' 2026-06-02 13:35:01.373040 | ubuntu-noble | Loading collection infoblox.nios_modules from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/infoblox/nios_modules 2026-06-02 13:35:01.373271 | ubuntu-noble | Found installed collection infoblox.nios_modules:1.8.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/infoblox/nios_modules' 2026-06-02 13:35:01.373935 | ubuntu-noble | Loading collection telekom_mms.icinga_director from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/telekom_mms/icinga_director 2026-06-02 13:35:01.373952 | ubuntu-noble | Found installed collection telekom_mms.icinga_director:2.4.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/telekom_mms/icinga_director' 2026-06-02 13:35:01.378875 | ubuntu-noble | Initial connection to galaxy_server: https://galaxy.ansible.com 2026-06-02 13:35:01.378904 | ubuntu-noble | Created /home/zuul/.ansible/galaxy_token 2026-06-02 13:35:01.378935 | ubuntu-noble | Calling Galaxy at https://galaxy.ansible.com/api/ 2026-06-02 13:35:01.773020 | ubuntu-noble | Found API version 'v3, pulp-v3, v1' with Galaxy server default (https://galaxy.ansible.com/api/) 2026-06-02 13:35:01.775319 | ubuntu-noble | Calling Galaxy at https://galaxy.ansible.com/api/v3/collections/osism/commons/ 2026-06-02 13:35:02.074752 | debian-bookworm | Calling Galaxy at https://galaxy.ansible.com/api/v3/collections/osism/commons/versions/?limit=100 2026-06-02 13:35:02.783284 | ubuntu-noble | Calling Galaxy at https://galaxy.ansible.com/api/v3/collections/osism/commons/versions/?limit=100 2026-06-02 13:35:03.048891 | debian-bookworm | Calling Galaxy at https://galaxy.ansible.com/api/v3/collections/osism/commons/versions/0.20260601.0/ 2026-06-02 13:35:03.684922 | debian-bookworm | Server https://galaxy.ansible.com/api/ has not signed osism.commons:0.20260601.0 2026-06-02 13:35:03.685398 | debian-bookworm | Fetching a collection tarball for 'osism.commons:0.20260601.0' from Ansible Galaxy 2026-06-02 13:35:03.806225 | ubuntu-noble | Calling Galaxy at https://galaxy.ansible.com/api/v3/collections/osism/commons/versions/0.20260601.0/ 2026-06-02 13:35:04.720308 | ubuntu-noble | Server https://galaxy.ansible.com/api/ has not signed osism.commons:0.20260601.0 2026-06-02 13:35:04.720363 | ubuntu-noble | Fetching a collection tarball for 'osism.commons:0.20260601.0' from Ansible Galaxy 2026-06-02 13:35:04.994275 | debian-bookworm | Validating downloaded file hash 1d41d3b5d145afda8cce7ec8515d5495c0afe9a3787ce4d2ea101956f5f7e2b1 with expected hash 1d41d3b5d145afda8cce7ec8515d5495c0afe9a3787ce4d2ea101956f5f7e2b1 2026-06-02 13:35:04.994553 | debian-bookworm | Collection 'osism.commons:0.20260601.0' obtained from server default https://galaxy.ansible.com/api/ 2026-06-02 13:35:05.161976 | debian-bookworm | Starting galaxy collection install process 2026-06-02 13:35:05.162262 | debian-bookworm | Process install dependency map 2026-06-02 13:35:05.162536 | debian-bookworm | Starting collection install process 2026-06-02 13:35:05.162844 | debian-bookworm | 'ansible.posix:1.6.2' is already installed, skipping. 2026-06-02 13:35:05.163111 | debian-bookworm | 'community.docker:4.8.2' is already installed, skipping. 2026-06-02 13:35:05.163432 | debian-bookworm | 'community.general:10.7.6' is already installed, skipping. 2026-06-02 13:35:05.163707 | debian-bookworm | 'community.library_inventory_filtering_v1:1.1.5' is already installed, skipping. 2026-06-02 13:35:05.163981 | debian-bookworm | Downloading https://galaxy.ansible.com/api/v3/plugin/ansible/content/published/collections/artifacts/osism-commons-0.20260601.0.tar.gz to /home/zuul/.ansible/tmp/ansible-local-18312ojcjzkr/tmpk2axogz4/osism-commons-0.20260601.0-ppse5jqk 2026-06-02 13:35:05.164234 | debian-bookworm | Installing 'osism.commons:0.20260601.0' to '/home/zuul/.ansible/collections/ansible_collections/osism/commons' 2026-06-02 13:35:05.164477 | debian-bookworm | osism.commons:0.20260601.0 was installed successfully 2026-06-02 13:35:05.238412 | debian-bookworm | INFO [delegated > dependency] Dependency completed successfully. 2026-06-02 13:35:05.238661 | debian-bookworm | WARNING [delegated > dependency] Executed: Missing roles requirements file: requirements.yml (Remove from dependency_sequence to suppress) 2026-06-02 13:35:05.239418 | debian-bookworm | WARNING Molecule executed 1 scenario (1 missing files) 2026-06-02 13:35:06.145885 | ubuntu-noble | Validating downloaded file hash 1d41d3b5d145afda8cce7ec8515d5495c0afe9a3787ce4d2ea101956f5f7e2b1 with expected hash 1d41d3b5d145afda8cce7ec8515d5495c0afe9a3787ce4d2ea101956f5f7e2b1 2026-06-02 13:35:06.145978 | ubuntu-noble | Collection 'osism.commons:0.20260601.0' obtained from server default https://galaxy.ansible.com/api/ 2026-06-02 13:35:06.318140 | ubuntu-noble | Starting galaxy collection install process 2026-06-02 13:35:06.318209 | ubuntu-noble | Process install dependency map 2026-06-02 13:35:06.318224 | ubuntu-noble | Starting collection install process 2026-06-02 13:35:06.318235 | ubuntu-noble | 'ansible.posix:1.6.2' is already installed, skipping. 2026-06-02 13:35:06.318585 | ubuntu-noble | 'community.docker:4.8.2' is already installed, skipping. 2026-06-02 13:35:06.319263 | ubuntu-noble | 'community.general:10.7.6' is already installed, skipping. 2026-06-02 13:35:06.319661 | ubuntu-noble | 'community.library_inventory_filtering_v1:1.1.5' is already installed, skipping. 2026-06-02 13:35:06.320038 | ubuntu-noble | Downloading https://galaxy.ansible.com/api/v3/plugin/ansible/content/published/collections/artifacts/osism-commons-0.20260601.0.tar.gz to /home/zuul/.ansible/tmp/ansible-local-1654egnay8bv/tmpcst774cc/osism-commons-0.20260601.0-admmvnez 2026-06-02 13:35:06.320457 | ubuntu-noble | Installing 'osism.commons:0.20260601.0' to '/home/zuul/.ansible/collections/ansible_collections/osism/commons' 2026-06-02 13:35:06.320774 | ubuntu-noble | osism.commons:0.20260601.0 was installed successfully 2026-06-02 13:35:06.379125 | ubuntu-noble | INFO [delegated > dependency] Dependency completed successfully. 2026-06-02 13:35:06.379489 | ubuntu-noble | WARNING [delegated > dependency] Executed: Missing roles requirements file: requirements.yml (Remove from dependency_sequence to suppress) 2026-06-02 13:35:06.380242 | ubuntu-noble | WARNING Molecule executed 1 scenario (1 missing files) 2026-06-02 13:35:06.530569 | debian-bookworm | ok: Runtime: 0:00:06.981473 2026-06-02 13:35:06.538633 | ubuntu-noble | ok: Runtime: 0:00:08.028098 2026-06-02 13:35:06.546731 | 2026-06-02 13:35:06.546868 | TASK [ansible-molecule : Run molecule create action with scenario delegated] 2026-06-02 13:35:07.122932 | debian-bookworm | skipping: Conditional result was False 2026-06-02 13:35:07.124332 | ubuntu-noble | skipping: Conditional result was False 2026-06-02 13:35:07.139184 | 2026-06-02 13:35:07.139361 | TASK [ansible-molecule : Run molecule prepare action with scenario delegated] 2026-06-02 13:35:07.751593 | debian-bookworm | WARNING Molecule scenarios should migrate to 'extensions/molecule' 2026-06-02 13:35:07.761323 | debian-bookworm | DEBUG [unknown > config] provisioner.env found in /home/zuul/src/github.com/osism/ansible-collection-services/molecule/delegated/molecule.yml, this can be defined in ansible.env 2026-06-02 13:35:07.834203 | ubuntu-noble | WARNING Molecule scenarios should migrate to 'extensions/molecule' 2026-06-02 13:35:07.853732 | ubuntu-noble | DEBUG [unknown > config] provisioner.env found in /home/zuul/src/github.com/osism/ansible-collection-services/molecule/delegated/molecule.yml, this can be defined in ansible.env 2026-06-02 13:35:08.207262 | debian-bookworm | DEBUG [unknown > config] provisioner.env found in /home/zuul/src/github.com/osism/ansible-collection-services/molecule/delegated/molecule.yml, this can be defined in ansible.env 2026-06-02 13:35:08.207846 | debian-bookworm | DEBUG [delegated > validate] Validating schema /home/zuul/src/github.com/osism/ansible-collection-services/molecule/delegated/molecule.yml. 2026-06-02 13:35:08.227794 | debian-bookworm | DEBUG [default > validate] Validating schema /home/zuul/src/github.com/osism/ansible-collection-services/molecule/default/molecule.yml. 2026-06-02 13:35:08.233195 | debian-bookworm | INFO [delegated > discovery] scenario test matrix: prepare 2026-06-02 13:35:08.233255 | debian-bookworm | INFO [delegated > prerun] Performing prerun with role_name_check=0... 2026-06-02 13:35:08.379193 | ubuntu-noble | DEBUG [unknown > config] provisioner.env found in /home/zuul/src/github.com/osism/ansible-collection-services/molecule/delegated/molecule.yml, this can be defined in ansible.env 2026-06-02 13:35:08.380048 | ubuntu-noble | DEBUG [delegated > validate] Validating schema /home/zuul/src/github.com/osism/ansible-collection-services/molecule/delegated/molecule.yml. 2026-06-02 13:35:08.403467 | ubuntu-noble | DEBUG [default > validate] Validating schema /home/zuul/src/github.com/osism/ansible-collection-services/molecule/default/molecule.yml. 2026-06-02 13:35:08.409428 | ubuntu-noble | INFO [delegated > discovery] scenario test matrix: prepare 2026-06-02 13:35:08.410943 | ubuntu-noble | INFO [delegated > prerun] Performing prerun with role_name_check=0... 2026-06-02 13:35:09.395119 | debian-bookworm | INFO [delegated > prepare] Executing 2026-06-02 13:35:09.709737 | debian-bookworm | DEBUG [delegated > prepare] ansible-playbook version: ansible-playbook 2026-06-02 13:35:09.709791 | debian-bookworm | config file = None 2026-06-02 13:35:09.709807 | debian-bookworm | configured module search path = 2026-06-02 13:35:09.709812 | debian-bookworm | ansible python module location = /home/zuul/venv/lib/python3.11/site-packages/ansible 2026-06-02 13:35:09.709820 | debian-bookworm | ansible collection location = /home/zuul/.ansible/collections:/usr/share/ansible/collections 2026-06-02 13:35:09.709825 | debian-bookworm | executable location = /home/zuul/venv/bin/ansible-playbook 2026-06-02 13:35:09.709829 | debian-bookworm | python version = 3.11.2 (main, Apr 8 2026, 01:58:00) (/home/zuul/venv/bin/python3) 2026-06-02 13:35:09.709833 | debian-bookworm | jinja version = 3.1.6 2026-06-02 13:35:09.709837 | debian-bookworm | libyaml = True 2026-06-02 13:35:09.709929 | debian-bookworm | DEBUG ANSIBLE ENVIRONMENT: 2026-06-02 13:35:09.709935 | debian-bookworm | ANSIBLE_COLLECTIONS_PATH: /home/zuul/venv/.ansible/collections:/home/zuul/.ansible/collections 2026-06-02 13:35:09.709939 | debian-bookworm | ANSIBLE_CONFIG: /home/zuul/.ansible/tmp/molecule.oWZD.delegated/ansible.cfg 2026-06-02 13:35:09.709944 | debian-bookworm | ANSIBLE_LIBRARY: ../../plugins 2026-06-02 13:35:09.709948 | debian-bookworm | ANSIBLE_PYTHON_INTERPRETER: /home/zuul/venv/bin/python 2026-06-02 13:35:09.709951 | debian-bookworm | ANSIBLE_ROLE: auditd 2026-06-02 13:35:09.709955 | debian-bookworm | ANSIBLE_ROLES_PATH: ../../roles 2026-06-02 13:35:09.709959 | debian-bookworm | ANSIBLE_VERBOSITY: 1 2026-06-02 13:35:09.709963 | debian-bookworm | 2026-06-02 13:35:09.710152 | debian-bookworm | DEBUG MOLECULE ENVIRONMENT: 2026-06-02 13:35:09.710157 | debian-bookworm | MOLECULE_DEBUG: True 2026-06-02 13:35:09.710161 | debian-bookworm | MOLECULE_DEPENDENCY_NAME: galaxy 2026-06-02 13:35:09.710165 | debian-bookworm | MOLECULE_DRIVER_NAME: default 2026-06-02 13:35:09.710168 | debian-bookworm | MOLECULE_ENV_FILE: /home/zuul/src/github.com/osism/ansible-collection-services/.env.yml 2026-06-02 13:35:09.710172 | debian-bookworm | MOLECULE_EPHEMERAL_DIRECTORY: /home/zuul/.ansible/tmp/molecule.oWZD.delegated 2026-06-02 13:35:09.710176 | debian-bookworm | MOLECULE_FILE: /home/zuul/.ansible/tmp/molecule.oWZD.delegated/molecule.yml 2026-06-02 13:35:09.710180 | debian-bookworm | MOLECULE_INSTANCE_CONFIG: /home/zuul/.ansible/tmp/molecule.oWZD.delegated/instance_config.yml 2026-06-02 13:35:09.710184 | debian-bookworm | MOLECULE_INVENTORY_FILE: /home/zuul/.ansible/tmp/molecule.oWZD.delegated/inventory/ansible_inventory.yml 2026-06-02 13:35:09.710189 | debian-bookworm | MOLECULE_PROJECT_DIRECTORY: /home/zuul/src/github.com/osism/ansible-collection-services 2026-06-02 13:35:09.710193 | debian-bookworm | MOLECULE_PROVISIONER_NAME: ansible 2026-06-02 13:35:09.710197 | debian-bookworm | MOLECULE_SCENARIO_DIRECTORY: /home/zuul/src/github.com/osism/ansible-collection-services/molecule/delegated 2026-06-02 13:35:09.710200 | debian-bookworm | MOLECULE_SCENARIO_NAME: delegated 2026-06-02 13:35:09.710204 | debian-bookworm | MOLECULE_STATE_FILE: /home/zuul/.ansible/tmp/molecule.oWZD.delegated/state.yml 2026-06-02 13:35:09.710208 | debian-bookworm | MOLECULE_VERIFIER_NAME: testinfra 2026-06-02 13:35:09.710212 | debian-bookworm | MOLECULE_VERIFIER_TEST_DIRECTORY: /home/zuul/src/github.com/osism/ansible-collection-services/molecule/delegated/tests 2026-06-02 13:35:09.710216 | debian-bookworm | 2026-06-02 13:35:09.710472 | debian-bookworm | DEBUG SHELL REPLAY: ANSIBLE_COLLECTIONS_PATH=/home/zuul/venv/.ansible/collections:/home/zuul/.ansible/collections ANSIBLE_CONFIG=/home/zuul/.ansible/tmp/molecule.oWZD.delegated/ansible.cfg ANSIBLE_LIBRARY=../../plugins ANSIBLE_PYTHON_INTERPRETER=/home/zuul/venv/bin/python ANSIBLE_ROLE=auditd ANSIBLE_ROLES_PATH=../../roles ANSIBLE_VERBOSITY=1 MOLECULE_DEBUG=True MOLECULE_DEPENDENCY_NAME=galaxy MOLECULE_DRIVER_NAME=default MOLECULE_ENV_FILE=/home/zuul/src/github.com/osism/ansible-collection-services/.env.yml MOLECULE_EPHEMERAL_DIRECTORY=/home/zuul/.ansible/tmp/molecule.oWZD.delegated MOLECULE_FILE=/home/zuul/.ansible/tmp/molecule.oWZD.delegated/molecule.yml MOLECULE_INSTANCE_CONFIG=/home/zuul/.ansible/tmp/molecule.oWZD.delegated/instance_config.yml MOLECULE_INVENTORY_FILE=/home/zuul/.ansible/tmp/molecule.oWZD.delegated/inventory/ansible_inventory.yml MOLECULE_PROJECT_DIRECTORY=/home/zuul/src/github.com/osism/ansible-collection-services MOLECULE_PROVISIONER_NAME=ansible MOLECULE_SCENARIO_DIRECTORY=/home/zuul/src/github.com/osism/ansible-collection-services/molecule/delegated MOLECULE_SCENARIO_NAME=delegated MOLECULE_STATE_FILE=/home/zuul/.ansible/tmp/molecule.oWZD.delegated/state.yml MOLECULE_VERIFIER_NAME=testinfra MOLECULE_VERIFIER_TEST_DIRECTORY=/home/zuul/src/github.com/osism/ansible-collection-services/molecule/delegated/tests 2026-06-02 13:35:09.978898 | debian-bookworm | Using /home/zuul/.ansible/tmp/molecule.oWZD.delegated/ansible.cfg as config file 2026-06-02 13:35:09.803300 | ubuntu-noble | INFO [delegated > prepare] Executing 2026-06-02 13:35:10.180851 | ubuntu-noble | DEBUG [delegated > prepare] ansible-playbook version: ansible-playbook 2026-06-02 13:35:10.181012 | ubuntu-noble | config file = None 2026-06-02 13:35:10.181052 | ubuntu-noble | configured module search path = 2026-06-02 13:35:10.181066 | ubuntu-noble | ansible python module location = /home/zuul/venv/lib/python3.12/site-packages/ansible 2026-06-02 13:35:10.181079 | ubuntu-noble | ansible collection location = /home/zuul/.ansible/collections:/usr/share/ansible/collections 2026-06-02 13:35:10.181090 | ubuntu-noble | executable location = /home/zuul/venv/bin/ansible-playbook 2026-06-02 13:35:10.181100 | ubuntu-noble | python version = 3.12.3 (main, Mar 23 2026, 19:04:32) (/home/zuul/venv/bin/python3) 2026-06-02 13:35:10.181111 | ubuntu-noble | jinja version = 3.1.6 2026-06-02 13:35:10.181121 | ubuntu-noble | libyaml = True 2026-06-02 13:35:10.181649 | ubuntu-noble | DEBUG ANSIBLE ENVIRONMENT: 2026-06-02 13:35:10.181674 | ubuntu-noble | ANSIBLE_COLLECTIONS_PATH: /home/zuul/venv/.ansible/collections:/home/zuul/.ansible/collections 2026-06-02 13:35:10.181685 | ubuntu-noble | ANSIBLE_CONFIG: /home/zuul/.ansible/tmp/molecule.oWZD.delegated/ansible.cfg 2026-06-02 13:35:10.181695 | ubuntu-noble | ANSIBLE_LIBRARY: ../../plugins 2026-06-02 13:35:10.181706 | ubuntu-noble | ANSIBLE_PYTHON_INTERPRETER: /home/zuul/venv/bin/python 2026-06-02 13:35:10.181715 | ubuntu-noble | ANSIBLE_ROLE: auditd 2026-06-02 13:35:10.181725 | ubuntu-noble | ANSIBLE_ROLES_PATH: ../../roles 2026-06-02 13:35:10.181735 | ubuntu-noble | ANSIBLE_VERBOSITY: 1 2026-06-02 13:35:10.181747 | ubuntu-noble | 2026-06-02 13:35:10.182177 | ubuntu-noble | DEBUG MOLECULE ENVIRONMENT: 2026-06-02 13:35:10.182208 | ubuntu-noble | MOLECULE_DEBUG: True 2026-06-02 13:35:10.182219 | ubuntu-noble | MOLECULE_DEPENDENCY_NAME: galaxy 2026-06-02 13:35:10.182229 | ubuntu-noble | MOLECULE_DRIVER_NAME: default 2026-06-02 13:35:10.182239 | ubuntu-noble | MOLECULE_ENV_FILE: /home/zuul/src/github.com/osism/ansible-collection-services/.env.yml 2026-06-02 13:35:10.182249 | ubuntu-noble | MOLECULE_EPHEMERAL_DIRECTORY: /home/zuul/.ansible/tmp/molecule.oWZD.delegated 2026-06-02 13:35:10.182259 | ubuntu-noble | MOLECULE_FILE: /home/zuul/.ansible/tmp/molecule.oWZD.delegated/molecule.yml 2026-06-02 13:35:10.182269 | ubuntu-noble | MOLECULE_INSTANCE_CONFIG: /home/zuul/.ansible/tmp/molecule.oWZD.delegated/instance_config.yml 2026-06-02 13:35:10.182279 | ubuntu-noble | MOLECULE_INVENTORY_FILE: /home/zuul/.ansible/tmp/molecule.oWZD.delegated/inventory/ansible_inventory.yml 2026-06-02 13:35:10.182289 | ubuntu-noble | MOLECULE_PROJECT_DIRECTORY: /home/zuul/src/github.com/osism/ansible-collection-services 2026-06-02 13:35:10.182299 | ubuntu-noble | MOLECULE_PROVISIONER_NAME: ansible 2026-06-02 13:35:10.182309 | ubuntu-noble | MOLECULE_SCENARIO_DIRECTORY: /home/zuul/src/github.com/osism/ansible-collection-services/molecule/delegated 2026-06-02 13:35:10.182319 | ubuntu-noble | MOLECULE_SCENARIO_NAME: delegated 2026-06-02 13:35:10.182329 | ubuntu-noble | MOLECULE_STATE_FILE: /home/zuul/.ansible/tmp/molecule.oWZD.delegated/state.yml 2026-06-02 13:35:10.182338 | ubuntu-noble | MOLECULE_VERIFIER_NAME: testinfra 2026-06-02 13:35:10.182348 | ubuntu-noble | MOLECULE_VERIFIER_TEST_DIRECTORY: /home/zuul/src/github.com/osism/ansible-collection-services/molecule/delegated/tests 2026-06-02 13:35:10.182360 | ubuntu-noble | 2026-06-02 13:35:10.182773 | ubuntu-noble | DEBUG SHELL REPLAY: ANSIBLE_COLLECTIONS_PATH=/home/zuul/venv/.ansible/collections:/home/zuul/.ansible/collections ANSIBLE_CONFIG=/home/zuul/.ansible/tmp/molecule.oWZD.delegated/ansible.cfg ANSIBLE_LIBRARY=../../plugins ANSIBLE_PYTHON_INTERPRETER=/home/zuul/venv/bin/python ANSIBLE_ROLE=auditd ANSIBLE_ROLES_PATH=../../roles ANSIBLE_VERBOSITY=1 MOLECULE_DEBUG=True MOLECULE_DEPENDENCY_NAME=galaxy MOLECULE_DRIVER_NAME=default MOLECULE_ENV_FILE=/home/zuul/src/github.com/osism/ansible-collection-services/.env.yml MOLECULE_EPHEMERAL_DIRECTORY=/home/zuul/.ansible/tmp/molecule.oWZD.delegated MOLECULE_FILE=/home/zuul/.ansible/tmp/molecule.oWZD.delegated/molecule.yml MOLECULE_INSTANCE_CONFIG=/home/zuul/.ansible/tmp/molecule.oWZD.delegated/instance_config.yml MOLECULE_INVENTORY_FILE=/home/zuul/.ansible/tmp/molecule.oWZD.delegated/inventory/ansible_inventory.yml MOLECULE_PROJECT_DIRECTORY=/home/zuul/src/github.com/osism/ansible-collection-services MOLECULE_PROVISIONER_NAME=ansible MOLECULE_SCENARIO_DIRECTORY=/home/zuul/src/github.com/osism/ansible-collection-services/molecule/delegated MOLECULE_SCENARIO_NAME=delegated MOLECULE_STATE_FILE=/home/zuul/.ansible/tmp/molecule.oWZD.delegated/state.yml MOLECULE_VERIFIER_NAME=testinfra MOLECULE_VERIFIER_TEST_DIRECTORY=/home/zuul/src/github.com/osism/ansible-collection-services/molecule/delegated/tests 2026-06-02 13:35:10.222106 | debian-bookworm | 2026-06-02 13:35:10.222479 | debian-bookworm | PLAY [Prepare] ***************************************************************** 2026-06-02 13:35:10.222868 | debian-bookworm | 2026-06-02 13:35:10.223272 | debian-bookworm | TASK [Gathering Facts] ********************************************************* 2026-06-02 13:35:10.502773 | ubuntu-noble | Using /home/zuul/.ansible/tmp/molecule.oWZD.delegated/ansible.cfg as config file 2026-06-02 13:35:10.778774 | ubuntu-noble | 2026-06-02 13:35:10.780987 | ubuntu-noble | PLAY [Prepare] ***************************************************************** 2026-06-02 13:35:10.781020 | ubuntu-noble | 2026-06-02 13:35:10.781025 | ubuntu-noble | TASK [Gathering Facts] ********************************************************* 2026-06-02 13:35:11.280863 | debian-bookworm | ok: [molecule-auditd] 2026-06-02 13:35:11.280974 | debian-bookworm | 2026-06-02 13:35:11.281374 | debian-bookworm | TASK [Install packages in venv] ************************************************ 2026-06-02 13:35:12.057236 | ubuntu-noble | ok: [molecule-auditd] 2026-06-02 13:35:12.057323 | ubuntu-noble | 2026-06-02 13:35:12.057335 | ubuntu-noble | TASK [Install packages in venv] ************************************************ 2026-06-02 13:35:15.742765 | debian-bookworm | changed: [molecule-auditd] => (item=docker) => {"ansible_loop_var": "item", "changed": true, "cmd": ["/home/zuul/venv/bin/pip3", "install", "docker"], "item": "docker", "name": ["docker"], "requirements": null, "state": "present", "stderr": "", "stderr_lines": [], "stdout": "Collecting docker\n Downloading docker-7.1.0-py3-none-any.whl (147 kB)\n ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ 147.8/147.8 kB 4.2 MB/s eta 0:00:00\nRequirement already satisfied: requests>=2.26.0 in /home/zuul/venv/lib/python3.11/site-packages (from docker) (2.34.2)\nRequirement already satisfied: urllib3>=1.26.0 in /home/zuul/venv/lib/python3.11/site-packages (from docker) (2.7.0)\nRequirement already satisfied: charset_normalizer<4,>=2 in /home/zuul/venv/lib/python3.11/site-packages (from requests>=2.26.0->docker) (3.4.7)\nRequirement already satisfied: idna<4,>=2.5 in /home/zuul/venv/lib/python3.11/site-packages (from requests>=2.26.0->docker) (3.17)\nRequirement already satisfied: certifi>=2023.5.7 in /home/zuul/venv/lib/python3.11/site-packages (from requests>=2.26.0->docker) (2026.5.20)\nInstalling collected packages: docker\nSuccessfully installed docker-7.1.0\n", "stdout_lines": ["Collecting docker", " Downloading docker-7.1.0-py3-none-any.whl (147 kB)", " ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ 147.8/147.8 kB 4.2 MB/s eta 0:00:00", "Requirement already satisfied: requests>=2.26.0 in /home/zuul/venv/lib/python3.11/site-packages (from docker) (2.34.2)", "Requirement already satisfied: urllib3>=1.26.0 in /home/zuul/venv/lib/python3.11/site-packages (from docker) (2.7.0)", "Requirement already satisfied: charset_normalizer<4,>=2 in /home/zuul/venv/lib/python3.11/site-packages (from requests>=2.26.0->docker) (3.4.7)", "Requirement already satisfied: idna<4,>=2.5 in /home/zuul/venv/lib/python3.11/site-packages (from requests>=2.26.0->docker) (3.17)", "Requirement already satisfied: certifi>=2023.5.7 in /home/zuul/venv/lib/python3.11/site-packages (from requests>=2.26.0->docker) (2026.5.20)", "Installing collected packages: docker", "Successfully installed docker-7.1.0"], "version": null, "virtualenv": "/home/zuul/venv"} 2026-06-02 13:35:15.743786 | debian-bookworm | changed: [molecule-auditd] => (item=netaddr) => {"ansible_loop_var": "item", "changed": true, "cmd": ["/home/zuul/venv/bin/pip3", "install", "netaddr"], "item": "netaddr", "name": ["netaddr"], "requirements": null, "state": "present", "stderr": "", "stderr_lines": [], "stdout": "Collecting netaddr\n Downloading netaddr-1.3.0-py3-none-any.whl (2.3 MB)\n ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ 2.3/2.3 MB 10.1 MB/s eta 0:00:00\nInstalling collected packages: netaddr\nSuccessfully installed netaddr-1.3.0\n", "stdout_lines": ["Collecting netaddr", " Downloading netaddr-1.3.0-py3-none-any.whl (2.3 MB)", " ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ 2.3/2.3 MB 10.1 MB/s eta 0:00:00", "Installing collected packages: netaddr", "Successfully installed netaddr-1.3.0"], "version": null, "virtualenv": "/home/zuul/venv"} 2026-06-02 13:35:15.744146 | debian-bookworm | ok: [molecule-auditd] => (item=requests) => {"ansible_loop_var": "item", "changed": false, "cmd": ["/home/zuul/venv/bin/pip3", "install", "requests"], "item": "requests", "name": ["requests"], "requirements": null, "state": "present", "stderr": "", "stderr_lines": [], "stdout": "Requirement already satisfied: requests in /home/zuul/venv/lib/python3.11/site-packages (2.34.2)\nRequirement already satisfied: charset_normalizer<4,>=2 in /home/zuul/venv/lib/python3.11/site-packages (from requests) (3.4.7)\nRequirement already satisfied: idna<4,>=2.5 in /home/zuul/venv/lib/python3.11/site-packages (from requests) (3.17)\nRequirement already satisfied: urllib3<3,>=1.26 in /home/zuul/venv/lib/python3.11/site-packages (from requests) (2.7.0)\nRequirement already satisfied: certifi>=2023.5.7 in /home/zuul/venv/lib/python3.11/site-packages (from requests) (2026.5.20)\n", "stdout_lines": ["Requirement already satisfied: requests in /home/zuul/venv/lib/python3.11/site-packages (2.34.2)", "Requirement already satisfied: charset_normalizer<4,>=2 in /home/zuul/venv/lib/python3.11/site-packages (from requests) (3.4.7)", "Requirement already satisfied: idna<4,>=2.5 in /home/zuul/venv/lib/python3.11/site-packages (from requests) (3.17)", "Requirement already satisfied: urllib3<3,>=1.26 in /home/zuul/venv/lib/python3.11/site-packages (from requests) (2.7.0)", "Requirement already satisfied: certifi>=2023.5.7 in /home/zuul/venv/lib/python3.11/site-packages (from requests) (2026.5.20)"], "version": null, "virtualenv": "/home/zuul/venv"} 2026-06-02 13:35:15.744423 | debian-bookworm | 2026-06-02 13:35:15.744762 | debian-bookworm | TASK [Include required prepare tasks] ****************************************** 2026-06-02 13:35:15.760196 | debian-bookworm | included: /home/zuul/src/github.com/osism/ansible-collection-services/molecule/delegated/prepare/auditd.yml for molecule-auditd 2026-06-02 13:35:15.760484 | debian-bookworm | 2026-06-02 13:35:15.760836 | debian-bookworm | PLAY RECAP ********************************************************************* 2026-06-02 13:35:15.761138 | debian-bookworm | molecule-auditd : ok=3 changed=1 unreachable=0 failed=0 skipped=0 rescued=0 ignored=0 2026-06-02 13:35:15.761395 | debian-bookworm | 2026-06-02 13:35:15.838237 | debian-bookworm | INFO [delegated > prepare] Executed: Successful 2026-06-02 13:35:15.838833 | debian-bookworm | INFO Molecule executed 1 scenario (1 successful) 2026-06-02 13:35:17.146973 | ubuntu-noble | changed: [molecule-auditd] => (item=docker) => {"ansible_loop_var": "item", "changed": true, "cmd": ["/home/zuul/venv/bin/pip3", "install", "docker"], "item": "docker", "name": ["docker"], "requirements": null, "state": "present", "stderr": "", "stderr_lines": [], "stdout": "Collecting docker\n Downloading docker-7.1.0-py3-none-any.whl.metadata (3.8 kB)\nRequirement already satisfied: requests>=2.26.0 in /home/zuul/venv/lib/python3.12/site-packages (from docker) (2.34.2)\nRequirement already satisfied: urllib3>=1.26.0 in /home/zuul/venv/lib/python3.12/site-packages (from docker) (2.7.0)\nRequirement already satisfied: charset_normalizer<4,>=2 in /home/zuul/venv/lib/python3.12/site-packages (from requests>=2.26.0->docker) (3.4.7)\nRequirement already satisfied: idna<4,>=2.5 in /home/zuul/venv/lib/python3.12/site-packages (from requests>=2.26.0->docker) (3.17)\nRequirement already satisfied: certifi>=2023.5.7 in /home/zuul/venv/lib/python3.12/site-packages (from requests>=2.26.0->docker) (2026.5.20)\nDownloading docker-7.1.0-py3-none-any.whl (147 kB)\n ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ 147.8/147.8 kB 1.5 MB/s eta 0:00:00\nInstalling collected packages: docker\nSuccessfully installed docker-7.1.0\n", "stdout_lines": ["Collecting docker", " Downloading docker-7.1.0-py3-none-any.whl.metadata (3.8 kB)", "Requirement already satisfied: requests>=2.26.0 in /home/zuul/venv/lib/python3.12/site-packages (from docker) (2.34.2)", "Requirement already satisfied: urllib3>=1.26.0 in /home/zuul/venv/lib/python3.12/site-packages (from docker) (2.7.0)", "Requirement already satisfied: charset_normalizer<4,>=2 in /home/zuul/venv/lib/python3.12/site-packages (from requests>=2.26.0->docker) (3.4.7)", "Requirement already satisfied: idna<4,>=2.5 in /home/zuul/venv/lib/python3.12/site-packages (from requests>=2.26.0->docker) (3.17)", "Requirement already satisfied: certifi>=2023.5.7 in /home/zuul/venv/lib/python3.12/site-packages (from requests>=2.26.0->docker) (2026.5.20)", "Downloading docker-7.1.0-py3-none-any.whl (147 kB)", " ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ 147.8/147.8 kB 1.5 MB/s eta 0:00:00", "Installing collected packages: docker", "Successfully installed docker-7.1.0"], "version": null, "virtualenv": "/home/zuul/venv"} 2026-06-02 13:35:17.147040 | ubuntu-noble | changed: [molecule-auditd] => (item=netaddr) => {"ansible_loop_var": "item", "changed": true, "cmd": ["/home/zuul/venv/bin/pip3", "install", "netaddr"], "item": "netaddr", "name": ["netaddr"], "requirements": null, "state": "present", "stderr": "", "stderr_lines": [], "stdout": "Collecting netaddr\n Downloading netaddr-1.3.0-py3-none-any.whl.metadata (5.0 kB)\nDownloading netaddr-1.3.0-py3-none-any.whl (2.3 MB)\n ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ 2.3/2.3 MB 10.4 MB/s eta 0:00:00\nInstalling collected packages: netaddr\nSuccessfully installed netaddr-1.3.0\n", "stdout_lines": ["Collecting netaddr", " Downloading netaddr-1.3.0-py3-none-any.whl.metadata (5.0 kB)", "Downloading netaddr-1.3.0-py3-none-any.whl (2.3 MB)", " ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ 2.3/2.3 MB 10.4 MB/s eta 0:00:00", "Installing collected packages: netaddr", "Successfully installed netaddr-1.3.0"], "version": null, "virtualenv": "/home/zuul/venv"} 2026-06-02 13:35:17.147062 | ubuntu-noble | ok: [molecule-auditd] => (item=requests) => {"ansible_loop_var": "item", "changed": false, "cmd": ["/home/zuul/venv/bin/pip3", "install", "requests"], "item": "requests", "name": ["requests"], "requirements": null, "state": "present", "stderr": "", "stderr_lines": [], "stdout": "Requirement already satisfied: requests in /home/zuul/venv/lib/python3.12/site-packages (2.34.2)\nRequirement already satisfied: charset_normalizer<4,>=2 in /home/zuul/venv/lib/python3.12/site-packages (from requests) (3.4.7)\nRequirement already satisfied: idna<4,>=2.5 in /home/zuul/venv/lib/python3.12/site-packages (from requests) (3.17)\nRequirement already satisfied: urllib3<3,>=1.26 in /home/zuul/venv/lib/python3.12/site-packages (from requests) (2.7.0)\nRequirement already satisfied: certifi>=2023.5.7 in /home/zuul/venv/lib/python3.12/site-packages (from requests) (2026.5.20)\n", "stdout_lines": ["Requirement already satisfied: requests in /home/zuul/venv/lib/python3.12/site-packages (2.34.2)", "Requirement already satisfied: charset_normalizer<4,>=2 in /home/zuul/venv/lib/python3.12/site-packages (from requests) (3.4.7)", "Requirement already satisfied: idna<4,>=2.5 in /home/zuul/venv/lib/python3.12/site-packages (from requests) (3.17)", "Requirement already satisfied: urllib3<3,>=1.26 in /home/zuul/venv/lib/python3.12/site-packages (from requests) (2.7.0)", "Requirement already satisfied: certifi>=2023.5.7 in /home/zuul/venv/lib/python3.12/site-packages (from requests) (2026.5.20)"], "version": null, "virtualenv": "/home/zuul/venv"} 2026-06-02 13:35:17.147068 | ubuntu-noble | 2026-06-02 13:35:17.147110 | ubuntu-noble | TASK [Include required prepare tasks] ****************************************** 2026-06-02 13:35:17.170174 | ubuntu-noble | included: /home/zuul/src/github.com/osism/ansible-collection-services/molecule/delegated/prepare/auditd.yml for molecule-auditd 2026-06-02 13:35:17.170412 | ubuntu-noble | 2026-06-02 13:35:17.170572 | ubuntu-noble | PLAY RECAP ********************************************************************* 2026-06-02 13:35:17.170704 | ubuntu-noble | molecule-auditd : ok=3 changed=1 unreachable=0 failed=0 skipped=0 rescued=0 ignored=0 2026-06-02 13:35:17.170819 | ubuntu-noble | 2026-06-02 13:35:17.301656 | ubuntu-noble | INFO [delegated > prepare] Executed: Successful 2026-06-02 13:35:17.302451 | ubuntu-noble | INFO Molecule executed 1 scenario (1 successful) 2026-06-02 13:35:17.719063 | debian-bookworm | ok: Runtime: 0:00:08.452813 2026-06-02 13:35:17.731115 | ubuntu-noble | ok: Runtime: 0:00:09.868284 2026-06-02 13:35:17.739034 | 2026-06-02 13:35:17.739156 | TASK [ansible-molecule : Reset connection] 2026-06-02 13:35:17.781793 | 2026-06-02 13:35:17.781914 | TASK [ansible-molecule : Reset connection] 2026-06-02 13:35:17.821975 | 2026-06-02 13:35:17.822108 | TASK [ansible-molecule : Run molecule converge action with scenario delegated] 2026-06-02 13:35:18.669011 | debian-bookworm | WARNING Molecule scenarios should migrate to 'extensions/molecule' 2026-06-02 13:35:18.676685 | debian-bookworm | DEBUG [unknown > config] provisioner.env found in /home/zuul/src/github.com/osism/ansible-collection-services/molecule/delegated/molecule.yml, this can be defined in ansible.env 2026-06-02 13:35:18.810121 | ubuntu-noble | WARNING Molecule scenarios should migrate to 'extensions/molecule' 2026-06-02 13:35:18.819996 | ubuntu-noble | DEBUG [unknown > config] provisioner.env found in /home/zuul/src/github.com/osism/ansible-collection-services/molecule/delegated/molecule.yml, this can be defined in ansible.env 2026-06-02 13:35:19.103838 | debian-bookworm | DEBUG [unknown > config] provisioner.env found in /home/zuul/src/github.com/osism/ansible-collection-services/molecule/delegated/molecule.yml, this can be defined in ansible.env 2026-06-02 13:35:19.104436 | debian-bookworm | DEBUG [delegated > validate] Validating schema /home/zuul/src/github.com/osism/ansible-collection-services/molecule/delegated/molecule.yml. 2026-06-02 13:35:19.123113 | debian-bookworm | DEBUG [default > validate] Validating schema /home/zuul/src/github.com/osism/ansible-collection-services/molecule/default/molecule.yml. 2026-06-02 13:35:19.128416 | debian-bookworm | INFO [delegated > discovery] scenario test matrix: dependency, create, prepare, converge 2026-06-02 13:35:19.128519 | debian-bookworm | INFO [delegated > prerun] Performing prerun with role_name_check=0... 2026-06-02 13:35:19.445782 | ubuntu-noble | DEBUG [unknown > config] provisioner.env found in /home/zuul/src/github.com/osism/ansible-collection-services/molecule/delegated/molecule.yml, this can be defined in ansible.env 2026-06-02 13:35:19.446500 | ubuntu-noble | DEBUG [delegated > validate] Validating schema /home/zuul/src/github.com/osism/ansible-collection-services/molecule/delegated/molecule.yml. 2026-06-02 13:35:19.470691 | ubuntu-noble | DEBUG [default > validate] Validating schema /home/zuul/src/github.com/osism/ansible-collection-services/molecule/default/molecule.yml. 2026-06-02 13:35:19.476774 | ubuntu-noble | INFO [delegated > discovery] scenario test matrix: dependency, create, prepare, converge 2026-06-02 13:35:19.476847 | ubuntu-noble | INFO [delegated > prerun] Performing prerun with role_name_check=0... 2026-06-02 13:35:20.277777 | debian-bookworm | INFO [delegated > dependency] Executing 2026-06-02 13:35:20.278172 | debian-bookworm | WARNING [delegated > dependency] Missing roles requirements file: requirements.yml 2026-06-02 13:35:20.625245 | debian-bookworm | ansible-galaxy [core 2.18.17] 2026-06-02 13:35:20.625745 | debian-bookworm | config file = None 2026-06-02 13:35:20.626169 | debian-bookworm | configured module search path = ['/home/zuul/src/github.com/osism/ansible-collection-services/plugins/modules', '/home/zuul/.ansible/plugins/modules', '/usr/share/ansible/plugins/modules'] 2026-06-02 13:35:20.626656 | debian-bookworm | ansible python module location = /home/zuul/venv/lib/python3.11/site-packages/ansible 2026-06-02 13:35:20.627052 | debian-bookworm | ansible collection location = /home/zuul/.ansible/collections:/usr/share/ansible/collections:/home/zuul/venv/lib/python3.11/site-packages:/home/zuul/venv/lib/python3.11/dist-packages:/home/zuul/venv/lib/python3/dist-packages:/home/zuul/venv/local/lib/python3.11/dist-packages 2026-06-02 13:35:20.627461 | debian-bookworm | executable location = /home/zuul/venv/bin/ansible-galaxy 2026-06-02 13:35:20.627813 | debian-bookworm | python version = 3.11.2 (main, Apr 8 2026, 01:58:00) [GCC 12.2.0] (/home/zuul/venv/bin/python3) 2026-06-02 13:35:20.628163 | debian-bookworm | jinja version = 3.1.6 2026-06-02 13:35:20.628460 | debian-bookworm | libyaml = True 2026-06-02 13:35:20.628819 | debian-bookworm | No config file found; using defaults 2026-06-02 13:35:20.629248 | debian-bookworm | Reading requirement file at '/home/zuul/src/github.com/osism/ansible-collection-services/molecule/delegated/collections.yml' 2026-06-02 13:35:20.631549 | debian-bookworm | Loading collection osism.services from /home/zuul/.ansible/collections/ansible_collections/osism/services 2026-06-02 13:35:20.631921 | debian-bookworm | Found installed collection osism.services:999.0.0 at '/home/zuul/.ansible/collections/ansible_collections/osism/services' 2026-06-02 13:35:20.632270 | debian-bookworm | Loading collection osism.commons from /home/zuul/.ansible/collections/ansible_collections/osism/commons 2026-06-02 13:35:20.633904 | debian-bookworm | Found installed collection osism.commons:0.20260601.0 at '/home/zuul/.ansible/collections/ansible_collections/osism/commons' 2026-06-02 13:35:20.639353 | debian-bookworm | Loading collection sensu.sensu_go from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/sensu/sensu_go 2026-06-02 13:35:20.639760 | debian-bookworm | Found installed collection sensu.sensu_go:1.14.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/sensu/sensu_go' 2026-06-02 13:35:20.640095 | debian-bookworm | Loading collection ravendb.ravendb from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/ravendb/ravendb 2026-06-02 13:35:20.640440 | debian-bookworm | Found installed collection ravendb.ravendb:1.0.4 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/ravendb/ravendb' 2026-06-02 13:35:20.640794 | debian-bookworm | Loading collection ibm.spectrum_virtualize from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/ibm/spectrum_virtualize 2026-06-02 13:35:20.641129 | debian-bookworm | Found installed collection ibm.spectrum_virtualize:2.0.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/ibm/spectrum_virtualize' 2026-06-02 13:35:20.641468 | debian-bookworm | Loading collection infoblox.nios_modules from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/infoblox/nios_modules 2026-06-02 13:35:20.641869 | debian-bookworm | Found installed collection infoblox.nios_modules:1.8.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/infoblox/nios_modules' 2026-06-02 13:35:20.643494 | debian-bookworm | Loading collection community.vmware from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/vmware 2026-06-02 13:35:20.643809 | debian-bookworm | Found installed collection community.vmware:5.10.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/vmware' 2026-06-02 13:35:20.644084 | debian-bookworm | Loading collection ibm.storage_virtualize from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/ibm/storage_virtualize 2026-06-02 13:35:20.644453 | debian-bookworm | Found installed collection ibm.storage_virtualize:2.7.4 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/ibm/storage_virtualize' 2026-06-02 13:35:20.644990 | debian-bookworm | Loading collection vmware.vmware from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/vmware/vmware 2026-06-02 13:35:20.645259 | debian-bookworm | Found installed collection vmware.vmware:1.11.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/vmware/vmware' 2026-06-02 13:35:20.646203 | debian-bookworm | Loading collection hitachivantara.vspone_block from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/hitachivantara/vspone_block 2026-06-02 13:35:20.646516 | debian-bookworm | Found installed collection hitachivantara.vspone_block:3.5.1 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/hitachivantara/vspone_block' 2026-06-02 13:35:20.652754 | debian-bookworm | Loading collection fortinet.fortimanager from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/fortinet/fortimanager 2026-06-02 13:35:20.653059 | debian-bookworm | Found installed collection fortinet.fortimanager:2.11.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/fortinet/fortimanager' 2026-06-02 13:35:20.654973 | debian-bookworm | Loading collection azure.azcollection from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/azure/azcollection 2026-06-02 13:35:20.655273 | debian-bookworm | Found installed collection azure.azcollection:3.10.1 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/azure/azcollection' 2026-06-02 13:35:20.655552 | debian-bookworm | Loading collection community.sops from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/sops 2026-06-02 13:35:20.655849 | debian-bookworm | Found installed collection community.sops:2.2.7 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/sops' 2026-06-02 13:35:20.656226 | debian-bookworm | Loading collection kubevirt.core from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/kubevirt/core 2026-06-02 13:35:20.656494 | debian-bookworm | Found installed collection kubevirt.core:2.2.3 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/kubevirt/core' 2026-06-02 13:35:20.656794 | debian-bookworm | Loading collection inspur.ispim from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/inspur/ispim 2026-06-02 13:35:20.657068 | debian-bookworm | Found installed collection inspur.ispim:2.2.3 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/inspur/ispim' 2026-06-02 13:35:20.658076 | debian-bookworm | Loading collection google.cloud from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/google/cloud 2026-06-02 13:35:20.658364 | debian-bookworm | Found installed collection google.cloud:1.9.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/google/cloud' 2026-06-02 13:35:20.658671 | debian-bookworm | Loading collection cyberark.pas from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/cyberark/pas 2026-06-02 13:35:20.658926 | debian-bookworm | Found installed collection cyberark.pas:1.0.36 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/cyberark/pas' 2026-06-02 13:35:20.659329 | debian-bookworm | Loading collection community.zabbix from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/zabbix 2026-06-02 13:35:20.659605 | debian-bookworm | Found installed collection community.zabbix:3.3.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/zabbix' 2026-06-02 13:35:20.660380 | debian-bookworm | Loading collection netbox.netbox from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/netbox/netbox 2026-06-02 13:35:20.660672 | debian-bookworm | Found installed collection netbox.netbox:3.21.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/netbox/netbox' 2026-06-02 13:35:20.661019 | debian-bookworm | Loading collection community.sap_libs from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/sap_libs 2026-06-02 13:35:20.661253 | debian-bookworm | Found installed collection community.sap_libs:1.5.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/sap_libs' 2026-06-02 13:35:20.661731 | debian-bookworm | Loading collection community.docker from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/docker 2026-06-02 13:35:20.662057 | debian-bookworm | Found installed collection community.docker:4.8.2 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/docker' 2026-06-02 13:35:20.665352 | debian-bookworm | Loading collection fortinet.fortios from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/fortinet/fortios 2026-06-02 13:35:20.665735 | debian-bookworm | Found installed collection fortinet.fortios:2.4.2 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/fortinet/fortios' 2026-06-02 13:35:20.666396 | debian-bookworm | Loading collection kubernetes.core from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/kubernetes/core 2026-06-02 13:35:20.666660 | debian-bookworm | Found installed collection kubernetes.core:5.4.1 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/kubernetes/core' 2026-06-02 13:35:20.666912 | debian-bookworm | Loading collection community.proxysql from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/proxysql 2026-06-02 13:35:20.667162 | debian-bookworm | Found installed collection community.proxysql:1.7.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/proxysql' 2026-06-02 13:35:20.667489 | debian-bookworm | Loading collection chocolatey.chocolatey from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/chocolatey/chocolatey 2026-06-02 13:35:20.667758 | debian-bookworm | Found installed collection chocolatey.chocolatey:1.5.3 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/chocolatey/chocolatey' 2026-06-02 13:35:20.668470 | debian-bookworm | Loading collection openstack.cloud from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/openstack/cloud 2026-06-02 13:35:20.668738 | debian-bookworm | Found installed collection openstack.cloud:2.5.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/openstack/cloud' 2026-06-02 13:35:20.669069 | debian-bookworm | Loading collection cisco.ucs from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/cisco/ucs 2026-06-02 13:35:20.669314 | debian-bookworm | Found installed collection cisco.ucs:1.16.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/cisco/ucs' 2026-06-02 13:35:20.670448 | debian-bookworm | Loading collection ansible.netcommon from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/ansible/netcommon 2026-06-02 13:35:20.670792 | debian-bookworm | Found installed collection ansible.netcommon:7.2.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/ansible/netcommon' 2026-06-02 13:35:20.671223 | debian-bookworm | Loading collection netapp.storagegrid from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/netapp/storagegrid 2026-06-02 13:35:20.671497 | debian-bookworm | Found installed collection netapp.storagegrid:21.14.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/netapp/storagegrid' 2026-06-02 13:35:20.672382 | debian-bookworm | Loading collection vyos.vyos from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/vyos/vyos 2026-06-02 13:35:20.672719 | debian-bookworm | Found installed collection vyos.vyos:5.0.