2026-05-14 18:49:24.027420 | Job console starting 2026-05-14 18:49:24.066605 | Updating git repos 2026-05-14 18:49:24.144428 | Cloning repos into workspace 2026-05-14 18:49:24.208100 | Restoring repo states 2026-05-14 18:49:24.237054 | Merging changes 2026-05-14 18:49:24.879996 | Checking out repos 2026-05-14 18:49:24.976116 | Preparing playbooks 2026-05-14 18:49:25.734920 | Running Ansible setup 2026-05-14 18:49:32.560567 | PRE-RUN START: [trusted : github.com/osism/zuul-config/playbooks/base/pre.yaml@main] 2026-05-14 18:49:33.405044 | 2026-05-14 18:49:33.405215 | PLAY [Base pre] 2026-05-14 18:49:33.425057 | 2026-05-14 18:49:33.425238 | TASK [Setup log path fact] 2026-05-14 18:49:33.466439 | debian-bookworm | ok 2026-05-14 18:49:33.487064 | 2026-05-14 18:49:33.487227 | TASK [set-zuul-log-path-fact : Set log path for a build] 2026-05-14 18:49:33.530166 | debian-bookworm | ok 2026-05-14 18:49:33.547079 | 2026-05-14 18:49:33.547218 | TASK [emit-job-header : Print job information] 2026-05-14 18:49:33.599915 | # Job Information 2026-05-14 18:49:33.600161 | Ansible Version: 2.16.14 2026-05-14 18:49:33.600206 | Job: ansible-collection-services-molecule-auditd 2026-05-14 18:49:33.600246 | Pipeline: check 2026-05-14 18:49:33.600277 | Executor: 521e9411259a 2026-05-14 18:49:33.600304 | Triggered by: https://github.com/osism/ansible-collection-services/pull/2081 2026-05-14 18:49:33.600333 | Event ID: 49a27050-4fc5-11f1-847f-e1bdb43b56a2 2026-05-14 18:49:33.607333 | 2026-05-14 18:49:33.607514 | LOOP [emit-job-header : Print node information] 2026-05-14 18:49:33.734202 | debian-bookworm | ok: 2026-05-14 18:49:33.735224 | debian-bookworm | # Node Information 2026-05-14 18:49:33.735323 | debian-bookworm | Inventory Hostname: debian-bookworm 2026-05-14 18:49:33.735368 | debian-bookworm | Hostname: debian 2026-05-14 18:49:33.735406 | debian-bookworm | Username: zuul 2026-05-14 18:49:33.735442 | debian-bookworm | Distro: Debian 12.13 2026-05-14 18:49:33.735542 | debian-bookworm | Provider: regiocloud-a 2026-05-14 18:49:33.735583 | debian-bookworm | Region: 2026-05-14 18:49:33.735619 | debian-bookworm | Label: debian-bookworm 2026-05-14 18:49:33.735652 | debian-bookworm | Product Name: OpenStack Nova 2026-05-14 18:49:33.735684 | debian-bookworm | Interface IP: 2a13:1a81:8000:3124:f816:3eff:fe86:fde1 2026-05-14 18:49:33.800236 | debian-bookworm | ok: 2026-05-14 18:49:33.800439 | debian-bookworm | # Node Information 2026-05-14 18:49:33.800572 | debian-bookworm | Inventory Hostname: ubuntu-noble 2026-05-14 18:49:33.800628 | debian-bookworm | Hostname: ubuntu 2026-05-14 18:49:33.800682 | debian-bookworm | Username: zuul 2026-05-14 18:49:33.800728 | debian-bookworm | Distro: Ubuntu 24.04 2026-05-14 18:49:33.800770 | debian-bookworm | Provider: regiocloud-a 2026-05-14 18:49:33.800811 | debian-bookworm | Region: 2026-05-14 18:49:33.800853 | debian-bookworm | Label: ubuntu-noble 2026-05-14 18:49:33.800893 | debian-bookworm | Product Name: OpenStack Nova 2026-05-14 18:49:33.800933 | debian-bookworm | Interface IP: 2a13:1a81:8000:3124:f816:3eff:fe1b:14f4 2026-05-14 18:49:33.822398 | 2026-05-14 18:49:33.822579 | TASK [log-inventory : Ensure Zuul Ansible directory exists] 2026-05-14 18:49:34.308131 | debian-bookworm -> localhost | changed 2026-05-14 18:49:34.324658 | 2026-05-14 18:49:34.324832 | TASK [log-inventory : Copy ansible inventory to logs dir] 2026-05-14 18:49:35.437711 | debian-bookworm -> localhost | changed 2026-05-14 18:49:35.449857 | ubuntu-noble -> localhost | ok 2026-05-14 18:49:35.465440 | 2026-05-14 18:49:35.465605 | TASK [add-build-sshkey : Check to see if ssh key was already created for this build] 2026-05-14 18:49:35.764073 | debian-bookworm -> localhost | ok 2026-05-14 18:49:35.771277 | 2026-05-14 18:49:35.771490 | TASK [add-build-sshkey : Create a new key in workspace based on build UUID] 2026-05-14 18:49:35.824122 | debian-bookworm | ok 2026-05-14 18:49:35.828631 | ubuntu-noble | ok 2026-05-14 18:49:35.849827 | debian-bookworm | included: /var/lib/zuul/builds/6f3b451f1e134b72a0f318ea9875401f/trusted/project_1/github.com/osism/openinfra-zuul-jobs/roles/add-build-sshkey/tasks/create-key-and-replace.yaml 2026-05-14 18:49:35.849943 | ubuntu-noble | included: /var/lib/zuul/builds/6f3b451f1e134b72a0f318ea9875401f/trusted/project_1/github.com/osism/openinfra-zuul-jobs/roles/add-build-sshkey/tasks/create-key-and-replace.yaml 2026-05-14 18:49:35.856626 | 2026-05-14 18:49:35.856730 | TASK [add-build-sshkey : Create Temp SSH key] 2026-05-14 18:49:37.289141 | debian-bookworm -> localhost | Generating public/private rsa key pair. 2026-05-14 18:49:37.289685 | debian-bookworm -> localhost | Your identification has been saved in /var/lib/zuul/builds/6f3b451f1e134b72a0f318ea9875401f/work/6f3b451f1e134b72a0f318ea9875401f_id_rsa 2026-05-14 18:49:37.289779 | debian-bookworm -> localhost | Your public key has been saved in /var/lib/zuul/builds/6f3b451f1e134b72a0f318ea9875401f/work/6f3b451f1e134b72a0f318ea9875401f_id_rsa.pub 2026-05-14 18:49:37.289840 | debian-bookworm -> localhost | The key fingerprint is: 2026-05-14 18:49:37.289902 | debian-bookworm -> localhost | SHA256:SpLaP0WSNYi57FqszlIreKWvAmff4e3QdgoDkJX90Bs zuul-build-sshkey 2026-05-14 18:49:37.289956 | debian-bookworm -> localhost | The key's randomart image is: 2026-05-14 18:49:37.290015 | debian-bookworm -> localhost | +---[RSA 3072]----+ 2026-05-14 18:49:37.290065 | debian-bookworm -> localhost | | .= o | 2026-05-14 18:49:37.290114 | debian-bookworm -> localhost | | o+ + E | 2026-05-14 18:49:37.290161 | debian-bookworm -> localhost | | o. . = + | 2026-05-14 18:49:37.290207 | debian-bookworm -> localhost | | .o.o + | 2026-05-14 18:49:37.290252 | debian-bookworm -> localhost | | o+ .oS | 2026-05-14 18:49:37.290297 | debian-bookworm -> localhost | |. +o=+.o. | 2026-05-14 18:49:37.290342 | debian-bookworm -> localhost | |o+.O.o=+o . | 2026-05-14 18:49:37.290387 | debian-bookworm -> localhost | |=.* ..+=.o | 2026-05-14 18:49:37.290432 | debian-bookworm -> localhost | | *+o. .oo | 2026-05-14 18:49:37.290557 | debian-bookworm -> localhost | +----[SHA256]-----+ 2026-05-14 18:49:37.290703 | debian-bookworm -> localhost | ok: Runtime: 0:00:00.911225 2026-05-14 18:49:37.305307 | 2026-05-14 18:49:37.305438 | TASK [add-build-sshkey : Remote setup ssh keys (linux)] 2026-05-14 18:49:37.339317 | debian-bookworm | ok 2026-05-14 18:49:37.354417 | ubuntu-noble | ok 2026-05-14 18:49:37.370338 | debian-bookworm | included: /var/lib/zuul/builds/6f3b451f1e134b72a0f318ea9875401f/trusted/project_1/github.com/osism/openinfra-zuul-jobs/roles/add-build-sshkey/tasks/remote-linux.yaml 2026-05-14 18:49:37.370446 | ubuntu-noble | included: /var/lib/zuul/builds/6f3b451f1e134b72a0f318ea9875401f/trusted/project_1/github.com/osism/openinfra-zuul-jobs/roles/add-build-sshkey/tasks/remote-linux.yaml 2026-05-14 18:49:37.382033 | 2026-05-14 18:49:37.382147 | TASK [add-build-sshkey : Remove previously added zuul-build-sshkey] 2026-05-14 18:49:37.410914 | debian-bookworm | skipping: Conditional result was False 2026-05-14 18:49:37.421899 | ubuntu-noble | skipping: Conditional result was False 2026-05-14 18:49:37.429211 | 2026-05-14 18:49:37.429325 | TASK [add-build-sshkey : Enable access via build key on all nodes] 2026-05-14 18:49:38.101455 | debian-bookworm | changed 2026-05-14 18:49:38.206935 | ubuntu-noble | changed 2026-05-14 18:49:38.217065 | 2026-05-14 18:49:38.217247 | TASK [add-build-sshkey : Make sure user has a .ssh] 2026-05-14 18:49:38.506044 | debian-bookworm | ok 2026-05-14 18:49:38.550977 | ubuntu-noble | ok 2026-05-14 18:49:38.561516 | 2026-05-14 18:49:38.561679 | TASK [add-build-sshkey : Install build private key as SSH key on all nodes] 2026-05-14 18:49:39.237239 | debian-bookworm | changed 2026-05-14 18:49:39.319604 | ubuntu-noble | changed 2026-05-14 18:49:39.328737 | 2026-05-14 18:49:39.328901 | TASK [add-build-sshkey : Install build public key as SSH key on all nodes] 2026-05-14 18:49:40.089131 | debian-bookworm | changed 2026-05-14 18:49:40.106110 | ubuntu-noble | changed 2026-05-14 18:49:40.112484 | 2026-05-14 18:49:40.112616 | TASK [add-build-sshkey : Remote setup ssh keys (windows)] 2026-05-14 18:49:40.141812 | debian-bookworm | skipping: Conditional result was False 2026-05-14 18:49:40.152955 | ubuntu-noble | skipping: Conditional result was False 2026-05-14 18:49:40.160024 | 2026-05-14 18:49:40.160144 | TASK [remove-zuul-sshkey : Remove master key from local agent] 2026-05-14 18:49:40.580228 | debian-bookworm -> localhost | changed 2026-05-14 18:49:40.597970 | 2026-05-14 18:49:40.598119 | TASK [add-build-sshkey : Add back temp key] 2026-05-14 18:49:40.944287 | debian-bookworm -> localhost | Identity added: /var/lib/zuul/builds/6f3b451f1e134b72a0f318ea9875401f/work/6f3b451f1e134b72a0f318ea9875401f_id_rsa (zuul-build-sshkey) 2026-05-14 18:49:40.944662 | debian-bookworm -> localhost | ok: Runtime: 0:00:00.017654 2026-05-14 18:49:40.954553 | 2026-05-14 18:49:40.954678 | TASK [add-build-sshkey : Verify we can still SSH to all nodes] 2026-05-14 18:49:41.337342 | debian-bookworm | ok 2026-05-14 18:49:41.381086 | ubuntu-noble | ok 2026-05-14 18:49:41.391210 | 2026-05-14 18:49:41.391378 | TASK [add-build-sshkey : Verify we can still SSH to all nodes (windows)] 2026-05-14 18:49:41.419660 | debian-bookworm | skipping: Conditional result was False 2026-05-14 18:49:41.430781 | ubuntu-noble | skipping: Conditional result was False 2026-05-14 18:49:41.448186 | 2026-05-14 18:49:41.448306 | TASK [start-zuul-console : Start zuul_console daemon.] 2026-05-14 18:49:41.858020 | debian-bookworm | ok 2026-05-14 18:49:41.912149 | ubuntu-noble | ok 2026-05-14 18:49:41.936798 | 2026-05-14 18:49:41.936982 | TASK [validate-host : Define zuul_info_dir fact] 2026-05-14 18:49:41.972662 | debian-bookworm | ok 2026-05-14 18:49:41.988032 | ubuntu-noble | ok 2026-05-14 18:49:41.993405 | 2026-05-14 18:49:41.993540 | TASK [validate-host : Ensure Zuul Ansible directory exists] 2026-05-14 18:49:42.306818 | debian-bookworm -> localhost | ok 2026-05-14 18:49:42.314646 | 2026-05-14 18:49:42.314774 | TASK [validate-host : Collect information about the host] 2026-05-14 18:49:43.542866 | debian-bookworm | ok 2026-05-14 18:49:43.579502 | ubuntu-noble | ok 2026-05-14 18:49:43.600654 | 2026-05-14 18:49:43.600810 | TASK [validate-host : Sanitize hostname] 2026-05-14 18:49:43.681266 | ubuntu-noble | ok 2026-05-14 18:49:43.708698 | debian-bookworm | ok 2026-05-14 18:49:43.714818 | 2026-05-14 18:49:43.715035 | TASK [validate-host : Write out all ansible variables/facts known for each host] 2026-05-14 18:49:44.432813 | ubuntu-noble -> localhost | changed 2026-05-14 18:49:44.585905 | debian-bookworm -> localhost | changed 2026-05-14 18:49:44.592369 | 2026-05-14 18:49:44.592513 | TASK [validate-host : Collect information about zuul worker] 2026-05-14 18:49:45.113301 | debian-bookworm | ok 2026-05-14 18:49:45.184828 | ubuntu-noble | ok 2026-05-14 18:49:45.194597 | 2026-05-14 18:49:45.194803 | TASK [validate-host : Write out all zuul information for each host] 2026-05-14 18:49:45.893856 | ubuntu-noble -> localhost | changed 2026-05-14 18:49:45.919416 | debian-bookworm -> localhost | changed 2026-05-14 18:49:45.937394 | 2026-05-14 18:49:45.937588 | TASK [prepare-workspace-log : Start zuul_console daemon.] 2026-05-14 18:49:46.227929 | debian-bookworm | ok 2026-05-14 18:49:46.275022 | ubuntu-noble | ok 2026-05-14 18:49:46.281983 | 2026-05-14 18:49:46.282122 | TASK [prepare-workspace-log : Synchronize src repos to workspace directory.] 2026-05-14 18:49:47.548531 | ubuntu-noble | changed: 2026-05-14 18:49:47.548801 | ubuntu-noble | cd+++++++++ src/ 2026-05-14 18:49:47.548836 | ubuntu-noble | cd+++++++++ src/github.com/ 2026-05-14 18:49:47.548860 | ubuntu-noble | cd+++++++++ src/github.com/osism/ 2026-05-14 18:49:47.548881 | ubuntu-noble | cd+++++++++ src/github.com/osism/ansible-collection-services/ 2026-05-14 18:49:47.548903 | ubuntu-noble | config] provisioner.env found in /home/zuul/src/github.com/osism/ansible-collection-services/molecule/delegated/molecule.yml, this can be defined in ansible.env 2026-05-14 18:51:03.877503 | debian-bookworm | WARNING Molecule scenarios should migrate to 'extensions/molecule' 2026-05-14 18:51:03.917015 | debian-bookworm | DEBUG [unknown > config] provisioner.env found in /home/zuul/src/github.com/osism/ansible-collection-services/molecule/delegated/molecule.yml, this can be defined in ansible.env 2026-05-14 18:51:04.652822 | ubuntu-noble | DEBUG [unknown > config] provisioner.env found in /home/zuul/src/github.com/osism/ansible-collection-services/molecule/delegated/molecule.yml, this can be defined in ansible.env 2026-05-14 18:51:04.654451 | ubuntu-noble | DEBUG [delegated > validate] Validating schema /home/zuul/src/github.com/osism/ansible-collection-services/molecule/delegated/molecule.yml. 2026-05-14 18:51:04.666487 | ubuntu-noble | CRITICAL 'molecule/default/molecule.yml' glob failed. Exiting. 2026-05-14 18:51:04.666645 | ubuntu-noble | INFO default scenario not found, disabling shared state. 2026-05-14 18:51:04.666936 | ubuntu-noble | INFO [delegated > discovery] scenario test matrix: dependency 2026-05-14 18:51:04.667073 | ubuntu-noble | INFO [delegated > prerun] Performing prerun with role_name_check=0... 2026-05-14 18:51:04.529692 | debian-bookworm | DEBUG [unknown > config] provisioner.env found in /home/zuul/src/github.com/osism/ansible-collection-services/molecule/delegated/molecule.yml, this can be defined in ansible.env 2026-05-14 18:51:04.530449 | debian-bookworm | DEBUG [delegated > validate] Validating schema /home/zuul/src/github.com/osism/ansible-collection-services/molecule/delegated/molecule.yml. 2026-05-14 18:51:04.540749 | debian-bookworm | CRITICAL 'molecule/default/molecule.yml' glob failed. Exiting. 2026-05-14 18:51:04.540893 | debian-bookworm | INFO default scenario not found, disabling shared state. 2026-05-14 18:51:04.541134 | debian-bookworm | INFO [delegated > discovery] scenario test matrix: dependency 2026-05-14 18:51:04.541298 | debian-bookworm | INFO [delegated > prerun] Performing prerun with role_name_check=0... 2026-05-14 18:51:05.761304 | debian-bookworm | INFO [delegated > dependency] Executing 2026-05-14 18:51:05.762230 | debian-bookworm | WARNING [delegated > dependency] Missing roles requirements file: requirements.yml 2026-05-14 18:51:06.016464 | ubuntu-noble | INFO [delegated > dependency] Executing 2026-05-14 18:51:06.018008 | ubuntu-noble | WARNING [delegated > dependency] Missing roles requirements file: requirements.yml 2026-05-14 18:51:06.125729 | debian-bookworm | ansible-galaxy [core 2.18.16] 2026-05-14 18:51:06.125820 | debian-bookworm | config file = None 2026-05-14 18:51:06.125836 | debian-bookworm | configured module search path = ['/home/zuul/src/github.com/osism/ansible-collection-services/plugins/modules', '/home/zuul/.ansible/plugins/modules', '/usr/share/ansible/plugins/modules'] 2026-05-14 18:51:06.125850 | debian-bookworm | ansible python module location = /home/zuul/venv/lib/python3.11/site-packages/ansible 2026-05-14 18:51:06.125870 | debian-bookworm | ansible collection location = /home/zuul/.ansible/collections:/usr/share/ansible/collections:/home/zuul/venv/lib/python3.11/site-packages:/home/zuul/venv/lib/python3.11/dist-packages:/home/zuul/venv/lib/python3/dist-packages:/home/zuul/venv/local/lib/python3.11/dist-packages 2026-05-14 18:51:06.126266 | debian-bookworm | executable location = /home/zuul/venv/bin/ansible-galaxy 2026-05-14 18:51:06.126685 | debian-bookworm | python version = 3.11.2 (main, Apr 28 2025, 14:11:48) [GCC 12.2.0] (/home/zuul/venv/bin/python3) 2026-05-14 18:51:06.127085 | debian-bookworm | jinja version = 3.1.6 2026-05-14 18:51:06.127399 | debian-bookworm | libyaml = True 2026-05-14 18:51:06.127727 | debian-bookworm | No config file found; using defaults 2026-05-14 18:51:06.128208 | debian-bookworm | Reading requirement file at '/home/zuul/src/github.com/osism/ansible-collection-services/molecule/delegated/collections.yml' 2026-05-14 18:51:06.129829 | debian-bookworm | Loading collection vyos.vyos from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/vyos/vyos 2026-05-14 18:51:06.130264 | debian-bookworm | Found installed collection vyos.vyos:5.0.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/vyos/vyos' 2026-05-14 18:51:06.130730 | debian-bookworm | Loading collection community.library_inventory_filtering_v1 from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/library_inventory_filtering_v1 2026-05-14 18:51:06.131155 | debian-bookworm | Found installed collection community.library_inventory_filtering_v1:1.1.5 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/library_inventory_filtering_v1' 2026-05-14 18:51:06.131977 | debian-bookworm | Loading collection netapp.ontap from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/netapp/ontap 2026-05-14 18:51:06.132419 | debian-bookworm | Found installed collection netapp.ontap:22.14.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/netapp/ontap' 2026-05-14 18:51:06.132872 | debian-bookworm | Loading collection cisco.ucs from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/cisco/ucs 2026-05-14 18:51:06.133275 | debian-bookworm | Found installed collection cisco.ucs:1.16.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/cisco/ucs' 2026-05-14 18:51:06.134594 | debian-bookworm | Loading collection cisco.aci from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/cisco/aci 2026-05-14 18:51:06.134937 | debian-bookworm | Found installed collection cisco.aci:2.13.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/cisco/aci' 2026-05-14 18:51:06.135888 | debian-bookworm | Loading collection community.digitalocean from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/digitalocean 2026-05-14 18:51:06.136209 | debian-bookworm | Found installed collection community.digitalocean:1.27.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/digitalocean' 2026-05-14 18:51:06.137084 | debian-bookworm | Loading collection google.cloud from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/google/cloud 2026-05-14 18:51:06.137407 | debian-bookworm | Found installed collection google.cloud:1.10.2 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/google/cloud' 2026-05-14 18:51:06.137801 | debian-bookworm | Loading collection purestorage.flashblade from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/purestorage/flashblade 2026-05-14 18:51:06.138127 | debian-bookworm | Found installed collection purestorage.flashblade:1.22.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/purestorage/flashblade' 2026-05-14 18:51:06.138445 | debian-bookworm | Loading collection cloud.common from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/cloud/common 2026-05-14 18:51:06.138718 | debian-bookworm | Found installed collection cloud.common:4.2.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/cloud/common' 2026-05-14 18:51:06.140462 | debian-bookworm | Loading collection cisco.nxos from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/cisco/nxos 2026-05-14 18:51:06.140790 | debian-bookworm | Found installed collection cisco.nxos:9.4.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/cisco/nxos' 2026-05-14 18:51:06.143275 | debian-bookworm | Loading collection vmware.vmware_rest from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/vmware/vmware_rest 2026-05-14 18:51:06.143613 | debian-bookworm | Found installed collection vmware.vmware_rest:4.9.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/vmware/vmware_rest' 2026-05-14 18:51:06.143907 | debian-bookworm | Loading collection community.mongodb from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/mongodb 2026-05-14 18:51:06.144200 | debian-bookworm | Found installed collection community.mongodb:1.7.10 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/mongodb' 2026-05-14 18:51:06.148334 | debian-bookworm | Loading collection community.aws from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/aws 2026-05-14 18:51:06.148735 | debian-bookworm | Found installed collection community.aws:9.3.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/aws' 2026-05-14 18:51:06.149851 | debian-bookworm | Loading collection amazon.aws from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/amazon/aws 2026-05-14 18:51:06.153470 | debian-bookworm | Found installed collection amazon.aws:9.5.2 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/amazon/aws' 2026-05-14 18:51:06.154611 | debian-bookworm | Loading collection community.routeros from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/routeros 2026-05-14 18:51:06.154886 | debian-bookworm | Found installed collection community.routeros:3.14.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/routeros' 2026-05-14 18:51:06.155126 | debian-bookworm | Loading collection community.dns from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/dns 2026-05-14 18:51:06.155457 | debian-bookworm | Found installed collection community.dns:3.4.1 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/dns' 2026-05-14 18:51:06.155741 | debian-bookworm | Loading collection community.sops from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/sops 2026-05-14 18:51:06.155983 | debian-bookworm | Found installed collection community.sops:2.2.7 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/sops' 2026-05-14 18:51:06.156222 | debian-bookworm | Loading collection kaytus.ksmanage from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/kaytus/ksmanage 2026-05-14 18:51:06.156459 | debian-bookworm | Found installed collection kaytus.ksmanage:2.0.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/kaytus/ksmanage' 2026-05-14 18:51:06.156776 | debian-bookworm | Loading collection community.okd from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/okd 2026-05-14 18:51:06.156995 | debian-bookworm | Found installed collection community.okd:4.0.2 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/okd' 2026-05-14 18:51:06.157200 | debian-bookworm | Loading collection cisco.iosxr from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/cisco/iosxr 2026-05-14 18:51:06.157488 | debian-bookworm | Found installed collection cisco.iosxr:10.3.1 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/cisco/iosxr' 2026-05-14 18:51:06.157759 | debian-bookworm | Loading collection microsoft.ad from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/microsoft/ad 2026-05-14 18:51:06.157970 | debian-bookworm | Found installed collection microsoft.ad:1.10.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/microsoft/ad' 2026-05-14 18:51:06.190299 | debian-bookworm | Loading collection community.network from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/network 2026-05-14 18:51:06.190998 | debian-bookworm | Found installed collection community.network:5.1.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/network' 2026-05-14 18:51:06.191405 | debian-bookworm | Loading collection community.sap_libs from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/sap_libs 2026-05-14 18:51:06.191813 | debian-bookworm | Found installed collection community.sap_libs:1.5.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/sap_libs' 2026-05-14 18:51:06.192502 | debian-bookworm | Loading collection theforeman.foreman from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/theforeman/foreman 2026-05-14 18:51:06.192964 | debian-bookworm | Found installed collection theforeman.foreman:4.2.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/theforeman/foreman' 2026-05-14 18:51:06.193410 | debian-bookworm | Loading collection netapp_eseries.santricity from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/netapp_eseries/santricity 2026-05-14 18:51:06.193829 | debian-bookworm | Found installed collection netapp_eseries.santricity:1.4.1 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/netapp_eseries/santricity' 2026-05-14 18:51:06.194261 | debian-bookworm | Loading collection dellemc.powerflex from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/dellemc/powerflex 2026-05-14 18:51:06.194645 | debian-bookworm | Found installed collection dellemc.powerflex:2.6.1 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/dellemc/powerflex' 2026-05-14 18:51:06.195016 | debian-bookworm | Loading collection ansible.windows from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/ansible/windows 2026-05-14 18:51:06.195292 | debian-bookworm | Found installed collection ansible.windows:2.8.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/ansible/windows' 2026-05-14 18:51:06.198176 | debian-bookworm | Loading collection fortinet.fortios from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/fortinet/fortios 2026-05-14 18:51:06.198512 | debian-bookworm | Found installed collection fortinet.fortios:2.4.2 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/fortinet/fortios' 2026-05-14 18:51:06.198864 | debian-bookworm | Loading collection community.zabbix from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/zabbix 2026-05-14 18:51:06.199172 | debian-bookworm | Found installed collection community.zabbix:3.3.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/zabbix' 2026-05-14 18:51:06.199713 | debian-bookworm | Loading collection splunk.es from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/splunk/es 2026-05-14 18:51:06.200039 | debian-bookworm | Found installed collection splunk.es:4.0.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/splunk/es' 2026-05-14 18:51:06.200352 | debian-bookworm | Loading collection sensu.sensu_go from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/sensu/sensu_go 2026-05-14 18:51:06.200634 | debian-bookworm | Found installed collection sensu.sensu_go:1.14.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/sensu/sensu_go' 2026-05-14 18:51:06.200981 | debian-bookworm | Loading collection ibm.spectrum_virtualize from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/ibm/spectrum_virtualize 2026-05-14 18:51:06.201234 | debian-bookworm | Found installed collection ibm.spectrum_virtualize:2.0.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/ibm/spectrum_virtualize' 2026-05-14 18:51:06.201552 | debian-bookworm | Loading collection check_point.mgmt from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/check_point/mgmt 2026-05-14 18:51:06.201901 | debian-bookworm | Found installed collection check_point.mgmt:6.7.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/check_point/mgmt' 2026-05-14 18:51:06.202166 | debian-bookworm | Loading collection cisco.intersight from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/cisco/intersight 2026-05-14 18:51:06.202371 | debian-bookworm | Found installed collection cisco.intersight:2.12.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/cisco/intersight' 2026-05-14 18:51:06.204096 | debian-bookworm | Loading collection awx.awx from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/awx/awx 2026-05-14 18:51:06.204365 | debian-bookworm | Found installed collection awx.awx:24.6.1 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/awx/awx' 2026-05-14 18:51:06.204781 | debian-bookworm | Loading collection wti.remote from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/wti/remote 2026-05-14 18:51:06.205102 | debian-bookworm | Found installed collection wti.remote:1.0.10 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/wti/remote' 2026-05-14 18:51:06.205865 | debian-bookworm | Loading collection telekom_mms.icinga_director from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/telekom_mms/icinga_director 2026-05-14 18:51:06.206320 | debian-bookworm | Found installed collection telekom_mms.icinga_director:2.5.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/telekom_mms/icinga_director' 2026-05-14 18:51:06.206735 | debian-bookworm | Loading collection cisco.ios from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/cisco/ios 2026-05-14 18:51:06.207079 | debian-bookworm | Found installed collection cisco.ios:9.2.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/cisco/ios' 2026-05-14 18:51:06.207404 | debian-bookworm | Loading collection community.crypto from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/crypto 2026-05-14 18:51:06.207683 | debian-bookworm | Found installed collection community.crypto:2.26.6 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/crypto' 2026-05-14 18:51:06.208009 | debian-bookworm | Loading collection ieisystem.inmanage from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/ieisystem/inmanage 2026-05-14 18:51:06.208255 | debian-bookworm | Found installed collection ieisystem.inmanage:3.0.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/ieisystem/inmanage' 2026-05-14 18:51:06.208556 | debian-bookworm | Loading collection community.mysql from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/mysql 2026-05-14 18:51:06.208860 | debian-bookworm | Found installed collection community.mysql:3.16.1 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/mysql' 2026-05-14 18:51:06.209180 | debian-bookworm | Loading collection netbox.netbox from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/netbox/netbox 2026-05-14 18:51:06.209438 | debian-bookworm | Found installed collection netbox.netbox:3.21.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/netbox/netbox' 2026-05-14 18:51:06.209867 | debian-bookworm | Loading collection hitachivantara.vspone_object from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/hitachivantara/vspone_object 2026-05-14 18:51:06.210123 | debian-bookworm | Found installed collection hitachivantara.vspone_object:1.1.1 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/hitachivantara/vspone_object' 2026-05-14 18:51:06.210414 | debian-bookworm | Loading collection purestorage.flasharray from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/purestorage/flasharray 2026-05-14 18:51:06.211053 | debian-bookworm | Found installed collection purestorage.flasharray:1.40.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/purestorage/flasharray' 2026-05-14 18:51:06.211410 | debian-bookworm | Loading collection cisco.dnac from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/cisco/dnac 2026-05-14 18:51:06.211703 | debian-bookworm | Found installed collection cisco.dnac:6.31.3 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/cisco/dnac' 2026-05-14 18:51:06.211960 | debian-bookworm | Loading collection community.rabbitmq from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/rabbitmq 2026-05-14 18:51:06.212309 | debian-bookworm | Found installed collection community.rabbitmq:1.6.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/rabbitmq' 2026-05-14 18:51:06.212561 | debian-bookworm | Loading collection netapp.cloudmanager from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/netapp/cloudmanager 2026-05-14 18:51:06.212884 | debian-bookworm | Found installed collection netapp.cloudmanager:21.24.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/netapp/cloudmanager' 2026-05-14 18:51:06.213154 | debian-bookworm | Loading collection chocolatey.chocolatey from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/chocolatey/chocolatey 2026-05-14 18:51:06.213402 | debian-bookworm | Found installed collection chocolatey.chocolatey:1.5.3 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/chocolatey/chocolatey' 2026-05-14 18:51:06.213798 | debian-bookworm | Loading collection cloudscale_ch.cloud from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/cloudscale_ch/cloud 2026-05-14 18:51:06.214056 | debian-bookworm | Found installed collection cloudscale_ch.cloud:2.5.2 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/cloudscale_ch/cloud' 2026-05-14 18:51:06.218352 | debian-bookworm | Loading collection fortinet.fortimanager from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/fortinet/fortimanager 2026-05-14 18:51:06.218738 | debian-bookworm | Found installed collection fortinet.fortimanager:2.11.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/fortinet/fortimanager' 2026-05-14 18:51:06.219354 | debian-bookworm | Loading collection arista.eos from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/arista/eos 2026-05-14 18:51:06.219705 | debian-bookworm | Found installed collection arista.eos:10.1.1 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/arista/eos' 2026-05-14 18:51:06.221364 | debian-bookworm | Loading collection cisco.meraki from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/cisco/meraki 2026-05-14 18:51:06.221779 | debian-bookworm | Found installed collection cisco.meraki:2.21.9 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/cisco/meraki' 2026-05-14 18:51:06.222131 | debian-bookworm | Loading collection community.hashi_vault from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/hashi_vault 2026-05-14 18:51:06.222381 | debian-bookworm | Found installed collection community.hashi_vault:6.2.1 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/hashi_vault' 2026-05-14 18:51:06.223037 | debian-bookworm | Loading collection hetzner.hcloud from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/hetzner/hcloud 2026-05-14 18:51:06.223354 | debian-bookworm | Found installed collection hetzner.hcloud:4.3.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/hetzner/hcloud' 2026-05-14 18:51:06.223688 | debian-bookworm | Loading collection vultr.cloud from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/vultr/cloud 2026-05-14 18:51:06.224000 | debian-bookworm | Found installed collection vultr.cloud:1.13.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/vultr/cloud' 2026-05-14 18:51:06.224252 | debian-bookworm | Loading collection community.ciscosmb from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/ciscosmb 2026-05-14 18:51:06.224558 | debian-bookworm | Found installed collection community.ciscosmb:1.0.11 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/ciscosmb' 2026-05-14 18:51:06.226052 | debian-bookworm | Loading collection azure.azcollection from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/azure/azcollection 2026-05-14 18:51:06.226403 | debian-bookworm | Found installed collection azure.azcollection:3.12.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/azure/azcollection' 2026-05-14 18:51:06.226733 | debian-bookworm | Loading collection community.postgresql from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/postgresql 2026-05-14 18:51:06.227051 | debian-bookworm | Found installed collection community.postgresql:3.14.3 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/postgresql' 2026-05-14 18:51:06.227489 | debian-bookworm | Loading collection kubernetes.core from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/kubernetes/core 2026-05-14 18:51:06.227881 | debian-bookworm | Found installed collection kubernetes.core:5.4.1 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/kubernetes/core' 2026-05-14 18:51:06.228187 | debian-bookworm | Loading collection containers.podman from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/containers/podman 2026-05-14 18:51:06.228435 | debian-bookworm | Found installed collection containers.podman:1.18.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/containers/podman' 2026-05-14 18:51:06.228878 | debian-bookworm | Loading collection dellemc.unity from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/dellemc/unity 2026-05-14 18:51:06.229165 | debian-bookworm | Found installed collection dellemc.unity:2.1.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/dellemc/unity' 2026-05-14 18:51:06.229442 | debian-bookworm | Loading collection hitachivantara.vspone_block from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/hitachivantara/vspone_block 2026-05-14 18:51:06.229808 | debian-bookworm | Found installed collection hitachivantara.vspone_block:3.5.1 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/hitachivantara/vspone_block' 2026-05-14 18:51:06.230084 | debian-bookworm | Loading collection community.proxmox from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/proxmox 2026-05-14 18:51:06.230341 | debian-bookworm | Found installed collection community.proxmox:1.4.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/proxmox' 2026-05-14 18:51:06.230856 | debian-bookworm | Loading collection openstack.cloud from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/openstack/cloud 2026-05-14 18:51:06.231121 | debian-bookworm | Found installed collection openstack.cloud:2.5.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/openstack/cloud' 2026-05-14 18:51:06.231416 | debian-bookworm | Loading collection vmware.vmware from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/vmware/vmware 2026-05-14 18:51:06.231686 | debian-bookworm | Found installed collection vmware.vmware:1.11.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/vmware/vmware' 2026-05-14 18:51:06.231930 | debian-bookworm | Loading collection cisco.asa from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/cisco/asa 2026-05-14 18:51:06.232174 | debian-bookworm | Found installed collection cisco.asa:6.1.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/cisco/asa' 2026-05-14 18:51:06.232418 | debian-bookworm | Loading collection ansible.posix from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/ansible/posix 2026-05-14 18:51:06.232678 | debian-bookworm | Found installed collection ansible.posix:1.6.2 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/ansible/posix' 2026-05-14 18:51:06.232919 | debian-bookworm | Loading collection community.hrobot from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/hrobot 2026-05-14 18:51:06.233160 | debian-bookworm | Found installed collection community.hrobot:2.7.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/hrobot' 2026-05-14 18:51:06.234638 | debian-bookworm | Loading collection cisco.mso from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/cisco/mso 2026-05-14 18:51:06.234864 | debian-bookworm | Found installed collection cisco.mso:2.12.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/cisco/mso' 2026-05-14 18:51:06.235146 | debian-bookworm | Loading collection grafana.grafana from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/grafana/grafana 2026-05-14 18:51:06.235377 | debian-bookworm | Found installed collection grafana.grafana:5.7.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/grafana/grafana' 2026-05-14 18:51:06.235663 | debian-bookworm | Loading collection inspur.ispim from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/inspur/ispim 2026-05-14 18:51:06.235884 | debian-bookworm | Found installed collection inspur.ispim:2.2.4 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/inspur/ispim' 2026-05-14 18:51:06.236453 | debian-bookworm | Loading collection ovirt.ovirt from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/ovirt/ovirt 2026-05-14 18:51:06.236691 | debian-bookworm | Found installed collection ovirt.ovirt:3.2.1 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/ovirt/ovirt' 2026-05-14 18:51:06.236903 | debian-bookworm | Loading collection microsoft.iis from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/microsoft/iis 2026-05-14 18:51:06.237122 | debian-bookworm | Found installed collection microsoft.iis:1.1.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/microsoft/iis' 2026-05-14 18:51:06.237335 | debian-bookworm | Loading collection community.libvirt from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/libvirt 2026-05-14 18:51:06.237549 | debian-bookworm | Found installed collection community.libvirt:1.4.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/libvirt' 2026-05-14 18:51:06.245992 | debian-bookworm | Loading collection community.general from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/general 2026-05-14 18:51:06.246252 | debian-bookworm | Found installed collection community.general:10.7.6 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/general' 2026-05-14 18:51:06.247211 | debian-bookworm | Loading collection ansible.netcommon from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/ansible/netcommon 2026-05-14 18:51:06.247444 | debian-bookworm | Found installed collection ansible.netcommon:7.2.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/ansible/netcommon' 2026-05-14 18:51:06.247693 | debian-bookworm | Loading collection community.proxysql from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/proxysql 2026-05-14 18:51:06.247923 | debian-bookworm | Found installed collection community.proxysql:1.7.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/proxysql' 2026-05-14 18:51:06.248219 | debian-bookworm | Loading collection f5networks.f5_modules from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/f5networks/f5_modules 2026-05-14 18:51:06.248453 | debian-bookworm | Found installed collection f5networks.f5_modules:1.39.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/f5networks/f5_modules' 2026-05-14 18:51:06.248701 | debian-bookworm | Loading collection ansible.utils from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/ansible/utils 2026-05-14 18:51:06.248931 | debian-bookworm | Found installed collection ansible.utils:5.1.2 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/ansible/utils' 2026-05-14 18:51:06.249365 | debian-bookworm | Loading collection ngine_io.cloudstack from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/ngine_io/cloudstack 2026-05-14 18:51:06.249616 | debian-bookworm | Found installed collection ngine_io.cloudstack:2.5.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/ngine_io/cloudstack' 2026-05-14 18:51:06.250219 | debian-bookworm | Loading collection dellemc.enterprise_sonic from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/dellemc/enterprise_sonic 2026-05-14 18:51:06.250463 | debian-bookworm | Found installed collection dellemc.enterprise_sonic:2.5.1 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/dellemc/enterprise_sonic' 2026-05-14 18:51:06.250786 | debian-bookworm | Loading collection community.grafana from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/grafana 2026-05-14 18:51:06.251019 | debian-bookworm | Found installed collection community.grafana:2.3.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/grafana' 2026-05-14 18:51:06.251423 | debian-bookworm | Loading collection community.windows from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/windows 2026-05-14 18:51:06.251701 | debian-bookworm | Found installed collection community.windows:2.4.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/windows' 2026-05-14 18:51:06.251933 | debian-bookworm | Loading collection ravendb.ravendb from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/ravendb/ravendb 2026-05-14 18:51:06.252168 | debian-bookworm | Found installed collection ravendb.ravendb:1.0.4 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/ravendb/ravendb' 2026-05-14 18:51:06.252488 | debian-bookworm | Loading collection community.docker from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/docker 2026-05-14 18:51:06.252752 | debian-bookworm | Found installed collection community.docker:4.8.5 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/docker' 2026-05-14 18:51:06.252985 | debian-bookworm | Loading collection kubevirt.core from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/kubevirt/core 2026-05-14 18:51:06.253214 | debian-bookworm | Found installed collection kubevirt.core:2.2.3 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/kubevirt/core' 2026-05-14 18:51:06.253441 | debian-bookworm | Loading collection netapp.storagegrid from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/netapp/storagegrid 2026-05-14 18:51:06.253725 | debian-bookworm | Found installed collection netapp.storagegrid:21.14.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/netapp/storagegrid' 2026-05-14 18:51:06.254704 | debian-bookworm | Loading collection junipernetworks.junos from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/junipernetworks/junos 2026-05-14 18:51:06.254934 | debian-bookworm | Found installed collection junipernetworks.junos:9.1.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/junipernetworks/junos' 2026-05-14 18:51:06.255210 | debian-bookworm | Loading collection infinidat.infinibox from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/infinidat/infinibox 2026-05-14 18:51:06.255434 | debian-bookworm | Found installed collection infinidat.infinibox:1.6.3 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/infinidat/infinibox' 2026-05-14 18:51:06.256889 | debian-bookworm | Loading collection community.vmware from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/vmware 2026-05-14 18:51:06.257110 | debian-bookworm | Found installed collection community.vmware:5.10.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/vmware' 2026-05-14 18:51:06.257690 | debian-bookworm | Loading collection cyberark.pas from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/cyberark/pas 2026-05-14 18:51:06.258032 | debian-bookworm | Found installed collection cyberark.pas:1.0.36 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/cyberark/pas' 2026-05-14 18:51:06.258218 | debian-bookworm | Loading collection ibm.storage_virtualize from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/ibm/storage_virtualize 2026-05-14 18:51:06.258441 | debian-bookworm | Found installed collection ibm.storage_virtualize:2.7.4 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/ibm/storage_virtualize' 2026-05-14 18:51:06.258647 | debian-bookworm | Loading collection cyberark.conjur from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/cyberark/conjur 2026-05-14 18:51:06.258829 | debian-bookworm | Found installed collection cyberark.conjur:1.3.9 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/cyberark/conjur' 2026-05-14 18:51:06.259060 | debian-bookworm | Loading collection lowlydba.sqlserver from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/lowlydba/sqlserver 2026-05-14 18:51:06.259224 | debian-bookworm | Found installed collection lowlydba.sqlserver:2.7.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/lowlydba/sqlserver' 2026-05-14 18:51:06.259456 | debian-bookworm | Loading collection infoblox.nios_modules from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/infoblox/nios_modules 2026-05-14 18:51:06.259656 | debian-bookworm | Found installed collection infoblox.nios_modules:1.8.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/infoblox/nios_modules' 2026-05-14 18:51:06.259936 | debian-bookworm | Loading collection dellemc.openmanage from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/dellemc/openmanage 2026-05-14 18:51:06.260154 | debian-bookworm | Found installed collection dellemc.openmanage:9.12.3 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/dellemc/openmanage' 2026-05-14 18:51:06.260664 | debian-bookworm | Loading collection ibm.qradar from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/ibm/qradar 2026-05-14 18:51:06.260894 | debian-bookworm | Found installed collection ibm.qradar:4.0.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/ibm/qradar' 2026-05-14 18:51:06.261103 | debian-bookworm | Loading collection cisco.ise from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/cisco/ise 2026-05-14 18:51:06.261325 | debian-bookworm | Found installed collection cisco.ise:2.10.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/cisco/ise' 2026-05-14 18:51:06.265724 | debian-bookworm | Loading collection osism.services from /home/zuul/.ansible/collections/ansible_collections/osism/services 2026-05-14 18:51:06.265935 | debian-bookworm | Found installed collection osism.services:999.0.0 at '/home/zuul/.ansible/collections/ansible_collections/osism/services' 2026-05-14 18:51:06.269741 | debian-bookworm | Initial connection to galaxy_server: https://galaxy.ansible.com 2026-05-14 18:51:06.269939 | debian-bookworm | Created /home/zuul/.ansible/galaxy_token 2026-05-14 18:51:06.270057 | debian-bookworm | Calling Galaxy at https://galaxy.ansible.com/api/ 2026-05-14 18:51:06.405571 | ubuntu-noble | ansible-galaxy [core 2.18.16] 2026-05-14 18:51:06.406290 | ubuntu-noble | config file = None 2026-05-14 18:51:06.406764 | ubuntu-noble | configured module search path = ['/home/zuul/src/github.com/osism/ansible-collection-services/plugins/modules', '/home/zuul/.ansible/plugins/modules', '/usr/share/ansible/plugins/modules'] 2026-05-14 18:51:06.407216 | ubuntu-noble | ansible python module location = /home/zuul/venv/lib/python3.12/site-packages/ansible 2026-05-14 18:51:06.407667 | ubuntu-noble | ansible collection location = /home/zuul/.ansible/collections:/usr/share/ansible/collections:/home/zuul/venv/lib/python3.12/site-packages:/home/zuul/venv/lib/python3.12/dist-packages:/home/zuul/venv/lib/python3/dist-packages:/home/zuul/venv/local/lib/python3.12/dist-packages 2026-05-14 18:51:06.408085 | ubuntu-noble | executable location = /home/zuul/venv/bin/ansible-galaxy 2026-05-14 18:51:06.408492 | ubuntu-noble | python version = 3.12.3 (main, Mar 23 2026, 19:04:32) [GCC 13.3.0] (/home/zuul/venv/bin/python3) 2026-05-14 18:51:06.409999 | ubuntu-noble | jinja version = 3.1.6 2026-05-14 18:51:06.410033 | ubuntu-noble | libyaml = True 2026-05-14 18:51:06.410044 | ubuntu-noble | No config file found; using defaults 2026-05-14 18:51:06.410056 | ubuntu-noble | Reading requirement file at '/home/zuul/src/github.com/osism/ansible-collection-services/molecule/delegated/collections.yml' 2026-05-14 18:51:06.419559 | ubuntu-noble | Loading collection osism.services from /home/zuul/.ansible/collections/ansible_collections/osism/services 2026-05-14 18:51:06.419638 | ubuntu-noble | Found installed collection osism.services:999.0.0 at '/home/zuul/.ansible/collections/ansible_collections/osism/services' 2026-05-14 18:51:06.431033 | ubuntu-noble | Loading collection inspur.ispim from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/inspur/ispim 2026-05-14 18:51:06.431189 | ubuntu-noble | Found installed collection inspur.ispim:2.2.4 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/inspur/ispim' 2026-05-14 18:51:06.431408 | ubuntu-noble | Loading collection infinidat.infinibox from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/infinidat/infinibox 2026-05-14 18:51:06.431815 | ubuntu-noble | Found installed collection infinidat.infinibox:1.6.3 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/infinidat/infinibox' 2026-05-14 18:51:06.432326 | ubuntu-noble | Loading collection cisco.ios from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/cisco/ios 2026-05-14 18:51:06.432659 | ubuntu-noble | Found installed collection cisco.ios:9.2.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/cisco/ios' 2026-05-14 18:51:06.433087 | ubuntu-noble | Loading collection community.okd from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/okd 2026-05-14 18:51:06.433427 | ubuntu-noble | Found installed collection community.okd:4.0.2 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/okd' 2026-05-14 18:51:06.439430 | ubuntu-noble | Loading collection fortinet.fortimanager from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/fortinet/fortimanager 2026-05-14 18:51:06.439826 | ubuntu-noble | Found installed collection fortinet.fortimanager:2.11.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/fortinet/fortimanager' 2026-05-14 18:51:06.440095 | ubuntu-noble | Loading collection kaytus.ksmanage from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/kaytus/ksmanage 2026-05-14 18:51:06.440396 | ubuntu-noble | Found installed collection kaytus.ksmanage:2.0.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/kaytus/ksmanage' 2026-05-14 18:51:06.441337 | ubuntu-noble | Loading collection community.proxmox from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/proxmox 2026-05-14 18:51:06.441360 | ubuntu-noble | Found installed collection community.proxmox:1.4.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/proxmox' 2026-05-14 18:51:06.441367 | ubuntu-noble | Loading collection community.ciscosmb from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/ciscosmb 2026-05-14 18:51:06.441373 | ubuntu-noble | Found installed collection community.ciscosmb:1.0.11 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/ciscosmb' 2026-05-14 18:51:06.467976 | ubuntu-noble | Loading collection community.general from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/general 2026-05-14 18:51:06.468032 | ubuntu-noble | Found installed collection community.general:10.7.6 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/general' 2026-05-14 18:51:06.468968 | ubuntu-noble | Loading collection ansible.netcommon from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/ansible/netcommon 2026-05-14 18:51:06.469341 | ubuntu-noble | Found installed collection ansible.netcommon:7.2.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/ansible/netcommon' 2026-05-14 18:51:06.470095 | ubuntu-noble | Loading collection dellemc.openmanage from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/dellemc/openmanage 2026-05-14 18:51:06.470417 | ubuntu-noble | Found installed collection dellemc.openmanage:9.12.3 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/dellemc/openmanage' 2026-05-14 18:51:06.471203 | ubuntu-noble | Loading collection ibm.qradar from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/ibm/qradar 2026-05-14 18:51:06.471225 | ubuntu-noble | Found installed collection ibm.qradar:4.0.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/ibm/qradar' 2026-05-14 18:51:06.471834 | ubuntu-noble | Loading collection vultr.cloud from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/vultr/cloud 2026-05-14 18:51:06.471848 | ubuntu-noble | Found installed collection vultr.cloud:1.13.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/vultr/cloud' 2026-05-14 18:51:06.472937 | ubuntu-noble | Loading collection vyos.vyos from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/vyos/vyos 2026-05-14 18:51:06.472976 | ubuntu-noble | Found installed collection vyos.vyos:5.0.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/vyos/vyos' 2026-05-14 18:51:06.473519 | ubuntu-noble | Loading collection microsoft.iis from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/microsoft/iis 2026-05-14 18:51:06.473534 | ubuntu-noble | Found installed collection microsoft.iis:1.1.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/microsoft/iis' 2026-05-14 18:51:06.474162 | ubuntu-noble | Loading collection community.hrobot from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/hrobot 2026-05-14 18:51:06.474183 | ubuntu-noble | Found installed collection community.hrobot:2.7.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/hrobot' 2026-05-14 18:51:06.474869 | ubuntu-noble | Loading collection vmware.vmware from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/vmware/vmware 2026-05-14 18:51:06.474882 | ubuntu-noble | Found installed collection vmware.vmware:1.11.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/vmware/vmware' 2026-05-14 18:51:06.477022 | ubuntu-noble | Loading collection dellemc.unity from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/dellemc/unity 2026-05-14 18:51:06.477137 | ubuntu-noble | Found installed collection dellemc.unity:2.1.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/dellemc/unity' 2026-05-14 18:51:06.477392 | ubuntu-noble | Loading collection community.routeros from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/routeros 2026-05-14 18:51:06.477762 | ubuntu-noble | Found installed collection community.routeros:3.14.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/routeros' 2026-05-14 18:51:06.478285 | ubuntu-noble | Loading collection ieisystem.inmanage from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/ieisystem/inmanage 2026-05-14 18:51:06.478655 | ubuntu-noble | Found installed collection ieisystem.inmanage:3.0.