2026-06-02 12:59:52.217449 | Job console starting 2026-06-02 12:59:52.243154 | Updating git repos 2026-06-02 12:59:52.290775 | Cloning repos into workspace 2026-06-02 12:59:52.372376 | Restoring repo states 2026-06-02 12:59:52.392342 | Merging changes 2026-06-02 12:59:52.993395 | Checking out repos 2026-06-02 12:59:53.112980 | Preparing playbooks 2026-06-02 12:59:53.992229 | Running Ansible setup 2026-06-02 12:59:59.348898 | PRE-RUN START: [trusted : github.com/osism/zuul-config/playbooks/base/pre.yaml@main] 2026-06-02 13:00:00.162101 | 2026-06-02 13:00:00.162296 | PLAY [Base pre] 2026-06-02 13:00:00.180606 | 2026-06-02 13:00:00.180800 | TASK [Setup log path fact] 2026-06-02 13:00:00.212285 | debian-bookworm | ok 2026-06-02 13:00:00.231765 | 2026-06-02 13:00:00.231930 | TASK [set-zuul-log-path-fact : Set log path for a build] 2026-06-02 13:00:00.271744 | debian-bookworm | ok 2026-06-02 13:00:00.282239 | 2026-06-02 13:00:00.282369 | TASK [emit-job-header : Print job information] 2026-06-02 13:00:00.321708 | # Job Information 2026-06-02 13:00:00.321893 | Ansible Version: 2.16.14 2026-06-02 13:00:00.321930 | Job: ansible-collection-services-molecule-auditd 2026-06-02 13:00:00.321964 | Pipeline: check 2026-06-02 13:00:00.321987 | Executor: 521e9411259a 2026-06-02 13:00:00.322009 | Triggered by: https://github.com/osism/ansible-collection-services/pull/2090 2026-06-02 13:00:00.322031 | Event ID: e5b79850-5e82-11f1-9ec4-3dc1bc93b4f8 2026-06-02 13:00:00.328326 | 2026-06-02 13:00:00.328451 | LOOP [emit-job-header : Print node information] 2026-06-02 13:00:00.444609 | debian-bookworm | ok: 2026-06-02 13:00:00.444915 | debian-bookworm | # Node Information 2026-06-02 13:00:00.444959 | debian-bookworm | Inventory Hostname: debian-bookworm 2026-06-02 13:00:00.444992 | debian-bookworm | Hostname: debian 2026-06-02 13:00:00.445020 | debian-bookworm | Username: zuul 2026-06-02 13:00:00.445047 | debian-bookworm | Distro: Debian 12.14 2026-06-02 13:00:00.445077 | debian-bookworm | Provider: regiocloud-a 2026-06-02 13:00:00.445104 | debian-bookworm | Region: 2026-06-02 13:00:00.445131 | debian-bookworm | Label: debian-bookworm 2026-06-02 13:00:00.445158 | debian-bookworm | Product Name: OpenStack Nova 2026-06-02 13:00:00.445184 | debian-bookworm | Interface IP: 2a13:1a81:8000:3124:f816:3eff:fed0:9304 2026-06-02 13:00:00.509597 | debian-bookworm | ok: 2026-06-02 13:00:00.509781 | debian-bookworm | # Node Information 2026-06-02 13:00:00.509823 | debian-bookworm | Inventory Hostname: ubuntu-noble 2026-06-02 13:00:00.509855 | debian-bookworm | Hostname: ubuntu 2026-06-02 13:00:00.509890 | debian-bookworm | Username: zuul 2026-06-02 13:00:00.509919 | debian-bookworm | Distro: Ubuntu 24.04 2026-06-02 13:00:00.509946 | debian-bookworm | Provider: regiocloud-a 2026-06-02 13:00:00.509971 | debian-bookworm | Region: 2026-06-02 13:00:00.509996 | debian-bookworm | Label: ubuntu-noble 2026-06-02 13:00:00.510020 | debian-bookworm | Product Name: OpenStack Nova 2026-06-02 13:00:00.510044 | debian-bookworm | Interface IP: 2a13:1a81:8000:3124:f816:3eff:fe3b:ddb0 2026-06-02 13:00:00.532535 | 2026-06-02 13:00:00.532724 | TASK [log-inventory : Ensure Zuul Ansible directory exists] 2026-06-02 13:00:01.034952 | debian-bookworm -> localhost | changed 2026-06-02 13:00:01.045330 | 2026-06-02 13:00:01.045496 | TASK [log-inventory : Copy ansible inventory to logs dir] 2026-06-02 13:00:02.147258 | debian-bookworm -> localhost | changed 2026-06-02 13:00:02.222464 | ubuntu-noble -> localhost | ok 2026-06-02 13:00:02.240798 | 2026-06-02 13:00:02.240931 | TASK [add-build-sshkey : Check to see if ssh key was already created for this build] 2026-06-02 13:00:02.529277 | debian-bookworm -> localhost | ok 2026-06-02 13:00:02.539903 | 2026-06-02 13:00:02.540062 | TASK [add-build-sshkey : Create a new key in workspace based on build UUID] 2026-06-02 13:00:02.565124 | debian-bookworm | ok 2026-06-02 13:00:02.579808 | ubuntu-noble | ok 2026-06-02 13:00:02.599036 | debian-bookworm | included: /var/lib/zuul/builds/bafe5455e936492ebabe791aa3467240/trusted/project_1/github.com/osism/openinfra-zuul-jobs/roles/add-build-sshkey/tasks/create-key-and-replace.yaml 2026-06-02 13:00:02.599164 | ubuntu-noble | included: /var/lib/zuul/builds/bafe5455e936492ebabe791aa3467240/trusted/project_1/github.com/osism/openinfra-zuul-jobs/roles/add-build-sshkey/tasks/create-key-and-replace.yaml 2026-06-02 13:00:02.606199 | 2026-06-02 13:00:02.606321 | TASK [add-build-sshkey : Create Temp SSH key] 2026-06-02 13:00:03.489050 | debian-bookworm -> localhost | Generating public/private rsa key pair. 2026-06-02 13:00:03.489507 | debian-bookworm -> localhost | Your identification has been saved in /var/lib/zuul/builds/bafe5455e936492ebabe791aa3467240/work/bafe5455e936492ebabe791aa3467240_id_rsa 2026-06-02 13:00:03.489600 | debian-bookworm -> localhost | Your public key has been saved in /var/lib/zuul/builds/bafe5455e936492ebabe791aa3467240/work/bafe5455e936492ebabe791aa3467240_id_rsa.pub 2026-06-02 13:00:03.489695 | debian-bookworm -> localhost | The key fingerprint is: 2026-06-02 13:00:03.489762 | debian-bookworm -> localhost | SHA256:wQv7gU04HazISuKX9BOXbzGq57jm5n5hW3Mic80/1eE zuul-build-sshkey 2026-06-02 13:00:03.489822 | debian-bookworm -> localhost | The key's randomart image is: 2026-06-02 13:00:03.489887 | debian-bookworm -> localhost | +---[RSA 3072]----+ 2026-06-02 13:00:03.489943 | debian-bookworm -> localhost | | .. | 2026-06-02 13:00:03.490001 | debian-bookworm -> localhost | | +.. | 2026-06-02 13:00:03.490053 | debian-bookworm -> localhost | | . .+.* | 2026-06-02 13:00:03.490103 | debian-bookworm -> localhost | |. ..o..X = . | 2026-06-02 13:00:03.490153 | debian-bookworm -> localhost | |.o..o = S = . o| 2026-06-02 13:00:03.490203 | debian-bookworm -> localhost | | ..o o B O + E.| 2026-06-02 13:00:03.490253 | debian-bookworm -> localhost | | . + X + . . | 2026-06-02 13:00:03.490305 | debian-bookworm -> localhost | | +.+ o | 2026-06-02 13:00:03.490357 | debian-bookworm -> localhost | | **=. . | 2026-06-02 13:00:03.490409 | debian-bookworm -> localhost | +----[SHA256]-----+ 2026-06-02 13:00:03.490536 | debian-bookworm -> localhost | ok: Runtime: 0:00:00.371551 2026-06-02 13:00:03.503483 | 2026-06-02 13:00:03.503705 | TASK [add-build-sshkey : Remote setup ssh keys (linux)] 2026-06-02 13:00:03.529082 | debian-bookworm | ok 2026-06-02 13:00:03.543838 | ubuntu-noble | ok 2026-06-02 13:00:03.558962 | debian-bookworm | included: /var/lib/zuul/builds/bafe5455e936492ebabe791aa3467240/trusted/project_1/github.com/osism/openinfra-zuul-jobs/roles/add-build-sshkey/tasks/remote-linux.yaml 2026-06-02 13:00:03.559056 | ubuntu-noble | included: /var/lib/zuul/builds/bafe5455e936492ebabe791aa3467240/trusted/project_1/github.com/osism/openinfra-zuul-jobs/roles/add-build-sshkey/tasks/remote-linux.yaml 2026-06-02 13:00:03.570469 | 2026-06-02 13:00:03.570582 | TASK [add-build-sshkey : Remove previously added zuul-build-sshkey] 2026-06-02 13:00:03.588906 | debian-bookworm | skipping: Conditional result was False 2026-06-02 13:00:03.600152 | ubuntu-noble | skipping: Conditional result was False 2026-06-02 13:00:03.608030 | 2026-06-02 13:00:03.608155 | TASK [add-build-sshkey : Enable access via build key on all nodes] 2026-06-02 13:00:04.289192 | debian-bookworm | changed 2026-06-02 13:00:04.372654 | ubuntu-noble | changed 2026-06-02 13:00:04.386669 | 2026-06-02 13:00:04.387043 | TASK [add-build-sshkey : Make sure user has a .ssh] 2026-06-02 13:00:04.669185 | debian-bookworm | ok 2026-06-02 13:00:04.750154 | ubuntu-noble | ok 2026-06-02 13:00:04.758318 | 2026-06-02 13:00:04.758444 | TASK [add-build-sshkey : Install build private key as SSH key on all nodes] 2026-06-02 13:00:05.501790 | ubuntu-noble | changed 2026-06-02 13:00:05.507593 | debian-bookworm | changed 2026-06-02 13:00:05.513090 | 2026-06-02 13:00:05.513199 | TASK [add-build-sshkey : Install build public key as SSH key on all nodes] 2026-06-02 13:00:06.250458 | debian-bookworm | changed 2026-06-02 13:00:06.266440 | ubuntu-noble | changed 2026-06-02 13:00:06.272915 | 2026-06-02 13:00:06.273061 | TASK [add-build-sshkey : Remote setup ssh keys (windows)] 2026-06-02 13:00:06.297448 | debian-bookworm | skipping: Conditional result was False 2026-06-02 13:00:06.321278 | ubuntu-noble | skipping: Conditional result was False 2026-06-02 13:00:06.335286 | 2026-06-02 13:00:06.335838 | TASK [remove-zuul-sshkey : Remove master key from local agent] 2026-06-02 13:00:06.733038 | debian-bookworm -> localhost | changed 2026-06-02 13:00:06.750846 | 2026-06-02 13:00:06.750997 | TASK [add-build-sshkey : Add back temp key] 2026-06-02 13:00:07.098855 | debian-bookworm -> localhost | Identity added: /var/lib/zuul/builds/bafe5455e936492ebabe791aa3467240/work/bafe5455e936492ebabe791aa3467240_id_rsa (zuul-build-sshkey) 2026-06-02 13:00:07.099886 | debian-bookworm -> localhost | ok: Runtime: 0:00:00.023353 2026-06-02 13:00:07.106796 | 2026-06-02 13:00:07.106923 | TASK [add-build-sshkey : Verify we can still SSH to all nodes] 2026-06-02 13:00:07.474898 | ubuntu-noble | ok 2026-06-02 13:00:07.479501 | debian-bookworm | ok 2026-06-02 13:00:07.484560 | 2026-06-02 13:00:07.484685 | TASK [add-build-sshkey : Verify we can still SSH to all nodes (windows)] 2026-06-02 13:00:07.520081 | debian-bookworm | skipping: Conditional result was False 2026-06-02 13:00:07.531430 | ubuntu-noble | skipping: Conditional result was False 2026-06-02 13:00:07.554926 | 2026-06-02 13:00:07.555067 | TASK [start-zuul-console : Start zuul_console daemon.] 2026-06-02 13:00:08.018453 | debian-bookworm | ok 2026-06-02 13:00:08.049116 | ubuntu-noble | ok 2026-06-02 13:00:08.111896 | 2026-06-02 13:00:08.112051 | TASK [validate-host : Define zuul_info_dir fact] 2026-06-02 13:00:08.154134 | debian-bookworm | ok 2026-06-02 13:00:08.159154 | ubuntu-noble | ok 2026-06-02 13:00:08.164972 | 2026-06-02 13:00:08.165106 | TASK [validate-host : Ensure Zuul Ansible directory exists] 2026-06-02 13:00:08.465988 | debian-bookworm -> localhost | ok 2026-06-02 13:00:08.481199 | 2026-06-02 13:00:08.481372 | TASK [validate-host : Collect information about the host] 2026-06-02 13:00:09.611763 | ubuntu-noble | ok 2026-06-02 13:00:09.670008 | debian-bookworm | ok 2026-06-02 13:00:09.687933 | 2026-06-02 13:00:09.688115 | TASK [validate-host : Sanitize hostname] 2026-06-02 13:00:09.755443 | debian-bookworm | ok 2026-06-02 13:00:09.779269 | ubuntu-noble | ok 2026-06-02 13:00:09.789304 | 2026-06-02 13:00:09.789495 | TASK [validate-host : Write out all ansible variables/facts known for each host] 2026-06-02 13:00:10.393585 | debian-bookworm -> localhost | changed 2026-06-02 13:00:10.394781 | ubuntu-noble -> localhost | changed 2026-06-02 13:00:10.400524 | 2026-06-02 13:00:10.400662 | TASK [validate-host : Collect information about zuul worker] 2026-06-02 13:00:10.897038 | ubuntu-noble | ok 2026-06-02 13:00:10.915137 | debian-bookworm | ok 2026-06-02 13:00:10.923549 | 2026-06-02 13:00:10.923770 | TASK [validate-host : Write out all zuul information for each host] 2026-06-02 13:00:11.456783 | debian-bookworm -> localhost | changed 2026-06-02 13:00:11.559794 | ubuntu-noble -> localhost | changed 2026-06-02 13:00:11.573864 | 2026-06-02 13:00:11.574006 | TASK [prepare-workspace-log : Start zuul_console daemon.] 2026-06-02 13:00:11.865887 | debian-bookworm | ok 2026-06-02 13:00:11.911213 | ubuntu-noble | ok 2026-06-02 13:00:11.917960 | 2026-06-02 13:00:11.918095 | TASK [prepare-workspace-log : Synchronize src repos to workspace directory.] 2026-06-02 13:00:13.258401 | ubuntu-noble | changed: 2026-06-02 13:00:13.268937 | ubuntu-noble | cd+++++++++ src/ 2026-06-02 13:00:13.269043 | ubuntu-noble | cd+++++++++ src/github.com/ 2026-06-02 13:00:13.269072 | ubuntu-noble | cd+++++++++ src/github.com/osism/ 2026-06-02 13:00:13.269095 | ubuntu-noble | cd+++++++++ src/github.com/osism/ansible-collection-services/ 2026-06-02 13:00:13.269118 | ubuntu-noble | config] provisioner.env found in /home/zuul/src/github.com/osism/ansible-collection-services/molecule/delegated/molecule.yml, this can be defined in ansible.env 2026-06-02 13:01:25.117202 | debian-bookworm | WARNING Molecule scenarios should migrate to 'extensions/molecule' 2026-06-02 13:01:25.149782 | debian-bookworm | DEBUG [unknown > config] provisioner.env found in /home/zuul/src/github.com/osism/ansible-collection-services/molecule/delegated/molecule.yml, this can be defined in ansible.env 2026-06-02 13:01:25.854186 | ubuntu-noble | DEBUG [unknown > config] provisioner.env found in /home/zuul/src/github.com/osism/ansible-collection-services/molecule/delegated/molecule.yml, this can be defined in ansible.env 2026-06-02 13:01:25.854825 | ubuntu-noble | DEBUG [delegated > validate] Validating schema /home/zuul/src/github.com/osism/ansible-collection-services/molecule/delegated/molecule.yml. 2026-06-02 13:01:25.878336 | ubuntu-noble | DEBUG [default > validate] Validating schema /home/zuul/src/github.com/osism/ansible-collection-services/molecule/default/molecule.yml. 2026-06-02 13:01:25.884077 | ubuntu-noble | INFO [delegated > discovery] scenario test matrix: dependency 2026-06-02 13:01:25.884133 | ubuntu-noble | INFO [delegated > prerun] Performing prerun with role_name_check=0... 2026-06-02 13:01:25.742288 | debian-bookworm | DEBUG [unknown > config] provisioner.env found in /home/zuul/src/github.com/osism/ansible-collection-services/molecule/delegated/molecule.yml, this can be defined in ansible.env 2026-06-02 13:01:25.742893 | debian-bookworm | DEBUG [delegated > validate] Validating schema /home/zuul/src/github.com/osism/ansible-collection-services/molecule/delegated/molecule.yml. 2026-06-02 13:01:25.764082 | debian-bookworm | DEBUG [default > validate] Validating schema /home/zuul/src/github.com/osism/ansible-collection-services/molecule/default/molecule.yml. 2026-06-02 13:01:25.769544 | debian-bookworm | INFO [delegated > discovery] scenario test matrix: dependency 2026-06-02 13:01:25.769646 | debian-bookworm | INFO [delegated > prerun] Performing prerun with role_name_check=0... 2026-06-02 13:01:26.823084 | debian-bookworm | INFO [delegated > dependency] Executing 2026-06-02 13:01:26.823367 | debian-bookworm | WARNING [delegated > dependency] Missing roles requirements file: requirements.yml 2026-06-02 13:01:27.184124 | ubuntu-noble | INFO [delegated > dependency] Executing 2026-06-02 13:01:27.184607 | ubuntu-noble | WARNING [delegated > dependency] Missing roles requirements file: requirements.yml 2026-06-02 13:01:27.163415 | debian-bookworm | ansible-galaxy [core 2.18.17] 2026-06-02 13:01:27.164004 | debian-bookworm | config file = None 2026-06-02 13:01:27.164530 | debian-bookworm | configured module search path = ['/home/zuul/src/github.com/osism/ansible-collection-services/plugins/modules', '/home/zuul/.ansible/plugins/modules', '/usr/share/ansible/plugins/modules'] 2026-06-02 13:01:27.165098 | debian-bookworm | ansible python module location = /home/zuul/venv/lib/python3.11/site-packages/ansible 2026-06-02 13:01:27.165500 | debian-bookworm | ansible collection location = /home/zuul/.ansible/collections:/usr/share/ansible/collections:/home/zuul/venv/lib/python3.11/site-packages:/home/zuul/venv/lib/python3.11/dist-packages:/home/zuul/venv/lib/python3/dist-packages:/home/zuul/venv/local/lib/python3.11/dist-packages 2026-06-02 13:01:27.166012 | debian-bookworm | executable location = /home/zuul/venv/bin/ansible-galaxy 2026-06-02 13:01:27.166408 | debian-bookworm | python version = 3.11.2 (main, Apr 8 2026, 01:58:00) [GCC 12.2.0] (/home/zuul/venv/bin/python3) 2026-06-02 13:01:27.166779 | debian-bookworm | jinja version = 3.1.6 2026-06-02 13:01:27.167130 | debian-bookworm | libyaml = True 2026-06-02 13:01:27.167425 | debian-bookworm | No config file found; using defaults 2026-06-02 13:01:27.167942 | debian-bookworm | Reading requirement file at '/home/zuul/src/github.com/osism/ansible-collection-services/molecule/delegated/collections.yml' 2026-06-02 13:01:27.169960 | debian-bookworm | Loading collection theforeman.foreman from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/theforeman/foreman 2026-06-02 13:01:27.170372 | debian-bookworm | Found installed collection theforeman.foreman:4.2.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/theforeman/foreman' 2026-06-02 13:01:27.170811 | debian-bookworm | Loading collection community.postgresql from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/postgresql 2026-06-02 13:01:27.171227 | debian-bookworm | Found installed collection community.postgresql:3.14.2 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/postgresql' 2026-06-02 13:01:27.171623 | debian-bookworm | Loading collection community.proxysql from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/proxysql 2026-06-02 13:01:27.171943 | debian-bookworm | Found installed collection community.proxysql:1.7.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/proxysql' 2026-06-02 13:01:27.172386 | debian-bookworm | Loading collection community.crypto from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/crypto 2026-06-02 13:01:27.172780 | debian-bookworm | Found installed collection community.crypto:2.26.6 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/crypto' 2026-06-02 13:01:27.173096 | debian-bookworm | Loading collection chocolatey.chocolatey from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/chocolatey/chocolatey 2026-06-02 13:01:27.173477 | debian-bookworm | Found installed collection chocolatey.chocolatey:1.5.3 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/chocolatey/chocolatey' 2026-06-02 13:01:27.173767 | debian-bookworm | Loading collection ibm.spectrum_virtualize from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/ibm/spectrum_virtualize 2026-06-02 13:01:27.174177 | debian-bookworm | Found installed collection ibm.spectrum_virtualize:2.0.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/ibm/spectrum_virtualize' 2026-06-02 13:01:27.174465 | debian-bookworm | Loading collection community.docker from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/docker 2026-06-02 13:01:27.174934 | debian-bookworm | Found installed collection community.docker:4.8.2 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/docker' 2026-06-02 13:01:27.175227 | debian-bookworm | Loading collection microsoft.iis from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/microsoft/iis 2026-06-02 13:01:27.175546 | debian-bookworm | Found installed collection microsoft.iis:1.0.3 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/microsoft/iis' 2026-06-02 13:01:27.175893 | debian-bookworm | Loading collection vyos.vyos from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/vyos/vyos 2026-06-02 13:01:27.176281 | debian-bookworm | Found installed collection vyos.vyos:5.0.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/vyos/vyos' 2026-06-02 13:01:27.176991 | debian-bookworm | Loading collection community.grafana from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/grafana 2026-06-02 13:01:27.177277 | debian-bookworm | Found installed collection community.grafana:2.3.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/grafana' 2026-06-02 13:01:27.177633 | debian-bookworm | Loading collection inspur.ispim from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/inspur/ispim 2026-06-02 13:01:27.177919 | debian-bookworm | Found installed collection inspur.ispim:2.2.3 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/inspur/ispim' 2026-06-02 13:01:27.178261 | debian-bookworm | Loading collection google.cloud from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/google/cloud 2026-06-02 13:01:27.178600 | debian-bookworm | Found installed collection google.cloud:1.9.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/google/cloud' 2026-06-02 13:01:27.179096 | debian-bookworm | Loading collection ovirt.ovirt from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/ovirt/ovirt 2026-06-02 13:01:27.179426 | debian-bookworm | Found installed collection ovirt.ovirt:3.2.1 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/ovirt/ovirt' 2026-06-02 13:01:27.180318 | debian-bookworm | Loading collection community.digitalocean from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/digitalocean 2026-06-02 13:01:27.180593 | debian-bookworm | Found installed collection community.digitalocean:1.27.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/digitalocean' 2026-06-02 13:01:27.181642 | debian-bookworm | Loading collection ngine_io.cloudstack from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/ngine_io/cloudstack 2026-06-02 13:01:27.182154 | debian-bookworm | Found installed collection ngine_io.cloudstack:2.5.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/ngine_io/cloudstack' 2026-06-02 13:01:27.182448 | debian-bookworm | Loading collection purestorage.flashblade from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/purestorage/flashblade 2026-06-02 13:01:27.182725 | debian-bookworm | Found installed collection purestorage.flashblade:1.22.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/purestorage/flashblade' 2026-06-02 13:01:27.183136 | debian-bookworm | Loading collection community.proxmox from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/proxmox 2026-06-02 13:01:27.183397 | debian-bookworm | Found installed collection community.proxmox:1.4.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/proxmox' 2026-06-02 13:01:27.183649 | debian-bookworm | Loading collection cisco.dnac from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/cisco/dnac 2026-06-02 13:01:27.183944 | debian-bookworm | Found installed collection cisco.dnac:6.31.3 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/cisco/dnac' 2026-06-02 13:01:27.184350 | debian-bookworm | Loading collection vultr.cloud from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/vultr/cloud 2026-06-02 13:01:27.184612 | debian-bookworm | Found installed collection vultr.cloud:1.13.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/vultr/cloud' 2026-06-02 13:01:27.193023 | debian-bookworm | Loading collection community.general from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/general 2026-06-02 13:01:27.193377 | debian-bookworm | Found installed collection community.general:10.7.6 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/general' 2026-06-02 13:01:27.193917 | debian-bookworm | Loading collection dellemc.openmanage from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/dellemc/openmanage 2026-06-02 13:01:27.194253 | debian-bookworm | Found installed collection dellemc.openmanage:9.12.3 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/dellemc/openmanage' 2026-06-02 13:01:27.194763 | debian-bookworm | Loading collection dellemc.enterprise_sonic from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/dellemc/enterprise_sonic 2026-06-02 13:01:27.195162 | debian-bookworm | Found installed collection dellemc.enterprise_sonic:2.5.1 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/dellemc/enterprise_sonic' 2026-06-02 13:01:27.195528 | debian-bookworm | Loading collection community.mysql from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/mysql 2026-06-02 13:01:27.195785 | debian-bookworm | Found installed collection community.mysql:3.16.1 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/mysql' 2026-06-02 13:01:27.196170 | debian-bookworm | Loading collection microsoft.ad from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/microsoft/ad 2026-06-02 13:01:27.196425 | debian-bookworm | Found installed collection microsoft.ad:1.9.2 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/microsoft/ad' 2026-06-02 13:01:27.196684 | debian-bookworm | Loading collection community.library_inventory_filtering_v1 from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/library_inventory_filtering_v1 2026-06-02 13:01:27.197049 | debian-bookworm | Found installed collection community.library_inventory_filtering_v1:1.1.5 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/library_inventory_filtering_v1' 2026-06-02 13:01:27.197301 | debian-bookworm | Loading collection community.rabbitmq from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/rabbitmq 2026-06-02 13:01:27.197546 | debian-bookworm | Found installed collection community.rabbitmq:1.6.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/rabbitmq' 2026-06-02 13:01:27.198025 | debian-bookworm | Loading collection hetzner.hcloud from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/hetzner/hcloud 2026-06-02 13:01:27.198322 | debian-bookworm | Found installed collection hetzner.hcloud:4.3.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/hetzner/hcloud' 2026-06-02 13:01:27.199812 | debian-bookworm | Loading collection cisco.meraki from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/cisco/meraki 2026-06-02 13:01:27.200138 | debian-bookworm | Found installed collection cisco.meraki:2.21.8 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/cisco/meraki' 2026-06-02 13:01:27.200412 | debian-bookworm | Loading collection grafana.grafana from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/grafana/grafana 2026-06-02 13:01:27.200683 | debian-bookworm | Found installed collection grafana.grafana:5.7.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/grafana/grafana' 2026-06-02 13:01:27.200972 | debian-bookworm | Loading collection infoblox.nios_modules from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/infoblox/nios_modules 2026-06-02 13:01:27.201242 | debian-bookworm | Found installed collection infoblox.nios_modules:1.8.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/infoblox/nios_modules' 2026-06-02 13:01:27.201520 | debian-bookworm | Loading collection community.mongodb from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/mongodb 2026-06-02 13:01:27.201792 | debian-bookworm | Found installed collection community.mongodb:1.7.10 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/mongodb' 2026-06-02 13:01:27.202082 | debian-bookworm | Loading collection containers.podman from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/containers/podman 2026-06-02 13:01:27.202360 | debian-bookworm | Found installed collection containers.podman:1.18.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/containers/podman' 2026-06-02 13:01:27.202630 | debian-bookworm | Loading collection ravendb.ravendb from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/ravendb/ravendb 2026-06-02 13:01:27.202942 | debian-bookworm | Found installed collection ravendb.ravendb:1.0.4 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/ravendb/ravendb' 2026-06-02 13:01:27.204199 | debian-bookworm | Loading collection community.vmware from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/vmware 2026-06-02 13:01:27.204470 | debian-bookworm | Found installed collection community.vmware:5.10.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/vmware' 2026-06-02 13:01:27.204748 | debian-bookworm | Loading collection sensu.sensu_go from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/sensu/sensu_go 2026-06-02 13:01:27.205034 | debian-bookworm | Found installed collection sensu.sensu_go:1.14.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/sensu/sensu_go' 2026-06-02 13:01:27.210401 | debian-bookworm | Loading collection fortinet.fortimanager from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/fortinet/fortimanager 2026-06-02 13:01:27.210709 | debian-bookworm | Found installed collection fortinet.fortimanager:2.11.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/fortinet/fortimanager' 2026-06-02 13:01:27.211034 | debian-bookworm | Loading collection kubevirt.core from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/kubevirt/core 2026-06-02 13:01:27.211338 | debian-bookworm | Found installed collection kubevirt.core:2.2.3 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/kubevirt/core' 2026-06-02 13:01:27.211628 | debian-bookworm | Loading collection cloud.common from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/cloud/common 2026-06-02 13:01:27.211880 | debian-bookworm | Found installed collection cloud.common:4.2.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/cloud/common' 2026-06-02 13:01:27.212222 | debian-bookworm | Loading collection ieisystem.inmanage from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/ieisystem/inmanage 2026-06-02 13:01:27.212445 | debian-bookworm | Found installed collection ieisystem.inmanage:3.0.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/ieisystem/inmanage' 2026-06-02 13:01:27.212745 | debian-bookworm | Loading collection community.routeros from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/routeros 2026-06-02 13:01:27.212997 | debian-bookworm | Found installed collection community.routeros:3.13.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/routeros' 2026-06-02 13:01:27.213448 | debian-bookworm | Loading collection arista.eos from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/arista/eos 2026-06-02 13:01:27.213721 | debian-bookworm | Found installed collection arista.eos:10.1.1 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/arista/eos' 2026-06-02 13:01:27.214011 | debian-bookworm | Loading collection ansible.posix from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/ansible/posix 2026-06-02 13:01:27.214281 | debian-bookworm | Found installed collection ansible.posix:1.6.2 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/ansible/posix' 2026-06-02 13:01:27.215264 | debian-bookworm | Loading collection junipernetworks.junos from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/junipernetworks/junos 2026-06-02 13:01:27.215573 | debian-bookworm | Found installed collection junipernetworks.junos:9.1.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/junipernetworks/junos' 2026-06-02 13:01:27.216764 | debian-bookworm | Loading collection amazon.aws from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/amazon/aws 2026-06-02 13:01:27.217071 | debian-bookworm | Found installed collection amazon.aws:9.5.2 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/amazon/aws' 2026-06-02 13:01:27.217603 | debian-bookworm | Loading collection splunk.es from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/splunk/es 2026-06-02 13:01:27.217891 | debian-bookworm | Found installed collection splunk.es:4.0.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/splunk/es' 2026-06-02 13:01:27.218674 | debian-bookworm | Loading collection telekom_mms.icinga_director from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/telekom_mms/icinga_director 2026-06-02 13:01:27.219167 | debian-bookworm | Found installed collection telekom_mms.icinga_director:2.4.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/telekom_mms/icinga_director' 2026-06-02 13:01:27.219473 | debian-bookworm | Loading collection infinidat.infinibox from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/infinidat/infinibox 2026-06-02 13:01:27.219773 | debian-bookworm | Found installed collection infinidat.infinibox:1.6.3 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/infinidat/infinibox' 2026-06-02 13:01:27.220250 | debian-bookworm | Loading collection vmware.vmware from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/vmware/vmware 2026-06-02 13:01:27.220544 | debian-bookworm | Found installed collection vmware.vmware:1.11.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/vmware/vmware' 2026-06-02 13:01:27.220825 | debian-bookworm | Loading collection community.dns from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/dns 2026-06-02 13:01:27.221235 | debian-bookworm | Found installed collection community.dns:3.4.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/dns' 2026-06-02 13:01:27.221533 | debian-bookworm | Loading collection dellemc.powerflex from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/dellemc/powerflex 2026-06-02 13:01:27.221821 | debian-bookworm | Found installed collection dellemc.powerflex:2.6.1 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/dellemc/powerflex' 2026-06-02 13:01:27.222221 | debian-bookworm | Loading collection kubernetes.core from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/kubernetes/core 2026-06-02 13:01:27.222506 | debian-bookworm | Found installed collection kubernetes.core:5.4.1 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/kubernetes/core' 2026-06-02 13:01:27.222787 | debian-bookworm | Loading collection lowlydba.sqlserver from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/lowlydba/sqlserver 2026-06-02 13:01:27.223210 | debian-bookworm | Found installed collection lowlydba.sqlserver:2.7.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/lowlydba/sqlserver' 2026-06-02 13:01:27.224009 | debian-bookworm | Loading collection cisco.aci from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/cisco/aci 2026-06-02 13:01:27.224377 | debian-bookworm | Found installed collection cisco.aci:2.12.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/cisco/aci' 2026-06-02 13:01:27.224685 | debian-bookworm | Loading collection community.ciscosmb from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/ciscosmb 2026-06-02 13:01:27.225031 | debian-bookworm | Found installed collection community.ciscosmb:1.0.11 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/ciscosmb' 2026-06-02 13:01:27.225285 | debian-bookworm | Loading collection community.sap_libs from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/sap_libs 2026-06-02 13:01:27.225623 | debian-bookworm | Found installed collection community.sap_libs:1.5.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/sap_libs' 2026-06-02 13:01:27.225891 | debian-bookworm | Loading collection cyberark.pas from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/cyberark/pas 2026-06-02 13:01:27.226143 | debian-bookworm | Found installed collection cyberark.pas:1.0.36 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/cyberark/pas' 2026-06-02 13:01:27.226489 | debian-bookworm | Loading collection netapp.cloudmanager from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/netapp/cloudmanager 2026-06-02 13:01:27.226755 | debian-bookworm | Found installed collection netapp.cloudmanager:21.24.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/netapp/cloudmanager' 2026-06-02 13:01:27.227153 | debian-bookworm | Loading collection check_point.mgmt from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/check_point/mgmt 2026-06-02 13:01:27.227405 | debian-bookworm | Found installed collection check_point.mgmt:6.6.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/check_point/mgmt' 2026-06-02 13:01:27.227697 | debian-bookworm | Loading collection ibm.qradar from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/ibm/qradar 2026-06-02 13:01:27.227921 | debian-bookworm | Found installed collection ibm.qradar:4.0.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/ibm/qradar' 2026-06-02 13:01:27.262167 | debian-bookworm | Loading collection community.network from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/network 2026-06-02 13:01:27.262707 | debian-bookworm | Found installed collection community.network:5.1.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/network' 2026-06-02 13:01:27.263110 | debian-bookworm | Loading collection netapp.storagegrid from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/netapp/storagegrid 2026-06-02 13:01:27.263650 | debian-bookworm | Found installed collection netapp.storagegrid:21.14.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/netapp/storagegrid' 2026-06-02 13:01:27.264038 | debian-bookworm | Loading collection purestorage.flasharray from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/purestorage/flasharray 2026-06-02 13:01:27.264271 | debian-bookworm | Found installed collection purestorage.flasharray:1.39.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/purestorage/flasharray' 2026-06-02 13:01:27.266049 | debian-bookworm | Loading collection vmware.vmware_rest from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/vmware/vmware_rest 2026-06-02 13:01:27.266322 | debian-bookworm | Found installed collection vmware.vmware_rest:4.9.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/vmware/vmware_rest' 2026-06-02 13:01:27.266924 | debian-bookworm | Loading collection dellemc.unity from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/dellemc/unity 2026-06-02 13:01:27.267251 | debian-bookworm | Found installed collection dellemc.unity:2.1.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/dellemc/unity' 2026-06-02 13:01:27.267643 | debian-bookworm | Loading collection cyberark.conjur from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/cyberark/conjur 2026-06-02 13:01:27.268028 | debian-bookworm | Found installed collection cyberark.conjur:1.3.8 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/cyberark/conjur' 2026-06-02 13:01:27.268444 | debian-bookworm | Loading collection hitachivantara.vspone_object from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/hitachivantara/vspone_object 2026-06-02 13:01:27.268756 | debian-bookworm | Found installed collection hitachivantara.vspone_object:1.0.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/hitachivantara/vspone_object' 2026-06-02 13:01:27.269136 | debian-bookworm | Loading collection kaytus.ksmanage from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/kaytus/ksmanage 2026-06-02 13:01:27.269527 | debian-bookworm | Found installed collection kaytus.ksmanage:2.0.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/kaytus/ksmanage' 2026-06-02 13:01:27.271709 | debian-bookworm | Loading collection fortinet.fortios from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/fortinet/fortios 2026-06-02 13:01:27.272115 | debian-bookworm | Found installed collection fortinet.fortios:2.4.2 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/fortinet/fortios' 2026-06-02 13:01:27.272486 | debian-bookworm | Loading collection cisco.asa from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/cisco/asa 2026-06-02 13:01:27.272775 | debian-bookworm | Found installed collection cisco.asa:6.1.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/cisco/asa' 2026-06-02 13:01:27.274627 | debian-bookworm | Loading collection cisco.nxos from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/cisco/nxos 2026-06-02 13:01:27.274939 | debian-bookworm | Found installed collection cisco.nxos:9.4.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/cisco/nxos' 2026-06-02 13:01:27.275321 | debian-bookworm | Loading collection openstack.cloud from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/openstack/cloud 2026-06-02 13:01:27.275549 | debian-bookworm | Found installed collection openstack.cloud:2.5.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/openstack/cloud' 2026-06-02 13:01:27.275993 | debian-bookworm | Loading collection ansible.windows from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/ansible/windows 2026-06-02 13:01:27.276372 | debian-bookworm | Found installed collection ansible.windows:2.8.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/ansible/windows' 2026-06-02 13:01:27.277070 | debian-bookworm | Loading collection cisco.iosxr from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/cisco/iosxr 2026-06-02 13:01:27.277435 | debian-bookworm | Found installed collection cisco.iosxr:10.3.1 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/cisco/iosxr' 2026-06-02 13:01:27.277815 | debian-bookworm | Loading collection hitachivantara.vspone_block from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/hitachivantara/vspone_block 2026-06-02 13:01:27.278142 | debian-bookworm | Found installed collection hitachivantara.vspone_block:3.5.1 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/hitachivantara/vspone_block' 2026-06-02 13:01:27.278473 | debian-bookworm | Loading collection community.hrobot from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/hrobot 2026-06-02 13:01:27.278767 | debian-bookworm | Found installed collection community.hrobot:2.7.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/hrobot' 2026-06-02 13:01:27.279036 | debian-bookworm | Loading collection cisco.intersight from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/cisco/intersight 2026-06-02 13:01:27.279201 | debian-bookworm | Found installed collection cisco.intersight:2.7.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/cisco/intersight' 2026-06-02 13:01:27.279526 | debian-bookworm | Loading collection community.windows from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/windows 2026-06-02 13:01:27.279858 | debian-bookworm | Found installed collection community.windows:2.4.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/windows' 2026-06-02 13:01:27.280181 | debian-bookworm | Loading collection ibm.storage_virtualize from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/ibm/storage_virtualize 2026-06-02 13:01:27.280465 | debian-bookworm | Found installed collection ibm.storage_virtualize:2.7.4 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/ibm/storage_virtualize' 2026-06-02 13:01:27.280664 | debian-bookworm | Loading collection community.sops from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/sops 2026-06-02 13:01:27.280895 | debian-bookworm | Found installed collection community.sops:2.2.7 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/sops' 2026-06-02 13:01:27.281315 | debian-bookworm | Loading collection netapp.ontap from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/netapp/ontap 2026-06-02 13:01:27.281498 | debian-bookworm | Found installed collection netapp.ontap:22.14.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/netapp/ontap' 2026-06-02 13:01:27.282260 | debian-bookworm | Loading collection cloudscale_ch.cloud from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/cloudscale_ch/cloud 2026-06-02 13:01:27.282623 | debian-bookworm | Found installed collection cloudscale_ch.cloud:2.5.2 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/cloudscale_ch/cloud' 2026-06-02 13:01:27.283045 | debian-bookworm | Loading collection f5networks.f5_modules from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/f5networks/f5_modules 2026-06-02 13:01:27.283337 | debian-bookworm | Found installed collection f5networks.f5_modules:1.39.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/f5networks/f5_modules' 2026-06-02 13:01:27.283526 | debian-bookworm | Loading collection cisco.ucs from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/cisco/ucs 2026-06-02 13:01:27.283690 | debian-bookworm | Found installed collection cisco.ucs:1.16.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/cisco/ucs' 2026-06-02 13:01:27.283914 | debian-bookworm | Loading collection community.hashi_vault from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/hashi_vault 2026-06-02 13:01:27.284200 | debian-bookworm | Found installed collection community.hashi_vault:6.2.1 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/hashi_vault' 2026-06-02 13:01:27.284370 | debian-bookworm | Loading collection community.libvirt from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/libvirt 2026-06-02 13:01:27.284673 | debian-bookworm | Found installed collection community.libvirt:1.4.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/libvirt' 2026-06-02 13:01:27.286947 | debian-bookworm | Loading collection awx.awx from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/awx/awx 2026-06-02 13:01:27.287181 | debian-bookworm | Found installed collection awx.awx:24.6.1 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/awx/awx' 2026-06-02 13:01:27.289018 | debian-bookworm | Loading collection azure.azcollection from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/azure/azcollection 2026-06-02 13:01:27.289216 | debian-bookworm | Found installed collection azure.azcollection:3.10.1 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/azure/azcollection' 2026-06-02 13:01:27.292673 | debian-bookworm | Loading collection community.aws from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/aws 2026-06-02 13:01:27.292922 | debian-bookworm | Found installed collection community.aws:9.3.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/aws' 2026-06-02 13:01:27.293806 | debian-bookworm | Loading collection cisco.ios from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/cisco/ios 2026-06-02 13:01:27.294013 | debian-bookworm | Found installed collection cisco.ios:9.2.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/cisco/ios' 2026-06-02 13:01:27.294371 | debian-bookworm | Loading collection community.okd from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/okd 2026-06-02 13:01:27.294728 | debian-bookworm | Found installed collection community.okd:4.0.2 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/okd' 2026-06-02 13:01:27.295054 | debian-bookworm | Loading collection netapp_eseries.santricity from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/netapp_eseries/santricity 2026-06-02 13:01:27.295359 | debian-bookworm | Found installed collection netapp_eseries.santricity:1.4.1 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/netapp_eseries/santricity' 2026-06-02 13:01:27.296655 | debian-bookworm | Loading collection cisco.mso from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/cisco/mso 2026-06-02 13:01:27.296989 | debian-bookworm | Found installed collection cisco.mso:2.11.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/cisco/mso' 2026-06-02 13:01:27.297304 | debian-bookworm | Loading collection ansible.utils from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/ansible/utils 2026-06-02 13:01:27.297515 | debian-bookworm | Found installed collection ansible.utils:5.1.2 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/ansible/utils' 2026-06-02 13:01:27.297795 | debian-bookworm | Loading collection cisco.ise from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/cisco/ise 2026-06-02 13:01:27.298069 | debian-bookworm | Found installed collection cisco.ise:2.10.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/cisco/ise' 2026-06-02 13:01:27.298333 | debian-bookworm | Loading collection wti.remote from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/wti/remote 2026-06-02 13:01:27.298539 | debian-bookworm | Found installed collection wti.remote:1.0.10 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/wti/remote' 2026-06-02 13:01:27.299119 | debian-bookworm | Loading collection netbox.netbox from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/netbox/netbox 2026-06-02 13:01:27.299349 | debian-bookworm | Found installed collection netbox.netbox:3.21.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/netbox/netbox' 2026-06-02 13:01:27.300281 | debian-bookworm | Loading collection ansible.netcommon from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/ansible/netcommon 2026-06-02 13:01:27.300570 | debian-bookworm | Found installed collection ansible.netcommon:7.2.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/ansible/netcommon' 2026-06-02 13:01:27.300803 | debian-bookworm | Loading collection community.zabbix from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/zabbix 2026-06-02 13:01:27.301057 | debian-bookworm | Found installed collection community.zabbix:3.3.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/zabbix' 2026-06-02 13:01:27.305382 | debian-bookworm | Loading collection osism.services from /home/zuul/.ansible/collections/ansible_collections/osism/services 2026-06-02 13:01:27.305623 | debian-bookworm | Found installed collection osism.services:999.0.0 at '/home/zuul/.ansible/collections/ansible_collections/osism/services' 2026-06-02 13:01:27.309186 | debian-bookworm | Initial connection to galaxy_server: https://galaxy.ansible.com 2026-06-02 13:01:27.309507 | debian-bookworm | Created /home/zuul/.ansible/galaxy_token 2026-06-02 13:01:27.309629 | debian-bookworm | Calling Galaxy at https://galaxy.ansible.com/api/ 2026-06-02 13:01:27.561873 | ubuntu-noble | ansible-galaxy [core 2.18.17] 2026-06-02 13:01:27.561919 | ubuntu-noble | config file = None 2026-06-02 13:01:27.561927 | ubuntu-noble | configured module search path = ['/home/zuul/src/github.com/osism/ansible-collection-services/plugins/modules', '/home/zuul/.ansible/plugins/modules', '/usr/share/ansible/plugins/modules'] 2026-06-02 13:01:27.562258 | ubuntu-noble | ansible python module location = /home/zuul/venv/lib/python3.12/site-packages/ansible 2026-06-02 13:01:27.562628 | ubuntu-noble | ansible collection location = /home/zuul/.ansible/collections:/usr/share/ansible/collections:/home/zuul/venv/lib/python3.12/site-packages:/home/zuul/venv/lib/python3.12/dist-packages:/home/zuul/venv/lib/python3/dist-packages:/home/zuul/venv/local/lib/python3.12/dist-packages 2026-06-02 13:01:27.562919 | ubuntu-noble | executable location = /home/zuul/venv/bin/ansible-galaxy 2026-06-02 13:01:27.563317 | ubuntu-noble | python version = 3.12.3 (main, Mar 23 2026, 19:04:32) [GCC 13.3.0] (/home/zuul/venv/bin/python3) 2026-06-02 13:01:27.563614 | ubuntu-noble | jinja version = 3.1.6 2026-06-02 13:01:27.563895 | ubuntu-noble | libyaml = True 2026-06-02 13:01:27.564144 | ubuntu-noble | No config file found; using defaults 2026-06-02 13:01:27.564646 | ubuntu-noble | Reading requirement file at '/home/zuul/src/github.com/osism/ansible-collection-services/molecule/delegated/collections.yml' 2026-06-02 13:01:27.572421 | ubuntu-noble | Loading collection ovirt.ovirt from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/ovirt/ovirt 2026-06-02 13:01:27.572859 | ubuntu-noble | Found installed collection ovirt.ovirt:3.2.1 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/ovirt/ovirt' 2026-06-02 13:01:27.573393 | ubuntu-noble | Loading collection wti.remote from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/wti/remote 2026-06-02 13:01:27.573746 | ubuntu-noble | Found installed collection wti.remote:1.0.10 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/wti/remote' 2026-06-02 13:01:27.574161 | ubuntu-noble | Loading collection ibm.qradar from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/ibm/qradar 2026-06-02 13:01:27.574526 | ubuntu-noble | Found installed collection ibm.qradar:4.0.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/ibm/qradar' 2026-06-02 13:01:27.575123 | ubuntu-noble | Loading collection netapp.storagegrid from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/netapp/storagegrid 2026-06-02 13:01:27.575612 | ubuntu-noble | Found installed collection netapp.storagegrid:21.14.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/netapp/storagegrid' 2026-06-02 13:01:27.575954 | ubuntu-noble | Loading collection community.windows from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/windows 2026-06-02 13:01:27.576243 | ubuntu-noble | Found installed collection community.windows:2.4.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/windows' 2026-06-02 13:01:27.576573 | ubuntu-noble | Loading collection cisco.ise from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/cisco/ise 2026-06-02 13:01:27.577007 | ubuntu-noble | Found installed collection cisco.ise:2.10.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/cisco/ise' 2026-06-02 13:01:27.578571 | ubuntu-noble | Loading collection cisco.mso from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/cisco/mso 2026-06-02 13:01:27.578813 | ubuntu-noble | Found installed collection cisco.mso:2.11.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/cisco/mso' 2026-06-02 13:01:27.579164 | ubuntu-noble | Loading collection lowlydba.sqlserver from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/lowlydba/sqlserver 2026-06-02 13:01:27.579499 | ubuntu-noble | Found installed collection lowlydba.sqlserver:2.7.