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/vyos/vyos' 2026-06-02 13:35:20.673510 | debian-bookworm | Loading collection cloudscale_ch.cloud from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/cloudscale_ch/cloud 2026-06-02 13:35:20.673847 | debian-bookworm | Found installed collection cloudscale_ch.cloud:2.5.2 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/cloudscale_ch/cloud' 2026-06-02 13:35:20.674348 | debian-bookworm | Loading collection check_point.mgmt from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/check_point/mgmt 2026-06-02 13:35:20.674592 | debian-bookworm | Found installed collection check_point.mgmt:6.6.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/check_point/mgmt' 2026-06-02 13:35:20.674868 | debian-bookworm | Loading collection cisco.dnac from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/cisco/dnac 2026-06-02 13:35:20.675114 | debian-bookworm | Found installed collection cisco.dnac:6.31.3 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/cisco/dnac' 2026-06-02 13:35:20.676832 | debian-bookworm | Loading collection cisco.aci from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/cisco/aci 2026-06-02 13:35:20.677204 | debian-bookworm | Found installed collection cisco.aci:2.12.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/cisco/aci' 2026-06-02 13:35:20.677455 | debian-bookworm | Loading collection purestorage.flashblade from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/purestorage/flashblade 2026-06-02 13:35:20.677803 | debian-bookworm | Found installed collection purestorage.flashblade:1.22.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/purestorage/flashblade' 2026-06-02 13:35:20.678649 | debian-bookworm | Loading collection arista.eos from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/arista/eos 2026-06-02 13:35:20.678956 | debian-bookworm | Found installed collection arista.eos:10.1.1 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/arista/eos' 2026-06-02 13:35:20.679924 | debian-bookworm | Loading collection netapp.ontap from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/netapp/ontap 2026-06-02 13:35:20.680167 | debian-bookworm | Found installed collection netapp.ontap:22.14.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/netapp/ontap' 2026-06-02 13:35:20.689740 | debian-bookworm | Loading collection community.general from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/general 2026-06-02 13:35:20.690114 | debian-bookworm | Found installed collection community.general:10.7.6 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/general' 2026-06-02 13:35:20.690490 | debian-bookworm | Loading collection community.ciscosmb from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/ciscosmb 2026-06-02 13:35:20.690865 | debian-bookworm | Found installed collection community.ciscosmb:1.0.11 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/ciscosmb' 2026-06-02 13:35:20.692448 | debian-bookworm | Loading collection cisco.meraki from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/cisco/meraki 2026-06-02 13:35:20.692842 | debian-bookworm | Found installed collection cisco.meraki:2.21.8 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/cisco/meraki' 2026-06-02 13:35:20.693832 | debian-bookworm | Loading collection community.windows from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/windows 2026-06-02 13:35:20.694356 | debian-bookworm | Found installed collection community.windows:2.4.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/windows' 2026-06-02 13:35:20.694725 | debian-bookworm | Loading collection lowlydba.sqlserver from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/lowlydba/sqlserver 2026-06-02 13:35:20.695041 | debian-bookworm | Found installed collection lowlydba.sqlserver:2.7.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/lowlydba/sqlserver' 2026-06-02 13:35:20.696587 | debian-bookworm | Loading collection awx.awx from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/awx/awx 2026-06-02 13:35:20.697017 | debian-bookworm | Found installed collection awx.awx:24.6.1 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/awx/awx' 2026-06-02 13:35:20.697739 | debian-bookworm | Loading collection cisco.ios from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/cisco/ios 2026-06-02 13:35:20.698121 | debian-bookworm | Found installed collection cisco.ios:9.2.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/cisco/ios' 2026-06-02 13:35:20.698509 | debian-bookworm | Loading collection f5networks.f5_modules from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/f5networks/f5_modules 2026-06-02 13:35:20.698931 | debian-bookworm | Found installed collection f5networks.f5_modules:1.39.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/f5networks/f5_modules' 2026-06-02 13:35:20.699322 | debian-bookworm | Loading collection cisco.asa from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/cisco/asa 2026-06-02 13:35:20.699612 | debian-bookworm | Found installed collection cisco.asa:6.1.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/cisco/asa' 2026-06-02 13:35:20.700482 | debian-bookworm | Loading collection community.digitalocean from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/digitalocean 2026-06-02 13:35:20.700892 | debian-bookworm | Found installed collection community.digitalocean:1.27.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/digitalocean' 2026-06-02 13:35:20.701263 | debian-bookworm | Loading collection microsoft.iis from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/microsoft/iis 2026-06-02 13:35:20.701656 | debian-bookworm | Found installed collection microsoft.iis:1.0.3 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/microsoft/iis' 2026-06-02 13:35:20.701954 | debian-bookworm | Loading collection ansible.utils from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/ansible/utils 2026-06-02 13:35:20.702344 | debian-bookworm | Found installed collection ansible.utils:5.1.2 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/ansible/utils' 2026-06-02 13:35:20.702649 | debian-bookworm | Loading collection cyberark.conjur from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/cyberark/conjur 2026-06-02 13:35:20.702931 | debian-bookworm | Found installed collection cyberark.conjur:1.3.8 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/cyberark/conjur' 2026-06-02 13:35:20.703424 | debian-bookworm | Loading collection community.library_inventory_filtering_v1 from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/library_inventory_filtering_v1 2026-06-02 13:35:20.703757 | debian-bookworm | Found installed collection community.library_inventory_filtering_v1:1.1.5 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/library_inventory_filtering_v1' 2026-06-02 13:35:20.705356 | debian-bookworm | Loading collection vmware.vmware_rest from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/vmware/vmware_rest 2026-06-02 13:35:20.705716 | debian-bookworm | Found installed collection vmware.vmware_rest:4.9.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/vmware/vmware_rest' 2026-06-02 13:35:20.706252 | debian-bookworm | Loading collection wti.remote from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/wti/remote 2026-06-02 13:35:20.706580 | debian-bookworm | Found installed collection wti.remote:1.0.10 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/wti/remote' 2026-06-02 13:35:20.707937 | debian-bookworm | Loading collection amazon.aws from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/amazon/aws 2026-06-02 13:35:20.708269 | debian-bookworm | Found installed collection amazon.aws:9.5.2 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/amazon/aws' 2026-06-02 13:35:20.709799 | debian-bookworm | Loading collection cisco.mso from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/cisco/mso 2026-06-02 13:35:20.710128 | debian-bookworm | Found installed collection cisco.mso:2.11.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/cisco/mso' 2026-06-02 13:35:20.711218 | debian-bookworm | Loading collection hetzner.hcloud from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/hetzner/hcloud 2026-06-02 13:35:20.711573 | debian-bookworm | Found installed collection hetzner.hcloud:4.3.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/hetzner/hcloud' 2026-06-02 13:35:20.711945 | debian-bookworm | Loading collection community.hashi_vault from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/hashi_vault 2026-06-02 13:35:20.712292 | debian-bookworm | Found installed collection community.hashi_vault:6.2.1 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/hashi_vault' 2026-06-02 13:35:20.712651 | debian-bookworm | Loading collection ansible.windows from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/ansible/windows 2026-06-02 13:35:20.712986 | debian-bookworm | Found installed collection ansible.windows:2.8.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/ansible/windows' 2026-06-02 13:35:20.713250 | debian-bookworm | Loading collection ansible.posix from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/ansible/posix 2026-06-02 13:35:20.713587 | debian-bookworm | Found installed collection ansible.posix:1.6.2 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/ansible/posix' 2026-06-02 13:35:20.714099 | debian-bookworm | Loading collection cisco.iosxr from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/cisco/iosxr 2026-06-02 13:35:20.714368 | debian-bookworm | Found installed collection cisco.iosxr:10.3.1 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/cisco/iosxr' 2026-06-02 13:35:20.714837 | debian-bookworm | Loading collection community.mongodb from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/mongodb 2026-06-02 13:35:20.715131 | debian-bookworm | Found installed collection community.mongodb:1.7.10 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/mongodb' 2026-06-02 13:35:20.715433 | debian-bookworm | Loading collection community.libvirt from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/libvirt 2026-06-02 13:35:20.715729 | debian-bookworm | Found installed collection community.libvirt:1.4.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/libvirt' 2026-06-02 13:35:20.716542 | debian-bookworm | Loading collection dellemc.unity from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/dellemc/unity 2026-06-02 13:35:20.716833 | debian-bookworm | Found installed collection dellemc.unity:2.1.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/dellemc/unity' 2026-06-02 13:35:20.717511 | debian-bookworm | Loading collection ovirt.ovirt from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/ovirt/ovirt 2026-06-02 13:35:20.717803 | debian-bookworm | Found installed collection ovirt.ovirt:3.2.1 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/ovirt/ovirt' 2026-06-02 13:35:20.718077 | debian-bookworm | Loading collection community.routeros from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/routeros 2026-06-02 13:35:20.718352 | debian-bookworm | Found installed collection community.routeros:3.13.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/routeros' 2026-06-02 13:35:20.718790 | debian-bookworm | Loading collection vultr.cloud from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/vultr/cloud 2026-06-02 13:35:20.719062 | debian-bookworm | Found installed collection vultr.cloud:1.13.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/vultr/cloud' 2026-06-02 13:35:20.719568 | debian-bookworm | Loading collection dellemc.powerflex from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/dellemc/powerflex 2026-06-02 13:35:20.719827 | debian-bookworm | Found installed collection dellemc.powerflex:2.6.1 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/dellemc/powerflex' 2026-06-02 13:35:20.720122 | debian-bookworm | Loading collection netapp_eseries.santricity from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/netapp_eseries/santricity 2026-06-02 13:35:20.720350 | debian-bookworm | Found installed collection netapp_eseries.santricity:1.4.1 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/netapp_eseries/santricity' 2026-06-02 13:35:20.720855 | debian-bookworm | Loading collection community.okd from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/okd 2026-06-02 13:35:20.721064 | debian-bookworm | Found installed collection community.okd:4.0.2 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/okd' 2026-06-02 13:35:20.721338 | debian-bookworm | Loading collection cisco.ise from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/cisco/ise 2026-06-02 13:35:20.721608 | debian-bookworm | Found installed collection cisco.ise:2.10.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/cisco/ise' 2026-06-02 13:35:20.721953 | debian-bookworm | Loading collection cloud.common from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/cloud/common 2026-06-02 13:35:20.722208 | debian-bookworm | Found installed collection cloud.common:4.2.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/cloud/common' 2026-06-02 13:35:20.724254 | debian-bookworm | Loading collection cisco.nxos from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/cisco/nxos 2026-06-02 13:35:20.724582 | debian-bookworm | Found installed collection cisco.nxos:9.4.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/cisco/nxos' 2026-06-02 13:35:20.724921 | debian-bookworm | Loading collection grafana.grafana from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/grafana/grafana 2026-06-02 13:35:20.725257 | debian-bookworm | Found installed collection grafana.grafana:5.7.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/grafana/grafana' 2026-06-02 13:35:20.725438 | debian-bookworm | Loading collection cisco.intersight from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/cisco/intersight 2026-06-02 13:35:20.725743 | debian-bookworm | Found installed collection cisco.intersight:2.7.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/cisco/intersight' 2026-06-02 13:35:20.729175 | debian-bookworm | Loading collection community.aws from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/aws 2026-06-02 13:35:20.729513 | debian-bookworm | Found installed collection community.aws:9.3.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/aws' 2026-06-02 13:35:20.731117 | debian-bookworm | Loading collection theforeman.foreman from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/theforeman/foreman 2026-06-02 13:35:20.731500 | debian-bookworm | Found installed collection theforeman.foreman:4.2.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/theforeman/foreman' 2026-06-02 13:35:20.732604 | debian-bookworm | Loading collection junipernetworks.junos from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/junipernetworks/junos 2026-06-02 13:35:20.732973 | debian-bookworm | Found installed collection junipernetworks.junos:9.1.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/junipernetworks/junos' 2026-06-02 13:35:20.733449 | debian-bookworm | Loading collection community.crypto from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/crypto 2026-06-02 13:35:20.733778 | debian-bookworm | Found installed collection community.crypto:2.26.6 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/crypto' 2026-06-02 13:35:20.734118 | debian-bookworm | Loading collection microsoft.ad from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/microsoft/ad 2026-06-02 13:35:20.734429 | debian-bookworm | Found installed collection microsoft.ad:1.9.2 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/microsoft/ad' 2026-06-02 13:35:20.734827 | debian-bookworm | Loading collection community.proxmox from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/proxmox 2026-06-02 13:35:20.735115 | debian-bookworm | Found installed collection community.proxmox:1.4.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/proxmox' 2026-06-02 13:35:20.735663 | debian-bookworm | Loading collection telekom_mms.icinga_director from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/telekom_mms/icinga_director 2026-06-02 13:35:20.735941 | debian-bookworm | Found installed collection telekom_mms.icinga_director:2.4.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/telekom_mms/icinga_director' 2026-06-02 13:35:20.736616 | debian-bookworm | Loading collection splunk.es from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/splunk/es 2026-06-02 13:35:20.736934 | debian-bookworm | Found installed collection splunk.es:4.0.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/splunk/es' 2026-06-02 13:35:20.737210 | debian-bookworm | Loading collection community.mysql from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/mysql 2026-06-02 13:35:20.737485 | debian-bookworm | Found installed collection community.mysql:3.16.1 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/mysql' 2026-06-02 13:35:20.737692 | debian-bookworm | Loading collection hitachivantara.vspone_object from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/hitachivantara/vspone_object 2026-06-02 13:35:20.737999 | debian-bookworm | Found installed collection hitachivantara.vspone_object:1.0.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/hitachivantara/vspone_object' 2026-06-02 13:35:20.775049 | debian-bookworm | Loading collection community.network from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/network 2026-06-02 13:35:20.775518 | debian-bookworm | Found installed collection community.network:5.1.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/network' 2026-06-02 13:35:20.775934 | debian-bookworm | Loading collection community.postgresql from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/postgresql 2026-06-02 13:35:20.776316 | debian-bookworm | Found installed collection community.postgresql:3.14.2 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/postgresql' 2026-06-02 13:35:20.776662 | debian-bookworm | Loading collection containers.podman from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/containers/podman 2026-06-02 13:35:20.777029 | debian-bookworm | Found installed collection containers.podman:1.18.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/containers/podman' 2026-06-02 13:35:20.777308 | debian-bookworm | Loading collection community.grafana from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/grafana 2026-06-02 13:35:20.777751 | debian-bookworm | Found installed collection community.grafana:2.3.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/grafana' 2026-06-02 13:35:20.778038 | debian-bookworm | Loading collection community.rabbitmq from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/rabbitmq 2026-06-02 13:35:20.778417 | debian-bookworm | Found installed collection community.rabbitmq:1.6.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/rabbitmq' 2026-06-02 13:35:20.778724 | debian-bookworm | Loading collection purestorage.flasharray from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/purestorage/flasharray 2026-06-02 13:35:20.779089 | debian-bookworm | Found installed collection purestorage.flasharray:1.39.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/purestorage/flasharray' 2026-06-02 13:35:20.779592 | debian-bookworm | Loading collection community.dns from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/dns 2026-06-02 13:35:20.779951 | debian-bookworm | Found installed collection community.dns:3.4.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/dns' 2026-06-02 13:35:20.780235 | debian-bookworm | Loading collection netapp.cloudmanager from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/netapp/cloudmanager 2026-06-02 13:35:20.780582 | debian-bookworm | Found installed collection netapp.cloudmanager:21.24.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/netapp/cloudmanager' 2026-06-02 13:35:20.780874 | debian-bookworm | Loading collection ibm.qradar from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/ibm/qradar 2026-06-02 13:35:20.781129 | debian-bookworm | Found installed collection ibm.qradar:4.0.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/ibm/qradar' 2026-06-02 13:35:20.781458 | debian-bookworm | Loading collection infinidat.infinibox from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/infinidat/infinibox 2026-06-02 13:35:20.781728 | debian-bookworm | Found installed collection infinidat.infinibox:1.6.3 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/infinidat/infinibox' 2026-06-02 13:35:20.781975 | debian-bookworm | Loading collection kaytus.ksmanage from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/kaytus/ksmanage 2026-06-02 13:35:20.782312 | debian-bookworm | Found installed collection kaytus.ksmanage:2.0.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/kaytus/ksmanage' 2026-06-02 13:35:20.782559 | debian-bookworm | Loading collection community.hrobot from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/hrobot 2026-06-02 13:35:20.782823 | debian-bookworm | Found installed collection community.hrobot:2.7.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/hrobot' 2026-06-02 13:35:20.783162 | debian-bookworm | Loading collection ieisystem.inmanage from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/ieisystem/inmanage 2026-06-02 13:35:20.783474 | debian-bookworm | Found installed collection ieisystem.inmanage:3.0.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/ieisystem/inmanage' 2026-06-02 13:35:20.783845 | debian-bookworm | Loading collection ngine_io.cloudstack from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/ngine_io/cloudstack 2026-06-02 13:35:20.784063 | debian-bookworm | Found installed collection ngine_io.cloudstack:2.5.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/ngine_io/cloudstack' 2026-06-02 13:35:20.784499 | debian-bookworm | Loading collection dellemc.openmanage from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/dellemc/openmanage 2026-06-02 13:35:20.784794 | debian-bookworm | Found installed collection dellemc.openmanage:9.12.3 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/dellemc/openmanage' 2026-06-02 13:35:20.785610 | debian-bookworm | Loading collection dellemc.enterprise_sonic from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/dellemc/enterprise_sonic 2026-06-02 13:35:20.785956 | debian-bookworm | Found installed collection dellemc.enterprise_sonic:2.5.1 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/dellemc/enterprise_sonic' 2026-06-02 13:35:20.786658 | debian-bookworm | Starting galaxy collection install process 2026-06-02 13:35:20.786855 | debian-bookworm | Nothing to do. All requested collections are already installed. If you want to reinstall them, consider using `--force`. 2026-06-02 13:35:20.854702 | debian-bookworm | INFO [delegated > dependency] Dependency completed successfully. 2026-06-02 13:35:20.854919 | debian-bookworm | WARNING [delegated > dependency] Executed: Missing roles requirements file: requirements.yml (Remove from converge_sequence to suppress) 2026-06-02 13:35:20.870670 | debian-bookworm | INFO [delegated > create] Executing 2026-06-02 13:35:20.873284 | debian-bookworm | WARNING [delegated > create] Executed: Missing playbook (Remove from converge_sequence to suppress) 2026-06-02 13:35:20.882582 | debian-bookworm | INFO [delegated > prepare] Executing 2026-06-02 13:35:20.882757 | debian-bookworm | WARNING [delegated > prepare] Skipping, instances already prepared. 2026-06-02 13:35:20.882853 | debian-bookworm | INFO [delegated > prepare] Executed: Successful 2026-06-02 13:35:20.890537 | debian-bookworm | INFO [delegated > converge] Executing 2026-06-02 13:35:21.211363 | debian-bookworm | DEBUG [delegated > converge] ansible-playbook version: ansible-playbook 2026-06-02 13:35:21.211420 | debian-bookworm | config file = None 2026-06-02 13:35:21.211426 | debian-bookworm | configured module search path = 2026-06-02 13:35:21.211431 | debian-bookworm | ansible python module location = /home/zuul/venv/lib/python3.11/site-packages/ansible 2026-06-02 13:35:21.211437 | debian-bookworm | ansible collection location = /home/zuul/.ansible/collections:/usr/share/ansible/collections 2026-06-02 13:35:21.211441 | debian-bookworm | executable location = /home/zuul/venv/bin/ansible-playbook 2026-06-02 13:35:21.211446 | debian-bookworm | python version = 3.11.2 (main, Apr 8 2026, 01:58:00) (/home/zuul/venv/bin/python3) 2026-06-02 13:35:21.211449 | debian-bookworm | jinja version = 3.1.6 2026-06-02 13:35:21.211453 | debian-bookworm | libyaml = True 2026-06-02 13:35:21.211552 | debian-bookworm | DEBUG ANSIBLE ENVIRONMENT: 2026-06-02 13:35:21.211559 | debian-bookworm | ANSIBLE_COLLECTIONS_PATH: /home/zuul/venv/.ansible/collections:/home/zuul/.ansible/collections 2026-06-02 13:35:21.211563 | debian-bookworm | ANSIBLE_CONFIG: /home/zuul/.ansible/tmp/molecule.oWZD.delegated/ansible.cfg 2026-06-02 13:35:21.211567 | debian-bookworm | ANSIBLE_LIBRARY: ../../plugins 2026-06-02 13:35:21.211571 | debian-bookworm | ANSIBLE_PYTHON_INTERPRETER: /home/zuul/venv/bin/python 2026-06-02 13:35:21.211575 | debian-bookworm | ANSIBLE_ROLE: auditd 2026-06-02 13:35:21.211579 | debian-bookworm | ANSIBLE_ROLES_PATH: ../../roles 2026-06-02 13:35:21.211583 | debian-bookworm | ANSIBLE_VERBOSITY: 1 2026-06-02 13:35:21.211586 | debian-bookworm | 2026-06-02 13:35:21.211775 | debian-bookworm | DEBUG MOLECULE ENVIRONMENT: 2026-06-02 13:35:21.211781 | debian-bookworm | MOLECULE_DEBUG: True 2026-06-02 13:35:21.211785 | debian-bookworm | MOLECULE_DEPENDENCY_NAME: galaxy 2026-06-02 13:35:21.211810 | debian-bookworm | MOLECULE_DRIVER_NAME: default 2026-06-02 13:35:21.211814 | debian-bookworm | MOLECULE_ENV_FILE: /home/zuul/src/github.com/osism/ansible-collection-services/.env.yml 2026-06-02 13:35:21.211818 | debian-bookworm | MOLECULE_EPHEMERAL_DIRECTORY: /home/zuul/.ansible/tmp/molecule.oWZD.delegated 2026-06-02 13:35:21.211824 | debian-bookworm | MOLECULE_FILE: /home/zuul/.ansible/tmp/molecule.oWZD.delegated/molecule.yml 2026-06-02 13:35:21.211828 | debian-bookworm | MOLECULE_INSTANCE_CONFIG: /home/zuul/.ansible/tmp/molecule.oWZD.delegated/instance_config.yml 2026-06-02 13:35:21.211832 | debian-bookworm | MOLECULE_INVENTORY_FILE: /home/zuul/.ansible/tmp/molecule.oWZD.delegated/inventory/ansible_inventory.yml 2026-06-02 13:35:21.211836 | debian-bookworm | MOLECULE_PROJECT_DIRECTORY: /home/zuul/src/github.com/osism/ansible-collection-services 2026-06-02 13:35:21.211840 | debian-bookworm | MOLECULE_PROVISIONER_NAME: ansible 2026-06-02 13:35:21.211845 | debian-bookworm | MOLECULE_SCENARIO_DIRECTORY: /home/zuul/src/github.com/osism/ansible-collection-services/molecule/delegated 2026-06-02 13:35:21.211848 | debian-bookworm | MOLECULE_SCENARIO_NAME: delegated 2026-06-02 13:35:21.211852 | debian-bookworm | MOLECULE_STATE_FILE: /home/zuul/.ansible/tmp/molecule.oWZD.delegated/state.yml 2026-06-02 13:35:21.211856 | debian-bookworm | MOLECULE_VERIFIER_NAME: testinfra 2026-06-02 13:35:21.211860 | debian-bookworm | MOLECULE_VERIFIER_TEST_DIRECTORY: /home/zuul/src/github.com/osism/ansible-collection-services/molecule/delegated/tests 2026-06-02 13:35:21.211864 | debian-bookworm | 2026-06-02 13:35:21.212051 | debian-bookworm | DEBUG SHELL REPLAY: ANSIBLE_COLLECTIONS_PATH=/home/zuul/venv/.ansible/collections:/home/zuul/.ansible/collections ANSIBLE_CONFIG=/home/zuul/.ansible/tmp/molecule.oWZD.delegated/ansible.cfg ANSIBLE_LIBRARY=../../plugins ANSIBLE_PYTHON_INTERPRETER=/home/zuul/venv/bin/python ANSIBLE_ROLE=auditd ANSIBLE_ROLES_PATH=../../roles ANSIBLE_VERBOSITY=1 MOLECULE_DEBUG=True MOLECULE_DEPENDENCY_NAME=galaxy MOLECULE_DRIVER_NAME=default MOLECULE_ENV_FILE=/home/zuul/src/github.com/osism/ansible-collection-services/.env.yml MOLECULE_EPHEMERAL_DIRECTORY=/home/zuul/.ansible/tmp/molecule.oWZD.delegated MOLECULE_FILE=/home/zuul/.ansible/tmp/molecule.oWZD.delegated/molecule.yml MOLECULE_INSTANCE_CONFIG=/home/zuul/.ansible/tmp/molecule.oWZD.delegated/instance_config.yml MOLECULE_INVENTORY_FILE=/home/zuul/.ansible/tmp/molecule.oWZD.delegated/inventory/ansible_inventory.yml MOLECULE_PROJECT_DIRECTORY=/home/zuul/src/github.com/osism/ansible-collection-services MOLECULE_PROVISIONER_NAME=ansible MOLECULE_SCENARIO_DIRECTORY=/home/zuul/src/github.com/osism/ansible-collection-services/molecule/delegated MOLECULE_SCENARIO_NAME=delegated MOLECULE_STATE_FILE=/home/zuul/.ansible/tmp/molecule.oWZD.delegated/state.yml MOLECULE_VERIFIER_NAME=testinfra MOLECULE_VERIFIER_TEST_DIRECTORY=/home/zuul/src/github.com/osism/ansible-collection-services/molecule/delegated/tests 2026-06-02 13:35:20.906155 | ubuntu-noble | INFO [delegated > dependency] Executing 2026-06-02 13:35:20.906828 | ubuntu-noble | WARNING [delegated > dependency] Missing roles requirements file: requirements.yml 2026-06-02 13:35:21.325976 | ubuntu-noble | ansible-galaxy [core 2.18.17] 2026-06-02 13:35:21.326041 | ubuntu-noble | config file = None 2026-06-02 13:35:21.326050 | ubuntu-noble | configured module search path = ['/home/zuul/src/github.com/osism/ansible-collection-services/plugins/modules', '/home/zuul/.ansible/plugins/modules', '/usr/share/ansible/plugins/modules'] 2026-06-02 13:35:21.326362 | ubuntu-noble | ansible python module location = /home/zuul/venv/lib/python3.12/site-packages/ansible 2026-06-02 13:35:21.326705 | ubuntu-noble | ansible collection location = /home/zuul/.ansible/collections:/usr/share/ansible/collections:/home/zuul/venv/lib/python3.12/site-packages:/home/zuul/venv/lib/python3.12/dist-packages:/home/zuul/venv/lib/python3/dist-packages:/home/zuul/venv/local/lib/python3.12/dist-packages 2026-06-02 13:35:21.327060 | ubuntu-noble | executable location = /home/zuul/venv/bin/ansible-galaxy 2026-06-02 13:35:21.327370 | ubuntu-noble | python version = 3.12.3 (main, Mar 23 2026, 19:04:32) [GCC 13.3.0] (/home/zuul/venv/bin/python3) 2026-06-02 13:35:21.327651 | ubuntu-noble | jinja version = 3.1.6 2026-06-02 13:35:21.327944 | ubuntu-noble | libyaml = True 2026-06-02 13:35:21.328267 | ubuntu-noble | No config file found; using defaults 2026-06-02 13:35:21.328779 | ubuntu-noble | Reading requirement file at '/home/zuul/src/github.com/osism/ansible-collection-services/molecule/delegated/collections.yml' 2026-06-02 13:35:21.339220 | ubuntu-noble | Loading collection community.crypto from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/crypto 2026-06-02 13:35:21.339577 | ubuntu-noble | Found installed collection community.crypto:2.26.6 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/crypto' 2026-06-02 13:35:21.479474 | debian-bookworm | Using /home/zuul/.ansible/tmp/molecule.oWZD.delegated/ansible.cfg as config file 2026-06-02 13:35:21.702797 | debian-bookworm | 2026-06-02 13:35:21.703110 | debian-bookworm | PLAY [Converge] **************************************************************** 2026-06-02 13:35:21.703426 | debian-bookworm | 2026-06-02 13:35:21.703730 | debian-bookworm | TASK [Gathering Facts] ********************************************************* 2026-06-02 13:35:21.400364 | ubuntu-noble | Loading collection community.network from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/network 2026-06-02 13:35:21.400948 | ubuntu-noble | Found installed collection community.network:5.1.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/network' 2026-06-02 13:35:21.401382 | ubuntu-noble | Loading collection community.ciscosmb from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/ciscosmb 2026-06-02 13:35:21.401791 | ubuntu-noble | Found installed collection community.ciscosmb:1.0.11 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/ciscosmb' 2026-06-02 13:35:21.402122 | ubuntu-noble | Loading collection ibm.qradar from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/ibm/qradar 2026-06-02 13:35:21.402593 | ubuntu-noble | Found installed collection ibm.qradar:4.0.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/ibm/qradar' 2026-06-02 13:35:21.403076 | ubuntu-noble | Loading collection openstack.cloud from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/openstack/cloud 2026-06-02 13:35:21.405976 | ubuntu-noble | Found installed collection openstack.cloud:2.5.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/openstack/cloud' 2026-06-02 13:35:21.406066 | ubuntu-noble | Loading collection community.routeros from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/routeros 2026-06-02 13:35:21.406074 | ubuntu-noble | Found installed collection community.routeros:3.13.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/routeros' 2026-06-02 13:35:21.406078 | ubuntu-noble | Loading collection hetzner.hcloud from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/hetzner/hcloud 2026-06-02 13:35:21.406082 | ubuntu-noble | Found installed collection hetzner.hcloud:4.3.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/hetzner/hcloud' 2026-06-02 13:35:21.406815 | ubuntu-noble | Loading collection arista.eos from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/arista/eos 2026-06-02 13:35:21.407382 | ubuntu-noble | Found installed collection arista.eos:10.1.1 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/arista/eos' 2026-06-02 13:35:21.407685 | ubuntu-noble | Loading collection community.sops from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/sops 2026-06-02 13:35:21.408090 | ubuntu-noble | Found installed collection community.sops:2.2.7 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/sops' 2026-06-02 13:35:21.408384 | ubuntu-noble | Loading collection community.proxmox from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/proxmox 2026-06-02 13:35:21.408766 | ubuntu-noble | Found installed collection community.proxmox:1.4.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/proxmox' 2026-06-02 13:35:21.412313 | ubuntu-noble | Loading collection fortinet.fortios from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/fortinet/fortios 2026-06-02 13:35:21.412575 | ubuntu-noble | Found installed collection fortinet.fortios:2.4.2 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/fortinet/fortios' 2026-06-02 13:35:21.415376 | ubuntu-noble | Loading collection vmware.vmware_rest from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/vmware/vmware_rest 2026-06-02 13:35:21.415641 | ubuntu-noble | Found installed collection vmware.vmware_rest:4.9.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/vmware/vmware_rest' 2026-06-02 13:35:21.416245 | ubuntu-noble | Loading collection cloud.common from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/cloud/common 2026-06-02 13:35:21.416511 | ubuntu-noble | Found installed collection cloud.common:4.2.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/cloud/common' 2026-06-02 13:35:21.416947 | ubuntu-noble | Loading collection netapp.storagegrid from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/netapp/storagegrid 2026-06-02 13:35:21.417242 | ubuntu-noble | Found installed collection netapp.storagegrid:21.14.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/netapp/storagegrid' 2026-06-02 13:35:21.417735 | ubuntu-noble | Loading collection ansible.windows from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/ansible/windows 2026-06-02 13:35:21.418049 | ubuntu-noble | Found installed collection ansible.windows:2.8.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/ansible/windows' 2026-06-02 13:35:21.429962 | ubuntu-noble | Loading collection community.general from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/general 2026-06-02 13:35:21.430363 | ubuntu-noble | Found installed collection community.general:10.7.6 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/general' 2026-06-02 13:35:21.430790 | ubuntu-noble | Loading collection community.mongodb from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/mongodb 2026-06-02 13:35:21.431299 | ubuntu-noble | Found installed collection community.mongodb:1.7.10 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/mongodb' 2026-06-02 13:35:21.431659 | ubuntu-noble | Loading collection purestorage.flashblade from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/purestorage/flashblade 2026-06-02 13:35:21.432069 | ubuntu-noble | Found installed collection purestorage.flashblade:1.22.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/purestorage/flashblade' 2026-06-02 13:35:21.432479 | ubuntu-noble | Loading collection cisco.asa from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/cisco/asa 2026-06-02 13:35:21.432838 | ubuntu-noble | Found installed collection cisco.asa:6.1.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/cisco/asa' 2026-06-02 13:35:21.435032 | ubuntu-noble | Loading collection netbox.netbox from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/netbox/netbox 2026-06-02 13:35:21.435639 | ubuntu-noble | Found installed collection netbox.netbox:3.21.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/netbox/netbox' 2026-06-02 13:35:21.436382 | ubuntu-noble | Loading collection cisco.mso from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/cisco/mso 2026-06-02 13:35:21.436794 | ubuntu-noble | Found installed collection cisco.mso:2.11.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/cisco/mso' 2026-06-02 13:35:21.437696 | ubuntu-noble | Loading collection cloudscale_ch.cloud from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/cloudscale_ch/cloud 2026-06-02 13:35:21.438157 | ubuntu-noble | Found installed collection cloudscale_ch.cloud:2.5.2 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/cloudscale_ch/cloud' 2026-06-02 13:35:21.438517 | ubuntu-noble | Loading collection hitachivantara.vspone_object from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/hitachivantara/vspone_object 2026-06-02 13:35:21.439046 | ubuntu-noble | Found installed collection hitachivantara.vspone_object:1.0.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/hitachivantara/vspone_object' 2026-06-02 13:35:21.439355 | ubuntu-noble | Loading collection lowlydba.sqlserver from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/lowlydba/sqlserver 2026-06-02 13:35:21.439654 | ubuntu-noble | Found installed collection lowlydba.sqlserver:2.7.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/lowlydba/sqlserver' 2026-06-02 13:35:21.439968 | ubuntu-noble | Loading collection ravendb.ravendb from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/ravendb/ravendb 2026-06-02 13:35:21.440299 | ubuntu-noble | Found installed collection ravendb.ravendb:1.0.4 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/ravendb/ravendb' 2026-06-02 13:35:21.440572 | ubuntu-noble | Loading collection inspur.ispim from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/inspur/ispim 2026-06-02 13:35:21.440950 | ubuntu-noble | Found installed collection inspur.ispim:2.2.3 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/inspur/ispim' 2026-06-02 13:35:21.441276 | ubuntu-noble | Loading collection kaytus.ksmanage from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/kaytus/ksmanage 2026-06-02 13:35:21.441526 | ubuntu-noble | Found installed collection kaytus.ksmanage:2.0.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/kaytus/ksmanage' 2026-06-02 13:35:21.442046 | ubuntu-noble | Loading collection community.hrobot from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/hrobot 2026-06-02 13:35:21.442290 | ubuntu-noble | Found installed collection community.hrobot:2.7.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/hrobot' 2026-06-02 13:35:21.444278 | ubuntu-noble | Loading collection theforeman.foreman from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/theforeman/foreman 2026-06-02 13:35:21.444716 | ubuntu-noble | Found installed collection theforeman.foreman:4.2.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/theforeman/foreman' 2026-06-02 13:35:21.444986 | ubuntu-noble | Loading collection cisco.intersight from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/cisco/intersight 2026-06-02 13:35:21.445338 | ubuntu-noble | Found installed collection cisco.intersight:2.7.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/cisco/intersight' 2026-06-02 13:35:21.447495 | ubuntu-noble | Loading collection azure.azcollection from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/azure/azcollection 2026-06-02 13:35:21.447729 | ubuntu-noble | Found installed collection azure.azcollection:3.10.1 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/azure/azcollection' 2026-06-02 13:35:21.449025 | ubuntu-noble | Loading collection community.digitalocean from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/digitalocean 2026-06-02 13:35:21.449392 | ubuntu-noble | Found installed collection community.digitalocean:1.27.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/digitalocean' 2026-06-02 13:35:21.449771 | ubuntu-noble | Loading collection netapp_eseries.santricity from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/netapp_eseries/santricity 2026-06-02 13:35:21.450159 | ubuntu-noble | Found installed collection netapp_eseries.santricity:1.4.1 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/netapp_eseries/santricity' 2026-06-02 13:35:21.450724 | ubuntu-noble | Loading collection telekom_mms.icinga_director from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/telekom_mms/icinga_director 2026-06-02 13:35:21.451151 | ubuntu-noble | Found installed collection telekom_mms.icinga_director:2.4.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/telekom_mms/icinga_director' 2026-06-02 13:35:21.451682 | ubuntu-noble | Loading collection check_point.mgmt from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/check_point/mgmt 2026-06-02 13:35:21.452945 | ubuntu-noble | Found installed collection check_point.mgmt:6.6.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/check_point/mgmt' 2026-06-02 13:35:21.453169 | ubuntu-noble | Loading collection junipernetworks.junos from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/junipernetworks/junos 2026-06-02 13:35:21.453564 | ubuntu-noble | Found installed collection junipernetworks.junos:9.1.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/junipernetworks/junos' 2026-06-02 13:35:21.456106 | ubuntu-noble | Loading collection awx.awx from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/awx/awx 2026-06-02 13:35:21.456528 | ubuntu-noble | Found installed collection awx.awx:24.6.1 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/awx/awx' 2026-06-02 13:35:21.457665 | ubuntu-noble | Loading collection google.cloud from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/google/cloud 2026-06-02 13:35:21.458085 | ubuntu-noble | Found installed collection google.cloud:1.9.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/google/cloud' 2026-06-02 13:35:21.458981 | ubuntu-noble | Loading collection dellemc.unity from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/dellemc/unity 2026-06-02 13:35:21.459364 | ubuntu-noble | Found installed collection dellemc.unity:2.1.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/dellemc/unity' 2026-06-02 13:35:21.459599 | ubuntu-noble | Loading collection ibm.spectrum_virtualize from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/ibm/spectrum_virtualize 2026-06-02 13:35:21.460097 | ubuntu-noble | Found installed collection ibm.spectrum_virtualize:2.0.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/ibm/spectrum_virtualize' 2026-06-02 13:35:21.460629 | ubuntu-noble | Loading collection vmware.vmware from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/vmware/vmware 2026-06-02 13:35:21.461030 | ubuntu-noble | Found installed collection vmware.vmware:1.11.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/vmware/vmware' 2026-06-02 13:35:21.463883 | ubuntu-noble | Loading collection cisco.nxos from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/cisco/nxos 2026-06-02 13:35:21.464167 | ubuntu-noble | Found installed collection cisco.nxos:9.4.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/cisco/nxos' 2026-06-02 13:35:21.464643 | ubuntu-noble | Loading collection purestorage.flasharray from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/purestorage/flasharray 2026-06-02 13:35:21.465071 | ubuntu-noble | Found installed collection purestorage.flasharray:1.39.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/purestorage/flasharray' 2026-06-02 13:35:21.465620 | ubuntu-noble | Loading collection community.zabbix from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/zabbix 2026-06-02 13:35:21.466113 | ubuntu-noble | Found installed collection community.zabbix:3.3.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/zabbix' 2026-06-02 13:35:21.466467 | ubuntu-noble | Loading collection community.libvirt from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/libvirt 2026-06-02 13:35:21.467957 | ubuntu-noble | Found installed collection community.libvirt:1.4.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/libvirt' 2026-06-02 13:35:21.467986 | ubuntu-noble | Loading collection ibm.storage_virtualize from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/ibm/storage_virtualize 2026-06-02 13:35:21.467992 | ubuntu-noble | Found installed collection ibm.storage_virtualize:2.7.4 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/ibm/storage_virtualize' 2026-06-02 13:35:21.468021 | ubuntu-noble | Loading collection containers.podman from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/containers/podman 2026-06-02 13:35:21.468513 | ubuntu-noble | Found installed collection containers.podman:1.18.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/containers/podman' 2026-06-02 13:35:21.469297 | ubuntu-noble | Loading collection dellemc.powerflex from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/dellemc/powerflex 2026-06-02 13:35:21.469944 | ubuntu-noble | Found installed collection dellemc.powerflex:2.6.1 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/dellemc/powerflex' 2026-06-02 13:35:21.470316 | ubuntu-noble | Loading collection cisco.ise from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/cisco/ise 2026-06-02 13:35:21.470738 | ubuntu-noble | Found installed collection cisco.ise:2.10.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/cisco/ise' 2026-06-02 13:35:21.474158 | ubuntu-noble | Loading collection cisco.meraki from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/cisco/meraki 2026-06-02 13:35:21.474681 | ubuntu-noble | Found installed collection cisco.meraki:2.21.8 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/cisco/meraki' 2026-06-02 13:35:21.475300 | ubuntu-noble | Loading collection ansible.utils from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/ansible/utils 2026-06-02 13:35:21.476056 | ubuntu-noble | Found installed collection ansible.utils:5.1.2 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/ansible/utils' 2026-06-02 13:35:21.491084 | ubuntu-noble | Loading collection fortinet.fortimanager from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/fortinet/fortimanager 2026-06-02 13:35:21.491681 | ubuntu-noble | Found installed collection fortinet.fortimanager:2.11.