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/ieisystem/inmanage' 2026-05-14 18:51:06.479033 | ubuntu-noble | Loading collection grafana.grafana from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/grafana/grafana 2026-05-14 18:51:06.479475 | ubuntu-noble | Found installed collection grafana.grafana:5.7.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/grafana/grafana' 2026-05-14 18:51:06.479824 | ubuntu-noble | Loading collection lowlydba.sqlserver from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/lowlydba/sqlserver 2026-05-14 18:51:06.480296 | ubuntu-noble | Found installed collection lowlydba.sqlserver:2.7.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/lowlydba/sqlserver' 2026-05-14 18:51:06.480627 | ubuntu-noble | Loading collection netapp.storagegrid from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/netapp/storagegrid 2026-05-14 18:51:06.480927 | ubuntu-noble | Found installed collection netapp.storagegrid:21.14.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/netapp/storagegrid' 2026-05-14 18:51:06.482997 | ubuntu-noble | Loading collection community.windows from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/windows 2026-05-14 18:51:06.483034 | ubuntu-noble | Found installed collection community.windows:2.4.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/windows' 2026-05-14 18:51:06.483044 | ubuntu-noble | Loading collection cisco.nxos from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/cisco/nxos 2026-05-14 18:51:06.483067 | ubuntu-noble | Found installed collection cisco.nxos:9.4.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/cisco/nxos' 2026-05-14 18:51:06.483076 | ubuntu-noble | Loading collection telekom_mms.icinga_director from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/telekom_mms/icinga_director 2026-05-14 18:51:06.483189 | ubuntu-noble | Found installed collection telekom_mms.icinga_director:2.5.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/telekom_mms/icinga_director' 2026-05-14 18:51:06.483937 | ubuntu-noble | Loading collection hetzner.hcloud from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/hetzner/hcloud 2026-05-14 18:51:06.484359 | ubuntu-noble | Found installed collection hetzner.hcloud:4.3.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/hetzner/hcloud' 2026-05-14 18:51:06.484686 | ubuntu-noble | Loading collection cisco.asa from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/cisco/asa 2026-05-14 18:51:06.484943 | ubuntu-noble | Found installed collection cisco.asa:6.1.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/cisco/asa' 2026-05-14 18:51:06.485331 | ubuntu-noble | Loading collection cisco.ise from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/cisco/ise 2026-05-14 18:51:06.485586 | ubuntu-noble | Found installed collection cisco.ise:2.10.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/cisco/ise' 2026-05-14 18:51:06.485908 | ubuntu-noble | Loading collection splunk.es from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/splunk/es 2026-05-14 18:51:06.486282 | ubuntu-noble | Found installed collection splunk.es:4.0.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/splunk/es' 2026-05-14 18:51:06.487596 | ubuntu-noble | Loading collection community.vmware from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/vmware 2026-05-14 18:51:06.487922 | ubuntu-noble | Found installed collection community.vmware:5.10.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/vmware' 2026-05-14 18:51:06.488257 | ubuntu-noble | Loading collection community.hashi_vault from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/hashi_vault 2026-05-14 18:51:06.488553 | ubuntu-noble | Found installed collection community.hashi_vault:6.2.1 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/hashi_vault' 2026-05-14 18:51:06.491065 | ubuntu-noble | Loading collection awx.awx from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/awx/awx 2026-05-14 18:51:06.491429 | ubuntu-noble | Found installed collection awx.awx:24.6.1 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/awx/awx' 2026-05-14 18:51:06.491706 | ubuntu-noble | Loading collection community.mongodb from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/mongodb 2026-05-14 18:51:06.491998 | ubuntu-noble | Found installed collection community.mongodb:1.7.10 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/mongodb' 2026-05-14 18:51:06.492786 | ubuntu-noble | Loading collection cloudscale_ch.cloud from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/cloudscale_ch/cloud 2026-05-14 18:51:06.493096 | ubuntu-noble | Found installed collection cloudscale_ch.cloud:2.5.2 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/cloudscale_ch/cloud' 2026-05-14 18:51:06.493399 | ubuntu-noble | Loading collection containers.podman from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/containers/podman 2026-05-14 18:51:06.493672 | ubuntu-noble | Found installed collection containers.podman:1.18.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/containers/podman' 2026-05-14 18:51:06.493927 | ubuntu-noble | Loading collection ibm.spectrum_virtualize from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/ibm/spectrum_virtualize 2026-05-14 18:51:06.494182 | ubuntu-noble | Found installed collection ibm.spectrum_virtualize:2.0.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/ibm/spectrum_virtualize' 2026-05-14 18:51:06.495985 | ubuntu-noble | Loading collection azure.azcollection from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/azure/azcollection 2026-05-14 18:51:06.496274 | ubuntu-noble | Found installed collection azure.azcollection:3.12.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/azure/azcollection' 2026-05-14 18:51:06.496528 | ubuntu-noble | Loading collection cisco.ucs from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/cisco/ucs 2026-05-14 18:51:06.496772 | ubuntu-noble | Found installed collection cisco.ucs:1.16.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/cisco/ucs' 2026-05-14 18:51:06.497663 | ubuntu-noble | Loading collection google.cloud from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/google/cloud 2026-05-14 18:51:06.497938 | ubuntu-noble | Found installed collection google.cloud:1.10.2 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/google/cloud' 2026-05-14 18:51:06.498254 | ubuntu-noble | Loading collection ibm.storage_virtualize from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/ibm/storage_virtualize 2026-05-14 18:51:06.498511 | ubuntu-noble | Found installed collection ibm.storage_virtualize:2.7.4 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/ibm/storage_virtualize' 2026-05-14 18:51:06.498703 | ubuntu-noble | Loading collection ansible.utils from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/ansible/utils 2026-05-14 18:51:06.498969 | ubuntu-noble | Found installed collection ansible.utils:5.1.2 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/ansible/utils' 2026-05-14 18:51:06.499385 | ubuntu-noble | Loading collection ngine_io.cloudstack from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/ngine_io/cloudstack 2026-05-14 18:51:06.499634 | ubuntu-noble | Found installed collection ngine_io.cloudstack:2.5.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/ngine_io/cloudstack' 2026-05-14 18:51:06.500442 | ubuntu-noble | Loading collection cisco.iosxr from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/cisco/iosxr 2026-05-14 18:51:06.500669 | ubuntu-noble | Found installed collection cisco.iosxr:10.3.1 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/cisco/iosxr' 2026-05-14 18:51:06.502261 | ubuntu-noble | Loading collection cisco.mso from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/cisco/mso 2026-05-14 18:51:06.502487 | ubuntu-noble | Found installed collection cisco.mso:2.12.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/cisco/mso' 2026-05-14 18:51:06.503525 | ubuntu-noble | Loading collection community.digitalocean from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/digitalocean 2026-05-14 18:51:06.503784 | ubuntu-noble | Found installed collection community.digitalocean:1.27.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/digitalocean' 2026-05-14 18:51:06.504135 | ubuntu-noble | Loading collection hitachivantara.vspone_object from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/hitachivantara/vspone_object 2026-05-14 18:51:06.504370 | ubuntu-noble | Found installed collection hitachivantara.vspone_object:1.1.1 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/hitachivantara/vspone_object' 2026-05-14 18:51:06.504877 | ubuntu-noble | Loading collection community.sap_libs from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/sap_libs 2026-05-14 18:51:06.504890 | ubuntu-noble | Found installed collection community.sap_libs:1.5.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/sap_libs' 2026-05-14 18:51:06.505625 | ubuntu-noble | Loading collection openstack.cloud from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/openstack/cloud 2026-05-14 18:51:06.505865 | ubuntu-noble | Found installed collection openstack.cloud:2.5.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/openstack/cloud' 2026-05-14 18:51:06.506139 | ubuntu-noble | Loading collection community.mysql from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/mysql 2026-05-14 18:51:06.506365 | ubuntu-noble | Found installed collection community.mysql:3.16.1 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/mysql' 2026-05-14 18:51:06.507072 | ubuntu-noble | Loading collection check_point.mgmt from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/check_point/mgmt 2026-05-14 18:51:06.507092 | ubuntu-noble | Found installed collection check_point.mgmt:6.7.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/check_point/mgmt' 2026-05-14 18:51:06.508172 | ubuntu-noble | Loading collection community.postgresql from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/postgresql 2026-05-14 18:51:06.508198 | ubuntu-noble | Found installed collection community.postgresql:3.14.3 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/postgresql' 2026-05-14 18:51:06.508215 | ubuntu-noble | Loading collection netapp.cloudmanager from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/netapp/cloudmanager 2026-05-14 18:51:06.508221 | ubuntu-noble | Found installed collection netapp.cloudmanager:21.24.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/netapp/cloudmanager' 2026-05-14 18:51:06.510162 | ubuntu-noble | Loading collection cisco.meraki from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/cisco/meraki 2026-05-14 18:51:06.510405 | ubuntu-noble | Found installed collection cisco.meraki:2.21.9 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/cisco/meraki' 2026-05-14 18:51:06.510906 | ubuntu-noble | Loading collection community.rabbitmq from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/rabbitmq 2026-05-14 18:51:06.510919 | ubuntu-noble | Found installed collection community.rabbitmq:1.6.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/rabbitmq' 2026-05-14 18:51:06.512043 | ubuntu-noble | Loading collection arista.eos from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/arista/eos 2026-05-14 18:51:06.512064 | ubuntu-noble | Found installed collection arista.eos:10.1.1 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/arista/eos' 2026-05-14 18:51:06.512884 | ubuntu-noble | Loading collection ovirt.ovirt from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/ovirt/ovirt 2026-05-14 18:51:06.512899 | ubuntu-noble | Found installed collection ovirt.ovirt:3.2.1 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/ovirt/ovirt' 2026-05-14 18:51:06.513299 | ubuntu-noble | Loading collection purestorage.flasharray from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/purestorage/flasharray 2026-05-14 18:51:06.513540 | ubuntu-noble | Found installed collection purestorage.flasharray:1.40.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/purestorage/flasharray' 2026-05-14 18:51:06.514006 | ubuntu-noble | Loading collection cyberark.conjur from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/cyberark/conjur 2026-05-14 18:51:06.514024 | ubuntu-noble | Found installed collection cyberark.conjur:1.3.9 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/cyberark/conjur' 2026-05-14 18:51:06.514591 | ubuntu-noble | Loading collection community.grafana from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/grafana 2026-05-14 18:51:06.514605 | ubuntu-noble | Found installed collection community.grafana:2.3.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/grafana' 2026-05-14 18:51:06.514794 | ubuntu-noble | Loading collection infoblox.nios_modules from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/infoblox/nios_modules 2026-05-14 18:51:06.515055 | ubuntu-noble | Found installed collection infoblox.nios_modules:1.8.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/infoblox/nios_modules' 2026-05-14 18:51:06.515837 | ubuntu-noble | Loading collection netbox.netbox from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/netbox/netbox 2026-05-14 18:51:06.516056 | ubuntu-noble | Found installed collection netbox.netbox:3.21.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/netbox/netbox' 2026-05-14 18:51:06.517209 | ubuntu-noble | Loading collection netapp.ontap from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/netapp/ontap 2026-05-14 18:51:06.517438 | ubuntu-noble | Found installed collection netapp.ontap:22.14.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/netapp/ontap' 2026-05-14 18:51:06.517857 | ubuntu-noble | Loading collection community.crypto from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/crypto 2026-05-14 18:51:06.518077 | ubuntu-noble | Found installed collection community.crypto:2.26.6 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/crypto' 2026-05-14 18:51:06.518671 | ubuntu-noble | Loading collection community.zabbix from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/zabbix 2026-05-14 18:51:06.518692 | ubuntu-noble | Found installed collection community.zabbix:3.3.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/zabbix' 2026-05-14 18:51:06.519233 | ubuntu-noble | Loading collection kubevirt.core from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/kubevirt/core 2026-05-14 18:51:06.519494 | ubuntu-noble | Found installed collection kubevirt.core:2.2.3 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/kubevirt/core' 2026-05-14 18:51:06.519657 | ubuntu-noble | Loading collection purestorage.flashblade from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/purestorage/flashblade 2026-05-14 18:51:06.519873 | ubuntu-noble | Found installed collection purestorage.flashblade:1.22.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/purestorage/flashblade' 2026-05-14 18:51:06.520783 | ubuntu-noble | Loading collection junipernetworks.junos from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/junipernetworks/junos 2026-05-14 18:51:06.521023 | ubuntu-noble | Found installed collection junipernetworks.junos:9.1.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/junipernetworks/junos' 2026-05-14 18:51:06.522707 | ubuntu-noble | Loading collection theforeman.foreman from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/theforeman/foreman 2026-05-14 18:51:06.523038 | ubuntu-noble | Found installed collection theforeman.foreman:4.2.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/theforeman/foreman' 2026-05-14 18:51:06.524781 | ubuntu-noble | Loading collection cisco.aci from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/cisco/aci 2026-05-14 18:51:06.525086 | ubuntu-noble | Found installed collection cisco.aci:2.13.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/cisco/aci' 2026-05-14 18:51:06.525357 | ubuntu-noble | Loading collection ansible.posix from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/ansible/posix 2026-05-14 18:51:06.525549 | ubuntu-noble | Found installed collection ansible.posix:1.6.2 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/ansible/posix' 2026-05-14 18:51:06.526044 | ubuntu-noble | Loading collection sensu.sensu_go from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/sensu/sensu_go 2026-05-14 18:51:06.526062 | ubuntu-noble | Found installed collection sensu.sensu_go:1.14.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/sensu/sensu_go' 2026-05-14 18:51:06.528991 | ubuntu-noble | Loading collection vmware.vmware_rest from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/vmware/vmware_rest 2026-05-14 18:51:06.529327 | ubuntu-noble | Found installed collection vmware.vmware_rest:4.9.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/vmware/vmware_rest' 2026-05-14 18:51:06.529540 | ubuntu-noble | Loading collection cisco.dnac from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/cisco/dnac 2026-05-14 18:51:06.530055 | ubuntu-noble | Found installed collection cisco.dnac:6.31.3 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/cisco/dnac' 2026-05-14 18:51:06.530074 | ubuntu-noble | Loading collection community.library_inventory_filtering_v1 from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/library_inventory_filtering_v1 2026-05-14 18:51:06.530348 | ubuntu-noble | Found installed collection community.library_inventory_filtering_v1:1.1.5 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/library_inventory_filtering_v1' 2026-05-14 18:51:06.530592 | ubuntu-noble | Loading collection ravendb.ravendb from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/ravendb/ravendb 2026-05-14 18:51:06.530837 | ubuntu-noble | Found installed collection ravendb.ravendb:1.0.4 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/ravendb/ravendb' 2026-05-14 18:51:06.531290 | ubuntu-noble | Loading collection f5networks.f5_modules from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/f5networks/f5_modules 2026-05-14 18:51:06.531518 | ubuntu-noble | Found installed collection f5networks.f5_modules:1.39.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/f5networks/f5_modules' 2026-05-14 18:51:06.572437 | ubuntu-noble | Loading collection community.network from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/network 2026-05-14 18:51:06.572545 | ubuntu-noble | Found installed collection community.network:5.1.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/network' 2026-05-14 18:51:06.577015 | ubuntu-noble | Loading collection fortinet.fortios from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/fortinet/fortios 2026-05-14 18:51:06.577068 | ubuntu-noble | Found installed collection fortinet.fortios:2.4.2 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/fortinet/fortios' 2026-05-14 18:51:06.577081 | ubuntu-noble | Loading collection dellemc.enterprise_sonic from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/dellemc/enterprise_sonic 2026-05-14 18:51:06.577311 | ubuntu-noble | Found installed collection dellemc.enterprise_sonic:2.5.1 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/dellemc/enterprise_sonic' 2026-05-14 18:51:06.580649 | ubuntu-noble | Loading collection community.aws from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/aws 2026-05-14 18:51:06.581277 | ubuntu-noble | Found installed collection community.aws:9.3.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/aws' 2026-05-14 18:51:06.581664 | ubuntu-noble | Loading collection cyberark.pas from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/cyberark/pas 2026-05-14 18:51:06.582211 | ubuntu-noble | Found installed collection cyberark.pas:1.0.36 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/cyberark/pas' 2026-05-14 18:51:06.582575 | ubuntu-noble | Loading collection cloud.common from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/cloud/common 2026-05-14 18:51:06.582913 | ubuntu-noble | Found installed collection cloud.common:4.2.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/cloud/common' 2026-05-14 18:51:06.583449 | ubuntu-noble | Loading collection community.docker from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/docker 2026-05-14 18:51:06.583835 | ubuntu-noble | Found installed collection community.docker:4.8.5 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/docker' 2026-05-14 18:51:06.584237 | ubuntu-noble | Loading collection kubernetes.core from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/kubernetes/core 2026-05-14 18:51:06.584694 | ubuntu-noble | Found installed collection kubernetes.core:5.4.1 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/kubernetes/core' 2026-05-14 18:51:06.585072 | ubuntu-noble | Loading collection community.proxysql from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/proxysql 2026-05-14 18:51:06.585464 | ubuntu-noble | Found installed collection community.proxysql:1.7.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/proxysql' 2026-05-14 18:51:06.585906 | ubuntu-noble | Loading collection amazon.aws from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/amazon/aws 2026-05-14 18:51:06.586350 | ubuntu-noble | Found installed collection amazon.aws:9.5.2 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/amazon/aws' 2026-05-14 18:51:06.586754 | ubuntu-noble | Loading collection microsoft.ad from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/microsoft/ad 2026-05-14 18:51:06.587206 | ubuntu-noble | Found installed collection microsoft.ad:1.10.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/microsoft/ad' 2026-05-14 18:51:06.587525 | ubuntu-noble | Loading collection community.libvirt from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/libvirt 2026-05-14 18:51:06.587831 | ubuntu-noble | Found installed collection community.libvirt:1.4.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/libvirt' 2026-05-14 18:51:06.538635 | debian-bookworm | Found API version 'v3, pulp-v3, v1' with Galaxy server default (https://galaxy.ansible.com/api/) 2026-05-14 18:51:06.588191 | ubuntu-noble | Loading collection dellemc.powerflex from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/dellemc/powerflex 2026-05-14 18:51:06.539400 | debian-bookworm | Calling Galaxy at https://galaxy.ansible.com/api/v3/collections/osism/commons/ 2026-05-14 18:51:06.588550 | ubuntu-noble | Found installed collection dellemc.powerflex:2.6.1 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/dellemc/powerflex' 2026-05-14 18:51:06.588979 | ubuntu-noble | Loading collection netapp_eseries.santricity from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/netapp_eseries/santricity 2026-05-14 18:51:06.589372 | ubuntu-noble | Found installed collection netapp_eseries.santricity:1.4.1 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/netapp_eseries/santricity' 2026-05-14 18:51:06.590997 | ubuntu-noble | Loading collection cisco.intersight from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/cisco/intersight 2026-05-14 18:51:06.591024 | ubuntu-noble | Found installed collection cisco.intersight:2.12.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/cisco/intersight' 2026-05-14 18:51:06.591033 | ubuntu-noble | Loading collection ansible.windows from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/ansible/windows 2026-05-14 18:51:06.591041 | ubuntu-noble | Found installed collection ansible.windows:2.8.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/ansible/windows' 2026-05-14 18:51:06.591048 | ubuntu-noble | Loading collection hitachivantara.vspone_block from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/hitachivantara/vspone_block 2026-05-14 18:51:06.591056 | ubuntu-noble | Found installed collection hitachivantara.vspone_block:3.5.1 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/hitachivantara/vspone_block' 2026-05-14 18:51:06.591214 | ubuntu-noble | Loading collection community.dns from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/dns 2026-05-14 18:51:06.591473 | ubuntu-noble | Found installed collection community.dns:3.4.1 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/dns' 2026-05-14 18:51:06.591722 | ubuntu-noble | Loading collection chocolatey.chocolatey from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/chocolatey/chocolatey 2026-05-14 18:51:06.591993 | ubuntu-noble | Found installed collection chocolatey.chocolatey:1.5.3 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/chocolatey/chocolatey' 2026-05-14 18:51:06.592404 | ubuntu-noble | Loading collection wti.remote from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/wti/remote 2026-05-14 18:51:06.592630 | ubuntu-noble | Found installed collection wti.remote:1.0.10 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/wti/remote' 2026-05-14 18:51:06.592837 | ubuntu-noble | Loading collection community.sops from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/sops 2026-05-14 18:51:06.593063 | ubuntu-noble | Found installed collection community.sops:2.2.7 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/sops' 2026-05-14 18:51:06.595666 | ubuntu-noble | Initial connection to galaxy_server: https://galaxy.ansible.com 2026-05-14 18:51:06.595985 | ubuntu-noble | Created /home/zuul/.ansible/galaxy_token 2026-05-14 18:51:06.596238 | ubuntu-noble | Calling Galaxy at https://galaxy.ansible.com/api/ 2026-05-14 18:51:07.059215 | ubuntu-noble | Found API version 'v3, pulp-v3, v1' with Galaxy server default (https://galaxy.ansible.com/api/) 2026-05-14 18:51:07.059827 | ubuntu-noble | Calling Galaxy at https://galaxy.ansible.com/api/v3/collections/osism/commons/ 2026-05-14 18:51:07.122059 | debian-bookworm | Calling Galaxy at https://galaxy.ansible.com/api/v3/collections/osism/commons/versions/?limit=100 2026-05-14 18:51:07.668297 | ubuntu-noble | Calling Galaxy at https://galaxy.ansible.com/api/v3/collections/osism/commons/versions/?limit=100 2026-05-14 18:51:07.890898 | debian-bookworm | Calling Galaxy at https://galaxy.ansible.com/api/v3/collections/osism/commons/versions/0.20260318.0/ 2026-05-14 18:51:08.476044 | debian-bookworm | Server https://galaxy.ansible.com/api/ has not signed osism.commons:0.20260318.0 2026-05-14 18:51:08.476640 | debian-bookworm | Fetching a collection tarball for 'osism.commons:0.20260318.0' from Ansible Galaxy 2026-05-14 18:51:08.814789 | ubuntu-noble | Calling Galaxy at https://galaxy.ansible.com/api/v3/collections/osism/commons/versions/0.20260318.0/ 2026-05-14 18:51:09.731394 | ubuntu-noble | Server https://galaxy.ansible.com/api/ has not signed osism.commons:0.20260318.0 2026-05-14 18:51:09.732001 | ubuntu-noble | Fetching a collection tarball for 'osism.commons:0.20260318.0' from Ansible Galaxy 2026-05-14 18:51:10.077919 | debian-bookworm | Validating downloaded file hash a8b0daa997f8a6a43297328a901f89a21e28c6a6ab16356fcbec4c59b6328e15 with expected hash a8b0daa997f8a6a43297328a901f89a21e28c6a6ab16356fcbec4c59b6328e15 2026-05-14 18:51:10.078449 | debian-bookworm | Collection 'osism.commons:0.20260318.0' obtained from server default https://galaxy.ansible.com/api/ 2026-05-14 18:51:10.264717 | debian-bookworm | Starting galaxy collection install process 2026-05-14 18:51:10.265251 | debian-bookworm | Process install dependency map 2026-05-14 18:51:10.265712 | debian-bookworm | Starting collection install process 2026-05-14 18:51:10.266076 | debian-bookworm | 'ansible.posix:1.6.2' is already installed, skipping. 2026-05-14 18:51:10.266417 | debian-bookworm | 'community.docker:4.8.5' is already installed, skipping. 2026-05-14 18:51:10.266822 | debian-bookworm | 'community.general:10.7.6' is already installed, skipping. 2026-05-14 18:51:10.267160 | debian-bookworm | 'community.library_inventory_filtering_v1:1.1.5' is already installed, skipping. 2026-05-14 18:51:10.267508 | debian-bookworm | Downloading https://galaxy.ansible.com/api/v3/plugin/ansible/content/published/collections/artifacts/osism-commons-0.20260318.0.tar.gz to /home/zuul/.ansible/tmp/ansible-local-1824u413_vb3/tmpcdlqsry0/osism-commons-0.20260318.0-khalmxhh 2026-05-14 18:51:10.267906 | debian-bookworm | Installing 'osism.commons:0.20260318.0' to '/home/zuul/.ansible/collections/ansible_collections/osism/commons' 2026-05-14 18:51:10.268233 | debian-bookworm | osism.commons:0.20260318.0 was installed successfully 2026-05-14 18:51:10.360236 | debian-bookworm | INFO [delegated > dependency] Dependency completed successfully. 2026-05-14 18:51:10.360746 | debian-bookworm | WARNING [delegated > dependency] Executed: Missing roles requirements file: requirements.yml (Remove from dependency_sequence to suppress) 2026-05-14 18:51:10.361754 | debian-bookworm | WARNING Molecule executed 1 scenario (1 missing files) 2026-05-14 18:51:10.823263 | debian-bookworm | ok: Runtime: 0:00:06.884826 2026-05-14 18:51:11.773881 | ubuntu-noble | ok: Runtime: 0:00:08.091132 2026-05-14 18:51:11.786653 | 2026-05-14 18:51:11.786810 | TASK [ansible-molecule : Run molecule create action with scenario delegated] 2026-05-14 18:51:11.353622 | ubuntu-noble | Validating downloaded file hash a8b0daa997f8a6a43297328a901f89a21e28c6a6ab16356fcbec4c59b6328e15 with expected hash a8b0daa997f8a6a43297328a901f89a21e28c6a6ab16356fcbec4c59b6328e15 2026-05-14 18:51:11.353698 | ubuntu-noble | Collection 'osism.commons:0.20260318.0' obtained from server default https://galaxy.ansible.com/api/ 2026-05-14 18:51:11.527088 | ubuntu-noble | Starting galaxy collection install process 2026-05-14 18:51:11.527186 | ubuntu-noble | Process install dependency map 2026-05-14 18:51:11.527233 | ubuntu-noble | Starting collection install process 2026-05-14 18:51:11.527450 | ubuntu-noble | 'ansible.posix:1.6.2' is already installed, skipping. 2026-05-14 18:51:11.527819 | ubuntu-noble | 'community.docker:4.8.5' is already installed, skipping. 2026-05-14 18:51:11.528258 | ubuntu-noble | 'community.general:10.7.6' is already installed, skipping. 2026-05-14 18:51:11.528615 | ubuntu-noble | 'community.library_inventory_filtering_v1:1.1.5' is already installed, skipping. 2026-05-14 18:51:11.529026 | ubuntu-noble | Downloading https://galaxy.ansible.com/api/v3/plugin/ansible/content/published/collections/artifacts/osism-commons-0.20260318.0.tar.gz to /home/zuul/.ansible/tmp/ansible-local-1650f90es7oz/tmpv6ndlg_t/osism-commons-0.20260318.0-xwodq9gc 2026-05-14 18:51:11.529433 | ubuntu-noble | Installing 'osism.commons:0.20260318.0' to '/home/zuul/.ansible/collections/ansible_collections/osism/commons' 2026-05-14 18:51:11.529767 | ubuntu-noble | osism.commons:0.20260318.0 was installed successfully 2026-05-14 18:51:11.611697 | ubuntu-noble | INFO [delegated > dependency] Dependency completed successfully. 2026-05-14 18:51:11.612309 | ubuntu-noble | WARNING [delegated > dependency] Executed: Missing roles requirements file: requirements.yml (Remove from dependency_sequence to suppress) 2026-05-14 18:51:11.614304 | ubuntu-noble | WARNING Molecule executed 1 scenario (1 missing files) 2026-05-14 18:51:12.359220 | debian-bookworm | skipping: Conditional result was False 2026-05-14 18:51:12.359911 | ubuntu-noble | skipping: Conditional result was False 2026-05-14 18:51:12.366087 | 2026-05-14 18:51:12.366231 | TASK [ansible-molecule : Run molecule prepare action with scenario delegated] 2026-05-14 18:51:13.102638 | ubuntu-noble | WARNING Molecule scenarios should migrate to 'extensions/molecule' 2026-05-14 18:51:13.112492 | ubuntu-noble | DEBUG [unknown > config] provisioner.env found in /home/zuul/src/github.com/osism/ansible-collection-services/molecule/delegated/molecule.yml, this can be defined in ansible.env 2026-05-14 18:51:12.999502 | debian-bookworm | WARNING Molecule scenarios should migrate to 'extensions/molecule' 2026-05-14 18:51:13.010947 | debian-bookworm | DEBUG [unknown > config] provisioner.env found in /home/zuul/src/github.com/osism/ansible-collection-services/molecule/delegated/molecule.yml, this can be defined in ansible.env 2026-05-14 18:51:13.638005 | ubuntu-noble | DEBUG [unknown > config] provisioner.env found in /home/zuul/src/github.com/osism/ansible-collection-services/molecule/delegated/molecule.yml, this can be defined in ansible.env 2026-05-14 18:51:13.638695 | ubuntu-noble | DEBUG [delegated > validate] Validating schema /home/zuul/src/github.com/osism/ansible-collection-services/molecule/delegated/molecule.yml. 2026-05-14 18:51:13.647492 | ubuntu-noble | CRITICAL 'molecule/default/molecule.yml' glob failed. Exiting. 2026-05-14 18:51:13.647531 | ubuntu-noble | INFO default scenario not found, disabling shared state. 2026-05-14 18:51:13.647770 | ubuntu-noble | INFO [delegated > discovery] scenario test matrix: prepare 2026-05-14 18:51:13.647853 | ubuntu-noble | INFO [delegated > prerun] Performing prerun with role_name_check=0... 2026-05-14 18:51:13.478344 | debian-bookworm | DEBUG [unknown > config] provisioner.env found in /home/zuul/src/github.com/osism/ansible-collection-services/molecule/delegated/molecule.yml, this can be defined in ansible.env 2026-05-14 18:51:13.478915 | debian-bookworm | DEBUG [delegated > validate] Validating schema /home/zuul/src/github.com/osism/ansible-collection-services/molecule/delegated/molecule.yml. 2026-05-14 18:51:13.490132 | debian-bookworm | CRITICAL 'molecule/default/molecule.yml' glob failed. Exiting. 2026-05-14 18:51:13.490224 | debian-bookworm | INFO default scenario not found, disabling shared state. 2026-05-14 18:51:13.490389 | debian-bookworm | INFO [delegated > discovery] scenario test matrix: prepare 2026-05-14 18:51:13.490555 | debian-bookworm | INFO [delegated > prerun] Performing prerun with role_name_check=0... 2026-05-14 18:51:14.711872 | debian-bookworm | INFO [delegated > prepare] Executing 2026-05-14 18:51:14.996568 | ubuntu-noble | INFO [delegated > prepare] Executing 2026-05-14 18:51:15.357388 | ubuntu-noble | DEBUG [delegated > prepare] ansible-playbook version: ansible-playbook 2026-05-14 18:51:15.357449 | ubuntu-noble | config file = None 2026-05-14 18:51:15.357466 | ubuntu-noble | configured module search path = 2026-05-14 18:51:15.357471 | ubuntu-noble | ansible python module location = /home/zuul/venv/lib/python3.12/site-packages/ansible 2026-05-14 18:51:15.357476 | ubuntu-noble | ansible collection location = /home/zuul/.ansible/collections:/usr/share/ansible/collections 2026-05-14 18:51:15.357479 | ubuntu-noble | executable location = /home/zuul/venv/bin/ansible-playbook 2026-05-14 18:51:15.357483 | ubuntu-noble | python version = 3.12.3 (main, Mar 23 2026, 19:04:32) (/home/zuul/venv/bin/python3) 2026-05-14 18:51:15.357486 | ubuntu-noble | jinja version = 3.1.6 2026-05-14 18:51:15.357490 | ubuntu-noble | libyaml = True 2026-05-14 18:51:15.357565 | ubuntu-noble | DEBUG ANSIBLE ENVIRONMENT: 2026-05-14 18:51:15.357570 | ubuntu-noble | ANSIBLE_COLLECTIONS_PATH: /home/zuul/venv/.ansible/collections:/home/zuul/.ansible/collections 2026-05-14 18:51:15.357574 | ubuntu-noble | ANSIBLE_CONFIG: /home/zuul/.ansible/tmp/molecule.oWZD.delegated/ansible.cfg 2026-05-14 18:51:15.357577 | ubuntu-noble | ANSIBLE_LIBRARY: ../../plugins 2026-05-14 18:51:15.357581 | ubuntu-noble | ANSIBLE_PYTHON_INTERPRETER: /home/zuul/venv/bin/python 2026-05-14 18:51:15.357584 | ubuntu-noble | ANSIBLE_ROLE: auditd 2026-05-14 18:51:15.357588 | ubuntu-noble | ANSIBLE_ROLES_PATH: ../../roles 2026-05-14 18:51:15.357591 | ubuntu-noble | ANSIBLE_VERBOSITY: 1 2026-05-14 18:51:15.357595 | ubuntu-noble | 2026-05-14 18:51:15.357665 | ubuntu-noble | DEBUG MOLECULE ENVIRONMENT: 2026-05-14 18:51:15.357670 | ubuntu-noble | MOLECULE_DEBUG: True 2026-05-14 18:51:15.357674 | ubuntu-noble | MOLECULE_DEPENDENCY_NAME: galaxy 2026-05-14 18:51:15.357677 | ubuntu-noble | MOLECULE_DRIVER_NAME: default 2026-05-14 18:51:15.357680 | ubuntu-noble | MOLECULE_ENV_FILE: /home/zuul/src/github.com/osism/ansible-collection-services/.env.yml 2026-05-14 18:51:15.357684 | ubuntu-noble | MOLECULE_EPHEMERAL_DIRECTORY: /home/zuul/.ansible/tmp/molecule.oWZD.delegated 2026-05-14 18:51:15.357688 | ubuntu-noble | MOLECULE_FILE: /home/zuul/.ansible/tmp/molecule.oWZD.delegated/molecule.yml 2026-05-14 18:51:15.357691 | ubuntu-noble | MOLECULE_INSTANCE_CONFIG: /home/zuul/.ansible/tmp/molecule.oWZD.delegated/instance_config.yml 2026-05-14 18:51:15.357694 | ubuntu-noble | MOLECULE_INVENTORY_FILE: /home/zuul/.ansible/tmp/molecule.oWZD.delegated/inventory/ansible_inventory.yml 2026-05-14 18:51:15.357698 | ubuntu-noble | MOLECULE_PROJECT_DIRECTORY: /home/zuul/src/github.com/osism/ansible-collection-services 2026-05-14 18:51:15.357701 | ubuntu-noble | MOLECULE_PROVISIONER_NAME: ansible 2026-05-14 18:51:15.357705 | ubuntu-noble | MOLECULE_SCENARIO_DIRECTORY: /home/zuul/src/github.com/osism/ansible-collection-services/molecule/delegated 2026-05-14 18:51:15.357708 | ubuntu-noble | MOLECULE_SCENARIO_NAME: delegated 2026-05-14 18:51:15.357711 | ubuntu-noble | MOLECULE_STATE_FILE: /home/zuul/.ansible/tmp/molecule.oWZD.delegated/state.yml 2026-05-14 18:51:15.357715 | ubuntu-noble | MOLECULE_VERIFIER_NAME: testinfra 2026-05-14 18:51:15.357718 | ubuntu-noble | MOLECULE_VERIFIER_TEST_DIRECTORY: /home/zuul/src/github.com/osism/ansible-collection-services/molecule/delegated/tests 2026-05-14 18:51:15.357722 | ubuntu-noble | 2026-05-14 18:51:15.357868 | ubuntu-noble | DEBUG SHELL REPLAY: ANSIBLE_COLLECTIONS_PATH=/home/zuul/venv/.ansible/collections:/home/zuul/.ansible/collections ANSIBLE_CONFIG=/home/zuul/.ansible/tmp/molecule.oWZD.delegated/ansible.cfg ANSIBLE_LIBRARY=../../plugins ANSIBLE_PYTHON_INTERPRETER=/home/zuul/venv/bin/python ANSIBLE_ROLE=auditd ANSIBLE_ROLES_PATH=../../roles ANSIBLE_VERBOSITY=1 MOLECULE_DEBUG=True MOLECULE_DEPENDENCY_NAME=galaxy MOLECULE_DRIVER_NAME=default MOLECULE_ENV_FILE=/home/zuul/src/github.com/osism/ansible-collection-services/.env.yml MOLECULE_EPHEMERAL_DIRECTORY=/home/zuul/.ansible/tmp/molecule.oWZD.delegated MOLECULE_FILE=/home/zuul/.ansible/tmp/molecule.oWZD.delegated/molecule.yml MOLECULE_INSTANCE_CONFIG=/home/zuul/.ansible/tmp/molecule.oWZD.delegated/instance_config.yml MOLECULE_INVENTORY_FILE=/home/zuul/.ansible/tmp/molecule.oWZD.delegated/inventory/ansible_inventory.yml MOLECULE_PROJECT_DIRECTORY=/home/zuul/src/github.com/osism/ansible-collection-services MOLECULE_PROVISIONER_NAME=ansible MOLECULE_SCENARIO_DIRECTORY=/home/zuul/src/github.com/osism/ansible-collection-services/molecule/delegated MOLECULE_SCENARIO_NAME=delegated MOLECULE_STATE_FILE=/home/zuul/.ansible/tmp/molecule.oWZD.delegated/state.yml MOLECULE_VERIFIER_NAME=testinfra MOLECULE_VERIFIER_TEST_DIRECTORY=/home/zuul/src/github.com/osism/ansible-collection-services/molecule/delegated/tests 2026-05-14 18:51:15.044184 | debian-bookworm | DEBUG [delegated > prepare] ansible-playbook version: ansible-playbook 2026-05-14 18:51:15.044250 | debian-bookworm | config file = None 2026-05-14 18:51:15.044270 | debian-bookworm | configured module search path = 2026-05-14 18:51:15.044275 | debian-bookworm | ansible python module location = /home/zuul/venv/lib/python3.11/site-packages/ansible 2026-05-14 18:51:15.044283 | debian-bookworm | ansible collection location = /home/zuul/.ansible/collections:/usr/share/ansible/collections 2026-05-14 18:51:15.044288 | debian-bookworm | executable location = /home/zuul/venv/bin/ansible-playbook 2026-05-14 18:51:15.044293 | debian-bookworm | python version = 3.11.2 (main, Apr 28 2025, 14:11:48) (/home/zuul/venv/bin/python3) 2026-05-14 18:51:15.044297 | debian-bookworm | jinja version = 3.1.6 2026-05-14 18:51:15.044301 | debian-bookworm | libyaml = True 2026-05-14 18:51:15.044344 | debian-bookworm | DEBUG ANSIBLE ENVIRONMENT: 2026-05-14 18:51:15.044350 | debian-bookworm | ANSIBLE_COLLECTIONS_PATH: /home/zuul/venv/.ansible/collections:/home/zuul/.ansible/collections 2026-05-14 18:51:15.044355 | debian-bookworm | ANSIBLE_CONFIG: /home/zuul/.ansible/tmp/molecule.oWZD.delegated/ansible.cfg 2026-05-14 18:51:15.044359 | debian-bookworm | ANSIBLE_LIBRARY: ../../plugins 2026-05-14 18:51:15.044364 | debian-bookworm | ANSIBLE_PYTHON_INTERPRETER: /home/zuul/venv/bin/python 2026-05-14 18:51:15.044368 | debian-bookworm | ANSIBLE_ROLE: auditd 2026-05-14 18:51:15.044372 | debian-bookworm | ANSIBLE_ROLES_PATH: ../../roles 2026-05-14 18:51:15.044376 | debian-bookworm | ANSIBLE_VERBOSITY: 1 2026-05-14 18:51:15.044380 | debian-bookworm | 2026-05-14 18:51:15.044590 | debian-bookworm | DEBUG MOLECULE ENVIRONMENT: 2026-05-14 18:51:15.044595 | debian-bookworm | MOLECULE_DEBUG: True 2026-05-14 18:51:15.044600 | debian-bookworm | MOLECULE_DEPENDENCY_NAME: galaxy 2026-05-14 18:51:15.044604 | debian-bookworm | MOLECULE_DRIVER_NAME: default 2026-05-14 18:51:15.044608 | debian-bookworm | MOLECULE_ENV_FILE: /home/zuul/src/github.com/osism/ansible-collection-services/.env.yml 2026-05-14 18:51:15.044612 | debian-bookworm | MOLECULE_EPHEMERAL_DIRECTORY: /home/zuul/.ansible/tmp/molecule.oWZD.delegated 2026-05-14 18:51:15.044616 | debian-bookworm | MOLECULE_FILE: /home/zuul/.ansible/tmp/molecule.oWZD.delegated/molecule.yml 2026-05-14 18:51:15.044620 | debian-bookworm | MOLECULE_INSTANCE_CONFIG: /home/zuul/.ansible/tmp/molecule.oWZD.delegated/instance_config.yml 2026-05-14 18:51:15.044624 | debian-bookworm | MOLECULE_INVENTORY_FILE: /home/zuul/.ansible/tmp/molecule.oWZD.delegated/inventory/ansible_inventory.yml 2026-05-14 18:51:15.044629 | debian-bookworm | MOLECULE_PROJECT_DIRECTORY: /home/zuul/src/github.com/osism/ansible-collection-services 2026-05-14 18:51:15.044633 | debian-bookworm | MOLECULE_PROVISIONER_NAME: ansible 2026-05-14 18:51:15.044637 | debian-bookworm | MOLECULE_SCENARIO_DIRECTORY: /home/zuul/src/github.com/osism/ansible-collection-services/molecule/delegated 2026-05-14 18:51:15.044641 | debian-bookworm | MOLECULE_SCENARIO_NAME: delegated 2026-05-14 18:51:15.044645 | debian-bookworm | MOLECULE_STATE_FILE: /home/zuul/.ansible/tmp/molecule.oWZD.delegated/state.yml 2026-05-14 18:51:15.044649 | debian-bookworm | MOLECULE_VERIFIER_NAME: testinfra 2026-05-14 18:51:15.044653 | debian-bookworm | MOLECULE_VERIFIER_TEST_DIRECTORY: /home/zuul/src/github.com/osism/ansible-collection-services/molecule/delegated/tests 2026-05-14 18:51:15.044657 | debian-bookworm | 2026-05-14 18:51:15.044902 | debian-bookworm | DEBUG SHELL REPLAY: ANSIBLE_COLLECTIONS_PATH=/home/zuul/venv/.ansible/collections:/home/zuul/.ansible/collections ANSIBLE_CONFIG=/home/zuul/.ansible/tmp/molecule.oWZD.delegated/ansible.cfg ANSIBLE_LIBRARY=../../plugins ANSIBLE_PYTHON_INTERPRETER=/home/zuul/venv/bin/python ANSIBLE_ROLE=auditd ANSIBLE_ROLES_PATH=../../roles ANSIBLE_VERBOSITY=1 MOLECULE_DEBUG=True MOLECULE_DEPENDENCY_NAME=galaxy MOLECULE_DRIVER_NAME=default MOLECULE_ENV_FILE=/home/zuul/src/github.com/osism/ansible-collection-services/.env.yml MOLECULE_EPHEMERAL_DIRECTORY=/home/zuul/.ansible/tmp/molecule.oWZD.delegated MOLECULE_FILE=/home/zuul/.ansible/tmp/molecule.oWZD.delegated/molecule.yml MOLECULE_INSTANCE_CONFIG=/home/zuul/.ansible/tmp/molecule.oWZD.delegated/instance_config.yml MOLECULE_INVENTORY_FILE=/home/zuul/.ansible/tmp/molecule.oWZD.delegated/inventory/ansible_inventory.yml MOLECULE_PROJECT_DIRECTORY=/home/zuul/src/github.com/osism/ansible-collection-services MOLECULE_PROVISIONER_NAME=ansible MOLECULE_SCENARIO_DIRECTORY=/home/zuul/src/github.com/osism/ansible-collection-services/molecule/delegated MOLECULE_SCENARIO_NAME=delegated MOLECULE_STATE_FILE=/home/zuul/.ansible/tmp/molecule.oWZD.delegated/state.yml MOLECULE_VERIFIER_NAME=testinfra MOLECULE_VERIFIER_TEST_DIRECTORY=/home/zuul/src/github.com/osism/ansible-collection-services/molecule/delegated/tests 2026-05-14 18:51:15.337202 | debian-bookworm | Using /home/zuul/.ansible/tmp/molecule.oWZD.delegated/ansible.cfg as config file 2026-05-14 18:51:15.667166 | ubuntu-noble | Using /home/zuul/.ansible/tmp/molecule.oWZD.delegated/ansible.cfg as config file 2026-05-14 18:51:15.589974 | debian-bookworm | 2026-05-14 18:51:15.590421 | debian-bookworm | PLAY [Prepare] ***************************************************************** 2026-05-14 18:51:15.590877 | debian-bookworm | 2026-05-14 18:51:15.591261 | debian-bookworm | TASK [Gathering Facts] ********************************************************* 2026-05-14 18:51:15.939220 | ubuntu-noble | 2026-05-14 18:51:15.941104 | ubuntu-noble | PLAY [Prepare] ***************************************************************** 2026-05-14 18:51:15.941152 | ubuntu-noble | 2026-05-14 18:51:15.941158 | ubuntu-noble | TASK [Gathering Facts] ********************************************************* 2026-05-14 18:51:16.712187 | debian-bookworm | ok: [molecule-auditd] 2026-05-14 18:51:16.712301 | debian-bookworm | 2026-05-14 18:51:16.712462 | debian-bookworm | TASK [Install packages in venv] ************************************************ 2026-05-14 18:51:17.229048 | ubuntu-noble | ok: [molecule-auditd] 2026-05-14 18:51:17.229096 | ubuntu-noble | 2026-05-14 18:51:17.229103 | ubuntu-noble | TASK [Install packages in venv] ************************************************ 2026-05-14 18:51:21.292685 | debian-bookworm | changed: [molecule-auditd] => (item=docker) => {"ansible_loop_var": "item", "changed": true, "cmd": ["/home/zuul/venv/bin/pip3", "install", "docker"], "item": "docker", "name": ["docker"], "requirements": null, "state": "present", "stderr": "", "stderr_lines": [], "stdout": "Collecting docker\n Downloading docker-7.1.0-py3-none-any.whl (147 kB)\n ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ 147.8/147.8 kB 4.6 MB/s eta 0:00:00\nRequirement already satisfied: requests>=2.26.0 in /home/zuul/venv/lib/python3.11/site-packages (from docker) (2.34.1)\nRequirement already satisfied: urllib3>=1.26.0 in /home/zuul/venv/lib/python3.11/site-packages (from docker) (2.7.0)\nRequirement already satisfied: charset_normalizer<4,>=2 in /home/zuul/venv/lib/python3.11/site-packages (from requests>=2.26.0->docker) (3.4.7)\nRequirement already satisfied: idna<4,>=2.5 in /home/zuul/venv/lib/python3.11/site-packages (from requests>=2.26.0->docker) (3.15)\nRequirement already satisfied: certifi>=2023.5.7 in /home/zuul/venv/lib/python3.11/site-packages (from requests>=2.26.0->docker) (2026.4.22)\nInstalling collected packages: docker\nSuccessfully installed docker-7.1.0\n", "stdout_lines": ["Collecting docker", " Downloading docker-7.1.0-py3-none-any.whl (147 kB)", " ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ 147.8/147.8 kB 4.6 MB/s eta 0:00:00", "Requirement already satisfied: requests>=2.26.0 in /home/zuul/venv/lib/python3.11/site-packages (from docker) (2.34.1)", "Requirement already satisfied: urllib3>=1.26.0 in /home/zuul/venv/lib/python3.11/site-packages (from docker) (2.7.0)", "Requirement already satisfied: charset_normalizer<4,>=2 in /home/zuul/venv/lib/python3.11/site-packages (from requests>=2.26.0->docker) (3.4.7)", "Requirement already satisfied: idna<4,>=2.5 in /home/zuul/venv/lib/python3.11/site-packages (from requests>=2.26.0->docker) (3.15)", "Requirement already satisfied: certifi>=2023.5.7 in /home/zuul/venv/lib/python3.11/site-packages (from requests>=2.26.0->docker) (2026.4.22)", "Installing collected packages: docker", "Successfully installed docker-7.1.0"], "version": null, "virtualenv": "/home/zuul/venv"} 2026-05-14 18:51:21.293074 | debian-bookworm | changed: [molecule-auditd] => (item=netaddr) => {"ansible_loop_var": "item", "changed": true, "cmd": ["/home/zuul/venv/bin/pip3", "install", "netaddr"], "item": "netaddr", "name": ["netaddr"], "requirements": null, "state": "present", "stderr": "", "stderr_lines": [], "stdout": "Collecting netaddr\n Downloading netaddr-1.3.0-py3-none-any.whl (2.3 MB)\n ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ 2.3/2.3 MB 20.4 MB/s eta 0:00:00\nInstalling collected packages: netaddr\nSuccessfully installed netaddr-1.3.0\n", "stdout_lines": ["Collecting netaddr", " Downloading netaddr-1.3.0-py3-none-any.whl (2.3 MB)", " ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ 2.3/2.3 MB 20.4 MB/s eta 0:00:00", "Installing collected packages: netaddr", "Successfully installed netaddr-1.3.0"], "version": null, "virtualenv": "/home/zuul/venv"} 2026-05-14 18:51:21.293280 | debian-bookworm | ok: [molecule-auditd] => (item=requests) => {"ansible_loop_var": "item", "changed": false, "cmd": ["/home/zuul/venv/bin/pip3", "install", "requests"], "item": "requests", "name": ["requests"], "requirements": null, "state": "present", "stderr": "", "stderr_lines": [], "stdout": "Requirement already satisfied: requests in /home/zuul/venv/lib/python3.11/site-packages (2.34.1)\nRequirement already satisfied: charset_normalizer<4,>=2 in /home/zuul/venv/lib/python3.11/site-packages (from requests) (3.4.7)\nRequirement already satisfied: idna<4,>=2.5 in /home/zuul/venv/lib/python3.11/site-packages (from requests) (3.15)\nRequirement already satisfied: urllib3<3,>=1.26 in /home/zuul/venv/lib/python3.11/site-packages (from requests) (2.7.0)\nRequirement already satisfied: certifi>=2023.5.7 in /home/zuul/venv/lib/python3.11/site-packages (from requests) (2026.4.22)\n", "stdout_lines": ["Requirement already satisfied: requests in /home/zuul/venv/lib/python3.11/site-packages (2.34.1)", "Requirement already satisfied: charset_normalizer<4,>=2 in /home/zuul/venv/lib/python3.11/site-packages (from requests) (3.4.7)", "Requirement already satisfied: idna<4,>=2.5 in /home/zuul/venv/lib/python3.11/site-packages (from requests) (3.15)", "Requirement already satisfied: urllib3<3,>=1.26 in /home/zuul/venv/lib/python3.11/site-packages (from requests) (2.7.0)", "Requirement already satisfied: certifi>=2023.5.7 in /home/zuul/venv/lib/python3.11/site-packages (from requests) (2026.4.22)"], "version": null, "virtualenv": "/home/zuul/venv"} 2026-05-14 18:51:21.293474 | debian-bookworm | 2026-05-14 18:51:21.293619 | debian-bookworm | TASK [Include required prepare tasks] ****************************************** 2026-05-14 18:51:21.310736 | debian-bookworm | included: /home/zuul/src/github.com/osism/ansible-collection-services/molecule/delegated/prepare/auditd.yml for molecule-auditd 2026-05-14 18:51:21.310895 | debian-bookworm | 2026-05-14 18:51:21.311085 | debian-bookworm | PLAY RECAP ********************************************************************* 2026-05-14 18:51:21.311279 | debian-bookworm | molecule-auditd : ok=3 changed=1 unreachable=0 failed=0 skipped=0 rescued=0 ignored=0 2026-05-14 18:51:21.311470 | debian-bookworm | 2026-05-14 18:51:21.440368 | debian-bookworm | INFO [delegated > prepare] Executed: Successful 2026-05-14 18:51:21.440999 | debian-bookworm | INFO Molecule executed 1 scenario (1 successful) 2026-05-14 18:51:21.936570 | debian-bookworm | ok: Runtime: 0:00:08.844127 2026-05-14 18:51:22.329545 | ubuntu-noble | ok: Runtime: 0:00:09.544615 2026-05-14 18:51:22.336560 | 2026-05-14 18:51:22.336708 | TASK [ansible-molecule : Reset connection] 2026-05-14 18:51:22.373709 | 2026-05-14 18:51:22.373865 | TASK [ansible-molecule : Reset connection] 2026-05-14 18:51:22.412268 | 2026-05-14 18:51:22.099679 | ubuntu-noble | changed: [molecule-auditd] => (item=docker) => {"ansible_loop_var": "item", "changed": true, "cmd": ["/home/zuul/venv/bin/pip3", "install", "docker"], "item": "docker", "name": ["docker"], "requirements": null, "state": "present", "stderr": "", "stderr_lines": [], "stdout": "Collecting docker\n Downloading docker-7.1.0-py3-none-any.whl.metadata (3.8 kB)\nRequirement already satisfied: requests>=2.26.0 in /home/zuul/venv/lib/python3.12/site-packages (from docker) (2.34.1)\nRequirement already satisfied: urllib3>=1.26.0 in /home/zuul/venv/lib/python3.12/site-packages (from docker) (2.7.0)\nRequirement already satisfied: charset_normalizer<4,>=2 in /home/zuul/venv/lib/python3.12/site-packages (from requests>=2.26.0->docker) (3.4.7)\nRequirement already satisfied: idna<4,>=2.5 in /home/zuul/venv/lib/python3.12/site-packages (from requests>=2.26.0->docker) (3.15)\nRequirement already satisfied: certifi>=2023.5.7 in /home/zuul/venv/lib/python3.12/site-packages (from requests>=2.26.0->docker) (2026.4.22)\nDownloading docker-7.1.0-py3-none-any.whl (147 kB)\n ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ 147.8/147.8 kB 2.6 MB/s eta 0:00:00\nInstalling collected packages: docker\nSuccessfully installed docker-7.1.0\n", "stdout_lines": ["Collecting docker", " Downloading docker-7.1.0-py3-none-any.whl.metadata (3.8 kB)", "Requirement already satisfied: requests>=2.26.0 in /home/zuul/venv/lib/python3.12/site-packages (from docker) (2.34.1)", "Requirement already satisfied: urllib3>=1.26.0 in /home/zuul/venv/lib/python3.12/site-packages (from docker) (2.7.0)", "Requirement already satisfied: charset_normalizer<4,>=2 in /home/zuul/venv/lib/python3.12/site-packages (from requests>=2.26.0->docker) (3.4.7)", "Requirement already satisfied: idna<4,>=2.5 in /home/zuul/venv/lib/python3.12/site-packages (from requests>=2.26.0->docker) (3.15)", "Requirement already satisfied: certifi>=2023.5.7 in /home/zuul/venv/lib/python3.12/site-packages (from requests>=2.26.0->docker) (2026.4.22)", "Downloading docker-7.1.0-py3-none-any.whl (147 kB)", " ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ 147.8/147.8 kB 2.6 MB/s eta 0:00:00", "Installing collected packages: docker", "Successfully installed docker-7.1.0"], "version": null, "virtualenv": "/home/zuul/venv"} 2026-05-14 18:51:22.412668 | TASK [ansible-molecule : Run molecule converge action with scenario delegated] 2026-05-14 18:51:22.099742 | ubuntu-noble | changed: [molecule-auditd] => (item=netaddr) => {"ansible_loop_var": "item", "changed": true, "cmd": ["/home/zuul/venv/bin/pip3", "install", "netaddr"], "item": "netaddr", "name": ["netaddr"], "requirements": null, "state": "present", "stderr": "", "stderr_lines": [], "stdout": "Collecting netaddr\n Downloading netaddr-1.3.0-py3-none-any.whl.metadata (5.0 kB)\nDownloading netaddr-1.3.0-py3-none-any.whl (2.3 MB)\n ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ 2.3/2.3 MB 14.2 MB/s eta 0:00:00\nInstalling collected packages: netaddr\nSuccessfully installed netaddr-1.3.0\n", "stdout_lines": ["Collecting netaddr", " Downloading netaddr-1.3.0-py3-none-any.whl.metadata (5.0 kB)", "Downloading netaddr-1.3.0-py3-none-any.whl (2.3 MB)", " ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ 2.3/2.3 MB 14.2 MB/s eta 0:00:00", "Installing collected packages: netaddr", "Successfully installed netaddr-1.3.0"], "version": null, "virtualenv": "/home/zuul/venv"} 2026-05-14 18:51:22.099766 | ubuntu-noble | ok: [molecule-auditd] => (item=requests) => {"ansible_loop_var": "item", "changed": false, "cmd": ["/home/zuul/venv/bin/pip3", "install", "requests"], "item": "requests", "name": ["requests"], "requirements": null, "state": "present", "stderr": "", "stderr_lines": [], "stdout": "Requirement already satisfied: requests in /home/zuul/venv/lib/python3.12/site-packages (2.34.1)\nRequirement already satisfied: charset_normalizer<4,>=2 in /home/zuul/venv/lib/python3.12/site-packages (from requests) (3.4.7)\nRequirement already satisfied: idna<4,>=2.5 in /home/zuul/venv/lib/python3.12/site-packages (from requests) (3.15)\nRequirement already satisfied: urllib3<3,>=1.26 in /home/zuul/venv/lib/python3.12/site-packages (from requests) (2.7.0)\nRequirement already satisfied: certifi>=2023.5.7 in /home/zuul/venv/lib/python3.12/site-packages (from requests) (2026.4.22)\n", "stdout_lines": ["Requirement already satisfied: requests in /home/zuul/venv/lib/python3.12/site-packages (2.34.1)", "Requirement already satisfied: charset_normalizer<4,>=2 in /home/zuul/venv/lib/python3.12/site-packages (from requests) (3.4.7)", "Requirement already satisfied: idna<4,>=2.5 in /home/zuul/venv/lib/python3.12/site-packages (from requests) (3.15)", "Requirement already satisfied: urllib3<3,>=1.26 in /home/zuul/venv/lib/python3.12/site-packages (from requests) (2.7.0)", "Requirement already satisfied: certifi>=2023.5.7 in /home/zuul/venv/lib/python3.12/site-packages (from requests) (2026.4.22)"], "version": null, "virtualenv": "/home/zuul/venv"} 2026-05-14 18:51:22.099772 | ubuntu-noble | 2026-05-14 18:51:22.099778 | ubuntu-noble | TASK [Include required prepare tasks] ****************************************** 2026-05-14 18:51:22.126050 | ubuntu-noble | included: /home/zuul/src/github.com/osism/ansible-collection-services/molecule/delegated/prepare/auditd.yml for molecule-auditd 2026-05-14 18:51:22.126094 | ubuntu-noble | 2026-05-14 18:51:22.126100 | ubuntu-noble | PLAY RECAP ********************************************************************* 2026-05-14 18:51:22.126105 | ubuntu-noble | molecule-auditd : ok=3 changed=1 unreachable=0 failed=0 skipped=0 rescued=0 ignored=0 2026-05-14 18:51:22.126109 | ubuntu-noble | 2026-05-14 18:51:22.212168 | ubuntu-noble | INFO [delegated > prepare] Executed: Successful 2026-05-14 18:51:22.213240 | ubuntu-noble | INFO Molecule executed 1 scenario (1 successful) 2026-05-14 18:51:23.326486 | ubuntu-noble | WARNING Molecule scenarios should migrate to 'extensions/molecule' 2026-05-14 18:51:23.335040 | ubuntu-noble | DEBUG [unknown > config] provisioner.env found in /home/zuul/src/github.com/osism/ansible-collection-services/molecule/delegated/molecule.yml, this can be defined in ansible.env 2026-05-14 18:51:23.244054 | debian-bookworm | WARNING Molecule scenarios should migrate to 'extensions/molecule' 2026-05-14 18:51:23.253907 | debian-bookworm | DEBUG [unknown > config] provisioner.env found in /home/zuul/src/github.com/osism/ansible-collection-services/molecule/delegated/molecule.yml, this can be defined in ansible.env 2026-05-14 18:51:23.833601 | ubuntu-noble | DEBUG [unknown > config] provisioner.env found in /home/zuul/src/github.com/osism/ansible-collection-services/molecule/delegated/molecule.yml, this can be defined in ansible.env 2026-05-14 18:51:23.834250 | ubuntu-noble | DEBUG [delegated > validate] Validating schema /home/zuul/src/github.com/osism/ansible-collection-services/molecule/delegated/molecule.yml. 2026-05-14 18:51:23.845596 | ubuntu-noble | CRITICAL 'molecule/default/molecule.yml' glob failed. Exiting. 