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/lowlydba/sqlserver' 2026-06-02 13:01:27.583220 | ubuntu-noble | Loading collection fortinet.fortios from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/fortinet/fortios 2026-06-02 13:01:27.583484 | ubuntu-noble | Found installed collection fortinet.fortios:2.4.2 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/fortinet/fortios' 2026-06-02 13:01:27.585818 | ubuntu-noble | Loading collection cisco.meraki from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/cisco/meraki 2026-06-02 13:01:27.586140 | ubuntu-noble | Found installed collection cisco.meraki:2.21.8 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/cisco/meraki' 2026-06-02 13:01:27.586475 | ubuntu-noble | Loading collection infinidat.infinibox from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/infinidat/infinibox 2026-06-02 13:01:27.586746 | ubuntu-noble | Found installed collection infinidat.infinibox:1.6.3 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/infinidat/infinibox' 2026-06-02 13:01:27.587021 | ubuntu-noble | Loading collection sensu.sensu_go from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/sensu/sensu_go 2026-06-02 13:01:27.587337 | ubuntu-noble | Found installed collection sensu.sensu_go:1.14.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/sensu/sensu_go' 2026-06-02 13:01:27.587739 | ubuntu-noble | Loading collection ravendb.ravendb from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/ravendb/ravendb 2026-06-02 13:01:27.588186 | ubuntu-noble | Found installed collection ravendb.ravendb:1.0.4 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/ravendb/ravendb' 2026-06-02 13:01:27.588526 | ubuntu-noble | Loading collection microsoft.iis from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/microsoft/iis 2026-06-02 13:01:27.588755 | ubuntu-noble | Found installed collection microsoft.iis:1.0.3 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/microsoft/iis' 2026-06-02 13:01:27.589390 | ubuntu-noble | Loading collection dellemc.openmanage from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/dellemc/openmanage 2026-06-02 13:01:27.589858 | ubuntu-noble | Found installed collection dellemc.openmanage:9.12.3 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/dellemc/openmanage' 2026-06-02 13:01:27.590563 | ubuntu-noble | Loading collection cisco.iosxr from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/cisco/iosxr 2026-06-02 13:01:27.590826 | ubuntu-noble | Found installed collection cisco.iosxr:10.3.1 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/cisco/iosxr' 2026-06-02 13:01:27.592970 | ubuntu-noble | Loading collection junipernetworks.junos from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/junipernetworks/junos 2026-06-02 13:01:27.593373 | ubuntu-noble | Found installed collection junipernetworks.junos:9.1.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/junipernetworks/junos' 2026-06-02 13:01:27.612872 | ubuntu-noble | Loading collection awx.awx from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/awx/awx 2026-06-02 13:01:27.612904 | ubuntu-noble | Found installed collection awx.awx:24.6.1 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/awx/awx' 2026-06-02 13:01:27.613600 | ubuntu-noble | Loading collection community.vmware from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/vmware 2026-06-02 13:01:27.614185 | ubuntu-noble | Found installed collection community.vmware:5.10.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/vmware' 2026-06-02 13:01:27.614629 | ubuntu-noble | Loading collection kubevirt.core from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/kubevirt/core 2026-06-02 13:01:27.614941 | ubuntu-noble | Found installed collection kubevirt.core:2.2.3 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/kubevirt/core' 2026-06-02 13:01:27.615134 | ubuntu-noble | Loading collection infoblox.nios_modules from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/infoblox/nios_modules 2026-06-02 13:01:27.615459 | ubuntu-noble | Found installed collection infoblox.nios_modules:1.8.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/infoblox/nios_modules' 2026-06-02 13:01:27.615706 | ubuntu-noble | Loading collection community.hrobot from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/hrobot 2026-06-02 13:01:27.615969 | ubuntu-noble | Found installed collection community.hrobot:2.7.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/hrobot' 2026-06-02 13:01:27.616360 | ubuntu-noble | Loading collection containers.podman from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/containers/podman 2026-06-02 13:01:27.616602 | ubuntu-noble | Found installed collection containers.podman:1.18.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/containers/podman' 2026-06-02 13:01:27.617084 | ubuntu-noble | Loading collection community.proxmox from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/proxmox 2026-06-02 13:01:27.617383 | ubuntu-noble | Found installed collection community.proxmox:1.4.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/proxmox' 2026-06-02 13:01:27.617869 | ubuntu-noble | Loading collection community.crypto from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/crypto 2026-06-02 13:01:27.618160 | ubuntu-noble | Found installed collection community.crypto:2.26.6 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/crypto' 2026-06-02 13:01:27.618652 | ubuntu-noble | Loading collection community.docker from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/docker 2026-06-02 13:01:27.618983 | ubuntu-noble | Found installed collection community.docker:4.8.2 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/docker' 2026-06-02 13:01:27.619230 | ubuntu-noble | Loading collection ibm.spectrum_virtualize from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/ibm/spectrum_virtualize 2026-06-02 13:01:27.619475 | ubuntu-noble | Found installed collection ibm.spectrum_virtualize:2.0.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/ibm/spectrum_virtualize' 2026-06-02 13:01:27.620285 | ubuntu-noble | Loading collection dellemc.enterprise_sonic from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/dellemc/enterprise_sonic 2026-06-02 13:01:27.620577 | ubuntu-noble | Found installed collection dellemc.enterprise_sonic:2.5.1 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/dellemc/enterprise_sonic' 2026-06-02 13:01:27.620930 | ubuntu-noble | Loading collection netapp.cloudmanager from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/netapp/cloudmanager 2026-06-02 13:01:27.621242 | ubuntu-noble | Found installed collection netapp.cloudmanager:21.24.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/netapp/cloudmanager' 2026-06-02 13:01:27.622052 | ubuntu-noble | Loading collection netbox.netbox from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/netbox/netbox 2026-06-02 13:01:27.622379 | ubuntu-noble | Found installed collection netbox.netbox:3.21.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/netbox/netbox' 2026-06-02 13:01:27.622850 | ubuntu-noble | Loading collection community.mongodb from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/mongodb 2026-06-02 13:01:27.623165 | ubuntu-noble | Found installed collection community.mongodb:1.7.10 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/mongodb' 2026-06-02 13:01:27.626997 | ubuntu-noble | Loading collection community.aws from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/aws 2026-06-02 13:01:27.627195 | ubuntu-noble | Found installed collection community.aws:9.3.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/aws' 2026-06-02 13:01:27.629411 | ubuntu-noble | Loading collection azure.azcollection from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/azure/azcollection 2026-06-02 13:01:27.629618 | ubuntu-noble | Found installed collection azure.azcollection:3.10.1 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/azure/azcollection' 2026-06-02 13:01:27.630185 | ubuntu-noble | Loading collection vmware.vmware from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/vmware/vmware 2026-06-02 13:01:27.630512 | ubuntu-noble | Found installed collection vmware.vmware:1.11.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/vmware/vmware' 2026-06-02 13:01:27.630864 | ubuntu-noble | Loading collection kaytus.ksmanage from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/kaytus/ksmanage 2026-06-02 13:01:27.631152 | ubuntu-noble | Found installed collection kaytus.ksmanage:2.0.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/kaytus/ksmanage' 2026-06-02 13:01:27.631916 | ubuntu-noble | Loading collection ngine_io.cloudstack from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/ngine_io/cloudstack 2026-06-02 13:01:27.632167 | ubuntu-noble | Found installed collection ngine_io.cloudstack:2.5.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/ngine_io/cloudstack' 2026-06-02 13:01:27.643581 | ubuntu-noble | Loading collection community.general from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/general 2026-06-02 13:01:27.643731 | ubuntu-noble | Found installed collection community.general:10.7.6 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/general' 2026-06-02 13:01:27.643905 | ubuntu-noble | Loading collection splunk.es from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/splunk/es 2026-06-02 13:01:27.644100 | ubuntu-noble | Found installed collection splunk.es:4.0.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/splunk/es' 2026-06-02 13:01:27.646425 | ubuntu-noble | Loading collection vmware.vmware_rest from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/vmware/vmware_rest 2026-06-02 13:01:27.647864 | ubuntu-noble | Found installed collection vmware.vmware_rest:4.9.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/vmware/vmware_rest' 2026-06-02 13:01:27.647885 | ubuntu-noble | Loading collection openstack.cloud from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/openstack/cloud 2026-06-02 13:01:27.647890 | ubuntu-noble | Found installed collection openstack.cloud:2.5.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/openstack/cloud' 2026-06-02 13:01:27.647894 | ubuntu-noble | Loading collection hitachivantara.vspone_object from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/hitachivantara/vspone_object 2026-06-02 13:01:27.648735 | ubuntu-noble | Found installed collection hitachivantara.vspone_object:1.0.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/hitachivantara/vspone_object' 2026-06-02 13:01:27.648880 | ubuntu-noble | Loading collection chocolatey.chocolatey from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/chocolatey/chocolatey 2026-06-02 13:01:27.649039 | ubuntu-noble | Found installed collection chocolatey.chocolatey:1.5.3 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/chocolatey/chocolatey' 2026-06-02 13:01:27.649171 | ubuntu-noble | Loading collection community.postgresql from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/postgresql 2026-06-02 13:01:27.649360 | ubuntu-noble | Found installed collection community.postgresql:3.14.2 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/postgresql' 2026-06-02 13:01:27.649484 | ubuntu-noble | Loading collection community.mysql from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/mysql 2026-06-02 13:01:27.649654 | ubuntu-noble | Found installed collection community.mysql:3.16.1 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/mysql' 2026-06-02 13:01:27.649809 | ubuntu-noble | Loading collection cisco.dnac from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/cisco/dnac 2026-06-02 13:01:27.649997 | ubuntu-noble | Found installed collection cisco.dnac:6.31.3 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/cisco/dnac' 2026-06-02 13:01:27.652778 | ubuntu-noble | Loading collection cisco.nxos from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/cisco/nxos 2026-06-02 13:01:27.653901 | ubuntu-noble | Found installed collection cisco.nxos:9.4.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/cisco/nxos' 2026-06-02 13:01:27.654045 | ubuntu-noble | Loading collection cisco.asa from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/cisco/asa 2026-06-02 13:01:27.654216 | ubuntu-noble | Found installed collection cisco.asa:6.1.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/cisco/asa' 2026-06-02 13:01:27.655297 | ubuntu-noble | Loading collection cisco.aci from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/cisco/aci 2026-06-02 13:01:27.655418 | ubuntu-noble | Found installed collection cisco.aci:2.12.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/cisco/aci' 2026-06-02 13:01:27.656956 | ubuntu-noble | Loading collection vyos.vyos from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/vyos/vyos 2026-06-02 13:01:27.657857 | ubuntu-noble | Found installed collection vyos.vyos:5.0.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/vyos/vyos' 2026-06-02 13:01:27.658017 | ubuntu-noble | Loading collection community.proxysql from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/proxysql 2026-06-02 13:01:27.658126 | ubuntu-noble | Found installed collection community.proxysql:1.7.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/proxysql' 2026-06-02 13:01:27.658232 | ubuntu-noble | Loading collection community.hashi_vault from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/hashi_vault 2026-06-02 13:01:27.658361 | ubuntu-noble | Found installed collection community.hashi_vault:6.2.1 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/hashi_vault' 2026-06-02 13:01:27.658500 | ubuntu-noble | Loading collection dellemc.unity from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/dellemc/unity 2026-06-02 13:01:27.658637 | ubuntu-noble | Found installed collection dellemc.unity:2.1.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/dellemc/unity' 2026-06-02 13:01:27.661639 | ubuntu-noble | Loading collection check_point.mgmt from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/check_point/mgmt 2026-06-02 13:01:27.661738 | ubuntu-noble | Found installed collection check_point.mgmt:6.6.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/check_point/mgmt' 2026-06-02 13:01:27.661865 | ubuntu-noble | Loading collection cloudscale_ch.cloud from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/cloudscale_ch/cloud 2026-06-02 13:01:27.663086 | ubuntu-noble | Found installed collection cloudscale_ch.cloud:2.5.2 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/cloudscale_ch/cloud' 2026-06-02 13:01:27.663182 | ubuntu-noble | Loading collection ansible.netcommon from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/ansible/netcommon 2026-06-02 13:01:27.663368 | ubuntu-noble | Found installed collection ansible.netcommon:7.2.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/ansible/netcommon' 2026-06-02 13:01:27.663474 | ubuntu-noble | Loading collection arista.eos from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/arista/eos 2026-06-02 13:01:27.664556 | ubuntu-noble | Found installed collection arista.eos:10.1.1 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/arista/eos' 2026-06-02 13:01:27.664760 | ubuntu-noble | Loading collection community.dns from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/dns 2026-06-02 13:01:27.664902 | ubuntu-noble | Found installed collection community.dns:3.4.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/dns' 2026-06-02 13:01:27.665016 | ubuntu-noble | Loading collection vultr.cloud from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/vultr/cloud 2026-06-02 13:01:27.665120 | ubuntu-noble | Found installed collection vultr.cloud:1.13.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/vultr/cloud' 2026-06-02 13:01:27.666747 | ubuntu-noble | Loading collection amazon.aws from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/amazon/aws 2026-06-02 13:01:27.667960 | ubuntu-noble | Found installed collection amazon.aws:9.5.2 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/amazon/aws' 2026-06-02 13:01:27.669376 | ubuntu-noble | Loading collection ansible.utils from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/ansible/utils 2026-06-02 13:01:27.669481 | ubuntu-noble | Found installed collection ansible.utils:5.1.2 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/ansible/utils' 2026-06-02 13:01:27.669644 | ubuntu-noble | Loading collection netapp_eseries.santricity from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/netapp_eseries/santricity 2026-06-02 13:01:27.669739 | ubuntu-noble | Found installed collection netapp_eseries.santricity:1.4.1 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/netapp_eseries/santricity' 2026-06-02 13:01:27.669862 | ubuntu-noble | Loading collection community.rabbitmq from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/rabbitmq 2026-06-02 13:01:27.669967 | ubuntu-noble | Found installed collection community.rabbitmq:1.6.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/rabbitmq' 2026-06-02 13:01:27.670072 | ubuntu-noble | Loading collection cyberark.pas from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/cyberark/pas 2026-06-02 13:01:27.670179 | ubuntu-noble | Found installed collection cyberark.pas:1.0.36 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/cyberark/pas' 2026-06-02 13:01:27.670294 | ubuntu-noble | Loading collection ieisystem.inmanage from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/ieisystem/inmanage 2026-06-02 13:01:27.671844 | ubuntu-noble | Found installed collection ieisystem.inmanage:3.0.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/ieisystem/inmanage' 2026-06-02 13:01:27.671856 | ubuntu-noble | Loading collection purestorage.flasharray from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/purestorage/flasharray 2026-06-02 13:01:27.671861 | ubuntu-noble | Found installed collection purestorage.flasharray:1.39.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/purestorage/flasharray' 2026-06-02 13:01:27.676533 | ubuntu-noble | Loading collection fortinet.fortimanager from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/fortinet/fortimanager 2026-06-02 13:01:27.676627 | ubuntu-noble | Found installed collection fortinet.fortimanager:2.11.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/fortinet/fortimanager' 2026-06-02 13:01:27.677763 | ubuntu-noble | Loading collection community.sops from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/sops 2026-06-02 13:01:27.677945 | ubuntu-noble | Found installed collection community.sops:2.2.7 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/sops' 2026-06-02 13:01:27.678048 | ubuntu-noble | Loading collection grafana.grafana from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/grafana/grafana 2026-06-02 13:01:27.678454 | ubuntu-noble | Found installed collection grafana.grafana:5.7.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/grafana/grafana' 2026-06-02 13:01:27.678555 | ubuntu-noble | Loading collection cloud.common from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/cloud/common 2026-06-02 13:01:27.678659 | ubuntu-noble | Found installed collection cloud.common:4.2.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/cloud/common' 2026-06-02 13:01:27.679566 | ubuntu-noble | Loading collection hetzner.hcloud from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/hetzner/hcloud 2026-06-02 13:01:27.679678 | ubuntu-noble | Found installed collection hetzner.hcloud:4.3.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/hetzner/hcloud' 2026-06-02 13:01:27.680085 | ubuntu-noble | Loading collection community.ciscosmb from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/ciscosmb 2026-06-02 13:01:27.680235 | ubuntu-noble | Found installed collection community.ciscosmb:1.0.11 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/ciscosmb' 2026-06-02 13:01:27.680357 | ubuntu-noble | Loading collection cisco.ucs from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/cisco/ucs 2026-06-02 13:01:27.680495 | ubuntu-noble | Found installed collection cisco.ucs:1.16.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/cisco/ucs' 2026-06-02 13:01:27.682631 | ubuntu-noble | Loading collection theforeman.foreman from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/theforeman/foreman 2026-06-02 13:01:27.682736 | ubuntu-noble | Found installed collection theforeman.foreman:4.2.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/theforeman/foreman' 2026-06-02 13:01:27.683368 | ubuntu-noble | Loading collection community.zabbix from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/zabbix 2026-06-02 13:01:27.683528 | ubuntu-noble | Found installed collection community.zabbix:3.3.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/zabbix' 2026-06-02 13:01:27.683640 | ubuntu-noble | Loading collection microsoft.ad from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/microsoft/ad 2026-06-02 13:01:27.684644 | ubuntu-noble | Found installed collection microsoft.ad:1.9.2 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/microsoft/ad' 2026-06-02 13:01:27.684797 | ubuntu-noble | Loading collection community.libvirt from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/libvirt 2026-06-02 13:01:27.685740 | ubuntu-noble | Found installed collection community.libvirt:1.4.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/libvirt' 2026-06-02 13:01:27.685895 | ubuntu-noble | Loading collection ibm.storage_virtualize from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/ibm/storage_virtualize 2026-06-02 13:01:27.686001 | ubuntu-noble | Found installed collection ibm.storage_virtualize:2.7.4 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/ibm/storage_virtualize' 2026-06-02 13:01:27.686406 | ubuntu-noble | Loading collection hitachivantara.vspone_block from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/hitachivantara/vspone_block 2026-06-02 13:01:27.686511 | ubuntu-noble | Found installed collection hitachivantara.vspone_block:3.5.1 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/hitachivantara/vspone_block' 2026-06-02 13:01:27.686654 | ubuntu-noble | Loading collection cisco.ios from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/cisco/ios 2026-06-02 13:01:27.686755 | ubuntu-noble | Found installed collection cisco.ios:9.2.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/cisco/ios' 2026-06-02 13:01:27.687539 | ubuntu-noble | Loading collection community.okd from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/okd 2026-06-02 13:01:27.688487 | ubuntu-noble | Found installed collection community.okd:4.0.2 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/okd' 2026-06-02 13:01:27.688693 | ubuntu-noble | Loading collection f5networks.f5_modules from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/f5networks/f5_modules 2026-06-02 13:01:27.688800 | ubuntu-noble | Found installed collection f5networks.f5_modules:1.39.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/f5networks/f5_modules' 2026-06-02 13:01:27.689847 | ubuntu-noble | Loading collection netapp.ontap from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/netapp/ontap 2026-06-02 13:01:27.689972 | ubuntu-noble | Found installed collection netapp.ontap:22.14.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/netapp/ontap' 2026-06-02 13:01:27.690470 | ubuntu-noble | Loading collection kubernetes.core from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/kubernetes/core 2026-06-02 13:01:27.690605 | ubuntu-noble | Found installed collection kubernetes.core:5.4.1 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/kubernetes/core' 2026-06-02 13:01:27.691411 | ubuntu-noble | Loading collection community.sap_libs from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/sap_libs 2026-06-02 13:01:27.691511 | ubuntu-noble | Found installed collection community.sap_libs:1.5.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/sap_libs' 2026-06-02 13:01:27.692783 | ubuntu-noble | Loading collection community.digitalocean from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/digitalocean 2026-06-02 13:01:27.692943 | ubuntu-noble | Found installed collection community.digitalocean:1.27.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/digitalocean' 2026-06-02 13:01:27.693196 | ubuntu-noble | Loading collection inspur.ispim from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/inspur/ispim 2026-06-02 13:01:27.693694 | ubuntu-noble | Found installed collection inspur.ispim:2.2.3 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/inspur/ispim' 2026-06-02 13:01:27.693841 | ubuntu-noble | Loading collection community.routeros from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/routeros 2026-06-02 13:01:27.694621 | ubuntu-noble | Found installed collection community.routeros:3.13.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/routeros' 2026-06-02 13:01:27.694771 | ubuntu-noble | Loading collection dellemc.powerflex from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/dellemc/powerflex 2026-06-02 13:01:27.694924 | ubuntu-noble | Found installed collection dellemc.powerflex:2.6.1 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/dellemc/powerflex' 2026-06-02 13:01:27.695989 | ubuntu-noble | Loading collection ansible.windows from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/ansible/windows 2026-06-02 13:01:27.696341 | ubuntu-noble | Found installed collection ansible.windows:2.8.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/ansible/windows' 2026-06-02 13:01:27.696443 | ubuntu-noble | Loading collection ansible.posix from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/ansible/posix 2026-06-02 13:01:27.696591 | ubuntu-noble | Found installed collection ansible.posix:1.6.2 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/ansible/posix' 2026-06-02 13:01:27.696700 | ubuntu-noble | Loading collection telekom_mms.icinga_director from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/telekom_mms/icinga_director 2026-06-02 13:01:27.697527 | ubuntu-noble | Found installed collection telekom_mms.icinga_director:2.4.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/telekom_mms/icinga_director' 2026-06-02 13:01:27.736791 | ubuntu-noble | Loading collection community.network from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/network 2026-06-02 13:01:27.738862 | ubuntu-noble | Found installed collection community.network:5.1.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/network' 2026-06-02 13:01:27.740621 | ubuntu-noble | Loading collection community.grafana from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/grafana 2026-06-02 13:01:27.740803 | ubuntu-noble | Found installed collection community.grafana:2.3.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/grafana' 2026-06-02 13:01:27.741290 | ubuntu-noble | Loading collection google.cloud from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/google/cloud 2026-06-02 13:01:27.741396 | ubuntu-noble | Found installed collection google.cloud:1.9.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/google/cloud' 2026-06-02 13:01:27.741502 | ubuntu-noble | Loading collection cisco.intersight from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/cisco/intersight 2026-06-02 13:01:27.741608 | ubuntu-noble | Found installed collection cisco.intersight:2.7.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/cisco/intersight' 2026-06-02 13:01:27.741713 | ubuntu-noble | Loading collection cyberark.conjur from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/cyberark/conjur 2026-06-02 13:01:27.741817 | ubuntu-noble | Found installed collection cyberark.conjur:1.3.8 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/cyberark/conjur' 2026-06-02 13:01:27.741946 | ubuntu-noble | Loading collection purestorage.flashblade from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/purestorage/flashblade 2026-06-02 13:01:27.742040 | ubuntu-noble | Found installed collection purestorage.flashblade:1.22.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/purestorage/flashblade' 2026-06-02 13:01:27.742145 | ubuntu-noble | Loading collection community.library_inventory_filtering_v1 from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/library_inventory_filtering_v1 2026-06-02 13:01:27.742249 | ubuntu-noble | Found installed collection community.library_inventory_filtering_v1:1.1.5 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/library_inventory_filtering_v1' 2026-06-02 13:01:27.753705 | ubuntu-noble | Loading collection osism.services from /home/zuul/.ansible/collections/ansible_collections/osism/services 2026-06-02 13:01:27.753859 | ubuntu-noble | Found installed collection osism.services:999.0.0 at '/home/zuul/.ansible/collections/ansible_collections/osism/services' 2026-06-02 13:01:27.758079 | ubuntu-noble | Initial connection to galaxy_server: https://galaxy.ansible.com 2026-06-02 13:01:27.758405 | ubuntu-noble | Created /home/zuul/.ansible/galaxy_token 2026-06-02 13:01:27.758502 | ubuntu-noble | Calling Galaxy at https://galaxy.ansible.com/api/ 2026-06-02 13:01:27.864842 | debian-bookworm | Found API version 'v3, pulp-v3, v1' with Galaxy server default (https://galaxy.ansible.com/api/) 2026-06-02 13:01:27.867640 | debian-bookworm | Calling Galaxy at https://galaxy.ansible.com/api/v3/collections/osism/commons/ 2026-06-02 13:01:28.061640 | ubuntu-noble | Found API version 'v3, pulp-v3, v1' with Galaxy server default (https://galaxy.ansible.com/api/) 2026-06-02 13:01:28.062166 | ubuntu-noble | Calling Galaxy at https://galaxy.ansible.com/api/v3/collections/osism/commons/ 2026-06-02 13:01:29.455663 | ubuntu-noble | Calling Galaxy at https://galaxy.ansible.com/api/v3/collections/osism/commons/versions/?limit=100 2026-06-02 13:01:30.153932 | debian-bookworm | Calling Galaxy at https://galaxy.ansible.com/api/v3/collections/osism/commons/versions/?limit=100 2026-06-02 13:01:31.673697 | debian-bookworm | Calling Galaxy at https://galaxy.ansible.com/api/v3/collections/osism/commons/versions/0.20260601.0/ 2026-06-02 13:01:34.562560 | ubuntu-noble | Calling Galaxy at https://galaxy.ansible.com/api/v3/collections/osism/commons/versions/0.20260601.0/ 2026-06-02 13:01:35.483062 | ubuntu-noble | Server https://galaxy.ansible.com/api/ has not signed osism.commons:0.20260601.0 2026-06-02 13:01:35.483340 | ubuntu-noble | Fetching a collection tarball for 'osism.commons:0.20260601.0' from Ansible Galaxy 2026-06-02 13:01:37.978760 | debian-bookworm | Server https://galaxy.ansible.com/api/ has not signed osism.commons:0.20260601.0 2026-06-02 13:01:37.979111 | debian-bookworm | Fetching a collection tarball for 'osism.commons:0.20260601.0' from Ansible Galaxy 2026-06-02 13:01:38.433934 | ubuntu-noble | Validating downloaded file hash 1d41d3b5d145afda8cce7ec8515d5495c0afe9a3787ce4d2ea101956f5f7e2b1 with expected hash 1d41d3b5d145afda8cce7ec8515d5495c0afe9a3787ce4d2ea101956f5f7e2b1 2026-06-02 13:01:38.434002 | ubuntu-noble | Collection 'osism.commons:0.20260601.0' obtained from server default https://galaxy.ansible.com/api/ 2026-06-02 13:01:38.613627 | ubuntu-noble | Starting galaxy collection install process 2026-06-02 13:01:38.613671 | ubuntu-noble | Process install dependency map 2026-06-02 13:01:38.613678 | ubuntu-noble | Starting collection install process 2026-06-02 13:01:38.613683 | ubuntu-noble | 'ansible.posix:1.6.2' is already installed, skipping. 2026-06-02 13:01:38.613687 | ubuntu-noble | 'community.docker:4.8.2' is already installed, skipping. 2026-06-02 13:01:38.613691 | ubuntu-noble | 'community.general:10.7.6' is already installed, skipping. 2026-06-02 13:01:38.613695 | ubuntu-noble | 'community.library_inventory_filtering_v1:1.1.5' is already installed, skipping. 2026-06-02 13:01:38.613700 | ubuntu-noble | Downloading https://galaxy.ansible.com/api/v3/plugin/ansible/content/published/collections/artifacts/osism-commons-0.20260601.0.tar.gz to /home/zuul/.ansible/tmp/ansible-local-1679nxkfxneh/tmpyuttdby3/osism-commons-0.20260601.0-2xm85lr5 2026-06-02 13:01:38.613719 | ubuntu-noble | Installing 'osism.commons:0.20260601.0' to '/home/zuul/.ansible/collections/ansible_collections/osism/commons' 2026-06-02 13:01:38.613723 | ubuntu-noble | osism.commons:0.20260601.0 was installed successfully 2026-06-02 13:01:38.691895 | ubuntu-noble | INFO [delegated > dependency] Dependency completed successfully. 2026-06-02 13:01:38.692030 | ubuntu-noble | WARNING [delegated > dependency] Executed: Missing roles requirements file: requirements.yml (Remove from dependency_sequence to suppress) 2026-06-02 13:01:38.692629 | ubuntu-noble | WARNING Molecule executed 1 scenario (1 missing files) 2026-06-02 13:01:41.420992 | debian-bookworm | Validating downloaded file hash 1d41d3b5d145afda8cce7ec8515d5495c0afe9a3787ce4d2ea101956f5f7e2b1 with expected hash 1d41d3b5d145afda8cce7ec8515d5495c0afe9a3787ce4d2ea101956f5f7e2b1 2026-06-02 13:01:41.421582 | debian-bookworm | Collection 'osism.commons:0.20260601.0' obtained from server default https://galaxy.ansible.com/api/ 2026-06-02 13:01:41.568839 | debian-bookworm | Starting galaxy collection install process 2026-06-02 13:01:41.569348 | debian-bookworm | Process install dependency map 2026-06-02 13:01:41.569727 | debian-bookworm | Starting collection install process 2026-06-02 13:01:41.570121 | debian-bookworm | 'ansible.posix:1.6.2' is already installed, skipping. 2026-06-02 13:01:41.570478 | debian-bookworm | 'community.docker:4.8.2' is already installed, skipping. 2026-06-02 13:01:41.570821 | debian-bookworm | 'community.general:10.7.6' is already installed, skipping. 2026-06-02 13:01:41.571196 | debian-bookworm | 'community.library_inventory_filtering_v1:1.1.5' is already installed, skipping. 2026-06-02 13:01:41.571569 | debian-bookworm | Downloading https://galaxy.ansible.com/api/v3/plugin/ansible/content/published/collections/artifacts/osism-commons-0.20260601.0.tar.gz to /home/zuul/.ansible/tmp/ansible-local-1833dkb8wn8c/tmpydqqw0dn/osism-commons-0.20260601.0-falff111 2026-06-02 13:01:41.572025 | debian-bookworm | Installing 'osism.commons:0.20260601.0' to '/home/zuul/.ansible/collections/ansible_collections/osism/commons' 2026-06-02 13:01:41.572389 | debian-bookworm | osism.commons:0.20260601.0 was installed successfully 2026-06-02 13:01:41.625256 | debian-bookworm | INFO [delegated > dependency] Dependency completed successfully. 2026-06-02 13:01:41.625668 | debian-bookworm | WARNING [delegated > dependency] Executed: Missing roles requirements file: requirements.yml (Remove from dependency_sequence to suppress) 2026-06-02 13:01:41.626485 | debian-bookworm | WARNING Molecule executed 1 scenario (1 missing files) 2026-06-02 13:01:42.039293 | ubuntu-noble | ok: Runtime: 0:00:13.846025 2026-06-02 13:01:42.047922 | debian-bookworm | ok: Runtime: 0:00:16.884198 2026-06-02 13:01:42.055963 | 2026-06-02 13:01:42.056079 | TASK [ansible-molecule : Run molecule create action with scenario delegated] 2026-06-02 13:01:42.622448 | ubuntu-noble | skipping: Conditional result was False 2026-06-02 13:01:42.623166 | debian-bookworm | skipping: Conditional result was False 2026-06-02 13:01:42.629872 | 2026-06-02 13:01:42.630000 | TASK [ansible-molecule : Run molecule prepare action with scenario delegated] 2026-06-02 13:01:43.420959 | ubuntu-noble | WARNING Molecule scenarios should migrate to 'extensions/molecule' 2026-06-02 13:01:43.431654 | ubuntu-noble | DEBUG [unknown > config] provisioner.env found in /home/zuul/src/github.com/osism/ansible-collection-services/molecule/delegated/molecule.yml, this can be defined in ansible.env 2026-06-02 13:01:43.256499 | debian-bookworm | WARNING Molecule scenarios should migrate to 'extensions/molecule' 2026-06-02 13:01:43.265983 | debian-bookworm | DEBUG [unknown > config] provisioner.env found in /home/zuul/src/github.com/osism/ansible-collection-services/molecule/delegated/molecule.yml, this can be defined in ansible.env 2026-06-02 13:01:43.683698 | debian-bookworm | DEBUG [unknown > config] provisioner.env found in /home/zuul/src/github.com/osism/ansible-collection-services/molecule/delegated/molecule.yml, this can be defined in ansible.env 2026-06-02 13:01:43.683770 | debian-bookworm | DEBUG [delegated > validate] Validating schema /home/zuul/src/github.com/osism/ansible-collection-services/molecule/delegated/molecule.yml. 2026-06-02 13:01:43.936858 | ubuntu-noble | DEBUG [unknown > config] provisioner.env found in /home/zuul/src/github.com/osism/ansible-collection-services/molecule/delegated/molecule.yml, this can be defined in ansible.env 2026-06-02 13:01:43.937492 | ubuntu-noble | DEBUG [delegated > validate] Validating schema /home/zuul/src/github.com/osism/ansible-collection-services/molecule/delegated/molecule.yml. 2026-06-02 13:01:43.960246 | ubuntu-noble | DEBUG [default > validate] Validating schema /home/zuul/src/github.com/osism/ansible-collection-services/molecule/default/molecule.yml. 2026-06-02 13:01:43.966043 | ubuntu-noble | INFO [delegated > discovery] scenario test matrix: prepare 2026-06-02 13:01:43.966081 | ubuntu-noble | INFO [delegated > prerun] Performing prerun with role_name_check=0... 2026-06-02 13:01:43.703854 | debian-bookworm | DEBUG [default > validate] Validating schema /home/zuul/src/github.com/osism/ansible-collection-services/molecule/default/molecule.yml. 2026-06-02 13:01:43.709116 | debian-bookworm | INFO [delegated > discovery] scenario test matrix: prepare 2026-06-02 13:01:43.709204 | debian-bookworm | INFO [delegated > prerun] Performing prerun with role_name_check=0... 2026-06-02 13:01:44.761643 | debian-bookworm | INFO [delegated > prepare] Executing 2026-06-02 13:01:45.052589 | debian-bookworm | DEBUG [delegated > prepare] ansible-playbook version: ansible-playbook 2026-06-02 13:01:45.052696 | debian-bookworm | config file = None 2026-06-02 13:01:45.052733 | debian-bookworm | configured module search path = 2026-06-02 13:01:45.052756 | debian-bookworm | ansible python module location = /home/zuul/venv/lib/python3.11/site-packages/ansible 2026-06-02 13:01:45.052777 | debian-bookworm | ansible collection location = /home/zuul/.ansible/collections:/usr/share/ansible/collections 2026-06-02 13:01:45.052791 | debian-bookworm | executable location = /home/zuul/venv/bin/ansible-playbook 2026-06-02 13:01:45.052797 | debian-bookworm | python version = 3.11.2 (main, Apr 8 2026, 01:58:00) (/home/zuul/venv/bin/python3) 2026-06-02 13:01:45.052806 | debian-bookworm | jinja version = 3.1.6 2026-06-02 13:01:45.052821 | debian-bookworm | libyaml = True 2026-06-02 13:01:45.052864 | debian-bookworm | DEBUG ANSIBLE ENVIRONMENT: 2026-06-02 13:01:45.052882 | debian-bookworm | ANSIBLE_COLLECTIONS_PATH: /home/zuul/venv/.ansible/collections:/home/zuul/.ansible/collections 2026-06-02 13:01:45.052889 | debian-bookworm | ANSIBLE_CONFIG: /home/zuul/.ansible/tmp/molecule.oWZD.delegated/ansible.cfg 2026-06-02 13:01:45.052895 | debian-bookworm | ANSIBLE_LIBRARY: ../../plugins 2026-06-02 13:01:45.052902 | debian-bookworm | ANSIBLE_PYTHON_INTERPRETER: /home/zuul/venv/bin/python 2026-06-02 13:01:45.052911 | debian-bookworm | ANSIBLE_ROLE: auditd 2026-06-02 13:01:45.052917 | debian-bookworm | ANSIBLE_ROLES_PATH: ../../roles 2026-06-02 13:01:45.052923 | debian-bookworm | ANSIBLE_VERBOSITY: 1 2026-06-02 13:01:45.052929 | debian-bookworm | 2026-06-02 13:01:45.052936 | debian-bookworm | DEBUG MOLECULE ENVIRONMENT: 2026-06-02 13:01:45.052943 | debian-bookworm | MOLECULE_DEBUG: True 2026-06-02 13:01:45.052957 | debian-bookworm | MOLECULE_DEPENDENCY_NAME: galaxy 2026-06-02 13:01:45.052965 | debian-bookworm | MOLECULE_DRIVER_NAME: default 2026-06-02 13:01:45.052971 | debian-bookworm | MOLECULE_ENV_FILE: /home/zuul/src/github.com/osism/ansible-collection-services/.env.yml 2026-06-02 13:01:45.052978 | debian-bookworm | MOLECULE_EPHEMERAL_DIRECTORY: /home/zuul/.ansible/tmp/molecule.oWZD.delegated 2026-06-02 13:01:45.052984 | debian-bookworm | MOLECULE_FILE: /home/zuul/.ansible/tmp/molecule.oWZD.delegated/molecule.yml 2026-06-02 13:01:45.052990 | debian-bookworm | MOLECULE_INSTANCE_CONFIG: /home/zuul/.ansible/tmp/molecule.oWZD.delegated/instance_config.yml 2026-06-02 13:01:45.052997 | debian-bookworm | MOLECULE_INVENTORY_FILE: /home/zuul/.ansible/tmp/molecule.oWZD.delegated/inventory/ansible_inventory.yml 2026-06-02 13:01:45.053004 | debian-bookworm | MOLECULE_PROJECT_DIRECTORY: /home/zuul/src/github.com/osism/ansible-collection-services 2026-06-02 13:01:45.053010 | debian-bookworm | MOLECULE_PROVISIONER_NAME: ansible 2026-06-02 13:01:45.053016 | debian-bookworm | MOLECULE_SCENARIO_DIRECTORY: /home/zuul/src/github.com/osism/ansible-collection-services/molecule/delegated 2026-06-02 13:01:45.053022 | debian-bookworm | MOLECULE_SCENARIO_NAME: delegated 2026-06-02 13:01:45.053028 | debian-bookworm | MOLECULE_STATE_FILE: /home/zuul/.ansible/tmp/molecule.oWZD.delegated/state.yml 2026-06-02 13:01:45.053035 | debian-bookworm | MOLECULE_VERIFIER_NAME: testinfra 2026-06-02 13:01:45.053042 | debian-bookworm | MOLECULE_VERIFIER_TEST_DIRECTORY: /home/zuul/src/github.com/osism/ansible-collection-services/molecule/delegated/tests 2026-06-02 13:01:45.053049 | debian-bookworm | 2026-06-02 13:01:45.053062 | debian-bookworm | DEBUG SHELL REPLAY: ANSIBLE_COLLECTIONS_PATH=/home/zuul/venv/.ansible/collections:/home/zuul/.ansible/collections ANSIBLE_CONFIG=/home/zuul/.ansible/tmp/molecule.oWZD.delegated/ansible.cfg ANSIBLE_LIBRARY=../../plugins ANSIBLE_PYTHON_INTERPRETER=/home/zuul/venv/bin/python ANSIBLE_ROLE=auditd ANSIBLE_ROLES_PATH=../../roles ANSIBLE_VERBOSITY=1 MOLECULE_DEBUG=True MOLECULE_DEPENDENCY_NAME=galaxy MOLECULE_DRIVER_NAME=default MOLECULE_ENV_FILE=/home/zuul/src/github.com/osism/ansible-collection-services/.env.yml MOLECULE_EPHEMERAL_DIRECTORY=/home/zuul/.ansible/tmp/molecule.oWZD.delegated MOLECULE_FILE=/home/zuul/.ansible/tmp/molecule.oWZD.delegated/molecule.yml MOLECULE_INSTANCE_CONFIG=/home/zuul/.ansible/tmp/molecule.oWZD.delegated/instance_config.yml MOLECULE_INVENTORY_FILE=/home/zuul/.ansible/tmp/molecule.oWZD.delegated/inventory/ansible_inventory.yml MOLECULE_PROJECT_DIRECTORY=/home/zuul/src/github.com/osism/ansible-collection-services MOLECULE_PROVISIONER_NAME=ansible MOLECULE_SCENARIO_DIRECTORY=/home/zuul/src/github.com/osism/ansible-collection-services/molecule/delegated MOLECULE_SCENARIO_NAME=delegated MOLECULE_STATE_FILE=/home/zuul/.ansible/tmp/molecule.oWZD.delegated/state.yml MOLECULE_VERIFIER_NAME=testinfra MOLECULE_VERIFIER_TEST_DIRECTORY=/home/zuul/src/github.com/osism/ansible-collection-services/molecule/delegated/tests 2026-06-02 13:01:45.296165 | ubuntu-noble | INFO [delegated > prepare] Executing 2026-06-02 13:01:45.647688 | ubuntu-noble | DEBUG [delegated > prepare] ansible-playbook version: ansible-playbook 2026-06-02 13:01:45.647744 | ubuntu-noble | config file = None 2026-06-02 13:01:45.647760 | ubuntu-noble | configured module search path = 2026-06-02 13:01:45.647766 | ubuntu-noble | ansible python module location = /home/zuul/venv/lib/python3.12/site-packages/ansible 2026-06-02 13:01:45.647772 | ubuntu-noble | ansible collection location = /home/zuul/.ansible/collections:/usr/share/ansible/collections 2026-06-02 13:01:45.647776 | ubuntu-noble | executable location = /home/zuul/venv/bin/ansible-playbook 2026-06-02 13:01:45.647779 | ubuntu-noble | python version = 3.12.3 (main, Mar 23 2026, 19:04:32) (/home/zuul/venv/bin/python3) 2026-06-02 13:01:45.647783 | ubuntu-noble | jinja version = 3.1.6 2026-06-02 13:01:45.647787 | ubuntu-noble | libyaml = True 2026-06-02 13:01:45.648098 | ubuntu-noble | DEBUG ANSIBLE ENVIRONMENT: 2026-06-02 13:01:45.648107 | ubuntu-noble | ANSIBLE_COLLECTIONS_PATH: /home/zuul/venv/.ansible/collections:/home/zuul/.ansible/collections 2026-06-02 13:01:45.648111 | ubuntu-noble | ANSIBLE_CONFIG: /home/zuul/.ansible/tmp/molecule.oWZD.delegated/ansible.cfg 2026-06-02 13:01:45.648115 | ubuntu-noble | ANSIBLE_LIBRARY: ../../plugins 2026-06-02 13:01:45.648118 | ubuntu-noble | ANSIBLE_PYTHON_INTERPRETER: /home/zuul/venv/bin/python 2026-06-02 13:01:45.648122 | ubuntu-noble | ANSIBLE_ROLE: auditd 2026-06-02 13:01:45.648125 | ubuntu-noble | ANSIBLE_ROLES_PATH: ../../roles 2026-06-02 13:01:45.648129 | ubuntu-noble | ANSIBLE_VERBOSITY: 1 2026-06-02 13:01:45.648133 | ubuntu-noble | 2026-06-02 13:01:45.648337 | ubuntu-noble | DEBUG MOLECULE ENVIRONMENT: 2026-06-02 13:01:45.648343 | ubuntu-noble | MOLECULE_DEBUG: True 2026-06-02 13:01:45.648347 | ubuntu-noble | MOLECULE_DEPENDENCY_NAME: galaxy 2026-06-02 13:01:45.648350 | ubuntu-noble | MOLECULE_DRIVER_NAME: default 2026-06-02 13:01:45.648354 | ubuntu-noble | MOLECULE_ENV_FILE: /home/zuul/src/github.com/osism/ansible-collection-services/.env.yml 2026-06-02 13:01:45.648358 | ubuntu-noble | MOLECULE_EPHEMERAL_DIRECTORY: /home/zuul/.ansible/tmp/molecule.oWZD.delegated 2026-06-02 13:01:45.648362 | ubuntu-noble | MOLECULE_FILE: /home/zuul/.ansible/tmp/molecule.oWZD.delegated/molecule.yml 2026-06-02 13:01:45.648365 | ubuntu-noble | MOLECULE_INSTANCE_CONFIG: /home/zuul/.ansible/tmp/molecule.oWZD.delegated/instance_config.yml 2026-06-02 13:01:45.648368 | ubuntu-noble | MOLECULE_INVENTORY_FILE: /home/zuul/.ansible/tmp/molecule.oWZD.delegated/inventory/ansible_inventory.yml 2026-06-02 13:01:45.648372 | ubuntu-noble | MOLECULE_PROJECT_DIRECTORY: /home/zuul/src/github.com/osism/ansible-collection-services 2026-06-02 13:01:45.648376 | ubuntu-noble | MOLECULE_PROVISIONER_NAME: ansible 2026-06-02 13:01:45.648379 | ubuntu-noble | MOLECULE_SCENARIO_DIRECTORY: /home/zuul/src/github.com/osism/ansible-collection-services/molecule/delegated 2026-06-02 13:01:45.648383 | ubuntu-noble | MOLECULE_SCENARIO_NAME: delegated 2026-06-02 13:01:45.648386 | ubuntu-noble | MOLECULE_STATE_FILE: /home/zuul/.ansible/tmp/molecule.oWZD.delegated/state.yml 2026-06-02 13:01:45.648390 | ubuntu-noble | MOLECULE_VERIFIER_NAME: testinfra 2026-06-02 13:01:45.648393 | ubuntu-noble | MOLECULE_VERIFIER_TEST_DIRECTORY: /home/zuul/src/github.com/osism/ansible-collection-services/molecule/delegated/tests 2026-06-02 13:01:45.648397 | ubuntu-noble | 2026-06-02 13:01:45.648707 | ubuntu-noble | DEBUG SHELL REPLAY: ANSIBLE_COLLECTIONS_PATH=/home/zuul/venv/.ansible/collections:/home/zuul/.ansible/collections ANSIBLE_CONFIG=/home/zuul/.ansible/tmp/molecule.oWZD.delegated/ansible.cfg ANSIBLE_LIBRARY=../../plugins ANSIBLE_PYTHON_INTERPRETER=/home/zuul/venv/bin/python ANSIBLE_ROLE=auditd ANSIBLE_ROLES_PATH=../../roles ANSIBLE_VERBOSITY=1 MOLECULE_DEBUG=True MOLECULE_DEPENDENCY_NAME=galaxy MOLECULE_DRIVER_NAME=default MOLECULE_ENV_FILE=/home/zuul/src/github.com/osism/ansible-collection-services/.env.yml MOLECULE_EPHEMERAL_DIRECTORY=/home/zuul/.ansible/tmp/molecule.oWZD.delegated MOLECULE_FILE=/home/zuul/.ansible/tmp/molecule.oWZD.delegated/molecule.yml MOLECULE_INSTANCE_CONFIG=/home/zuul/.ansible/tmp/molecule.oWZD.delegated/instance_config.yml MOLECULE_INVENTORY_FILE=/home/zuul/.ansible/tmp/molecule.oWZD.delegated/inventory/ansible_inventory.yml MOLECULE_PROJECT_DIRECTORY=/home/zuul/src/github.com/osism/ansible-collection-services MOLECULE_PROVISIONER_NAME=ansible MOLECULE_SCENARIO_DIRECTORY=/home/zuul/src/github.com/osism/ansible-collection-services/molecule/delegated MOLECULE_SCENARIO_NAME=delegated MOLECULE_STATE_FILE=/home/zuul/.ansible/tmp/molecule.oWZD.delegated/state.yml MOLECULE_VERIFIER_NAME=testinfra MOLECULE_VERIFIER_TEST_DIRECTORY=/home/zuul/src/github.com/osism/ansible-collection-services/molecule/delegated/tests 2026-06-02 13:01:45.323916 | debian-bookworm | Using /home/zuul/.ansible/tmp/molecule.oWZD.delegated/ansible.cfg as config file 2026-06-02 13:01:45.571181 | debian-bookworm | 2026-06-02 13:01:45.571649 | debian-bookworm | PLAY [Prepare] ***************************************************************** 2026-06-02 13:01:45.572154 | debian-bookworm | 2026-06-02 13:01:45.572540 | debian-bookworm | TASK [Gathering Facts] ********************************************************* 2026-06-02 13:01:45.952301 | ubuntu-noble | Using /home/zuul/.ansible/tmp/molecule.oWZD.delegated/ansible.cfg as config file 2026-06-02 13:01:46.220886 | ubuntu-noble | 2026-06-02 13:01:46.220936 | ubuntu-noble | PLAY [Prepare] ***************************************************************** 2026-06-02 13:01:46.220942 | ubuntu-noble | 2026-06-02 13:01:46.222307 | ubuntu-noble | TASK [Gathering Facts] ********************************************************* 2026-06-02 13:01:46.605223 | debian-bookworm | ok: [molecule-auditd] 2026-06-02 13:01:46.605365 | debian-bookworm | 2026-06-02 13:01:46.605824 | debian-bookworm | TASK [Install packages in venv] ************************************************ 2026-06-02 13:01:47.411808 | ubuntu-noble | ok: [molecule-auditd] 2026-06-02 13:01:47.411905 | ubuntu-noble | 2026-06-02 13:01:47.413084 | ubuntu-noble | TASK [Install packages in venv] ************************************************ 2026-06-02 13:01:50.767002 | debian-bookworm | changed: [molecule-auditd] => (item=docker) => {"ansible_loop_var": "item", "changed": true, "cmd": ["/home/zuul/venv/bin/pip3", "install", "docker"], "item": "docker", "name": ["docker"], "requirements": null, "state": "present", "stderr": "", "stderr_lines": [], "stdout": "Collecting docker\n Downloading docker-7.1.0-py3-none-any.whl (147 kB)\n ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ 147.8/147.8 kB 3.9 MB/s eta 0:00:00\nRequirement already satisfied: requests>=2.26.0 in /home/zuul/venv/lib/python3.11/site-packages (from docker) (2.34.2)\nRequirement already satisfied: urllib3>=1.26.0 in /home/zuul/venv/lib/python3.11/site-packages (from docker) (2.7.0)\nRequirement already satisfied: charset_normalizer<4,>=2 in /home/zuul/venv/lib/python3.11/site-packages (from requests>=2.26.0->docker) (3.4.7)\nRequirement already satisfied: idna<4,>=2.5 in /home/zuul/venv/lib/python3.11/site-packages (from requests>=2.26.0->docker) (3.17)\nRequirement already satisfied: certifi>=2023.5.7 in /home/zuul/venv/lib/python3.11/site-packages (from requests>=2.26.0->docker) (2026.5.20)\nInstalling collected packages: docker\nSuccessfully installed docker-7.1.0\n", "stdout_lines": ["Collecting docker", " Downloading docker-7.1.0-py3-none-any.whl (147 kB)", " ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ 147.8/147.8 kB 3.9 MB/s eta 0:00:00", "Requirement already satisfied: requests>=2.26.0 in /home/zuul/venv/lib/python3.11/site-packages (from docker) (2.34.2)", "Requirement already satisfied: urllib3>=1.26.0 in /home/zuul/venv/lib/python3.11/site-packages (from docker) (2.7.0)", "Requirement already satisfied: charset_normalizer<4,>=2 in /home/zuul/venv/lib/python3.11/site-packages (from requests>=2.26.0->docker) (3.4.7)", "Requirement already satisfied: idna<4,>=2.5 in /home/zuul/venv/lib/python3.11/site-packages (from requests>=2.26.0->docker) (3.17)", "Requirement already satisfied: certifi>=2023.5.7 in /home/zuul/venv/lib/python3.11/site-packages (from requests>=2.26.0->docker) (2026.5.20)", "Installing collected packages: docker", "Successfully installed docker-7.1.0"], "version": null, "virtualenv": "/home/zuul/venv"} 2026-06-02 13:01:50.767765 | debian-bookworm | changed: [molecule-auditd] => (item=netaddr) => {"ansible_loop_var": "item", "changed": true, "cmd": ["/home/zuul/venv/bin/pip3", "install", "netaddr"], "item": "netaddr", "name": ["netaddr"], "requirements": null, "state": "present", "stderr": "", "stderr_lines": [], "stdout": "Collecting netaddr\n Downloading netaddr-1.3.0-py3-none-any.whl (2.3 MB)\n ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ 2.3/2.3 MB 14.0 MB/s eta 0:00:00\nInstalling collected packages: netaddr\nSuccessfully installed netaddr-1.3.0\n", "stdout_lines": ["Collecting netaddr", " Downloading netaddr-1.3.0-py3-none-any.whl (2.3 MB)", " ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ 2.3/2.3 MB 14.0 MB/s eta 0:00:00", "Installing collected packages: netaddr", "Successfully installed netaddr-1.3.0"], "version": null, "virtualenv": "/home/zuul/venv"} 2026-06-02 13:01:50.768226 | debian-bookworm | ok: [molecule-auditd] => (item=requests) => {"ansible_loop_var": "item", "changed": false, "cmd": ["/home/zuul/venv/bin/pip3", "install", "requests"], "item": "requests", "name": ["requests"], "requirements": null, "state": "present", "stderr": "", "stderr_lines": [], "stdout": "Requirement already satisfied: requests in /home/zuul/venv/lib/python3.11/site-packages (2.34.2)\nRequirement already satisfied: charset_normalizer<4,>=2 in /home/zuul/venv/lib/python3.11/site-packages (from requests) (3.4.7)\nRequirement already satisfied: idna<4,>=2.5 in /home/zuul/venv/lib/python3.11/site-packages (from requests) (3.17)\nRequirement already satisfied: urllib3<3,>=1.26 in /home/zuul/venv/lib/python3.11/site-packages (from requests) (2.7.0)\nRequirement already satisfied: certifi>=2023.5.7 in /home/zuul/venv/lib/python3.11/site-packages (from requests) (2026.5.20)\n", "stdout_lines": ["Requirement already satisfied: requests in /home/zuul/venv/lib/python3.11/site-packages (2.34.2)", "Requirement already satisfied: charset_normalizer<4,>=2 in /home/zuul/venv/lib/python3.11/site-packages (from requests) (3.4.7)", "Requirement already satisfied: idna<4,>=2.5 in /home/zuul/venv/lib/python3.11/site-packages (from requests) (3.17)", "Requirement already satisfied: urllib3<3,>=1.26 in /home/zuul/venv/lib/python3.11/site-packages (from requests) (2.7.0)", "Requirement already satisfied: certifi>=2023.5.7 in /home/zuul/venv/lib/python3.11/site-packages (from requests) (2026.5.20)"], "version": null, "virtualenv": "/home/zuul/venv"} 2026-06-02 13:01:50.768549 | debian-bookworm | 2026-06-02 13:01:50.768846 | debian-bookworm | TASK [Include required prepare tasks] ****************************************** 2026-06-02 13:01:50.786357 | debian-bookworm | included: /home/zuul/src/github.com/osism/ansible-collection-services/molecule/delegated/prepare/auditd.yml for molecule-auditd 2026-06-02 13:01:50.786627 | debian-bookworm | 2026-06-02 13:01:50.786985 | debian-bookworm | PLAY RECAP ********************************************************************* 2026-06-02 13:01:50.787298 | debian-bookworm | molecule-auditd : ok=3 changed=1 unreachable=0 failed=0 skipped=0 rescued=0 ignored=0 2026-06-02 13:01:50.787553 | debian-bookworm | 2026-06-02 13:01:50.861444 | debian-bookworm | INFO [delegated > prepare] Executed: Successful 2026-06-02 13:01:50.862193 | debian-bookworm | INFO Molecule executed 1 scenario (1 successful) 2026-06-02 13:01:51.209769 | debian-bookworm | ok: Runtime: 0:00:07.933003 2026-06-02 13:01:52.144196 | ubuntu-noble | changed: [molecule-auditd] => (item=docker) => {"ansible_loop_var": "item", "changed": true, "cmd": ["/home/zuul/venv/bin/pip3", "install", "docker"], "item": "docker", "name": ["docker"], "requirements": null, "state": "present", "stderr": "", "stderr_lines": [], "stdout": "Collecting docker\n Downloading docker-7.1.0-py3-none-any.whl.metadata (3.8 kB)\nRequirement already satisfied: requests>=2.26.0 in /home/zuul/venv/lib/python3.12/site-packages (from docker) (2.34.2)\nRequirement already satisfied: urllib3>=1.26.0 in /home/zuul/venv/lib/python3.12/site-packages (from docker) (2.7.0)\nRequirement already satisfied: charset_normalizer<4,>=2 in /home/zuul/venv/lib/python3.12/site-packages (from requests>=2.26.0->docker) (3.4.7)\nRequirement already satisfied: idna<4,>=2.5 in /home/zuul/venv/lib/python3.12/site-packages (from requests>=2.26.0->docker) (3.17)\nRequirement already satisfied: certifi>=2023.5.7 in /home/zuul/venv/lib/python3.12/site-packages (from requests>=2.26.0->docker) (2026.5.20)\nDownloading docker-7.1.0-py3-none-any.whl (147 kB)\n ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ 147.8/147.8 kB 4.0 MB/s eta 0:00:00\nInstalling collected packages: docker\nSuccessfully installed docker-7.1.0\n", "stdout_lines": ["Collecting docker", " Downloading docker-7.1.0-py3-none-any.whl.metadata (3.8 kB)", "Requirement already satisfied: requests>=2.26.0 in /home/zuul/venv/lib/python3.12/site-packages (from docker) (2.34.2)", "Requirement already satisfied: urllib3>=1.26.0 in /home/zuul/venv/lib/python3.12/site-packages (from docker) (2.7.0)", "Requirement already satisfied: charset_normalizer<4,>=2 in /home/zuul/venv/lib/python3.12/site-packages (from requests>=2.26.0->docker) (3.4.7)", "Requirement already satisfied: idna<4,>=2.5 in /home/zuul/venv/lib/python3.12/site-packages (from requests>=2.26.0->docker) (3.17)", "Requirement already satisfied: certifi>=2023.5.7 in /home/zuul/venv/lib/python3.12/site-packages (from requests>=2.26.0->docker) (2026.5.20)", "Downloading docker-7.1.0-py3-none-any.whl (147 kB)", " ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ 147.8/147.8 kB 4.0 MB/s eta 0:00:00", "Installing collected packages: docker", "Successfully installed docker-7.1.0"], "version": null, "virtualenv": "/home/zuul/venv"} 2026-06-02 13:01:52.145015 | ubuntu-noble | changed: [molecule-auditd] => (item=netaddr) => {"ansible_loop_var": "item", "changed": true, "cmd": ["/home/zuul/venv/bin/pip3", "install", "netaddr"], "item": "netaddr", "name": ["netaddr"], "requirements": null, "state": "present", "stderr": "", "stderr_lines": [], "stdout": "Collecting netaddr\n Downloading netaddr-1.3.0-py3-none-any.whl.metadata (5.0 kB)\nDownloading netaddr-1.3.0-py3-none-any.whl (2.3 MB)\n ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ 2.3/2.3 MB 14.4 MB/s eta 0:00:00\nInstalling collected packages: netaddr\nSuccessfully installed netaddr-1.3.0\n", "stdout_lines": ["Collecting netaddr", " Downloading netaddr-1.3.0-py3-none-any.whl.metadata (5.0 kB)", "Downloading netaddr-1.3.0-py3-none-any.whl (2.3 MB)", " ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ 2.3/2.3 MB 14.4 MB/s eta 0:00:00", "Installing collected packages: netaddr", "Successfully installed netaddr-1.3.0"], "version": null, "virtualenv": "/home/zuul/venv"} 2026-06-02 13:01:52.145048 | ubuntu-noble | ok: [molecule-auditd] => (item=requests) => {"ansible_loop_var": "item", "changed": false, "cmd": ["/home/zuul/venv/bin/pip3", "install", "requests"], "item": "requests", "name": ["requests"], "requirements": null, "state": "present", "stderr": "", "stderr_lines": [], "stdout": "Requirement already satisfied: requests in /home/zuul/venv/lib/python3.12/site-packages (2.34.2)\nRequirement already satisfied: charset_normalizer<4,>=2 in /home/zuul/venv/lib/python3.12/site-packages (from requests) (3.4.7)\nRequirement already satisfied: idna<4,>=2.5 in /home/zuul/venv/lib/python3.12/site-packages (from requests) (3.17)\nRequirement already satisfied: urllib3<3,>=1.26 in /home/zuul/venv/lib/python3.12/site-packages (from requests) (2.7.0)\nRequirement already satisfied: certifi>=2023.5.7 in /home/zuul/venv/lib/python3.12/site-packages (from requests) (2026.5.20)\n", "stdout_lines": ["Requirement already satisfied: requests in /home/zuul/venv/lib/python3.12/site-packages (2.34.2)", "Requirement already satisfied: charset_normalizer<4,>=2 in /home/zuul/venv/lib/python3.12/site-packages (from requests) (3.4.7)", "Requirement already satisfied: idna<4,>=2.5 in /home/zuul/venv/lib/python3.12/site-packages (from requests) (3.17)", "Requirement already satisfied: urllib3<3,>=1.26 in /home/zuul/venv/lib/python3.12/site-packages (from requests) (2.7.0)", "Requirement already satisfied: certifi>=2023.5.7 in /home/zuul/venv/lib/python3.12/site-packages (from requests) (2026.5.20)"], "version": null, "virtualenv": "/home/zuul/venv"} 2026-06-02 13:01:52.145055 | ubuntu-noble | 2026-06-02 13:01:52.145060 | ubuntu-noble | TASK [Include required prepare tasks] ****************************************** 2026-06-02 13:01:52.164919 | ubuntu-noble | included: /home/zuul/src/github.com/osism/ansible-collection-services/molecule/delegated/prepare/auditd.yml for molecule-auditd 2026-06-02 13:01:52.164951 | ubuntu-noble | 2026-06-02 13:01:52.164957 | ubuntu-noble | PLAY RECAP ********************************************************************* 2026-06-02 13:01:52.164962 | ubuntu-noble | molecule-auditd : ok=3 changed=1 unreachable=0 failed=0 skipped=0 rescued=0 ignored=0 2026-06-02 13:01:52.164966 | ubuntu-noble | 2026-06-02 13:01:52.328117 | ubuntu-noble | ok: Runtime: 0:00:09.240367 2026-06-02 13:01:52.334539 | 2026-06-02 13:01:52.334684 | TASK [ansible-molecule : Reset connection] 2026-06-02 13:01:52.365337 | 2026-06-02 13:01:52.365469 | TASK [ansible-molecule : Reset connection] 2026-06-02 13:01:52.391444 | 2026-06-02 13:01:52.391573 | TASK [ansible-molecule : Run molecule converge action with scenario delegated] 2026-06-02 13:01:52.249905 | ubuntu-noble | INFO [delegated > prepare] Executed: Successful 2026-06-02 13:01:52.249951 | ubuntu-noble | INFO Molecule executed 1 scenario (1 successful) 2026-06-02 13:01:53.343151 | ubuntu-noble | WARNING Molecule scenarios should migrate to 'extensions/molecule' 2026-06-02 13:01:53.352853 | ubuntu-noble | DEBUG [unknown > config] provisioner.env found in /home/zuul/src/github.com/osism/ansible-collection-services/molecule/delegated/molecule.yml, this can be defined in ansible.env 2026-06-02 13:01:53.175480 | debian-bookworm | WARNING Molecule scenarios should migrate to 'extensions/molecule' 2026-06-02 13:01:53.184503 | debian-bookworm | DEBUG [unknown > config] provisioner.env found in /home/zuul/src/github.com/osism/ansible-collection-services/molecule/delegated/molecule.yml, this can be defined in ansible.env 2026-06-02 13:01:53.858509 | ubuntu-noble | DEBUG [unknown > config] provisioner.env found in /home/zuul/src/github.com/osism/ansible-collection-services/molecule/delegated/molecule.yml, this can be defined in ansible.env 2026-06-02 13:01:53.859233 | ubuntu-noble | DEBUG [delegated > validate] Validating schema /home/zuul/src/github.com/osism/ansible-collection-services/molecule/delegated/molecule.yml. 2026-06-02 13:01:53.880817 | ubuntu-noble | DEBUG [default > validate] Validating schema /home/zuul/src/github.com/osism/ansible-collection-services/molecule/default/molecule.yml. 2026-06-02 13:01:53.886516 | ubuntu-noble | INFO [delegated > discovery] scenario test matrix: dependency, create, prepare, converge 2026-06-02 13:01:53.886577 | ubuntu-noble | INFO [delegated > prerun] Performing prerun with role_name_check=0... 2026-06-02 13:01:53.592498 | debian-bookworm | DEBUG [unknown > config] provisioner.env found in /home/zuul/src/github.com/osism/ansible-collection-services/molecule/delegated/molecule.yml, this can be defined in ansible.env 2026-06-02 13:01:53.593089 | debian-bookworm | DEBUG [delegated > validate] Validating schema /home/zuul/src/github.com/osism/ansible-collection-services/molecule/delegated/molecule.yml. 2026-06-02 13:01:53.611870 | debian-bookworm | DEBUG [default > validate] Validating schema /home/zuul/src/github.com/osism/ansible-collection-services/molecule/default/molecule.yml. 2026-06-02 13:01:53.617181 | debian-bookworm | INFO [delegated > discovery] scenario test matrix: dependency, create, prepare, converge 2026-06-02 13:01:53.617277 | debian-bookworm | INFO [delegated > prerun] Performing prerun with role_name_check=0... 2026-06-02 13:01:54.712042 | debian-bookworm | INFO [delegated > dependency] Executing 2026-06-02 13:01:54.712414 | debian-bookworm | WARNING [delegated > dependency] Missing roles requirements file: requirements.yml 2026-06-02 13:01:55.215096 | ubuntu-noble | INFO [delegated > dependency] Executing 2026-06-02 13:01:55.215559 | ubuntu-noble | WARNING [delegated > dependency] Missing roles requirements file: requirements.yml 2026-06-02 13:01:55.057235 | debian-bookworm | ansible-galaxy [core 2.18.17] 2026-06-02 13:01:55.057701 | debian-bookworm | config file = None 2026-06-02 13:01:55.058134 | debian-bookworm | configured module search path = ['/home/zuul/src/github.com/osism/ansible-collection-services/plugins/modules', '/home/zuul/.ansible/plugins/modules', '/usr/share/ansible/plugins/modules'] 2026-06-02 13:01:55.058564 | debian-bookworm | ansible python module location = /home/zuul/venv/lib/python3.11/site-packages/ansible 2026-06-02 13:01:55.058963 | debian-bookworm | ansible collection location = /home/zuul/.ansible/collections:/usr/share/ansible/collections:/home/zuul/venv/lib/python3.11/site-packages:/home/zuul/venv/lib/python3.11/dist-packages:/home/zuul/venv/lib/python3/dist-packages:/home/zuul/venv/local/lib/python3.11/dist-packages 2026-06-02 13:01:55.059292 | debian-bookworm | executable location = /home/zuul/venv/bin/ansible-galaxy 2026-06-02 13:01:55.059606 | debian-bookworm | python version = 3.11.2 (main, Apr 8 2026, 01:58:00) [GCC 12.2.0] (/home/zuul/venv/bin/python3) 2026-06-02 13:01:55.060025 | debian-bookworm | jinja version = 3.1.6 2026-06-02 13:01:55.060343 | debian-bookworm | libyaml = True 2026-06-02 13:01:55.060708 | debian-bookworm | No config file found; using defaults 2026-06-02 13:01:55.061190 | debian-bookworm | Reading requirement file at '/home/zuul/src/github.com/osism/ansible-collection-services/molecule/delegated/collections.yml' 2026-06-02 13:01:55.063417 | debian-bookworm | Loading collection osism.commons from /home/zuul/.ansible/collections/ansible_collections/osism/commons 2026-06-02 13:01:55.064780 | debian-bookworm | Found installed collection osism.commons:0.20260601.0 at '/home/zuul/.ansible/collections/ansible_collections/osism/commons' 2026-06-02 13:01:55.065985 | debian-bookworm | Loading collection osism.services from /home/zuul/.ansible/collections/ansible_collections/osism/services 2026-06-02 13:01:55.066410 | debian-bookworm | Found installed collection osism.services:999.0.0 at '/home/zuul/.ansible/collections/ansible_collections/osism/services' 2026-06-02 13:01:55.070993 | debian-bookworm | Loading collection dellemc.enterprise_sonic from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/dellemc/enterprise_sonic 2026-06-02 13:01:55.071450 | debian-bookworm | Found installed collection dellemc.enterprise_sonic:2.5.1 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/dellemc/enterprise_sonic' 2026-06-02 13:01:55.071886 | debian-bookworm | Loading collection community.proxysql from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/proxysql 2026-06-02 13:01:55.072729 | debian-bookworm | Found installed collection community.proxysql:1.7.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/proxysql' 2026-06-02 13:01:55.073180 | debian-bookworm | Loading collection kubernetes.core from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/kubernetes/core 2026-06-02 13:01:55.073735 | debian-bookworm | Found installed collection kubernetes.core:5.4.1 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/kubernetes/core' 2026-06-02 13:01:55.078431 | debian-bookworm | Loading collection community.aws from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/aws 2026-06-02 13:01:55.078795 | debian-bookworm | Found installed collection community.aws:9.3.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/aws' 2026-06-02 13:01:55.079173 | debian-bookworm | Loading collection cisco.asa from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/cisco/asa 2026-06-02 13:01:55.079510 | debian-bookworm | Found installed collection cisco.asa:6.1.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/cisco/asa' 2026-06-02 13:01:55.079846 | debian-bookworm | Loading collection community.dns from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/dns 2026-06-02 13:01:55.080223 | debian-bookworm | Found installed collection community.dns:3.4.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/dns' 2026-06-02 13:01:55.080475 | debian-bookworm | Loading collection community.sops from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/sops 2026-06-02 13:01:55.080811 | debian-bookworm | Found installed collection community.sops:2.2.7 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/sops' 2026-06-02 13:01:55.081429 | debian-bookworm | Loading collection community.hrobot from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/hrobot 2026-06-02 13:01:55.081808 | debian-bookworm | Found installed collection community.hrobot:2.7.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/hrobot' 2026-06-02 13:01:55.116080 | debian-bookworm | Loading collection community.network from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/network 2026-06-02 13:01:55.116447 | debian-bookworm | Found installed collection community.network:5.1.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/network' 2026-06-02 13:01:55.116800 | debian-bookworm | Loading collection wti.remote from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/wti/remote 2026-06-02 13:01:55.117159 | debian-bookworm | Found installed collection wti.remote:1.0.10 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/wti/remote' 2026-06-02 13:01:55.117758 | debian-bookworm | Loading collection cisco.iosxr from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/cisco/iosxr 2026-06-02 13:01:55.118154 | debian-bookworm | Found installed collection cisco.iosxr:10.3.1 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/cisco/iosxr' 2026-06-02 13:01:55.118490 | debian-bookworm | Loading collection cloud.common from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/cloud/common 2026-06-02 13:01:55.118749 | debian-bookworm | Found installed collection cloud.common:4.2.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/cloud/common' 2026-06-02 13:01:55.119110 | debian-bookworm | Loading collection community.library_inventory_filtering_v1 from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/library_inventory_filtering_v1 2026-06-02 13:01:55.119371 | debian-bookworm | Found installed collection community.library_inventory_filtering_v1:1.1.5 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/library_inventory_filtering_v1' 2026-06-02 13:01:55.119723 | debian-bookworm | Loading collection kaytus.ksmanage from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/kaytus/ksmanage 2026-06-02 13:01:55.120034 | debian-bookworm | Found installed collection kaytus.ksmanage:2.0.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/kaytus/ksmanage' 2026-06-02 13:01:55.124971 | debian-bookworm | Loading collection fortinet.fortimanager from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/fortinet/fortimanager 2026-06-02 13:01:55.125307 | debian-bookworm | Found installed collection fortinet.fortimanager:2.11.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/fortinet/fortimanager' 2026-06-02 13:01:55.125712 | debian-bookworm | Loading collection ieisystem.inmanage from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/ieisystem/inmanage 2026-06-02 13:01:55.126070 | debian-bookworm | Found installed collection ieisystem.inmanage:3.0.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/ieisystem/inmanage' 2026-06-02 13:01:55.126321 | debian-bookworm | Loading collection sensu.sensu_go from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/sensu/sensu_go 2026-06-02 13:01:55.126666 | debian-bookworm | Found installed collection sensu.sensu_go:1.14.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/sensu/sensu_go' 2026-06-02 13:01:55.126984 | debian-bookworm | Loading collection microsoft.ad from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/microsoft/ad 2026-06-02 13:01:55.127332 | debian-bookworm | Found installed collection microsoft.ad:1.9.2 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/microsoft/ad' 2026-06-02 13:01:55.127583 | debian-bookworm | Loading collection kubevirt.core from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/kubevirt/core 2026-06-02 13:01:55.127848 | debian-bookworm | Found installed collection kubevirt.core:2.2.3 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/kubevirt/core' 2026-06-02 13:01:55.128305 | debian-bookworm | Loading collection arista.eos from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/arista/eos 2026-06-02 13:01:55.128596 | debian-bookworm | Found installed collection arista.eos:10.1.1 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/arista/eos' 2026-06-02 13:01:55.128948 | debian-bookworm | Loading collection netapp.storagegrid from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/netapp/storagegrid 2026-06-02 13:01:55.129200 | debian-bookworm | Found installed collection netapp.storagegrid:21.14.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/netapp/storagegrid' 2026-06-02 13:01:55.129542 | debian-bookworm | Loading collection ibm.qradar from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/ibm/qradar 2026-06-02 13:01:55.129890 | debian-bookworm | Found installed collection ibm.qradar:4.0.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/ibm/qradar' 2026-06-02 13:01:55.130227 | debian-bookworm | Loading collection infinidat.infinibox from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/infinidat/infinibox 2026-06-02 13:01:55.130487 | debian-bookworm | Found installed collection infinidat.infinibox:1.6.3 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/infinidat/infinibox' 2026-06-02 13:01:55.130823 | debian-bookworm | Loading collection community.mongodb from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/mongodb 2026-06-02 13:01:55.131129 | debian-bookworm | Found installed collection community.mongodb:1.7.10 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/mongodb' 2026-06-02 13:01:55.131439 | debian-bookworm | Loading collection community.grafana from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/grafana 2026-06-02 13:01:55.131656 | debian-bookworm | Found installed collection community.grafana:2.3.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/grafana' 2026-06-02 13:01:55.131849 | debian-bookworm | Loading collection community.libvirt from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/libvirt 2026-06-02 13:01:55.132162 | debian-bookworm | Found installed collection community.libvirt:1.4.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/libvirt' 2026-06-02 13:01:55.134263 | debian-bookworm | Loading collection vmware.vmware_rest from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/vmware/vmware_rest 2026-06-02 13:01:55.134527 | debian-bookworm | Found installed collection vmware.vmware_rest:4.9.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/vmware/vmware_rest' 2026-06-02 13:01:55.134805 | debian-bookworm | Loading collection ansible.utils from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/ansible/utils 2026-06-02 13:01:55.135104 | debian-bookworm | Found installed collection ansible.utils:5.1.2 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/ansible/utils' 2026-06-02 13:01:55.135610 | debian-bookworm | Loading collection openstack.cloud from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/openstack/cloud 2026-06-02 13:01:55.135891 | debian-bookworm | Found installed collection openstack.cloud:2.5.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/openstack/cloud' 2026-06-02 13:01:55.136218 | debian-bookworm | Loading collection inspur.ispim from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/inspur/ispim 2026-06-02 13:01:55.136484 | debian-bookworm | Found installed collection inspur.ispim:2.2.3 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/inspur/ispim' 2026-06-02 13:01:55.136852 | debian-bookworm | Loading collection dellemc.powerflex from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/dellemc/powerflex 2026-06-02 13:01:55.137144 | debian-bookworm | Found installed collection dellemc.powerflex:2.6.1 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/dellemc/powerflex' 2026-06-02 13:01:55.137369 | debian-bookworm | Loading collection cyberark.conjur from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/cyberark/conjur 2026-06-02 13:01:55.137603 | debian-bookworm | Found installed collection cyberark.conjur:1.3.8 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/cyberark/conjur' 2026-06-02 13:01:55.137831 | debian-bookworm | Loading collection community.routeros from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/routeros 2026-06-02 13:01:55.138071 | debian-bookworm | Found installed collection community.routeros:3.13.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/routeros' 2026-06-02 13:01:55.138401 | debian-bookworm | Loading collection vultr.cloud from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/vultr/cloud 2026-06-02 13:01:55.138628 | debian-bookworm | Found installed collection vultr.cloud:1.13.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/vultr/cloud' 2026-06-02 13:01:55.139221 | debian-bookworm | Loading collection ngine_io.cloudstack from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/ngine_io/cloudstack 2026-06-02 13:01:55.139436 | debian-bookworm | Found installed collection ngine_io.cloudstack:2.5.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/ngine_io/cloudstack' 2026-06-02 13:01:55.141881 | debian-bookworm | Loading collection awx.awx from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/awx/awx 2026-06-02 13:01:55.142105 | debian-bookworm | Found installed collection awx.awx:24.6.1 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/awx/awx' 2026-06-02 13:01:55.143850 | debian-bookworm | Loading collection azure.azcollection from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/azure/azcollection 2026-06-02 13:01:55.144099 | debian-bookworm | Found installed collection azure.azcollection:3.10.1 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/azure/azcollection' 2026-06-02 13:01:55.144416 | debian-bookworm | Loading collection purestorage.flashblade from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/purestorage/flashblade 2026-06-02 13:01:55.144627 | debian-bookworm | Found installed collection purestorage.flashblade:1.22.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/purestorage/flashblade' 2026-06-02 13:01:55.144921 | debian-bookworm | Loading collection containers.podman from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/containers/podman 2026-06-02 13:01:55.145139 | debian-bookworm | Found installed collection containers.podman:1.18.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/containers/podman' 2026-06-02 13:01:55.145536 | debian-bookworm | Loading collection vmware.vmware from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/vmware/vmware 2026-06-02 13:01:55.145761 | debian-bookworm | Found installed collection vmware.vmware:1.11.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/vmware/vmware' 2026-06-02 13:01:55.146159 | debian-bookworm | Loading collection f5networks.f5_modules from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/f5networks/f5_modules 2026-06-02 13:01:55.146369 | debian-bookworm | Found installed collection f5networks.f5_modules:1.39.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/f5networks/f5_modules' 2026-06-02 13:01:55.147410 | debian-bookworm | Loading collection community.digitalocean from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/digitalocean 2026-06-02 13:01:55.147619 | debian-bookworm | Found installed collection community.digitalocean:1.27.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/digitalocean' 2026-06-02 13:01:55.156445 | debian-bookworm | Loading collection community.general from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/general 2026-06-02 13:01:55.156656 | debian-bookworm | Found installed collection community.general:10.7.6 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/general' 2026-06-02 13:01:55.158364 | debian-bookworm | Loading collection cisco.aci from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/cisco/aci 2026-06-02 13:01:55.158573 | debian-bookworm | Found installed collection cisco.aci:2.12.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/cisco/aci' 2026-06-02 13:01:55.158783 | debian-bookworm | Loading collection cisco.ucs from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/cisco/ucs 2026-06-02 13:01:55.159009 | debian-bookworm | Found installed collection cisco.ucs:1.16.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/cisco/ucs' 2026-06-02 13:01:55.160031 | debian-bookworm | Loading collection ansible.netcommon from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/ansible/netcommon 2026-06-02 13:01:55.160258 | debian-bookworm | Found installed collection ansible.netcommon:7.2.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/ansible/netcommon' 2026-06-02 13:01:55.160570 | debian-bookworm | Loading collection netapp.cloudmanager from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/netapp/cloudmanager 2026-06-02 13:01:55.160789 | debian-bookworm | Found installed collection netapp.cloudmanager:21.24.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/netapp/cloudmanager' 2026-06-02 13:01:55.161768 | debian-bookworm | Loading collection netapp.ontap from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/netapp/ontap 2026-06-02 13:01:55.162030 | debian-bookworm | Found installed collection netapp.ontap:22.14.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/netapp/ontap' 2026-06-02 13:01:55.162245 | debian-bookworm | Loading collection ibm.spectrum_virtualize from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/ibm/spectrum_virtualize 2026-06-02 13:01:55.162455 | debian-bookworm | Found installed collection ibm.spectrum_virtualize:2.0.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/ibm/spectrum_virtualize' 2026-06-02 13:01:55.163091 | debian-bookworm | Loading collection netbox.netbox from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/netbox/netbox 2026-06-02 13:01:55.163298 | debian-bookworm | Found installed collection netbox.netbox:3.21.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/netbox/netbox' 2026-06-02 13:01:55.163686 | debian-bookworm | Loading collection community.postgresql from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/postgresql 2026-06-02 13:01:55.163914 | debian-bookworm | Found installed collection community.postgresql:3.14.2 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/postgresql' 2026-06-02 13:01:55.164786 | debian-bookworm | Loading collection lowlydba.sqlserver from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/lowlydba/sqlserver 2026-06-02 13:01:55.165364 | debian-bookworm | Found installed collection lowlydba.sqlserver:2.7.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/lowlydba/sqlserver' 2026-06-02 13:01:55.165671 | debian-bookworm | Loading collection ansible.posix from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/ansible/posix 2026-06-02 13:01:55.166021 | debian-bookworm | Found installed collection ansible.posix:1.6.2 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/ansible/posix' 2026-06-02 13:01:55.166405 | debian-bookworm | Loading collection netapp_eseries.santricity from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/netapp_eseries/santricity 2026-06-02 13:01:55.166777 | debian-bookworm | Found installed collection netapp_eseries.santricity:1.4.1 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/netapp_eseries/santricity' 2026-06-02 13:01:55.167281 | debian-bookworm | Loading collection theforeman.foreman from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/theforeman/foreman 2026-06-02 13:01:55.167683 | debian-bookworm | Found installed collection theforeman.foreman:4.2.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/theforeman/foreman' 2026-06-02 13:01:55.168195 | debian-bookworm | Loading collection ovirt.ovirt from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/ovirt/ovirt 2026-06-02 13:01:55.168582 | debian-bookworm | Found installed collection ovirt.ovirt:3.2.1 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/ovirt/ovirt' 2026-06-02 13:01:55.169007 | debian-bookworm | Loading collection dellemc.unity from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/dellemc/unity 2026-06-02 13:01:55.169389 | debian-bookworm | Found installed collection dellemc.unity:2.1.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/dellemc/unity' 2026-06-02 13:01:55.169681 | debian-bookworm | Loading collection purestorage.flasharray from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/purestorage/flasharray 2026-06-02 13:01:55.170085 | debian-bookworm | Found installed collection purestorage.flasharray:1.39.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/purestorage/flasharray' 2026-06-02 13:01:55.171036 | debian-bookworm | Loading collection cisco.mso from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/cisco/mso 2026-06-02 13:01:55.171410 | debian-bookworm | Found installed collection cisco.mso:2.11.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/cisco/mso' 2026-06-02 13:01:55.171794 | debian-bookworm | Loading collection community.rabbitmq from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/rabbitmq 2026-06-02 13:01:55.172148 | debian-bookworm | Found installed collection community.rabbitmq:1.6.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/rabbitmq' 2026-06-02 13:01:55.172534 | debian-bookworm | Loading collection cisco.dnac from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/cisco/dnac 2026-06-02 13:01:55.172817 | debian-bookworm | Found installed collection cisco.dnac:6.31.3 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/cisco/dnac' 2026-06-02 13:01:55.173119 | debian-bookworm | Loading collection community.mysql from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/mysql 2026-06-02 13:01:55.173503 | debian-bookworm | Found installed collection community.mysql:3.16.1 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/mysql' 2026-06-02 13:01:55.173790 | debian-bookworm | Loading collection ibm.storage_virtualize from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/ibm/storage_virtualize 2026-06-02 13:01:55.174119 | debian-bookworm | Found installed collection ibm.storage_virtualize:2.7.4 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/ibm/storage_virtualize' 2026-06-02 13:01:55.174402 | debian-bookworm | Loading collection cyberark.pas from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/cyberark/pas 2026-06-02 13:01:55.174764 | debian-bookworm | Found installed collection cyberark.pas:1.0.36 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/cyberark/pas' 2026-06-02 13:01:55.175068 | debian-bookworm | Loading collection hitachivantara.vspone_object from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/hitachivantara/vspone_object 2026-06-02 13:01:55.175355 | debian-bookworm | Found installed collection hitachivantara.vspone_object:1.0.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/hitachivantara/vspone_object' 2026-06-02 13:01:55.175635 | debian-bookworm | Loading collection community.proxmox from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/proxmox 2026-06-02 13:01:55.175934 | debian-bookworm | Found installed collection community.proxmox:1.4.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/proxmox' 2026-06-02 13:01:55.176350 | debian-bookworm | Loading collection ravendb.ravendb from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/ravendb/ravendb 2026-06-02 13:01:55.176640 | debian-bookworm | Found installed collection ravendb.ravendb:1.0.4 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/ravendb/ravendb' 2026-06-02 13:01:55.176942 | debian-bookworm | Loading collection check_point.mgmt from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/check_point/mgmt 2026-06-02 13:01:55.177334 | debian-bookworm | Found installed collection check_point.mgmt:6.6.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/check_point/mgmt' 2026-06-02 13:01:55.177629 | debian-bookworm | Loading collection telekom_mms.icinga_director from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/telekom_mms/icinga_director 2026-06-02 13:01:55.178081 | debian-bookworm | Found installed collection telekom_mms.icinga_director:2.4.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/telekom_mms/icinga_director' 2026-06-02 13:01:55.178348 | debian-bookworm | Loading collection hitachivantara.vspone_block from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/hitachivantara/vspone_block 2026-06-02 13:01:55.178618 | debian-bookworm | Found installed collection hitachivantara.vspone_block:3.5.1 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/hitachivantara/vspone_block' 2026-06-02 13:01:55.178865 | debian-bookworm | Loading collection community.hashi_vault from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/hashi_vault 2026-06-02 13:01:55.179132 | debian-bookworm | Found installed collection community.hashi_vault:6.2.1 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/hashi_vault' 2026-06-02 13:01:55.179377 | debian-bookworm | Loading collection community.ciscosmb from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/ciscosmb 2026-06-02 13:01:55.179626 | debian-bookworm | Found installed collection community.ciscosmb:1.0.11 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/ciscosmb' 2026-06-02 13:01:55.180086 | debian-bookworm | Loading collection cloudscale_ch.cloud from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/cloudscale_ch/cloud 2026-06-02 13:01:55.180344 | debian-bookworm | Found installed collection cloudscale_ch.cloud:2.5.2 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/cloudscale_ch/cloud' 2026-06-02 13:01:55.180679 | debian-bookworm | Loading collection junipernetworks.junos from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/junipernetworks/junos 2026-06-02 13:01:55.180984 | debian-bookworm | Found installed collection junipernetworks.junos:9.1.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/junipernetworks/junos' 2026-06-02 13:01:55.181240 | debian-bookworm | Loading collection grafana.grafana from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/grafana/grafana 2026-06-02 13:01:55.181560 | debian-bookworm | Found installed collection grafana.grafana:5.7.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/grafana/grafana' 2026-06-02 13:01:55.181831 | debian-bookworm | Loading collection vyos.vyos from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/vyos/vyos 2026-06-02 13:01:55.182129 | debian-bookworm | Found installed collection vyos.vyos:5.0.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/vyos/vyos' 2026-06-02 13:01:55.185220 | debian-bookworm | Loading collection fortinet.fortios from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/fortinet/fortios 2026-06-02 13:01:55.185490 | debian-bookworm | Found installed collection fortinet.fortios:2.4.2 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/fortinet/fortios' 2026-06-02 13:01:55.185761 | debian-bookworm | Loading collection cisco.intersight from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/cisco/intersight 2026-06-02 13:01:55.186071 | debian-bookworm | Found installed collection cisco.intersight:2.7.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/cisco/intersight' 2026-06-02 13:01:55.186355 | debian-bookworm | Loading collection community.zabbix from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/zabbix 2026-06-02 13:01:55.186614 | debian-bookworm | Found installed collection community.zabbix:3.3.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/zabbix' 2026-06-02 13:01:55.188440 | debian-bookworm | Loading collection cisco.nxos from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/cisco/nxos 2026-06-02 13:01:55.188780 | debian-bookworm | Found installed collection cisco.nxos:9.4.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/cisco/nxos' 2026-06-02 13:01:55.189103 | debian-bookworm | Loading collection cisco.ise from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/cisco/ise 2026-06-02 13:01:55.189341 | debian-bookworm | Found installed collection cisco.ise:2.10.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/cisco/ise' 2026-06-02 13:01:55.189745 | debian-bookworm | Loading collection dellemc.openmanage from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/dellemc/openmanage 2026-06-02 13:01:55.190091 | debian-bookworm | Found installed collection dellemc.openmanage:9.12.3 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/dellemc/openmanage' 2026-06-02 13:01:55.190418 | debian-bookworm | Loading collection community.sap_libs from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/sap_libs 2026-06-02 13:01:55.190724 | debian-bookworm | Found installed collection community.sap_libs:1.5.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/sap_libs' 2026-06-02 13:01:55.192244 | debian-bookworm | Loading collection cisco.meraki from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/cisco/meraki 2026-06-02 13:01:55.192479 | debian-bookworm | Found installed collection cisco.meraki:2.21.8 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/cisco/meraki' 2026-06-02 13:01:55.192907 | debian-bookworm | Loading collection community.docker from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/docker 2026-06-02 13:01:55.193163 | debian-bookworm | Found installed collection community.docker:4.8.2 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/docker' 2026-06-02 13:01:55.194415 | debian-bookworm | Loading collection amazon.aws from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/amazon/aws 2026-06-02 13:01:55.194647 | debian-bookworm | Found installed collection amazon.aws:9.5.2 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/amazon/aws' 2026-06-02 13:01:55.195066 | debian-bookworm | Loading collection community.windows from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/windows 2026-06-02 13:01:55.195299 | debian-bookworm | Found installed collection community.windows:2.4.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/windows' 2026-06-02 13:01:55.195527 | debian-bookworm | Loading collection microsoft.iis from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/microsoft/iis 2026-06-02 13:01:55.195751 | debian-bookworm | Found installed collection microsoft.iis:1.0.3 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/microsoft/iis' 2026-06-02 13:01:55.196206 | debian-bookworm | Loading collection community.crypto from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/crypto 2026-06-02 13:01:55.196437 | debian-bookworm | Found installed collection community.crypto:2.26.6 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/crypto' 2026-06-02 13:01:55.196795 | debian-bookworm | Loading collection community.okd from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/okd 2026-06-02 13:01:55.197048 | debian-bookworm | Found installed collection community.okd:4.0.2 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/okd' 2026-06-02 13:01:55.197281 | debian-bookworm | Loading collection infoblox.nios_modules from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/infoblox/nios_modules 2026-06-02 13:01:55.197510 | debian-bookworm | Found installed collection infoblox.nios_modules:1.8.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/infoblox/nios_modules' 2026-06-02 13:01:55.198457 | debian-bookworm | Loading collection google.cloud from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/google/cloud 2026-06-02 13:01:55.198696 | debian-bookworm | Found installed collection google.cloud:1.9.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/google/cloud' 2026-06-02 13:01:55.200427 | debian-bookworm | Loading collection community.vmware from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/vmware 2026-06-02 13:01:55.200654 | debian-bookworm | Found installed collection community.vmware:5.10.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/vmware' 2026-06-02 13:01:55.201083 | debian-bookworm | Loading collection ansible.windows from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/ansible/windows 2026-06-02 13:01:55.201330 | debian-bookworm | Found installed collection ansible.windows:2.8.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/ansible/windows' 2026-06-02 13:01:55.202223 | debian-bookworm | Loading collection hetzner.hcloud from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/hetzner/hcloud 2026-06-02 13:01:55.202446 | debian-bookworm | Found installed collection hetzner.hcloud:4.3.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/hetzner/hcloud' 2026-06-02 13:01:55.203213 | debian-bookworm | Loading collection cisco.ios from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/cisco/ios 2026-06-02 13:01:55.203438 | debian-bookworm | Found installed collection cisco.ios:9.2.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/cisco/ios' 2026-06-02 13:01:55.203670 | debian-bookworm | Loading collection chocolatey.chocolatey from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/chocolatey/chocolatey 2026-06-02 13:01:55.203985 | debian-bookworm | Found installed collection chocolatey.chocolatey:1.5.3 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/chocolatey/chocolatey' 2026-06-02 13:01:55.204654 | debian-bookworm | Loading collection splunk.es from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/splunk/es 2026-06-02 13:01:55.204883 | debian-bookworm | Found installed collection splunk.es:4.0.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/splunk/es' 2026-06-02 13:01:55.205406 | debian-bookworm | Starting galaxy collection install process 2026-06-02 13:01:55.205586 | debian-bookworm | Nothing to do. All requested collections are already installed. If you want to reinstall them, consider using `--force`. 2026-06-02 13:01:55.256475 | debian-bookworm | INFO [delegated > dependency] Dependency completed successfully. 2026-06-02 13:01:55.256676 | debian-bookworm | WARNING [delegated > dependency] Executed: Missing roles requirements file: requirements.yml (Remove from converge_sequence to suppress) 2026-06-02 13:01:55.270725 | debian-bookworm | INFO [delegated > create] Executing 2026-06-02 13:01:55.273056 | debian-bookworm | WARNING [delegated > create] Executed: Missing playbook (Remove from converge_sequence to suppress) 2026-06-02 13:01:55.281280 | debian-bookworm | INFO [delegated > prepare] Executing 2026-06-02 13:01:55.281361 | debian-bookworm | WARNING [delegated > prepare] Skipping, instances already prepared. 2026-06-02 13:01:55.281449 | debian-bookworm | INFO [delegated > prepare] Executed: Successful 2026-06-02 13:01:55.289546 | debian-bookworm | INFO [delegated > converge] Executing 2026-06-02 13:01:55.612882 | ubuntu-noble | ansible-galaxy [core 2.18.17] 2026-06-02 13:01:55.612925 | ubuntu-noble | config file = None 2026-06-02 13:01:55.612934 | ubuntu-noble | configured module search path = ['/home/zuul/src/github.com/osism/ansible-collection-services/plugins/modules', '/home/zuul/.ansible/plugins/modules', '/usr/share/ansible/plugins/modules'] 2026-06-02 13:01:55.612943 | ubuntu-noble | ansible python module location = /home/zuul/venv/lib/python3.12/site-packages/ansible 2026-06-02 13:01:55.613246 | ubuntu-noble | ansible collection location = /home/zuul/.ansible/collections:/usr/share/ansible/collections:/home/zuul/venv/lib/python3.12/site-packages:/home/zuul/venv/lib/python3.12/dist-packages:/home/zuul/venv/lib/python3/dist-packages:/home/zuul/venv/local/lib/python3.12/dist-packages 2026-06-02 13:01:55.613540 | ubuntu-noble | executable location = /home/zuul/venv/bin/ansible-galaxy 2026-06-02 13:01:55.613952 | ubuntu-noble | python version = 3.12.3 (main, Mar 23 2026, 19:04:32) [GCC 13.3.0] (/home/zuul/venv/bin/python3) 2026-06-02 13:01:55.614249 | ubuntu-noble | jinja version = 3.1.6 2026-06-02 13:01:55.614535 | ubuntu-noble | libyaml = True 2026-06-02 13:01:55.614873 | ubuntu-noble | No config file found; using defaults 2026-06-02 13:01:55.615470 | ubuntu-noble | Reading requirement file at '/home/zuul/src/github.com/osism/ansible-collection-services/molecule/delegated/collections.yml' 2026-06-02 13:01:55.624807 | ubuntu-noble | Loading collection community.routeros from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/routeros 2026-06-02 13:01:55.625246 | ubuntu-noble | Found installed collection community.routeros:3.13.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/routeros' 2026-06-02 13:01:55.626052 | ubuntu-noble | Loading collection ibm.qradar from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/ibm/qradar 2026-06-02 13:01:55.626446 | ubuntu-noble | Found installed collection ibm.qradar:4.0.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/ibm/qradar' 2026-06-02 13:01:55.628477 | ubuntu-noble | Loading collection theforeman.foreman from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/theforeman/foreman 2026-06-02 13:01:55.628915 | ubuntu-noble | Found installed collection theforeman.foreman:4.2.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/theforeman/foreman' 2026-06-02 13:01:55.629305 | ubuntu-noble | Loading collection kaytus.ksmanage from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/kaytus/ksmanage 2026-06-02 13:01:55.629732 | ubuntu-noble | Found installed collection kaytus.ksmanage:2.0.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/kaytus/ksmanage' 2026-06-02 13:01:55.630115 | ubuntu-noble | Loading collection community.docker from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/docker 2026-06-02 13:01:55.630504 | ubuntu-noble | Found installed collection community.docker:4.8.2 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/docker' 2026-06-02 13:01:55.630966 | ubuntu-noble | Loading collection community.mysql from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/mysql 2026-06-02 13:01:55.631266 | ubuntu-noble | Found installed collection community.mysql:3.16.1 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/mysql' 2026-06-02 13:01:55.631654 | ubuntu-noble | Loading collection splunk.es from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/splunk/es 2026-06-02 13:01:55.632087 | ubuntu-noble | Found installed collection splunk.es:4.0.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/splunk/es' 2026-06-02 13:01:55.632464 | ubuntu-noble | Loading collection ansible.windows from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/ansible/windows 2026-06-02 13:01:55.632929 | ubuntu-noble | Found installed collection ansible.windows:2.8.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/ansible/windows' 2026-06-02 13:01:55.633317 | ubuntu-noble | Loading collection community.mongodb from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/mongodb 2026-06-02 13:01:55.633717 | ubuntu-noble | Found installed collection community.mongodb:1.7.10 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/mongodb' 2026-06-02 13:01:55.634758 | ubuntu-noble | Loading collection community.digitalocean from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/digitalocean 2026-06-02 13:01:55.635176 | ubuntu-noble | Found installed collection community.digitalocean:1.27.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/digitalocean' 2026-06-02 13:01:55.638072 | ubuntu-noble | Loading collection vmware.vmware_rest from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/vmware/vmware_rest 2026-06-02 13:01:55.638430 | ubuntu-noble | Found installed collection vmware.vmware_rest:4.9.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/vmware/vmware_rest' 2026-06-02 13:01:55.638798 | ubuntu-noble | Loading collection sensu.sensu_go from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/sensu/sensu_go 2026-06-02 13:01:55.639157 | ubuntu-noble | Found installed collection sensu.sensu_go:1.14.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/sensu/sensu_go' 2026-06-02 13:01:55.639821 | ubuntu-noble | Loading collection openstack.cloud from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/openstack/cloud 2026-06-02 13:01:55.640230 | ubuntu-noble | Found installed collection openstack.cloud:2.5.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/openstack/cloud' 2026-06-02 13:01:55.662793 | ubuntu-noble | Loading collection cisco.nxos from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/cisco/nxos 2026-06-02 13:01:55.663863 | ubuntu-noble | Found installed collection cisco.nxos:9.4.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/cisco/nxos' 2026-06-02 13:01:55.664129 | ubuntu-noble | Loading collection hetzner.hcloud from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/hetzner/hcloud 2026-06-02 13:01:55.664508 | ubuntu-noble | Found installed collection hetzner.hcloud:4.3.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/hetzner/hcloud' 2026-06-02 13:01:55.665559 | ubuntu-noble | Loading collection dellemc.unity from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/dellemc/unity 2026-06-02 13:01:55.666002 | ubuntu-noble | Found installed collection dellemc.unity:2.1.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/dellemc/unity' 2026-06-02 13:01:55.666285 | ubuntu-noble | Loading collection lowlydba.sqlserver from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/lowlydba/sqlserver 2026-06-02 13:01:55.666583 | ubuntu-noble | Found installed collection lowlydba.sqlserver:2.7.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/lowlydba/sqlserver' 2026-06-02 13:01:55.709176 | ubuntu-noble | Loading collection community.network from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/network 2026-06-02 13:01:55.709952 | ubuntu-noble | Found installed collection community.network:5.1.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/network' 2026-06-02 13:01:55.710304 | ubuntu-noble | Loading collection community.rabbitmq from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/rabbitmq 2026-06-02 13:01:55.710777 | ubuntu-noble | Found installed collection community.rabbitmq:1.6.