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/fortinet/fortimanager' 2026-06-02 13:35:21.493184 | ubuntu-noble | Loading collection ovirt.ovirt from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/ovirt/ovirt 2026-06-02 13:35:21.493834 | ubuntu-noble | Found installed collection ovirt.ovirt:3.2.1 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/ovirt/ovirt' 2026-06-02 13:35:21.496962 | ubuntu-noble | Loading collection ansible.netcommon from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/ansible/netcommon 2026-06-02 13:35:21.496994 | ubuntu-noble | Found installed collection ansible.netcommon:7.2.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/ansible/netcommon' 2026-06-02 13:35:21.497157 | ubuntu-noble | Loading collection community.grafana from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/grafana 2026-06-02 13:35:21.497737 | ubuntu-noble | Found installed collection community.grafana:2.3.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/grafana' 2026-06-02 13:35:21.498397 | ubuntu-noble | Loading collection community.dns from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/dns 2026-06-02 13:35:21.498887 | ubuntu-noble | Found installed collection community.dns:3.4.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/dns' 2026-06-02 13:35:21.499649 | ubuntu-noble | Loading collection vultr.cloud from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/vultr/cloud 2026-06-02 13:35:21.500144 | ubuntu-noble | Found installed collection vultr.cloud:1.13.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/vultr/cloud' 2026-06-02 13:35:21.500610 | ubuntu-noble | Loading collection infoblox.nios_modules from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/infoblox/nios_modules 2026-06-02 13:35:21.501035 | ubuntu-noble | Found installed collection infoblox.nios_modules:1.8.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/infoblox/nios_modules' 2026-06-02 13:35:21.501470 | ubuntu-noble | Loading collection kubevirt.core from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/kubevirt/core 2026-06-02 13:35:21.501889 | ubuntu-noble | Found installed collection kubevirt.core:2.2.3 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/kubevirt/core' 2026-06-02 13:35:21.502305 | ubuntu-noble | Loading collection sensu.sensu_go from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/sensu/sensu_go 2026-06-02 13:35:21.502754 | ubuntu-noble | Found installed collection sensu.sensu_go:1.14.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/sensu/sensu_go' 2026-06-02 13:35:21.504238 | ubuntu-noble | Loading collection vyos.vyos from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/vyos/vyos 2026-06-02 13:35:21.504594 | ubuntu-noble | Found installed collection vyos.vyos:5.0.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/vyos/vyos' 2026-06-02 13:35:21.504988 | ubuntu-noble | Loading collection ansible.posix from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/ansible/posix 2026-06-02 13:35:21.505446 | ubuntu-noble | Found installed collection ansible.posix:1.6.2 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/ansible/posix' 2026-06-02 13:35:21.506407 | ubuntu-noble | Loading collection kubernetes.core from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/kubernetes/core 2026-06-02 13:35:21.506802 | ubuntu-noble | Found installed collection kubernetes.core:5.4.1 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/kubernetes/core' 2026-06-02 13:35:21.507292 | ubuntu-noble | Loading collection community.sap_libs from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/sap_libs 2026-06-02 13:35:21.507658 | ubuntu-noble | Found installed collection community.sap_libs:1.5.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/sap_libs' 2026-06-02 13:35:21.509957 | ubuntu-noble | Loading collection community.windows from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/windows 2026-06-02 13:35:21.509986 | ubuntu-noble | Found installed collection community.windows:2.4.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/windows' 2026-06-02 13:35:21.509992 | ubuntu-noble | Loading collection community.library_inventory_filtering_v1 from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/library_inventory_filtering_v1 2026-06-02 13:35:21.510092 | ubuntu-noble | Found installed collection community.library_inventory_filtering_v1:1.1.5 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/library_inventory_filtering_v1' 2026-06-02 13:35:21.510109 | ubuntu-noble | Loading collection community.docker from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/docker 2026-06-02 13:35:21.510113 | ubuntu-noble | Found installed collection community.docker:4.8.2 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/docker' 2026-06-02 13:35:21.510123 | ubuntu-noble | Loading collection microsoft.iis from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/microsoft/iis 2026-06-02 13:35:21.510607 | ubuntu-noble | Found installed collection microsoft.iis:1.0.3 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/microsoft/iis' 2026-06-02 13:35:21.510946 | ubuntu-noble | Loading collection cyberark.conjur from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/cyberark/conjur 2026-06-02 13:35:21.511297 | ubuntu-noble | Found installed collection cyberark.conjur:1.3.8 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/cyberark/conjur' 2026-06-02 13:35:21.512304 | ubuntu-noble | Loading collection cisco.ios from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/cisco/ios 2026-06-02 13:35:21.512644 | ubuntu-noble | Found installed collection cisco.ios:9.2.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/cisco/ios' 2026-06-02 13:35:21.513194 | ubuntu-noble | Loading collection hitachivantara.vspone_block from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/hitachivantara/vspone_block 2026-06-02 13:35:21.513536 | ubuntu-noble | Found installed collection hitachivantara.vspone_block:3.5.1 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/hitachivantara/vspone_block' 2026-06-02 13:35:21.514057 | ubuntu-noble | Loading collection f5networks.f5_modules from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/f5networks/f5_modules 2026-06-02 13:35:21.514382 | ubuntu-noble | Found installed collection f5networks.f5_modules:1.39.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/f5networks/f5_modules' 2026-06-02 13:35:21.515113 | ubuntu-noble | Loading collection splunk.es from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/splunk/es 2026-06-02 13:35:21.515434 | ubuntu-noble | Found installed collection splunk.es:4.0.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/splunk/es' 2026-06-02 13:35:21.515728 | ubuntu-noble | Loading collection ieisystem.inmanage from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/ieisystem/inmanage 2026-06-02 13:35:21.516077 | ubuntu-noble | Found installed collection ieisystem.inmanage:3.0.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/ieisystem/inmanage' 2026-06-02 13:35:21.516544 | ubuntu-noble | Loading collection community.okd from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/okd 2026-06-02 13:35:21.517686 | ubuntu-noble | Found installed collection community.okd:4.0.2 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/okd' 2026-06-02 13:35:21.518279 | ubuntu-noble | Loading collection dellemc.enterprise_sonic from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/dellemc/enterprise_sonic 2026-06-02 13:35:21.518616 | ubuntu-noble | Found installed collection dellemc.enterprise_sonic:2.5.1 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/dellemc/enterprise_sonic' 2026-06-02 13:35:21.519240 | ubuntu-noble | Loading collection cisco.iosxr from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/cisco/iosxr 2026-06-02 13:35:21.519675 | ubuntu-noble | Found installed collection cisco.iosxr:10.3.1 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/cisco/iosxr' 2026-06-02 13:35:21.520203 | ubuntu-noble | Loading collection community.mysql from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/mysql 2026-06-02 13:35:21.520545 | ubuntu-noble | Found installed collection community.mysql:3.16.1 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/mysql' 2026-06-02 13:35:21.521062 | ubuntu-noble | Loading collection grafana.grafana from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/grafana/grafana 2026-06-02 13:35:21.521393 | ubuntu-noble | Found installed collection grafana.grafana:5.7.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/grafana/grafana' 2026-06-02 13:35:21.521808 | ubuntu-noble | Loading collection community.hashi_vault from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/hashi_vault 2026-06-02 13:35:21.522172 | ubuntu-noble | Found installed collection community.hashi_vault:6.2.1 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/hashi_vault' 2026-06-02 13:35:21.522511 | ubuntu-noble | Loading collection community.postgresql from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/postgresql 2026-06-02 13:35:21.522973 | ubuntu-noble | Found installed collection community.postgresql:3.14.2 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/postgresql' 2026-06-02 13:35:21.526501 | ubuntu-noble | Loading collection community.aws from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/aws 2026-06-02 13:35:21.526888 | ubuntu-noble | Found installed collection community.aws:9.3.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/aws' 2026-06-02 13:35:21.527346 | ubuntu-noble | Loading collection chocolatey.chocolatey from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/chocolatey/chocolatey 2026-06-02 13:35:21.527649 | ubuntu-noble | Found installed collection chocolatey.chocolatey:1.5.3 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/chocolatey/chocolatey' 2026-06-02 13:35:21.528101 | ubuntu-noble | Loading collection cyberark.pas from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/cyberark/pas 2026-06-02 13:35:21.528406 | ubuntu-noble | Found installed collection cyberark.pas:1.0.36 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/cyberark/pas' 2026-06-02 13:35:21.528799 | ubuntu-noble | Loading collection ngine_io.cloudstack from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/ngine_io/cloudstack 2026-06-02 13:35:21.529289 | ubuntu-noble | Found installed collection ngine_io.cloudstack:2.5.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/ngine_io/cloudstack' 2026-06-02 13:35:21.529583 | ubuntu-noble | Loading collection cisco.dnac from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/cisco/dnac 2026-06-02 13:35:21.529971 | ubuntu-noble | Found installed collection cisco.dnac:6.31.3 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/cisco/dnac' 2026-06-02 13:35:21.531286 | ubuntu-noble | Loading collection community.vmware from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/vmware 2026-06-02 13:35:21.531626 | ubuntu-noble | Found installed collection community.vmware:5.10.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/vmware' 2026-06-02 13:35:21.532017 | ubuntu-noble | Loading collection microsoft.ad from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/microsoft/ad 2026-06-02 13:35:21.532361 | ubuntu-noble | Found installed collection microsoft.ad:1.9.2 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/microsoft/ad' 2026-06-02 13:35:21.532784 | ubuntu-noble | Loading collection infinidat.infinibox from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/infinidat/infinibox 2026-06-02 13:35:21.534962 | ubuntu-noble | Found installed collection infinidat.infinibox:1.6.3 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/infinidat/infinibox' 2026-06-02 13:35:21.534987 | ubuntu-noble | Loading collection amazon.aws from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/amazon/aws 2026-06-02 13:35:21.535013 | ubuntu-noble | Found installed collection amazon.aws:9.5.2 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/amazon/aws' 2026-06-02 13:35:21.536614 | ubuntu-noble | Loading collection cisco.aci from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/cisco/aci 2026-06-02 13:35:21.537014 | ubuntu-noble | Found installed collection cisco.aci:2.12.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/cisco/aci' 2026-06-02 13:35:21.537371 | ubuntu-noble | Loading collection cisco.ucs from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/cisco/ucs 2026-06-02 13:35:21.537691 | ubuntu-noble | Found installed collection cisco.ucs:1.16.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/cisco/ucs' 2026-06-02 13:35:21.538188 | ubuntu-noble | Loading collection dellemc.openmanage from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/dellemc/openmanage 2026-06-02 13:35:21.538547 | ubuntu-noble | Found installed collection dellemc.openmanage:9.12.3 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/dellemc/openmanage' 2026-06-02 13:35:21.538884 | ubuntu-noble | Loading collection community.rabbitmq from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/rabbitmq 2026-06-02 13:35:21.539314 | ubuntu-noble | Found installed collection community.rabbitmq:1.6.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/rabbitmq' 2026-06-02 13:35:21.539657 | ubuntu-noble | Loading collection wti.remote from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/wti/remote 2026-06-02 13:35:21.539962 | ubuntu-noble | Found installed collection wti.remote:1.0.10 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/wti/remote' 2026-06-02 13:35:21.540876 | ubuntu-noble | Loading collection netapp.ontap from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/netapp/ontap 2026-06-02 13:35:21.541230 | ubuntu-noble | Found installed collection netapp.ontap:22.14.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/netapp/ontap' 2026-06-02 13:35:21.541500 | ubuntu-noble | Loading collection community.proxysql from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/proxysql 2026-06-02 13:35:21.541785 | ubuntu-noble | Found installed collection community.proxysql:1.7.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/proxysql' 2026-06-02 13:35:21.542104 | ubuntu-noble | Loading collection netapp.cloudmanager from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/netapp/cloudmanager 2026-06-02 13:35:21.542492 | ubuntu-noble | Found installed collection netapp.cloudmanager:21.24.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/netapp/cloudmanager' 2026-06-02 13:35:21.555694 | ubuntu-noble | Loading collection osism.services from /home/zuul/.ansible/collections/ansible_collections/osism/services 2026-06-02 13:35:21.556182 | ubuntu-noble | Found installed collection osism.services:999.0.0 at '/home/zuul/.ansible/collections/ansible_collections/osism/services' 2026-06-02 13:35:21.556470 | ubuntu-noble | Loading collection osism.commons from /home/zuul/.ansible/collections/ansible_collections/osism/commons 2026-06-02 13:35:21.557802 | ubuntu-noble | Found installed collection osism.commons:0.20260601.0 at '/home/zuul/.ansible/collections/ansible_collections/osism/commons' 2026-06-02 13:35:21.559696 | ubuntu-noble | Starting galaxy collection install process 2026-06-02 13:35:21.560040 | ubuntu-noble | Nothing to do. All requested collections are already installed. If you want to reinstall them, consider using `--force`. 2026-06-02 13:35:21.638228 | ubuntu-noble | INFO [delegated > dependency] Dependency completed successfully. 2026-06-02 13:35:21.638482 | ubuntu-noble | WARNING [delegated > dependency] Executed: Missing roles requirements file: requirements.yml (Remove from converge_sequence to suppress) 2026-06-02 13:35:21.657171 | ubuntu-noble | INFO [delegated > create] Executing 2026-06-02 13:35:21.660057 | ubuntu-noble | WARNING [delegated > create] Executed: Missing playbook (Remove from converge_sequence to suppress) 2026-06-02 13:35:21.670490 | ubuntu-noble | INFO [delegated > prepare] Executing 2026-06-02 13:35:21.670561 | ubuntu-noble | WARNING [delegated > prepare] Skipping, instances already prepared. 2026-06-02 13:35:21.670682 | ubuntu-noble | INFO [delegated > prepare] Executed: Successful 2026-06-02 13:35:21.679382 | ubuntu-noble | INFO [delegated > converge] Executing 2026-06-02 13:35:22.067194 | ubuntu-noble | DEBUG [delegated > converge] ansible-playbook version: ansible-playbook 2026-06-02 13:35:22.067255 | ubuntu-noble | config file = None 2026-06-02 13:35:22.067261 | ubuntu-noble | configured module search path = 2026-06-02 13:35:22.067266 | ubuntu-noble | ansible python module location = /home/zuul/venv/lib/python3.12/site-packages/ansible 2026-06-02 13:35:22.067270 | ubuntu-noble | ansible collection location = /home/zuul/.ansible/collections:/usr/share/ansible/collections 2026-06-02 13:35:22.067274 | ubuntu-noble | executable location = /home/zuul/venv/bin/ansible-playbook 2026-06-02 13:35:22.067278 | ubuntu-noble | python version = 3.12.3 (main, Mar 23 2026, 19:04:32) (/home/zuul/venv/bin/python3) 2026-06-02 13:35:22.067282 | ubuntu-noble | jinja version = 3.1.6 2026-06-02 13:35:22.067285 | ubuntu-noble | libyaml = True 2026-06-02 13:35:22.067451 | ubuntu-noble | DEBUG ANSIBLE ENVIRONMENT: 2026-06-02 13:35:22.067458 | ubuntu-noble | ANSIBLE_COLLECTIONS_PATH: /home/zuul/venv/.ansible/collections:/home/zuul/.ansible/collections 2026-06-02 13:35:22.067462 | ubuntu-noble | ANSIBLE_CONFIG: /home/zuul/.ansible/tmp/molecule.oWZD.delegated/ansible.cfg 2026-06-02 13:35:22.067465 | ubuntu-noble | ANSIBLE_LIBRARY: ../../plugins 2026-06-02 13:35:22.067469 | ubuntu-noble | ANSIBLE_PYTHON_INTERPRETER: /home/zuul/venv/bin/python 2026-06-02 13:35:22.067473 | ubuntu-noble | ANSIBLE_ROLE: auditd 2026-06-02 13:35:22.067476 | ubuntu-noble | ANSIBLE_ROLES_PATH: ../../roles 2026-06-02 13:35:22.067480 | ubuntu-noble | ANSIBLE_VERBOSITY: 1 2026-06-02 13:35:22.067485 | ubuntu-noble | 2026-06-02 13:35:22.067595 | ubuntu-noble | DEBUG MOLECULE ENVIRONMENT: 2026-06-02 13:35:22.067602 | ubuntu-noble | MOLECULE_DEBUG: True 2026-06-02 13:35:22.067605 | ubuntu-noble | MOLECULE_DEPENDENCY_NAME: galaxy 2026-06-02 13:35:22.067624 | ubuntu-noble | MOLECULE_DRIVER_NAME: default 2026-06-02 13:35:22.067628 | ubuntu-noble | MOLECULE_ENV_FILE: /home/zuul/src/github.com/osism/ansible-collection-services/.env.yml 2026-06-02 13:35:22.067632 | ubuntu-noble | MOLECULE_EPHEMERAL_DIRECTORY: /home/zuul/.ansible/tmp/molecule.oWZD.delegated 2026-06-02 13:35:22.067636 | ubuntu-noble | MOLECULE_FILE: /home/zuul/.ansible/tmp/molecule.oWZD.delegated/molecule.yml 2026-06-02 13:35:22.067639 | ubuntu-noble | MOLECULE_INSTANCE_CONFIG: /home/zuul/.ansible/tmp/molecule.oWZD.delegated/instance_config.yml 2026-06-02 13:35:22.067643 | ubuntu-noble | MOLECULE_INVENTORY_FILE: /home/zuul/.ansible/tmp/molecule.oWZD.delegated/inventory/ansible_inventory.yml 2026-06-02 13:35:22.067647 | ubuntu-noble | MOLECULE_PROJECT_DIRECTORY: /home/zuul/src/github.com/osism/ansible-collection-services 2026-06-02 13:35:22.067650 | ubuntu-noble | MOLECULE_PROVISIONER_NAME: ansible 2026-06-02 13:35:22.067654 | ubuntu-noble | MOLECULE_SCENARIO_DIRECTORY: /home/zuul/src/github.com/osism/ansible-collection-services/molecule/delegated 2026-06-02 13:35:22.067658 | ubuntu-noble | MOLECULE_SCENARIO_NAME: delegated 2026-06-02 13:35:22.067661 | ubuntu-noble | MOLECULE_STATE_FILE: /home/zuul/.ansible/tmp/molecule.oWZD.delegated/state.yml 2026-06-02 13:35:22.067665 | ubuntu-noble | MOLECULE_VERIFIER_NAME: testinfra 2026-06-02 13:35:22.067668 | ubuntu-noble | MOLECULE_VERIFIER_TEST_DIRECTORY: /home/zuul/src/github.com/osism/ansible-collection-services/molecule/delegated/tests 2026-06-02 13:35:22.067672 | ubuntu-noble | 2026-06-02 13:35:22.067848 | ubuntu-noble | DEBUG SHELL REPLAY: ANSIBLE_COLLECTIONS_PATH=/home/zuul/venv/.ansible/collections:/home/zuul/.ansible/collections ANSIBLE_CONFIG=/home/zuul/.ansible/tmp/molecule.oWZD.delegated/ansible.cfg ANSIBLE_LIBRARY=../../plugins ANSIBLE_PYTHON_INTERPRETER=/home/zuul/venv/bin/python ANSIBLE_ROLE=auditd ANSIBLE_ROLES_PATH=../../roles ANSIBLE_VERBOSITY=1 MOLECULE_DEBUG=True MOLECULE_DEPENDENCY_NAME=galaxy MOLECULE_DRIVER_NAME=default MOLECULE_ENV_FILE=/home/zuul/src/github.com/osism/ansible-collection-services/.env.yml MOLECULE_EPHEMERAL_DIRECTORY=/home/zuul/.ansible/tmp/molecule.oWZD.delegated MOLECULE_FILE=/home/zuul/.ansible/tmp/molecule.oWZD.delegated/molecule.yml MOLECULE_INSTANCE_CONFIG=/home/zuul/.ansible/tmp/molecule.oWZD.delegated/instance_config.yml MOLECULE_INVENTORY_FILE=/home/zuul/.ansible/tmp/molecule.oWZD.delegated/inventory/ansible_inventory.yml MOLECULE_PROJECT_DIRECTORY=/home/zuul/src/github.com/osism/ansible-collection-services MOLECULE_PROVISIONER_NAME=ansible MOLECULE_SCENARIO_DIRECTORY=/home/zuul/src/github.com/osism/ansible-collection-services/molecule/delegated MOLECULE_SCENARIO_NAME=delegated MOLECULE_STATE_FILE=/home/zuul/.ansible/tmp/molecule.oWZD.delegated/state.yml MOLECULE_VERIFIER_NAME=testinfra MOLECULE_VERIFIER_TEST_DIRECTORY=/home/zuul/src/github.com/osism/ansible-collection-services/molecule/delegated/tests 2026-06-02 13:35:22.840057 | debian-bookworm | ok: [molecule-auditd] 2026-06-02 13:35:22.840135 | debian-bookworm | 2026-06-02 13:35:22.840267 | debian-bookworm | TASK [Include required variables] ********************************************** 2026-06-02 13:35:22.864693 | debian-bookworm | ok: [molecule-auditd] => {"ansible_facts": {}, "ansible_included_var_files": ["/home/zuul/src/github.com/osism/ansible-collection-services/molecule/delegated/vars/auditd.yml"], "changed": false} 2026-06-02 13:35:22.864742 | debian-bookworm | 2026-06-02 13:35:22.864830 | debian-bookworm | TASK [Include role auditd] ***************************************************** 2026-06-02 13:35:22.389149 | ubuntu-noble | Using /home/zuul/.ansible/tmp/molecule.oWZD.delegated/ansible.cfg as config file 2026-06-02 13:35:22.672104 | ubuntu-noble | 2026-06-02 13:35:22.672204 | ubuntu-noble | PLAY [Converge] **************************************************************** 2026-06-02 13:35:22.672219 | ubuntu-noble | 2026-06-02 13:35:22.674358 | ubuntu-noble | TASK [Gathering Facts] ********************************************************* 2026-06-02 13:35:22.898336 | debian-bookworm | included: auditd for molecule-auditd 2026-06-02 13:35:22.898436 | debian-bookworm | 2026-06-02 13:35:22.898564 | debian-bookworm | TASK [auditd : Include distribution specific install tasks] ******************** 2026-06-02 13:35:22.921809 | debian-bookworm | included: /home/zuul/src/github.com/osism/ansible-collection-services/roles/auditd/tasks/install-Debian-family.yml for molecule-auditd 2026-06-02 13:35:22.921903 | debian-bookworm | 2026-06-02 13:35:22.922012 | debian-bookworm | TASK [auditd : Install auditd package] ***************************************** 2026-06-02 13:35:24.024519 | ubuntu-noble | ok: [molecule-auditd] 2026-06-02 13:35:24.024759 | ubuntu-noble | 2026-06-02 13:35:24.025052 | ubuntu-noble | TASK [Include required variables] ********************************************** 2026-06-02 13:35:24.062980 | ubuntu-noble | ok: [molecule-auditd] => {"ansible_facts": {}, "ansible_included_var_files": ["/home/zuul/src/github.com/osism/ansible-collection-services/molecule/delegated/vars/auditd.yml"], "changed": false} 2026-06-02 13:35:24.063216 | ubuntu-noble | 2026-06-02 13:35:24.063400 | ubuntu-noble | TASK [Include role auditd] ***************************************************** 2026-06-02 13:35:24.133381 | ubuntu-noble | included: auditd for molecule-auditd 2026-06-02 13:35:24.133807 | ubuntu-noble | 2026-06-02 13:35:24.134217 | ubuntu-noble | TASK [auditd : Include distribution specific install tasks] ******************** 2026-06-02 13:35:24.180654 | ubuntu-noble | included: /home/zuul/src/github.com/osism/ansible-collection-services/roles/auditd/tasks/install-Debian-family.yml for molecule-auditd 2026-06-02 13:35:24.180717 | ubuntu-noble | 2026-06-02 13:35:24.180725 | ubuntu-noble | TASK [auditd : Install auditd package] ***************************************** 2026-06-02 13:35:26.756907 | debian-bookworm | The following additional packages will be installed: 2026-06-02 13:35:26.757078 | debian-bookworm | libauparse0 2026-06-02 13:35:26.757258 | debian-bookworm | Suggested packages: 2026-06-02 13:35:26.757427 | debian-bookworm | audispd-plugins 2026-06-02 13:35:26.757600 | debian-bookworm | The following NEW packages will be installed: 2026-06-02 13:35:26.757787 | debian-bookworm | auditd libauparse0 2026-06-02 13:35:26.757957 | debian-bookworm | 0 upgraded, 2 newly installed, 0 to remove and 0 not upgraded. 2026-06-02 13:35:26.759327 | debian-bookworm | changed: [molecule-auditd] => {"cache_update_time": 1780407221, "cache_updated": false, "changed": true, "stderr": "debconf: delaying package configuration, since apt-utils is not installed\n", "stderr_lines": ["debconf: delaying package configuration, since apt-utils is not installed"], "stdout": "Reading package lists...\nBuilding dependency tree...\nReading state information...\nThe following additional packages will be installed:\n libauparse0\nSuggested packages:\n audispd-plugins\nThe following NEW packages will be installed:\n auditd libauparse0\n0 upgraded, 2 newly installed, 0 to remove and 0 not upgraded.\nNeed to get 279 kB of archives.\nAfter this operation, 934 kB of additional disk space will be used.\nGet:1 http://deb.debian.org/debian bookworm/main amd64 libauparse0 amd64 1:3.0.9-1 [61.9 kB]\nGet:2 http://deb.debian.org/debian bookworm/main amd64 auditd amd64 1:3.0.9-1 [218 kB]\nFetched 279 kB in 0s (3790 kB/s)\nSelecting previously unselected package libauparse0:amd64.\r\n(Reading database ... \r(Reading database ... 5%\r(Reading database ... 10%\r(Reading database ... 15%\r(Reading database ... 20%\r(Reading database ... 25%\r(Reading database ... 30%\r(Reading database ... 35%\r(Reading database ... 40%\r(Reading database ... 45%\r(Reading database ... 50%\r(Reading database ... 55%\r(Reading database ... 60%\r(Reading database ... 65%\r(Reading database ... 70%\r(Reading database ... 75%\r(Reading database ... 80%\r(Reading database ... 85%\r(Reading database ... 90%\r(Reading database ... 95%\r(Reading database ... 100%\r(Reading database ... 28689 files and directories currently installed.)\r\nPreparing to unpack .../libauparse0_1%3a3.0.9-1_amd64.deb ...\r\nUnpacking libauparse0:amd64 (1:3.0.9-1) ...\r\nSelecting previously unselected package auditd.\r\nPreparing to unpack .../auditd_1%3a3.0.9-1_amd64.deb ...\r\nUnpacking auditd (1:3.0.9-1) ...\r\nSetting up libauparse0:amd64 (1:3.0.9-1) ...\r\nSetting up auditd (1:3.0.9-1) ...\r\nCreated symlink /etc/systemd/system/multi-user.target.wants/auditd.service → /lib/systemd/system/auditd.service.\r\r\nProcessing triggers for libc-bin (2.36-9+deb12u14) ...\r\n", "stdout_lines": ["Reading package lists...", "Building dependency tree...", "Reading state information...", "The following additional packages will be installed:", " libauparse0", "Suggested packages:", " audispd-plugins", "The following NEW packages will be installed:", " auditd libauparse0", "0 upgraded, 2 newly installed, 0 to remove and 0 not upgraded.", "Need to get 279 kB of archives.", "After this operation, 934 kB of additional disk space will be used.", "Get:1 http://deb.debian.org/debian bookworm/main amd64 libauparse0 amd64 1:3.0.9-1 [61.9 kB]", "Get:2 http://deb.debian.org/debian bookworm/main amd64 auditd amd64 1:3.0.9-1 [218 kB]", "Fetched 279 kB in 0s (3790 kB/s)", "Selecting previously unselected package libauparse0:amd64.", "(Reading database ... ", "(Reading database ... 5%", "(Reading database ... 10%", "(Reading database ... 15%", "(Reading database ... 20%", "(Reading database ... 25%", "(Reading database ... 30%", "(Reading database ... 35%", "(Reading database ... 40%", "(Reading database ... 45%", "(Reading database ... 50%", "(Reading database ... 55%", "(Reading database ... 60%", "(Reading database ... 65%", "(Reading database ... 70%", "(Reading database ... 75%", "(Reading database ... 80%", "(Reading database ... 85%", "(Reading database ... 90%", "(Reading database ... 95%", "(Reading database ... 100%", "(Reading database ... 28689 files and directories currently installed.)", "Preparing to unpack .../libauparse0_1%3a3.0.9-1_amd64.deb ...", "Unpacking libauparse0:amd64 (1:3.0.9-1) ...", "Selecting previously unselected package auditd.", "Preparing to unpack .../auditd_1%3a3.0.9-1_amd64.deb ...", "Unpacking auditd (1:3.0.9-1) ...", "Setting up libauparse0:amd64 (1:3.0.9-1) ...", "Setting up auditd (1:3.0.9-1) ...", "Created symlink /etc/systemd/system/multi-user.target.wants/auditd.service → /lib/systemd/system/auditd.service.", "", "Processing triggers for libc-bin (2.36-9+deb12u14) ..."]} 2026-06-02 13:35:26.759443 | debian-bookworm | 2026-06-02 13:35:26.759638 | debian-bookworm | TASK [auditd : Install audispd-plugins package] ******************************** 2026-06-02 13:35:29.293008 | debian-bookworm | The following NEW packages will be installed: 2026-06-02 13:35:29.293077 | debian-bookworm | audispd-plugins 2026-06-02 13:35:29.293089 | debian-bookworm | 0 upgraded, 1 newly installed, 0 to remove and 0 not upgraded. 2026-06-02 13:35:29.293116 | debian-bookworm | changed: [molecule-auditd] => {"cache_update_time": 1780407221, "cache_updated": false, "changed": true, "stderr": "debconf: delaying package configuration, since apt-utils is not installed\n", "stderr_lines": ["debconf: delaying package configuration, since apt-utils is not installed"], "stdout": "Reading package lists...\nBuilding dependency tree...\nReading state information...\nThe following NEW packages will be installed:\n audispd-plugins\n0 upgraded, 1 newly installed, 0 to remove and 0 not upgraded.\nNeed to get 45.6 kB of archives.\nAfter this operation, 132 kB of additional disk space will be used.\nGet:1 http://deb.debian.org/debian bookworm/main amd64 audispd-plugins amd64 1:3.0.9-1 [45.6 kB]\nFetched 45.6 kB in 0s (930 kB/s)\nSelecting previously unselected package audispd-plugins.\r\n(Reading database ... \r(Reading database ... 5%\r(Reading database ... 10%\r(Reading database ... 15%\r(Reading database ... 20%\r(Reading database ... 25%\r(Reading database ... 30%\r(Reading database ... 35%\r(Reading database ... 40%\r(Reading database ... 45%\r(Reading database ... 50%\r(Reading database ... 55%\r(Reading database ... 60%\r(Reading database ... 65%\r(Reading database ... 70%\r(Reading database ... 75%\r(Reading database ... 80%\r(Reading database ... 85%\r(Reading database ... 90%\r(Reading database ... 95%\r(Reading database ... 100%\r(Reading database ... 28780 files and directories currently installed.)\r\nPreparing to unpack .../audispd-plugins_1%3a3.0.9-1_amd64.deb ...\r\nUnpacking audispd-plugins (1:3.0.9-1) ...\r\nSetting up audispd-plugins (1:3.0.9-1) ...\r\n", "stdout_lines": ["Reading package lists...", "Building dependency tree...", "Reading state information...", "The following NEW packages will be installed:", " audispd-plugins", "0 upgraded, 1 newly installed, 0 to remove and 0 not upgraded.", "Need to get 45.6 kB of archives.", "After this operation, 132 kB of additional disk space will be used.", "Get:1 http://deb.debian.org/debian bookworm/main amd64 audispd-plugins amd64 1:3.0.9-1 [45.6 kB]", "Fetched 45.6 kB in 0s (930 kB/s)", "Selecting previously unselected package audispd-plugins.", "(Reading database ... ", "(Reading database ... 5%", "(Reading database ... 10%", "(Reading database ... 15%", "(Reading database ... 20%", "(Reading database ... 25%", "(Reading database ... 30%", "(Reading database ... 35%", "(Reading database ... 40%", "(Reading database ... 45%", "(Reading database ... 50%", "(Reading database ... 55%", "(Reading database ... 60%", "(Reading database ... 65%", "(Reading database ... 70%", "(Reading database ... 75%", "(Reading database ... 80%", "(Reading database ... 85%", "(Reading database ... 90%", "(Reading database ... 95%", "(Reading database ... 100%", "(Reading database ... 28780 files and directories currently installed.)", "Preparing to unpack .../audispd-plugins_1%3a3.0.9-1_amd64.deb ...", "Unpacking audispd-plugins (1:3.0.9-1) ...", "Setting up audispd-plugins (1:3.0.9-1) ..."]} 2026-06-02 13:35:29.293129 | debian-bookworm | 2026-06-02 13:35:29.293228 | debian-bookworm | TASK [auditd : Copy auditd.conf configuration files] *************************** 2026-06-02 13:35:29.184402 | ubuntu-noble | The following additional packages will be installed: 2026-06-02 13:35:29.184659 | ubuntu-noble | libauparse0t64 2026-06-02 13:35:29.184827 | ubuntu-noble | Suggested packages: 2026-06-02 13:35:29.186958 | ubuntu-noble | audispd-plugins 2026-06-02 13:35:29.186993 | ubuntu-noble | The following NEW packages will be installed: 2026-06-02 13:35:29.187018 | ubuntu-noble | auditd libauparse0t64 2026-06-02 13:35:29.187029 | ubuntu-noble | 0 upgraded, 2 newly installed, 0 to remove and 3 not upgraded. 2026-06-02 13:35:29.188975 | ubuntu-noble | changed: [molecule-auditd] => {"cache_update_time": 1780407224, "cache_updated": false, "changed": true, "stderr": "debconf: delaying package configuration, since apt-utils is not installed\n", "stderr_lines": ["debconf: delaying package configuration, since apt-utils is not installed"], "stdout": "Reading package lists...\nBuilding dependency tree...\nReading state information...\nThe following additional packages will be installed:\n libauparse0t64\nSuggested packages:\n audispd-plugins\nThe following NEW packages will be installed:\n auditd libauparse0t64\n0 upgraded, 2 newly installed, 0 to remove and 3 not upgraded.\nNeed to get 274 kB of archives.\nAfter this operation, 893 kB of additional disk space will be used.\nGet:1 http://archive.ubuntu.com/ubuntu noble-updates/main amd64 libauparse0t64 amd64 1:3.1.2-2.1build1.1 [58.9 kB]\nGet:2 http://archive.ubuntu.com/ubuntu noble-updates/main amd64 auditd amd64 1:3.1.2-2.1build1.1 [215 kB]\nFetched 274 kB in 0s (1976 kB/s)\nSelecting previously unselected package libauparse0t64:amd64.\r\n(Reading database ... \r(Reading database ... 5%\r(Reading database ... 10%\r(Reading database ... 15%\r(Reading database ... 20%\r(Reading database ... 25%\r(Reading database ... 30%\r(Reading database ... 35%\r(Reading database ... 40%\r(Reading database ... 45%\r(Reading database ... 50%\r(Reading database ... 55%\r(Reading database ... 60%\r(Reading database ... 65%\r(Reading database ... 70%\r(Reading database ... 75%\r(Reading database ... 80%\r(Reading database ... 85%\r(Reading database ... 90%\r(Reading database ... 95%\r(Reading database ... 100%\r(Reading database ... 36110 files and directories currently installed.)\r\nPreparing to unpack .../libauparse0t64_1%3a3.1.2-2.1build1.1_amd64.deb ...\r\nAdding 'diversion of /lib/x86_64-linux-gnu/libauparse.so.0 to /lib/x86_64-linux-gnu/libauparse.so.0.usr-is-merged by libauparse0t64'\r\nAdding 'diversion of /lib/x86_64-linux-gnu/libauparse.so.0.0.0 to /lib/x86_64-linux-gnu/libauparse.so.0.0.0.usr-is-merged by libauparse0t64'\r\nUnpacking libauparse0t64:amd64 (1:3.1.2-2.1build1.1) ...\r\nSelecting previously unselected package auditd.\r\nPreparing to unpack .../auditd_1%3a3.1.2-2.1build1.1_amd64.deb ...\r\nUnpacking auditd (1:3.1.2-2.1build1.1) ...\r\nSetting up libauparse0t64:amd64 (1:3.1.2-2.1build1.1) ...\r\nSetting up auditd (1:3.1.2-2.1build1.1) ...\r\nCreated symlink /etc/systemd/system/multi-user.target.wants/auditd.service → /usr/lib/systemd/system/auditd.service.\r\r\nProcessing triggers for libc-bin (2.39-0ubuntu8.7) ...\r\n", "stdout_lines": ["Reading package lists...", "Building dependency tree...", "Reading state information...", "The following additional packages will be installed:", " libauparse0t64", "Suggested packages:", " audispd-plugins", "The following NEW packages will be installed:", " auditd libauparse0t64", "0 upgraded, 2 newly installed, 0 to remove and 3 not upgraded.", "Need to get 274 kB of archives.", "After this operation, 893 kB of additional disk space will be used.", "Get:1 http://archive.ubuntu.com/ubuntu noble-updates/main amd64 libauparse0t64 amd64 1:3.1.2-2.1build1.1 [58.9 kB]", "Get:2 http://archive.ubuntu.com/ubuntu noble-updates/main amd64 auditd amd64 1:3.1.2-2.1build1.1 [215 kB]", "Fetched 274 kB in 0s (1976 kB/s)", "Selecting previously unselected package libauparse0t64:amd64.", "(Reading database ... ", "(Reading database ... 5%", "(Reading database ... 10%", "(Reading database ... 15%", "(Reading database ... 20%", "(Reading database ... 25%", "(Reading database ... 30%", "(Reading database ... 35%", "(Reading database ... 40%", "(Reading database ... 45%", "(Reading database ... 50%", "(Reading database ... 55%", "(Reading database ... 60%", "(Reading database ... 65%", "(Reading database ... 70%", "(Reading database ... 75%", "(Reading database ... 80%", "(Reading database ... 85%", "(Reading database ... 90%", "(Reading database ... 95%", "(Reading database ... 100%", "(Reading database ... 36110 files and directories currently installed.)", "Preparing to unpack .../libauparse0t64_1%3a3.1.2-2.1build1.1_amd64.deb ...", "Adding 'diversion of /lib/x86_64-linux-gnu/libauparse.so.0 to /lib/x86_64-linux-gnu/libauparse.so.0.usr-is-merged by libauparse0t64'", "Adding 'diversion of /lib/x86_64-linux-gnu/libauparse.so.0.0.0 to /lib/x86_64-linux-gnu/libauparse.so.0.0.0.usr-is-merged by libauparse0t64'", "Unpacking libauparse0t64:amd64 (1:3.1.2-2.1build1.1) ...", "Selecting previously unselected package auditd.", "Preparing to unpack .../auditd_1%3a3.1.2-2.1build1.1_amd64.deb ...", "Unpacking auditd (1:3.1.2-2.1build1.1) ...", "Setting up libauparse0t64:amd64 (1:3.1.2-2.1build1.1) ...", "Setting up auditd (1:3.1.2-2.1build1.1) ...", "Created symlink /etc/systemd/system/multi-user.target.wants/auditd.service → /usr/lib/systemd/system/auditd.service.", "", "Processing triggers for libc-bin (2.39-0ubuntu8.7) ..."]} 2026-06-02 13:35:29.189183 | ubuntu-noble | 2026-06-02 13:35:29.189341 | ubuntu-noble | TASK [auditd : Install audispd-plugins package] ******************************** 2026-06-02 13:35:30.392129 | debian-bookworm | --- before 2026-06-02 13:35:30.392214 | debian-bookworm | +++ after: /home/zuul/.ansible/tmp/ansible-local-2086qm5j61hv/tmpgy9fktrp/auditd.conf.j2 2026-06-02 13:35:30.392230 | debian-bookworm | @@ -0,0 +1,37 @@ 2026-06-02 13:35:30.392239 | debian-bookworm | +# 2026-06-02 13:35:30.392315 | debian-bookworm | +# This file controls the configuration of the audit daemon 2026-06-02 13:35:30.392409 | debian-bookworm | +# 2026-06-02 13:35:30.392502 | debian-bookworm | + 2026-06-02 13:35:30.392614 | debian-bookworm | +local_events = yes 2026-06-02 13:35:30.392706 | debian-bookworm | +write_logs = yes 2026-06-02 13:35:30.392808 | debian-bookworm | +log_file = /var/log/audit/audit.log 2026-06-02 13:35:30.392909 | debian-bookworm | +log_group = adm 2026-06-02 13:35:30.393005 | debian-bookworm | +log_format = RAW 2026-06-02 13:35:30.393102 | debian-bookworm | +flush = INCREMENTAL_ASYNC 2026-06-02 13:35:30.393197 | debian-bookworm | +freq = 50 2026-06-02 13:35:30.393294 | debian-bookworm | +max_log_file = 8 2026-06-02 13:35:30.393386 | debian-bookworm | +num_logs = 5 2026-06-02 13:35:30.393479 | debian-bookworm | +priority_boost = 4 2026-06-02 13:35:30.393574 | debian-bookworm | +disp_qos = lossy 2026-06-02 13:35:30.393878 | debian-bookworm | +dispatcher = /sbin/audispd 2026-06-02 13:35:30.393991 | debian-bookworm | +name_format = NONE 2026-06-02 13:35:30.394125 | debian-bookworm | +##name = mydomain 2026-06-02 13:35:30.394258 | debian-bookworm | +max_log_file_action = ROTATE 2026-06-02 13:35:30.394361 | debian-bookworm | +space_left = 12361 2026-06-02 13:35:30.394451 | debian-bookworm | +space_left_action = email 2026-06-02 13:35:30.394549 | debian-bookworm | +verify_email = yes 2026-06-02 13:35:30.394687 | debian-bookworm | +action_mail_acct = root 2026-06-02 13:35:30.394777 | debian-bookworm | +admin_space_left = 50 2026-06-02 13:35:30.394877 | debian-bookworm | +admin_space_left_action = SUSPEND 2026-06-02 13:35:30.394974 | debian-bookworm | +disk_full_action = SUSPEND 2026-06-02 13:35:30.395069 | debian-bookworm | +disk_error_action = SUSPEND 2026-06-02 13:35:30.395164 | debian-bookworm | +use_libwrap = yes 2026-06-02 13:35:30.395283 | debian-bookworm | +##tcp_listen_port = 60 2026-06-02 13:35:30.395379 | debian-bookworm | +tcp_listen_queue = 5 2026-06-02 13:35:30.395472 | debian-bookworm | +tcp_max_per_addr = 1 2026-06-02 13:35:30.395570 | debian-bookworm | +##tcp_client_ports = 1024-65535 2026-06-02 13:35:30.395683 | debian-bookworm | +tcp_client_max_idle = 0 2026-06-02 13:35:30.395777 | debian-bookworm | +enable_krb5 = no 2026-06-02 13:35:30.395871 | debian-bookworm | +krb5_principal = auditd 2026-06-02 13:35:30.395969 | debian-bookworm | +##krb5_key_file = /etc/audit/audit.key 2026-06-02 13:35:30.396066 | debian-bookworm | +distribute_network = no 2026-06-02 13:35:30.396156 | debian-bookworm | 2026-06-02 13:35:30.396275 | debian-bookworm | changed: [molecule-auditd] => {"changed": true, "checksum": "e902cc6bebf86c17087d153e359a2cc1231672e0", "dest": "/etc/audit/audit.conf", "gid": 0, "group": "root", "md5sum": "69dfd768317bae876a6a78c8aeb5cce1", "mode": "0640", "owner": "root", "size": 806, "src": "/home/zuul/.ansible/tmp/ansible-tmp-1780407329.313356-2456-257297360812581/.source.conf", "state": "file", "uid": 0} 2026-06-02 13:35:30.396355 | debian-bookworm | 2026-06-02 13:35:30.396466 | debian-bookworm | TASK [auditd : Adjust auditd/audispd configurations] *************************** 2026-06-02 13:35:30.786955 | debian-bookworm | ok: [molecule-auditd] => (item={'parameter': 'active', 'value': 'no', 'config': '/etc/audit/plugins.d/syslog.conf'}) => {"ansible_loop_var": "item", "backup": "", "changed": false, "item": {"config": "/etc/audit/plugins.d/syslog.conf", "parameter": "active", "value": "no"}, "msg": ""} 2026-06-02 13:35:30.787082 | debian-bookworm | 2026-06-02 13:35:30.787290 | debian-bookworm | TASK [auditd : Deploy rules for auditd] **************************************** 2026-06-02 13:35:31.534280 | debian-bookworm | --- before 2026-06-02 13:35:31.534518 | debian-bookworm | +++ after: /home/zuul/.ansible/tmp/ansible-local-2086qm5j61hv/tmpny85_3_k/20-neo23x0.rules.j2 2026-06-02 13:35:31.534783 | debian-bookworm | @@ -0,0 +1,750 @@ 2026-06-02 13:35:31.534994 | debian-bookworm | +# ___ ___ __ __ 2026-06-02 13:35:31.535157 | debian-bookworm | +# / | __ ______/ (_) /_____/ / 2026-06-02 13:35:31.535421 | debian-bookworm | +# / /| |/ / / / __ / / __/ __ / 2026-06-02 13:35:31.536873 | debian-bookworm | +# / ___ / /_/ / /_/ / / /_/ /_/ / 2026-06-02 13:35:31.536894 | debian-bookworm | +# /_/ |_\__,_/\__,_/_/\__/\__,_/ 2026-06-02 13:35:31.536899 | debian-bookworm | +# 2026-06-02 13:35:31.536904 | debian-bookworm | +# Linux Audit Daemon - Best Practice Configuration 2026-06-02 13:35:31.536908 | debian-bookworm | +# /etc/audit/audit.rules 2026-06-02 13:35:31.536913 | debian-bookworm | +# 2026-06-02 13:35:31.536917 | debian-bookworm | +# Compiled by Florian Roth 2026-06-02 13:35:31.536921 | debian-bookworm | +# 2026-06-02 13:35:31.536928 | debian-bookworm | +# Created : 2017/12/05 2026-06-02 13:35:31.539360 | debian-bookworm | +# Modified : 2023/01/25 2026-06-02 13:35:31.539386 | debian-bookworm | +# 2026-06-02 13:35:31.539392 | debian-bookworm | +# Based on rules published here: 2026-06-02 13:35:31.539396 | debian-bookworm | +# Gov.uk auditd rules 2026-06-02 13:35:31.539400 | debian-bookworm | +# https://github.com/gds-operations/puppet-auditd/pull/1 2026-06-02 13:35:31.539405 | debian-bookworm | +# CentOS 7 hardening 2026-06-02 13:35:31.539409 | debian-bookworm | +# https://highon.coffee/blog/security-harden-centos-7/#auditd---audit-daemon 2026-06-02 13:35:31.539414 | debian-bookworm | +# Linux audit repo 2026-06-02 13:35:31.539418 | debian-bookworm | +# https://github.com/linux-audit/audit-userspace/tree/master/rules 2026-06-02 13:35:31.539423 | debian-bookworm | +# Auditd high performance linux auditing 2026-06-02 13:35:31.539431 | debian-bookworm | +# https://linux-audit.com/tuning-auditd-high-performance-linux-auditing/ 2026-06-02 13:35:31.539538 | debian-bookworm | +# 2026-06-02 13:35:31.539690 | debian-bookworm | +# Further rules 2026-06-02 13:35:31.539887 | debian-bookworm | +# For PCI DSS compliance see: 2026-06-02 13:35:31.540102 | debian-bookworm | +# https://github.com/linux-audit/audit-userspace/blob/master/rules/30-pci-dss-v31.rules 2026-06-02 13:35:31.540294 | debian-bookworm | +# For NISPOM compliance see: 2026-06-02 13:35:31.540494 | debian-bookworm | +# https://github.com/linux-audit/audit-userspace/blob/master/rules/30-nispom.rules 2026-06-02 13:35:31.540643 | debian-bookworm | + 2026-06-02 13:35:31.540781 | debian-bookworm | +# Remove any existing rules 2026-06-02 13:35:31.540914 | debian-bookworm | +-D 2026-06-02 13:35:31.541045 | debian-bookworm | + 2026-06-02 13:35:31.541175 | debian-bookworm | +# Buffer Size 2026-06-02 13:35:31.541310 | debian-bookworm | +## Feel free to increase this if the machine panic's 2026-06-02 13:35:31.541444 | debian-bookworm | +-b 8192 2026-06-02 13:35:31.541576 | debian-bookworm | + 2026-06-02 13:35:31.541723 | debian-bookworm | +# Failure Mode 2026-06-02 13:35:31.541864 | debian-bookworm | +## Possible values: 0 (silent), 1 (printk, print a failure message), 2 (panic, halt the system) 2026-06-02 13:35:31.541999 | debian-bookworm | +-f 1 2026-06-02 13:35:31.542139 | debian-bookworm | + 2026-06-02 13:35:31.542310 | debian-bookworm | +# Ignore errors 2026-06-02 13:35:31.542400 | debian-bookworm | +## e.g. caused by users or files not found in the local environment 2026-06-02 13:35:31.542535 | debian-bookworm | +-i 2026-06-02 13:35:31.542710 | debian-bookworm | + 2026-06-02 13:35:31.542908 | debian-bookworm | +# Self Auditing --------------------------------------------------------------- 2026-06-02 13:35:31.542968 | debian-bookworm | + 2026-06-02 13:35:31.543287 | debian-bookworm | +## Audit the audit logs 2026-06-02 13:35:31.543296 | debian-bookworm | +### Successful and unsuccessful attempts to read information from the audit records 2026-06-02 13:35:31.543418 | debian-bookworm | +-w /var/log/audit/ -p wra -k auditlog 2026-06-02 13:35:31.543527 | debian-bookworm | +-w /var/audit/ -p wra -k auditlog 2026-06-02 13:35:31.543660 | debian-bookworm | + 2026-06-02 13:35:31.543781 | debian-bookworm | +## Auditd configuration 2026-06-02 13:35:31.543905 | debian-bookworm | +### Modifications to audit configuration that occur while the audit collection functions are operating 2026-06-02 13:35:31.544027 | debian-bookworm | +-w /etc/audit/ -p wa -k auditconfig 2026-06-02 13:35:31.544160 | debian-bookworm | +-w /etc/libaudit.conf -p wa -k auditconfig 2026-06-02 13:35:31.544281 | debian-bookworm | +-w /etc/audisp/ -p wa -k audispconfig 2026-06-02 13:35:31.544399 | debian-bookworm | + 2026-06-02 13:35:31.544519 | debian-bookworm | +## Monitor for use of audit management tools 2026-06-02 13:35:31.544655 | debian-bookworm | +-w /sbin/auditctl -p x -k audittools 2026-06-02 13:35:31.544778 | debian-bookworm | +-w /sbin/auditd -p x -k audittools 2026-06-02 13:35:31.544899 | debian-bookworm | +-w /usr/sbin/auditd -p x -k audittools 2026-06-02 13:35:31.545023 | debian-bookworm | +-w /usr/sbin/augenrules -p x -k audittools 2026-06-02 13:35:31.545144 | debian-bookworm | + 2026-06-02 13:35:31.545266 | debian-bookworm | +## Access to all audit trails 2026-06-02 13:35:31.545387 | debian-bookworm | + 2026-06-02 13:35:31.545561 | debian-bookworm | +-a always,exit -F path=/usr/sbin/ausearch -F perm=x -k audittools 2026-06-02 13:35:31.545704 | debian-bookworm | +-a always,exit -F path=/usr/sbin/aureport -F perm=x -k audittools 2026-06-02 13:35:31.545826 | debian-bookworm | +-a always,exit -F path=/usr/sbin/aulast -F perm=x -k audittools 2026-06-02 13:35:31.545949 | debian-bookworm | +-a always,exit -F path=/usr/sbin/aulastlogin -F perm=x -k audittools 2026-06-02 13:35:31.546072 | debian-bookworm | +-a always,exit -F path=/usr/sbin/auvirt -F perm=x -k audittools 2026-06-02 13:35:31.546191 | debian-bookworm | + 2026-06-02 13:35:31.546311 | debian-bookworm | +# Filters --------------------------------------------------------------------- 2026-06-02 13:35:31.546428 | debian-bookworm | + 2026-06-02 13:35:31.546549 | debian-bookworm | +### We put these early because audit is a first match wins system. 