2026-05-14 18:51:23.845674 | ubuntu-noble | INFO default scenario not found, disabling shared state. 2026-05-14 18:51:23.845883 | ubuntu-noble | INFO [delegated > discovery] scenario test matrix: dependency, create, prepare, converge 2026-05-14 18:51:23.846036 | ubuntu-noble | INFO [delegated > prerun] Performing prerun with role_name_check=0... 2026-05-14 18:51:23.705714 | debian-bookworm | DEBUG [unknown > config] provisioner.env found in /home/zuul/src/github.com/osism/ansible-collection-services/molecule/delegated/molecule.yml, this can be defined in ansible.env 2026-05-14 18:51:23.706298 | debian-bookworm | DEBUG [delegated > validate] Validating schema /home/zuul/src/github.com/osism/ansible-collection-services/molecule/delegated/molecule.yml. 2026-05-14 18:51:23.716481 | debian-bookworm | CRITICAL 'molecule/default/molecule.yml' glob failed. Exiting. 2026-05-14 18:51:23.716552 | debian-bookworm | INFO default scenario not found, disabling shared state. 2026-05-14 18:51:23.716725 | debian-bookworm | INFO [delegated > discovery] scenario test matrix: dependency, create, prepare, converge 2026-05-14 18:51:23.716862 | debian-bookworm | INFO [delegated > prerun] Performing prerun with role_name_check=0... 2026-05-14 18:51:24.873980 | debian-bookworm | INFO [delegated > dependency] Executing 2026-05-14 18:51:24.874285 | debian-bookworm | WARNING [delegated > dependency] Missing roles requirements file: requirements.yml 2026-05-14 18:51:25.262421 | ubuntu-noble | INFO [delegated > dependency] Executing 2026-05-14 18:51:25.262977 | ubuntu-noble | WARNING [delegated > dependency] Missing roles requirements file: requirements.yml 2026-05-14 18:51:25.232558 | debian-bookworm | ansible-galaxy [core 2.18.16] 2026-05-14 18:51:25.233126 | debian-bookworm | config file = None 2026-05-14 18:51:25.233737 | debian-bookworm | configured module search path = ['/home/zuul/src/github.com/osism/ansible-collection-services/plugins/modules', '/home/zuul/.ansible/plugins/modules', '/usr/share/ansible/plugins/modules'] 2026-05-14 18:51:25.234123 | debian-bookworm | ansible python module location = /home/zuul/venv/lib/python3.11/site-packages/ansible 2026-05-14 18:51:25.234542 | debian-bookworm | ansible collection location = /home/zuul/.ansible/collections:/usr/share/ansible/collections:/home/zuul/venv/lib/python3.11/site-packages:/home/zuul/venv/lib/python3.11/dist-packages:/home/zuul/venv/lib/python3/dist-packages:/home/zuul/venv/local/lib/python3.11/dist-packages 2026-05-14 18:51:25.234865 | debian-bookworm | executable location = /home/zuul/venv/bin/ansible-galaxy 2026-05-14 18:51:25.235113 | debian-bookworm | python version = 3.11.2 (main, Apr 28 2025, 14:11:48) [GCC 12.2.0] (/home/zuul/venv/bin/python3) 2026-05-14 18:51:25.235374 | debian-bookworm | jinja version = 3.1.6 2026-05-14 18:51:25.235631 | debian-bookworm | libyaml = True 2026-05-14 18:51:25.235846 | debian-bookworm | No config file found; using defaults 2026-05-14 18:51:25.236206 | debian-bookworm | Reading requirement file at '/home/zuul/src/github.com/osism/ansible-collection-services/molecule/delegated/collections.yml' 2026-05-14 18:51:25.238828 | debian-bookworm | Loading collection osism.commons from /home/zuul/.ansible/collections/ansible_collections/osism/commons 2026-05-14 18:51:25.240619 | debian-bookworm | Found installed collection osism.commons:0.20260318.0 at '/home/zuul/.ansible/collections/ansible_collections/osism/commons' 2026-05-14 18:51:25.241941 | debian-bookworm | Loading collection osism.services from /home/zuul/.ansible/collections/ansible_collections/osism/services 2026-05-14 18:51:25.242252 | debian-bookworm | Found installed collection osism.services:999.0.0 at '/home/zuul/.ansible/collections/ansible_collections/osism/services' 2026-05-14 18:51:25.246770 | debian-bookworm | Loading collection cisco.dnac from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/cisco/dnac 2026-05-14 18:51:25.247104 | debian-bookworm | Found installed collection cisco.dnac:6.31.3 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/cisco/dnac' 2026-05-14 18:51:25.247427 | debian-bookworm | Loading collection ravendb.ravendb from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/ravendb/ravendb 2026-05-14 18:51:25.247751 | debian-bookworm | Found installed collection ravendb.ravendb:1.0.4 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/ravendb/ravendb' 2026-05-14 18:51:25.248181 | debian-bookworm | Loading collection netapp.storagegrid from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/netapp/storagegrid 2026-05-14 18:51:25.248514 | debian-bookworm | Found installed collection netapp.storagegrid:21.14.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/netapp/storagegrid' 2026-05-14 18:51:25.249097 | debian-bookworm | Loading collection community.windows from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/windows 2026-05-14 18:51:25.249502 | debian-bookworm | Found installed collection community.windows:2.4.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/windows' 2026-05-14 18:51:25.250694 | debian-bookworm | Loading collection hetzner.hcloud from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/hetzner/hcloud 2026-05-14 18:51:25.250985 | debian-bookworm | Found installed collection hetzner.hcloud:4.3.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/hetzner/hcloud' 2026-05-14 18:51:25.251280 | debian-bookworm | Loading collection community.mysql from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/mysql 2026-05-14 18:51:25.251600 | debian-bookworm | Found installed collection community.mysql:3.16.1 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/mysql' 2026-05-14 18:51:25.251897 | debian-bookworm | Loading collection community.library_inventory_filtering_v1 from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/library_inventory_filtering_v1 2026-05-14 18:51:25.252197 | debian-bookworm | Found installed collection community.library_inventory_filtering_v1:1.1.5 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/library_inventory_filtering_v1' 2026-05-14 18:51:25.252516 | debian-bookworm | Loading collection community.sap_libs from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/sap_libs 2026-05-14 18:51:25.252823 | debian-bookworm | Found installed collection community.sap_libs:1.5.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/sap_libs' 2026-05-14 18:51:25.253131 | debian-bookworm | Loading collection inspur.ispim from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/inspur/ispim 2026-05-14 18:51:25.253473 | debian-bookworm | Found installed collection inspur.ispim:2.2.4 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/inspur/ispim' 2026-05-14 18:51:25.253818 | debian-bookworm | Loading collection purestorage.flasharray from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/purestorage/flasharray 2026-05-14 18:51:25.254118 | debian-bookworm | Found installed collection purestorage.flasharray:1.40.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/purestorage/flasharray' 2026-05-14 18:51:25.254445 | debian-bookworm | Loading collection containers.podman from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/containers/podman 2026-05-14 18:51:25.254738 | debian-bookworm | Found installed collection containers.podman:1.18.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/containers/podman' 2026-05-14 18:51:25.255035 | debian-bookworm | Loading collection community.mongodb from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/mongodb 2026-05-14 18:51:25.255333 | debian-bookworm | Found installed collection community.mongodb:1.7.10 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/mongodb' 2026-05-14 18:51:25.256283 | debian-bookworm | Loading collection arista.eos from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/arista/eos 2026-05-14 18:51:25.256583 | debian-bookworm | Found installed collection arista.eos:10.1.1 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/arista/eos' 2026-05-14 18:51:25.256918 | debian-bookworm | Loading collection grafana.grafana from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/grafana/grafana 2026-05-14 18:51:25.257240 | debian-bookworm | Found installed collection grafana.grafana:5.7.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/grafana/grafana' 2026-05-14 18:51:25.258177 | debian-bookworm | Loading collection google.cloud from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/google/cloud 2026-05-14 18:51:25.258501 | debian-bookworm | Found installed collection google.cloud:1.10.2 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/google/cloud' 2026-05-14 18:51:25.258801 | debian-bookworm | Loading collection cisco.ucs from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/cisco/ucs 2026-05-14 18:51:25.259098 | debian-bookworm | Found installed collection cisco.ucs:1.16.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/cisco/ucs' 2026-05-14 18:51:25.260965 | debian-bookworm | Loading collection cisco.nxos from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/cisco/nxos 2026-05-14 18:51:25.261264 | debian-bookworm | Found installed collection cisco.nxos:9.4.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/cisco/nxos' 2026-05-14 18:51:25.262664 | debian-bookworm | Loading collection amazon.aws from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/amazon/aws 2026-05-14 18:51:25.262958 | debian-bookworm | Found installed collection amazon.aws:9.5.2 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/amazon/aws' 2026-05-14 18:51:25.263540 | debian-bookworm | Loading collection ibm.qradar from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/ibm/qradar 2026-05-14 18:51:25.263841 | debian-bookworm | Found installed collection ibm.qradar:4.0.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/ibm/qradar' 2026-05-14 18:51:25.264130 | debian-bookworm | Loading collection community.rabbitmq from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/rabbitmq 2026-05-14 18:51:25.264446 | debian-bookworm | Found installed collection community.rabbitmq:1.6.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/rabbitmq' 2026-05-14 18:51:25.264738 | debian-bookworm | Loading collection hitachivantara.vspone_object from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/hitachivantara/vspone_object 2026-05-14 18:51:25.265038 | debian-bookworm | Found installed collection hitachivantara.vspone_object:1.1.1 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/hitachivantara/vspone_object' 2026-05-14 18:51:25.265337 | debian-bookworm | Loading collection community.libvirt from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/libvirt 2026-05-14 18:51:25.265745 | debian-bookworm | Found installed collection community.libvirt:1.4.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/libvirt' 2026-05-14 18:51:25.266042 | debian-bookworm | Loading collection community.grafana from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/grafana 2026-05-14 18:51:25.266264 | debian-bookworm | Found installed collection community.grafana:2.3.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/grafana' 2026-05-14 18:51:25.266553 | debian-bookworm | Loading collection netapp.cloudmanager from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/netapp/cloudmanager 2026-05-14 18:51:25.266840 | debian-bookworm | Found installed collection netapp.cloudmanager:21.24.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/netapp/cloudmanager' 2026-05-14 18:51:25.267116 | debian-bookworm | Loading collection kubevirt.core from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/kubevirt/core 2026-05-14 18:51:25.267426 | debian-bookworm | Found installed collection kubevirt.core:2.2.3 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/kubevirt/core' 2026-05-14 18:51:25.267671 | debian-bookworm | Loading collection community.hrobot from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/hrobot 2026-05-14 18:51:25.267940 | debian-bookworm | Found installed collection community.hrobot:2.7.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/hrobot' 2026-05-14 18:51:25.268210 | debian-bookworm | Loading collection community.hashi_vault from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/hashi_vault 2026-05-14 18:51:25.268508 | debian-bookworm | Found installed collection community.hashi_vault:6.2.1 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/hashi_vault' 2026-05-14 18:51:25.269377 | debian-bookworm | Loading collection vyos.vyos from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/vyos/vyos 2026-05-14 18:51:25.269760 | debian-bookworm | Found installed collection vyos.vyos:5.0.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/vyos/vyos' 2026-05-14 18:51:25.270272 | debian-bookworm | Loading collection vmware.vmware from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/vmware/vmware 2026-05-14 18:51:25.270603 | debian-bookworm | Found installed collection vmware.vmware:1.11.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/vmware/vmware' 2026-05-14 18:51:25.271330 | debian-bookworm | Loading collection dellemc.enterprise_sonic from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/dellemc/enterprise_sonic 2026-05-14 18:51:25.271647 | debian-bookworm | Found installed collection dellemc.enterprise_sonic:2.5.1 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/dellemc/enterprise_sonic' 2026-05-14 18:51:25.273678 | debian-bookworm | Loading collection ansible.netcommon from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/ansible/netcommon 2026-05-14 18:51:25.274049 | debian-bookworm | Found installed collection ansible.netcommon:7.2.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/ansible/netcommon' 2026-05-14 18:51:25.277375 | debian-bookworm | Loading collection fortinet.fortios from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/fortinet/fortios 2026-05-14 18:51:25.277792 | debian-bookworm | Found installed collection fortinet.fortios:2.4.2 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/fortinet/fortios' 2026-05-14 18:51:25.279324 | debian-bookworm | Loading collection theforeman.foreman from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/theforeman/foreman 2026-05-14 18:51:25.279710 | debian-bookworm | Found installed collection theforeman.foreman:4.2.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/theforeman/foreman' 2026-05-14 18:51:25.280720 | debian-bookworm | Loading collection junipernetworks.junos from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/junipernetworks/junos 2026-05-14 18:51:25.280966 | debian-bookworm | Found installed collection junipernetworks.junos:9.1.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/junipernetworks/junos' 2026-05-14 18:51:25.281297 | debian-bookworm | Loading collection lowlydba.sqlserver from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/lowlydba/sqlserver 2026-05-14 18:51:25.281562 | debian-bookworm | Found installed collection lowlydba.sqlserver:2.7.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/lowlydba/sqlserver' 2026-05-14 18:51:25.282633 | debian-bookworm | Loading collection f5networks.f5_modules from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/f5networks/f5_modules 2026-05-14 18:51:25.283122 | debian-bookworm | Found installed collection f5networks.f5_modules:1.39.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/f5networks/f5_modules' 2026-05-14 18:51:25.283494 | debian-bookworm | Loading collection cisco.asa from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/cisco/asa 2026-05-14 18:51:25.283806 | debian-bookworm | Found installed collection cisco.asa:6.1.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/cisco/asa' 2026-05-14 18:51:25.284614 | debian-bookworm | Loading collection cisco.mso from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/cisco/mso 2026-05-14 18:51:25.285018 | debian-bookworm | Found installed collection cisco.mso:2.12.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/cisco/mso' 2026-05-14 18:51:25.285890 | debian-bookworm | Loading collection community.digitalocean from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/digitalocean 2026-05-14 18:51:25.286247 | debian-bookworm | Found installed collection community.digitalocean:1.27.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/digitalocean' 2026-05-14 18:51:25.286656 | debian-bookworm | Loading collection community.proxmox from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/proxmox 2026-05-14 18:51:25.286976 | debian-bookworm | Found installed collection community.proxmox:1.4.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/proxmox' 2026-05-14 18:51:25.289008 | debian-bookworm | Loading collection awx.awx from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/awx/awx 2026-05-14 18:51:25.289280 | debian-bookworm | Found installed collection awx.awx:24.6.1 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/awx/awx' 2026-05-14 18:51:25.289848 | debian-bookworm | Loading collection dellemc.powerflex from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/dellemc/powerflex 2026-05-14 18:51:25.290455 | debian-bookworm | Found installed collection dellemc.powerflex:2.6.1 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/dellemc/powerflex' 2026-05-14 18:51:25.290760 | debian-bookworm | Loading collection chocolatey.chocolatey from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/chocolatey/chocolatey 2026-05-14 18:51:25.290973 | debian-bookworm | Found installed collection chocolatey.chocolatey:1.5.3 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/chocolatey/chocolatey' 2026-05-14 18:51:25.291294 | debian-bookworm | Loading collection ngine_io.cloudstack from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/ngine_io/cloudstack 2026-05-14 18:51:25.291635 | debian-bookworm | Found installed collection ngine_io.cloudstack:2.5.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/ngine_io/cloudstack' 2026-05-14 18:51:25.291901 | debian-bookworm | Loading collection infinidat.infinibox from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/infinidat/infinibox 2026-05-14 18:51:25.292131 | debian-bookworm | Found installed collection infinidat.infinibox:1.6.3 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/infinidat/infinibox' 2026-05-14 18:51:25.294669 | debian-bookworm | Loading collection vmware.vmware_rest from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/vmware/vmware_rest 2026-05-14 18:51:25.294999 | debian-bookworm | Found installed collection vmware.vmware_rest:4.9.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/vmware/vmware_rest' 2026-05-14 18:51:25.295232 | debian-bookworm | Loading collection community.proxysql from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/proxysql 2026-05-14 18:51:25.295542 | debian-bookworm | Found installed collection community.proxysql:1.7.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/proxysql' 2026-05-14 18:51:25.304250 | debian-bookworm | Loading collection community.general from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/general 2026-05-14 18:51:25.304502 | debian-bookworm | Found installed collection community.general:10.7.6 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/general' 2026-05-14 18:51:25.305148 | debian-bookworm | Loading collection splunk.es from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/splunk/es 2026-05-14 18:51:25.305501 | debian-bookworm | Found installed collection splunk.es:4.0.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/splunk/es' 2026-05-14 18:51:25.355906 | debian-bookworm | Loading collection community.network from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/network 2026-05-14 18:51:25.356518 | debian-bookworm | Found installed collection community.network:5.1.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/network' 2026-05-14 18:51:25.357001 | debian-bookworm | Loading collection cisco.ise from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/cisco/ise 2026-05-14 18:51:25.357545 | debian-bookworm | Found installed collection cisco.ise:2.10.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/cisco/ise' 2026-05-14 18:51:25.358368 | debian-bookworm | Loading collection kubernetes.core from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/kubernetes/core 2026-05-14 18:51:25.358794 | debian-bookworm | Found installed collection kubernetes.core:5.4.1 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/kubernetes/core' 2026-05-14 18:51:25.359541 | debian-bookworm | Loading collection telekom_mms.icinga_director from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/telekom_mms/icinga_director 2026-05-14 18:51:25.359922 | debian-bookworm | Found installed collection telekom_mms.icinga_director:2.5.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/telekom_mms/icinga_director' 2026-05-14 18:51:25.360292 | debian-bookworm | Loading collection ibm.storage_virtualize from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/ibm/storage_virtualize 2026-05-14 18:51:25.360688 | debian-bookworm | Found installed collection ibm.storage_virtualize:2.7.4 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/ibm/storage_virtualize' 2026-05-14 18:51:25.361368 | debian-bookworm | Loading collection wti.remote from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/wti/remote 2026-05-14 18:51:25.361836 | debian-bookworm | Found installed collection wti.remote:1.0.10 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/wti/remote' 2026-05-14 18:51:25.362219 | debian-bookworm | Loading collection purestorage.flashblade from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/purestorage/flashblade 2026-05-14 18:51:25.362627 | debian-bookworm | Found installed collection purestorage.flashblade:1.22.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/purestorage/flashblade' 2026-05-14 18:51:25.363810 | debian-bookworm | Loading collection netbox.netbox from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/netbox/netbox 2026-05-14 18:51:25.364139 | debian-bookworm | Found installed collection netbox.netbox:3.21.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/netbox/netbox' 2026-05-14 18:51:25.364551 | debian-bookworm | Loading collection cyberark.conjur from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/cyberark/conjur 2026-05-14 18:51:25.364892 | debian-bookworm | Found installed collection cyberark.conjur:1.3.9 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/cyberark/conjur' 2026-05-14 18:51:25.365535 | debian-bookworm | Loading collection community.postgresql from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/postgresql 2026-05-14 18:51:25.365948 | debian-bookworm | Found installed collection community.postgresql:3.14.3 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/postgresql' 2026-05-14 18:51:25.366893 | debian-bookworm | Loading collection openstack.cloud from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/openstack/cloud 2026-05-14 18:51:25.367228 | debian-bookworm | Found installed collection openstack.cloud:2.5.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/openstack/cloud' 2026-05-14 18:51:25.367589 | debian-bookworm | Loading collection kaytus.ksmanage from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/kaytus/ksmanage 2026-05-14 18:51:25.368022 | debian-bookworm | Found installed collection kaytus.ksmanage:2.0.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/kaytus/ksmanage' 2026-05-14 18:51:25.370616 | debian-bookworm | Loading collection cisco.aci from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/cisco/aci 2026-05-14 18:51:25.371034 | debian-bookworm | Found installed collection cisco.aci:2.13.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/cisco/aci' 2026-05-14 18:51:25.371369 | debian-bookworm | Loading collection cloud.common from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/cloud/common 2026-05-14 18:51:25.371821 | debian-bookworm | Found installed collection cloud.common:4.2.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/cloud/common' 2026-05-14 18:51:25.372150 | debian-bookworm | Loading collection infoblox.nios_modules from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/infoblox/nios_modules 2026-05-14 18:51:25.372510 | debian-bookworm | Found installed collection infoblox.nios_modules:1.8.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/infoblox/nios_modules' 2026-05-14 18:51:25.377925 | debian-bookworm | Loading collection community.aws from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/aws 2026-05-14 18:51:25.378314 | debian-bookworm | Found installed collection community.aws:9.3.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/aws' 2026-05-14 18:51:25.378710 | debian-bookworm | Loading collection cisco.intersight from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/cisco/intersight 2026-05-14 18:51:25.379084 | debian-bookworm | Found installed collection cisco.intersight:2.12.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/cisco/intersight' 2026-05-14 18:51:25.379759 | debian-bookworm | Loading collection check_point.mgmt from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/check_point/mgmt 2026-05-14 18:51:25.380134 | debian-bookworm | Found installed collection check_point.mgmt:6.7.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/check_point/mgmt' 2026-05-14 18:51:25.380520 | debian-bookworm | Loading collection microsoft.iis from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/microsoft/iis 2026-05-14 18:51:25.380891 | debian-bookworm | Found installed collection microsoft.iis:1.1.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/microsoft/iis' 2026-05-14 18:51:25.381672 | debian-bookworm | Loading collection community.okd from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/okd 2026-05-14 18:51:25.382029 | debian-bookworm | Found installed collection community.okd:4.0.2 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/okd' 2026-05-14 18:51:25.383348 | debian-bookworm | Loading collection cisco.ios from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/cisco/ios 2026-05-14 18:51:25.383821 | debian-bookworm | Found installed collection cisco.ios:9.2.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/cisco/ios' 2026-05-14 18:51:25.384996 | debian-bookworm | Loading collection dellemc.unity from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/dellemc/unity 2026-05-14 18:51:25.385460 | debian-bookworm | Found installed collection dellemc.unity:2.1.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/dellemc/unity' 2026-05-14 18:51:25.386278 | debian-bookworm | Loading collection community.crypto from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/crypto 2026-05-14 18:51:25.386726 | debian-bookworm | Found installed collection community.crypto:2.26.6 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/crypto' 2026-05-14 18:51:25.389318 | debian-bookworm | Loading collection community.vmware from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/vmware 2026-05-14 18:51:25.389854 | debian-bookworm | Found installed collection community.vmware:5.10.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/vmware' 2026-05-14 18:51:25.390180 | debian-bookworm | Loading collection community.ciscosmb from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/ciscosmb 2026-05-14 18:51:25.390623 | debian-bookworm | Found installed collection community.ciscosmb:1.0.11 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/ciscosmb' 2026-05-14 18:51:25.400839 | debian-bookworm | Loading collection fortinet.fortimanager from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/fortinet/fortimanager 2026-05-14 18:51:25.401213 | debian-bookworm | Found installed collection fortinet.fortimanager:2.11.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/fortinet/fortimanager' 2026-05-14 18:51:25.401950 | debian-bookworm | Loading collection vultr.cloud from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/vultr/cloud 2026-05-14 18:51:25.402310 | debian-bookworm | Found installed collection vultr.cloud:1.13.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/vultr/cloud' 2026-05-14 18:51:25.403749 | debian-bookworm | Loading collection cisco.iosxr from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/cisco/iosxr 2026-05-14 18:51:25.404151 | debian-bookworm | Found installed collection cisco.iosxr:10.3.1 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/cisco/iosxr' 2026-05-14 18:51:25.407356 | debian-bookworm | Loading collection azure.azcollection from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/azure/azcollection 2026-05-14 18:51:25.407742 | debian-bookworm | Found installed collection azure.azcollection:3.12.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/azure/azcollection' 2026-05-14 18:51:25.408887 | debian-bookworm | Loading collection dellemc.openmanage from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/dellemc/openmanage 2026-05-14 18:51:25.409251 | debian-bookworm | Found installed collection dellemc.openmanage:9.12.3 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/dellemc/openmanage' 2026-05-14 18:51:25.409667 | debian-bookworm | Loading collection community.routeros from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/routeros 2026-05-14 18:51:25.410143 | debian-bookworm | Found installed collection community.routeros:3.14.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/routeros' 2026-05-14 18:51:25.411701 | debian-bookworm | Loading collection netapp.ontap from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/netapp/ontap 2026-05-14 18:51:25.412048 | debian-bookworm | Found installed collection netapp.ontap:22.14.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/netapp/ontap' 2026-05-14 18:51:25.413449 | debian-bookworm | Loading collection cloudscale_ch.cloud from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/cloudscale_ch/cloud 2026-05-14 18:51:25.413878 | debian-bookworm | Found installed collection cloudscale_ch.cloud:2.5.2 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/cloudscale_ch/cloud' 2026-05-14 18:51:25.414454 | debian-bookworm | Loading collection community.dns from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/dns 2026-05-14 18:51:25.414838 | debian-bookworm | Found installed collection community.dns:3.4.1 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/dns' 2026-05-14 18:51:25.415875 | debian-bookworm | Loading collection ovirt.ovirt from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/ovirt/ovirt 2026-05-14 18:51:25.416241 | debian-bookworm | Found installed collection ovirt.ovirt:3.2.1 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/ovirt/ovirt' 2026-05-14 18:51:25.416668 | debian-bookworm | Loading collection community.sops from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/sops 2026-05-14 18:51:25.417035 | debian-bookworm | Found installed collection community.sops:2.2.7 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/sops' 2026-05-14 18:51:25.420146 | debian-bookworm | Loading collection cisco.meraki from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/cisco/meraki 2026-05-14 18:51:25.420537 | debian-bookworm | Found installed collection cisco.meraki:2.21.9 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/cisco/meraki' 2026-05-14 18:51:25.421020 | debian-bookworm | Loading collection microsoft.ad from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/microsoft/ad 2026-05-14 18:51:25.421419 | debian-bookworm | Found installed collection microsoft.ad:1.10.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/microsoft/ad' 2026-05-14 18:51:25.421842 | debian-bookworm | Loading collection ansible.utils from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/ansible/utils 2026-05-14 18:51:25.422210 | debian-bookworm | Found installed collection ansible.utils:5.1.2 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/ansible/utils' 2026-05-14 18:51:25.422608 | debian-bookworm | Loading collection cyberark.pas from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/cyberark/pas 2026-05-14 18:51:25.423009 | debian-bookworm | Found installed collection cyberark.pas:1.0.36 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/cyberark/pas' 2026-05-14 18:51:25.423373 | debian-bookworm | Loading collection ieisystem.inmanage from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/ieisystem/inmanage 2026-05-14 18:51:25.423771 | debian-bookworm | Found installed collection ieisystem.inmanage:3.0.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/ieisystem/inmanage' 2026-05-14 18:51:25.424133 | debian-bookworm | Loading collection sensu.sensu_go from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/sensu/sensu_go 2026-05-14 18:51:25.424553 | debian-bookworm | Found installed collection sensu.sensu_go:1.14.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/sensu/sensu_go' 2026-05-14 18:51:25.425015 | debian-bookworm | Loading collection community.zabbix from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/zabbix 2026-05-14 18:51:25.425338 | debian-bookworm | Found installed collection community.zabbix:3.3.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/zabbix' 2026-05-14 18:51:25.426000 | debian-bookworm | Loading collection ansible.windows from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/ansible/windows 2026-05-14 18:51:25.426263 | debian-bookworm | Found installed collection ansible.windows:2.8.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/ansible/windows' 2026-05-14 18:51:25.426984 | debian-bookworm | Loading collection hitachivantara.vspone_block from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/hitachivantara/vspone_block 2026-05-14 18:51:25.427381 | debian-bookworm | Found installed collection hitachivantara.vspone_block:3.5.1 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/hitachivantara/vspone_block' 2026-05-14 18:51:25.428014 | debian-bookworm | Loading collection community.docker from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/docker 2026-05-14 18:51:25.428403 | debian-bookworm | Found installed collection community.docker:4.8.5 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/docker' 2026-05-14 18:51:25.428830 | debian-bookworm | Loading collection ansible.posix from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/ansible/posix 2026-05-14 18:51:25.429288 | debian-bookworm | Found installed collection ansible.posix:1.6.2 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/ansible/posix' 2026-05-14 18:51:25.430248 | debian-bookworm | Loading collection netapp_eseries.santricity from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/netapp_eseries/santricity 2026-05-14 18:51:25.430863 | debian-bookworm | Found installed collection netapp_eseries.santricity:1.4.1 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/netapp_eseries/santricity' 2026-05-14 18:51:25.431133 | debian-bookworm | Loading collection ibm.spectrum_virtualize from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/ibm/spectrum_virtualize 2026-05-14 18:51:25.431641 | debian-bookworm | Found installed collection ibm.spectrum_virtualize:2.0.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/ibm/spectrum_virtualize' 2026-05-14 18:51:25.432702 | debian-bookworm | Starting galaxy collection install process 2026-05-14 18:51:25.432895 | debian-bookworm | Nothing to do. All requested collections are already installed. If you want to reinstall them, consider using `--force`. 2026-05-14 18:51:25.656023 | ubuntu-noble | ansible-galaxy [core 2.18.16] 2026-05-14 18:51:25.656074 | ubuntu-noble | config file = None 2026-05-14 18:51:25.656084 | ubuntu-noble | configured module search path = ['/home/zuul/src/github.com/osism/ansible-collection-services/plugins/modules', '/home/zuul/.ansible/plugins/modules', '/usr/share/ansible/plugins/modules'] 2026-05-14 18:51:25.656595 | ubuntu-noble | ansible python module location = /home/zuul/venv/lib/python3.12/site-packages/ansible 2026-05-14 18:51:25.657184 | ubuntu-noble | ansible collection location = /home/zuul/.ansible/collections:/usr/share/ansible/collections:/home/zuul/venv/lib/python3.12/site-packages:/home/zuul/venv/lib/python3.12/dist-packages:/home/zuul/venv/lib/python3/dist-packages:/home/zuul/venv/local/lib/python3.12/dist-packages 2026-05-14 18:51:25.657492 | ubuntu-noble | executable location = /home/zuul/venv/bin/ansible-galaxy 2026-05-14 18:51:25.657801 | ubuntu-noble | python version = 3.12.3 (main, Mar 23 2026, 19:04:32) [GCC 13.3.0] (/home/zuul/venv/bin/python3) 2026-05-14 18:51:25.658210 | ubuntu-noble | jinja version = 3.1.6 2026-05-14 18:51:25.658497 | ubuntu-noble | libyaml = True 2026-05-14 18:51:25.658749 | ubuntu-noble | No config file found; using defaults 2026-05-14 18:51:25.659310 | ubuntu-noble | Reading requirement file at '/home/zuul/src/github.com/osism/ansible-collection-services/molecule/delegated/collections.yml' 2026-05-14 18:51:25.668753 | ubuntu-noble | Loading collection arista.eos from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/arista/eos 2026-05-14 18:51:25.669209 | ubuntu-noble | Found installed collection arista.eos:10.1.1 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/arista/eos' 2026-05-14 18:51:25.669534 | ubuntu-noble | Loading collection microsoft.iis from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/microsoft/iis 2026-05-14 18:51:25.669849 | ubuntu-noble | Found installed collection microsoft.iis:1.1.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/microsoft/iis' 2026-05-14 18:51:25.670182 | ubuntu-noble | Loading collection netapp.storagegrid from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/netapp/storagegrid 2026-05-14 18:51:25.670468 | ubuntu-noble | Found installed collection netapp.storagegrid:21.14.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/netapp/storagegrid' 2026-05-14 18:51:25.671846 | ubuntu-noble | Loading collection community.digitalocean from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/digitalocean 2026-05-14 18:51:25.672193 | ubuntu-noble | Found installed collection community.digitalocean:1.27.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/digitalocean' 2026-05-14 18:51:25.674032 | ubuntu-noble | Loading collection theforeman.foreman from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/theforeman/foreman 2026-05-14 18:51:25.674338 | ubuntu-noble | Found installed collection theforeman.foreman:4.2.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/theforeman/foreman' 2026-05-14 18:51:25.675428 | ubuntu-noble | Loading collection cisco.ios from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/cisco/ios 2026-05-14 18:51:25.675726 | ubuntu-noble | Found installed collection cisco.ios:9.2.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/cisco/ios' 2026-05-14 18:51:25.680516 | ubuntu-noble | Loading collection fortinet.fortios from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/fortinet/fortios 2026-05-14 18:51:25.680819 | ubuntu-noble | Found installed collection fortinet.fortios:2.4.2 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/fortinet/fortios' 2026-05-14 18:51:25.699131 | ubuntu-noble | Loading collection cisco.aci from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/cisco/aci 2026-05-14 18:51:25.699473 | ubuntu-noble | Found installed collection cisco.aci:2.13.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/cisco/aci' 2026-05-14 18:51:25.699798 | ubuntu-noble | Loading collection purestorage.flasharray from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/purestorage/flasharray 2026-05-14 18:51:25.700185 | ubuntu-noble | Found installed collection purestorage.flasharray:1.40.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/purestorage/flasharray' 2026-05-14 18:51:25.700497 | ubuntu-noble | Loading collection chocolatey.chocolatey from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/chocolatey/chocolatey 2026-05-14 18:51:25.700804 | ubuntu-noble | Found installed collection chocolatey.chocolatey:1.5.3 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/chocolatey/chocolatey' 2026-05-14 18:51:25.701891 | ubuntu-noble | Loading collection vyos.vyos from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/vyos/vyos 2026-05-14 18:51:25.703133 | ubuntu-noble | Found installed collection vyos.vyos:5.0.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/vyos/vyos' 2026-05-14 18:51:25.703183 | ubuntu-noble | Loading collection community.proxysql from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/proxysql 2026-05-14 18:51:25.703194 | ubuntu-noble | Found installed collection community.proxysql:1.7.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/proxysql' 2026-05-14 18:51:25.704266 | ubuntu-noble | Loading collection junipernetworks.junos from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/junipernetworks/junos 2026-05-14 18:51:25.704298 | ubuntu-noble | Found installed collection junipernetworks.junos:9.1.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/junipernetworks/junos' 2026-05-14 18:51:25.706041 | ubuntu-noble | Loading collection kubernetes.core from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/kubernetes/core 2026-05-14 18:51:25.706071 | ubuntu-noble | Found installed collection kubernetes.core:5.4.1 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/kubernetes/core' 2026-05-14 18:51:25.706079 | ubuntu-noble | Loading collection community.rabbitmq from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/rabbitmq 2026-05-14 18:51:25.706086 | ubuntu-noble | Found installed collection community.rabbitmq:1.6.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/rabbitmq' 2026-05-14 18:51:25.706143 | ubuntu-noble | Loading collection microsoft.ad from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/microsoft/ad 2026-05-14 18:51:25.706476 | ubuntu-noble | Found installed collection microsoft.ad:1.10.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/microsoft/ad' 2026-05-14 18:51:25.706728 | ubuntu-noble | Loading collection ibm.storage_virtualize from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/ibm/storage_virtualize 2026-05-14 18:51:25.707168 | ubuntu-noble | Found installed collection ibm.storage_virtualize:2.7.4 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/ibm/storage_virtualize' 2026-05-14 18:51:25.708884 | ubuntu-noble | Loading collection cisco.nxos from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/cisco/nxos 2026-05-14 18:51:25.709298 | ubuntu-noble | Found installed collection cisco.nxos:9.4.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/cisco/nxos' 2026-05-14 18:51:25.709746 | ubuntu-noble | Loading collection hitachivantara.vspone_block from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/hitachivantara/vspone_block 2026-05-14 18:51:25.710156 | ubuntu-noble | Found installed collection hitachivantara.vspone_block:3.5.1 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/hitachivantara/vspone_block' 2026-05-14 18:51:25.710491 | ubuntu-noble | Loading collection infoblox.nios_modules from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/infoblox/nios_modules 2026-05-14 18:51:25.710747 | ubuntu-noble | Found installed collection infoblox.nios_modules:1.8.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/infoblox/nios_modules' 2026-05-14 18:51:25.711106 | ubuntu-noble | Loading collection community.routeros from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/routeros 2026-05-14 18:51:25.711368 | ubuntu-noble | Found installed collection community.routeros:3.14.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/routeros' 2026-05-14 18:51:25.711685 | ubuntu-noble | Loading collection containers.podman from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/containers/podman 2026-05-14 18:51:25.711934 | ubuntu-noble | Found installed collection containers.podman:1.18.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/containers/podman' 2026-05-14 18:51:25.712320 | ubuntu-noble | Loading collection community.mongodb from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/mongodb 2026-05-14 18:51:25.712582 | ubuntu-noble | Found installed collection community.mongodb:1.7.10 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/mongodb' 2026-05-14 18:51:25.713304 | ubuntu-noble | Loading collection ansible.netcommon from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/ansible/netcommon 2026-05-14 18:51:25.713598 | ubuntu-noble | Found installed collection ansible.netcommon:7.2.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/ansible/netcommon' 2026-05-14 18:51:25.713874 | ubuntu-noble | Loading collection ieisystem.inmanage from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/ieisystem/inmanage 2026-05-14 18:51:25.714226 | ubuntu-noble | Found installed collection ieisystem.inmanage:3.0.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/ieisystem/inmanage' 2026-05-14 18:51:25.714502 | ubuntu-noble | Loading collection wti.remote from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/wti/remote 2026-05-14 18:51:25.714766 | ubuntu-noble | Found installed collection wti.remote:1.0.10 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/wti/remote' 2026-05-14 18:51:25.715085 | ubuntu-noble | Loading collection netapp.cloudmanager from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/netapp/cloudmanager 2026-05-14 18:51:25.715356 | ubuntu-noble | Found installed collection netapp.cloudmanager:21.24.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/netapp/cloudmanager' 2026-05-14 18:51:25.715617 | ubuntu-noble | Loading collection community.hrobot from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/hrobot 2026-05-14 18:51:25.715883 | ubuntu-noble | Found installed collection community.hrobot:2.7.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/hrobot' 2026-05-14 18:51:25.716211 | ubuntu-noble | Loading collection infinidat.infinibox from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/infinidat/infinibox 2026-05-14 18:51:25.716432 | ubuntu-noble | Found installed collection infinidat.infinibox:1.6.3 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/infinidat/infinibox' 2026-05-14 18:51:25.716695 | ubuntu-noble | Loading collection community.libvirt from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/libvirt 2026-05-14 18:51:25.716904 | ubuntu-noble | Found installed collection community.libvirt:1.4.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/libvirt' 2026-05-14 18:51:25.717253 | ubuntu-noble | Loading collection ansible.posix from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/ansible/posix 2026-05-14 18:51:25.717491 | ubuntu-noble | Found installed collection ansible.posix:1.6.2 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/ansible/posix' 2026-05-14 18:51:25.717745 | ubuntu-noble | Loading collection dellemc.openmanage from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/dellemc/openmanage 2026-05-14 18:51:25.718082 | ubuntu-noble | Found installed collection dellemc.openmanage:9.12.3 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/dellemc/openmanage' 2026-05-14 18:51:25.719178 | ubuntu-noble | Loading collection dellemc.unity from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/dellemc/unity 2026-05-14 18:51:25.719357 | ubuntu-noble | Found installed collection dellemc.unity:2.1.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/dellemc/unity' 2026-05-14 18:51:25.720767 | ubuntu-noble | Loading collection cisco.dnac from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/cisco/dnac 2026-05-14 18:51:25.721053 | ubuntu-noble | Found installed collection cisco.dnac:6.31.3 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/cisco/dnac' 2026-05-14 18:51:25.721466 | ubuntu-noble | Loading collection community.postgresql from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/postgresql 2026-05-14 18:51:25.722036 | ubuntu-noble | Found installed collection community.postgresql:3.14.3 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/postgresql' 2026-05-14 18:51:25.722228 | ubuntu-noble | Loading collection cisco.ucs from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/cisco/ucs 2026-05-14 18:51:25.722729 | ubuntu-noble | Found installed collection cisco.ucs:1.16.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/cisco/ucs' 2026-05-14 18:51:25.763322 | ubuntu-noble | Loading collection community.network from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/network 2026-05-14 18:51:25.763846 | ubuntu-noble | Found installed collection community.network:5.1.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/network' 2026-05-14 18:51:25.767099 | ubuntu-noble | Loading collection awx.awx from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/awx/awx 2026-05-14 18:51:25.767136 | ubuntu-noble | Found installed collection awx.awx:24.6.1 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/awx/awx' 2026-05-14 18:51:25.767145 | ubuntu-noble | Loading collection cyberark.pas from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/cyberark/pas 2026-05-14 18:51:25.767152 | ubuntu-noble | Found installed collection cyberark.pas:1.0.36 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/cyberark/pas' 2026-05-14 18:51:25.767441 | ubuntu-noble | Loading collection community.crypto from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/crypto 2026-05-14 18:51:25.767734 | ubuntu-noble | Found installed collection community.crypto:2.26.6 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/crypto' 2026-05-14 18:51:25.768076 | ubuntu-noble | Loading collection inspur.ispim from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/inspur/ispim 2026-05-14 18:51:25.768386 | ubuntu-noble | Found installed collection inspur.ispim:2.2.4 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/inspur/ispim' 2026-05-14 18:51:25.768642 | ubuntu-noble | Loading collection ravendb.ravendb from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/ravendb/ravendb 2026-05-14 18:51:25.768931 | ubuntu-noble | Found installed collection ravendb.ravendb:1.0.4 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/ravendb/ravendb' 2026-05-14 18:51:25.769284 | ubuntu-noble | Loading collection community.zabbix from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/zabbix 2026-05-14 18:51:25.769598 | ubuntu-noble | Found installed collection community.zabbix:3.3.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/zabbix' 2026-05-14 18:51:25.769886 | ubuntu-noble | Loading collection ovirt.ovirt from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/ovirt/ovirt 2026-05-14 18:51:25.770224 | ubuntu-noble | Found installed collection ovirt.ovirt:3.2.1 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/ovirt/ovirt' 2026-05-14 18:51:25.771935 | ubuntu-noble | Loading collection cisco.meraki from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/cisco/meraki 2026-05-14 18:51:25.772279 | ubuntu-noble | Found installed collection cisco.meraki:2.21.9 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/cisco/meraki' 2026-05-14 18:51:25.778396 | ubuntu-noble | Loading collection fortinet.fortimanager from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/fortinet/fortimanager 2026-05-14 18:51:25.778814 | ubuntu-noble | Found installed collection fortinet.fortimanager:2.11.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/fortinet/fortimanager' 2026-05-14 18:51:25.779222 | ubuntu-noble | Loading collection community.dns from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/dns 2026-05-14 18:51:25.779554 | ubuntu-noble | Found installed collection community.dns:3.4.1 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/dns' 2026-05-14 18:51:25.779912 | ubuntu-noble | Loading collection cisco.iosxr from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/cisco/iosxr 2026-05-14 18:51:25.780324 | ubuntu-noble | Found installed collection cisco.iosxr:10.3.1 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/cisco/iosxr' 2026-05-14 18:51:25.782156 | ubuntu-noble | Loading collection community.vmware from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/vmware 2026-05-14 18:51:25.782186 | ubuntu-noble | Found installed collection community.vmware:5.10.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/vmware' 2026-05-14 18:51:25.786002 | ubuntu-noble | Loading collection vmware.vmware_rest from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/vmware/vmware_rest 2026-05-14 18:51:25.786037 | ubuntu-noble | Found installed collection vmware.vmware_rest:4.9.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/vmware/vmware_rest' 2026-05-14 18:51:25.786047 | ubuntu-noble | Loading collection ibm.spectrum_virtualize from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/ibm/spectrum_virtualize 2026-05-14 18:51:25.786055 | ubuntu-noble | Found installed collection ibm.spectrum_virtualize:2.0.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/ibm/spectrum_virtualize' 2026-05-14 18:51:25.786125 | ubuntu-noble | Loading collection netapp_eseries.santricity from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/netapp_eseries/santricity 2026-05-14 18:51:25.786408 | ubuntu-noble | Found installed collection netapp_eseries.santricity:1.4.1 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/netapp_eseries/santricity' 2026-05-14 18:51:25.786830 | ubuntu-noble | Loading collection kubevirt.core from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/kubevirt/core 2026-05-14 18:51:25.787374 | ubuntu-noble | Found installed collection kubevirt.core:2.2.3 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/kubevirt/core' 2026-05-14 18:51:25.787910 | ubuntu-noble | Loading collection telekom_mms.icinga_director from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/telekom_mms/icinga_director 2026-05-14 18:51:25.788443 | ubuntu-noble | Found installed collection telekom_mms.icinga_director:2.5.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/telekom_mms/icinga_director' 2026-05-14 18:51:25.788796 | ubuntu-noble | Loading collection cisco.intersight from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/cisco/intersight 2026-05-14 18:51:25.789238 | ubuntu-noble | Found installed collection cisco.intersight:2.12.