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/rabbitmq' 2026-06-02 13:01:55.711580 | ubuntu-noble | Loading collection ibm.storage_virtualize from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/ibm/storage_virtualize 2026-06-02 13:01:55.712254 | ubuntu-noble | Found installed collection ibm.storage_virtualize:2.7.4 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/ibm/storage_virtualize' 2026-06-02 13:01:55.713053 | ubuntu-noble | Loading collection dellemc.powerflex from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/dellemc/powerflex 2026-06-02 13:01:55.715870 | ubuntu-noble | Found installed collection dellemc.powerflex:2.6.1 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/dellemc/powerflex' 2026-06-02 13:01:55.715897 | ubuntu-noble | Loading collection community.library_inventory_filtering_v1 from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/library_inventory_filtering_v1 2026-06-02 13:01:55.715905 | ubuntu-noble | Found installed collection community.library_inventory_filtering_v1:1.1.5 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/library_inventory_filtering_v1' 2026-06-02 13:01:55.715912 | ubuntu-noble | Loading collection cisco.ise from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/cisco/ise 2026-06-02 13:01:55.715918 | ubuntu-noble | Found installed collection cisco.ise:2.10.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/cisco/ise' 2026-06-02 13:01:55.715925 | ubuntu-noble | Loading collection ngine_io.cloudstack from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/ngine_io/cloudstack 2026-06-02 13:01:55.715979 | ubuntu-noble | Found installed collection ngine_io.cloudstack:2.5.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/ngine_io/cloudstack' 2026-06-02 13:01:55.716309 | ubuntu-noble | Loading collection cisco.dnac from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/cisco/dnac 2026-06-02 13:01:55.716596 | ubuntu-noble | Found installed collection cisco.dnac:6.31.3 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/cisco/dnac' 2026-06-02 13:01:55.716959 | ubuntu-noble | Loading collection google.cloud from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/google/cloud 2026-06-02 13:01:55.717280 | ubuntu-noble | Found installed collection google.cloud:1.9.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/google/cloud' 2026-06-02 13:01:55.717664 | ubuntu-noble | Loading collection check_point.mgmt from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/check_point/mgmt 2026-06-02 13:01:55.718026 | ubuntu-noble | Found installed collection check_point.mgmt:6.6.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/check_point/mgmt' 2026-06-02 13:01:55.718382 | ubuntu-noble | Loading collection ravendb.ravendb from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/ravendb/ravendb 2026-06-02 13:01:55.718772 | ubuntu-noble | Found installed collection ravendb.ravendb:1.0.4 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/ravendb/ravendb' 2026-06-02 13:01:55.719098 | ubuntu-noble | Loading collection cisco.asa from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/cisco/asa 2026-06-02 13:01:55.719429 | ubuntu-noble | Found installed collection cisco.asa:6.1.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/cisco/asa' 2026-06-02 13:01:55.719647 | ubuntu-noble | Loading collection chocolatey.chocolatey from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/chocolatey/chocolatey 2026-06-02 13:01:55.719936 | ubuntu-noble | Found installed collection chocolatey.chocolatey:1.5.3 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/chocolatey/chocolatey' 2026-06-02 13:01:55.720128 | ubuntu-noble | Loading collection community.ciscosmb from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/ciscosmb 2026-06-02 13:01:55.720314 | ubuntu-noble | Found installed collection community.ciscosmb:1.0.11 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/ciscosmb' 2026-06-02 13:01:55.722960 | ubuntu-noble | Loading collection community.aws from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/aws 2026-06-02 13:01:55.723285 | ubuntu-noble | Found installed collection community.aws:9.3.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/aws' 2026-06-02 13:01:55.723639 | ubuntu-noble | Loading collection netapp_eseries.santricity from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/netapp_eseries/santricity 2026-06-02 13:01:55.723974 | ubuntu-noble | Found installed collection netapp_eseries.santricity:1.4.1 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/netapp_eseries/santricity' 2026-06-02 13:01:55.724439 | ubuntu-noble | Loading collection community.okd from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/okd 2026-06-02 13:01:55.724772 | ubuntu-noble | Found installed collection community.okd:4.0.2 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/okd' 2026-06-02 13:01:55.725276 | ubuntu-noble | Loading collection netapp.storagegrid from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/netapp/storagegrid 2026-06-02 13:01:55.725642 | ubuntu-noble | Found installed collection netapp.storagegrid:21.14.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/netapp/storagegrid' 2026-06-02 13:01:55.727200 | ubuntu-noble | Loading collection ansible.netcommon from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/ansible/netcommon 2026-06-02 13:01:55.727609 | ubuntu-noble | Found installed collection ansible.netcommon:7.2.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/ansible/netcommon' 2026-06-02 13:01:55.729037 | ubuntu-noble | Loading collection cisco.aci from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/cisco/aci 2026-06-02 13:01:55.729276 | ubuntu-noble | Found installed collection cisco.aci:2.12.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/cisco/aci' 2026-06-02 13:01:55.730145 | ubuntu-noble | Loading collection cloudscale_ch.cloud from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/cloudscale_ch/cloud 2026-06-02 13:01:55.730368 | ubuntu-noble | Found installed collection cloudscale_ch.cloud:2.5.2 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/cloudscale_ch/cloud' 2026-06-02 13:01:55.730627 | ubuntu-noble | Loading collection ansible.utils from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/ansible/utils 2026-06-02 13:01:55.731064 | ubuntu-noble | Found installed collection ansible.utils:5.1.2 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/ansible/utils' 2026-06-02 13:01:55.731867 | ubuntu-noble | Loading collection vyos.vyos from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/vyos/vyos 2026-06-02 13:01:55.732222 | ubuntu-noble | Found installed collection vyos.vyos:5.0.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/vyos/vyos' 2026-06-02 13:01:55.732641 | ubuntu-noble | Loading collection vmware.vmware from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/vmware/vmware 2026-06-02 13:01:55.733001 | ubuntu-noble | Found installed collection vmware.vmware:1.11.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/vmware/vmware' 2026-06-02 13:01:55.733337 | ubuntu-noble | Loading collection community.dns from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/dns 2026-06-02 13:01:55.733641 | ubuntu-noble | Found installed collection community.dns:3.4.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/dns' 2026-06-02 13:01:55.733987 | ubuntu-noble | Loading collection cyberark.conjur from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/cyberark/conjur 2026-06-02 13:01:55.734256 | ubuntu-noble | Found installed collection cyberark.conjur:1.3.8 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/cyberark/conjur' 2026-06-02 13:01:55.734452 | ubuntu-noble | Loading collection cyberark.pas from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/cyberark/pas 2026-06-02 13:01:55.734743 | ubuntu-noble | Found installed collection cyberark.pas:1.0.36 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/cyberark/pas' 2026-06-02 13:01:55.735100 | ubuntu-noble | Loading collection netapp.cloudmanager from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/netapp/cloudmanager 2026-06-02 13:01:55.735392 | ubuntu-noble | Found installed collection netapp.cloudmanager:21.24.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/netapp/cloudmanager' 2026-06-02 13:01:55.735667 | ubuntu-noble | Loading collection infoblox.nios_modules from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/infoblox/nios_modules 2026-06-02 13:01:55.735997 | ubuntu-noble | Found installed collection infoblox.nios_modules:1.8.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/infoblox/nios_modules' 2026-06-02 13:01:55.736655 | ubuntu-noble | Loading collection dellemc.openmanage from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/dellemc/openmanage 2026-06-02 13:01:55.737003 | ubuntu-noble | Found installed collection dellemc.openmanage:9.12.3 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/dellemc/openmanage' 2026-06-02 13:01:55.743037 | ubuntu-noble | Loading collection fortinet.fortimanager from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/fortinet/fortimanager 2026-06-02 13:01:55.743292 | ubuntu-noble | Found installed collection fortinet.fortimanager:2.11.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/fortinet/fortimanager' 2026-06-02 13:01:55.743716 | ubuntu-noble | Loading collection community.hrobot from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/hrobot 2026-06-02 13:01:55.744039 | ubuntu-noble | Found installed collection community.hrobot:2.7.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/hrobot' 2026-06-02 13:01:55.746565 | ubuntu-noble | Loading collection awx.awx from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/awx/awx 2026-06-02 13:01:55.746957 | ubuntu-noble | Found installed collection awx.awx:24.6.1 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/awx/awx' 2026-06-02 13:01:55.748393 | ubuntu-noble | Loading collection cisco.mso from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/cisco/mso 2026-06-02 13:01:55.748744 | ubuntu-noble | Found installed collection cisco.mso:2.11.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/cisco/mso' 2026-06-02 13:01:55.752484 | ubuntu-noble | Loading collection fortinet.fortios from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/fortinet/fortios 2026-06-02 13:01:55.752663 | ubuntu-noble | Found installed collection fortinet.fortios:2.4.2 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/fortinet/fortios' 2026-06-02 13:01:55.753054 | ubuntu-noble | Loading collection inspur.ispim from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/inspur/ispim 2026-06-02 13:01:55.753370 | ubuntu-noble | Found installed collection inspur.ispim:2.2.3 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/inspur/ispim' 2026-06-02 13:01:55.753663 | ubuntu-noble | Loading collection hitachivantara.vspone_object from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/hitachivantara/vspone_object 2026-06-02 13:01:55.754081 | ubuntu-noble | Found installed collection hitachivantara.vspone_object:1.0.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/hitachivantara/vspone_object' 2026-06-02 13:01:55.755219 | ubuntu-noble | Loading collection junipernetworks.junos from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/junipernetworks/junos 2026-06-02 13:01:55.755544 | ubuntu-noble | Found installed collection junipernetworks.junos:9.1.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/junipernetworks/junos' 2026-06-02 13:01:55.755916 | ubuntu-noble | Loading collection purestorage.flasharray from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/purestorage/flasharray 2026-06-02 13:01:55.756220 | ubuntu-noble | Found installed collection purestorage.flasharray:1.39.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/purestorage/flasharray' 2026-06-02 13:01:55.756403 | ubuntu-noble | Loading collection community.sops from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/sops 2026-06-02 13:01:55.756750 | ubuntu-noble | Found installed collection community.sops:2.2.7 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/sops' 2026-06-02 13:01:55.757153 | ubuntu-noble | Loading collection microsoft.ad from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/microsoft/ad 2026-06-02 13:01:55.757516 | ubuntu-noble | Found installed collection microsoft.ad:1.9.2 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/microsoft/ad' 2026-06-02 13:01:55.757882 | ubuntu-noble | Loading collection community.grafana from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/grafana 2026-06-02 13:01:55.758156 | ubuntu-noble | Found installed collection community.grafana:2.3.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/grafana' 2026-06-02 13:01:55.758398 | ubuntu-noble | Loading collection community.libvirt from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/libvirt 2026-06-02 13:01:55.758644 | ubuntu-noble | Found installed collection community.libvirt:1.4.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/libvirt' 2026-06-02 13:01:55.758872 | ubuntu-noble | Loading collection ibm.spectrum_virtualize from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/ibm/spectrum_virtualize 2026-06-02 13:01:55.759193 | ubuntu-noble | Found installed collection ibm.spectrum_virtualize:2.0.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/ibm/spectrum_virtualize' 2026-06-02 13:01:55.759907 | ubuntu-noble | Loading collection kubernetes.core from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/kubernetes/core 2026-06-02 13:01:55.760223 | ubuntu-noble | Found installed collection kubernetes.core:5.4.1 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/kubernetes/core' 2026-06-02 13:01:55.761200 | ubuntu-noble | Loading collection cisco.ios from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/cisco/ios 2026-06-02 13:01:55.761515 | ubuntu-noble | Found installed collection cisco.ios:9.2.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/cisco/ios' 2026-06-02 13:01:55.763518 | ubuntu-noble | Loading collection azure.azcollection from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/azure/azcollection 2026-06-02 13:01:55.764844 | ubuntu-noble | Found installed collection azure.azcollection:3.10.1 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/azure/azcollection' 2026-06-02 13:01:55.764878 | ubuntu-noble | Loading collection dellemc.enterprise_sonic from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/dellemc/enterprise_sonic 2026-06-02 13:01:55.764884 | ubuntu-noble | Found installed collection dellemc.enterprise_sonic:2.5.1 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/dellemc/enterprise_sonic' 2026-06-02 13:01:55.765144 | ubuntu-noble | Loading collection infinidat.infinibox from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/infinidat/infinibox 2026-06-02 13:01:55.765345 | ubuntu-noble | Found installed collection infinidat.infinibox:1.6.3 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/infinidat/infinibox' 2026-06-02 13:01:55.765597 | ubuntu-noble | Loading collection kubevirt.core from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/kubevirt/core 2026-06-02 13:01:55.765897 | ubuntu-noble | Found installed collection kubevirt.core:2.2.3 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/kubevirt/core' 2026-06-02 13:01:55.766865 | ubuntu-noble | Loading collection cisco.iosxr from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/cisco/iosxr 2026-06-02 13:01:55.766886 | ubuntu-noble | Found installed collection cisco.iosxr:10.3.1 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/cisco/iosxr' 2026-06-02 13:01:55.767229 | ubuntu-noble | Loading collection community.sap_libs from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/sap_libs 2026-06-02 13:01:55.767485 | ubuntu-noble | Found installed collection community.sap_libs:1.5.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/sap_libs' 2026-06-02 13:01:55.768185 | ubuntu-noble | Loading collection community.windows from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/windows 2026-06-02 13:01:55.768221 | ubuntu-noble | Found installed collection community.windows:2.4.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/windows' 2026-06-02 13:01:55.769589 | ubuntu-noble | Loading collection community.crypto from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/crypto 2026-06-02 13:01:55.769613 | ubuntu-noble | Found installed collection community.crypto:2.26.6 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/crypto' 2026-06-02 13:01:55.769627 | ubuntu-noble | Loading collection ieisystem.inmanage from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/ieisystem/inmanage 2026-06-02 13:01:55.769632 | ubuntu-noble | Found installed collection ieisystem.inmanage:3.0.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/ieisystem/inmanage' 2026-06-02 13:01:55.769636 | ubuntu-noble | Loading collection microsoft.iis from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/microsoft/iis 2026-06-02 13:01:55.769641 | ubuntu-noble | Found installed collection microsoft.iis:1.0.3 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/microsoft/iis' 2026-06-02 13:01:55.779996 | ubuntu-noble | Loading collection community.general from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/general 2026-06-02 13:01:55.780032 | ubuntu-noble | Found installed collection community.general:10.7.6 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/general' 2026-06-02 13:01:55.780040 | ubuntu-noble | Loading collection cloud.common from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/cloud/common 2026-06-02 13:01:55.780047 | ubuntu-noble | Found installed collection cloud.common:4.2.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/cloud/common' 2026-06-02 13:01:55.780976 | ubuntu-noble | Loading collection netbox.netbox from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/netbox/netbox 2026-06-02 13:01:55.780999 | ubuntu-noble | Found installed collection netbox.netbox:3.21.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/netbox/netbox' 2026-06-02 13:01:55.781773 | ubuntu-noble | Loading collection ovirt.ovirt from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/ovirt/ovirt 2026-06-02 13:01:55.781793 | ubuntu-noble | Found installed collection ovirt.ovirt:3.2.1 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/ovirt/ovirt' 2026-06-02 13:01:55.783365 | ubuntu-noble | Loading collection amazon.aws from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/amazon/aws 2026-06-02 13:01:55.783394 | ubuntu-noble | Found installed collection amazon.aws:9.5.2 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/amazon/aws' 2026-06-02 13:01:55.783708 | ubuntu-noble | Loading collection grafana.grafana from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/grafana/grafana 2026-06-02 13:01:55.784018 | ubuntu-noble | Found installed collection grafana.grafana:5.7.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/grafana/grafana' 2026-06-02 13:01:55.785787 | ubuntu-noble | Loading collection cisco.meraki from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/cisco/meraki 2026-06-02 13:01:55.786105 | ubuntu-noble | Found installed collection cisco.meraki:2.21.8 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/cisco/meraki' 2026-06-02 13:01:55.786344 | ubuntu-noble | Loading collection cisco.intersight from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/cisco/intersight 2026-06-02 13:01:55.786798 | ubuntu-noble | Found installed collection cisco.intersight:2.7.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/cisco/intersight' 2026-06-02 13:01:55.786810 | ubuntu-noble | Loading collection community.postgresql from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/postgresql 2026-06-02 13:01:55.787051 | ubuntu-noble | Found installed collection community.postgresql:3.14.2 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/postgresql' 2026-06-02 13:01:55.787326 | ubuntu-noble | Loading collection community.hashi_vault from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/hashi_vault 2026-06-02 13:01:55.787562 | ubuntu-noble | Found installed collection community.hashi_vault:6.2.1 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/hashi_vault' 2026-06-02 13:01:55.787885 | ubuntu-noble | Loading collection containers.podman from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/containers/podman 2026-06-02 13:01:55.788135 | ubuntu-noble | Found installed collection containers.podman:1.18.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/containers/podman' 2026-06-02 13:01:55.788356 | ubuntu-noble | Loading collection community.zabbix from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/zabbix 2026-06-02 13:01:55.788618 | ubuntu-noble | Found installed collection community.zabbix:3.3.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/zabbix' 2026-06-02 13:01:55.789172 | ubuntu-noble | Loading collection ansible.posix from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/ansible/posix 2026-06-02 13:01:55.789192 | ubuntu-noble | Found installed collection ansible.posix:1.6.2 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/ansible/posix' 2026-06-02 13:01:55.789741 | ubuntu-noble | Loading collection telekom_mms.icinga_director from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/telekom_mms/icinga_director 2026-06-02 13:01:55.789761 | ubuntu-noble | Found installed collection telekom_mms.icinga_director:2.4.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/telekom_mms/icinga_director' 2026-06-02 13:01:55.790738 | ubuntu-noble | Loading collection wti.remote from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/wti/remote 2026-06-02 13:01:55.790760 | ubuntu-noble | Found installed collection wti.remote:1.0.10 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/wti/remote' 2026-06-02 13:01:55.790765 | ubuntu-noble | Loading collection purestorage.flashblade from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/purestorage/flashblade 2026-06-02 13:01:55.790770 | ubuntu-noble | Found installed collection purestorage.flashblade:1.22.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/purestorage/flashblade' 2026-06-02 13:01:55.791758 | ubuntu-noble | Loading collection netapp.ontap from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/netapp/ontap 2026-06-02 13:01:55.792031 | ubuntu-noble | Found installed collection netapp.ontap:22.14.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/netapp/ontap' 2026-06-02 13:01:55.792506 | ubuntu-noble | Loading collection f5networks.f5_modules from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/f5networks/f5_modules 2026-06-02 13:01:55.792956 | ubuntu-noble | Found installed collection f5networks.f5_modules:1.39.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/f5networks/f5_modules' 2026-06-02 13:01:55.792973 | ubuntu-noble | Loading collection community.proxysql from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/proxysql 2026-06-02 13:01:55.793245 | ubuntu-noble | Found installed collection community.proxysql:1.7.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/proxysql' 2026-06-02 13:01:55.795439 | ubuntu-noble | Loading collection community.vmware from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/vmware 2026-06-02 13:01:55.795464 | ubuntu-noble | Found installed collection community.vmware:5.10.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/vmware' 2026-06-02 13:01:55.795470 | ubuntu-noble | Loading collection cisco.ucs from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/cisco/ucs 2026-06-02 13:01:55.795475 | ubuntu-noble | Found installed collection cisco.ucs:1.16.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/cisco/ucs' 2026-06-02 13:01:55.795895 | ubuntu-noble | Loading collection vultr.cloud from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/vultr/cloud 2026-06-02 13:01:55.796128 | ubuntu-noble | Found installed collection vultr.cloud:1.13.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/vultr/cloud' 2026-06-02 13:01:55.796955 | ubuntu-noble | Loading collection arista.eos from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/arista/eos 2026-06-02 13:01:55.797168 | ubuntu-noble | Found installed collection arista.eos:10.1.1 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/arista/eos' 2026-06-02 13:01:55.797650 | ubuntu-noble | Loading collection hitachivantara.vspone_block from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/hitachivantara/vspone_block 2026-06-02 13:01:55.797935 | ubuntu-noble | Found installed collection hitachivantara.vspone_block:3.5.1 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/hitachivantara/vspone_block' 2026-06-02 13:01:55.798260 | ubuntu-noble | Loading collection community.proxmox from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/proxmox 2026-06-02 13:01:55.798447 | ubuntu-noble | Found installed collection community.proxmox:1.4.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/proxmox' 2026-06-02 13:01:55.813379 | ubuntu-noble | Loading collection osism.services from /home/zuul/.ansible/collections/ansible_collections/osism/services 2026-06-02 13:01:55.813910 | ubuntu-noble | Found installed collection osism.services:999.0.0 at '/home/zuul/.ansible/collections/ansible_collections/osism/services' 2026-06-02 13:01:55.813925 | ubuntu-noble | Loading collection osism.commons from /home/zuul/.ansible/collections/ansible_collections/osism/commons 2026-06-02 13:01:55.813930 | ubuntu-noble | Found installed collection osism.commons:0.20260601.0 at '/home/zuul/.ansible/collections/ansible_collections/osism/commons' 2026-06-02 13:01:55.815105 | ubuntu-noble | Starting galaxy collection install process 2026-06-02 13:01:55.815133 | ubuntu-noble | Nothing to do. All requested collections are already installed. If you want to reinstall them, consider using `--force`. 2026-06-02 13:01:55.879586 | ubuntu-noble | INFO [delegated > dependency] Dependency completed successfully. 2026-06-02 13:01:55.881906 | ubuntu-noble | WARNING [delegated > dependency] Executed: Missing roles requirements file: requirements.yml (Remove from converge_sequence to suppress) 2026-06-02 13:01:55.898158 | ubuntu-noble | INFO [delegated > create] Executing 2026-06-02 13:01:55.900962 | ubuntu-noble | WARNING [delegated > create] Executed: Missing playbook (Remove from converge_sequence to suppress) 2026-06-02 13:01:55.910666 | ubuntu-noble | INFO [delegated > prepare] Executing 2026-06-02 13:01:55.910747 | ubuntu-noble | WARNING [delegated > prepare] Skipping, instances already prepared. 2026-06-02 13:01:55.910853 | ubuntu-noble | INFO [delegated > prepare] Executed: Successful 2026-06-02 13:01:55.918764 | ubuntu-noble | INFO [delegated > converge] Executing 2026-06-02 13:01:55.570970 | debian-bookworm | DEBUG [delegated > converge] ansible-playbook version: ansible-playbook 2026-06-02 13:01:55.571063 | debian-bookworm | config file = None 2026-06-02 13:01:55.571081 | debian-bookworm | configured module search path = 2026-06-02 13:01:55.571094 | debian-bookworm | ansible python module location = /home/zuul/venv/lib/python3.11/site-packages/ansible 2026-06-02 13:01:55.571107 | debian-bookworm | ansible collection location = /home/zuul/.ansible/collections:/usr/share/ansible/collections 2026-06-02 13:01:55.571118 | debian-bookworm | executable location = /home/zuul/venv/bin/ansible-playbook 2026-06-02 13:01:55.571129 | debian-bookworm | python version = 3.11.2 (main, Apr 8 2026, 01:58:00) (/home/zuul/venv/bin/python3) 2026-06-02 13:01:55.571141 | debian-bookworm | jinja version = 3.1.6 2026-06-02 13:01:55.571152 | debian-bookworm | libyaml = True 2026-06-02 13:01:55.571163 | debian-bookworm | DEBUG ANSIBLE ENVIRONMENT: 2026-06-02 13:01:55.571174 | debian-bookworm | ANSIBLE_COLLECTIONS_PATH: /home/zuul/venv/.ansible/collections:/home/zuul/.ansible/collections 2026-06-02 13:01:55.571185 | debian-bookworm | ANSIBLE_CONFIG: /home/zuul/.ansible/tmp/molecule.oWZD.delegated/ansible.cfg 2026-06-02 13:01:55.571196 | debian-bookworm | ANSIBLE_LIBRARY: ../../plugins 2026-06-02 13:01:55.571207 | debian-bookworm | ANSIBLE_PYTHON_INTERPRETER: /home/zuul/venv/bin/python 2026-06-02 13:01:55.571218 | debian-bookworm | ANSIBLE_ROLE: auditd 2026-06-02 13:01:55.571228 | debian-bookworm | ANSIBLE_ROLES_PATH: ../../roles 2026-06-02 13:01:55.571239 | debian-bookworm | ANSIBLE_VERBOSITY: 1 2026-06-02 13:01:55.571250 | debian-bookworm | 2026-06-02 13:01:55.571274 | debian-bookworm | DEBUG MOLECULE ENVIRONMENT: 2026-06-02 13:01:55.571286 | debian-bookworm | MOLECULE_DEBUG: True 2026-06-02 13:01:55.571297 | debian-bookworm | MOLECULE_DEPENDENCY_NAME: galaxy 2026-06-02 13:01:55.571332 | debian-bookworm | MOLECULE_DRIVER_NAME: default 2026-06-02 13:01:55.571344 | debian-bookworm | MOLECULE_ENV_FILE: /home/zuul/src/github.com/osism/ansible-collection-services/.env.yml 2026-06-02 13:01:55.571369 | debian-bookworm | MOLECULE_EPHEMERAL_DIRECTORY: /home/zuul/.ansible/tmp/molecule.oWZD.delegated 2026-06-02 13:01:55.571385 | debian-bookworm | MOLECULE_FILE: /home/zuul/.ansible/tmp/molecule.oWZD.delegated/molecule.yml 2026-06-02 13:01:55.571396 | debian-bookworm | MOLECULE_INSTANCE_CONFIG: /home/zuul/.ansible/tmp/molecule.oWZD.delegated/instance_config.yml 2026-06-02 13:01:55.571407 | debian-bookworm | MOLECULE_INVENTORY_FILE: /home/zuul/.ansible/tmp/molecule.oWZD.delegated/inventory/ansible_inventory.yml 2026-06-02 13:01:55.571419 | debian-bookworm | MOLECULE_PROJECT_DIRECTORY: /home/zuul/src/github.com/osism/ansible-collection-services 2026-06-02 13:01:55.571430 | debian-bookworm | MOLECULE_PROVISIONER_NAME: ansible 2026-06-02 13:01:55.571442 | debian-bookworm | MOLECULE_SCENARIO_DIRECTORY: /home/zuul/src/github.com/osism/ansible-collection-services/molecule/delegated 2026-06-02 13:01:55.571453 | debian-bookworm | MOLECULE_SCENARIO_NAME: delegated 2026-06-02 13:01:55.571463 | debian-bookworm | MOLECULE_STATE_FILE: /home/zuul/.ansible/tmp/molecule.oWZD.delegated/state.yml 2026-06-02 13:01:55.571474 | debian-bookworm | MOLECULE_VERIFIER_NAME: testinfra 2026-06-02 13:01:55.571486 | debian-bookworm | MOLECULE_VERIFIER_TEST_DIRECTORY: /home/zuul/src/github.com/osism/ansible-collection-services/molecule/delegated/tests 2026-06-02 13:01:55.571497 | debian-bookworm | 2026-06-02 13:01:55.571522 | debian-bookworm | DEBUG SHELL REPLAY: ANSIBLE_COLLECTIONS_PATH=/home/zuul/venv/.ansible/collections:/home/zuul/.ansible/collections ANSIBLE_CONFIG=/home/zuul/.ansible/tmp/molecule.oWZD.delegated/ansible.cfg ANSIBLE_LIBRARY=../../plugins ANSIBLE_PYTHON_INTERPRETER=/home/zuul/venv/bin/python ANSIBLE_ROLE=auditd ANSIBLE_ROLES_PATH=../../roles ANSIBLE_VERBOSITY=1 MOLECULE_DEBUG=True MOLECULE_DEPENDENCY_NAME=galaxy MOLECULE_DRIVER_NAME=default MOLECULE_ENV_FILE=/home/zuul/src/github.com/osism/ansible-collection-services/.env.yml MOLECULE_EPHEMERAL_DIRECTORY=/home/zuul/.ansible/tmp/molecule.oWZD.delegated MOLECULE_FILE=/home/zuul/.ansible/tmp/molecule.oWZD.delegated/molecule.yml MOLECULE_INSTANCE_CONFIG=/home/zuul/.ansible/tmp/molecule.oWZD.delegated/instance_config.yml MOLECULE_INVENTORY_FILE=/home/zuul/.ansible/tmp/molecule.oWZD.delegated/inventory/ansible_inventory.yml MOLECULE_PROJECT_DIRECTORY=/home/zuul/src/github.com/osism/ansible-collection-services MOLECULE_PROVISIONER_NAME=ansible MOLECULE_SCENARIO_DIRECTORY=/home/zuul/src/github.com/osism/ansible-collection-services/molecule/delegated MOLECULE_SCENARIO_NAME=delegated MOLECULE_STATE_FILE=/home/zuul/.ansible/tmp/molecule.oWZD.delegated/state.yml MOLECULE_VERIFIER_NAME=testinfra MOLECULE_VERIFIER_TEST_DIRECTORY=/home/zuul/src/github.com/osism/ansible-collection-services/molecule/delegated/tests 2026-06-02 13:01:55.826335 | debian-bookworm | Using /home/zuul/.ansible/tmp/molecule.oWZD.delegated/ansible.cfg as config file 2026-06-02 13:01:56.274526 | ubuntu-noble | DEBUG [delegated > converge] ansible-playbook version: ansible-playbook 2026-06-02 13:01:56.274578 | ubuntu-noble | config file = None 2026-06-02 13:01:56.274584 | ubuntu-noble | configured module search path = 2026-06-02 13:01:56.274588 | ubuntu-noble | ansible python module location = /home/zuul/venv/lib/python3.12/site-packages/ansible 2026-06-02 13:01:56.274593 | ubuntu-noble | ansible collection location = /home/zuul/.ansible/collections:/usr/share/ansible/collections 2026-06-02 13:01:56.274597 | ubuntu-noble | executable location = /home/zuul/venv/bin/ansible-playbook 2026-06-02 13:01:56.274601 | ubuntu-noble | python version = 3.12.3 (main, Mar 23 2026, 19:04:32) (/home/zuul/venv/bin/python3) 2026-06-02 13:01:56.274604 | ubuntu-noble | jinja version = 3.1.6 2026-06-02 13:01:56.274608 | ubuntu-noble | libyaml = True 2026-06-02 13:01:56.275022 | ubuntu-noble | DEBUG ANSIBLE ENVIRONMENT: 2026-06-02 13:01:56.275031 | ubuntu-noble | ANSIBLE_COLLECTIONS_PATH: /home/zuul/venv/.ansible/collections:/home/zuul/.ansible/collections 2026-06-02 13:01:56.275035 | ubuntu-noble | ANSIBLE_CONFIG: /home/zuul/.ansible/tmp/molecule.oWZD.delegated/ansible.cfg 2026-06-02 13:01:56.275038 | ubuntu-noble | ANSIBLE_LIBRARY: ../../plugins 2026-06-02 13:01:56.275042 | ubuntu-noble | ANSIBLE_PYTHON_INTERPRETER: /home/zuul/venv/bin/python 2026-06-02 13:01:56.275046 | ubuntu-noble | ANSIBLE_ROLE: auditd 2026-06-02 13:01:56.275058 | ubuntu-noble | ANSIBLE_ROLES_PATH: ../../roles 2026-06-02 13:01:56.275062 | ubuntu-noble | ANSIBLE_VERBOSITY: 1 2026-06-02 13:01:56.275068 | ubuntu-noble | 2026-06-02 13:01:56.275264 | ubuntu-noble | DEBUG MOLECULE ENVIRONMENT: 2026-06-02 13:01:56.275270 | ubuntu-noble | MOLECULE_DEBUG: True 2026-06-02 13:01:56.275273 | ubuntu-noble | MOLECULE_DEPENDENCY_NAME: galaxy 2026-06-02 13:01:56.275289 | ubuntu-noble | MOLECULE_DRIVER_NAME: default 2026-06-02 13:01:56.275293 | ubuntu-noble | MOLECULE_ENV_FILE: /home/zuul/src/github.com/osism/ansible-collection-services/.env.yml 2026-06-02 13:01:56.275296 | ubuntu-noble | MOLECULE_EPHEMERAL_DIRECTORY: /home/zuul/.ansible/tmp/molecule.oWZD.delegated 2026-06-02 13:01:56.275300 | ubuntu-noble | MOLECULE_FILE: /home/zuul/.ansible/tmp/molecule.oWZD.delegated/molecule.yml 2026-06-02 13:01:56.275304 | ubuntu-noble | MOLECULE_INSTANCE_CONFIG: /home/zuul/.ansible/tmp/molecule.oWZD.delegated/instance_config.yml 2026-06-02 13:01:56.275307 | ubuntu-noble | MOLECULE_INVENTORY_FILE: /home/zuul/.ansible/tmp/molecule.oWZD.delegated/inventory/ansible_inventory.yml 2026-06-02 13:01:56.275311 | ubuntu-noble | MOLECULE_PROJECT_DIRECTORY: /home/zuul/src/github.com/osism/ansible-collection-services 2026-06-02 13:01:56.275314 | ubuntu-noble | MOLECULE_PROVISIONER_NAME: ansible 2026-06-02 13:01:56.275318 | ubuntu-noble | MOLECULE_SCENARIO_DIRECTORY: /home/zuul/src/github.com/osism/ansible-collection-services/molecule/delegated 2026-06-02 13:01:56.275321 | ubuntu-noble | MOLECULE_SCENARIO_NAME: delegated 2026-06-02 13:01:56.275325 | ubuntu-noble | MOLECULE_STATE_FILE: /home/zuul/.ansible/tmp/molecule.oWZD.delegated/state.yml 2026-06-02 13:01:56.275328 | ubuntu-noble | MOLECULE_VERIFIER_NAME: testinfra 2026-06-02 13:01:56.275332 | ubuntu-noble | MOLECULE_VERIFIER_TEST_DIRECTORY: /home/zuul/src/github.com/osism/ansible-collection-services/molecule/delegated/tests 2026-06-02 13:01:56.275336 | ubuntu-noble | 2026-06-02 13:01:56.275588 | ubuntu-noble | DEBUG SHELL REPLAY: ANSIBLE_COLLECTIONS_PATH=/home/zuul/venv/.ansible/collections:/home/zuul/.ansible/collections ANSIBLE_CONFIG=/home/zuul/.ansible/tmp/molecule.oWZD.delegated/ansible.cfg ANSIBLE_LIBRARY=../../plugins ANSIBLE_PYTHON_INTERPRETER=/home/zuul/venv/bin/python ANSIBLE_ROLE=auditd ANSIBLE_ROLES_PATH=../../roles ANSIBLE_VERBOSITY=1 MOLECULE_DEBUG=True MOLECULE_DEPENDENCY_NAME=galaxy MOLECULE_DRIVER_NAME=default MOLECULE_ENV_FILE=/home/zuul/src/github.com/osism/ansible-collection-services/.env.yml MOLECULE_EPHEMERAL_DIRECTORY=/home/zuul/.ansible/tmp/molecule.oWZD.delegated MOLECULE_FILE=/home/zuul/.ansible/tmp/molecule.oWZD.delegated/molecule.yml MOLECULE_INSTANCE_CONFIG=/home/zuul/.ansible/tmp/molecule.oWZD.delegated/instance_config.yml MOLECULE_INVENTORY_FILE=/home/zuul/.ansible/tmp/molecule.oWZD.delegated/inventory/ansible_inventory.yml MOLECULE_PROJECT_DIRECTORY=/home/zuul/src/github.com/osism/ansible-collection-services MOLECULE_PROVISIONER_NAME=ansible MOLECULE_SCENARIO_DIRECTORY=/home/zuul/src/github.com/osism/ansible-collection-services/molecule/delegated MOLECULE_SCENARIO_NAME=delegated MOLECULE_STATE_FILE=/home/zuul/.ansible/tmp/molecule.oWZD.delegated/state.yml MOLECULE_VERIFIER_NAME=testinfra MOLECULE_VERIFIER_TEST_DIRECTORY=/home/zuul/src/github.com/osism/ansible-collection-services/molecule/delegated/tests 2026-06-02 13:01:56.030388 | debian-bookworm | 2026-06-02 13:01:56.030958 | debian-bookworm | PLAY [Converge] **************************************************************** 2026-06-02 13:01:56.031429 | debian-bookworm | 2026-06-02 13:01:56.031923 | debian-bookworm | TASK [Gathering Facts] ********************************************************* 2026-06-02 13:01:56.590886 | ubuntu-noble | Using /home/zuul/.ansible/tmp/molecule.oWZD.delegated/ansible.cfg as config file 2026-06-02 13:01:56.821958 | ubuntu-noble | 2026-06-02 13:01:56.822290 | ubuntu-noble | PLAY [Converge] **************************************************************** 2026-06-02 13:01:56.822558 | ubuntu-noble | 2026-06-02 13:01:56.822901 | ubuntu-noble | TASK [Gathering Facts] ********************************************************* 2026-06-02 13:01:58.051821 | debian-bookworm | ok: [molecule-auditd] 2026-06-02 13:01:58.051985 | debian-bookworm | 2026-06-02 13:01:58.052184 | debian-bookworm | TASK [Include required variables] ********************************************** 2026-06-02 13:01:58.083755 | debian-bookworm | ok: [molecule-auditd] => {"ansible_facts": {}, "ansible_included_var_files": ["/home/zuul/src/github.com/osism/ansible-collection-services/molecule/delegated/vars/auditd.yml"], "changed": false} 2026-06-02 13:01:58.083836 | debian-bookworm | 2026-06-02 13:01:58.083999 | debian-bookworm | TASK [Include role auditd] ***************************************************** 2026-06-02 13:01:58.124137 | debian-bookworm | included: auditd for molecule-auditd 2026-06-02 13:01:58.124289 | debian-bookworm | 2026-06-02 13:01:58.124469 | debian-bookworm | TASK [auditd : Include distribution specific install tasks] ******************** 2026-06-02 13:01:58.151657 | debian-bookworm | included: /home/zuul/src/github.com/osism/ansible-collection-services/roles/auditd/tasks/install-Debian-family.yml for molecule-auditd 2026-06-02 13:01:58.151781 | debian-bookworm | 2026-06-02 13:01:58.151945 | debian-bookworm | TASK [auditd : Install auditd package] ***************************************** 2026-06-02 13:01:59.043517 | ubuntu-noble | ok: [molecule-auditd] 2026-06-02 13:01:59.043607 | ubuntu-noble | 2026-06-02 13:01:59.043781 | ubuntu-noble | TASK [Include required variables] ********************************************** 2026-06-02 13:01:59.076509 | ubuntu-noble | ok: [molecule-auditd] => {"ansible_facts": {}, "ansible_included_var_files": ["/home/zuul/src/github.com/osism/ansible-collection-services/molecule/delegated/vars/auditd.yml"], "changed": false} 2026-06-02 13:01:59.076746 | ubuntu-noble | 2026-06-02 13:01:59.077036 | ubuntu-noble | TASK [Include role auditd] ***************************************************** 2026-06-02 13:01:59.140419 | ubuntu-noble | included: auditd for molecule-auditd 2026-06-02 13:01:59.140705 | ubuntu-noble | 2026-06-02 13:01:59.141123 | ubuntu-noble | TASK [auditd : Include distribution specific install tasks] ******************** 2026-06-02 13:01:59.175688 | ubuntu-noble | included: /home/zuul/src/github.com/osism/ansible-collection-services/roles/auditd/tasks/install-Debian-family.yml for molecule-auditd 2026-06-02 13:01:59.175976 | ubuntu-noble | 2026-06-02 13:01:59.176193 | ubuntu-noble | TASK [auditd : Install auditd package] ***************************************** 2026-06-02 13:02:01.874098 | debian-bookworm | The following additional packages will be installed: 2026-06-02 13:02:01.874206 | debian-bookworm | libauparse0 2026-06-02 13:02:01.874224 | debian-bookworm | Suggested packages: 2026-06-02 13:02:01.874233 | debian-bookworm | audispd-plugins 2026-06-02 13:02:01.874344 | debian-bookworm | The following NEW packages will be installed: 2026-06-02 13:02:01.874443 | debian-bookworm | auditd libauparse0 2026-06-02 13:02:01.874541 | debian-bookworm | 0 upgraded, 2 newly installed, 0 to remove and 0 not upgraded. 2026-06-02 13:02:01.875344 | debian-bookworm | changed: [molecule-auditd] => {"cache_update_time": 1780405220, "cache_updated": false, "changed": true, "stderr": "debconf: delaying package configuration, since apt-utils is not installed\n", "stderr_lines": ["debconf: delaying package configuration, since apt-utils is not installed"], "stdout": "Reading package lists...\nBuilding dependency tree...\nReading state information...\nThe following additional packages will be installed:\n libauparse0\nSuggested packages:\n audispd-plugins\nThe following NEW packages will be installed:\n auditd libauparse0\n0 upgraded, 2 newly installed, 0 to remove and 0 not upgraded.\nNeed to get 279 kB of archives.\nAfter this operation, 934 kB of additional disk space will be used.\nGet:1 http://deb.debian.org/debian bookworm/main amd64 libauparse0 amd64 1:3.0.9-1 [61.9 kB]\nGet:2 http://deb.debian.org/debian bookworm/main amd64 auditd amd64 1:3.0.9-1 [218 kB]\nFetched 279 kB in 0s (3857 kB/s)\nSelecting previously unselected package libauparse0:amd64.\r\n(Reading database ... \r(Reading database ... 5%\r(Reading database ... 10%\r(Reading database ... 15%\r(Reading database ... 20%\r(Reading database ... 25%\r(Reading database ... 30%\r(Reading database ... 35%\r(Reading database ... 40%\r(Reading database ... 45%\r(Reading database ... 50%\r(Reading database ... 55%\r(Reading database ... 60%\r(Reading database ... 65%\r(Reading database ... 70%\r(Reading database ... 75%\r(Reading database ... 80%\r(Reading database ... 85%\r(Reading database ... 90%\r(Reading database ... 95%\r(Reading database ... 100%\r(Reading database ... 28689 files and directories currently installed.)\r\nPreparing to unpack .../libauparse0_1%3a3.0.9-1_amd64.deb ...\r\nUnpacking libauparse0:amd64 (1:3.0.9-1) ...\r\nSelecting previously unselected package auditd.\r\nPreparing to unpack .../auditd_1%3a3.0.9-1_amd64.deb ...\r\nUnpacking auditd (1:3.0.9-1) ...\r\nSetting up libauparse0:amd64 (1:3.0.9-1) ...\r\nSetting up auditd (1:3.0.9-1) ...\r\nCreated symlink /etc/systemd/system/multi-user.target.wants/auditd.service → /lib/systemd/system/auditd.service.\r\r\nProcessing triggers for libc-bin (2.36-9+deb12u14) ...\r\n", "stdout_lines": ["Reading package lists...", "Building dependency tree...", "Reading state information...", "The following additional packages will be installed:", " libauparse0", "Suggested packages:", " audispd-plugins", "The following NEW packages will be installed:", " auditd libauparse0", "0 upgraded, 2 newly installed, 0 to remove and 0 not upgraded.", "Need to get 279 kB of archives.", "After this operation, 934 kB of additional disk space will be used.", "Get:1 http://deb.debian.org/debian bookworm/main amd64 libauparse0 amd64 1:3.0.9-1 [61.9 kB]", "Get:2 http://deb.debian.org/debian bookworm/main amd64 auditd amd64 1:3.0.9-1 [218 kB]", "Fetched 279 kB in 0s (3857 kB/s)", "Selecting previously unselected package libauparse0:amd64.", "(Reading database ... ", "(Reading database ... 5%", "(Reading database ... 10%", "(Reading database ... 15%", "(Reading database ... 20%", "(Reading database ... 25%", "(Reading database ... 30%", "(Reading database ... 35%", "(Reading database ... 40%", "(Reading database ... 45%", "(Reading database ... 50%", "(Reading database ... 55%", "(Reading database ... 60%", "(Reading database ... 65%", "(Reading database ... 70%", "(Reading database ... 75%", "(Reading database ... 80%", "(Reading database ... 85%", "(Reading database ... 90%", "(Reading database ... 95%", "(Reading database ... 100%", "(Reading database ... 28689 files and directories currently installed.)", "Preparing to unpack .../libauparse0_1%3a3.0.9-1_amd64.deb ...", "Unpacking libauparse0:amd64 (1:3.0.9-1) ...", "Selecting previously unselected package auditd.", "Preparing to unpack .../auditd_1%3a3.0.9-1_amd64.deb ...", "Unpacking auditd (1:3.0.9-1) ...", "Setting up libauparse0:amd64 (1:3.0.9-1) ...", "Setting up auditd (1:3.0.9-1) ...", "Created symlink /etc/systemd/system/multi-user.target.wants/auditd.service → /lib/systemd/system/auditd.service.", "", "Processing triggers for libc-bin (2.36-9+deb12u14) ..."]} 2026-06-02 13:02:01.875380 | debian-bookworm | 2026-06-02 13:02:01.875469 | debian-bookworm | TASK [auditd : Install audispd-plugins package] ******************************** 2026-06-02 13:02:04.062397 | ubuntu-noble | The following additional packages will be installed: 2026-06-02 13:02:04.062510 | ubuntu-noble | libauparse0t64 2026-06-02 13:02:04.062629 | ubuntu-noble | Suggested packages: 2026-06-02 13:02:04.062745 | ubuntu-noble | audispd-plugins 2026-06-02 13:02:04.062904 | ubuntu-noble | The following NEW packages will be installed: 2026-06-02 13:02:04.063023 | ubuntu-noble | auditd libauparse0t64 2026-06-02 13:02:04.063141 | ubuntu-noble | 0 upgraded, 2 newly installed, 0 to remove and 3 not upgraded. 2026-06-02 13:02:04.066981 | ubuntu-noble | changed: [molecule-auditd] => {"cache_update_time": 1780405222, "cache_updated": false, "changed": true, "stderr": "debconf: delaying package configuration, since apt-utils is not installed\n", "stderr_lines": ["debconf: delaying package configuration, since apt-utils is not installed"], "stdout": "Reading package lists...\nBuilding dependency tree...\nReading state information...\nThe following additional packages will be installed:\n libauparse0t64\nSuggested packages:\n audispd-plugins\nThe following NEW packages will be installed:\n auditd libauparse0t64\n0 upgraded, 2 newly installed, 0 to remove and 3 not upgraded.\nNeed to get 274 kB of archives.\nAfter this operation, 893 kB of additional disk space will be used.\nGet:1 http://archive.ubuntu.com/ubuntu noble-updates/main amd64 libauparse0t64 amd64 1:3.1.2-2.1build1.1 [58.9 kB]\nGet:2 http://archive.ubuntu.com/ubuntu noble-updates/main amd64 auditd amd64 1:3.1.2-2.1build1.1 [215 kB]\nFetched 274 kB in 0s (2083 kB/s)\nSelecting previously unselected package libauparse0t64:amd64.\r\n(Reading database ... \r(Reading database ... 5%\r(Reading database ... 10%\r(Reading database ... 15%\r(Reading database ... 20%\r(Reading database ... 25%\r(Reading database ... 30%\r(Reading database ... 35%\r(Reading database ... 40%\r(Reading database ... 45%\r(Reading database ... 50%\r(Reading database ... 55%\r(Reading database ... 60%\r(Reading database ... 65%\r(Reading database ... 70%\r(Reading database ... 75%\r(Reading database ... 80%\r(Reading database ... 85%\r(Reading database ... 90%\r(Reading database ... 95%\r(Reading database ... 100%\r(Reading database ... 36110 files and directories currently installed.)\r\nPreparing to unpack .../libauparse0t64_1%3a3.1.2-2.1build1.1_amd64.deb ...\r\nAdding 'diversion of /lib/x86_64-linux-gnu/libauparse.so.0 to /lib/x86_64-linux-gnu/libauparse.so.0.usr-is-merged by libauparse0t64'\r\nAdding 'diversion of /lib/x86_64-linux-gnu/libauparse.so.0.0.0 to /lib/x86_64-linux-gnu/libauparse.so.0.0.0.usr-is-merged by libauparse0t64'\r\nUnpacking libauparse0t64:amd64 (1:3.1.2-2.1build1.1) ...\r\nSelecting previously unselected package auditd.\r\nPreparing to unpack .../auditd_1%3a3.1.2-2.1build1.1_amd64.deb ...\r\nUnpacking auditd (1:3.1.2-2.1build1.1) ...\r\nSetting up libauparse0t64:amd64 (1:3.1.2-2.1build1.1) ...\r\nSetting up auditd (1:3.1.2-2.1build1.1) ...\r\nCreated symlink /etc/systemd/system/multi-user.target.wants/auditd.service → /usr/lib/systemd/system/auditd.service.\r\r\nProcessing triggers for libc-bin (2.39-0ubuntu8.7) ...\r\n", "stdout_lines": ["Reading package lists...", "Building dependency tree...", "Reading state information...", "The following additional packages will be installed:", " libauparse0t64", "Suggested packages:", " audispd-plugins", "The following NEW packages will be installed:", " auditd libauparse0t64", "0 upgraded, 2 newly installed, 0 to remove and 3 not upgraded.", "Need to get 274 kB of archives.", "After this operation, 893 kB of additional disk space will be used.", "Get:1 http://archive.ubuntu.com/ubuntu noble-updates/main amd64 libauparse0t64 amd64 1:3.1.2-2.1build1.1 [58.9 kB]", "Get:2 http://archive.ubuntu.com/ubuntu noble-updates/main amd64 auditd amd64 1:3.1.2-2.1build1.1 [215 kB]", "Fetched 274 kB in 0s (2083 kB/s)", "Selecting previously unselected package libauparse0t64:amd64.", "(Reading database ... ", "(Reading database ... 5%", "(Reading database ... 10%", "(Reading database ... 15%", "(Reading database ... 20%", "(Reading database ... 25%", "(Reading database ... 30%", "(Reading database ... 35%", "(Reading database ... 40%", "(Reading database ... 45%", "(Reading database ... 50%", "(Reading database ... 55%", "(Reading database ... 60%", "(Reading database ... 65%", "(Reading database ... 70%", "(Reading database ... 75%", "(Reading database ... 80%", "(Reading database ... 85%", "(Reading database ... 90%", "(Reading database ... 95%", "(Reading database ... 100%", "(Reading database ... 36110 files and directories currently installed.)", "Preparing to unpack .../libauparse0t64_1%3a3.1.2-2.1build1.1_amd64.deb ...", "Adding 'diversion of /lib/x86_64-linux-gnu/libauparse.so.0 to /lib/x86_64-linux-gnu/libauparse.so.0.usr-is-merged by libauparse0t64'", "Adding 'diversion of /lib/x86_64-linux-gnu/libauparse.so.0.0.0 to /lib/x86_64-linux-gnu/libauparse.so.0.0.0.usr-is-merged by libauparse0t64'", "Unpacking libauparse0t64:amd64 (1:3.1.2-2.1build1.1) ...", "Selecting previously unselected package auditd.", "Preparing to unpack .../auditd_1%3a3.1.2-2.1build1.1_amd64.deb ...", "Unpacking auditd (1:3.1.2-2.1build1.1) ...", "Setting up libauparse0t64:amd64 (1:3.1.2-2.1build1.1) ...", "Setting up auditd (1:3.1.2-2.1build1.1) ...", "Created symlink /etc/systemd/system/multi-user.target.wants/auditd.service → /usr/lib/systemd/system/auditd.service.", "", "Processing triggers for libc-bin (2.39-0ubuntu8.7) ..."]} 2026-06-02 13:02:04.067034 | ubuntu-noble | 2026-06-02 13:02:04.067044 | ubuntu-noble | TASK [auditd : Install audispd-plugins package] ******************************** 2026-06-02 13:02:04.752054 | debian-bookworm | The following NEW packages will be installed: 2026-06-02 13:02:04.752150 | debian-bookworm | audispd-plugins 2026-06-02 13:02:04.752167 | debian-bookworm | 0 upgraded, 1 newly installed, 0 to remove and 0 not upgraded. 2026-06-02 13:02:04.752184 | debian-bookworm | changed: [molecule-auditd] => {"cache_update_time": 1780405220, "cache_updated": false, "changed": true, "stderr": "debconf: delaying package configuration, since apt-utils is not installed\n", "stderr_lines": ["debconf: delaying package configuration, since apt-utils is not installed"], "stdout": "Reading package lists...\nBuilding dependency tree...\nReading state information...\nThe following NEW packages will be installed:\n audispd-plugins\n0 upgraded, 1 newly installed, 0 to remove and 0 not upgraded.\nNeed to get 45.6 kB of archives.\nAfter this operation, 132 kB of additional disk space will be used.\nGet:1 http://deb.debian.org/debian bookworm/main amd64 audispd-plugins amd64 1:3.0.9-1 [45.6 kB]\nFetched 45.6 kB in 0s (952 kB/s)\nSelecting previously unselected package audispd-plugins.\r\n(Reading database ... \r(Reading database ... 5%\r(Reading database ... 10%\r(Reading database ... 15%\r(Reading database ... 20%\r(Reading database ... 25%\r(Reading database ... 30%\r(Reading database ... 35%\r(Reading database ... 40%\r(Reading database ... 45%\r(Reading database ... 50%\r(Reading database ... 55%\r(Reading database ... 60%\r(Reading database ... 65%\r(Reading database ... 70%\r(Reading database ... 75%\r(Reading database ... 80%\r(Reading database ... 85%\r(Reading database ... 90%\r(Reading database ... 95%\r(Reading database ... 100%\r(Reading database ... 28780 files and directories currently installed.)\r\nPreparing to unpack .../audispd-plugins_1%3a3.0.9-1_amd64.deb ...\r\nUnpacking audispd-plugins (1:3.0.9-1) ...