2026-06-02 13:35:31.546704 | debian-bookworm | + 2026-06-02 13:35:31.546831 | debian-bookworm | +## Ignore SELinux AVC records 2026-06-02 13:35:31.546955 | debian-bookworm | +-a always,exclude -F msgtype=AVC 2026-06-02 13:35:31.547071 | debian-bookworm | + 2026-06-02 13:35:31.547211 | debian-bookworm | +## Ignore current working directory records 2026-06-02 13:35:31.547325 | debian-bookworm | +-a always,exclude -F msgtype=CWD 2026-06-02 13:35:31.547438 | debian-bookworm | + 2026-06-02 13:35:31.547555 | debian-bookworm | +## Cron jobs fill the logs with stuff we normally don't want (works with SELinux) 2026-06-02 13:35:31.547681 | debian-bookworm | +-a never,user -F subj_type=crond_t 2026-06-02 13:35:31.547796 | debian-bookworm | +-a never,exit -F subj_type=crond_t 2026-06-02 13:35:31.547909 | debian-bookworm | + 2026-06-02 13:35:31.548046 | debian-bookworm | +## This prevents chrony from overwhelming the logs 2026-06-02 13:35:31.548146 | debian-bookworm | +-a never,exit -F arch=b64 -S adjtimex -F auid=-1 -F uid=chrony -F subj_type=chronyd_t 2026-06-02 13:35:31.548257 | debian-bookworm | + 2026-06-02 13:35:31.548375 | debian-bookworm | +## This is not very interesting and wastes a lot of space if the server is public facing 2026-06-02 13:35:31.548501 | debian-bookworm | +-a always,exclude -F msgtype=CRYPTO_KEY_USER 2026-06-02 13:35:31.548637 | debian-bookworm | + 2026-06-02 13:35:31.548757 | debian-bookworm | +## Open VM Tools 2026-06-02 13:35:31.548868 | debian-bookworm | +-a exit,never -F arch=b64 -S all -F exe=/usr/bin/vmtoolsd 2026-06-02 13:35:31.548968 | debian-bookworm | + 2026-06-02 13:35:31.549080 | debian-bookworm | +## High Volume Event Filter (especially on Linux Workstations) 2026-06-02 13:35:31.549187 | debian-bookworm | +-a never,exit -F arch=b64 -F dir=/dev/shm -k sharedmemaccess 2026-06-02 13:35:31.549292 | debian-bookworm | +-a never,exit -F arch=b64 -F dir=/var/lock/lvm -k locklvm 2026-06-02 13:35:31.549394 | debian-bookworm | + 2026-06-02 13:35:31.549498 | debian-bookworm | +## FileBeat 2026-06-02 13:35:31.549648 | debian-bookworm | +-a never,exit -F arch=b64 -F path=/opt/filebeat -k filebeat 2026-06-02 13:35:31.549715 | debian-bookworm | + 2026-06-02 13:35:31.549819 | debian-bookworm | +## More information on how to filter events 2026-06-02 13:35:31.549936 | debian-bookworm | +### https://access.redhat.com/solutions/2482221 2026-06-02 13:35:31.550033 | debian-bookworm | + 2026-06-02 13:35:31.550138 | debian-bookworm | +# Rules ----------------------------------------------------------------------- 2026-06-02 13:35:31.550240 | debian-bookworm | + 2026-06-02 13:35:31.550343 | debian-bookworm | +## Kernel parameters 2026-06-02 13:35:31.550447 | debian-bookworm | +-w /etc/sysctl.conf -p wa -k sysctl 2026-06-02 13:35:31.550550 | debian-bookworm | +-w /etc/sysctl.d -p wa -k sysctl 2026-06-02 13:35:31.550663 | debian-bookworm | + 2026-06-02 13:35:31.550766 | debian-bookworm | +## Kernel module loading and unloading 2026-06-02 13:35:31.550876 | debian-bookworm | +-a always,exit -F perm=x -F auid!=-1 -F path=/sbin/insmod -k modules 2026-06-02 13:35:31.550981 | debian-bookworm | +-a always,exit -F perm=x -F auid!=-1 -F path=/sbin/modprobe -k modules 2026-06-02 13:35:31.551087 | debian-bookworm | +-a always,exit -F perm=x -F auid!=-1 -F path=/sbin/rmmod -k modules 2026-06-02 13:35:31.551210 | debian-bookworm | +-a always,exit -F arch=b64 -S finit_module -S init_module -S delete_module -F auid!=-1 -k modules 2026-06-02 13:35:31.551329 | debian-bookworm | + 2026-06-02 13:35:31.551433 | debian-bookworm | +## Modprobe configuration 2026-06-02 13:35:31.551544 | debian-bookworm | +-w /etc/modprobe.conf -p wa -k modprobe 2026-06-02 13:35:31.551675 | debian-bookworm | +-w /etc/modprobe.d -p wa -k modprobe 2026-06-02 13:35:31.551780 | debian-bookworm | + 2026-06-02 13:35:31.551886 | debian-bookworm | +## KExec usage (all actions) 2026-06-02 13:35:31.551995 | debian-bookworm | +-a always,exit -F arch=b64 -S kexec_load -k KEXEC 2026-06-02 13:35:31.552089 | debian-bookworm | + 2026-06-02 13:35:31.552182 | debian-bookworm | +## Special files 2026-06-02 13:35:31.552281 | debian-bookworm | +-a always,exit -F arch=b64 -S mknod -S mknodat -k specialfiles 2026-06-02 13:35:31.552386 | debian-bookworm | + 2026-06-02 13:35:31.552473 | debian-bookworm | +## Mount operations (only attributable) 2026-06-02 13:35:31.552572 | debian-bookworm | +-a always,exit -F arch=b64 -S mount -S umount2 -F auid!=-1 -k mount 2026-06-02 13:35:31.552678 | debian-bookworm | + 2026-06-02 13:35:31.552773 | debian-bookworm | +### NFS mount 2026-06-02 13:35:31.552880 | debian-bookworm | +-a always,exit -F path=/sbin/mount.nfs -F perm=x -F auid>=500 -F auid!=4294967295 -k T1078_Valid_Accounts 2026-06-02 13:35:31.552977 | debian-bookworm | +-a always,exit -F path=/usr/sbin/mount.nfs -F perm=x -F auid>=500 -F auid!=4294967295 -k T1078_Valid_Accounts 2026-06-02 13:35:31.553066 | debian-bookworm | + 2026-06-02 13:35:31.553161 | debian-bookworm | +## Change swap (only attributable) 2026-06-02 13:35:31.553257 | debian-bookworm | +-a always,exit -F arch=b64 -S swapon -S swapoff -F auid!=-1 -k swap 2026-06-02 13:35:31.553350 | debian-bookworm | + 2026-06-02 13:35:31.553475 | debian-bookworm | +## Time 2026-06-02 13:35:31.553541 | debian-bookworm | +-a always,exit -F arch=b64 -F uid!=ntp -S adjtimex -S settimeofday -S clock_settime -k time 2026-06-02 13:35:31.553649 | debian-bookworm | +### Local time zone 2026-06-02 13:35:31.553751 | debian-bookworm | +-w /etc/localtime -p wa -k localtime 2026-06-02 13:35:31.553845 | debian-bookworm | + 2026-06-02 13:35:31.553940 | debian-bookworm | +## Stunnel 2026-06-02 13:35:31.554035 | debian-bookworm | +-w /usr/sbin/stunnel -p x -k stunnel 2026-06-02 13:35:31.554133 | debian-bookworm | +-w /usr/bin/stunnel -p x -k stunnel 2026-06-02 13:35:31.554224 | debian-bookworm | + 2026-06-02 13:35:31.554320 | debian-bookworm | +## Cron configuration & scheduled jobs 2026-06-02 13:35:31.554414 | debian-bookworm | +-w /etc/cron.allow -p wa -k cron 2026-06-02 13:35:31.554507 | debian-bookworm | +-w /etc/cron.deny -p wa -k cron 2026-06-02 13:35:31.554628 | debian-bookworm | +-w /etc/cron.d/ -p wa -k cron 2026-06-02 13:35:31.554730 | debian-bookworm | +-w /etc/cron.daily/ -p wa -k cron 2026-06-02 13:35:31.554823 | debian-bookworm | +-w /etc/cron.hourly/ -p wa -k cron 2026-06-02 13:35:31.554921 | debian-bookworm | +-w /etc/cron.monthly/ -p wa -k cron 2026-06-02 13:35:31.555014 | debian-bookworm | +-w /etc/cron.weekly/ -p wa -k cron 2026-06-02 13:35:31.555110 | debian-bookworm | +-w /etc/crontab -p wa -k cron 2026-06-02 13:35:31.555224 | debian-bookworm | +-w /var/spool/cron/ -p wa -k cron 2026-06-02 13:35:31.555317 | debian-bookworm | + 2026-06-02 13:35:31.555412 | debian-bookworm | +## User, group, password databases 2026-06-02 13:35:31.555506 | debian-bookworm | +-w /etc/group -p wa -k etcgroup 2026-06-02 13:35:31.555626 | debian-bookworm | +-w /etc/passwd -p wa -k etcpasswd 2026-06-02 13:35:31.555708 | debian-bookworm | +-w /etc/gshadow -k etcgroup 2026-06-02 13:35:31.555802 | debian-bookworm | +-w /etc/shadow -k etcpasswd 2026-06-02 13:35:31.555899 | debian-bookworm | +-w /etc/security/opasswd -k opasswd 2026-06-02 13:35:31.555992 | debian-bookworm | + 2026-06-02 13:35:31.556085 | debian-bookworm | +## Sudoers file changes 2026-06-02 13:35:31.556179 | debian-bookworm | +-w /etc/sudoers -p wa -k actions 2026-06-02 13:35:31.556271 | debian-bookworm | +-w /etc/sudoers.d/ -p wa -k actions 2026-06-02 13:35:31.556360 | debian-bookworm | + 2026-06-02 13:35:31.556453 | debian-bookworm | +## Passwd 2026-06-02 13:35:31.556551 | debian-bookworm | +-w /usr/bin/passwd -p x -k passwd_modification 2026-06-02 13:35:31.556653 | debian-bookworm | + 2026-06-02 13:35:31.556761 | debian-bookworm | +## Tools to change group identifiers 2026-06-02 13:35:31.556845 | debian-bookworm | +-w /usr/sbin/groupadd -p x -k group_modification 2026-06-02 13:35:31.556944 | debian-bookworm | +-w /usr/sbin/groupmod -p x -k group_modification 2026-06-02 13:35:31.557037 | debian-bookworm | +-w /usr/sbin/addgroup -p x -k group_modification 2026-06-02 13:35:31.557132 | debian-bookworm | +-w /usr/sbin/useradd -p x -k user_modification 2026-06-02 13:35:31.557229 | debian-bookworm | +-w /usr/sbin/userdel -p x -k user_modification 2026-06-02 13:35:31.557324 | debian-bookworm | +-w /usr/sbin/usermod -p x -k user_modification 2026-06-02 13:35:31.557418 | debian-bookworm | +-w /usr/sbin/adduser -p x -k user_modification 2026-06-02 13:35:31.557512 | debian-bookworm | + 2026-06-02 13:35:31.557627 | debian-bookworm | +## Login configuration and information 2026-06-02 13:35:31.557716 | debian-bookworm | +-w /etc/login.defs -p wa -k login 2026-06-02 13:35:31.557823 | debian-bookworm | +-w /etc/securetty -p wa -k login 2026-06-02 13:35:31.557907 | debian-bookworm | +-w /var/log/faillog -p wa -k login 2026-06-02 13:35:31.558000 | debian-bookworm | +-w /var/log/lastlog -p wa -k login 2026-06-02 13:35:31.558094 | debian-bookworm | +-w /var/log/tallylog -p wa -k login 2026-06-02 13:35:31.558187 | debian-bookworm | + 2026-06-02 13:35:31.558281 | debian-bookworm | +## Network Environment 2026-06-02 13:35:31.558377 | debian-bookworm | +### Changes to hostname 2026-06-02 13:35:31.558471 | debian-bookworm | +-a always,exit -F arch=b64 -S sethostname -S setdomainname -k network_modifications 2026-06-02 13:35:31.558563 | debian-bookworm | + 2026-06-02 13:35:31.558690 | debian-bookworm | +### Detect Remote Shell Use 2026-06-02 13:35:31.558786 | debian-bookworm | +-a always,exit -F arch=b64 -F exe=/bin/bash -F success=1 -S connect -k "remote_shell" 2026-06-02 13:35:31.558881 | debian-bookworm | +-a always,exit -F arch=b64 -F exe=/usr/bin/bash -F success=1 -S connect -k "remote_shell" 2026-06-02 13:35:31.558970 | debian-bookworm | + 2026-06-02 13:35:31.559066 | debian-bookworm | +### Successful IPv4 Connections 2026-06-02 13:35:31.559159 | debian-bookworm | +-a always,exit -F arch=b64 -S connect -F a2=16 -F success=1 -F key=network_connect_4 2026-06-02 13:35:31.559278 | debian-bookworm | + 2026-06-02 13:35:31.559378 | debian-bookworm | +### Successful IPv6 Connections 2026-06-02 13:35:31.559473 | debian-bookworm | +-a always,exit -F arch=b64 -S connect -F a2=28 -F success=1 -F key=network_connect_6 2026-06-02 13:35:31.559566 | debian-bookworm | + 2026-06-02 13:35:31.559673 | debian-bookworm | +### Changes to other files 2026-06-02 13:35:31.559771 | debian-bookworm | +-w /etc/hosts -p wa -k network_modifications 2026-06-02 13:35:31.559865 | debian-bookworm | +-w /etc/sysconfig/network -p wa -k network_modifications 2026-06-02 13:35:31.559960 | debian-bookworm | +-w /etc/sysconfig/network-scripts -p w -k network_modifications 2026-06-02 13:35:31.560056 | debian-bookworm | +-w /etc/network/ -p wa -k network 2026-06-02 13:35:31.560154 | debian-bookworm | +-a always,exit -F dir=/etc/NetworkManager/ -F perm=wa -k network_modifications 2026-06-02 13:35:31.560247 | debian-bookworm | + 2026-06-02 13:35:31.560341 | debian-bookworm | +### Changes to issue 2026-06-02 13:35:31.560438 | debian-bookworm | +-w /etc/issue -p wa -k etcissue 2026-06-02 13:35:31.560536 | debian-bookworm | +-w /etc/issue.net -p wa -k etcissue 2026-06-02 13:35:31.560638 | debian-bookworm | + 2026-06-02 13:35:31.560731 | debian-bookworm | +## System startup scripts 2026-06-02 13:35:31.560828 | debian-bookworm | +-w /etc/inittab -p wa -k init 2026-06-02 13:35:31.560923 | debian-bookworm | +-w /etc/init.d/ -p wa -k init 2026-06-02 13:35:31.561019 | debian-bookworm | +-w /etc/init/ -p wa -k init 2026-06-02 13:35:31.561130 | debian-bookworm | + 2026-06-02 13:35:31.561205 | debian-bookworm | +## Library search paths 2026-06-02 13:35:31.561302 | debian-bookworm | +-w /etc/ld.so.conf -p wa -k libpath 2026-06-02 13:35:31.561400 | debian-bookworm | +-w /etc/ld.so.conf.d -p wa -k libpath 2026-06-02 13:35:31.561491 | debian-bookworm | + 2026-06-02 13:35:31.561590 | debian-bookworm | +## Systemwide library preloads (LD_PRELOAD) 2026-06-02 13:35:31.561696 | debian-bookworm | +-w /etc/ld.so.preload -p wa -k systemwide_preloads 2026-06-02 13:35:31.561788 | debian-bookworm | + 2026-06-02 13:35:31.561883 | debian-bookworm | +## Pam configuration 2026-06-02 13:35:31.561979 | debian-bookworm | +-w /etc/pam.d/ -p wa -k pam 2026-06-02 13:35:31.562100 | debian-bookworm | +-w /etc/security/limits.conf -p wa -k pam 2026-06-02 13:35:31.562253 | debian-bookworm | +-w /etc/security/limits.d -p wa -k pam 2026-06-02 13:35:31.562403 | debian-bookworm | +-w /etc/security/pam_env.conf -p wa -k pam 2026-06-02 13:35:31.562549 | debian-bookworm | +-w /etc/security/namespace.conf -p wa -k pam 2026-06-02 13:35:31.562747 | debian-bookworm | +-w /etc/security/namespace.d -p wa -k pam 2026-06-02 13:35:31.562859 | debian-bookworm | +-w /etc/security/namespace.init -p wa -k pam 2026-06-02 13:35:31.562955 | debian-bookworm | + 2026-06-02 13:35:31.563052 | debian-bookworm | +## Mail configuration 2026-06-02 13:35:31.563149 | debian-bookworm | +-w /etc/aliases -p wa -k mail 2026-06-02 13:35:31.563303 | debian-bookworm | +-w /etc/postfix/ -p wa -k mail 2026-06-02 13:35:31.563368 | debian-bookworm | +-w /etc/exim4/ -p wa -k mail 2026-06-02 13:35:31.563462 | debian-bookworm | + 2026-06-02 13:35:31.563556 | debian-bookworm | +## SSH configuration 2026-06-02 13:35:31.563674 | debian-bookworm | +-w /etc/ssh/sshd_config -k sshd 2026-06-02 13:35:31.563771 | debian-bookworm | +-w /etc/ssh/sshd_config.d -k sshd 2026-06-02 13:35:31.563862 | debian-bookworm | + 2026-06-02 13:35:31.563957 | debian-bookworm | +## root ssh key tampering 2026-06-02 13:35:31.564052 | debian-bookworm | +-w /root/.ssh -p wa -k rootkey 2026-06-02 13:35:31.564142 | debian-bookworm | + 2026-06-02 13:35:31.564237 | debian-bookworm | +# Systemd 2026-06-02 13:35:31.564334 | debian-bookworm | +-w /bin/systemctl -p x -k systemd 2026-06-02 13:35:31.564432 | debian-bookworm | +-w /etc/systemd/ -p wa -k systemd 2026-06-02 13:35:31.564525 | debian-bookworm | +-w /usr/lib/systemd -p wa -k systemd 2026-06-02 13:35:31.564643 | debian-bookworm | + 2026-06-02 13:35:31.564729 | debian-bookworm | +## https://systemd.network/systemd.generator.html 2026-06-02 13:35:31.564826 | debian-bookworm | +-w /etc/systemd/system-generators/ -p wa -k systemd_generator 2026-06-02 13:35:31.564926 | debian-bookworm | +-w /usr/local/lib/systemd/system-generators/ -p wa -k systemd_generator 2026-06-02 13:35:31.565023 | debian-bookworm | +-w /usr/lib/systemd/system-generators -p wa -k systemd_generator 2026-06-02 13:35:31.565116 | debian-bookworm | + 2026-06-02 13:35:31.565213 | debian-bookworm | +-w /etc/systemd/user-generators/ -p wa -k systemd_generator 2026-06-02 13:35:31.565397 | debian-bookworm | +-w /usr/local/lib/systemd/user-generators/ -p wa -k systemd_generator 2026-06-02 13:35:31.565408 | debian-bookworm | +-w /lib/systemd/system-generators/ -p wa -k systemd_generator 2026-06-02 13:35:31.565499 | debian-bookworm | + 2026-06-02 13:35:31.565787 | debian-bookworm | +## SELinux events that modify the system's Mandatory Access Controls (MAC) 2026-06-02 13:35:31.565798 | debian-bookworm | +-w /etc/selinux/ -p wa -k mac_policy 2026-06-02 13:35:31.565815 | debian-bookworm | + 2026-06-02 13:35:31.565914 | debian-bookworm | +## Critical elements access failures 2026-06-02 13:35:31.566015 | debian-bookworm | +-a always,exit -F arch=b64 -S open -F dir=/etc -F success=0 -k unauthedfileaccess 2026-06-02 13:35:31.566119 | debian-bookworm | +-a always,exit -F arch=b64 -S open -F dir=/bin -F success=0 -k unauthedfileaccess 2026-06-02 13:35:31.566217 | debian-bookworm | +-a always,exit -F arch=b64 -S open -F dir=/sbin -F success=0 -k unauthedfileaccess 2026-06-02 13:35:31.566312 | debian-bookworm | +-a always,exit -F arch=b64 -S open -F dir=/usr/bin -F success=0 -k unauthedfileaccess 2026-06-02 13:35:31.566410 | debian-bookworm | +-a always,exit -F arch=b64 -S open -F dir=/usr/sbin -F success=0 -k unauthedfileaccess 2026-06-02 13:35:31.566522 | debian-bookworm | +-a always,exit -F arch=b64 -S open -F dir=/var -F success=0 -k unauthedfileaccess 2026-06-02 13:35:31.566619 | debian-bookworm | +-a always,exit -F arch=b64 -S open -F dir=/home -F success=0 -k unauthedfileaccess 2026-06-02 13:35:31.566719 | debian-bookworm | +-a always,exit -F arch=b64 -S open -F dir=/srv -F success=0 -k unauthedfileaccess 2026-06-02 13:35:31.566809 | debian-bookworm | + 2026-06-02 13:35:31.566906 | debian-bookworm | +## Process ID change (switching accounts) applications 2026-06-02 13:35:31.567002 | debian-bookworm | +-w /bin/su -p x -k priv_esc 2026-06-02 13:35:31.567099 | debian-bookworm | +-w /usr/bin/sudo -p x -k priv_esc 2026-06-02 13:35:31.567226 | debian-bookworm | + 2026-06-02 13:35:31.567326 | debian-bookworm | +## Power state 2026-06-02 13:35:31.567422 | debian-bookworm | +-w /sbin/shutdown -p x -k power 2026-06-02 13:35:31.567517 | debian-bookworm | +-w /sbin/poweroff -p x -k power 2026-06-02 13:35:31.567698 | debian-bookworm | +-w /sbin/reboot -p x -k power 2026-06-02 13:35:31.567824 | debian-bookworm | +-w /sbin/halt -p x -k power 2026-06-02 13:35:31.567920 | debian-bookworm | + 2026-06-02 13:35:31.568016 | debian-bookworm | +## Session initiation information 2026-06-02 13:35:31.568122 | debian-bookworm | +-w /var/run/utmp -p wa -k session 2026-06-02 13:35:31.568213 | debian-bookworm | +-w /var/log/btmp -p wa -k session 2026-06-02 13:35:31.568303 | debian-bookworm | +-w /var/log/wtmp -p wa -k session 2026-06-02 13:35:31.568394 | debian-bookworm | + 2026-06-02 13:35:31.568524 | debian-bookworm | +## Discretionary Access Control (DAC) modifications 2026-06-02 13:35:31.568616 | debian-bookworm | +-a always,exit -F arch=b64 -S chmod -F auid>=1000 -F auid!=-1 -k perm_mod 2026-06-02 13:35:31.568743 | debian-bookworm | +-a always,exit -F arch=b64 -S chown -F auid>=1000 -F auid!=-1 -k perm_mod 2026-06-02 13:35:31.568809 | debian-bookworm | +-a always,exit -F arch=b64 -S fchmod -F auid>=1000 -F auid!=-1 -k perm_mod 2026-06-02 13:35:31.568903 | debian-bookworm | +-a always,exit -F arch=b64 -S fchmodat -F auid>=1000 -F auid!=-1 -k perm_mod 2026-06-02 13:35:31.569005 | debian-bookworm | +-a always,exit -F arch=b64 -S fchown -F auid>=1000 -F auid!=-1 -k perm_mod 2026-06-02 13:35:31.569096 | debian-bookworm | +-a always,exit -F arch=b64 -S fchownat -F auid>=1000 -F auid!=-1 -k perm_mod 2026-06-02 13:35:31.569193 | debian-bookworm | +-a always,exit -F arch=b64 -S fremovexattr -F auid>=1000 -F auid!=-1 -k perm_mod 2026-06-02 13:35:31.569292 | debian-bookworm | +-a always,exit -F arch=b64 -S fsetxattr -F auid>=1000 -F auid!=-1 -k perm_mod 2026-06-02 13:35:31.569387 | debian-bookworm | +-a always,exit -F arch=b64 -S lchown -F auid>=1000 -F auid!=-1 -k perm_mod 2026-06-02 13:35:31.569483 | debian-bookworm | +-a always,exit -F arch=b64 -S lremovexattr -F auid>=1000 -F auid!=-1 -k perm_mod 2026-06-02 13:35:31.569583 | debian-bookworm | +-a always,exit -F arch=b64 -S lsetxattr -F auid>=1000 -F auid!=-1 -k perm_mod 2026-06-02 13:35:31.569694 | debian-bookworm | +-a always,exit -F arch=b64 -S removexattr -F auid>=1000 -F auid!=-1 -k perm_mod 2026-06-02 13:35:31.569808 | debian-bookworm | +-a always,exit -F arch=b64 -S setxattr -F auid>=1000 -F auid!=-1 -k perm_mod 2026-06-02 13:35:31.569959 | debian-bookworm | + 2026-06-02 13:35:31.570060 | debian-bookworm | +# Special Rules --------------------------------------------------------------- 2026-06-02 13:35:31.570152 | debian-bookworm | + 2026-06-02 13:35:31.570246 | debian-bookworm | +## Reconnaissance 2026-06-02 13:35:31.570343 | debian-bookworm | +-w /usr/bin/whoami -p x -k recon 2026-06-02 13:35:31.570440 | debian-bookworm | +-w /usr/bin/id -p x -k recon 2026-06-02 13:35:31.570534 | debian-bookworm | +-w /bin/hostname -p x -k recon 2026-06-02 13:35:31.570657 | debian-bookworm | +-w /bin/uname -p x -k recon 2026-06-02 13:35:31.570744 | debian-bookworm | +-w /etc/issue -p r -k recon 2026-06-02 13:35:31.570839 | debian-bookworm | +-w /etc/hostname -p r -k recon 2026-06-02 13:35:31.570930 | debian-bookworm | + 2026-06-02 13:35:31.571023 | debian-bookworm | +## Suspicious activity 2026-06-02 13:35:31.571118 | debian-bookworm | +-w /usr/bin/wget -p x -k susp_activity 2026-06-02 13:35:31.571237 | debian-bookworm | +-w /usr/bin/curl -p x -k susp_activity 2026-06-02 13:35:31.571336 | debian-bookworm | +-w /usr/bin/base64 -p x -k susp_activity 2026-06-02 13:35:31.571431 | debian-bookworm | +-w /bin/nc -p x -k susp_activity 2026-06-02 13:35:31.571527 | debian-bookworm | +-w /bin/netcat -p x -k susp_activity 2026-06-02 13:35:31.571675 | debian-bookworm | +-w /usr/bin/ncat -p x -k susp_activity 2026-06-02 13:35:31.571774 | debian-bookworm | +-w /usr/bin/ss -p x -k susp_activity 2026-06-02 13:35:31.571870 | debian-bookworm | +-w /usr/bin/netstat -p x -k susp_activity 2026-06-02 13:35:31.571971 | debian-bookworm | +-w /usr/bin/ssh -p x -k susp_activity 2026-06-02 13:35:31.572062 | debian-bookworm | +-w /usr/bin/scp -p x -k susp_activity 2026-06-02 13:35:31.572154 | debian-bookworm | +-w /usr/bin/sftp -p x -k susp_activity 2026-06-02 13:35:31.572247 | debian-bookworm | +-w /usr/bin/ftp -p x -k susp_activity 2026-06-02 13:35:31.572350 | debian-bookworm | +-w /usr/bin/socat -p x -k susp_activity 2026-06-02 13:35:31.573128 | debian-bookworm | +-w /usr/bin/wireshark -p x -k susp_activity 2026-06-02 13:35:31.573151 | debian-bookworm | +-w /usr/bin/tshark -p x -k susp_activity 2026-06-02 13:35:31.573156 | debian-bookworm | +-w /usr/bin/rawshark -p x -k susp_activity 2026-06-02 13:35:31.573160 | debian-bookworm | +-w /usr/bin/rdesktop -p x -k susp_activity 2026-06-02 13:35:31.573164 | debian-bookworm | +-w /usr/local/bin/rdesktop -p x -k susp_activity 2026-06-02 13:35:31.573168 | debian-bookworm | +-w /usr/bin/wlfreerdp -p x -k susp_activity 2026-06-02 13:35:31.573172 | debian-bookworm | +-w /usr/bin/xfreerdp -p x -k susp_activity 2026-06-02 13:35:31.573176 | debian-bookworm | +-w /usr/local/bin/xfreerdp -p x -k susp_activity 2026-06-02 13:35:31.573183 | debian-bookworm | +-w /usr/bin/nmap -p x -k susp_activity 2026-06-02 13:35:31.573256 | debian-bookworm | + 2026-06-02 13:35:31.573350 | debian-bookworm | +## sssd 2026-06-02 13:35:31.573481 | debian-bookworm | +-a always,exit -F path=/usr/libexec/sssd/p11_child -F perm=x -F auid>=500 -F auid!=4294967295 -k T1078_Valid_Accounts 2026-06-02 13:35:31.573549 | debian-bookworm | +-a always,exit -F path=/usr/libexec/sssd/krb5_child -F perm=x -F auid>=500 -F auid!=4294967295 -k T1078_Valid_Accounts 2026-06-02 13:35:31.573675 | debian-bookworm | +-a always,exit -F path=/usr/libexec/sssd/ldap_child -F perm=x -F auid>=500 -F auid!=4294967295 -k T1078_Valid_Accounts 2026-06-02 13:35:31.573774 | debian-bookworm | +-a always,exit -F path=/usr/libexec/sssd/selinux_child -F perm=x -F auid>=500 -F auid!=4294967295 -k T1078_Valid_Accounts 2026-06-02 13:35:31.573871 | debian-bookworm | +-a always,exit -F path=/usr/libexec/sssd/proxy_child -F perm=x -F auid>=500 -F auid!=4294967295 -k T1078_Valid_Accounts 2026-06-02 13:35:31.573963 | debian-bookworm | + 2026-06-02 13:35:31.574059 | debian-bookworm | +## T1002 Data Compressed 2026-06-02 13:35:31.574175 | debian-bookworm | + 2026-06-02 13:35:31.574257 | debian-bookworm | +-w /usr/bin/zip -p x -k Data_Compressed 2026-06-02 13:35:31.574354 | debian-bookworm | +-w /usr/bin/gzip -p x -k Data_Compressed 2026-06-02 13:35:31.574447 | debian-bookworm | +-w /usr/bin/tar -p x -k Data_Compressed 2026-06-02 13:35:31.574541 | debian-bookworm | +-w /usr/bin/bzip2 -p x -k Data_Compressed 2026-06-02 13:35:31.574642 | debian-bookworm | + 2026-06-02 13:35:31.574737 | debian-bookworm | +-w /usr/bin/lzip -p x -k Data_Compressed 2026-06-02 13:35:31.574834 | debian-bookworm | +-w /usr/local/bin/lzip -p x -k Data_Compressed 2026-06-02 13:35:31.574928 | debian-bookworm | + 2026-06-02 13:35:31.575031 | debian-bookworm | +-w /usr/bin/lz4 -p x -k Data_Compressed 2026-06-02 13:35:31.575125 | debian-bookworm | +-w /usr/local/bin/lz4 -p x -k Data_Compressed 2026-06-02 13:35:31.575252 | debian-bookworm | + 2026-06-02 13:35:31.575355 | debian-bookworm | +-w /usr/bin/lzop -p x -k Data_Compressed 2026-06-02 13:35:31.575444 | debian-bookworm | +-w /usr/local/bin/lzop -p x -k Data_Compressed 2026-06-02 13:35:31.575537 | debian-bookworm | + 2026-06-02 13:35:31.575671 | debian-bookworm | +-w /usr/bin/plzip -p x -k Data_Compressed 2026-06-02 13:35:31.575758 | debian-bookworm | +-w /usr/local/bin/plzip -p x -k Data_Compressed 2026-06-02 13:35:31.575848 | debian-bookworm | + 2026-06-02 13:35:31.575941 | debian-bookworm | +-w /usr/bin/pbzip2 -p x -k Data_Compressed 2026-06-02 13:35:31.576036 | debian-bookworm | +-w /usr/local/bin/pbzip2 -p x -k Data_Compressed 2026-06-02 13:35:31.576127 | debian-bookworm | + 2026-06-02 13:35:31.576223 | debian-bookworm | +-w /usr/bin/lbzip2 -p x -k Data_Compressed 2026-06-02 13:35:31.576323 | debian-bookworm | +-w /usr/local/bin/lbzip2 -p x -k Data_Compressed 2026-06-02 13:35:31.576415 | debian-bookworm | + 2026-06-02 13:35:31.576509 | debian-bookworm | +-w /usr/bin/pixz -p x -k Data_Compressed 2026-06-02 13:35:31.576616 | debian-bookworm | +-w /usr/local/bin/pixz -p x -k Data_Compressed 2026-06-02 13:35:31.576702 | debian-bookworm | + 2026-06-02 13:35:31.576803 | debian-bookworm | +-w /usr/bin/pigz -p x -k Data_Compressed 2026-06-02 13:35:31.576896 | debian-bookworm | +-w /usr/local/bin/pigz -p x -k Data_Compressed 2026-06-02 13:35:31.576990 | debian-bookworm | +-w /usr/bin/unpigz -p x -k Data_Compressed 2026-06-02 13:35:31.577085 | debian-bookworm | +-w /usr/local/bin/unpigz -p x -k Data_Compressed 2026-06-02 13:35:31.577176 | debian-bookworm | + 2026-06-02 13:35:31.577272 | debian-bookworm | +-w /usr/bin/zstd -p x -k Data_Compressed 2026-06-02 13:35:31.577368 | debian-bookworm | +-w /usr/local/bin/zstd -p x -k Data_Compressed 2026-06-02 13:35:31.577460 | debian-bookworm | + 2026-06-02 13:35:31.577557 | debian-bookworm | +## Added to catch netcat on Ubuntu 2026-06-02 13:35:31.577667 | debian-bookworm | +-w /bin/nc.openbsd -p x -k susp_activity 2026-06-02 13:35:31.577763 | debian-bookworm | +-w /bin/nc.traditional -p x -k susp_activity 2026-06-02 13:35:31.577854 | debian-bookworm | + 2026-06-02 13:35:31.577948 | debian-bookworm | +## Sbin suspicious activity 2026-06-02 13:35:31.578046 | debian-bookworm | +-w /sbin/iptables -p x -k sbin_susp 2026-06-02 13:35:31.578140 | debian-bookworm | +-w /sbin/ip6tables -p x -k sbin_susp 2026-06-02 13:35:31.578236 | debian-bookworm | +-w /sbin/ifconfig -p x -k sbin_susp 2026-06-02 13:35:31.578331 | debian-bookworm | +-w /usr/sbin/arptables -p x -k sbin_susp 2026-06-02 13:35:31.578425 | debian-bookworm | +-w /usr/sbin/ebtables -p x -k sbin_susp 2026-06-02 13:35:31.578529 | debian-bookworm | +-w /sbin/xtables-nft-multi -p x -k sbin_susp 2026-06-02 13:35:31.578651 | debian-bookworm | +-w /usr/sbin/nft -p x -k sbin_susp 2026-06-02 13:35:31.578746 | debian-bookworm | +-w /usr/sbin/tcpdump -p x -k sbin_susp 2026-06-02 13:35:31.578842 | debian-bookworm | +-w /usr/sbin/traceroute -p x -k sbin_susp 2026-06-02 13:35:31.578936 | debian-bookworm | +-w /usr/sbin/ufw -p x -k sbin_susp 2026-06-02 13:35:31.579031 | debian-bookworm | + 2026-06-02 13:35:31.579125 | debian-bookworm | +### kde4 2026-06-02 13:35:31.579276 | debian-bookworm | +-a always,exit -F path=/usr/libexec/kde4/kpac_dhcp_helper -F perm=x -F auid>=1000 -F auid!=4294967295 -k T1078_Valid_Accounts 2026-06-02 13:35:31.579369 | debian-bookworm | +-a always,exit -F path=/usr/libexec/kde4/kdesud -F perm=x -F auid>=1000 -F auid!=4294967295 -k T1078_Valid_Accounts 2026-06-02 13:35:31.579466 | debian-bookworm | + 2026-06-02 13:35:31.579585 | debian-bookworm | +## dbus-send invocation 2026-06-02 13:35:31.579671 | debian-bookworm | +### may indicate privilege escalation CVE-2021-3560 2026-06-02 13:35:31.579765 | debian-bookworm | +-w /usr/bin/dbus-send -p x -k dbus_send 2026-06-02 13:35:31.579863 | debian-bookworm | +-w /usr/bin/gdbus -p x -k gdubs_call 2026-06-02 13:35:31.579954 | debian-bookworm | + 2026-06-02 13:35:31.580050 | debian-bookworm | +## pkexec invocation 2026-06-02 13:35:31.580148 | debian-bookworm | +### may indicate privilege escalation CVE-2021-4034 2026-06-02 13:35:31.580243 | debian-bookworm | +-w /usr/bin/pkexec -p x -k pkexec 2026-06-02 13:35:31.580335 | debian-bookworm | + 2026-06-02 13:35:31.580429 | debian-bookworm | +## Suspicious shells 2026-06-02 13:35:31.580525 | debian-bookworm | +-w /bin/ash -p x -k susp_shell 2026-06-02 13:35:31.580650 | debian-bookworm | +-w /bin/csh -p x -k susp_shell 2026-06-02 13:35:31.580725 | debian-bookworm | +-w /bin/fish -p x -k susp_shell 2026-06-02 13:35:31.580820 | debian-bookworm | +-w /bin/tcsh -p x -k susp_shell 2026-06-02 13:35:31.580914 | debian-bookworm | +-w /bin/tclsh -p x -k susp_shell 2026-06-02 13:35:31.581010 | debian-bookworm | +-w /bin/xonsh -p x -k susp_shell 2026-06-02 13:35:31.581103 | debian-bookworm | +-w /usr/local/bin/xonsh -p x -k susp_shell 2026-06-02 13:35:31.581198 | debian-bookworm | +-w /bin/open -p x -k susp_shell 2026-06-02 13:35:31.581292 | debian-bookworm | +-w /bin/rbash -p x -k susp_shell 2026-06-02 13:35:31.581383 | debian-bookworm | + 2026-06-02 13:35:31.581479 | debian-bookworm | +# Web Server Actvity 2026-06-02 13:35:31.581577 | debian-bookworm | +## Change the number "33" to the ID of your WebServer user. Default: www-data:x:33:33 2026-06-02 13:35:31.581715 | debian-bookworm | +-a always,exit -F arch=b64 -S execve -F euid=33 -k detect_execve_www 2026-06-02 13:35:31.581795 | debian-bookworm | + 2026-06-02 13:35:31.581888 | debian-bookworm | +### https://clustershell.readthedocs.io/ 2026-06-02 13:35:31.581982 | debian-bookworm | +-w /bin/clush -p x -k susp_shell 2026-06-02 13:35:31.582078 | debian-bookworm | +-w /usr/local/bin/clush -p x -k susp_shell 2026-06-02 13:35:31.582173 | debian-bookworm | +-w /etc/clustershell/clush.conf -p x -k susp_shell 2026-06-02 13:35:31.582264 | debian-bookworm | + 2026-06-02 13:35:31.582359 | debian-bookworm | +### https://github.com/tmux/tmux 2026-06-02 13:35:31.582452 | debian-bookworm | +-w /bin/tmux -p x -k susp_shell 2026-06-02 13:35:31.582545 | debian-bookworm | +-w /usr/local/bin/tmux -p x -k susp_shell 2026-06-02 13:35:31.582648 | debian-bookworm | + 2026-06-02 13:35:31.582752 | debian-bookworm | +## Shell/profile configurations 2026-06-02 13:35:31.582850 | debian-bookworm | +-w /etc/profile.d/ -p wa -k shell_profiles 2026-06-02 13:35:31.582944 | debian-bookworm | +-w /etc/profile -p wa -k shell_profiles 2026-06-02 13:35:31.583041 | debian-bookworm | +-w /etc/shells -p wa -k shell_profiles 2026-06-02 13:35:31.583134 | debian-bookworm | +-w /etc/bashrc -p wa -k shell_profiles 2026-06-02 13:35:31.583257 | debian-bookworm | +-w /etc/csh.cshrc -p wa -k shell_profiles 2026-06-02 13:35:31.583357 | debian-bookworm | +-w /etc/csh.login -p wa -k shell_profiles 2026-06-02 13:35:31.583455 | debian-bookworm | +-w /etc/fish/ -p wa -k shell_profiles 2026-06-02 13:35:31.583552 | debian-bookworm | +-w /etc/zsh/ -p wa -k shell_profiles 2026-06-02 13:35:31.583656 | debian-bookworm | + 2026-06-02 13:35:31.583751 | debian-bookworm | +### https://github.com/xxh/xxh 2026-06-02 13:35:31.583871 | debian-bookworm | +-w /usr/local/bin/xxh.bash -p x -k susp_shell 2026-06-02 13:35:31.583951 | debian-bookworm | +-w /usr/local/bin/xxh.xsh -p x -k susp_shell 2026-06-02 13:35:31.584051 | debian-bookworm | +-w /usr/local/bin/xxh.zsh -p x -k susp_shell 2026-06-02 13:35:31.584139 | debian-bookworm | + 2026-06-02 13:35:31.584236 | debian-bookworm | +## Injection 2026-06-02 13:35:31.584334 | debian-bookworm | +### These rules watch for code injection by the ptrace facility. 2026-06-02 13:35:31.584429 | debian-bookworm | +### This could indicate someone trying to do something bad or just debugging 2026-06-02 13:35:31.584526 | debian-bookworm | +-a always,exit -F arch=b64 -S ptrace -F a0=0x4 -k code_injection 2026-06-02 13:35:31.584701 | debian-bookworm | +-a always,exit -F arch=b64 -S ptrace -F a0=0x5 -k data_injection 2026-06-02 13:35:31.584764 | debian-bookworm | +-a always,exit -F arch=b64 -S ptrace -F a0=0x6 -k register_injection 2026-06-02 13:35:31.584845 | debian-bookworm | +-a always,exit -F arch=b64 -S ptrace -k tracing 2026-06-02 13:35:31.584957 | debian-bookworm | + 2026-06-02 13:35:31.585036 | debian-bookworm | +## Anonymous File Creation 2026-06-02 13:35:31.585130 | debian-bookworm | +### These rules watch the use of memfd_create 2026-06-02 13:35:31.585227 | debian-bookworm | +### "memfd_create" creates anonymous file and returns a file descriptor to access it 2026-06-02 13:35:31.585335 | debian-bookworm | +### When combined with "fexecve" can be used to stealthily run binaries in memory without touching disk 2026-06-02 13:35:31.585425 | debian-bookworm | +-a always,exit -F arch=b64 -S memfd_create -F key=anon_file_create 2026-06-02 13:35:31.585519 | debian-bookworm | + 2026-06-02 13:35:31.585632 | debian-bookworm | +## Privilege Abuse 2026-06-02 13:35:31.585716 | debian-bookworm | +### The purpose of this rule is to detect when an admin may be abusing power by looking in user's home dir. 2026-06-02 13:35:31.585819 | debian-bookworm | +-a always,exit -F dir=/home -F uid=0 -F auid>=1000 -F auid!=-1 -C auid!=obj_uid -k power_abuse 2026-06-02 13:35:31.585911 | debian-bookworm | + 2026-06-02 13:35:31.586025 | debian-bookworm | +# Socket Creations 2026-06-02 13:35:31.586103 | debian-bookworm | +# will catch both IPv4 and IPv6 2026-06-02 13:35:31.586195 | debian-bookworm | + 2026-06-02 13:35:31.586297 | debian-bookworm | +-a always,exit -F arch=b32 -S socket -F a0=2 -k network_socket_created 2026-06-02 13:35:31.586394 | debian-bookworm | +-a always,exit -F arch=b64 -S socket -F a0=2 -k network_socket_created 2026-06-02 13:35:31.586488 | debian-bookworm | + 2026-06-02 13:35:31.586584 | debian-bookworm | +-a always,exit -F arch=b32 -S socket -F a0=10 -k network_socket_created 2026-06-02 13:35:31.586691 | debian-bookworm | +-a always,exit -F arch=b64 -S socket -F a0=10 -k network_socket_created 2026-06-02 13:35:31.586783 | debian-bookworm | + 2026-06-02 13:35:31.586877 | debian-bookworm | +# Software Management --------------------------------------------------------- 2026-06-02 13:35:31.586971 | debian-bookworm | + 2026-06-02 13:35:31.587084 | debian-bookworm | +# RPM (Redhat/CentOS) 2026-06-02 13:35:31.587165 | debian-bookworm | +-w /usr/bin/rpm -p x -k software_mgmt 2026-06-02 13:35:31.587286 | debian-bookworm | +-w /usr/bin/yum -p x -k software_mgmt 2026-06-02 13:35:31.587408 | debian-bookworm | + 2026-06-02 13:35:31.587478 | debian-bookworm | +# DNF (Fedora/RedHat 8/CentOS 8) 2026-06-02 13:35:31.587572 | debian-bookworm | +-w /usr/bin/dnf -p x -k software_mgmt 2026-06-02 13:35:31.587677 | debian-bookworm | + 2026-06-02 13:35:31.587772 | debian-bookworm | +# YAST/Zypper/RPM (SuSE) 2026-06-02 13:35:31.587868 | debian-bookworm | +-w /sbin/yast -p x -k software_mgmt 2026-06-02 13:35:31.587966 | debian-bookworm | +-w /sbin/yast2 -p x -k software_mgmt 2026-06-02 13:35:31.588083 | debian-bookworm | +-w /bin/rpm -p x -k software_mgmt 2026-06-02 13:35:31.588184 | debian-bookworm | +-w /usr/bin/zypper -k software_mgmt 2026-06-02 13:35:31.588273 | debian-bookworm | + 2026-06-02 13:35:31.588369 | debian-bookworm | +# DPKG / APT-GET (Debian/Ubuntu) 2026-06-02 13:35:31.588465 | debian-bookworm | +-w /usr/bin/dpkg -p x -k software_mgmt 2026-06-02 13:35:31.588560 | debian-bookworm | +-w /usr/bin/apt -p x -k software_mgmt 2026-06-02 13:35:31.588703 | debian-bookworm | +-w /usr/bin/apt-add-repository -p x -k software_mgmt 2026-06-02 13:35:31.588787 | debian-bookworm | +-w /usr/bin/apt-get -p x -k software_mgmt 2026-06-02 13:35:31.588882 | debian-bookworm | +-w /usr/bin/aptitude -p x -k software_mgmt 2026-06-02 13:35:31.588975 | debian-bookworm | +-w /usr/bin/wajig -p x -k software_mgmt 2026-06-02 13:35:31.589070 | debian-bookworm | +-w /usr/bin/snap -p x -k software_mgmt 2026-06-02 13:35:31.589162 | debian-bookworm | + 2026-06-02 13:35:31.589257 | debian-bookworm | +# PIP(3) (Python installs) 2026-06-02 13:35:31.589353 | debian-bookworm | +-w /usr/bin/pip -p x -k third_party_software_mgmt 2026-06-02 13:35:31.589450 | debian-bookworm | +-w /usr/local/bin/pip -p x -k third_party_software_mgmt 2026-06-02 13:35:31.589546 | debian-bookworm | +-w /usr/bin/pip3 -p x -k third_party_software_mgmt 2026-06-02 13:35:31.589656 | debian-bookworm | +-w /usr/local/bin/pip3 -p x -k third_party_software_mgmt 2026-06-02 13:35:31.589751 | debian-bookworm | +-w /usr/bin/pipx -p x -k third_party_software_mgmt 2026-06-02 13:35:31.589847 | debian-bookworm | +-w /usr/local/bin/pipx -p x -k third_party_software_mgmt 2026-06-02 13:35:31.589949 | debian-bookworm | + 2026-06-02 13:35:31.590051 | debian-bookworm | +# npm 2026-06-02 13:35:31.590154 | debian-bookworm | +## T1072 third party software 2026-06-02 13:35:31.590251 | debian-bookworm | +## https://www.npmjs.com 2026-06-02 13:35:31.590354 | debian-bookworm | +## https://docs.npmjs.com/cli/v6/commands/npm-audit 2026-06-02 13:35:31.590455 | debian-bookworm | +-w /usr/bin/npm -p x -k third_party_software_mgmt 2026-06-02 13:35:31.590545 | debian-bookworm | + 2026-06-02 13:35:31.590653 | debian-bookworm | +# Comprehensive Perl Archive Network (CPAN) (CPAN installs) 2026-06-02 13:35:31.590748 | debian-bookworm | +## T1072 third party software 2026-06-02 13:35:31.590845 | debian-bookworm | +## https://www.cpan.org 2026-06-02 13:35:31.590970 | debian-bookworm | +-w /usr/bin/cpan -p x -k third_party_software_mgmt 2026-06-02 13:35:31.591062 | debian-bookworm | + 2026-06-02 13:35:31.591161 | debian-bookworm | +# Ruby (RubyGems installs) 2026-06-02 13:35:31.591293 | debian-bookworm | +## T1072 third party software 2026-06-02 13:35:31.591392 | debian-bookworm | +## https://rubygems.org 2026-06-02 13:35:31.591482 | debian-bookworm | +-w /usr/bin/gem -p x -k third_party_software_mgmt 2026-06-02 13:35:31.591577 | debian-bookworm | + 2026-06-02 13:35:31.591715 | debian-bookworm | +# LuaRocks (Lua installs) 2026-06-02 13:35:31.591811 | debian-bookworm | +## T1072 third party software 2026-06-02 13:35:31.591917 | debian-bookworm | +## https://luarocks.org 2026-06-02 13:35:31.592035 | debian-bookworm | +-w /usr/bin/luarocks -p x -k third_party_software_mgmt 2026-06-02 13:35:31.592131 | debian-bookworm | + 2026-06-02 13:35:31.592227 | debian-bookworm | +# Pacman (Arch Linux) 2026-06-02 13:35:31.592327 | debian-bookworm | +## https://wiki.archlinux.org/title/Pacman 2026-06-02 13:35:31.592438 | debian-bookworm | +## T1072 third party software 2026-06-02 13:35:31.592526 | debian-bookworm | +-w /etc/pacman.conf -p x -k third_party_software_mgmt 2026-06-02 13:35:31.592652 | debian-bookworm | +-w /etc/pacman.d -p x -k third_party_software_mgmt 2026-06-02 13:35:31.592800 | debian-bookworm | + 2026-06-02 13:35:31.592835 | debian-bookworm | +# Special Software ------------------------------------------------------------ 2026-06-02 13:35:31.592927 | debian-bookworm | + 2026-06-02 13:35:31.593020 | debian-bookworm | +## GDS specific secrets 2026-06-02 13:35:31.593115 | debian-bookworm | +-w /etc/puppet/ssl -p wa -k puppet_ssl 2026-06-02 13:35:31.593209 | debian-bookworm | + 2026-06-02 13:35:31.593302 | debian-bookworm | +## IBM Bigfix BESClient 2026-06-02 13:35:31.593402 | debian-bookworm | +-a always,exit -F arch=b64 -S open -F dir=/opt/BESClient -F success=0 -k soft_besclient 2026-06-02 13:35:31.593500 | debian-bookworm | +-w /var/opt/BESClient/ -p wa -k soft_besclient 2026-06-02 13:35:31.593591 | debian-bookworm | + 2026-06-02 13:35:31.593709 | debian-bookworm | +## CHEF https://www.chef.io/chef/ 2026-06-02 13:35:31.593801 | debian-bookworm | +-w /etc/chef -p wa -k soft_chef 2026-06-02 13:35:31.593892 | debian-bookworm | + 2026-06-02 13:35:31.593985 | debian-bookworm | +## Salt 2026-06-02 13:35:31.594083 | debian-bookworm | +## https://saltproject.io/ 2026-06-02 13:35:31.594192 | debian-bookworm | +## https://docs.saltproject.io/en/latest/ref/configuration/master.html 2026-06-02 13:35:31.594296 | debian-bookworm | +-w /etc/salt -p wa -k soft_salt 2026-06-02 13:35:31.594405 | debian-bookworm | +-w /usr/local/etc/salt -p wa -k soft_salt 2026-06-02 13:35:31.594507 | debian-bookworm | + 2026-06-02 13:35:31.594646 | debian-bookworm | +## Otter 2026-06-02 13:35:31.594731 | debian-bookworm | +## https://inedo.com/otter 2026-06-02 13:35:31.594835 | debian-bookworm | +-w /etc/otter -p wa -k soft_otter 2026-06-02 13:35:31.594936 | debian-bookworm | + 2026-06-02 13:35:31.595039 | debian-bookworm | +## T1081 Credentials In Files 2026-06-02 13:35:31.595141 | debian-bookworm | +-w /usr/bin/grep -p x -k string_search 2026-06-02 13:35:31.595271 | debian-bookworm | +-w /usr/bin/egrep -p x -k string_search 2026-06-02 13:35:31.595434 | debian-bookworm | +-w /usr/bin/ugrep -p x -k string_search 2026-06-02 13:35:31.595539 | debian-bookworm | +### macOS 2026-06-02 13:35:31.595625 | debian-bookworm | +-w /usr/local/bin/grep -p x -k string_search 2026-06-02 13:35:31.595747 | debian-bookworm | +-w /usr/local/bin/egrep -p x -k string_search 2026-06-02 13:35:31.595855 | debian-bookworm | +-w /usr/local/bin/ugrep -p x -k string_search 2026-06-02 13:35:31.595958 | debian-bookworm | + 2026-06-02 13:35:31.596052 | debian-bookworm | +### https://github.com/tmbinc/bgrep 2026-06-02 13:35:31.596148 | debian-bookworm | +-w /usr/bin/bgrep -p x -k string_search 2026-06-02 13:35:31.596244 | debian-bookworm | +### macOS 2026-06-02 13:35:31.596338 | debian-bookworm | +-w /usr/local/bin/bgrep -p x -k string_search 2026-06-02 13:35:31.596430 | debian-bookworm | + 2026-06-02 13:35:31.596530 | debian-bookworm | +### https://github.com/BurntSushi/ripgrep 2026-06-02 13:35:31.596656 | debian-bookworm | +-w /usr/bin/rg -p x -k string_search 2026-06-02 13:35:31.603344 | debian-bookworm | +### macOS 2026-06-02 13:35:31.603379 | debian-bookworm | +-w /usr/local/bin/rg -p x -k string_search 2026-06-02 13:35:31.603384 | debian-bookworm | + 2026-06-02 13:35:31.603388 | debian-bookworm | +### https://github.com/awgn/cgrep 2026-06-02 13:35:31.603392 | debian-bookworm | + 2026-06-02 13:35:31.603396 | debian-bookworm | +-w /usr/bin/cgrep -p x -k string_search 2026-06-02 13:35:31.603400 | debian-bookworm | +### macOS 2026-06-02 13:35:31.603404 | debian-bookworm | +-w /usr/local/bin/cgrep -p x -k string_search 2026-06-02 13:35:31.603408 | debian-bookworm | + 2026-06-02 13:35:31.603411 | debian-bookworm | +### https://github.com/jpr5/ngrep 2026-06-02 13:35:31.603415 | debian-bookworm | +-w /usr/bin/ngrep -p x -k string_search 2026-06-02 13:35:31.603419 | debian-bookworm | +### macOS 2026-06-02 13:35:31.603423 | debian-bookworm | +-w /usr/local/bin/ngrep -p x -k string_search 2026-06-02 13:35:31.603427 | debian-bookworm | + 2026-06-02 13:35:31.603430 | debian-bookworm | +### https://github.com/vrothberg/vgrep 2026-06-02 13:35:31.603434 | debian-bookworm | +-w /usr/bin/vgrep -p x -k string_search 2026-06-02 13:35:31.603438 | debian-bookworm | +### macOS 2026-06-02 13:35:31.603442 | debian-bookworm | +-w /usr/local/bin/vgrep -p x -k string_search 2026-06-02 13:35:31.603445 | debian-bookworm | + 2026-06-02 13:35:31.603449 | debian-bookworm | +### https://github.com/monochromegane/the_platinum_searcher 2026-06-02 13:35:31.603453 | debian-bookworm | +-w /usr/bin/pt -p x -k string_search 2026-06-02 13:35:31.603457 | debian-bookworm | +### macOS 2026-06-02 13:35:31.603460 | debian-bookworm | +-w /usr/local/bin/pt -p x -k string_search 2026-06-02 13:35:31.603464 | debian-bookworm | + 2026-06-02 13:35:31.603468 | debian-bookworm | +### https://github.com/gvansickle/ucg 2026-06-02 13:35:31.603472 | debian-bookworm | +-w /usr/bin/ucg -p x -k string_search 2026-06-02 13:35:31.603475 | debian-bookworm | +### macOS 2026-06-02 13:35:31.603479 | debian-bookworm | +-w /usr/local/bin/ucg -p x -k string_search 2026-06-02 13:35:31.603483 | debian-bookworm | + 2026-06-02 13:35:31.603487 | debian-bookworm | +### https://github.com/ggreer/the_silver_searcher 2026-06-02 13:35:31.603490 | debian-bookworm | +-w /usr/bin/ag -p x -k string_search 2026-06-02 13:35:31.603494 | debian-bookworm | +### macOS 2026-06-02 13:35:31.603498 | debian-bookworm | +-w /usr/local/bin/ag -p x -k string_search 2026-06-02 13:35:31.603501 | debian-bookworm | + 2026-06-02 13:35:31.603505 | debian-bookworm | +### https://github.com/beyondgrep/ack3 2026-06-02 13:35:31.603509 | debian-bookworm | +### https://beyondgrep.com 2026-06-02 13:35:31.603513 | debian-bookworm | +-w /usr/bin/ack -p x -k string_search 2026-06-02 13:35:31.603517 | debian-bookworm | +-w /usr/local/bin/ack -p x -k string_search 2026-06-02 13:35:31.603520 | debian-bookworm | +-w /usr/bin/semgrep -p x -k string_search 2026-06-02 13:35:31.603524 | debian-bookworm | +### macOS 2026-06-02 13:35:31.603528 | debian-bookworm | +-w /usr/local/bin/semgrep -p x -k string_search 2026-06-02 13:35:31.603531 | debian-bookworm | + 2026-06-02 13:35:31.603535 | debian-bookworm | +## Docker 2026-06-02 13:35:31.603539 | debian-bookworm | +-w /usr/bin/dockerd -k docker 2026-06-02 13:35:31.603543 | debian-bookworm | +-w /usr/bin/docker -k docker 2026-06-02 13:35:31.603546 | debian-bookworm | +-w /usr/bin/docker-containerd -k docker 2026-06-02 13:35:31.603550 | debian-bookworm | +-w /usr/bin/docker-runc -k docker 2026-06-02 13:35:31.603554 | debian-bookworm | +-w /var/lib/docker -p wa -k docker 2026-06-02 13:35:31.603558 | debian-bookworm | +-w /etc/docker -k docker 2026-06-02 13:35:31.603561 | debian-bookworm | +-w /etc/sysconfig/docker -k docker 2026-06-02 13:35:31.603565 | debian-bookworm | +-w /etc/sysconfig/docker-storage -k docker 2026-06-02 13:35:31.603569 | debian-bookworm | +-w /usr/lib/systemd/system/docker.service -k docker 2026-06-02 13:35:31.603572 | debian-bookworm | +-w /usr/lib/systemd/system/docker.socket -k docker 2026-06-02 13:35:31.603576 | debian-bookworm | + 2026-06-02 13:35:31.603580 | debian-bookworm | +## Virtualization stuff 2026-06-02 13:35:31.603584 | debian-bookworm | +-w /usr/bin/qemu-system-x86_64 -p x -k qemu-system-x86_64 2026-06-02 13:35:31.603587 | debian-bookworm | +-w /usr/bin/qemu-img -p x -k qemu-img 2026-06-02 13:35:31.603591 | debian-bookworm | +-w /usr/bin/qemu-kvm -p x -k qemu-kvm 2026-06-02 13:35:31.603595 | debian-bookworm | +-w /usr/bin/qemu -p x -k qemu 2026-06-02 13:35:31.603620 | debian-bookworm | +-w /usr/bin/virtualbox -p x -k virtualbox 2026-06-02 13:35:31.603624 | debian-bookworm | +-w /usr/bin/virt-manager -p x -k virt-manager 2026-06-02 13:35:31.603628 | debian-bookworm | +-w /usr/bin/VBoxManage -p x -k VBoxManage 2026-06-02 13:35:31.603632 | debian-bookworm | + 2026-06-02 13:35:31.603635 | debian-bookworm | +#### VirtualBox on macOS 2026-06-02 13:35:31.603639 | debian-bookworm | + 2026-06-02 13:35:31.603643 | debian-bookworm | +-w /usr/local/bin/VirtualBox -p x -k virt_tool 2026-06-02 13:35:31.603655 | debian-bookworm | +-w /usr/local/bin/VirtualBoxVM -p x -k virt_tool 2026-06-02 13:35:31.603659 | debian-bookworm | +-w /usr/local/bin/VBoxManage -p x -k virt_tool 2026-06-02 13:35:31.603662 | debian-bookworm | +-w /usr/local/bin/VBoxVRDP -p x -k virt_tool 2026-06-02 13:35:31.603666 | debian-bookworm | +-w /usr/local/bin/VBoxHeadless -p x -k virt_tool 2026-06-02 13:35:31.603670 | debian-bookworm | +-w /usr/local/bin/vboxwebsrv -p x -k virt_tool 2026-06-02 13:35:31.603678 | debian-bookworm | +-w /usr/local/bin/VBoxBugReport -p x -k virt_tool 2026-06-02 13:35:31.603682 | debian-bookworm | +-w /usr/local/bin/VBoxBalloonCtrl -p x -k virt_tool 2026-06-02 13:35:31.603686 | debian-bookworm | +-w /usr/local/bin/VBoxAutostart -p x -k virt_tool 2026-06-02 13:35:31.603690 | debian-bookworm | +-w /usr/local/bin/VBoxDTrace -p x -k virt_tool 2026-06-02 13:35:31.603764 | debian-bookworm | +-w /usr/local/bin/vbox-img -p x -k virt_tool 2026-06-02 13:35:31.603861 | debian-bookworm | +-w /Library/LaunchDaemons/org.virtualbox.startup.plist -p x -k virt_tool 2026-06-02 13:35:31.603958 | debian-bookworm | +-w /Library/Application Support/VirtualBox/LaunchDaemons/ -p x -k virt_tool 2026-06-02 13:35:31.604054 | debian-bookworm | +-w /Library/Application Support/VirtualBox/VBoxDrv.kext/ -p x -k virt_tool 2026-06-02 13:35:31.604293 | debian-bookworm | +-w /Library/Application Support/VirtualBox/VBoxUSB.kext/ -p x -k virt_tool 2026-06-02 13:35:31.604303 | debian-bookworm | +-w /Library/Application Support/VirtualBox/VBoxNetFlt.kext/ -p x -k virt_tool 2026-06-02 13:35:31.604339 | debian-bookworm | +-w /Library/Application Support/VirtualBox/VBoxNetAdp.kext/ -p x -k virt_tool 2026-06-02 13:35:31.604445 | debian-bookworm | + 2026-06-02 13:35:31.604544 | debian-bookworm | +### Parallels Desktop on macOS 2026-06-02 13:35:31.604655 | debian-bookworm | + 2026-06-02 13:35:31.604752 | debian-bookworm | +-w /usr/local/bin/prl_convert -p x -k virt_tool 2026-06-02 13:35:31.604846 | debian-bookworm | +-w /usr/local/bin/prl_disk_tool -p x -k virt_tool 2026-06-02 13:35:31.604940 | debian-bookworm | +-w /usr/local/bin/prl_perf_ctl -p x -k virt_tool 2026-06-02 13:35:31.605037 | debian-bookworm | +-w /usr/local/bin/prlcore2dmp -p x -k virt_tool 2026-06-02 13:35:31.605169 | debian-bookworm | +-w /usr/local/bin/prlctl -p x -k virt_tool 2026-06-02 13:35:31.605263 | debian-bookworm | +-w /usr/local/bin/prlexec -p x -k virt_tool 2026-06-02 13:35:31.605367 | debian-bookworm | +-w /usr/local/bin/prlsrvctl -p x -k virt_tool 2026-06-02 13:35:31.605478 | debian-bookworm | +-w /Library/Preferences/Parallels -p x -k virt_tool 2026-06-02 13:35:31.605589 | debian-bookworm | + 2026-06-02 13:35:31.605711 | debian-bookworm | +### qemu on macOS 2026-06-02 13:35:31.605805 | debian-bookworm | + 2026-06-02 13:35:31.605912 | debian-bookworm | +-w /usr/local/bin/qemu-edid -p x -k virt_tool 2026-06-02 13:35:31.605995 | debian-bookworm | +-w /usr/local/bin/qemu-img -p x -k virt_tool 2026-06-02 13:35:31.606092 | debian-bookworm | +-w /usr/local/bin/qemu-io -p x -k virt_tool 2026-06-02 13:35:31.606186 | debian-bookworm | +-w /usr/local/bin/qemu-nbd -p x -k virt_tool 2026-06-02 13:35:31.606286 | debian-bookworm | +-w /usr/local/bin/qemu-system-x86_64 -p x -k virt_tool 2026-06-02 13:35:31.606379 | debian-bookworm | + 2026-06-02 13:35:31.606474 | debian-bookworm | +## Kubelet 2026-06-02 13:35:31.606569 | debian-bookworm | +-w /usr/bin/kubelet -k kubelet 2026-06-02 13:35:31.606711 | debian-bookworm | + 2026-06-02 13:35:31.606807 | debian-bookworm | +# ipc system call 2026-06-02 13:35:31.606903 | debian-bookworm | +# /usr/include/linux/ipc.h 2026-06-02 13:35:31.606997 | debian-bookworm | + 2026-06-02 13:35:31.607098 | debian-bookworm | +## msgctl 2026-06-02 13:35:31.607225 | debian-bookworm | +#-a always,exit -S ipc -F a0=14 -k Inter-Process_Communication 2026-06-02 13:35:31.607320 | debian-bookworm | +## msgget 2026-06-02 13:35:31.607419 | debian-bookworm | +#-a always,exit -S ipc -F a0=13 -k Inter-Process_Communication 2026-06-02 13:35:31.607518 | debian-bookworm | +## Use these lines on x86_64, ia64 instead 2026-06-02 13:35:31.607632 | debian-bookworm | +-a always,exit -F arch=b64 -S msgctl -k Inter-Process_Communication 2026-06-02 13:35:31.607730 | debian-bookworm | +-a always,exit -F arch=b64 -S msgget -k Inter-Process_Communication 2026-06-02 13:35:31.607822 | debian-bookworm | + 2026-06-02 13:35:31.607915 | debian-bookworm | +## semctl 2026-06-02 13:35:31.608013 | debian-bookworm | +#-a always,exit -S ipc -F a0=3 -k Inter-Process_Communication 2026-06-02 13:35:31.608108 | debian-bookworm | +## semget 2026-06-02 13:35:31.608206 | debian-bookworm | +#-a always,exit -S ipc -F a0=2 -k Inter-Process_Communication 2026-06-02 13:35:31.608300 | debian-bookworm | +## semop 2026-06-02 13:35:31.608398 | debian-bookworm | +#-a always,exit -S ipc -F a0=1 -k Inter-Process_Communication 2026-06-02 13:35:31.608493 | debian-bookworm | +## semtimedop 2026-06-02 13:35:31.608590 | debian-bookworm | +#-a always,exit -S ipc -F a0=4 -k Inter-Process_Communication 2026-06-02 13:35:31.608702 | debian-bookworm | +## Use these lines on x86_64, ia64 instead 2026-06-02 13:35:31.608800 | debian-bookworm | +-a always,exit -F arch=b64 -S semctl -k Inter-Process_Communication 2026-06-02 13:35:31.608897 | debian-bookworm | +-a always,exit -F arch=b64 -S semget -k Inter-Process_Communication 2026-06-02 13:35:31.608996 | debian-bookworm | +-a always,exit -F arch=b64 -S semop -k Inter-Process_Communication 2026-06-02 13:35:31.609092 | debian-bookworm | +-a always,exit -F arch=b64 -S semtimedop -k Inter-Process_Communication 2026-06-02 13:35:31.609185 | debian-bookworm | + 2026-06-02 13:35:31.609278 | debian-bookworm | +## shmctl 2026-06-02 13:35:31.609374 | debian-bookworm | +#-a always,exit -S ipc -F a0=24 -k Inter-Process_Communication 2026-06-02 13:35:31.609469 | debian-bookworm | +## shmget 2026-06-02 13:35:31.609566 | debian-bookworm | +#-a always,exit -S ipc -F a0=23 -k Inter-Process_Communication 2026-06-02 13:35:31.609674 | debian-bookworm | +## Use these lines on x86_64, ia64 instead 2026-06-02 13:35:31.609769 | debian-bookworm | +-a always,exit -F arch=b64 -S shmctl -k Inter-Process_Communication 2026-06-02 13:35:31.609867 | debian-bookworm | +-a always,exit -F arch=b64 -S shmget -k Inter-Process_Communication 2026-06-02 13:35:31.609959 | debian-bookworm | + 2026-06-02 13:35:31.610055 | debian-bookworm | +# High Volume Events ---------------------------------------------------------- 2026-06-02 13:35:31.610147 | debian-bookworm | + 2026-06-02 13:35:31.610244 | debian-bookworm | +## Disable these rules if they create too many events in your environment 2026-06-02 13:35:31.610338 | debian-bookworm | + 2026-06-02 13:35:31.610430 | debian-bookworm | +## Common Shells 2026-06-02 13:35:31.610527 | debian-bookworm | +-w /bin/bash -p x -k susp_shell 2026-06-02 13:35:31.610662 | debian-bookworm | +-w /bin/dash -p x -k susp_shell 2026-06-02 13:35:31.610768 | debian-bookworm | +-w /bin/busybox -p x -k susp_shell 2026-06-02 13:35:31.610862 | debian-bookworm | +-w /bin/zsh -p x -k susp_shell 2026-06-02 13:35:31.610957 | debian-bookworm | +-w /bin/sh -p x -k susp_shell 2026-06-02 13:35:31.611055 | debian-bookworm | +-w /bin/ksh -p x -k susp_shell 2026-06-02 13:35:31.611150 | debian-bookworm | + 2026-06-02 13:35:31.611288 | debian-bookworm | +## Root command executions 2026-06-02 13:35:31.611381 | debian-bookworm | +-a always,exit -F arch=b64 -F euid=0 -F auid>=1000 -F auid!=-1 -S execve -k rootcmd 2026-06-02 13:35:31.611472 | debian-bookworm | + 2026-06-02 13:35:31.611568 | debian-bookworm | +## File Deletion Events by User 2026-06-02 13:35:31.611683 | debian-bookworm | +-a always,exit -F arch=b64 -S rmdir -S unlink -S unlinkat -S rename -S renameat -F auid>=1000 -F auid!=-1 -k delete 2026-06-02 13:35:31.611775 | debian-bookworm | + 2026-06-02 13:35:31.611870 | debian-bookworm | +## File Access 2026-06-02 13:35:31.611967 | debian-bookworm | +### Unauthorized Access (unsuccessful) 2026-06-02 13:35:31.612070 | debian-bookworm | +-a always,exit -F arch=b64 -S creat -S open -S openat -S open_by_handle_at -S truncate -S ftruncate -F exit=-EACCES -F auid>=1000 -F auid!=-1 -k file_access 2026-06-02 13:35:31.612169 | debian-bookworm | +-a always,exit -F arch=b64 -S creat -S open -S openat -S open_by_handle_at -S truncate -S ftruncate -F exit=-EPERM -F auid>=1000 -F auid!=-1 -k file_access 2026-06-02 13:35:31.612263 | debian-bookworm | + 2026-06-02 13:35:31.612359 | debian-bookworm | +### Unsuccessful Creation 2026-06-02 13:35:31.612457 | debian-bookworm | +-a always,exit -F arch=b64 -S mkdir,creat,link,symlink,mknod,mknodat,linkat,symlinkat -F exit=-EACCES -k file_creation 2026-06-02 13:35:31.612553 | debian-bookworm | +-a always,exit -F arch=b64 -S mkdir,link,symlink,mkdirat -F exit=-EPERM -k file_creation 2026-06-02 13:35:31.612661 | debian-bookworm | + 2026-06-02 13:35:31.612754 | debian-bookworm | +### Unsuccessful Modification 2026-06-02 13:35:31.612858 | debian-bookworm | +-a always,exit -F arch=b64 -S rename -S renameat -S truncate -S chmod -S setxattr -S lsetxattr -S removexattr -S lremovexattr -F exit=-EACCES -k file_modification 2026-06-02 13:35:31.612954 | debian-bookworm | +-a always,exit -F arch=b64 -S rename -S renameat -S truncate -S chmod -S setxattr -S lsetxattr -S removexattr -S lremovexattr -F exit=-EPERM -k file_modification 2026-06-02 13:35:31.613042 | debian-bookworm | + 2026-06-02 13:35:31.613138 | debian-bookworm | +## 32bit API Exploitation 2026-06-02 13:35:31.613235 | debian-bookworm | +### If you are on a 64 bit platform, everything _should_ be running 2026-06-02 13:35:31.613334 | debian-bookworm | +### in 64 bit mode. This rule will detect any use of the 32 bit syscalls 2026-06-02 13:35:31.613428 | debian-bookworm | +### because this might be a sign of someone exploiting a hole in the 32 2026-06-02 13:35:31.613522 | debian-bookworm | +### bit API. 2026-06-02 13:35:31.613649 | debian-bookworm | +-a always,exit -F arch=b32 -S all -k 32bit_api 2026-06-02 13:35:31.613743 | debian-bookworm | + 2026-06-02 13:35:31.613842 | debian-bookworm | +# Make The Configuration Immutable -------------------------------------------- 2026-06-02 13:35:31.613937 | debian-bookworm | + 2026-06-02 13:35:31.614032 | debian-bookworm | +##-e 2 2026-06-02 13:35:31.614124 | debian-bookworm | 2026-06-02 13:35:31.614369 | debian-bookworm | changed: [molecule-auditd] => (item=20-neo23x0.rules) => {"ansible_loop_var": "item", "changed": true, "checksum": "9f99ce5c4f891fbf3e2bce06ed4cb97fb9e01f41", "dest": "/etc/audit/rules.d/20-neo23x0.rules", "gid": 0, "group": "root", "item": "20-neo23x0.rules", "md5sum": "6ac57206fd77de34805c3f4d50ef8b1d", "mode": "0644", "owner": "root", "size": 27367, "src": "/home/zuul/.ansible/tmp/ansible-tmp-1780407330.8091207-2534-66115800746128/.source.rules", "state": "file", "uid": 0} 2026-06-02 13:35:31.614462 | debian-bookworm | 2026-06-02 13:35:31.614579 | debian-bookworm | TASK [auditd : Manage auditd service] ****************************************** 2026-06-02 13:35:32.315956 | debian-bookworm | ok: [molecule-auditd] => {"changed": false, "enabled": true, "name": "auditd", "state": "started", "status": {"ActiveEnterTimestamp": "Tue 2026-06-02 13:35:26 UTC", "ActiveEnterTimestampMonotonic": "483986550", "ActiveExitTimestampMonotonic": "0", "ActiveState": "active", "After": "local-fs.target system.slice systemd-journald.socket systemd-tmpfiles-setup.service", "AllowIsolate": "no", "AssertResult": "yes", "AssertTimestamp": "Tue 2026-06-02 13:35:26 UTC", "AssertTimestampMonotonic": "483936326", "Before": "shutdown.target sysinit.target systemd-update-utmp.service ssh.service", "BlockIOAccounting": "no", "BlockIOWeight": "[not set]", "CPUAccounting": "yes", "CPUAffinityFromNUMA": "no", "CPUQuotaPerSecUSec": "infinity", "CPUQuotaPeriodUSec": "infinity", "CPUSchedulingPolicy": "0", "CPUSchedulingPriority": "0", "CPUSchedulingResetOnFork": "no", "CPUShares": "[not set]", "CPUUsageNSec": "35018000", "CPUWeight": "[not set]", "CacheDirectoryMode": "0755", "CanFreeze": "yes", "CanIsolate": "no", "CanReload": "no", "CanStart": "yes", "CanStop": "yes", "CapabilityBoundingSet": "cap_chown cap_dac_override cap_dac_read_search cap_fowner cap_fsetid cap_kill cap_setgid cap_setuid cap_setpcap cap_linux_immutable cap_net_bind_service cap_net_broadcast cap_net_admin cap_net_raw cap_ipc_lock cap_ipc_owner cap_sys_rawio cap_sys_chroot cap_sys_ptrace cap_sys_pacct cap_sys_admin cap_sys_boot cap_sys_nice cap_sys_resource cap_sys_time cap_sys_tty_config cap_mknod cap_lease cap_audit_write cap_audit_control cap_setfcap cap_mac_override cap_mac_admin cap_syslog cap_wake_alarm cap_block_suspend cap_audit_read cap_perfmon cap_bpf cap_checkpoint_restore", "CleanResult": "success", "CollectMode": "inactive", "ConditionResult": "yes", "ConditionTimestamp": "Tue 2026-06-02 13:35:26 UTC", "ConditionTimestampMonotonic": "483936274", "ConfigurationDirectoryMode": "0755", "Conflicts": "shutdown.target", "ControlGroup": "/system.slice/auditd.service", "ControlGroupId": "3250", "ControlPID": "0", "CoredumpFilter": "0x33", "DefaultDependencies": "no", "DefaultMemoryLow": "0", "DefaultMemoryMin": "0", "Delegate": "no", "Description": "Security Auditing Service", "DevicePolicy": "auto", "Documentation": "\"man:auditd(8)\" https://github.com/linux-audit/audit-documentation", "DynamicUser": "no", "ExecMainCode": "0", "ExecMainExitTimestampMonotonic": "0", "ExecMainPID": "2306", "ExecMainStartTimestamp": "Tue 2026-06-02 13:35:26 UTC", "ExecMainStartTimestampMonotonic": "483968729", "ExecMainStatus": "0", "ExecStart": "{ path=/sbin/auditd ; argv[]=/sbin/auditd ; ignore_errors=no ; start_time=[Tue 2026-06-02 13:35:26 UTC] ; stop_time=[Tue 2026-06-02 13:35:26 UTC] ; pid=2305 ; code=exited ; status=0 }", "ExecStartEx": "{ path=/sbin/auditd ; argv[]=/sbin/auditd ; flags= ; start_time=[Tue 2026-06-02 13:35:26 UTC] ; stop_time=[Tue 2026-06-02 13:35:26 UTC] ; pid=2305 ; code=exited ; status=0 }", "ExecStartPost": "{ path=/sbin/augenrules ; argv[]=/sbin/augenrules --load ; ignore_errors=yes ; start_time=[Tue 2026-06-02 13:35:26 UTC] ; stop_time=[Tue 2026-06-02 13:35:26 UTC] ; pid=2309 ; code=exited ; status=0 }", "ExecStartPostEx": "{ path=/sbin/augenrules ; argv[]=/sbin/augenrules --load ; flags=ignore-failure ; start_time=[Tue 2026-06-02 13:35:26 UTC] ; stop_time=[Tue 2026-06-02 13:35:26 UTC] ; pid=2309 ; code=exited ; status=0 }", "ExitType": "main", "FailureAction": "none", "FileDescriptorStoreMax": "0", "FinalKillSignal": "9", "FragmentPath": "/lib/systemd/system/auditd.service", "FreezerState": "running", "GID": "[not set]", "GuessMainPID": "yes", "IOAccounting": "no", "IOReadBytes": "18446744073709551615", "IOReadOperations": "18446744073709551615", "IOSchedulingClass": "2", "IOSchedulingPriority": "4", "IOWeight": "[not set]", "IOWriteBytes": "18446744073709551615", "IOWriteOperations": "18446744073709551615", "IPAccounting": "no", "IPEgressBytes": "[no data]", "IPEgressPackets": "[no data]", "IPIngressBytes": "[no data]", "IPIngressPackets": "[no data]", "Id": "auditd.service", "IgnoreOnIsolate": "no", "IgnoreSIGPIPE": "yes", "InactiveEnterTimestampMonotonic": "0", "InactiveExitTimestamp": "Tue 2026-06-02 13:35:26 UTC", "InactiveExitTimestampMonotonic": "483952469", "InvocationID": "46b3207586434fe492e954bbd0a9fb39", "JobRunningTimeoutUSec": "infinity", "JobTimeoutAction": "none", "JobTimeoutUSec": "infinity", "KeyringMode": "private", "KillMode": "control-group", "KillSignal": "15", "LimitAS": "infinity", "LimitASSoft": "infinity", "LimitCORE": "infinity", "LimitCORESoft": "0", "LimitCPU": "infinity", "LimitCPUSoft": "infinity", "LimitDATA": "infinity", "LimitDATASoft": "infinity", "LimitFSIZE": "infinity", "LimitFSIZESoft": "infinity", "LimitLOCKS": "infinity", "LimitLOCKSSoft": "infinity", "LimitMEMLOCK": "8388608", "LimitMEMLOCKSoft": "8388608", "LimitMSGQUEUE": "819200", "LimitMSGQUEUESoft": "819200", "LimitNICE": "0", "LimitNICESoft": "0", "LimitNOFILE": "524288", "LimitNOFILESoft": "1024", "LimitNPROC": "15480", "LimitNPROCSoft": "15480", "LimitRSS": "infinity", "LimitRSSSoft": "infinity", "LimitRTPRIO": "0", "LimitRTPRIOSoft": "0", "LimitRTTIME": "infinity", "LimitRTTIMESoft": "infinity", "LimitSIGPENDING": "15480", "LimitSIGPENDINGSoft": "15480", "LimitSTACK": "infinity", "LimitSTACKSoft": "8388608", "LoadState": "loaded", "LockPersonality": "yes", "LogLevelMax": "-1", "LogRateLimitBurst": "0", "LogRateLimitIntervalUSec": "0", "LogsDirectoryMode": "0755", "MainPID": "2306", "ManagedOOMMemoryPressure": "auto", "ManagedOOMMemoryPressureLimit": "0", "ManagedOOMPreference": "none", "ManagedOOMSwap": "auto", "MemoryAccounting": "yes", "MemoryAvailable": "infinity", "MemoryCurrent": "704512", "MemoryDenyWriteExecute": "yes", "MemoryHigh": "infinity", "MemoryLimit": "infinity", "MemoryLow": "0", "MemoryMax": "infinity", "MemoryMin": "0", "MemorySwapMax": "infinity", "MountAPIVFS": "no", "NFileDescriptorStore": "0", "NRestarts": "0", "NUMAPolicy": "n/a", "Names": "auditd.service", "NeedDaemonReload": "no", "Nice": "0", "NoNewPrivileges": "no", "NonBlocking": "no", "NotifyAccess": "none", "OOMPolicy": "stop", "OOMScoreAdjust": "0", "OnFailureJobMode": "replace", "OnSuccessJobMode": "fail", "PIDFile": "/run/auditd.pid", "Perpetual": "no", "PrivateDevices": "no", "PrivateIPC": "no", "PrivateMounts": "no", "PrivateNetwork": "no", "PrivateTmp": "no", "PrivateUsers": "no", "ProcSubset": "all", "ProtectClock": "no", "ProtectControlGroups": "yes", "ProtectHome": "no", "ProtectHostname": "no", "ProtectKernelLogs": "no", "ProtectKernelModules": "yes", "ProtectKernelTunables": "no", "ProtectProc": "default", "ProtectSystem": "no", "RefuseManualStart": "no", "RefuseManualStop": "no", "ReloadResult": "success", "RemainAfterExit": "no", "RemoveIPC": "no", "Requires": "system.slice", "Restart": "on-failure", "RestartKillSignal": "15", "RestartPreventExitStatus": "2 4 6", "RestartUSec": "100ms", "RestrictNamespaces": "no", "RestrictRealtime": "yes", "RestrictSUIDSGID": "no", "Result": "success", "RootDirectoryStartOnly": "no", "RuntimeDirectoryMode": "0755", "RuntimeDirectoryPreserve": "no", "RuntimeMaxUSec": "infinity", "RuntimeRandomizedExtraUSec": "0", "SameProcessGroup": "no", "SecureBits": "0", "SendSIGHUP": "no", "SendSIGKILL": "yes", "Slice": "system.slice", "StandardError": "inherit", "StandardInput": "null", "StandardOutput": "journal", "StartLimitAction": "none", "StartLimitBurst": "5", "StartLimitIntervalUSec": "10s", "StartupBlockIOWeight": "[not set]", "StartupCPUShares": "[not set]", "StartupCPUWeight": "[not set]", "StartupIOWeight": "[not set]", "StateChangeTimestamp": "Tue 2026-06-02 13:35:26 UTC", "StateChangeTimestampMonotonic": "483986550", "StateDirectoryMode": "0755", "StatusErrno": "0", "StopWhenUnneeded": "no", "SubState": "running", "SuccessAction": "none", "SyslogFacility": "3", "SyslogLevel": "6", "SyslogLevelPrefix": "yes", "SyslogPriority": "30", "SystemCallErrorNumber": "2147483646", "TTYReset": "no", "TTYVHangup": "no", "TTYVTDisallocate": "no", "TasksAccounting": "yes", "TasksCurrent": "2", "TasksMax": "4644", "TimeoutAbortUSec": "1min 30s", "TimeoutCleanUSec": "infinity", "TimeoutStartFailureMode": "terminate", "TimeoutStartUSec": "1min 30s", "TimeoutStopFailureMode": "terminate", "TimeoutStopUSec": "1min 30s", "TimerSlackNSec": "50000", "Transient": "no", "Type": "forking", "UID": "[not set]", "UMask": "0022", "UnitFilePreset": "enabled", "UnitFileState": "enabled", "UtmpMode": "init", "WantedBy": "multi-user.target", "WatchdogSignal": "6", "WatchdogTimestampMonotonic": "0", "WatchdogUSec": "0"}} 2026-06-02 13:35:32.322133 | debian-bookworm | 2026-06-02 13:35:32.322267 | debian-bookworm | TASK [auditd : List existing rules files] ************************************** 2026-06-02 13:35:32.702890 | debian-bookworm | ok: [molecule-auditd] => {"changed": false, "cmd": ["find", "/etc/audit/rules.d", "-type", "f", "-printf", "%f\n"], "delta": "0:00:00.007203", "end": "2026-06-02 13:35:32.660128", "msg": "", "rc": 0, "start": "2026-06-02 13:35:32.652925", "stderr": "", "stderr_lines": [], "stdout": "audit.rules\n20-neo23x0.rules", "stdout_lines": ["audit.rules", "20-neo23x0.rules"]} 2026-06-02 13:35:32.703020 | debian-bookworm | 2026-06-02 13:35:32.703040 | debian-bookworm | TASK [auditd : Remove unmanaged rules files] *********************************** 2026-06-02 13:35:32.810179 | ubuntu-noble | The following NEW packages will be installed: 2026-06-02 13:35:32.810226 | ubuntu-noble | audispd-plugins 2026-06-02 13:35:32.810234 | ubuntu-noble | 0 upgraded, 1 newly installed, 0 to remove and 3 not upgraded. 2026-06-02 13:35:32.810243 | ubuntu-noble | changed: [molecule-auditd] => {"cache_update_time": 1780407224, "cache_updated": false, "changed": true, "stderr": "debconf: delaying package configuration, since apt-utils is not installed\n", "stderr_lines": ["debconf: delaying package configuration, since apt-utils is not installed"], "stdout": "Reading package lists...\nBuilding dependency tree...\nReading state information...\nThe following NEW packages will be installed:\n audispd-plugins\n0 upgraded, 1 newly installed, 0 to remove and 3 not upgraded.\nNeed to get 38.8 kB of archives.\nAfter this operation, 131 kB of additional disk space will be used.\nGet:1 http://archive.ubuntu.com/ubuntu noble-updates/universe amd64 audispd-plugins amd64 1:3.1.2-2.1build1.1 [38.8 kB]\nFetched 38.8 kB in 0s (645 kB/s)\nSelecting previously unselected package audispd-plugins.\r\n(Reading database ... \r(Reading database ... 5%\r(Reading database ... 10%\r(Reading database ... 15%\r(Reading database ... 20%\r(Reading database ... 25%\r(Reading database ... 30%\r(Reading database ... 35%\r(Reading database ... 40%\r(Reading database ... 45%\r(Reading database ... 50%\r(Reading database ... 55%\r(Reading database ... 60%\r(Reading database ... 65%\r(Reading database ... 70%\r(Reading database ... 75%\r(Reading database ... 80%\r(Reading database ... 85%\r(Reading database ... 90%\r(Reading database ... 95%\r(Reading database ... 100%\r(Reading database ... 36206 files and directories currently installed.)\r\nPreparing to unpack .../audispd-plugins_1%3a3.1.2-2.1build1.1_amd64.deb ...\r\nUnpacking audispd-plugins (1:3.1.2-2.1build1.1) ...\r\nSetting up audispd-plugins (1:3.1.2-2.1build1.1) ...\r\n", "stdout_lines": ["Reading package lists...", "Building dependency tree...", "Reading state information...", "The following NEW packages will be installed:", " audispd-plugins", "0 upgraded, 1 newly installed, 0 to remove and 3 not upgraded.", "Need to get 38.8 kB of archives.", "After this operation, 131 kB of additional disk space will be used.", "Get:1 http://archive.ubuntu.com/ubuntu noble-updates/universe amd64 audispd-plugins amd64 1:3.1.2-2.1build1.1 [38.8 kB]", "Fetched 38.8 kB in 0s (645 kB/s)", "Selecting previously unselected package audispd-plugins.", "(Reading database ... ", "(Reading database ... 5%", "(Reading database ... 10%", "(Reading database ... 15%", "(Reading database ... 20%", "(Reading database ... 25%", "(Reading database ... 30%", "(Reading database ... 35%", "(Reading database ... 40%", "(Reading database ... 45%", "(Reading database ... 50%", "(Reading database ... 55%", "(Reading database ... 60%", "(Reading database ... 65%", "(Reading database ... 70%", "(Reading database ... 75%", "(Reading database ... 80%", "(Reading database ... 85%", "(Reading database ... 90%", "(Reading database ... 95%", "(Reading database ... 100%", "(Reading database ... 36206 files and directories currently installed.)", "Preparing to unpack .../audispd-plugins_1%3a3.1.2-2.1build1.1_amd64.deb ...", "Unpacking audispd-plugins (1:3.1.2-2.1build1.1) ...", "Setting up audispd-plugins (1:3.1.2-2.1build1.1) ..."]} 2026-06-02 13:35:32.810266 | ubuntu-noble | 2026-06-02 13:35:32.810272 | ubuntu-noble | TASK [auditd : Copy auditd.conf configuration files] *************************** 2026-06-02 13:35:33.023061 | debian-bookworm | --- before 2026-06-02 13:35:33.023130 | debian-bookworm | +++ after 2026-06-02 13:35:33.023146 | debian-bookworm | @@ -1,4 +1,4 @@ 2026-06-02 13:35:33.023156 | debian-bookworm | { 2026-06-02 13:35:33.023174 | debian-bookworm | "path": "/etc/audit/rules.d/audit.rules", 2026-06-02 13:35:33.023214 | debian-bookworm | - "state": "file" 2026-06-02 13:35:33.023292 | debian-bookworm | + "state": "absent" 2026-06-02 13:35:33.023373 | debian-bookworm | } 2026-06-02 13:35:33.023471 | debian-bookworm | 2026-06-02 13:35:33.023573 | debian-bookworm | changed: [molecule-auditd] => (item=audit.rules) => {"ansible_loop_var": "item", "changed": true, "item": "audit.rules", "path": "/etc/audit/rules.d/audit.rules", "state": "absent"} 2026-06-02 13:35:33.023686 | debian-bookworm | skipping: [molecule-auditd] => (item=20-neo23x0.rules) => {"ansible_loop_var": "item", "changed": false, "false_condition": "item not in auditd_rules_files", "item": "20-neo23x0.rules", "skip_reason": "Conditional result was False"} 2026-06-02 13:35:33.023773 | debian-bookworm | 2026-06-02 13:35:33.023873 | debian-bookworm | RUNNING HANDLER [auditd : Restart auditd service] ****************************** 2026-06-02 13:35:33.707150 | debian-bookworm | changed: [molecule-auditd] => {"changed": true, "name": "auditd", "state": "started", "status": {"ActiveEnterTimestamp": "Tue 2026-06-02 13:35:26 UTC", "ActiveEnterTimestampMonotonic": "483986550", "ActiveExitTimestampMonotonic": "0", "ActiveState": "active", "After": "local-fs.target system.slice systemd-journald.socket systemd-tmpfiles-setup.service", "AllowIsolate": "no", "AssertResult": "yes", "AssertTimestamp": "Tue 2026-06-02 13:35:26 UTC", "AssertTimestampMonotonic": "483936326", "Before": "shutdown.target sysinit.target systemd-update-utmp.service ssh.service", "BlockIOAccounting": "no", "BlockIOWeight": "[not set]", "CPUAccounting": "yes", "CPUAffinityFromNUMA": "no", "CPUQuotaPerSecUSec": "infinity", "CPUQuotaPeriodUSec": "infinity", "CPUSchedulingPolicy": "0", "CPUSchedulingPriority": "0", "CPUSchedulingResetOnFork": "no", "CPUShares": "[not set]", "CPUUsageNSec": "36055000", "CPUWeight": "[not set]", "CacheDirectoryMode": "0755", "CanFreeze": "yes", "CanIsolate": "no", "CanReload": "no", "CanStart": "yes", "CanStop": "yes", "CapabilityBoundingSet": "cap_chown cap_dac_override cap_dac_read_search cap_fowner cap_fsetid cap_kill cap_setgid cap_setuid cap_setpcap cap_linux_immutable cap_net_bind_service cap_net_broadcast cap_net_admin cap_net_raw cap_ipc_lock cap_ipc_owner cap_sys_rawio cap_sys_chroot cap_sys_ptrace cap_sys_pacct cap_sys_admin cap_sys_boot cap_sys_nice cap_sys_resource cap_sys_time cap_sys_tty_config cap_mknod cap_lease cap_audit_write cap_audit_control cap_setfcap cap_mac_override cap_mac_admin cap_syslog cap_wake_alarm cap_block_suspend cap_audit_read cap_perfmon cap_bpf cap_checkpoint_restore", "CleanResult": "success", "CollectMode": "inactive", "ConditionResult": "yes", "ConditionTimestamp": "Tue 2026-06-02 13:35:26 UTC", "ConditionTimestampMonotonic": "483936274", "ConfigurationDirectoryMode": "0755", "Conflicts": "shutdown.target", "ControlGroup": "/system.slice/auditd.service", "ControlGroupId": "3250", "ControlPID": "0", "CoredumpFilter": "0x33", "DefaultDependencies": "no", "DefaultMemoryLow": "0", "DefaultMemoryMin": "0", "Delegate": "no", "Description": "Security Auditing Service", "DevicePolicy": "auto", "Documentation": "\"man:auditd(8)\" https://github.com/linux-audit/audit-documentation", "DynamicUser": "no", "ExecMainCode": "0", "ExecMainExitTimestampMonotonic": "0", "ExecMainPID": "2306", "ExecMainStartTimestamp": "Tue 2026-06-02 13:35:26 UTC", "ExecMainStartTimestampMonotonic": "483968729", "ExecMainStatus": "0", "ExecStart": "{ path=/sbin/auditd ; argv[]=/sbin/auditd ; ignore_errors=no ; start_time=[Tue 2026-06-02 13:35:26 UTC] ; stop_time=[Tue 2026-06-02 13:35:26 UTC] ; pid=2305 ; code=exited ; status=0 }", "ExecStartEx": "{ path=/sbin/auditd ; argv[]=/sbin/auditd ; flags= ; start_time=[Tue 2026-06-02 13:35:26 UTC] ; stop_time=[Tue 2026-06-02 13:35:26 UTC] ; pid=2305 ; code=exited ; status=0 }", "ExecStartPost": "{ path=/sbin/augenrules ; argv[]=/sbin/augenrules --load ; ignore_errors=yes ; start_time=[Tue 2026-06-02 13:35:26 UTC] ; stop_time=[Tue 2026-06-02 13:35:26 UTC] ; pid=2309 ; code=exited ; status=0 }", "ExecStartPostEx": "{ path=/sbin/augenrules ; argv[]=/sbin/augenrules --load ; flags=ignore-failure ; start_time=[Tue 2026-06-02 13:35:26 UTC] ; stop_time=[Tue 2026-06-02 13:35:26 UTC] ; pid=2309 ; code=exited ; status=0 }", "ExitType": "main", "FailureAction": "none", "FileDescriptorStoreMax": "0", "FinalKillSignal": "9", "FragmentPath": "/lib/systemd/system/auditd.service", "FreezerState": "running", "GID": "[not set]", "GuessMainPID": "yes", "IOAccounting": "no", "IOReadBytes": "18446744073709551615", "IOReadOperations": "18446744073709551615", "IOSchedulingClass": "2", "IOSchedulingPriority": "4", "IOWeight": "[not set]", "IOWriteBytes": "18446744073709551615", "IOWriteOperations": "18446744073709551615", "IPAccounting": "no", "IPEgressBytes": "[no data]", "IPEgressPackets": "[no data]", "IPIngressBytes": "[no data]", "IPIngressPackets": "[no data]", "Id": "auditd.service", "IgnoreOnIsolate": "no", "IgnoreSIGPIPE": "yes", "InactiveEnterTimestampMonotonic": "0", "InactiveExitTimestamp": "Tue 2026-06-02 13:35:26 UTC", "InactiveExitTimestampMonotonic": "483952469", "InvocationID": "46b3207586434fe492e954bbd0a9fb39", "JobRunningTimeoutUSec": "infinity", "JobTimeoutAction": "none", "JobTimeoutUSec": "infinity", "KeyringMode": "private", "KillMode": "control-group", "KillSignal": "15", "LimitAS": "infinity", "LimitASSoft": "infinity", "LimitCORE": "infinity", "LimitCORESoft": "0", "LimitCPU": "infinity", "LimitCPUSoft": "infinity", "LimitDATA": "infinity", "LimitDATASoft": "infinity", "LimitFSIZE": "infinity", "LimitFSIZESoft": "infinity", "LimitLOCKS": "infinity", "LimitLOCKSSoft": "infinity", "LimitMEMLOCK": "8388608", "LimitMEMLOCKSoft": "8388608", "LimitMSGQUEUE": "819200", "LimitMSGQUEUESoft": "819200", "LimitNICE": "0", "LimitNICESoft": "0", "LimitNOFILE": "524288", "LimitNOFILESoft": "1024", "LimitNPROC": "15480", "LimitNPROCSoft": "15480", "LimitRSS": "infinity", "LimitRSSSoft": "infinity", "LimitRTPRIO": "0", "LimitRTPRIOSoft": "0", "LimitRTTIME": "infinity", "LimitRTTIMESoft": "infinity", "LimitSIGPENDING": "15480", "LimitSIGPENDINGSoft": "15480", "LimitSTACK": "infinity", "LimitSTACKSoft": "8388608", "LoadState": "loaded", "LockPersonality": "yes", "LogLevelMax": "-1", "LogRateLimitBurst": "0", "LogRateLimitIntervalUSec": "0", "LogsDirectoryMode": "0755", "MainPID": "2306", "ManagedOOMMemoryPressure": "auto", "ManagedOOMMemoryPressureLimit": "0", "ManagedOOMPreference": "none", "ManagedOOMSwap": "auto", "MemoryAccounting": "yes", "MemoryAvailable": "infinity", "MemoryCurrent": "712704", "MemoryDenyWriteExecute": "yes", "MemoryHigh": "infinity", "MemoryLimit": "infinity", "MemoryLow": "0", "MemoryMax": "infinity", "MemoryMin": "0", "MemorySwapMax": "infinity", "MountAPIVFS": "no", "NFileDescriptorStore": "0", "NRestarts": "0", "NUMAPolicy": "n/a", "Names": "auditd.service", "NeedDaemonReload": "no", "Nice": "0", "NoNewPrivileges": "no", "NonBlocking": "no", "NotifyAccess": "none", "OOMPolicy": "stop", "OOMScoreAdjust": "0", "OnFailureJobMode": "replace", "OnSuccessJobMode": "fail", "PIDFile": "/run/auditd.pid", "Perpetual": "no", "PrivateDevices": "no", "PrivateIPC": "no", "PrivateMounts": "no", "PrivateNetwork": "no", "PrivateTmp": "no", "PrivateUsers": "no", "ProcSubset": "all", "ProtectClock": "no", "ProtectControlGroups": "yes", "ProtectHome": "no", "ProtectHostname": "no", "ProtectKernelLogs": "no", "ProtectKernelModules": "yes", "ProtectKernelTunables": "no", "ProtectProc": "default", "ProtectSystem": "no", "RefuseManualStart": "no", "RefuseManualStop": "no", "ReloadResult": "success", "RemainAfterExit": "no", "RemoveIPC": "no", "Requires": "system.slice", "Restart": "on-failure", "RestartKillSignal": "15", "RestartPreventExitStatus": "2 4 6", "RestartUSec": "100ms", "RestrictNamespaces": "no", "RestrictRealtime": "yes", "RestrictSUIDSGID": "no", "Result": "success", "RootDirectoryStartOnly": "no", "RuntimeDirectoryMode": "0755", "RuntimeDirectoryPreserve": "no", "RuntimeMaxUSec": "infinity", "RuntimeRandomizedExtraUSec": "0", "SameProcessGroup": "no", "SecureBits": "0", "SendSIGHUP": "no", "SendSIGKILL": "yes", "Slice": "system.slice", "StandardError": "inherit", "StandardInput": "null", "StandardOutput": "journal", "StartLimitAction": "none", "StartLimitBurst": "5", "StartLimitIntervalUSec": "10s", "StartupBlockIOWeight": "[not set]", "StartupCPUShares": "[not set]", "StartupCPUWeight": "[not set]", "StartupIOWeight": "[not set]", "StateChangeTimestamp": "Tue 2026-06-02 13:35:26 UTC", "StateChangeTimestampMonotonic": "483986550", "StateDirectoryMode": "0755", "StatusErrno": "0", "StopWhenUnneeded": "no", "SubState": "running", "SuccessAction": "none", "SyslogFacility": "3", "SyslogLevel": "6", "SyslogLevelPrefix": "yes", "SyslogPriority": "30", "SystemCallErrorNumber": "2147483646", "TTYReset": "no", "TTYVHangup": "no", "TTYVTDisallocate": "no", "TasksAccounting": "yes", "TasksCurrent": "2", "TasksMax": "4644", "TimeoutAbortUSec": "1min 30s", "TimeoutCleanUSec": "infinity", "TimeoutStartFailureMode": "terminate", "TimeoutStartUSec": "1min 30s", "TimeoutStopFailureMode": "terminate", "TimeoutStopUSec": "1min 30s", "TimerSlackNSec": "50000", "Transient": "no", "Type": "forking", "UID": "[not set]", "UMask": "0022", "UnitFilePreset": "enabled", "UnitFileState": "enabled", "UtmpMode": "init", "WantedBy": "multi-user.target", "WatchdogSignal": "6", "WatchdogTimestampMonotonic": "0", "WatchdogUSec": "0"}} 2026-06-02 13:35:33.707279 | debian-bookworm | 2026-06-02 13:35:33.707374 | debian-bookworm | RUNNING HANDLER [auditd : Generate auditd rules] ******************************* 2026-06-02 13:35:34.108252 | debian-bookworm | changed: [molecule-auditd] => {"changed": true, "cmd": ["augenrules", "--load"], "delta": "0:00:00.094689", "end": "2026-06-02 13:35:34.062908", "msg": "", "rc": 0, "start": "2026-06-02 13:35:33.968219", "stderr": "Unknown user: chrony\nThere was an error in line 24 of /etc/audit/audit.rules\nError sending add rule data request (No such file or directory)\nThere was an error in line 28 of /etc/audit/audit.rules\nUnknown user: ntp\nThere was an error in line 44 of /etc/audit/audit.rules\nError sending add rule data request (No such file or directory)\nThere was an error in line 83 of /etc/audit/audit.rules\nError sending add rule data request (No such file or directory)\nThere was an error in line 84 of /etc/audit/audit.rules\nError sending add rule data request (No such file or directory)\nThere was an error in line 112 of /etc/audit/audit.rules\nError sending add rule data request (No such file or directory)\nThere was an error in line 115 of /etc/audit/audit.rules\nError sending add rule data request (No such file or directory)\nThere was an error in line 176 of /etc/audit/audit.rules\nError sending add rule data request (No such file or directory)\nThere was an error in line 177 of /etc/audit/audit.rules\nError sending add rule data request (No such file or directory)\nThere was an error in line 178 of /etc/audit/audit.rules\nError sending add rule data request (No such file or directory)\nThere was an error in line 179 of /etc/audit/audit.rules\nError sending add rule data request (No such file or directory)\nThere was an error in line 180 of /etc/audit/audit.rules\nError sending add rule data request (No such file or directory)\nThere was an error in line 217 of /etc/audit/audit.rules\nError sending add rule data request (No such file or directory)\nThere was an error in line 218 of /etc/audit/audit.rules\nError sending add rule data request (No such file or directory)\nThere was an error in line 234 of /etc/audit/audit.rules\nError sending add rule data request (No such file or directory)\nThere was an error in line 285 of /etc/audit/audit.rules\nError sending add rule data request (No such file or directory)\nThere was an error in line 286 of /etc/audit/audit.rules\nError sending add rule data request (No such file or directory)\nThere was an error in line 324 of /etc/audit/audit.rules\nError sending add rule data request (No such file or directory)\nThere was an error in line 325 of /etc/audit/audit.rules\nError sending add rule data request (No such file or directory)\nThere was an error in line 346 of /etc/audit/audit.rules\nparameter passed without an option given\nThere was an error in line 347 of /etc/audit/audit.rules\nparameter passed without an option given\nThere was an error in line 348 of /etc/audit/audit.rules\nparameter passed without an option given\nThere was an error in line 349 of /etc/audit/audit.rules\nparameter passed without an option given\nThere was an error in line 350 of /etc/audit/audit.rules\nparameter passed without an option given\nThere was an error in line 351 of /etc/audit/audit.rules\nError sending add rule data request (No such file or directory)\nThere was an error in line 359 of /etc/audit/audit.rules", "stderr_lines": ["Unknown user: chrony", "There was an error in line 24 of /etc/audit/audit.rules", "Error sending add rule data request (No such file or directory)", "There was an error in line 28 of /etc/audit/audit.rules", "Unknown user: ntp", "There was an error in line 44 of /etc/audit/audit.rules", "Error sending add rule data request (No such file or directory)", "There was an error in line 83 of /etc/audit/audit.rules", "Error sending add rule data request (No such file or directory)", "There was an error in line 84 of /etc/audit/audit.rules", "Error sending add rule data request (No such file or directory)", "There was an error in line 112 of /etc/audit/audit.rules", "Error sending add rule data request (No such file or directory)", "There was an error in line 115 of /etc/audit/audit.rules", "Error sending add rule data request (No such file or directory)", "There was an error in line 176 of /etc/audit/audit.rules", "Error sending add rule data request (No such file or directory)", "There was an error in line 177 of /etc/audit/audit.rules", "Error sending add rule data request (No such file or directory)", "There was an error in line 178 of /etc/audit/audit.rules", "Error sending add rule data request (No such file or directory)", "There was an error in line 179 of /etc/audit/audit.rules", "Error sending add rule data request (No such file or directory)", "There was an error in line 180 of /etc/audit/audit.rules", "Error sending add rule data request (No such file or directory)", "There was an error in line 217 of /etc/audit/audit.rules", "Error sending add rule data request (No such file or directory)", "There was an error in line 218 of /etc/audit/audit.rules", "Error sending add rule data request (No such file or directory)", "There was an error in line 234 of /etc/audit/audit.rules", "Error sending add rule data request (No such file or directory)", "There was an error in line 285 of /etc/audit/audit.rules", "Error sending add rule data request (No such file or directory)", "There was an error in line 286 of /etc/audit/audit.rules", "Error sending add rule data request (No such file or directory)", "There was an error in line 324 of /etc/audit/audit.rules", "Error sending add rule data request (No such file or directory)", "There was an error in line 325 of /etc/audit/audit.rules", "Error sending add rule data request (No such file or directory)", "There was an error in line 346 of /etc/audit/audit.rules", "parameter passed without an option given", "There was an error in line 347 of /etc/audit/audit.rules", "parameter passed without an option given", "There was an error in line 348 of /etc/audit/audit.rules", "parameter passed without an option given", "There was an error in line 349 of /etc/audit/audit.rules", "parameter passed without an option given", "There was an error in line 350 of /etc/audit/audit.rules", "parameter passed without an option given", "There was an error in line 351 of /etc/audit/audit.rules", "Error sending add rule data request (No such file or directory)", "There was an error in line 359 of /etc/audit/audit.rules"], "stdout": "/usr/sbin/augenrules: No change\nNo rules\nenabled 1\nfailure 1\npid 2696\nrate_limit 0\nbacklog_limit 8192\nlost 0\nbacklog 598\nbacklog_wait_time 60000\nbacklog_wait_time_actual 0\nenabled 1\nfailure 1\npid 2696\nrate_limit 0\nbacklog_limit 8192\nlost 0\nbacklog 352\nbacklog_wait_time 60000\nbacklog_wait_time_actual 0", "stdout_lines": ["/usr/sbin/augenrules: No change", "No rules", "enabled 1", "failure 1", "pid 2696", "rate_limit 0", "backlog_limit 8192", "lost 0", "backlog 598", "backlog_wait_time 60000", "backlog_wait_time_actual 0", "enabled 1", "failure 1", "pid 2696", "rate_limit 0", "backlog_limit 8192", "lost 0", "backlog 352", "backlog_wait_time 60000", "backlog_wait_time_actual 0"]} 2026-06-02 13:35:34.108307 | debian-bookworm | 2026-06-02 13:35:34.108403 | debian-bookworm | RUNNING HANDLER [auditd : Restart auditd service] ****************************** 2026-06-02 13:35:34.171979 | ubuntu-noble | --- before 2026-06-02 13:35:34.172029 | ubuntu-noble | +++ after: /home/zuul/.ansible/tmp/ansible-local-1924x23g6tam/tmpohehpq3u/auditd.conf.j2 2026-06-02 13:35:34.172036 | ubuntu-noble | @@ -0,0 +1,37 @@ 2026-06-02 13:35:34.172041 | ubuntu-noble | +# 2026-06-02 13:35:34.172046 | ubuntu-noble | +# This file controls the configuration of the audit daemon 2026-06-02 13:35:34.172051 | ubuntu-noble | +# 2026-06-02 13:35:34.172055 | ubuntu-noble | + 2026-06-02 13:35:34.172101 | ubuntu-noble | +local_events = yes 2026-06-02 13:35:34.172376 | ubuntu-noble | +write_logs = yes 2026-06-02 13:35:34.172623 | ubuntu-noble | +log_file = /var/log/audit/audit.log 2026-06-02 13:35:34.172867 | ubuntu-noble | +log_group = adm 2026-06-02 13:35:34.173142 | ubuntu-noble | +log_format = RAW 2026-06-02 13:35:34.173416 | ubuntu-noble | +flush = INCREMENTAL_ASYNC 2026-06-02 13:35:34.173652 | ubuntu-noble | +freq = 50 2026-06-02 13:35:34.173894 | ubuntu-noble | +max_log_file = 8 2026-06-02 13:35:34.174186 | ubuntu-noble | +num_logs = 5 2026-06-02 13:35:34.174513 | ubuntu-noble | +priority_boost = 4 2026-06-02 13:35:34.174762 | ubuntu-noble | +disp_qos = lossy 2026-06-02 13:35:34.175060 | ubuntu-noble | +dispatcher = /sbin/audispd 2026-06-02 13:35:34.175406 | ubuntu-noble | +name_format = NONE 2026-06-02 13:35:34.175654 | ubuntu-noble | +##name = mydomain 2026-06-02 13:35:34.175902 | ubuntu-noble | +max_log_file_action = ROTATE 2026-06-02 13:35:34.176195 | ubuntu-noble | +space_left = 12361 2026-06-02 13:35:34.176468 | ubuntu-noble | +space_left_action = email 2026-06-02 13:35:34.176710 | ubuntu-noble | +verify_email = yes 2026-06-02 13:35:34.176977 | ubuntu-noble | +action_mail_acct = root 2026-06-02 13:35:34.177223 | ubuntu-noble | +admin_space_left = 50 2026-06-02 13:35:34.177497 | ubuntu-noble | +admin_space_left_action = SUSPEND 2026-06-02 13:35:34.177750 | ubuntu-noble | +disk_full_action = SUSPEND 2026-06-02 13:35:34.178027 | ubuntu-noble | +disk_error_action = SUSPEND 2026-06-02 13:35:34.178343 | ubuntu-noble | +use_libwrap = yes 2026-06-02 13:35:34.178568 | ubuntu-noble | +##tcp_listen_port = 60 2026-06-02 13:35:34.178772 | ubuntu-noble | +tcp_listen_queue = 5 2026-06-02 13:35:34.178997 | ubuntu-noble | +tcp_max_per_addr = 1 2026-06-02 13:35:34.179201 | ubuntu-noble | +##tcp_client_ports = 1024-65535 2026-06-02 13:35:34.179423 | ubuntu-noble | +tcp_client_max_idle = 0 2026-06-02 13:35:34.179622 | ubuntu-noble | +enable_krb5 = no 2026-06-02 13:35:34.179823 | ubuntu-noble | +krb5_principal = auditd 2026-06-02 13:35:34.180051 | ubuntu-noble | +##krb5_key_file = /etc/audit/audit.key 2026-06-02 13:35:34.180246 | ubuntu-noble | +distribute_network = no 2026-06-02 13:35:34.180470 | ubuntu-noble | 2026-06-02 13:35:34.180719 | ubuntu-noble | changed: [molecule-auditd] => {"changed": true, "checksum": "e902cc6bebf86c17087d153e359a2cc1231672e0", "dest": "/etc/audit/audit.conf", "gid": 0, "group": "root", "md5sum": "69dfd768317bae876a6a78c8aeb5cce1", "mode": "0640", "owner": "root", "size": 806, "src": "/home/zuul/.ansible/tmp/ansible-tmp-1780407332.829864-2321-11970058432130/.source.conf", "state": "file", "uid": 0} 2026-06-02 13:35:34.181331 | ubuntu-noble | 2026-06-02 13:35:34.181602 | ubuntu-noble | TASK [auditd : Adjust auditd/audispd configurations] *************************** 2026-06-02 13:35:34.804590 | debian-bookworm | changed: [molecule-auditd] => {"changed": true, "name": "auditd", "state": "started", "status": {"ActiveEnterTimestamp": "Tue 2026-06-02 13:35:33 UTC", "ActiveEnterTimestampMonotonic": "491544647", "ActiveExitTimestamp": "Tue 2026-06-02 13:35:33 UTC", "ActiveExitTimestampMonotonic": "491367992", "ActiveState": "active", "After": "local-fs.target system.slice systemd-journald.socket systemd-tmpfiles-setup.service", "AllowIsolate": "no", "AssertResult": "yes", "AssertTimestamp": "Tue 2026-06-02 13:35:33 UTC", "AssertTimestampMonotonic": "491413008", "Before": "shutdown.target sysinit.target systemd-update-utmp.service ssh.service", "BlockIOAccounting": "no", "BlockIOWeight": "[not set]", "CPUAccounting": "yes", "CPUAffinityFromNUMA": "no", "CPUQuotaPerSecUSec": "infinity", "CPUQuotaPeriodUSec": "infinity", "CPUSchedulingPolicy": "0", "CPUSchedulingPriority": "0", "CPUSchedulingResetOnFork": "no", "CPUShares": "[not set]", "CPUUsageNSec": "175299000", "CPUWeight": "[not set]", "CacheDirectoryMode": "0755", "CanFreeze": "yes", "CanIsolate": "no", "CanReload": "no", "CanStart": "yes", "CanStop": "yes", "CapabilityBoundingSet": "cap_chown cap_dac_override cap_dac_read_search cap_fowner cap_fsetid cap_kill cap_setgid cap_setuid cap_setpcap cap_linux_immutable cap_net_bind_service cap_net_broadcast cap_net_admin cap_net_raw cap_ipc_lock cap_ipc_owner cap_sys_rawio cap_sys_chroot cap_sys_ptrace cap_sys_pacct cap_sys_admin cap_sys_boot cap_sys_nice cap_sys_resource cap_sys_time cap_sys_tty_config cap_mknod cap_lease cap_audit_write cap_audit_control cap_setfcap cap_mac_override cap_mac_admin cap_syslog cap_wake_alarm cap_block_suspend cap_audit_read cap_perfmon cap_bpf cap_checkpoint_restore", "CleanResult": "success", "CollectMode": "inactive", "ConditionResult": "yes", "ConditionTimestamp": "Tue 2026-06-02 13:35:33 UTC", "ConditionTimestampMonotonic": "491412934", "ConfigurationDirectoryMode": "0755", "Conflicts": "shutdown.target", "ControlGroup": "/system.slice/auditd.service", "ControlGroupId": "3289", "ControlPID": "0", "CoredumpFilter": "0x33", "DefaultDependencies": "no", "DefaultMemoryLow": "0", "DefaultMemoryMin": "0", "Delegate": "no", "Description": "Security Auditing Service", "DevicePolicy": "auto", "Documentation": "\"man:auditd(8)\" https://github.com/linux-audit/audit-documentation", "DynamicUser": "no", "ExecMainCode": "0", "ExecMainExitTimestampMonotonic": "0", "ExecMainPID": "2696", "ExecMainStartTimestamp": "Tue 2026-06-02 13:35:33 UTC", "ExecMainStartTimestampMonotonic": "491449274", "ExecMainStatus": "0", "ExecStart": "{ path=/sbin/auditd ; argv[]=/sbin/auditd ; ignore_errors=no ; start_time=[Tue 2026-06-02 13:35:33 UTC] ; stop_time=[Tue 2026-06-02 13:35:33 UTC] ; pid=2694 ; code=exited ; status=0 }", "ExecStartEx": "{ path=/sbin/auditd ; argv[]=/sbin/auditd ; flags= ; start_time=[Tue 2026-06-02 13:35:33 UTC] ; stop_time=[Tue 2026-06-02 13:35:33 UTC] ; pid=2694 ; code=exited ; status=0 }", "ExecStartPost": "{ path=/sbin/augenrules ; argv[]=/sbin/augenrules --load ; ignore_errors=yes ; start_time=[Tue 2026-06-02 13:35:33 UTC] ; stop_time=[Tue 2026-06-02 13:35:33 UTC] ; pid=2700 ; code=exited ; status=0 }", "ExecStartPostEx": "{ path=/sbin/augenrules ; argv[]=/sbin/augenrules --load ; flags=ignore-failure ; start_time=[Tue 2026-06-02 13:35:33 UTC] ; stop_time=[Tue 2026-06-02 13:35:33 UTC] ; pid=2700 ; code=exited ; status=0 }", "ExitType": "main", "FailureAction": "none", "FileDescriptorStoreMax": "0", "FinalKillSignal": "9", "FragmentPath": "/lib/systemd/system/auditd.service", "FreezerState": "running", "GID": "[not set]", "GuessMainPID": "yes", "IOAccounting": "no", "IOReadBytes": "18446744073709551615", "IOReadOperations": "18446744073709551615", "IOSchedulingClass": "2", "IOSchedulingPriority": "4", "IOWeight": "[not set]", "IOWriteBytes": "18446744073709551615", "IOWriteOperations": "18446744073709551615", "IPAccounting": "no", "IPEgressBytes": "[no data]", "IPEgressPackets": "[no data]", "IPIngressBytes": "[no data]", "IPIngressPackets": "[no data]", "Id": "auditd.service", "IgnoreOnIsolate": "no", "IgnoreSIGPIPE": "yes", "InactiveEnterTimestamp": "Tue 2026-06-02 13:35:33 UTC", "InactiveEnterTimestampMonotonic": "491411695", "InactiveExitTimestamp": "Tue 2026-06-02 13:35:33 UTC", "InactiveExitTimestampMonotonic": "491429671", "InvocationID": "c780d3a354374aaa95e796dba72c45cd", "JobRunningTimeoutUSec": "infinity", "JobTimeoutAction": "none", "JobTimeoutUSec": "infinity", "KeyringMode": "private", "KillMode": "control-group", "KillSignal": "15", "LimitAS": "infinity", "LimitASSoft": "infinity", "LimitCORE": "infinity", "LimitCORESoft": "0", "LimitCPU": "infinity", "LimitCPUSoft": "infinity", "LimitDATA": "infinity", "LimitDATASoft": "infinity", "LimitFSIZE": "infinity", "LimitFSIZESoft": "infinity", "LimitLOCKS": "infinity", "LimitLOCKSSoft": "infinity", "LimitMEMLOCK": "8388608", "LimitMEMLOCKSoft": "8388608", "LimitMSGQUEUE": "819200", "LimitMSGQUEUESoft": "819200", "LimitNICE": "0", "LimitNICESoft": "0", "LimitNOFILE": "524288", "LimitNOFILESoft": "1024", "LimitNPROC": "15480", "LimitNPROCSoft": "15480", "LimitRSS": "infinity", "LimitRSSSoft": "infinity", "LimitRTPRIO": "0", "LimitRTPRIOSoft": "0", "LimitRTTIME": "infinity", "LimitRTTIMESoft": "infinity", "LimitSIGPENDING": "15480", "LimitSIGPENDINGSoft": "15480", "LimitSTACK": "infinity", "LimitSTACKSoft": "8388608", "LoadState": "loaded", "LockPersonality": "yes", "LogLevelMax": "-1", "LogRateLimitBurst": "0", "LogRateLimitIntervalUSec": "0", "LogsDirectoryMode": "0755", "MainPID": "2696", "ManagedOOMMemoryPressure": "auto", "ManagedOOMMemoryPressureLimit": "0", "ManagedOOMPreference": "none", "ManagedOOMSwap": "auto", "MemoryAccounting": "yes", "MemoryAvailable": "infinity", "MemoryCurrent": "2080768", "MemoryDenyWriteExecute": "yes", "MemoryHigh": "infinity", "MemoryLimit": "infinity", "MemoryLow": "0", "MemoryMax": "infinity", "MemoryMin": "0", "MemorySwapMax": "infinity", "MountAPIVFS": "no", "NFileDescriptorStore": "0", "NRestarts": "0", "NUMAPolicy": "n/a", "Names": "auditd.service", "NeedDaemonReload": "no", "Nice": "0", "NoNewPrivileges": "no", "NonBlocking": "no", "NotifyAccess": "none", "OOMPolicy": "stop", "OOMScoreAdjust": "0", "OnFailureJobMode": "replace", "OnSuccessJobMode": "fail", "PIDFile": "/run/auditd.pid", "Perpetual": "no", "PrivateDevices": "no", "PrivateIPC": "no", "PrivateMounts": "no", "PrivateNetwork": "no", "PrivateTmp": "no", "PrivateUsers": "no", "ProcSubset": "all", "ProtectClock": "no", "ProtectControlGroups": "yes", "ProtectHome": "no", "ProtectHostname": "no", "ProtectKernelLogs": "no", "ProtectKernelModules": "yes", "ProtectKernelTunables": "no", "ProtectProc": "default", "ProtectSystem": "no", "RefuseManualStart": "no", "RefuseManualStop": "no", "ReloadResult": "success", "RemainAfterExit": "no", "RemoveIPC": "no", "Requires": "system.slice", "Restart": "on-failure", "RestartKillSignal": "15", "RestartPreventExitStatus": "2 4 6", "RestartUSec": "100ms", "RestrictNamespaces": "no", "RestrictRealtime": "yes", "RestrictSUIDSGID": "no", "Result": "success", "RootDirectoryStartOnly": "no", "RuntimeDirectoryMode": "0755", "RuntimeDirectoryPreserve": "no", "RuntimeMaxUSec": "infinity", "RuntimeRandomizedExtraUSec": "0", "SameProcessGroup": "no", "SecureBits": "0", "SendSIGHUP": "no", "SendSIGKILL": "yes", "Slice": "system.slice", "StandardError": "inherit", "StandardInput": "null", "StandardOutput": "journal", "StartLimitAction": "none", "StartLimitBurst": "5", "StartLimitIntervalUSec": "10s", "StartupBlockIOWeight": "[not set]", "StartupCPUShares": "[not set]", "StartupCPUWeight": "[not set]", "StartupIOWeight": "[not set]", "StateChangeTimestamp": "Tue 2026-06-02 13:35:33 UTC", "StateChangeTimestampMonotonic": "491544647", "StateDirectoryMode": "0755", "StatusErrno": "0", "StopWhenUnneeded": "no", "SubState": "running", "SuccessAction": "none", "SyslogFacility": "3", "SyslogLevel": "6", "SyslogLevelPrefix": "yes", "SyslogPriority": "30", "SystemCallErrorNumber": "2147483646", "TTYReset": "no", "TTYVHangup": "no", "TTYVTDisallocate": "no", "TasksAccounting": "yes", "TasksCurrent": "2", "TasksMax": "4644", "TimeoutAbortUSec": "1min 30s", "TimeoutCleanUSec": "infinity", "TimeoutStartFailureMode": "terminate", "TimeoutStartUSec": "1min 30s", "TimeoutStopFailureMode": "terminate", "TimeoutStopUSec": "1min 30s", "TimerSlackNSec": "50000", "Transient": "no", "Type": "forking", "UID": "[not set]", "UMask": "0022", "UnitFilePreset": "enabled", "UnitFileState": "enabled", "UtmpMode": "init", "WantedBy": "multi-user.target", "WatchdogSignal": "6", "WatchdogTimestampMonotonic": "0", "WatchdogUSec": "0"}} 2026-06-02 13:35:34.806632 | debian-bookworm | 2026-06-02 13:35:34.806745 | debian-bookworm | PLAY RECAP ********************************************************************* 2026-06-02 13:35:34.806867 | debian-bookworm | molecule-auditd : ok=15 changed=8 unreachable=0 failed=0 skipped=0 rescued=0 ignored=0 2026-06-02 13:35:34.806964 | debian-bookworm | 2026-06-02 13:35:34.641284 | ubuntu-noble | ok: [molecule-auditd] => (item={'parameter': 'active', 'value': 'no', 'config': '/etc/audit/plugins.d/syslog.conf'}) => {"ansible_loop_var": "item", "backup": "", "changed": false, "item": {"config": "/etc/audit/plugins.d/syslog.conf", "parameter": "active", "value": "no"}, "msg": ""} 2026-06-02 13:35:34.641588 | ubuntu-noble | 2026-06-02 13:35:34.641987 | ubuntu-noble | TASK [auditd : Deploy rules for auditd] **************************************** 2026-06-02 13:35:34.898454 | debian-bookworm | INFO [delegated > converge] Executed: Successful 2026-06-02 13:35:34.898767 | debian-bookworm | WARNING Molecule executed 1 scenario (1 missing files) 2026-06-02 13:35:35.578884 | ubuntu-noble | --- before 2026-06-02 13:35:35.579305 | ubuntu-noble | +++ after: /home/zuul/.ansible/tmp/ansible-local-1924x23g6tam/tmp5unpvwuu/20-neo23x0.rules.j2 2026-06-02 13:35:35.579567 | ubuntu-noble | @@ -0,0 +1,750 @@ 2026-06-02 13:35:35.581019 | ubuntu-noble | +# ___ ___ __ __ 2026-06-02 13:35:35.581071 | ubuntu-noble | +# / | __ ______/ (_) /_____/ / 2026-06-02 13:35:35.581084 | ubuntu-noble | +# / /| |/ / / / __ / / __/ __ / 2026-06-02 13:35:35.581096 | ubuntu-noble | +# / ___ / /_/ / /_/ / / /_/ /_/ / 2026-06-02 13:35:35.581107 | ubuntu-noble | +# /_/ |_\__,_/\__,_/_/\__/\__,_/ 2026-06-02 13:35:35.581118 | ubuntu-noble | +# 2026-06-02 13:35:35.581204 | ubuntu-noble | +# Linux Audit Daemon - Best Practice Configuration 2026-06-02 13:35:35.581454 | ubuntu-noble | +# /etc/audit/audit.rules 2026-06-02 13:35:35.581628 | ubuntu-noble | +# 2026-06-02 13:35:35.581799 | ubuntu-noble | +# Compiled by Florian Roth 2026-06-02 13:35:35.582001 | ubuntu-noble | +# 2026-06-02 13:35:35.582237 | ubuntu-noble | +# Created : 2017/12/05 2026-06-02 13:35:35.583461 | ubuntu-noble | +# Modified : 2023/01/25 2026-06-02 13:35:35.583792 | ubuntu-noble | +# 2026-06-02 13:35:35.584093 | ubuntu-noble | +# Based on rules published here: 2026-06-02 13:35:35.584462 | ubuntu-noble | +# Gov.uk auditd rules 2026-06-02 13:35:35.585106 | ubuntu-noble | +# https://github.com/gds-operations/puppet-auditd/pull/1 2026-06-02 13:35:35.585548 | ubuntu-noble | +# CentOS 7 hardening 2026-06-02 13:35:35.585998 | ubuntu-noble | +# https://highon.coffee/blog/security-harden-centos-7/#auditd---audit-daemon 2026-06-02 13:35:35.586354 | ubuntu-noble | +# Linux audit repo 2026-06-02 13:35:35.586698 | ubuntu-noble | +# https://github.com/linux-audit/audit-userspace/tree/master/rules 2026-06-02 13:35:35.587049 | ubuntu-noble | +# Auditd high performance linux auditing 2026-06-02 13:35:35.587475 | ubuntu-noble | +# https://linux-audit.com/tuning-auditd-high-performance-linux-auditing/ 2026-06-02 13:35:35.587704 | ubuntu-noble | +# 2026-06-02 13:35:35.587934 | ubuntu-noble | +# Further rules 2026-06-02 13:35:35.588328 | ubuntu-noble | +# For PCI DSS compliance see: 2026-06-02 13:35:35.588663 | ubuntu-noble | +# https://github.com/linux-audit/audit-userspace/blob/master/rules/30-pci-dss-v31.rules 2026-06-02 13:35:35.588974 | ubuntu-noble | +# For NISPOM compliance see: 2026-06-02 13:35:35.589355 | ubuntu-noble | +# https://github.com/linux-audit/audit-userspace/blob/master/rules/30-nispom.rules 2026-06-02 13:35:35.589569 | ubuntu-noble | + 2026-06-02 13:35:35.589783 | ubuntu-noble | +# Remove any existing rules 2026-06-02 13:35:35.590004 | ubuntu-noble | +-D 2026-06-02 13:35:35.590246 | ubuntu-noble | + 2026-06-02 13:35:35.590457 | ubuntu-noble | +# Buffer Size 2026-06-02 13:35:35.590689 | ubuntu-noble | +## Feel free to increase this if the machine panic's 2026-06-02 13:35:35.590895 | ubuntu-noble | +-b 8192 2026-06-02 13:35:35.591953 | ubuntu-noble | + 2026-06-02 13:35:35.591983 | ubuntu-noble | +# Failure Mode 2026-06-02 13:35:35.591991 | ubuntu-noble | +## Possible values: 0 (silent), 1 (printk, print a failure message), 2 (panic, halt the system) 2026-06-02 13:35:35.591999 | ubuntu-noble | +-f 1 2026-06-02 13:35:35.592035 | ubuntu-noble | + 2026-06-02 13:35:35.592369 | ubuntu-noble | +# Ignore errors 2026-06-02 13:35:35.592639 | ubuntu-noble | +## e.g. caused by users or files not found in the local environment 2026-06-02 13:35:35.592847 | ubuntu-noble | +-i 2026-06-02 13:35:35.593079 | ubuntu-noble | + 2026-06-02 13:35:35.593334 | ubuntu-noble | +# Self Auditing --------------------------------------------------------------- 2026-06-02 13:35:35.593532 | ubuntu-noble | + 2026-06-02 13:35:35.593740 | ubuntu-noble | +## Audit the audit logs 2026-06-02 13:35:35.593994 | ubuntu-noble | +### Successful and unsuccessful attempts to read information from the audit records 2026-06-02 13:35:35.594267 | ubuntu-noble | +-w /var/log/audit/ -p wra -k auditlog 2026-06-02 13:35:35.594480 | ubuntu-noble | +-w /var/audit/ -p wra -k auditlog 2026-06-02 13:35:35.594659 | ubuntu-noble | + 2026-06-02 13:35:35.594846 | ubuntu-noble | +## Auditd configuration 2026-06-02 13:35:35.595122 | ubuntu-noble | +### Modifications to audit configuration that occur while the audit collection functions are operating 2026-06-02 13:35:35.595365 | ubuntu-noble | +-w /etc/audit/ -p wa -k auditconfig 2026-06-02 13:35:35.595561 | ubuntu-noble | +-w /etc/libaudit.conf -p wa -k auditconfig 2026-06-02 13:35:35.595748 | ubuntu-noble | +-w /etc/audisp/ -p wa -k audispconfig 2026-06-02 13:35:35.595948 | ubuntu-noble | + 2026-06-02 13:35:35.596155 | ubuntu-noble | +## Monitor for use of audit management tools 2026-06-02 13:35:35.596405 | ubuntu-noble | +-w /sbin/auditctl -p x -k audittools 2026-06-02 13:35:35.596599 | ubuntu-noble | +-w /sbin/auditd -p x -k audittools 2026-06-02 13:35:35.596814 | ubuntu-noble | +-w /usr/sbin/auditd -p x -k audittools 2026-06-02 13:35:35.597052 | ubuntu-noble | +-w /usr/sbin/augenrules -p x -k audittools 2026-06-02 13:35:35.597336 | ubuntu-noble | + 2026-06-02 13:35:35.597512 | ubuntu-noble | +## Access to all audit trails 2026-06-02 13:35:35.597668 | ubuntu-noble | + 2026-06-02 13:35:35.598938 | ubuntu-noble | +-a always,exit -F path=/usr/sbin/ausearch -F perm=x -k audittools 2026-06-02 13:35:35.598958 | ubuntu-noble | +-a always,exit -F path=/usr/sbin/aureport -F perm=x -k audittools 2026-06-02 13:35:35.598964 | ubuntu-noble | +-a always,exit -F path=/usr/sbin/aulast -F perm=x -k audittools 2026-06-02 13:35:35.598970 | ubuntu-noble | +-a always,exit -F path=/usr/sbin/aulastlogin -F perm=x -k audittools 2026-06-02 13:35:35.598975 | ubuntu-noble | +-a always,exit -F path=/usr/sbin/auvirt -F perm=x -k audittools 2026-06-02 13:35:35.598980 | ubuntu-noble | + 2026-06-02 13:35:35.598986 | ubuntu-noble | +# Filters --------------------------------------------------------------------- 2026-06-02 13:35:35.598991 | ubuntu-noble | + 2026-06-02 13:35:35.599092 | ubuntu-noble | +### We put these early because audit is a first match wins system. 2026-06-02 13:35:35.599397 | ubuntu-noble | + 2026-06-02 13:35:35.599565 | ubuntu-noble | +## Ignore SELinux AVC records 2026-06-02 13:35:35.599722 | ubuntu-noble | +-a always,exclude -F msgtype=AVC 2026-06-02 13:35:35.599861 | ubuntu-noble | + 2026-06-02 13:35:35.600034 | ubuntu-noble | +## Ignore current working directory records 2026-06-02 13:35:35.600227 | ubuntu-noble | +-a always,exclude -F msgtype=CWD 2026-06-02 13:35:35.600379 | ubuntu-noble | + 2026-06-02 13:35:35.600540 | ubuntu-noble | +## Cron jobs fill the logs with stuff we normally don't want (works with SELinux) 2026-06-02 13:35:35.600694 | ubuntu-noble | +-a never,user -F subj_type=crond_t 2026-06-02 13:35:35.600844 | ubuntu-noble | +-a never,exit -F subj_type=crond_t 2026-06-02 13:35:35.601010 | ubuntu-noble | + 2026-06-02 13:35:35.601167 | ubuntu-noble | +## This prevents chrony from overwhelming the logs 2026-06-02 13:35:35.601347 | ubuntu-noble | +-a never,exit -F arch=b64 -S adjtimex -F auid=-1 -F uid=chrony -F subj_type=chronyd_t 2026-06-02 13:35:35.601487 | ubuntu-noble | + 2026-06-02 13:35:35.601638 | ubuntu-noble | +## This is not very interesting and wastes a lot of space if the server is public facing 2026-06-02 13:35:35.601797 | ubuntu-noble | +-a always,exclude -F msgtype=CRYPTO_KEY_USER 2026-06-02 13:35:35.601960 | ubuntu-noble | + 2026-06-02 13:35:35.602112 | ubuntu-noble | +## Open VM Tools 2026-06-02 13:35:35.602288 | ubuntu-noble | +-a exit,never -F arch=b64 -S all -F exe=/usr/bin/vmtoolsd 2026-06-02 13:35:35.602504 | ubuntu-noble | + 2026-06-02 13:35:35.602666 | ubuntu-noble | +## High Volume Event Filter (especially on Linux Workstations) 2026-06-02 13:35:35.602820 | ubuntu-noble | +-a never,exit -F arch=b64 -F dir=/dev/shm -k sharedmemaccess 2026-06-02 13:35:35.602992 | ubuntu-noble | +-a never,exit -F arch=b64 -F dir=/var/lock/lvm -k locklvm 2026-06-02 13:35:35.603139 | ubuntu-noble | + 2026-06-02 13:35:35.603358 | ubuntu-noble | +## FileBeat 2026-06-02 13:35:35.603515 | ubuntu-noble | +-a never,exit -F arch=b64 -F path=/opt/filebeat -k filebeat 2026-06-02 13:35:35.603655 | ubuntu-noble | + 2026-06-02 13:35:35.603804 | ubuntu-noble | +## More information on how to filter events 2026-06-02 13:35:35.603974 | ubuntu-noble | +### https://access.redhat.com/solutions/2482221 2026-06-02 13:35:35.604118 | ubuntu-noble | + 2026-06-02 13:35:35.604284 | ubuntu-noble | +# Rules ----------------------------------------------------------------------- 2026-06-02 13:35:35.604425 | ubuntu-noble | + 2026-06-02 13:35:35.604573 | ubuntu-noble | +## Kernel parameters 2026-06-02 13:35:35.604720 | ubuntu-noble | +-w /etc/sysctl.conf -p wa -k sysctl 2026-06-02 13:35:35.604871 | ubuntu-noble | +-w /etc/sysctl.d -p wa -k sysctl 2026-06-02 13:35:35.605027 | ubuntu-noble | + 2026-06-02 13:35:35.605194 | ubuntu-noble | +## Kernel module loading and unloading 2026-06-02 13:35:35.605350 | ubuntu-noble | +-a always,exit -F perm=x -F auid!=-1 -F path=/sbin/insmod -k modules 2026-06-02 13:35:35.605498 | ubuntu-noble | +-a always,exit -F perm=x -F auid!=-1 -F path=/sbin/modprobe -k modules 2026-06-02 13:35:35.605644 | ubuntu-noble | +-a always,exit -F perm=x -F auid!=-1 -F path=/sbin/rmmod -k modules 2026-06-02 13:35:35.605795 | ubuntu-noble | +-a always,exit -F arch=b64 -S finit_module -S init_module -S delete_module -F auid!=-1 -k modules 2026-06-02 13:35:35.605949 | ubuntu-noble | + 2026-06-02 13:35:35.606101 | ubuntu-noble | +## Modprobe configuration 2026-06-02 13:35:35.606293 | ubuntu-noble | +-w /etc/modprobe.conf -p wa -k modprobe 2026-06-02 13:35:35.606442 | ubuntu-noble | +-w /etc/modprobe.d -p wa -k modprobe 2026-06-02 13:35:35.606580 | ubuntu-noble | + 2026-06-02 13:35:35.606729 | ubuntu-noble | +## KExec usage (all actions) 2026-06-02 13:35:35.606883 | ubuntu-noble | +-a always,exit -F arch=b64 -S kexec_load -k KEXEC 2026-06-02 13:35:35.607934 | ubuntu-noble | + 2026-06-02 13:35:35.607952 | ubuntu-noble | +## Special files 2026-06-02 13:35:35.607957 | ubuntu-noble | +-a always,exit -F arch=b64 -S mknod -S mknodat -k specialfiles 2026-06-02 13:35:35.607962 | ubuntu-noble | + 2026-06-02 13:35:35.607967 | ubuntu-noble | +## Mount operations (only attributable) 2026-06-02 13:35:35.607972 | ubuntu-noble | +-a always,exit -F arch=b64 -S mount -S umount2 -F auid!=-1 -k mount 2026-06-02 13:35:35.607977 | ubuntu-noble | + 2026-06-02 13:35:35.607996 | ubuntu-noble | +### NFS mount 2026-06-02 13:35:35.608157 | ubuntu-noble | +-a always,exit -F path=/sbin/mount.nfs -F perm=x -F auid>=500 -F auid!=4294967295 -k T1078_Valid_Accounts 2026-06-02 13:35:35.608346 | ubuntu-noble | +-a always,exit -F path=/usr/sbin/mount.nfs -F perm=x -F auid>=500 -F auid!=4294967295 -k T1078_Valid_Accounts 2026-06-02 13:35:35.608489 | ubuntu-noble | + 2026-06-02 13:35:35.608639 | ubuntu-noble | +## Change swap (only attributable) 2026-06-02 13:35:35.608824 | ubuntu-noble | +-a always,exit -F arch=b64 -S swapon -S swapoff -F auid!=-1 -k swap 2026-06-02 13:35:35.608985 | ubuntu-noble | + 2026-06-02 13:35:35.609136 | ubuntu-noble | +## Time 2026-06-02 13:35:35.609310 | ubuntu-noble | +-a always,exit -F arch=b64 -F uid!=ntp -S adjtimex -S settimeofday -S clock_settime -k time 2026-06-02 13:35:35.609457 | ubuntu-noble | +### Local time zone 2026-06-02 13:35:35.609599 | ubuntu-noble | +-w /etc/localtime -p wa -k localtime 2026-06-02 13:35:35.609736 | ubuntu-noble | + 2026-06-02 13:35:35.609877 | ubuntu-noble | +## Stunnel 2026-06-02 13:35:35.610038 | ubuntu-noble | +-w /usr/sbin/stunnel -p x -k stunnel 2026-06-02 13:35:35.610240 | ubuntu-noble | +-w /usr/bin/stunnel -p x -k stunnel 2026-06-02 13:35:35.610383 | ubuntu-noble | + 2026-06-02 13:35:35.610531 | ubuntu-noble | +## Cron configuration & scheduled jobs 2026-06-02 13:35:35.610677 | ubuntu-noble | +-w /etc/cron.allow -p wa -k cron 2026-06-02 13:35:35.610820 | ubuntu-noble | +-w /etc/cron.deny -p wa -k cron 2026-06-02 13:35:35.610984 | ubuntu-noble | +-w /etc/cron.d/ -p wa -k cron 2026-06-02 13:35:35.611138 | ubuntu-noble | +-w /etc/cron.daily/ -p wa -k cron 2026-06-02 13:35:35.611305 | ubuntu-noble | +-w /etc/cron.hourly/ -p wa -k cron 2026-06-02 13:35:35.611451 | ubuntu-noble | +-w /etc/cron.monthly/ -p wa -k cron 2026-06-02 13:35:35.611608 | ubuntu-noble | +-w /etc/cron.weekly/ -p wa -k cron 2026-06-02 13:35:35.611751 | ubuntu-noble | +-w /etc/crontab -p wa -k cron 2026-06-02 13:35:35.611894 | ubuntu-noble | +-w /var/spool/cron/ -p wa -k cron 2026-06-02 13:35:35.612050 | ubuntu-noble | + 2026-06-02 13:35:35.612212 | ubuntu-noble | +## User, group, password databases 2026-06-02 13:35:35.612356 | ubuntu-noble | +-w /etc/group -p wa -k etcgroup 2026-06-02 13:35:35.612497 | ubuntu-noble | +-w /etc/passwd -p wa -k etcpasswd 2026-06-02 13:35:35.612639 | ubuntu-noble | +-w /etc/gshadow -k etcgroup 2026-06-02 13:35:35.612780 | ubuntu-noble | +-w /etc/shadow -k etcpasswd 2026-06-02 13:35:35.612938 | ubuntu-noble | +-w /etc/security/opasswd -k opasswd 2026-06-02 13:35:35.613082 | ubuntu-noble | + 2026-06-02 13:35:35.613271 | ubuntu-noble | +## Sudoers file changes 2026-06-02 13:35:35.613423 | ubuntu-noble | +-w /etc/sudoers -p wa -k actions 2026-06-02 13:35:35.613570 | ubuntu-noble | +-w /etc/sudoers.d/ -p wa -k actions 2026-06-02 13:35:35.613708 | ubuntu-noble | + 2026-06-02 13:35:35.613850 | ubuntu-noble | +## Passwd 2026-06-02 13:35:35.614016 | ubuntu-noble | +-w /usr/bin/passwd -p x -k passwd_modification 2026-06-02 13:35:35.614157 | ubuntu-noble | + 2026-06-02 13:35:35.614940 | ubuntu-noble | +## Tools to change group identifiers 2026-06-02 13:35:35.614954 | ubuntu-noble | +-w /usr/sbin/groupadd -p x -k group_modification 2026-06-02 13:35:35.614960 | ubuntu-noble | +-w /usr/sbin/groupmod -p x -k group_modification 2026-06-02 13:35:35.614964 | ubuntu-noble | +-w /usr/sbin/addgroup -p x -k group_modification 2026-06-02 13:35:35.614969 | ubuntu-noble | +-w /usr/sbin/useradd -p x -k user_modification 2026-06-02 13:35:35.614997 | ubuntu-noble | +-w /usr/sbin/userdel -p x -k user_modification 2026-06-02 13:35:35.615148 | ubuntu-noble | +-w /usr/sbin/usermod -p x -k user_modification 2026-06-02 13:35:35.615314 | ubuntu-noble | +-w /usr/sbin/adduser -p x -k user_modification 2026-06-02 13:35:35.615452 | ubuntu-noble | + 2026-06-02 13:35:35.615598 | ubuntu-noble | +## Login configuration and information 2026-06-02 13:35:35.615742 | ubuntu-noble | +-w /etc/login.defs -p wa -k login 2026-06-02 13:35:35.615887 | ubuntu-noble | +-w /etc/securetty -p wa -k login 2026-06-02 13:35:35.616047 | ubuntu-noble | +-w /var/log/faillog -p wa -k login 2026-06-02 13:35:35.616209 | ubuntu-noble | +-w /var/log/lastlog -p wa -k login 2026-06-02 13:35:35.616355 | ubuntu-noble | +-w /var/log/tallylog -p wa -k login 2026-06-02 13:35:35.616494 | ubuntu-noble | + 2026-06-02 13:35:35.616637 | ubuntu-noble | +## Network Environment 2026-06-02 13:35:35.616778 | ubuntu-noble | +### Changes to hostname 2026-06-02 13:35:35.616961 | ubuntu-noble | +-a always,exit -F arch=b64 -S sethostname -S setdomainname -k network_modifications 2026-06-02 13:35:35.617105 | ubuntu-noble | + 2026-06-02 13:35:35.617296 | ubuntu-noble | +### Detect Remote Shell Use 2026-06-02 13:35:35.617450 | ubuntu-noble | +-a always,exit -F arch=b64 -F exe=/bin/bash -F success=1 -S connect -k "remote_shell" 2026-06-02 13:35:35.617599 | ubuntu-noble | +-a always,exit -F arch=b64 -F exe=/usr/bin/bash -F success=1 -S connect -k "remote_shell" 2026-06-02 13:35:35.617734 | ubuntu-noble | + 2026-06-02 13:35:35.617880 | ubuntu-noble | +### Successful IPv4 Connections 2026-06-02 13:35:35.618047 | ubuntu-noble | +-a always,exit -F arch=b64 -S connect -F a2=16 -F success=1 -F key=network_connect_4 2026-06-02 13:35:35.618213 | ubuntu-noble | + 2026-06-02 13:35:35.618363 | ubuntu-noble | +### Successful IPv6 Connections 2026-06-02 13:35:35.618513 | ubuntu-noble | +-a always,exit -F arch=b64 -S connect -F a2=28 -F success=1 -F key=network_connect_6 2026-06-02 13:35:35.618649 | ubuntu-noble | + 2026-06-02 13:35:35.618795 | ubuntu-noble | +### Changes to other files 2026-06-02 13:35:35.618980 | ubuntu-noble | +-w /etc/hosts -p wa -k network_modifications 2026-06-02 13:35:35.619994 | ubuntu-noble | +-w /etc/sysconfig/network -p wa -k network_modifications 2026-06-02 13:35:35.620044 | ubuntu-noble | +-w /etc/sysconfig/network-scripts -p w -k network_modifications 2026-06-02 13:35:35.620051 | ubuntu-noble | +-w /etc/network/ -p wa -k network 2026-06-02 13:35:35.620064 | ubuntu-noble | +-a always,exit -F dir=/etc/NetworkManager/ -F perm=wa -k network_modifications 2026-06-02 13:35:35.620071 | ubuntu-noble | + 2026-06-02 13:35:35.620077 | ubuntu-noble | +### Changes to issue 2026-06-02 13:35:35.620083 | ubuntu-noble | +-w /etc/issue -p wa -k etcissue 2026-06-02 13:35:35.621225 | ubuntu-noble | +-w /etc/issue.net -p wa -k etcissue 2026-06-02 13:35:35.621391 | ubuntu-noble | + 2026-06-02 13:35:35.621521 | ubuntu-noble | +## System startup scripts 2026-06-02 13:35:35.621653 | ubuntu-noble | +-w /etc/inittab -p wa -k init 2026-06-02 13:35:35.621783 | ubuntu-noble | +-w /etc/init.d/ -p wa -k init 2026-06-02 13:35:35.621954 | ubuntu-noble | +-w /etc/init/ -p wa -k init 2026-06-02 13:35:35.622039 | ubuntu-noble | + 2026-06-02 13:35:35.622165 | ubuntu-noble | +## Library search paths 2026-06-02 13:35:35.622338 | ubuntu-noble | +-w /etc/ld.so.conf -p wa -k libpath 2026-06-02 13:35:35.622461 | ubuntu-noble | +-w /etc/ld.so.conf.d -p wa -k libpath 2026-06-02 13:35:35.622582 | ubuntu-noble | + 2026-06-02 13:35:35.622711 | ubuntu-noble | +## Systemwide library preloads (LD_PRELOAD) 2026-06-02 13:35:35.622845 | ubuntu-noble | +-w /etc/ld.so.preload -p wa -k systemwide_preloads 2026-06-02 13:35:35.624358 | ubuntu-noble | + 2026-06-02 13:35:35.624401 | ubuntu-noble | +## Pam configuration 2026-06-02 13:35:35.624408 | ubuntu-noble | +-w /etc/pam.d/ -p wa -k pam 2026-06-02 13:35:35.624415 | ubuntu-noble | +-w /etc/security/limits.conf -p wa -k pam 2026-06-02 13:35:35.624421 | ubuntu-noble | +-w /etc/security/limits.d -p wa -k pam 2026-06-02 13:35:35.624427 | ubuntu-noble | +-w /etc/security/pam_env.conf -p wa -k pam 2026-06-02 13:35:35.624434 | ubuntu-noble | +-w /etc/security/namespace.conf -p wa -k pam 2026-06-02 13:35:35.624440 | ubuntu-noble | +-w /etc/security/namespace.d -p wa -k pam 2026-06-02 13:35:35.624450 | ubuntu-noble | +-w /etc/security/namespace.init -p wa -k pam 2026-06-02 13:35:35.624518 | ubuntu-noble | + 2026-06-02 13:35:35.624631 | ubuntu-noble | +## Mail configuration 2026-06-02 13:35:35.624955 | ubuntu-noble | +-w /etc/aliases -p wa -k mail 2026-06-02 13:35:35.625101 | ubuntu-noble | +-w /etc/postfix/ -p wa -k mail 2026-06-02 13:35:35.625227 | ubuntu-noble | +-w /etc/exim4/ -p wa -k mail 2026-06-02 13:35:35.625344 | ubuntu-noble | + 2026-06-02 13:35:35.625462 | ubuntu-noble | +## SSH configuration 2026-06-02 13:35:35.625589 | ubuntu-noble | +-w /etc/ssh/sshd_config -k sshd 2026-06-02 13:35:35.625704 | ubuntu-noble | +-w /etc/ssh/sshd_config.d -k sshd 2026-06-02 13:35:35.625811 | ubuntu-noble | + 2026-06-02 13:35:35.625960 | ubuntu-noble | +## root ssh key tampering 2026-06-02 13:35:35.626082 | ubuntu-noble | +-w /root/.ssh -p wa -k rootkey 2026-06-02 13:35:35.626207 | ubuntu-noble | + 2026-06-02 13:35:35.626318 | ubuntu-noble | +# Systemd 2026-06-02 13:35:35.626441 | ubuntu-noble | +-w /bin/systemctl -p x -k systemd 2026-06-02 13:35:35.626551 | ubuntu-noble | +-w /etc/systemd/ -p wa -k systemd 2026-06-02 13:35:35.626678 | ubuntu-noble | +-w /usr/lib/systemd -p wa -k systemd 2026-06-02 13:35:35.626786 | ubuntu-noble | + 2026-06-02 13:35:35.626943 | ubuntu-noble | +## https://systemd.network/systemd.generator.html 2026-06-02 13:35:35.627042 | ubuntu-noble | +-w /etc/systemd/system-generators/ -p wa -k systemd_generator 2026-06-02 13:35:35.627162 | ubuntu-noble | +-w /usr/local/lib/systemd/system-generators/ -p wa -k systemd_generator 2026-06-02 13:35:35.627362 | ubuntu-noble | +-w /usr/lib/systemd/system-generators -p wa -k systemd_generator 2026-06-02 13:35:35.627480 | ubuntu-noble | + 2026-06-02 13:35:35.627597 | ubuntu-noble | +-w /etc/systemd/user-generators/ -p wa -k systemd_generator 2026-06-02 13:35:35.627761 | ubuntu-noble | +-w /usr/local/lib/systemd/user-generators/ -p wa -k systemd_generator 2026-06-02 13:35:35.627837 | ubuntu-noble | +-w /lib/systemd/system-generators/ -p wa -k systemd_generator 2026-06-02 13:35:35.628039 | ubuntu-noble | + 2026-06-02 13:35:35.628089 | ubuntu-noble | +## SELinux events that modify the system's Mandatory Access Controls (MAC) 2026-06-02 13:35:35.628213 | ubuntu-noble | +-w /etc/selinux/ -p wa -k mac_policy 2026-06-02 13:35:35.628310 | ubuntu-noble | + 2026-06-02 13:35:35.628419 | ubuntu-noble | +## Critical elements access failures 2026-06-02 13:35:35.628534 | ubuntu-noble | +-a always,exit -F arch=b64 -S open -F dir=/etc -F success=0 -k unauthedfileaccess 2026-06-02 13:35:35.628647 | ubuntu-noble | +-a always,exit -F arch=b64 -S open -F dir=/bin -F success=0 -k unauthedfileaccess 2026-06-02 13:35:35.628758 | ubuntu-noble | +-a always,exit -F arch=b64 -S open -F dir=/sbin -F success=0 -k unauthedfileaccess 2026-06-02 13:35:35.628871 | ubuntu-noble | +-a always,exit -F arch=b64 -S open -F dir=/usr/bin -F success=0 -k unauthedfileaccess 2026-06-02 13:35:35.630106 | ubuntu-noble | +-a always,exit -F arch=b64 -S open -F dir=/usr/sbin -F success=0 -k unauthedfileaccess 2026-06-02 13:35:35.630129 | ubuntu-noble | +-a always,exit -F arch=b64 -S open -F dir=/var -F success=0 -k unauthedfileaccess 2026-06-02 13:35:35.630296 | ubuntu-noble | +-a always,exit -F arch=b64 -S open -F dir=/home -F success=0 -k unauthedfileaccess 2026-06-02 13:35:35.630395 | ubuntu-noble | +-a always,exit -F arch=b64 -S open -F dir=/srv -F success=0 -k unauthedfileaccess 2026-06-02 13:35:35.630496 | ubuntu-noble | + 2026-06-02 13:35:35.630600 | ubuntu-noble | +## Process ID change (switching accounts) applications 2026-06-02 13:35:35.630698 | ubuntu-noble | +-w /bin/su -p x -k priv_esc 2026-06-02 13:35:35.630809 | ubuntu-noble | +-w /usr/bin/sudo -p x -k priv_esc 2026-06-02 13:35:35.630897 | ubuntu-noble | + 2026-06-02 13:35:35.631016 | ubuntu-noble | +## Power state 2026-06-02 13:35:35.631116 | ubuntu-noble | +-w /sbin/shutdown -p x -k power 2026-06-02 13:35:35.631225 | ubuntu-noble | +-w /sbin/poweroff -p x -k power 2026-06-02 13:35:35.631321 | ubuntu-noble | +-w /sbin/reboot -p x -k power 2026-06-02 13:35:35.631417 | ubuntu-noble | +-w /sbin/halt -p x -k power 2026-06-02 13:35:35.631508 | ubuntu-noble | + 2026-06-02 13:35:35.631606 | ubuntu-noble | +## Session initiation information 2026-06-02 13:35:35.631704 | ubuntu-noble | +-w /var/run/utmp -p wa -k session 2026-06-02 13:35:35.631803 | ubuntu-noble | +-w /var/log/btmp -p wa -k session 2026-06-02 13:35:35.631902 | ubuntu-noble | +-w /var/log/wtmp -p wa -k session 2026-06-02 13:35:35.632320 | ubuntu-noble | + 2026-06-02 13:35:35.632428 | ubuntu-noble | +## Discretionary Access Control (DAC) modifications 2026-06-02 13:35:35.632533 | ubuntu-noble | +-a always,exit -F arch=b64 -S chmod -F auid>=1000 -F auid!=-1 -k perm_mod 2026-06-02 13:35:35.632637 | ubuntu-noble | +-a always,exit -F arch=b64 -S chown -F auid>=1000 -F auid!=-1 -k perm_mod 2026-06-02 13:35:35.632739 | ubuntu-noble | +-a always,exit -F arch=b64 -S fchmod -F auid>=1000 -F auid!=-1 -k perm_mod 2026-06-02 13:35:35.632841 | ubuntu-noble | +-a always,exit -F arch=b64 -S fchmodat -F auid>=1000 -F auid!=-1 -k perm_mod 2026-06-02 13:35:35.634301 | ubuntu-noble | +-a always,exit -F arch=b64 -S fchown -F auid>=1000 -F auid!=-1 -k perm_mod 2026-06-02 13:35:35.634325 | ubuntu-noble | +-a always,exit -F arch=b64 -S fchownat -F auid>=1000 -F auid!=-1 -k perm_mod 2026-06-02 13:35:35.634329 | ubuntu-noble | +-a always,exit -F arch=b64 -S fremovexattr -F auid>=1000 -F auid!=-1 -k perm_mod 2026-06-02 13:35:35.634339 | ubuntu-noble | +-a always,exit -F arch=b64 -S fsetxattr -F auid>=1000 -F auid!=-1 -k perm_mod 2026-06-02 13:35:35.634343 | ubuntu-noble | +-a always,exit -F arch=b64 -S lchown -F auid>=1000 -F auid!=-1 -k perm_mod 2026-06-02 13:35:35.634347 | ubuntu-noble | +-a always,exit -F arch=b64 -S lremovexattr -F auid>=1000 -F auid!=-1 -k perm_mod 2026-06-02 13:35:35.634350 | ubuntu-noble | +-a always,exit -F arch=b64 -S lsetxattr -F auid>=1000 -F auid!=-1 -k perm_mod 2026-06-02 13:35:35.634354 | ubuntu-noble | +-a always,exit -F arch=b64 -S removexattr -F auid>=1000 -F auid!=-1 -k perm_mod 2026-06-02 13:35:35.634357 | ubuntu-noble | +-a always,exit -F arch=b64 -S setxattr -F auid>=1000 -F auid!=-1 -k perm_mod 2026-06-02 13:35:35.634361 | ubuntu-noble | + 2026-06-02 13:35:35.634364 | ubuntu-noble | +# Special Rules --------------------------------------------------------------- 2026-06-02 13:35:35.634368 | ubuntu-noble | + 2026-06-02 13:35:35.634382 | ubuntu-noble | +## Reconnaissance 2026-06-02 13:35:35.634390 | ubuntu-noble | +-w /usr/bin/whoami -p x -k recon 2026-06-02 13:35:35.634393 | ubuntu-noble | +-w /usr/bin/id -p x -k recon 2026-06-02 13:35:35.634723 | ubuntu-noble | +-w /bin/hostname -p x -k recon 2026-06-02 13:35:35.634734 | ubuntu-noble | +-w /bin/uname -p x -k recon 2026-06-02 13:35:35.634738 | ubuntu-noble | +-w /etc/issue -p r -k recon 2026-06-02 13:35:35.634762 | ubuntu-noble | +-w /etc/hostname -p r -k recon 2026-06-02 13:35:35.634854 | ubuntu-noble | + 2026-06-02 13:35:35.636145 | ubuntu-noble | +## Suspicious activity 2026-06-02 13:35:35.636169 | ubuntu-noble | +-w /usr/bin/wget -p x -k susp_activity 2026-06-02 13:35:35.636195 | ubuntu-noble | +-w /usr/bin/curl -p x -k susp_activity 2026-06-02 13:35:35.636199 | ubuntu-noble | +-w /usr/bin/base64 -p x -k susp_activity 2026-06-02 13:35:35.636203 | ubuntu-noble | +-w /bin/nc -p x -k susp_activity 2026-06-02 13:35:35.636206 | ubuntu-noble | +-w /bin/netcat -p x -k susp_activity 2026-06-02 13:35:35.636210 | ubuntu-noble | +-w /usr/bin/ncat -p x -k susp_activity 2026-06-02 13:35:35.636213 | ubuntu-noble | +-w /usr/bin/ss -p x -k susp_activity 2026-06-02 13:35:35.636217 | ubuntu-noble | +-w /usr/bin/netstat -p x -k susp_activity 2026-06-02 13:35:35.636220 | ubuntu-noble | +-w /usr/bin/ssh -p x -k susp_activity 2026-06-02 13:35:35.636223 | ubuntu-noble | +-w /usr/bin/scp -p x -k susp_activity 2026-06-02 13:35:35.636227 | ubuntu-noble | +-w /usr/bin/sftp -p x -k susp_activity 2026-06-02 13:35:35.636230 | ubuntu-noble | +-w /usr/bin/ftp -p x -k susp_activity 2026-06-02 13:35:35.636450 | ubuntu-noble | +-w /usr/bin/socat -p x -k susp_activity 2026-06-02 13:35:35.636513 | ubuntu-noble | +-w /usr/bin/wireshark -p x -k susp_activity 2026-06-02 13:35:35.636530 | ubuntu-noble | +-w /usr/bin/tshark -p x -k susp_activity 2026-06-02 13:35:35.636644 | ubuntu-noble | +-w /usr/bin/rawshark -p x -k susp_activity 2026-06-02 13:35:35.636740 | ubuntu-noble | +-w /usr/bin/rdesktop -p x -k susp_activity 2026-06-02 13:35:35.636841 | ubuntu-noble | +-w /usr/local/bin/rdesktop -p x -k susp_activity 2026-06-02 13:35:35.638014 | ubuntu-noble | +-w /usr/bin/wlfreerdp -p x -k susp_activity 2026-06-02 13:35:35.638060 | ubuntu-noble | +-w /usr/bin/xfreerdp -p x -k susp_activity 2026-06-02 13:35:35.638071 | ubuntu-noble | +-w /usr/local/bin/xfreerdp -p x -k susp_activity 2026-06-02 13:35:35.638082 | ubuntu-noble | +-w /usr/bin/nmap -p x -k susp_activity 2026-06-02 13:35:35.638092 | ubuntu-noble | + 2026-06-02 13:35:35.638104 | ubuntu-noble | +## sssd 2026-06-02 13:35:35.638115 | ubuntu-noble | +-a always,exit -F path=/usr/libexec/sssd/p11_child -F perm=x -F auid>=500 -F auid!=4294967295 -k T1078_Valid_Accounts 2026-06-02 13:35:35.638126 | ubuntu-noble | +-a always,exit -F path=/usr/libexec/sssd/krb5_child -F perm=x -F auid>=500 -F auid!=4294967295 -k T1078_Valid_Accounts 2026-06-02 13:35:35.638136 | ubuntu-noble | +-a always,exit -F path=/usr/libexec/sssd/ldap_child -F perm=x -F auid>=500 -F auid!=4294967295 -k T1078_Valid_Accounts 2026-06-02 13:35:35.638146 | ubuntu-noble | +-a always,exit -F path=/usr/libexec/sssd/selinux_child -F perm=x -F auid>=500 -F auid!=4294967295 -k T1078_Valid_Accounts 2026-06-02 13:35:35.638163 | ubuntu-noble | +-a always,exit -F path=/usr/libexec/sssd/proxy_child -F perm=x -F auid>=500 -F auid!=4294967295 -k T1078_Valid_Accounts 2026-06-02 13:35:35.638213 | ubuntu-noble | + 2026-06-02 13:35:35.638228 | ubuntu-noble | +## T1002 Data Compressed 2026-06-02 13:35:35.638302 | ubuntu-noble | + 2026-06-02 13:35:35.638500 | ubuntu-noble | +-w /usr/bin/zip -p x -k Data_Compressed 2026-06-02 13:35:35.638519 | ubuntu-noble | +-w /usr/bin/gzip -p x -k Data_Compressed 2026-06-02 13:35:35.638597 | ubuntu-noble | +-w /usr/bin/tar -p x -k Data_Compressed 2026-06-02 13:35:35.638696 | ubuntu-noble | +-w /usr/bin/bzip2 -p x -k Data_Compressed 2026-06-02 13:35:35.638791 | ubuntu-noble | + 2026-06-02 13:35:35.639004 | ubuntu-noble | +-w /usr/bin/lzip -p x -k Data_Compressed 2026-06-02 13:35:35.640163 | ubuntu-noble | +-w /usr/local/bin/lzip -p x -k Data_Compressed 2026-06-02 13:35:35.640238 | ubuntu-noble | + 2026-06-02 13:35:35.640261 | ubuntu-noble | +-w /usr/bin/lz4 -p x -k Data_Compressed 2026-06-02 13:35:35.640395 | ubuntu-noble | +-w /usr/local/bin/lz4 -p x -k Data_Compressed 2026-06-02 13:35:35.640501 | ubuntu-noble | + 2026-06-02 13:35:35.640619 | ubuntu-noble | +-w /usr/bin/lzop -p x -k Data_Compressed 2026-06-02 13:35:35.640685 | ubuntu-noble | +-w /usr/local/bin/lzop -p x -k Data_Compressed 2026-06-02 13:35:35.640801 | ubuntu-noble | + 2026-06-02 13:35:35.640881 | ubuntu-noble | +-w /usr/bin/plzip -p x -k Data_Compressed 2026-06-02 13:35:35.641440 | ubuntu-noble | +-w /usr/local/bin/plzip -p x -k Data_Compressed 2026-06-02 13:35:35.641472 | ubuntu-noble | + 2026-06-02 13:35:35.641481 | ubuntu-noble | +-w /usr/bin/pbzip2 -p x -k Data_Compressed 2026-06-02 13:35:35.641512 | ubuntu-noble | +-w /usr/local/bin/pbzip2 -p x -k Data_Compressed 2026-06-02 13:35:35.641870 | ubuntu-noble | + 2026-06-02 13:35:35.641890 | ubuntu-noble | +-w /usr/bin/lbzip2 -p x -k Data_Compressed 2026-06-02 13:35:35.641899 | ubuntu-noble | +-w /usr/local/bin/lbzip2 -p x -k Data_Compressed 2026-06-02 13:35:35.641909 | ubuntu-noble | + 2026-06-02 13:35:35.642015 | ubuntu-noble | +-w /usr/bin/pixz -p x -k Data_Compressed 2026-06-02 13:35:35.642095 | ubuntu-noble | +-w /usr/local/bin/pixz -p x -k Data_Compressed 2026-06-02 13:35:35.643992 | ubuntu-noble | + 2026-06-02 13:35:35.644042 | ubuntu-noble | +-w /usr/bin/pigz -p x -k Data_Compressed 2026-06-02 13:35:35.644057 | ubuntu-noble | +-w /usr/local/bin/pigz -p x -k Data_Compressed 2026-06-02 13:35:35.644068 | ubuntu-noble | +-w /usr/bin/unpigz -p x -k Data_Compressed 2026-06-02 13:35:35.644076 | ubuntu-noble | +-w /usr/local/bin/unpigz -p x -k Data_Compressed 2026-06-02 13:35:35.644086 | ubuntu-noble | + 2026-06-02 13:35:35.644095 | ubuntu-noble | +-w /usr/bin/zstd -p x -k Data_Compressed 2026-06-02 13:35:35.644104 | ubuntu-noble | +-w /usr/local/bin/zstd -p x -k Data_Compressed 2026-06-02 13:35:35.644113 | ubuntu-noble | + 2026-06-02 13:35:35.644122 | ubuntu-noble | +## Added to catch netcat on Ubuntu 2026-06-02 13:35:35.644131 | ubuntu-noble | +-w /bin/nc.openbsd -p x -k susp_activity 2026-06-02 13:35:35.644140 | ubuntu-noble | +-w /bin/nc.traditional -p x -k susp_activity 2026-06-02 13:35:35.644149 | ubuntu-noble | + 2026-06-02 13:35:35.644158 | ubuntu-noble | +## Sbin suspicious activity 2026-06-02 13:35:35.644168 | ubuntu-noble | +-w /sbin/iptables -p x -k sbin_susp 2026-06-02 13:35:35.644224 | ubuntu-noble | +-w /sbin/ip6tables -p x -k sbin_susp 2026-06-02 13:35:35.644233 | ubuntu-noble | +-w /sbin/ifconfig -p x -k sbin_susp 2026-06-02 13:35:35.644242 | ubuntu-noble | +-w /usr/sbin/arptables -p x -k sbin_susp 2026-06-02 13:35:35.644251 | ubuntu-noble | +-w /usr/sbin/ebtables -p x -k sbin_susp 2026-06-02 13:35:35.644266 | ubuntu-noble | +-w /sbin/xtables-nft-multi -p x -k sbin_susp 2026-06-02 13:35:35.644276 | ubuntu-noble | +-w /usr/sbin/nft -p x -k sbin_susp 2026-06-02 13:35:35.644284 | ubuntu-noble | +-w /usr/sbin/tcpdump -p x -k sbin_susp 2026-06-02 13:35:35.644373 | ubuntu-noble | +-w /usr/sbin/traceroute -p x -k sbin_susp 2026-06-02 13:35:35.644443 | ubuntu-noble | +-w /usr/sbin/ufw -p x -k sbin_susp 2026-06-02 13:35:35.644540 | ubuntu-noble | + 2026-06-02 13:35:35.644632 | ubuntu-noble | +### kde4 2026-06-02 13:35:35.644744 | ubuntu-noble | +-a always,exit -F path=/usr/libexec/kde4/kpac_dhcp_helper -F perm=x -F auid>=1000 -F auid!=4294967295 -k T1078_Valid_Accounts 2026-06-02 13:35:35.644847 | ubuntu-noble | +-a always,exit -F path=/usr/libexec/kde4/kdesud -F perm=x -F auid>=1000 -F auid!=4294967295 -k T1078_Valid_Accounts 2026-06-02 13:35:35.644980 | ubuntu-noble | + 2026-06-02 13:35:35.645082 | ubuntu-noble | +## dbus-send invocation 2026-06-02 13:35:35.645219 | ubuntu-noble | +### may indicate privilege escalation CVE-2021-3560 2026-06-02 13:35:35.645298 | ubuntu-noble | +-w /usr/bin/dbus-send -p x -k dbus_send 2026-06-02 13:35:35.645398 | ubuntu-noble | +-w /usr/bin/gdbus -p x -k gdubs_call 2026-06-02 13:35:35.645491 | ubuntu-noble | + 2026-06-02 13:35:35.645586 | ubuntu-noble | +## pkexec invocation 2026-06-02 13:35:35.645686 | ubuntu-noble | +### may indicate privilege escalation CVE-2021-4034 2026-06-02 13:35:35.645781 | ubuntu-noble | +-w /usr/bin/pkexec -p x -k pkexec 2026-06-02 13:35:35.645875 | ubuntu-noble | + 2026-06-02 13:35:35.645998 | ubuntu-noble | +## Suspicious shells 2026-06-02 13:35:35.646095 | ubuntu-noble | +-w /bin/ash -p x -k susp_shell 2026-06-02 13:35:35.646210 | ubuntu-noble | +-w /bin/csh -p x -k susp_shell 2026-06-02 13:35:35.646301 | ubuntu-noble | +-w /bin/fish -p x -k susp_shell 2026-06-02 13:35:35.646401 | ubuntu-noble | +-w /bin/tcsh -p x -k susp_shell 2026-06-02 13:35:35.646500 | ubuntu-noble | +-w /bin/tclsh -p x -k susp_shell 2026-06-02 13:35:35.646677 | ubuntu-noble | +-w /bin/xonsh -p x -k susp_shell 2026-06-02 13:35:35.646696 | ubuntu-noble | +-w /usr/local/bin/xonsh -p x -k susp_shell 2026-06-02 13:35:35.646785 | ubuntu-noble | +-w /bin/open -p x -k susp_shell 2026-06-02 13:35:35.646882 | ubuntu-noble | +-w /bin/rbash -p x -k susp_shell 2026-06-02 13:35:35.647016 | ubuntu-noble | + 2026-06-02 13:35:35.647092 | ubuntu-noble | +# Web Server Actvity 2026-06-02 13:35:35.647208 | ubuntu-noble | +## Change the number "33" to the ID of your WebServer user. Default: www-data:x:33:33 2026-06-02 13:35:35.647308 | ubuntu-noble | +-a always,exit -F arch=b64 -S execve -F euid=33 -k detect_execve_www 2026-06-02 13:35:35.647400 | ubuntu-noble | + 2026-06-02 13:35:35.647501 | ubuntu-noble | +### https://clustershell.readthedocs.io/ 2026-06-02 13:35:35.647604 | ubuntu-noble | +-w /bin/clush -p x -k susp_shell 2026-06-02 13:35:35.647707 | ubuntu-noble | +-w /usr/local/bin/clush -p x -k susp_shell 2026-06-02 13:35:35.647808 | ubuntu-noble | +-w /etc/clustershell/clush.conf -p x -k susp_shell 2026-06-02 13:35:35.647900 | ubuntu-noble | + 2026-06-02 13:35:35.648096 | ubuntu-noble | +### https://github.com/tmux/tmux 2026-06-02 13:35:35.648246 | ubuntu-noble | +-w /bin/tmux -p x -k susp_shell 2026-06-02 13:35:35.648339 | ubuntu-noble | +-w /usr/local/bin/tmux -p x -k susp_shell 2026-06-02 13:35:35.648435 | ubuntu-noble | + 2026-06-02 13:35:35.648537 | ubuntu-noble | +## Shell/profile configurations 2026-06-02 13:35:35.648640 | ubuntu-noble | +-w /etc/profile.d/ -p wa -k shell_profiles 2026-06-02 13:35:35.648740 | ubuntu-noble | +-w /etc/profile -p wa -k shell_profiles 2026-06-02 13:35:35.648885 | ubuntu-noble | +-w /etc/shells -p wa -k shell_profiles 2026-06-02 13:35:35.648951 | ubuntu-noble | +-w /etc/bashrc -p wa -k shell_profiles 2026-06-02 13:35:35.649053 | ubuntu-noble | +-w /etc/csh.cshrc -p wa -k shell_profiles 2026-06-02 13:35:35.649155 | ubuntu-noble | +-w /etc/csh.login -p wa -k shell_profiles 2026-06-02 13:35:35.649264 | ubuntu-noble | +-w /etc/fish/ -p wa -k shell_profiles 2026-06-02 13:35:35.649361 | ubuntu-noble | +-w /etc/zsh/ -p wa -k shell_profiles 2026-06-02 13:35:35.649457 | ubuntu-noble | + 2026-06-02 13:35:35.649981 | ubuntu-noble | +### https://github.com/xxh/xxh 2026-06-02 13:35:35.650000 | ubuntu-noble | +-w /usr/local/bin/xxh.bash -p x -k susp_shell 2026-06-02 13:35:35.650007 | ubuntu-noble | +-w /usr/local/bin/xxh.xsh -p x -k susp_shell 2026-06-02 13:35:35.650014 | ubuntu-noble | +-w /usr/local/bin/xxh.zsh -p x -k susp_shell 2026-06-02 13:35:35.650023 | ubuntu-noble | + 2026-06-02 13:35:35.650112 | ubuntu-noble | +## Injection 2026-06-02 13:35:35.650229 | ubuntu-noble | +### These rules watch for code injection by the ptrace facility. 