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/cisco/intersight' 2026-05-14 18:51:25.789627 | ubuntu-noble | Loading collection ansible.windows from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/ansible/windows 2026-05-14 18:51:25.790198 | ubuntu-noble | Found installed collection ansible.windows:2.8.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/ansible/windows' 2026-05-14 18:51:25.790670 | ubuntu-noble | Loading collection ibm.qradar from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/ibm/qradar 2026-05-14 18:51:25.791097 | ubuntu-noble | Found installed collection ibm.qradar:4.0.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/ibm/qradar' 2026-05-14 18:51:25.792628 | ubuntu-noble | Loading collection community.aws from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/aws 2026-05-14 18:51:25.793485 | ubuntu-noble | Found installed collection community.aws:9.3.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/aws' 2026-05-14 18:51:25.794171 | ubuntu-noble | Loading collection netbox.netbox from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/netbox/netbox 2026-05-14 18:51:25.794592 | ubuntu-noble | Found installed collection netbox.netbox:3.21.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/netbox/netbox' 2026-05-14 18:51:25.794943 | ubuntu-noble | Loading collection openstack.cloud from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/openstack/cloud 2026-05-14 18:51:25.795285 | ubuntu-noble | Found installed collection openstack.cloud:2.5.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/openstack/cloud' 2026-05-14 18:51:25.795768 | ubuntu-noble | Loading collection hitachivantara.vspone_object from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/hitachivantara/vspone_object 2026-05-14 18:51:25.797625 | ubuntu-noble | Found installed collection hitachivantara.vspone_object:1.1.1 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/hitachivantara/vspone_object' 2026-05-14 18:51:25.797668 | ubuntu-noble | Loading collection cyberark.conjur from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/cyberark/conjur 2026-05-14 18:51:25.797681 | ubuntu-noble | Found installed collection cyberark.conjur:1.3.9 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/cyberark/conjur' 2026-05-14 18:51:25.797692 | ubuntu-noble | Loading collection kaytus.ksmanage from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/kaytus/ksmanage 2026-05-14 18:51:25.797702 | ubuntu-noble | Found installed collection kaytus.ksmanage:2.0.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/kaytus/ksmanage' 2026-05-14 18:51:25.798867 | ubuntu-noble | Loading collection azure.azcollection from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/azure/azcollection 2026-05-14 18:51:25.798898 | ubuntu-noble | Found installed collection azure.azcollection:3.12.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/azure/azcollection' 2026-05-14 18:51:25.799623 | ubuntu-noble | Loading collection hetzner.hcloud from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/hetzner/hcloud 2026-05-14 18:51:25.799895 | ubuntu-noble | Found installed collection hetzner.hcloud:4.3.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/hetzner/hcloud' 2026-05-14 18:51:25.800688 | ubuntu-noble | Loading collection dellemc.powerflex from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/dellemc/powerflex 2026-05-14 18:51:25.800710 | ubuntu-noble | Found installed collection dellemc.powerflex:2.6.1 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/dellemc/powerflex' 2026-05-14 18:51:25.802505 | ubuntu-noble | Loading collection dellemc.enterprise_sonic from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/dellemc/enterprise_sonic 2026-05-14 18:51:25.802539 | ubuntu-noble | Found installed collection dellemc.enterprise_sonic:2.5.1 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/dellemc/enterprise_sonic' 2026-05-14 18:51:25.802546 | ubuntu-noble | Loading collection community.ciscosmb from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/ciscosmb 2026-05-14 18:51:25.802551 | ubuntu-noble | Found installed collection community.ciscosmb:1.0.11 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/ciscosmb' 2026-05-14 18:51:25.804445 | ubuntu-noble | Loading collection amazon.aws from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/amazon/aws 2026-05-14 18:51:25.804472 | ubuntu-noble | Found installed collection amazon.aws:9.5.2 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/amazon/aws' 2026-05-14 18:51:25.804478 | ubuntu-noble | Loading collection community.sap_libs from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/sap_libs 2026-05-14 18:51:25.804496 | ubuntu-noble | Found installed collection community.sap_libs:1.5.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/sap_libs' 2026-05-14 18:51:25.805067 | ubuntu-noble | Loading collection vmware.vmware from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/vmware/vmware 2026-05-14 18:51:25.805096 | ubuntu-noble | Found installed collection vmware.vmware:1.11.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/vmware/vmware' 2026-05-14 18:51:25.806036 | ubuntu-noble | Loading collection google.cloud from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/google/cloud 2026-05-14 18:51:25.806278 | ubuntu-noble | Found installed collection google.cloud:1.10.2 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/google/cloud' 2026-05-14 18:51:25.807085 | ubuntu-noble | Loading collection check_point.mgmt from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/check_point/mgmt 2026-05-14 18:51:25.807109 | ubuntu-noble | Found installed collection check_point.mgmt:6.7.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/check_point/mgmt' 2026-05-14 18:51:25.809008 | ubuntu-noble | Loading collection ngine_io.cloudstack from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/ngine_io/cloudstack 2026-05-14 18:51:25.809036 | ubuntu-noble | Found installed collection ngine_io.cloudstack:2.5.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/ngine_io/cloudstack' 2026-05-14 18:51:25.809042 | ubuntu-noble | Loading collection purestorage.flashblade from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/purestorage/flashblade 2026-05-14 18:51:25.809047 | ubuntu-noble | Found installed collection purestorage.flashblade:1.22.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/purestorage/flashblade' 2026-05-14 18:51:25.809052 | ubuntu-noble | Loading collection ansible.utils from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/ansible/utils 2026-05-14 18:51:25.809057 | ubuntu-noble | Found installed collection ansible.utils:5.1.2 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/ansible/utils' 2026-05-14 18:51:25.809084 | ubuntu-noble | Loading collection cloud.common from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/cloud/common 2026-05-14 18:51:25.809316 | ubuntu-noble | Found installed collection cloud.common:4.2.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/cloud/common' 2026-05-14 18:51:25.809547 | ubuntu-noble | Loading collection f5networks.f5_modules from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/f5networks/f5_modules 2026-05-14 18:51:25.809856 | ubuntu-noble | Found installed collection f5networks.f5_modules:1.39.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/f5networks/f5_modules' 2026-05-14 18:51:25.810473 | ubuntu-noble | Loading collection cloudscale_ch.cloud from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/cloudscale_ch/cloud 2026-05-14 18:51:25.810706 | ubuntu-noble | Found installed collection cloudscale_ch.cloud:2.5.2 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/cloudscale_ch/cloud' 2026-05-14 18:51:25.811072 | ubuntu-noble | Loading collection cisco.asa from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/cisco/asa 2026-05-14 18:51:25.811284 | ubuntu-noble | Found installed collection cisco.asa:6.1.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/cisco/asa' 2026-05-14 18:51:25.811562 | ubuntu-noble | Loading collection community.mysql from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/mysql 2026-05-14 18:51:25.811766 | ubuntu-noble | Found installed collection community.mysql:3.16.1 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/mysql' 2026-05-14 18:51:25.812849 | ubuntu-noble | Loading collection netapp.ontap from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/netapp/ontap 2026-05-14 18:51:25.813137 | ubuntu-noble | Found installed collection netapp.ontap:22.14.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/netapp/ontap' 2026-05-14 18:51:25.813410 | ubuntu-noble | Loading collection lowlydba.sqlserver from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/lowlydba/sqlserver 2026-05-14 18:51:25.813623 | ubuntu-noble | Found installed collection lowlydba.sqlserver:2.7.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/lowlydba/sqlserver' 2026-05-14 18:51:25.813818 | ubuntu-noble | Loading collection community.sops from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/sops 2026-05-14 18:51:25.814082 | ubuntu-noble | Found installed collection community.sops:2.2.7 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/sops' 2026-05-14 18:51:25.814281 | ubuntu-noble | Loading collection community.proxmox from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/proxmox 2026-05-14 18:51:25.814579 | ubuntu-noble | Found installed collection community.proxmox:1.4.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/proxmox' 2026-05-14 18:51:25.814767 | ubuntu-noble | Loading collection sensu.sensu_go from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/sensu/sensu_go 2026-05-14 18:51:25.815090 | ubuntu-noble | Found installed collection sensu.sensu_go:1.14.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/sensu/sensu_go' 2026-05-14 18:51:25.815351 | ubuntu-noble | Loading collection cisco.ise from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/cisco/ise 2026-05-14 18:51:25.815547 | ubuntu-noble | Found installed collection cisco.ise:2.10.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/cisco/ise' 2026-05-14 18:51:25.817049 | ubuntu-noble | Loading collection cisco.mso from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/cisco/mso 2026-05-14 18:51:25.817240 | ubuntu-noble | Found installed collection cisco.mso:2.12.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/cisco/mso' 2026-05-14 18:51:25.817941 | ubuntu-noble | Loading collection splunk.es from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/splunk/es 2026-05-14 18:51:25.818281 | ubuntu-noble | Found installed collection splunk.es:4.0.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/splunk/es' 2026-05-14 18:51:25.818464 | ubuntu-noble | Loading collection community.library_inventory_filtering_v1 from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/library_inventory_filtering_v1 2026-05-14 18:51:25.818761 | ubuntu-noble | Found installed collection community.library_inventory_filtering_v1:1.1.5 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/library_inventory_filtering_v1' 2026-05-14 18:51:25.819175 | ubuntu-noble | Loading collection community.docker from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/docker 2026-05-14 18:51:25.819459 | ubuntu-noble | Found installed collection community.docker:4.8.5 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/docker' 2026-05-14 18:51:25.819738 | ubuntu-noble | Loading collection community.hashi_vault from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/hashi_vault 2026-05-14 18:51:25.820071 | ubuntu-noble | Found installed collection community.hashi_vault:6.2.1 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/hashi_vault' 2026-05-14 18:51:25.820396 | ubuntu-noble | Loading collection community.okd from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/okd 2026-05-14 18:51:25.820607 | ubuntu-noble | Found installed collection community.okd:4.0.2 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/okd' 2026-05-14 18:51:25.821070 | ubuntu-noble | Loading collection vultr.cloud from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/vultr/cloud 2026-05-14 18:51:25.821257 | ubuntu-noble | Found installed collection vultr.cloud:1.13.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/vultr/cloud' 2026-05-14 18:51:25.821474 | ubuntu-noble | Loading collection grafana.grafana from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/grafana/grafana 2026-05-14 18:51:25.821743 | ubuntu-noble | Found installed collection grafana.grafana:5.7.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/grafana/grafana' 2026-05-14 18:51:25.822273 | ubuntu-noble | Loading collection community.windows from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/windows 2026-05-14 18:51:25.822595 | ubuntu-noble | Found installed collection community.windows:2.4.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/windows' 2026-05-14 18:51:25.822897 | ubuntu-noble | Loading collection community.grafana from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/grafana 2026-05-14 18:51:25.823239 | ubuntu-noble | Found installed collection community.grafana:2.3.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/grafana' 2026-05-14 18:51:25.832673 | ubuntu-noble | Loading collection community.general from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/general 2026-05-14 18:51:25.832907 | ubuntu-noble | Found installed collection community.general:10.7.6 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/general' 2026-05-14 18:51:25.846013 | ubuntu-noble | Loading collection osism.commons from /home/zuul/.ansible/collections/ansible_collections/osism/commons 2026-05-14 18:51:25.847528 | ubuntu-noble | Found installed collection osism.commons:0.20260318.0 at '/home/zuul/.ansible/collections/ansible_collections/osism/commons' 2026-05-14 18:51:25.848934 | ubuntu-noble | Loading collection osism.services from /home/zuul/.ansible/collections/ansible_collections/osism/services 2026-05-14 18:51:25.849010 | ubuntu-noble | Found installed collection osism.services:999.0.0 at '/home/zuul/.ansible/collections/ansible_collections/osism/services' 2026-05-14 18:51:25.849731 | ubuntu-noble | Starting galaxy collection install process 2026-05-14 18:51:25.849748 | ubuntu-noble | Nothing to do. All requested collections are already installed. If you want to reinstall them, consider using `--force`. 2026-05-14 18:51:25.919079 | ubuntu-noble | INFO [delegated > dependency] Dependency completed successfully. 2026-05-14 18:51:25.919152 | ubuntu-noble | WARNING [delegated > dependency] Executed: Missing roles requirements file: requirements.yml (Remove from converge_sequence to suppress) 2026-05-14 18:51:25.936360 | ubuntu-noble | INFO [delegated > create] Executing 2026-05-14 18:51:25.938910 | ubuntu-noble | WARNING [delegated > create] Executed: Missing playbook (Remove from converge_sequence to suppress) 2026-05-14 18:51:25.948188 | ubuntu-noble | INFO [delegated > prepare] Executing 2026-05-14 18:51:25.948339 | ubuntu-noble | WARNING [delegated > prepare] Skipping, instances already prepared. 2026-05-14 18:51:25.948444 | ubuntu-noble | INFO [delegated > prepare] Executed: Successful 2026-05-14 18:51:25.956788 | ubuntu-noble | INFO [delegated > converge] Executing 2026-05-14 18:51:25.503134 | debian-bookworm | INFO [delegated > dependency] Dependency completed successfully. 2026-05-14 18:51:25.503322 | debian-bookworm | WARNING [delegated > dependency] Executed: Missing roles requirements file: requirements.yml (Remove from converge_sequence to suppress) 2026-05-14 18:51:25.511816 | debian-bookworm | INFO [delegated > create] Executing 2026-05-14 18:51:25.513738 | debian-bookworm | WARNING [delegated > create] Executed: Missing playbook (Remove from converge_sequence to suppress) 2026-05-14 18:51:25.521460 | debian-bookworm | INFO [delegated > prepare] Executing 2026-05-14 18:51:25.521591 | debian-bookworm | WARNING [delegated > prepare] Skipping, instances already prepared. 2026-05-14 18:51:25.521728 | debian-bookworm | INFO [delegated > prepare] Executed: Successful 2026-05-14 18:51:25.529338 | debian-bookworm | INFO [delegated > converge] Executing 2026-05-14 18:51:25.856819 | debian-bookworm | DEBUG [delegated > converge] ansible-playbook version: ansible-playbook 2026-05-14 18:51:25.856920 | debian-bookworm | config file = None 2026-05-14 18:51:25.856937 | debian-bookworm | configured module search path = 2026-05-14 18:51:25.856951 | debian-bookworm | ansible python module location = /home/zuul/venv/lib/python3.11/site-packages/ansible 2026-05-14 18:51:25.856964 | debian-bookworm | ansible collection location = /home/zuul/.ansible/collections:/usr/share/ansible/collections 2026-05-14 18:51:25.856975 | debian-bookworm | executable location = /home/zuul/venv/bin/ansible-playbook 2026-05-14 18:51:25.856987 | debian-bookworm | python version = 3.11.2 (main, Apr 28 2025, 14:11:48) (/home/zuul/venv/bin/python3) 2026-05-14 18:51:25.856998 | debian-bookworm | jinja version = 3.1.6 2026-05-14 18:51:25.857009 | debian-bookworm | libyaml = True 2026-05-14 18:51:25.857021 | debian-bookworm | DEBUG ANSIBLE ENVIRONMENT: 2026-05-14 18:51:25.857033 | debian-bookworm | ANSIBLE_COLLECTIONS_PATH: /home/zuul/venv/.ansible/collections:/home/zuul/.ansible/collections 2026-05-14 18:51:25.857043 | debian-bookworm | ANSIBLE_CONFIG: /home/zuul/.ansible/tmp/molecule.oWZD.delegated/ansible.cfg 2026-05-14 18:51:25.857055 | debian-bookworm | ANSIBLE_LIBRARY: ../../plugins 2026-05-14 18:51:25.857066 | debian-bookworm | ANSIBLE_PYTHON_INTERPRETER: /home/zuul/venv/bin/python 2026-05-14 18:51:25.857077 | debian-bookworm | ANSIBLE_ROLE: auditd 2026-05-14 18:51:25.857088 | debian-bookworm | ANSIBLE_ROLES_PATH: ../../roles 2026-05-14 18:51:25.857099 | debian-bookworm | ANSIBLE_VERBOSITY: 1 2026-05-14 18:51:25.857111 | debian-bookworm | 2026-05-14 18:51:25.857123 | debian-bookworm | DEBUG MOLECULE ENVIRONMENT: 2026-05-14 18:51:25.857134 | debian-bookworm | MOLECULE_DEBUG: True 2026-05-14 18:51:25.857169 | debian-bookworm | MOLECULE_DEPENDENCY_NAME: galaxy 2026-05-14 18:51:25.857215 | debian-bookworm | MOLECULE_DRIVER_NAME: default 2026-05-14 18:51:25.857241 | debian-bookworm | MOLECULE_ENV_FILE: /home/zuul/src/github.com/osism/ansible-collection-services/.env.yml 2026-05-14 18:51:25.857256 | debian-bookworm | MOLECULE_EPHEMERAL_DIRECTORY: /home/zuul/.ansible/tmp/molecule.oWZD.delegated 2026-05-14 18:51:25.857268 | debian-bookworm | MOLECULE_FILE: /home/zuul/.ansible/tmp/molecule.oWZD.delegated/molecule.yml 2026-05-14 18:51:25.857278 | debian-bookworm | MOLECULE_INSTANCE_CONFIG: /home/zuul/.ansible/tmp/molecule.oWZD.delegated/instance_config.yml 2026-05-14 18:51:25.857289 | debian-bookworm | MOLECULE_INVENTORY_FILE: /home/zuul/.ansible/tmp/molecule.oWZD.delegated/inventory/ansible_inventory.yml 2026-05-14 18:51:25.857302 | debian-bookworm | MOLECULE_PROJECT_DIRECTORY: /home/zuul/src/github.com/osism/ansible-collection-services 2026-05-14 18:51:25.857313 | debian-bookworm | MOLECULE_PROVISIONER_NAME: ansible 2026-05-14 18:51:25.857325 | debian-bookworm | MOLECULE_SCENARIO_DIRECTORY: /home/zuul/src/github.com/osism/ansible-collection-services/molecule/delegated 2026-05-14 18:51:25.857337 | debian-bookworm | MOLECULE_SCENARIO_NAME: delegated 2026-05-14 18:51:25.857348 | debian-bookworm | MOLECULE_STATE_FILE: /home/zuul/.ansible/tmp/molecule.oWZD.delegated/state.yml 2026-05-14 18:51:25.857359 | debian-bookworm | MOLECULE_VERIFIER_NAME: testinfra 2026-05-14 18:51:25.857370 | debian-bookworm | MOLECULE_VERIFIER_TEST_DIRECTORY: /home/zuul/src/github.com/osism/ansible-collection-services/molecule/delegated/tests 2026-05-14 18:51:25.857408 | debian-bookworm | 2026-05-14 18:51:25.857428 | debian-bookworm | DEBUG SHELL REPLAY: ANSIBLE_COLLECTIONS_PATH=/home/zuul/venv/.ansible/collections:/home/zuul/.ansible/collections ANSIBLE_CONFIG=/home/zuul/.ansible/tmp/molecule.oWZD.delegated/ansible.cfg ANSIBLE_LIBRARY=../../plugins ANSIBLE_PYTHON_INTERPRETER=/home/zuul/venv/bin/python ANSIBLE_ROLE=auditd ANSIBLE_ROLES_PATH=../../roles ANSIBLE_VERBOSITY=1 MOLECULE_DEBUG=True MOLECULE_DEPENDENCY_NAME=galaxy MOLECULE_DRIVER_NAME=default MOLECULE_ENV_FILE=/home/zuul/src/github.com/osism/ansible-collection-services/.env.yml MOLECULE_EPHEMERAL_DIRECTORY=/home/zuul/.ansible/tmp/molecule.oWZD.delegated MOLECULE_FILE=/home/zuul/.ansible/tmp/molecule.oWZD.delegated/molecule.yml MOLECULE_INSTANCE_CONFIG=/home/zuul/.ansible/tmp/molecule.oWZD.delegated/instance_config.yml MOLECULE_INVENTORY_FILE=/home/zuul/.ansible/tmp/molecule.oWZD.delegated/inventory/ansible_inventory.yml MOLECULE_PROJECT_DIRECTORY=/home/zuul/src/github.com/osism/ansible-collection-services MOLECULE_PROVISIONER_NAME=ansible MOLECULE_SCENARIO_DIRECTORY=/home/zuul/src/github.com/osism/ansible-collection-services/molecule/delegated MOLECULE_SCENARIO_NAME=delegated MOLECULE_STATE_FILE=/home/zuul/.ansible/tmp/molecule.oWZD.delegated/state.yml MOLECULE_VERIFIER_NAME=testinfra MOLECULE_VERIFIER_TEST_DIRECTORY=/home/zuul/src/github.com/osism/ansible-collection-services/molecule/delegated/tests 2026-05-14 18:51:26.326536 | ubuntu-noble | DEBUG [delegated > converge] ansible-playbook version: ansible-playbook 2026-05-14 18:51:26.326612 | ubuntu-noble | config file = None 2026-05-14 18:51:26.326627 | ubuntu-noble | configured module search path = 2026-05-14 18:51:26.326638 | ubuntu-noble | ansible python module location = /home/zuul/venv/lib/python3.12/site-packages/ansible 2026-05-14 18:51:26.326649 | ubuntu-noble | ansible collection location = /home/zuul/.ansible/collections:/usr/share/ansible/collections 2026-05-14 18:51:26.326658 | ubuntu-noble | executable location = /home/zuul/venv/bin/ansible-playbook 2026-05-14 18:51:26.326668 | ubuntu-noble | python version = 3.12.3 (main, Mar 23 2026, 19:04:32) (/home/zuul/venv/bin/python3) 2026-05-14 18:51:26.326677 | ubuntu-noble | jinja version = 3.1.6 2026-05-14 18:51:26.326686 | ubuntu-noble | libyaml = True 2026-05-14 18:51:26.327371 | ubuntu-noble | DEBUG ANSIBLE ENVIRONMENT: 2026-05-14 18:51:26.327418 | ubuntu-noble | ANSIBLE_COLLECTIONS_PATH: /home/zuul/venv/.ansible/collections:/home/zuul/.ansible/collections 2026-05-14 18:51:26.327430 | ubuntu-noble | ANSIBLE_CONFIG: /home/zuul/.ansible/tmp/molecule.oWZD.delegated/ansible.cfg 2026-05-14 18:51:26.327441 | ubuntu-noble | ANSIBLE_LIBRARY: ../../plugins 2026-05-14 18:51:26.327450 | ubuntu-noble | ANSIBLE_PYTHON_INTERPRETER: /home/zuul/venv/bin/python 2026-05-14 18:51:26.327460 | ubuntu-noble | ANSIBLE_ROLE: auditd 2026-05-14 18:51:26.327470 | ubuntu-noble | ANSIBLE_ROLES_PATH: ../../roles 2026-05-14 18:51:26.327482 | ubuntu-noble | ANSIBLE_VERBOSITY: 1 2026-05-14 18:51:26.327494 | ubuntu-noble | 2026-05-14 18:51:26.327926 | ubuntu-noble | DEBUG MOLECULE ENVIRONMENT: 2026-05-14 18:51:26.328019 | ubuntu-noble | MOLECULE_DEBUG: True 2026-05-14 18:51:26.328046 | ubuntu-noble | MOLECULE_DEPENDENCY_NAME: galaxy 2026-05-14 18:51:26.328099 | ubuntu-noble | MOLECULE_DRIVER_NAME: default 2026-05-14 18:51:26.328119 | ubuntu-noble | MOLECULE_ENV_FILE: /home/zuul/src/github.com/osism/ansible-collection-services/.env.yml 2026-05-14 18:51:26.328131 | ubuntu-noble | MOLECULE_EPHEMERAL_DIRECTORY: /home/zuul/.ansible/tmp/molecule.oWZD.delegated 2026-05-14 18:51:26.328141 | ubuntu-noble | MOLECULE_FILE: /home/zuul/.ansible/tmp/molecule.oWZD.delegated/molecule.yml 2026-05-14 18:51:26.328150 | ubuntu-noble | MOLECULE_INSTANCE_CONFIG: /home/zuul/.ansible/tmp/molecule.oWZD.delegated/instance_config.yml 2026-05-14 18:51:26.328159 | ubuntu-noble | MOLECULE_INVENTORY_FILE: /home/zuul/.ansible/tmp/molecule.oWZD.delegated/inventory/ansible_inventory.yml 2026-05-14 18:51:26.328169 | ubuntu-noble | MOLECULE_PROJECT_DIRECTORY: /home/zuul/src/github.com/osism/ansible-collection-services 2026-05-14 18:51:26.328179 | ubuntu-noble | MOLECULE_PROVISIONER_NAME: ansible 2026-05-14 18:51:26.328188 | ubuntu-noble | MOLECULE_SCENARIO_DIRECTORY: /home/zuul/src/github.com/osism/ansible-collection-services/molecule/delegated 2026-05-14 18:51:26.328218 | ubuntu-noble | MOLECULE_SCENARIO_NAME: delegated 2026-05-14 18:51:26.328228 | ubuntu-noble | MOLECULE_STATE_FILE: /home/zuul/.ansible/tmp/molecule.oWZD.delegated/state.yml 2026-05-14 18:51:26.328238 | ubuntu-noble | MOLECULE_VERIFIER_NAME: testinfra 2026-05-14 18:51:26.328247 | ubuntu-noble | MOLECULE_VERIFIER_TEST_DIRECTORY: /home/zuul/src/github.com/osism/ansible-collection-services/molecule/delegated/tests 2026-05-14 18:51:26.328258 | ubuntu-noble | 2026-05-14 18:51:26.328679 | ubuntu-noble | DEBUG SHELL REPLAY: ANSIBLE_COLLECTIONS_PATH=/home/zuul/venv/.ansible/collections:/home/zuul/.ansible/collections ANSIBLE_CONFIG=/home/zuul/.ansible/tmp/molecule.oWZD.delegated/ansible.cfg ANSIBLE_LIBRARY=../../plugins ANSIBLE_PYTHON_INTERPRETER=/home/zuul/venv/bin/python ANSIBLE_ROLE=auditd ANSIBLE_ROLES_PATH=../../roles ANSIBLE_VERBOSITY=1 MOLECULE_DEBUG=True MOLECULE_DEPENDENCY_NAME=galaxy MOLECULE_DRIVER_NAME=default MOLECULE_ENV_FILE=/home/zuul/src/github.com/osism/ansible-collection-services/.env.yml MOLECULE_EPHEMERAL_DIRECTORY=/home/zuul/.ansible/tmp/molecule.oWZD.delegated MOLECULE_FILE=/home/zuul/.ansible/tmp/molecule.oWZD.delegated/molecule.yml MOLECULE_INSTANCE_CONFIG=/home/zuul/.ansible/tmp/molecule.oWZD.delegated/instance_config.yml MOLECULE_INVENTORY_FILE=/home/zuul/.ansible/tmp/molecule.oWZD.delegated/inventory/ansible_inventory.yml MOLECULE_PROJECT_DIRECTORY=/home/zuul/src/github.com/osism/ansible-collection-services MOLECULE_PROVISIONER_NAME=ansible MOLECULE_SCENARIO_DIRECTORY=/home/zuul/src/github.com/osism/ansible-collection-services/molecule/delegated MOLECULE_SCENARIO_NAME=delegated MOLECULE_STATE_FILE=/home/zuul/.ansible/tmp/molecule.oWZD.delegated/state.yml MOLECULE_VERIFIER_NAME=testinfra MOLECULE_VERIFIER_TEST_DIRECTORY=/home/zuul/src/github.com/osism/ansible-collection-services/molecule/delegated/tests 2026-05-14 18:51:26.128454 | debian-bookworm | Using /home/zuul/.ansible/tmp/molecule.oWZD.delegated/ansible.cfg as config file 2026-05-14 18:51:26.364830 | debian-bookworm | 2026-05-14 18:51:26.364901 | debian-bookworm | PLAY [Converge] **************************************************************** 2026-05-14 18:51:26.364915 | debian-bookworm | 2026-05-14 18:51:26.364926 | debian-bookworm | TASK [Gathering Facts] ********************************************************* 2026-05-14 18:51:26.647715 | ubuntu-noble | Using /home/zuul/.ansible/tmp/molecule.oWZD.delegated/ansible.cfg as config file 2026-05-14 18:51:26.885033 | ubuntu-noble | 2026-05-14 18:51:26.885100 | ubuntu-noble | PLAY [Converge] **************************************************************** 2026-05-14 18:51:26.885112 | ubuntu-noble | 2026-05-14 18:51:26.885226 | ubuntu-noble | TASK [Gathering Facts] ********************************************************* 2026-05-14 18:51:27.497446 | debian-bookworm | ok: [molecule-auditd] 2026-05-14 18:51:27.497506 | debian-bookworm | 2026-05-14 18:51:27.497517 | debian-bookworm | TASK [Include required variables] ********************************************** 2026-05-14 18:51:27.532989 | debian-bookworm | ok: [molecule-auditd] => {"ansible_facts": {}, "ansible_included_var_files": ["/home/zuul/src/github.com/osism/ansible-collection-services/molecule/delegated/vars/auditd.yml"], "changed": false} 2026-05-14 18:51:27.533035 | debian-bookworm | 2026-05-14 18:51:27.533042 | debian-bookworm | TASK [Include role auditd] ***************************************************** 2026-05-14 18:51:27.577443 | debian-bookworm | included: auditd for molecule-auditd 2026-05-14 18:51:27.577516 | debian-bookworm | 2026-05-14 18:51:27.577532 | debian-bookworm | TASK [auditd : Include distribution specific install tasks] ******************** 2026-05-14 18:51:27.603075 | debian-bookworm | included: /home/zuul/src/github.com/osism/ansible-collection-services/roles/auditd/tasks/install-Debian-family.yml for molecule-auditd 2026-05-14 18:51:27.603830 | debian-bookworm | 2026-05-14 18:51:27.604317 | debian-bookworm | TASK [auditd : Install auditd package] ***************************************** 2026-05-14 18:51:28.163160 | ubuntu-noble | ok: [molecule-auditd] 2026-05-14 18:51:28.163355 | ubuntu-noble | 2026-05-14 18:51:28.163491 | ubuntu-noble | TASK [Include required variables] ********************************************** 2026-05-14 18:51:28.188543 | ubuntu-noble | ok: [molecule-auditd] => {"ansible_facts": {}, "ansible_included_var_files": ["/home/zuul/src/github.com/osism/ansible-collection-services/molecule/delegated/vars/auditd.yml"], "changed": false} 2026-05-14 18:51:28.188722 | ubuntu-noble | 2026-05-14 18:51:28.188854 | ubuntu-noble | TASK [Include role auditd] ***************************************************** 2026-05-14 18:51:28.252683 | ubuntu-noble | included: auditd for molecule-auditd 2026-05-14 18:51:28.253193 | ubuntu-noble | 2026-05-14 18:51:28.253584 | ubuntu-noble | TASK [auditd : Include distribution specific install tasks] ******************** 2026-05-14 18:51:28.289881 | ubuntu-noble | included: /home/zuul/src/github.com/osism/ansible-collection-services/roles/auditd/tasks/install-Debian-family.yml for molecule-auditd 2026-05-14 18:51:28.290052 | ubuntu-noble | 2026-05-14 18:51:28.290072 | ubuntu-noble | TASK [auditd : Install auditd package] ***************************************** 2026-05-14 18:51:31.709837 | debian-bookworm | The following additional packages will be installed: 2026-05-14 18:51:31.709879 | debian-bookworm | libauparse0 2026-05-14 18:51:31.711309 | debian-bookworm | Suggested packages: 2026-05-14 18:51:31.711341 | debian-bookworm | audispd-plugins 2026-05-14 18:51:31.711346 | debian-bookworm | The following NEW packages will be installed: 2026-05-14 18:51:31.711352 | debian-bookworm | auditd libauparse0 2026-05-14 18:51:31.711356 | debian-bookworm | 0 upgraded, 2 newly installed, 0 to remove and 1 not upgraded. 2026-05-14 18:51:31.711407 | debian-bookworm | changed: [molecule-auditd] => {"cache_update_time": 1778784594, "cache_updated": false, "changed": true, "stderr": "debconf: delaying package configuration, since apt-utils is not installed\n", "stderr_lines": ["debconf: delaying package configuration, since apt-utils is not installed"], "stdout": "Reading package lists...\nBuilding dependency tree...\nReading state information...\nThe following additional packages will be installed:\n libauparse0\nSuggested packages:\n audispd-plugins\nThe following NEW packages will be installed:\n auditd libauparse0\n0 upgraded, 2 newly installed, 0 to remove and 1 not upgraded.\nNeed to get 279 kB of archives.\nAfter this operation, 934 kB of additional disk space will be used.\nGet:1 http://deb.debian.org/debian bookworm/main amd64 libauparse0 amd64 1:3.0.9-1 [61.9 kB]\nGet:2 http://deb.debian.org/debian bookworm/main amd64 auditd amd64 1:3.0.9-1 [218 kB]\nFetched 279 kB in 0s (3454 kB/s)\nSelecting previously unselected package libauparse0:amd64.\r\n(Reading database ... \r(Reading database ... 5%\r(Reading database ... 10%\r(Reading database ... 15%\r(Reading database ... 20%\r(Reading database ... 25%\r(Reading database ... 30%\r(Reading database ... 35%\r(Reading database ... 40%\r(Reading database ... 45%\r(Reading database ... 50%\r(Reading database ... 55%\r(Reading database ... 60%\r(Reading database ... 65%\r(Reading database ... 70%\r(Reading database ... 75%\r(Reading database ... 80%\r(Reading database ... 85%\r(Reading database ... 90%\r(Reading database ... 95%\r(Reading database ... 100%\r(Reading database ... 28690 files and directories currently installed.)\r\nPreparing to unpack .../libauparse0_1%3a3.0.9-1_amd64.deb ...\r\nUnpacking libauparse0:amd64 (1:3.0.9-1) ...\r\nSelecting previously unselected package auditd.\r\nPreparing to unpack .../auditd_1%3a3.0.9-1_amd64.deb ...\r\nUnpacking auditd (1:3.0.9-1) ...\r\nSetting up libauparse0:amd64 (1:3.0.9-1) ...\r\nSetting up auditd (1:3.0.9-1) ...\r\nCreated symlink /etc/systemd/system/multi-user.target.wants/auditd.service → /lib/systemd/system/auditd.service.\r\r\nProcessing triggers for libc-bin (2.36-9+deb12u13) ...\r\n", "stdout_lines": ["Reading package lists...", "Building dependency tree...", "Reading state information...", "The following additional packages will be installed:", " libauparse0", "Suggested packages:", " audispd-plugins", "The following NEW packages will be installed:", " auditd libauparse0", "0 upgraded, 2 newly installed, 0 to remove and 1 not upgraded.", "Need to get 279 kB of archives.", "After this operation, 934 kB of additional disk space will be used.", "Get:1 http://deb.debian.org/debian bookworm/main amd64 libauparse0 amd64 1:3.0.9-1 [61.9 kB]", "Get:2 http://deb.debian.org/debian bookworm/main amd64 auditd amd64 1:3.0.9-1 [218 kB]", "Fetched 279 kB in 0s (3454 kB/s)", "Selecting previously unselected package libauparse0:amd64.", "(Reading database ... ", "(Reading database ... 5%", "(Reading database ... 10%", "(Reading database ... 15%", "(Reading database ... 20%", "(Reading database ... 25%", "(Reading database ... 30%", "(Reading database ... 35%", "(Reading database ... 40%", "(Reading database ... 45%", "(Reading database ... 50%", "(Reading database ... 55%", "(Reading database ... 60%", "(Reading database ... 65%", "(Reading database ... 70%", "(Reading database ... 75%", "(Reading database ... 80%", "(Reading database ... 85%", "(Reading database ... 90%", "(Reading database ... 95%", "(Reading database ... 100%", "(Reading database ... 28690 files and directories currently installed.)", "Preparing to unpack .../libauparse0_1%3a3.0.9-1_amd64.deb ...", "Unpacking libauparse0:amd64 (1:3.0.9-1) ...", "Selecting previously unselected package auditd.", "Preparing to unpack .../auditd_1%3a3.0.9-1_amd64.deb ...", "Unpacking auditd (1:3.0.9-1) ...", "Setting up libauparse0:amd64 (1:3.0.9-1) ...", "Setting up auditd (1:3.0.9-1) ...", "Created symlink /etc/systemd/system/multi-user.target.wants/auditd.service → /lib/systemd/system/auditd.service.", "", "Processing triggers for libc-bin (2.36-9+deb12u13) ..."]} 2026-05-14 18:51:31.711425 | debian-bookworm | 2026-05-14 18:51:31.711432 | debian-bookworm | TASK [auditd : Install audispd-plugins package] ******************************** 2026-05-14 18:51:33.004006 | ubuntu-noble | The following additional packages will be installed: 2026-05-14 18:51:33.004047 | ubuntu-noble | libauparse0t64 2026-05-14 18:51:33.004053 | ubuntu-noble | Suggested packages: 2026-05-14 18:51:33.004058 | ubuntu-noble | audispd-plugins 2026-05-14 18:51:33.004063 | ubuntu-noble | The following NEW packages will be installed: 2026-05-14 18:51:33.006008 | ubuntu-noble | auditd libauparse0t64 2026-05-14 18:51:33.006033 | ubuntu-noble | 0 upgraded, 2 newly installed, 0 to remove and 0 not upgraded. 2026-05-14 18:51:33.007121 | ubuntu-noble | changed: [molecule-auditd] => {"cache_update_time": 1778784596, "cache_updated": false, "changed": true, "stderr": "debconf: delaying package configuration, since apt-utils is not installed\n", "stderr_lines": ["debconf: delaying package configuration, since apt-utils is not installed"], "stdout": "Reading package lists...\nBuilding dependency tree...\nReading state information...\nThe following additional packages will be installed:\n libauparse0t64\nSuggested packages:\n audispd-plugins\nThe following NEW packages will be installed:\n auditd libauparse0t64\n0 upgraded, 2 newly installed, 0 to remove and 0 not upgraded.\nNeed to get 274 kB of archives.\nAfter this operation, 893 kB of additional disk space will be used.\nGet:1 http://archive.ubuntu.com/ubuntu noble-updates/main amd64 libauparse0t64 amd64 1:3.1.2-2.1build1.1 [58.9 kB]\nGet:2 http://archive.ubuntu.com/ubuntu noble-updates/main amd64 auditd amd64 1:3.1.2-2.1build1.1 [215 kB]\nFetched 274 kB in 0s (1872 kB/s)\nSelecting previously unselected package libauparse0t64:amd64.\r\n(Reading database ... \r(Reading database ... 5%\r(Reading database ... 10%\r(Reading database ... 15%\r(Reading database ... 20%\r(Reading database ... 25%\r(Reading database ... 30%\r(Reading database ... 35%\r(Reading database ... 40%\r(Reading database ... 45%\r(Reading database ... 50%\r(Reading database ... 55%\r(Reading database ... 60%\r(Reading database ... 65%\r(Reading database ... 70%\r(Reading database ... 75%\r(Reading database ... 80%\r(Reading database ... 85%\r(Reading database ... 90%\r(Reading database ... 95%\r(Reading database ... 100%\r(Reading database ... 36110 files and directories currently installed.)\r\nPreparing to unpack .../libauparse0t64_1%3a3.1.2-2.1build1.1_amd64.deb ...\r\nAdding 'diversion of /lib/x86_64-linux-gnu/libauparse.so.0 to /lib/x86_64-linux-gnu/libauparse.so.0.usr-is-merged by libauparse0t64'\r\nAdding 'diversion of /lib/x86_64-linux-gnu/libauparse.so.0.0.0 to /lib/x86_64-linux-gnu/libauparse.so.0.0.0.usr-is-merged by libauparse0t64'\r\nUnpacking libauparse0t64:amd64 (1:3.1.2-2.1build1.1) ...\r\nSelecting previously unselected package auditd.\r\nPreparing to unpack .../auditd_1%3a3.1.2-2.1build1.1_amd64.deb ...\r\nUnpacking auditd (1:3.1.2-2.1build1.1) ...\r\nSetting up libauparse0t64:amd64 (1:3.1.2-2.1build1.1) ...\r\nSetting up auditd (1:3.1.2-2.1build1.1) ...\r\nCreated symlink /etc/systemd/system/multi-user.target.wants/auditd.service → /usr/lib/systemd/system/auditd.service.\r\r\nProcessing triggers for libc-bin (2.39-0ubuntu8.7) ...\r\n", "stdout_lines": ["Reading package lists...", "Building dependency tree...", "Reading state information...", "The following additional packages will be installed:", " libauparse0t64", "Suggested packages:", " audispd-plugins", "The following NEW packages will be installed:", " auditd libauparse0t64", "0 upgraded, 2 newly installed, 0 to remove and 0 not upgraded.", "Need to get 274 kB of archives.", "After this operation, 893 kB of additional disk space will be used.", "Get:1 http://archive.ubuntu.com/ubuntu noble-updates/main amd64 libauparse0t64 amd64 1:3.1.2-2.1build1.1 [58.9 kB]", "Get:2 http://archive.ubuntu.com/ubuntu noble-updates/main amd64 auditd amd64 1:3.1.2-2.1build1.1 [215 kB]", "Fetched 274 kB in 0s (1872 kB/s)", "Selecting previously unselected package libauparse0t64:amd64.", "(Reading database ... ", "(Reading database ... 5%", "(Reading database ... 10%", "(Reading database ... 15%", "(Reading database ... 20%", "(Reading database ... 25%", "(Reading database ... 30%", "(Reading database ... 35%", "(Reading database ... 40%", "(Reading database ... 45%", "(Reading database ... 50%", "(Reading database ... 55%", "(Reading database ... 60%", "(Reading database ... 65%", "(Reading database ... 70%", "(Reading database ... 75%", "(Reading database ... 80%", "(Reading database ... 85%", "(Reading database ... 90%", "(Reading database ... 95%", "(Reading database ... 100%", "(Reading database ... 36110 files and directories currently installed.)", "Preparing to unpack .../libauparse0t64_1%3a3.1.2-2.1build1.1_amd64.deb ...", "Adding 'diversion of /lib/x86_64-linux-gnu/libauparse.so.0 to /lib/x86_64-linux-gnu/libauparse.so.0.usr-is-merged by libauparse0t64'", "Adding 'diversion of /lib/x86_64-linux-gnu/libauparse.so.0.0.0 to /lib/x86_64-linux-gnu/libauparse.so.0.0.0.usr-is-merged by libauparse0t64'", "Unpacking libauparse0t64:amd64 (1:3.1.2-2.1build1.1) ...", "Selecting previously unselected package auditd.", "Preparing to unpack .../auditd_1%3a3.1.2-2.1build1.1_amd64.deb ...", "Unpacking auditd (1:3.1.2-2.1build1.1) ...", "Setting up libauparse0t64:amd64 (1:3.1.2-2.1build1.1) ...", "Setting up auditd (1:3.1.2-2.1build1.1) ...", "Created symlink /etc/systemd/system/multi-user.target.wants/auditd.service → /usr/lib/systemd/system/auditd.service.", "", "Processing triggers for libc-bin (2.39-0ubuntu8.7) ..."]} 2026-05-14 18:51:33.007310 | ubuntu-noble | 2026-05-14 18:51:33.007442 | ubuntu-noble | TASK [auditd : Install audispd-plugins package] ******************************** 2026-05-14 18:51:34.446221 | debian-bookworm | The following NEW packages will be installed: 2026-05-14 18:51:34.446268 | debian-bookworm | audispd-plugins 2026-05-14 18:51:34.446277 | debian-bookworm | 0 upgraded, 1 newly installed, 0 to remove and 1 not upgraded. 2026-05-14 18:51:34.446287 | debian-bookworm | changed: [molecule-auditd] => {"cache_update_time": 1778784594, "cache_updated": false, "changed": true, "stderr": "debconf: delaying package configuration, since apt-utils is not installed\n", "stderr_lines": ["debconf: delaying package configuration, since apt-utils is not installed"], "stdout": "Reading package lists...\nBuilding dependency tree...\nReading state information...\nThe following NEW packages will be installed:\n audispd-plugins\n0 upgraded, 1 newly installed, 0 to remove and 1 not upgraded.\nNeed to get 45.6 kB of archives.\nAfter this operation, 132 kB of additional disk space will be used.\nGet:1 http://deb.debian.org/debian bookworm/main amd64 audispd-plugins amd64 1:3.0.9-1 [45.6 kB]\nFetched 45.6 kB in 0s (921 kB/s)\nSelecting previously unselected package audispd-plugins.\r\n(Reading database ... \r(Reading database ... 5%\r(Reading database ... 10%\r(Reading database ... 15%\r(Reading database ... 20%\r(Reading database ... 25%\r(Reading database ... 30%\r(Reading database ... 35%\r(Reading database ... 40%\r(Reading database ... 45%\r(Reading database ... 50%\r(Reading database ... 55%\r(Reading database ... 60%\r(Reading database ... 65%\r(Reading database ... 70%\r(Reading database ... 75%\r(Reading database ... 80%\r(Reading database ... 85%\r(Reading database ... 90%\r(Reading database ... 95%\r(Reading database ... 100%\r(Reading database ... 28781 files and directories currently installed.)\r\nPreparing to unpack .../audispd-plugins_1%3a3.0.9-1_amd64.deb ...\r\nUnpacking audispd-plugins (1:3.0.9-1) ...\r\nSetting up audispd-plugins (1:3.0.9-1) ...\r\n", "stdout_lines": ["Reading package lists...", "Building dependency tree...", "Reading state information...", "The following NEW packages will be installed:", " audispd-plugins", "0 upgraded, 1 newly installed, 0 to remove and 1 not upgraded.", "Need to get 45.6 kB of archives.", "After this operation, 132 kB of additional disk space will be used.", "Get:1 http://deb.debian.org/debian bookworm/main amd64 audispd-plugins amd64 1:3.0.9-1 [45.6 kB]", "Fetched 45.6 kB in 0s (921 kB/s)", "Selecting previously unselected package audispd-plugins.", "(Reading database ... ", "(Reading database ... 5%", "(Reading database ... 10%", "(Reading database ... 15%", "(Reading database ... 20%", "(Reading database ... 25%", "(Reading database ... 30%", "(Reading database ... 35%", "(Reading database ... 40%", "(Reading database ... 45%", "(Reading database ... 50%", "(Reading database ... 55%", "(Reading database ... 60%", "(Reading database ... 65%", "(Reading database ... 70%", "(Reading database ... 75%", "(Reading database ... 80%", "(Reading database ... 85%", "(Reading database ... 90%", "(Reading database ... 95%", "(Reading database ... 100%", "(Reading database ... 28781 files and directories currently installed.)", "Preparing to unpack .../audispd-plugins_1%3a3.0.9-1_amd64.deb ...", "Unpacking audispd-plugins (1:3.0.9-1) ...", "Setting up audispd-plugins (1:3.0.9-1) ..."]} 2026-05-14 18:51:34.446315 | debian-bookworm | 2026-05-14 18:51:34.446322 | debian-bookworm | TASK [auditd : Copy auditd.conf configuration files] *************************** 2026-05-14 18:51:35.581364 | debian-bookworm | --- before 2026-05-14 18:51:35.581417 | debian-bookworm | +++ after: /home/zuul/.ansible/tmp/ansible-local-2080o1in5eau/tmpmusra5x_/auditd.conf.j2 2026-05-14 18:51:35.581426 | debian-bookworm | @@ -0,0 +1,37 @@ 2026-05-14 18:51:35.581432 | debian-bookworm | +# 2026-05-14 18:51:35.581438 | debian-bookworm | +# This file controls the configuration of the audit daemon 2026-05-14 18:51:35.581443 | debian-bookworm | +# 2026-05-14 18:51:35.581448 | debian-bookworm | + 2026-05-14 18:51:35.581454 | debian-bookworm | +local_events = yes 2026-05-14 18:51:35.581459 | debian-bookworm | +write_logs = yes 2026-05-14 18:51:35.581465 | debian-bookworm | +log_file = /var/log/audit/audit.log 2026-05-14 18:51:35.581472 | debian-bookworm | +log_group = adm 2026-05-14 18:51:35.581477 | debian-bookworm | +log_format = RAW 2026-05-14 18:51:35.581483 | debian-bookworm | +flush = INCREMENTAL_ASYNC 2026-05-14 18:51:35.581488 | debian-bookworm | +freq = 50 2026-05-14 18:51:35.581493 | debian-bookworm | +max_log_file = 8 2026-05-14 18:51:35.581498 | debian-bookworm | +num_logs = 5 2026-05-14 18:51:35.581503 | debian-bookworm | +priority_boost = 4 2026-05-14 18:51:35.581508 | debian-bookworm | +disp_qos = lossy 2026-05-14 18:51:35.581513 | debian-bookworm | +dispatcher = /sbin/audispd 2026-05-14 18:51:35.581518 | debian-bookworm | +name_format = NONE 2026-05-14 18:51:35.581523 | debian-bookworm | +##name = mydomain 2026-05-14 18:51:35.581528 | debian-bookworm | +max_log_file_action = ROTATE 2026-05-14 18:51:35.581533 | debian-bookworm | +space_left = 12361 2026-05-14 18:51:35.581538 | debian-bookworm | +space_left_action = email 2026-05-14 18:51:35.581543 | debian-bookworm | +verify_email = yes 2026-05-14 18:51:35.581548 | debian-bookworm | +action_mail_acct = root 2026-05-14 18:51:35.581553 | debian-bookworm | +admin_space_left = 50 2026-05-14 18:51:35.581558 | debian-bookworm | +admin_space_left_action = SUSPEND 2026-05-14 18:51:35.581563 | debian-bookworm | +disk_full_action = SUSPEND 2026-05-14 18:51:35.581568 | debian-bookworm | +disk_error_action = SUSPEND 2026-05-14 18:51:35.581573 | debian-bookworm | +use_libwrap = yes 2026-05-14 18:51:35.581578 | debian-bookworm | +##tcp_listen_port = 60 2026-05-14 18:51:35.581583 | debian-bookworm | +tcp_listen_queue = 5 2026-05-14 18:51:35.581588 | debian-bookworm | +tcp_max_per_addr = 1 2026-05-14 18:51:35.581594 | debian-bookworm | +##tcp_client_ports = 1024-65535 2026-05-14 18:51:35.581598 | debian-bookworm | +tcp_client_max_idle = 0 2026-05-14 18:51:35.581603 | debian-bookworm | +enable_krb5 = no 2026-05-14 18:51:35.581608 | debian-bookworm | +krb5_principal = auditd 2026-05-14 18:51:35.581614 | debian-bookworm | +##krb5_key_file = /etc/audit/audit.key 2026-05-14 18:51:35.581619 | debian-bookworm | +distribute_network = no 2026-05-14 18:51:35.581624 | debian-bookworm | 2026-05-14 18:51:35.581669 | debian-bookworm | changed: [molecule-auditd] => {"changed": true, "checksum": "e902cc6bebf86c17087d153e359a2cc1231672e0", "dest": "/etc/audit/audit.conf", "gid": 0, "group": "root", "md5sum": "69dfd768317bae876a6a78c8aeb5cce1", "mode": "0640", "owner": "root", "size": 806, "src": "/home/zuul/.ansible/tmp/ansible-tmp-1778784694.4650328-2450-224326941291998/.source.conf", "state": "file", "uid": 0} 2026-05-14 18:51:35.581679 | debian-bookworm | 2026-05-14 18:51:35.581692 | debian-bookworm | TASK [auditd : Adjust auditd/audispd configurations] *************************** 2026-05-14 18:51:36.018495 | debian-bookworm | ok: [molecule-auditd] => (item={'parameter': 'active', 'value': 'no', 'config': '/etc/audit/plugins.d/syslog.conf'}) => {"ansible_loop_var": "item", "backup": "", "changed": false, "item": {"config": "/etc/audit/plugins.d/syslog.conf", "parameter": "active", "value": "no"}, "msg": ""} 2026-05-14 18:51:36.018560 | debian-bookworm | 2026-05-14 18:51:36.018570 | debian-bookworm | TASK [auditd : Deploy rules for auditd] **************************************** 2026-05-14 18:51:36.623559 | ubuntu-noble | The following NEW packages will be installed: 2026-05-14 18:51:36.623625 | ubuntu-noble | audispd-plugins 2026-05-14 18:51:36.623634 | ubuntu-noble | 0 upgraded, 1 newly installed, 0 to remove and 0 not upgraded. 2026-05-14 18:51:36.623643 | ubuntu-noble | changed: [molecule-auditd] => {"cache_update_time": 1778784596, "cache_updated": false, "changed": true, "stderr": "debconf: delaying package configuration, since apt-utils is not installed\n", "stderr_lines": ["debconf: delaying package configuration, since apt-utils is not installed"], "stdout": "Reading package lists...\nBuilding dependency tree...\nReading state information...\nThe following NEW packages will be installed:\n audispd-plugins\n0 upgraded, 1 newly installed, 0 to remove and 0 not upgraded.\nNeed to get 38.8 kB of archives.\nAfter this operation, 131 kB of additional disk space will be used.\nGet:1 http://archive.ubuntu.com/ubuntu noble-updates/universe amd64 audispd-plugins amd64 1:3.1.2-2.1build1.1 [38.8 kB]\nFetched 38.8 kB in 0s (561 kB/s)\nSelecting previously unselected package audispd-plugins.\r\n(Reading database ... \r(Reading database ... 5%\r(Reading database ... 10%\r(Reading database ... 15%\r(Reading database ... 20%\r(Reading database ... 25%\r(Reading database ... 30%\r(Reading database ... 35%\r(Reading database ... 40%\r(Reading database ... 45%\r(Reading database ... 50%\r(Reading database ... 55%\r(Reading database ... 60%\r(Reading database ... 65%\r(Reading database ... 70%\r(Reading database ... 75%\r(Reading database ... 80%\r(Reading database ... 85%\r(Reading database ... 90%\r(Reading database ... 95%\r(Reading database ... 100%\r(Reading database ... 36206 files and directories currently installed.)\r\nPreparing to unpack .../audispd-plugins_1%3a3.1.2-2.1build1.1_amd64.deb ...\r\nUnpacking audispd-plugins (1:3.1.2-2.1build1.1) ...\r\nSetting up audispd-plugins (1:3.1.2-2.1build1.1) ...\r\n", "stdout_lines": ["Reading package lists...", "Building dependency tree...", "Reading state information...", "The following NEW packages will be installed:", " audispd-plugins", "0 upgraded, 1 newly installed, 0 to remove and 0 not upgraded.", "Need to get 38.8 kB of archives.", "After this operation, 131 kB of additional disk space will be used.", "Get:1 http://archive.ubuntu.com/ubuntu noble-updates/universe amd64 audispd-plugins amd64 1:3.1.2-2.1build1.1 [38.8 kB]", "Fetched 38.8 kB in 0s (561 kB/s)", "Selecting previously unselected package audispd-plugins.", "(Reading database ... ", "(Reading database ... 5%", "(Reading database ... 10%", "(Reading database ... 15%", "(Reading database ... 20%", "(Reading database ... 25%", "(Reading database ... 30%", "(Reading database ... 35%", "(Reading database ... 40%", "(Reading database ... 45%", "(Reading database ... 50%", "(Reading database ... 55%", "(Reading database ... 60%", "(Reading database ... 65%", "(Reading database ... 70%", "(Reading database ... 75%", "(Reading database ... 80%", "(Reading database ... 85%", "(Reading database ... 90%", "(Reading database ... 95%", "(Reading database ... 100%", "(Reading database ... 36206 files and directories currently installed.)", "Preparing to unpack .../audispd-plugins_1%3a3.1.2-2.1build1.1_amd64.deb ...", "Unpacking audispd-plugins (1:3.1.2-2.1build1.1) ...", "Setting up audispd-plugins (1:3.1.2-2.1build1.1) ..."]} 2026-05-14 18:51:36.623669 | ubuntu-noble | 2026-05-14 18:51:36.623675 | ubuntu-noble | TASK [auditd : Copy auditd.conf configuration files] *************************** 2026-05-14 18:51:36.877762 | debian-bookworm | --- before 2026-05-14 18:51:36.877834 | debian-bookworm | +++ after: /home/zuul/.ansible/tmp/ansible-local-2080o1in5eau/tmpb60jemtb/20-neo23x0.rules.j2 2026-05-14 18:51:36.877848 | debian-bookworm | @@ -0,0 +1,750 @@ 2026-05-14 18:51:36.877857 | debian-bookworm | +# ___ ___ __ __ 2026-05-14 18:51:36.877868 | debian-bookworm | +# / | __ ______/ (_) /_____/ / 2026-05-14 18:51:36.877877 | debian-bookworm | +# / /| |/ / / / __ / / __/ __ / 2026-05-14 18:51:36.877885 | debian-bookworm | +# / ___ / /_/ / /_/ / / /_/ /_/ / 2026-05-14 18:51:36.877893 | debian-bookworm | +# /_/ |_\__,_/\__,_/_/\__/\__,_/ 2026-05-14 18:51:36.877902 | debian-bookworm | +# 2026-05-14 18:51:36.877910 | debian-bookworm | +# Linux Audit Daemon - Best Practice Configuration 2026-05-14 18:51:36.877919 | debian-bookworm | +# /etc/audit/audit.rules 2026-05-14 18:51:36.877928 | debian-bookworm | +# 2026-05-14 18:51:36.877936 | debian-bookworm | +# Compiled by Florian Roth 2026-05-14 18:51:36.877944 | debian-bookworm | +# 2026-05-14 18:51:36.877953 | debian-bookworm | +# Created : 2017/12/05 2026-05-14 18:51:36.878031 | debian-bookworm | +# Modified : 2023/01/25 2026-05-14 18:51:36.878308 | debian-bookworm | +# 2026-05-14 18:51:36.878554 | debian-bookworm | +# Based on rules published here: 2026-05-14 18:51:36.878790 | debian-bookworm | +# Gov.uk auditd rules 2026-05-14 18:51:36.879339 | debian-bookworm | +# https://github.com/gds-operations/puppet-auditd/pull/1 2026-05-14 18:51:36.879730 | debian-bookworm | +# CentOS 7 hardening 2026-05-14 18:51:36.880095 | debian-bookworm | +# https://highon.coffee/blog/security-harden-centos-7/#auditd---audit-daemon 2026-05-14 18:51:36.880486 | debian-bookworm | +# Linux audit repo 2026-05-14 18:51:36.880795 | debian-bookworm | +# https://github.com/linux-audit/audit-userspace/tree/master/rules 2026-05-14 18:51:36.881076 | debian-bookworm | +# Auditd high performance linux auditing 2026-05-14 18:51:36.881377 | debian-bookworm | +# https://linux-audit.com/tuning-auditd-high-performance-linux-auditing/ 2026-05-14 18:51:36.881579 | debian-bookworm | +# 2026-05-14 18:51:36.881814 | debian-bookworm | +# Further rules 2026-05-14 18:51:36.882095 | debian-bookworm | +# For PCI DSS compliance see: 2026-05-14 18:51:36.882409 | debian-bookworm | +# https://github.com/linux-audit/audit-userspace/blob/master/rules/30-pci-dss-v31.rules 2026-05-14 18:51:36.882679 | debian-bookworm | +# For NISPOM compliance see: 2026-05-14 18:51:36.882951 | debian-bookworm | +# https://github.com/linux-audit/audit-userspace/blob/master/rules/30-nispom.rules 2026-05-14 18:51:36.883209 | debian-bookworm | + 2026-05-14 18:51:36.883479 | debian-bookworm | +# Remove any existing rules 2026-05-14 18:51:36.883675 | debian-bookworm | +-D 2026-05-14 18:51:36.883903 | debian-bookworm | + 2026-05-14 18:51:36.884088 | debian-bookworm | +# Buffer Size 2026-05-14 18:51:36.884291 | debian-bookworm | +## Feel free to increase this if the machine panic's 2026-05-14 18:51:36.884476 | debian-bookworm | +-b 8192 2026-05-14 18:51:36.884653 | debian-bookworm | + 2026-05-14 18:51:36.885108 | debian-bookworm | +# Failure Mode 2026-05-14 18:51:36.885380 | debian-bookworm | +## Possible values: 0 (silent), 1 (printk, print a failure message), 2 (panic, halt the system) 2026-05-14 18:51:36.885576 | debian-bookworm | +-f 1 2026-05-14 18:51:36.885793 | debian-bookworm | + 2026-05-14 18:51:36.885965 | debian-bookworm | +# Ignore errors 2026-05-14 18:51:36.886127 | debian-bookworm | +## e.g. caused by users or files not found in the local environment 2026-05-14 18:51:36.886304 | debian-bookworm | +-i 2026-05-14 18:51:36.886463 | debian-bookworm | + 2026-05-14 18:51:36.886625 | debian-bookworm | +# Self Auditing --------------------------------------------------------------- 2026-05-14 18:51:36.886781 | debian-bookworm | + 2026-05-14 18:51:36.886944 | debian-bookworm | +## Audit the audit logs 2026-05-14 18:51:36.887114 | debian-bookworm | +### Successful and unsuccessful attempts to read information from the audit records 2026-05-14 18:51:36.887293 | debian-bookworm | +-w /var/log/audit/ -p wra -k auditlog 2026-05-14 18:51:36.887458 | debian-bookworm | +-w /var/audit/ -p wra -k auditlog 2026-05-14 18:51:36.887614 | debian-bookworm | + 2026-05-14 18:51:36.887773 | debian-bookworm | +## Auditd configuration 2026-05-14 18:51:36.887936 | debian-bookworm | +### Modifications to audit configuration that occur while the audit collection functions are operating 2026-05-14 18:51:36.888099 | debian-bookworm | +-w /etc/audit/ -p wa -k auditconfig 2026-05-14 18:51:36.888260 | debian-bookworm | +-w /etc/libaudit.conf -p wa -k auditconfig 2026-05-14 18:51:36.888436 | debian-bookworm | +-w /etc/audisp/ -p wa -k audispconfig 2026-05-14 18:51:36.888593 | debian-bookworm | + 2026-05-14 18:51:36.888753 | debian-bookworm | +## Monitor for use of audit management tools 2026-05-14 18:51:36.888911 | debian-bookworm | +-w /sbin/auditctl -p x -k audittools 2026-05-14 18:51:36.889070 | debian-bookworm | +-w /sbin/auditd -p x -k audittools 2026-05-14 18:51:36.889231 | debian-bookworm | +-w /usr/sbin/auditd -p x -k audittools 2026-05-14 18:51:36.889439 | debian-bookworm | +-w /usr/sbin/augenrules -p x -k audittools 2026-05-14 18:51:36.889600 | debian-bookworm | + 2026-05-14 18:51:36.889795 | debian-bookworm | +## Access to all audit trails 2026-05-14 18:51:36.889943 | debian-bookworm | + 2026-05-14 18:51:36.890096 | debian-bookworm | +-a always,exit -F path=/usr/sbin/ausearch -F perm=x -k audittools 2026-05-14 18:51:36.890241 | debian-bookworm | +-a always,exit -F path=/usr/sbin/aureport -F perm=x -k audittools 2026-05-14 18:51:36.890401 | debian-bookworm | +-a always,exit -F path=/usr/sbin/aulast -F perm=x -k audittools 2026-05-14 18:51:36.890547 | debian-bookworm | +-a always,exit -F path=/usr/sbin/aulastlogin -F perm=x -k audittools 2026-05-14 18:51:36.890690 | debian-bookworm | +-a always,exit -F path=/usr/sbin/auvirt -F perm=x -k audittools 2026-05-14 18:51:36.890828 | debian-bookworm | + 2026-05-14 18:51:36.891042 | debian-bookworm | +# Filters --------------------------------------------------------------------- 2026-05-14 18:51:36.891241 | debian-bookworm | + 2026-05-14 18:51:36.891437 | debian-bookworm | +### We put these early because audit is a first match wins system. 