\r\nSetting up audispd-plugins (1:3.0.9-1) ...\r\n", "stdout_lines": ["Reading package lists...", "Building dependency tree...", "Reading state information...", "The following NEW packages will be installed:", " audispd-plugins", "0 upgraded, 1 newly installed, 0 to remove and 0 not upgraded.", "Need to get 45.6 kB of archives.", "After this operation, 132 kB of additional disk space will be used.", "Get:1 http://deb.debian.org/debian bookworm/main amd64 audispd-plugins amd64 1:3.0.9-1 [45.6 kB]", "Fetched 45.6 kB in 0s (952 kB/s)", "Selecting previously unselected package audispd-plugins.", "(Reading database ... ", "(Reading database ... 5%", "(Reading database ... 10%", "(Reading database ... 15%", "(Reading database ... 20%", "(Reading database ... 25%", "(Reading database ... 30%", "(Reading database ... 35%", "(Reading database ... 40%", "(Reading database ... 45%", "(Reading database ... 50%", "(Reading database ... 55%", "(Reading database ... 60%", "(Reading database ... 65%", "(Reading database ... 70%", "(Reading database ... 75%", "(Reading database ... 80%", "(Reading database ... 85%", "(Reading database ... 90%", "(Reading database ... 95%", "(Reading database ... 100%", "(Reading database ... 28780 files and directories currently installed.)", "Preparing to unpack .../audispd-plugins_1%3a3.0.9-1_amd64.deb ...", "Unpacking audispd-plugins (1:3.0.9-1) ...", "Setting up audispd-plugins (1:3.0.9-1) ..."]} 2026-06-02 13:02:04.752201 | debian-bookworm | 2026-06-02 13:02:04.752225 | debian-bookworm | TASK [auditd : Copy auditd.conf configuration files] *************************** 2026-06-02 13:02:06.032253 | debian-bookworm | --- before 2026-06-02 13:02:06.032408 | debian-bookworm | +++ after: /home/zuul/.ansible/tmp/ansible-local-20898lforhbx/tmplg64o1v1/auditd.conf.j2 2026-06-02 13:02:06.032425 | debian-bookworm | @@ -0,0 +1,37 @@ 2026-06-02 13:02:06.032448 | debian-bookworm | +# 2026-06-02 13:02:06.032461 | debian-bookworm | +# This file controls the configuration of the audit daemon 2026-06-02 13:02:06.032592 | debian-bookworm | +# 2026-06-02 13:02:06.032717 | debian-bookworm | + 2026-06-02 13:02:06.032853 | debian-bookworm | +local_events = yes 2026-06-02 13:02:06.033011 | debian-bookworm | +write_logs = yes 2026-06-02 13:02:06.033155 | debian-bookworm | +log_file = /var/log/audit/audit.log 2026-06-02 13:02:06.033283 | debian-bookworm | +log_group = adm 2026-06-02 13:02:06.033417 | debian-bookworm | +log_format = RAW 2026-06-02 13:02:06.033554 | debian-bookworm | +flush = INCREMENTAL_ASYNC 2026-06-02 13:02:06.033688 | debian-bookworm | +freq = 50 2026-06-02 13:02:06.033824 | debian-bookworm | +max_log_file = 8 2026-06-02 13:02:06.033971 | debian-bookworm | +num_logs = 5 2026-06-02 13:02:06.034105 | debian-bookworm | +priority_boost = 4 2026-06-02 13:02:06.034237 | debian-bookworm | +disp_qos = lossy 2026-06-02 13:02:06.034631 | debian-bookworm | +dispatcher = /sbin/audispd 2026-06-02 13:02:06.034785 | debian-bookworm | +name_format = NONE 2026-06-02 13:02:06.034947 | debian-bookworm | +##name = mydomain 2026-06-02 13:02:06.035119 | debian-bookworm | +max_log_file_action = ROTATE 2026-06-02 13:02:06.035259 | debian-bookworm | +space_left = 12361 2026-06-02 13:02:06.035401 | debian-bookworm | +space_left_action = email 2026-06-02 13:02:06.035521 | debian-bookworm | +verify_email = yes 2026-06-02 13:02:06.035643 | debian-bookworm | +action_mail_acct = root 2026-06-02 13:02:06.035774 | debian-bookworm | +admin_space_left = 50 2026-06-02 13:02:06.035904 | debian-bookworm | +admin_space_left_action = SUSPEND 2026-06-02 13:02:06.036216 | debian-bookworm | +disk_full_action = SUSPEND 2026-06-02 13:02:06.036334 | debian-bookworm | +disk_error_action = SUSPEND 2026-06-02 13:02:06.036452 | debian-bookworm | +use_libwrap = yes 2026-06-02 13:02:06.036575 | debian-bookworm | +##tcp_listen_port = 60 2026-06-02 13:02:06.036698 | debian-bookworm | +tcp_listen_queue = 5 2026-06-02 13:02:06.036820 | debian-bookworm | +tcp_max_per_addr = 1 2026-06-02 13:02:06.036992 | debian-bookworm | +##tcp_client_ports = 1024-65535 2026-06-02 13:02:06.037108 | debian-bookworm | +tcp_client_max_idle = 0 2026-06-02 13:02:06.037225 | debian-bookworm | +enable_krb5 = no 2026-06-02 13:02:06.037338 | debian-bookworm | +krb5_principal = auditd 2026-06-02 13:02:06.037458 | debian-bookworm | +##krb5_key_file = /etc/audit/audit.key 2026-06-02 13:02:06.037571 | debian-bookworm | +distribute_network = no 2026-06-02 13:02:06.037680 | debian-bookworm | 2026-06-02 13:02:06.037821 | debian-bookworm | changed: [molecule-auditd] => {"changed": true, "checksum": "e902cc6bebf86c17087d153e359a2cc1231672e0", "dest": "/etc/audit/audit.conf", "gid": 0, "group": "root", "md5sum": "69dfd768317bae876a6a78c8aeb5cce1", "mode": "0640", "owner": "root", "size": 806, "src": "/home/zuul/.ansible/tmp/ansible-tmp-1780405324.7795186-2459-217832934879812/.source.conf", "state": "file", "uid": 0} 2026-06-02 13:02:06.037936 | debian-bookworm | 2026-06-02 13:02:06.038068 | debian-bookworm | TASK [auditd : Adjust auditd/audispd configurations] *************************** 2026-06-02 13:02:06.450137 | debian-bookworm | ok: [molecule-auditd] => (item={'parameter': 'active', 'value': 'no', 'config': '/etc/audit/plugins.d/syslog.conf'}) => {"ansible_loop_var": "item", "backup": "", "changed": false, "item": {"config": "/etc/audit/plugins.d/syslog.conf", "parameter": "active", "value": "no"}, "msg": ""} 2026-06-02 13:02:06.450199 | debian-bookworm | 2026-06-02 13:02:06.450211 | debian-bookworm | TASK [auditd : Deploy rules for auditd] **************************************** 2026-06-02 13:02:07.450479 | ubuntu-noble | The following NEW packages will be installed: 2026-06-02 13:02:07.450521 | ubuntu-noble | audispd-plugins 2026-06-02 13:02:07.450527 | ubuntu-noble | 0 upgraded, 1 newly installed, 0 to remove and 3 not upgraded. 2026-06-02 13:02:07.450534 | ubuntu-noble | changed: [molecule-auditd] => {"cache_update_time": 1780405222, "cache_updated": false, "changed": true, "stderr": "debconf: delaying package configuration, since apt-utils is not installed\n", "stderr_lines": ["debconf: delaying package configuration, since apt-utils is not installed"], "stdout": "Reading package lists...\nBuilding dependency tree...\nReading state information...\nThe following NEW packages will be installed:\n audispd-plugins\n0 upgraded, 1 newly installed, 0 to remove and 3 not upgraded.\nNeed to get 38.8 kB of archives.\nAfter this operation, 131 kB of additional disk space will be used.\nGet:1 http://archive.ubuntu.com/ubuntu noble-updates/universe amd64 audispd-plugins amd64 1:3.1.2-2.1build1.1 [38.8 kB]\nFetched 38.8 kB in 0s (639 kB/s)\nSelecting previously unselected package audispd-plugins.\r\n(Reading database ... \r(Reading database ... 5%\r(Reading database ... 10%\r(Reading database ... 15%\r(Reading database ... 20%\r(Reading database ... 25%\r(Reading database ... 30%\r(Reading database ... 35%\r(Reading database ... 40%\r(Reading database ... 45%\r(Reading database ... 50%\r(Reading database ... 55%\r(Reading database ... 60%\r(Reading database ... 65%\r(Reading database ... 70%\r(Reading database ... 75%\r(Reading database ... 80%\r(Reading database ... 85%\r(Reading database ... 90%\r(Reading database ... 95%\r(Reading database ... 100%\r(Reading database ... 36206 files and directories currently installed.)\r\nPreparing to unpack .../audispd-plugins_1%3a3.1.2-2.1build1.1_amd64.deb ...\r\nUnpacking audispd-plugins (1:3.1.2-2.1build1.1) ...\r\nSetting up audispd-plugins (1:3.1.2-2.1build1.1) ...\r\n", "stdout_lines": ["Reading package lists...", "Building dependency tree...", "Reading state information...", "The following NEW packages will be installed:", " audispd-plugins", "0 upgraded, 1 newly installed, 0 to remove and 3 not upgraded.", "Need to get 38.8 kB of archives.", "After this operation, 131 kB of additional disk space will be used.", "Get:1 http://archive.ubuntu.com/ubuntu noble-updates/universe amd64 audispd-plugins amd64 1:3.1.2-2.1build1.1 [38.8 kB]", "Fetched 38.8 kB in 0s (639 kB/s)", "Selecting previously unselected package audispd-plugins.", "(Reading database ... ", "(Reading database ... 5%", "(Reading database ... 10%", "(Reading database ... 15%", "(Reading database ... 20%", "(Reading database ... 25%", "(Reading database ... 30%", "(Reading database ... 35%", "(Reading database ... 40%", "(Reading database ... 45%", "(Reading database ... 50%", "(Reading database ... 55%", "(Reading database ... 60%", "(Reading database ... 65%", "(Reading database ... 70%", "(Reading database ... 75%", "(Reading database ... 80%", "(Reading database ... 85%", "(Reading database ... 90%", "(Reading database ... 95%", "(Reading database ... 100%", "(Reading database ... 36206 files and directories currently installed.)", "Preparing to unpack .../audispd-plugins_1%3a3.1.2-2.1build1.1_amd64.deb ...", "Unpacking audispd-plugins (1:3.1.2-2.1build1.1) ...", "Setting up audispd-plugins (1:3.1.2-2.1build1.1) ..."]} 2026-06-02 13:02:07.450555 | ubuntu-noble | 2026-06-02 13:02:07.450560 | ubuntu-noble | TASK [auditd : Copy auditd.conf configuration files] *************************** 2026-06-02 13:02:07.251295 | debian-bookworm | --- before 2026-06-02 13:02:07.251371 | debian-bookworm | +++ after: /home/zuul/.ansible/tmp/ansible-local-20898lforhbx/tmpow3hbv3f/20-neo23x0.rules.j2 2026-06-02 13:02:07.251450 | debian-bookworm | @@ -0,0 +1,750 @@ 2026-06-02 13:02:07.251540 | debian-bookworm | +# ___ ___ __ __ 2026-06-02 13:02:07.251638 | debian-bookworm | +# / | __ ______/ (_) /_____/ / 2026-06-02 13:02:07.251734 | debian-bookworm | +# / /| |/ / / / __ / / __/ __ / 2026-06-02 13:02:07.251863 | debian-bookworm | +# / ___ / /_/ / /_/ / / /_/ /_/ / 2026-06-02 13:02:07.252014 | debian-bookworm | +# /_/ |_\__,_/\__,_/_/\__/\__,_/ 2026-06-02 13:02:07.252063 | debian-bookworm | +# 2026-06-02 13:02:07.252369 | debian-bookworm | +# Linux Audit Daemon - Best Practice Configuration 2026-06-02 13:02:07.252376 | debian-bookworm | +# /etc/audit/audit.rules 2026-06-02 13:02:07.252384 | debian-bookworm | +# 2026-06-02 13:02:07.252436 | debian-bookworm | +# Compiled by Florian Roth 2026-06-02 13:02:07.252569 | debian-bookworm | +# 2026-06-02 13:02:07.252658 | debian-bookworm | +# Created : 2017/12/05 2026-06-02 13:02:07.252728 | debian-bookworm | +# Modified : 2023/01/25 2026-06-02 13:02:07.252830 | debian-bookworm | +# 2026-06-02 13:02:07.252916 | debian-bookworm | +# Based on rules published here: 2026-06-02 13:02:07.253027 | debian-bookworm | +# Gov.uk auditd rules 2026-06-02 13:02:07.253291 | debian-bookworm | +# https://github.com/gds-operations/puppet-auditd/pull/1 2026-06-02 13:02:07.253446 | debian-bookworm | +# CentOS 7 hardening 2026-06-02 13:02:07.253600 | debian-bookworm | +# https://highon.coffee/blog/security-harden-centos-7/#auditd---audit-daemon 2026-06-02 13:02:07.253739 | debian-bookworm | +# Linux audit repo 2026-06-02 13:02:07.253883 | debian-bookworm | +# https://github.com/linux-audit/audit-userspace/tree/master/rules 2026-06-02 13:02:07.254059 | debian-bookworm | +# Auditd high performance linux auditing 2026-06-02 13:02:07.254195 | debian-bookworm | +# https://linux-audit.com/tuning-auditd-high-performance-linux-auditing/ 2026-06-02 13:02:07.254291 | debian-bookworm | +# 2026-06-02 13:02:07.254384 | debian-bookworm | +# Further rules 2026-06-02 13:02:07.254524 | debian-bookworm | +# For PCI DSS compliance see: 2026-06-02 13:02:07.254681 | debian-bookworm | +# https://github.com/linux-audit/audit-userspace/blob/master/rules/30-pci-dss-v31.rules 2026-06-02 13:02:07.254816 | debian-bookworm | +# For NISPOM compliance see: 2026-06-02 13:02:07.254969 | debian-bookworm | +# https://github.com/linux-audit/audit-userspace/blob/master/rules/30-nispom.rules 2026-06-02 13:02:07.255066 | debian-bookworm | + 2026-06-02 13:02:07.255167 | debian-bookworm | +# Remove any existing rules 2026-06-02 13:02:07.255261 | debian-bookworm | +-D 2026-06-02 13:02:07.255355 | debian-bookworm | + 2026-06-02 13:02:07.255450 | debian-bookworm | +# Buffer Size 2026-06-02 13:02:07.255546 | debian-bookworm | +## Feel free to increase this if the machine panic's 2026-06-02 13:02:07.255641 | debian-bookworm | +-b 8192 2026-06-02 13:02:07.255734 | debian-bookworm | + 2026-06-02 13:02:07.255828 | debian-bookworm | +# Failure Mode 2026-06-02 13:02:07.255958 | debian-bookworm | +## Possible values: 0 (silent), 1 (printk, print a failure message), 2 (panic, halt the system) 2026-06-02 13:02:07.257467 | debian-bookworm | +-f 1 2026-06-02 13:02:07.257607 | debian-bookworm | + 2026-06-02 13:02:07.257715 | debian-bookworm | +# Ignore errors 2026-06-02 13:02:07.257824 | debian-bookworm | +## e.g. caused by users or files not found in the local environment 2026-06-02 13:02:07.257937 | debian-bookworm | +-i 2026-06-02 13:02:07.258072 | debian-bookworm | + 2026-06-02 13:02:07.258173 | debian-bookworm | +# Self Auditing --------------------------------------------------------------- 2026-06-02 13:02:07.258285 | debian-bookworm | + 2026-06-02 13:02:07.258395 | debian-bookworm | +## Audit the audit logs 2026-06-02 13:02:07.258505 | debian-bookworm | +### Successful and unsuccessful attempts to read information from the audit records 2026-06-02 13:02:07.258612 | debian-bookworm | +-w /var/log/audit/ -p wra -k auditlog 2026-06-02 13:02:07.258709 | debian-bookworm | +-w /var/audit/ -p wra -k auditlog 2026-06-02 13:02:07.258809 | debian-bookworm | + 2026-06-02 13:02:07.258917 | debian-bookworm | +## Auditd configuration 2026-06-02 13:02:07.259047 | debian-bookworm | +### Modifications to audit configuration that occur while the audit collection functions are operating 2026-06-02 13:02:07.259160 | debian-bookworm | +-w /etc/audit/ -p wa -k auditconfig 2026-06-02 13:02:07.259277 | debian-bookworm | +-w /etc/libaudit.conf -p wa -k auditconfig 2026-06-02 13:02:07.259400 | debian-bookworm | +-w /etc/audisp/ -p wa -k audispconfig 2026-06-02 13:02:07.259480 | debian-bookworm | + 2026-06-02 13:02:07.259587 | debian-bookworm | +## Monitor for use of audit management tools 2026-06-02 13:02:07.260367 | debian-bookworm | +-w /sbin/auditctl -p x -k audittools 2026-06-02 13:02:07.266827 | debian-bookworm | +-w /sbin/auditd -p x -k audittools 2026-06-02 13:02:07.266867 | debian-bookworm | +-w /usr/sbin/auditd -p x -k audittools 2026-06-02 13:02:07.266872 | debian-bookworm | +-w /usr/sbin/augenrules -p x -k audittools 2026-06-02 13:02:07.266877 | debian-bookworm | + 2026-06-02 13:02:07.266882 | debian-bookworm | +## Access to all audit trails 2026-06-02 13:02:07.266887 | debian-bookworm | + 2026-06-02 13:02:07.266891 | debian-bookworm | +-a always,exit -F path=/usr/sbin/ausearch -F perm=x -k audittools 2026-06-02 13:02:07.266897 | debian-bookworm | +-a always,exit -F path=/usr/sbin/aureport -F perm=x -k audittools 2026-06-02 13:02:07.266902 | debian-bookworm | +-a always,exit -F path=/usr/sbin/aulast -F perm=x -k audittools 2026-06-02 13:02:07.266906 | debian-bookworm | +-a always,exit -F path=/usr/sbin/aulastlogin -F perm=x -k audittools 2026-06-02 13:02:07.266910 | debian-bookworm | +-a always,exit -F path=/usr/sbin/auvirt -F perm=x -k audittools 2026-06-02 13:02:07.266914 | debian-bookworm | + 2026-06-02 13:02:07.266969 | debian-bookworm | +# Filters --------------------------------------------------------------------- 2026-06-02 13:02:07.266974 | debian-bookworm | + 2026-06-02 13:02:07.266996 | debian-bookworm | +### We put these early because audit is a first match wins system. 2026-06-02 13:02:07.267000 | debian-bookworm | + 2026-06-02 13:02:07.267004 | debian-bookworm | +## Ignore SELinux AVC records 2026-06-02 13:02:07.267009 | debian-bookworm | +-a always,exclude -F msgtype=AVC 2026-06-02 13:02:07.267013 | debian-bookworm | + 2026-06-02 13:02:07.267018 | debian-bookworm | +## Ignore current working directory records 2026-06-02 13:02:07.267022 | debian-bookworm | +-a always,exclude -F msgtype=CWD 2026-06-02 13:02:07.267026 | debian-bookworm | + 2026-06-02 13:02:07.267030 | debian-bookworm | +## Cron jobs fill the logs with stuff we normally don't want (works with SELinux) 2026-06-02 13:02:07.267035 | debian-bookworm | +-a never,user -F subj_type=crond_t 2026-06-02 13:02:07.267040 | debian-bookworm | +-a never,exit -F subj_type=crond_t 2026-06-02 13:02:07.267044 | debian-bookworm | + 2026-06-02 13:02:07.267048 | debian-bookworm | +## This prevents chrony from overwhelming the logs 2026-06-02 13:02:07.267053 | debian-bookworm | +-a never,exit -F arch=b64 -S adjtimex -F auid=-1 -F uid=chrony -F subj_type=chronyd_t 2026-06-02 13:02:07.267057 | debian-bookworm | + 2026-06-02 13:02:07.267062 | debian-bookworm | +## This is not very interesting and wastes a lot of space if the server is public facing 2026-06-02 13:02:07.267066 | debian-bookworm | +-a always,exclude -F msgtype=CRYPTO_KEY_USER 2026-06-02 13:02:07.267070 | debian-bookworm | + 2026-06-02 13:02:07.267074 | debian-bookworm | +## Open VM Tools 2026-06-02 13:02:07.267079 | debian-bookworm | +-a exit,never -F arch=b64 -S all -F exe=/usr/bin/vmtoolsd 2026-06-02 13:02:07.267083 | debian-bookworm | + 2026-06-02 13:02:07.267087 | debian-bookworm | +## High Volume Event Filter (especially on Linux Workstations) 2026-06-02 13:02:07.267092 | debian-bookworm | +-a never,exit -F arch=b64 -F dir=/dev/shm -k sharedmemaccess 2026-06-02 13:02:07.267096 | debian-bookworm | +-a never,exit -F arch=b64 -F dir=/var/lock/lvm -k locklvm 2026-06-02 13:02:07.267100 | debian-bookworm | + 2026-06-02 13:02:07.267104 | debian-bookworm | +## FileBeat 2026-06-02 13:02:07.267109 | debian-bookworm | +-a never,exit -F arch=b64 -F path=/opt/filebeat -k filebeat 2026-06-02 13:02:07.267113 | debian-bookworm | + 2026-06-02 13:02:07.267117 | debian-bookworm | +## More information on how to filter events 2026-06-02 13:02:07.267121 | debian-bookworm | +### https://access.redhat.com/solutions/2482221 2026-06-02 13:02:07.267125 | debian-bookworm | + 2026-06-02 13:02:07.267130 | debian-bookworm | +# Rules ----------------------------------------------------------------------- 2026-06-02 13:02:07.267134 | debian-bookworm | + 2026-06-02 13:02:07.267138 | debian-bookworm | +## Kernel parameters 2026-06-02 13:02:07.267142 | debian-bookworm | +-w /etc/sysctl.conf -p wa -k sysctl 2026-06-02 13:02:07.267146 | debian-bookworm | +-w /etc/sysctl.d -p wa -k sysctl 2026-06-02 13:02:07.267150 | debian-bookworm | + 2026-06-02 13:02:07.267155 | debian-bookworm | +## Kernel module loading and unloading 2026-06-02 13:02:07.267159 | debian-bookworm | +-a always,exit -F perm=x -F auid!=-1 -F path=/sbin/insmod -k modules 2026-06-02 13:02:07.267163 | debian-bookworm | +-a always,exit -F perm=x -F auid!=-1 -F path=/sbin/modprobe -k modules 2026-06-02 13:02:07.267167 | debian-bookworm | +-a always,exit -F perm=x -F auid!=-1 -F path=/sbin/rmmod -k modules 2026-06-02 13:02:07.267171 | debian-bookworm | +-a always,exit -F arch=b64 -S finit_module -S init_module -S delete_module -F auid!=-1 -k modules 2026-06-02 13:02:07.267176 | debian-bookworm | + 2026-06-02 13:02:07.267180 | debian-bookworm | +## Modprobe configuration 2026-06-02 13:02:07.267184 | debian-bookworm | +-w /etc/modprobe.conf -p wa -k modprobe 2026-06-02 13:02:07.267188 | debian-bookworm | +-w /etc/modprobe.d -p wa -k modprobe 2026-06-02 13:02:07.267193 | debian-bookworm | + 2026-06-02 13:02:07.267197 | debian-bookworm | +## KExec usage (all actions) 2026-06-02 13:02:07.267201 | debian-bookworm | +-a always,exit -F arch=b64 -S kexec_load -k KEXEC 2026-06-02 13:02:07.267205 | debian-bookworm | + 2026-06-02 13:02:07.267209 | debian-bookworm | +## Special files 2026-06-02 13:02:07.267214 | debian-bookworm | +-a always,exit -F arch=b64 -S mknod -S mknodat -k specialfiles 2026-06-02 13:02:07.267218 | debian-bookworm | + 2026-06-02 13:02:07.267222 | debian-bookworm | +## Mount operations (only attributable) 2026-06-02 13:02:07.267232 | debian-bookworm | +-a always,exit -F arch=b64 -S mount -S umount2 -F auid!=-1 -k mount 2026-06-02 13:02:07.267236 | debian-bookworm | + 2026-06-02 13:02:07.267241 | debian-bookworm | +### NFS mount 2026-06-02 13:02:07.267252 | debian-bookworm | +-a always,exit -F path=/sbin/mount.nfs -F perm=x -F auid>=500 -F auid!=4294967295 -k T1078_Valid_Accounts 2026-06-02 13:02:07.267260 | debian-bookworm | +-a always,exit -F path=/usr/sbin/mount.nfs -F perm=x -F auid>=500 -F auid!=4294967295 -k T1078_Valid_Accounts 2026-06-02 13:02:07.267283 | debian-bookworm | + 2026-06-02 13:02:07.267380 | debian-bookworm | +## Change swap (only attributable) 2026-06-02 13:02:07.267476 | debian-bookworm | +-a always,exit -F arch=b64 -S swapon -S swapoff -F auid!=-1 -k swap 2026-06-02 13:02:07.267569 | debian-bookworm | + 2026-06-02 13:02:07.267664 | debian-bookworm | +## Time 2026-06-02 13:02:07.267765 | debian-bookworm | +-a always,exit -F arch=b64 -F uid!=ntp -S adjtimex -S settimeofday -S clock_settime -k time 2026-06-02 13:02:07.267860 | debian-bookworm | +### Local time zone 2026-06-02 13:02:07.268017 | debian-bookworm | +-w /etc/localtime -p wa -k localtime 2026-06-02 13:02:07.268115 | debian-bookworm | + 2026-06-02 13:02:07.268212 | debian-bookworm | +## Stunnel 2026-06-02 13:02:07.268311 | debian-bookworm | +-w /usr/sbin/stunnel -p x -k stunnel 2026-06-02 13:02:07.268405 | debian-bookworm | +-w /usr/bin/stunnel -p x -k stunnel 2026-06-02 13:02:07.268495 | debian-bookworm | + 2026-06-02 13:02:07.268591 | debian-bookworm | +## Cron configuration & scheduled jobs 2026-06-02 13:02:07.268687 | debian-bookworm | +-w /etc/cron.allow -p wa -k cron 2026-06-02 13:02:07.268783 | debian-bookworm | +-w /etc/cron.deny -p wa -k cron 2026-06-02 13:02:07.268878 | debian-bookworm | +-w /etc/cron.d/ -p wa -k cron 2026-06-02 13:02:07.268994 | debian-bookworm | +-w /etc/cron.daily/ -p wa -k cron 2026-06-02 13:02:07.269089 | debian-bookworm | +-w /etc/cron.hourly/ -p wa -k cron 2026-06-02 13:02:07.269187 | debian-bookworm | +-w /etc/cron.monthly/ -p wa -k cron 2026-06-02 13:02:07.269285 | debian-bookworm | +-w /etc/cron.weekly/ -p wa -k cron 2026-06-02 13:02:07.269381 | debian-bookworm | +-w /etc/crontab -p wa -k cron 2026-06-02 13:02:07.269476 | debian-bookworm | +-w /var/spool/cron/ -p wa -k cron 2026-06-02 13:02:07.269568 | debian-bookworm | + 2026-06-02 13:02:07.269666 | debian-bookworm | +## User, group, password databases 2026-06-02 13:02:07.269765 | debian-bookworm | +-w /etc/group -p wa -k etcgroup 2026-06-02 13:02:07.269856 | debian-bookworm | +-w /etc/passwd -p wa -k etcpasswd 2026-06-02 13:02:07.269986 | debian-bookworm | +-w /etc/gshadow -k etcgroup 2026-06-02 13:02:07.270082 | debian-bookworm | +-w /etc/shadow -k etcpasswd 2026-06-02 13:02:07.270177 | debian-bookworm | +-w /etc/security/opasswd -k opasswd 2026-06-02 13:02:07.270270 | debian-bookworm | + 2026-06-02 13:02:07.270367 | debian-bookworm | +## Sudoers file changes 2026-06-02 13:02:07.270463 | debian-bookworm | +-w /etc/sudoers -p wa -k actions 2026-06-02 13:02:07.270556 | debian-bookworm | +-w /etc/sudoers.d/ -p wa -k actions 2026-06-02 13:02:07.270648 | debian-bookworm | + 2026-06-02 13:02:07.270741 | debian-bookworm | +## Passwd 2026-06-02 13:02:07.270838 | debian-bookworm | +-w /usr/bin/passwd -p x -k passwd_modification 2026-06-02 13:02:07.270952 | debian-bookworm | + 2026-06-02 13:02:07.271040 | debian-bookworm | +## Tools to change group identifiers 2026-06-02 13:02:07.271138 | debian-bookworm | +-w /usr/sbin/groupadd -p x -k group_modification 2026-06-02 13:02:07.271237 | debian-bookworm | +-w /usr/sbin/groupmod -p x -k group_modification 2026-06-02 13:02:07.271331 | debian-bookworm | +-w /usr/sbin/addgroup -p x -k group_modification 2026-06-02 13:02:07.271426 | debian-bookworm | +-w /usr/sbin/useradd -p x -k user_modification 2026-06-02 13:02:07.271524 | debian-bookworm | +-w /usr/sbin/userdel -p x -k user_modification 2026-06-02 13:02:07.271617 | debian-bookworm | +-w /usr/sbin/usermod -p x -k user_modification 2026-06-02 13:02:07.271713 | debian-bookworm | +-w /usr/sbin/adduser -p x -k user_modification 2026-06-02 13:02:07.271804 | debian-bookworm | + 2026-06-02 13:02:07.271910 | debian-bookworm | +## Login configuration and information 2026-06-02 13:02:07.272061 | debian-bookworm | +-w /etc/login.defs -p wa -k login 2026-06-02 13:02:07.272169 | debian-bookworm | +-w /etc/securetty -p wa -k login 2026-06-02 13:02:07.272266 | debian-bookworm | +-w /var/log/faillog -p wa -k login 2026-06-02 13:02:07.272361 | debian-bookworm | +-w /var/log/lastlog -p wa -k login 2026-06-02 13:02:07.272454 | debian-bookworm | +-w /var/log/tallylog -p wa -k login 2026-06-02 13:02:07.272555 | debian-bookworm | + 2026-06-02 13:02:07.272652 | debian-bookworm | +## Network Environment 2026-06-02 13:02:07.272746 | debian-bookworm | +### Changes to hostname 2026-06-02 13:02:07.272844 | debian-bookworm | +-a always,exit -F arch=b64 -S sethostname -S setdomainname -k network_modifications 2026-06-02 13:02:07.272949 | debian-bookworm | + 2026-06-02 13:02:07.273045 | debian-bookworm | +### Detect Remote Shell Use 2026-06-02 13:02:07.273145 | debian-bookworm | +-a always,exit -F arch=b64 -F exe=/bin/bash -F success=1 -S connect -k "remote_shell" 2026-06-02 13:02:07.273242 | debian-bookworm | +-a always,exit -F arch=b64 -F exe=/usr/bin/bash -F success=1 -S connect -k "remote_shell" 2026-06-02 13:02:07.273334 | debian-bookworm | + 2026-06-02 13:02:07.273431 | debian-bookworm | +### Successful IPv4 Connections 2026-06-02 13:02:07.273529 | debian-bookworm | +-a always,exit -F arch=b64 -S connect -F a2=16 -F success=1 -F key=network_connect_4 2026-06-02 13:02:07.273621 | debian-bookworm | + 2026-06-02 13:02:07.273718 | debian-bookworm | +### Successful IPv6 Connections 2026-06-02 13:02:07.273813 | debian-bookworm | +-a always,exit -F arch=b64 -S connect -F a2=28 -F success=1 -F key=network_connect_6 2026-06-02 13:02:07.273905 | debian-bookworm | + 2026-06-02 13:02:07.274014 | debian-bookworm | +### Changes to other files 2026-06-02 13:02:07.274112 | debian-bookworm | +-w /etc/hosts -p wa -k network_modifications 2026-06-02 13:02:07.274205 | debian-bookworm | +-w /etc/sysconfig/network -p wa -k network_modifications 2026-06-02 13:02:07.274301 | debian-bookworm | +-w /etc/sysconfig/network-scripts -p w -k network_modifications 2026-06-02 13:02:07.274393 | debian-bookworm | +-w /etc/network/ -p wa -k network 2026-06-02 13:02:07.274491 | debian-bookworm | +-a always,exit -F dir=/etc/NetworkManager/ -F perm=wa -k network_modifications 2026-06-02 13:02:07.274587 | debian-bookworm | + 2026-06-02 13:02:07.274682 | debian-bookworm | +### Changes to issue 2026-06-02 13:02:07.274775 | debian-bookworm | +-w /etc/issue -p wa -k etcissue 2026-06-02 13:02:07.274871 | debian-bookworm | +-w /etc/issue.net -p wa -k etcissue 2026-06-02 13:02:07.274978 | debian-bookworm | + 2026-06-02 13:02:07.275074 | debian-bookworm | +## System startup scripts 2026-06-02 13:02:07.275169 | debian-bookworm | +-w /etc/inittab -p wa -k init 2026-06-02 13:02:07.275266 | debian-bookworm | +-w /etc/init.d/ -p wa -k init 2026-06-02 13:02:07.275361 | debian-bookworm | +-w /etc/init/ -p wa -k init 2026-06-02 13:02:07.275453 | debian-bookworm | + 2026-06-02 13:02:07.275549 | debian-bookworm | +## Library search paths 2026-06-02 13:02:07.275659 | debian-bookworm | +-w /etc/ld.so.conf -p wa -k libpath 2026-06-02 13:02:07.275750 | debian-bookworm | +-w /etc/ld.so.conf.d -p wa -k libpath 2026-06-02 13:02:07.275843 | debian-bookworm | + 2026-06-02 13:02:07.276004 | debian-bookworm | +## Systemwide library preloads (LD_PRELOAD) 2026-06-02 13:02:07.276099 | debian-bookworm | +-w /etc/ld.so.preload -p wa -k systemwide_preloads 2026-06-02 13:02:07.276193 | debian-bookworm | + 2026-06-02 13:02:07.276292 | debian-bookworm | +## Pam configuration 2026-06-02 13:02:07.276387 | debian-bookworm | +-w /etc/pam.d/ -p wa -k pam 2026-06-02 13:02:07.276486 | debian-bookworm | +-w /etc/security/limits.conf -p wa -k pam 2026-06-02 13:02:07.276582 | debian-bookworm | +-w /etc/security/limits.d -p wa -k pam 2026-06-02 13:02:07.276676 | debian-bookworm | +-w /etc/security/pam_env.conf -p wa -k pam 2026-06-02 13:02:07.276773 | debian-bookworm | +-w /etc/security/namespace.conf -p wa -k pam 2026-06-02 13:02:07.276867 | debian-bookworm | +-w /etc/security/namespace.d -p wa -k pam 2026-06-02 13:02:07.276992 | debian-bookworm | +-w /etc/security/namespace.init -p wa -k pam 2026-06-02 13:02:07.277083 | debian-bookworm | + 2026-06-02 13:02:07.277182 | debian-bookworm | +## Mail configuration 2026-06-02 13:02:07.277275 | debian-bookworm | +-w /etc/aliases -p wa -k mail 2026-06-02 13:02:07.277372 | debian-bookworm | +-w /etc/postfix/ -p wa -k mail 2026-06-02 13:02:07.277467 | debian-bookworm | +-w /etc/exim4/ -p wa -k mail 2026-06-02 13:02:07.277558 | debian-bookworm | + 2026-06-02 13:02:07.277651 | debian-bookworm | +## SSH configuration 2026-06-02 13:02:07.277745 | debian-bookworm | +-w /etc/ssh/sshd_config -k sshd 2026-06-02 13:02:07.277839 | debian-bookworm | +-w /etc/ssh/sshd_config.d -k sshd 2026-06-02 13:02:07.277972 | debian-bookworm | + 2026-06-02 13:02:07.278038 | debian-bookworm | +## root ssh key tampering 2026-06-02 13:02:07.278132 | debian-bookworm | +-w /root/.ssh -p wa -k rootkey 2026-06-02 13:02:07.278222 | debian-bookworm | + 2026-06-02 13:02:07.278316 | debian-bookworm | +# Systemd 2026-06-02 13:02:07.278418 | debian-bookworm | +-w /bin/systemctl -p x -k systemd 2026-06-02 13:02:07.278505 | debian-bookworm | +-w /etc/systemd/ -p wa -k systemd 2026-06-02 13:02:07.278603 | debian-bookworm | +-w /usr/lib/systemd -p wa -k systemd 2026-06-02 13:02:07.278694 | debian-bookworm | + 2026-06-02 13:02:07.278793 | debian-bookworm | +## https://systemd.network/systemd.generator.html 2026-06-02 13:02:07.278891 | debian-bookworm | +-w /etc/systemd/system-generators/ -p wa -k systemd_generator 2026-06-02 13:02:07.278999 | debian-bookworm | +-w /usr/local/lib/systemd/system-generators/ -p wa -k systemd_generator 2026-06-02 13:02:07.279098 | debian-bookworm | +-w /usr/lib/systemd/system-generators -p wa -k systemd_generator 2026-06-02 13:02:07.279191 | debian-bookworm | + 2026-06-02 13:02:07.279287 | debian-bookworm | +-w /etc/systemd/user-generators/ -p wa -k systemd_generator 2026-06-02 13:02:07.279384 | debian-bookworm | +-w /usr/local/lib/systemd/user-generators/ -p wa -k systemd_generator 2026-06-02 13:02:07.279502 | debian-bookworm | +-w /lib/systemd/system-generators/ -p wa -k systemd_generator 2026-06-02 13:02:07.279575 | debian-bookworm | + 2026-06-02 13:02:07.279672 | debian-bookworm | +## SELinux events that modify the system's Mandatory Access Controls (MAC) 2026-06-02 13:02:07.279767 | debian-bookworm | +-w /etc/selinux/ -p wa -k mac_policy 2026-06-02 13:02:07.279860 | debian-bookworm | + 2026-06-02 13:02:07.280016 | debian-bookworm | +## Critical elements access failures 2026-06-02 13:02:07.280121 | debian-bookworm | +-a always,exit -F arch=b64 -S open -F dir=/etc -F success=0 -k unauthedfileaccess 2026-06-02 13:02:07.280224 | debian-bookworm | +-a always,exit -F arch=b64 -S open -F dir=/bin -F success=0 -k unauthedfileaccess 2026-06-02 13:02:07.280321 | debian-bookworm | +-a always,exit -F arch=b64 -S open -F dir=/sbin -F success=0 -k unauthedfileaccess 2026-06-02 13:02:07.280421 | debian-bookworm | +-a always,exit -F arch=b64 -S open -F dir=/usr/bin -F success=0 -k unauthedfileaccess 2026-06-02 13:02:07.280517 | debian-bookworm | +-a always,exit -F arch=b64 -S open -F dir=/usr/sbin -F success=0 -k unauthedfileaccess 2026-06-02 13:02:07.280614 | debian-bookworm | +-a always,exit -F arch=b64 -S open -F dir=/var -F success=0 -k unauthedfileaccess 2026-06-02 13:02:07.280712 | debian-bookworm | +-a always,exit -F arch=b64 -S open -F dir=/home -F success=0 -k unauthedfileaccess 2026-06-02 13:02:07.280809 | debian-bookworm | +-a always,exit -F arch=b64 -S open -F dir=/srv -F success=0 -k unauthedfileaccess 2026-06-02 13:02:07.280901 | debian-bookworm | + 2026-06-02 13:02:07.281037 | debian-bookworm | +## Process ID change (switching accounts) applications 2026-06-02 13:02:07.281132 | debian-bookworm | +-w /bin/su -p x -k priv_esc 2026-06-02 13:02:07.281229 | debian-bookworm | +-w /usr/bin/sudo -p x -k priv_esc 2026-06-02 13:02:07.281320 | debian-bookworm | + 2026-06-02 13:02:07.281416 | debian-bookworm | +## Power state 2026-06-02 13:02:07.281511 | debian-bookworm | +-w /sbin/shutdown -p x -k power 2026-06-02 13:02:07.281605 | debian-bookworm | +-w /sbin/poweroff -p x -k power 2026-06-02 13:02:07.281698 | debian-bookworm | +-w /sbin/reboot -p x -k power 2026-06-02 13:02:07.281794 | debian-bookworm | +-w /sbin/halt -p x -k power 2026-06-02 13:02:07.281887 | debian-bookworm | + 2026-06-02 13:02:07.281991 | debian-bookworm | +## Session initiation information 2026-06-02 13:02:07.282085 | debian-bookworm | +-w /var/run/utmp -p wa -k session 2026-06-02 13:02:07.282207 | debian-bookworm | +-w /var/log/btmp -p wa -k session 2026-06-02 13:02:07.282305 | debian-bookworm | +-w /var/log/wtmp -p wa -k session 2026-06-02 13:02:07.282396 | debian-bookworm | + 2026-06-02 13:02:07.282493 | debian-bookworm | +## Discretionary Access Control (DAC) modifications 2026-06-02 13:02:07.282592 | debian-bookworm | +-a always,exit -F arch=b64 -S chmod -F auid>=1000 -F auid!=-1 -k perm_mod 2026-06-02 13:02:07.282688 | debian-bookworm | +-a always,exit -F arch=b64 -S chown -F auid>=1000 -F auid!=-1 -k perm_mod 2026-06-02 13:02:07.282786 | debian-bookworm | +-a always,exit -F arch=b64 -S fchmod -F auid>=1000 -F auid!=-1 -k perm_mod 2026-06-02 13:02:07.282881 | debian-bookworm | +-a always,exit -F arch=b64 -S fchmodat -F auid>=1000 -F auid!=-1 -k perm_mod 2026-06-02 13:02:07.283013 | debian-bookworm | +-a always,exit -F arch=b64 -S fchown -F auid>=1000 -F auid!=-1 -k perm_mod 2026-06-02 13:02:07.283107 | debian-bookworm | +-a always,exit -F arch=b64 -S fchownat -F auid>=1000 -F auid!=-1 -k perm_mod 2026-06-02 13:02:07.283204 | debian-bookworm | +-a always,exit -F arch=b64 -S fremovexattr -F auid>=1000 -F auid!=-1 -k perm_mod 2026-06-02 13:02:07.283307 | debian-bookworm | +-a always,exit -F arch=b64 -S fsetxattr -F auid>=1000 -F auid!=-1 -k perm_mod 2026-06-02 13:02:07.283406 | debian-bookworm | +-a always,exit -F arch=b64 -S lchown -F auid>=1000 -F auid!=-1 -k perm_mod 2026-06-02 13:02:07.283504 | debian-bookworm | +-a always,exit -F arch=b64 -S lremovexattr -F auid>=1000 -F auid!=-1 -k perm_mod 2026-06-02 13:02:07.283600 | debian-bookworm | +-a always,exit -F arch=b64 -S lsetxattr -F auid>=1000 -F auid!=-1 -k perm_mod 2026-06-02 13:02:07.283698 | debian-bookworm | +-a always,exit -F arch=b64 -S removexattr -F auid>=1000 -F auid!=-1 -k perm_mod 2026-06-02 13:02:07.283812 | debian-bookworm | +-a always,exit -F arch=b64 -S setxattr -F auid>=1000 -F auid!=-1 -k perm_mod 2026-06-02 13:02:07.284001 | debian-bookworm | + 2026-06-02 13:02:07.284104 | debian-bookworm | +# Special Rules --------------------------------------------------------------- 2026-06-02 13:02:07.284196 | debian-bookworm | + 2026-06-02 13:02:07.284293 | debian-bookworm | +## Reconnaissance 2026-06-02 13:02:07.284393 | debian-bookworm | +-w /usr/bin/whoami -p x -k recon 2026-06-02 13:02:07.284485 | debian-bookworm | +-w /usr/bin/id -p x -k recon 2026-06-02 13:02:07.284583 | debian-bookworm | +-w /bin/hostname -p x -k recon 2026-06-02 13:02:07.284681 | debian-bookworm | +-w /bin/uname -p x -k recon 2026-06-02 13:02:07.284777 | debian-bookworm | +-w /etc/issue -p r -k recon 2026-06-02 13:02:07.284875 | debian-bookworm | +-w /etc/hostname -p r -k recon 2026-06-02 13:02:07.284975 | debian-bookworm | + 2026-06-02 13:02:07.285072 | debian-bookworm | +## Suspicious activity 2026-06-02 13:02:07.285168 | debian-bookworm | +-w /usr/bin/wget -p x -k susp_activity 2026-06-02 13:02:07.285268 | debian-bookworm | +-w /usr/bin/curl -p x -k susp_activity 2026-06-02 13:02:07.285363 | debian-bookworm | +-w /usr/bin/base64 -p x -k susp_activity 2026-06-02 13:02:07.285460 | debian-bookworm | +-w /bin/nc -p x -k susp_activity 2026-06-02 13:02:07.285555 | debian-bookworm | +-w /bin/netcat -p x -k susp_activity 2026-06-02 13:02:07.285662 | debian-bookworm | +-w /usr/bin/ncat -p x -k susp_activity 2026-06-02 13:02:07.285760 | debian-bookworm | +-w /usr/bin/ss -p x -k susp_activity 2026-06-02 13:02:07.285855 | debian-bookworm | +-w /usr/bin/netstat -p x -k susp_activity 2026-06-02 13:02:07.285977 | debian-bookworm | +-w /usr/bin/ssh -p x -k susp_activity 2026-06-02 13:02:07.286058 | debian-bookworm | +-w /usr/bin/scp -p x -k susp_activity 2026-06-02 13:02:07.286156 | debian-bookworm | +-w /usr/bin/sftp -p x -k susp_activity 2026-06-02 13:02:07.286253 | debian-bookworm | +-w /usr/bin/ftp -p x -k susp_activity 2026-06-02 13:02:07.286350 | debian-bookworm | +-w /usr/bin/socat -p x -k susp_activity 2026-06-02 13:02:07.286444 | debian-bookworm | +-w /usr/bin/wireshark -p x -k susp_activity 2026-06-02 13:02:07.286538 | debian-bookworm | +-w /usr/bin/tshark -p x -k susp_activity 2026-06-02 13:02:07.286635 | debian-bookworm | +-w /usr/bin/rawshark -p x -k susp_activity 2026-06-02 13:02:07.286733 | debian-bookworm | +-w /usr/bin/rdesktop -p x -k susp_activity 2026-06-02 13:02:07.286830 | debian-bookworm | +-w /usr/local/bin/rdesktop -p x -k susp_activity 2026-06-02 13:02:07.286946 | debian-bookworm | +-w /usr/bin/wlfreerdp -p x -k susp_activity 2026-06-02 13:02:07.287054 | debian-bookworm | +-w /usr/bin/xfreerdp -p x -k susp_activity 2026-06-02 13:02:07.287152 | debian-bookworm | +-w /usr/local/bin/xfreerdp -p x -k susp_activity 2026-06-02 13:02:07.287251 | debian-bookworm | +-w /usr/bin/nmap -p x -k susp_activity 2026-06-02 13:02:07.287343 | debian-bookworm | + 2026-06-02 13:02:07.287440 | debian-bookworm | +## sssd 2026-06-02 13:02:07.287546 | debian-bookworm | +-a always,exit -F path=/usr/libexec/sssd/p11_child -F perm=x -F auid>=500 -F auid!=4294967295 -k T1078_Valid_Accounts 2026-06-02 13:02:07.287644 | debian-bookworm | +-a always,exit -F path=/usr/libexec/sssd/krb5_child -F perm=x -F auid>=500 -F auid!=4294967295 -k T1078_Valid_Accounts 2026-06-02 13:02:07.287743 | debian-bookworm | +-a always,exit -F path=/usr/libexec/sssd/ldap_child -F perm=x -F auid>=500 -F auid!=4294967295 -k T1078_Valid_Accounts 2026-06-02 13:02:07.287842 | debian-bookworm | +-a always,exit -F path=/usr/libexec/sssd/selinux_child -F perm=x -F auid>=500 -F auid!=4294967295 -k T1078_Valid_Accounts 2026-06-02 13:02:07.287956 | debian-bookworm | +-a always,exit -F path=/usr/libexec/sssd/proxy_child -F perm=x -F auid>=500 -F auid!=4294967295 -k T1078_Valid_Accounts 2026-06-02 13:02:07.288072 | debian-bookworm | + 2026-06-02 13:02:07.288171 | debian-bookworm | +## T1002 Data Compressed 2026-06-02 13:02:07.288264 | debian-bookworm | + 2026-06-02 13:02:07.288361 | debian-bookworm | +-w /usr/bin/zip -p x -k Data_Compressed 2026-06-02 13:02:07.288460 | debian-bookworm | +-w /usr/bin/gzip -p x -k Data_Compressed 2026-06-02 13:02:07.288558 | debian-bookworm | +-w /usr/bin/tar -p x -k Data_Compressed 2026-06-02 13:02:07.288659 | debian-bookworm | +-w /usr/bin/bzip2 -p x -k Data_Compressed 2026-06-02 13:02:07.288754 | debian-bookworm | + 2026-06-02 13:02:07.288853 | debian-bookworm | +-w /usr/bin/lzip -p x -k Data_Compressed 2026-06-02 13:02:07.288986 | debian-bookworm | +-w /usr/local/bin/lzip -p x -k Data_Compressed 2026-06-02 13:02:07.289085 | debian-bookworm | + 2026-06-02 13:02:07.289196 | debian-bookworm | +-w /usr/bin/lz4 -p x -k Data_Compressed 2026-06-02 13:02:07.289314 | debian-bookworm | +-w /usr/local/bin/lz4 -p x -k Data_Compressed 2026-06-02 13:02:07.289392 | debian-bookworm | + 2026-06-02 13:02:07.289490 | debian-bookworm | +-w /usr/bin/lzop -p x -k Data_Compressed 2026-06-02 13:02:07.289586 | debian-bookworm | +-w /usr/local/bin/lzop -p x -k Data_Compressed 2026-06-02 13:02:07.289684 | debian-bookworm | + 2026-06-02 13:02:07.289779 | debian-bookworm | +-w /usr/bin/plzip -p x -k Data_Compressed 2026-06-02 13:02:07.289877 | debian-bookworm | +-w /usr/local/bin/plzip -p x -k Data_Compressed 2026-06-02 13:02:07.289985 | debian-bookworm | + 2026-06-02 13:02:07.290082 | debian-bookworm | +-w /usr/bin/pbzip2 -p x -k Data_Compressed 2026-06-02 13:02:07.290178 | debian-bookworm | +-w /usr/local/bin/pbzip2 -p x -k Data_Compressed 2026-06-02 13:02:07.290270 | debian-bookworm | + 2026-06-02 13:02:07.290406 | debian-bookworm | +-w /usr/bin/lbzip2 -p x -k Data_Compressed 2026-06-02 13:02:07.290471 | debian-bookworm | +-w /usr/local/bin/lbzip2 -p x -k Data_Compressed 2026-06-02 13:02:07.290561 | debian-bookworm | + 2026-06-02 13:02:07.290657 | debian-bookworm | +-w /usr/bin/pixz -p x -k Data_Compressed 2026-06-02 13:02:07.290750 | debian-bookworm | +-w /usr/local/bin/pixz -p x -k Data_Compressed 2026-06-02 13:02:07.290841 | debian-bookworm | + 2026-06-02 13:02:07.290961 | debian-bookworm | +-w /usr/bin/pigz -p x -k Data_Compressed 2026-06-02 13:02:07.291060 | debian-bookworm | +-w /usr/local/bin/pigz -p x -k Data_Compressed 2026-06-02 13:02:07.291156 | debian-bookworm | +-w /usr/bin/unpigz -p x -k Data_Compressed 2026-06-02 13:02:07.291258 | debian-bookworm | +-w /usr/local/bin/unpigz -p x -k Data_Compressed 2026-06-02 13:02:07.291349 | debian-bookworm | + 2026-06-02 13:02:07.291463 | debian-bookworm | +-w /usr/bin/zstd -p x -k Data_Compressed 2026-06-02 13:02:07.291554 | debian-bookworm | +-w /usr/local/bin/zstd -p x -k Data_Compressed 2026-06-02 13:02:07.291669 | debian-bookworm | + 2026-06-02 13:02:07.291774 | debian-bookworm | +## Added to catch netcat on Ubuntu 2026-06-02 13:02:07.291886 | debian-bookworm | +-w /bin/nc.openbsd -p x -k susp_activity 2026-06-02 13:02:07.292065 | debian-bookworm | +-w /bin/nc.traditional -p x -k susp_activity 2026-06-02 13:02:07.292178 | debian-bookworm | + 2026-06-02 13:02:07.292289 | debian-bookworm | +## Sbin suspicious activity 2026-06-02 13:02:07.292389 | debian-bookworm | +-w /sbin/iptables -p x -k sbin_susp 2026-06-02 13:02:07.292485 | debian-bookworm | +-w /sbin/ip6tables -p x -k sbin_susp 2026-06-02 13:02:07.292584 | debian-bookworm | +-w /sbin/ifconfig -p x -k sbin_susp 2026-06-02 13:02:07.292682 | debian-bookworm | +-w /usr/sbin/arptables -p x -k sbin_susp 2026-06-02 13:02:07.292780 | debian-bookworm | +-w /usr/sbin/ebtables -p x -k sbin_susp 2026-06-02 13:02:07.292888 | debian-bookworm | +-w /sbin/xtables-nft-multi -p x -k sbin_susp 2026-06-02 13:02:07.293004 | debian-bookworm | +-w /usr/sbin/nft -p x -k sbin_susp 2026-06-02 13:02:07.293101 | debian-bookworm | +-w /usr/sbin/tcpdump -p x -k sbin_susp 2026-06-02 13:02:07.293196 | debian-bookworm | +-w /usr/sbin/traceroute -p x -k sbin_susp 2026-06-02 13:02:07.293293 | debian-bookworm | +-w /usr/sbin/ufw -p x -k sbin_susp 2026-06-02 13:02:07.293387 | debian-bookworm | + 2026-06-02 13:02:07.293482 | debian-bookworm | +### kde4 2026-06-02 13:02:07.293584 | debian-bookworm | +-a always,exit -F path=/usr/libexec/kde4/kpac_dhcp_helper -F perm=x -F auid>=1000 -F auid!=4294967295 -k T1078_Valid_Accounts 2026-06-02 13:02:07.293686 | debian-bookworm | +-a always,exit -F path=/usr/libexec/kde4/kdesud -F perm=x -F auid>=1000 -F auid!=4294967295 -k T1078_Valid_Accounts 2026-06-02 13:02:07.293778 | debian-bookworm | + 2026-06-02 13:02:07.293877 | debian-bookworm | +## dbus-send invocation 2026-06-02 13:02:07.293995 | debian-bookworm | +### may indicate privilege escalation CVE-2021-3560 2026-06-02 13:02:07.294089 | debian-bookworm | +-w /usr/bin/dbus-send -p x -k dbus_send 2026-06-02 13:02:07.294184 | debian-bookworm | +-w /usr/bin/gdbus -p x -k gdubs_call 2026-06-02 13:02:07.294273 | debian-bookworm | + 2026-06-02 13:02:07.294368 | debian-bookworm | +## pkexec invocation 2026-06-02 13:02:07.294467 | debian-bookworm | +### may indicate privilege escalation CVE-2021-4034 2026-06-02 13:02:07.294563 | debian-bookworm | +-w /usr/bin/pkexec -p x -k pkexec 2026-06-02 13:02:07.294653 | debian-bookworm | + 2026-06-02 13:02:07.294746 | debian-bookworm | +## Suspicious shells 2026-06-02 13:02:07.294839 | debian-bookworm | +-w /bin/ash -p x -k susp_shell 2026-06-02 13:02:07.294978 | debian-bookworm | +-w /bin/csh -p x -k susp_shell 2026-06-02 13:02:07.295085 | debian-bookworm | +-w /bin/fish -p x -k susp_shell 2026-06-02 13:02:07.295181 | debian-bookworm | +-w /bin/tcsh -p x -k susp_shell 2026-06-02 13:02:07.295275 | debian-bookworm | +-w /bin/tclsh -p x -k susp_shell 2026-06-02 13:02:07.295372 | debian-bookworm | +-w /bin/xonsh -p x -k susp_shell 2026-06-02 13:02:07.295470 | debian-bookworm | +-w /usr/local/bin/xonsh -p x -k susp_shell 2026-06-02 13:02:07.295561 | debian-bookworm | +-w /bin/open -p x -k susp_shell 2026-06-02 13:02:07.295658 | debian-bookworm | +-w /bin/rbash -p x -k susp_shell 2026-06-02 13:02:07.295749 | debian-bookworm | + 2026-06-02 13:02:07.295845 | debian-bookworm | +# Web Server Actvity 2026-06-02 13:02:07.296013 | debian-bookworm | +## Change the number "33" to the ID of your WebServer user. Default: www-data:x:33:33 2026-06-02 13:02:07.296253 | debian-bookworm | +-a always,exit -F arch=b64 -S execve -F euid=33 -k detect_execve_www 2026-06-02 13:02:07.296264 | debian-bookworm | + 2026-06-02 13:02:07.296312 | debian-bookworm | +### https://clustershell.readthedocs.io/ 2026-06-02 13:02:07.296399 | debian-bookworm | +-w /bin/clush -p x -k susp_shell 2026-06-02 13:02:07.296652 | debian-bookworm | +-w /usr/local/bin/clush -p x -k susp_shell 2026-06-02 13:02:07.296661 | debian-bookworm | +-w /etc/clustershell/clush.conf -p x -k susp_shell 2026-06-02 13:02:07.296680 | debian-bookworm | + 2026-06-02 13:02:07.296773 | debian-bookworm | +### https://github.com/tmux/tmux 2026-06-02 13:02:07.296882 | debian-bookworm | +-w /bin/tmux -p x -k susp_shell 2026-06-02 13:02:07.296975 | debian-bookworm | +-w /usr/local/bin/tmux -p x -k susp_shell 2026-06-02 13:02:07.297067 | debian-bookworm | + 2026-06-02 13:02:07.297171 | debian-bookworm | +## Shell/profile configurations 2026-06-02 13:02:07.297268 | debian-bookworm | +-w /etc/profile.d/ -p wa -k shell_profiles 2026-06-02 13:02:07.297364 | debian-bookworm | +-w /etc/profile -p wa -k shell_profiles 2026-06-02 13:02:07.297458 | debian-bookworm | +-w /etc/shells -p wa -k shell_profiles 2026-06-02 13:02:07.297567 | debian-bookworm | +-w /etc/bashrc -p wa -k shell_profiles 2026-06-02 13:02:07.297675 | debian-bookworm | +-w /etc/csh.cshrc -p wa -k shell_profiles 2026-06-02 13:02:07.297768 | debian-bookworm | +-w /etc/csh.login -p wa -k shell_profiles 2026-06-02 13:02:07.297864 | debian-bookworm | +-w /etc/fish/ -p wa -k shell_profiles 2026-06-02 13:02:07.298033 | debian-bookworm | +-w /etc/zsh/ -p wa -k shell_profiles 2026-06-02 13:02:07.298081 | debian-bookworm | + 2026-06-02 13:02:07.298176 | debian-bookworm | +### https://github.com/xxh/xxh 2026-06-02 13:02:07.298270 | debian-bookworm | +-w /usr/local/bin/xxh.bash -p x -k susp_shell 2026-06-02 13:02:07.298364 | debian-bookworm | +-w /usr/local/bin/xxh.xsh -p x -k susp_shell 2026-06-02 13:02:07.298458 | debian-bookworm | +-w /usr/local/bin/xxh.zsh -p x -k susp_shell 2026-06-02 13:02:07.298552 | debian-bookworm | + 2026-06-02 13:02:07.298648 | debian-bookworm | +## Injection 2026-06-02 13:02:07.298745 | debian-bookworm | +### These rules watch for code injection by the ptrace facility. 2026-06-02 13:02:07.298842 | debian-bookworm | +### This could indicate someone trying to do something bad or just debugging 2026-06-02 13:02:07.298955 | debian-bookworm | +-a always,exit -F arch=b64 -S ptrace -F a0=0x4 -k code_injection 2026-06-02 13:02:07.299055 | debian-bookworm | +-a always,exit -F arch=b64 -S ptrace -F a0=0x5 -k data_injection 2026-06-02 13:02:07.299150 | debian-bookworm | +-a always,exit -F arch=b64 -S ptrace -F a0=0x6 -k register_injection 2026-06-02 13:02:07.299245 | debian-bookworm | +-a always,exit -F arch=b64 -S ptrace -k tracing 2026-06-02 13:02:07.299339 | debian-bookworm | + 2026-06-02 13:02:07.299434 | debian-bookworm | +## Anonymous File Creation 2026-06-02 13:02:07.299531 | debian-bookworm | +### These rules watch the use of memfd_create 2026-06-02 13:02:07.299630 | debian-bookworm | +### "memfd_create" creates anonymous file and returns a file descriptor to access it 2026-06-02 13:02:07.299742 | debian-bookworm | +### When combined with "fexecve" can be used to stealthily run binaries in memory without touching disk 2026-06-02 13:02:07.299834 | debian-bookworm | +-a always,exit -F arch=b64 -S memfd_create -F key=anon_file_create 2026-06-02 13:02:07.299948 | debian-bookworm | + 2026-06-02 13:02:07.300078 | debian-bookworm | +## Privilege Abuse 2026-06-02 13:02:07.300193 | debian-bookworm | +### The purpose of this rule is to detect when an admin may be abusing power by looking in user's home dir. 2026-06-02 13:02:07.300293 | debian-bookworm | +-a always,exit -F dir=/home -F uid=0 -F auid>=1000 -F auid!=-1 -C auid!