2026-06-02 13:35:35.650332 | ubuntu-noble | +### This could indicate someone trying to do something bad or just debugging 2026-06-02 13:35:35.650435 | ubuntu-noble | +-a always,exit -F arch=b64 -S ptrace -F a0=0x4 -k code_injection 2026-06-02 13:35:35.650536 | ubuntu-noble | +-a always,exit -F arch=b64 -S ptrace -F a0=0x5 -k data_injection 2026-06-02 13:35:35.650640 | ubuntu-noble | +-a always,exit -F arch=b64 -S ptrace -F a0=0x6 -k register_injection 2026-06-02 13:35:35.650745 | ubuntu-noble | +-a always,exit -F arch=b64 -S ptrace -k tracing 2026-06-02 13:35:35.650839 | ubuntu-noble | + 2026-06-02 13:35:35.650959 | ubuntu-noble | +## Anonymous File Creation 2026-06-02 13:35:35.651069 | ubuntu-noble | +### These rules watch the use of memfd_create 2026-06-02 13:35:35.651160 | ubuntu-noble | +### "memfd_create" creates anonymous file and returns a file descriptor to access it 2026-06-02 13:35:35.651298 | ubuntu-noble | +### When combined with "fexecve" can be used to stealthily run binaries in memory without touching disk 2026-06-02 13:35:35.651397 | ubuntu-noble | +-a always,exit -F arch=b64 -S memfd_create -F key=anon_file_create 2026-06-02 13:35:35.651491 | ubuntu-noble | + 2026-06-02 13:35:35.651589 | ubuntu-noble | +## Privilege Abuse 2026-06-02 13:35:35.651693 | ubuntu-noble | +### The purpose of this rule is to detect when an admin may be abusing power by looking in user's home dir. 2026-06-02 13:35:35.651800 | ubuntu-noble | +-a always,exit -F dir=/home -F uid=0 -F auid>=1000 -F auid!=-1 -C auid!=obj_uid -k power_abuse 2026-06-02 13:35:35.651891 | ubuntu-noble | + 2026-06-02 13:35:35.652006 | ubuntu-noble | +# Socket Creations 2026-06-02 13:35:35.652167 | ubuntu-noble | +# will catch both IPv4 and IPv6 2026-06-02 13:35:35.652250 | ubuntu-noble | + 2026-06-02 13:35:35.652361 | ubuntu-noble | +-a always,exit -F arch=b32 -S socket -F a0=2 -k network_socket_created 2026-06-02 13:35:35.652460 | ubuntu-noble | +-a always,exit -F arch=b64 -S socket -F a0=2 -k network_socket_created 2026-06-02 13:35:35.652555 | ubuntu-noble | + 2026-06-02 13:35:35.652656 | ubuntu-noble | +-a always,exit -F arch=b32 -S socket -F a0=10 -k network_socket_created 2026-06-02 13:35:35.653253 | ubuntu-noble | +-a always,exit -F arch=b64 -S socket -F a0=10 -k network_socket_created 2026-06-02 13:35:35.653274 | ubuntu-noble | + 2026-06-02 13:35:35.653281 | ubuntu-noble | +# Software Management --------------------------------------------------------- 2026-06-02 13:35:35.653288 | ubuntu-noble | + 2026-06-02 13:35:35.653294 | ubuntu-noble | +# RPM (Redhat/CentOS) 2026-06-02 13:35:35.653301 | ubuntu-noble | +-w /usr/bin/rpm -p x -k software_mgmt 2026-06-02 13:35:35.653335 | ubuntu-noble | +-w /usr/bin/yum -p x -k software_mgmt 2026-06-02 13:35:35.653428 | ubuntu-noble | + 2026-06-02 13:35:35.653527 | ubuntu-noble | +# DNF (Fedora/RedHat 8/CentOS 8) 2026-06-02 13:35:35.653626 | ubuntu-noble | +-w /usr/bin/dnf -p x -k software_mgmt 2026-06-02 13:35:35.653718 | ubuntu-noble | + 2026-06-02 13:35:35.653815 | ubuntu-noble | +# YAST/Zypper/RPM (SuSE) 2026-06-02 13:35:35.653933 | ubuntu-noble | +-w /sbin/yast -p x -k software_mgmt 2026-06-02 13:35:35.654025 | ubuntu-noble | +-w /sbin/yast2 -p x -k software_mgmt 2026-06-02 13:35:35.654128 | ubuntu-noble | +-w /bin/rpm -p x -k software_mgmt 2026-06-02 13:35:35.654249 | ubuntu-noble | +-w /usr/bin/zypper -k software_mgmt 2026-06-02 13:35:35.654342 | ubuntu-noble | + 2026-06-02 13:35:35.654422 | ubuntu-noble | +# DPKG / APT-GET (Debian/Ubuntu) 2026-06-02 13:35:35.654523 | ubuntu-noble | +-w /usr/bin/dpkg -p x -k software_mgmt 2026-06-02 13:35:35.654625 | ubuntu-noble | +-w /usr/bin/apt -p x -k software_mgmt 2026-06-02 13:35:35.654727 | ubuntu-noble | +-w /usr/bin/apt-add-repository -p x -k software_mgmt 2026-06-02 13:35:35.654826 | ubuntu-noble | +-w /usr/bin/apt-get -p x -k software_mgmt 2026-06-02 13:35:35.654983 | ubuntu-noble | +-w /usr/bin/aptitude -p x -k software_mgmt 2026-06-02 13:35:35.655103 | ubuntu-noble | +-w /usr/bin/wajig -p x -k software_mgmt 2026-06-02 13:35:35.655246 | ubuntu-noble | +-w /usr/bin/snap -p x -k software_mgmt 2026-06-02 13:35:35.655343 | ubuntu-noble | + 2026-06-02 13:35:35.655450 | ubuntu-noble | +# PIP(3) (Python installs) 2026-06-02 13:35:35.655551 | ubuntu-noble | +-w /usr/bin/pip -p x -k third_party_software_mgmt 2026-06-02 13:35:35.655653 | ubuntu-noble | +-w /usr/local/bin/pip -p x -k third_party_software_mgmt 2026-06-02 13:35:35.655759 | ubuntu-noble | +-w /usr/bin/pip3 -p x -k third_party_software_mgmt 2026-06-02 13:35:35.655858 | ubuntu-noble | +-w /usr/local/bin/pip3 -p x -k third_party_software_mgmt 2026-06-02 13:35:35.655975 | ubuntu-noble | +-w /usr/bin/pipx -p x -k third_party_software_mgmt 2026-06-02 13:35:35.657954 | ubuntu-noble | +-w /usr/local/bin/pipx -p x -k third_party_software_mgmt 2026-06-02 13:35:35.657988 | ubuntu-noble | + 2026-06-02 13:35:35.657994 | ubuntu-noble | +# npm 2026-06-02 13:35:35.658000 | ubuntu-noble | +## T1072 third party software 2026-06-02 13:35:35.658006 | ubuntu-noble | +## https://www.npmjs.com 2026-06-02 13:35:35.658013 | ubuntu-noble | +## https://docs.npmjs.com/cli/v6/commands/npm-audit 2026-06-02 13:35:35.658021 | ubuntu-noble | +-w /usr/bin/npm -p x -k third_party_software_mgmt 2026-06-02 13:35:35.658029 | ubuntu-noble | + 2026-06-02 13:35:35.658038 | ubuntu-noble | +# Comprehensive Perl Archive Network (CPAN) (CPAN installs) 2026-06-02 13:35:35.658046 | ubuntu-noble | +## T1072 third party software 2026-06-02 13:35:35.658054 | ubuntu-noble | +## https://www.cpan.org 2026-06-02 13:35:35.658063 | ubuntu-noble | +-w /usr/bin/cpan -p x -k third_party_software_mgmt 2026-06-02 13:35:35.658072 | ubuntu-noble | + 2026-06-02 13:35:35.658081 | ubuntu-noble | +# Ruby (RubyGems installs) 2026-06-02 13:35:35.658087 | ubuntu-noble | +## T1072 third party software 2026-06-02 13:35:35.658092 | ubuntu-noble | +## https://rubygems.org 2026-06-02 13:35:35.658097 | ubuntu-noble | +-w /usr/bin/gem -p x -k third_party_software_mgmt 2026-06-02 13:35:35.658102 | ubuntu-noble | + 2026-06-02 13:35:35.658107 | ubuntu-noble | +# LuaRocks (Lua installs) 2026-06-02 13:35:35.658116 | ubuntu-noble | +## T1072 third party software 2026-06-02 13:35:35.658121 | ubuntu-noble | +## https://luarocks.org 2026-06-02 13:35:35.658223 | ubuntu-noble | +-w /usr/bin/luarocks -p x -k third_party_software_mgmt 2026-06-02 13:35:35.658356 | ubuntu-noble | + 2026-06-02 13:35:35.658413 | ubuntu-noble | +# Pacman (Arch Linux) 2026-06-02 13:35:35.658514 | ubuntu-noble | +## https://wiki.archlinux.org/title/Pacman 2026-06-02 13:35:35.658612 | ubuntu-noble | +## T1072 third party software 2026-06-02 13:35:35.658712 | ubuntu-noble | +-w /etc/pacman.conf -p x -k third_party_software_mgmt 2026-06-02 13:35:35.658814 | ubuntu-noble | +-w /etc/pacman.d -p x -k third_party_software_mgmt 2026-06-02 13:35:35.658907 | ubuntu-noble | + 2026-06-02 13:35:35.659021 | ubuntu-noble | +# Special Software ------------------------------------------------------------ 2026-06-02 13:35:35.659115 | ubuntu-noble | + 2026-06-02 13:35:35.659268 | ubuntu-noble | +## GDS specific secrets 2026-06-02 13:35:35.659342 | ubuntu-noble | +-w /etc/puppet/ssl -p wa -k puppet_ssl 2026-06-02 13:35:35.659436 | ubuntu-noble | + 2026-06-02 13:35:35.659536 | ubuntu-noble | +## IBM Bigfix BESClient 2026-06-02 13:35:35.659642 | ubuntu-noble | +-a always,exit -F arch=b64 -S open -F dir=/opt/BESClient -F success=0 -k soft_besclient 2026-06-02 13:35:35.659743 | ubuntu-noble | +-w /var/opt/BESClient/ -p wa -k soft_besclient 2026-06-02 13:35:35.659837 | ubuntu-noble | + 2026-06-02 13:35:35.659953 | ubuntu-noble | +## CHEF https://www.chef.io/chef/ 2026-06-02 13:35:35.660053 | ubuntu-noble | +-w /etc/chef -p wa -k soft_chef 2026-06-02 13:35:35.660145 | ubuntu-noble | + 2026-06-02 13:35:35.660253 | ubuntu-noble | +## Salt 2026-06-02 13:35:35.660361 | ubuntu-noble | +## https://saltproject.io/ 2026-06-02 13:35:35.660449 | ubuntu-noble | +## https://docs.saltproject.io/en/latest/ref/configuration/master.html 2026-06-02 13:35:35.660549 | ubuntu-noble | +-w /etc/salt -p wa -k soft_salt 2026-06-02 13:35:35.660644 | ubuntu-noble | +-w /usr/local/etc/salt -p wa -k soft_salt 2026-06-02 13:35:35.660735 | ubuntu-noble | + 2026-06-02 13:35:35.660832 | ubuntu-noble | +## Otter 2026-06-02 13:35:35.660945 | ubuntu-noble | +## https://inedo.com/otter 2026-06-02 13:35:35.661044 | ubuntu-noble | +-w /etc/otter -p wa -k soft_otter 2026-06-02 13:35:35.661134 | ubuntu-noble | + 2026-06-02 13:35:35.661243 | ubuntu-noble | +## T1081 Credentials In Files 2026-06-02 13:35:35.661344 | ubuntu-noble | +-w /usr/bin/grep -p x -k string_search 2026-06-02 13:35:35.661444 | ubuntu-noble | +-w /usr/bin/egrep -p x -k string_search 2026-06-02 13:35:35.661542 | ubuntu-noble | +-w /usr/bin/ugrep -p x -k string_search 2026-06-02 13:35:35.661640 | ubuntu-noble | +### macOS 2026-06-02 13:35:35.661741 | ubuntu-noble | +-w /usr/local/bin/grep -p x -k string_search 2026-06-02 13:35:35.661838 | ubuntu-noble | +-w /usr/local/bin/egrep -p x -k string_search 2026-06-02 13:35:35.661950 | ubuntu-noble | +-w /usr/local/bin/ugrep -p x -k string_search 2026-06-02 13:35:35.662045 | ubuntu-noble | + 2026-06-02 13:35:35.662155 | ubuntu-noble | +### https://github.com/tmbinc/bgrep 2026-06-02 13:35:35.662309 | ubuntu-noble | +-w /usr/bin/bgrep -p x -k string_search 2026-06-02 13:35:35.662406 | ubuntu-noble | +### macOS 2026-06-02 13:35:35.662518 | ubuntu-noble | +-w /usr/local/bin/bgrep -p x -k string_search 2026-06-02 13:35:35.662596 | ubuntu-noble | + 2026-06-02 13:35:35.662703 | ubuntu-noble | +### https://github.com/BurntSushi/ripgrep 2026-06-02 13:35:35.662803 | ubuntu-noble | +-w /usr/bin/rg -p x -k string_search 2026-06-02 13:35:35.662896 | ubuntu-noble | +### macOS 2026-06-02 13:35:35.663041 | ubuntu-noble | +-w /usr/local/bin/rg -p x -k string_search 2026-06-02 13:35:35.663134 | ubuntu-noble | + 2026-06-02 13:35:35.663368 | ubuntu-noble | +### https://github.com/awgn/cgrep 2026-06-02 13:35:35.663513 | ubuntu-noble | + 2026-06-02 13:35:35.663651 | ubuntu-noble | +-w /usr/bin/cgrep -p x -k string_search 2026-06-02 13:35:35.663718 | ubuntu-noble | +### macOS 2026-06-02 13:35:35.663820 | ubuntu-noble | +-w /usr/local/bin/cgrep -p x -k string_search 2026-06-02 13:35:35.663930 | ubuntu-noble | + 2026-06-02 13:35:35.664035 | ubuntu-noble | +### https://github.com/jpr5/ngrep 2026-06-02 13:35:35.664132 | ubuntu-noble | +-w /usr/bin/ngrep -p x -k string_search 2026-06-02 13:35:35.664242 | ubuntu-noble | +### macOS 2026-06-02 13:35:35.664339 | ubuntu-noble | +-w /usr/local/bin/ngrep -p x -k string_search 2026-06-02 13:35:35.664429 | ubuntu-noble | + 2026-06-02 13:35:35.664529 | ubuntu-noble | +### https://github.com/vrothberg/vgrep 2026-06-02 13:35:35.664629 | ubuntu-noble | +-w /usr/bin/vgrep -p x -k string_search 2026-06-02 13:35:35.664736 | ubuntu-noble | +### macOS 2026-06-02 13:35:35.664842 | ubuntu-noble | +-w /usr/local/bin/vgrep -p x -k string_search 2026-06-02 13:35:35.664949 | ubuntu-noble | + 2026-06-02 13:35:35.665055 | ubuntu-noble | +### https://github.com/monochromegane/the_platinum_searcher 2026-06-02 13:35:35.665156 | ubuntu-noble | +-w /usr/bin/pt -p x -k string_search 2026-06-02 13:35:35.665263 | ubuntu-noble | +### macOS 2026-06-02 13:35:35.665362 | ubuntu-noble | +-w /usr/local/bin/pt -p x -k string_search 2026-06-02 13:35:35.665488 | ubuntu-noble | + 2026-06-02 13:35:35.665605 | ubuntu-noble | +### https://github.com/gvansickle/ucg 2026-06-02 13:35:35.665707 | ubuntu-noble | +-w /usr/bin/ucg -p x -k string_search 2026-06-02 13:35:35.665806 | ubuntu-noble | +### macOS 2026-06-02 13:35:35.665952 | ubuntu-noble | +-w /usr/local/bin/ucg -p x -k string_search 2026-06-02 13:35:35.666047 | ubuntu-noble | + 2026-06-02 13:35:35.666154 | ubuntu-noble | +### https://github.com/ggreer/the_silver_searcher 2026-06-02 13:35:35.666287 | ubuntu-noble | +-w /usr/bin/ag -p x -k string_search 2026-06-02 13:35:35.666383 | ubuntu-noble | +### macOS 2026-06-02 13:35:35.666484 | ubuntu-noble | +-w /usr/local/bin/ag -p x -k string_search 2026-06-02 13:35:35.666619 | ubuntu-noble | + 2026-06-02 13:35:35.666731 | ubuntu-noble | +### https://github.com/beyondgrep/ack3 2026-06-02 13:35:35.666829 | ubuntu-noble | +### https://beyondgrep.com 2026-06-02 13:35:35.666946 | ubuntu-noble | +-w /usr/bin/ack -p x -k string_search 2026-06-02 13:35:35.667052 | ubuntu-noble | +-w /usr/local/bin/ack -p x -k string_search 2026-06-02 13:35:35.667152 | ubuntu-noble | +-w /usr/bin/semgrep -p x -k string_search 2026-06-02 13:35:35.667266 | ubuntu-noble | +### macOS 2026-06-02 13:35:35.667366 | ubuntu-noble | +-w /usr/local/bin/semgrep -p x -k string_search 2026-06-02 13:35:35.667461 | ubuntu-noble | + 2026-06-02 13:35:35.667558 | ubuntu-noble | +## Docker 2026-06-02 13:35:35.667655 | ubuntu-noble | +-w /usr/bin/dockerd -k docker 2026-06-02 13:35:35.667751 | ubuntu-noble | +-w /usr/bin/docker -k docker 2026-06-02 13:35:35.667852 | ubuntu-noble | +-w /usr/bin/docker-containerd -k docker 2026-06-02 13:35:35.667963 | ubuntu-noble | +-w /usr/bin/docker-runc -k docker 2026-06-02 13:35:35.668063 | ubuntu-noble | +-w /var/lib/docker -p wa -k docker 2026-06-02 13:35:35.668158 | ubuntu-noble | +-w /etc/docker -k docker 2026-06-02 13:35:35.668267 | ubuntu-noble | +-w /etc/sysconfig/docker -k docker 2026-06-02 13:35:35.668367 | ubuntu-noble | +-w /etc/sysconfig/docker-storage -k docker 2026-06-02 13:35:35.668467 | ubuntu-noble | +-w /usr/lib/systemd/system/docker.service -k docker 2026-06-02 13:35:35.668571 | ubuntu-noble | +-w /usr/lib/systemd/system/docker.socket -k docker 2026-06-02 13:35:35.668663 | ubuntu-noble | + 2026-06-02 13:35:35.668760 | ubuntu-noble | +## Virtualization stuff 2026-06-02 13:35:35.668860 | ubuntu-noble | +-w /usr/bin/qemu-system-x86_64 -p x -k qemu-system-x86_64 2026-06-02 13:35:35.668977 | ubuntu-noble | +-w /usr/bin/qemu-img -p x -k qemu-img 2026-06-02 13:35:35.669074 | ubuntu-noble | +-w /usr/bin/qemu-kvm -p x -k qemu-kvm 2026-06-02 13:35:35.669195 | ubuntu-noble | +-w /usr/bin/qemu -p x -k qemu 2026-06-02 13:35:35.669281 | ubuntu-noble | +-w /usr/bin/virtualbox -p x -k virtualbox 2026-06-02 13:35:35.669384 | ubuntu-noble | +-w /usr/bin/virt-manager -p x -k virt-manager 2026-06-02 13:35:35.669483 | ubuntu-noble | +-w /usr/bin/VBoxManage -p x -k VBoxManage 2026-06-02 13:35:35.669576 | ubuntu-noble | + 2026-06-02 13:35:35.669675 | ubuntu-noble | +#### VirtualBox on macOS 2026-06-02 13:35:35.669767 | ubuntu-noble | + 2026-06-02 13:35:35.669891 | ubuntu-noble | +-w /usr/local/bin/VirtualBox -p x -k virt_tool 2026-06-02 13:35:35.670009 | ubuntu-noble | +-w /usr/local/bin/VirtualBoxVM -p x -k virt_tool 2026-06-02 13:35:35.670112 | ubuntu-noble | +-w /usr/local/bin/VBoxManage -p x -k virt_tool 2026-06-02 13:35:35.670284 | ubuntu-noble | +-w /usr/local/bin/VBoxVRDP -p x -k virt_tool 2026-06-02 13:35:35.670342 | ubuntu-noble | +-w /usr/local/bin/VBoxHeadless -p x -k virt_tool 2026-06-02 13:35:35.670443 | ubuntu-noble | +-w /usr/local/bin/vboxwebsrv -p x -k virt_tool 2026-06-02 13:35:35.670553 | ubuntu-noble | +-w /usr/local/bin/VBoxBugReport -p x -k virt_tool 2026-06-02 13:35:35.670653 | ubuntu-noble | +-w /usr/local/bin/VBoxBalloonCtrl -p x -k virt_tool 2026-06-02 13:35:35.670752 | ubuntu-noble | +-w /usr/local/bin/VBoxAutostart -p x -k virt_tool 2026-06-02 13:35:35.670853 | ubuntu-noble | +-w /usr/local/bin/VBoxDTrace -p x -k virt_tool 2026-06-02 13:35:35.670963 | ubuntu-noble | +-w /usr/local/bin/vbox-img -p x -k virt_tool 2026-06-02 13:35:35.671066 | ubuntu-noble | +-w /Library/LaunchDaemons/org.virtualbox.startup.plist -p x -k virt_tool 2026-06-02 13:35:35.671195 | ubuntu-noble | +-w /Library/Application Support/VirtualBox/LaunchDaemons/ -p x -k virt_tool 2026-06-02 13:35:35.671285 | ubuntu-noble | +-w /Library/Application Support/VirtualBox/VBoxDrv.kext/ -p x -k virt_tool 2026-06-02 13:35:35.671423 | ubuntu-noble | +-w /Library/Application Support/VirtualBox/VBoxUSB.kext/ -p x -k virt_tool 2026-06-02 13:35:35.671488 | ubuntu-noble | +-w /Library/Application Support/VirtualBox/VBoxNetFlt.kext/ -p x -k virt_tool 2026-06-02 13:35:35.672490 | ubuntu-noble | +-w /Library/Application Support/VirtualBox/VBoxNetAdp.kext/ -p x -k virt_tool 2026-06-02 13:35:35.672513 | ubuntu-noble | + 2026-06-02 13:35:35.672518 | ubuntu-noble | +### Parallels Desktop on macOS 2026-06-02 13:35:35.672521 | ubuntu-noble | + 2026-06-02 13:35:35.672525 | ubuntu-noble | +-w /usr/local/bin/prl_convert -p x -k virt_tool 2026-06-02 13:35:35.672529 | ubuntu-noble | +-w /usr/local/bin/prl_disk_tool -p x -k virt_tool 2026-06-02 13:35:35.672532 | ubuntu-noble | +-w /usr/local/bin/prl_perf_ctl -p x -k virt_tool 2026-06-02 13:35:35.672536 | ubuntu-noble | +-w /usr/local/bin/prlcore2dmp -p x -k virt_tool 2026-06-02 13:35:35.672539 | ubuntu-noble | +-w /usr/local/bin/prlctl -p x -k virt_tool 2026-06-02 13:35:35.672547 | ubuntu-noble | +-w /usr/local/bin/prlexec -p x -k virt_tool 2026-06-02 13:35:35.672636 | ubuntu-noble | +-w /usr/local/bin/prlsrvctl -p x -k virt_tool 2026-06-02 13:35:35.672739 | ubuntu-noble | +-w /Library/Preferences/Parallels -p x -k virt_tool 2026-06-02 13:35:35.672832 | ubuntu-noble | + 2026-06-02 13:35:35.672944 | ubuntu-noble | +### qemu on macOS 2026-06-02 13:35:35.673037 | ubuntu-noble | + 2026-06-02 13:35:35.673140 | ubuntu-noble | +-w /usr/local/bin/qemu-edid -p x -k virt_tool 2026-06-02 13:35:35.673255 | ubuntu-noble | +-w /usr/local/bin/qemu-img -p x -k virt_tool 2026-06-02 13:35:35.673356 | ubuntu-noble | +-w /usr/local/bin/qemu-io -p x -k virt_tool 2026-06-02 13:35:35.673454 | ubuntu-noble | +-w /usr/local/bin/qemu-nbd -p x -k virt_tool 2026-06-02 13:35:35.673558 | ubuntu-noble | +-w /usr/local/bin/qemu-system-x86_64 -p x -k virt_tool 2026-06-02 13:35:35.673664 | ubuntu-noble | + 2026-06-02 13:35:35.673749 | ubuntu-noble | +## Kubelet 2026-06-02 13:35:35.673846 | ubuntu-noble | +-w /usr/bin/kubelet -k kubelet 2026-06-02 13:35:35.673953 | ubuntu-noble | + 2026-06-02 13:35:35.674050 | ubuntu-noble | +# ipc system call 2026-06-02 13:35:35.674150 | ubuntu-noble | +# /usr/include/linux/ipc.h 2026-06-02 13:35:35.674271 | ubuntu-noble | + 2026-06-02 13:35:35.674368 | ubuntu-noble | +## msgctl 2026-06-02 13:35:35.674472 | ubuntu-noble | +#-a always,exit -S ipc -F a0=14 -k Inter-Process_Communication 2026-06-02 13:35:35.674567 | ubuntu-noble | +## msgget 2026-06-02 13:35:35.674681 | ubuntu-noble | +#-a always,exit -S ipc -F a0=13 -k Inter-Process_Communication 2026-06-02 13:35:35.674786 | ubuntu-noble | +## Use these lines on x86_64, ia64 instead 2026-06-02 13:35:35.674886 | ubuntu-noble | +-a always,exit -F arch=b64 -S msgctl -k Inter-Process_Communication 2026-06-02 13:35:35.675002 | ubuntu-noble | +-a always,exit -F arch=b64 -S msgget -k Inter-Process_Communication 2026-06-02 13:35:35.675093 | ubuntu-noble | + 2026-06-02 13:35:35.675203 | ubuntu-noble | +## semctl 2026-06-02 13:35:35.675306 | ubuntu-noble | +#-a always,exit -S ipc -F a0=3 -k Inter-Process_Communication 2026-06-02 13:35:35.675402 | ubuntu-noble | +## semget 2026-06-02 13:35:35.675506 | ubuntu-noble | +#-a always,exit -S ipc -F a0=2 -k Inter-Process_Communication 2026-06-02 13:35:35.675604 | ubuntu-noble | +## semop 2026-06-02 13:35:35.675715 | ubuntu-noble | +#-a always,exit -S ipc -F a0=1 -k Inter-Process_Communication 2026-06-02 13:35:35.675805 | ubuntu-noble | +## semtimedop 2026-06-02 13:35:35.675906 | ubuntu-noble | +#-a always,exit -S ipc -F a0=4 -k Inter-Process_Communication 2026-06-02 13:35:35.676047 | ubuntu-noble | +## Use these lines on x86_64, ia64 instead 2026-06-02 13:35:35.676150 | ubuntu-noble | +-a always,exit -F arch=b64 -S semctl -k Inter-Process_Communication 2026-06-02 13:35:35.676266 | ubuntu-noble | +-a always,exit -F arch=b64 -S semget -k Inter-Process_Communication 2026-06-02 13:35:35.676366 | ubuntu-noble | +-a always,exit -F arch=b64 -S semop -k Inter-Process_Communication 2026-06-02 13:35:35.676470 | ubuntu-noble | +-a always,exit -F arch=b64 -S semtimedop -k Inter-Process_Communication 2026-06-02 13:35:35.676565 | ubuntu-noble | + 2026-06-02 13:35:35.676661 | ubuntu-noble | +## shmctl 2026-06-02 13:35:35.676764 | ubuntu-noble | +#-a always,exit -S ipc -F a0=24 -k Inter-Process_Communication 2026-06-02 13:35:35.676860 | ubuntu-noble | +## shmget 2026-06-02 13:35:35.676982 | ubuntu-noble | +#-a always,exit -S ipc -F a0=23 -k Inter-Process_Communication 2026-06-02 13:35:35.677080 | ubuntu-noble | +## Use these lines on x86_64, ia64 instead 2026-06-02 13:35:35.677226 | ubuntu-noble | +-a always,exit -F arch=b64 -S shmctl -k Inter-Process_Communication 2026-06-02 13:35:35.677309 | ubuntu-noble | +-a always,exit -F arch=b64 -S shmget -k Inter-Process_Communication 2026-06-02 13:35:35.677404 | ubuntu-noble | + 2026-06-02 13:35:35.677502 | ubuntu-noble | +# High Volume Events ---------------------------------------------------------- 2026-06-02 13:35:35.677594 | ubuntu-noble | + 2026-06-02 13:35:35.677695 | ubuntu-noble | +## Disable these rules if they create too many events in your environment 2026-06-02 13:35:35.677786 | ubuntu-noble | + 2026-06-02 13:35:35.677884 | ubuntu-noble | +## Common Shells 2026-06-02 13:35:35.678021 | ubuntu-noble | +-w /bin/bash -p x -k susp_shell 2026-06-02 13:35:35.678122 | ubuntu-noble | +-w /bin/dash -p x -k susp_shell 2026-06-02 13:35:35.678235 | ubuntu-noble | +-w /bin/busybox -p x -k susp_shell 2026-06-02 13:35:35.678340 | ubuntu-noble | +-w /bin/zsh -p x -k susp_shell 2026-06-02 13:35:35.678441 | ubuntu-noble | +-w /bin/sh -p x -k susp_shell 2026-06-02 13:35:35.678543 | ubuntu-noble | +-w /bin/ksh -p x -k susp_shell 2026-06-02 13:35:35.679941 | ubuntu-noble | + 2026-06-02 13:35:35.679965 | ubuntu-noble | +## Root command executions 2026-06-02 13:35:35.679969 | ubuntu-noble | +-a always,exit -F arch=b64 -F euid=0 -F auid>=1000 -F auid!=-1 -S execve -k rootcmd 2026-06-02 13:35:35.679973 | ubuntu-noble | + 2026-06-02 13:35:35.679977 | ubuntu-noble | +## File Deletion Events by User 2026-06-02 13:35:35.679981 | ubuntu-noble | +-a always,exit -F arch=b64 -S rmdir -S unlink -S unlinkat -S rename -S renameat -F auid>=1000 -F auid!=-1 -k delete 2026-06-02 13:35:35.679985 | ubuntu-noble | + 2026-06-02 13:35:35.679988 | ubuntu-noble | +## File Access 2026-06-02 13:35:35.679992 | ubuntu-noble | +### Unauthorized Access (unsuccessful) 2026-06-02 13:35:35.679996 | ubuntu-noble | +-a always,exit -F arch=b64 -S creat -S open -S openat -S open_by_handle_at -S truncate -S ftruncate -F exit=-EACCES -F auid>=1000 -F auid!=-1 -k file_access 2026-06-02 13:35:35.680001 | ubuntu-noble | +-a always,exit -F arch=b64 -S creat -S open -S openat -S open_by_handle_at -S truncate -S ftruncate -F exit=-EPERM -F auid>=1000 -F auid!=-1 -k file_access 2026-06-02 13:35:35.680004 | ubuntu-noble | + 2026-06-02 13:35:35.680008 | ubuntu-noble | +### Unsuccessful Creation 2026-06-02 13:35:35.680011 | ubuntu-noble | +-a always,exit -F arch=b64 -S mkdir,creat,link,symlink,mknod,mknodat,linkat,symlinkat -F exit=-EACCES -k file_creation 2026-06-02 13:35:35.680018 | ubuntu-noble | +-a always,exit -F arch=b64 -S mkdir,link,symlink,mkdirat -F exit=-EPERM -k file_creation 2026-06-02 13:35:35.680102 | ubuntu-noble | + 2026-06-02 13:35:35.680211 | ubuntu-noble | +### Unsuccessful Modification 2026-06-02 13:35:35.680316 | ubuntu-noble | +-a always,exit -F arch=b64 -S rename -S renameat -S truncate -S chmod -S setxattr -S lsetxattr -S removexattr -S lremovexattr -F exit=-EACCES -k file_modification 2026-06-02 13:35:35.680418 | ubuntu-noble | +-a always,exit -F arch=b64 -S rename -S renameat -S truncate -S chmod -S setxattr -S lsetxattr -S removexattr -S lremovexattr -F exit=-EPERM -k file_modification 2026-06-02 13:35:35.680509 | ubuntu-noble | + 2026-06-02 13:35:35.680613 | ubuntu-noble | +## 32bit API Exploitation 2026-06-02 13:35:35.680715 | ubuntu-noble | +### If you are on a 64 bit platform, everything _should_ be running 2026-06-02 13:35:35.680815 | ubuntu-noble | +### in 64 bit mode. This rule will detect any use of the 32 bit syscalls 2026-06-02 13:35:35.680932 | ubuntu-noble | +### because this might be a sign of someone exploiting a hole in the 32 2026-06-02 13:35:35.681028 | ubuntu-noble | +### bit API. 2026-06-02 13:35:35.681139 | ubuntu-noble | +-a always,exit -F arch=b32 -S all -k 32bit_api 2026-06-02 13:35:35.681264 | ubuntu-noble | + 2026-06-02 13:35:35.681366 | ubuntu-noble | +# Make The Configuration Immutable -------------------------------------------- 2026-06-02 13:35:35.681462 | ubuntu-noble | + 2026-06-02 13:35:35.681561 | ubuntu-noble | +##-e 2 2026-06-02 13:35:35.681653 | ubuntu-noble | 2026-06-02 13:35:35.681885 | ubuntu-noble | changed: [molecule-auditd] => (item=20-neo23x0.rules) => {"ansible_loop_var": "item", "changed": true, "checksum": "9f99ce5c4f891fbf3e2bce06ed4cb97fb9e01f41", "dest": "/etc/audit/rules.d/20-neo23x0.rules", "gid": 0, "group": "root", "item": "20-neo23x0.rules", "md5sum": "6ac57206fd77de34805c3f4d50ef8b1d", "mode": "0644", "owner": "root", "size": 27367, "src": "/home/zuul/.ansible/tmp/ansible-tmp-1780407334.664886-2399-229703867114506/.source.rules", "state": "file", "uid": 0} 2026-06-02 13:35:35.681993 | ubuntu-noble | 2026-06-02 13:35:35.682094 | ubuntu-noble | TASK [auditd : Manage auditd service] ****************************************** 2026-06-02 13:35:36.529854 | ubuntu-noble | ok: [molecule-auditd] => {"changed": false, "enabled": true, "name": "auditd", "state": "started", "status": {"ActiveEnterTimestamp": "Tue 2026-06-02 13:35:28 UTC", "ActiveEnterTimestampMonotonic": "150947494", "ActiveExitTimestampMonotonic": "0", "ActiveState": "active", "After": "system.slice systemd-journald.socket systemd-tmpfiles-setup.service local-fs.target", "AllowIsolate": "no", "AssertResult": "yes", "AssertTimestamp": "Tue 2026-06-02 13:35:28 UTC", "AssertTimestampMonotonic": "150873554", "Before": "systemd-update-utmp.service ssh.service sysinit.target shutdown.target", "BlockIOAccounting": "no", "BlockIOWeight": "[not set]", "CPUAccounting": "yes", "CPUAffinityFromNUMA": "no", "CPUQuotaPerSecUSec": "infinity", "CPUQuotaPeriodUSec": "infinity", "CPUSchedulingPolicy": "0", "CPUSchedulingPriority": "0", "CPUSchedulingResetOnFork": "no", "CPUShares": "[not set]", "CPUUsageNSec": "56804000", "CPUWeight": "[not set]", "CacheDirectoryMode": "0755", "CanFreeze": "yes", "CanIsolate": "no", "CanReload": "no", "CanStart": "yes", "CanStop": "yes", "CapabilityBoundingSet": "cap_chown cap_dac_override cap_dac_read_search cap_fowner cap_fsetid cap_kill cap_setgid cap_setuid cap_setpcap cap_linux_immutable cap_net_bind_service cap_net_broadcast cap_net_admin cap_net_raw cap_ipc_lock cap_ipc_owner cap_sys_rawio cap_sys_chroot cap_sys_ptrace cap_sys_pacct cap_sys_admin cap_sys_boot cap_sys_nice cap_sys_resource cap_sys_time cap_sys_tty_config cap_mknod cap_lease cap_audit_write cap_audit_control cap_setfcap cap_mac_override cap_mac_admin cap_syslog cap_wake_alarm cap_block_suspend cap_audit_read cap_perfmon cap_bpf cap_checkpoint_restore", "CleanResult": "success", "CollectMode": "inactive", "ConditionResult": "yes", "ConditionTimestamp": "Tue 2026-06-02 13:35:28 UTC", "ConditionTimestampMonotonic": "150873504", "ConfigurationDirectoryMode": "0755", "Conflicts": "shutdown.target", "ControlGroup": "/system.slice/auditd.service", "ControlGroupId": "3826", "ControlPID": "0", "CoredumpFilter": "0x33", "CoredumpReceive": "no", "DefaultDependencies": "no", "DefaultMemoryLow": "0", "DefaultMemoryMin": "0", "DefaultStartupMemoryLow": "0", "Delegate": "no", "Description": "Security Auditing Service", "DevicePolicy": "auto", "Documentation": "\"man:auditd(8)\" https://github.com/linux-audit/audit-documentation", "DynamicUser": "no", "ExecMainCode": "0", "ExecMainExitTimestampMonotonic": "0", "ExecMainPID": "2168", "ExecMainStartTimestamp": "Tue 2026-06-02 13:35:28 UTC", "ExecMainStartTimestampMonotonic": "150904413", "ExecMainStatus": "0", "ExecStart": "{ path=/sbin/auditd ; argv[]=/sbin/auditd ; ignore_errors=no ; start_time=[Tue 2026-06-02 13:35:28 UTC] ; stop_time=[Tue 2026-06-02 13:35:28 UTC] ; pid=2167 ; code=exited ; status=0 }", "ExecStartEx": "{ path=/sbin/auditd ; argv[]=/sbin/auditd ; flags= ; start_time=[Tue 2026-06-02 13:35:28 UTC] ; stop_time=[Tue 2026-06-02 13:35:28 UTC] ; pid=2167 ; code=exited ; status=0 }", "ExecStartPost": "{ path=/sbin/augenrules ; argv[]=/sbin/augenrules --load ; ignore_errors=yes ; start_time=[Tue 2026-06-02 13:35:28 UTC] ; stop_time=[Tue 2026-06-02 13:35:28 UTC] ; pid=2171 ; code=exited ; status=0 }", "ExecStartPostEx": "{ path=/sbin/augenrules ; argv[]=/sbin/augenrules --load ; flags=ignore-failure ; start_time=[Tue 2026-06-02 13:35:28 UTC] ; stop_time=[Tue 2026-06-02 13:35:28 UTC] ; pid=2171 ; code=exited ; status=0 }", "ExitType": "main", "ExtensionImagePolicy": "root=verity+signed+encrypted+unprotected+absent:usr=verity+signed+encrypted+unprotected+absent:home=encrypted+unprotected+absent:srv=encrypted+unprotected+absent:tmp=encrypted+unprotected+absent:var=encrypted+unprotected+absent", "FailureAction": "none", "FileDescriptorStoreMax": "0", "FileDescriptorStorePreserve": "restart", "FinalKillSignal": "9", "FragmentPath": "/usr/lib/systemd/system/auditd.service", "FreezerState": "running", "GID": "[not set]", "GuessMainPID": "yes", "IOAccounting": "no", "IOReadBytes": "[not set]", "IOReadOperations": "[not set]", "IOSchedulingClass": "2", "IOSchedulingPriority": "4", "IOWeight": "[not set]", "IOWriteBytes": "[not set]", "IOWriteOperations": "[not set]", "IPAccounting": "no", "IPEgressBytes": "[no data]", "IPEgressPackets": "[no data]", "IPIngressBytes": "[no data]", "IPIngressPackets": "[no data]", "Id": "auditd.service", "IgnoreOnIsolate": "no", "IgnoreSIGPIPE": "yes", "InactiveEnterTimestampMonotonic": "0", "InactiveExitTimestamp": "Tue 2026-06-02 13:35:28 UTC", "InactiveExitTimestampMonotonic": "150879365", "InvocationID": "cb62f935a2fa4278a403f9101673113b", "JobRunningTimeoutUSec": "infinity", "JobTimeoutAction": "none", "JobTimeoutUSec": "infinity", "KeyringMode": "private", "KillMode": "control-group", "KillSignal": "15", "LimitAS": "infinity", "LimitASSoft": "infinity", "LimitCORE": "infinity", "LimitCORESoft": "0", "LimitCPU": "infinity", "LimitCPUSoft": "infinity", "LimitDATA": "infinity", "LimitDATASoft": "infinity", "LimitFSIZE": "infinity", "LimitFSIZESoft": "infinity", "LimitLOCKS": "infinity", "LimitLOCKSSoft": "infinity", "LimitMEMLOCK": "8388608", "LimitMEMLOCKSoft": "8388608", "LimitMSGQUEUE": "819200", "LimitMSGQUEUESoft": "819200", "LimitNICE": "0", "LimitNICESoft": "0", "LimitNOFILE": "524288", "LimitNOFILESoft": "1024", "LimitNPROC": "15372", "LimitNPROCSoft": "15372", "LimitRSS": "infinity", "LimitRSSSoft": "infinity", "LimitRTPRIO": "0", "LimitRTPRIOSoft": "0", "LimitRTTIME": "infinity", "LimitRTTIMESoft": "infinity", "LimitSIGPENDING": "15372", "LimitSIGPENDINGSoft": "15372", "LimitSTACK": "infinity", "LimitSTACKSoft": "8388608", "LoadState": "loaded", "LockPersonality": "yes", "LogLevelMax": "-1", "LogRateLimitBurst": "0", "LogRateLimitIntervalUSec": "0", "LogsDirectoryMode": "0755", "MainPID": "2168", "ManagedOOMMemoryPressure": "auto", "ManagedOOMMemoryPressureLimit": "0", "ManagedOOMPreference": "none", "ManagedOOMSwap": "auto", "MemoryAccounting": "yes", "MemoryAvailable": "3521761280", "MemoryCurrent": "499712", "MemoryDenyWriteExecute": "yes", "MemoryHigh": "infinity", "MemoryKSM": "no", "MemoryLimit": "infinity", "MemoryLow": "0", "MemoryMax": "infinity", "MemoryMin": "0", "MemoryPeak": "2101248", "MemoryPressureThresholdUSec": "200ms", "MemoryPressureWatch": "auto", "MemorySwapCurrent": "0", "MemorySwapMax": "infinity", "MemorySwapPeak": "0", "MemoryZSwapCurrent": "0", "MemoryZSwapMax": "infinity", "MountAPIVFS": "no", "MountImagePolicy": "root=verity+signed+encrypted+unprotected+absent:usr=verity+signed+encrypted+unprotected+absent:home=encrypted+unprotected+absent:srv=encrypted+unprotected+absent:tmp=encrypted+unprotected+absent:var=encrypted+unprotected+absent", "NFileDescriptorStore": "0", "NRestarts": "0", "NUMAPolicy": "n/a", "Names": "auditd.service", "NeedDaemonReload": "no", "Nice": "0", "NoNewPrivileges": "no", "NonBlocking": "no", "NotifyAccess": "none", "OOMPolicy": "stop", "OOMScoreAdjust": "0", "OnFailureJobMode": "replace", "OnSuccessJobMode": "fail", "PIDFile": "/run/auditd.pid", "Perpetual": "no", "PrivateDevices": "no", "PrivateIPC": "no", "PrivateMounts": "no", "PrivateNetwork": "no", "PrivateTmp": "no", "PrivateUsers": "no", "ProcSubset": "all", "ProtectClock": "no", "ProtectControlGroups": "no", "ProtectHome": "no", "ProtectHostname": "no", "ProtectKernelLogs": "no", "ProtectKernelModules": "yes", "ProtectKernelTunables": "no", "ProtectProc": "default", "ProtectSystem": "no", "RefuseManualStart": "no", "RefuseManualStop": "no", "ReloadResult": "success", "ReloadSignal": "1", "RemainAfterExit": "no", "RemoveIPC": "no", "Requires": "system.slice", "Restart": "on-failure", "RestartKillSignal": "15", "RestartMaxDelayUSec": "infinity", "RestartMode": "normal", "RestartPreventExitStatus": "2 4 6", "RestartSteps": "0", "RestartUSec": "100ms", "RestartUSecNext": "100ms", "RestrictNamespaces": "no", "RestrictRealtime": "yes", "RestrictSUIDSGID": "no", "Result": "success", "RootDirectoryStartOnly": "no", "RootEphemeral": "no", "RootImagePolicy": "root=verity+signed+encrypted+unprotected+absent:usr=verity+signed+encrypted+unprotected+absent:home=encrypted+unprotected+absent:srv=encrypted+unprotected+absent:tmp=encrypted+unprotected+absent:var=encrypted+unprotected+absent", "RuntimeDirectoryMode": "0755", "RuntimeDirectoryPreserve": "no", "RuntimeMaxUSec": "infinity", "RuntimeRandomizedExtraUSec": "0", "SameProcessGroup": "no", "SecureBits": "0", "SendSIGHUP": "no", "SendSIGKILL": "yes", "SetLoginEnvironment": "no", "Slice": "system.slice", "StandardError": "inherit", "StandardInput": "null", "StandardOutput": "journal", "StartLimitAction": "none", "StartLimitBurst": "5", "StartLimitIntervalUSec": "10s", "StartupBlockIOWeight": "[not set]", "StartupCPUShares": "[not set]", "StartupCPUWeight": "[not set]", "StartupIOWeight": "[not set]", "StartupMemoryHigh": "infinity", "StartupMemoryLow": "0", "StartupMemoryMax": "infinity", "StartupMemorySwapMax": "infinity", "StartupMemoryZSwapMax": "infinity", "StateChangeTimestamp": "Tue 2026-06-02 13:35:28 UTC", "StateChangeTimestampMonotonic": "150947494", "StateDirectoryMode": "0755", "StatusErrno": "0", "StopWhenUnneeded": "no", "SubState": "running", "SuccessAction": "none", "SurviveFinalKillSignal": "no", "SyslogFacility": "3", "SyslogLevel": "6", "SyslogLevelPrefix": "yes", "SyslogPriority": "30", "SystemCallErrorNumber": "2147483646", "TTYReset": "no", "TTYVHangup": "no", "TTYVTDisallocate": "no", "TasksAccounting": "yes", "TasksCurrent": "2", "TasksMax": "4611", "TimeoutAbortUSec": "1min 30s", "TimeoutCleanUSec": "infinity", "TimeoutStartFailureMode": "terminate", "TimeoutStartUSec": "1min 30s", "TimeoutStopFailureMode": "terminate", "TimeoutStopUSec": "1min 30s", "TimerSlackNSec": "50000", "Transient": "no", "Type": "forking", "UID": "[not set]", "UMask": "0022", "UnitFilePreset": "enabled", "UnitFileState": "enabled", "UtmpMode": "init", "WantedBy": "multi-user.target", "WatchdogSignal": "6", "WatchdogTimestampMonotonic": "0", "WatchdogUSec": "0"}} 2026-06-02 13:35:36.538828 | ubuntu-noble | 2026-06-02 13:35:36.539348 | ubuntu-noble | TASK [auditd : List existing rules files] ************************************** 2026-06-02 13:35:37.015973 | ubuntu-noble | ok: [molecule-auditd] => {"changed": false, "cmd": ["find", "/etc/audit/rules.d", "-type", "f", "-printf", "%f\n"], "delta": "0:00:00.008979", "end": "2026-06-02 13:35:36.953627", "msg": "", "rc": 0, "start": "2026-06-02 13:35:36.944648", "stderr": "", "stderr_lines": [], "stdout": "audit.rules\n20-neo23x0.rules", "stdout_lines": ["audit.rules", "20-neo23x0.rules"]} 2026-06-02 13:35:37.016216 | ubuntu-noble | 2026-06-02 13:35:37.016422 | ubuntu-noble | TASK [auditd : Remove unmanaged rules files] *********************************** 2026-06-02 13:35:37.409351 | ubuntu-noble | --- before 2026-06-02 13:35:37.411418 | ubuntu-noble | +++ after 2026-06-02 13:35:37.411445 | ubuntu-noble | @@ -1,4 +1,4 @@ 2026-06-02 13:35:37.411450 | ubuntu-noble | { 2026-06-02 13:35:37.411454 | ubuntu-noble | "path": "/etc/audit/rules.d/audit.rules", 2026-06-02 13:35:37.411459 | ubuntu-noble | - "state": "file" 2026-06-02 13:35:37.411463 | ubuntu-noble | + "state": "absent" 2026-06-02 13:35:37.411467 | ubuntu-noble | } 2026-06-02 13:35:37.411471 | ubuntu-noble | 2026-06-02 13:35:37.411476 | ubuntu-noble | changed: [molecule-auditd] => (item=audit.rules) => {"ansible_loop_var": "item", "changed": true, "item": "audit.rules", "path": "/etc/audit/rules.d/audit.rules", "state": "absent"} 2026-06-02 13:35:37.411569 | ubuntu-noble | skipping: [molecule-auditd] => (item=20-neo23x0.rules) => {"ansible_loop_var": "item", "changed": false, "false_condition": "item not in auditd_rules_files", "item": "20-neo23x0.rules", "skip_reason": "Conditional result was False"} 2026-06-02 13:35:37.411777 | ubuntu-noble | 2026-06-02 13:35:37.412049 | ubuntu-noble | RUNNING HANDLER [auditd : Restart auditd service] ****************************** 2026-06-02 13:35:38.165682 | ubuntu-noble | changed: [molecule-auditd] => {"changed": true, "name": "auditd", "state": "started", "status": {"ActiveEnterTimestamp": "Tue 2026-06-02 13:35:28 UTC", "ActiveEnterTimestampMonotonic": "150947494", "ActiveExitTimestampMonotonic": "0", "ActiveState": "active", "After": "system.slice systemd-journald.socket systemd-tmpfiles-setup.service local-fs.target", "AllowIsolate": "no", "AssertResult": "yes", "AssertTimestamp": "Tue 2026-06-02 13:35:28 UTC", "AssertTimestampMonotonic": "150873554", "Before": "systemd-update-utmp.service ssh.service sysinit.target shutdown.target", "BlockIOAccounting": "no", "BlockIOWeight": "[not set]", "CPUAccounting": "yes", "CPUAffinityFromNUMA": "no", "CPUQuotaPerSecUSec": "infinity", "CPUQuotaPeriodUSec": "infinity", "CPUSchedulingPolicy": "0", "CPUSchedulingPriority": "0", "CPUSchedulingResetOnFork": "no", "CPUShares": "[not set]", "CPUUsageNSec": "59276000", "CPUWeight": "[not set]", "CacheDirectoryMode": "0755", "CanFreeze": "yes", "CanIsolate": "no", "CanReload": "no", "CanStart": "yes", "CanStop": "yes", "CapabilityBoundingSet": "cap_chown cap_dac_override cap_dac_read_search cap_fowner cap_fsetid cap_kill cap_setgid cap_setuid cap_setpcap cap_linux_immutable cap_net_bind_service cap_net_broadcast cap_net_admin cap_net_raw cap_ipc_lock cap_ipc_owner cap_sys_rawio cap_sys_chroot cap_sys_ptrace cap_sys_pacct cap_sys_admin cap_sys_boot cap_sys_nice cap_sys_resource cap_sys_time cap_sys_tty_config cap_mknod cap_lease cap_audit_write cap_audit_control cap_setfcap cap_mac_override cap_mac_admin cap_syslog cap_wake_alarm cap_block_suspend cap_audit_read cap_perfmon cap_bpf cap_checkpoint_restore", "CleanResult": "success", "CollectMode": "inactive", "ConditionResult": "yes", "ConditionTimestamp": "Tue 2026-06-02 13:35:28 UTC", "ConditionTimestampMonotonic": "150873504", "ConfigurationDirectoryMode": "0755", "Conflicts": "shutdown.target", "ControlGroup": "/system.slice/auditd.service", "ControlGroupId": "3826", "ControlPID": "0", "CoredumpFilter": "0x33", "CoredumpReceive": "no", "DefaultDependencies": "no", "DefaultMemoryLow": "0", "DefaultMemoryMin": "0", "DefaultStartupMemoryLow": "0", "Delegate": "no", "Description": "Security Auditing Service", "DevicePolicy": "auto", "Documentation": "\"man:auditd(8)\" https://github.com/linux-audit/audit-documentation", "DynamicUser": "no", "ExecMainCode": "0", "ExecMainExitTimestampMonotonic": "0", "ExecMainPID": "2168", "ExecMainStartTimestamp": "Tue 2026-06-02 13:35:28 UTC", "ExecMainStartTimestampMonotonic": "150904413", "ExecMainStatus": "0", "ExecStart": "{ path=/sbin/auditd ; argv[]=/sbin/auditd ; ignore_errors=no ; start_time=[Tue 2026-06-02 13:35:28 UTC] ; stop_time=[Tue 2026-06-02 13:35:28 UTC] ; pid=2167 ; code=exited ; status=0 }", "ExecStartEx": "{ path=/sbin/auditd ; argv[]=/sbin/auditd ; flags= ; start_time=[Tue 2026-06-02 13:35:28 UTC] ; stop_time=[Tue 2026-06-02 13:35:28 UTC] ; pid=2167 ; code=exited ; status=0 }", "ExecStartPost": "{ path=/sbin/augenrules ; argv[]=/sbin/augenrules --load ; ignore_errors=yes ; start_time=[Tue 2026-06-02 13:35:28 UTC] ; stop_time=[Tue 2026-06-02 13:35:28 UTC] ; pid=2171 ; code=exited ; status=0 }", "ExecStartPostEx": "{ path=/sbin/augenrules ; argv[]=/sbin/augenrules --load ; flags=ignore-failure ; start_time=[Tue 2026-06-02 13:35:28 UTC] ; stop_time=[Tue 2026-06-02 13:35:28 UTC] ; pid=2171 ; code=exited ; status=0 }", "ExitType": "main", "ExtensionImagePolicy": "root=verity+signed+encrypted+unprotected+absent:usr=verity+signed+encrypted+unprotected+absent:home=encrypted+unprotected+absent:srv=encrypted+unprotected+absent:tmp=encrypted+unprotected+absent:var=encrypted+unprotected+absent", "FailureAction": "none", "FileDescriptorStoreMax": "0", "FileDescriptorStorePreserve": "restart", "FinalKillSignal": "9", "FragmentPath": "/usr/lib/systemd/system/auditd.service", "FreezerState": "running", "GID": "[not set]", "GuessMainPID": "yes", "IOAccounting": "no", "IOReadBytes": "[not set]", "IOReadOperations": "[not set]", "IOSchedulingClass": "2", "IOSchedulingPriority": "4", "IOWeight": "[not set]", "IOWriteBytes": "[not set]", "IOWriteOperations": "[not set]", "IPAccounting": "no", "IPEgressBytes": "[no data]", "IPEgressPackets": "[no data]", "IPIngressBytes": "[no data]", "IPIngressPackets": "[no data]", "Id": "auditd.service", "IgnoreOnIsolate": "no", "IgnoreSIGPIPE": "yes", "InactiveEnterTimestampMonotonic": "0", "InactiveExitTimestamp": "Tue 2026-06-02 13:35:28 UTC", "InactiveExitTimestampMonotonic": "150879365", "InvocationID": "cb62f935a2fa4278a403f9101673113b", "JobRunningTimeoutUSec": "infinity", "JobTimeoutAction": "none", "JobTimeoutUSec": "infinity", "KeyringMode": "private", "KillMode": "control-group", "KillSignal": "15", "LimitAS": "infinity", "LimitASSoft": "infinity", "LimitCORE": "infinity", "LimitCORESoft": "0", "LimitCPU": "infinity", "LimitCPUSoft": "infinity", "LimitDATA": "infinity", "LimitDATASoft": "infinity", "LimitFSIZE": "infinity", "LimitFSIZESoft": "infinity", "LimitLOCKS": "infinity", "LimitLOCKSSoft": "infinity", "LimitMEMLOCK": "8388608", "LimitMEMLOCKSoft": "8388608", "LimitMSGQUEUE": "819200", "LimitMSGQUEUESoft": "819200", "LimitNICE": "0", "LimitNICESoft": "0", "LimitNOFILE": "524288", "LimitNOFILESoft": "1024", "LimitNPROC": "15372", "LimitNPROCSoft": "15372", "LimitRSS": "infinity", "LimitRSSSoft": "infinity", "LimitRTPRIO": "0", "LimitRTPRIOSoft": "0", "LimitRTTIME": "infinity", "LimitRTTIMESoft": "infinity", "LimitSIGPENDING": "15372", "LimitSIGPENDINGSoft": "15372", "LimitSTACK": "infinity", "LimitSTACKSoft": "8388608", "LoadState": "loaded", "LockPersonality": "yes", "LogLevelMax": "-1", "LogRateLimitBurst": "0", "LogRateLimitIntervalUSec": "0", "LogsDirectoryMode": "0755", "MainPID": "2168", "ManagedOOMMemoryPressure": "auto", "ManagedOOMMemoryPressureLimit": "0", "ManagedOOMPreference": "none", "ManagedOOMSwap": "auto", "MemoryAccounting": "yes", "MemoryAvailable": "3533844480", "MemoryCurrent": "507904", "MemoryDenyWriteExecute": "yes", "MemoryHigh": "infinity", "MemoryKSM": "no", "MemoryLimit": "infinity", "MemoryLow": "0", "MemoryMax": "infinity", "MemoryMin": "0", "MemoryPeak": "2101248", "MemoryPressureThresholdUSec": "200ms", "MemoryPressureWatch": "auto", "MemorySwapCurrent": "0", "MemorySwapMax": "infinity", "MemorySwapPeak": "0", "MemoryZSwapCurrent": "0", "MemoryZSwapMax": "infinity", "MountAPIVFS": "no", "MountImagePolicy": "root=verity+signed+encrypted+unprotected+absent:usr=verity+signed+encrypted+unprotected+absent:home=encrypted+unprotected+absent:srv=encrypted+unprotected+absent:tmp=encrypted+unprotected+absent:var=encrypted+unprotected+absent", "NFileDescriptorStore": "0", "NRestarts": "0", "NUMAPolicy": "n/a", "Names": "auditd.service", "NeedDaemonReload": "no", "Nice": "0", "NoNewPrivileges": "no", "NonBlocking": "no", "NotifyAccess": "none", "OOMPolicy": "stop", "OOMScoreAdjust": "0", "OnFailureJobMode": "replace", "OnSuccessJobMode": "fail", "PIDFile": "/run/auditd.pid", "Perpetual": "no", "PrivateDevices": "no", "PrivateIPC": "no", "PrivateMounts": "no", "PrivateNetwork": "no", "PrivateTmp": "no", "PrivateUsers": "no", "ProcSubset": "all", "ProtectClock": "no", "ProtectControlGroups": "no", "ProtectHome": "no", "ProtectHostname": "no", "ProtectKernelLogs": "no", "ProtectKernelModules": "yes", "ProtectKernelTunables": "no", "ProtectProc": "default", "ProtectSystem": "no", "RefuseManualStart": "no", "RefuseManualStop": "no", "ReloadResult": "success", "ReloadSignal": "1", "RemainAfterExit": "no", "RemoveIPC": "no", "Requires": "system.slice", "Restart": "on-failure", "RestartKillSignal": "15", "RestartMaxDelayUSec": "infinity", "RestartMode": "normal", "RestartPreventExitStatus": "2 