2026-05-14 18:51:36.891577 | debian-bookworm | + 2026-05-14 18:51:36.891743 | debian-bookworm | +## Ignore SELinux AVC records 2026-05-14 18:51:36.891887 | debian-bookworm | +-a always,exclude -F msgtype=AVC 2026-05-14 18:51:36.892020 | debian-bookworm | + 2026-05-14 18:51:36.892158 | debian-bookworm | +## Ignore current working directory records 2026-05-14 18:51:36.892316 | debian-bookworm | +-a always,exclude -F msgtype=CWD 2026-05-14 18:51:36.892449 | debian-bookworm | + 2026-05-14 18:51:36.892587 | debian-bookworm | +## Cron jobs fill the logs with stuff we normally don't want (works with SELinux) 2026-05-14 18:51:36.892721 | debian-bookworm | +-a never,user -F subj_type=crond_t 2026-05-14 18:51:36.892857 | debian-bookworm | +-a never,exit -F subj_type=crond_t 2026-05-14 18:51:36.892989 | debian-bookworm | + 2026-05-14 18:51:36.893127 | debian-bookworm | +## This prevents chrony from overwhelming the logs 2026-05-14 18:51:36.893265 | debian-bookworm | +-a never,exit -F arch=b64 -S adjtimex -F auid=-1 -F uid=chrony -F subj_type=chronyd_t 2026-05-14 18:51:36.893414 | debian-bookworm | + 2026-05-14 18:51:36.893552 | debian-bookworm | +## This is not very interesting and wastes a lot of space if the server is public facing 2026-05-14 18:51:36.893721 | debian-bookworm | +-a always,exclude -F msgtype=CRYPTO_KEY_USER 2026-05-14 18:51:36.893854 | debian-bookworm | + 2026-05-14 18:51:36.893988 | debian-bookworm | +## Open VM Tools 2026-05-14 18:51:36.894125 | debian-bookworm | +-a exit,never -F arch=b64 -S all -F exe=/usr/bin/vmtoolsd 2026-05-14 18:51:36.894258 | debian-bookworm | + 2026-05-14 18:51:36.894444 | debian-bookworm | +## High Volume Event Filter (especially on Linux Workstations) 2026-05-14 18:51:36.894571 | debian-bookworm | +-a never,exit -F arch=b64 -F dir=/dev/shm -k sharedmemaccess 2026-05-14 18:51:36.894697 | debian-bookworm | +-a never,exit -F arch=b64 -F dir=/var/lock/lvm -k locklvm 2026-05-14 18:51:36.894818 | debian-bookworm | + 2026-05-14 18:51:36.894940 | debian-bookworm | +## FileBeat 2026-05-14 18:51:36.895065 | debian-bookworm | +-a never,exit -F arch=b64 -F path=/opt/filebeat -k filebeat 2026-05-14 18:51:36.895182 | debian-bookworm | + 2026-05-14 18:51:36.895320 | debian-bookworm | +## More information on how to filter events 2026-05-14 18:51:36.895446 | debian-bookworm | +### https://access.redhat.com/solutions/2482221 2026-05-14 18:51:36.895564 | debian-bookworm | + 2026-05-14 18:51:36.895684 | debian-bookworm | +# Rules ----------------------------------------------------------------------- 2026-05-14 18:51:36.895800 | debian-bookworm | + 2026-05-14 18:51:36.895920 | debian-bookworm | +## Kernel parameters 2026-05-14 18:51:36.896043 | debian-bookworm | +-w /etc/sysctl.conf -p wa -k sysctl 2026-05-14 18:51:36.896166 | debian-bookworm | +-w /etc/sysctl.d -p wa -k sysctl 2026-05-14 18:51:36.896297 | debian-bookworm | + 2026-05-14 18:51:36.896420 | debian-bookworm | +## Kernel module loading and unloading 2026-05-14 18:51:36.896544 | debian-bookworm | +-a always,exit -F perm=x -F auid!=-1 -F path=/sbin/insmod -k modules 2026-05-14 18:51:36.896668 | debian-bookworm | +-a always,exit -F perm=x -F auid!=-1 -F path=/sbin/modprobe -k modules 2026-05-14 18:51:36.896791 | debian-bookworm | +-a always,exit -F perm=x -F auid!=-1 -F path=/sbin/rmmod -k modules 2026-05-14 18:51:36.896913 | debian-bookworm | +-a always,exit -F arch=b64 -S finit_module -S init_module -S delete_module -F auid!=-1 -k modules 2026-05-14 18:51:36.897029 | debian-bookworm | + 2026-05-14 18:51:36.897148 | debian-bookworm | +## Modprobe configuration 2026-05-14 18:51:36.897307 | debian-bookworm | +-w /etc/modprobe.conf -p wa -k modprobe 2026-05-14 18:51:36.897438 | debian-bookworm | +-w /etc/modprobe.d -p wa -k modprobe 2026-05-14 18:51:36.897551 | debian-bookworm | + 2026-05-14 18:51:36.897681 | debian-bookworm | +## KExec usage (all actions) 2026-05-14 18:51:36.897794 | debian-bookworm | +-a always,exit -F arch=b64 -S kexec_load -k KEXEC 2026-05-14 18:51:36.897900 | debian-bookworm | + 2026-05-14 18:51:36.898009 | debian-bookworm | +## Special files 2026-05-14 18:51:36.898118 | debian-bookworm | +-a always,exit -F arch=b64 -S mknod -S mknodat -k specialfiles 2026-05-14 18:51:36.898225 | debian-bookworm | + 2026-05-14 18:51:36.898355 | debian-bookworm | +## Mount operations (only attributable) 2026-05-14 18:51:36.898468 | debian-bookworm | +-a always,exit -F arch=b64 -S mount -S umount2 -F auid!=-1 -k mount 2026-05-14 18:51:36.898575 | debian-bookworm | + 2026-05-14 18:51:36.898685 | debian-bookworm | +### NFS mount 2026-05-14 18:51:36.898811 | debian-bookworm | +-a always,exit -F path=/sbin/mount.nfs -F perm=x -F auid>=500 -F auid!=4294967295 -k T1078_Valid_Accounts 2026-05-14 18:51:36.898930 | debian-bookworm | +-a always,exit -F path=/usr/sbin/mount.nfs -F perm=x -F auid>=500 -F auid!=4294967295 -k T1078_Valid_Accounts 2026-05-14 18:51:36.899037 | debian-bookworm | + 2026-05-14 18:51:36.899147 | debian-bookworm | +## Change swap (only attributable) 2026-05-14 18:51:36.899260 | debian-bookworm | +-a always,exit -F arch=b64 -S swapon -S swapoff -F auid!=-1 -k swap 2026-05-14 18:51:36.899426 | debian-bookworm | + 2026-05-14 18:51:36.899538 | debian-bookworm | +## Time 2026-05-14 18:51:36.899653 | debian-bookworm | +-a always,exit -F arch=b64 -F uid!=ntp -S adjtimex -S settimeofday -S clock_settime -k time 2026-05-14 18:51:36.899766 | debian-bookworm | +### Local time zone 2026-05-14 18:51:36.899877 | debian-bookworm | +-w /etc/localtime -p wa -k localtime 2026-05-14 18:51:36.899986 | debian-bookworm | + 2026-05-14 18:51:36.900094 | debian-bookworm | +## Stunnel 2026-05-14 18:51:36.900206 | debian-bookworm | +-w /usr/sbin/stunnel -p x -k stunnel 2026-05-14 18:51:36.900334 | debian-bookworm | +-w /usr/bin/stunnel -p x -k stunnel 2026-05-14 18:51:36.900445 | debian-bookworm | + 2026-05-14 18:51:36.900557 | debian-bookworm | +## Cron configuration & scheduled jobs 2026-05-14 18:51:36.900669 | debian-bookworm | +-w /etc/cron.allow -p wa -k cron 2026-05-14 18:51:36.900779 | debian-bookworm | +-w /etc/cron.deny -p wa -k cron 2026-05-14 18:51:36.900889 | debian-bookworm | +-w /etc/cron.d/ -p wa -k cron 2026-05-14 18:51:36.901002 | debian-bookworm | +-w /etc/cron.daily/ -p wa -k cron 2026-05-14 18:51:36.901113 | debian-bookworm | +-w /etc/cron.hourly/ -p wa -k cron 2026-05-14 18:51:36.901287 | debian-bookworm | +-w /etc/cron.monthly/ -p wa -k cron 2026-05-14 18:51:36.901436 | debian-bookworm | +-w /etc/cron.weekly/ -p wa -k cron 2026-05-14 18:51:36.901553 | debian-bookworm | +-w /etc/crontab -p wa -k cron 2026-05-14 18:51:36.901692 | debian-bookworm | +-w /var/spool/cron/ -p wa -k cron 2026-05-14 18:51:36.901806 | debian-bookworm | + 2026-05-14 18:51:36.901918 | debian-bookworm | +## User, group, password databases 2026-05-14 18:51:36.902032 | debian-bookworm | +-w /etc/group -p wa -k etcgroup 2026-05-14 18:51:36.902146 | debian-bookworm | +-w /etc/passwd -p wa -k etcpasswd 2026-05-14 18:51:36.902262 | debian-bookworm | +-w /etc/gshadow -k etcgroup 2026-05-14 18:51:36.902436 | debian-bookworm | +-w /etc/shadow -k etcpasswd 2026-05-14 18:51:36.902560 | debian-bookworm | +-w /etc/security/opasswd -k opasswd 2026-05-14 18:51:36.902672 | debian-bookworm | + 2026-05-14 18:51:36.902782 | debian-bookworm | +## Sudoers file changes 2026-05-14 18:51:36.902895 | debian-bookworm | +-w /etc/sudoers -p wa -k actions 2026-05-14 18:51:36.903007 | debian-bookworm | +-w /etc/sudoers.d/ -p wa -k actions 2026-05-14 18:51:36.903115 | debian-bookworm | + 2026-05-14 18:51:36.903227 | debian-bookworm | +## Passwd 2026-05-14 18:51:36.903385 | debian-bookworm | +-w /usr/bin/passwd -p x -k passwd_modification 2026-05-14 18:51:36.903497 | debian-bookworm | + 2026-05-14 18:51:36.903610 | debian-bookworm | +## Tools to change group identifiers 2026-05-14 18:51:36.903724 | debian-bookworm | +-w /usr/sbin/groupadd -p x -k group_modification 2026-05-14 18:51:36.903836 | debian-bookworm | +-w /usr/sbin/groupmod -p x -k group_modification 2026-05-14 18:51:36.903947 | debian-bookworm | +-w /usr/sbin/addgroup -p x -k group_modification 2026-05-14 18:51:36.904060 | debian-bookworm | +-w /usr/sbin/useradd -p x -k user_modification 2026-05-14 18:51:36.904171 | debian-bookworm | +-w /usr/sbin/userdel -p x -k user_modification 2026-05-14 18:51:36.904297 | debian-bookworm | +-w /usr/sbin/usermod -p x -k user_modification 2026-05-14 18:51:36.904415 | debian-bookworm | +-w /usr/sbin/adduser -p x -k user_modification 2026-05-14 18:51:36.904523 | debian-bookworm | + 2026-05-14 18:51:36.904636 | debian-bookworm | +## Login configuration and information 2026-05-14 18:51:36.904748 | debian-bookworm | +-w /etc/login.defs -p wa -k login 2026-05-14 18:51:36.904860 | debian-bookworm | +-w /etc/securetty -p wa -k login 2026-05-14 18:51:36.904972 | debian-bookworm | +-w /var/log/faillog -p wa -k login 2026-05-14 18:51:36.905081 | debian-bookworm | +-w /var/log/lastlog -p wa -k login 2026-05-14 18:51:36.905193 | debian-bookworm | +-w /var/log/tallylog -p wa -k login 2026-05-14 18:51:36.905319 | debian-bookworm | + 2026-05-14 18:51:36.905430 | debian-bookworm | +## Network Environment 2026-05-14 18:51:36.905539 | debian-bookworm | +### Changes to hostname 2026-05-14 18:51:36.905673 | debian-bookworm | +-a always,exit -F arch=b64 -S sethostname -S setdomainname -k network_modifications 2026-05-14 18:51:36.905784 | debian-bookworm | + 2026-05-14 18:51:36.905894 | debian-bookworm | +### Detect Remote Shell Use 2026-05-14 18:51:36.906005 | debian-bookworm | +-a always,exit -F arch=b64 -F exe=/bin/bash -F success=1 -S connect -k "remote_shell" 2026-05-14 18:51:36.906115 | debian-bookworm | +-a always,exit -F arch=b64 -F exe=/usr/bin/bash -F success=1 -S connect -k "remote_shell" 2026-05-14 18:51:36.906220 | debian-bookworm | + 2026-05-14 18:51:36.906380 | debian-bookworm | +### Successful IPv4 Connections 2026-05-14 18:51:36.906498 | debian-bookworm | +-a always,exit -F arch=b64 -S connect -F a2=16 -F success=1 -F key=network_connect_4 2026-05-14 18:51:36.906606 | debian-bookworm | + 2026-05-14 18:51:36.906717 | debian-bookworm | +### Successful IPv6 Connections 2026-05-14 18:51:36.906831 | debian-bookworm | +-a always,exit -F arch=b64 -S connect -F a2=28 -F success=1 -F key=network_connect_6 2026-05-14 18:51:36.906948 | debian-bookworm | + 2026-05-14 18:51:36.907060 | debian-bookworm | +### Changes to other files 2026-05-14 18:51:36.907172 | debian-bookworm | +-w /etc/hosts -p wa -k network_modifications 2026-05-14 18:51:36.907299 | debian-bookworm | +-w /etc/sysconfig/network -p wa -k network_modifications 2026-05-14 18:51:36.907414 | debian-bookworm | +-w /etc/sysconfig/network-scripts -p w -k network_modifications 2026-05-14 18:51:36.907525 | debian-bookworm | +-w /etc/network/ -p wa -k network 2026-05-14 18:51:36.907640 | debian-bookworm | +-a always,exit -F dir=/etc/NetworkManager/ -F perm=wa -k network_modifications 2026-05-14 18:51:36.907750 | debian-bookworm | + 2026-05-14 18:51:36.907861 | debian-bookworm | +### Changes to issue 2026-05-14 18:51:36.907972 | debian-bookworm | +-w /etc/issue -p wa -k etcissue 2026-05-14 18:51:36.908085 | debian-bookworm | +-w /etc/issue.net -p wa -k etcissue 2026-05-14 18:51:36.908192 | debian-bookworm | + 2026-05-14 18:51:36.908314 | debian-bookworm | +## System startup scripts 2026-05-14 18:51:36.908425 | debian-bookworm | +-w /etc/inittab -p wa -k init 2026-05-14 18:51:36.908537 | debian-bookworm | +-w /etc/init.d/ -p wa -k init 2026-05-14 18:51:36.908647 | debian-bookworm | +-w /etc/init/ -p wa -k init 2026-05-14 18:51:36.908754 | debian-bookworm | + 2026-05-14 18:51:36.908864 | debian-bookworm | +## Library search paths 2026-05-14 18:51:36.908976 | debian-bookworm | +-w /etc/ld.so.conf -p wa -k libpath 2026-05-14 18:51:36.909088 | debian-bookworm | +-w /etc/ld.so.conf.d -p wa -k libpath 2026-05-14 18:51:36.909196 | debian-bookworm | + 2026-05-14 18:51:36.909321 | debian-bookworm | +## Systemwide library preloads (LD_PRELOAD) 2026-05-14 18:51:36.909434 | debian-bookworm | +-w /etc/ld.so.preload -p wa -k systemwide_preloads 2026-05-14 18:51:36.909542 | debian-bookworm | + 2026-05-14 18:51:36.909673 | debian-bookworm | +## Pam configuration 2026-05-14 18:51:36.909787 | debian-bookworm | +-w /etc/pam.d/ -p wa -k pam 2026-05-14 18:51:36.909926 | debian-bookworm | +-w /etc/security/limits.conf -p wa -k pam 2026-05-14 18:51:36.910062 | debian-bookworm | +-w /etc/security/limits.d -p wa -k pam 2026-05-14 18:51:36.910178 | debian-bookworm | +-w /etc/security/pam_env.conf -p wa -k pam 2026-05-14 18:51:36.910327 | debian-bookworm | +-w /etc/security/namespace.conf -p wa -k pam 2026-05-14 18:51:36.910445 | debian-bookworm | +-w /etc/security/namespace.d -p wa -k pam 2026-05-14 18:51:36.910556 | debian-bookworm | +-w /etc/security/namespace.init -p wa -k pam 2026-05-14 18:51:36.910666 | debian-bookworm | + 2026-05-14 18:51:36.910777 | debian-bookworm | +## Mail configuration 2026-05-14 18:51:36.910888 | debian-bookworm | +-w /etc/aliases -p wa -k mail 2026-05-14 18:51:36.911001 | debian-bookworm | +-w /etc/postfix/ -p wa -k mail 2026-05-14 18:51:36.911111 | debian-bookworm | +-w /etc/exim4/ -p wa -k mail 2026-05-14 18:51:36.911219 | debian-bookworm | + 2026-05-14 18:51:36.911343 | debian-bookworm | +## SSH configuration 2026-05-14 18:51:36.911455 | debian-bookworm | +-w /etc/ssh/sshd_config -k sshd 2026-05-14 18:51:36.911565 | debian-bookworm | +-w /etc/ssh/sshd_config.d -k sshd 2026-05-14 18:51:36.911676 | debian-bookworm | + 2026-05-14 18:51:36.911787 | debian-bookworm | +## root ssh key tampering 2026-05-14 18:51:36.911897 | debian-bookworm | +-w /root/.ssh -p wa -k rootkey 2026-05-14 18:51:36.912003 | debian-bookworm | + 2026-05-14 18:51:36.912157 | debian-bookworm | +# Systemd 2026-05-14 18:51:36.912297 | debian-bookworm | +-w /bin/systemctl -p x -k systemd 2026-05-14 18:51:36.912414 | debian-bookworm | +-w /etc/systemd/ -p wa -k systemd 2026-05-14 18:51:36.912526 | debian-bookworm | +-w /usr/lib/systemd -p wa -k systemd 2026-05-14 18:51:36.912634 | debian-bookworm | + 2026-05-14 18:51:36.912746 | debian-bookworm | +## https://systemd.network/systemd.generator.html 2026-05-14 18:51:36.912855 | debian-bookworm | +-w /etc/systemd/system-generators/ -p wa -k systemd_generator 2026-05-14 18:51:36.912966 | debian-bookworm | +-w /usr/local/lib/systemd/system-generators/ -p wa -k systemd_generator 2026-05-14 18:51:36.913080 | debian-bookworm | +-w /usr/lib/systemd/system-generators -p wa -k systemd_generator 2026-05-14 18:51:36.913190 | debian-bookworm | + 2026-05-14 18:51:36.913316 | debian-bookworm | +-w /etc/systemd/user-generators/ -p wa -k systemd_generator 2026-05-14 18:51:36.913428 | debian-bookworm | +-w /usr/local/lib/systemd/user-generators/ -p wa -k systemd_generator 2026-05-14 18:51:36.913539 | debian-bookworm | +-w /lib/systemd/system-generators/ -p wa -k systemd_generator 2026-05-14 18:51:36.913675 | debian-bookworm | + 2026-05-14 18:51:36.913793 | debian-bookworm | +## SELinux events that modify the system's Mandatory Access Controls (MAC) 2026-05-14 18:51:36.913905 | debian-bookworm | +-w /etc/selinux/ -p wa -k mac_policy 2026-05-14 18:51:36.914011 | debian-bookworm | + 2026-05-14 18:51:36.914130 | debian-bookworm | +## Critical elements access failures 2026-05-14 18:51:36.914247 | debian-bookworm | +-a always,exit -F arch=b64 -S open -F dir=/etc -F success=0 -k unauthedfileaccess 2026-05-14 18:51:36.914410 | debian-bookworm | +-a always,exit -F arch=b64 -S open -F dir=/bin -F success=0 -k unauthedfileaccess 2026-05-14 18:51:36.914585 | debian-bookworm | +-a always,exit -F arch=b64 -S open -F dir=/sbin -F success=0 -k unauthedfileaccess 2026-05-14 18:51:36.914711 | debian-bookworm | +-a always,exit -F arch=b64 -S open -F dir=/usr/bin -F success=0 -k unauthedfileaccess 2026-05-14 18:51:36.914826 | debian-bookworm | +-a always,exit -F arch=b64 -S open -F dir=/usr/sbin -F success=0 -k unauthedfileaccess 2026-05-14 18:51:36.914940 | debian-bookworm | +-a always,exit -F arch=b64 -S open -F dir=/var -F success=0 -k unauthedfileaccess 2026-05-14 18:51:36.915053 | debian-bookworm | +-a always,exit -F arch=b64 -S open -F dir=/home -F success=0 -k unauthedfileaccess 2026-05-14 18:51:36.915168 | debian-bookworm | +-a always,exit -F arch=b64 -S open -F dir=/srv -F success=0 -k unauthedfileaccess 2026-05-14 18:51:36.915297 | debian-bookworm | + 2026-05-14 18:51:36.915426 | debian-bookworm | +## Process ID change (switching accounts) applications 2026-05-14 18:51:36.915538 | debian-bookworm | +-w /bin/su -p x -k priv_esc 2026-05-14 18:51:36.915690 | debian-bookworm | +-w /usr/bin/sudo -p x -k priv_esc 2026-05-14 18:51:36.915831 | debian-bookworm | + 2026-05-14 18:51:36.915988 | debian-bookworm | +## Power state 2026-05-14 18:51:36.916162 | debian-bookworm | +-w /sbin/shutdown -p x -k power 2026-05-14 18:51:36.916358 | debian-bookworm | +-w /sbin/poweroff -p x -k power 2026-05-14 18:51:36.916533 | debian-bookworm | +-w /sbin/reboot -p x -k power 2026-05-14 18:51:36.916702 | debian-bookworm | +-w /sbin/halt -p x -k power 2026-05-14 18:51:36.916870 | debian-bookworm | + 2026-05-14 18:51:36.917042 | debian-bookworm | +## Session initiation information 2026-05-14 18:51:36.917171 | debian-bookworm | +-w /var/run/utmp -p wa -k session 2026-05-14 18:51:36.917307 | debian-bookworm | +-w /var/log/btmp -p wa -k session 2026-05-14 18:51:36.917422 | debian-bookworm | +-w /var/log/wtmp -p wa -k session 2026-05-14 18:51:36.917531 | debian-bookworm | + 2026-05-14 18:51:36.917669 | debian-bookworm | +## Discretionary Access Control (DAC) modifications 2026-05-14 18:51:36.917788 | debian-bookworm | +-a always,exit -F arch=b64 -S chmod -F auid>=1000 -F auid!=-1 -k perm_mod 2026-05-14 18:51:36.917929 | debian-bookworm | +-a always,exit -F arch=b64 -S chown -F auid>=1000 -F auid!=-1 -k perm_mod 2026-05-14 18:51:36.918064 | debian-bookworm | +-a always,exit -F arch=b64 -S fchmod -F auid>=1000 -F auid!=-1 -k perm_mod 2026-05-14 18:51:36.918179 | debian-bookworm | +-a always,exit -F arch=b64 -S fchmodat -F auid>=1000 -F auid!=-1 -k perm_mod 2026-05-14 18:51:36.918344 | debian-bookworm | +-a always,exit -F arch=b64 -S fchown -F auid>=1000 -F auid!=-1 -k perm_mod 2026-05-14 18:51:36.918469 | debian-bookworm | +-a always,exit -F arch=b64 -S fchownat -F auid>=1000 -F auid!=-1 -k perm_mod 2026-05-14 18:51:36.918582 | debian-bookworm | +-a always,exit -F arch=b64 -S fremovexattr -F auid>=1000 -F auid!=-1 -k perm_mod 2026-05-14 18:51:36.918698 | debian-bookworm | +-a always,exit -F arch=b64 -S fsetxattr -F auid>=1000 -F auid!=-1 -k perm_mod 2026-05-14 18:51:36.918812 | debian-bookworm | +-a always,exit -F arch=b64 -S lchown -F auid>=1000 -F auid!=-1 -k perm_mod 2026-05-14 18:51:36.918923 | debian-bookworm | +-a always,exit -F arch=b64 -S lremovexattr -F auid>=1000 -F auid!=-1 -k perm_mod 2026-05-14 18:51:36.919072 | debian-bookworm | +-a always,exit -F arch=b64 -S lsetxattr -F auid>=1000 -F auid!=-1 -k perm_mod 2026-05-14 18:51:36.919209 | debian-bookworm | +-a always,exit -F arch=b64 -S removexattr -F auid>=1000 -F auid!=-1 -k perm_mod 2026-05-14 18:51:36.919343 | debian-bookworm | +-a always,exit -F arch=b64 -S setxattr -F auid>=1000 -F auid!=-1 -k perm_mod 2026-05-14 18:51:36.919454 | debian-bookworm | + 2026-05-14 18:51:36.919565 | debian-bookworm | +# Special Rules --------------------------------------------------------------- 2026-05-14 18:51:36.919674 | debian-bookworm | + 2026-05-14 18:51:36.919785 | debian-bookworm | +## Reconnaissance 2026-05-14 18:51:36.919896 | debian-bookworm | +-w /usr/bin/whoami -p x -k recon 2026-05-14 18:51:36.920007 | debian-bookworm | +-w /usr/bin/id -p x -k recon 2026-05-14 18:51:36.920121 | debian-bookworm | +-w /bin/hostname -p x -k recon 2026-05-14 18:51:36.920232 | debian-bookworm | +-w /bin/uname -p x -k recon 2026-05-14 18:51:36.920356 | debian-bookworm | +-w /etc/issue -p r -k recon 2026-05-14 18:51:36.920467 | debian-bookworm | +-w /etc/hostname -p r -k recon 2026-05-14 18:51:36.920576 | debian-bookworm | + 2026-05-14 18:51:36.920689 | debian-bookworm | +## Suspicious activity 2026-05-14 18:51:36.920802 | debian-bookworm | +-w /usr/bin/wget -p x -k susp_activity 2026-05-14 18:51:36.920911 | debian-bookworm | +-w /usr/bin/curl -p x -k susp_activity 2026-05-14 18:51:36.921023 | debian-bookworm | +-w /usr/bin/base64 -p x -k susp_activity 2026-05-14 18:51:36.921133 | debian-bookworm | +-w /bin/nc -p x -k susp_activity 2026-05-14 18:51:36.921243 | debian-bookworm | +-w /bin/netcat -p x -k susp_activity 2026-05-14 18:51:36.921429 | debian-bookworm | +-w /usr/bin/ncat -p x -k susp_activity 2026-05-14 18:51:36.921583 | debian-bookworm | +-w /usr/bin/ss -p x -k susp_activity 2026-05-14 18:51:36.921731 | debian-bookworm | +-w /usr/bin/netstat -p x -k susp_activity 2026-05-14 18:51:36.921844 | debian-bookworm | +-w /usr/bin/ssh -p x -k susp_activity 2026-05-14 18:51:36.921956 | debian-bookworm | +-w /usr/bin/scp -p x -k susp_activity 2026-05-14 18:51:36.922069 | debian-bookworm | +-w /usr/bin/sftp -p x -k susp_activity 2026-05-14 18:51:36.922179 | debian-bookworm | +-w /usr/bin/ftp -p x -k susp_activity 2026-05-14 18:51:36.922319 | debian-bookworm | +-w /usr/bin/socat -p x -k susp_activity 2026-05-14 18:51:36.922434 | debian-bookworm | +-w /usr/bin/wireshark -p x -k susp_activity 2026-05-14 18:51:36.922545 | debian-bookworm | +-w /usr/bin/tshark -p x -k susp_activity 2026-05-14 18:51:36.922658 | debian-bookworm | +-w /usr/bin/rawshark -p x -k susp_activity 2026-05-14 18:51:36.922769 | debian-bookworm | +-w /usr/bin/rdesktop -p x -k susp_activity 2026-05-14 18:51:36.922882 | debian-bookworm | +-w /usr/local/bin/rdesktop -p x -k susp_activity 2026-05-14 18:51:36.922994 | debian-bookworm | +-w /usr/bin/wlfreerdp -p x -k susp_activity 2026-05-14 18:51:36.923107 | debian-bookworm | +-w /usr/bin/xfreerdp -p x -k susp_activity 2026-05-14 18:51:36.923220 | debian-bookworm | +-w /usr/local/bin/xfreerdp -p x -k susp_activity 2026-05-14 18:51:36.923377 | debian-bookworm | +-w /usr/bin/nmap -p x -k susp_activity 2026-05-14 18:51:36.923516 | debian-bookworm | + 2026-05-14 18:51:36.923631 | debian-bookworm | +## sssd 2026-05-14 18:51:36.923750 | debian-bookworm | +-a always,exit -F path=/usr/libexec/sssd/p11_child -F perm=x -F auid>=500 -F auid!=4294967295 -k T1078_Valid_Accounts 2026-05-14 18:51:36.923866 | debian-bookworm | +-a always,exit -F path=/usr/libexec/sssd/krb5_child -F perm=x -F auid>=500 -F auid!=4294967295 -k T1078_Valid_Accounts 2026-05-14 18:51:36.923982 | debian-bookworm | +-a always,exit -F path=/usr/libexec/sssd/ldap_child -F perm=x -F auid>=500 -F auid!=4294967295 -k T1078_Valid_Accounts 2026-05-14 18:51:36.924096 | debian-bookworm | +-a always,exit -F path=/usr/libexec/sssd/selinux_child -F perm=x -F auid>=500 -F auid!=4294967295 -k T1078_Valid_Accounts 2026-05-14 18:51:36.924208 | debian-bookworm | +-a always,exit -F path=/usr/libexec/sssd/proxy_child -F perm=x -F auid>=500 -F auid!=4294967295 -k T1078_Valid_Accounts 2026-05-14 18:51:36.924340 | debian-bookworm | + 2026-05-14 18:51:36.924458 | debian-bookworm | +## T1002 Data Compressed 2026-05-14 18:51:36.924567 | debian-bookworm | + 2026-05-14 18:51:36.924680 | debian-bookworm | +-w /usr/bin/zip -p x -k Data_Compressed 2026-05-14 18:51:36.924792 | debian-bookworm | +-w /usr/bin/gzip -p x -k Data_Compressed 2026-05-14 18:51:36.924904 | debian-bookworm | +-w /usr/bin/tar -p x -k Data_Compressed 2026-05-14 18:51:36.925016 | debian-bookworm | +-w /usr/bin/bzip2 -p x -k Data_Compressed 2026-05-14 18:51:36.925123 | debian-bookworm | + 2026-05-14 18:51:36.925234 | debian-bookworm | +-w /usr/bin/lzip -p x -k Data_Compressed 2026-05-14 18:51:36.925389 | debian-bookworm | +-w /usr/local/bin/lzip -p x -k Data_Compressed 2026-05-14 18:51:36.925501 | debian-bookworm | + 2026-05-14 18:51:36.925612 | debian-bookworm | +-w /usr/bin/lz4 -p x -k Data_Compressed 2026-05-14 18:51:36.925744 | debian-bookworm | +-w /usr/local/bin/lz4 -p x -k Data_Compressed 2026-05-14 18:51:36.925867 | debian-bookworm | + 2026-05-14 18:51:36.925981 | debian-bookworm | +-w /usr/bin/lzop -p x -k Data_Compressed 2026-05-14 18:51:36.926092 | debian-bookworm | +-w /usr/local/bin/lzop -p x -k Data_Compressed 2026-05-14 18:51:36.926199 | debian-bookworm | + 2026-05-14 18:51:36.926322 | debian-bookworm | +-w /usr/bin/plzip -p x -k Data_Compressed 2026-05-14 18:51:36.926434 | debian-bookworm | +-w /usr/local/bin/plzip -p x -k Data_Compressed 2026-05-14 18:51:36.926540 | debian-bookworm | + 2026-05-14 18:51:36.926649 | debian-bookworm | +-w /usr/bin/pbzip2 -p x -k Data_Compressed 2026-05-14 18:51:36.926759 | debian-bookworm | +-w /usr/local/bin/pbzip2 -p x -k Data_Compressed 2026-05-14 18:51:36.926867 | debian-bookworm | + 2026-05-14 18:51:36.926977 | debian-bookworm | +-w /usr/bin/lbzip2 -p x -k Data_Compressed 2026-05-14 18:51:36.927087 | debian-bookworm | +-w /usr/local/bin/lbzip2 -p x -k Data_Compressed 2026-05-14 18:51:36.927193 | debian-bookworm | + 2026-05-14 18:51:36.927318 | debian-bookworm | +-w /usr/bin/pixz -p x -k Data_Compressed 2026-05-14 18:51:36.927431 | debian-bookworm | +-w /usr/local/bin/pixz -p x -k Data_Compressed 2026-05-14 18:51:36.927606 | debian-bookworm | + 2026-05-14 18:51:36.927727 | debian-bookworm | +-w /usr/bin/pigz -p x -k Data_Compressed 2026-05-14 18:51:36.927838 | debian-bookworm | +-w /usr/local/bin/pigz -p x -k Data_Compressed 2026-05-14 18:51:36.927948 | debian-bookworm | +-w /usr/bin/unpigz -p x -k Data_Compressed 2026-05-14 18:51:36.928061 | debian-bookworm | +-w /usr/local/bin/unpigz -p x -k Data_Compressed 2026-05-14 18:51:36.928169 | debian-bookworm | + 2026-05-14 18:51:36.928298 | debian-bookworm | +-w /usr/bin/zstd -p x -k Data_Compressed 2026-05-14 18:51:36.928429 | debian-bookworm | +-w /usr/local/bin/zstd -p x -k Data_Compressed 2026-05-14 18:51:36.928550 | debian-bookworm | + 2026-05-14 18:51:36.928663 | debian-bookworm | +## Added to catch netcat on Ubuntu 2026-05-14 18:51:36.928777 | debian-bookworm | +-w /bin/nc.openbsd -p x -k susp_activity 2026-05-14 18:51:36.928887 | debian-bookworm | +-w /bin/nc.traditional -p x -k susp_activity 2026-05-14 18:51:36.928994 | debian-bookworm | + 2026-05-14 18:51:36.929107 | debian-bookworm | +## Sbin suspicious activity 2026-05-14 18:51:36.929218 | debian-bookworm | +-w /sbin/iptables -p x -k sbin_susp 2026-05-14 18:51:36.929449 | debian-bookworm | +-w /sbin/ip6tables -p x -k sbin_susp 2026-05-14 18:51:36.929580 | debian-bookworm | +-w /sbin/ifconfig -p x -k sbin_susp 2026-05-14 18:51:36.929716 | debian-bookworm | +-w /usr/sbin/arptables -p x -k sbin_susp 2026-05-14 18:51:36.929828 | debian-bookworm | +-w /usr/sbin/ebtables -p x -k sbin_susp 2026-05-14 18:51:36.929942 | debian-bookworm | +-w /sbin/xtables-nft-multi -p x -k sbin_susp 2026-05-14 18:51:36.930052 | debian-bookworm | +-w /usr/sbin/nft -p x -k sbin_susp 2026-05-14 18:51:36.930163 | debian-bookworm | +-w /usr/sbin/tcpdump -p x -k sbin_susp 2026-05-14 18:51:36.930290 | debian-bookworm | +-w /usr/sbin/traceroute -p x -k sbin_susp 2026-05-14 18:51:36.930406 | debian-bookworm | +-w /usr/sbin/ufw -p x -k sbin_susp 2026-05-14 18:51:36.930514 | debian-bookworm | + 2026-05-14 18:51:36.930624 | debian-bookworm | +### kde4 2026-05-14 18:51:36.930739 | debian-bookworm | +-a always,exit -F path=/usr/libexec/kde4/kpac_dhcp_helper -F perm=x -F auid>=1000 -F auid!=4294967295 -k T1078_Valid_Accounts 2026-05-14 18:51:36.930854 | debian-bookworm | +-a always,exit -F path=/usr/libexec/kde4/kdesud -F perm=x -F auid>=1000 -F auid!=4294967295 -k T1078_Valid_Accounts 2026-05-14 18:51:36.930961 | debian-bookworm | + 2026-05-14 18:51:36.931092 | debian-bookworm | +## dbus-send invocation 2026-05-14 18:51:36.931206 | debian-bookworm | +### may indicate privilege escalation CVE-2021-3560 2026-05-14 18:51:36.931350 | debian-bookworm | +-w /usr/bin/dbus-send -p x -k dbus_send 2026-05-14 18:51:36.931467 | debian-bookworm | +-w /usr/bin/gdbus -p x -k gdubs_call 2026-05-14 18:51:36.931577 | debian-bookworm | + 2026-05-14 18:51:36.931689 | debian-bookworm | +## pkexec invocation 2026-05-14 18:51:36.931809 | debian-bookworm | +### may indicate privilege escalation CVE-2021-4034 2026-05-14 18:51:36.931928 | debian-bookworm | +-w /usr/bin/pkexec -p x -k pkexec 2026-05-14 18:51:36.932037 | debian-bookworm | + 2026-05-14 18:51:36.932148 | debian-bookworm | +## Suspicious shells 2026-05-14 18:51:36.932258 | debian-bookworm | +-w /bin/ash -p x -k susp_shell 2026-05-14 18:51:36.932385 | debian-bookworm | +-w /bin/csh -p x -k susp_shell 2026-05-14 18:51:36.932495 | debian-bookworm | +-w /bin/fish -p x -k susp_shell 2026-05-14 18:51:36.932606 | debian-bookworm | +-w /bin/tcsh -p x -k susp_shell 2026-05-14 18:51:36.932716 | debian-bookworm | +-w /bin/tclsh -p x -k susp_shell 2026-05-14 18:51:36.933100 | debian-bookworm | +-w /bin/xonsh -p x -k susp_shell 2026-05-14 18:51:36.933227 | debian-bookworm | +-w /usr/local/bin/xonsh -p x -k susp_shell 2026-05-14 18:51:36.933361 | debian-bookworm | +-w /bin/open -p x -k susp_shell 2026-05-14 18:51:36.933473 | debian-bookworm | +-w /bin/rbash -p x -k susp_shell 2026-05-14 18:51:36.933579 | debian-bookworm | + 2026-05-14 18:51:36.933720 | debian-bookworm | +# Web Server Actvity 2026-05-14 18:51:36.933837 | debian-bookworm | +## Change the number "33" to the ID of your WebServer user. Default: www-data:x:33:33 2026-05-14 18:51:36.933954 | debian-bookworm | +-a always,exit -F arch=b64 -S execve -F euid=33 -k detect_execve_www 2026-05-14 18:51:36.934065 | debian-bookworm | + 2026-05-14 18:51:36.934178 | debian-bookworm | +### https://clustershell.readthedocs.io/ 2026-05-14 18:51:36.934304 | debian-bookworm | +-w /bin/clush -p x -k susp_shell 2026-05-14 18:51:36.934416 | debian-bookworm | +-w /usr/local/bin/clush -p x -k susp_shell 2026-05-14 18:51:36.934528 | debian-bookworm | +-w /etc/clustershell/clush.conf -p x -k susp_shell 2026-05-14 18:51:36.934635 | debian-bookworm | + 2026-05-14 18:51:36.934746 | debian-bookworm | +### https://github.com/tmux/tmux 2026-05-14 18:51:36.934855 | debian-bookworm | +-w /bin/tmux -p x -k susp_shell 2026-05-14 18:51:36.934967 | debian-bookworm | +-w /usr/local/bin/tmux -p x -k susp_shell 2026-05-14 18:51:36.935074 | debian-bookworm | + 2026-05-14 18:51:36.935185 | debian-bookworm | +## Shell/profile configurations 2026-05-14 18:51:36.935311 | debian-bookworm | +-w /etc/profile.d/ -p wa -k shell_profiles 2026-05-14 18:51:36.935425 | debian-bookworm | +-w /etc/profile -p wa -k shell_profiles 2026-05-14 18:51:36.935537 | debian-bookworm | +-w /etc/shells -p wa -k shell_profiles 2026-05-14 18:51:36.935646 | debian-bookworm | +-w /etc/bashrc -p wa -k shell_profiles 2026-05-14 18:51:36.935759 | debian-bookworm | +-w /etc/csh.cshrc -p wa -k shell_profiles 2026-05-14 18:51:36.935872 | debian-bookworm | +-w /etc/csh.login -p wa -k shell_profiles 2026-05-14 18:51:36.935990 | debian-bookworm | +-w /etc/fish/ -p wa -k shell_profiles 2026-05-14 18:51:36.936103 | debian-bookworm | +-w /etc/zsh/ -p wa -k shell_profiles 2026-05-14 18:51:36.936219 | debian-bookworm | + 2026-05-14 18:51:36.936344 | debian-bookworm | +### https://github.com/xxh/xxh 2026-05-14 18:51:36.936457 | debian-bookworm | +-w /usr/local/bin/xxh.bash -p x -k susp_shell 2026-05-14 18:51:36.936566 | debian-bookworm | +-w /usr/local/bin/xxh.xsh -p x -k susp_shell 2026-05-14 18:51:36.936673 | debian-bookworm | +-w /usr/local/bin/xxh.zsh -p x -k susp_shell 2026-05-14 18:51:36.936780 | debian-bookworm | + 2026-05-14 18:51:36.936891 | debian-bookworm | +## Injection 2026-05-14 18:51:36.937006 | debian-bookworm | +### These rules watch for code injection by the ptrace facility. 2026-05-14 18:51:36.937118 | debian-bookworm | +### This could indicate someone trying to do something bad or just debugging 2026-05-14 18:51:36.937230 | debian-bookworm | +-a always,exit -F arch=b64 -S ptrace -F a0=0x4 -k code_injection 2026-05-14 18:51:36.937383 | debian-bookworm | +-a always,exit -F arch=b64 -S ptrace -F a0=0x5 -k data_injection 2026-05-14 18:51:36.937498 | debian-bookworm | +-a always,exit -F arch=b64 -S ptrace -F a0=0x6 -k register_injection 2026-05-14 18:51:36.937608 | debian-bookworm | +-a always,exit -F arch=b64 -S ptrace -k tracing 2026-05-14 18:51:36.937737 | debian-bookworm | + 2026-05-14 18:51:36.937850 | debian-bookworm | +## Anonymous File Creation 2026-05-14 18:51:36.937963 | debian-bookworm | +### These rules watch the use of memfd_create 2026-05-14 18:51:36.938076 | debian-bookworm | +### "memfd_create" creates anonymous file and returns a file descriptor to access it 2026-05-14 18:51:36.938197 | debian-bookworm | +### When combined with "fexecve" can be used to stealthily run binaries in memory without touching disk 2026-05-14 18:51:36.938350 | debian-bookworm | +-a always,exit -F arch=b64 -S memfd_create -F key=anon_file_create 2026-05-14 18:51:36.938462 | debian-bookworm | + 2026-05-14 18:51:36.938571 | debian-bookworm | +## Privilege Abuse 2026-05-14 18:51:36.938685 | debian-bookworm | +### The purpose of this rule is to detect when an admin may be abusing power by looking in user's home dir. 2026-05-14 18:51:36.938805 | debian-bookworm | +-a always,exit -F dir=/home -F uid=0 -F auid>=1000 -F auid!=-1 -C auid!=obj_uid -k power_abuse 2026-05-14 18:51:36.938915 | debian-bookworm | + 2026-05-14 18:51:36.939028 | debian-bookworm | +# Socket Creations 2026-05-14 18:51:36.939139 | debian-bookworm | +# will catch both IPv4 and IPv6 2026-05-14 18:51:36.939247 | debian-bookworm | + 2026-05-14 18:51:36.939377 | debian-bookworm | +-a always,exit -F arch=b32 -S socket -F a0=2 -k network_socket_created 2026-05-14 18:51:36.939490 | debian-bookworm | +-a always,exit -F arch=b64 -S socket -F a0=2 -k network_socket_created 2026-05-14 18:51:36.939595 | debian-bookworm | + 2026-05-14 18:51:36.939705 | debian-bookworm | +-a always,exit -F arch=b32 -S socket -F a0=10 -k network_socket_created 2026-05-14 18:51:36.939816 | debian-bookworm | +-a always,exit -F arch=b64 -S socket -F a0=10 -k network_socket_created 2026-05-14 18:51:36.939922 | debian-bookworm | + 2026-05-14 18:51:36.940032 | debian-bookworm | +# Software Management --------------------------------------------------------- 2026-05-14 18:51:36.940139 | debian-bookworm | + 2026-05-14 18:51:36.940249 | debian-bookworm | +# RPM (Redhat/CentOS) 2026-05-14 18:51:36.940375 | debian-bookworm | +-w /usr/bin/rpm -p x -k software_mgmt 2026-05-14 18:51:36.940487 | debian-bookworm | +-w /usr/bin/yum -p x -k software_mgmt 2026-05-14 18:51:36.940594 | debian-bookworm | + 2026-05-14 18:51:36.940704 | debian-bookworm | +# DNF (Fedora/RedHat 8/CentOS 8) 2026-05-14 18:51:36.940814 | debian-bookworm | +-w /usr/bin/dnf -p x -k software_mgmt 2026-05-14 18:51:36.940919 | debian-bookworm | + 2026-05-14 18:51:36.941030 | debian-bookworm | +# YAST/Zypper/RPM (SuSE) 2026-05-14 18:51:36.941140 | debian-bookworm | +-w /sbin/yast -p x -k software_mgmt 2026-05-14 18:51:36.941252 | debian-bookworm | +-w /sbin/yast2 -p x -k software_mgmt 2026-05-14 18:51:36.941404 | debian-bookworm | +-w /bin/rpm -p x -k software_mgmt 2026-05-14 18:51:36.941520 | debian-bookworm | +-w /usr/bin/zypper -k software_mgmt 2026-05-14 18:51:36.941655 | debian-bookworm | + 2026-05-14 18:51:36.941772 | debian-bookworm | +# DPKG / APT-GET (Debian/Ubuntu) 2026-05-14 18:51:36.941885 | debian-bookworm | +-w /usr/bin/dpkg -p x -k software_mgmt 2026-05-14 18:51:36.941996 | debian-bookworm | +-w /usr/bin/apt -p x -k software_mgmt 2026-05-14 18:51:36.942110 | debian-bookworm | +-w /usr/bin/apt-add-repository -p x -k software_mgmt 2026-05-14 18:51:36.942221 | debian-bookworm | +-w /usr/bin/apt-get -p x -k software_mgmt 2026-05-14 18:51:36.942347 | debian-bookworm | +-w /usr/bin/aptitude -p x -k software_mgmt 2026-05-14 18:51:36.942460 | debian-bookworm | +-w /usr/bin/wajig -p x -k software_mgmt 2026-05-14 18:51:36.942577 | debian-bookworm | +-w /usr/bin/snap -p x -k software_mgmt 2026-05-14 18:51:36.942686 | debian-bookworm | + 2026-05-14 18:51:36.942797 | debian-bookworm | +# PIP(3) (Python installs) 2026-05-14 18:51:36.942913 | debian-bookworm | +-w /usr/bin/pip -p x -k third_party_software_mgmt 2026-05-14 18:51:36.943025 | debian-bookworm | +-w /usr/local/bin/pip -p x -k third_party_software_mgmt 2026-05-14 18:51:36.943146 | debian-bookworm | +-w /usr/bin/pip3 -p x -k third_party_software_mgmt 2026-05-14 18:51:36.943257 | debian-bookworm | +-w /usr/local/bin/pip3 -p x -k third_party_software_mgmt 2026-05-14 18:51:36.943381 | debian-bookworm | +-w /usr/bin/pipx -p x -k third_party_software_mgmt 2026-05-14 18:51:36.943492 | debian-bookworm | +-w /usr/local/bin/pipx -p x -k third_party_software_mgmt 2026-05-14 18:51:36.943602 | debian-bookworm | + 2026-05-14 18:51:36.943714 | debian-bookworm | +# npm 2026-05-14 18:51:36.943828 | debian-bookworm | +## T1072 third party software 2026-05-14 18:51:36.943940 | debian-bookworm | +## https://www.npmjs.com 2026-05-14 18:51:36.944053 | debian-bookworm | +## https://docs.npmjs.com/cli/v6/commands/npm-audit 2026-05-14 18:51:36.944167 | debian-bookworm | +-w /usr/bin/npm -p x -k third_party_software_mgmt 2026-05-14 18:51:36.944308 | debian-bookworm | + 2026-05-14 18:51:36.944433 | debian-bookworm | +# Comprehensive Perl Archive Network (CPAN) (CPAN installs) 2026-05-14 18:51:36.944547 | debian-bookworm | +## T1072 third party software 2026-05-14 18:51:36.944659 | debian-bookworm | +## https://www.cpan.org 2026-05-14 18:51:36.944772 | debian-bookworm | +-w /usr/bin/cpan -p x -k third_party_software_mgmt 2026-05-14 18:51:36.944880 | debian-bookworm | + 2026-05-14 18:51:36.944990 | debian-bookworm | +# Ruby (RubyGems installs) 2026-05-14 18:51:36.945102 | debian-bookworm | +## T1072 third party software 2026-05-14 18:51:36.945213 | debian-bookworm | +## https://rubygems.org 2026-05-14 18:51:36.945342 | debian-bookworm | +-w /usr/bin/gem -p x -k third_party_software_mgmt 2026-05-14 18:51:36.945450 | debian-bookworm | + 2026-05-14 18:51:36.945559 | debian-bookworm | +# LuaRocks (Lua installs) 2026-05-14 18:51:36.945716 | debian-bookworm | +## T1072 third party software 2026-05-14 18:51:36.945828 | debian-bookworm | +## https://luarocks.org 2026-05-14 18:51:36.945941 | debian-bookworm | +-w /usr/bin/luarocks -p x -k third_party_software_mgmt 2026-05-14 18:51:36.946050 | debian-bookworm | + 2026-05-14 18:51:36.946162 | debian-bookworm | +# Pacman (Arch Linux) 2026-05-14 18:51:36.946307 | debian-bookworm | +## https://wiki.archlinux.org/title/Pacman 2026-05-14 18:51:36.946425 | debian-bookworm | +## T1072 third party software 2026-05-14 18:51:36.946538 | debian-bookworm | +-w /etc/pacman.conf -p x -k third_party_software_mgmt 2026-05-14 18:51:36.946649 | debian-bookworm | +-w /etc/pacman.d -p x -k third_party_software_mgmt 2026-05-14 18:51:36.946756 | debian-bookworm | + 2026-05-14 18:51:36.946867 | debian-bookworm | +# Special Software ------------------------------------------------------------ 2026-05-14 18:51:36.946974 | debian-bookworm | + 2026-05-14 18:51:36.947085 | debian-bookworm | +## GDS specific secrets 2026-05-14 18:51:36.947198 | debian-bookworm | +-w /etc/puppet/ssl -p wa -k puppet_ssl 2026-05-14 18:51:36.947321 | debian-bookworm | + 2026-05-14 18:51:36.947432 | debian-bookworm | +## IBM Bigfix BESClient 2026-05-14 18:51:36.947546 | debian-bookworm | +-a always,exit -F arch=b64 -S open -F dir=/opt/BESClient -F success=0 -k soft_besclient 2026-05-14 18:51:36.947657 | debian-bookworm | +-w /var/opt/BESClient/ -p wa -k soft_besclient 2026-05-14 18:51:36.947767 | debian-bookworm | + 2026-05-14 18:51:36.947876 | debian-bookworm | +## CHEF https://www.chef.io/chef/ 2026-05-14 18:51:36.947984 | debian-bookworm | +-w /etc/chef -p wa -k soft_chef 2026-05-14 18:51:36.948090 | debian-bookworm | + 2026-05-14 18:51:36.948198 | debian-bookworm | +## Salt 2026-05-14 18:51:36.948341 | debian-bookworm | +## https://saltproject.io/ 2026-05-14 18:51:36.948459 | debian-bookworm | +## https://docs.saltproject.io/en/latest/ref/configuration/master.html 2026-05-14 18:51:36.948570 | debian-bookworm | +-w /etc/salt -p wa -k soft_salt 2026-05-14 18:51:36.948681 | debian-bookworm | +-w /usr/local/etc/salt -p wa -k soft_salt 2026-05-14 18:51:36.948790 | debian-bookworm | + 2026-05-14 18:51:36.948899 | debian-bookworm | +## Otter 2026-05-14 18:51:36.949009 | debian-bookworm | +## https://inedo.com/otter 2026-05-14 18:51:36.949120 | debian-bookworm | +-w /etc/otter -p wa -k soft_otter 2026-05-14 18:51:36.949226 | debian-bookworm | + 2026-05-14 18:51:36.949349 | debian-bookworm | +## T1081 Credentials In Files 2026-05-14 18:51:36.949463 | debian-bookworm | +-w /usr/bin/grep -p x -k string_search 2026-05-14 18:51:36.949573 | debian-bookworm | +-w /usr/bin/egrep -p x -k string_search 2026-05-14 18:51:36.949708 | debian-bookworm | +-w /usr/bin/ugrep -p x -k string_search 2026-05-14 18:51:36.949819 | debian-bookworm | +### macOS 2026-05-14 18:51:36.949930 | debian-bookworm | +-w /usr/local/bin/grep -p x -k string_search 2026-05-14 18:51:36.950040 | debian-bookworm | +-w /usr/local/bin/egrep -p x -k string_search 2026-05-14 18:51:36.950149 | debian-bookworm | +-w /usr/local/bin/ugrep -p x -k string_search 2026-05-14 18:51:36.950257 | debian-bookworm | + 2026-05-14 18:51:36.950384 | debian-bookworm | +### https://github.com/tmbinc/bgrep 2026-05-14 18:51:36.950495 | debian-bookworm | +-w /usr/bin/bgrep -p x -k string_search 2026-05-14 18:51:36.950605 | debian-bookworm | +### macOS 2026-05-14 18:51:36.950717 | debian-bookworm | +-w /usr/local/bin/bgrep -p x -k string_search 2026-05-14 18:51:36.950836 | debian-bookworm | + 2026-05-14 18:51:36.950950 | debian-bookworm | +### https://github.com/BurntSushi/ripgrep 2026-05-14 18:51:36.951062 | debian-bookworm | +-w /usr/bin/rg -p x -k string_search 2026-05-14 18:51:36.951171 | debian-bookworm | +### macOS 2026-05-14 18:51:36.951295 | debian-bookworm | +-w /usr/local/bin/rg -p x -k string_search 2026-05-14 18:51:36.951405 | debian-bookworm | + 2026-05-14 18:51:36.951522 | debian-bookworm | +### https://github.com/awgn/cgrep 2026-05-14 18:51:36.951630 | debian-bookworm | + 2026-05-14 18:51:36.951740 | debian-bookworm | +-w /usr/bin/cgrep -p x -k string_search 2026-05-14 18:51:36.951851 | debian-bookworm | +### macOS 2026-05-14 18:51:36.951963 | debian-bookworm | +-w /usr/local/bin/cgrep -p x -k string_search 2026-05-14 18:51:36.952072 | debian-bookworm | + 2026-05-14 18:51:36.952184 | debian-bookworm | +### https://github.com/jpr5/ngrep 2026-05-14 18:51:36.952330 | debian-bookworm | +-w /usr/bin/ngrep -p x -k string_search 2026-05-14 18:51:36.952444 | debian-bookworm | +### macOS 2026-05-14 18:51:36.952553 | debian-bookworm | +-w /usr/local/bin/ngrep -p x -k string_search 2026-05-14 18:51:36.952661 | debian-bookworm | + 2026-05-14 18:51:36.952770 | debian-bookworm | +### https://github.com/vrothberg/vgrep 2026-05-14 18:51:36.952880 | debian-bookworm | +-w /usr/bin/vgrep -p x -k string_search 2026-05-14 18:51:36.952989 | debian-bookworm | +### macOS 2026-05-14 18:51:36.953099 | debian-bookworm | +-w /usr/local/bin/vgrep -p x -k string_search 2026-05-14 18:51:36.953206 | debian-bookworm | + 2026-05-14 18:51:36.953334 | debian-bookworm | +### https://github.com/monochromegane/the_platinum_searcher 2026-05-14 18:51:36.953447 | debian-bookworm | +-w /usr/bin/pt -p x -k string_search 2026-05-14 18:51:36.953556 | debian-bookworm | +### macOS 2026-05-14 18:51:36.953687 | debian-bookworm | +-w /usr/local/bin/pt -p x -k string_search 2026-05-14 18:51:36.953799 | debian-bookworm | + 2026-05-14 18:51:36.953909 | debian-bookworm | +### https://github.com/gvansickle/ucg 2026-05-14 18:51:36.954020 | debian-bookworm | +-w /usr/bin/ucg -p x -k string_search 2026-05-14 18:51:36.954129 | debian-bookworm | +### macOS 2026-05-14 18:51:36.954238 | debian-bookworm | +-w /usr/local/bin/ucg -p x -k string_search 2026-05-14 18:51:36.954357 | debian-bookworm | + 2026-05-14 18:51:36.954469 | debian-bookworm | +### https://github.com/ggreer/the_silver_searcher 2026-05-14 18:51:36.954581 | debian-bookworm | +-w /usr/bin/ag -p x -k string_search 2026-05-14 18:51:36.954690 | debian-bookworm | +### macOS 2026-05-14 18:51:36.954800 | debian-bookworm | +-w /usr/local/bin/ag -p x -k string_search 2026-05-14 18:51:36.954907 | debian-bookworm | + 2026-05-14 18:51:36.955017 | debian-bookworm | +### https://github.com/beyondgrep/ack3 2026-05-14 18:51:36.955131 | debian-bookworm | +### https://beyondgrep.com 2026-05-14 18:51:36.955240 | debian-bookworm | +-w /usr/bin/ack -p x -k string_search 2026-05-14 18:51:36.955385 | debian-bookworm | +-w /usr/local/bin/ack -p x -k string_search 2026-05-14 18:51:36.955498 | debian-bookworm | +-w /usr/bin/semgrep -p x -k string_search 2026-05-14 18:51:36.955606 | debian-bookworm | +### macOS 2026-05-14 18:51:36.955715 | debian-bookworm | +-w /usr/local/bin/semgrep -p x -k string_search 2026-05-14 18:51:36.955819 | debian-bookworm | + 2026-05-14 18:51:36.955926 | debian-bookworm | +## Docker 2026-05-14 18:51:36.956035 | debian-bookworm | +-w /usr/bin/dockerd -k docker 2026-05-14 18:51:36.956144 | debian-bookworm | +-w /usr/bin/docker -k docker 2026-05-14 18:51:36.956252 | debian-bookworm | +-w /usr/bin/docker-containerd -k docker 2026-05-14 18:51:36.956375 | debian-bookworm | +-w /usr/bin/docker-runc -k docker 2026-05-14 18:51:36.956493 | debian-bookworm | +-w /var/lib/docker -p wa -k docker 2026-05-14 18:51:36.956604 | debian-bookworm | +-w /etc/docker -k docker 2026-05-14 18:51:36.956714 | debian-bookworm | +-w /etc/sysconfig/docker -k docker 2026-05-14 18:51:36.956825 | debian-bookworm | +-w /etc/sysconfig/docker-storage -k docker 2026-05-14 18:51:36.956937 | debian-bookworm | +-w /usr/lib/systemd/system/docker.service -k docker 2026-05-14 18:51:36.957051 | debian-bookworm | +-w /usr/lib/systemd/system/docker.socket -k docker 2026-05-14 18:51:36.957159 | debian-bookworm | + 2026-05-14 18:51:36.957302 | debian-bookworm | +## Virtualization stuff 2026-05-14 18:51:36.957420 | debian-bookworm | +-w /usr/bin/qemu-system-x86_64 -p x -k qemu-system-x86_64 2026-05-14 18:51:36.957532 | debian-bookworm | +-w /usr/bin/qemu-img -p x -k qemu-img 2026-05-14 18:51:36.957668 | debian-bookworm | +-w /usr/bin/qemu-kvm -p x -k qemu-kvm 2026-05-14 18:51:36.957782 | debian-bookworm | +-w /usr/bin/qemu -p x -k qemu 2026-05-14 18:51:36.957893 | debian-bookworm | +-w /usr/bin/virtualbox -p x -k virtualbox 2026-05-14 18:51:36.958004 | debian-bookworm | +-w /usr/bin/virt-manager -p x -k virt-manager 2026-05-14 18:51:36.958115 | debian-bookworm | +-w /usr/bin/VBoxManage -p x -k VBoxManage 2026-05-14 18:51:36.958223 | debian-bookworm | + 2026-05-14 18:51:36.958347 | debian-bookworm | +#### VirtualBox on macOS 2026-05-14 18:51:36.958457 | debian-bookworm | + 2026-05-14 18:51:36.958568 | debian-bookworm | +-w /usr/local/bin/VirtualBox -p x -k virt_tool 2026-05-14 18:51:36.958691 | debian-bookworm | +-w /usr/local/bin/VirtualBoxVM -p x -k virt_tool 2026-05-14 18:51:36.958805 | debian-bookworm | +-w /usr/local/bin/VBoxManage -p x -k virt_tool 2026-05-14 18:51:36.958918 | debian-bookworm | +-w /usr/local/bin/VBoxVRDP -p x -k virt_tool 2026-05-14 18:51:36.959032 | debian-bookworm | +-w /usr/local/bin/VBoxHeadless -p x -k virt_tool 2026-05-14 18:51:36.959142 | debian-bookworm | +-w /usr/local/bin/vboxwebsrv -p x -k virt_tool 2026-05-14 18:51:36.959255 | debian-bookworm | +-w /usr/local/bin/VBoxBugReport -p x -k virt_tool 2026-05-14 18:51:36.959379 | debian-bookworm | +-w /usr/local/bin/VBoxBalloonCtrl -p x -k virt_tool 2026-05-14 18:51:36.959492 | debian-bookworm | +-w /usr/local/bin/VBoxAutostart -p x -k virt_tool 2026-05-14 18:51:36.959603 | debian-bookworm | +-w /usr/local/bin/VBoxDTrace -p x -k virt_tool 2026-05-14 18:51:36.959713 | debian-bookworm | +-w /usr/local/bin/vbox-img -p x -k virt_tool 2026-05-14 18:51:36.959827 | debian-bookworm | +-w /Library/LaunchDaemons/org.virtualbox.startup.plist -p x -k virt_tool 2026-05-14 18:51:36.959939 | debian-bookworm | +-w /Library/Application Support/VirtualBox/LaunchDaemons/ -p x -k virt_tool 2026-05-14 18:51:36.960055 | debian-bookworm | +-w /Library/Application Support/VirtualBox/VBoxDrv.kext/ -p x -k virt_tool 2026-05-14 18:51:36.960167 | debian-bookworm | +-w /Library/Application Support/VirtualBox/VBoxUSB.kext/ -p x -k virt_tool 2026-05-14 18:51:36.960328 | debian-bookworm | +-w /Library/Application Support/VirtualBox/VBoxNetFlt.kext/ -p x -k virt_tool 2026-05-14 18:51:36.960448 | debian-bookworm | +-w /Library/Application Support/VirtualBox/VBoxNetAdp.kext/ -p x -k virt_tool 2026-05-14 18:51:36.960556 | debian-bookworm | + 2026-05-14 18:51:36.960669 | debian-bookworm | +### Parallels Desktop on macOS 2026-05-14 18:51:36.960776 | debian-bookworm | + 2026-05-14 18:51:36.960886 | debian-bookworm | +-w /usr/local/bin/prl_convert -p x -k virt_tool 2026-05-14 18:51:36.960999 | debian-bookworm | +-w /usr/local/bin/prl_disk_tool -p x -k virt_tool 2026-05-14 18:51:36.961108 | debian-bookworm | +-w /usr/local/bin/prl_perf_ctl -p x -k virt_tool 2026-05-14 18:51:36.961218 | debian-bookworm | +-w /usr/local/bin/prlcore2dmp -p x -k virt_tool 2026-05-14 18:51:36.961343 | debian-bookworm | +-w /usr/local/bin/prlctl -p x -k virt_tool 2026-05-14 18:51:36.961456 | debian-bookworm | +-w /usr/local/bin/prlexec -p x -k virt_tool 2026-05-14 18:51:36.961565 | debian-bookworm | +-w /usr/local/bin/prlsrvctl -p x -k virt_tool 2026-05-14 18:51:36.961698 | debian-bookworm | +-w /Library/Preferences/Parallels -p x -k virt_tool 2026-05-14 18:51:36.961807 | debian-bookworm | + 2026-05-14 18:51:36.961918 | debian-bookworm | +### qemu on macOS 2026-05-14 18:51:36.962026 | debian-bookworm | + 2026-05-14 18:51:36.962139 | debian-bookworm | +-w /usr/local/bin/qemu-edid -p x -k virt_tool 2026-05-14 18:51:36.962249 | debian-bookworm | +-w /usr/local/bin/qemu-img -p x -k virt_tool 2026-05-14 18:51:36.962373 | debian-bookworm | +-w /usr/local/bin/qemu-io -p x -k virt_tool 2026-05-14 18:51:36.962487 | debian-bookworm | +-w /usr/local/bin/qemu-nbd -p x -k virt_tool 2026-05-14 18:51:36.962600 | debian-bookworm | +-w /usr/local/bin/qemu-system-x86_64 -p x -k virt_tool 2026-05-14 18:51:36.962705 | debian-bookworm | + 2026-05-14 18:51:36.962814 | debian-bookworm | +## Kubelet 2026-05-14 18:51:36.962923 | debian-bookworm | +-w /usr/bin/kubelet -k kubelet 2026-05-14 18:51:36.963029 | debian-bookworm | + 2026-05-14 18:51:36.963137 | debian-bookworm | +# ipc system call 2026-05-14 18:51:36.963247 | debian-bookworm | +# /usr/include/linux/ipc.h 2026-05-14 18:51:36.963393 | debian-bookworm | + 2026-05-14 18:51:36.963514 | debian-bookworm | +## msgctl 2026-05-14 18:51:36.963630 | debian-bookworm | +#-a always,exit -S ipc -F a0=14 -k Inter-Process_Communication 2026-05-14 18:51:36.963738 | debian-bookworm | +## msgget 2026-05-14 18:51:36.963851 | debian-bookworm | +#-a always,exit -S ipc -F a0=13 -k Inter-Process_Communication 2026-05-14 18:51:36.963972 | debian-bookworm | +## Use these lines on x86_64, ia64 instead 2026-05-14 18:51:36.964090 | debian-bookworm | +-a always,exit -F arch=b64 -S msgctl -k Inter-Process_Communication 2026-05-14 18:51:36.964203 | debian-bookworm | +-a always,exit -F arch=b64 -S msgget -k Inter-Process_Communication 2026-05-14 18:51:36.964328 | debian-bookworm | + 2026-05-14 18:51:36.964438 | debian-bookworm | +## semctl 2026-05-14 18:51:36.964552 | debian-bookworm | +#-a always,exit -S ipc -F a0=3 -k Inter-Process_Communication 2026-05-14 18:51:36.964662 | debian-bookworm | +## semget 2026-05-14 18:51:36.964775 | debian-bookworm | +#-a always,exit -S ipc -F a0=2 -k Inter-Process_Communication 2026-05-14 18:51:36.964884 | debian-bookworm | +## semop 2026-05-14 18:51:36.964995 | debian-bookworm | +#-a always,exit -S ipc -F a0=1 -k Inter-Process_Communication 2026-05-14 18:51:36.965104 | debian-bookworm | +## semtimedop 2026-05-14 18:51:36.965219 | debian-bookworm | +#-a always,exit -S ipc -F a0=4 -k Inter-Process_Communication 2026-05-14 18:51:36.965365 | debian-bookworm | +## Use these lines on x86_64, ia64 instead 2026-05-14 18:51:36.965494 | debian-bookworm | +-a always,exit -F arch=b64 -S semctl -k Inter-Process_Communication 2026-05-14 18:51:36.965608 | debian-bookworm | +-a always,exit -F arch=b64 -S semget -k Inter-Process_Communication 2026-05-14 18:51:36.965747 | debian-bookworm | +-a always,exit -F arch=b64 -S semop -k Inter-Process_Communication 2026-05-14 18:51:36.965861 | debian-bookworm | +-a always,exit -F arch=b64 -S semtimedop -k Inter-Process_Communication 2026-05-14 18:51:36.965968 | debian-bookworm | + 2026-05-14 18:51:36.966079 | debian-bookworm | +## shmctl 2026-05-14 18:51:36.966192 | debian-bookworm | +#-a always,exit -S ipc -F a0=24 -k Inter-Process_Communication 2026-05-14 18:51:36.966380 | debian-bookworm | +## shmget 2026-05-14 18:51:36.966497 | debian-bookworm | +#-a always,exit -S ipc -F a0=23 -k Inter-Process_Communication 2026-05-14 18:51:36.966610 | debian-bookworm | +## Use these lines on x86_64, ia64 instead 2026-05-14 18:51:36.966723 | debian-bookworm | +-a always,exit -F arch=b64 -S shmctl -k Inter-Process_Communication 2026-05-14 18:51:36.966841 | debian-bookworm | +-a always,exit -F arch=b64 -S shmget -k Inter-Process_Communication 2026-05-14 18:51:36.966955 | debian-bookworm | + 2026-05-14 18:51:36.967066 | debian-bookworm | +# High Volume Events ---------------------------------------------------------- 2026-05-14 18:51:36.967171 | debian-bookworm | + 2026-05-14 18:51:36.967320 | debian-bookworm | +## Disable these rules if they create too many events in your environment 2026-05-14 18:51:36.967430 | debian-bookworm | + 2026-05-14 18:51:36.967539 | debian-bookworm | +## Common Shells 2026-05-14 18:51:36.967649 | debian-bookworm | +-w /bin/bash -p x -k susp_shell 2026-05-14 18:51:36.967764 | debian-bookworm | +-w /bin/dash -p x -k susp_shell 2026-05-14 18:51:36.967878 | debian-bookworm | +-w /bin/busybox -p x -k susp_shell 2026-05-14 18:51:36.968009 | debian-bookworm | +-w /bin/zsh -p x -k susp_shell 2026-05-14 18:51:36.968122 | debian-bookworm | +-w /bin/sh -p x -k susp_shell 2026-05-14 18:51:36.968232 | debian-bookworm | +-w /bin/ksh -p x -k susp_shell 2026-05-14 18:51:36.968361 | debian-bookworm | + 2026-05-14 18:51:36.968476 | debian-bookworm | +## Root command executions 2026-05-14 18:51:36.968590 | debian-bookworm | +-a always,exit -F arch=b64 -F euid=0 -F auid>=1000 -F auid!=-1 -S execve -k rootcmd 2026-05-14 18:51:36.968696 | debian-bookworm | + 2026-05-14 18:51:36.968808 | debian-bookworm | +## File Deletion Events by User 2026-05-14 18:51:36.968925 | debian-bookworm | +-a always,exit -F arch=b64 -S rmdir -S unlink -S unlinkat -S rename -S renameat -F auid>=1000 -F auid!