=obj_uid -k power_abuse 2026-06-02 13:02:07.300389 | debian-bookworm | + 2026-06-02 13:02:07.300493 | debian-bookworm | +# Socket Creations 2026-06-02 13:02:07.300588 | debian-bookworm | +# will catch both IPv4 and IPv6 2026-06-02 13:02:07.300687 | debian-bookworm | + 2026-06-02 13:02:07.300790 | debian-bookworm | +-a always,exit -F arch=b32 -S socket -F a0=2 -k network_socket_created 2026-06-02 13:02:07.300893 | debian-bookworm | +-a always,exit -F arch=b64 -S socket -F a0=2 -k network_socket_created 2026-06-02 13:02:07.301001 | debian-bookworm | + 2026-06-02 13:02:07.301127 | debian-bookworm | +-a always,exit -F arch=b32 -S socket -F a0=10 -k network_socket_created 2026-06-02 13:02:07.301207 | debian-bookworm | +-a always,exit -F arch=b64 -S socket -F a0=10 -k network_socket_created 2026-06-02 13:02:07.301441 | debian-bookworm | + 2026-06-02 13:02:07.301526 | debian-bookworm | +# Software Management --------------------------------------------------------- 2026-06-02 13:02:07.301541 | debian-bookworm | + 2026-06-02 13:02:07.301601 | debian-bookworm | +# RPM (Redhat/CentOS) 2026-06-02 13:02:07.301694 | debian-bookworm | +-w /usr/bin/rpm -p x -k software_mgmt 2026-06-02 13:02:07.301791 | debian-bookworm | +-w /usr/bin/yum -p x -k software_mgmt 2026-06-02 13:02:07.301884 | debian-bookworm | + 2026-06-02 13:02:07.301991 | debian-bookworm | +# DNF (Fedora/RedHat 8/CentOS 8) 2026-06-02 13:02:07.302086 | debian-bookworm | +-w /usr/bin/dnf -p x -k software_mgmt 2026-06-02 13:02:07.302179 | debian-bookworm | + 2026-06-02 13:02:07.302276 | debian-bookworm | +# YAST/Zypper/RPM (SuSE) 2026-06-02 13:02:07.302422 | debian-bookworm | +-w /sbin/yast -p x -k software_mgmt 2026-06-02 13:02:07.302471 | debian-bookworm | +-w /sbin/yast2 -p x -k software_mgmt 2026-06-02 13:02:07.302565 | debian-bookworm | +-w /bin/rpm -p x -k software_mgmt 2026-06-02 13:02:07.302668 | debian-bookworm | +-w /usr/bin/zypper -k software_mgmt 2026-06-02 13:02:07.302760 | debian-bookworm | + 2026-06-02 13:02:07.302859 | debian-bookworm | +# DPKG / APT-GET (Debian/Ubuntu) 2026-06-02 13:02:07.302988 | debian-bookworm | +-w /usr/bin/dpkg -p x -k software_mgmt 2026-06-02 13:02:07.303085 | debian-bookworm | +-w /usr/bin/apt -p x -k software_mgmt 2026-06-02 13:02:07.303186 | debian-bookworm | +-w /usr/bin/apt-add-repository -p x -k software_mgmt 2026-06-02 13:02:07.303281 | debian-bookworm | +-w /usr/bin/apt-get -p x -k software_mgmt 2026-06-02 13:02:07.303375 | debian-bookworm | +-w /usr/bin/aptitude -p x -k software_mgmt 2026-06-02 13:02:07.303508 | debian-bookworm | +-w /usr/bin/wajig -p x -k software_mgmt 2026-06-02 13:02:07.303570 | debian-bookworm | +-w /usr/bin/snap -p x -k software_mgmt 2026-06-02 13:02:07.303664 | debian-bookworm | + 2026-06-02 13:02:07.303758 | debian-bookworm | +# PIP(3) (Python installs) 2026-06-02 13:02:07.303859 | debian-bookworm | +-w /usr/bin/pip -p x -k third_party_software_mgmt 2026-06-02 13:02:07.304010 | debian-bookworm | +-w /usr/local/bin/pip -p x -k third_party_software_mgmt 2026-06-02 13:02:07.304091 | debian-bookworm | +-w /usr/bin/pip3 -p x -k third_party_software_mgmt 2026-06-02 13:02:07.304189 | debian-bookworm | +-w /usr/local/bin/pip3 -p x -k third_party_software_mgmt 2026-06-02 13:02:07.304299 | debian-bookworm | +-w /usr/bin/pipx -p x -k third_party_software_mgmt 2026-06-02 13:02:07.304382 | debian-bookworm | +-w /usr/local/bin/pipx -p x -k third_party_software_mgmt 2026-06-02 13:02:07.304477 | debian-bookworm | + 2026-06-02 13:02:07.304615 | debian-bookworm | +# npm 2026-06-02 13:02:07.304673 | debian-bookworm | +## T1072 third party software 2026-06-02 13:02:07.304769 | debian-bookworm | +## https://www.npmjs.com 2026-06-02 13:02:07.304867 | debian-bookworm | +## https://docs.npmjs.com/cli/v6/commands/npm-audit 2026-06-02 13:02:07.305049 | debian-bookworm | +-w /usr/bin/npm -p x -k third_party_software_mgmt 2026-06-02 13:02:07.305094 | debian-bookworm | + 2026-06-02 13:02:07.305169 | debian-bookworm | +# Comprehensive Perl Archive Network (CPAN) (CPAN installs) 2026-06-02 13:02:07.305265 | debian-bookworm | +## T1072 third party software 2026-06-02 13:02:07.305360 | debian-bookworm | +## https://www.cpan.org 2026-06-02 13:02:07.305458 | debian-bookworm | +-w /usr/bin/cpan -p x -k third_party_software_mgmt 2026-06-02 13:02:07.305550 | debian-bookworm | + 2026-06-02 13:02:07.305657 | debian-bookworm | +# Ruby (RubyGems installs) 2026-06-02 13:02:07.305742 | debian-bookworm | +## T1072 third party software 2026-06-02 13:02:07.305856 | debian-bookworm | +## https://rubygems.org 2026-06-02 13:02:07.305980 | debian-bookworm | +-w /usr/bin/gem -p x -k third_party_software_mgmt 2026-06-02 13:02:07.306076 | debian-bookworm | + 2026-06-02 13:02:07.306172 | debian-bookworm | +# LuaRocks (Lua installs) 2026-06-02 13:02:07.306267 | debian-bookworm | +## T1072 third party software 2026-06-02 13:02:07.306362 | debian-bookworm | +## https://luarocks.org 2026-06-02 13:02:07.306465 | debian-bookworm | +-w /usr/bin/luarocks -p x -k third_party_software_mgmt 2026-06-02 13:02:07.306561 | debian-bookworm | + 2026-06-02 13:02:07.306656 | debian-bookworm | +# Pacman (Arch Linux) 2026-06-02 13:02:07.306774 | debian-bookworm | +## https://wiki.archlinux.org/title/Pacman 2026-06-02 13:02:07.306847 | debian-bookworm | +## T1072 third party software 2026-06-02 13:02:07.307044 | debian-bookworm | +-w /etc/pacman.conf -p x -k third_party_software_mgmt 2026-06-02 13:02:07.307095 | debian-bookworm | +-w /etc/pacman.d -p x -k third_party_software_mgmt 2026-06-02 13:02:07.307173 | debian-bookworm | + 2026-06-02 13:02:07.307286 | debian-bookworm | +# Special Software ------------------------------------------------------------ 2026-06-02 13:02:07.307383 | debian-bookworm | + 2026-06-02 13:02:07.307474 | debian-bookworm | +## GDS specific secrets 2026-06-02 13:02:07.307572 | debian-bookworm | +-w /etc/puppet/ssl -p wa -k puppet_ssl 2026-06-02 13:02:07.307665 | debian-bookworm | + 2026-06-02 13:02:07.307759 | debian-bookworm | +## IBM Bigfix BESClient 2026-06-02 13:02:07.307879 | debian-bookworm | +-a always,exit -F arch=b64 -S open -F dir=/opt/BESClient -F success=0 -k soft_besclient 2026-06-02 13:02:07.307992 | debian-bookworm | +-w /var/opt/BESClient/ -p wa -k soft_besclient 2026-06-02 13:02:07.308214 | debian-bookworm | + 2026-06-02 13:02:07.308300 | debian-bookworm | +## CHEF https://www.chef.io/chef/ 2026-06-02 13:02:07.308392 | debian-bookworm | +-w /etc/chef -p wa -k soft_chef 2026-06-02 13:02:07.308485 | debian-bookworm | + 2026-06-02 13:02:07.308583 | debian-bookworm | +## Salt 2026-06-02 13:02:07.308675 | debian-bookworm | +## https://saltproject.io/ 2026-06-02 13:02:07.308777 | debian-bookworm | +## https://docs.saltproject.io/en/latest/ref/configuration/master.html 2026-06-02 13:02:07.308874 | debian-bookworm | +-w /etc/salt -p wa -k soft_salt 2026-06-02 13:02:07.309007 | debian-bookworm | +-w /usr/local/etc/salt -p wa -k soft_salt 2026-06-02 13:02:07.309107 | debian-bookworm | + 2026-06-02 13:02:07.309202 | debian-bookworm | +## Otter 2026-06-02 13:02:07.309297 | debian-bookworm | +## https://inedo.com/otter 2026-06-02 13:02:07.309392 | debian-bookworm | +-w /etc/otter -p wa -k soft_otter 2026-06-02 13:02:07.309484 | debian-bookworm | + 2026-06-02 13:02:07.309580 | debian-bookworm | +## T1081 Credentials In Files 2026-06-02 13:02:07.309686 | debian-bookworm | +-w /usr/bin/grep -p x -k string_search 2026-06-02 13:02:07.309769 | debian-bookworm | +-w /usr/bin/egrep -p x -k string_search 2026-06-02 13:02:07.309865 | debian-bookworm | +-w /usr/bin/ugrep -p x -k string_search 2026-06-02 13:02:07.309971 | debian-bookworm | +### macOS 2026-06-02 13:02:07.311155 | debian-bookworm | +-w /usr/local/bin/grep -p x -k string_search 2026-06-02 13:02:07.311189 | debian-bookworm | +-w /usr/local/bin/egrep -p x -k string_search 2026-06-02 13:02:07.311195 | debian-bookworm | +-w /usr/local/bin/ugrep -p x -k string_search 2026-06-02 13:02:07.311200 | debian-bookworm | + 2026-06-02 13:02:07.311205 | debian-bookworm | +### https://github.com/tmbinc/bgrep 2026-06-02 13:02:07.311210 | debian-bookworm | +-w /usr/bin/bgrep -p x -k string_search 2026-06-02 13:02:07.311234 | debian-bookworm | +### macOS 2026-06-02 13:02:07.311240 | debian-bookworm | +-w /usr/local/bin/bgrep -p x -k string_search 2026-06-02 13:02:07.311256 | debian-bookworm | + 2026-06-02 13:02:07.311262 | debian-bookworm | +### https://github.com/BurntSushi/ripgrep 2026-06-02 13:02:07.311266 | debian-bookworm | +-w /usr/bin/rg -p x -k string_search 2026-06-02 13:02:07.311271 | debian-bookworm | +### macOS 2026-06-02 13:02:07.311281 | debian-bookworm | +-w /usr/local/bin/rg -p x -k string_search 2026-06-02 13:02:07.311286 | debian-bookworm | + 2026-06-02 13:02:07.311340 | debian-bookworm | +### https://github.com/awgn/cgrep 2026-06-02 13:02:07.311434 | debian-bookworm | + 2026-06-02 13:02:07.311542 | debian-bookworm | +-w /usr/bin/cgrep -p x -k string_search 2026-06-02 13:02:07.311623 | debian-bookworm | +### macOS 2026-06-02 13:02:07.311769 | debian-bookworm | +-w /usr/local/bin/cgrep -p x -k string_search 2026-06-02 13:02:07.311806 | debian-bookworm | + 2026-06-02 13:02:07.311899 | debian-bookworm | +### https://github.com/jpr5/ngrep 2026-06-02 13:02:07.312036 | debian-bookworm | +-w /usr/bin/ngrep -p x -k string_search 2026-06-02 13:02:07.312130 | debian-bookworm | +### macOS 2026-06-02 13:02:07.312227 | debian-bookworm | +-w /usr/local/bin/ngrep -p x -k string_search 2026-06-02 13:02:07.312320 | debian-bookworm | + 2026-06-02 13:02:07.312444 | debian-bookworm | +### https://github.com/vrothberg/vgrep 2026-06-02 13:02:07.312517 | debian-bookworm | +-w /usr/bin/vgrep -p x -k string_search 2026-06-02 13:02:07.312611 | debian-bookworm | +### macOS 2026-06-02 13:02:07.312702 | debian-bookworm | +-w /usr/local/bin/vgrep -p x -k string_search 2026-06-02 13:02:07.312802 | debian-bookworm | + 2026-06-02 13:02:07.312902 | debian-bookworm | +### https://github.com/monochromegane/the_platinum_searcher 2026-06-02 13:02:07.313025 | debian-bookworm | +-w /usr/bin/pt -p x -k string_search 2026-06-02 13:02:07.313116 | debian-bookworm | +### macOS 2026-06-02 13:02:07.313217 | debian-bookworm | +-w /usr/local/bin/pt -p x -k string_search 2026-06-02 13:02:07.313305 | debian-bookworm | + 2026-06-02 13:02:07.313404 | debian-bookworm | +### https://github.com/gvansickle/ucg 2026-06-02 13:02:07.313555 | debian-bookworm | +-w /usr/bin/ucg -p x -k string_search 2026-06-02 13:02:07.313591 | debian-bookworm | +### macOS 2026-06-02 13:02:07.313691 | debian-bookworm | +-w /usr/local/bin/ucg -p x -k string_search 2026-06-02 13:02:07.313786 | debian-bookworm | + 2026-06-02 13:02:07.313885 | debian-bookworm | +### https://github.com/ggreer/the_silver_searcher 2026-06-02 13:02:07.314000 | debian-bookworm | +-w /usr/bin/ag -p x -k string_search 2026-06-02 13:02:07.314094 | debian-bookworm | +### macOS 2026-06-02 13:02:07.314197 | debian-bookworm | +-w /usr/local/bin/ag -p x -k string_search 2026-06-02 13:02:07.314289 | debian-bookworm | + 2026-06-02 13:02:07.314390 | debian-bookworm | +### https://github.com/beyondgrep/ack3 2026-06-02 13:02:07.314484 | debian-bookworm | +### https://beyondgrep.com 2026-06-02 13:02:07.314604 | debian-bookworm | +-w /usr/bin/ack -p x -k string_search 2026-06-02 13:02:07.314677 | debian-bookworm | +-w /usr/local/bin/ack -p x -k string_search 2026-06-02 13:02:07.314844 | debian-bookworm | +-w /usr/bin/semgrep -p x -k string_search 2026-06-02 13:02:07.314886 | debian-bookworm | +### macOS 2026-06-02 13:02:07.314986 | debian-bookworm | +-w /usr/local/bin/semgrep -p x -k string_search 2026-06-02 13:02:07.315082 | debian-bookworm | + 2026-06-02 13:02:07.315177 | debian-bookworm | +## Docker 2026-06-02 13:02:07.315272 | debian-bookworm | +-w /usr/bin/dockerd -k docker 2026-06-02 13:02:07.315368 | debian-bookworm | +-w /usr/bin/docker -k docker 2026-06-02 13:02:07.315467 | debian-bookworm | +-w /usr/bin/docker-containerd -k docker 2026-06-02 13:02:07.315560 | debian-bookworm | +-w /usr/bin/docker-runc -k docker 2026-06-02 13:02:07.315650 | debian-bookworm | +-w /var/lib/docker -p wa -k docker 2026-06-02 13:02:07.315751 | debian-bookworm | +-w /etc/docker -k docker 2026-06-02 13:02:07.315841 | debian-bookworm | +-w /etc/sysconfig/docker -k docker 2026-06-02 13:02:07.316091 | debian-bookworm | +-w /etc/sysconfig/docker-storage -k docker 2026-06-02 13:02:07.316134 | debian-bookworm | +-w /usr/lib/systemd/system/docker.service -k docker 2026-06-02 13:02:07.316163 | debian-bookworm | +-w /usr/lib/systemd/system/docker.socket -k docker 2026-06-02 13:02:07.316258 | debian-bookworm | + 2026-06-02 13:02:07.316352 | debian-bookworm | +## Virtualization stuff 2026-06-02 13:02:07.316446 | debian-bookworm | +-w /usr/bin/qemu-system-x86_64 -p x -k qemu-system-x86_64 2026-06-02 13:02:07.316539 | debian-bookworm | +-w /usr/bin/qemu-img -p x -k qemu-img 2026-06-02 13:02:07.316635 | debian-bookworm | +-w /usr/bin/qemu-kvm -p x -k qemu-kvm 2026-06-02 13:02:07.316728 | debian-bookworm | +-w /usr/bin/qemu -p x -k qemu 2026-06-02 13:02:07.316878 | debian-bookworm | +-w /usr/bin/virtualbox -p x -k virtualbox 2026-06-02 13:02:07.316974 | debian-bookworm | +-w /usr/bin/virt-manager -p x -k virt-manager 2026-06-02 13:02:07.317038 | debian-bookworm | +-w /usr/bin/VBoxManage -p x -k VBoxManage 2026-06-02 13:02:07.317128 | debian-bookworm | + 2026-06-02 13:02:07.317298 | debian-bookworm | +#### VirtualBox on macOS 2026-06-02 13:02:07.317391 | debian-bookworm | + 2026-06-02 13:02:07.317488 | debian-bookworm | +-w /usr/local/bin/VirtualBox -p x -k virt_tool 2026-06-02 13:02:07.317582 | debian-bookworm | +-w /usr/local/bin/VirtualBoxVM -p x -k virt_tool 2026-06-02 13:02:07.317681 | debian-bookworm | +-w /usr/local/bin/VBoxManage -p x -k virt_tool 2026-06-02 13:02:07.317775 | debian-bookworm | +-w /usr/local/bin/VBoxVRDP -p x -k virt_tool 2026-06-02 13:02:07.317871 | debian-bookworm | +-w /usr/local/bin/VBoxHeadless -p x -k virt_tool 2026-06-02 13:02:07.317986 | debian-bookworm | +-w /usr/local/bin/vboxwebsrv -p x -k virt_tool 2026-06-02 13:02:07.318077 | debian-bookworm | +-w /usr/local/bin/VBoxBugReport -p x -k virt_tool 2026-06-02 13:02:07.318171 | debian-bookworm | +-w /usr/local/bin/VBoxBalloonCtrl -p x -k virt_tool 2026-06-02 13:02:07.318269 | debian-bookworm | +-w /usr/local/bin/VBoxAutostart -p x -k virt_tool 2026-06-02 13:02:07.318365 | debian-bookworm | +-w /usr/local/bin/VBoxDTrace -p x -k virt_tool 2026-06-02 13:02:07.318461 | debian-bookworm | +-w /usr/local/bin/vbox-img -p x -k virt_tool 2026-06-02 13:02:07.318560 | debian-bookworm | +-w /Library/LaunchDaemons/org.virtualbox.startup.plist -p x -k virt_tool 2026-06-02 13:02:07.318658 | debian-bookworm | +-w /Library/Application Support/VirtualBox/LaunchDaemons/ -p x -k virt_tool 2026-06-02 13:02:07.318757 | debian-bookworm | +-w /Library/Application Support/VirtualBox/VBoxDrv.kext/ -p x -k virt_tool 2026-06-02 13:02:07.318855 | debian-bookworm | +-w /Library/Application Support/VirtualBox/VBoxUSB.kext/ -p x -k virt_tool 2026-06-02 13:02:07.318962 | debian-bookworm | +-w /Library/Application Support/VirtualBox/VBoxNetFlt.kext/ -p x -k virt_tool 2026-06-02 13:02:07.319062 | debian-bookworm | +-w /Library/Application Support/VirtualBox/VBoxNetAdp.kext/ -p x -k virt_tool 2026-06-02 13:02:07.319148 | debian-bookworm | + 2026-06-02 13:02:07.319244 | debian-bookworm | +### Parallels Desktop on macOS 2026-06-02 13:02:07.319333 | debian-bookworm | + 2026-06-02 13:02:07.319426 | debian-bookworm | +-w /usr/local/bin/prl_convert -p x -k virt_tool 2026-06-02 13:02:07.319521 | debian-bookworm | +-w /usr/local/bin/prl_disk_tool -p x -k virt_tool 2026-06-02 13:02:07.319615 | debian-bookworm | +-w /usr/local/bin/prl_perf_ctl -p x -k virt_tool 2026-06-02 13:02:07.319710 | debian-bookworm | +-w /usr/local/bin/prlcore2dmp -p x -k virt_tool 2026-06-02 13:02:07.319811 | debian-bookworm | +-w /usr/local/bin/prlctl -p x -k virt_tool 2026-06-02 13:02:07.319905 | debian-bookworm | +-w /usr/local/bin/prlexec -p x -k virt_tool 2026-06-02 13:02:07.320037 | debian-bookworm | +-w /usr/local/bin/prlsrvctl -p x -k virt_tool 2026-06-02 13:02:07.320159 | debian-bookworm | +-w /Library/Preferences/Parallels -p x -k virt_tool 2026-06-02 13:02:07.320235 | debian-bookworm | + 2026-06-02 13:02:07.320332 | debian-bookworm | +### qemu on macOS 2026-06-02 13:02:07.320421 | debian-bookworm | + 2026-06-02 13:02:07.320516 | debian-bookworm | +-w /usr/local/bin/qemu-edid -p x -k virt_tool 2026-06-02 13:02:07.320611 | debian-bookworm | +-w /usr/local/bin/qemu-img -p x -k virt_tool 2026-06-02 13:02:07.320707 | debian-bookworm | +-w /usr/local/bin/qemu-io -p x -k virt_tool 2026-06-02 13:02:07.320802 | debian-bookworm | +-w /usr/local/bin/qemu-nbd -p x -k virt_tool 2026-06-02 13:02:07.320901 | debian-bookworm | +-w /usr/local/bin/qemu-system-x86_64 -p x -k virt_tool 2026-06-02 13:02:07.321020 | debian-bookworm | + 2026-06-02 13:02:07.321115 | debian-bookworm | +## Kubelet 2026-06-02 13:02:07.321249 | debian-bookworm | +-w /usr/bin/kubelet -k kubelet 2026-06-02 13:02:07.321300 | debian-bookworm | + 2026-06-02 13:02:07.321398 | debian-bookworm | +# ipc system call 2026-06-02 13:02:07.321493 | debian-bookworm | +# /usr/include/linux/ipc.h 2026-06-02 13:02:07.321584 | debian-bookworm | + 2026-06-02 13:02:07.321693 | debian-bookworm | +## msgctl 2026-06-02 13:02:07.321780 | debian-bookworm | +#-a always,exit -S ipc -F a0=14 -k Inter-Process_Communication 2026-06-02 13:02:07.321874 | debian-bookworm | +## msgget 2026-06-02 13:02:07.321987 | debian-bookworm | +#-a always,exit -S ipc -F a0=13 -k Inter-Process_Communication 2026-06-02 13:02:07.322084 | debian-bookworm | +## Use these lines on x86_64, ia64 instead 2026-06-02 13:02:07.322182 | debian-bookworm | +-a always,exit -F arch=b64 -S msgctl -k Inter-Process_Communication 2026-06-02 13:02:07.322277 | debian-bookworm | +-a always,exit -F arch=b64 -S msgget -k Inter-Process_Communication 2026-06-02 13:02:07.322372 | debian-bookworm | + 2026-06-02 13:02:07.322467 | debian-bookworm | +## semctl 2026-06-02 13:02:07.322563 | debian-bookworm | +#-a always,exit -S ipc -F a0=3 -k Inter-Process_Communication 2026-06-02 13:02:07.322656 | debian-bookworm | +## semget 2026-06-02 13:02:07.322753 | debian-bookworm | +#-a always,exit -S ipc -F a0=2 -k Inter-Process_Communication 2026-06-02 13:02:07.322847 | debian-bookworm | +## semop 2026-06-02 13:02:07.322960 | debian-bookworm | +#-a always,exit -S ipc -F a0=1 -k Inter-Process_Communication 2026-06-02 13:02:07.323055 | debian-bookworm | +## semtimedop 2026-06-02 13:02:07.323149 | debian-bookworm | +#-a always,exit -S ipc -F a0=4 -k Inter-Process_Communication 2026-06-02 13:02:07.323247 | debian-bookworm | +## Use these lines on x86_64, ia64 instead 2026-06-02 13:02:07.323345 | debian-bookworm | +-a always,exit -F arch=b64 -S semctl -k Inter-Process_Communication 2026-06-02 13:02:07.323442 | debian-bookworm | +-a always,exit -F arch=b64 -S semget -k Inter-Process_Communication 2026-06-02 13:02:07.323538 | debian-bookworm | +-a always,exit -F arch=b64 -S semop -k Inter-Process_Communication 2026-06-02 13:02:07.323637 | debian-bookworm | +-a always,exit -F arch=b64 -S semtimedop -k Inter-Process_Communication 2026-06-02 13:02:07.323729 | debian-bookworm | + 2026-06-02 13:02:07.323821 | debian-bookworm | +## shmctl 2026-06-02 13:02:07.323955 | debian-bookworm | +#-a always,exit -S ipc -F a0=24 -k Inter-Process_Communication 2026-06-02 13:02:07.324385 | debian-bookworm | +## shmget 2026-06-02 13:02:07.324505 | debian-bookworm | +#-a always,exit -S ipc -F a0=23 -k Inter-Process_Communication 2026-06-02 13:02:07.324604 | debian-bookworm | +## Use these lines on x86_64, ia64 instead 2026-06-02 13:02:07.324833 | debian-bookworm | +-a always,exit -F arch=b64 -S shmctl -k Inter-Process_Communication 2026-06-02 13:02:07.324976 | debian-bookworm | +-a always,exit -F arch=b64 -S shmget -k Inter-Process_Communication 2026-06-02 13:02:07.325065 | debian-bookworm | + 2026-06-02 13:02:07.325164 | debian-bookworm | +# High Volume Events ---------------------------------------------------------- 2026-06-02 13:02:07.325258 | debian-bookworm | + 2026-06-02 13:02:07.325354 | debian-bookworm | +## Disable these rules if they create too many events in your environment 2026-06-02 13:02:07.325450 | debian-bookworm | + 2026-06-02 13:02:07.325559 | debian-bookworm | +## Common Shells 2026-06-02 13:02:07.325637 | debian-bookworm | +-w /bin/bash -p x -k susp_shell 2026-06-02 13:02:07.325735 | debian-bookworm | +-w /bin/dash -p x -k susp_shell 2026-06-02 13:02:07.325830 | debian-bookworm | +-w /bin/busybox -p x -k susp_shell 2026-06-02 13:02:07.325973 | debian-bookworm | +-w /bin/zsh -p x -k susp_shell 2026-06-02 13:02:07.326056 | debian-bookworm | +-w /bin/sh -p x -k susp_shell 2026-06-02 13:02:07.326150 | debian-bookworm | +-w /bin/ksh -p x -k susp_shell 2026-06-02 13:02:07.326243 | debian-bookworm | + 2026-06-02 13:02:07.326345 | debian-bookworm | +## Root command executions 2026-06-02 13:02:07.326443 | debian-bookworm | +-a always,exit -F arch=b64 -F euid=0 -F auid>=1000 -F auid!=-1 -S execve -k rootcmd 2026-06-02 13:02:07.326535 | debian-bookworm | + 2026-06-02 13:02:07.326634 | debian-bookworm | +## File Deletion Events by User 2026-06-02 13:02:07.326733 | debian-bookworm | +-a always,exit -F arch=b64 -S rmdir -S unlink -S unlinkat -S rename -S renameat -F auid>=1000 -F auid!=-1 -k delete 2026-06-02 13:02:07.326827 | debian-bookworm | + 2026-06-02 13:02:07.326939 | debian-bookworm | +## File Access 2026-06-02 13:02:07.327029 | debian-bookworm | +### Unauthorized Access (unsuccessful) 2026-06-02 13:02:07.327131 | debian-bookworm | +-a always,exit -F arch=b64 -S creat -S open -S openat -S open_by_handle_at -S truncate -S ftruncate -F exit=-EACCES -F auid>=1000 -F auid!=-1 -k file_access 2026-06-02 13:02:07.327232 | debian-bookworm | +-a always,exit -F arch=b64 -S creat -S open -S openat -S open_by_handle_at -S truncate -S ftruncate -F exit=-EPERM -F auid>=1000 -F auid!=-1 -k file_access 2026-06-02 13:02:07.327327 | debian-bookworm | + 2026-06-02 13:02:07.327421 | debian-bookworm | +### Unsuccessful Creation 2026-06-02 13:02:07.327711 | debian-bookworm | +-a always,exit -F arch=b64 -S mkdir,creat,link,symlink,mknod,mknodat,linkat,symlinkat -F exit=-EACCES -k file_creation 2026-06-02 13:02:07.327825 | debian-bookworm | +-a always,exit -F arch=b64 -S mkdir,link,symlink,mkdirat -F exit=-EPERM -k file_creation 2026-06-02 13:02:07.328001 | debian-bookworm | + 2026-06-02 13:02:07.328171 | debian-bookworm | +### Unsuccessful Modification 2026-06-02 13:02:07.328300 | debian-bookworm | +-a always,exit -F arch=b64 -S rename -S renameat -S truncate -S chmod -S setxattr -S lsetxattr -S removexattr -S lremovexattr -F exit=-EACCES -k file_modification 2026-06-02 13:02:07.328397 | debian-bookworm | +-a always,exit -F arch=b64 -S rename -S renameat -S truncate -S chmod -S setxattr -S lsetxattr -S removexattr -S lremovexattr -F exit=-EPERM -k file_modification 2026-06-02 13:02:07.328488 | debian-bookworm | + 2026-06-02 13:02:07.328582 | debian-bookworm | +## 32bit API Exploitation 2026-06-02 13:02:07.328682 | debian-bookworm | +### If you are on a 64 bit platform, everything _should_ be running 2026-06-02 13:02:07.328780 | debian-bookworm | +### in 64 bit mode. This rule will detect any use of the 32 bit syscalls 2026-06-02 13:02:07.328902 | debian-bookworm | +### because this might be a sign of someone exploiting a hole in the 32 2026-06-02 13:02:07.328989 | debian-bookworm | +### bit API. 2026-06-02 13:02:07.329085 | debian-bookworm | +-a always,exit -F arch=b32 -S all -k 32bit_api 2026-06-02 13:02:07.329179 | debian-bookworm | + 2026-06-02 13:02:07.329278 | debian-bookworm | +# Make The Configuration Immutable -------------------------------------------- 2026-06-02 13:02:07.329368 | debian-bookworm | + 2026-06-02 13:02:07.329463 | debian-bookworm | +##-e 2 2026-06-02 13:02:07.329556 | debian-bookworm | 2026-06-02 13:02:07.329781 | debian-bookworm | changed: [molecule-auditd] => (item=20-neo23x0.rules) => {"ansible_loop_var": "item", "changed": true, "checksum": "9f99ce5c4f891fbf3e2bce06ed4cb97fb9e01f41", "dest": "/etc/audit/rules.d/20-neo23x0.rules", "gid": 0, "group": "root", "item": "20-neo23x0.rules", "md5sum": "6ac57206fd77de34805c3f4d50ef8b1d", "mode": "0644", "owner": "root", "size": 27367, "src": "/home/zuul/.ansible/tmp/ansible-tmp-1780405326.4744434-2537-145414078075126/.source.rules", "state": "file", "uid": 0} 2026-06-02 13:02:07.329863 | debian-bookworm | 2026-06-02 13:02:07.330009 | debian-bookworm | TASK [auditd : Manage auditd service] ****************************************** 2026-06-02 13:02:08.092741 | debian-bookworm | ok: [molecule-auditd] => {"changed": false, "enabled": true, "name": "auditd", "state": "started", "status": {"ActiveEnterTimestamp": "Tue 2026-06-02 13:02:01 UTC", "ActiveEnterTimestampMonotonic": "810588568", "ActiveExitTimestampMonotonic": "0", "ActiveState": "active", "After": "local-fs.target system.slice systemd-tmpfiles-setup.service systemd-journald.socket", "AllowIsolate": "no", "AssertResult": "yes", "AssertTimestamp": "Tue 2026-06-02 13:02:01 UTC", "AssertTimestampMonotonic": "810512360", "Before": "sysinit.target shutdown.target systemd-update-utmp.service ssh.service", "BlockIOAccounting": "no", "BlockIOWeight": "[not set]", "CPUAccounting": "yes", "CPUAffinityFromNUMA": "no", "CPUQuotaPerSecUSec": "infinity", "CPUQuotaPeriodUSec": "infinity", "CPUSchedulingPolicy": "0", "CPUSchedulingPriority": "0", "CPUSchedulingResetOnFork": "no", "CPUShares": "[not set]", "CPUUsageNSec": "51504000", "CPUWeight": "[not set]", "CacheDirectoryMode": "0755", "CanFreeze": "yes", "CanIsolate": "no", "CanReload": "no", "CanStart": "yes", "CanStop": "yes", "CapabilityBoundingSet": "cap_chown cap_dac_override cap_dac_read_search cap_fowner cap_fsetid cap_kill cap_setgid cap_setuid cap_setpcap cap_linux_immutable cap_net_bind_service cap_net_broadcast cap_net_admin cap_net_raw cap_ipc_lock cap_ipc_owner cap_sys_rawio cap_sys_chroot cap_sys_ptrace cap_sys_pacct cap_sys_admin cap_sys_boot cap_sys_nice cap_sys_resource cap_sys_time cap_sys_tty_config cap_mknod cap_lease cap_audit_write cap_audit_control cap_setfcap cap_mac_override cap_mac_admin cap_syslog cap_wake_alarm cap_block_suspend cap_audit_read cap_perfmon cap_bpf cap_checkpoint_restore", "CleanResult": "success", "CollectMode": "inactive", "ConditionResult": "yes", "ConditionTimestamp": "Tue 2026-06-02 13:02:01 UTC", "ConditionTimestampMonotonic": "810512290", "ConfigurationDirectoryMode": "0755", "Conflicts": "shutdown.target", "ControlGroup": "/system.slice/auditd.service", "ControlGroupId": "3289", "ControlPID": "0", "CoredumpFilter": "0x33", "DefaultDependencies": "no", "DefaultMemoryLow": "0", "DefaultMemoryMin": "0", "Delegate": "no", "Description": "Security Auditing Service", "DevicePolicy": "auto", "Documentation": "\"man:auditd(8)\" https://github.com/linux-audit/audit-documentation", "DynamicUser": "no", "ExecMainCode": "0", "ExecMainExitTimestampMonotonic": "0", "ExecMainPID": "2309", "ExecMainStartTimestamp": "Tue 2026-06-02 13:02:01 UTC", "ExecMainStartTimestampMonotonic": "810561247", "ExecMainStatus": "0", "ExecStart": "{ path=/sbin/auditd ; argv[]=/sbin/auditd ; ignore_errors=no ; start_time=[Tue 2026-06-02 13:02:01 UTC] ; stop_time=[Tue 2026-06-02 13:02:01 UTC] ; pid=2308 ; code=exited ; status=0 }", "ExecStartEx": "{ path=/sbin/auditd ; argv[]=/sbin/auditd ; flags= ; start_time=[Tue 2026-06-02 13:02:01 UTC] ; stop_time=[Tue 2026-06-02 13:02:01 UTC] ; pid=2308 ; code=exited ; status=0 }", "ExecStartPost": "{ path=/sbin/augenrules ; argv[]=/sbin/augenrules --load ; ignore_errors=yes ; start_time=[Tue 2026-06-02 13:02:01 UTC] ; stop_time=[Tue 2026-06-02 13:02:01 UTC] ; pid=2312 ; code=exited ; status=0 }", "ExecStartPostEx": "{ path=/sbin/augenrules ; argv[]=/sbin/augenrules --load ; flags=ignore-failure ; start_time=[Tue 2026-06-02 13:02:01 UTC] ; stop_time=[Tue 2026-06-02 13:02:01 UTC] ; pid=2312 ; code=exited ; status=0 }", "ExitType": "main", "FailureAction": "none", "FileDescriptorStoreMax": "0", "FinalKillSignal": "9", "FragmentPath": "/lib/systemd/system/auditd.service", "FreezerState": "running", "GID": "[not set]", "GuessMainPID": "yes", "IOAccounting": "no", "IOReadBytes": "18446744073709551615", "IOReadOperations": "18446744073709551615", "IOSchedulingClass": "2", "IOSchedulingPriority": "4", "IOWeight": "[not set]", "IOWriteBytes": "18446744073709551615", "IOWriteOperations": "18446744073709551615", "IPAccounting": "no", "IPEgressBytes": "[no data]", "IPEgressPackets": "[no data]", "IPIngressBytes": "[no data]", "IPIngressPackets": "[no data]", "Id": "auditd.service", "IgnoreOnIsolate": "no", "IgnoreSIGPIPE": "yes", "InactiveEnterTimestampMonotonic": "0", "InactiveExitTimestamp": "Tue 2026-06-02 13:02:01 UTC", "InactiveExitTimestampMonotonic": "810541329", "InvocationID": "425b0de4d9014a33b486b3b9eac78cc3", "JobRunningTimeoutUSec": "infinity", "JobTimeoutAction": "none", "JobTimeoutUSec": "infinity", "KeyringMode": "private", "KillMode": "control-group", "KillSignal": "15", "LimitAS": "infinity", "LimitASSoft": "infinity", "LimitCORE": "infinity", "LimitCORESoft": "0", "LimitCPU": "infinity", "LimitCPUSoft": "infinity", "LimitDATA": "infinity", "LimitDATASoft": "infinity", "LimitFSIZE": "infinity", "LimitFSIZESoft": "infinity", "LimitLOCKS": "infinity", "LimitLOCKSSoft": "infinity", "LimitMEMLOCK": "8388608", "LimitMEMLOCKSoft": "8388608", "LimitMSGQUEUE": "819200", "LimitMSGQUEUESoft": "819200", "LimitNICE": "0", "LimitNICESoft": "0", "LimitNOFILE": "524288", "LimitNOFILESoft": "1024", "LimitNPROC": "15480", "LimitNPROCSoft": "15480", "LimitRSS": "infinity", "LimitRSSSoft": "infinity", "LimitRTPRIO": "0", "LimitRTPRIOSoft": "0", "LimitRTTIME": "infinity", "LimitRTTIMESoft": "infinity", "LimitSIGPENDING": "15480", "LimitSIGPENDINGSoft": "15480", "LimitSTACK": "infinity", "LimitSTACKSoft": "8388608", "LoadState": "loaded", "LockPersonality": "yes", "LogLevelMax": "-1", "LogRateLimitBurst": "0", "LogRateLimitIntervalUSec": "0", "LogsDirectoryMode": "0755", "MainPID": "2309", "ManagedOOMMemoryPressure": "auto", "ManagedOOMMemoryPressureLimit": "0", "ManagedOOMPreference": "none", "ManagedOOMSwap": "auto", "MemoryAccounting": "yes", "MemoryAvailable": "infinity", "MemoryCurrent": "704512", "MemoryDenyWriteExecute": "yes", "MemoryHigh": "infinity", "MemoryLimit": "infinity", "MemoryLow": "0", "MemoryMax": "infinity", "MemoryMin": "0", "MemorySwapMax": "infinity", "MountAPIVFS": "no", "NFileDescriptorStore": "0", "NRestarts": "0", "NUMAPolicy": "n/a", "Names": "auditd.service", "NeedDaemonReload": "no", "Nice": "0", "NoNewPrivileges": "no", "NonBlocking": "no", "NotifyAccess": "none", "OOMPolicy": "stop", "OOMScoreAdjust": "0", "OnFailureJobMode": "replace", "OnSuccessJobMode": "fail", "PIDFile": "/run/auditd.pid", "Perpetual": "no", "PrivateDevices": "no", "PrivateIPC": "no", "PrivateMounts": "no", "PrivateNetwork": "no", "PrivateTmp": "no", "PrivateUsers": "no", "ProcSubset": "all", "ProtectClock": "no", "ProtectControlGroups": "yes", "ProtectHome": "no", "ProtectHostname": "no", "ProtectKernelLogs": "no", "ProtectKernelModules": "yes", "ProtectKernelTunables": "no", "ProtectProc": "default", "ProtectSystem": "no", "RefuseManualStart": "no", "RefuseManualStop": "no", "ReloadResult": "success", "RemainAfterExit": "no", "RemoveIPC": "no", "Requires": "system.slice", "Restart": "on-failure", "RestartKillSignal": "15", "RestartPreventExitStatus": "2 4 6", "RestartUSec": "100ms", "RestrictNamespaces": "no", "RestrictRealtime": "yes", "RestrictSUIDSGID": "no", "Result": "success", "RootDirectoryStartOnly": "no", "RuntimeDirectoryMode": "0755", "RuntimeDirectoryPreserve": "no", "RuntimeMaxUSec": "infinity", "RuntimeRandomizedExtraUSec": "0", "SameProcessGroup": "no", "SecureBits": "0", "SendSIGHUP": "no", "SendSIGKILL": "yes", "Slice": "system.slice", "StandardError": "inherit", "StandardInput": "null", "StandardOutput": "journal", "StartLimitAction": "none", "StartLimitBurst": "5", "StartLimitIntervalUSec": "10s", "StartupBlockIOWeight": "[not set]", "StartupCPUShares": "[not set]", "StartupCPUWeight": "[not set]", "StartupIOWeight": "[not set]", "StateChangeTimestamp": "Tue 2026-06-02 13:02:01 UTC", "StateChangeTimestampMonotonic": "810588568", "StateDirectoryMode": "0755", "StatusErrno": "0", "StopWhenUnneeded": "no", "SubState": "running", "SuccessAction": "none", "SyslogFacility": "3", "SyslogLevel": "6", "SyslogLevelPrefix": "yes", "SyslogPriority": "30", "SystemCallErrorNumber": "2147483646", "TTYReset": "no", "TTYVHangup": "no", "TTYVTDisallocate": "no", "TasksAccounting": "yes", "TasksCurrent": "2", "TasksMax": "4644", "TimeoutAbortUSec": "1min 30s", "TimeoutCleanUSec": "infinity", "TimeoutStartFailureMode": "terminate", "TimeoutStartUSec": "1min 30s", "TimeoutStopFailureMode": "terminate", "TimeoutStopUSec": "1min 30s", "TimerSlackNSec": "50000", "Transient": "no", "Type": "forking", "UID": "[not set]", "UMask": "0022", "UnitFilePreset": "enabled", "UnitFileState": "enabled", "UtmpMode": "init", "WantedBy": "multi-user.target", "WatchdogSignal": "6", "WatchdogTimestampMonotonic": "0", "WatchdogUSec": "0"}} 2026-06-02 13:02:08.097206 | debian-bookworm | 2026-06-02 13:02:08.097303 | debian-bookworm | TASK [auditd : List existing rules files] ************************************** 2026-06-02 13:02:08.732932 | ubuntu-noble | --- before 2026-06-02 13:02:08.733010 | ubuntu-noble | +++ after: /home/zuul/.ansible/tmp/ansible-local-1946wuvk8gvj/tmpmh2skjjm/auditd.conf.j2 2026-06-02 13:02:08.733029 | ubuntu-noble | @@ -0,0 +1,37 @@ 2026-06-02 13:02:08.733043 | ubuntu-noble | +# 2026-06-02 13:02:08.733186 | ubuntu-noble | +# This file controls the configuration of the audit daemon 2026-06-02 13:02:08.733541 | ubuntu-noble | +# 2026-06-02 13:02:08.733911 | ubuntu-noble | + 2026-06-02 13:02:08.734277 | ubuntu-noble | +local_events = yes 2026-06-02 13:02:08.734546 | ubuntu-noble | +write_logs = yes 2026-06-02 13:02:08.734814 | ubuntu-noble | +log_file = /var/log/audit/audit.log 2026-06-02 13:02:08.735173 | ubuntu-noble | +log_group = adm 2026-06-02 13:02:08.735426 | ubuntu-noble | +log_format = RAW 2026-06-02 13:02:08.735662 | ubuntu-noble | +flush = INCREMENTAL_ASYNC 2026-06-02 13:02:08.735971 | ubuntu-noble | +freq = 50 2026-06-02 13:02:08.736183 | ubuntu-noble | +max_log_file = 8 2026-06-02 13:02:08.736378 | ubuntu-noble | +num_logs = 5 2026-06-02 13:02:08.736574 | ubuntu-noble | +priority_boost = 4 2026-06-02 13:02:08.736769 | ubuntu-noble | +disp_qos = lossy 2026-06-02 13:02:08.737017 | ubuntu-noble | +dispatcher = /sbin/audispd 2026-06-02 13:02:08.737221 | ubuntu-noble | +name_format = NONE 2026-06-02 13:02:08.737419 | ubuntu-noble | +##name = mydomain 2026-06-02 13:02:08.737617 | ubuntu-noble | +max_log_file_action = ROTATE 2026-06-02 13:02:08.737814 | ubuntu-noble | +space_left = 12361 2026-06-02 13:02:08.738055 | ubuntu-noble | +space_left_action = email 2026-06-02 13:02:08.738260 | ubuntu-noble | +verify_email = yes 2026-06-02 13:02:08.738453 | ubuntu-noble | +action_mail_acct = root 2026-06-02 13:02:08.738654 | ubuntu-noble | +admin_space_left = 50 2026-06-02 13:02:08.739857 | ubuntu-noble | +admin_space_left_action = SUSPEND 2026-06-02 13:02:08.739877 | ubuntu-noble | +disk_full_action = SUSPEND 2026-06-02 13:02:08.739897 | ubuntu-noble | +disk_error_action = SUSPEND 2026-06-02 13:02:08.739904 | ubuntu-noble | +use_libwrap = yes 2026-06-02 13:02:08.739910 | ubuntu-noble | +##tcp_listen_port = 60 2026-06-02 13:02:08.739916 | ubuntu-noble | +tcp_listen_queue = 5 2026-06-02 13:02:08.740073 | ubuntu-noble | +tcp_max_per_addr = 1 2026-06-02 13:02:08.740280 | ubuntu-noble | +##tcp_client_ports = 1024-65535 2026-06-02 13:02:08.740476 | ubuntu-noble | +tcp_client_max_idle = 0 2026-06-02 13:02:08.740673 | ubuntu-noble | +enable_krb5 = no 2026-06-02 13:02:08.740932 | ubuntu-noble | +krb5_principal = auditd 2026-06-02 13:02:08.741151 | ubuntu-noble | +##krb5_key_file = /etc/audit/audit.key 2026-06-02 13:02:08.741354 | ubuntu-noble | +distribute_network = no 2026-06-02 13:02:08.741528 | ubuntu-noble | 2026-06-02 13:02:08.741760 | ubuntu-noble | changed: [molecule-auditd] => {"changed": true, "checksum": "e902cc6bebf86c17087d153e359a2cc1231672e0", "dest": "/etc/audit/audit.conf", "gid": 0, "group": "root", "md5sum": "69dfd768317bae876a6a78c8aeb5cce1", "mode": "0640", "owner": "root", "size": 806, "src": "/home/zuul/.ansible/tmp/ansible-tmp-1780405327.4666355-2345-158829127866181/.source.conf", "state": "file", "uid": 0} 2026-06-02 13:02:08.742260 | ubuntu-noble | 2026-06-02 13:02:08.742508 | ubuntu-noble | TASK [auditd : Adjust auditd/audispd configurations] *************************** 2026-06-02 13:02:08.502357 | debian-bookworm | ok: [molecule-auditd] => {"changed": false, "cmd": ["find", "/etc/audit/rules.d", "-type", "f", "-printf", "%f\n"], "delta": "0:00:00.005244", "end": "2026-06-02 13:02:08.450993", "msg": "", "rc": 0, "start": "2026-06-02 13:02:08.445749", "stderr": "", "stderr_lines": [], "stdout": "audit.rules\n20-neo23x0.rules", "stdout_lines": ["audit.rules", "20-neo23x0.rules"]} 2026-06-02 13:02:08.502450 | debian-bookworm | 2026-06-02 13:02:08.502462 | debian-bookworm | TASK [auditd : Remove unmanaged rules files] *********************************** 2026-06-02 13:02:08.837978 | debian-bookworm | --- before 2026-06-02 13:02:08.838061 | debian-bookworm | +++ after 2026-06-02 13:02:08.838159 | debian-bookworm | @@ -1,4 +1,4 @@ 2026-06-02 13:02:08.838260 | debian-bookworm | { 2026-06-02 13:02:08.838361 | debian-bookworm | "path": "/etc/audit/rules.d/audit.rules", 2026-06-02 13:02:08.838447 | debian-bookworm | - "state": "file" 2026-06-02 13:02:08.838540 | debian-bookworm | + "state": "absent" 2026-06-02 13:02:08.838631 | debian-bookworm | } 2026-06-02 13:02:08.838720 | debian-bookworm | 2026-06-02 13:02:08.838822 | debian-bookworm | changed: [molecule-auditd] => (item=audit.rules) => {"ansible_loop_var": "item", "changed": true, "item": "audit.rules", "path": "/etc/audit/rules.d/audit.rules", "state": "absent"} 2026-06-02 13:02:08.838934 | debian-bookworm | skipping: [molecule-auditd] => (item=20-neo23x0.rules) => {"ansible_loop_var": "item", "changed": false, "false_condition": "item not in auditd_rules_files", "item": "20-neo23x0.rules", "skip_reason": "Conditional result was False"} 2026-06-02 13:02:08.839020 | debian-bookworm | 2026-06-02 13:02:08.839119 | debian-bookworm | RUNNING HANDLER [auditd : Restart auditd service] ****************************** 2026-06-02 13:02:09.185792 | ubuntu-noble | ok: [molecule-auditd] => (item={'parameter': 'active', 'value': 'no', 'config': '/etc/audit/plugins.d/syslog.conf'}) => {"ansible_loop_var": "item", "backup": "", "changed": false, "item": {"config": "/etc/audit/plugins.d/syslog.conf", "parameter": "active", "value": "no"}, "msg": ""} 2026-06-02 13:02:09.186027 | ubuntu-noble | 2026-06-02 13:02:09.186172 | ubuntu-noble | TASK [auditd : Deploy rules for auditd] **************************************** 2026-06-02 13:02:09.467921 | debian-bookworm | changed: [molecule-auditd] => {"changed": true, "name": "auditd", "state": "started", "status": {"ActiveEnterTimestamp": "Tue 2026-06-02 13:02:01 UTC", "ActiveEnterTimestampMonotonic": "810588568", "ActiveExitTimestampMonotonic": "0", "ActiveState": "active", "After": "local-fs.target system.slice systemd-tmpfiles-setup.service systemd-journald.socket", "AllowIsolate": "no", "AssertResult": "yes", "AssertTimestamp": "Tue 2026-06-02 13:02:01 UTC", "AssertTimestampMonotonic": "810512360", "Before": "sysinit.target shutdown.target systemd-update-utmp.service ssh.service", "BlockIOAccounting": "no", "BlockIOWeight": "[not set]", "CPUAccounting": "yes", "CPUAffinityFromNUMA": "no", "CPUQuotaPerSecUSec": "infinity", "CPUQuotaPeriodUSec": "infinity", "CPUSchedulingPolicy": "0", "CPUSchedulingPriority": "0", "CPUSchedulingResetOnFork": "no", "CPUShares": "[not set]", "CPUUsageNSec": "52894000", "CPUWeight": "[not set]", "CacheDirectoryMode": "0755", "CanFreeze": "yes", "CanIsolate": "no", "CanReload": "no", "CanStart": "yes", "CanStop": "yes", "CapabilityBoundingSet": "cap_chown cap_dac_override cap_dac_read_search cap_fowner cap_fsetid cap_kill cap_setgid cap_setuid cap_setpcap cap_linux_immutable cap_net_bind_service cap_net_broadcast cap_net_admin cap_net_raw cap_ipc_lock cap_ipc_owner cap_sys_rawio cap_sys_chroot cap_sys_ptrace cap_sys_pacct cap_sys_admin cap_sys_boot cap_sys_nice cap_sys_resource cap_sys_time cap_sys_tty_config cap_mknod cap_lease cap_audit_write cap_audit_control cap_setfcap cap_mac_override cap_mac_admin cap_syslog cap_wake_alarm cap_block_suspend cap_audit_read cap_perfmon cap_bpf cap_checkpoint_restore", "CleanResult": "success", "CollectMode": "inactive", "ConditionResult": "yes", "ConditionTimestamp": "Tue 2026-06-02 13:02:01 UTC", "ConditionTimestampMonotonic": "810512290", "ConfigurationDirectoryMode": "0755", "Conflicts": "shutdown.target", "ControlGroup": "/system.slice/auditd.service", "ControlGroupId": "3289", "ControlPID": "0", "CoredumpFilter": "0x33", "DefaultDependencies": "no", "DefaultMemoryLow": "0", "DefaultMemoryMin": "0", "Delegate": "no", "Description": "Security Auditing Service", "DevicePolicy": "auto", "Documentation": "\"man:auditd(8)\" https://github.com/linux-audit/audit-documentation", "DynamicUser": "no", "ExecMainCode": "0", "ExecMainExitTimestampMonotonic": "0", "ExecMainPID": "2309", "ExecMainStartTimestamp": "Tue 2026-06-02 13:02:01 UTC", "ExecMainStartTimestampMonotonic": "810561247", "ExecMainStatus": "0", "ExecStart": "{ path=/sbin/auditd ; argv[]=/sbin/auditd ; ignore_errors=no ; start_time=[Tue 2026-06-02 13:02:01 UTC] ; stop_time=[Tue 2026-06-02 13:02:01 UTC] ; pid=2308 ; code=exited ; status=0 }", "ExecStartEx": "{ path=/sbin/auditd ; argv[]=/sbin/auditd ; flags= ; start_time=[Tue 2026-06-02 13:02:01 UTC] ; stop_time=[Tue 2026-06-02 13:02:01 UTC] ; pid=2308 ; code=exited ; status=0 }", "ExecStartPost": "{ path=/sbin/augenrules ; argv[]=/sbin/augenrules --load ; ignore_errors=yes ; start_time=[Tue 2026-06-02 13:02:01 UTC] ; stop_time=[Tue 2026-06-02 13:02:01 UTC] ; pid=2312 ; code=exited ; status=0 }", "ExecStartPostEx": "{ path=/sbin/augenrules ; argv[]=/sbin/augenrules --load ; flags=ignore-failure ; start_time=[Tue 2026-06-02 13:02:01 UTC] ; stop_time=[Tue 2026-06-02 13:02:01 UTC] ; pid=2312 ; code=exited ; status=0 }", "ExitType": "main", "FailureAction": "none", "FileDescriptorStoreMax": "0", "FinalKillSignal": "9", "FragmentPath": "/lib/systemd/system/auditd.service", "FreezerState": "running", "GID": "[not set]", "GuessMainPID": "yes", "IOAccounting": "no", "IOReadBytes": "18446744073709551615", "IOReadOperations": "18446744073709551615", "IOSchedulingClass": "2", "IOSchedulingPriority": "4", "IOWeight": "[not set]", "IOWriteBytes": "18446744073709551615", "IOWriteOperations": "18446744073709551615", "IPAccounting": "no", "IPEgressBytes": "[no data]", "IPEgressPackets": "[no data]", "IPIngressBytes": "[no data]", "IPIngressPackets": "[no data]", "Id": "auditd.service", "IgnoreOnIsolate": "no", "IgnoreSIGPIPE": "yes", "InactiveEnterTimestampMonotonic": "0", "InactiveExitTimestamp": "Tue 2026-06-02 13:02:01 UTC", "InactiveExitTimestampMonotonic": "810541329", "InvocationID": "425b0de4d9014a33b486b3b9eac78cc3", "JobRunningTimeoutUSec": "infinity", "JobTimeoutAction": "none", "JobTimeoutUSec": "infinity", "KeyringMode": "private", "KillMode": "control-group", "KillSignal": "15", "LimitAS": "infinity", "LimitASSoft": "infinity", "LimitCORE": "infinity", "LimitCORESoft": "0", "LimitCPU": "infinity", "LimitCPUSoft": "infinity", "LimitDATA": "infinity", "LimitDATASoft": "infinity", "LimitFSIZE": "infinity", "LimitFSIZESoft": "infinity", "LimitLOCKS": "infinity", "LimitLOCKSSoft": "infinity", "LimitMEMLOCK": "8388608", "LimitMEMLOCKSoft": "8388608", "LimitMSGQUEUE": "819200", "LimitMSGQUEUESoft": "819200", "LimitNICE": "0", "LimitNICESoft": "0", "LimitNOFILE": "524288", "LimitNOFILESoft": "1024", "LimitNPROC": "15480", "LimitNPROCSoft": "15480", "LimitRSS": "infinity", "LimitRSSSoft": "infinity", "LimitRTPRIO": "0", "LimitRTPRIOSoft": "0", "LimitRTTIME": "infinity", "LimitRTTIMESoft": "infinity", "LimitSIGPENDING": "15480", "LimitSIGPENDINGSoft": "15480", "LimitSTACK": "infinity", "LimitSTACKSoft": "8388608", "LoadState": "loaded", "LockPersonality": "yes", "LogLevelMax": "-1", "LogRateLimitBurst": "0", "LogRateLimitIntervalUSec": "0", "LogsDirectoryMode": "0755", "MainPID": "2309", "ManagedOOMMemoryPressure": "auto", "ManagedOOMMemoryPressureLimit": "0", "ManagedOOMPreference": "none", "ManagedOOMSwap": "auto", "MemoryAccounting": "yes", "MemoryAvailable": "infinity", "MemoryCurrent": "712704", "MemoryDenyWriteExecute": "yes", "MemoryHigh": "infinity", "MemoryLimit": "infinity", "MemoryLow": "0", "MemoryMax": "infinity", "MemoryMin": "0", "MemorySwapMax": "infinity", "MountAPIVFS": "no", "NFileDescriptorStore": "0", "NRestarts": "0", "NUMAPolicy": "n/a", "Names": "auditd.service", "NeedDaemonReload": "no", "Nice": "0", "NoNewPrivileges": "no", "NonBlocking": "no", "NotifyAccess": "none", "OOMPolicy": "stop", "OOMScoreAdjust": "0", "OnFailureJobMode": "replace", "OnSuccessJobMode": "fail", "PIDFile": "/run/auditd.pid", "Perpetual": "no", "PrivateDevices": "no", "PrivateIPC": "no", "PrivateMounts": "no", "PrivateNetwork": "no", "PrivateTmp": "no", "PrivateUsers": "no", "ProcSubset": "all", "ProtectClock": "no", "ProtectControlGroups": "yes", "ProtectHome": "no", "ProtectHostname": "no", "ProtectKernelLogs": "no", "ProtectKernelModules": "yes", "ProtectKernelTunables": "no", "ProtectProc": "default", "ProtectSystem": "no", "RefuseManualStart": "no", "RefuseManualStop": "no", "ReloadResult": "success", "RemainAfterExit": "no", "RemoveIPC": "no", "Requires": "system.slice", "Restart": "on-failure", "RestartKillSignal": "15", "RestartPreventExitStatus": "2 4 6", "RestartUSec": "100ms", "RestrictNamespaces": "no", "RestrictRealtime": "yes", "RestrictSUIDSGID": "no", "Result": "success", "RootDirectoryStartOnly": "no", "RuntimeDirectoryMode": "0755", "RuntimeDirectoryPreserve": "no", "RuntimeMaxUSec": "infinity", "RuntimeRandomizedExtraUSec": "0", "SameProcessGroup": "no", "SecureBits": "0", "SendSIGHUP": "no", "SendSIGKILL": "yes", "Slice": "system.slice", "StandardError": "inherit", "StandardInput": "null", "StandardOutput": "journal", "StartLimitAction": "none", "StartLimitBurst": "5", "StartLimitIntervalUSec": "10s", "StartupBlockIOWeight": "[not set]", "StartupCPUShares": "[not set]", "StartupCPUWeight": "[not set]", "StartupIOWeight": "[not set]", "StateChangeTimestamp": "Tue 2026-06-02 13:02:01 UTC", "StateChangeTimestampMonotonic": "810588568", "StateDirectoryMode": "0755", "StatusErrno": "0", "StopWhenUnneeded": "no", "SubState": "running", "SuccessAction": "none", "SyslogFacility": "3", "SyslogLevel": "6", "SyslogLevelPrefix": "yes", "SyslogPriority": "30", "SystemCallErrorNumber": "2147483646", "TTYReset": "no", "TTYVHangup": "no", "TTYVTDisallocate": "no", "TasksAccounting": "yes", "TasksCurrent": "2", "TasksMax": "4644", "TimeoutAbortUSec": "1min 30s", "TimeoutCleanUSec": "infinity", "TimeoutStartFailureMode": "terminate", "TimeoutStartUSec": "1min 30s", "TimeoutStopFailureMode": "terminate", "TimeoutStopUSec": "1min 30s", "TimerSlackNSec": "50000", "Transient": "no", "Type": "forking", "UID": "[not set]", "UMask": "0022", "UnitFilePreset": "enabled", "UnitFileState": "enabled", "UtmpMode": "init", "WantedBy": "multi-user.target", "WatchdogSignal": "6", "WatchdogTimestampMonotonic": "0", "WatchdogUSec": "0"}} 2026-06-02 13:02:09.468825 | debian-bookworm | 2026-06-02 13:02:09.468962 | debian-bookworm | RUNNING HANDLER [auditd : Generate auditd rules] ******************************* 2026-06-02 13:02:09.822507 | debian-bookworm | changed: [molecule-auditd] => {"changed": true, "cmd": ["augenrules", "--load"], "delta": "0:00:00.095895", "end": "2026-06-02 13:02:09.778780", "msg": "", "rc": 0, "start": "2026-06-02 13:02:09.682885", "stderr": "Unknown user: chrony\nThere was an error in line 24 of /etc/audit/audit.rules\nError sending add rule data request (No such file or directory)\nThere was an error in line 28 of /etc/audit/audit.rules\nUnknown user: ntp\nThere was an error in line 44 of /etc/audit/audit.rules\nError sending add rule data request (No such file or directory)\nThere was an error in line 83 of /etc/audit/audit.rules\nError sending add rule data request (No such file or directory)\nThere was an error in line 84 of /etc/audit/audit.rules\nError sending add rule data request (No such file or directory)\nThere was an error in line 112 of /etc/audit/audit.rules\nError sending add rule data request (No such file or directory)\nThere was an error in line 115 of /etc/audit/audit.rules\nError sending add rule data request (No such file or directory)\nThere was an error in line 176 of /etc/audit/audit.rules\nError sending add rule data request (No such file or directory)\nThere was an error in line 177 of /etc/audit/audit.rules\nError sending add rule data request (No such file or directory)\nThere was an error in line 178 of /etc/audit/audit.rules\nError sending add rule data request (No such file or directory)\nThere was an error in line 179 of /etc/audit/audit.rules\nError sending add rule data request (No such file or directory)\nThere was an error in line 180 of /etc/audit/audit.rules\nError sending add rule data request (No such file or directory)\nThere was an error in line 217 of /etc/audit/audit.rules\nError sending add rule data request (No such file or directory)\nThere was an error in line 218 of /etc/audit/audit.rules\nError sending add rule data request (No such file or directory)\nThere was an error in line 234 of /etc/audit/audit.rules\nError sending add rule data request (No such file or directory)\nThere was an error in line 285 of /etc/audit/audit.rules\nError sending add rule data request (No such file or directory)\nThere was an error in line 286 of /etc/audit/audit.rules\nError sending add rule data request (No such file or directory)\nThere was an error in line 324 of /etc/audit/audit.rules\nError sending add rule data request (No such file or directory)\nThere was an error in line 325 of /etc/audit/audit.rules\nError sending add rule data request (No such file or directory)\nThere was an error in line 346 of /etc/audit/audit.rules\nparameter passed without an option given\nThere was an error in line 347 of /etc/audit/audit.rules\nparameter passed without an option given\nThere was an error in line 348 of /etc/audit/audit.rules\nparameter passed without an option given\nThere was an error in line 349 of /etc/audit/audit.rules\nparameter passed without an option given\nThere was an error in line 350 of /etc/audit/audit.rules\nparameter passed without an option given\nThere was an error in line 351 of /etc/audit/audit.rules\nError sending add rule data request (No such file or directory)\nThere was an error in line 359 of /etc/audit/audit.rules", "stderr_lines": ["Unknown user: chrony", "There was an error in line 24 of /etc/audit/audit.rules", "Error sending add rule data request (No such file or directory)", "There was an error in line 28 of /etc/audit/audit.rules", "Unknown user: ntp", "There was an error in line 44 of /etc/audit/audit.rules", "Error sending add rule data request (No such file or directory)", "There was an error in line 83 of /etc/audit/audit.rules", "Error sending add rule data request (No such file or directory)", "There was an error in line 84 of /etc/audit/audit.rules", "Error sending add rule data request (No such file or directory)", "There was an error in line 112 of /etc/audit/audit.rules", "Error sending add rule data request (No such file or directory)", "There was an error in line 115 of /etc/audit/audit.rules", "Error sending add rule data request (No such file or directory)", "There was an error in line 176 of /etc/audit/audit.rules", "Error sending add rule data request (No such file or directory)", "There was an error in line 177 of /etc/audit/audit.rules", "Error sending add rule data request (No such file or directory)", "There was an error in line 178 of /etc/audit/audit.rules", "Error sending add rule data request (No such file or directory)", "There was an error in line 179 of /etc/audit/audit.rules", "Error sending add rule data request (No such file or directory)", "There was an error in line 180 of /etc/audit/audit.rules", "Error sending add rule data request (No such file or directory)", "There was an error in line 217 of /etc/audit/audit.rules", "Error sending add rule data request (No such file or directory)", "There was an error in line 218 of /etc/audit/audit.rules", "Error sending add rule data request (No such file or directory)", "There was an error in line 234 of /etc/audit/audit.rules", "Error sending add rule data request (No such file or directory)", "There was an error in line 285 of /etc/audit/audit.rules", "Error sending add rule data request (No such file or directory)", "There was an error in line 286 of /etc/audit/audit.rules", "Error sending add rule data request (No such file or directory)", "There was an error in line 324 of /etc/audit/audit.rules", "Error sending add rule data request (No such file or directory)", "There was an error in line 325 of /etc/audit/audit.rules", "Error sending add rule data request (No such file or directory)", "There was an error in line 346 of /etc/audit/audit.rules", "parameter passed without an option given", "There was an error in line 347 of /etc/audit/audit.rules", "parameter passed without an option given", "There was an error in line 348 of /etc/audit/audit.rules", "parameter passed without an option given", "There was an error in line 349 of /etc/audit/audit.rules", "parameter passed without an option given", "There was an error in line 350 of /etc/audit/audit.rules", "parameter passed without an option given", "There was an error in line 351 of /etc/audit/audit.rules", "Error sending add rule data request (No such file or directory)", "There was an error in line 359 of /etc/audit/audit.rules"], "stdout": "/usr/sbin/augenrules: No change\nNo rules\nenabled 1\nfailure 1\npid 2698\nrate_limit 0\nbacklog_limit 8192\nlost 0\nbacklog 908\nbacklog_wait_time 60000\nbacklog_wait_time_actual 0\nenabled 1\nfailure 1\npid 2698\nrate_limit 0\nbacklog_limit 8192\nlost 0\nbacklog 752\nbacklog_wait_time 60000\nbacklog_wait_time_actual 0", "stdout_lines": ["/usr/sbin/augenrules: No change", "No rules", "enabled 1", "failure 1", "pid 2698", "rate_limit 0", "backlog_limit 8192", "lost 0", "backlog 908", "backlog_wait_time 60000", "backlog_wait_time_actual 0", "enabled 1", "failure 1", "pid 2698", "rate_limit 0", "backlog_limit 8192", "lost 0", "backlog 752", "backlog_wait_time 60000", "backlog_wait_time_actual 0"]} 2026-06-02 13:02:09.822596 | debian-bookworm | 2026-06-02 13:02:09.822737 | debian-bookworm | RUNNING HANDLER [auditd : Restart auditd service] ****************************** 2026-06-02 13:02:10.040890 | ubuntu-noble | --- before 2026-06-02 13:02:10.043872 | ubuntu-noble | +++ after: /home/zuul/.ansible/tmp/ansible-local-1946wuvk8gvj/tmp4ba5aldp/20-neo23x0.rules.j2 2026-06-02 13:02:10.043962 | ubuntu-noble | @@ -0,0 +1,750 @@ 2026-06-02 13:02:10.043972 | ubuntu-noble | +# ___ ___ __ __ 2026-06-02 13:02:10.043980 | ubuntu-noble | +# / | __ ______/ (_) /_____/ / 2026-06-02 13:02:10.044073 | ubuntu-noble | +# / /| |/ / / / __ / / __/ __ / 2026-06-02 13:02:10.044283 | ubuntu-noble | +# / ___ / /_/ / /_/ / / /_/ /_/ / 2026-06-02 13:02:10.044472 | ubuntu-noble | +# /_/ |_\__,_/\__,_/_/\__/\__,_/ 2026-06-02 13:02:10.044665 | ubuntu-noble | +# 2026-06-02 13:02:10.044896 | ubuntu-noble | +# Linux Audit Daemon - Best Practice Configuration 2026-06-02 13:02:10.045122 | ubuntu-noble | +# /etc/audit/audit.rules 2026-06-02 13:02:10.045303 | ubuntu-noble | +# 2026-06-02 13:02:10.045497 | ubuntu-noble | +# Compiled by Florian Roth 2026-06-02 13:02:10.045682 | ubuntu-noble | +# 2026-06-02 13:02:10.045927 | ubuntu-noble | +# Created : 2017/12/05 2026-06-02 13:02:10.046129 | ubuntu-noble | +# Modified : 2023/01/25 2026-06-02 13:02:10.046308 | ubuntu-noble | +# 2026-06-02 13:02:10.047857 | ubuntu-noble | +# Based on rules published here: 2026-06-02 13:02:10.047880 | ubuntu-noble | +# Gov.uk auditd rules 2026-06-02 13:02:10.047944 | ubuntu-noble | +# https://github.com/gds-operations/puppet-auditd/pull/1 2026-06-02 13:02:10.047953 | ubuntu-noble | +# CentOS 7 hardening 2026-06-02 13:02:10.047959 | ubuntu-noble | +# https://highon.coffee/blog/security-harden-centos-7/#auditd---audit-daemon 2026-06-02 13:02:10.047997 | ubuntu-noble | +# Linux audit repo 2026-06-02 13:02:10.048270 | ubuntu-noble | +# https://github.com/linux-audit/audit-userspace/tree/master/rules 2026-06-02 13:02:10.048504 | ubuntu-noble | +# Auditd high performance linux auditing 2026-06-02 13:02:10.048748 | ubuntu-noble | +# https://linux-audit.com/tuning-auditd-high-performance-linux-auditing/ 2026-06-02 13:02:10.048962 | ubuntu-noble | +# 2026-06-02 13:02:10.049135 | ubuntu-noble | +# Further rules 2026-06-02 13:02:10.049363 | ubuntu-noble | +# For PCI DSS compliance see: 2026-06-02 13:02:10.049611 | ubuntu-noble | +# https://github.com/linux-audit/audit-userspace/blob/master/rules/30-pci-dss-v31.rules 2026-06-02 13:02:10.049857 | ubuntu-noble | +# For NISPOM compliance see: 2026-06-02 13:02:10.050132 | ubuntu-noble | +# https://github.com/linux-audit/audit-userspace/blob/master/rules/30-nispom.rules 2026-06-02 13:02:10.050302 | ubuntu-noble | + 2026-06-02 13:02:10.050469 | ubuntu-noble | +# Remove any existing rules 2026-06-02 13:02:10.050626 | ubuntu-noble | +-D 2026-06-02 13:02:10.050785 | ubuntu-noble | + 2026-06-02 13:02:10.050987 | ubuntu-noble | +# Buffer Size 2026-06-02 13:02:10.051162 | ubuntu-noble | +## Feel free to increase this if the machine panic's 2026-06-02 13:02:10.051322 | ubuntu-noble | +-b 8192 2026-06-02 13:02:10.051487 | ubuntu-noble | + 2026-06-02 13:02:10.051653 | ubuntu-noble | +# Failure Mode 2026-06-02 13:02:10.051846 | ubuntu-noble | +## Possible values: 0 (silent), 1 (printk, print a failure message), 2 (panic, halt the system) 2026-06-02 13:02:10.052072 | ubuntu-noble | +-f 1 2026-06-02 13:02:10.052212 | ubuntu-noble | + 2026-06-02 13:02:10.052360 | ubuntu-noble | +# Ignore errors 2026-06-02 13:02:10.052508 | ubuntu-noble | +## e.g. caused by users or files not found in the local environment 2026-06-02 13:02:10.052647 | ubuntu-noble | +-i 2026-06-02 13:02:10.052789 | ubuntu-noble | + 2026-06-02 13:02:10.052973 | ubuntu-noble | +# Self Auditing --------------------------------------------------------------- 2026-06-02 13:02:10.053121 | ubuntu-noble | + 2026-06-02 13:02:10.053268 | ubuntu-noble | +## Audit the audit logs 2026-06-02 13:02:10.053419 | ubuntu-noble | +### Successful and unsuccessful attempts to read information from the audit records 2026-06-02 13:02:10.053567 | ubuntu-noble | +-w /var/log/audit/ -p wra -k auditlog 2026-06-02 13:02:10.053714 | ubuntu-noble | +-w /var/audit/ -p wra -k auditlog 2026-06-02 13:02:10.053882 | ubuntu-noble | + 2026-06-02 13:02:10.054051 | ubuntu-noble | +## Auditd configuration 2026-06-02 13:02:10.054203 | ubuntu-noble | +### Modifications to audit configuration that occur while the audit collection functions are operating 2026-06-02 13:02:10.054350 | ubuntu-noble | +-w /etc/audit/ -p wa -k auditconfig 2026-06-02 13:02:10.054496 | ubuntu-noble | +-w /etc/libaudit.conf -p wa -k auditconfig 2026-06-02 13:02:10.054639 | ubuntu-noble | +-w /etc/audisp/ -p wa -k audispconfig 2026-06-02 13:02:10.054776 | ubuntu-noble | + 2026-06-02 13:02:10.054965 | ubuntu-noble | +## Monitor for use of audit management tools 2026-06-02 13:02:10.055118 | ubuntu-noble | +-w /sbin/auditctl -p x -k audittools 2026-06-02 13:02:10.055265 | ubuntu-noble | +-w /sbin/auditd -p x -k audittools 2026-06-02 13:02:10.055430 | ubuntu-noble | +-w /usr/sbin/auditd -p x -k audittools 2026-06-02 13:02:10.055579 | ubuntu-noble | +-w /usr/sbin/augenrules -p x -k audittools 2026-06-02 13:02:10.055715 | ubuntu-noble | + 2026-06-02 13:02:10.055886 | ubuntu-noble | +## Access to all audit trails 2026-06-02 13:02:10.056077 | ubuntu-noble | + 2026-06-02 13:02:10.056234 | ubuntu-noble | +-a always,exit -F path=/usr/sbin/ausearch -F perm=x -k audittools 2026-06-02 13:02:10.056382 | ubuntu-noble | +-a always,exit -F path=/usr/sbin/aureport -F perm=x -k audittools 2026-06-02 13:02:10.056535 | ubuntu-noble | +-a always,exit -F path=/usr/sbin/aulast -F perm=x -k audittools 2026-06-02 13:02:10.056679 | ubuntu-noble | +-a always,exit -F path=/usr/sbin/aulastlogin -F perm=x -k audittools 2026-06-02 13:02:10.056820 | ubuntu-noble | +-a always,exit -F path=/usr/sbin/auvirt -F perm=x -k audittools 2026-06-02 13:02:10.056990 | ubuntu-noble | + 2026-06-02 13:02:10.057131 | ubuntu-noble | +# Filters --------------------------------------------------------------------- 2026-06-02 13:02:10.057261 | ubuntu-noble | + 2026-06-02 13:02:10.057401 | ubuntu-noble | +### We put these early because audit is a first match wins system. 