4 6", "RestartSteps": "0", "RestartUSec": "100ms", "RestartUSecNext": "100ms", "RestrictNamespaces": "no", "RestrictRealtime": "yes", "RestrictSUIDSGID": "no", "Result": "success", "RootDirectoryStartOnly": "no", "RootEphemeral": "no", "RootImagePolicy": "root=verity+signed+encrypted+unprotected+absent:usr=verity+signed+encrypted+unprotected+absent:home=encrypted+unprotected+absent:srv=encrypted+unprotected+absent:tmp=encrypted+unprotected+absent:var=encrypted+unprotected+absent", "RuntimeDirectoryMode": "0755", "RuntimeDirectoryPreserve": "no", "RuntimeMaxUSec": "infinity", "RuntimeRandomizedExtraUSec": "0", "SameProcessGroup": "no", "SecureBits": "0", "SendSIGHUP": "no", "SendSIGKILL": "yes", "SetLoginEnvironment": "no", "Slice": "system.slice", "StandardError": "inherit", "StandardInput": "null", "StandardOutput": "journal", "StartLimitAction": "none", "StartLimitBurst": "5", "StartLimitIntervalUSec": "10s", "StartupBlockIOWeight": "[not set]", "StartupCPUShares": "[not set]", "StartupCPUWeight": "[not set]", "StartupIOWeight": "[not set]", "StartupMemoryHigh": "infinity", "StartupMemoryLow": "0", "StartupMemoryMax": "infinity", "StartupMemorySwapMax": "infinity", "StartupMemoryZSwapMax": "infinity", "StateChangeTimestamp": "Tue 2026-06-02 13:35:28 UTC", "StateChangeTimestampMonotonic": "150947494", "StateDirectoryMode": "0755", "StatusErrno": "0", "StopWhenUnneeded": "no", "SubState": "running", "SuccessAction": "none", "SurviveFinalKillSignal": "no", "SyslogFacility": "3", "SyslogLevel": "6", "SyslogLevelPrefix": "yes", "SyslogPriority": "30", "SystemCallErrorNumber": "2147483646", "TTYReset": "no", "TTYVHangup": "no", "TTYVTDisallocate": "no", "TasksAccounting": "yes", "TasksCurrent": "2", "TasksMax": "4611", "TimeoutAbortUSec": "1min 30s", "TimeoutCleanUSec": "infinity", "TimeoutStartFailureMode": "terminate", "TimeoutStartUSec": "1min 30s", "TimeoutStopFailureMode": "terminate", "TimeoutStopUSec": "1min 30s", "TimerSlackNSec": "50000", "Transient": "no", "Type": "forking", "UID": "[not set]", "UMask": "0022", "UnitFilePreset": "enabled", "UnitFileState": "enabled", "UtmpMode": "init", "WantedBy": "multi-user.target", "WatchdogSignal": "6", "WatchdogTimestampMonotonic": "0", "WatchdogUSec": "0"}} 2026-06-02 13:35:38.172850 | ubuntu-noble | 2026-06-02 13:35:38.173123 | ubuntu-noble | RUNNING HANDLER [auditd : Generate auditd rules] ******************************* 2026-06-02 13:35:38.633082 | ubuntu-noble | changed: [molecule-auditd] => {"changed": true, "cmd": ["augenrules", "--load"], "delta": "0:00:00.071710", "end": "2026-06-02 13:35:38.566565", "msg": "", "rc": 0, "start": "2026-06-02 13:35:38.494855", "stderr": "Unknown user: chrony\nThere was an error in line 24 of /etc/audit/audit.rules\nError sending add rule data request (No such file or directory)\nThere was an error in line 28 of /etc/audit/audit.rules\nUnknown user: ntp\nThere was an error in line 44 of /etc/audit/audit.rules\nError sending add rule data request (No such file or directory)\nThere was an error in line 83 of /etc/audit/audit.rules\nError sending add rule data request (No such file or directory)\nThere was an error in line 84 of /etc/audit/audit.rules\nError sending add rule data request (No such file or directory)\nThere was an error in line 86 of /etc/audit/audit.rules\nError sending add rule data request (No such file or directory)\nThere was an error in line 112 of /etc/audit/audit.rules\nError sending add rule data request (No such file or directory)\nThere was an error in line 115 of /etc/audit/audit.rules\nError sending add rule data request (No such file or directory)\nThere was an error in line 176 of /etc/audit/audit.rules\nError sending add rule data request (No such file or directory)\nThere was an error in line 177 of /etc/audit/audit.rules\nError sending add rule data request (No such file or directory)\nThere was an error in line 178 of /etc/audit/audit.rules\nError sending add rule data request (No such file or directory)\nThere was an error in line 179 of /etc/audit/audit.rules\nError sending add rule data request (No such file or directory)\nThere was an error in line 180 of /etc/audit/audit.rules\nError sending add rule data request (No such file or directory)\nThere was an error in line 217 of /etc/audit/audit.rules\nError sending add rule data request (No such file or directory)\nThere was an error in line 218 of /etc/audit/audit.rules\nError sending add rule data request (No such file or directory)\nThere was an error in line 234 of /etc/audit/audit.rules\nError sending add rule data request (No such file or directory)\nThere was an error in line 285 of /etc/audit/audit.rules\nError sending add rule data request (No such file or directory)\nThere was an error in line 286 of /etc/audit/audit.rules\nError sending add rule data request (No such file or directory)\nThere was an error in line 324 of /etc/audit/audit.rules\nError sending add rule data request (No such file or directory)\nThere was an error in line 325 of /etc/audit/audit.rules\nError sending add rule data request (No such file or directory)\nThere was an error in line 346 of /etc/audit/audit.rules\nparameter passed without an option given\nThere was an error in line 347 of /etc/audit/audit.rules\nparameter passed without an option given\nThere was an error in line 348 of /etc/audit/audit.rules\nparameter passed without an option given\nThere was an error in line 349 of /etc/audit/audit.rules\nparameter passed without an option given\nThere was an error in line 350 of /etc/audit/audit.rules\nparameter passed without an option given\nThere was an error in line 351 of /etc/audit/audit.rules\nError sending add rule data request (No such file or directory)\nThere was an error in line 359 of /etc/audit/audit.rules", "stderr_lines": ["Unknown user: chrony", "There was an error in line 24 of /etc/audit/audit.rules", "Error sending add rule data request (No such file or directory)", "There was an error in line 28 of /etc/audit/audit.rules", "Unknown user: ntp", "There was an error in line 44 of /etc/audit/audit.rules", "Error sending add rule data request (No such file or directory)", "There was an error in line 83 of /etc/audit/audit.rules", "Error sending add rule data request (No such file or directory)", "There was an error in line 84 of /etc/audit/audit.rules", "Error sending add rule data request (No such file or directory)", "There was an error in line 86 of /etc/audit/audit.rules", "Error sending add rule data request (No such file or directory)", "There was an error in line 112 of /etc/audit/audit.rules", "Error sending add rule data request (No such file or directory)", "There was an error in line 115 of /etc/audit/audit.rules", "Error sending add rule data request (No such file or directory)", "There was an error in line 176 of /etc/audit/audit.rules", "Error sending add rule data request (No such file or directory)", "There was an error in line 177 of /etc/audit/audit.rules", "Error sending add rule data request (No such file or directory)", "There was an error in line 178 of /etc/audit/audit.rules", "Error sending add rule data request (No such file or directory)", "There was an error in line 179 of /etc/audit/audit.rules", "Error sending add rule data request (No such file or directory)", "There was an error in line 180 of /etc/audit/audit.rules", "Error sending add rule data request (No such file or directory)", "There was an error in line 217 of /etc/audit/audit.rules", "Error sending add rule data request (No such file or directory)", "There was an error in line 218 of /etc/audit/audit.rules", "Error sending add rule data request (No such file or directory)", "There was an error in line 234 of /etc/audit/audit.rules", "Error sending add rule data request (No such file or directory)", "There was an error in line 285 of /etc/audit/audit.rules", "Error sending add rule data request (No such file or directory)", "There was an error in line 286 of /etc/audit/audit.rules", "Error sending add rule data request (No such file or directory)", "There was an error in line 324 of /etc/audit/audit.rules", "Error sending add rule data request (No such file or directory)", "There was an error in line 325 of /etc/audit/audit.rules", "Error sending add rule data request (No such file or directory)", "There was an error in line 346 of /etc/audit/audit.rules", "parameter passed without an option given", "There was an error in line 347 of /etc/audit/audit.rules", "parameter passed without an option given", "There was an error in line 348 of /etc/audit/audit.rules", "parameter passed without an option given", "There was an error in line 349 of /etc/audit/audit.rules", "parameter passed without an option given", "There was an error in line 350 of /etc/audit/audit.rules", "parameter passed without an option given", "There was an error in line 351 of /etc/audit/audit.rules", "Error sending add rule data request (No such file or directory)", "There was an error in line 359 of /etc/audit/audit.rules"], "stdout": "/usr/sbin/augenrules: No change\nNo rules\nenabled 1\nfailure 1\npid 2560\nrate_limit 0\nbacklog_limit 8192\nlost 0\nbacklog 1299\nbacklog_wait_time 60000\nbacklog_wait_time_actual 0\nenabled 1\nfailure 1\npid 2560\nrate_limit 0\nbacklog_limit 8192\nlost 0\nbacklog 1284\nbacklog_wait_time 60000\nbacklog_wait_time_actual 0", "stdout_lines": ["/usr/sbin/augenrules: No change", "No rules", "enabled 1", "failure 1", "pid 2560", "rate_limit 0", "backlog_limit 8192", "lost 0", "backlog 1299", "backlog_wait_time 60000", "backlog_wait_time_actual 0", "enabled 1", "failure 1", "pid 2560", "rate_limit 0", "backlog_limit 8192", "lost 0", "backlog 1284", "backlog_wait_time 60000", "backlog_wait_time_actual 0"]} 2026-06-02 13:35:38.633173 | ubuntu-noble | 2026-06-02 13:35:38.633181 | ubuntu-noble | RUNNING HANDLER [auditd : Restart auditd service] ****************************** 2026-06-02 13:35:39.431225 | ubuntu-noble | changed: [molecule-auditd] => {"changed": true, "name": "auditd", "state": "started", "status": {"ActiveEnterTimestamp": "Tue 2026-06-02 13:35:38 UTC", "ActiveEnterTimestampMonotonic": "160682398", "ActiveExitTimestamp": "Tue 2026-06-02 13:35:37 UTC", "ActiveExitTimestampMonotonic": "160508560", "ActiveState": "active", "After": "system.slice systemd-journald.socket systemd-tmpfiles-setup.service local-fs.target", "AllowIsolate": "no", "AssertResult": "yes", "AssertTimestamp": "Tue 2026-06-02 13:35:37 UTC", "AssertTimestampMonotonic": "160552193", "Before": "systemd-update-utmp.service ssh.service sysinit.target shutdown.target", "BlockIOAccounting": "no", "BlockIOWeight": "[not set]", "CPUAccounting": "yes", "CPUAffinityFromNUMA": "no", "CPUQuotaPerSecUSec": "infinity", "CPUQuotaPeriodUSec": "infinity", "CPUSchedulingPolicy": "0", "CPUSchedulingPriority": "0", "CPUSchedulingResetOnFork": "no", "CPUShares": "[not set]", "CPUUsageNSec": "198424000", "CPUWeight": "[not set]", "CacheDirectoryMode": "0755", "CanFreeze": "yes", "CanIsolate": "no", "CanReload": "no", "CanStart": "yes", "CanStop": "yes", "CapabilityBoundingSet": "cap_chown cap_dac_override cap_dac_read_search cap_fowner cap_fsetid cap_kill cap_setgid cap_setuid cap_setpcap cap_linux_immutable cap_net_bind_service cap_net_broadcast cap_net_admin cap_net_raw cap_ipc_lock cap_ipc_owner cap_sys_rawio cap_sys_chroot cap_sys_ptrace cap_sys_pacct cap_sys_admin cap_sys_boot cap_sys_nice cap_sys_resource cap_sys_time cap_sys_tty_config cap_mknod cap_lease cap_audit_write cap_audit_control cap_setfcap cap_mac_override cap_mac_admin cap_syslog cap_wake_alarm cap_block_suspend cap_audit_read cap_perfmon cap_bpf cap_checkpoint_restore", "CleanResult": "success", "CollectMode": "inactive", "ConditionResult": "yes", "ConditionTimestamp": "Tue 2026-06-02 13:35:37 UTC", "ConditionTimestampMonotonic": "160552055", "ConfigurationDirectoryMode": "0755", "Conflicts": "shutdown.target", "ControlGroup": "/system.slice/auditd.service", "ControlGroupId": "3868", "ControlPID": "0", "CoredumpFilter": "0x33", "CoredumpReceive": "no", "DefaultDependencies": "no", "DefaultMemoryLow": "0", "DefaultMemoryMin": "0", "DefaultStartupMemoryLow": "0", "Delegate": "no", "Description": "Security Auditing Service", "DevicePolicy": "auto", "Documentation": "\"man:auditd(8)\" https://github.com/linux-audit/audit-documentation", "DynamicUser": "no", "ExecMainCode": "0", "ExecMainExitTimestampMonotonic": "0", "ExecMainPID": "2560", "ExecMainStartTimestamp": "Tue 2026-06-02 13:35:38 UTC", "ExecMainStartTimestampMonotonic": "160592611", "ExecMainStatus": "0", "ExecStart": "{ path=/sbin/auditd ; argv[]=/sbin/auditd ; ignore_errors=no ; start_time=[Tue 2026-06-02 13:35:37 UTC] ; stop_time=[Tue 2026-06-02 13:35:38 UTC] ; pid=2559 ; code=exited ; status=0 }", "ExecStartEx": "{ path=/sbin/auditd ; argv[]=/sbin/auditd ; flags= ; start_time=[Tue 2026-06-02 13:35:37 UTC] ; stop_time=[Tue 2026-06-02 13:35:38 UTC] ; pid=2559 ; code=exited ; status=0 }", "ExecStartPost": "{ path=/sbin/augenrules ; argv[]=/sbin/augenrules --load ; ignore_errors=yes ; start_time=[Tue 2026-06-02 13:35:38 UTC] ; stop_time=[Tue 2026-06-02 13:35:38 UTC] ; pid=2564 ; code=exited ; status=0 }", "ExecStartPostEx": "{ path=/sbin/augenrules ; argv[]=/sbin/augenrules --load ; flags=ignore-failure ; start_time=[Tue 2026-06-02 13:35:38 UTC] ; stop_time=[Tue 2026-06-02 13:35:38 UTC] ; pid=2564 ; code=exited ; status=0 }", "ExitType": "main", "ExtensionImagePolicy": "root=verity+signed+encrypted+unprotected+absent:usr=verity+signed+encrypted+unprotected+absent:home=encrypted+unprotected+absent:srv=encrypted+unprotected+absent:tmp=encrypted+unprotected+absent:var=encrypted+unprotected+absent", "FailureAction": "none", "FileDescriptorStoreMax": "0", "FileDescriptorStorePreserve": "restart", "FinalKillSignal": "9", "FragmentPath": "/usr/lib/systemd/system/auditd.service", "FreezerState": "running", "GID": "[not set]", "GuessMainPID": "yes", "IOAccounting": "no", "IOReadBytes": "[not set]", "IOReadOperations": "[not set]", "IOSchedulingClass": "2", "IOSchedulingPriority": "4", "IOWeight": "[not set]", "IOWriteBytes": "[not set]", "IOWriteOperations": "[not set]", "IPAccounting": "no", "IPEgressBytes": "[no data]", "IPEgressPackets": "[no data]", "IPIngressBytes": "[no data]", "IPIngressPackets": "[no data]", "Id": "auditd.service", "IgnoreOnIsolate": "no", "IgnoreSIGPIPE": "yes", "InactiveEnterTimestamp": "Tue 2026-06-02 13:35:37 UTC", "InactiveEnterTimestampMonotonic": "160550190", "InactiveExitTimestamp": "Tue 2026-06-02 13:35:37 UTC", "InactiveExitTimestampMonotonic": "160567796", "InvocationID": "45d7c4be1b0d4173b3dba13e846c8b5b", "JobRunningTimeoutUSec": "infinity", "JobTimeoutAction": "none", "JobTimeoutUSec": "infinity", "KeyringMode": "private", "KillMode": "control-group", "KillSignal": "15", "LimitAS": "infinity", "LimitASSoft": "infinity", "LimitCORE": "infinity", "LimitCORESoft": "0", "LimitCPU": "infinity", "LimitCPUSoft": "infinity", "LimitDATA": "infinity", "LimitDATASoft": "infinity", "LimitFSIZE": "infinity", "LimitFSIZESoft": "infinity", "LimitLOCKS": "infinity", "LimitLOCKSSoft": "infinity", "LimitMEMLOCK": "8388608", "LimitMEMLOCKSoft": "8388608", "LimitMSGQUEUE": "819200", "LimitMSGQUEUESoft": "819200", "LimitNICE": "0", "LimitNICESoft": "0", "LimitNOFILE": "524288", "LimitNOFILESoft": "1024", "LimitNPROC": "15372", "LimitNPROCSoft": "15372", "LimitRSS": "infinity", "LimitRSSSoft": "infinity", "LimitRTPRIO": "0", "LimitRTPRIOSoft": "0", "LimitRTTIME": "infinity", "LimitRTTIMESoft": "infinity", "LimitSIGPENDING": "15372", "LimitSIGPENDINGSoft": "15372", "LimitSTACK": "infinity", "LimitSTACKSoft": "8388608", "LoadState": "loaded", "LockPersonality": "yes", "LogLevelMax": "-1", "LogRateLimitBurst": "0", "LogRateLimitIntervalUSec": "0", "LogsDirectoryMode": "0755", "MainPID": "2560", "ManagedOOMMemoryPressure": "auto", "ManagedOOMMemoryPressureLimit": "0", "ManagedOOMPreference": "none", "ManagedOOMSwap": "auto", "MemoryAccounting": "yes", "MemoryAvailable": "3529080832", "MemoryCurrent": "1863680", "MemoryDenyWriteExecute": "yes", "MemoryHigh": "infinity", "MemoryKSM": "no", "MemoryLimit": "infinity", "MemoryLow": "0", "MemoryMax": "infinity", "MemoryMin": "0", "MemoryPeak": "2326528", "MemoryPressureThresholdUSec": "200ms", "MemoryPressureWatch": "auto", "MemorySwapCurrent": "0", "MemorySwapMax": "infinity", "MemorySwapPeak": "0", "MemoryZSwapCurrent": "0", "MemoryZSwapMax": "infinity", "MountAPIVFS": "no", "MountImagePolicy": "root=verity+signed+encrypted+unprotected+absent:usr=verity+signed+encrypted+unprotected+absent:home=encrypted+unprotected+absent:srv=encrypted+unprotected+absent:tmp=encrypted+unprotected+absent:var=encrypted+unprotected+absent", "NFileDescriptorStore": "0", "NRestarts": "0", "NUMAPolicy": "n/a", "Names": "auditd.service", "NeedDaemonReload": "no", "Nice": "0", "NoNewPrivileges": "no", "NonBlocking": "no", "NotifyAccess": "none", "OOMPolicy": "stop", "OOMScoreAdjust": "0", "OnFailureJobMode": "replace", "OnSuccessJobMode": "fail", "PIDFile": "/run/auditd.pid", "Perpetual": "no", "PrivateDevices": "no", "PrivateIPC": "no", "PrivateMounts": "no", "PrivateNetwork": "no", "PrivateTmp": "no", "PrivateUsers": "no", "ProcSubset": "all", "ProtectClock": "no", "ProtectControlGroups": "no", "ProtectHome": "no", "ProtectHostname": "no", "ProtectKernelLogs": "no", "ProtectKernelModules": "yes", "ProtectKernelTunables": "no", "ProtectProc": "default", "ProtectSystem": "no", "RefuseManualStart": "no", "RefuseManualStop": "no", "ReloadResult": "success", "ReloadSignal": "1", "RemainAfterExit": "no", "RemoveIPC": "no", "Requires": "system.slice", "Restart": "on-failure", "RestartKillSignal": "15", "RestartMaxDelayUSec": "infinity", "RestartMode": "normal", "RestartPreventExitStatus": "2 4 6", "RestartSteps": "0", "RestartUSec": "100ms", "RestartUSecNext": "100ms", "RestrictNamespaces": "no", "RestrictRealtime": "yes", "RestrictSUIDSGID": "no", "Result": "success", "RootDirectoryStartOnly": "no", "RootEphemeral": "no", "RootImagePolicy": "root=verity+signed+encrypted+unprotected+absent:usr=verity+signed+encrypted+unprotected+absent:home=encrypted+unprotected+absent:srv=encrypted+unprotected+absent:tmp=encrypted+unprotected+absent:var=encrypted+unprotected+absent", "RuntimeDirectoryMode": "0755", "RuntimeDirectoryPreserve": "no", "RuntimeMaxUSec": "infinity", "RuntimeRandomizedExtraUSec": "0", "SameProcessGroup": "no", "SecureBits": "0", "SendSIGHUP": "no", "SendSIGKILL": "yes", "SetLoginEnvironment": "no", "Slice": "system.slice", "StandardError": "inherit", "StandardInput": "null", "StandardOutput": "journal", "StartLimitAction": "none", "StartLimitBurst": "5", "StartLimitIntervalUSec": "10s", "StartupBlockIOWeight": "[not set]", "StartupCPUShares": "[not set]", "StartupCPUWeight": "[not set]", "StartupIOWeight": "[not set]", "StartupMemoryHigh": "infinity", "StartupMemoryLow": "0", "StartupMemoryMax": "infinity", "StartupMemorySwapMax": "infinity", "StartupMemoryZSwapMax": "infinity", "StateChangeTimestamp": "Tue 2026-06-02 13:35:38 UTC", "StateChangeTimestampMonotonic": "160682398", "StateDirectoryMode": "0755", "StatusErrno": "0", "StopWhenUnneeded": "no", "SubState": "running", "SuccessAction": "none", "SurviveFinalKillSignal": "no", "SyslogFacility": "3", "SyslogLevel": "6", "SyslogLevelPrefix": "yes", "SyslogPriority": "30", "SystemCallErrorNumber": "2147483646", "TTYReset": "no", "TTYVHangup": "no", "TTYVTDisallocate": "no", "TasksAccounting": "yes", "TasksCurrent": "2", "TasksMax": "4611", "TimeoutAbortUSec": "1min 30s", "TimeoutCleanUSec": "infinity", "TimeoutStartFailureMode": "terminate", "TimeoutStartUSec": "1min 30s", "TimeoutStopFailureMode": "terminate", "TimeoutStopUSec": "1min 30s", "TimerSlackNSec": "50000", "Transient": "no", "Type": "forking", "UID": "[not set]", "UMask": "0022", "UnitFilePreset": "enabled", "UnitFileState": "enabled", "UtmpMode": "init", "WantedBy": "multi-user.target", "WatchdogSignal": "6", "WatchdogTimestampMonotonic": "0", "WatchdogUSec": "0"}} 2026-06-02 13:35:39.432775 | ubuntu-noble | 2026-06-02 13:35:39.432801 | ubuntu-noble | PLAY RECAP ********************************************************************* 2026-06-02 13:35:39.432808 | ubuntu-noble | molecule-auditd : ok=15 changed=8 unreachable=0 failed=0 skipped=0 rescued=0 ignored=0 2026-06-02 13:35:39.432812 | ubuntu-noble | 2026-06-02 13:35:39.548709 | ubuntu-noble | INFO [delegated > converge] Executed: Successful 2026-06-02 13:35:39.549767 | ubuntu-noble | WARNING Molecule executed 1 scenario (1 missing files) 2026-06-02 13:35:39.913878 | debian-bookworm | ok: Runtime: 0:00:16.603610 2026-06-02 13:35:39.953286 | ubuntu-noble | ok: Runtime: 0:00:21.212328 2026-06-02 13:35:39.981490 | 2026-06-02 13:35:39.981652 | TASK [ansible-molecule : Run molecule verify action with scenario delegated] 2026-06-02 13:35:40.637354 | debian-bookworm | WARNING Molecule scenarios should migrate to 'extensions/molecule' 2026-06-02 13:35:40.648301 | debian-bookworm | DEBUG [unknown > config] provisioner.env found in /home/zuul/src/github.com/osism/ansible-collection-services/molecule/delegated/molecule.yml, this can be defined in ansible.env 2026-06-02 13:35:40.841200 | ubuntu-noble | WARNING Molecule scenarios should migrate to 'extensions/molecule' 2026-06-02 13:35:40.853295 | ubuntu-noble | DEBUG [unknown > config] provisioner.env found in /home/zuul/src/github.com/osism/ansible-collection-services/molecule/delegated/molecule.yml, this can be defined in ansible.env 2026-06-02 13:35:41.117575 | debian-bookworm | DEBUG [unknown > config] provisioner.env found in /home/zuul/src/github.com/osism/ansible-collection-services/molecule/delegated/molecule.yml, this can be defined in ansible.env 2026-06-02 13:35:41.118204 | debian-bookworm | DEBUG [delegated > validate] Validating schema /home/zuul/src/github.com/osism/ansible-collection-services/molecule/delegated/molecule.yml. 2026-06-02 13:35:41.140411 | debian-bookworm | DEBUG [default > validate] Validating schema /home/zuul/src/github.com/osism/ansible-collection-services/molecule/default/molecule.yml. 2026-06-02 13:35:41.145943 | debian-bookworm | INFO [delegated > discovery] scenario test matrix: verify 2026-06-02 13:35:41.146047 | debian-bookworm | INFO [delegated > prerun] Performing prerun with role_name_check=0... 2026-06-02 13:35:41.437672 | ubuntu-noble | DEBUG [unknown > config] provisioner.env found in /home/zuul/src/github.com/osism/ansible-collection-services/molecule/delegated/molecule.yml, this can be defined in ansible.env 2026-06-02 13:35:41.438373 | ubuntu-noble | DEBUG [delegated > validate] Validating schema /home/zuul/src/github.com/osism/ansible-collection-services/molecule/delegated/molecule.yml. 2026-06-02 13:35:41.464758 | ubuntu-noble | DEBUG [default > validate] Validating schema /home/zuul/src/github.com/osism/ansible-collection-services/molecule/default/molecule.yml. 2026-06-02 13:35:41.470676 | ubuntu-noble | INFO [delegated > discovery] scenario test matrix: verify 2026-06-02 13:35:41.470748 | ubuntu-noble | INFO [delegated > prerun] Performing prerun with role_name_check=0... 2026-06-02 13:35:42.526929 | debian-bookworm | INFO [delegated > verify] Executing 2026-06-02 13:35:42.528971 | debian-bookworm | INFO [delegated > verify] Executing Testinfra tests found in /home/zuul/src/github.com/osism/ansible-collection-services/molecule/delegated/tests/... 2026-06-02 13:35:42.530125 | debian-bookworm | DEBUG ANSIBLE ENVIRONMENT: 2026-06-02 13:35:42.530135 | debian-bookworm | ANSIBLE_COLLECTIONS_PATH: /home/zuul/venv/.ansible/collections:/home/zuul/.ansible/collections 2026-06-02 13:35:42.530142 | debian-bookworm | ANSIBLE_CONFIG: /home/zuul/.ansible/tmp/molecule.oWZD.delegated/ansible.cfg 2026-06-02 13:35:42.530149 | debian-bookworm | ANSIBLE_LIBRARY: ../../plugins 2026-06-02 13:35:42.530155 | debian-bookworm | ANSIBLE_PYTHON_INTERPRETER: /home/zuul/venv/bin/python 2026-06-02 13:35:42.530161 | debian-bookworm | ANSIBLE_ROLE: auditd 2026-06-02 13:35:42.530165 | debian-bookworm | ANSIBLE_ROLES_PATH: ../../roles 2026-06-02 13:35:42.530170 | debian-bookworm | ANSIBLE_VERBOSITY: 1 2026-06-02 13:35:42.530175 | debian-bookworm | 2026-06-02 13:35:42.530277 | debian-bookworm | DEBUG MOLECULE ENVIRONMENT: 2026-06-02 13:35:42.530283 | debian-bookworm | MOLECULE_DEBUG: True 2026-06-02 13:35:42.530288 | debian-bookworm | MOLECULE_DEPENDENCY_NAME: galaxy 2026-06-02 13:35:42.530293 | debian-bookworm | MOLECULE_DRIVER_NAME: default 2026-06-02 13:35:42.530298 | debian-bookworm | MOLECULE_ENV_FILE: /home/zuul/src/github.com/osism/ansible-collection-services/.env.yml 2026-06-02 13:35:42.530303 | debian-bookworm | MOLECULE_EPHEMERAL_DIRECTORY: /home/zuul/.ansible/tmp/molecule.oWZD.delegated 2026-06-02 13:35:42.530308 | debian-bookworm | MOLECULE_FILE: /home/zuul/.ansible/tmp/molecule.oWZD.delegated/molecule.yml 2026-06-02 13:35:42.530313 | debian-bookworm | MOLECULE_INSTANCE_CONFIG: /home/zuul/.ansible/tmp/molecule.oWZD.delegated/instance_config.yml 2026-06-02 13:35:42.530318 | debian-bookworm | MOLECULE_INVENTORY_FILE: /home/zuul/.ansible/tmp/molecule.oWZD.delegated/inventory/ansible_inventory.yml 2026-06-02 13:35:42.530324 | debian-bookworm | MOLECULE_PROJECT_DIRECTORY: /home/zuul/src/github.com/osism/ansible-collection-services 2026-06-02 13:35:42.530329 | debian-bookworm | MOLECULE_PROVISIONER_NAME: ansible 2026-06-02 13:35:42.530334 | debian-bookworm | MOLECULE_SCENARIO_DIRECTORY: /home/zuul/src/github.com/osism/ansible-collection-services/molecule/delegated 2026-06-02 13:35:42.530338 | debian-bookworm | MOLECULE_SCENARIO_NAME: delegated 2026-06-02 13:35:42.530343 | debian-bookworm | MOLECULE_STATE_FILE: /home/zuul/.ansible/tmp/molecule.oWZD.delegated/state.yml 2026-06-02 13:35:42.530348 | debian-bookworm | MOLECULE_VERIFIER_NAME: testinfra 2026-06-02 13:35:42.530354 | debian-bookworm | MOLECULE_VERIFIER_TEST_DIRECTORY: /home/zuul/src/github.com/osism/ansible-collection-services/molecule/delegated/tests 2026-06-02 13:35:42.530359 | debian-bookworm | 2026-06-02 13:35:42.530446 | debian-bookworm | DEBUG SHELL REPLAY: ANSIBLE_COLLECTIONS_PATH=/home/zuul/venv/.ansible/collections:/home/zuul/.ansible/collections ANSIBLE_CONFIG=/home/zuul/.ansible/tmp/molecule.oWZD.delegated/ansible.cfg ANSIBLE_LIBRARY=../../plugins ANSIBLE_PYTHON_INTERPRETER=/home/zuul/venv/bin/python ANSIBLE_ROLE=auditd ANSIBLE_ROLES_PATH=../../roles ANSIBLE_VERBOSITY=1 MOLECULE_DEBUG=True MOLECULE_DEPENDENCY_NAME=galaxy MOLECULE_DRIVER_NAME=default MOLECULE_ENV_FILE=/home/zuul/src/github.com/osism/ansible-collection-services/.env.yml MOLECULE_EPHEMERAL_DIRECTORY=/home/zuul/.ansible/tmp/molecule.oWZD.delegated MOLECULE_FILE=/home/zuul/.ansible/tmp/molecule.oWZD.delegated/molecule.yml MOLECULE_INSTANCE_CONFIG=/home/zuul/.ansible/tmp/molecule.oWZD.delegated/instance_config.yml MOLECULE_INVENTORY_FILE=/home/zuul/.ansible/tmp/molecule.oWZD.delegated/inventory/ansible_inventory.yml MOLECULE_PROJECT_DIRECTORY=/home/zuul/src/github.com/osism/ansible-collection-services MOLECULE_PROVISIONER_NAME=ansible MOLECULE_SCENARIO_DIRECTORY=/home/zuul/src/github.com/osism/ansible-collection-services/molecule/delegated MOLECULE_SCENARIO_NAME=delegated MOLECULE_STATE_FILE=/home/zuul/.ansible/tmp/molecule.oWZD.delegated/state.yml MOLECULE_VERIFIER_NAME=testinfra MOLECULE_VERIFIER_TEST_DIRECTORY=/home/zuul/src/github.com/osism/ansible-collection-services/molecule/delegated/tests 2026-06-02 13:35:42.765116 | debian-bookworm | writing pytest debug information to pytestdebug.log 2026-06-02 13:35:42.778947 | debian-bookworm | ============================= test session starts ============================== 2026-06-02 13:35:42.779597 | debian-bookworm | platform linux -- Python 3.11.2, pytest-8.4.2, pluggy-1.6.0 -- /home/zuul/venv/bin/python3 2026-06-02 13:35:42.780066 | debian-bookworm | using: pytest-8.4.2 2026-06-02 13:35:42.780447 | debian-bookworm | registered third-party plugins: 2026-06-02 13:35:42.781341 | debian-bookworm | pytest-testinfra-10.2.2 at /home/zuul/venv/lib/python3.11/site-packages/testinfra/plugin.py 2026-06-02 13:35:42.781779 | debian-bookworm | rootdir: /home/zuul 2026-06-02 13:35:42.782161 | debian-bookworm | plugins: testinfra-10.2.2 2026-06-02 13:35:43.171678 | ubuntu-noble | INFO [delegated > verify] Executing 2026-06-02 13:35:43.173846 | ubuntu-noble | INFO [delegated > verify] Executing Testinfra tests found in /home/zuul/src/github.com/osism/ansible-collection-services/molecule/delegated/tests/... 2026-06-02 13:35:43.174996 | ubuntu-noble | DEBUG ANSIBLE ENVIRONMENT: 2026-06-02 13:35:43.175026 | ubuntu-noble | ANSIBLE_COLLECTIONS_PATH: /home/zuul/venv/.ansible/collections:/home/zuul/.ansible/collections 2026-06-02 13:35:43.175042 | ubuntu-noble | ANSIBLE_CONFIG: /home/zuul/.ansible/tmp/molecule.oWZD.delegated/ansible.cfg 2026-06-02 13:35:43.175055 | ubuntu-noble | ANSIBLE_LIBRARY: ../../plugins 2026-06-02 13:35:43.175066 | ubuntu-noble | ANSIBLE_PYTHON_INTERPRETER: /home/zuul/venv/bin/python 2026-06-02 13:35:43.175076 | ubuntu-noble | ANSIBLE_ROLE: auditd 2026-06-02 13:35:43.175087 | ubuntu-noble | ANSIBLE_ROLES_PATH: ../../roles 2026-06-02 13:35:43.175098 | ubuntu-noble | ANSIBLE_VERBOSITY: 1 2026-06-02 13:35:43.175109 | ubuntu-noble | 2026-06-02 13:35:43.175130 | ubuntu-noble | DEBUG MOLECULE ENVIRONMENT: 2026-06-02 13:35:43.175141 | ubuntu-noble | MOLECULE_DEBUG: True 2026-06-02 13:35:43.175165 | ubuntu-noble | MOLECULE_DEPENDENCY_NAME: galaxy 2026-06-02 13:35:43.175177 | ubuntu-noble | MOLECULE_DRIVER_NAME: default 2026-06-02 13:35:43.175188 | ubuntu-noble | MOLECULE_ENV_FILE: /home/zuul/src/github.com/osism/ansible-collection-services/.env.yml 2026-06-02 13:35:43.175199 | ubuntu-noble | MOLECULE_EPHEMERAL_DIRECTORY: /home/zuul/.ansible/tmp/molecule.oWZD.delegated 2026-06-02 13:35:43.175210 | ubuntu-noble | MOLECULE_FILE: /home/zuul/.ansible/tmp/molecule.oWZD.delegated/molecule.yml 2026-06-02 13:35:43.175221 | ubuntu-noble | MOLECULE_INSTANCE_CONFIG: /home/zuul/.ansible/tmp/molecule.oWZD.delegated/instance_config.yml 2026-06-02 13:35:43.175232 | ubuntu-noble | MOLECULE_INVENTORY_FILE: /home/zuul/.ansible/tmp/molecule.oWZD.delegated/inventory/ansible_inventory.yml 2026-06-02 13:35:43.175244 | ubuntu-noble | MOLECULE_PROJECT_DIRECTORY: /home/zuul/src/github.com/osism/ansible-collection-services 2026-06-02 13:35:43.175255 | ubuntu-noble | MOLECULE_PROVISIONER_NAME: ansible 2026-06-02 13:35:43.175266 | ubuntu-noble | MOLECULE_SCENARIO_DIRECTORY: /home/zuul/src/github.com/osism/ansible-collection-services/molecule/delegated 2026-06-02 13:35:43.175277 | ubuntu-noble | MOLECULE_SCENARIO_NAME: delegated 2026-06-02 13:35:43.175288 | ubuntu-noble | MOLECULE_STATE_FILE: /home/zuul/.ansible/tmp/molecule.oWZD.delegated/state.yml 2026-06-02 13:35:43.175300 | ubuntu-noble | MOLECULE_VERIFIER_NAME: testinfra 2026-06-02 13:35:43.175310 | ubuntu-noble | MOLECULE_VERIFIER_TEST_DIRECTORY: /home/zuul/src/github.com/osism/ansible-collection-services/molecule/delegated/tests 2026-06-02 13:35:43.175321 | ubuntu-noble | 2026-06-02 13:35:43.175354 | ubuntu-noble | DEBUG SHELL REPLAY: ANSIBLE_COLLECTIONS_PATH=/home/zuul/venv/.ansible/collections:/home/zuul/.ansible/collections ANSIBLE_CONFIG=/home/zuul/.ansible/tmp/molecule.oWZD.delegated/ansible.cfg ANSIBLE_LIBRARY=../../plugins ANSIBLE_PYTHON_INTERPRETER=/home/zuul/venv/bin/python ANSIBLE_ROLE=auditd ANSIBLE_ROLES_PATH=../../roles ANSIBLE_VERBOSITY=1 MOLECULE_DEBUG=True MOLECULE_DEPENDENCY_NAME=galaxy MOLECULE_DRIVER_NAME=default MOLECULE_ENV_FILE=/home/zuul/src/github.com/osism/ansible-collection-services/.env.yml MOLECULE_EPHEMERAL_DIRECTORY=/home/zuul/.ansible/tmp/molecule.oWZD.delegated MOLECULE_FILE=/home/zuul/.ansible/tmp/molecule.oWZD.delegated/molecule.yml MOLECULE_INSTANCE_CONFIG=/home/zuul/.ansible/tmp/molecule.oWZD.delegated/instance_config.yml MOLECULE_INVENTORY_FILE=/home/zuul/.ansible/tmp/molecule.oWZD.delegated/inventory/ansible_inventory.yml MOLECULE_PROJECT_DIRECTORY=/home/zuul/src/github.com/osism/ansible-collection-services MOLECULE_PROVISIONER_NAME=ansible MOLECULE_SCENARIO_DIRECTORY=/home/zuul/src/github.com/osism/ansible-collection-services/molecule/delegated MOLECULE_SCENARIO_NAME=delegated MOLECULE_STATE_FILE=/home/zuul/.ansible/tmp/molecule.oWZD.delegated/state.yml MOLECULE_VERIFIER_NAME=testinfra MOLECULE_VERIFIER_TEST_DIRECTORY=/home/zuul/src/github.com/osism/ansible-collection-services/molecule/delegated/tests 2026-06-02 13:35:43.493088 | ubuntu-noble | writing pytest debug information to pytestdebug.log 2026-06-02 13:35:43.515994 | ubuntu-noble | ============================= test session starts ============================== 2026-06-02 13:35:43.516060 | ubuntu-noble | platform linux -- Python 3.12.3, pytest-8.4.2, pluggy-1.6.0 -- /home/zuul/venv/bin/python3 2026-06-02 13:35:43.516076 | ubuntu-noble | using: pytest-8.4.2 2026-06-02 13:35:43.516495 | ubuntu-noble | registered third-party plugins: 2026-06-02 13:35:43.516973 | ubuntu-noble | pytest-testinfra-10.2.2 at /home/zuul/venv/lib/python3.12/site-packages/testinfra/plugin.py 2026-06-02 13:35:43.517454 | ubuntu-noble | rootdir: /home/zuul 2026-06-02 13:35:43.517954 | ubuntu-noble | plugins: testinfra-10.2.2 2026-06-02 13:35:43.752762 | debian-bookworm | collecting ... collected 6 items 2026-06-02 13:35:43.753099 | debian-bookworm | 2026-06-02 13:35:44.707022 | ubuntu-noble | collecting ... collected 6 items 2026-06-02 13:35:44.707649 | ubuntu-noble | 2026-06-02 13:35:47.806965 | debian-bookworm | tests/auditd.py::test_pkg[ansible://molecule-auditd] PASSED [ 16%] 2026-06-02 13:35:47.848018 | debian-bookworm | tests/auditd.py::test_conffile[ansible://molecule-auditd] PASSED [ 33%] 2026-06-02 13:35:49.724014 | ubuntu-noble | tests/auditd.py::test_pkg[ansible://molecule-auditd] PASSED [ 16%] 2026-06-02 13:35:49.774450 | ubuntu-noble | tests/auditd.py::test_conffile[ansible://molecule-auditd] PASSED [ 33%] 2026-06-02 13:35:50.208325 | debian-bookworm | tests/auditd.py::test_adjustment[ansible://molecule-auditd] PASSED [ 50%] 2026-06-02 13:35:52.693005 | ubuntu-noble | tests/auditd.py::test_adjustment[ansible://molecule-auditd] PASSED [ 50%] 2026-06-02 13:35:54.856958 | debian-bookworm | tests/auditd.py::test_rulefiles[ansible://molecule-auditd] PASSED [ 66%] 2026-06-02 13:35:56.074131 | debian-bookworm | tests/auditd.py::test_srv[ansible://molecule-auditd] PASSED [ 83%] 2026-06-02 13:35:56.156344 | debian-bookworm | wrote pytest debug information to pytestdebug.log 2026-06-02 13:35:56.157801 | debian-bookworm | tests/auditd.py::test_function[ansible://molecule-auditd] PASSED [100%] 2026-06-02 13:35:56.157833 | debian-bookworm | 2026-06-02 13:35:56.157839 | debian-bookworm | ============================== 6 passed in 13.33s ============================== 2026-06-02 13:35:56.198140 | debian-bookworm | INFO [delegated > verify] Verifier completed successfully. 2026-06-02 13:35:56.198230 | debian-bookworm | INFO [delegated > verify] Executed: Successful 2026-06-02 13:35:56.198237 | debian-bookworm | INFO Molecule executed 1 scenario (1 successful) 2026-06-02 13:35:58.419097 | ubuntu-noble | tests/auditd.py::test_rulefiles[ansible://molecule-auditd] PASSED [ 66%] 2026-06-02 13:35:59.911027 | ubuntu-noble | tests/auditd.py::test_srv[ansible://molecule-auditd] PASSED [ 83%] 2026-06-02 13:35:59.990958 | ubuntu-noble | wrote pytest debug information to pytestdebug.log 2026-06-02 13:35:59.993507 | ubuntu-noble | tests/auditd.py::test_function[ansible://molecule-auditd] PASSED [100%] 2026-06-02 13:35:59.993600 | ubuntu-noble | 2026-06-02 13:35:59.993987 | ubuntu-noble | ============================== 6 passed in 16.43s ============================== 2026-06-02 13:36:00.046167 | ubuntu-noble | INFO [delegated > verify] Verifier completed successfully. 2026-06-02 13:36:00.046276 | ubuntu-noble | INFO [delegated > verify] Executed: Successful 2026-06-02 13:36:00.046306 | ubuntu-noble | INFO Molecule executed 1 scenario (1 successful) 2026-06-02 13:36:00.566151 | debian-bookworm | ok: Runtime: 0:00:15.935506 2026-06-02 13:36:00.579795 | ubuntu-noble | ok: Runtime: 0:00:19.668768 2026-06-02 13:36:00.589934 | 2026-06-02 13:36:00.590071 | TASK [ansible-molecule : Run molecule destroy action with scenario delegated] 2026-06-02 13:36:01.145581 | debian-bookworm | skipping: Conditional result was False 2026-06-02 13:36:01.147391 | ubuntu-noble | skipping: Conditional result was False 2026-06-02 13:36:01.173230 | 2026-06-02 13:36:01.173942 | PLAY RECAP 2026-06-02 13:36:01.174558 | debian-bookworm | ok: 17 changed: 12 unreachable: 0 failed: 0 skipped: 16 rescued: 0 ignored: 0 2026-06-02 13:36:01.174917 | ubuntu-noble | ok: 17 changed: 12 unreachable: 0 failed: 0 skipped: 16 rescued: 0 ignored: 0 2026-06-02 13:36:01.175206 | 2026-06-02 13:36:01.334565 | RUN END RESULT_NORMAL: [untrusted : github.com/osism/zuul-jobs/playbooks/ansible-molecule/run.yaml@main] 2026-06-02 13:36:01.336042 | POST-RUN START: [untrusted : github.com/osism/ansible-collection-services/playbooks/collect-container-logs.yml@main] 2026-06-02 13:36:02.082760 | 2026-06-02 13:36:02.082968 | PLAY [Collect container logs] 2026-06-02 13:36:02.097978 | 2026-06-02 13:36:02.098103 | TASK [Create container log directory] 2026-06-02 13:36:02.735288 | debian-bookworm | changed 2026-06-02 13:36:02.784103 | ubuntu-noble | changed 2026-06-02 13:36:02.793236 | 2026-06-02 13:36:02.793403 | TASK [Capture container overview] 2026-06-02 13:36:03.370934 | debian-bookworm | ok: Runtime: 0:00:00.010308 2026-06-02 13:36:03.383511 | ubuntu-noble | ok: Runtime: 0:00:00.007486 2026-06-02 13:36:03.392449 | 2026-06-02 13:36:03.392579 | TASK [List containers] 2026-06-02 13:36:03.966970 | debian-bookworm | ok: ERROR (ignored) 2026-06-02 13:36:03.967615 | debian-bookworm | { 2026-06-02 13:36:03.967758 | debian-bookworm | "failed_when_result": false, 2026-06-02 13:36:03.967832 | debian-bookworm | "msg": "[Errno 2] No such file or directory: b'docker'", 2026-06-02 13:36:03.967909 | debian-bookworm | "rc": 2 2026-06-02 13:36:03.967966 | debian-bookworm | } 2026-06-02 13:36:03.981043 | ubuntu-noble | ok: ERROR (ignored) 2026-06-02 13:36:03.981240 | ubuntu-noble | { 2026-06-02 13:36:03.981297 | ubuntu-noble | "failed_when_result": false, 2026-06-02 13:36:03.981337 | ubuntu-noble | "msg": "[Errno 2] No such file or directory: b'docker'", 2026-06-02 13:36:03.981373 | ubuntu-noble | "rc": 2 2026-06-02 13:36:03.981405 | ubuntu-noble | } 2026-06-02 13:36:03.989146 | 2026-06-02 13:36:03.989290 | LOOP [Save per-container logs] 2026-06-02 13:36:04.069353 | 2026-06-02 13:36:04.069695 | LOOP [Save per-container inspect (state and health)] 2026-06-02 13:36:04.152865 | 2026-06-02 13:36:04.153167 | TASK [Open container log permissions] 2026-06-02 13:36:04.429994 | debian-bookworm | ok 2026-06-02 13:36:04.491617 | ubuntu-noble | changed 2026-06-02 13:36:04.494271 | 2026-06-02 13:36:04.494374 | PLAY RECAP 2026-06-02 13:36:04.494500 | debian-bookworm | ok: 4 changed: 1 unreachable: 0 failed: 0 skipped: 2 rescued: 0 ignored: 0 2026-06-02 13:36:04.494555 | ubuntu-noble | ok: 4 changed: 2 unreachable: 0 failed: 0 skipped: 2 rescued: 0 ignored: 0 2026-06-02 13:36:04.494587 | 2026-06-02 13:36:04.630576 | POST-RUN END RESULT_NORMAL: [untrusted : github.com/osism/ansible-collection-services/playbooks/collect-container-logs.yml@main] 2026-06-02 13:36:04.634143 | POST-RUN START: [trusted : github.com/osism/zuul-config/playbooks/base/post-fetch.yaml@main] 2026-06-02 13:36:05.425910 | 2026-06-02 13:36:05.426079 | PLAY [Base post-fetch] 2026-06-02 13:36:05.440341 | 2026-06-02 13:36:05.440475 | TASK [fetch-output : Set log path for multiple nodes] 2026-06-02 13:36:05.513195 | debian-bookworm | ok 2026-06-02 13:36:05.528381 | ubuntu-noble | ok 2026-06-02 13:36:05.533335 | 2026-06-02 13:36:05.533466 | TASK [fetch-output : Set log path for single node] 2026-06-02 13:36:05.568600 | debian-bookworm | skipping: Conditional result was False 2026-06-02 13:36:05.569379 | ubuntu-noble | skipping: Conditional result was False 2026-06-02 13:36:05.575514 | 2026-06-02 13:36:05.575644 | LOOP [fetch-output : Ensure local output dirs] 2026-06-02 13:36:06.063470 | ubuntu-noble -> localhost | changed: "/var/lib/zuul/builds/289bcbed15f346aa938a30f6511b3f95/work/logs/ubuntu-noble" 2026-06-02 13:36:06.079664 | debian-bookworm -> localhost | changed: "/var/lib/zuul/builds/289bcbed15f346aa938a30f6511b3f95/work/logs/debian-bookworm" 2026-06-02 13:36:06.362233 | debian-bookworm -> localhost | changed: "/var/lib/zuul/builds/289bcbed15f346aa938a30f6511b3f95/work/artifacts" 2026-06-02 13:36:06.377501 | ubuntu-noble -> localhost | ok: "/var/lib/zuul/builds/289bcbed15f346aa938a30f6511b3f95/work/artifacts" 2026-06-02 13:36:06.632942 | debian-bookworm -> localhost | changed: "/var/lib/zuul/builds/289bcbed15f346aa938a30f6511b3f95/work/docs" 2026-06-02 13:36:06.637380 | ubuntu-noble -> localhost | ok: "/var/lib/zuul/builds/289bcbed15f346aa938a30f6511b3f95/work/docs" 2026-06-02 13:36:06.651139 | 2026-06-02 13:36:06.651331 | LOOP [fetch-output : Collect logs, artifacts and docs] 2026-06-02 13:36:07.449827 | ubuntu-noble | changed: 2026-06-02 13:36:07.450345 | ubuntu-noble | .d..t...... ./ 2026-06-02 13:36:07.450423 | ubuntu-noble | >f+++++++++ sudo-debug.txt 2026-06-02 13:36:07.450472 | ubuntu-noble | >f+++++++++ sudo-strace.log 2026-06-02 13:36:07.450508 | ubuntu-noble | >f+++++++++ sudo-strace.log.time 2026-06-02 13:36:07.450538 | ubuntu-noble | cd+++++++++ container-logs/ 2026-06-02 13:36:07.450566 | ubuntu-noble | >f+++++++++ container-logs/_overview.txt 2026-06-02 13:36:07.450626 | ubuntu-noble | changed: All items complete 2026-06-02 13:36:07.450663 | 2026-06-02 13:36:07.465868 | debian-bookworm | changed: 2026-06-02 13:36:07.466018 | debian-bookworm | .d..t...... ./ 2026-06-02 13:36:07.466072 | debian-bookworm | >f+++++++++ sudo-debug.txt 2026-06-02 13:36:07.466113 | debian-bookworm | >f+++++++++ sudo-strace.log 2026-06-02 13:36:07.466150 | debian-bookworm | >f+++++++++ sudo-strace.log.time 2026-06-02 13:36:07.466194 | debian-bookworm | cd+++++++++ container-logs/ 2026-06-02 13:36:07.466230 | debian-bookworm | >f+++++++++ container-logs/_overview.txt 2026-06-02 13:36:08.030291 | ubuntu-noble | changed: .d..t...... ./ 2026-06-02 13:36:08.043610 | debian-bookworm | ok 2026-06-02 13:36:08.616085 | ubuntu-noble | changed: .d..t...... ./ 2026-06-02 13:36:08.681117 | debian-bookworm | ok 2026-06-02 13:36:08.720479 | 2026-06-02 13:36:08.720636 | LOOP [merge-output-to-logs : Move artifacts and docs to logs dir] 2026-06-02 13:36:09.256696 | debian-bookworm -> localhost | ok: Item: artifacts Runtime: 0:00:00.011883 2026-06-02 13:36:09.256981 | debian-bookworm -> localhost | changed: All items complete 2026-06-02 13:36:09.257018 | 2026-06-02 13:36:09.598545 | debian-bookworm -> localhost | ok: Item: docs Runtime: 0:00:00.010389 2026-06-02 13:36:09.618266 | 2026-06-02 13:36:09.618368 | PLAY RECAP 2026-06-02 13:36:09.618419 | debian-bookworm | ok: 4 changed: 3 unreachable: 0 failed: 0 skipped: 1 rescued: 0 ignored: 0 2026-06-02 13:36:09.618454 | ubuntu-noble | ok: 3 changed: 2 unreachable: 0 failed: 0 skipped: 1 rescued: 0 ignored: 0 2026-06-02 13:36:09.618475 | 2026-06-02 13:36:09.749093 | POST-RUN END RESULT_NORMAL: [trusted : github.com/osism/zuul-config/playbooks/base/post-fetch.yaml@main] 2026-06-02 13:36:09.752824 | POST-RUN START: [trusted : github.com/osism/zuul-config/playbooks/base/post.yaml@main] 2026-06-02 13:36:10.551011 | 2026-06-02 13:36:10.551191 | PLAY [Base post] 2026-06-02 13:36:10.565444 | 2026-06-02 13:36:10.565596 | TASK [remove-build-sshkey : Remove the build SSH key from all nodes] 2026-06-02 13:36:11.361702 | debian-bookworm | changed 2026-06-02 13:36:11.471976 | ubuntu-noble | changed 2026-06-02 13:36:11.483204 | 2026-06-02 13:36:11.483345 | PLAY RECAP 2026-06-02 13:36:11.483443 | debian-bookworm | ok: 1 changed: 1 unreachable: 0 failed: 0 skipped: 0 rescued: 0 ignored: 0 2026-06-02 13:36:11.483483 | ubuntu-noble | ok: 1 changed: 1 unreachable: 0 failed: 0 skipped: 0 rescued: 0 ignored: 0 2026-06-02 13:36:11.483510 | 2026-06-02 13:36:11.628536 | POST-RUN END RESULT_NORMAL: [trusted : github.com/osism/zuul-config/playbooks/base/post.yaml@main] 2026-06-02 13:36:11.631703 | POST-RUN START: [trusted : github.com/osism/zuul-config/playbooks/base/post-logs.yaml@main] 2026-06-02 13:36:12.448101 | 2026-06-02 13:36:12.448287 | PLAY [Base post-logs] 2026-06-02 13:36:12.459248 | 2026-06-02 13:36:12.459380 | TASK [generate-zuul-manifest : Generate Zuul manifest] 2026-06-02 13:36:12.944153 | localhost | changed 2026-06-02 13:36:12.962265 | 2026-06-02 13:36:12.962491 | TASK [generate-zuul-manifest : Return Zuul manifest URL to Zuul] 2026-06-02 13:36:13.001072 | localhost | ok 2026-06-02 13:36:13.008220 | 2026-06-02 13:36:13.008371 | TASK [Set zuul-log-path fact] 2026-06-02 13:36:13.028608 | localhost | ok 2026-06-02 13:36:13.041052 | 2026-06-02 13:36:13.041192 | TASK [set-zuul-log-path-fact : Set log path for a build] 2026-06-02 13:36:13.068130 | localhost | ok 2026-06-02 13:36:13.071588 | 2026-06-02 13:36:13.071720 | TASK [upload-logs : Create log directories] 2026-06-02 13:36:13.648111 | localhost | changed 2026-06-02 13:36:13.651666 | 2026-06-02 13:36:13.651799 | TASK [upload-logs : Ensure logs are readable before uploading] 2026-06-02 13:36:14.205032 | localhost -> localhost | ok: Runtime: 0:00:00.007195 2026-06-02 13:36:14.210234 | 2026-06-02 13:36:14.210357 | TASK [upload-logs : Upload logs to log server] 2026-06-02 13:36:14.820882 | localhost | Output suppressed because no_log was given 2026-06-02 13:36:14.825709 | 2026-06-02 13:36:14.825923 | LOOP [upload-logs : Compress console log and json output] 2026-06-02 13:36:14.887411 | localhost | skipping: Conditional result was False 2026-06-02 13:36:14.893895 | localhost | skipping: Conditional result was False 2026-06-02 13:36:14.897526 | 2026-06-02 13:36:14.897644 | LOOP [upload-logs : Upload compressed console log and json output] 2026-06-02 13:36:14.957518 | localhost | skipping: Conditional result was False 2026-06-02 13:36:14.958149 | 2026-06-02 13:36:14.961391 | localhost | skipping: Conditional result was False 2026-06-02 13:36:14.966150 | 2026-06-02 13:36:14.966311 | LOOP [upload-logs : Upload console log and json output]