=-1 -k delete 2026-05-14 18:51:36.969043 | debian-bookworm | + 2026-05-14 18:51:36.969152 | debian-bookworm | +## File Access 2026-05-14 18:51:36.969262 | debian-bookworm | +### Unauthorized Access (unsuccessful) 2026-05-14 18:51:36.969400 | debian-bookworm | +-a always,exit -F arch=b64 -S creat -S open -S openat -S open_by_handle_at -S truncate -S ftruncate -F exit=-EACCES -F auid>=1000 -F auid!=-1 -k file_access 2026-05-14 18:51:36.969519 | debian-bookworm | +-a always,exit -F arch=b64 -S creat -S open -S openat -S open_by_handle_at -S truncate -S ftruncate -F exit=-EPERM -F auid>=1000 -F auid!=-1 -k file_access 2026-05-14 18:51:36.969648 | debian-bookworm | + 2026-05-14 18:51:36.969765 | debian-bookworm | +### Unsuccessful Creation 2026-05-14 18:51:36.969882 | debian-bookworm | +-a always,exit -F arch=b64 -S mkdir,creat,link,symlink,mknod,mknodat,linkat,symlinkat -F exit=-EACCES -k file_creation 2026-05-14 18:51:36.970003 | debian-bookworm | +-a always,exit -F arch=b64 -S mkdir,link,symlink,mkdirat -F exit=-EPERM -k file_creation 2026-05-14 18:51:36.970112 | debian-bookworm | + 2026-05-14 18:51:36.970224 | debian-bookworm | +### Unsuccessful Modification 2026-05-14 18:51:36.970384 | debian-bookworm | +-a always,exit -F arch=b64 -S rename -S renameat -S truncate -S chmod -S setxattr -S lsetxattr -S removexattr -S lremovexattr -F exit=-EACCES -k file_modification 2026-05-14 18:51:36.970505 | debian-bookworm | +-a always,exit -F arch=b64 -S rename -S renameat -S truncate -S chmod -S setxattr -S lsetxattr -S removexattr -S lremovexattr -F exit=-EPERM -k file_modification 2026-05-14 18:51:36.970614 | debian-bookworm | + 2026-05-14 18:51:36.970726 | debian-bookworm | +## 32bit API Exploitation 2026-05-14 18:51:36.970843 | debian-bookworm | +### If you are on a 64 bit platform, everything _should_ be running 2026-05-14 18:51:36.970957 | debian-bookworm | +### in 64 bit mode. This rule will detect any use of the 32 bit syscalls 2026-05-14 18:51:36.971071 | debian-bookworm | +### because this might be a sign of someone exploiting a hole in the 32 2026-05-14 18:51:36.971182 | debian-bookworm | +### bit API. 2026-05-14 18:51:36.971310 | debian-bookworm | +-a always,exit -F arch=b32 -S all -k 32bit_api 2026-05-14 18:51:36.971420 | debian-bookworm | + 2026-05-14 18:51:36.971535 | debian-bookworm | +# Make The Configuration Immutable -------------------------------------------- 2026-05-14 18:51:36.971654 | debian-bookworm | + 2026-05-14 18:51:36.971763 | debian-bookworm | +##-e 2 2026-05-14 18:51:36.971870 | debian-bookworm | 2026-05-14 18:51:36.972118 | debian-bookworm | changed: [molecule-auditd] => (item=20-neo23x0.rules) => {"ansible_loop_var": "item", "changed": true, "checksum": "9f99ce5c4f891fbf3e2bce06ed4cb97fb9e01f41", "dest": "/etc/audit/rules.d/20-neo23x0.rules", "gid": 0, "group": "root", "item": "20-neo23x0.rules", "md5sum": "6ac57206fd77de34805c3f4d50ef8b1d", "mode": "0644", "owner": "root", "size": 27367, "src": "/home/zuul/.ansible/tmp/ansible-tmp-1778784696.0430999-2528-227696945513974/.source.rules", "state": "file", "uid": 0} 2026-05-14 18:51:36.972231 | debian-bookworm | 2026-05-14 18:51:36.972392 | debian-bookworm | TASK [auditd : Manage auditd service] ****************************************** 2026-05-14 18:51:37.699914 | debian-bookworm | ok: [molecule-auditd] => {"changed": false, "enabled": true, "name": "auditd", "state": "started", "status": {"ActiveEnterTimestamp": "Thu 2026-05-14 18:51:30 UTC", "ActiveEnterTimestampMonotonic": "153736431", "ActiveExitTimestampMonotonic": "0", "ActiveState": "active", "After": "systemd-tmpfiles-setup.service systemd-journald.socket local-fs.target system.slice", "AllowIsolate": "no", "AssertResult": "yes", "AssertTimestamp": "Thu 2026-05-14 18:51:30 UTC", "AssertTimestampMonotonic": "153660360", "Before": "sysinit.target systemd-update-utmp.service shutdown.target ssh.service", "BlockIOAccounting": "no", "BlockIOWeight": "[not set]", "CPUAccounting": "yes", "CPUAffinityFromNUMA": "no", "CPUQuotaPerSecUSec": "infinity", "CPUQuotaPeriodUSec": "infinity", "CPUSchedulingPolicy": "0", "CPUSchedulingPriority": "0", "CPUSchedulingResetOnFork": "no", "CPUShares": "[not set]", "CPUUsageNSec": "47894000", "CPUWeight": "[not set]", "CacheDirectoryMode": "0755", "CanFreeze": "yes", "CanIsolate": "no", "CanReload": "no", "CanStart": "yes", "CanStop": "yes", "CapabilityBoundingSet": "cap_chown cap_dac_override cap_dac_read_search cap_fowner cap_fsetid cap_kill cap_setgid cap_setuid cap_setpcap cap_linux_immutable cap_net_bind_service cap_net_broadcast cap_net_admin cap_net_raw cap_ipc_lock cap_ipc_owner cap_sys_rawio cap_sys_chroot cap_sys_ptrace cap_sys_pacct cap_sys_admin cap_sys_boot cap_sys_nice cap_sys_resource cap_sys_time cap_sys_tty_config cap_mknod cap_lease cap_audit_write cap_audit_control cap_setfcap cap_mac_override cap_mac_admin cap_syslog cap_wake_alarm cap_block_suspend cap_audit_read cap_perfmon cap_bpf cap_checkpoint_restore", "CleanResult": "success", "CollectMode": "inactive", "ConditionResult": "yes", "ConditionTimestamp": "Thu 2026-05-14 18:51:30 UTC", "ConditionTimestampMonotonic": "153660322", "ConfigurationDirectoryMode": "0755", "Conflicts": "shutdown.target", "ControlGroup": "/system.slice/auditd.service", "ControlGroupId": "3328", "ControlPID": "0", "CoredumpFilter": "0x33", "DefaultDependencies": "no", "DefaultMemoryLow": "0", "DefaultMemoryMin": "0", "Delegate": "no", "Description": "Security Auditing Service", "DevicePolicy": "auto", "Documentation": "\"man:auditd(8)\" https://github.com/linux-audit/audit-documentation", "DynamicUser": "no", "ExecMainCode": "0", "ExecMainExitTimestampMonotonic": "0", "ExecMainPID": "2300", "ExecMainStartTimestamp": "Thu 2026-05-14 18:51:30 UTC", "ExecMainStartTimestampMonotonic": "153709413", "ExecMainStatus": "0", "ExecStart": "{ path=/sbin/auditd ; argv[]=/sbin/auditd ; ignore_errors=no ; start_time=[Thu 2026-05-14 18:51:30 UTC] ; stop_time=[Thu 2026-05-14 18:51:30 UTC] ; pid=2299 ; code=exited ; status=0 }", "ExecStartEx": "{ path=/sbin/auditd ; argv[]=/sbin/auditd ; flags= ; start_time=[Thu 2026-05-14 18:51:30 UTC] ; stop_time=[Thu 2026-05-14 18:51:30 UTC] ; pid=2299 ; code=exited ; status=0 }", "ExecStartPost": "{ path=/sbin/augenrules ; argv[]=/sbin/augenrules --load ; ignore_errors=yes ; start_time=[Thu 2026-05-14 18:51:30 UTC] ; stop_time=[Thu 2026-05-14 18:51:30 UTC] ; pid=2303 ; code=exited ; status=0 }", "ExecStartPostEx": "{ path=/sbin/augenrules ; argv[]=/sbin/augenrules --load ; flags=ignore-failure ; start_time=[Thu 2026-05-14 18:51:30 UTC] ; stop_time=[Thu 2026-05-14 18:51:30 UTC] ; pid=2303 ; code=exited ; status=0 }", "ExitType": "main", "FailureAction": "none", "FileDescriptorStoreMax": "0", "FinalKillSignal": "9", "FragmentPath": "/lib/systemd/system/auditd.service", "FreezerState": "running", "GID": "[not set]", "GuessMainPID": "yes", "IOAccounting": "no", "IOReadBytes": "18446744073709551615", "IOReadOperations": "18446744073709551615", "IOSchedulingClass": "2", "IOSchedulingPriority": "4", "IOWeight": "[not set]", "IOWriteBytes": "18446744073709551615", "IOWriteOperations": "18446744073709551615", "IPAccounting": "no", "IPEgressBytes": "[no data]", "IPEgressPackets": "[no data]", "IPIngressBytes": "[no data]", "IPIngressPackets": "[no data]", "Id": "auditd.service", "IgnoreOnIsolate": "no", "IgnoreSIGPIPE": "yes", "InactiveEnterTimestampMonotonic": "0", "InactiveExitTimestamp": "Thu 2026-05-14 18:51:30 UTC", "InactiveExitTimestampMonotonic": "153688750", "InvocationID": "b7b6ad57154a4cd0b9eb7937e0e2c289", "JobRunningTimeoutUSec": "infinity", "JobTimeoutAction": "none", "JobTimeoutUSec": "infinity", "KeyringMode": "private", "KillMode": "control-group", "KillSignal": "15", "LimitAS": "infinity", "LimitASSoft": "infinity", "LimitCORE": "infinity", "LimitCORESoft": "0", "LimitCPU": "infinity", "LimitCPUSoft": "infinity", "LimitDATA": "infinity", "LimitDATASoft": "infinity", "LimitFSIZE": "infinity", "LimitFSIZESoft": "infinity", "LimitLOCKS": "infinity", "LimitLOCKSSoft": "infinity", "LimitMEMLOCK": "8388608", "LimitMEMLOCKSoft": "8388608", "LimitMSGQUEUE": "819200", "LimitMSGQUEUESoft": "819200", "LimitNICE": "0", "LimitNICESoft": "0", "LimitNOFILE": "524288", "LimitNOFILESoft": "1024", "LimitNPROC": "15480", "LimitNPROCSoft": "15480", "LimitRSS": "infinity", "LimitRSSSoft": "infinity", "LimitRTPRIO": "0", "LimitRTPRIOSoft": "0", "LimitRTTIME": "infinity", "LimitRTTIMESoft": "infinity", "LimitSIGPENDING": "15480", "LimitSIGPENDINGSoft": "15480", "LimitSTACK": "infinity", "LimitSTACKSoft": "8388608", "LoadState": "loaded", "LockPersonality": "yes", "LogLevelMax": "-1", "LogRateLimitBurst": "0", "LogRateLimitIntervalUSec": "0", "LogsDirectoryMode": "0755", "MainPID": "2300", "ManagedOOMMemoryPressure": "auto", "ManagedOOMMemoryPressureLimit": "0", "ManagedOOMPreference": "none", "ManagedOOMSwap": "auto", "MemoryAccounting": "yes", "MemoryAvailable": "infinity", "MemoryCurrent": "708608", "MemoryDenyWriteExecute": "yes", "MemoryHigh": "infinity", "MemoryLimit": "infinity", "MemoryLow": "0", "MemoryMax": "infinity", "MemoryMin": "0", "MemorySwapMax": "infinity", "MountAPIVFS": "no", "NFileDescriptorStore": "0", "NRestarts": "0", "NUMAPolicy": "n/a", "Names": "auditd.service", "NeedDaemonReload": "no", "Nice": "0", "NoNewPrivileges": "no", "NonBlocking": "no", "NotifyAccess": "none", "OOMPolicy": "stop", "OOMScoreAdjust": "0", "OnFailureJobMode": "replace", "OnSuccessJobMode": "fail", "PIDFile": "/run/auditd.pid", "Perpetual": "no", "PrivateDevices": "no", "PrivateIPC": "no", "PrivateMounts": "no", "PrivateNetwork": "no", "PrivateTmp": "no", "PrivateUsers": "no", "ProcSubset": "all", "ProtectClock": "no", "ProtectControlGroups": "yes", "ProtectHome": "no", "ProtectHostname": "no", "ProtectKernelLogs": "no", "ProtectKernelModules": "yes", "ProtectKernelTunables": "no", "ProtectProc": "default", "ProtectSystem": "no", "RefuseManualStart": "no", "RefuseManualStop": "no", "ReloadResult": "success", "RemainAfterExit": "no", "RemoveIPC": "no", "Requires": "system.slice", "Restart": "on-failure", "RestartKillSignal": "15", "RestartPreventExitStatus": "2 4 6", "RestartUSec": "100ms", "RestrictNamespaces": "no", "RestrictRealtime": "yes", "RestrictSUIDSGID": "no", "Result": "success", "RootDirectoryStartOnly": "no", "RuntimeDirectoryMode": "0755", "RuntimeDirectoryPreserve": "no", "RuntimeMaxUSec": "infinity", "RuntimeRandomizedExtraUSec": "0", "SameProcessGroup": "no", "SecureBits": "0", "SendSIGHUP": "no", "SendSIGKILL": "yes", "Slice": "system.slice", "StandardError": "inherit", "StandardInput": "null", "StandardOutput": "journal", "StartLimitAction": "none", "StartLimitBurst": "5", "StartLimitIntervalUSec": "10s", "StartupBlockIOWeight": "[not set]", "StartupCPUShares": "[not set]", "StartupCPUWeight": "[not set]", "StartupIOWeight": "[not set]", "StateChangeTimestamp": "Thu 2026-05-14 18:51:30 UTC", "StateChangeTimestampMonotonic": "153736431", "StateDirectoryMode": "0755", "StatusErrno": "0", "StopWhenUnneeded": "no", "SubState": "running", "SuccessAction": "none", "SyslogFacility": "3", "SyslogLevel": "6", "SyslogLevelPrefix": "yes", "SyslogPriority": "30", "SystemCallErrorNumber": "2147483646", "TTYReset": "no", "TTYVHangup": "no", "TTYVTDisallocate": "no", "TasksAccounting": "yes", "TasksCurrent": "2", "TasksMax": "4644", "TimeoutAbortUSec": "1min 30s", "TimeoutCleanUSec": "infinity", "TimeoutStartFailureMode": "terminate", "TimeoutStartUSec": "1min 30s", "TimeoutStopFailureMode": "terminate", "TimeoutStopUSec": "1min 30s", "TimerSlackNSec": "50000", "Transient": "no", "Type": "forking", "UID": "[not set]", "UMask": "0022", "UnitFilePreset": "enabled", "UnitFileState": "enabled", "UtmpMode": "init", "WantedBy": "multi-user.target", "WatchdogSignal": "6", "WatchdogTimestampMonotonic": "0", "WatchdogUSec": "0"}} 2026-05-14 18:51:37.710448 | debian-bookworm | 2026-05-14 18:51:37.710496 | debian-bookworm | TASK [auditd : List existing rules files] ************************************** 2026-05-14 18:51:37.992992 | ubuntu-noble | --- before 2026-05-14 18:51:37.993045 | ubuntu-noble | +++ after: /home/zuul/.ansible/tmp/ansible-local-19172mcj6ob1/tmp_tr6xtw4/auditd.conf.j2 2026-05-14 18:51:37.993051 | ubuntu-noble | @@ -0,0 +1,37 @@ 2026-05-14 18:51:37.993055 | ubuntu-noble | +# 2026-05-14 18:51:37.993060 | ubuntu-noble | +# This file controls the configuration of the audit daemon 2026-05-14 18:51:37.993063 | ubuntu-noble | +# 2026-05-14 18:51:37.993067 | ubuntu-noble | + 2026-05-14 18:51:37.993070 | ubuntu-noble | +local_events = yes 2026-05-14 18:51:37.993074 | ubuntu-noble | +write_logs = yes 2026-05-14 18:51:37.993077 | ubuntu-noble | +log_file = /var/log/audit/audit.log 2026-05-14 18:51:37.993082 | ubuntu-noble | +log_group = adm 2026-05-14 18:51:37.993085 | ubuntu-noble | +log_format = RAW 2026-05-14 18:51:37.993088 | ubuntu-noble | +flush = INCREMENTAL_ASYNC 2026-05-14 18:51:37.993125 | ubuntu-noble | +freq = 50 2026-05-14 18:51:37.993252 | ubuntu-noble | +max_log_file = 8 2026-05-14 18:51:37.993367 | ubuntu-noble | +num_logs = 5 2026-05-14 18:51:37.993479 | ubuntu-noble | +priority_boost = 4 2026-05-14 18:51:37.993593 | ubuntu-noble | +disp_qos = lossy 2026-05-14 18:51:37.993706 | ubuntu-noble | +dispatcher = /sbin/audispd 2026-05-14 18:51:37.993819 | ubuntu-noble | +name_format = NONE 2026-05-14 18:51:37.993961 | ubuntu-noble | +##name = mydomain 2026-05-14 18:51:37.994086 | ubuntu-noble | +max_log_file_action = ROTATE 2026-05-14 18:51:37.994199 | ubuntu-noble | +space_left = 12361 2026-05-14 18:51:37.994311 | ubuntu-noble | +space_left_action = email 2026-05-14 18:51:37.994433 | ubuntu-noble | +verify_email = yes 2026-05-14 18:51:37.994546 | ubuntu-noble | +action_mail_acct = root 2026-05-14 18:51:37.994659 | ubuntu-noble | +admin_space_left = 50 2026-05-14 18:51:37.994776 | ubuntu-noble | +admin_space_left_action = SUSPEND 2026-05-14 18:51:37.994904 | ubuntu-noble | +disk_full_action = SUSPEND 2026-05-14 18:51:37.995048 | ubuntu-noble | +disk_error_action = SUSPEND 2026-05-14 18:51:37.995169 | ubuntu-noble | +use_libwrap = yes 2026-05-14 18:51:37.995285 | ubuntu-noble | +##tcp_listen_port = 60 2026-05-14 18:51:37.995398 | ubuntu-noble | +tcp_listen_queue = 5 2026-05-14 18:51:37.995511 | ubuntu-noble | +tcp_max_per_addr = 1 2026-05-14 18:51:37.995625 | ubuntu-noble | +##tcp_client_ports = 1024-65535 2026-05-14 18:51:37.995739 | ubuntu-noble | +tcp_client_max_idle = 0 2026-05-14 18:51:37.995850 | ubuntu-noble | +enable_krb5 = no 2026-05-14 18:51:37.996020 | ubuntu-noble | +krb5_principal = auditd 2026-05-14 18:51:37.996143 | ubuntu-noble | +##krb5_key_file = /etc/audit/audit.key 2026-05-14 18:51:37.996255 | ubuntu-noble | +distribute_network = no 2026-05-14 18:51:37.996359 | ubuntu-noble | 2026-05-14 18:51:37.996508 | ubuntu-noble | changed: [molecule-auditd] => {"changed": true, "checksum": "e902cc6bebf86c17087d153e359a2cc1231672e0", "dest": "/etc/audit/audit.conf", "gid": 0, "group": "root", "md5sum": "69dfd768317bae876a6a78c8aeb5cce1", "mode": "0640", "owner": "root", "size": 806, "src": "/home/zuul/.ansible/tmp/ansible-tmp-1778784696.645089-2314-230818093829173/.source.conf", "state": "file", "uid": 0} 2026-05-14 18:51:37.996651 | ubuntu-noble | 2026-05-14 18:51:37.996780 | ubuntu-noble | TASK [auditd : Adjust auditd/audispd configurations] *************************** 2026-05-14 18:51:38.112791 | debian-bookworm | ok: [molecule-auditd] => {"changed": false, "cmd": ["find", "/etc/audit/rules.d", "-type", "f", "-printf", "%f\n"], "delta": "0:00:00.007578", "end": "2026-05-14 18:51:38.064518", "msg": "", "rc": 0, "start": "2026-05-14 18:51:38.056940", "stderr": "", "stderr_lines": [], "stdout": "audit.rules\n20-neo23x0.rules", "stdout_lines": ["audit.rules", "20-neo23x0.rules"]} 2026-05-14 18:51:38.112852 | debian-bookworm | 2026-05-14 18:51:38.112860 | debian-bookworm | TASK [auditd : Remove unmanaged rules files] *********************************** 2026-05-14 18:51:38.467086 | debian-bookworm | --- before 2026-05-14 18:51:38.467140 | debian-bookworm | +++ after 2026-05-14 18:51:38.467146 | debian-bookworm | @@ -1,4 +1,4 @@ 2026-05-14 18:51:38.467152 | debian-bookworm | { 2026-05-14 18:51:38.467157 | debian-bookworm | "path": "/etc/audit/rules.d/audit.rules", 2026-05-14 18:51:38.467164 | debian-bookworm | - "state": "file" 2026-05-14 18:51:38.467170 | debian-bookworm | + "state": "absent" 2026-05-14 18:51:38.467175 | debian-bookworm | } 2026-05-14 18:51:38.467180 | debian-bookworm | 2026-05-14 18:51:38.467187 | debian-bookworm | changed: [molecule-auditd] => (item=audit.rules) => {"ansible_loop_var": "item", "changed": true, "item": "audit.rules", "path": "/etc/audit/rules.d/audit.rules", "state": "absent"} 2026-05-14 18:51:38.467194 | debian-bookworm | skipping: [molecule-auditd] => (item=20-neo23x0.rules) => {"ansible_loop_var": "item", "changed": false, "false_condition": "item not in auditd_rules_files", "item": "20-neo23x0.rules", "skip_reason": "Conditional result was False"} 2026-05-14 18:51:38.467206 | debian-bookworm | 2026-05-14 18:51:38.467212 | debian-bookworm | RUNNING HANDLER [auditd : Restart auditd service] ****************************** 2026-05-14 18:51:38.482740 | ubuntu-noble | ok: [molecule-auditd] => (item={'parameter': 'active', 'value': 'no', 'config': '/etc/audit/plugins.d/syslog.conf'}) => {"ansible_loop_var": "item", "backup": "", "changed": false, "item": {"config": "/etc/audit/plugins.d/syslog.conf", "parameter": "active", "value": "no"}, "msg": ""} 2026-05-14 18:51:38.483035 | ubuntu-noble | 2026-05-14 18:51:38.483234 | ubuntu-noble | TASK [auditd : Deploy rules for auditd] **************************************** 2026-05-14 18:51:39.420501 | ubuntu-noble | --- before 2026-05-14 18:51:39.423665 | ubuntu-noble | +++ after: /home/zuul/.ansible/tmp/ansible-local-19172mcj6ob1/tmpkoicybqq/20-neo23x0.rules.j2 2026-05-14 18:51:39.423892 | ubuntu-noble | @@ -0,0 +1,750 @@ 2026-05-14 18:51:39.424088 | ubuntu-noble | +# ___ ___ __ __ 2026-05-14 18:51:39.424252 | ubuntu-noble | +# / | __ ______/ (_) /_____/ / 2026-05-14 18:51:39.424422 | ubuntu-noble | +# / /| |/ / / / __ / / __/ __ / 2026-05-14 18:51:39.424623 | ubuntu-noble | +# / ___ / /_/ / /_/ / / /_/ /_/ / 2026-05-14 18:51:39.424771 | ubuntu-noble | +# /_/ |_\__,_/\__,_/_/\__/\__,_/ 2026-05-14 18:51:39.424943 | ubuntu-noble | +# 2026-05-14 18:51:39.425138 | ubuntu-noble | +# Linux Audit Daemon - Best Practice Configuration 2026-05-14 18:51:39.425344 | ubuntu-noble | +# /etc/audit/audit.rules 2026-05-14 18:51:39.425478 | ubuntu-noble | +# 2026-05-14 18:51:39.425634 | ubuntu-noble | +# Compiled by Florian Roth 2026-05-14 18:51:39.425912 | ubuntu-noble | +# 2026-05-14 18:51:39.425937 | ubuntu-noble | +# Created : 2017/12/05 2026-05-14 18:51:39.428389 | ubuntu-noble | +# Modified : 2023/01/25 2026-05-14 18:51:39.428549 | ubuntu-noble | +# 2026-05-14 18:51:39.428699 | ubuntu-noble | +# Based on rules published here: 2026-05-14 18:51:39.428847 | ubuntu-noble | +# Gov.uk auditd rules 2026-05-14 18:51:39.431004 | ubuntu-noble | +# https://github.com/gds-operations/puppet-auditd/pull/1 2026-05-14 18:51:39.431038 | ubuntu-noble | +# CentOS 7 hardening 2026-05-14 18:51:39.431045 | ubuntu-noble | +# https://highon.coffee/blog/security-harden-centos-7/#auditd---audit-daemon 2026-05-14 18:51:39.431052 | ubuntu-noble | +# Linux audit repo 2026-05-14 18:51:39.431058 | ubuntu-noble | +# https://github.com/linux-audit/audit-userspace/tree/master/rules 2026-05-14 18:51:39.431071 | ubuntu-noble | +# Auditd high performance linux auditing 2026-05-14 18:51:39.431328 | ubuntu-noble | +# https://linux-audit.com/tuning-auditd-high-performance-linux-auditing/ 2026-05-14 18:51:39.431497 | ubuntu-noble | +# 2026-05-14 18:51:39.431668 | ubuntu-noble | +# Further rules 2026-05-14 18:51:39.432020 | ubuntu-noble | +# For PCI DSS compliance see: 2026-05-14 18:51:39.432310 | ubuntu-noble | +# https://github.com/linux-audit/audit-userspace/blob/master/rules/30-pci-dss-v31.rules 2026-05-14 18:51:39.432564 | ubuntu-noble | +# For NISPOM compliance see: 2026-05-14 18:51:39.432827 | ubuntu-noble | +# https://github.com/linux-audit/audit-userspace/blob/master/rules/30-nispom.rules 2026-05-14 18:51:39.433036 | ubuntu-noble | + 2026-05-14 18:51:39.433207 | ubuntu-noble | +# Remove any existing rules 2026-05-14 18:51:39.433369 | ubuntu-noble | +-D 2026-05-14 18:51:39.433529 | ubuntu-noble | + 2026-05-14 18:51:39.433700 | ubuntu-noble | +# Buffer Size 2026-05-14 18:51:39.433915 | ubuntu-noble | +## Feel free to increase this if the machine panic's 2026-05-14 18:51:39.434097 | ubuntu-noble | +-b 8192 2026-05-14 18:51:39.434231 | ubuntu-noble | + 2026-05-14 18:51:39.434342 | ubuntu-noble | +# Failure Mode 2026-05-14 18:51:39.434460 | ubuntu-noble | +## Possible values: 0 (silent), 1 (printk, print a failure message), 2 (panic, halt the system) 2026-05-14 18:51:39.434567 | ubuntu-noble | +-f 1 2026-05-14 18:51:39.434667 | ubuntu-noble | + 2026-05-14 18:51:39.434781 | ubuntu-noble | +# Ignore errors 2026-05-14 18:51:39.434902 | ubuntu-noble | +## e.g. caused by users or files not found in the local environment 2026-05-14 18:51:39.435022 | ubuntu-noble | +-i 2026-05-14 18:51:39.435123 | ubuntu-noble | + 2026-05-14 18:51:39.435230 | ubuntu-noble | +# Self Auditing --------------------------------------------------------------- 2026-05-14 18:51:39.435363 | ubuntu-noble | + 2026-05-14 18:51:39.435442 | ubuntu-noble | +## Audit the audit logs 2026-05-14 18:51:39.435551 | ubuntu-noble | +### Successful and unsuccessful attempts to read information from the audit records 2026-05-14 18:51:39.435661 | ubuntu-noble | +-w /var/log/audit/ -p wra -k auditlog 2026-05-14 18:51:39.435772 | ubuntu-noble | +-w /var/audit/ -p wra -k auditlog 2026-05-14 18:51:39.435892 | ubuntu-noble | + 2026-05-14 18:51:39.436009 | ubuntu-noble | +## Auditd configuration 2026-05-14 18:51:39.436151 | ubuntu-noble | +### Modifications to audit configuration that occur while the audit collection functions are operating 2026-05-14 18:51:39.436286 | ubuntu-noble | +-w /etc/audit/ -p wa -k auditconfig 2026-05-14 18:51:39.436399 | ubuntu-noble | +-w /etc/libaudit.conf -p wa -k auditconfig 2026-05-14 18:51:39.436505 | ubuntu-noble | +-w /etc/audisp/ -p wa -k audispconfig 2026-05-14 18:51:39.436610 | ubuntu-noble | + 2026-05-14 18:51:39.436718 | ubuntu-noble | +## Monitor for use of audit management tools 2026-05-14 18:51:39.436829 | ubuntu-noble | +-w /sbin/auditctl -p x -k audittools 2026-05-14 18:51:39.437003 | ubuntu-noble | +-w /sbin/auditd -p x -k audittools 2026-05-14 18:51:39.437118 | ubuntu-noble | +-w /usr/sbin/auditd -p x -k audittools 2026-05-14 18:51:39.437260 | ubuntu-noble | +-w /usr/sbin/augenrules -p x -k audittools 2026-05-14 18:51:39.437397 | ubuntu-noble | + 2026-05-14 18:51:39.437534 | ubuntu-noble | +## Access to all audit trails 2026-05-14 18:51:39.437647 | ubuntu-noble | + 2026-05-14 18:51:39.437786 | ubuntu-noble | +-a always,exit -F path=/usr/sbin/ausearch -F perm=x -k audittools 2026-05-14 18:51:39.437911 | ubuntu-noble | +-a always,exit -F path=/usr/sbin/aureport -F perm=x -k audittools 2026-05-14 18:51:39.438031 | ubuntu-noble | +-a always,exit -F path=/usr/sbin/aulast -F perm=x -k audittools 2026-05-14 18:51:39.438132 | ubuntu-noble | +-a always,exit -F path=/usr/sbin/aulastlogin -F perm=x -k audittools 2026-05-14 18:51:39.438252 | ubuntu-noble | +-a always,exit -F path=/usr/sbin/auvirt -F perm=x -k audittools 2026-05-14 18:51:39.438347 | ubuntu-noble | + 2026-05-14 18:51:39.438448 | ubuntu-noble | +# Filters --------------------------------------------------------------------- 2026-05-14 18:51:39.438542 | ubuntu-noble | + 2026-05-14 18:51:39.438672 | ubuntu-noble | +### We put these early because audit is a first match wins system. 2026-05-14 18:51:39.438806 | ubuntu-noble | + 2026-05-14 18:51:39.439004 | ubuntu-noble | +## Ignore SELinux AVC records 2026-05-14 18:51:39.439980 | ubuntu-noble | +-a always,exclude -F msgtype=AVC 2026-05-14 18:51:39.440002 | ubuntu-noble | + 2026-05-14 18:51:39.440008 | ubuntu-noble | +## Ignore current working directory records 2026-05-14 18:51:39.440012 | ubuntu-noble | +-a always,exclude -F msgtype=CWD 2026-05-14 18:51:39.440017 | ubuntu-noble | + 2026-05-14 18:51:39.440021 | ubuntu-noble | +## Cron jobs fill the logs with stuff we normally don't want (works with SELinux) 2026-05-14 18:51:39.440025 | ubuntu-noble | +-a never,user -F subj_type=crond_t 2026-05-14 18:51:39.440034 | ubuntu-noble | +-a never,exit -F subj_type=crond_t 2026-05-14 18:51:39.440507 | ubuntu-noble | + 2026-05-14 18:51:39.440632 | ubuntu-noble | +## This prevents chrony from overwhelming the logs 2026-05-14 18:51:39.440738 | ubuntu-noble | +-a never,exit -F arch=b64 -S adjtimex -F auid=-1 -F uid=chrony -F subj_type=chronyd_t 2026-05-14 18:51:39.440912 | ubuntu-noble | + 2026-05-14 18:51:39.441024 | ubuntu-noble | +## This is not very interesting and wastes a lot of space if the server is public facing 2026-05-14 18:51:39.441156 | ubuntu-noble | +-a always,exclude -F msgtype=CRYPTO_KEY_USER 2026-05-14 18:51:39.441253 | ubuntu-noble | + 2026-05-14 18:51:39.441353 | ubuntu-noble | +## Open VM Tools 2026-05-14 18:51:39.441457 | ubuntu-noble | +-a exit,never -F arch=b64 -S all -F exe=/usr/bin/vmtoolsd 2026-05-14 18:51:39.441550 | ubuntu-noble | + 2026-05-14 18:51:39.441657 | ubuntu-noble | +## High Volume Event Filter (especially on Linux Workstations) 2026-05-14 18:51:39.441757 | ubuntu-noble | +-a never,exit -F arch=b64 -F dir=/dev/shm -k sharedmemaccess 2026-05-14 18:51:39.441857 | ubuntu-noble | +-a never,exit -F arch=b64 -F dir=/var/lock/lvm -k locklvm 2026-05-14 18:51:39.442031 | ubuntu-noble | + 2026-05-14 18:51:39.442437 | ubuntu-noble | +## FileBeat 2026-05-14 18:51:39.443206 | ubuntu-noble | +-a never,exit -F arch=b64 -F path=/opt/filebeat -k filebeat 2026-05-14 18:51:39.445052 | ubuntu-noble | + 2026-05-14 18:51:39.445075 | ubuntu-noble | +## More information on how to filter events 2026-05-14 18:51:39.445080 | ubuntu-noble | +### https://access.redhat.com/solutions/2482221 2026-05-14 18:51:39.445084 | ubuntu-noble | + 2026-05-14 18:51:39.445732 | ubuntu-noble | +# Rules ----------------------------------------------------------------------- 2026-05-14 18:51:39.445748 | ubuntu-noble | + 2026-05-14 18:51:39.445782 | ubuntu-noble | +## Kernel parameters 2026-05-14 18:51:39.446189 | ubuntu-noble | +-w /etc/sysctl.conf -p wa -k sysctl 2026-05-14 18:51:39.446541 | ubuntu-noble | +-w /etc/sysctl.d -p wa -k sysctl 2026-05-14 18:51:39.446924 | ubuntu-noble | + 2026-05-14 18:51:39.447311 | ubuntu-noble | +## Kernel module loading and unloading 2026-05-14 18:51:39.447722 | ubuntu-noble | +-a always,exit -F perm=x -F auid!=-1 -F path=/sbin/insmod -k modules 2026-05-14 18:51:39.448282 | ubuntu-noble | +-a always,exit -F perm=x -F auid!=-1 -F path=/sbin/modprobe -k modules 2026-05-14 18:51:39.448752 | ubuntu-noble | +-a always,exit -F perm=x -F auid!=-1 -F path=/sbin/rmmod -k modules 2026-05-14 18:51:39.449446 | ubuntu-noble | +-a always,exit -F arch=b64 -S finit_module -S init_module -S delete_module -F auid!=-1 -k modules 2026-05-14 18:51:39.449641 | ubuntu-noble | + 2026-05-14 18:51:39.449796 | ubuntu-noble | +## Modprobe configuration 2026-05-14 18:51:39.450019 | ubuntu-noble | +-w /etc/modprobe.conf -p wa -k modprobe 2026-05-14 18:51:39.450244 | ubuntu-noble | +-w /etc/modprobe.d -p wa -k modprobe 2026-05-14 18:51:39.450417 | ubuntu-noble | + 2026-05-14 18:51:39.450616 | ubuntu-noble | +## KExec usage (all actions) 2026-05-14 18:51:39.450772 | ubuntu-noble | +-a always,exit -F arch=b64 -S kexec_load -k KEXEC 2026-05-14 18:51:39.450922 | ubuntu-noble | + 2026-05-14 18:51:39.451084 | ubuntu-noble | +## Special files 2026-05-14 18:51:39.451232 | ubuntu-noble | +-a always,exit -F arch=b64 -S mknod -S mknodat -k specialfiles 2026-05-14 18:51:39.451359 | ubuntu-noble | + 2026-05-14 18:51:39.451499 | ubuntu-noble | +## Mount operations (only attributable) 2026-05-14 18:51:39.451640 | ubuntu-noble | +-a always,exit -F arch=b64 -S mount -S umount2 -F auid!=-1 -k mount 2026-05-14 18:51:39.451766 | ubuntu-noble | + 2026-05-14 18:51:39.451918 | ubuntu-noble | +### NFS mount 2026-05-14 18:51:39.452119 | ubuntu-noble | +-a always,exit -F path=/sbin/mount.nfs -F perm=x -F auid>=500 -F auid!=4294967295 -k T1078_Valid_Accounts 2026-05-14 18:51:39.452368 | ubuntu-noble | +-a always,exit -F path=/usr/sbin/mount.nfs -F perm=x -F auid>=500 -F auid!=4294967295 -k T1078_Valid_Accounts 2026-05-14 18:51:39.452509 | ubuntu-noble | + 2026-05-14 18:51:39.452649 | ubuntu-noble | +## Change swap (only attributable) 2026-05-14 18:51:39.452909 | ubuntu-noble | +-a always,exit -F arch=b64 -S swapon -S swapoff -F auid!=-1 -k swap 2026-05-14 18:51:39.453064 | ubuntu-noble | + 2026-05-14 18:51:39.453199 | ubuntu-noble | +## Time 2026-05-14 18:51:39.453401 | ubuntu-noble | +-a always,exit -F arch=b64 -F uid!=ntp -S adjtimex -S settimeofday -S clock_settime -k time 2026-05-14 18:51:39.453630 | ubuntu-noble | +### Local time zone 2026-05-14 18:51:39.453838 | ubuntu-noble | +-w /etc/localtime -p wa -k localtime 2026-05-14 18:51:39.454133 | ubuntu-noble | + 2026-05-14 18:51:39.454295 | ubuntu-noble | +## Stunnel 2026-05-14 18:51:39.454443 | ubuntu-noble | +-w /usr/sbin/stunnel -p x -k stunnel 2026-05-14 18:51:39.454591 | ubuntu-noble | +-w /usr/bin/stunnel -p x -k stunnel 2026-05-14 18:51:39.454732 | ubuntu-noble | + 2026-05-14 18:51:39.454918 | ubuntu-noble | +## Cron configuration & scheduled jobs 2026-05-14 18:51:39.455085 | ubuntu-noble | +-w /etc/cron.allow -p wa -k cron 2026-05-14 18:51:39.455229 | ubuntu-noble | +-w /etc/cron.deny -p wa -k cron 2026-05-14 18:51:39.455373 | ubuntu-noble | +-w /etc/cron.d/ -p wa -k cron 2026-05-14 18:51:39.455523 | ubuntu-noble | +-w /etc/cron.daily/ -p wa -k cron 2026-05-14 18:51:39.455669 | ubuntu-noble | +-w /etc/cron.hourly/ -p wa -k cron 2026-05-14 18:51:39.455806 | ubuntu-noble | +-w /etc/cron.monthly/ -p wa -k cron 2026-05-14 18:51:39.456000 | ubuntu-noble | +-w /etc/cron.weekly/ -p wa -k cron 2026-05-14 18:51:39.456141 | ubuntu-noble | +-w /etc/crontab -p wa -k cron 2026-05-14 18:51:39.456280 | ubuntu-noble | +-w /var/spool/cron/ -p wa -k cron 2026-05-14 18:51:39.456414 | ubuntu-noble | + 2026-05-14 18:51:39.456567 | ubuntu-noble | +## User, group, password databases 2026-05-14 18:51:39.456707 | ubuntu-noble | +-w /etc/group -p wa -k etcgroup 2026-05-14 18:51:39.456844 | ubuntu-noble | +-w /etc/passwd -p wa -k etcpasswd 2026-05-14 18:51:39.457016 | ubuntu-noble | +-w /etc/gshadow -k etcgroup 2026-05-14 18:51:39.457160 | ubuntu-noble | +-w /etc/shadow -k etcpasswd 2026-05-14 18:51:39.457302 | ubuntu-noble | +-w /etc/security/opasswd -k opasswd 2026-05-14 18:51:39.457441 | ubuntu-noble | + 2026-05-14 18:51:39.457584 | ubuntu-noble | +## Sudoers file changes 2026-05-14 18:51:39.457728 | ubuntu-noble | +-w /etc/sudoers -p wa -k actions 2026-05-14 18:51:39.457913 | ubuntu-noble | +-w /etc/sudoers.d/ -p wa -k actions 2026-05-14 18:51:39.458091 | ubuntu-noble | + 2026-05-14 18:51:39.458229 | ubuntu-noble | +## Passwd 2026-05-14 18:51:39.458370 | ubuntu-noble | +-w /usr/bin/passwd -p x -k passwd_modification 2026-05-14 18:51:39.458499 | ubuntu-noble | + 2026-05-14 18:51:39.458635 | ubuntu-noble | +## Tools to change group identifiers 2026-05-14 18:51:39.458793 | ubuntu-noble | +-w /usr/sbin/groupadd -p x -k group_modification 2026-05-14 18:51:39.459001 | ubuntu-noble | +-w /usr/sbin/groupmod -p x -k group_modification 2026-05-14 18:51:39.459146 | ubuntu-noble | +-w /usr/sbin/addgroup -p x -k group_modification 2026-05-14 18:51:39.459303 | ubuntu-noble | +-w /usr/sbin/useradd -p x -k user_modification 2026-05-14 18:51:39.459423 | ubuntu-noble | +-w /usr/sbin/userdel -p x -k user_modification 2026-05-14 18:51:39.459562 | ubuntu-noble | +-w /usr/sbin/usermod -p x -k user_modification 2026-05-14 18:51:39.459699 | ubuntu-noble | +-w /usr/sbin/adduser -p x -k user_modification 2026-05-14 18:51:39.459845 | ubuntu-noble | + 2026-05-14 18:51:39.460988 | ubuntu-noble | +## Login configuration and information 2026-05-14 18:51:39.461016 | ubuntu-noble | +-w /etc/login.defs -p wa -k login 2026-05-14 18:51:39.461020 | ubuntu-noble | +-w /etc/securetty -p wa -k login 2026-05-14 18:51:39.461024 | ubuntu-noble | +-w /var/log/faillog -p wa -k login 2026-05-14 18:51:39.461028 | ubuntu-noble | +-w /var/log/lastlog -p wa -k login 2026-05-14 18:51:39.461031 | ubuntu-noble | +-w /var/log/tallylog -p wa -k login 2026-05-14 18:51:39.461035 | ubuntu-noble | + 2026-05-14 18:51:39.461039 | ubuntu-noble | +## Network Environment 2026-05-14 18:51:39.461059 | ubuntu-noble | +### Changes to hostname 2026-05-14 18:51:39.461132 | ubuntu-noble | +-a always,exit -F arch=b64 -S sethostname -S setdomainname -k network_modifications 2026-05-14 18:51:39.461256 | ubuntu-noble | + 2026-05-14 18:51:39.461387 | ubuntu-noble | +### Detect Remote Shell Use 2026-05-14 18:51:39.461520 | ubuntu-noble | +-a always,exit -F arch=b64 -F exe=/bin/bash -F success=1 -S connect -k "remote_shell" 2026-05-14 18:51:39.461657 | ubuntu-noble | +-a always,exit -F arch=b64 -F exe=/usr/bin/bash -F success=1 -S connect -k "remote_shell" 2026-05-14 18:51:39.461776 | ubuntu-noble | + 2026-05-14 18:51:39.461917 | ubuntu-noble | +### Successful IPv4 Connections 2026-05-14 18:51:39.462067 | ubuntu-noble | +-a always,exit -F arch=b64 -S connect -F a2=16 -F success=1 -F key=network_connect_4 2026-05-14 18:51:39.462189 | ubuntu-noble | + 2026-05-14 18:51:39.462319 | ubuntu-noble | +### Successful IPv6 Connections 2026-05-14 18:51:39.462452 | ubuntu-noble | +-a always,exit -F arch=b64 -S connect -F a2=28 -F success=1 -F key=network_connect_6 2026-05-14 18:51:39.462572 | ubuntu-noble | + 2026-05-14 18:51:39.462701 | ubuntu-noble | +### Changes to other files 2026-05-14 18:51:39.462832 | ubuntu-noble | +-w /etc/hosts -p wa -k network_modifications 2026-05-14 18:51:39.463015 | ubuntu-noble | +-w /etc/sysconfig/network -p wa -k network_modifications 2026-05-14 18:51:39.463134 | ubuntu-noble | +-w /etc/sysconfig/network-scripts -p w -k network_modifications 2026-05-14 18:51:39.463270 | ubuntu-noble | +-w /etc/network/ -p wa -k network 2026-05-14 18:51:39.463381 | ubuntu-noble | +-a always,exit -F dir=/etc/NetworkManager/ -F perm=wa -k network_modifications 2026-05-14 18:51:39.463495 | ubuntu-noble | + 2026-05-14 18:51:39.463609 | ubuntu-noble | +### Changes to issue 2026-05-14 18:51:39.463719 | ubuntu-noble | +-w /etc/issue -p wa -k etcissue 2026-05-14 18:51:39.463835 | ubuntu-noble | +-w /etc/issue.net -p wa -k etcissue 2026-05-14 18:51:39.463972 | ubuntu-noble | + 2026-05-14 18:51:39.464088 | ubuntu-noble | +## System startup scripts 2026-05-14 18:51:39.464201 | ubuntu-noble | +-w /etc/inittab -p wa -k init 2026-05-14 18:51:39.464350 | ubuntu-noble | +-w /etc/init.d/ -p wa -k init 2026-05-14 18:51:39.464431 | ubuntu-noble | +-w /etc/init/ -p wa -k init 2026-05-14 18:51:39.464543 | ubuntu-noble | + 2026-05-14 18:51:39.464662 | ubuntu-noble | +## Library search paths 2026-05-14 18:51:39.464775 | ubuntu-noble | +-w /etc/ld.so.conf -p wa -k libpath 2026-05-14 18:51:39.464901 | ubuntu-noble | +-w /etc/ld.so.conf.d -p wa -k libpath 2026-05-14 18:51:39.465032 | ubuntu-noble | + 2026-05-14 18:51:39.465152 | ubuntu-noble | +## Systemwide library preloads (LD_PRELOAD) 2026-05-14 18:51:39.465266 | ubuntu-noble | +-w /etc/ld.so.preload -p wa -k systemwide_preloads 2026-05-14 18:51:39.465376 | ubuntu-noble | + 2026-05-14 18:51:39.465490 | ubuntu-noble | +## Pam configuration 2026-05-14 18:51:39.465606 | ubuntu-noble | +-w /etc/pam.d/ -p wa -k pam 2026-05-14 18:51:39.465725 | ubuntu-noble | +-w /etc/security/limits.conf -p wa -k pam 2026-05-14 18:51:39.465842 | ubuntu-noble | +-w /etc/security/limits.d -p wa -k pam 2026-05-14 18:51:39.466050 | ubuntu-noble | +-w /etc/security/pam_env.conf -p wa -k pam 2026-05-14 18:51:39.466121 | ubuntu-noble | +-w /etc/security/namespace.conf -p wa -k pam 2026-05-14 18:51:39.466251 | ubuntu-noble | +-w /etc/security/namespace.d -p wa -k pam 2026-05-14 18:51:39.466357 | ubuntu-noble | +-w /etc/security/namespace.init -p wa -k pam 2026-05-14 18:51:39.466463 | ubuntu-noble | + 2026-05-14 18:51:39.467342 | ubuntu-noble | +## Mail configuration 2026-05-14 18:51:39.467366 | ubuntu-noble | +-w /etc/aliases -p wa -k mail 2026-05-14 18:51:39.467369 | ubuntu-noble | +-w /etc/postfix/ -p wa -k mail 2026-05-14 18:51:39.467373 | ubuntu-noble | +-w /etc/exim4/ -p wa -k mail 2026-05-14 18:51:39.467377 | ubuntu-noble | + 2026-05-14 18:51:39.467381 | ubuntu-noble | +## SSH configuration 2026-05-14 18:51:39.467434 | ubuntu-noble | +-w /etc/ssh/sshd_config -k sshd 2026-05-14 18:51:39.467439 | ubuntu-noble | +-w /etc/ssh/sshd_config.d -k sshd 2026-05-14 18:51:39.467446 | ubuntu-noble | + 2026-05-14 18:51:39.467477 | ubuntu-noble | +## root ssh key tampering 2026-05-14 18:51:39.467615 | ubuntu-noble | +-w /root/.ssh -p wa -k rootkey 2026-05-14 18:51:39.467680 | ubuntu-noble | + 2026-05-14 18:51:39.467785 | ubuntu-noble | +# Systemd 2026-05-14 18:51:39.467899 | ubuntu-noble | +-w /bin/systemctl -p x -k systemd 2026-05-14 18:51:39.468029 | ubuntu-noble | +-w /etc/systemd/ -p wa -k systemd 2026-05-14 18:51:39.468129 | ubuntu-noble | +-w /usr/lib/systemd -p wa -k systemd 2026-05-14 18:51:39.468224 | ubuntu-noble | + 2026-05-14 18:51:39.468366 | ubuntu-noble | +## https://systemd.network/systemd.generator.html 2026-05-14 18:51:39.468438 | ubuntu-noble | +-w /etc/systemd/system-generators/ -p wa -k systemd_generator 2026-05-14 18:51:39.468547 | ubuntu-noble | +-w /usr/local/lib/systemd/system-generators/ -p wa -k systemd_generator 2026-05-14 18:51:39.468690 | ubuntu-noble | +-w /usr/lib/systemd/system-generators -p wa -k systemd_generator 2026-05-14 18:51:39.468753 | ubuntu-noble | + 2026-05-14 18:51:39.468857 | ubuntu-noble | +-w /etc/systemd/user-generators/ -p wa -k systemd_generator 2026-05-14 18:51:39.469067 | ubuntu-noble | +-w /usr/local/lib/systemd/user-generators/ -p wa -k systemd_generator 2026-05-14 18:51:39.469158 | ubuntu-noble | +-w /lib/systemd/system-generators/ -p wa -k systemd_generator 2026-05-14 18:51:39.469255 | ubuntu-noble | + 2026-05-14 18:51:39.469364 | ubuntu-noble | +## SELinux events that modify the system's Mandatory Access Controls (MAC) 2026-05-14 18:51:39.469469 | ubuntu-noble | +-w /etc/selinux/ -p wa -k mac_policy 2026-05-14 18:51:39.469561 | ubuntu-noble | + 2026-05-14 18:51:39.469658 | ubuntu-noble | +## Critical elements access failures 2026-05-14 18:51:39.469767 | ubuntu-noble | +-a always,exit -F arch=b64 -S open -F dir=/etc -F success=0 -k unauthedfileaccess 2026-05-14 18:51:39.469878 | ubuntu-noble | +-a always,exit -F arch=b64 -S open -F dir=/bin -F success=0 -k unauthedfileaccess 2026-05-14 18:51:39.159586 | debian-bookworm | changed: [molecule-auditd] => {"changed": true, "name": "auditd", "state": "started", "status": {"ActiveEnterTimestamp": "Thu 2026-05-14 18:51:30 UTC", "ActiveEnterTimestampMonotonic": "153736431", "ActiveExitTimestampMonotonic": "0", "ActiveState": "active", "After": "systemd-tmpfiles-setup.service systemd-journald.socket local-fs.target system.slice", "AllowIsolate": "no", "AssertResult": "yes", "AssertTimestamp": "Thu 2026-05-14 18:51:30 UTC", "AssertTimestampMonotonic": "153660360", "Before": "sysinit.target systemd-update-utmp.service shutdown.target ssh.service", "BlockIOAccounting": "no", "BlockIOWeight": "[not set]", "CPUAccounting": "yes", "CPUAffinityFromNUMA": "no", "CPUQuotaPerSecUSec": "infinity", "CPUQuotaPeriodUSec": "infinity", "CPUSchedulingPolicy": "0", "CPUSchedulingPriority": "0", "CPUSchedulingResetOnFork": "no", "CPUShares": "[not set]", "CPUUsageNSec": "49044000", "CPUWeight": "[not set]", "CacheDirectoryMode": "0755", "CanFreeze": "yes", "CanIsolate": "no", "CanReload": "no", "CanStart": "yes", "CanStop": "yes", "CapabilityBoundingSet": "cap_chown cap_dac_override cap_dac_read_search cap_fowner cap_fsetid cap_kill cap_setgid cap_setuid cap_setpcap cap_linux_immutable cap_net_bind_service cap_net_broadcast cap_net_admin cap_net_raw cap_ipc_lock cap_ipc_owner cap_sys_rawio cap_sys_chroot cap_sys_ptrace cap_sys_pacct cap_sys_admin cap_sys_boot cap_sys_nice cap_sys_resource cap_sys_time cap_sys_tty_config cap_mknod cap_lease cap_audit_write cap_audit_control cap_setfcap cap_mac_override cap_mac_admin cap_syslog cap_wake_alarm cap_block_suspend cap_audit_read cap_perfmon cap_bpf cap_checkpoint_restore", "CleanResult": "success", "CollectMode": "inactive", "ConditionResult": "yes", "ConditionTimestamp": "Thu 2026-05-14 18:51:30 UTC", "ConditionTimestampMonotonic": "153660322", "ConfigurationDirectoryMode": "0755", "Conflicts": "shutdown.target", "ControlGroup": "/system.slice/auditd.service", "ControlGroupId": "3328", "ControlPID": "0", "CoredumpFilter": "0x33", "DefaultDependencies": "no", "DefaultMemoryLow": "0", "DefaultMemoryMin": "0", "Delegate": "no", "Description": "Security Auditing Service", "DevicePolicy": "auto", "Documentation": "\"man:auditd(8)\" https://github.com/linux-audit/audit-documentation", "DynamicUser": "no", "ExecMainCode": "0", "ExecMainExitTimestampMonotonic": "0", "ExecMainPID": "2300", "ExecMainStartTimestamp": "Thu 2026-05-14 18:51:30 UTC", "ExecMainStartTimestampMonotonic": "153709413", "ExecMainStatus": "0", "ExecStart": "{ path=/sbin/auditd ; argv[]=/sbin/auditd ; ignore_errors=no ; start_time=[Thu 2026-05-14 18:51:30 UTC] ; stop_time=[Thu 2026-05-14 18:51:30 UTC] ; pid=2299 ; code=exited ; status=0 }", "ExecStartEx": "{ path=/sbin/auditd ; argv[]=/sbin/auditd ; flags= ; start_time=[Thu 2026-05-14 18:51:30 UTC] ; stop_time=[Thu 2026-05-14 18:51:30 UTC] ; pid=2299 ; code=exited ; status=0 }", "ExecStartPost": "{ path=/sbin/augenrules ; argv[]=/sbin/augenrules --load ; ignore_errors=yes ; start_time=[Thu 2026-05-14 18:51:30 UTC] ; stop_time=[Thu 2026-05-14 18:51:30 UTC] ; pid=2303 ; code=exited ; status=0 }", "ExecStartPostEx": "{ path=/sbin/augenrules ; argv[]=/sbin/augenrules --load ; flags=ignore-failure ; start_time=[Thu 2026-05-14 18:51:30 UTC] ; stop_time=[Thu 2026-05-14 18:51:30 UTC] ; pid=2303 ; code=exited ; status=0 }", "ExitType": "main", "FailureAction": "none", "FileDescriptorStoreMax": "0", "FinalKillSignal": "9", "FragmentPath": "/lib/systemd/system/auditd.service", "FreezerState": "running", "GID": "[not set]", "GuessMainPID": "yes", "IOAccounting": "no", "IOReadBytes": "18446744073709551615", "IOReadOperations": "18446744073709551615", "IOSchedulingClass": "2", "IOSchedulingPriority": "4", "IOWeight": "[not set]", "IOWriteBytes": "18446744073709551615", "IOWriteOperations": "18446744073709551615", "IPAccounting": "no", "IPEgressBytes": "[no data]", "IPEgressPackets": "[no data]", "IPIngressBytes": "[no data]", "IPIngressPackets": "[no data]", "Id": "auditd.service", "IgnoreOnIsolate": "no", "IgnoreSIGPIPE": "yes", "InactiveEnterTimestampMonotonic": "0", "InactiveExitTimestamp": "Thu 2026-05-14 18:51:30 UTC", "InactiveExitTimestampMonotonic": "153688750", "InvocationID": "b7b6ad57154a4cd0b9eb7937e0e2c289", "JobRunningTimeoutUSec": "infinity", "JobTimeoutAction": "none", "JobTimeoutUSec": "infinity", "KeyringMode": "private", "KillMode": "control-group", "KillSignal": "15", "LimitAS": "infinity", "LimitASSoft": "infinity", "LimitCORE": "infinity", "LimitCORESoft": "0", "LimitCPU": "infinity", "LimitCPUSoft": "infinity", "LimitDATA": "infinity", "LimitDATASoft": "infinity", "LimitFSIZE": "infinity", "LimitFSIZESoft": "infinity", "LimitLOCKS": "infinity", "LimitLOCKSSoft": "infinity", "LimitMEMLOCK": "8388608", "LimitMEMLOCKSoft": "8388608", "LimitMSGQUEUE": "819200", "LimitMSGQUEUESoft": "819200", "LimitNICE": "0", "LimitNICESoft": "0", "LimitNOFILE": "524288", "LimitNOFILESoft": "1024", "LimitNPROC": "15480", "LimitNPROCSoft": "15480", "LimitRSS": "infinity", "LimitRSSSoft": "infinity", "LimitRTPRIO": "0", "LimitRTPRIOSoft": "0", "LimitRTTIME": "infinity", "LimitRTTIMESoft": "infinity", "LimitSIGPENDING": "15480", "LimitSIGPENDINGSoft": "15480", "LimitSTACK": "infinity", "LimitSTACKSoft": "8388608", "LoadState": "loaded", "LockPersonality": "yes", "LogLevelMax": "-1", "LogRateLimitBurst": "0", "LogRateLimitIntervalUSec": "0", "LogsDirectoryMode": "0755", "MainPID": "2300", "ManagedOOMMemoryPressure": "auto", "ManagedOOMMemoryPressureLimit": "0", "ManagedOOMPreference": "none", "ManagedOOMSwap": "auto", "MemoryAccounting": "yes", "MemoryAvailable": "infinity", "MemoryCurrent": "716800", "MemoryDenyWriteExecute": "yes", "MemoryHigh": "infinity", "MemoryLimit": "infinity", "MemoryLow": "0", "MemoryMax": "infinity", "MemoryMin": "0", "MemorySwapMax": "infinity", "MountAPIVFS": "no", "NFileDescriptorStore": "0", "NRestarts": "0", "NUMAPolicy": "n/a", "Names": "auditd.service", "NeedDaemonReload": "no", "Nice": "0", "NoNewPrivileges": "no", "NonBlocking": "no", "NotifyAccess": "none", "OOMPolicy": "stop", "OOMScoreAdjust": "0", "OnFailureJobMode": "replace", "OnSuccessJobMode": "fail", "PIDFile": "/run/auditd.pid", "Perpetual": "no", "PrivateDevices": "no", "PrivateIPC": "no", "PrivateMounts": "no", "PrivateNetwork": "no", "PrivateTmp": "no", "PrivateUsers": "no", "ProcSubset": "all", "ProtectClock": "no", "ProtectControlGroups": "yes", "ProtectHome": "no", "ProtectHostname": "no", "ProtectKernelLogs": "no", "ProtectKernelModules": "yes", "ProtectKernelTunables": "no", "ProtectProc": "default", "ProtectSystem": "no", "RefuseManualStart": "no", "RefuseManualStop": "no", "ReloadResult": "success", "RemainAfterExit": "no", "RemoveIPC": "no", "Requires": "system.slice", "Restart": "on-failure", "RestartKillSignal": "15", "RestartPreventExitStatus": "2 4 6", "RestartUSec": "100ms", "RestrictNamespaces": "no", "RestrictRealtime": "yes", "RestrictSUIDSGID": "no", "Result": "success", "RootDirectoryStartOnly": "no", "RuntimeDirectoryMode": "0755", "RuntimeDirectoryPreserve": "no", "RuntimeMaxUSec": "infinity", "RuntimeRandomizedExtraUSec": "0", "SameProcessGroup": "no", "SecureBits": "0", "SendSIGHUP": "no", "SendSIGKILL": "yes", "Slice": "system.slice", "StandardError": "inherit", "StandardInput": "null", "StandardOutput": "journal", "StartLimitAction": "none", "StartLimitBurst": "5", "StartLimitIntervalUSec": "10s", "StartupBlockIOWeight": "[not set]", "StartupCPUShares": "[not set]", "StartupCPUWeight": "[not set]", "StartupIOWeight": "[not set]", "StateChangeTimestamp": "Thu 2026-05-14 18:51:30 UTC", "StateChangeTimestampMonotonic": "153736431", "StateDirectoryMode": "0755", "StatusErrno": "0", "StopWhenUnneeded": "no", "SubState": "running", "SuccessAction": "none", "SyslogFacility": "3", "SyslogLevel": "6", "SyslogLevelPrefix": "yes", "SyslogPriority": "30", "SystemCallErrorNumber": "2147483646", "TTYReset": "no", "TTYVHangup": "no", "TTYVTDisallocate": "no", "TasksAccounting": "yes", "TasksCurrent": "2", "TasksMax": "4644", "TimeoutAbortUSec": "1min 30s", "TimeoutCleanUSec": "infinity", "TimeoutStartFailureMode": "terminate", "TimeoutStartUSec": "1min 30s", "TimeoutStopFailureMode": "terminate", "TimeoutStopUSec": "1min 30s", "TimerSlackNSec": "50000", "Transient": "no", "Type": "forking", "UID": "[not set]", "UMask": "0022", "UnitFilePreset": "enabled", "UnitFileState": "enabled", "UtmpMode": "init", "WantedBy": "multi-user.target", "WatchdogSignal": "6", "WatchdogTimestampMonotonic": "0", "WatchdogUSec": "0"}} 2026-05-14 18:51:39.166135 | debian-bookworm | 2026-05-14 18:51:39.166168 | debian-bookworm | RUNNING HANDLER [auditd : Generate auditd rules] ******************************* 2026-05-14 18:51:39.470797 | ubuntu-noble | +-a always,exit -F arch=b64 -S open -F dir=/sbin -F success=0 -k unauthedfileaccess 2026-05-14 18:51:39.470838 | ubuntu-noble | +-a always,exit -F arch=b64 -S open -F dir=/usr/bin -F success=0 -k unauthedfileaccess 2026-05-14 18:51:39.470843 | ubuntu-noble | +-a always,exit -F arch=b64 -S open -F dir=/usr/sbin -F success=0 -k unauthedfileaccess 2026-05-14 18:51:39.470847 | ubuntu-noble | +-a always,exit -F arch=b64 -S open -F dir=/var -F success=0 -k unauthedfileaccess 2026-05-14 18:51:39.470850 | ubuntu-noble | +-a always,exit -F arch=b64 -S open -F dir=/home -F success=0 -k unauthedfileaccess 2026-05-14 18:51:39.470894 | ubuntu-noble | +-a always,exit -F arch=b64 -S open -F dir=/srv -F success=0 -k unauthedfileaccess 2026-05-14 18:51:39.471053 | ubuntu-noble | + 2026-05-14 18:51:39.471155 | ubuntu-noble | +## Process ID change (switching accounts) applications 2026-05-14 18:51:39.471257 | ubuntu-noble | +-w /bin/su -p x -k priv_esc 2026-05-14 18:51:39.471359 | ubuntu-noble | +-w /usr/bin/sudo -p x -k priv_esc 2026-05-14 18:51:39.471456 | ubuntu-noble | + 2026-05-14 18:51:39.471561 | ubuntu-noble | +## Power state 2026-05-14 18:51:39.471661 | ubuntu-noble | +-w /sbin/shutdown -p x -k power 2026-05-14 18:51:39.471757 | ubuntu-noble | +-w /sbin/poweroff -p x -k power 2026-05-14 18:51:39.472775 | ubuntu-noble | +-w /sbin/reboot -p x -k power 2026-05-14 18:51:39.472809 | ubuntu-noble | +-w /sbin/halt -p x -k power 2026-05-14 18:51:39.472813 | ubuntu-noble | + 2026-05-14 18:51:39.472817 | ubuntu-noble | +## Session initiation information 2026-05-14 18:51:39.472821 | ubuntu-noble | +-w /var/run/utmp -p wa -k session 2026-05-14 18:51:39.472824 | ubuntu-noble | +-w /var/log/btmp -p wa -k session 2026-05-14 18:51:39.472828 | ubuntu-noble | +-w /var/log/wtmp -p wa -k session 2026-05-14 18:51:39.472831 | ubuntu-noble | + 2026-05-14 18:51:39.472835 | ubuntu-noble | +## Discretionary Access Control (DAC) modifications 2026-05-14 18:51:39.472839 | ubuntu-noble | +-a always,exit -F arch=b64 -S chmod -F auid>=1000 -F auid!=-1 -k perm_mod 2026-05-14 18:51:39.472846 | ubuntu-noble | +-a always,exit -F arch=b64 -S chown -F auid>=1000 -F auid!=-1 -k perm_mod 2026-05-14 18:51:39.472997 | ubuntu-noble | +-a always,exit -F arch=b64 -S fchmod -F auid>=1000 -F auid!=-1 -k perm_mod 2026-05-14 18:51:39.473099 | ubuntu-noble | +-a always,exit -F arch=b64 -S fchmodat -F auid>=1000 -F auid!=-1 -k perm_mod 2026-05-14 18:51:39.473206 | ubuntu-noble | +-a always,exit -F arch=b64 -S fchown -F auid>=1000 -F auid!=-1 -k perm_mod 2026-05-14 18:51:39.473308 | ubuntu-noble | +-a always,exit -F arch=b64 -S fchownat -F auid>=1000 -F auid!=-1 -k perm_mod 2026-05-14 18:51:39.473412 | ubuntu-noble | +-a always,exit -F arch=b64 -S fremovexattr -F auid>=1000 -F auid!=-1 -k perm_mod 2026-05-14 18:51:39.473517 | ubuntu-noble | +-a always,exit -F arch=b64 -S fsetxattr -F auid>=1000 -F auid!=-1 -k perm_mod 2026-05-14 18:51:39.473614 | ubuntu-noble | +-a always,exit -F arch=b64 -S lchown -F auid>=1000 -F auid!=-1 -k perm_mod 2026-05-14 18:51:39.473721 | ubuntu-noble | +-a always,exit -F arch=b64 -S lremovexattr -F auid>=1000 -F auid!=-1 -k perm_mod 2026-05-14 18:51:39.473824 | ubuntu-noble | +-a always,exit -F arch=b64 -S lsetxattr -F auid>=1000 -F auid!=-1 -k perm_mod 2026-05-14 18:51:39.474001 | ubuntu-noble | +-a always,exit -F arch=b64 -S removexattr -F auid>=1000 -F auid!=-1 -k perm_mod 2026-05-14 18:51:39.474084 | ubuntu-noble | +-a always,exit -F arch=b64 -S setxattr -F auid>=1000 -F auid!