2026-06-02 13:02:10.057531 | ubuntu-noble | + 2026-06-02 13:02:10.057669 | ubuntu-noble | +## Ignore SELinux AVC records 2026-06-02 13:02:10.057811 | ubuntu-noble | +-a always,exclude -F msgtype=AVC 2026-06-02 13:02:10.059860 | ubuntu-noble | + 2026-06-02 13:02:10.059878 | ubuntu-noble | +## Ignore current working directory records 2026-06-02 13:02:10.059883 | ubuntu-noble | +-a always,exclude -F msgtype=CWD 2026-06-02 13:02:10.059887 | ubuntu-noble | + 2026-06-02 13:02:10.059891 | ubuntu-noble | +## Cron jobs fill the logs with stuff we normally don't want (works with SELinux) 2026-06-02 13:02:10.059895 | ubuntu-noble | +-a never,user -F subj_type=crond_t 2026-06-02 13:02:10.059911 | ubuntu-noble | +-a never,exit -F subj_type=crond_t 2026-06-02 13:02:10.059915 | ubuntu-noble | + 2026-06-02 13:02:10.059919 | ubuntu-noble | +## This prevents chrony from overwhelming the logs 2026-06-02 13:02:10.059923 | ubuntu-noble | +-a never,exit -F arch=b64 -S adjtimex -F auid=-1 -F uid=chrony -F subj_type=chronyd_t 2026-06-02 13:02:10.059927 | ubuntu-noble | + 2026-06-02 13:02:10.059931 | ubuntu-noble | +## This is not very interesting and wastes a lot of space if the server is public facing 2026-06-02 13:02:10.059935 | ubuntu-noble | +-a always,exclude -F msgtype=CRYPTO_KEY_USER 2026-06-02 13:02:10.059939 | ubuntu-noble | + 2026-06-02 13:02:10.059943 | ubuntu-noble | +## Open VM Tools 2026-06-02 13:02:10.059947 | ubuntu-noble | +-a exit,never -F arch=b64 -S all -F exe=/usr/bin/vmtoolsd 2026-06-02 13:02:10.059951 | ubuntu-noble | + 2026-06-02 13:02:10.060058 | ubuntu-noble | +## High Volume Event Filter (especially on Linux Workstations) 2026-06-02 13:02:10.060190 | ubuntu-noble | +-a never,exit -F arch=b64 -F dir=/dev/shm -k sharedmemaccess 2026-06-02 13:02:10.060321 | ubuntu-noble | +-a never,exit -F arch=b64 -F dir=/var/lock/lvm -k locklvm 2026-06-02 13:02:10.060439 | ubuntu-noble | + 2026-06-02 13:02:10.060563 | ubuntu-noble | +## FileBeat 2026-06-02 13:02:10.060693 | ubuntu-noble | +-a never,exit -F arch=b64 -F path=/opt/filebeat -k filebeat 2026-06-02 13:02:10.060810 | ubuntu-noble | + 2026-06-02 13:02:10.060967 | ubuntu-noble | +## More information on how to filter events 2026-06-02 13:02:10.061102 | ubuntu-noble | +### https://access.redhat.com/solutions/2482221 2026-06-02 13:02:10.061218 | ubuntu-noble | + 2026-06-02 13:02:10.061343 | ubuntu-noble | +# Rules ----------------------------------------------------------------------- 2026-06-02 13:02:10.061463 | ubuntu-noble | + 2026-06-02 13:02:10.061586 | ubuntu-noble | +## Kernel parameters 2026-06-02 13:02:10.061710 | ubuntu-noble | +-w /etc/sysctl.conf -p wa -k sysctl 2026-06-02 13:02:10.061864 | ubuntu-noble | +-w /etc/sysctl.d -p wa -k sysctl 2026-06-02 13:02:10.062028 | ubuntu-noble | + 2026-06-02 13:02:10.062155 | ubuntu-noble | +## Kernel module loading and unloading 2026-06-02 13:02:10.062285 | ubuntu-noble | +-a always,exit -F perm=x -F auid!=-1 -F path=/sbin/insmod -k modules 2026-06-02 13:02:10.062416 | ubuntu-noble | +-a always,exit -F perm=x -F auid!=-1 -F path=/sbin/modprobe -k modules 2026-06-02 13:02:10.062536 | ubuntu-noble | +-a always,exit -F perm=x -F auid!=-1 -F path=/sbin/rmmod -k modules 2026-06-02 13:02:10.062655 | ubuntu-noble | +-a always,exit -F arch=b64 -S finit_module -S init_module -S delete_module -F auid!=-1 -k modules 2026-06-02 13:02:10.062763 | ubuntu-noble | + 2026-06-02 13:02:10.062895 | ubuntu-noble | +## Modprobe configuration 2026-06-02 13:02:10.063033 | ubuntu-noble | +-w /etc/modprobe.conf -p wa -k modprobe 2026-06-02 13:02:10.063146 | ubuntu-noble | +-w /etc/modprobe.d -p wa -k modprobe 2026-06-02 13:02:10.063253 | ubuntu-noble | + 2026-06-02 13:02:10.063368 | ubuntu-noble | +## KExec usage (all actions) 2026-06-02 13:02:10.063487 | ubuntu-noble | +-a always,exit -F arch=b64 -S kexec_load -k KEXEC 2026-06-02 13:02:10.063608 | ubuntu-noble | + 2026-06-02 13:02:10.063723 | ubuntu-noble | +## Special files 2026-06-02 13:02:10.063856 | ubuntu-noble | +-a always,exit -F arch=b64 -S mknod -S mknodat -k specialfiles 2026-06-02 13:02:10.063982 | ubuntu-noble | + 2026-06-02 13:02:10.064100 | ubuntu-noble | +## Mount operations (only attributable) 2026-06-02 13:02:10.064217 | ubuntu-noble | +-a always,exit -F arch=b64 -S mount -S umount2 -F auid!=-1 -k mount 2026-06-02 13:02:10.064324 | ubuntu-noble | + 2026-06-02 13:02:10.064438 | ubuntu-noble | +### NFS mount 2026-06-02 13:02:10.064563 | ubuntu-noble | +-a always,exit -F path=/sbin/mount.nfs -F perm=x -F auid>=500 -F auid!=4294967295 -k T1078_Valid_Accounts 2026-06-02 13:02:10.064684 | ubuntu-noble | +-a always,exit -F path=/usr/sbin/mount.nfs -F perm=x -F auid>=500 -F auid!=4294967295 -k T1078_Valid_Accounts 2026-06-02 13:02:10.064793 | ubuntu-noble | + 2026-06-02 13:02:10.064966 | ubuntu-noble | +## Change swap (only attributable) 2026-06-02 13:02:10.065095 | ubuntu-noble | +-a always,exit -F arch=b64 -S swapon -S swapoff -F auid!=-1 -k swap 2026-06-02 13:02:10.065203 | ubuntu-noble | + 2026-06-02 13:02:10.065315 | ubuntu-noble | +## Time 2026-06-02 13:02:10.065436 | ubuntu-noble | +-a always,exit -F arch=b64 -F uid!=ntp -S adjtimex -S settimeofday -S clock_settime -k time 2026-06-02 13:02:10.065550 | ubuntu-noble | +### Local time zone 2026-06-02 13:02:10.065662 | ubuntu-noble | +-w /etc/localtime -p wa -k localtime 2026-06-02 13:02:10.065771 | ubuntu-noble | + 2026-06-02 13:02:10.065914 | ubuntu-noble | +## Stunnel 2026-06-02 13:02:10.066048 | ubuntu-noble | +-w /usr/sbin/stunnel -p x -k stunnel 2026-06-02 13:02:10.066164 | ubuntu-noble | +-w /usr/bin/stunnel -p x -k stunnel 2026-06-02 13:02:10.066271 | ubuntu-noble | + 2026-06-02 13:02:10.066386 | ubuntu-noble | +## Cron configuration & scheduled jobs 2026-06-02 13:02:10.066499 | ubuntu-noble | +-w /etc/cron.allow -p wa -k cron 2026-06-02 13:02:10.066612 | ubuntu-noble | +-w /etc/cron.deny -p wa -k cron 2026-06-02 13:02:10.066724 | ubuntu-noble | +-w /etc/cron.d/ -p wa -k cron 2026-06-02 13:02:10.066853 | ubuntu-noble | +-w /etc/cron.daily/ -p wa -k cron 2026-06-02 13:02:10.066991 | ubuntu-noble | +-w /etc/cron.hourly/ -p wa -k cron 2026-06-02 13:02:10.067105 | ubuntu-noble | +-w /etc/cron.monthly/ -p wa -k cron 2026-06-02 13:02:10.067219 | ubuntu-noble | +-w /etc/cron.weekly/ -p wa -k cron 2026-06-02 13:02:10.067332 | ubuntu-noble | +-w /etc/crontab -p wa -k cron 2026-06-02 13:02:10.067443 | ubuntu-noble | +-w /var/spool/cron/ -p wa -k cron 2026-06-02 13:02:10.067553 | ubuntu-noble | + 2026-06-02 13:02:10.067667 | ubuntu-noble | +## User, group, password databases 2026-06-02 13:02:10.067778 | ubuntu-noble | +-w /etc/group -p wa -k etcgroup 2026-06-02 13:02:10.067940 | ubuntu-noble | +-w /etc/passwd -p wa -k etcpasswd 2026-06-02 13:02:10.068065 | ubuntu-noble | +-w /etc/gshadow -k etcgroup 2026-06-02 13:02:10.068178 | ubuntu-noble | +-w /etc/shadow -k etcpasswd 2026-06-02 13:02:10.068292 | ubuntu-noble | +-w /etc/security/opasswd -k opasswd 2026-06-02 13:02:10.068400 | ubuntu-noble | + 2026-06-02 13:02:10.068515 | ubuntu-noble | +## Sudoers file changes 2026-06-02 13:02:10.068629 | ubuntu-noble | +-w /etc/sudoers -p wa -k actions 2026-06-02 13:02:10.068741 | ubuntu-noble | +-w /etc/sudoers.d/ -p wa -k actions 2026-06-02 13:02:10.068876 | ubuntu-noble | + 2026-06-02 13:02:10.069008 | ubuntu-noble | +## Passwd 2026-06-02 13:02:10.069125 | ubuntu-noble | +-w /usr/bin/passwd -p x -k passwd_modification 2026-06-02 13:02:10.069231 | ubuntu-noble | + 2026-06-02 13:02:10.069345 | ubuntu-noble | +## Tools to change group identifiers 2026-06-02 13:02:10.069463 | ubuntu-noble | +-w /usr/sbin/groupadd -p x -k group_modification 2026-06-02 13:02:10.070658 | ubuntu-noble | +-w /usr/sbin/groupmod -p x -k group_modification 2026-06-02 13:02:10.070820 | ubuntu-noble | +-w /usr/sbin/addgroup -p x -k group_modification 2026-06-02 13:02:10.071033 | ubuntu-noble | +-w /usr/sbin/useradd -p x -k user_modification 2026-06-02 13:02:10.072849 | ubuntu-noble | +-w /usr/sbin/userdel -p x -k user_modification 2026-06-02 13:02:10.072879 | ubuntu-noble | +-w /usr/sbin/usermod -p x -k user_modification 2026-06-02 13:02:10.072884 | ubuntu-noble | +-w /usr/sbin/adduser -p x -k user_modification 2026-06-02 13:02:10.072888 | ubuntu-noble | + 2026-06-02 13:02:10.072892 | ubuntu-noble | +## Login configuration and information 2026-06-02 13:02:10.072896 | ubuntu-noble | +-w /etc/login.defs -p wa -k login 2026-06-02 13:02:10.072915 | ubuntu-noble | +-w /etc/securetty -p wa -k login 2026-06-02 13:02:10.072920 | ubuntu-noble | +-w /var/log/faillog -p wa -k login 2026-06-02 13:02:10.072923 | ubuntu-noble | +-w /var/log/lastlog -p wa -k login 2026-06-02 13:02:10.072927 | ubuntu-noble | +-w /var/log/tallylog -p wa -k login 2026-06-02 13:02:10.072931 | ubuntu-noble | + 2026-06-02 13:02:10.072935 | ubuntu-noble | +## Network Environment 2026-06-02 13:02:10.072938 | ubuntu-noble | +### Changes to hostname 2026-06-02 13:02:10.072953 | ubuntu-noble | +-a always,exit -F arch=b64 -S sethostname -S setdomainname -k network_modifications 2026-06-02 13:02:10.072957 | ubuntu-noble | + 2026-06-02 13:02:10.072961 | ubuntu-noble | +### Detect Remote Shell Use 2026-06-02 13:02:10.072965 | ubuntu-noble | +-a always,exit -F arch=b64 -F exe=/bin/bash -F success=1 -S connect -k "remote_shell" 2026-06-02 13:02:10.073066 | ubuntu-noble | +-a always,exit -F arch=b64 -F exe=/usr/bin/bash -F success=1 -S connect -k "remote_shell" 2026-06-02 13:02:10.073178 | ubuntu-noble | + 2026-06-02 13:02:10.073293 | ubuntu-noble | +### Successful IPv4 Connections 2026-06-02 13:02:10.073413 | ubuntu-noble | +-a always,exit -F arch=b64 -S connect -F a2=16 -F success=1 -F key=network_connect_4 2026-06-02 13:02:10.073521 | ubuntu-noble | + 2026-06-02 13:02:10.073637 | ubuntu-noble | +### Successful IPv6 Connections 2026-06-02 13:02:10.073756 | ubuntu-noble | +-a always,exit -F arch=b64 -S connect -F a2=28 -F success=1 -F key=network_connect_6 2026-06-02 13:02:10.073897 | ubuntu-noble | + 2026-06-02 13:02:10.074034 | ubuntu-noble | +### Changes to other files 2026-06-02 13:02:10.074151 | ubuntu-noble | +-w /etc/hosts -p wa -k network_modifications 2026-06-02 13:02:10.074266 | ubuntu-noble | +-w /etc/sysconfig/network -p wa -k network_modifications 2026-06-02 13:02:10.074383 | ubuntu-noble | +-w /etc/sysconfig/network-scripts -p w -k network_modifications 2026-06-02 13:02:10.074496 | ubuntu-noble | +-w /etc/network/ -p wa -k network 2026-06-02 13:02:10.074623 | ubuntu-noble | +-a always,exit -F dir=/etc/NetworkManager/ -F perm=wa -k network_modifications 2026-06-02 13:02:10.074733 | ubuntu-noble | + 2026-06-02 13:02:10.074874 | ubuntu-noble | +### Changes to issue 2026-06-02 13:02:10.075041 | ubuntu-noble | +-w /etc/issue -p wa -k etcissue 2026-06-02 13:02:10.075158 | ubuntu-noble | +-w /etc/issue.net -p wa -k etcissue 2026-06-02 13:02:10.075270 | ubuntu-noble | + 2026-06-02 13:02:10.075707 | ubuntu-noble | +## System startup scripts 2026-06-02 13:02:10.075861 | ubuntu-noble | +-w /etc/inittab -p wa -k init 2026-06-02 13:02:10.076007 | ubuntu-noble | +-w /etc/init.d/ -p wa -k init 2026-06-02 13:02:10.076260 | ubuntu-noble | +-w /etc/init/ -p wa -k init 2026-06-02 13:02:10.076379 | ubuntu-noble | + 2026-06-02 13:02:10.076493 | ubuntu-noble | +## Library search paths 2026-06-02 13:02:10.076609 | ubuntu-noble | +-w /etc/ld.so.conf -p wa -k libpath 2026-06-02 13:02:10.076724 | ubuntu-noble | +-w /etc/ld.so.conf.d -p wa -k libpath 2026-06-02 13:02:10.076860 | ubuntu-noble | + 2026-06-02 13:02:10.077041 | ubuntu-noble | +## Systemwide library preloads (LD_PRELOAD) 2026-06-02 13:02:10.077159 | ubuntu-noble | +-w /etc/ld.so.preload -p wa -k systemwide_preloads 2026-06-02 13:02:10.077438 | ubuntu-noble | + 2026-06-02 13:02:10.077584 | ubuntu-noble | +## Pam configuration 2026-06-02 13:02:10.077701 | ubuntu-noble | +-w /etc/pam.d/ -p wa -k pam 2026-06-02 13:02:10.077950 | ubuntu-noble | +-w /etc/security/limits.conf -p wa -k pam 2026-06-02 13:02:10.078085 | ubuntu-noble | +-w /etc/security/limits.d -p wa -k pam 2026-06-02 13:02:10.078201 | ubuntu-noble | +-w /etc/security/pam_env.conf -p wa -k pam 2026-06-02 13:02:10.078316 | ubuntu-noble | +-w /etc/security/namespace.conf -p wa -k pam 2026-06-02 13:02:10.078429 | ubuntu-noble | +-w /etc/security/namespace.d -p wa -k pam 2026-06-02 13:02:10.078542 | ubuntu-noble | +-w /etc/security/namespace.init -p wa -k pam 2026-06-02 13:02:10.078652 | ubuntu-noble | + 2026-06-02 13:02:10.078767 | ubuntu-noble | +## Mail configuration 2026-06-02 13:02:10.078912 | ubuntu-noble | +-w /etc/aliases -p wa -k mail 2026-06-02 13:02:10.079226 | ubuntu-noble | +-w /etc/postfix/ -p wa -k mail 2026-06-02 13:02:10.079351 | ubuntu-noble | +-w /etc/exim4/ -p wa -k mail 2026-06-02 13:02:10.079657 | ubuntu-noble | + 2026-06-02 13:02:10.079780 | ubuntu-noble | +## SSH configuration 2026-06-02 13:02:10.079974 | ubuntu-noble | +-w /etc/ssh/sshd_config -k sshd 2026-06-02 13:02:10.080101 | ubuntu-noble | +-w /etc/ssh/sshd_config.d -k sshd 2026-06-02 13:02:10.080209 | ubuntu-noble | + 2026-06-02 13:02:10.080320 | ubuntu-noble | +## root ssh key tampering 2026-06-02 13:02:10.080434 | ubuntu-noble | +-w /root/.ssh -p wa -k rootkey 2026-06-02 13:02:10.080542 | ubuntu-noble | + 2026-06-02 13:02:10.080654 | ubuntu-noble | +# Systemd 2026-06-02 13:02:10.080767 | ubuntu-noble | +-w /bin/systemctl -p x -k systemd 2026-06-02 13:02:10.080923 | ubuntu-noble | +-w /etc/systemd/ -p wa -k systemd 2026-06-02 13:02:10.081044 | ubuntu-noble | +-w /usr/lib/systemd -p wa -k systemd 2026-06-02 13:02:10.081152 | ubuntu-noble | + 2026-06-02 13:02:10.081272 | ubuntu-noble | +## https://systemd.network/systemd.generator.html 2026-06-02 13:02:10.081386 | ubuntu-noble | +-w /etc/systemd/system-generators/ -p wa -k systemd_generator 2026-06-02 13:02:10.081503 | ubuntu-noble | +-w /usr/local/lib/systemd/system-generators/ -p wa -k systemd_generator 2026-06-02 13:02:10.081625 | ubuntu-noble | +-w /usr/lib/systemd/system-generators -p wa -k systemd_generator 2026-06-02 13:02:10.081745 | ubuntu-noble | + 2026-06-02 13:02:10.081888 | ubuntu-noble | +-w /etc/systemd/user-generators/ -p wa -k systemd_generator 2026-06-02 13:02:10.082027 | ubuntu-noble | +-w /usr/local/lib/systemd/user-generators/ -p wa -k systemd_generator 2026-06-02 13:02:10.082141 | ubuntu-noble | +-w /lib/systemd/system-generators/ -p wa -k systemd_generator 2026-06-02 13:02:10.082248 | ubuntu-noble | + 2026-06-02 13:02:10.082366 | ubuntu-noble | +## SELinux events that modify the system's Mandatory Access Controls (MAC) 2026-06-02 13:02:10.082480 | ubuntu-noble | +-w /etc/selinux/ -p wa -k mac_policy 2026-06-02 13:02:10.082586 | ubuntu-noble | + 2026-06-02 13:02:10.082698 | ubuntu-noble | +## Critical elements access failures 2026-06-02 13:02:10.082817 | ubuntu-noble | +-a always,exit -F arch=b64 -S open -F dir=/etc -F success=0 -k unauthedfileaccess 2026-06-02 13:02:10.083016 | ubuntu-noble | +-a always,exit -F arch=b64 -S open -F dir=/bin -F success=0 -k unauthedfileaccess 2026-06-02 13:02:10.083141 | ubuntu-noble | +-a always,exit -F arch=b64 -S open -F dir=/sbin -F success=0 -k unauthedfileaccess 2026-06-02 13:02:10.083260 | ubuntu-noble | +-a always,exit -F arch=b64 -S open -F dir=/usr/bin -F success=0 -k unauthedfileaccess 2026-06-02 13:02:10.083378 | ubuntu-noble | +-a always,exit -F arch=b64 -S open -F dir=/usr/sbin -F success=0 -k unauthedfileaccess 2026-06-02 13:02:10.083495 | ubuntu-noble | +-a always,exit -F arch=b64 -S open -F dir=/var -F success=0 -k unauthedfileaccess 2026-06-02 13:02:10.083612 | ubuntu-noble | +-a always,exit -F arch=b64 -S open -F dir=/home -F success=0 -k unauthedfileaccess 2026-06-02 13:02:10.083731 | ubuntu-noble | +-a always,exit -F arch=b64 -S open -F dir=/srv -F success=0 -k unauthedfileaccess 2026-06-02 13:02:10.083865 | ubuntu-noble | + 2026-06-02 13:02:10.084859 | ubuntu-noble | +## Process ID change (switching accounts) applications 2026-06-02 13:02:10.084871 | ubuntu-noble | +-w /bin/su -p x -k priv_esc 2026-06-02 13:02:10.084875 | ubuntu-noble | +-w /usr/bin/sudo -p x -k priv_esc 2026-06-02 13:02:10.084879 | ubuntu-noble | + 2026-06-02 13:02:10.084883 | ubuntu-noble | +## Power state 2026-06-02 13:02:10.084887 | ubuntu-noble | +-w /sbin/shutdown -p x -k power 2026-06-02 13:02:10.084890 | ubuntu-noble | +-w /sbin/poweroff -p x -k power 2026-06-02 13:02:10.084894 | ubuntu-noble | +-w /sbin/reboot -p x -k power 2026-06-02 13:02:10.084909 | ubuntu-noble | +-w /sbin/halt -p x -k power 2026-06-02 13:02:10.084913 | ubuntu-noble | + 2026-06-02 13:02:10.085034 | ubuntu-noble | +## Session initiation information 2026-06-02 13:02:10.085149 | ubuntu-noble | +-w /var/run/utmp -p wa -k session 2026-06-02 13:02:10.085264 | ubuntu-noble | +-w /var/log/btmp -p wa -k session 2026-06-02 13:02:10.085377 | ubuntu-noble | +-w /var/log/wtmp -p wa -k session 2026-06-02 13:02:10.085483 | ubuntu-noble | + 2026-06-02 13:02:10.085600 | ubuntu-noble | +## Discretionary Access Control (DAC) modifications 2026-06-02 13:02:10.085718 | ubuntu-noble | +-a always,exit -F arch=b64 -S chmod -F auid>=1000 -F auid!=-1 -k perm_mod 2026-06-02 13:02:10.085854 | ubuntu-noble | +-a always,exit -F arch=b64 -S chown -F auid>=1000 -F auid!=-1 -k perm_mod 2026-06-02 13:02:10.086023 | ubuntu-noble | +-a always,exit -F arch=b64 -S fchmod -F auid>=1000 -F auid!=-1 -k perm_mod 2026-06-02 13:02:10.086144 | ubuntu-noble | +-a always,exit -F arch=b64 -S fchmodat -F auid>=1000 -F auid!=-1 -k perm_mod 2026-06-02 13:02:10.086261 | ubuntu-noble | +-a always,exit -F arch=b64 -S fchown -F auid>=1000 -F auid!=-1 -k perm_mod 2026-06-02 13:02:10.086381 | ubuntu-noble | +-a always,exit -F arch=b64 -S fchownat -F auid>=1000 -F auid!=-1 -k perm_mod 2026-06-02 13:02:10.086500 | ubuntu-noble | +-a always,exit -F arch=b64 -S fremovexattr -F auid>=1000 -F auid!=-1 -k perm_mod 2026-06-02 13:02:10.086619 | ubuntu-noble | +-a always,exit -F arch=b64 -S fsetxattr -F auid>=1000 -F auid!=-1 -k perm_mod 2026-06-02 13:02:10.086734 | ubuntu-noble | +-a always,exit -F arch=b64 -S lchown -F auid>=1000 -F auid!=-1 -k perm_mod 2026-06-02 13:02:10.086874 | ubuntu-noble | +-a always,exit -F arch=b64 -S lremovexattr -F auid>=1000 -F auid!=-1 -k perm_mod 2026-06-02 13:02:10.087012 | ubuntu-noble | +-a always,exit -F arch=b64 -S lsetxattr -F auid>=1000 -F auid!=-1 -k perm_mod 2026-06-02 13:02:10.087128 | ubuntu-noble | +-a always,exit -F arch=b64 -S removexattr -F auid>=1000 -F auid!=-1 -k perm_mod 2026-06-02 13:02:10.087253 | ubuntu-noble | +-a always,exit -F arch=b64 -S setxattr -F auid>=1000 -F auid!=-1 -k perm_mod 2026-06-02 13:02:10.087361 | ubuntu-noble | + 2026-06-02 13:02:10.087473 | ubuntu-noble | +# Special Rules --------------------------------------------------------------- 2026-06-02 13:02:10.087579 | ubuntu-noble | + 2026-06-02 13:02:10.087699 | ubuntu-noble | +## Reconnaissance 2026-06-02 13:02:10.087815 | ubuntu-noble | +-w /usr/bin/whoami -p x -k recon 2026-06-02 13:02:10.087977 | ubuntu-noble | +-w /usr/bin/id -p x -k recon 2026-06-02 13:02:10.088097 | ubuntu-noble | +-w /bin/hostname -p x -k recon 2026-06-02 13:02:10.088212 | ubuntu-noble | +-w /bin/uname -p x -k recon 2026-06-02 13:02:10.088326 | ubuntu-noble | +-w /etc/issue -p r -k recon 2026-06-02 13:02:10.088438 | ubuntu-noble | +-w /etc/hostname -p r -k recon 2026-06-02 13:02:10.088545 | ubuntu-noble | + 2026-06-02 13:02:10.088659 | ubuntu-noble | +## Suspicious activity 2026-06-02 13:02:10.088775 | ubuntu-noble | +-w /usr/bin/wget -p x -k susp_activity 2026-06-02 13:02:10.088921 | ubuntu-noble | +-w /usr/bin/curl -p x -k susp_activity 2026-06-02 13:02:10.089042 | ubuntu-noble | +-w /usr/bin/base64 -p x -k susp_activity 2026-06-02 13:02:10.089156 | ubuntu-noble | +-w /bin/nc -p x -k susp_activity 2026-06-02 13:02:10.089270 | ubuntu-noble | +-w /bin/netcat -p x -k susp_activity 2026-06-02 13:02:10.089384 | ubuntu-noble | +-w /usr/bin/ncat -p x -k susp_activity 2026-06-02 13:02:10.089499 | ubuntu-noble | +-w /usr/bin/ss -p x -k susp_activity 2026-06-02 13:02:10.089613 | ubuntu-noble | +-w /usr/bin/netstat -p x -k susp_activity 2026-06-02 13:02:10.089725 | ubuntu-noble | +-w /usr/bin/ssh -p x -k susp_activity 2026-06-02 13:02:10.089856 | ubuntu-noble | +-w /usr/bin/scp -p x -k susp_activity 2026-06-02 13:02:10.089990 | ubuntu-noble | +-w /usr/bin/sftp -p x -k susp_activity 2026-06-02 13:02:10.090105 | ubuntu-noble | +-w /usr/bin/ftp -p x -k susp_activity 2026-06-02 13:02:10.090302 | ubuntu-noble | +-w /usr/bin/socat -p x -k susp_activity 2026-06-02 13:02:10.090421 | ubuntu-noble | +-w /usr/bin/wireshark -p x -k susp_activity 2026-06-02 13:02:10.090546 | ubuntu-noble | +-w /usr/bin/tshark -p x -k susp_activity 2026-06-02 13:02:10.090663 | ubuntu-noble | +-w /usr/bin/rawshark -p x -k susp_activity 2026-06-02 13:02:10.090779 | ubuntu-noble | +-w /usr/bin/rdesktop -p x -k susp_activity 2026-06-02 13:02:10.090941 | ubuntu-noble | +-w /usr/local/bin/rdesktop -p x -k susp_activity 2026-06-02 13:02:10.091069 | ubuntu-noble | +-w /usr/bin/wlfreerdp -p x -k susp_activity 2026-06-02 13:02:10.091184 | ubuntu-noble | +-w /usr/bin/xfreerdp -p x -k susp_activity 2026-06-02 13:02:10.091299 | ubuntu-noble | +-w /usr/local/bin/xfreerdp -p x -k susp_activity 2026-06-02 13:02:10.091413 | ubuntu-noble | +-w /usr/bin/nmap -p x -k susp_activity 2026-06-02 13:02:10.091523 | ubuntu-noble | + 2026-06-02 13:02:10.091633 | ubuntu-noble | +## sssd 2026-06-02 13:02:10.092845 | ubuntu-noble | +-a always,exit -F path=/usr/libexec/sssd/p11_child -F perm=x -F auid>=500 -F auid!=4294967295 -k T1078_Valid_Accounts 2026-06-02 13:02:10.092865 | ubuntu-noble | +-a always,exit -F path=/usr/libexec/sssd/krb5_child -F perm=x -F auid>=500 -F auid!=4294967295 -k T1078_Valid_Accounts 2026-06-02 13:02:10.092869 | ubuntu-noble | +-a always,exit -F path=/usr/libexec/sssd/ldap_child -F perm=x -F auid>=500 -F auid!=4294967295 -k T1078_Valid_Accounts 2026-06-02 13:02:10.092872 | ubuntu-noble | +-a always,exit -F path=/usr/libexec/sssd/selinux_child -F perm=x -F auid>=500 -F auid!=4294967295 -k T1078_Valid_Accounts 2026-06-02 13:02:10.092876 | ubuntu-noble | +-a always,exit -F path=/usr/libexec/sssd/proxy_child -F perm=x -F auid>=500 -F auid!=4294967295 -k T1078_Valid_Accounts 2026-06-02 13:02:10.092880 | ubuntu-noble | + 2026-06-02 13:02:10.092884 | ubuntu-noble | +## T1002 Data Compressed 2026-06-02 13:02:10.092887 | ubuntu-noble | + 2026-06-02 13:02:10.092891 | ubuntu-noble | +-w /usr/bin/zip -p x -k Data_Compressed 2026-06-02 13:02:10.092894 | ubuntu-noble | +-w /usr/bin/gzip -p x -k Data_Compressed 2026-06-02 13:02:10.092898 | ubuntu-noble | +-w /usr/bin/tar -p x -k Data_Compressed 2026-06-02 13:02:10.092934 | ubuntu-noble | +-w /usr/bin/bzip2 -p x -k Data_Compressed 2026-06-02 13:02:10.093049 | ubuntu-noble | + 2026-06-02 13:02:10.093166 | ubuntu-noble | +-w /usr/bin/lzip -p x -k Data_Compressed 2026-06-02 13:02:10.093282 | ubuntu-noble | +-w /usr/local/bin/lzip -p x -k Data_Compressed 2026-06-02 13:02:10.093388 | ubuntu-noble | + 2026-06-02 13:02:10.093504 | ubuntu-noble | +-w /usr/bin/lz4 -p x -k Data_Compressed 2026-06-02 13:02:10.093619 | ubuntu-noble | +-w /usr/local/bin/lz4 -p x -k Data_Compressed 2026-06-02 13:02:10.093723 | ubuntu-noble | + 2026-06-02 13:02:10.093854 | ubuntu-noble | +-w /usr/bin/lzop -p x -k Data_Compressed 2026-06-02 13:02:10.094007 | ubuntu-noble | +-w /usr/local/bin/lzop -p x -k Data_Compressed 2026-06-02 13:02:10.094119 | ubuntu-noble | + 2026-06-02 13:02:10.094235 | ubuntu-noble | +-w /usr/bin/plzip -p x -k Data_Compressed 2026-06-02 13:02:10.094351 | ubuntu-noble | +-w /usr/local/bin/plzip -p x -k Data_Compressed 2026-06-02 13:02:10.094460 | ubuntu-noble | + 2026-06-02 13:02:10.094576 | ubuntu-noble | +-w /usr/bin/pbzip2 -p x -k Data_Compressed 2026-06-02 13:02:10.094703 | ubuntu-noble | +-w /usr/local/bin/pbzip2 -p x -k Data_Compressed 2026-06-02 13:02:10.094811 | ubuntu-noble | + 2026-06-02 13:02:10.094969 | ubuntu-noble | +-w /usr/bin/lbzip2 -p x -k Data_Compressed 2026-06-02 13:02:10.095093 | ubuntu-noble | +-w /usr/local/bin/lbzip2 -p x -k Data_Compressed 2026-06-02 13:02:10.095202 | ubuntu-noble | + 2026-06-02 13:02:10.095314 | ubuntu-noble | +-w /usr/bin/pixz -p x -k Data_Compressed 2026-06-02 13:02:10.095429 | ubuntu-noble | +-w /usr/local/bin/pixz -p x -k Data_Compressed 2026-06-02 13:02:10.095536 | ubuntu-noble | + 2026-06-02 13:02:10.095658 | ubuntu-noble | +-w /usr/bin/pigz -p x -k Data_Compressed 2026-06-02 13:02:10.095773 | ubuntu-noble | +-w /usr/local/bin/pigz -p x -k Data_Compressed 2026-06-02 13:02:10.095919 | ubuntu-noble | +-w /usr/bin/unpigz -p x -k Data_Compressed 2026-06-02 13:02:10.096045 | ubuntu-noble | +-w /usr/local/bin/unpigz -p x -k Data_Compressed 2026-06-02 13:02:10.096154 | ubuntu-noble | + 2026-06-02 13:02:10.096270 | ubuntu-noble | +-w /usr/bin/zstd -p x -k Data_Compressed 2026-06-02 13:02:10.096386 | ubuntu-noble | +-w /usr/local/bin/zstd -p x -k Data_Compressed 2026-06-02 13:02:10.096493 | ubuntu-noble | + 2026-06-02 13:02:10.096606 | ubuntu-noble | +## Added to catch netcat on Ubuntu 2026-06-02 13:02:10.096723 | ubuntu-noble | +-w /bin/nc.openbsd -p x -k susp_activity 2026-06-02 13:02:10.096855 | ubuntu-noble | +-w /bin/nc.traditional -p x -k susp_activity 2026-06-02 13:02:10.097003 | ubuntu-noble | + 2026-06-02 13:02:10.097119 | ubuntu-noble | +## Sbin suspicious activity 2026-06-02 13:02:10.097235 | ubuntu-noble | +-w /sbin/iptables -p x -k sbin_susp 2026-06-02 13:02:10.097347 | ubuntu-noble | +-w /sbin/ip6tables -p x -k sbin_susp 2026-06-02 13:02:10.097460 | ubuntu-noble | +-w /sbin/ifconfig -p x -k sbin_susp 2026-06-02 13:02:10.097573 | ubuntu-noble | +-w /usr/sbin/arptables -p x -k sbin_susp 2026-06-02 13:02:10.097683 | ubuntu-noble | +-w /usr/sbin/ebtables -p x -k sbin_susp 2026-06-02 13:02:10.097796 | ubuntu-noble | +-w /sbin/xtables-nft-multi -p x -k sbin_susp 2026-06-02 13:02:10.097940 | ubuntu-noble | +-w /usr/sbin/nft -p x -k sbin_susp 2026-06-02 13:02:10.098063 | ubuntu-noble | +-w /usr/sbin/tcpdump -p x -k sbin_susp 2026-06-02 13:02:10.098177 | ubuntu-noble | +-w /usr/sbin/traceroute -p x -k sbin_susp 2026-06-02 13:02:10.098290 | ubuntu-noble | +-w /usr/sbin/ufw -p x -k sbin_susp 2026-06-02 13:02:10.098438 | ubuntu-noble | + 2026-06-02 13:02:10.098631 | ubuntu-noble | +### kde4 2026-06-02 13:02:10.098796 | ubuntu-noble | +-a always,exit -F path=/usr/libexec/kde4/kpac_dhcp_helper -F perm=x -F auid>=1000 -F auid!=4294967295 -k T1078_Valid_Accounts 2026-06-02 13:02:10.098978 | ubuntu-noble | +-a always,exit -F path=/usr/libexec/kde4/kdesud -F perm=x -F auid>=1000 -F auid!=4294967295 -k T1078_Valid_Accounts 2026-06-02 13:02:10.099101 | ubuntu-noble | + 2026-06-02 13:02:10.099216 | ubuntu-noble | +## dbus-send invocation 2026-06-02 13:02:10.099336 | ubuntu-noble | +### may indicate privilege escalation CVE-2021-3560 2026-06-02 13:02:10.099450 | ubuntu-noble | +-w /usr/bin/dbus-send -p x -k dbus_send 2026-06-02 13:02:10.099565 | ubuntu-noble | +-w /usr/bin/gdbus -p x -k gdubs_call 2026-06-02 13:02:10.099673 | ubuntu-noble | + 2026-06-02 13:02:10.099786 | ubuntu-noble | +## pkexec invocation 2026-06-02 13:02:10.099953 | ubuntu-noble | +### may indicate privilege escalation CVE-2021-4034 2026-06-02 13:02:10.100075 | ubuntu-noble | +-w /usr/bin/pkexec -p x -k pkexec 2026-06-02 13:02:10.100184 | ubuntu-noble | + 2026-06-02 13:02:10.100296 | ubuntu-noble | +## Suspicious shells 2026-06-02 13:02:10.100411 | ubuntu-noble | +-w /bin/ash -p x -k susp_shell 2026-06-02 13:02:10.100525 | ubuntu-noble | +-w /bin/csh -p x -k susp_shell 2026-06-02 13:02:10.100636 | ubuntu-noble | +-w /bin/fish -p x -k susp_shell 2026-06-02 13:02:10.100749 | ubuntu-noble | +-w /bin/tcsh -p x -k susp_shell 2026-06-02 13:02:10.100879 | ubuntu-noble | +-w /bin/tclsh -p x -k susp_shell 2026-06-02 13:02:10.101017 | ubuntu-noble | +-w /bin/xonsh -p x -k susp_shell 2026-06-02 13:02:10.101136 | ubuntu-noble | +-w /usr/local/bin/xonsh -p x -k susp_shell 2026-06-02 13:02:10.101857 | ubuntu-noble | +-w /bin/open -p x -k susp_shell 2026-06-02 13:02:10.101869 | ubuntu-noble | +-w /bin/rbash -p x -k susp_shell 2026-06-02 13:02:10.101873 | ubuntu-noble | + 2026-06-02 13:02:10.101877 | ubuntu-noble | +# Web Server Actvity 2026-06-02 13:02:10.101881 | ubuntu-noble | +## Change the number "33" to the ID of your WebServer user. Default: www-data:x:33:33 2026-06-02 13:02:10.101885 | ubuntu-noble | +-a always,exit -F arch=b64 -S execve -F euid=33 -k detect_execve_www 2026-06-02 13:02:10.101889 | ubuntu-noble | + 2026-06-02 13:02:10.102019 | ubuntu-noble | +### https://clustershell.readthedocs.io/ 2026-06-02 13:02:10.102139 | ubuntu-noble | +-w /bin/clush -p x -k susp_shell 2026-06-02 13:02:10.102268 | ubuntu-noble | +-w /usr/local/bin/clush -p x -k susp_shell 2026-06-02 13:02:10.102385 | ubuntu-noble | +-w /etc/clustershell/clush.conf -p x -k susp_shell 2026-06-02 13:02:10.102506 | ubuntu-noble | + 2026-06-02 13:02:10.102622 | ubuntu-noble | +### https://github.com/tmux/tmux 2026-06-02 13:02:10.102735 | ubuntu-noble | +-w /bin/tmux -p x -k susp_shell 2026-06-02 13:02:10.102869 | ubuntu-noble | +-w /usr/local/bin/tmux -p x -k susp_shell 2026-06-02 13:02:10.103000 | ubuntu-noble | + 2026-06-02 13:02:10.103116 | ubuntu-noble | +## Shell/profile configurations 2026-06-02 13:02:10.103231 | ubuntu-noble | +-w /etc/profile.d/ -p wa -k shell_profiles 2026-06-02 13:02:10.103344 | ubuntu-noble | +-w /etc/profile -p wa -k shell_profiles 2026-06-02 13:02:10.103457 | ubuntu-noble | +-w /etc/shells -p wa -k shell_profiles 2026-06-02 13:02:10.103570 | ubuntu-noble | +-w /etc/bashrc -p wa -k shell_profiles 2026-06-02 13:02:10.103682 | ubuntu-noble | +-w /etc/csh.cshrc -p wa -k shell_profiles 2026-06-02 13:02:10.103797 | ubuntu-noble | +-w /etc/csh.login -p wa -k shell_profiles 2026-06-02 13:02:10.103940 | ubuntu-noble | +-w /etc/fish/ -p wa -k shell_profiles 2026-06-02 13:02:10.104059 | ubuntu-noble | +-w /etc/zsh/ -p wa -k shell_profiles 2026-06-02 13:02:10.104167 | ubuntu-noble | + 2026-06-02 13:02:10.104280 | ubuntu-noble | +### https://github.com/xxh/xxh 2026-06-02 13:02:10.104393 | ubuntu-noble | +-w /usr/local/bin/xxh.bash -p x -k susp_shell 2026-06-02 13:02:10.104505 | ubuntu-noble | +-w /usr/local/bin/xxh.xsh -p x -k susp_shell 2026-06-02 13:02:10.104617 | ubuntu-noble | +-w /usr/local/bin/xxh.zsh -p x -k susp_shell 2026-06-02 13:02:10.104723 | ubuntu-noble | + 2026-06-02 13:02:10.104848 | ubuntu-noble | +## Injection 2026-06-02 13:02:10.105003 | ubuntu-noble | +### These rules watch for code injection by the ptrace facility. 2026-06-02 13:02:10.105122 | ubuntu-noble | +### This could indicate someone trying to do something bad or just debugging 2026-06-02 13:02:10.105239 | ubuntu-noble | +-a always,exit -F arch=b64 -S ptrace -F a0=0x4 -k code_injection 2026-06-02 13:02:10.105357 | ubuntu-noble | +-a always,exit -F arch=b64 -S ptrace -F a0=0x5 -k data_injection 2026-06-02 13:02:10.105472 | ubuntu-noble | +-a always,exit -F arch=b64 -S ptrace -F a0=0x6 -k register_injection 2026-06-02 13:02:10.105586 | ubuntu-noble | +-a always,exit -F arch=b64 -S ptrace -k tracing 2026-06-02 13:02:10.105694 | ubuntu-noble | + 2026-06-02 13:02:10.105809 | ubuntu-noble | +## Anonymous File Creation 2026-06-02 13:02:10.105954 | ubuntu-noble | +### These rules watch the use of memfd_create 2026-06-02 13:02:10.106078 | ubuntu-noble | +### "memfd_create" creates anonymous file and returns a file descriptor to access it 2026-06-02 13:02:10.106199 | ubuntu-noble | +### When combined with "fexecve" can be used to stealthily run binaries in memory without touching disk 2026-06-02 13:02:10.106316 | ubuntu-noble | +-a always,exit -F arch=b64 -S memfd_create -F key=anon_file_create 2026-06-02 13:02:10.106423 | ubuntu-noble | + 2026-06-02 13:02:10.107845 | ubuntu-noble | +## Privilege Abuse 2026-06-02 13:02:10.107858 | ubuntu-noble | +### The purpose of this rule is to detect when an admin may be abusing power by looking in user's home dir. 2026-06-02 13:02:10.107862 | ubuntu-noble | +-a always,exit -F dir=/home -F uid=0 -F auid>=1000 -F auid!=-1 -C auid!=obj_uid -k power_abuse 2026-06-02 13:02:10.107866 | ubuntu-noble | + 2026-06-02 13:02:10.107870 | ubuntu-noble | +# Socket Creations 2026-06-02 13:02:10.107874 | ubuntu-noble | +# will catch both IPv4 and IPv6 2026-06-02 13:02:10.107877 | ubuntu-noble | + 2026-06-02 13:02:10.107881 | ubuntu-noble | +-a always,exit -F arch=b32 -S socket -F a0=2 -k network_socket_created 2026-06-02 13:02:10.107885 | ubuntu-noble | +-a always,exit -F arch=b64 -S socket -F a0=2 -k network_socket_created 2026-06-02 13:02:10.107888 | ubuntu-noble | + 2026-06-02 13:02:10.107892 | ubuntu-noble | +-a always,exit -F arch=b32 -S socket -F a0=10 -k network_socket_created 2026-06-02 13:02:10.107895 | ubuntu-noble | +-a always,exit -F arch=b64 -S socket -F a0=10 -k network_socket_created 2026-06-02 13:02:10.107924 | ubuntu-noble | + 2026-06-02 13:02:10.107929 | ubuntu-noble | +# Software Management --------------------------------------------------------- 2026-06-02 13:02:10.108001 | ubuntu-noble | + 2026-06-02 13:02:10.108118 | ubuntu-noble | +# RPM (Redhat/CentOS) 2026-06-02 13:02:10.108244 | ubuntu-noble | +-w /usr/bin/rpm -p x -k software_mgmt 2026-06-02 13:02:10.108361 | ubuntu-noble | +-w /usr/bin/yum -p x -k software_mgmt 2026-06-02 13:02:10.108468 | ubuntu-noble | + 2026-06-02 13:02:10.108582 | ubuntu-noble | +# DNF (Fedora/RedHat 8/CentOS 8) 2026-06-02 13:02:10.108696 | ubuntu-noble | +-w /usr/bin/dnf -p x -k software_mgmt 2026-06-02 13:02:10.108802 | ubuntu-noble | + 2026-06-02 13:02:10.108945 | ubuntu-noble | +# YAST/Zypper/RPM (SuSE) 2026-06-02 13:02:10.109068 | ubuntu-noble | +-w /sbin/yast -p x -k software_mgmt 2026-06-02 13:02:10.109185 | ubuntu-noble | +-w /sbin/yast2 -p x -k software_mgmt 2026-06-02 13:02:10.109298 | ubuntu-noble | +-w /bin/rpm -p x -k software_mgmt 2026-06-02 13:02:10.109422 | ubuntu-noble | +-w /usr/bin/zypper -k software_mgmt 2026-06-02 13:02:10.109530 | ubuntu-noble | + 2026-06-02 13:02:10.109644 | ubuntu-noble | +# DPKG / APT-GET (Debian/Ubuntu) 2026-06-02 13:02:10.109759 | ubuntu-noble | +-w /usr/bin/dpkg -p x -k software_mgmt 2026-06-02 13:02:10.109888 | ubuntu-noble | +-w /usr/bin/apt -p x -k software_mgmt 2026-06-02 13:02:10.110053 | ubuntu-noble | +-w /usr/bin/apt-add-repository -p x -k software_mgmt 2026-06-02 13:02:10.110170 | ubuntu-noble | +-w /usr/bin/apt-get -p x -k software_mgmt 2026-06-02 13:02:10.110283 | ubuntu-noble | +-w /usr/bin/aptitude -p x -k software_mgmt 2026-06-02 13:02:10.110396 | ubuntu-noble | +-w /usr/bin/wajig -p x -k software_mgmt 2026-06-02 13:02:10.110510 | ubuntu-noble | +-w /usr/bin/snap -p x -k software_mgmt 2026-06-02 13:02:10.110620 | ubuntu-noble | + 2026-06-02 13:02:10.110732 | ubuntu-noble | +# PIP(3) (Python installs) 2026-06-02 13:02:10.110876 | ubuntu-noble | +-w /usr/bin/pip -p x -k third_party_software_mgmt 2026-06-02 13:02:10.111017 | ubuntu-noble | +-w /usr/local/bin/pip -p x -k third_party_software_mgmt 2026-06-02 13:02:10.111133 | ubuntu-noble | +-w /usr/bin/pip3 -p x -k third_party_software_mgmt 2026-06-02 13:02:10.111252 | ubuntu-noble | +-w /usr/local/bin/pip3 -p x -k third_party_software_mgmt 2026-06-02 13:02:10.111369 | ubuntu-noble | +-w /usr/bin/pipx -p x -k third_party_software_mgmt 2026-06-02 13:02:10.111489 | ubuntu-noble | +-w /usr/local/bin/pipx -p x -k third_party_software_mgmt 2026-06-02 13:02:10.111598 | ubuntu-noble | + 2026-06-02 13:02:10.111710 | ubuntu-noble | +# npm 2026-06-02 13:02:10.111844 | ubuntu-noble | +## T1072 third party software 2026-06-02 13:02:10.111983 | ubuntu-noble | +## https://www.npmjs.com 2026-06-02 13:02:10.112101 | ubuntu-noble | +## https://docs.npmjs.com/cli/v6/commands/npm-audit 2026-06-02 13:02:10.112221 | ubuntu-noble | +-w /usr/bin/npm -p x -k third_party_software_mgmt 2026-06-02 13:02:10.112330 | ubuntu-noble | + 2026-06-02 13:02:10.112445 | ubuntu-noble | +# Comprehensive Perl Archive Network (CPAN) (CPAN installs) 2026-06-02 13:02:10.112557 | ubuntu-noble | +## T1072 third party software 2026-06-02 13:02:10.112669 | ubuntu-noble | +## https://www.cpan.org 2026-06-02 13:02:10.112792 | ubuntu-noble | +-w /usr/bin/cpan -p x -k third_party_software_mgmt 2026-06-02 13:02:10.112954 | ubuntu-noble | + 2026-06-02 13:02:10.113074 | ubuntu-noble | +# Ruby (RubyGems installs) 2026-06-02 13:02:10.113190 | ubuntu-noble | +## T1072 third party software 2026-06-02 13:02:10.113304 | ubuntu-noble | +## https://rubygems.org 2026-06-02 13:02:10.113421 | ubuntu-noble | +-w /usr/bin/gem -p x -k third_party_software_mgmt 2026-06-02 13:02:10.113527 | ubuntu-noble | + 2026-06-02 13:02:10.113640 | ubuntu-noble | +# LuaRocks (Lua installs) 2026-06-02 13:02:10.113752 | ubuntu-noble | +## T1072 third party software 2026-06-02 13:02:10.113882 | ubuntu-noble | +## https://luarocks.org 2026-06-02 13:02:10.114017 | ubuntu-noble | +-w /usr/bin/luarocks -p x -k third_party_software_mgmt 2026-06-02 13:02:10.114127 | ubuntu-noble | + 2026-06-02 13:02:10.114243 | ubuntu-noble | +# Pacman (Arch Linux) 2026-06-02 13:02:10.114396 | ubuntu-noble | +## https://wiki.archlinux.org/title/Pacman 2026-06-02 13:02:10.114516 | ubuntu-noble | +## T1072 third party software 2026-06-02 13:02:10.114633 | ubuntu-noble | +-w /etc/pacman.conf -p x -k third_party_software_mgmt 2026-06-02 13:02:10.114750 | ubuntu-noble | +-w /etc/pacman.d -p x -k third_party_software_mgmt 2026-06-02 13:02:10.114877 | ubuntu-noble | + 2026-06-02 13:02:10.115012 | ubuntu-noble | +# Special Software ------------------------------------------------------------ 2026-06-02 13:02:10.115120 | ubuntu-noble | + 2026-06-02 13:02:10.115231 | ubuntu-noble | +## GDS specific secrets 2026-06-02 13:02:10.115344 | ubuntu-noble | +-w /etc/puppet/ssl -p wa -k puppet_ssl 2026-06-02 13:02:10.115453 | ubuntu-noble | + 2026-06-02 13:02:10.115566 | ubuntu-noble | +## IBM Bigfix BESClient 2026-06-02 13:02:10.115684 | ubuntu-noble | +-a always,exit -F arch=b64 -S open -F dir=/opt/BESClient -F success=0 -k soft_besclient 2026-06-02 13:02:10.115802 | ubuntu-noble | +-w /var/opt/BESClient/ -p wa -k soft_besclient 2026-06-02 13:02:10.115955 | ubuntu-noble | + 2026-06-02 13:02:10.116078 | ubuntu-noble | +## CHEF https://www.chef.io/chef/ 2026-06-02 13:02:10.116193 | ubuntu-noble | +-w /etc/chef -p wa -k soft_chef 2026-06-02 13:02:10.116302 | ubuntu-noble | + 2026-06-02 13:02:10.116412 | ubuntu-noble | +## Salt 2026-06-02 13:02:10.116525 | ubuntu-noble | +## https://saltproject.io/ 2026-06-02 13:02:10.116642 | ubuntu-noble | +## https://docs.saltproject.io/en/latest/ref/configuration/master.html 2026-06-02 13:02:10.116754 | ubuntu-noble | +-w /etc/salt -p wa -k soft_salt 2026-06-02 13:02:10.116883 | ubuntu-noble | +-w /usr/local/etc/salt -p wa -k soft_salt 2026-06-02 13:02:10.117009 | ubuntu-noble | + 2026-06-02 13:02:10.117121 | ubuntu-noble | +## Otter 2026-06-02 13:02:10.117236 | ubuntu-noble | +## https://inedo.com/otter 2026-06-02 13:02:10.117361 | ubuntu-noble | +-w /etc/otter -p wa -k soft_otter 2026-06-02 13:02:10.117466 | ubuntu-noble | + 2026-06-02 13:02:10.117579 | ubuntu-noble | +## T1081 Credentials In Files 2026-06-02 13:02:10.118846 | ubuntu-noble | +-w /usr/bin/grep -p x -k string_search 2026-06-02 13:02:10.118860 | ubuntu-noble | +-w /usr/bin/egrep -p x -k string_search 2026-06-02 13:02:10.118864 | ubuntu-noble | +-w /usr/bin/ugrep -p x -k string_search 2026-06-02 13:02:10.118867 | ubuntu-noble | +### macOS 2026-06-02 13:02:10.118871 | ubuntu-noble | +-w /usr/local/bin/grep -p x -k string_search 2026-06-02 13:02:10.118875 | ubuntu-noble | +-w /usr/local/bin/egrep -p x -k string_search 2026-06-02 13:02:10.118890 | ubuntu-noble | +-w /usr/local/bin/ugrep -p x -k string_search 2026-06-02 13:02:10.118894 | ubuntu-noble | + 2026-06-02 13:02:10.118898 | ubuntu-noble | +### https://github.com/tmbinc/bgrep 2026-06-02 13:02:10.118915 | ubuntu-noble | +-w /usr/bin/bgrep -p x -k string_search 2026-06-02 13:02:10.118919 | ubuntu-noble | +### macOS 2026-06-02 13:02:10.118923 | ubuntu-noble | +-w /usr/local/bin/bgrep -p x -k string_search 2026-06-02 13:02:10.118926 | ubuntu-noble | + 2026-06-02 13:02:10.119051 | ubuntu-noble | +### https://github.com/BurntSushi/ripgrep 2026-06-02 13:02:10.119168 | ubuntu-noble | +-w /usr/bin/rg -p x -k string_search 2026-06-02 13:02:10.119279 | ubuntu-noble | +### macOS 2026-06-02 13:02:10.119394 | ubuntu-noble | +-w /usr/local/bin/rg -p x -k string_search 2026-06-02 13:02:10.119502 | ubuntu-noble | + 2026-06-02 13:02:10.119619 | ubuntu-noble | +### https://github.com/awgn/cgrep 2026-06-02 13:02:10.119726 | ubuntu-noble | + 2026-06-02 13:02:10.119855 | ubuntu-noble | +-w /usr/bin/cgrep -p x -k string_search 2026-06-02 13:02:10.120010 | ubuntu-noble | +### macOS 2026-06-02 13:02:10.120130 | ubuntu-noble | +-w /usr/local/bin/cgrep -p x -k string_search 2026-06-02 13:02:10.120236 | ubuntu-noble | + 2026-06-02 13:02:10.120349 | ubuntu-noble | +### https://github.com/jpr5/ngrep 2026-06-02 13:02:10.120463 | ubuntu-noble | +-w /usr/bin/ngrep -p x -k string_search 2026-06-02 13:02:10.120572 | ubuntu-noble | +### macOS 2026-06-02 13:02:10.120685 | ubuntu-noble | +-w /usr/local/bin/ngrep -p x -k string_search 2026-06-02 13:02:10.120789 | ubuntu-noble | + 2026-06-02 13:02:10.120933 | ubuntu-noble | +### https://github.com/vrothberg/vgrep 2026-06-02 13:02:10.121053 | ubuntu-noble | +-w /usr/bin/vgrep -p x -k string_search 2026-06-02 13:02:10.121162 | ubuntu-noble | +### macOS 2026-06-02 13:02:10.121286 | ubuntu-noble | +-w /usr/local/bin/vgrep -p x -k string_search 2026-06-02 13:02:10.121394 | ubuntu-noble | + 2026-06-02 13:02:10.121510 | ubuntu-noble | +### https://github.com/monochromegane/the_platinum_searcher 2026-06-02 13:02:10.121624 | ubuntu-noble | +-w /usr/bin/pt -p x -k string_search 2026-06-02 13:02:10.121733 | ubuntu-noble | +### macOS 2026-06-02 13:02:10.121865 | ubuntu-noble | +-w /usr/local/bin/pt -p x -k string_search 2026-06-02 13:02:10.121995 | ubuntu-noble | + 2026-06-02 13:02:10.122112 | ubuntu-noble | +### https://github.com/gvansickle/ucg 2026-06-02 13:02:10.122226 | ubuntu-noble | +-w /usr/bin/ucg -p x -k string_search 2026-06-02 13:02:10.122334 | ubuntu-noble | +### macOS 2026-06-02 13:02:10.122449 | ubuntu-noble | +-w /usr/local/bin/ucg -p x -k string_search 2026-06-02 13:02:10.122555 | ubuntu-noble | + 2026-06-02 13:02:10.122669 | ubuntu-noble | +### https://github.com/ggreer/the_silver_searcher 2026-06-02 13:02:10.122782 | ubuntu-noble | +-w /usr/bin/ag -p x -k string_search 2026-06-02 13:02:10.122935 | ubuntu-noble | +### macOS 2026-06-02 13:02:10.123060 | ubuntu-noble | +-w /usr/local/bin/ag -p x -k string_search 2026-06-02 13:02:10.123169 | ubuntu-noble | + 2026-06-02 13:02:10.123284 | ubuntu-noble | +### https://github.com/beyondgrep/ack3 2026-06-02 13:02:10.123396 | ubuntu-noble | +### https://beyondgrep.com 2026-06-02 13:02:10.123510 | ubuntu-noble | +-w /usr/bin/ack -p x -k string_search 2026-06-02 13:02:10.123625 | ubuntu-noble | +-w /usr/local/bin/ack -p x -k string_search 2026-06-02 13:02:10.123738 | ubuntu-noble | +-w /usr/bin/semgrep -p x -k string_search 2026-06-02 13:02:10.123863 | ubuntu-noble | +### macOS 2026-06-02 13:02:10.123996 | ubuntu-noble | +-w /usr/local/bin/semgrep -p x -k string_search 2026-06-02 13:02:10.124105 | ubuntu-noble | + 2026-06-02 13:02:10.124215 | ubuntu-noble | +## Docker 2026-06-02 13:02:10.124329 | ubuntu-noble | +-w /usr/bin/dockerd -k docker 2026-06-02 13:02:10.124440 | ubuntu-noble | +-w /usr/bin/docker -k docker 2026-06-02 13:02:10.124554 | ubuntu-noble | +-w /usr/bin/docker-containerd -k docker 2026-06-02 13:02:10.124666 | ubuntu-noble | +-w /usr/bin/docker-runc -k docker 2026-06-02 13:02:10.124777 | ubuntu-noble | +-w /var/lib/docker -p wa -k docker 2026-06-02 13:02:10.124927 | ubuntu-noble | +-w /etc/docker -k docker 2026-06-02 13:02:10.125046 | ubuntu-noble | +-w /etc/sysconfig/docker -k docker 2026-06-02 13:02:10.125161 | ubuntu-noble | +-w /etc/sysconfig/docker-storage -k docker 2026-06-02 13:02:10.125274 | ubuntu-noble | +-w /usr/lib/systemd/system/docker.service -k docker 2026-06-02 13:02:10.125401 | ubuntu-noble | +-w /usr/lib/systemd/system/docker.socket -k docker 2026-06-02 13:02:10.125509 | ubuntu-noble | + 2026-06-02 13:02:10.125623 | ubuntu-noble | +## Virtualization stuff 2026-06-02 13:02:10.125737 | ubuntu-noble | +-w /usr/bin/qemu-system-x86_64 -p x -k qemu-system-x86_64 2026-06-02 13:02:10.125864 | ubuntu-noble | +-w /usr/bin/qemu-img -p x -k qemu-img 2026-06-02 13:02:10.125999 | ubuntu-noble | +-w /usr/bin/qemu-kvm -p x -k qemu-kvm 2026-06-02 13:02:10.126112 | ubuntu-noble | +-w /usr/bin/qemu -p x -k qemu 2026-06-02 13:02:10.126226 | ubuntu-noble | +-w /usr/bin/virtualbox -p x -k virtualbox 2026-06-02 13:02:10.126343 | ubuntu-noble | +-w /usr/bin/virt-manager -p x -k virt-manager 2026-06-02 13:02:10.126456 | ubuntu-noble | +-w /usr/bin/VBoxManage -p x -k VBoxManage 2026-06-02 13:02:10.126563 | ubuntu-noble | + 2026-06-02 13:02:10.126678 | ubuntu-noble | +#### VirtualBox on macOS 2026-06-02 13:02:10.126785 | ubuntu-noble | + 2026-06-02 13:02:10.126944 | ubuntu-noble | +-w /usr/local/bin/VirtualBox -p x -k virt_tool 2026-06-02 13:02:10.127068 | ubuntu-noble | +-w /usr/local/bin/VirtualBoxVM -p x -k virt_tool 2026-06-02 13:02:10.127182 | ubuntu-noble | +-w /usr/local/bin/VBoxManage -p x -k virt_tool 2026-06-02 13:02:10.127295 | ubuntu-noble | +-w /usr/local/bin/VBoxVRDP -p x -k virt_tool 2026-06-02 13:02:10.127413 | ubuntu-noble | +-w /usr/local/bin/VBoxHeadless -p x -k virt_tool 2026-06-02 13:02:10.127526 | ubuntu-noble | +-w /usr/local/bin/vboxwebsrv -p x -k virt_tool 2026-06-02 13:02:10.128844 | ubuntu-noble | +-w /usr/local/bin/VBoxBugReport -p x -k virt_tool 2026-06-02 13:02:10.128857 | ubuntu-noble | +-w /usr/local/bin/VBoxBalloonCtrl -p x -k virt_tool 2026-06-02 13:02:10.128861 | ubuntu-noble | +-w /usr/local/bin/VBoxAutostart -p x -k virt_tool 2026-06-02 13:02:10.128864 | ubuntu-noble | +-w /usr/local/bin/VBoxDTrace -p x -k virt_tool 2026-06-02 13:02:10.128868 | ubuntu-noble | +-w /usr/local/bin/vbox-img -p x -k virt_tool 2026-06-02 13:02:10.128872 | ubuntu-noble | +-w /Library/LaunchDaemons/org.virtualbox.startup.plist -p x -k virt_tool 2026-06-02 13:02:10.128876 | ubuntu-noble | +-w /Library/Application Support/VirtualBox/LaunchDaemons/ -p x -k virt_tool 2026-06-02 13:02:10.128880 | ubuntu-noble | +-w /Library/Application Support/VirtualBox/VBoxDrv.kext/ -p x -k virt_tool 2026-06-02 13:02:10.128883 | ubuntu-noble | +-w /Library/Application Support/VirtualBox/VBoxUSB.kext/ -p x -k virt_tool 2026-06-02 13:02:10.128887 | ubuntu-noble | +-w /Library/Application Support/VirtualBox/VBoxNetFlt.kext/ -p x -k virt_tool 2026-06-02 13:02:10.128890 | ubuntu-noble | +-w /Library/Application Support/VirtualBox/VBoxNetAdp.kext/ -p x -k virt_tool 2026-06-02 13:02:10.128894 | ubuntu-noble | + 2026-06-02 13:02:10.128898 | ubuntu-noble | +### Parallels Desktop on macOS 2026-06-02 13:02:10.129030 | ubuntu-noble | + 2026-06-02 13:02:10.129146 | ubuntu-noble | +-w /usr/local/bin/prl_convert -p x -k virt_tool 2026-06-02 13:02:10.129270 | ubuntu-noble | +-w /usr/local/bin/prl_disk_tool -p x -k virt_tool 2026-06-02 13:02:10.129542 | ubuntu-noble | +-w /usr/local/bin/prl_perf_ctl -p x -k virt_tool 2026-06-02 13:02:10.129688 | ubuntu-noble | +-w /usr/local/bin/prlcore2dmp -p x -k virt_tool 2026-06-02 13:02:10.129803 | ubuntu-noble | +-w /usr/local/bin/prlctl -p x -k virt_tool 2026-06-02 13:02:10.129953 | ubuntu-noble | +-w /usr/local/bin/prlexec -p x -k virt_tool 2026-06-02 13:02:10.130075 | ubuntu-noble | +-w /usr/local/bin/prlsrvctl -p x -k virt_tool 2026-06-02 13:02:10.130191 | ubuntu-noble | +-w /Library/Preferences/Parallels -p x -k virt_tool 2026-06-02 13:02:10.130299 | ubuntu-noble | + 2026-06-02 13:02:10.130413 | ubuntu-noble | +### qemu on macOS 2026-06-02 13:02:10.130520 | ubuntu-noble | + 2026-06-02 13:02:10.130635 | ubuntu-noble | +-w /usr/local/bin/qemu-edid -p x -k virt_tool 2026-06-02 13:02:10.130751 | ubuntu-noble | +-w /usr/local/bin/qemu-img -p x -k virt_tool 2026-06-02 13:02:10.130897 | ubuntu-noble | +-w /usr/local/bin/qemu-io -p x -k virt_tool 2026-06-02 13:02:10.131054 | ubuntu-noble | +-w /usr/local/bin/qemu-nbd -p x -k virt_tool 2026-06-02 13:02:10.131171 | ubuntu-noble | +-w /usr/local/bin/qemu-system-x86_64 -p x -k virt_tool 2026-06-02 13:02:10.131279 | ubuntu-noble | + 2026-06-02 13:02:10.131390 | ubuntu-noble | +## Kubelet 2026-06-02 13:02:10.131501 | ubuntu-noble | +-w /usr/bin/kubelet -k kubelet 2026-06-02 13:02:10.131607 | ubuntu-noble | + 2026-06-02 13:02:10.131720 | ubuntu-noble | +# ipc system call 2026-06-02 13:02:10.131849 | ubuntu-noble | +# /usr/include/linux/ipc.h 2026-06-02 13:02:10.131977 | ubuntu-noble | + 2026-06-02 13:02:10.132089 | ubuntu-noble | +## msgctl 2026-06-02 13:02:10.132208 | ubuntu-noble | +#-a always,exit -S ipc -F a0=14 -k Inter-Process_Communication 2026-06-02 13:02:10.132319 | ubuntu-noble | +## msgget 2026-06-02 13:02:10.132444 | ubuntu-noble | +#-a always,exit -S ipc -F a0=13 -k Inter-Process_Communication 2026-06-02 13:02:10.132572 | ubuntu-noble | +## Use these lines on x86_64, ia64 instead 2026-06-02 13:02:10.132689 | ubuntu-noble | +-a always,exit -F arch=b64 -S msgctl -k Inter-Process_Communication 2026-06-02 13:02:10.132805 | ubuntu-noble | +-a always,exit -F arch=b64 -S msgget -k Inter-Process_Communication 2026-06-02 13:02:10.132972 | ubuntu-noble | + 2026-06-02 13:02:10.133095 | ubuntu-noble | +## semctl 2026-06-02 13:02:10.133216 | ubuntu-noble | +#-a always,exit -S ipc -F a0=3 -k Inter-Process_Communication 2026-06-02 13:02:10.133327 | ubuntu-noble | +## semget 2026-06-02 13:02:10.133447 | ubuntu-noble | +#-a always,exit -S ipc -F a0=2 -k Inter-Process_Communication 2026-06-02 13:02:10.133557 | ubuntu-noble | +## semop 2026-06-02 13:02:10.133674 | ubuntu-noble | +#-a always,exit -S ipc -F a0=1 -k Inter-Process_Communication 2026-06-02 13:02:10.133786 | ubuntu-noble | +## semtimedop 2026-06-02 13:02:10.133933 | ubuntu-noble | +#-a always,exit -S ipc -F a0=4 -k Inter-Process_Communication 2026-06-02 13:02:10.134054 | ubuntu-noble | +## Use these lines on x86_64, ia64 instead 2026-06-02 13:02:10.134171 | ubuntu-noble | +-a always,exit -F arch=b64 -S semctl -k Inter-Process_Communication 2026-06-02 13:02:10.134288 | ubuntu-noble | +-a always,exit -F arch=b64 -S semget -k Inter-Process_Communication 2026-06-02 13:02:10.134404 | ubuntu-noble | +-a always,exit -F arch=b64 -S semop -k Inter-Process_Communication 2026-06-02 13:02:10.134523 | ubuntu-noble | +-a always,exit -F arch=b64 -S semtimedop -k Inter-Process_Communication 2026-06-02 13:02:10.134629 | ubuntu-noble | + 2026-06-02 13:02:10.134739 | ubuntu-noble | +## shmctl 2026-06-02 13:02:10.134883 | ubuntu-noble | +#-a always,exit -S ipc -F a0=24 -k Inter-Process_Communication 2026-06-02 13:02:10.135015 | ubuntu-noble | +## shmget 2026-06-02 13:02:10.135133 | ubuntu-noble | +#-a always,exit -S ipc -F a0=23 -k Inter-Process_Communication 2026-06-02 13:02:10.135249 | ubuntu-noble | +## Use these lines on x86_64, ia64 instead 2026-06-02 13:02:10.135365 | ubuntu-noble | +-a always,exit -F arch=b64 -S shmctl -k Inter-Process_Communication 2026-06-02 13:02:10.135481 | ubuntu-noble | +-a always,exit -F arch=b64 -S shmget -k Inter-Process_Communication 2026-06-02 13:02:10.135588 | ubuntu-noble | + 2026-06-02 13:02:10.135702 | ubuntu-noble | +# High Volume Events ---------------------------------------------------------- 2026-06-02 13:02:10.135811 | ubuntu-noble | + 2026-06-02 13:02:10.136026 | ubuntu-noble | +## Disable these rules if they create too many events in your environment 2026-06-02 13:02:10.136165 | ubuntu-noble | + 2026-06-02 13:02:10.136281 | ubuntu-noble | +## Common Shells 2026-06-02 13:02:10.136395 | ubuntu-noble | +-w /bin/bash -p x -k susp_shell 2026-06-02 13:02:10.136511 | ubuntu-noble | +-w /bin/dash -p x -k susp_shell 2026-06-02 13:02:10.136631 | ubuntu-noble | +-w /bin/busybox -p x -k susp_shell 2026-06-02 13:02:10.136752 | ubuntu-noble | +-w /bin/zsh -p x -k susp_shell 2026-06-02 13:02:10.136887 | ubuntu-noble | +-w /bin/sh -p x -k susp_shell 2026-06-02 13:02:10.137020 | ubuntu-noble | +-w /bin/ksh -p x -k susp_shell 2026-06-02 13:02:10.137129 | ubuntu-noble | + 2026-06-02 13:02:10.137241 | ubuntu-noble | +## Root command executions 2026-06-02 13:02:10.137360 | ubuntu-noble | +-a always,exit -F arch=b64 -F euid=0 -F auid>=1000 -F auid!