=-1 -k perm_mod 2026-05-14 18:51:39.474229 | ubuntu-noble | + 2026-05-14 18:51:39.474282 | ubuntu-noble | +# Special Rules --------------------------------------------------------------- 2026-05-14 18:51:39.474376 | ubuntu-noble | + 2026-05-14 18:51:39.474473 | ubuntu-noble | +## Reconnaissance 2026-05-14 18:51:39.474578 | ubuntu-noble | +-w /usr/bin/whoami -p x -k recon 2026-05-14 18:51:39.474674 | ubuntu-noble | +-w /usr/bin/id -p x -k recon 2026-05-14 18:51:39.474773 | ubuntu-noble | +-w /bin/hostname -p x -k recon 2026-05-14 18:51:39.474886 | ubuntu-noble | +-w /bin/uname -p x -k recon 2026-05-14 18:51:39.475006 | ubuntu-noble | +-w /etc/issue -p r -k recon 2026-05-14 18:51:39.475145 | ubuntu-noble | +-w /etc/hostname -p r -k recon 2026-05-14 18:51:39.475198 | ubuntu-noble | + 2026-05-14 18:51:39.475297 | ubuntu-noble | +## Suspicious activity 2026-05-14 18:51:39.475414 | ubuntu-noble | +-w /usr/bin/wget -p x -k susp_activity 2026-05-14 18:51:39.475502 | ubuntu-noble | +-w /usr/bin/curl -p x -k susp_activity 2026-05-14 18:51:39.475798 | ubuntu-noble | +-w /usr/bin/base64 -p x -k susp_activity 2026-05-14 18:51:39.475994 | ubuntu-noble | +-w /bin/nc -p x -k susp_activity 2026-05-14 18:51:39.476084 | ubuntu-noble | +-w /bin/netcat -p x -k susp_activity 2026-05-14 18:51:39.476193 | ubuntu-noble | +-w /usr/bin/ncat -p x -k susp_activity 2026-05-14 18:51:39.476283 | ubuntu-noble | +-w /usr/bin/ss -p x -k susp_activity 2026-05-14 18:51:39.476385 | ubuntu-noble | +-w /usr/bin/netstat -p x -k susp_activity 2026-05-14 18:51:39.476484 | ubuntu-noble | +-w /usr/bin/ssh -p x -k susp_activity 2026-05-14 18:51:39.476584 | ubuntu-noble | +-w /usr/bin/scp -p x -k susp_activity 2026-05-14 18:51:39.476684 | ubuntu-noble | +-w /usr/bin/sftp -p x -k susp_activity 2026-05-14 18:51:39.476788 | ubuntu-noble | +-w /usr/bin/ftp -p x -k susp_activity 2026-05-14 18:51:39.476985 | ubuntu-noble | +-w /usr/bin/socat -p x -k susp_activity 2026-05-14 18:51:39.477021 | ubuntu-noble | +-w /usr/bin/wireshark -p x -k susp_activity 2026-05-14 18:51:39.477124 | ubuntu-noble | +-w /usr/bin/tshark -p x -k susp_activity 2026-05-14 18:51:39.477229 | ubuntu-noble | +-w /usr/bin/rawshark -p x -k susp_activity 2026-05-14 18:51:39.477332 | ubuntu-noble | +-w /usr/bin/rdesktop -p x -k susp_activity 2026-05-14 18:51:39.477433 | ubuntu-noble | +-w /usr/local/bin/rdesktop -p x -k susp_activity 2026-05-14 18:51:39.477533 | ubuntu-noble | +-w /usr/bin/wlfreerdp -p x -k susp_activity 2026-05-14 18:51:39.477635 | ubuntu-noble | +-w /usr/bin/xfreerdp -p x -k susp_activity 2026-05-14 18:51:39.556732 | debian-bookworm | changed: [molecule-auditd] => {"changed": true, "cmd": ["augenrules", "--load"], "delta": "0:00:00.078456", "end": "2026-05-14 18:51:39.492645", "msg": "", "rc": 0, "start": "2026-05-14 18:51:39.414189", "stderr": "Unknown user: chrony\nThere was an error in line 24 of /etc/audit/audit.rules\nError sending add rule data request (No such file or directory)\nThere was an error in line 28 of /etc/audit/audit.rules\nUnknown user: ntp\nThere was an error in line 44 of /etc/audit/audit.rules\nError sending add rule data request (No such file or directory)\nThere was an error in line 83 of /etc/audit/audit.rules\nError sending add rule data request (No such file or directory)\nThere was an error in line 84 of /etc/audit/audit.rules\nError sending add rule data request (No such file or directory)\nThere was an error in line 112 of /etc/audit/audit.rules\nError sending add rule data request (No such file or directory)\nThere was an error in line 115 of /etc/audit/audit.rules\nError sending add rule data request (No such file or directory)\nThere was an error in line 176 of /etc/audit/audit.rules\nError sending add rule data request (No such file or directory)\nThere was an error in line 177 of /etc/audit/audit.rules\nError sending add rule data request (No such file or directory)\nThere was an error in line 178 of /etc/audit/audit.rules\nError sending add rule data request (No such file or directory)\nThere was an error in line 179 of /etc/audit/audit.rules\nError sending add rule data request (No such file or directory)\nThere was an error in line 180 of /etc/audit/audit.rules\nError sending add rule data request (No such file or directory)\nThere was an error in line 217 of /etc/audit/audit.rules\nError sending add rule data request (No such file or directory)\nThere was an error in line 218 of /etc/audit/audit.rules\nError sending add rule data request (No such file or directory)\nThere was an error in line 234 of /etc/audit/audit.rules\nError sending add rule data request (No such file or directory)\nThere was an error in line 285 of /etc/audit/audit.rules\nError sending add rule data request (No such file or directory)\nThere was an error in line 286 of /etc/audit/audit.rules\nError sending add rule data request (No such file or directory)\nThere was an error in line 324 of /etc/audit/audit.rules\nError sending add rule data request (No such file or directory)\nThere was an error in line 325 of /etc/audit/audit.rules\nError sending add rule data request (No such file or directory)\nThere was an error in line 346 of /etc/audit/audit.rules\nparameter passed without an option given\nThere was an error in line 347 of /etc/audit/audit.rules\nparameter passed without an option given\nThere was an error in line 348 of /etc/audit/audit.rules\nparameter passed without an option given\nThere was an error in line 349 of /etc/audit/audit.rules\nparameter passed without an option given\nThere was an error in line 350 of /etc/audit/audit.rules\nparameter passed without an option given\nThere was an error in line 351 of /etc/audit/audit.rules\nError sending add rule data request (No such file or directory)\nThere was an error in line 359 of /etc/audit/audit.rules", "stderr_lines": ["Unknown user: chrony", "There was an error in line 24 of /etc/audit/audit.rules", "Error sending add rule data request (No such file or directory)", "There was an error in line 28 of /etc/audit/audit.rules", "Unknown user: ntp", "There was an error in line 44 of /etc/audit/audit.rules", "Error sending add rule data request (No such file or directory)", "There was an error in line 83 of /etc/audit/audit.rules", "Error sending add rule data request (No such file or directory)", "There was an error in line 84 of /etc/audit/audit.rules", "Error sending add rule data request (No such file or directory)", "There was an error in line 112 of /etc/audit/audit.rules", "Error sending add rule data request (No such file or directory)", "There was an error in line 115 of /etc/audit/audit.rules", "Error sending add rule data request (No such file or directory)", "There was an error in line 176 of /etc/audit/audit.rules", "Error sending add rule data request (No such file or directory)", "There was an error in line 177 of /etc/audit/audit.rules", "Error sending add rule data request (No such file or directory)", "There was an error in line 178 of /etc/audit/audit.rules", "Error sending add rule data request (No such file or directory)", "There was an error in line 179 of /etc/audit/audit.rules", "Error sending add rule data request (No such file or directory)", "There was an error in line 180 of /etc/audit/audit.rules", "Error sending add rule data request (No such file or directory)", "There was an error in line 217 of /etc/audit/audit.rules", "Error sending add rule data request (No such file or directory)", "There was an error in line 218 of /etc/audit/audit.rules", "Error sending add rule data request (No such file or directory)", "There was an error in line 234 of /etc/audit/audit.rules", "Error sending add rule data request (No such file or directory)", "There was an error in line 285 of /etc/audit/audit.rules", "Error sending add rule data request (No such file or directory)", "There was an error in line 286 of /etc/audit/audit.rules", "Error sending add rule data request (No such file or directory)", "There was an error in line 324 of /etc/audit/audit.rules", "Error sending add rule data request (No such file or directory)", "There was an error in line 325 of /etc/audit/audit.rules", "Error sending add rule data request (No such file or directory)", "There was an error in line 346 of /etc/audit/audit.rules", "parameter passed without an option given", "There was an error in line 347 of /etc/audit/audit.rules", "parameter passed without an option given", "There was an error in line 348 of /etc/audit/audit.rules", "parameter passed without an option given", "There was an error in line 349 of /etc/audit/audit.rules", "parameter passed without an option given", "There was an error in line 350 of /etc/audit/audit.rules", "parameter passed without an option given", "There was an error in line 351 of /etc/audit/audit.rules", "Error sending add rule data request (No such file or directory)", "There was an error in line 359 of /etc/audit/audit.rules"], "stdout": "/usr/sbin/augenrules: No change\nNo rules\nenabled 1\nfailure 1\npid 2689\nrate_limit 0\nbacklog_limit 8192\nlost 0\nbacklog 1013\nbacklog_wait_time 60000\nbacklog_wait_time_actual 0\nenabled 1\nfailure 1\npid 2689\nrate_limit 0\nbacklog_limit 8192\nlost 0\nbacklog 998\nbacklog_wait_time 60000\nbacklog_wait_time_actual 0", "stdout_lines": ["/usr/sbin/augenrules: No change", "No rules", "enabled 1", "failure 1", "pid 2689", "rate_limit 0", "backlog_limit 8192", "lost 0", "backlog 1013", "backlog_wait_time 60000", "backlog_wait_time_actual 0", "enabled 1", "failure 1", "pid 2689", "rate_limit 0", "backlog_limit 8192", "lost 0", "backlog 998", "backlog_wait_time 60000", "backlog_wait_time_actual 0"]} 2026-05-14 18:51:39.556838 | debian-bookworm | 2026-05-14 18:51:39.556855 | debian-bookworm | RUNNING HANDLER [auditd : Restart auditd service] ****************************** 2026-05-14 18:51:39.477750 | ubuntu-noble | +-w /usr/local/bin/xfreerdp -p x -k susp_activity 2026-05-14 18:51:39.477852 | ubuntu-noble | +-w /usr/bin/nmap -p x -k susp_activity 2026-05-14 18:51:39.478176 | ubuntu-noble | + 2026-05-14 18:51:39.478190 | ubuntu-noble | +## sssd 2026-05-14 18:51:39.478197 | ubuntu-noble | +-a always,exit -F path=/usr/libexec/sssd/p11_child -F perm=x -F auid>=500 -F auid!=4294967295 -k T1078_Valid_Accounts 2026-05-14 18:51:39.478308 | ubuntu-noble | +-a always,exit -F path=/usr/libexec/sssd/krb5_child -F perm=x -F auid>=500 -F auid!=4294967295 -k T1078_Valid_Accounts 2026-05-14 18:51:39.478414 | ubuntu-noble | +-a always,exit -F path=/usr/libexec/sssd/ldap_child -F perm=x -F auid>=500 -F auid!=4294967295 -k T1078_Valid_Accounts 2026-05-14 18:51:39.478519 | ubuntu-noble | +-a always,exit -F path=/usr/libexec/sssd/selinux_child -F perm=x -F auid>=500 -F auid!=4294967295 -k T1078_Valid_Accounts 2026-05-14 18:51:39.478627 | ubuntu-noble | +-a always,exit -F path=/usr/libexec/sssd/proxy_child -F perm=x -F auid>=500 -F auid!=4294967295 -k T1078_Valid_Accounts 2026-05-14 18:51:39.478718 | ubuntu-noble | + 2026-05-14 18:51:39.478818 | ubuntu-noble | +## T1002 Data Compressed 2026-05-14 18:51:39.478944 | ubuntu-noble | + 2026-05-14 18:51:39.479075 | ubuntu-noble | +-w /usr/bin/zip -p x -k Data_Compressed 2026-05-14 18:51:39.479178 | ubuntu-noble | +-w /usr/bin/gzip -p x -k Data_Compressed 2026-05-14 18:51:39.479277 | ubuntu-noble | +-w /usr/bin/tar -p x -k Data_Compressed 2026-05-14 18:51:39.479380 | ubuntu-noble | +-w /usr/bin/bzip2 -p x -k Data_Compressed 2026-05-14 18:51:39.479476 | ubuntu-noble | + 2026-05-14 18:51:39.479575 | ubuntu-noble | +-w /usr/bin/lzip -p x -k Data_Compressed 2026-05-14 18:51:39.479675 | ubuntu-noble | +-w /usr/local/bin/lzip -p x -k Data_Compressed 2026-05-14 18:51:39.479769 | ubuntu-noble | + 2026-05-14 18:51:39.479903 | ubuntu-noble | +-w /usr/bin/lz4 -p x -k Data_Compressed 2026-05-14 18:51:39.481025 | ubuntu-noble | +-w /usr/local/bin/lz4 -p x -k Data_Compressed 2026-05-14 18:51:39.481049 | ubuntu-noble | + 2026-05-14 18:51:39.481054 | ubuntu-noble | +-w /usr/bin/lzop -p x -k Data_Compressed 2026-05-14 18:51:39.481057 | ubuntu-noble | +-w /usr/local/bin/lzop -p x -k Data_Compressed 2026-05-14 18:51:39.481061 | ubuntu-noble | + 2026-05-14 18:51:39.481065 | ubuntu-noble | +-w /usr/bin/plzip -p x -k Data_Compressed 2026-05-14 18:51:39.481068 | ubuntu-noble | +-w /usr/local/bin/plzip -p x -k Data_Compressed 2026-05-14 18:51:39.481072 | ubuntu-noble | + 2026-05-14 18:51:39.481075 | ubuntu-noble | +-w /usr/bin/pbzip2 -p x -k Data_Compressed 2026-05-14 18:51:39.481089 | ubuntu-noble | +-w /usr/local/bin/pbzip2 -p x -k Data_Compressed 2026-05-14 18:51:39.481096 | ubuntu-noble | + 2026-05-14 18:51:39.481183 | ubuntu-noble | +-w /usr/bin/lbzip2 -p x -k Data_Compressed 2026-05-14 18:51:39.481320 | ubuntu-noble | +-w /usr/local/bin/lbzip2 -p x -k Data_Compressed 2026-05-14 18:51:39.481380 | ubuntu-noble | + 2026-05-14 18:51:39.481483 | ubuntu-noble | +-w /usr/bin/pixz -p x -k Data_Compressed 2026-05-14 18:51:39.481584 | ubuntu-noble | +-w /usr/local/bin/pixz -p x -k Data_Compressed 2026-05-14 18:51:39.481678 | ubuntu-noble | + 2026-05-14 18:51:39.481799 | ubuntu-noble | +-w /usr/bin/pigz -p x -k Data_Compressed 2026-05-14 18:51:39.481977 | ubuntu-noble | +-w /usr/local/bin/pigz -p x -k Data_Compressed 2026-05-14 18:51:39.482121 | ubuntu-noble | +-w /usr/bin/unpigz -p x -k Data_Compressed 2026-05-14 18:51:39.482169 | ubuntu-noble | +-w /usr/local/bin/unpigz -p x -k Data_Compressed 2026-05-14 18:51:39.482391 | ubuntu-noble | + 2026-05-14 18:51:39.482398 | ubuntu-noble | +-w /usr/bin/zstd -p x -k Data_Compressed 2026-05-14 18:51:39.482463 | ubuntu-noble | +-w /usr/local/bin/zstd -p x -k Data_Compressed 2026-05-14 18:51:39.482557 | ubuntu-noble | + 2026-05-14 18:51:39.482996 | ubuntu-noble | +## Added to catch netcat on Ubuntu 2026-05-14 18:51:39.483014 | ubuntu-noble | +-w /bin/nc.openbsd -p x -k susp_activity 2026-05-14 18:51:39.483018 | ubuntu-noble | +-w /bin/nc.traditional -p x -k susp_activity 2026-05-14 18:51:39.483022 | ubuntu-noble | + 2026-05-14 18:51:39.483068 | ubuntu-noble | +## Sbin suspicious activity 2026-05-14 18:51:39.483169 | ubuntu-noble | +-w /sbin/iptables -p x -k sbin_susp 2026-05-14 18:51:39.483282 | ubuntu-noble | +-w /sbin/ip6tables -p x -k sbin_susp 2026-05-14 18:51:39.483368 | ubuntu-noble | +-w /sbin/ifconfig -p x -k sbin_susp 2026-05-14 18:51:39.483472 | ubuntu-noble | +-w /usr/sbin/arptables -p x -k sbin_susp 2026-05-14 18:51:39.483572 | ubuntu-noble | +-w /usr/sbin/ebtables -p x -k sbin_susp 2026-05-14 18:51:39.483668 | ubuntu-noble | +-w /sbin/xtables-nft-multi -p x -k sbin_susp 2026-05-14 18:51:39.483768 | ubuntu-noble | +-w /usr/sbin/nft -p x -k sbin_susp 2026-05-14 18:51:39.483904 | ubuntu-noble | +-w /usr/sbin/tcpdump -p x -k sbin_susp 2026-05-14 18:51:39.483992 | ubuntu-noble | +-w /usr/sbin/traceroute -p x -k sbin_susp 2026-05-14 18:51:39.484090 | ubuntu-noble | +-w /usr/sbin/ufw -p x -k sbin_susp 2026-05-14 18:51:39.484299 | ubuntu-noble | + 2026-05-14 18:51:39.484308 | ubuntu-noble | +### kde4 2026-05-14 18:51:39.484417 | ubuntu-noble | +-a always,exit -F path=/usr/libexec/kde4/kpac_dhcp_helper -F perm=x -F auid>=1000 -F auid!=4294967295 -k T1078_Valid_Accounts 2026-05-14 18:51:39.484496 | ubuntu-noble | +-a always,exit -F path=/usr/libexec/kde4/kdesud -F perm=x -F auid>=1000 -F auid!=4294967295 -k T1078_Valid_Accounts 2026-05-14 18:51:39.484590 | ubuntu-noble | + 2026-05-14 18:51:39.484690 | ubuntu-noble | +## dbus-send invocation 2026-05-14 18:51:39.484793 | ubuntu-noble | +### may indicate privilege escalation CVE-2021-3560 2026-05-14 18:51:39.484933 | ubuntu-noble | +-w /usr/bin/dbus-send -p x -k dbus_send 2026-05-14 18:51:39.485077 | ubuntu-noble | +-w /usr/bin/gdbus -p x -k gdubs_call 2026-05-14 18:51:39.485240 | ubuntu-noble | + 2026-05-14 18:51:39.485250 | ubuntu-noble | +## pkexec invocation 2026-05-14 18:51:39.485411 | ubuntu-noble | +### may indicate privilege escalation CVE-2021-4034 2026-05-14 18:51:39.486758 | ubuntu-noble | +-w /usr/bin/pkexec -p x -k pkexec 2026-05-14 18:51:39.486963 | ubuntu-noble | + 2026-05-14 18:51:39.487094 | ubuntu-noble | +## Suspicious shells 2026-05-14 18:51:39.487202 | ubuntu-noble | +-w /bin/ash -p x -k susp_shell 2026-05-14 18:51:39.487294 | ubuntu-noble | +-w /bin/csh -p x -k susp_shell 2026-05-14 18:51:39.487393 | ubuntu-noble | +-w /bin/fish -p x -k susp_shell 2026-05-14 18:51:39.487495 | ubuntu-noble | +-w /bin/tcsh -p x -k susp_shell 2026-05-14 18:51:39.487594 | ubuntu-noble | +-w /bin/tclsh -p x -k susp_shell 2026-05-14 18:51:39.487693 | ubuntu-noble | +-w /bin/xonsh -p x -k susp_shell 2026-05-14 18:51:39.487796 | ubuntu-noble | +-w /usr/local/bin/xonsh -p x -k susp_shell 2026-05-14 18:51:39.487920 | ubuntu-noble | +-w /bin/open -p x -k susp_shell 2026-05-14 18:51:39.488499 | ubuntu-noble | +-w /bin/rbash -p x -k susp_shell 2026-05-14 18:51:39.488511 | ubuntu-noble | + 2026-05-14 18:51:39.488994 | ubuntu-noble | +# Web Server Actvity 2026-05-14 18:51:39.489013 | ubuntu-noble | +## Change the number "33" to the ID of your WebServer user. Default: www-data:x:33:33 2026-05-14 18:51:39.489018 | ubuntu-noble | +-a always,exit -F arch=b64 -S execve -F euid=33 -k detect_execve_www 2026-05-14 18:51:39.489022 | ubuntu-noble | + 2026-05-14 18:51:39.489029 | ubuntu-noble | +### https://clustershell.readthedocs.io/ 2026-05-14 18:51:39.489112 | ubuntu-noble | +-w /bin/clush -p x -k susp_shell 2026-05-14 18:51:39.489212 | ubuntu-noble | +-w /usr/local/bin/clush -p x -k susp_shell 2026-05-14 18:51:39.489312 | ubuntu-noble | +-w /etc/clustershell/clush.conf -p x -k susp_shell 2026-05-14 18:51:39.489407 | ubuntu-noble | + 2026-05-14 18:51:39.489508 | ubuntu-noble | +### https://github.com/tmux/tmux 2026-05-14 18:51:39.489603 | ubuntu-noble | +-w /bin/tmux -p x -k susp_shell 2026-05-14 18:51:39.489702 | ubuntu-noble | +-w /usr/local/bin/tmux -p x -k susp_shell 2026-05-14 18:51:39.489801 | ubuntu-noble | + 2026-05-14 18:51:39.489931 | ubuntu-noble | +## Shell/profile configurations 2026-05-14 18:51:39.490079 | ubuntu-noble | +-w /etc/profile.d/ -p wa -k shell_profiles 2026-05-14 18:51:39.490182 | ubuntu-noble | +-w /etc/profile -p wa -k shell_profiles 2026-05-14 18:51:39.490278 | ubuntu-noble | +-w /etc/shells -p wa -k shell_profiles 2026-05-14 18:51:39.490376 | ubuntu-noble | +-w /etc/bashrc -p wa -k shell_profiles 2026-05-14 18:51:39.490477 | ubuntu-noble | +-w /etc/csh.cshrc -p wa -k shell_profiles 2026-05-14 18:51:39.490989 | ubuntu-noble | +-w /etc/csh.login -p wa -k shell_profiles 2026-05-14 18:51:39.491006 | ubuntu-noble | +-w /etc/fish/ -p wa -k shell_profiles 2026-05-14 18:51:39.491010 | ubuntu-noble | +-w /etc/zsh/ -p wa -k shell_profiles 2026-05-14 18:51:39.491014 | ubuntu-noble | + 2026-05-14 18:51:39.491017 | ubuntu-noble | +### https://github.com/xxh/xxh 2026-05-14 18:51:39.491091 | ubuntu-noble | +-w /usr/local/bin/xxh.bash -p x -k susp_shell 2026-05-14 18:51:39.491191 | ubuntu-noble | +-w /usr/local/bin/xxh.xsh -p x -k susp_shell 2026-05-14 18:51:39.491289 | ubuntu-noble | +-w /usr/local/bin/xxh.zsh -p x -k susp_shell 2026-05-14 18:51:39.491384 | ubuntu-noble | + 2026-05-14 18:51:39.491483 | ubuntu-noble | +## Injection 2026-05-14 18:51:39.491587 | ubuntu-noble | +### These rules watch for code injection by the ptrace facility. 2026-05-14 18:51:39.491686 | ubuntu-noble | +### This could indicate someone trying to do something bad or just debugging 2026-05-14 18:51:39.491791 | ubuntu-noble | +-a always,exit -F arch=b64 -S ptrace -F a0=0x4 -k code_injection 2026-05-14 18:51:39.491907 | ubuntu-noble | +-a always,exit -F arch=b64 -S ptrace -F a0=0x5 -k data_injection 2026-05-14 18:51:39.492340 | ubuntu-noble | +-a always,exit -F arch=b64 -S ptrace -F a0=0x6 -k register_injection 2026-05-14 18:51:39.492356 | ubuntu-noble | +-a always,exit -F arch=b64 -S ptrace -k tracing 2026-05-14 18:51:39.492360 | ubuntu-noble | + 2026-05-14 18:51:39.492363 | ubuntu-noble | +## Anonymous File Creation 2026-05-14 18:51:39.492424 | ubuntu-noble | +### These rules watch the use of memfd_create 2026-05-14 18:51:39.492523 | ubuntu-noble | +### "memfd_create" creates anonymous file and returns a file descriptor to access it 2026-05-14 18:51:39.492629 | ubuntu-noble | +### When combined with "fexecve" can be used to stealthily run binaries in memory without touching disk 2026-05-14 18:51:39.492730 | ubuntu-noble | +-a always,exit -F arch=b64 -S memfd_create -F key=anon_file_create 2026-05-14 18:51:39.492824 | ubuntu-noble | + 2026-05-14 18:51:39.492980 | ubuntu-noble | +## Privilege Abuse 2026-05-14 18:51:39.493107 | ubuntu-noble | +### The purpose of this rule is to detect when an admin may be abusing power by looking in user's home dir. 2026-05-14 18:51:39.493213 | ubuntu-noble | +-a always,exit -F dir=/home -F uid=0 -F auid>=1000 -F auid!=-1 -C auid!=obj_uid -k power_abuse 2026-05-14 18:51:39.493310 | ubuntu-noble | + 2026-05-14 18:51:39.493424 | ubuntu-noble | +# Socket Creations 2026-05-14 18:51:39.493564 | ubuntu-noble | +# will catch both IPv4 and IPv6 2026-05-14 18:51:39.493689 | ubuntu-noble | + 2026-05-14 18:51:39.493793 | ubuntu-noble | +-a always,exit -F arch=b32 -S socket -F a0=2 -k network_socket_created 2026-05-14 18:51:39.494085 | ubuntu-noble | +-a always,exit -F arch=b64 -S socket -F a0=2 -k network_socket_created 2026-05-14 18:51:39.494100 | ubuntu-noble | + 2026-05-14 18:51:39.494138 | ubuntu-noble | +-a always,exit -F arch=b32 -S socket -F a0=10 -k network_socket_created 2026-05-14 18:51:39.494241 | ubuntu-noble | +-a always,exit -F arch=b64 -S socket -F a0=10 -k network_socket_created 2026-05-14 18:51:39.494334 | ubuntu-noble | + 2026-05-14 18:51:39.494434 | ubuntu-noble | +# Software Management --------------------------------------------------------- 2026-05-14 18:51:39.494528 | ubuntu-noble | + 2026-05-14 18:51:39.494625 | ubuntu-noble | +# RPM (Redhat/CentOS) 2026-05-14 18:51:39.494726 | ubuntu-noble | +-w /usr/bin/rpm -p x -k software_mgmt 2026-05-14 18:51:39.494985 | ubuntu-noble | +-w /usr/bin/yum -p x -k software_mgmt 2026-05-14 18:51:39.495001 | ubuntu-noble | + 2026-05-14 18:51:39.495053 | ubuntu-noble | +# DNF (Fedora/RedHat 8/CentOS 8) 2026-05-14 18:51:39.495155 | ubuntu-noble | +-w /usr/bin/dnf -p x -k software_mgmt 2026-05-14 18:51:39.495246 | ubuntu-noble | + 2026-05-14 18:51:39.495349 | ubuntu-noble | +# YAST/Zypper/RPM (SuSE) 2026-05-14 18:51:39.495490 | ubuntu-noble | +-w /sbin/yast -p x -k software_mgmt 2026-05-14 18:51:39.495604 | ubuntu-noble | +-w /sbin/yast2 -p x -k software_mgmt 2026-05-14 18:51:39.495706 | ubuntu-noble | +-w /bin/rpm -p x -k software_mgmt 2026-05-14 18:51:39.497990 | ubuntu-noble | +-w /usr/bin/zypper -k software_mgmt 2026-05-14 18:51:39.498020 | ubuntu-noble | + 2026-05-14 18:51:39.498027 | ubuntu-noble | +# DPKG / APT-GET (Debian/Ubuntu) 2026-05-14 18:51:39.498033 | ubuntu-noble | +-w /usr/bin/dpkg -p x -k software_mgmt 2026-05-14 18:51:39.498038 | ubuntu-noble | +-w /usr/bin/apt -p x -k software_mgmt 2026-05-14 18:51:39.498043 | ubuntu-noble | +-w /usr/bin/apt-add-repository -p x -k software_mgmt 2026-05-14 18:51:39.498049 | ubuntu-noble | +-w /usr/bin/apt-get -p x -k software_mgmt 2026-05-14 18:51:39.498054 | ubuntu-noble | +-w /usr/bin/aptitude -p x -k software_mgmt 2026-05-14 18:51:39.498060 | ubuntu-noble | +-w /usr/bin/wajig -p x -k software_mgmt 2026-05-14 18:51:39.498065 | ubuntu-noble | +-w /usr/bin/snap -p x -k software_mgmt 2026-05-14 18:51:39.498071 | ubuntu-noble | + 2026-05-14 18:51:39.498076 | ubuntu-noble | +# PIP(3) (Python installs) 2026-05-14 18:51:39.498082 | ubuntu-noble | +-w /usr/bin/pip -p x -k third_party_software_mgmt 2026-05-14 18:51:39.498088 | ubuntu-noble | +-w /usr/local/bin/pip -p x -k third_party_software_mgmt 2026-05-14 18:51:39.498094 | ubuntu-noble | +-w /usr/bin/pip3 -p x -k third_party_software_mgmt 2026-05-14 18:51:39.498099 | ubuntu-noble | +-w /usr/local/bin/pip3 -p x -k third_party_software_mgmt 2026-05-14 18:51:39.498105 | ubuntu-noble | +-w /usr/bin/pipx -p x -k third_party_software_mgmt 2026-05-14 18:51:39.498111 | ubuntu-noble | +-w /usr/local/bin/pipx -p x -k third_party_software_mgmt 2026-05-14 18:51:39.498119 | ubuntu-noble | + 2026-05-14 18:51:39.498176 | ubuntu-noble | +# npm 2026-05-14 18:51:39.498328 | ubuntu-noble | +## T1072 third party software 2026-05-14 18:51:39.498477 | ubuntu-noble | +## https://www.npmjs.com 2026-05-14 18:51:39.498634 | ubuntu-noble | +## https://docs.npmjs.com/cli/v6/commands/npm-audit 2026-05-14 18:51:39.498801 | ubuntu-noble | +-w /usr/bin/npm -p x -k third_party_software_mgmt 2026-05-14 18:51:39.498974 | ubuntu-noble | + 2026-05-14 18:51:39.499133 | ubuntu-noble | +# Comprehensive Perl Archive Network (CPAN) (CPAN installs) 2026-05-14 18:51:39.499287 | ubuntu-noble | +## T1072 third party software 2026-05-14 18:51:39.499436 | ubuntu-noble | +## https://www.cpan.org 2026-05-14 18:51:39.499586 | ubuntu-noble | +-w /usr/bin/cpan -p x -k third_party_software_mgmt 2026-05-14 18:51:39.499720 | ubuntu-noble | + 2026-05-14 18:51:39.499898 | ubuntu-noble | +# Ruby (RubyGems installs) 2026-05-14 18:51:39.500080 | ubuntu-noble | +## T1072 third party software 2026-05-14 18:51:39.500225 | ubuntu-noble | +## https://rubygems.org 2026-05-14 18:51:39.500375 | ubuntu-noble | +-w /usr/bin/gem -p x -k third_party_software_mgmt 2026-05-14 18:51:39.500514 | ubuntu-noble | + 2026-05-14 18:51:39.500653 | ubuntu-noble | +# LuaRocks (Lua installs) 2026-05-14 18:51:39.500807 | ubuntu-noble | +## T1072 third party software 2026-05-14 18:51:39.501032 | ubuntu-noble | +## https://luarocks.org 2026-05-14 18:51:39.501196 | ubuntu-noble | +-w /usr/bin/luarocks -p x -k third_party_software_mgmt 2026-05-14 18:51:39.501327 | ubuntu-noble | + 2026-05-14 18:51:39.501471 | ubuntu-noble | +# Pacman (Arch Linux) 2026-05-14 18:51:39.501628 | ubuntu-noble | +## https://wiki.archlinux.org/title/Pacman 2026-05-14 18:51:39.501773 | ubuntu-noble | +## T1072 third party software 2026-05-14 18:51:39.501995 | ubuntu-noble | +-w /etc/pacman.conf -p x -k third_party_software_mgmt 2026-05-14 18:51:39.502159 | ubuntu-noble | +-w /etc/pacman.d -p x -k third_party_software_mgmt 2026-05-14 18:51:39.502294 | ubuntu-noble | + 2026-05-14 18:51:39.502445 | ubuntu-noble | +# Special Software ------------------------------------------------------------ 2026-05-14 18:51:39.502582 | ubuntu-noble | + 2026-05-14 18:51:39.502721 | ubuntu-noble | +## GDS specific secrets 2026-05-14 18:51:39.502881 | ubuntu-noble | +-w /etc/puppet/ssl -p wa -k puppet_ssl 2026-05-14 18:51:39.503036 | ubuntu-noble | + 2026-05-14 18:51:39.503597 | ubuntu-noble | +## IBM Bigfix BESClient 2026-05-14 18:51:39.503611 | ubuntu-noble | +-a always,exit -F arch=b64 -S open -F dir=/opt/BESClient -F success=0 -k soft_besclient 2026-05-14 18:51:39.503614 | ubuntu-noble | +-w /var/opt/BESClient/ -p wa -k soft_besclient 2026-05-14 18:51:39.503638 | ubuntu-noble | + 2026-05-14 18:51:39.503792 | ubuntu-noble | +## CHEF https://www.chef.io/chef/ 2026-05-14 18:51:39.504024 | ubuntu-noble | +-w /etc/chef -p wa -k soft_chef 2026-05-14 18:51:39.504161 | ubuntu-noble | + 2026-05-14 18:51:39.504303 | ubuntu-noble | +## Salt 2026-05-14 18:51:39.504448 | ubuntu-noble | +## https://saltproject.io/ 2026-05-14 18:51:39.504599 | ubuntu-noble | +## https://docs.saltproject.io/en/latest/ref/configuration/master.html 2026-05-14 18:51:39.504743 | ubuntu-noble | +-w /etc/salt -p wa -k soft_salt 2026-05-14 18:51:39.504905 | ubuntu-noble | +-w /usr/local/etc/salt -p wa -k soft_salt 2026-05-14 18:51:39.505064 | ubuntu-noble | + 2026-05-14 18:51:39.505208 | ubuntu-noble | +## Otter 2026-05-14 18:51:39.505358 | ubuntu-noble | +## https://inedo.com/otter 2026-05-14 18:51:39.505502 | ubuntu-noble | +-w /etc/otter -p wa -k soft_otter 2026-05-14 18:51:39.505640 | ubuntu-noble | + 2026-05-14 18:51:39.505787 | ubuntu-noble | +## T1081 Credentials In Files 2026-05-14 18:51:39.506012 | ubuntu-noble | +-w /usr/bin/grep -p x -k string_search 2026-05-14 18:51:39.506175 | ubuntu-noble | +-w /usr/bin/egrep -p x -k string_search 2026-05-14 18:51:39.506333 | ubuntu-noble | +-w /usr/bin/ugrep -p x -k string_search 2026-05-14 18:51:39.506478 | ubuntu-noble | +### macOS 2026-05-14 18:51:39.506630 | ubuntu-noble | +-w /usr/local/bin/grep -p x -k string_search 2026-05-14 18:51:39.506787 | ubuntu-noble | +-w /usr/local/bin/egrep -p x -k string_search 2026-05-14 18:51:39.507935 | ubuntu-noble | +-w /usr/local/bin/ugrep -p x -k string_search 2026-05-14 18:51:39.507965 | ubuntu-noble | + 2026-05-14 18:51:39.507969 | ubuntu-noble | +### https://github.com/tmbinc/bgrep 2026-05-14 18:51:39.507972 | ubuntu-noble | +-w /usr/bin/bgrep -p x -k string_search 2026-05-14 18:51:39.507976 | ubuntu-noble | +### macOS 2026-05-14 18:51:39.507979 | ubuntu-noble | +-w /usr/local/bin/bgrep -p x -k string_search 2026-05-14 18:51:39.507982 | ubuntu-noble | + 2026-05-14 18:51:39.507988 | ubuntu-noble | +### https://github.com/BurntSushi/ripgrep 2026-05-14 18:51:39.508151 | ubuntu-noble | +-w /usr/bin/rg -p x -k string_search 2026-05-14 18:51:39.508290 | ubuntu-noble | +### macOS 2026-05-14 18:51:39.508435 | ubuntu-noble | +-w /usr/local/bin/rg -p x -k string_search 2026-05-14 18:51:39.508571 | ubuntu-noble | + 2026-05-14 18:51:39.508718 | ubuntu-noble | +### https://github.com/awgn/cgrep 2026-05-14 18:51:39.508895 | ubuntu-noble | + 2026-05-14 18:51:39.509057 | ubuntu-noble | +-w /usr/bin/cgrep -p x -k string_search 2026-05-14 18:51:39.509200 | ubuntu-noble | +### macOS 2026-05-14 18:51:39.509346 | ubuntu-noble | +-w /usr/local/bin/cgrep -p x -k string_search 2026-05-14 18:51:39.509487 | ubuntu-noble | + 2026-05-14 18:51:39.509644 | ubuntu-noble | +### https://github.com/jpr5/ngrep 2026-05-14 18:51:39.509791 | ubuntu-noble | +-w /usr/bin/ngrep -p x -k string_search 2026-05-14 18:51:39.509965 | ubuntu-noble | +### macOS 2026-05-14 18:51:39.510125 | ubuntu-noble | +-w /usr/local/bin/ngrep -p x -k string_search 2026-05-14 18:51:39.510264 | ubuntu-noble | + 2026-05-14 18:51:39.510413 | ubuntu-noble | +### https://github.com/vrothberg/vgrep 2026-05-14 18:51:39.510559 | ubuntu-noble | +-w /usr/bin/vgrep -p x -k string_search 2026-05-14 18:51:39.510700 | ubuntu-noble | +### macOS 2026-05-14 18:51:39.510850 | ubuntu-noble | +-w /usr/local/bin/vgrep -p x -k string_search 2026-05-14 18:51:39.511034 | ubuntu-noble | + 2026-05-14 18:51:39.511195 | ubuntu-noble | +### https://github.com/monochromegane/the_platinum_searcher 2026-05-14 18:51:39.511348 | ubuntu-noble | +-w /usr/bin/pt -p x -k string_search 2026-05-14 18:51:39.511491 | ubuntu-noble | +### macOS 2026-05-14 18:51:39.511641 | ubuntu-noble | +-w /usr/local/bin/pt -p x -k string_search 2026-05-14 18:51:39.511778 | ubuntu-noble | + 2026-05-14 18:51:39.511992 | ubuntu-noble | +### https://github.com/gvansickle/ucg 2026-05-14 18:51:39.512150 | ubuntu-noble | +-w /usr/bin/ucg -p x -k string_search 2026-05-14 18:51:39.512291 | ubuntu-noble | +### macOS 2026-05-14 18:51:39.512434 | ubuntu-noble | +-w /usr/local/bin/ucg -p x -k string_search 2026-05-14 18:51:39.512563 | ubuntu-noble | + 2026-05-14 18:51:39.512750 | ubuntu-noble | +### https://github.com/ggreer/the_silver_searcher 2026-05-14 18:51:39.512856 | ubuntu-noble | +-w /usr/bin/ag -p x -k string_search 2026-05-14 18:51:39.513036 | ubuntu-noble | +### macOS 2026-05-14 18:51:39.513181 | ubuntu-noble | +-w /usr/local/bin/ag -p x -k string_search 2026-05-14 18:51:39.513316 | ubuntu-noble | + 2026-05-14 18:51:39.513468 | ubuntu-noble | +### https://github.com/beyondgrep/ack3 2026-05-14 18:51:39.513616 | ubuntu-noble | +### https://beyondgrep.com 2026-05-14 18:51:39.513761 | ubuntu-noble | +-w /usr/bin/ack -p x -k string_search 2026-05-14 18:51:39.513934 | ubuntu-noble | +-w /usr/local/bin/ack -p x -k string_search 2026-05-14 18:51:39.514147 | ubuntu-noble | +-w /usr/bin/semgrep -p x -k string_search 2026-05-14 18:51:39.514341 | ubuntu-noble | +### macOS 2026-05-14 18:51:39.514457 | ubuntu-noble | +-w /usr/local/bin/semgrep -p x -k string_search 2026-05-14 18:51:39.514606 | ubuntu-noble | + 2026-05-14 18:51:39.514758 | ubuntu-noble | +## Docker 2026-05-14 18:51:39.514974 | ubuntu-noble | +-w /usr/bin/dockerd -k docker 2026-05-14 18:51:39.515141 | ubuntu-noble | +-w /usr/bin/docker -k docker 2026-05-14 18:51:39.515245 | ubuntu-noble | +-w /usr/bin/docker-containerd -k docker 2026-05-14 18:51:39.515345 | ubuntu-noble | +-w /usr/bin/docker-runc -k docker 2026-05-14 18:51:39.515480 | ubuntu-noble | +-w /var/lib/docker -p wa -k docker 2026-05-14 18:51:39.515542 | ubuntu-noble | +-w /etc/docker -k docker 2026-05-14 18:51:39.515643 | ubuntu-noble | +-w /etc/sysconfig/docker -k docker 2026-05-14 18:51:39.515743 | ubuntu-noble | +-w /etc/sysconfig/docker-storage -k docker 2026-05-14 18:51:39.515844 | ubuntu-noble | +-w /usr/lib/systemd/system/docker.service -k docker 2026-05-14 18:51:39.515991 | ubuntu-noble | +-w /usr/lib/systemd/system/docker.socket -k docker 2026-05-14 18:51:39.516088 | ubuntu-noble | + 2026-05-14 18:51:39.516188 | ubuntu-noble | +## Virtualization stuff 2026-05-14 18:51:39.516288 | ubuntu-noble | +-w /usr/bin/qemu-system-x86_64 -p x -k qemu-system-x86_64 2026-05-14 18:51:39.516388 | ubuntu-noble | +-w /usr/bin/qemu-img -p x -k qemu-img 2026-05-14 18:51:39.516489 | ubuntu-noble | +-w /usr/bin/qemu-kvm -p x -k qemu-kvm 2026-05-14 18:51:39.516585 | ubuntu-noble | +-w /usr/bin/qemu -p x -k qemu 2026-05-14 18:51:39.516685 | ubuntu-noble | +-w /usr/bin/virtualbox -p x -k virtualbox 2026-05-14 18:51:39.516785 | ubuntu-noble | +-w /usr/bin/virt-manager -p x -k virt-manager 2026-05-14 18:51:39.516892 | ubuntu-noble | +-w /usr/bin/VBoxManage -p x -k VBoxManage 2026-05-14 18:51:39.517016 | ubuntu-noble | + 2026-05-14 18:51:39.517114 | ubuntu-noble | +#### VirtualBox on macOS 2026-05-14 18:51:39.517205 | ubuntu-noble | + 2026-05-14 18:51:39.517310 | ubuntu-noble | +-w /usr/local/bin/VirtualBox -p x -k virt_tool 2026-05-14 18:51:39.517445 | ubuntu-noble | +-w /usr/local/bin/VirtualBoxVM -p x -k virt_tool 2026-05-14 18:51:39.517581 | ubuntu-noble | +-w /usr/local/bin/VBoxManage -p x -k virt_tool 2026-05-14 18:51:39.517689 | ubuntu-noble | +-w /usr/local/bin/VBoxVRDP -p x -k virt_tool 2026-05-14 18:51:39.517791 | ubuntu-noble | +-w /usr/local/bin/VBoxHeadless -p x -k virt_tool 2026-05-14 18:51:39.517932 | ubuntu-noble | +-w /usr/local/bin/vboxwebsrv -p x -k virt_tool 2026-05-14 18:51:39.518059 | ubuntu-noble | +-w /usr/local/bin/VBoxBugReport -p x -k virt_tool 2026-05-14 18:51:39.518162 | ubuntu-noble | +-w /usr/local/bin/VBoxBalloonCtrl -p x -k virt_tool 2026-05-14 18:51:39.518261 | ubuntu-noble | +-w /usr/local/bin/VBoxAutostart -p x -k virt_tool 2026-05-14 18:51:39.518362 | ubuntu-noble | +-w /usr/local/bin/VBoxDTrace -p x -k virt_tool 2026-05-14 18:51:39.518463 | ubuntu-noble | +-w /usr/local/bin/vbox-img -p x -k virt_tool 2026-05-14 18:51:39.518570 | ubuntu-noble | +-w /Library/LaunchDaemons/org.virtualbox.startup.plist -p x -k virt_tool 2026-05-14 18:51:39.518712 | ubuntu-noble | +-w /Library/Application Support/VirtualBox/LaunchDaemons/ -p x -k virt_tool 2026-05-14 18:51:39.518800 | ubuntu-noble | +-w /Library/Application Support/VirtualBox/VBoxDrv.kext/ -p x -k virt_tool 2026-05-14 18:51:39.518939 | ubuntu-noble | +-w /Library/Application Support/VirtualBox/VBoxUSB.kext/ -p x -k virt_tool 2026-05-14 18:51:39.519105 | ubuntu-noble | +-w /Library/Application Support/VirtualBox/VBoxNetFlt.kext/ -p x -k virt_tool 2026-05-14 18:51:39.519212 | ubuntu-noble | +-w /Library/Application Support/VirtualBox/VBoxNetAdp.kext/ -p x -k virt_tool 2026-05-14 18:51:39.519309 | ubuntu-noble | + 2026-05-14 18:51:39.519411 | ubuntu-noble | +### Parallels Desktop on macOS 2026-05-14 18:51:39.519505 | ubuntu-noble | + 2026-05-14 18:51:39.519625 | ubuntu-noble | +-w /usr/local/bin/prl_convert -p x -k virt_tool 2026-05-14 18:51:39.519726 | ubuntu-noble | +-w /usr/local/bin/prl_disk_tool -p x -k virt_tool 2026-05-14 18:51:39.519829 | ubuntu-noble | +-w /usr/local/bin/prl_perf_ctl -p x -k virt_tool 2026-05-14 18:51:39.519962 | ubuntu-noble | +-w /usr/local/bin/prlcore2dmp -p x -k virt_tool 2026-05-14 18:51:39.520070 | ubuntu-noble | +-w /usr/local/bin/prlctl -p x -k virt_tool 2026-05-14 18:51:39.520170 | ubuntu-noble | +-w /usr/local/bin/prlexec -p x -k virt_tool 2026-05-14 18:51:39.520267 | ubuntu-noble | +-w /usr/local/bin/prlsrvctl -p x -k virt_tool 2026-05-14 18:51:39.520369 | ubuntu-noble | +-w /Library/Preferences/Parallels -p x -k virt_tool 2026-05-14 18:51:39.520908 | ubuntu-noble | + 2026-05-14 18:51:39.520917 | ubuntu-noble | +### qemu on macOS 2026-05-14 18:51:39.520921 | ubuntu-noble | + 2026-05-14 18:51:39.520925 | ubuntu-noble | +-w /usr/local/bin/qemu-edid -p x -k virt_tool 2026-05-14 18:51:39.520928 | ubuntu-noble | +-w /usr/local/bin/qemu-img -p x -k virt_tool 2026-05-14 18:51:39.520934 | ubuntu-noble | +-w /usr/local/bin/qemu-io -p x -k virt_tool 2026-05-14 18:51:39.521050 | ubuntu-noble | +-w /usr/local/bin/qemu-nbd -p x -k virt_tool 2026-05-14 18:51:39.521150 | ubuntu-noble | +-w /usr/local/bin/qemu-system-x86_64 -p x -k virt_tool 2026-05-14 18:51:39.521242 | ubuntu-noble | + 2026-05-14 18:51:39.521338 | ubuntu-noble | +## Kubelet 2026-05-14 18:51:39.521438 | ubuntu-noble | +-w /usr/bin/kubelet -k kubelet 2026-05-14 18:51:39.521551 | ubuntu-noble | + 2026-05-14 18:51:39.521659 | ubuntu-noble | +# ipc system call 2026-05-14 18:51:39.521760 | ubuntu-noble | +# /usr/include/linux/ipc.h 2026-05-14 18:51:39.521855 | ubuntu-noble | + 2026-05-14 18:51:39.521986 | ubuntu-noble | +## msgctl 2026-05-14 18:51:39.522085 | ubuntu-noble | +#-a always,exit -S ipc -F a0=14 -k Inter-Process_Communication 2026-05-14 18:51:39.522183 | ubuntu-noble | +## msgget 2026-05-14 18:51:39.522288 | ubuntu-noble | +#-a always,exit -S ipc -F a0=13 -k Inter-Process_Communication 2026-05-14 18:51:39.522389 | ubuntu-noble | +## Use these lines on x86_64, ia64 instead 2026-05-14 18:51:39.522498 | ubuntu-noble | +-a always,exit -F arch=b64 -S msgctl -k Inter-Process_Communication 2026-05-14 18:51:39.522600 | ubuntu-noble | +-a always,exit -F arch=b64 -S msgget -k Inter-Process_Communication 2026-05-14 18:51:39.522692 | ubuntu-noble | + 2026-05-14 18:51:39.522790 | ubuntu-noble | +## semctl 2026-05-14 18:51:39.522922 | ubuntu-noble | +#-a always,exit -S ipc -F a0=3 -k Inter-Process_Communication 2026-05-14 18:51:39.523063 | ubuntu-noble | +## semget 2026-05-14 18:51:39.523136 | ubuntu-noble | +#-a always,exit -S ipc -F a0=2 -k Inter-Process_Communication 2026-05-14 18:51:39.523236 | ubuntu-noble | +## semop 2026-05-14 18:51:39.523344 | ubuntu-noble | +#-a always,exit -S ipc -F a0=1 -k Inter-Process_Communication 2026-05-14 18:51:39.523435 | ubuntu-noble | +## semtimedop 2026-05-14 18:51:39.523539 | ubuntu-noble | +#-a always,exit -S ipc -F a0=4 -k Inter-Process_Communication 2026-05-14 18:51:39.523636 | ubuntu-noble | +## Use these lines on x86_64, ia64 instead 2026-05-14 18:51:39.523740 | ubuntu-noble | +-a always,exit -F arch=b64 -S semctl -k Inter-Process_Communication 2026-05-14 18:51:39.523841 | ubuntu-noble | +-a always,exit -F arch=b64 -S semget -k Inter-Process_Communication 2026-05-14 18:51:39.524020 | ubuntu-noble | +-a always,exit -F arch=b64 -S semop -k Inter-Process_Communication 2026-05-14 18:51:39.524144 | ubuntu-noble | +-a always,exit -F arch=b64 -S semtimedop -k Inter-Process_Communication 2026-05-14 18:51:39.524224 | ubuntu-noble | + 2026-05-14 18:51:39.524319 | ubuntu-noble | +## shmctl 2026-05-14 18:51:39.524420 | ubuntu-noble | +#-a always,exit -S ipc -F a0=24 -k Inter-Process_Communication 2026-05-14 18:51:39.524512 | ubuntu-noble | +## shmget 2026-05-14 18:51:39.524615 | ubuntu-noble | +#-a always,exit -S ipc -F a0=23 -k Inter-Process_Communication 2026-05-14 18:51:39.524719 | ubuntu-noble | +## Use these lines on x86_64, ia64 instead 2026-05-14 18:51:39.524824 | ubuntu-noble | +-a always,exit -F arch=b64 -S shmctl -k Inter-Process_Communication 2026-05-14 18:51:39.524936 | ubuntu-noble | +-a always,exit -F arch=b64 -S shmget -k Inter-Process_Communication 2026-05-14 18:51:39.525043 | ubuntu-noble | + 2026-05-14 18:51:39.525143 | ubuntu-noble | +# High Volume Events ---------------------------------------------------------- 2026-05-14 18:51:39.525237 | ubuntu-noble | + 2026-05-14 18:51:39.525334 | ubuntu-noble | +## Disable these rules if they create too many events in your environment 2026-05-14 18:51:39.525426 | ubuntu-noble | + 2026-05-14 18:51:39.525542 | ubuntu-noble | +## Common Shells 2026-05-14 18:51:39.525648 | ubuntu-noble | +-w /bin/bash -p x -k susp_shell 2026-05-14 18:51:39.525748 | ubuntu-noble | +-w /bin/dash -p x -k susp_shell 2026-05-14 18:51:39.525852 | ubuntu-noble | +-w /bin/busybox -p x -k susp_shell 2026-05-14 18:51:39.526000 | ubuntu-noble | +-w /bin/zsh -p x -k susp_shell 2026-05-14 18:51:39.526099 | ubuntu-noble | +-w /bin/sh -p x -k susp_shell 2026-05-14 18:51:39.526197 | ubuntu-noble | +-w /bin/ksh -p x -k susp_shell 2026-05-14 18:51:39.526309 | ubuntu-noble | + 2026-05-14 18:51:39.526392 | ubuntu-noble | +## Root command executions 2026-05-14 18:51:39.526499 | ubuntu-noble | +-a always,exit -F arch=b64 -F euid=0 -F auid>=1000 -F auid!=-1 -S execve -k rootcmd 2026-05-14 18:51:39.526592 | ubuntu-noble | + 2026-05-14 18:51:39.526698 | ubuntu-noble | +## File Deletion Events by User 2026-05-14 18:51:39.526802 | ubuntu-noble | +-a always,exit -F arch=b64 -S rmdir -S unlink -S unlinkat -S rename -S renameat -F auid>=1000 -F auid!=-1 -k delete 2026-05-14 18:51:39.526900 | ubuntu-noble | + 2026-05-14 18:51:39.527019 | ubuntu-noble | +## File Access 2026-05-14 18:51:39.527121 | ubuntu-noble | +### Unauthorized Access (unsuccessful) 2026-05-14 18:51:39.527233 | ubuntu-noble | +-a always,exit -F arch=b64 -S creat -S open -S openat -S open_by_handle_at -S truncate -S ftruncate -F exit=-EACCES -F auid>=1000 -F auid!=-1 -k file_access 2026-05-14 18:51:39.527338 | ubuntu-noble | +-a always,exit -F arch=b64 -S creat -S open -S openat -S open_by_handle_at -S truncate -S ftruncate -F exit=-EPERM -F auid>=1000 -F auid!=-1 -k file_access 2026-05-14 18:51:39.527428 | ubuntu-noble | + 2026-05-14 18:51:39.527526 | ubuntu-noble | +### Unsuccessful Creation 2026-05-14 18:51:39.527635 | ubuntu-noble | +-a always,exit -F arch=b64 -S mkdir,creat,link,symlink,mknod,mknodat,linkat,symlinkat -F exit=-EACCES -k file_creation 2026-05-14 18:51:39.527736 | ubuntu-noble | +-a always,exit -F arch=b64 -S mkdir,link,symlink,mkdirat -F exit=-EPERM -k file_creation 2026-05-14 18:51:39.527832 | ubuntu-noble | + 2026-05-14 18:51:39.527942 | ubuntu-noble | +### Unsuccessful Modification 2026-05-14 18:51:39.528065 | ubuntu-noble | +-a always,exit -F arch=b64 -S rename -S renameat -S truncate -S chmod -S setxattr -S lsetxattr -S removexattr -S lremovexattr -F exit=-EACCES -k file_modification 2026-05-14 18:51:39.528199 | ubuntu-noble | +-a always,exit -F arch=b64 -S rename -S renameat -S truncate -S chmod -S setxattr -S lsetxattr -S removexattr -S lremovexattr -F exit=-EPERM -k file_modification 2026-05-14 18:51:39.528296 | ubuntu-noble | + 2026-05-14 18:51:39.528433 | ubuntu-noble | +## 32bit API Exploitation 2026-05-14 18:51:39.528509 | ubuntu-noble | +### If you are on a 64 bit platform, everything _should_ be running 2026-05-14 18:51:39.528607 | ubuntu-noble | +### in 64 bit mode. This rule will detect any use of the 32 bit syscalls 2026-05-14 18:51:39.528707 | ubuntu-noble | +### because this might be a sign of someone exploiting a hole in the 32 2026-05-14 18:51:39.528802 | ubuntu-noble | +### bit API. 2026-05-14 18:51:39.528943 | ubuntu-noble | +-a always,exit -F arch=b32 -S all -k 32bit_api 2026-05-14 18:51:39.529054 | ubuntu-noble | + 2026-05-14 18:51:39.529161 | ubuntu-noble | +# Make The Configuration Immutable -------------------------------------------- 2026-05-14 18:51:39.529290 | ubuntu-noble | + 2026-05-14 18:51:39.529392 | ubuntu-noble | +##-e 2 2026-05-14 18:51:39.529487 | ubuntu-noble | 2026-05-14 18:51:39.530000 | ubuntu-noble | changed: [molecule-auditd] => (item=20-neo23x0.rules) => {"ansible_loop_var": "item", "changed": true, "checksum": "9f99ce5c4f891fbf3e2bce06ed4cb97fb9e01f41", "dest": "/etc/audit/rules.d/20-neo23x0.rules", "gid": 0, "group": "root", "item": "20-neo23x0.rules", "md5sum": "6ac57206fd77de34805c3f4d50ef8b1d", "mode": "0644", "owner": "root", "size": 27367, "src": "/home/zuul/.ansible/tmp/ansible-tmp-1778784698.5100687-2392-173074335952814/.source.rules", "state": "file", "uid": 0} 2026-05-14 18:51:39.530103 | ubuntu-noble | 2026-05-14 18:51:39.531003 | ubuntu-noble | TASK [auditd : Manage auditd service] ****************************************** 2026-05-14 18:51:40.377030 | ubuntu-noble | ok: [molecule-auditd] => {"changed": false, "enabled": true, "name": "auditd", "state": "started", "status": {"ActiveEnterTimestamp": "Thu 2026-05-14 18:51:32 UTC", "ActiveEnterTimestampMonotonic": "153775674", "ActiveExitTimestampMonotonic": "0", "ActiveState": "active", "After": "local-fs.target system.slice systemd-tmpfiles-setup.service systemd-journald.socket", "AllowIsolate": "no", "AssertResult": "yes", "AssertTimestamp": "Thu 2026-05-14 18:51:32 UTC", "AssertTimestampMonotonic": "153723094", "Before": "ssh.service shutdown.target sysinit.target systemd-update-utmp.service", "BlockIOAccounting": "no", "BlockIOWeight": "[not set]", "CPUAccounting": "yes", "CPUAffinityFromNUMA": "no", "CPUQuotaPerSecUSec": "infinity", "CPUQuotaPeriodUSec": "infinity", "CPUSchedulingPolicy": "0", "CPUSchedulingPriority": "0", "CPUSchedulingResetOnFork": "no", "CPUShares": "[not set]", "CPUUsageNSec": "40371000", "CPUWeight": "[not set]", "CacheDirectoryMode": "0755", "CanFreeze": "yes", "CanIsolate": "no", "CanReload": "no", "CanStart": "yes", "CanStop": "yes", "CapabilityBoundingSet": "cap_chown cap_dac_override cap_dac_read_search cap_fowner cap_fsetid cap_kill cap_setgid cap_setuid cap_setpcap cap_linux_immutable cap_net_bind_service cap_net_broadcast cap_net_admin cap_net_raw cap_ipc_lock cap_ipc_owner cap_sys_rawio cap_sys_chroot cap_sys_ptrace cap_sys_pacct cap_sys_admin cap_sys_boot cap_sys_nice cap_sys_resource cap_sys_time cap_sys_tty_config cap_mknod cap_lease cap_audit_write cap_audit_control cap_setfcap cap_mac_override cap_mac_admin cap_syslog cap_wake_alarm cap_block_suspend cap_audit_read cap_perfmon cap_bpf cap_checkpoint_restore", "CleanResult": "success", "CollectMode": "inactive", "ConditionResult": "yes", "ConditionTimestamp": "Thu 2026-05-14 18:51:32 UTC", "ConditionTimestampMonotonic": "153722996", "ConfigurationDirectoryMode": "0755", "Conflicts": "shutdown.target", "ControlGroup": "/system.slice/auditd.service", "ControlGroupId": "3826", "ControlPID": "0", "CoredumpFilter": "0x33", "CoredumpReceive": "no", "DefaultDependencies": "no", "DefaultMemoryLow": "0", "DefaultMemoryMin": "0", "DefaultStartupMemoryLow": "0", "Delegate": "no", "Description": "Security Auditing Service", "DevicePolicy": "auto", "Documentation": "\"man:auditd(8)\" https://github.com/linux-audit/audit-documentation", "DynamicUser": "no", "ExecMainCode": "0", "ExecMainExitTimestampMonotonic": "0", "ExecMainPID": "2161", "ExecMainStartTimestamp": "Thu 2026-05-14 18:51:32 UTC", "ExecMainStartTimestampMonotonic": "153745193", "ExecMainStatus": "0", "ExecStart": "{ path=/sbin/auditd ; argv[]=/sbin/auditd ; ignore_errors=no ; start_time=[Thu 2026-05-14 18:51:32 UTC] ; stop_time=[Thu 2026-05-14 18:51:32 UTC] ; pid=2160 ; code=exited ; status=0 }", "ExecStartEx": "{ path=/sbin/auditd ; argv[]=/sbin/auditd ; flags= ; start_time=[Thu 2026-05-14 18:51:32 UTC] ; stop_time=[Thu 2026-05-14 18:51:32 UTC] ; pid=2160 ; code=exited ; status=0 }", "ExecStartPost": "{ path=/sbin/augenrules ; argv[]=/sbin/augenrules --load ; ignore_errors=yes ; start_time=[Thu 2026-05-14 18:51:32 UTC] ; stop_time=[Thu 2026-05-14 18:51:32 UTC] ; pid=2164 ; code=exited ; status=0 }", "ExecStartPostEx": "{ path=/sbin/augenrules ; argv[]=/sbin/augenrules --load ; flags=ignore-failure ; start_time=[Thu 2026-05-14 18:51:32 UTC] ; stop_time=[Thu 2026-05-14 18:51:32 UTC] ; pid=2164 ; code=exited ; status=0 }", "ExitType": "main", "ExtensionImagePolicy": "root=verity+signed+encrypted+unprotected+absent:usr=verity+signed+encrypted+unprotected+absent:home=encrypted+unprotected+absent:srv=encrypted+unprotected+absent:tmp=encrypted+unprotected+absent:var=encrypted+unprotected+absent", "FailureAction": "none", "FileDescriptorStoreMax": "0", "FileDescriptorStorePreserve": "restart", "FinalKillSignal": "9", "FragmentPath": "/usr/lib/systemd/system/auditd.service", "FreezerState": "running", "GID": "[not set]", "GuessMainPID": "yes", "IOAccounting": "no", "IOReadBytes": "[not set]", "IOReadOperations": "[not set]", "IOSchedulingClass": "2", "IOSchedulingPriority": "4", "IOWeight": "[not set]", "IOWriteBytes": "[not set]", "IOWriteOperations": "[not set]", "IPAccounting": "no", "IPEgressBytes": "[no data]", "IPEgressPackets": "[no data]", "IPIngressBytes": "[no data]", "IPIngressPackets": "[no data]", "Id": "auditd.service", "IgnoreOnIsolate": "no", "IgnoreSIGPIPE": "yes", "InactiveEnterTimestampMonotonic": "0", "InactiveExitTimestamp": "Thu 2026-05-14 18:51:32 UTC", "InactiveExitTimestampMonotonic": "153731411", "InvocationID": "eb9a17996b454a29b3b74914263a3157", "JobRunningTimeoutUSec": "infinity", "JobTimeoutAction": "none", "JobTimeoutUSec": "infinity", "KeyringMode": "private", "KillMode": "control-group", "KillSignal": "15", "LimitAS": "infinity", "LimitASSoft": "infinity", "LimitCORE": "infinity", "LimitCORESoft": "0", "LimitCPU": "infinity", "LimitCPUSoft": "infinity", "LimitDATA": "infinity", "LimitDATASoft": "infinity", "LimitFSIZE": "infinity", "LimitFSIZESoft": "infinity", "LimitLOCKS": "infinity", "LimitLOCKSSoft": "infinity", "LimitMEMLOCK": "8388608", "LimitMEMLOCKSoft": "8388608", "LimitMSGQUEUE": "819200", "LimitMSGQUEUESoft": "819200", "LimitNICE": "0", "LimitNICESoft": "0", "LimitNOFILE": "524288", "LimitNOFILESoft": "1024", "LimitNPROC": "15372", "LimitNPROCSoft": "15372", "LimitRSS": "infinity", "LimitRSSSoft": "infinity", "LimitRTPRIO": "0", "LimitRTPRIOSoft": "0", "LimitRTTIME": "infinity", "LimitRTTIMESoft": "infinity", "LimitSIGPENDING": "15372", "LimitSIGPENDINGSoft": "15372", "LimitSTACK": "infinity", "LimitSTACKSoft": "8388608", "LoadState": "loaded", "LockPersonality": "yes", "LogLevelMax": "-1", "LogRateLimitBurst": "0", "LogRateLimitIntervalUSec": "0", "LogsDirectoryMode": "0755", "MainPID": "2161", "ManagedOOMMemoryPressure": "auto", "ManagedOOMMemoryPressureLimit": "0", "ManagedOOMPreference": "none", "ManagedOOMSwap": "auto", "MemoryAccounting": "yes", "MemoryAvailable": "3512672256", "MemoryCurrent": "503808", "MemoryDenyWriteExecute": "yes", "MemoryHigh": "infinity", "MemoryKSM": "no", "MemoryLimit": "infinity", "MemoryLow": "0", "MemoryMax": "infinity", "MemoryMin": "0", "MemoryPeak": "2088960", "MemoryPressureThresholdUSec": "200ms", "MemoryPressureWatch": "auto", "MemorySwapCurrent": "0", "MemorySwapMax": "infinity", "MemorySwapPeak": "0", "MemoryZSwapCurrent": "0", "MemoryZSwapMax": "infinity", "MountAPIVFS": "no", "MountImagePolicy": "root=verity+signed+encrypted+unprotected+absent:usr=verity+signed+encrypted+unprotected+absent:home=encrypted+unprotected+absent:srv=encrypted+unprotected+absent:tmp=encrypted+unprotected+absent:var=encrypted+unprotected+absent", "NFileDescriptorStore": "0", "NRestarts": "0", "NUMAPolicy": "n/a", "Names": "auditd.service", "NeedDaemonReload": "no", "Nice": "0", "NoNewPrivileges": "no", "NonBlocking": "no", "NotifyAccess": "none", "OOMPolicy": "stop", "OOMScoreAdjust": "0", "OnFailureJobMode": "replace", "OnSuccessJobMode": "fail", "PIDFile": "/run/auditd.pid", "Perpetual": "no", "PrivateDevices": "no", "PrivateIPC": "no", "PrivateMounts": "no", "PrivateNetwork": "no", "PrivateTmp": "no", "PrivateUsers": "no", "ProcSubset": "all", "ProtectClock": "no", "ProtectControlGroups": "no", "ProtectHome": "no", "ProtectHostname": "no", "ProtectKernelLogs": "no", "ProtectKernelModules": "yes", "ProtectKernelTunables": "no", "ProtectProc": "default", "ProtectSystem": "no", "RefuseManualStart": "no", "RefuseManualStop": "no", "ReloadResult": "success", "ReloadSignal": "1", "RemainAfterExit": "no", "RemoveIPC": "no", "Requires": "system.slice", "Restart": "on-failure", "RestartKillSignal": "15", "RestartMaxDelayUSec": "infinity", "RestartMode": "normal", "RestartPreventExitStatus": "2 4 6", "RestartSteps": "0", "RestartUSec": "100ms", "RestartUSecNext": "100ms", "RestrictNamespaces": "no", "RestrictRealtime": "yes", "RestrictSUIDSGID": "no", "Result": "success", "RootDirectoryStartOnly": "no", "RootEphemeral": "no", "RootImagePolicy": "root=verity+signed+encrypted+unprotected+absent:usr=verity+signed+encrypted+unprotected+absent:home=encrypted+unprotected+absent:srv=encrypted+unprotected+absent:tmp=encrypted+unprotected+absent:var=encrypted+unprotected+absent", "RuntimeDirectoryMode": "0755", "RuntimeDirectoryPreserve": "no", "RuntimeMaxUSec": "infinity", "RuntimeRandomizedExtraUSec": "0", "SameProcessGroup": "no", "SecureBits": "0", "SendSIGHUP": "no", "SendSIGKILL": "yes", "SetLoginEnvironment": "no", "Slice": "system.slice", "StandardError": "inherit", "StandardInput": "null", "StandardOutput": "journal", "StartLimitAction": "none", "StartLimitBurst": "5", "StartLimitIntervalUSec": "10s", "StartupBlockIOWeight": "[not set]", "StartupCPUShares": "[not set]", "StartupCPUWeight": "[not set]", "StartupIOWeight": "[not set]", "StartupMemoryHigh": "infinity", "StartupMemoryLow": "0", "StartupMemoryMax": "infinity", "StartupMemorySwapMax": "infinity", "StartupMemoryZSwapMax": "infinity", "StateChangeTimestamp": "Thu 2026-05-14 18:51:32 UTC", "StateChangeTimestampMonotonic": "153775674", "StateDirectoryMode": "0755", "StatusErrno": "0", "StopWhenUnneeded": "no", "SubState": "running", "SuccessAction": "none", "SurviveFinalKillSignal": "no", "SyslogFacility": "3", "SyslogLevel": "6", "SyslogLevelPrefix": "yes", "SyslogPriority": "30", "SystemCallErrorNumber": "2147483646", "TTYReset": "no", "TTYVHangup": "no", "TTYVTDisallocate": "no", "TasksAccounting": "yes", "TasksCurrent": "2", "TasksMax": "4611", "TimeoutAbortUSec": "1min 30s", "TimeoutCleanUSec": "infinity", "TimeoutStartFailureMode": "terminate", "TimeoutStartUSec": "1min 30s", "TimeoutStopFailureMode": "terminate", "TimeoutStopUSec": "1min 30s", "TimerSlackNSec": "50000", "Transient": "no", "Type": "forking", "UID": "[not set]", "UMask": "0022", "UnitFilePreset": "enabled", "UnitFileState": "enabled", "UtmpMode": "init", "WantedBy": "multi-user.target", "WatchdogSignal": "6", "WatchdogTimestampMonotonic": "0", "WatchdogUSec": "0"}} 2026-05-14 18:51:40.384537 | ubuntu-noble | 2026-05-14 18:51:40.384687 | ubuntu-noble | TASK [auditd : List existing rules files] ************************************** 2026-05-14 18:51:40.299531 | debian-bookworm | changed: [molecule-auditd] => {"changed": true, "name": "auditd", "state": "started", "status": {"ActiveEnterTimestamp": "Thu 2026-05-14 18:51:39 UTC", "ActiveEnterTimestampMonotonic": "161913099", "ActiveExitTimestamp": "Thu 2026-05-14 18:51:38 UTC", "ActiveExitTimestampMonotonic": "161751390", "ActiveState": "active", "After": "systemd-tmpfiles-setup.service systemd-journald.socket local-fs.target system.slice", "AllowIsolate": "no", "AssertResult": "yes", "AssertTimestamp": "Thu 2026-05-14 18:51:38 UTC", "AssertTimestampMonotonic": "161793839", "Before": "sysinit.target systemd-update-utmp.service shutdown.target ssh.service", "BlockIOAccounting": "no", "BlockIOWeight": "[not set]", "CPUAccounting": "yes", "CPUAffinityFromNUMA": "no", "CPUQuotaPerSecUSec": "infinity", "CPUQuotaPeriodUSec": "infinity", "CPUSchedulingPolicy": "0", "CPUSchedulingPriority": "0", "CPUSchedulingResetOnFork": "no", "CPUShares": "[not set]", "CPUUsageNSec": "168708000", "CPUWeight": "[not set]", "CacheDirectoryMode": "0755", "CanFreeze": "yes", "CanIsolate": "no", "CanReload": "no", "CanStart": "yes", "CanStop": "yes", "CapabilityBoundingSet": "cap_chown cap_dac_override cap_dac_read_search cap_fowner cap_fsetid cap_kill cap_setgid cap_setuid cap_setpcap cap_linux_immutable cap_net_bind_service cap_net_broadcast cap_net_admin cap_net_raw cap_ipc_lock cap_ipc_owner cap_sys_rawio cap_sys_chroot cap_sys_ptrace cap_sys_pacct cap_sys_admin cap_sys_boot cap_sys_nice cap_sys_resource cap_sys_time cap_sys_tty_config cap_mknod cap_lease cap_audit_write cap_audit_control cap_setfcap cap_mac_override cap_mac_admin cap_syslog cap_wake_alarm cap_block_suspend cap_audit_read cap_perfmon cap_bpf cap_checkpoint_restore", "CleanResult": "success", "CollectMode": "inactive", "ConditionResult": "yes", "ConditionTimestamp": "Thu 2026-05-14 18:51:38 UTC", "ConditionTimestampMonotonic": "161793762", "ConfigurationDirectoryMode": "0755", "Conflicts": "shutdown.target", "ControlGroup": "/system.slice/auditd.service", "ControlGroupId": "3367", "ControlPID": "0", "CoredumpFilter": "0x33", "DefaultDependencies": "no", "DefaultMemoryLow": "0", "DefaultMemoryMin": "0", "Delegate": "no", "Description": "Security Auditing Service", "DevicePolicy": "auto", "Documentation": "\"man:auditd(8)\" https://github.com/linux-audit/audit-documentation", "DynamicUser": "no", "ExecMainCode": "0", "ExecMainExitTimestampMonotonic": "0", "ExecMainPID": "2689", "ExecMainStartTimestamp": "Thu 2026-05-14 18:51:39 UTC", "ExecMainStartTimestampMonotonic": "161835907", "ExecMainStatus": "0", "ExecStart": "{ path=/sbin/auditd ; argv[]=/sbin/auditd ; ignore_errors=no ; start_time=[Thu 2026-05-14 18:51:38 UTC] ; stop_time=[Thu 2026-05-14 18:51:39 UTC] ; pid=2688 ; code=exited ; status=0 }", "ExecStartEx": "{ path=/sbin/auditd ; argv[]=/sbin/auditd ; flags= ; start_time=[Thu 2026-05-14 18:51:38 UTC] ; stop_time=[Thu 2026-05-14 18:51:39 UTC] ; pid=2688 ; code=exited ; status=0 }", "ExecStartPost": "{ path=/sbin/augenrules ; argv[]=/sbin/augenrules --load ; ignore_errors=yes ; start_time=[Thu 2026-05-14 18:51:39 UTC] ; stop_time=[Thu 2026-05-14 18:51:39 UTC] ; pid=2692 ; code=exited ; status=0 }", "ExecStartPostEx": "{ path=/sbin/augenrules ; argv[]=/sbin/augenrules --load ; flags=ignore-failure ; start_time=[Thu 2026-05-14 18:51:39 UTC] ; stop_time=[Thu 2026-05-14 18:51:39 UTC] ; pid=2692 ; code=exited ; status=0 }", "ExitType": "main", "FailureAction": "none", "FileDescriptorStoreMax": "0", "FinalKillSignal": "9", "FragmentPath": "/lib/systemd/system/auditd.service", "FreezerState": "running", "GID": "[not set]", "GuessMainPID": "yes", "IOAccounting": "no", "IOReadBytes": "18446744073709551615", "IOReadOperations": "18446744073709551615", "IOSchedulingClass": "2", "IOSchedulingPriority": "4", "IOWeight": "[not set]", "IOWriteBytes": "18446744073709551615", "IOWriteOperations": "18446744073709551615", "IPAccounting": "no", "IPEgressBytes": "[no data]", "IPEgressPackets": "[no data]", "IPIngressBytes": "[no data]", "IPIngressPackets": "[no data]", "Id": "auditd.service", "IgnoreOnIsolate": "no", "IgnoreSIGPIPE": "yes", "InactiveEnterTimestamp": "Thu 2026-05-14 18:51:38 UTC", "InactiveEnterTimestampMonotonic": "161792468", "InactiveExitTimestamp": "Thu 2026-05-14 18:51:38 UTC", "InactiveExitTimestampMonotonic": "161816287", "InvocationID": "d75cccb95b7e4d06833643335563dbe1", "JobRunningTimeoutUSec": "infinity", "JobTimeoutAction": "none", "JobTimeoutUSec": "infinity", "KeyringMode": "private", "KillMode": "control-group", "KillSignal": "15", "LimitAS": "infinity", "LimitASSoft": "infinity", "LimitCORE": "infinity", "LimitCORESoft": "0", "LimitCPU": "infinity", "LimitCPUSoft": "infinity", "LimitDATA": "infinity", "LimitDATASoft": "infinity", "LimitFSIZE": "infinity", "LimitFSIZESoft": "infinity", "LimitLOCKS": "infinity", "LimitLOCKSSoft": "infinity", "LimitMEMLOCK": "8388608", "LimitMEMLOCKSoft": "8388608", "LimitMSGQUEUE": "819200", "LimitMSGQUEUESoft": "819200", "LimitNICE": "0", "LimitNICESoft": "0", "LimitNOFILE": "524288", "LimitNOFILESoft": "1024", "LimitNPROC": "15480", "LimitNPROCSoft": "15480", "LimitRSS": "infinity", "LimitRSSSoft": "infinity", "LimitRTPRIO": "0", "LimitRTPRIOSoft": "0", "LimitRTTIME": "infinity", "LimitRTTIMESoft": "infinity", "LimitSIGPENDING": "15480", "LimitSIGPENDINGSoft": "15480", "LimitSTACK": "infinity", "LimitSTACKSoft": "8388608", "LoadState": "loaded", "LockPersonality": "yes", "LogLevelMax": "-1", "LogRateLimitBurst": "0", "LogRateLimitIntervalUSec": "0", "LogsDirectoryMode": "0755", "MainPID": "2689", "ManagedOOMMemoryPressure": "auto", "ManagedOOMMemoryPressureLimit": "0", "ManagedOOMPreference": "none", "ManagedOOMSwap": "auto", "MemoryAccounting": "yes", "MemoryAvailable": "infinity", "MemoryCurrent": "2080768", "MemoryDenyWriteExecute": "yes", "MemoryHigh": "infinity", "MemoryLimit": "infinity", "MemoryLow": "0", "MemoryMax": "infinity", "MemoryMin": "0", "MemorySwapMax": "infinity", "MountAPIVFS": "no", "NFileDescriptorStore": "0", "NRestarts": "0", "NUMAPolicy": "n/a", "Names": "auditd.service", "NeedDaemonReload": "no", "Nice": "0", "NoNewPrivileges": "no", "NonBlocking": "no", "NotifyAccess": "none", "OOMPolicy": "stop", "OOMScoreAdjust": "0", "OnFailureJobMode": "replace", "OnSuccessJobMode": "fail", "PIDFile": "/run/auditd.pid", "Perpetual": "no", "PrivateDevices": "no", "PrivateIPC": "no", "PrivateMounts": "no", "PrivateNetwork": "no", "PrivateTmp": "no", "PrivateUsers": "no", "ProcSubset": "all", "ProtectClock": "no", "ProtectControlGroups": "yes", "ProtectHome": "no", "ProtectHostname": "no", "ProtectKernelLogs": "no", "ProtectKernelModules": "yes", "ProtectKernelTunables": "no", "ProtectProc": "default", "ProtectSystem": "no", "RefuseManualStart": "no", "RefuseManualStop": "no", "ReloadResult": "success", "RemainAfterExit": "no", "RemoveIPC": "no", "Requires": "system.slice", "Restart": "on-failure", "RestartKillSignal": "15", "RestartPreventExitStatus": "2 4 6", "RestartUSec": "100ms", "RestrictNamespaces": "no", "RestrictRealtime": "yes", "RestrictSUIDSGID": "no", "Result": "success", "RootDirectoryStartOnly": "no", "RuntimeDirectoryMode": "0755", "RuntimeDirectoryPreserve": "no", "RuntimeMaxUSec": "infinity", "RuntimeRandomizedExtraUSec": "0", "SameProcessGroup": "no", "SecureBits": "0", "SendSIGHUP": "no", "SendSIGKILL": "yes", "Slice": "system.slice", "StandardError": "inherit", "StandardInput": "null", "StandardOutput": "journal", "StartLimitAction": "none", "StartLimitBurst": "5", "StartLimitIntervalUSec": "10s", "StartupBlockIOWeight": "[not set]", "StartupCPUShares": "[not set]", "StartupCPUWeight": "[not set]", "StartupIOWeight": "[not set]", "StateChangeTimestamp": "Thu 2026-05-14 18:51:39 UTC", "StateChangeTimestampMonotonic": "161913099", "StateDirectoryMode": "0755", "StatusErrno": "0", "StopWhenUnneeded": "no", "SubState": "running", "SuccessAction": "none", "SyslogFacility": "3", "SyslogLevel": "6", "SyslogLevelPrefix": "yes", "SyslogPriority": "30", "SystemCallErrorNumber": "2147483646", "TTYReset": "no", "TTYVHangup": "no", "TTYVTDisallocate": "no", "TasksAccounting": "yes", "TasksCurrent": "2", "TasksMax": "4644", "TimeoutAbortUSec": "1min 30s", "TimeoutCleanUSec": "infinity", "TimeoutStartFailureMode": "terminate", "TimeoutStartUSec": "1min 30s", "TimeoutStopFailureMode": "terminate", "TimeoutStopUSec": "1min 30s", "TimerSlackNSec": "50000", "Transient": "no", "Type": "forking", "UID": "[not set]", "UMask": "0022", "UnitFilePreset": "enabled", "UnitFileState": "enabled", "UtmpMode": "init", "WantedBy": "multi-user.target", "WatchdogSignal": "6", "WatchdogTimestampMonotonic": "0", "WatchdogUSec": "0"}} 2026-05-14 18:51:40.302540 | debian-bookworm | 2026-05-14 18:51:40.302676 | debian-bookworm | PLAY RECAP ********************************************************************* 2026-05-14 18:51:40.302817 | debian-bookworm | molecule-auditd : ok=15 changed=8 unreachable=0 failed=0 skipped=0 rescued=0 ignored=0 2026-05-14 18:51:40.302938 | debian-bookworm | 2026-05-14 18:51:40.404634 | debian-bookworm | INFO [delegated > converge] Executed: Successful 2026-05-14 18:51:40.405210 | debian-bookworm | WARNING Molecule executed 1 scenario (1 missing files) 2026-05-14 18:51:40.887741 | ubuntu-noble | ok: [molecule-auditd] => {"changed": false, "cmd": ["find", "/etc/audit/rules.d", "-type", "f", "-printf", "%f\n"], "delta": "0:00:00.009849", "end": "2026-05-14 18:51:40.831583", "msg": "", "rc": 0, "start": "2026-05-14 18:51:40.821734", "stderr": "", "stderr_lines": [], "stdout": "20-neo23x0.rules\naudit.rules", "stdout_lines": ["20-neo23x0.rules", "audit.rules"]} 2026-05-14 18:51:40.887885 | ubuntu-noble | 2026-05-14 18:51:40.888002 | ubuntu-noble | TASK [auditd : Remove unmanaged rules files] *********************************** 2026-05-14 18:51:40.980098 | debian-bookworm | ok: Runtime: 0:00:17.544611 2026-05-14 18:51:41.278963 | ubuntu-noble | skipping: [molecule-auditd] => (item=20-neo23x0.rules) => {"ansible_loop_var": "item", "changed": false, "false_condition": "item not in auditd_rules_files", "item": "20-neo23x0.rules", "skip_reason": "Conditional result was False"} 2026-05-14 18:51:41.279019 | ubuntu-noble | --- before 2026-05-14 18:51:41.279025 | ubuntu-noble | +++ after 2026-05-14 18:51:41.279029 | ubuntu-noble | @@ -1,4 +1,4 @@ 2026-05-14 18:51:41.279033 | ubuntu-noble | { 2026-05-14 18:51:41.279037 | ubuntu-noble | "path": "/etc/audit/rules.d/audit.rules", 2026-05-14 18:51:41.279042 | ubuntu-noble | - "state": "file" 2026-05-14 18:51:41.279084 | ubuntu-noble | + "state": "absent" 2026-05-14 18:51:41.279326 | ubuntu-noble | } 2026-05-14 18:51:41.279559 | ubuntu-noble | 2026-05-14 18:51:41.279872 | ubuntu-noble | changed: [molecule-auditd] => (item=audit.rules) => {"ansible_loop_var": "item", "changed": true, "item": "audit.rules", "path": "/etc/audit/rules.d/audit.rules", "state": "absent"} 2026-05-14 18:51:41.281116 | ubuntu-noble | 2026-05-14 18:51:41.281199 | ubuntu-noble | RUNNING HANDLER [auditd : Restart auditd service] ****************************** 2026-05-14 18:51:42.010646 | ubuntu-noble | changed: [molecule-auditd] => {"changed": true, "name": "auditd", "state": "started", "status": {"ActiveEnterTimestamp": "Thu 2026-05-14 18:51:32 UTC", "ActiveEnterTimestampMonotonic": "153775674", "ActiveExitTimestampMonotonic": "0", "ActiveState": "active", "After": "local-fs.target system.slice systemd-tmpfiles-setup.service systemd-journald.socket", "AllowIsolate": "no", "AssertResult": "yes", "AssertTimestamp": "Thu 2026-05-14 18:51:32 UTC", "AssertTimestampMonotonic": "153723094", "Before": "ssh.service shutdown.target sysinit.target systemd-update-utmp.service", "BlockIOAccounting": "no", "BlockIOWeight": "[not set]", "CPUAccounting": "yes", "CPUAffinityFromNUMA": "no", "CPUQuotaPerSecUSec": "infinity", "CPUQuotaPeriodUSec": "infinity", "CPUSchedulingPolicy": "0", "CPUSchedulingPriority": "0", "CPUSchedulingResetOnFork": "no", "CPUShares": "[not set]", "CPUUsageNSec": "42127000", "CPUWeight": "[not set]", "CacheDirectoryMode": "0755", "CanFreeze": "yes", "CanIsolate": "no", "CanReload": "no", "CanStart": "yes", "CanStop": "yes", "CapabilityBoundingSet": "cap_chown cap_dac_override cap_dac_read_search cap_fowner cap_fsetid cap_kill cap_setgid cap_setuid cap_setpcap cap_linux_immutable cap_net_bind_service cap_net_broadcast cap_net_admin cap_net_raw cap_ipc_lock cap_ipc_owner cap_sys_rawio cap_sys_chroot cap_sys_ptrace cap_sys_pacct cap_sys_admin cap_sys_boot cap_sys_nice cap_sys_resource cap_sys_time cap_sys_tty_config cap_mknod cap_lease cap_audit_write cap_audit_control cap_setfcap cap_mac_override cap_mac_admin cap_syslog cap_wake_alarm cap_block_suspend cap_audit_read cap_perfmon cap_bpf cap_checkpoint_restore", "CleanResult": "success", "CollectMode": "inactive", "ConditionResult": "yes", "ConditionTimestamp": "Thu 2026-05-14 18:51:32 UTC", "ConditionTimestampMonotonic": "153722996", "ConfigurationDirectoryMode": "0755", "Conflicts": "shutdown.target", "ControlGroup": "/system.slice/auditd.service", "ControlGroupId": "3826", "ControlPID": "0", "CoredumpFilter": "0x33", "CoredumpReceive": "no", "DefaultDependencies": "no", "DefaultMemoryLow": "0", "DefaultMemoryMin": "0", "DefaultStartupMemoryLow": "0", "Delegate": "no", "Description": "Security Auditing Service", "DevicePolicy": "auto", "Documentation": "\"man:auditd(8)\" https://github.com/linux-audit/audit-documentation", "DynamicUser": "no", "ExecMainCode": "0", "ExecMainExitTimestampMonotonic": "0", "ExecMainPID": "2161", "ExecMainStartTimestamp": "Thu 2026-05-14 18:51:32 UTC", "ExecMainStartTimestampMonotonic": "153745193", "ExecMainStatus": "0", "ExecStart": "{ path=/sbin/auditd ; argv[]=/sbin/auditd ; ignore_errors=no ; start_time=[Thu 2026-05-14 18:51:32 UTC] ; stop_time=[Thu 2026-05-14 18:51:32 UTC] ; pid=2160 ; code=exited ; status=0 }", "ExecStartEx": "{ path=/sbin/auditd ; argv[]=/sbin/auditd ; flags= ; start_time=[Thu 2026-05-14 18:51:32 UTC] ; stop_time=[Thu 2026-05-14 18:51:32 UTC] ; pid=2160 ; code=exited ; status=0 }", "ExecStartPost": "{ path=/sbin/augenrules ; argv[]=/sbin/augenrules --load ; ignore_errors=yes ; start_time=[Thu 2026-05-14 18:51:32 UTC] ; stop_time=[Thu 2026-05-14 18:51:32 UTC] ; pid=2164 ; code=exited ; status=0 }", "ExecStartPostEx": "{ path=/sbin/augenrules ; argv[]=/sbin/augenrules --load ; flags=ignore-failure ; start_time=[Thu 2026-05-14 18:51:32 UTC] ; stop_time=[Thu 2026-05-14 18:51:32 UTC] ; pid=2164 ; code=exited ; status=0 }", "ExitType": "main", "ExtensionImagePolicy": "root=verity+signed+encrypted+unprotected+absent:usr=verity+signed+encrypted+unprotected+absent:home=encrypted+unprotected+absent:srv=encrypted+unprotected+absent:tmp=encrypted+unprotected+absent:var=encrypted+unprotected+absent", "FailureAction": "none", "FileDescriptorStoreMax": "0", "FileDescriptorStorePreserve": "restart", "FinalKillSignal": "9", "FragmentPath": "/usr/lib/systemd/system/auditd.service", "FreezerState": "running", "GID": "[not set]", "GuessMainPID": "yes", "IOAccounting": "no", "IOReadBytes": "[not set]", "IOReadOperations": "[not set]", "IOSchedulingClass": "2", "IOSchedulingPriority": "4", "IOWeight": "[not set]", "IOWriteBytes": "[not set]", "IOWriteOperations": "[not set]", "IPAccounting": "no", "IPEgressBytes": "[no data]", "IPEgressPackets": "[no data]", "IPIngressBytes": "[no data]", "IPIngressPackets": "[no data]", "Id": "auditd.service", "IgnoreOnIsolate": "no", "IgnoreSIGPIPE": "yes", "InactiveEnterTimestampMonotonic": "0", "InactiveExitTimestamp": "Thu 2026-05-14 18:51:32 UTC", "InactiveExitTimestampMonotonic": "153731411", "InvocationID": "eb9a17996b454a29b3b74914263a3157", "JobRunningTimeoutUSec": "infinity", "JobTimeoutAction": "none", "JobTimeoutUSec": "infinity", "KeyringMode": "private", "KillMode": "control-group", "KillSignal": "15", "LimitAS": "infinity", "LimitASSoft": "infinity", "LimitCORE": "infinity", "LimitCORESoft": "0", "LimitCPU": "infinity", "LimitCPUSoft": "infinity", "LimitDATA": "infinity", "LimitDATASoft": "infinity", "LimitFSIZE": "infinity", "LimitFSIZESoft": "infinity", "LimitLOCKS": "infinity", "LimitLOCKSSoft": "infinity", "LimitMEMLOCK": "8388608", "LimitMEMLOCKSoft": "8388608", "LimitMSGQUEUE": "819200", "LimitMSGQUEUESoft": "819200", "LimitNICE": "0", "LimitNICESoft": "0", "LimitNOFILE": "524288", "LimitNOFILESoft": "1024", "LimitNPROC": "15372", "LimitNPROCSoft": "15372", "LimitRSS": "infinity", "LimitRSSSoft": "infinity", "LimitRTPRIO": "0", "LimitRTPRIOSoft": "0", "LimitRTTIME": "infinity", "LimitRTTIMESoft": "infinity", "LimitSIGPENDING": "15372", "LimitSIGPENDINGSoft": "15372", "LimitSTACK": "infinity", "LimitSTACKSoft": "8388608", "LoadState": "loaded", "LockPersonality": "yes", "LogLevelMax": "-1", "LogRateLimitBurst": "0", "LogRateLimitIntervalUSec": "0", "LogsDirectoryMode": "0755", "MainPID": "2161", "ManagedOOMMemoryPressure": "auto", "ManagedOOMMemoryPressureLimit": "0", "ManagedOOMPreference": "none", "ManagedOOMSwap": "auto", "MemoryAccounting": "yes", "MemoryAvailable": "3516272640", "MemoryCurrent": "512000", "MemoryDenyWriteExecute": "yes", "MemoryHigh": "infinity", "MemoryKSM": "no", "MemoryLimit": "infinity", "MemoryLow": "0", "MemoryMax": "infinity", "MemoryMin": "0", "MemoryPeak": "2088960", "MemoryPressureThresholdUSec": "200ms", "MemoryPressureWatch": "auto", "MemorySwapCurrent": "0", "MemorySwapMax": "infinity", "MemorySwapPeak": "0", "MemoryZSwapCurrent": "0", "MemoryZSwapMax": "infinity", "MountAPIVFS": "no", "MountImagePolicy": "root=verity+signed+encrypted+unprotected+absent:usr=verity+signed+encrypted+unprotected+absent:home=encrypted+unprotected+absent:srv=encrypted+unprotected+absent:tmp=encrypted+unprotected+absent:var=encrypted+unprotected+absent", "NFileDescriptorStore": "0", "NRestarts": "0", "NUMAPolicy": "n/a", "Names": "auditd.service", "NeedDaemonReload": "no", "Nice": "0", "NoNewPrivileges": "no", "NonBlocking": "no", "NotifyAccess": "none", "OOMPolicy": "stop", "OOMScoreAdjust": "0", "OnFailureJobMode": "replace", "OnSuccessJobMode": "fail", "PIDFile": "/run/auditd.pid", "Perpetual": "no", "PrivateDevices": "no", "PrivateIPC": "no", "PrivateMounts": "no", "PrivateNetwork": "no", "PrivateTmp": "no", "PrivateUsers": "no", "ProcSubset": "all", "ProtectClock": "no", "ProtectControlGroups": "no", "ProtectHome": "no", "ProtectHostname": "no", "ProtectKernelLogs": "no", "ProtectKernelModules": "yes", "ProtectKernelTunables": "no", "ProtectProc": "default", "ProtectSystem": "no", "RefuseManualStart": "no", "RefuseManualStop": "no", "ReloadResult": "success", "ReloadSignal": "1", "RemainAfterExit": "no", "RemoveIPC": "no", "Requires": "system.slice", "Restart": "on-failure", "RestartKillSignal": "15", "RestartMaxDelayUSec": "infinity", "RestartMode": "normal", "RestartPreventExitStatus": "2 4 6", "RestartSteps": "0", "RestartUSec": "100ms", "RestartUSecNext": "100ms", "RestrictNamespaces": "no", "RestrictRealtime": "yes", "RestrictSUIDSGID": "no", "Result": "success", "RootDirectoryStartOnly": "no", "RootEphemeral": "no", "RootImagePolicy": "root=verity+signed+encrypted+unprotected+absent:usr=verity+signed+encrypted+unprotected+absent:home=encrypted+unprotected+absent:srv=encrypted+unprotected+absent:tmp=encrypted+unprotected+absent:var=encrypted+unprotected+absent", "RuntimeDirectoryMode": "0755", "RuntimeDirectoryPreserve": "no", "RuntimeMaxUSec": "infinity", "RuntimeRandomizedExtraUSec": "0", "SameProcessGroup": "no", "SecureBits": "0", "SendSIGHUP": "no", "SendSIGKILL": "yes", "SetLoginEnvironment": "no", "Slice": "system.slice", "StandardError": "inherit", "StandardInput": "null", "StandardOutput": "journal", "StartLimitAction": "none", "StartLimitBurst": "5", "StartLimitIntervalUSec": "10s", "StartupBlockIOWeight": "[not set]", "StartupCPUShares": "[not set]", "StartupCPUWeight": "[not set]", "StartupIOWeight": "[not set]", "StartupMemoryHigh": "infinity", "StartupMemoryLow": "0", "StartupMemoryMax": "infinity", "StartupMemorySwapMax": "infinity", "StartupMemoryZSwapMax": "infinity", "StateChangeTimestamp": "Thu 2026-05-14 18:51:32 UTC", "StateChangeTimestampMonotonic": "153775674", "StateDirectoryMode": "0755", "StatusErrno": "0", "StopWhenUnneeded": "no", "SubState": "running", "SuccessAction": "none", "SurviveFinalKillSignal": "no", "SyslogFacility": "3", "SyslogLevel": "6", "SyslogLevelPrefix": "yes", "SyslogPriority": "30", "SystemCallErrorNumber": "2147483646", "TTYReset": "no", "TTYVHangup": "no", "TTYVTDisallocate": "no", "TasksAccounting": "yes", "TasksCurrent": "2", "TasksMax": "4611", "TimeoutAbortUSec": "1min 30s", "TimeoutCleanUSec": "infinity", "TimeoutStartFailureMode": "terminate", "TimeoutStartUSec": "1min 30s", "TimeoutStopFailureMode": "terminate", "TimeoutStopUSec": "1min 30s", "TimerSlackNSec": "50000", "Transient": "no", "Type": "forking", "UID": "[not set]", "UMask": "0022", "UnitFilePreset": "enabled", "UnitFileState": "enabled", "UtmpMode": "init", "WantedBy": "multi-user.target", "WatchdogSignal": "6", "WatchdogTimestampMonotonic": "0", "WatchdogUSec": "0"}} 2026-05-14 18:51:42.016148 | ubuntu-noble | 2026-05-14 18:51:42.016362 | ubuntu-noble | RUNNING HANDLER [auditd : Generate auditd rules] ******************************* 2026-05-14 18:51:42.435740 | ubuntu-noble | changed: [molecule-auditd] => {"changed": true, "cmd": ["augenrules", "--load"], "delta": "0:00:00.072621", "end": "2026-05-14 18:51:42.374511", "msg": "", "rc": 0, "start": "2026-05-14 18:51:42.301890", "stderr": "Unknown user: chrony\nThere was an error in line 24 of /etc/audit/audit.rules\nError sending add rule data request (No such file or directory)\nThere was an error in line 28 of /etc/audit/audit.rules\nUnknown user: ntp\nThere was an error in line 44 of /etc/audit/audit.rules\nError sending add rule data request (No such file or directory)\nThere was an error in line 83 of /etc/audit/audit.rules\nError sending add rule data request (No such file or directory)\nThere was an error in line 84 of /etc/audit/audit.rules\nError sending add rule data request (No such file or directory)\nThere was an error in line 86 of /etc/audit/audit.rules\nError sending add rule data request (No such file or directory)\nThere was an error in line 112 of /etc/audit/audit.rules\nError sending add rule data request (No such file or directory)\nThere was an error in line 115 of /etc/audit/audit.rules\nError sending add rule data request (No such file or directory)\nThere was an error in line 176 of /etc/audit/audit.rules\nError sending add rule data request (No such file or directory)\nThere was an error in line 177 of /etc/audit/audit.rules\nError sending add rule data request (No such file or directory)\nThere was an error in line 178 of /etc/audit/audit.rules\nError sending add rule data request (No such file or directory)\nThere was an error in line 179 of /etc/audit/audit.rules\nError sending add rule data request (No such file or directory)\nThere was an error in line 180 of /etc/audit/audit.rules\nError sending add rule data request (No such file or directory)\nThere was an error in line 217 of /etc/audit/audit.rules\nError sending add rule data request (No such file or directory)\nThere was an error in line 218 of /etc/audit/audit.rules\nError sending add rule data request (No such file or directory)\nThere was an error in line 234 of /etc/audit/audit.rules\nError sending add rule data request (No such file or directory)\nThere was an error in line 285 of /etc/audit/audit.rules\nError sending add rule data request (No such file or directory)\nThere was an error in line 286 of /etc/audit/audit.rules\nError sending add rule data request (No such file or directory)\nThere was an error in line 324 of /etc/audit/audit.rules\nError sending add rule data request (No such file or directory)\nThere was an error in line 325 of /etc/audit/audit.rules\nError sending add rule data request (No such file or directory)\nThere was an error in line 346 of /etc/audit/audit.rules\nparameter passed without an option given\nThere was an error in line 347 of /etc/audit/audit.rules\nparameter passed without an option given\nThere was an error in line 348 of /etc/audit/audit.rules\nparameter passed without an option given\nThere was an error in line 349 of /etc/audit/audit.rules\nparameter passed without an option given\nThere was an error in line 350 of /etc/audit/audit.rules\nparameter passed without an option given\nThere was an error in line 351 of /etc/audit/audit.rules\nError sending add rule data request (No such file or directory)\nThere was an error in line 359 of /etc/audit/audit.rules", "stderr_lines": ["Unknown user: chrony", "There was an error in line 24 of /etc/audit/audit.rules", "Error sending add rule data request (No such file or directory)", "There was an error in line 28 of /etc/audit/audit.rules", "Unknown user: ntp", "There was an error in line 44 of /etc/audit/audit.rules", "Error sending add rule data request (No such file or directory)", "There was an error in line 83 of /etc/audit/audit.rules", "Error sending add rule data request (No such file or directory)", "There was an error in line 84 of /etc/audit/audit.rules", "Error sending add rule data request (No such file or directory)", "There was an error in line 86 of /etc/audit/audit.rules", "Error sending add rule data request (No such file or directory)", "There was an error in line 112 of /etc/audit/audit.rules", "Error sending add rule data request (No such file or directory)", "There was an error in line 115 of /etc/audit/audit.rules", "Error sending add rule data request (No such file or directory)", "There was an error in line 176 of /etc/audit/audit.rules", "Error sending add rule data request (No such file or directory)", "There was an error in line 177 of /etc/audit/audit.rules", "Error sending add rule data request (No such file or directory)", "There was an error in line 178 of /etc/audit/audit.rules", "Error sending add rule data request (No such file or directory)", "There was an error in line 179 of /etc/audit/audit.rules", "Error sending add rule data request (No such file or directory)", "There was an error in line 180 of /etc/audit/audit.rules", "Error sending add rule data request (No such file or directory)", "There was an error in line 217 of /etc/audit/audit.rules", "Error sending add rule data request (No such file or directory)", "There was an error in line 218 of /etc/audit/audit.rules", "Error sending add rule data request (No such file or directory)", "There was an error in line 234 of /etc/audit/audit.rules", "Error sending add rule data request (No such file or directory)", "There was an error in line 285 of /etc/audit/audit.rules", "Error sending add rule data request (No such file or directory)", "There was an error in line 286 of /etc/audit/audit.rules", "Error sending add rule data request (No such file or directory)", "There was an error in line 324 of /etc/audit/audit.rules", "Error sending add rule data request (No such file or directory)", "There was an error in line 325 of /etc/audit/audit.rules", "Error sending add rule data request (No such file or directory)", "There was an error in line 346 of /etc/audit/audit.rules", "parameter passed without an option given", "There was an error in line 347 of /etc/audit/audit.rules", "parameter passed without an option given", "There was an error in line 348 of /etc/audit/audit.rules", "parameter passed without an option given", "There was an error in line 349 of /etc/audit/audit.rules", "parameter passed without an option given", "There was an error in line 350 of /etc/audit/audit.rules", "parameter passed without an option given", "There was an error in line 351 of /etc/audit/audit.rules", "Error sending add rule data request (No such file or directory)", "There was an error in line 359 of /etc/audit/audit.rules"], "stdout": "/usr/sbin/augenrules: No change\nNo rules\nenabled 1\nfailure 1\npid 2553\nrate_limit 0\nbacklog_limit 8192\nlost 0\nbacklog 963\nbacklog_wait_time 60000\nbacklog_wait_time_actual 0\nenabled 1\nfailure 1\npid 2553\nrate_limit 0\nbacklog_limit 8192\nlost 0\nbacklog 961\nbacklog_wait_time 60000\nbacklog_wait_time_actual 0", "stdout_lines": ["/usr/sbin/augenrules: No change", "No rules", "enabled 1", "failure 1", "pid 2553", "rate_limit 0", "backlog_limit 8192", "lost 0", "backlog 963", "backlog_wait_time 60000", "backlog_wait_time_actual 0", "enabled 1", "failure 1", "pid 2553", "rate_limit 0", "backlog_limit 8192", "lost 0", "backlog 961", "backlog_wait_time 60000", "backlog_wait_time_actual 0"]} 2026-05-14 18:51:42.436032 | ubuntu-noble | 2026-05-14 18:51:42.436194 | ubuntu-noble | RUNNING HANDLER [auditd : Restart auditd service] ****************************** 2026-05-14 18:51:43.245152 | ubuntu-noble | changed: [molecule-auditd] => {"changed": true, "name": "auditd", "state": "started", "status": {"ActiveEnterTimestamp": "Thu 2026-05-14 18:51:41 UTC", "ActiveEnterTimestampMonotonic": "163498830", "ActiveExitTimestamp": "Thu 2026-05-14 18:51:41 UTC", "ActiveExitTimestampMonotonic": "163351829", "ActiveState": "active", "After": "local-fs.target system.slice systemd-tmpfiles-setup.service systemd-journald.socket", "AllowIsolate": "no", "AssertResult": "yes", "AssertTimestamp": "Thu 2026-05-14 18:51:41 UTC", "AssertTimestampMonotonic": "163393320", "Before": "ssh.service shutdown.target sysinit.target systemd-update-utmp.service", "BlockIOAccounting": "no", "BlockIOWeight": "[not set]", "CPUAccounting": "yes", "CPUAffinityFromNUMA": "no", "CPUQuotaPerSecUSec": "infinity", "CPUQuotaPeriodUSec": "infinity", "CPUSchedulingPolicy": "0", "CPUSchedulingPriority": "0", "CPUSchedulingResetOnFork": "no", "CPUShares": "[not set]", "CPUUsageNSec": "151234000", "CPUWeight": "[not set]", "CacheDirectoryMode": "0755", "CanFreeze": "yes", "CanIsolate": "no", "CanReload": "no", "CanStart": "yes", "CanStop": "yes", "CapabilityBoundingSet": "cap_chown cap_dac_override cap_dac_read_search cap_fowner cap_fsetid cap_kill cap_setgid cap_setuid cap_setpcap cap_linux_immutable cap_net_bind_service cap_net_broadcast cap_net_admin cap_net_raw cap_ipc_lock cap_ipc_owner cap_sys_rawio cap_sys_chroot cap_sys_ptrace cap_sys_pacct cap_sys_admin cap_sys_boot cap_sys_nice cap_sys_resource cap_sys_time cap_sys_tty_config cap_mknod cap_lease cap_audit_write cap_audit_control cap_setfcap cap_mac_override cap_mac_admin cap_syslog cap_wake_alarm cap_block_suspend cap_audit_read cap_perfmon cap_bpf cap_checkpoint_restore", "CleanResult": "success", "CollectMode": "inactive", "ConditionResult": "yes", "ConditionTimestamp": "Thu 2026-05-14 18:51:41 UTC", "ConditionTimestampMonotonic": "163393228", "ConfigurationDirectoryMode": "0755", "Conflicts": "shutdown.target", "ControlGroup": "/system.slice/auditd.service", "ControlGroupId": "3868", "ControlPID": "0", "CoredumpFilter": "0x33", "CoredumpReceive": "no", "DefaultDependencies": "no", "DefaultMemoryLow": "0", "DefaultMemoryMin": "0", "DefaultStartupMemoryLow": "0", "Delegate": "no", "Description": "Security Auditing Service", "DevicePolicy": "auto", "Documentation": "\"man:auditd(8)\" https://github.com/linux-audit/audit-documentation", "DynamicUser": "no", "ExecMainCode": "0", "ExecMainExitTimestampMonotonic": "0", "ExecMainPID": "2553", "ExecMainStartTimestamp": "Thu 2026-05-14 18:51:41 UTC", "ExecMainStartTimestampMonotonic": "163425759", "ExecMainStatus": "0", "ExecStart": "{ path=/sbin/auditd ; argv[]=/sbin/auditd ; ignore_errors=no ; start_time=[Thu 2026-05-14 18:51:41 UTC] ; stop_time=[Thu 2026-05-14 18:51:41 UTC] ; pid=2552 ; code=exited ; status=0 }", "ExecStartEx": "{ path=/sbin/auditd ; argv[]=/sbin/auditd ; flags= ; start_time=[Thu 2026-05-14 18:51:41 UTC] ; stop_time=[Thu 2026-05-14 18:51:41 UTC] ; pid=2552 ; code=exited ; status=0 }", "ExecStartPost": "{ path=/sbin/augenrules ; argv[]=/sbin/augenrules --load ; ignore_errors=yes ; start_time=[Thu 2026-05-14 18:51:41 UTC] ; stop_time=[Thu 2026-05-14 18:51:41 UTC] ; pid=2556 ; code=exited ; status=0 }", "ExecStartPostEx": "{ path=/sbin/augenrules ; argv[]=/sbin/augenrules --load ; flags=ignore-failure ; start_time=[Thu 2026-05-14 18:51:41 UTC] ; stop_time=[Thu 2026-05-14 18:51:41 UTC] ; pid=2556 ; code=exited ; status=0 }", "ExitType": "main", "ExtensionImagePolicy": "root=verity+signed+encrypted+unprotected+absent:usr=verity+signed+encrypted+unprotected+absent:home=encrypted+unprotected+absent:srv=encrypted+unprotected+absent:tmp=encrypted+unprotected+absent:var=encrypted+unprotected+absent", "FailureAction": "none", "FileDescriptorStoreMax": "0", "FileDescriptorStorePreserve": "restart", "FinalKillSignal": "9", "FragmentPath": "/usr/lib/systemd/system/auditd.service", "FreezerState": "running", "GID": "[not set]", "GuessMainPID": "yes", "IOAccounting": "no", "IOReadBytes": "[not set]", "IOReadOperations": "[not set]", "IOSchedulingClass": "2", "IOSchedulingPriority": "4", "IOWeight": "[not set]", "IOWriteBytes": "[not set]", "IOWriteOperations": "[not set]", "IPAccounting": "no", "IPEgressBytes": "[no data]", "IPEgressPackets": "[no data]", "IPIngressBytes": "[no data]", "IPIngressPackets": "[no data]", "Id": "auditd.service", "IgnoreOnIsolate": "no", "IgnoreSIGPIPE": "yes", "InactiveEnterTimestamp": "Thu 2026-05-14 18:51:41 UTC", "InactiveEnterTimestampMonotonic": "163391661", "InactiveExitTimestamp": "Thu 2026-05-14 18:51:41 UTC", "InactiveExitTimestampMonotonic": "163402537", "InvocationID": "4059058cfc724549a881345ade08609c", "JobRunningTimeoutUSec": "infinity", "JobTimeoutAction": "none", "JobTimeoutUSec": "infinity", "KeyringMode": "private", "KillMode": "control-group", "KillSignal": "15", "LimitAS": "infinity", "LimitASSoft": "infinity", "LimitCORE": "infinity", "LimitCORESoft": "0", "LimitCPU": "infinity", "LimitCPUSoft": "infinity", "LimitDATA": "infinity", "LimitDATASoft": "infinity", "LimitFSIZE": "infinity", "LimitFSIZESoft": "infinity", "LimitLOCKS": "infinity", "LimitLOCKSSoft": "infinity", "LimitMEMLOCK": "8388608", "LimitMEMLOCKSoft": "8388608", "LimitMSGQUEUE": "819200", "LimitMSGQUEUESoft": "819200", "LimitNICE": "0", "LimitNICESoft": "0", "LimitNOFILE": "524288", "LimitNOFILESoft": "1024", "LimitNPROC": "15372", "LimitNPROCSoft": "15372", "LimitRSS": "infinity", "LimitRSSSoft": "infinity", "LimitRTPRIO": "0", "LimitRTPRIOSoft": "0", "LimitRTTIME": "infinity", "LimitRTTIMESoft": "infinity", "LimitSIGPENDING": "15372", "LimitSIGPENDINGSoft": "15372", "LimitSTACK": "infinity", "LimitSTACKSoft": "8388608", "LoadState": "loaded", "LockPersonality": "yes", "LogLevelMax": "-1", "LogRateLimitBurst": "0", "LogRateLimitIntervalUSec": "0", "LogsDirectoryMode": "0755", "MainPID": "2553", "ManagedOOMMemoryPressure": "auto", "ManagedOOMMemoryPressureLimit": "0", "ManagedOOMPreference": "none", "ManagedOOMSwap": "auto", "MemoryAccounting": "yes", "MemoryAvailable": "3520258048", "MemoryCurrent": "1859584", "MemoryDenyWriteExecute": "yes", "MemoryHigh": "infinity", "MemoryKSM": "no", "MemoryLimit": "infinity", "MemoryLow": "0", "MemoryMax": "infinity", "MemoryMin": "0", "MemoryPeak": "2207744", "MemoryPressureThresholdUSec": "200ms", "MemoryPressureWatch": "auto", "MemorySwapCurrent": "0", "MemorySwapMax": "infinity", "MemorySwapPeak": "0", "MemoryZSwapCurrent": "0", "MemoryZSwapMax": "infinity", "MountAPIVFS": "no", "MountImagePolicy": "root=verity+signed+encrypted+unprotected+absent:usr=verity+signed+encrypted+unprotected+absent:home=encrypted+unprotected+absent:srv=encrypted+unprotected+absent:tmp=encrypted+unprotected+absent:var=encrypted+unprotected+absent", "NFileDescriptorStore": "0", "NRestarts": "0", "NUMAPolicy": "n/a", "Names": "auditd.service", "NeedDaemonReload": "no", "Nice": "0", "NoNewPrivileges": "no", "NonBlocking": "no", "NotifyAccess": "none", "OOMPolicy": "stop", "OOMScoreAdjust": "0", "OnFailureJobMode": "replace", "OnSuccessJobMode": "fail", "PIDFile": "/run/auditd.pid", "Perpetual": "no", "PrivateDevices": "no", "PrivateIPC": "no", "PrivateMounts": "no", "PrivateNetwork": "no", "PrivateTmp": "no", "PrivateUsers": "no", "ProcSubset": "all", "ProtectClock": "no", "ProtectControlGroups": "no", "ProtectHome": "no", "ProtectHostname": "no", "ProtectKernelLogs": "no", "ProtectKernelModules": "yes", "ProtectKernelTunables": "no", "ProtectProc": "default", "ProtectSystem": "no", "RefuseManualStart": "no", "RefuseManualStop": "no", "ReloadResult": "success", "ReloadSignal": "1", "RemainAfterExit": "no", "RemoveIPC": "no", "Requires": "system.slice", "Restart": "on-failure", "RestartKillSignal": "15", "RestartMaxDelayUSec": "infinity", "RestartMode": "normal", "RestartPreventExitStatus": "2 4 6", "RestartSteps": "0", "RestartUSec": "100ms", "RestartUSecNext": "100ms", "RestrictNamespaces": "no", "RestrictRealtime": "yes", "RestrictSUIDSGID": "no", "Result": "success", "RootDirectoryStartOnly": "no", "RootEphemeral": "no", "RootImagePolicy": "root=verity+signed+encrypted+unprotected+absent:usr=verity+signed+encrypted+unprotected+absent:home=encrypted+unprotected+absent:srv=encrypted+unprotected+absent:tmp=encrypted+unprotected+absent:var=encrypted+unprotected+absent", "RuntimeDirectoryMode": "0755", "RuntimeDirectoryPreserve": "no", "RuntimeMaxUSec": "infinity", "RuntimeRandomizedExtraUSec": "0", "SameProcessGroup": "no", "SecureBits": "0", "SendSIGHUP": "no", "SendSIGKILL": "yes", "SetLoginEnvironment": "no", "Slice": "system.slice", "StandardError": "inherit", "StandardInput": "null", "StandardOutput": "journal", "StartLimitAction": "none", "StartLimitBurst": "5", "StartLimitIntervalUSec": "10s", "StartupBlockIOWeight": "[not set]", "StartupCPUShares": "[not set]", "StartupCPUWeight": "[not set]", "StartupIOWeight": "[not set]", "StartupMemoryHigh": "infinity", "StartupMemoryLow": "0", "StartupMemoryMax": "infinity", "StartupMemorySwapMax": "infinity", "StartupMemoryZSwapMax": "infinity", "StateChangeTimestamp": "Thu 2026-05-14 18:51:41 UTC", "StateChangeTimestampMonotonic": "163498830", "StateDirectoryMode": "0755", "StatusErrno": "0", "StopWhenUnneeded": "no", "SubState": "running", "SuccessAction": "none", "SurviveFinalKillSignal": "no", "SyslogFacility": "3", "SyslogLevel": "6", "SyslogLevelPrefix": "yes", "SyslogPriority": "30", "SystemCallErrorNumber": "2147483646", "TTYReset": "no", "TTYVHangup": "no", "TTYVTDisallocate": "no", "TasksAccounting": "yes", "TasksCurrent": "2", "TasksMax": "4611", "TimeoutAbortUSec": "1min 30s", "TimeoutCleanUSec": "infinity", "TimeoutStartFailureMode": "terminate", "TimeoutStartUSec": "1min 30s", "TimeoutStopFailureMode": "terminate", "TimeoutStopUSec": "1min 30s", "TimerSlackNSec": "50000", "Transient": "no", "Type": "forking", "UID": "[not set]", "UMask": "0022", "UnitFilePreset": "enabled", "UnitFileState": "enabled", "UtmpMode": "init", "WantedBy": "multi-user.target", "WatchdogSignal": "6", "WatchdogTimestampMonotonic": "0", "WatchdogUSec": "0"}} 2026-05-14 18:51:43.248651 | ubuntu-noble | 2026-05-14 18:51:43.248681 | ubuntu-noble | PLAY RECAP ********************************************************************* 2026-05-14 18:51:43.248688 | ubuntu-noble | molecule-auditd : ok=15 changed=8 unreachable=0 failed=0 skipped=0 rescued=0 ignored=0 2026-05-14 18:51:43.248692 | ubuntu-noble | 2026-05-14 18:51:43.359574 | ubuntu-noble | INFO [delegated > converge] Executed: Successful 2026-05-14 18:51:43.360208 | ubuntu-noble | WARNING Molecule executed 1 scenario (1 missing files) 2026-05-14 18:51:43.536814 | ubuntu-noble | ok: Runtime: 0:00:20.487295 2026-05-14 18:51:43.554317 | 2026-05-14 18:51:43.554461 | TASK [ansible-molecule : Run molecule verify action with scenario delegated] 2026-05-14 18:51:44.355519 | ubuntu-noble | WARNING Molecule scenarios should migrate to 'extensions/molecule' 2026-05-14 18:51:44.364485 | ubuntu-noble | DEBUG [unknown > config] provisioner.env found in /home/zuul/src/github.com/osism/ansible-collection-services/molecule/delegated/molecule.yml, this can be defined in ansible.env 2026-05-14 18:51:44.260019 | debian-bookworm | WARNING Molecule scenarios should migrate to 'extensions/molecule' 2026-05-14 18:51:44.273005 | debian-bookworm | DEBUG [unknown > config] provisioner.env found in /home/zuul/src/github.com/osism/ansible-collection-services/molecule/delegated/molecule.yml, this can be defined in ansible.env 2026-05-14 18:51:44.911640 | ubuntu-noble | DEBUG [unknown > config] provisioner.env found in /home/zuul/src/github.com/osism/ansible-collection-services/molecule/delegated/molecule.yml, this can be defined in ansible.env 2026-05-14 18:51:44.912612 | ubuntu-noble | DEBUG [delegated > validate] Validating schema /home/zuul/src/github.com/osism/ansible-collection-services/molecule/delegated/molecule.yml. 2026-05-14 18:51:44.925086 | ubuntu-noble | CRITICAL 'molecule/default/molecule.yml' glob failed. Exiting. 2026-05-14 18:51:44.925241 | ubuntu-noble | INFO default scenario not found, disabling shared state. 2026-05-14 18:51:44.925522 | ubuntu-noble | INFO [delegated > discovery] scenario test matrix: verify 2026-05-14 18:51:44.925642 | ubuntu-noble | INFO [delegated > prerun] Performing prerun with role_name_check=0... 2026-05-14 18:51:44.755893 | debian-bookworm | DEBUG [unknown > config] provisioner.env found in /home/zuul/src/github.com/osism/ansible-collection-services/molecule/delegated/molecule.yml, this can be defined in ansible.env 2026-05-14 18:51:44.756688 | debian-bookworm | DEBUG [delegated > validate] Validating schema /home/zuul/src/github.com/osism/ansible-collection-services/molecule/delegated/molecule.yml. 2026-05-14 18:51:44.767865 | debian-bookworm | CRITICAL 'molecule/default/molecule.yml' glob failed. Exiting. 2026-05-14 18:51:44.768015 | debian-bookworm | INFO default scenario not found, disabling shared state. 2026-05-14 18:51:44.768293 | debian-bookworm | INFO [delegated > discovery] scenario test matrix: verify 2026-05-14 18:51:44.768458 | debian-bookworm | INFO [delegated > prerun] Performing prerun with role_name_check=0... 2026-05-14 18:51:46.317738 | debian-bookworm | INFO [delegated > verify] Executing 2026-05-14 18:51:46.319505 | debian-bookworm | INFO [delegated > verify] Executing Testinfra tests found in /home/zuul/src/github.com/osism/ansible-collection-services/molecule/delegated/tests/... 2026-05-14 18:51:46.320614 | debian-bookworm | DEBUG ANSIBLE ENVIRONMENT: 2026-05-14 18:51:46.320638 | debian-bookworm | ANSIBLE_COLLECTIONS_PATH: /home/zuul/venv/.ansible/collections:/home/zuul/.ansible/collections 2026-05-14 18:51:46.320648 | debian-bookworm | ANSIBLE_CONFIG: /home/zuul/.ansible/tmp/molecule.oWZD.delegated/ansible.cfg 2026-05-14 18:51:46.320655 | debian-bookworm | ANSIBLE_LIBRARY: ../../plugins 2026-05-14 18:51:46.320661 | debian-bookworm | ANSIBLE_PYTHON_INTERPRETER: /home/zuul/venv/bin/python 2026-05-14 18:51:46.320668 | debian-bookworm | ANSIBLE_ROLE: auditd 2026-05-14 18:51:46.320674 | debian-bookworm | ANSIBLE_ROLES_PATH: ../../roles 2026-05-14 18:51:46.320680 | debian-bookworm | ANSIBLE_VERBOSITY: 1 2026-05-14 18:51:46.320686 | debian-bookworm | 2026-05-14 18:51:46.320865 | debian-bookworm | DEBUG MOLECULE ENVIRONMENT: 2026-05-14 18:51:46.320876 | debian-bookworm | MOLECULE_DEBUG: True 2026-05-14 18:51:46.320882 | debian-bookworm | MOLECULE_DEPENDENCY_NAME: galaxy 2026-05-14 18:51:46.320889 | debian-bookworm | MOLECULE_DRIVER_NAME: default 2026-05-14 18:51:46.320895 | debian-bookworm | MOLECULE_ENV_FILE: /home/zuul/src/github.com/osism/ansible-collection-services/.env.yml 2026-05-14 18:51:46.320901 | debian-bookworm | MOLECULE_EPHEMERAL_DIRECTORY: /home/zuul/.ansible/tmp/molecule.oWZD.delegated 2026-05-14 18:51:46.320908 | debian-bookworm | MOLECULE_FILE: /home/zuul/.ansible/tmp/molecule.oWZD.delegated/molecule.yml 2026-05-14 18:51:46.320913 | debian-bookworm | MOLECULE_INSTANCE_CONFIG: /home/zuul/.ansible/tmp/molecule.oWZD.delegated/instance_config.yml 2026-05-14 18:51:46.320919 | debian-bookworm | MOLECULE_INVENTORY_FILE: /home/zuul/.ansible/tmp/molecule.oWZD.delegated/inventory/ansible_inventory.yml 2026-05-14 18:51:46.320926 | debian-bookworm | MOLECULE_PROJECT_DIRECTORY: /home/zuul/src/github.com/osism/ansible-collection-services 2026-05-14 18:51:46.320932 | debian-bookworm | MOLECULE_PROVISIONER_NAME: ansible 2026-05-14 18:51:46.320938 | debian-bookworm | MOLECULE_SCENARIO_DIRECTORY: /home/zuul/src/github.com/osism/ansible-collection-services/molecule/delegated 2026-05-14 18:51:46.320944 | debian-bookworm | MOLECULE_SCENARIO_NAME: delegated 2026-05-14 18:51:46.320949 | debian-bookworm | MOLECULE_STATE_FILE: /home/zuul/.ansible/tmp/molecule.oWZD.delegated/state.yml 2026-05-14 18:51:46.320956 | debian-bookworm | MOLECULE_VERIFIER_NAME: testinfra 2026-05-14 18:51:46.320962 | debian-bookworm | MOLECULE_VERIFIER_TEST_DIRECTORY: /home/zuul/src/github.com/osism/ansible-collection-services/molecule/delegated/tests 2026-05-14 18:51:46.320968 | debian-bookworm | 2026-05-14 18:51:46.321155 | debian-bookworm | DEBUG SHELL REPLAY: ANSIBLE_COLLECTIONS_PATH=/home/zuul/venv/.ansible/collections:/home/zuul/.ansible/collections ANSIBLE_CONFIG=/home/zuul/.ansible/tmp/molecule.oWZD.delegated/ansible.cfg ANSIBLE_LIBRARY=../../plugins ANSIBLE_PYTHON_INTERPRETER=/home/zuul/venv/bin/python ANSIBLE_ROLE=auditd ANSIBLE_ROLES_PATH=../../roles ANSIBLE_VERBOSITY=1 MOLECULE_DEBUG=True MOLECULE_DEPENDENCY_NAME=galaxy MOLECULE_DRIVER_NAME=default MOLECULE_ENV_FILE=/home/zuul/src/github.com/osism/ansible-collection-services/.env.yml MOLECULE_EPHEMERAL_DIRECTORY=/home/zuul/.ansible/tmp/molecule.oWZD.delegated MOLECULE_FILE=/home/zuul/.ansible/tmp/molecule.oWZD.delegated/molecule.yml MOLECULE_INSTANCE_CONFIG=/home/zuul/.ansible/tmp/molecule.oWZD.delegated/instance_config.yml MOLECULE_INVENTORY_FILE=/home/zuul/.ansible/tmp/molecule.oWZD.delegated/inventory/ansible_inventory.yml MOLECULE_PROJECT_DIRECTORY=/home/zuul/src/github.com/osism/ansible-collection-services MOLECULE_PROVISIONER_NAME=ansible MOLECULE_SCENARIO_DIRECTORY=/home/zuul/src/github.com/osism/ansible-collection-services/molecule/delegated MOLECULE_SCENARIO_NAME=delegated MOLECULE_STATE_FILE=/home/zuul/.ansible/tmp/molecule.oWZD.delegated/state.yml MOLECULE_VERIFIER_NAME=testinfra MOLECULE_VERIFIER_TEST_DIRECTORY=/home/zuul/src/github.com/osism/ansible-collection-services/molecule/delegated/tests 2026-05-14 18:51:46.589136 | debian-bookworm | writing pytest debug information to pytestdebug.log 2026-05-14 18:51:46.598031 | ubuntu-noble | INFO [delegated > verify] Executing 2026-05-14 18:51:46.600759 | ubuntu-noble | INFO [delegated > verify] Executing Testinfra tests found in /home/zuul/src/github.com/osism/ansible-collection-services/molecule/delegated/tests/... 2026-05-14 18:51:46.602567 | ubuntu-noble | DEBUG ANSIBLE ENVIRONMENT: 2026-05-14 18:51:46.602603 | ubuntu-noble | ANSIBLE_COLLECTIONS_PATH: /home/zuul/venv/.ansible/collections:/home/zuul/.ansible/collections 2026-05-14 18:51:46.602615 | ubuntu-noble | ANSIBLE_CONFIG: /home/zuul/.ansible/tmp/molecule.oWZD.delegated/ansible.cfg 2026-05-14 18:51:46.602625 | ubuntu-noble | ANSIBLE_LIBRARY: ../../plugins 2026-05-14 18:51:46.602633 | ubuntu-noble | ANSIBLE_PYTHON_INTERPRETER: /home/zuul/venv/bin/python 2026-05-14 18:51:46.602641 | ubuntu-noble | ANSIBLE_ROLE: auditd 2026-05-14 18:51:46.602648 | ubuntu-noble | ANSIBLE_ROLES_PATH: ../../roles 2026-05-14 18:51:46.602656 | ubuntu-noble | ANSIBLE_VERBOSITY: 1 2026-05-14 18:51:46.602664 | ubuntu-noble | 2026-05-14 18:51:46.603016 | ubuntu-noble | DEBUG MOLECULE ENVIRONMENT: 2026-05-14 18:51:46.603035 | ubuntu-noble | MOLECULE_DEBUG: True 2026-05-14 18:51:46.603042 | ubuntu-noble | MOLECULE_DEPENDENCY_NAME: galaxy 2026-05-14 18:51:46.603049 | ubuntu-noble | MOLECULE_DRIVER_NAME: default 2026-05-14 18:51:46.603056 | ubuntu-noble | MOLECULE_ENV_FILE: /home/zuul/src/github.com/osism/ansible-collection-services/.env.yml 2026-05-14 18:51:46.603063 | ubuntu-noble | MOLECULE_EPHEMERAL_DIRECTORY: /home/zuul/.ansible/tmp/molecule.oWZD.delegated 2026-05-14 18:51:46.603070 | ubuntu-noble | MOLECULE_FILE: /home/zuul/.ansible/tmp/molecule.oWZD.delegated/molecule.yml 2026-05-14 18:51:46.603077 | ubuntu-noble | MOLECULE_INSTANCE_CONFIG: /home/zuul/.ansible/tmp/molecule.oWZD.delegated/instance_config.yml 2026-05-14 18:51:46.603084 | ubuntu-noble | MOLECULE_INVENTORY_FILE: /home/zuul/.ansible/tmp/molecule.oWZD.delegated/inventory/ansible_inventory.yml 2026-05-14 18:51:46.603091 | ubuntu-noble | MOLECULE_PROJECT_DIRECTORY: /home/zuul/src/github.com/osism/ansible-collection-services 2026-05-14 18:51:46.603097 | ubuntu-noble | MOLECULE_PROVISIONER_NAME: ansible 2026-05-14 18:51:46.603104 | ubuntu-noble | MOLECULE_SCENARIO_DIRECTORY: /home/zuul/src/github.com/osism/ansible-collection-services/molecule/delegated 2026-05-14 18:51:46.603110 | ubuntu-noble | MOLECULE_SCENARIO_NAME: delegated 2026-05-14 18:51:46.603117 | ubuntu-noble | MOLECULE_STATE_FILE: /home/zuul/.ansible/tmp/molecule.oWZD.delegated/state.yml 2026-05-14 18:51:46.603123 | ubuntu-noble | MOLECULE_VERIFIER_NAME: testinfra 2026-05-14 18:51:46.603129 | ubuntu-noble | MOLECULE_VERIFIER_TEST_DIRECTORY: /home/zuul/src/github.com/osism/ansible-collection-services/molecule/delegated/tests 2026-05-14 18:51:46.603136 | ubuntu-noble | 2026-05-14 18:51:46.603409 | ubuntu-noble | DEBUG SHELL REPLAY: ANSIBLE_COLLECTIONS_PATH=/home/zuul/venv/.ansible/collections:/home/zuul/.ansible/collections ANSIBLE_CONFIG=/home/zuul/.ansible/tmp/molecule.oWZD.delegated/ansible.cfg ANSIBLE_LIBRARY=../../plugins ANSIBLE_PYTHON_INTERPRETER=/home/zuul/venv/bin/python ANSIBLE_ROLE=auditd ANSIBLE_ROLES_PATH=../../roles ANSIBLE_VERBOSITY=1 MOLECULE_DEBUG=True MOLECULE_DEPENDENCY_NAME=galaxy MOLECULE_DRIVER_NAME=default MOLECULE_ENV_FILE=/home/zuul/src/github.com/osism/ansible-collection-services/.env.yml MOLECULE_EPHEMERAL_DIRECTORY=/home/zuul/.ansible/tmp/molecule.oWZD.delegated MOLECULE_FILE=/home/zuul/.ansible/tmp/molecule.oWZD.delegated/molecule.yml MOLECULE_INSTANCE_CONFIG=/home/zuul/.ansible/tmp/molecule.oWZD.delegated/instance_config.yml MOLECULE_INVENTORY_FILE=/home/zuul/.ansible/tmp/molecule.oWZD.delegated/inventory/ansible_inventory.yml MOLECULE_PROJECT_DIRECTORY=/home/zuul/src/github.com/osism/ansible-collection-services MOLECULE_PROVISIONER_NAME=ansible MOLECULE_SCENARIO_DIRECTORY=/home/zuul/src/github.com/osism/ansible-collection-services/molecule/delegated MOLECULE_SCENARIO_NAME=delegated MOLECULE_STATE_FILE=/home/zuul/.ansible/tmp/molecule.oWZD.delegated/state.yml MOLECULE_VERIFIER_NAME=testinfra MOLECULE_VERIFIER_TEST_DIRECTORY=/home/zuul/src/github.com/osism/ansible-collection-services/molecule/delegated/tests 2026-05-14 18:51:46.899323 | ubuntu-noble | writing pytest debug information to pytestdebug.log 2026-05-14 18:51:46.917045 | ubuntu-noble | ============================= test session starts ============================== 2026-05-14 18:51:46.917126 | ubuntu-noble | platform linux -- Python 3.12.3, pytest-8.4.2, pluggy-1.6.0 -- /home/zuul/venv/bin/python3 2026-05-14 18:51:46.917343 | ubuntu-noble | using: pytest-8.4.2 2026-05-14 18:51:46.917760 | ubuntu-noble | registered third-party plugins: 2026-05-14 18:51:46.918256 | ubuntu-noble | pytest-testinfra-10.2.2 at /home/zuul/venv/lib/python3.12/site-packages/testinfra/plugin.py 2026-05-14 18:51:46.918624 | ubuntu-noble | rootdir: /home/zuul 2026-05-14 18:51:46.919078 | ubuntu-noble | plugins: testinfra-10.2.2 2026-05-14 18:51:46.604785 | debian-bookworm | ============================= test session starts ============================== 2026-05-14 18:51:46.605335 | debian-bookworm | platform linux -- Python 3.11.2, pytest-8.4.2, pluggy-1.6.0 -- /home/zuul/venv/bin/python3 2026-05-14 18:51:46.605813 | debian-bookworm | using: pytest-8.4.2 2026-05-14 18:51:46.606158 | debian-bookworm | registered third-party plugins: 2026-05-14 18:51:46.606533 | debian-bookworm | pytest-testinfra-10.2.2 at /home/zuul/venv/lib/python3.11/site-packages/testinfra/plugin.py 2026-05-14 18:51:46.606827 | debian-bookworm | rootdir: /home/zuul 2026-05-14 18:51:46.607148 | debian-bookworm | plugins: testinfra-10.2.2 2026-05-14 18:51:48.019568 | ubuntu-noble | collecting ... collected 6 items 2026-05-14 18:51:48.020274 | ubuntu-noble | 2026-05-14 18:51:47.614264 | debian-bookworm | collecting ... collected 6 items 2026-05-14 18:51:47.614341 | debian-bookworm | 2026-05-14 18:51:51.938196 | debian-bookworm | tests/auditd.py::test_pkg[ansible://molecule-auditd] PASSED [ 16%] 2026-05-14 18:51:51.988315 | debian-bookworm | tests/auditd.py::test_conffile[ansible://molecule-auditd] PASSED [ 33%] 2026-05-14 18:51:52.925684 | ubuntu-noble | tests/auditd.py::test_pkg[ansible://molecule-auditd] PASSED [ 16%] 2026-05-14 18:51:52.978869 | ubuntu-noble | tests/auditd.py::test_conffile[ansible://molecule-auditd] PASSED [ 33%] 2026-05-14 18:51:54.500478 | debian-bookworm | tests/auditd.py::test_adjustment[ansible://molecule-auditd] PASSED [ 50%] 2026-05-14 18:51:55.875607 | ubuntu-noble | tests/auditd.py::test_adjustment[ansible://molecule-auditd] PASSED [ 50%] 2026-05-14 18:51:59.342068 | debian-bookworm | tests/auditd.py::test_rulefiles[ansible://molecule-auditd] PASSED [ 66%] 2026-05-14 18:52:00.557222 | debian-bookworm | tests/auditd.py::test_srv[ansible://molecule-auditd] PASSED [ 83%] 2026-05-14 18:52:00.633131 | debian-bookworm | wrote pytest debug information to pytestdebug.log 2026-05-14 18:52:00.633757 | debian-bookworm | tests/auditd.py::test_function[ansible://molecule-auditd] PASSED [100%] 2026-05-14 18:52:00.633854 | debian-bookworm | 2026-05-14 18:52:00.633877 | debian-bookworm | ============================== 6 passed in 13.99s ============================== 2026-05-14 18:52:00.671672 | debian-bookworm | INFO [delegated > verify] Verifier completed successfully. 2026-05-14 18:52:00.671790 | debian-bookworm | INFO [delegated > verify] Executed: Successful 2026-05-14 18:52:00.672097 | debian-bookworm | INFO Molecule executed 1 scenario (1 successful) 2026-05-14 18:52:01.117701 | debian-bookworm | ok: Runtime: 0:00:16.807895 2026-05-14 18:52:01.606387 | ubuntu-noble | tests/auditd.py::test_rulefiles[ansible://molecule-auditd] PASSED [ 66%] 2026-05-14 18:52:02.957495 | ubuntu-noble | tests/auditd.py::test_srv[ansible://molecule-auditd] PASSED [ 83%] 2026-05-14 18:52:03.041700 | ubuntu-noble | wrote pytest debug information to pytestdebug.log 2026-05-14 18:52:03.044013 | ubuntu-noble | tests/auditd.py::test_function[ansible://molecule-auditd] PASSED [100%] 2026-05-14 18:52:03.044344 | ubuntu-noble | 2026-05-14 18:52:03.044705 | ubuntu-noble | ============================== 6 passed in 16.07s ============================== 2026-05-14 18:52:03.098872 | ubuntu-noble | INFO [delegated > verify] Verifier completed successfully. 2026-05-14 18:52:03.099119 | ubuntu-noble | INFO [delegated > verify] Executed: Successful 2026-05-14 18:52:03.099921 | ubuntu-noble | INFO Molecule executed 1 scenario (1 successful) 2026-05-14 18:52:03.218815 | ubuntu-noble | ok: Runtime: 0:00:19.214315 2026-05-14 18:52:03.225632 | 2026-05-14 18:52:03.225770 | TASK [ansible-molecule : Run molecule destroy action with scenario delegated] 2026-05-14 18:52:03.784129 | debian-bookworm | skipping: Conditional result was False 2026-05-14 18:52:03.786179 | ubuntu-noble | skipping: Conditional result was False 2026-05-14 18:52:03.808710 | 2026-05-14 18:52:03.808865 | PLAY RECAP 2026-05-14 18:52:03.808932 | debian-bookworm | ok: 17 changed: 12 unreachable: 0 failed: 0 skipped: 16 rescued: 0 ignored: 0 2026-05-14 18:52:03.808965 | ubuntu-noble | ok: 17 changed: 12 unreachable: 0 failed: 0 skipped: 16 rescued: 0 ignored: 0 2026-05-14 18:52:03.808986 | 2026-05-14 18:52:04.005992 | RUN END RESULT_NORMAL: [untrusted : github.com/osism/zuul-jobs/playbooks/ansible-molecule/run.yaml@main] 2026-05-14 18:52:04.009260 | POST-RUN START: [trusted : github.com/osism/zuul-config/playbooks/base/post-fetch.yaml@main] 2026-05-14 18:52:04.825350 | 2026-05-14 18:52:04.825527 | PLAY [Base post-fetch] 2026-05-14 18:52:04.839884 | 2026-05-14 18:52:04.840024 | TASK [fetch-output : Set log path for multiple nodes] 2026-05-14 18:52:04.917504 | debian-bookworm | ok 2026-05-14 18:52:04.934648 | ubuntu-noble | ok 2026-05-14 18:52:04.940537 | 2026-05-14 18:52:04.940689 | TASK [fetch-output : Set log path for single node] 2026-05-14 18:52:04.978439 | debian-bookworm | skipping: Conditional result was False 2026-05-14 18:52:04.990582 | ubuntu-noble | skipping: Conditional result was False 2026-05-14 18:52:05.002085 | 2026-05-14 18:52:05.002330 | LOOP [fetch-output : Ensure local output dirs] 2026-05-14 18:52:05.570289 | debian-bookworm -> localhost | changed: "/var/lib/zuul/builds/6f3b451f1e134b72a0f318ea9875401f/work/logs/debian-bookworm" 2026-05-14 18:52:05.584494 | ubuntu-noble -> localhost | changed: "/var/lib/zuul/builds/6f3b451f1e134b72a0f318ea9875401f/work/logs/ubuntu-noble" 2026-05-14 18:52:05.872556 | ubuntu-noble -> localhost | changed: "/var/lib/zuul/builds/6f3b451f1e134b72a0f318ea9875401f/work/artifacts" 2026-05-14 18:52:05.975298 | debian-bookworm -> localhost | ok: "/var/lib/zuul/builds/6f3b451f1e134b72a0f318ea9875401f/work/artifacts" 2026-05-14 18:52:06.234900 | ubuntu-noble -> localhost | changed: "/var/lib/zuul/builds/6f3b451f1e134b72a0f318ea9875401f/work/docs" 2026-05-14 18:52:06.256420 | debian-bookworm -> localhost | ok: "/var/lib/zuul/builds/6f3b451f1e134b72a0f318ea9875401f/work/docs" 2026-05-14 18:52:06.256575 | debian-bookworm -> localhost | changed: All items complete 2026-05-14 18:52:06.256613 | 2026-05-14 18:52:06.276832 | 2026-05-14 18:52:06.277093 | LOOP [fetch-output : Collect logs, artifacts and docs] 2026-05-14 18:52:07.124946 | debian-bookworm | changed: 2026-05-14 18:52:07.125261 | debian-bookworm | .d..t...... ./ 2026-05-14 18:52:07.125304 | debian-bookworm | >f+++++++++ sudo-debug.txt 2026-05-14 18:52:07.125329 | debian-bookworm | >f+++++++++ sudo-strace.log 2026-05-14 18:52:07.125351 | debian-bookworm | >f+++++++++ sudo-strace.log.time 2026-05-14 18:52:07.131536 | ubuntu-noble | changed: 2026-05-14 18:52:07.131633 | ubuntu-noble | .d..t...... ./ 2026-05-14 18:52:07.131663 | ubuntu-noble | >f+++++++++ sudo-debug.txt 2026-05-14 18:52:07.131688 | ubuntu-noble | >f+++++++++ sudo-strace.log 2026-05-14 18:52:07.131710 | ubuntu-noble | >f+++++++++ sudo-strace.log.time 2026-05-14 18:52:07.705932 | ubuntu-noble | changed: .d..t...... ./ 2026-05-14 18:52:07.764676 | debian-bookworm | ok 2026-05-14 18:52:08.260705 | ubuntu-noble | changed: .d..t...... ./ 2026-05-14 18:52:08.389967 | debian-bookworm | ok 2026-05-14 18:52:08.390265 | debian-bookworm | changed: All items complete 2026-05-14 18:52:08.390334 | 2026-05-14 18:52:08.426886 | 2026-05-14 18:52:08.427108 | LOOP [merge-output-to-logs : Move artifacts and docs to logs dir] 2026-05-14 18:52:08.981634 | debian-bookworm -> localhost | ok: Item: artifacts Runtime: 0:00:00.009360 2026-05-14 18:52:09.303793 | debian-bookworm -> localhost | ok: Item: docs Runtime: 0:00:00.010697 2026-05-14 18:52:09.326537 | 2026-05-14 18:52:09.326675 | PLAY RECAP 2026-05-14 18:52:09.326734 | debian-bookworm | ok: 4 changed: 3 unreachable: 0 failed: 0 skipped: 1 rescued: 0 ignored: 0 2026-05-14 18:52:09.326769 | ubuntu-noble | ok: 3 changed: 2 unreachable: 0 failed: 0 skipped: 1 rescued: 0 ignored: 0 2026-05-14 18:52:09.326790 | 2026-05-14 18:52:09.476432 | POST-RUN END RESULT_NORMAL: [trusted : github.com/osism/zuul-config/playbooks/base/post-fetch.yaml@main] 2026-05-14 18:52:09.477901 | POST-RUN START: [trusted : github.com/osism/zuul-config/playbooks/base/post.yaml@main] 2026-05-14 18:52:10.268874 | 2026-05-14 18:52:10.269042 | PLAY [Base post] 2026-05-14 18:52:10.282307 | 2026-05-14 18:52:10.282447 | TASK [remove-build-sshkey : Remove the build SSH key from all nodes] 2026-05-14 18:52:11.136540 | debian-bookworm | changed 2026-05-14 18:52:11.175404 | ubuntu-noble | changed 2026-05-14 18:52:11.189649 | 2026-05-14 18:52:11.189804 | PLAY RECAP 2026-05-14 18:52:11.189899 | debian-bookworm | ok: 1 changed: 1 unreachable: 0 failed: 0 skipped: 0 rescued: 0 ignored: 0 2026-05-14 18:52:11.189938 | ubuntu-noble | ok: 1 changed: 1 unreachable: 0 failed: 0 skipped: 0 rescued: 0 ignored: 0 2026-05-14 18:52:11.189962 | 2026-05-14 18:52:11.340375 | POST-RUN END RESULT_NORMAL: [trusted : github.com/osism/zuul-config/playbooks/base/post.yaml@main] 2026-05-14 18:52:11.342341 | POST-RUN START: [trusted : github.com/osism/zuul-config/playbooks/base/post-logs.yaml@main] 2026-05-14 18:52:12.183759 | 2026-05-14 18:52:12.183939 | PLAY [Base post-logs] 2026-05-14 18:52:12.195497 | 2026-05-14 18:52:12.195634 | TASK [generate-zuul-manifest : Generate Zuul manifest] 2026-05-14 18:52:12.647884 | localhost | changed 2026-05-14 18:52:12.660307 | 2026-05-14 18:52:12.660464 | TASK [generate-zuul-manifest : Return Zuul manifest URL to Zuul] 2026-05-14 18:52:12.696126 | localhost | ok 2026-05-14 18:52:12.700026 | 2026-05-14 18:52:12.700127 | TASK [Set zuul-log-path fact] 2026-05-14 18:52:12.725883 | localhost | ok 2026-05-14 18:52:12.736875 | 2026-05-14 18:52:12.737161 | TASK [set-zuul-log-path-fact : Set log path for a build] 2026-05-14 18:52:12.774307 | localhost | ok 2026-05-14 18:52:12.780092 | 2026-05-14 18:52:12.780311 | TASK [upload-logs : Create log directories] 2026-05-14 18:52:13.317874 | localhost | changed 2026-05-14 18:52:13.324527 | 2026-05-14 18:52:13.324699 | TASK [upload-logs : Ensure logs are readable before uploading] 2026-05-14 18:52:13.874695 | localhost -> localhost | ok: Runtime: 0:00:00.007600 2026-05-14 18:52:13.884466 | 2026-05-14 18:52:13.884635 | TASK [upload-logs : Upload logs to log server] 2026-05-14 18:52:14.476532 | localhost | Output suppressed because no_log was given 2026-05-14 18:52:14.479602 | 2026-05-14 18:52:14.479867 | LOOP [upload-logs : Compress console log and json output] 2026-05-14 18:52:14.542658 | localhost | skipping: Conditional result was False 2026-05-14 18:52:14.547717 | localhost | skipping: Conditional result was False 2026-05-14 18:52:14.563068 | 2026-05-14 18:52:14.563372 | LOOP [upload-logs : Upload compressed console log and json output] 2026-05-14 18:52:14.625299 | localhost | skipping: Conditional result was False 2026-05-14 18:52:14.625887 | 2026-05-14 18:52:14.629747 | localhost | skipping: Conditional result was False 2026-05-14 18:52:14.638780 | 2026-05-14 18:52:14.639128 | LOOP [upload-logs : Upload console log and json output]