=-1 -S execve -k rootcmd 2026-06-02 13:02:10.137465 | ubuntu-noble | + 2026-06-02 13:02:10.137579 | ubuntu-noble | +## File Deletion Events by User 2026-06-02 13:02:10.138846 | ubuntu-noble | +-a always,exit -F arch=b64 -S rmdir -S unlink -S unlinkat -S rename -S renameat -F auid>=1000 -F auid!=-1 -k delete 2026-06-02 13:02:10.138860 | ubuntu-noble | + 2026-06-02 13:02:10.138864 | ubuntu-noble | +## File Access 2026-06-02 13:02:10.138868 | ubuntu-noble | +### Unauthorized Access (unsuccessful) 2026-06-02 13:02:10.138872 | ubuntu-noble | +-a always,exit -F arch=b64 -S creat -S open -S openat -S open_by_handle_at -S truncate -S ftruncate -F exit=-EACCES -F auid>=1000 -F auid!=-1 -k file_access 2026-06-02 13:02:10.138878 | ubuntu-noble | +-a always,exit -F arch=b64 -S creat -S open -S openat -S open_by_handle_at -S truncate -S ftruncate -F exit=-EPERM -F auid>=1000 -F auid!=-1 -k file_access 2026-06-02 13:02:10.138882 | ubuntu-noble | + 2026-06-02 13:02:10.138886 | ubuntu-noble | +### Unsuccessful Creation 2026-06-02 13:02:10.138890 | ubuntu-noble | +-a always,exit -F arch=b64 -S mkdir,creat,link,symlink,mknod,mknodat,linkat,symlinkat -F exit=-EACCES -k file_creation 2026-06-02 13:02:10.138894 | ubuntu-noble | +-a always,exit -F arch=b64 -S mkdir,link,symlink,mkdirat -F exit=-EPERM -k file_creation 2026-06-02 13:02:10.138897 | ubuntu-noble | + 2026-06-02 13:02:10.138912 | ubuntu-noble | +### Unsuccessful Modification 2026-06-02 13:02:10.138988 | ubuntu-noble | +-a always,exit -F arch=b64 -S rename -S renameat -S truncate -S chmod -S setxattr -S lsetxattr -S removexattr -S lremovexattr -F exit=-EACCES -k file_modification 2026-06-02 13:02:10.139123 | ubuntu-noble | +-a always,exit -F arch=b64 -S rename -S renameat -S truncate -S chmod -S setxattr -S lsetxattr -S removexattr -S lremovexattr -F exit=-EPERM -k file_modification 2026-06-02 13:02:10.139232 | ubuntu-noble | + 2026-06-02 13:02:10.139344 | ubuntu-noble | +## 32bit API Exploitation 2026-06-02 13:02:10.139460 | ubuntu-noble | +### If you are on a 64 bit platform, everything _should_ be running 2026-06-02 13:02:10.139578 | ubuntu-noble | +### in 64 bit mode. This rule will detect any use of the 32 bit syscalls 2026-06-02 13:02:10.139694 | ubuntu-noble | +### because this might be a sign of someone exploiting a hole in the 32 2026-06-02 13:02:10.139806 | ubuntu-noble | +### bit API. 2026-06-02 13:02:10.139981 | ubuntu-noble | +-a always,exit -F arch=b32 -S all -k 32bit_api 2026-06-02 13:02:10.140099 | ubuntu-noble | + 2026-06-02 13:02:10.140218 | ubuntu-noble | +# Make The Configuration Immutable -------------------------------------------- 2026-06-02 13:02:10.140326 | ubuntu-noble | + 2026-06-02 13:02:10.140436 | ubuntu-noble | +##-e 2 2026-06-02 13:02:10.140544 | ubuntu-noble | 2026-06-02 13:02:10.140801 | ubuntu-noble | changed: [molecule-auditd] => (item=20-neo23x0.rules) => {"ansible_loop_var": "item", "changed": true, "checksum": "9f99ce5c4f891fbf3e2bce06ed4cb97fb9e01f41", "dest": "/etc/audit/rules.d/20-neo23x0.rules", "gid": 0, "group": "root", "item": "20-neo23x0.rules", "md5sum": "6ac57206fd77de34805c3f4d50ef8b1d", "mode": "0644", "owner": "root", "size": 27367, "src": "/home/zuul/.ansible/tmp/ansible-tmp-1780405329.208064-2423-197027126932490/.source.rules", "state": "file", "uid": 0} 2026-06-02 13:02:10.140952 | ubuntu-noble | 2026-06-02 13:02:10.141082 | ubuntu-noble | TASK [auditd : Manage auditd service] ****************************************** 2026-06-02 13:02:10.881981 | ubuntu-noble | ok: [molecule-auditd] => {"changed": false, "enabled": true, "name": "auditd", "state": "started", "status": {"ActiveEnterTimestamp": "Tue 2026-06-02 13:02:03 UTC", "ActiveEnterTimestampMonotonic": "4507537671", "ActiveExitTimestampMonotonic": "0", "ActiveState": "active", "After": "systemd-journald.socket system.slice systemd-tmpfiles-setup.service local-fs.target", "AllowIsolate": "no", "AssertResult": "yes", "AssertTimestamp": "Tue 2026-06-02 13:02:03 UTC", "AssertTimestampMonotonic": "4507464413", "Before": "systemd-update-utmp.service ssh.service shutdown.target sysinit.target", "BlockIOAccounting": "no", "BlockIOWeight": "[not set]", "CPUAccounting": "yes", "CPUAffinityFromNUMA": "no", "CPUQuotaPerSecUSec": "infinity", "CPUQuotaPeriodUSec": "infinity", "CPUSchedulingPolicy": "0", "CPUSchedulingPriority": "0", "CPUSchedulingResetOnFork": "no", "CPUShares": "[not set]", "CPUUsageNSec": "55132000", "CPUWeight": "[not set]", "CacheDirectoryMode": "0755", "CanFreeze": "yes", "CanIsolate": "no", "CanReload": "no", "CanStart": "yes", "CanStop": "yes", "CapabilityBoundingSet": "cap_chown cap_dac_override cap_dac_read_search cap_fowner cap_fsetid cap_kill cap_setgid cap_setuid cap_setpcap cap_linux_immutable cap_net_bind_service cap_net_broadcast cap_net_admin cap_net_raw cap_ipc_lock cap_ipc_owner cap_sys_rawio cap_sys_chroot cap_sys_ptrace cap_sys_pacct cap_sys_admin cap_sys_boot cap_sys_nice cap_sys_resource cap_sys_time cap_sys_tty_config cap_mknod cap_lease cap_audit_write cap_audit_control cap_setfcap cap_mac_override cap_mac_admin cap_syslog cap_wake_alarm cap_block_suspend cap_audit_read cap_perfmon cap_bpf cap_checkpoint_restore", "CleanResult": "success", "CollectMode": "inactive", "ConditionResult": "yes", "ConditionTimestamp": "Tue 2026-06-02 13:02:03 UTC", "ConditionTimestampMonotonic": "4507463902", "ConfigurationDirectoryMode": "0755", "Conflicts": "shutdown.target", "ControlGroup": "/system.slice/auditd.service", "ControlGroupId": "3910", "ControlPID": "0", "CoredumpFilter": "0x33", "CoredumpReceive": "no", "DefaultDependencies": "no", "DefaultMemoryLow": "0", "DefaultMemoryMin": "0", "DefaultStartupMemoryLow": "0", "Delegate": "no", "Description": "Security Auditing Service", "DevicePolicy": "auto", "Documentation": "\"man:auditd(8)\" https://github.com/linux-audit/audit-documentation", "DynamicUser": "no", "ExecMainCode": "0", "ExecMainExitTimestampMonotonic": "0", "ExecMainPID": "2192", "ExecMainStartTimestamp": "Tue 2026-06-02 13:02:03 UTC", "ExecMainStartTimestampMonotonic": "4507487746", "ExecMainStatus": "0", "ExecStart": "{ path=/sbin/auditd ; argv[]=/sbin/auditd ; ignore_errors=no ; start_time=[Tue 2026-06-02 13:02:03 UTC] ; stop_time=[Tue 2026-06-02 13:02:03 UTC] ; pid=2191 ; code=exited ; status=0 }", "ExecStartEx": "{ path=/sbin/auditd ; argv[]=/sbin/auditd ; flags= ; start_time=[Tue 2026-06-02 13:02:03 UTC] ; stop_time=[Tue 2026-06-02 13:02:03 UTC] ; pid=2191 ; code=exited ; status=0 }", "ExecStartPost": "{ path=/sbin/augenrules ; argv[]=/sbin/augenrules --load ; ignore_errors=yes ; start_time=[Tue 2026-06-02 13:02:03 UTC] ; stop_time=[Tue 2026-06-02 13:02:03 UTC] ; pid=2195 ; code=exited ; status=0 }", "ExecStartPostEx": "{ path=/sbin/augenrules ; argv[]=/sbin/augenrules --load ; flags=ignore-failure ; start_time=[Tue 2026-06-02 13:02:03 UTC] ; stop_time=[Tue 2026-06-02 13:02:03 UTC] ; pid=2195 ; code=exited ; status=0 }", "ExitType": "main", "ExtensionImagePolicy": "root=verity+signed+encrypted+unprotected+absent:usr=verity+signed+encrypted+unprotected+absent:home=encrypted+unprotected+absent:srv=encrypted+unprotected+absent:tmp=encrypted+unprotected+absent:var=encrypted+unprotected+absent", "FailureAction": "none", "FileDescriptorStoreMax": "0", "FileDescriptorStorePreserve": "restart", "FinalKillSignal": "9", "FragmentPath": "/usr/lib/systemd/system/auditd.service", "FreezerState": "running", "GID": "[not set]", "GuessMainPID": "yes", "IOAccounting": "no", "IOReadBytes": "[not set]", "IOReadOperations": "[not set]", "IOSchedulingClass": "2", "IOSchedulingPriority": "4", "IOWeight": "[not set]", "IOWriteBytes": "[not set]", "IOWriteOperations": "[not set]", "IPAccounting": "no", "IPEgressBytes": "[no data]", "IPEgressPackets": "[no data]", "IPIngressBytes": "[no data]", "IPIngressPackets": "[no data]", "Id": "auditd.service", "IgnoreOnIsolate": "no", "IgnoreSIGPIPE": "yes", "InactiveEnterTimestampMonotonic": "0", "InactiveExitTimestamp": "Tue 2026-06-02 13:02:03 UTC", "InactiveExitTimestampMonotonic": "4507474431", "InvocationID": "797ff7ed28ec45878d7c5047aa498258", "JobRunningTimeoutUSec": "infinity", "JobTimeoutAction": "none", "JobTimeoutUSec": "infinity", "KeyringMode": "private", "KillMode": "control-group", "KillSignal": "15", "LimitAS": "infinity", "LimitASSoft": "infinity", "LimitCORE": "infinity", "LimitCORESoft": "0", "LimitCPU": "infinity", "LimitCPUSoft": "infinity", "LimitDATA": "infinity", "LimitDATASoft": "infinity", "LimitFSIZE": "infinity", "LimitFSIZESoft": "infinity", "LimitLOCKS": "infinity", "LimitLOCKSSoft": "infinity", "LimitMEMLOCK": "8388608", "LimitMEMLOCKSoft": "8388608", "LimitMSGQUEUE": "819200", "LimitMSGQUEUESoft": "819200", "LimitNICE": "0", "LimitNICESoft": "0", "LimitNOFILE": "524288", "LimitNOFILESoft": "1024", "LimitNPROC": "15372", "LimitNPROCSoft": "15372", "LimitRSS": "infinity", "LimitRSSSoft": "infinity", "LimitRTPRIO": "0", "LimitRTPRIOSoft": "0", "LimitRTTIME": "infinity", "LimitRTTIMESoft": "infinity", "LimitSIGPENDING": "15372", "LimitSIGPENDINGSoft": "15372", "LimitSTACK": "infinity", "LimitSTACKSoft": "8388608", "LoadState": "loaded", "LockPersonality": "yes", "LogLevelMax": "-1", "LogRateLimitBurst": "0", "LogRateLimitIntervalUSec": "0", "LogsDirectoryMode": "0755", "MainPID": "2192", "ManagedOOMMemoryPressure": "auto", "ManagedOOMMemoryPressureLimit": "0", "ManagedOOMPreference": "none", "ManagedOOMSwap": "auto", "MemoryAccounting": "yes", "MemoryAvailable": "3433484288", "MemoryCurrent": "512000", "MemoryDenyWriteExecute": "yes", "MemoryHigh": "infinity", "MemoryKSM": "no", "MemoryLimit": "infinity", "MemoryLow": "0", "MemoryMax": "infinity", "MemoryMin": "0", "MemoryPeak": "2142208", "MemoryPressureThresholdUSec": "200ms", "MemoryPressureWatch": "auto", "MemorySwapCurrent": "0", "MemorySwapMax": "infinity", "MemorySwapPeak": "0", "MemoryZSwapCurrent": "0", "MemoryZSwapMax": "infinity", "MountAPIVFS": "no", "MountImagePolicy": "root=verity+signed+encrypted+unprotected+absent:usr=verity+signed+encrypted+unprotected+absent:home=encrypted+unprotected+absent:srv=encrypted+unprotected+absent:tmp=encrypted+unprotected+absent:var=encrypted+unprotected+absent", "NFileDescriptorStore": "0", "NRestarts": "0", "NUMAPolicy": "n/a", "Names": "auditd.service", "NeedDaemonReload": "no", "Nice": "0", "NoNewPrivileges": "no", "NonBlocking": "no", "NotifyAccess": "none", "OOMPolicy": "stop", "OOMScoreAdjust": "0", "OnFailureJobMode": "replace", "OnSuccessJobMode": "fail", "PIDFile": "/run/auditd.pid", "Perpetual": "no", "PrivateDevices": "no", "PrivateIPC": "no", "PrivateMounts": "no", "PrivateNetwork": "no", "PrivateTmp": "no", "PrivateUsers": "no", "ProcSubset": "all", "ProtectClock": "no", "ProtectControlGroups": "no", "ProtectHome": "no", "ProtectHostname": "no", "ProtectKernelLogs": "no", "ProtectKernelModules": "yes", "ProtectKernelTunables": "no", "ProtectProc": "default", "ProtectSystem": "no", "RefuseManualStart": "no", "RefuseManualStop": "no", "ReloadResult": "success", "ReloadSignal": "1", "RemainAfterExit": "no", "RemoveIPC": "no", "Requires": "system.slice", "Restart": "on-failure", "RestartKillSignal": "15", "RestartMaxDelayUSec": "infinity", "RestartMode": "normal", "RestartPreventExitStatus": "2 4 6", "RestartSteps": "0", "RestartUSec": "100ms", "RestartUSecNext": "100ms", "RestrictNamespaces": "no", "RestrictRealtime": "yes", "RestrictSUIDSGID": "no", "Result": "success", "RootDirectoryStartOnly": "no", "RootEphemeral": "no", "RootImagePolicy": "root=verity+signed+encrypted+unprotected+absent:usr=verity+signed+encrypted+unprotected+absent:home=encrypted+unprotected+absent:srv=encrypted+unprotected+absent:tmp=encrypted+unprotected+absent:var=encrypted+unprotected+absent", "RuntimeDirectoryMode": "0755", "RuntimeDirectoryPreserve": "no", "RuntimeMaxUSec": "infinity", "RuntimeRandomizedExtraUSec": "0", "SameProcessGroup": "no", "SecureBits": "0", "SendSIGHUP": "no", "SendSIGKILL": "yes", "SetLoginEnvironment": "no", "Slice": "system.slice", "StandardError": "inherit", "StandardInput": "null", "StandardOutput": "journal", "StartLimitAction": "none", "StartLimitBurst": "5", "StartLimitIntervalUSec": "10s", "StartupBlockIOWeight": "[not set]", "StartupCPUShares": "[not set]", "StartupCPUWeight": "[not set]", "StartupIOWeight": "[not set]", "StartupMemoryHigh": "infinity", "StartupMemoryLow": "0", "StartupMemoryMax": "infinity", "StartupMemorySwapMax": "infinity", "StartupMemoryZSwapMax": "infinity", "StateChangeTimestamp": "Tue 2026-06-02 13:02:03 UTC", "StateChangeTimestampMonotonic": "4507537671", "StateDirectoryMode": "0755", "StatusErrno": "0", "StopWhenUnneeded": "no", "SubState": "running", "SuccessAction": "none", "SurviveFinalKillSignal": "no", "SyslogFacility": "3", "SyslogLevel": "6", "SyslogLevelPrefix": "yes", "SyslogPriority": "30", "SystemCallErrorNumber": "2147483646", "TTYReset": "no", "TTYVHangup": "no", "TTYVTDisallocate": "no", "TasksAccounting": "yes", "TasksCurrent": "2", "TasksMax": "4611", "TimeoutAbortUSec": "1min 30s", "TimeoutCleanUSec": "infinity", "TimeoutStartFailureMode": "terminate", "TimeoutStartUSec": "1min 30s", "TimeoutStopFailureMode": "terminate", "TimeoutStopUSec": "1min 30s", "TimerSlackNSec": "50000", "Transient": "no", "Type": "forking", "UID": "[not set]", "UMask": "0022", "UnitFilePreset": "enabled", "UnitFileState": "enabled", "UtmpMode": "init", "WantedBy": "multi-user.target", "WatchdogSignal": "6", "WatchdogTimestampMonotonic": "0", "WatchdogUSec": "0"}} 2026-06-02 13:02:10.888571 | ubuntu-noble | 2026-06-02 13:02:10.889056 | ubuntu-noble | TASK [auditd : List existing rules files] ************************************** 2026-06-02 13:02:10.577358 | debian-bookworm | changed: [molecule-auditd] => {"changed": true, "name": "auditd", "state": "started", "status": {"ActiveEnterTimestamp": "Tue 2026-06-02 13:02:09 UTC", "ActiveEnterTimestampMonotonic": "818923446", "ActiveExitTimestamp": "Tue 2026-06-02 13:02:09 UTC", "ActiveExitTimestampMonotonic": "818754144", "ActiveState": "active", "After": "local-fs.target system.slice systemd-tmpfiles-setup.service systemd-journald.socket", "AllowIsolate": "no", "AssertResult": "yes", "AssertTimestamp": "Tue 2026-06-02 13:02:09 UTC", "AssertTimestampMonotonic": "818797783", "Before": "sysinit.target shutdown.target systemd-update-utmp.service ssh.service", "BlockIOAccounting": "no", "BlockIOWeight": "[not set]", "CPUAccounting": "yes", "CPUAffinityFromNUMA": "no", "CPUQuotaPerSecUSec": "infinity", "CPUQuotaPeriodUSec": "infinity", "CPUSchedulingPolicy": "0", "CPUSchedulingPriority": "0", "CPUSchedulingResetOnFork": "no", "CPUShares": "[not set]", "CPUUsageNSec": "170867000", "CPUWeight": "[not set]", "CacheDirectoryMode": "0755", "CanFreeze": "yes", "CanIsolate": "no", "CanReload": "no", "CanStart": "yes", "CanStop": "yes", "CapabilityBoundingSet": "cap_chown cap_dac_override cap_dac_read_search cap_fowner cap_fsetid cap_kill cap_setgid cap_setuid cap_setpcap cap_linux_immutable cap_net_bind_service cap_net_broadcast cap_net_admin cap_net_raw cap_ipc_lock cap_ipc_owner cap_sys_rawio cap_sys_chroot cap_sys_ptrace cap_sys_pacct cap_sys_admin cap_sys_boot cap_sys_nice cap_sys_resource cap_sys_time cap_sys_tty_config cap_mknod cap_lease cap_audit_write cap_audit_control cap_setfcap cap_mac_override cap_mac_admin cap_syslog cap_wake_alarm cap_block_suspend cap_audit_read cap_perfmon cap_bpf cap_checkpoint_restore", "CleanResult": "success", "CollectMode": "inactive", "ConditionResult": "yes", "ConditionTimestamp": "Tue 2026-06-02 13:02:09 UTC", "ConditionTimestampMonotonic": "818797710", "ConfigurationDirectoryMode": "0755", "Conflicts": "shutdown.target", "ControlGroup": "/system.slice/auditd.service", "ControlGroupId": "3328", "ControlPID": "0", "CoredumpFilter": "0x33", "DefaultDependencies": "no", "DefaultMemoryLow": "0", "DefaultMemoryMin": "0", "Delegate": "no", "Description": "Security Auditing Service", "DevicePolicy": "auto", "Documentation": "\"man:auditd(8)\" https://github.com/linux-audit/audit-documentation", "DynamicUser": "no", "ExecMainCode": "0", "ExecMainExitTimestampMonotonic": "0", "ExecMainPID": "2698", "ExecMainStartTimestamp": "Tue 2026-06-02 13:02:09 UTC", "ExecMainStartTimestampMonotonic": "818829973", "ExecMainStatus": "0", "ExecStart": "{ path=/sbin/auditd ; argv[]=/sbin/auditd ; ignore_errors=no ; start_time=[Tue 2026-06-02 13:02:09 UTC] ; stop_time=[Tue 2026-06-02 13:02:09 UTC] ; pid=2697 ; code=exited ; status=0 }", "ExecStartEx": "{ path=/sbin/auditd ; argv[]=/sbin/auditd ; flags= ; start_time=[Tue 2026-06-02 13:02:09 UTC] ; stop_time=[Tue 2026-06-02 13:02:09 UTC] ; pid=2697 ; code=exited ; status=0 }", "ExecStartPost": "{ path=/sbin/augenrules ; argv[]=/sbin/augenrules --load ; ignore_errors=yes ; start_time=[Tue 2026-06-02 13:02:09 UTC] ; stop_time=[Tue 2026-06-02 13:02:09 UTC] ; pid=2701 ; code=exited ; status=0 }", "ExecStartPostEx": "{ path=/sbin/augenrules ; argv[]=/sbin/augenrules --load ; flags=ignore-failure ; start_time=[Tue 2026-06-02 13:02:09 UTC] ; stop_time=[Tue 2026-06-02 13:02:09 UTC] ; pid=2701 ; code=exited ; status=0 }", "ExitType": "main", "FailureAction": "none", "FileDescriptorStoreMax": "0", "FinalKillSignal": "9", "FragmentPath": "/lib/systemd/system/auditd.service", "FreezerState": "running", "GID": "[not set]", "GuessMainPID": "yes", "IOAccounting": "no", "IOReadBytes": "18446744073709551615", "IOReadOperations": "18446744073709551615", "IOSchedulingClass": "2", "IOSchedulingPriority": "4", "IOWeight": "[not set]", "IOWriteBytes": "18446744073709551615", "IOWriteOperations": "18446744073709551615", "IPAccounting": "no", "IPEgressBytes": "[no data]", "IPEgressPackets": "[no data]", "IPIngressBytes": "[no data]", "IPIngressPackets": "[no data]", "Id": "auditd.service", "IgnoreOnIsolate": "no", "IgnoreSIGPIPE": "yes", "InactiveEnterTimestamp": "Tue 2026-06-02 13:02:09 UTC", "InactiveEnterTimestampMonotonic": "818795854", "InactiveExitTimestamp": "Tue 2026-06-02 13:02:09 UTC", "InactiveExitTimestampMonotonic": "818814233", "InvocationID": "4bce3ae74ac246c4b89cc38bf11cead7", "JobRunningTimeoutUSec": "infinity", "JobTimeoutAction": "none", "JobTimeoutUSec": "infinity", "KeyringMode": "private", "KillMode": "control-group", "KillSignal": "15", "LimitAS": "infinity", "LimitASSoft": "infinity", "LimitCORE": "infinity", "LimitCORESoft": "0", "LimitCPU": "infinity", "LimitCPUSoft": "infinity", "LimitDATA": "infinity", "LimitDATASoft": "infinity", "LimitFSIZE": "infinity", "LimitFSIZESoft": "infinity", "LimitLOCKS": "infinity", "LimitLOCKSSoft": "infinity", "LimitMEMLOCK": "8388608", "LimitMEMLOCKSoft": "8388608", "LimitMSGQUEUE": "819200", "LimitMSGQUEUESoft": "819200", "LimitNICE": "0", "LimitNICESoft": "0", "LimitNOFILE": "524288", "LimitNOFILESoft": "1024", "LimitNPROC": "15480", "LimitNPROCSoft": "15480", "LimitRSS": "infinity", "LimitRSSSoft": "infinity", "LimitRTPRIO": "0", "LimitRTPRIOSoft": "0", "LimitRTTIME": "infinity", "LimitRTTIMESoft": "infinity", "LimitSIGPENDING": "15480", "LimitSIGPENDINGSoft": "15480", "LimitSTACK": "infinity", "LimitSTACKSoft": "8388608", "LoadState": "loaded", "LockPersonality": "yes", "LogLevelMax": "-1", "LogRateLimitBurst": "0", "LogRateLimitIntervalUSec": "0", "LogsDirectoryMode": "0755", "MainPID": "2698", "ManagedOOMMemoryPressure": "auto", "ManagedOOMMemoryPressureLimit": "0", "ManagedOOMPreference": "none", "ManagedOOMSwap": "auto", "MemoryAccounting": "yes", "MemoryAvailable": "infinity", "MemoryCurrent": "2064384", "MemoryDenyWriteExecute": "yes", "MemoryHigh": "infinity", "MemoryLimit": "infinity", "MemoryLow": "0", "MemoryMax": "infinity", "MemoryMin": "0", "MemorySwapMax": "infinity", "MountAPIVFS": "no", "NFileDescriptorStore": "0", "NRestarts": "0", "NUMAPolicy": "n/a", "Names": "auditd.service", "NeedDaemonReload": "no", "Nice": "0", "NoNewPrivileges": "no", "NonBlocking": "no", "NotifyAccess": "none", "OOMPolicy": "stop", "OOMScoreAdjust": "0", "OnFailureJobMode": "replace", "OnSuccessJobMode": "fail", "PIDFile": "/run/auditd.pid", "Perpetual": "no", "PrivateDevices": "no", "PrivateIPC": "no", "PrivateMounts": "no", "PrivateNetwork": "no", "PrivateTmp": "no", "PrivateUsers": "no", "ProcSubset": "all", "ProtectClock": "no", "ProtectControlGroups": "yes", "ProtectHome": "no", "ProtectHostname": "no", "ProtectKernelLogs": "no", "ProtectKernelModules": "yes", "ProtectKernelTunables": "no", "ProtectProc": "default", "ProtectSystem": "no", "RefuseManualStart": "no", "RefuseManualStop": "no", "ReloadResult": "success", "RemainAfterExit": "no", "RemoveIPC": "no", "Requires": "system.slice", "Restart": "on-failure", "RestartKillSignal": "15", "RestartPreventExitStatus": "2 4 6", "RestartUSec": "100ms", "RestrictNamespaces": "no", "RestrictRealtime": "yes", "RestrictSUIDSGID": "no", "Result": "success", "RootDirectoryStartOnly": "no", "RuntimeDirectoryMode": "0755", "RuntimeDirectoryPreserve": "no", "RuntimeMaxUSec": "infinity", "RuntimeRandomizedExtraUSec": "0", "SameProcessGroup": "no", "SecureBits": "0", "SendSIGHUP": "no", "SendSIGKILL": "yes", "Slice": "system.slice", "StandardError": "inherit", "StandardInput": "null", "StandardOutput": "journal", "StartLimitAction": "none", "StartLimitBurst": "5", "StartLimitIntervalUSec": "10s", "StartupBlockIOWeight": "[not set]", "StartupCPUShares": "[not set]", "StartupCPUWeight": "[not set]", "StartupIOWeight": "[not set]", "StateChangeTimestamp": "Tue 2026-06-02 13:02:09 UTC", "StateChangeTimestampMonotonic": "818923446", "StateDirectoryMode": "0755", "StatusErrno": "0", "StopWhenUnneeded": "no", "SubState": "running", "SuccessAction": "none", "SyslogFacility": "3", "SyslogLevel": "6", "SyslogLevelPrefix": "yes", "SyslogPriority": "30", "SystemCallErrorNumber": "2147483646", "TTYReset": "no", "TTYVHangup": "no", "TTYVTDisallocate": "no", "TasksAccounting": "yes", "TasksCurrent": "2", "TasksMax": "4644", "TimeoutAbortUSec": "1min 30s", "TimeoutCleanUSec": "infinity", "TimeoutStartFailureMode": "terminate", "TimeoutStartUSec": "1min 30s", "TimeoutStopFailureMode": "terminate", "TimeoutStopUSec": "1min 30s", "TimerSlackNSec": "50000", "Transient": "no", "Type": "forking", "UID": "[not set]", "UMask": "0022", "UnitFilePreset": "enabled", "UnitFileState": "enabled", "UtmpMode": "init", "WantedBy": "multi-user.target", "WatchdogSignal": "6", "WatchdogTimestampMonotonic": "0", "WatchdogUSec": "0"}} 2026-06-02 13:02:10.577411 | debian-bookworm | 2026-06-02 13:02:10.577422 | debian-bookworm | PLAY RECAP ********************************************************************* 2026-06-02 13:02:10.577430 | debian-bookworm | molecule-auditd : ok=15 changed=8 unreachable=0 failed=0 skipped=0 rescued=0 ignored=0 2026-06-02 13:02:10.577437 | debian-bookworm | 2026-06-02 13:02:10.650389 | debian-bookworm | INFO [delegated > converge] Executed: Successful 2026-06-02 13:02:10.650778 | debian-bookworm | WARNING Molecule executed 1 scenario (1 missing files) 2026-06-02 13:02:10.974521 | debian-bookworm | ok: Runtime: 0:00:17.815084 2026-06-02 13:02:11.329533 | ubuntu-noble | ok: [molecule-auditd] => {"changed": false, "cmd": ["find", "/etc/audit/rules.d", "-type", "f", "-printf", "%f\n"], "delta": "0:00:00.007916", "end": "2026-06-02 13:02:11.282985", "msg": "", "rc": 0, "start": "2026-06-02 13:02:11.275069", "stderr": "", "stderr_lines": [], "stdout": "audit.rules\n20-neo23x0.rules", "stdout_lines": ["audit.rules", "20-neo23x0.rules"]} 2026-06-02 13:02:11.329582 | ubuntu-noble | 2026-06-02 13:02:11.329588 | ubuntu-noble | TASK [auditd : Remove unmanaged rules files] *********************************** 2026-06-02 13:02:11.713426 | ubuntu-noble | --- before 2026-06-02 13:02:11.714027 | ubuntu-noble | +++ after 2026-06-02 13:02:11.714445 | ubuntu-noble | @@ -1,4 +1,4 @@ 2026-06-02 13:02:11.714878 | ubuntu-noble | { 2026-06-02 13:02:11.715301 | ubuntu-noble | "path": "/etc/audit/rules.d/audit.rules", 2026-06-02 13:02:11.715646 | ubuntu-noble | - "state": "file" 2026-06-02 13:02:11.716033 | ubuntu-noble | + "state": "absent" 2026-06-02 13:02:11.716368 | ubuntu-noble | } 2026-06-02 13:02:11.716889 | ubuntu-noble | 2026-06-02 13:02:11.717131 | ubuntu-noble | changed: [molecule-auditd] => (item=audit.rules) => {"ansible_loop_var": "item", "changed": true, "item": "audit.rules", "path": "/etc/audit/rules.d/audit.rules", "state": "absent"} 2026-06-02 13:02:11.717495 | ubuntu-noble | skipping: [molecule-auditd] => (item=20-neo23x0.rules) => {"ansible_loop_var": "item", "changed": false, "false_condition": "item not in auditd_rules_files", "item": "20-neo23x0.rules", "skip_reason": "Conditional result was False"} 2026-06-02 13:02:11.717814 | ubuntu-noble | 2026-06-02 13:02:11.718331 | ubuntu-noble | RUNNING HANDLER [auditd : Restart auditd service] ****************************** 2026-06-02 13:02:12.440953 | ubuntu-noble | changed: [molecule-auditd] => {"changed": true, "name": "auditd", "state": "started", "status": {"ActiveEnterTimestamp": "Tue 2026-06-02 13:02:03 UTC", "ActiveEnterTimestampMonotonic": "4507537671", "ActiveExitTimestampMonotonic": "0", "ActiveState": "active", "After": "systemd-journald.socket system.slice systemd-tmpfiles-setup.service local-fs.target", "AllowIsolate": "no", "AssertResult": "yes", "AssertTimestamp": "Tue 2026-06-02 13:02:03 UTC", "AssertTimestampMonotonic": "4507464413", "Before": "systemd-update-utmp.service ssh.service shutdown.target sysinit.target", "BlockIOAccounting": "no", "BlockIOWeight": "[not set]", "CPUAccounting": "yes", "CPUAffinityFromNUMA": "no", "CPUQuotaPerSecUSec": "infinity", "CPUQuotaPeriodUSec": "infinity", "CPUSchedulingPolicy": "0", "CPUSchedulingPriority": "0", "CPUSchedulingResetOnFork": "no", "CPUShares": "[not set]", "CPUUsageNSec": "56757000", "CPUWeight": "[not set]", "CacheDirectoryMode": "0755", "CanFreeze": "yes", "CanIsolate": "no", "CanReload": "no", "CanStart": "yes", "CanStop": "yes", "CapabilityBoundingSet": "cap_chown cap_dac_override cap_dac_read_search cap_fowner cap_fsetid cap_kill cap_setgid cap_setuid cap_setpcap cap_linux_immutable cap_net_bind_service cap_net_broadcast cap_net_admin cap_net_raw cap_ipc_lock cap_ipc_owner cap_sys_rawio cap_sys_chroot cap_sys_ptrace cap_sys_pacct cap_sys_admin cap_sys_boot cap_sys_nice cap_sys_resource cap_sys_time cap_sys_tty_config cap_mknod cap_lease cap_audit_write cap_audit_control cap_setfcap cap_mac_override cap_mac_admin cap_syslog cap_wake_alarm cap_block_suspend cap_audit_read cap_perfmon cap_bpf cap_checkpoint_restore", "CleanResult": "success", "CollectMode": "inactive", "ConditionResult": "yes", "ConditionTimestamp": "Tue 2026-06-02 13:02:03 UTC", "ConditionTimestampMonotonic": "4507463902", "ConfigurationDirectoryMode": "0755", "Conflicts": "shutdown.target", "ControlGroup": "/system.slice/auditd.service", "ControlGroupId": "3910", "ControlPID": "0", "CoredumpFilter": "0x33", "CoredumpReceive": "no", "DefaultDependencies": "no", "DefaultMemoryLow": "0", "DefaultMemoryMin": "0", "DefaultStartupMemoryLow": "0", "Delegate": "no", "Description": "Security Auditing Service", "DevicePolicy": "auto", "Documentation": "\"man:auditd(8)\" https://github.com/linux-audit/audit-documentation", "DynamicUser": "no", "ExecMainCode": "0", "ExecMainExitTimestampMonotonic": "0", "ExecMainPID": "2192", "ExecMainStartTimestamp": "Tue 2026-06-02 13:02:03 UTC", "ExecMainStartTimestampMonotonic": "4507487746", "ExecMainStatus": "0", "ExecStart": "{ path=/sbin/auditd ; argv[]=/sbin/auditd ; ignore_errors=no ; start_time=[Tue 2026-06-02 13:02:03 UTC] ; stop_time=[Tue 2026-06-02 13:02:03 UTC] ; pid=2191 ; code=exited ; status=0 }", "ExecStartEx": "{ path=/sbin/auditd ; argv[]=/sbin/auditd ; flags= ; start_time=[Tue 2026-06-02 13:02:03 UTC] ; stop_time=[Tue 2026-06-02 13:02:03 UTC] ; pid=2191 ; code=exited ; status=0 }", "ExecStartPost": "{ path=/sbin/augenrules ; argv[]=/sbin/augenrules --load ; ignore_errors=yes ; start_time=[Tue 2026-06-02 13:02:03 UTC] ; stop_time=[Tue 2026-06-02 13:02:03 UTC] ; pid=2195 ; code=exited ; status=0 }", "ExecStartPostEx": "{ path=/sbin/augenrules ; argv[]=/sbin/augenrules --load ; flags=ignore-failure ; start_time=[Tue 2026-06-02 13:02:03 UTC] ; stop_time=[Tue 2026-06-02 13:02:03 UTC] ; pid=2195 ; code=exited ; status=0 }", "ExitType": "main", "ExtensionImagePolicy": "root=verity+signed+encrypted+unprotected+absent:usr=verity+signed+encrypted+unprotected+absent:home=encrypted+unprotected+absent:srv=encrypted+unprotected+absent:tmp=encrypted+unprotected+absent:var=encrypted+unprotected+absent", "FailureAction": "none", "FileDescriptorStoreMax": "0", "FileDescriptorStorePreserve": "restart", "FinalKillSignal": "9", "FragmentPath": "/usr/lib/systemd/system/auditd.service", "FreezerState": "running", "GID": "[not set]", "GuessMainPID": "yes", "IOAccounting": "no", "IOReadBytes": "[not set]", "IOReadOperations": "[not set]", "IOSchedulingClass": "2", "IOSchedulingPriority": "4", "IOWeight": "[not set]", "IOWriteBytes": "[not set]", "IOWriteOperations": "[not set]", "IPAccounting": "no", "IPEgressBytes": "[no data]", "IPEgressPackets": "[no data]", "IPIngressBytes": "[no data]", "IPIngressPackets": "[no data]", "Id": "auditd.service", "IgnoreOnIsolate": "no", "IgnoreSIGPIPE": "yes", "InactiveEnterTimestampMonotonic": "0", "InactiveExitTimestamp": "Tue 2026-06-02 13:02:03 UTC", "InactiveExitTimestampMonotonic": "4507474431", "InvocationID": "797ff7ed28ec45878d7c5047aa498258", "JobRunningTimeoutUSec": "infinity", "JobTimeoutAction": "none", "JobTimeoutUSec": "infinity", "KeyringMode": "private", "KillMode": "control-group", "KillSignal": "15", "LimitAS": "infinity", "LimitASSoft": "infinity", "LimitCORE": "infinity", "LimitCORESoft": "0", "LimitCPU": "infinity", "LimitCPUSoft": "infinity", "LimitDATA": "infinity", "LimitDATASoft": "infinity", "LimitFSIZE": "infinity", "LimitFSIZESoft": "infinity", "LimitLOCKS": "infinity", "LimitLOCKSSoft": "infinity", "LimitMEMLOCK": "8388608", "LimitMEMLOCKSoft": "8388608", "LimitMSGQUEUE": "819200", "LimitMSGQUEUESoft": "819200", "LimitNICE": "0", "LimitNICESoft": "0", "LimitNOFILE": "524288", "LimitNOFILESoft": "1024", "LimitNPROC": "15372", "LimitNPROCSoft": "15372", "LimitRSS": "infinity", "LimitRSSSoft": "infinity", "LimitRTPRIO": "0", "LimitRTPRIOSoft": "0", "LimitRTTIME": "infinity", "LimitRTTIMESoft": "infinity", "LimitSIGPENDING": "15372", "LimitSIGPENDINGSoft": "15372", "LimitSTACK": "infinity", "LimitSTACKSoft": "8388608", "LoadState": "loaded", "LockPersonality": "yes", "LogLevelMax": "-1", "LogRateLimitBurst": "0", "LogRateLimitIntervalUSec": "0", "LogsDirectoryMode": "0755", "MainPID": "2192", "ManagedOOMMemoryPressure": "auto", "ManagedOOMMemoryPressureLimit": "0", "ManagedOOMPreference": "none", "ManagedOOMSwap": "auto", "MemoryAccounting": "yes", "MemoryAvailable": "3452358656", "MemoryCurrent": "520192", "MemoryDenyWriteExecute": "yes", "MemoryHigh": "infinity", "MemoryKSM": "no", "MemoryLimit": "infinity", "MemoryLow": "0", "MemoryMax": "infinity", "MemoryMin": "0", "MemoryPeak": "2142208", "MemoryPressureThresholdUSec": "200ms", "MemoryPressureWatch": "auto", "MemorySwapCurrent": "0", "MemorySwapMax": "infinity", "MemorySwapPeak": "0", "MemoryZSwapCurrent": "0", "MemoryZSwapMax": "infinity", "MountAPIVFS": "no", "MountImagePolicy": "root=verity+signed+encrypted+unprotected+absent:usr=verity+signed+encrypted+unprotected+absent:home=encrypted+unprotected+absent:srv=encrypted+unprotected+absent:tmp=encrypted+unprotected+absent:var=encrypted+unprotected+absent", "NFileDescriptorStore": "0", "NRestarts": "0", "NUMAPolicy": "n/a", "Names": "auditd.service", "NeedDaemonReload": "no", "Nice": "0", "NoNewPrivileges": "no", "NonBlocking": "no", "NotifyAccess": "none", "OOMPolicy": "stop", "OOMScoreAdjust": "0", "OnFailureJobMode": "replace", "OnSuccessJobMode": "fail", "PIDFile": "/run/auditd.pid", "Perpetual": "no", "PrivateDevices": "no", "PrivateIPC": "no", "PrivateMounts": "no", "PrivateNetwork": "no", "PrivateTmp": "no", "PrivateUsers": "no", "ProcSubset": "all", "ProtectClock": "no", "ProtectControlGroups": "no", "ProtectHome": "no", "ProtectHostname": "no", "ProtectKernelLogs": "no", "ProtectKernelModules": "yes", "ProtectKernelTunables": "no", "ProtectProc": "default", "ProtectSystem": "no", "RefuseManualStart": "no", "RefuseManualStop": "no", "ReloadResult": "success", "ReloadSignal": "1", "RemainAfterExit": "no", "RemoveIPC": "no", "Requires": "system.slice", "Restart": "on-failure", "RestartKillSignal": "15", "RestartMaxDelayUSec": "infinity", "RestartMode": "normal", "RestartPreventExitStatus": "2 4 6", "RestartSteps": "0", "RestartUSec": "100ms", "RestartUSecNext": "100ms", "RestrictNamespaces": "no", "RestrictRealtime": "yes", "RestrictSUIDSGID": "no", "Result": "success", "RootDirectoryStartOnly": "no", "RootEphemeral": "no", "RootImagePolicy": "root=verity+signed+encrypted+unprotected+absent:usr=verity+signed+encrypted+unprotected+absent:home=encrypted+unprotected+absent:srv=encrypted+unprotected+absent:tmp=encrypted+unprotected+absent:var=encrypted+unprotected+absent", "RuntimeDirectoryMode": "0755", "RuntimeDirectoryPreserve": "no", "RuntimeMaxUSec": "infinity", "RuntimeRandomizedExtraUSec": "0", "SameProcessGroup": "no", "SecureBits": "0", "SendSIGHUP": "no", "SendSIGKILL": "yes", "SetLoginEnvironment": "no", "Slice": "system.slice", "StandardError": "inherit", "StandardInput": "null", "StandardOutput": "journal", "StartLimitAction": "none", "StartLimitBurst": "5", "StartLimitIntervalUSec": "10s", "StartupBlockIOWeight": "[not set]", "StartupCPUShares": "[not set]", "StartupCPUWeight": "[not set]", "StartupIOWeight": "[not set]", "StartupMemoryHigh": "infinity", "StartupMemoryLow": "0", "StartupMemoryMax": "infinity", "StartupMemorySwapMax": "infinity", "StartupMemoryZSwapMax": "infinity", "StateChangeTimestamp": "Tue 2026-06-02 13:02:03 UTC", "StateChangeTimestampMonotonic": "4507537671", "StateDirectoryMode": "0755", "StatusErrno": "0", "StopWhenUnneeded": "no", "SubState": "running", "SuccessAction": "none", "SurviveFinalKillSignal": "no", "SyslogFacility": "3", "SyslogLevel": "6", "SyslogLevelPrefix": "yes", "SyslogPriority": "30", "SystemCallErrorNumber": "2147483646", "TTYReset": "no", "TTYVHangup": "no", "TTYVTDisallocate": "no", "TasksAccounting": "yes", "TasksCurrent": "2", "TasksMax": "4611", "TimeoutAbortUSec": "1min 30s", "TimeoutCleanUSec": "infinity", "TimeoutStartFailureMode": "terminate", "TimeoutStartUSec": "1min 30s", "TimeoutStopFailureMode": "terminate", "TimeoutStopUSec": "1min 30s", "TimerSlackNSec": "50000", "Transient": "no", "Type": "forking", "UID": "[not set]", "UMask": "0022", "UnitFilePreset": "enabled", "UnitFileState": "enabled", "UtmpMode": "init", "WantedBy": "multi-user.target", "WatchdogSignal": "6", "WatchdogTimestampMonotonic": "0", "WatchdogUSec": "0"}} 2026-06-02 13:02:12.447545 | ubuntu-noble | 2026-06-02 13:02:12.447584 | ubuntu-noble | RUNNING HANDLER [auditd : Generate auditd rules] ******************************* 2026-06-02 13:02:12.883469 | ubuntu-noble | changed: [molecule-auditd] => {"changed": true, "cmd": ["augenrules", "--load"], "delta": "0:00:00.080009", "end": "2026-06-02 13:02:12.815212", "msg": "", "rc": 0, "start": "2026-06-02 13:02:12.735203", "stderr": "Unknown user: chrony\nThere was an error in line 24 of /etc/audit/audit.rules\nError sending add rule data request (No such file or directory)\nThere was an error in line 28 of /etc/audit/audit.rules\nUnknown user: ntp\nThere was an error in line 44 of /etc/audit/audit.rules\nError sending add rule data request (No such file or directory)\nThere was an error in line 83 of /etc/audit/audit.rules\nError sending add rule data request (No such file or directory)\nThere was an error in line 84 of /etc/audit/audit.rules\nError sending add rule data request (No such file or directory)\nThere was an error in line 86 of /etc/audit/audit.rules\nError sending add rule data request (No such file or directory)\nThere was an error in line 112 of /etc/audit/audit.rules\nError sending add rule data request (No such file or directory)\nThere was an error in line 115 of /etc/audit/audit.rules\nError sending add rule data request (No such file or directory)\nThere was an error in line 176 of /etc/audit/audit.rules\nError sending add rule data request (No such file or directory)\nThere was an error in line 177 of /etc/audit/audit.rules\nError sending add rule data request (No such file or directory)\nThere was an error in line 178 of /etc/audit/audit.rules\nError sending add rule data request (No such file or directory)\nThere was an error in line 179 of /etc/audit/audit.rules\nError sending add rule data request (No such file or directory)\nThere was an error in line 180 of /etc/audit/audit.rules\nError sending add rule data request (No such file or directory)\nThere was an error in line 217 of /etc/audit/audit.rules\nError sending add rule data request (No such file or directory)\nThere was an error in line 218 of /etc/audit/audit.rules\nError sending add rule data request (No such file or directory)\nThere was an error in line 234 of /etc/audit/audit.rules\nError sending add rule data request (No such file or directory)\nThere was an error in line 285 of /etc/audit/audit.rules\nError sending add rule data request (No such file or directory)\nThere was an error in line 286 of /etc/audit/audit.rules\nError sending add rule data request (No such file or directory)\nThere was an error in line 324 of /etc/audit/audit.rules\nError sending add rule data request (No such file or directory)\nThere was an error in line 325 of /etc/audit/audit.rules\nError sending add rule data request (No such file or directory)\nThere was an error in line 346 of /etc/audit/audit.rules\nparameter passed without an option given\nThere was an error in line 347 of /etc/audit/audit.rules\nparameter passed without an option given\nThere was an error in line 348 of /etc/audit/audit.rules\nparameter passed without an option given\nThere was an error in line 349 of /etc/audit/audit.rules\nparameter passed without an option given\nThere was an error in line 350 of /etc/audit/audit.rules\nparameter passed without an option given\nThere was an error in line 351 of /etc/audit/audit.rules\nError sending add rule data request (No such file or directory)\nThere was an error in line 359 of /etc/audit/audit.rules", "stderr_lines": ["Unknown user: chrony", "There was an error in line 24 of /etc/audit/audit.rules", "Error sending add rule data request (No such file or directory)", "There was an error in line 28 of /etc/audit/audit.rules", "Unknown user: ntp", "There was an error in line 44 of /etc/audit/audit.rules", "Error sending add rule data request (No such file or directory)", "There was an error in line 83 of /etc/audit/audit.rules", "Error sending add rule data request (No such file or directory)", "There was an error in line 84 of /etc/audit/audit.rules", "Error sending add rule data request (No such file or directory)", "There was an error in line 86 of /etc/audit/audit.rules", "Error sending add rule data request (No such file or directory)", "There was an error in line 112 of /etc/audit/audit.rules", "Error sending add rule data request (No such file or directory)", "There was an error in line 115 of /etc/audit/audit.rules", "Error sending add rule data request (No such file or directory)", "There was an error in line 176 of /etc/audit/audit.rules", "Error sending add rule data request (No such file or directory)", "There was an error in line 177 of /etc/audit/audit.rules", "Error sending add rule data request (No such file or directory)", "There was an error in line 178 of /etc/audit/audit.rules", "Error sending add rule data request (No such file or directory)", "There was an error in line 179 of /etc/audit/audit.rules", "Error sending add rule data request (No such file or directory)", "There was an error in line 180 of /etc/audit/audit.rules", "Error sending add rule data request (No such file or directory)", "There was an error in line 217 of /etc/audit/audit.rules", "Error sending add rule data request (No such file or directory)", "There was an error in line 218 of /etc/audit/audit.rules", "Error sending add rule data request (No such file or directory)", "There was an error in line 234 of /etc/audit/audit.rules", "Error sending add rule data request (No such file or directory)", "There was an error in line 285 of /etc/audit/audit.rules", "Error sending add rule data request (No such file or directory)", "There was an error in line 286 of /etc/audit/audit.rules", "Error sending add rule data request (No such file or directory)", "There was an error in line 324 of /etc/audit/audit.rules", "Error sending add rule data request (No such file or directory)", "There was an error in line 325 of /etc/audit/audit.rules", "Error sending add rule data request (No such file or directory)", "There was an error in line 346 of /etc/audit/audit.rules", "parameter passed without an option given", "There was an error in line 347 of /etc/audit/audit.rules", "parameter passed without an option given", "There was an error in line 348 of /etc/audit/audit.rules", "parameter passed without an option given", "There was an error in line 349 of /etc/audit/audit.rules", "parameter passed without an option given", "There was an error in line 350 of /etc/audit/audit.rules", "parameter passed without an option given", "There was an error in line 351 of /etc/audit/audit.rules", "Error sending add rule data request (No such file or directory)", "There was an error in line 359 of /etc/audit/audit.rules"], "stdout": "/usr/sbin/augenrules: No change\nNo rules\nenabled 1\nfailure 1\npid 2584\nrate_limit 0\nbacklog_limit 8192\nlost 0\nbacklog 1254\nbacklog_wait_time 60000\nbacklog_wait_time_actual 0\nenabled 1\nfailure 1\npid 2584\nrate_limit 0\nbacklog_limit 8192\nlost 0\nbacklog 1232\nbacklog_wait_time 60000\nbacklog_wait_time_actual 0", "stdout_lines": ["/usr/sbin/augenrules: No change", "No rules", "enabled 1", "failure 1", "pid 2584", "rate_limit 0", "backlog_limit 8192", "lost 0", "backlog 1254", "backlog_wait_time 60000", "backlog_wait_time_actual 0", "enabled 1", "failure 1", "pid 2584", "rate_limit 0", "backlog_limit 8192", "lost 0", "backlog 1232", "backlog_wait_time 60000", "backlog_wait_time_actual 0"]} 2026-06-02 13:02:12.883531 | ubuntu-noble | 2026-06-02 13:02:12.884766 | ubuntu-noble | RUNNING HANDLER [auditd : Restart auditd service] ****************************** 2026-06-02 13:02:13.819310 | ubuntu-noble | ok: Runtime: 0:00:20.795064 2026-06-02 13:02:13.838174 | 2026-06-02 13:02:13.838314 | TASK [ansible-molecule : Run molecule verify action with scenario delegated] 2026-06-02 13:02:13.625687 | ubuntu-noble | changed: [molecule-auditd] => {"changed": true, "name": "auditd", "state": "started", "status": {"ActiveEnterTimestamp": "Tue 2026-06-02 13:02:12 UTC", "ActiveEnterTimestampMonotonic": "4516636595", "ActiveExitTimestamp": "Tue 2026-06-02 13:02:12 UTC", "ActiveExitTimestampMonotonic": "4516477224", "ActiveState": "active", "After": "systemd-journald.socket system.slice systemd-tmpfiles-setup.service local-fs.target", "AllowIsolate": "no", "AssertResult": "yes", "AssertTimestamp": "Tue 2026-06-02 13:02:12 UTC", "AssertTimestampMonotonic": "4516526637", "Before": "systemd-update-utmp.service ssh.service shutdown.target sysinit.target", "BlockIOAccounting": "no", "BlockIOWeight": "[not set]", "CPUAccounting": "yes", "CPUAffinityFromNUMA": "no", "CPUQuotaPerSecUSec": "infinity", "CPUQuotaPeriodUSec": "infinity", "CPUSchedulingPolicy": "0", "CPUSchedulingPriority": "0", "CPUSchedulingResetOnFork": "no", "CPUShares": "[not set]", "CPUUsageNSec": "176404000", "CPUWeight": "[not set]", "CacheDirectoryMode": "0755", "CanFreeze": "yes", "CanIsolate": "no", "CanReload": "no", "CanStart": "yes", "CanStop": "yes", "CapabilityBoundingSet": "cap_chown cap_dac_override cap_dac_read_search cap_fowner cap_fsetid cap_kill cap_setgid cap_setuid cap_setpcap cap_linux_immutable cap_net_bind_service cap_net_broadcast cap_net_admin cap_net_raw cap_ipc_lock cap_ipc_owner cap_sys_rawio cap_sys_chroot cap_sys_ptrace cap_sys_pacct cap_sys_admin cap_sys_boot cap_sys_nice cap_sys_resource cap_sys_time cap_sys_tty_config cap_mknod cap_lease cap_audit_write cap_audit_control cap_setfcap cap_mac_override cap_mac_admin cap_syslog cap_wake_alarm cap_block_suspend cap_audit_read cap_perfmon cap_bpf cap_checkpoint_restore", "CleanResult": "success", "CollectMode": "inactive", "ConditionResult": "yes", "ConditionTimestamp": "Tue 2026-06-02 13:02:12 UTC", "ConditionTimestampMonotonic": "4516526550", "ConfigurationDirectoryMode": "0755", "Conflicts": "shutdown.target", "ControlGroup": "/system.slice/auditd.service", "ControlGroupId": "3952", "ControlPID": "0", "CoredumpFilter": "0x33", "CoredumpReceive": "no", "DefaultDependencies": "no", "DefaultMemoryLow": "0", "DefaultMemoryMin": "0", "DefaultStartupMemoryLow": "0", "Delegate": "no", "Description": "Security Auditing Service", "DevicePolicy": "auto", "Documentation": "\"man:auditd(8)\" https://github.com/linux-audit/audit-documentation", "DynamicUser": "no", "ExecMainCode": "0", "ExecMainExitTimestampMonotonic": "0", "ExecMainPID": "2584", "ExecMainStartTimestamp": "Tue 2026-06-02 13:02:12 UTC", "ExecMainStartTimestampMonotonic": "4516551326", "ExecMainStatus": "0", "ExecStart": "{ path=/sbin/auditd ; argv[]=/sbin/auditd ; ignore_errors=no ; start_time=[Tue 2026-06-02 13:02:12 UTC] ; stop_time=[Tue 2026-06-02 13:02:12 UTC] ; pid=2583 ; code=exited ; status=0 }", "ExecStartEx": "{ path=/sbin/auditd ; argv[]=/sbin/auditd ; flags= ; start_time=[Tue 2026-06-02 13:02:12 UTC] ; stop_time=[Tue 2026-06-02 13:02:12 UTC] ; pid=2583 ; code=exited ; status=0 }", "ExecStartPost": "{ path=/sbin/augenrules ; argv[]=/sbin/augenrules --load ; ignore_errors=yes ; start_time=[Tue 2026-06-02 13:02:12 UTC] ; stop_time=[Tue 2026-06-02 13:02:12 UTC] ; pid=2588 ; code=exited ; status=0 }", "ExecStartPostEx": "{ path=/sbin/augenrules ; argv[]=/sbin/augenrules --load ; flags=ignore-failure ; start_time=[Tue 2026-06-02 13:02:12 UTC] ; stop_time=[Tue 2026-06-02 13:02:12 UTC] ; pid=2588 ; code=exited ; status=0 }", "ExitType": "main", "ExtensionImagePolicy": "root=verity+signed+encrypted+unprotected+absent:usr=verity+signed+encrypted+unprotected+absent:home=encrypted+unprotected+absent:srv=encrypted+unprotected+absent:tmp=encrypted+unprotected+absent:var=encrypted+unprotected+absent", "FailureAction": "none", "FileDescriptorStoreMax": "0", "FileDescriptorStorePreserve": "restart", "FinalKillSignal": "9", "FragmentPath": "/usr/lib/systemd/system/auditd.service", "FreezerState": "running", "GID": "[not set]", "GuessMainPID": "yes", "IOAccounting": "no", "IOReadBytes": "[not set]", "IOReadOperations": "[not set]", "IOSchedulingClass": "2", "IOSchedulingPriority": "4", "IOWeight": "[not set]", "IOWriteBytes": "[not set]", "IOWriteOperations": "[not set]", "IPAccounting": "no", "IPEgressBytes": "[no data]", "IPEgressPackets": "[no data]", "IPIngressBytes": "[no data]", "IPIngressPackets": "[no data]", "Id": "auditd.service", "IgnoreOnIsolate": "no", "IgnoreSIGPIPE": "yes", "InactiveEnterTimestamp": "Tue 2026-06-02 13:02:12 UTC", "InactiveEnterTimestampMonotonic": "4516524836", "InactiveExitTimestamp": "Tue 2026-06-02 13:02:12 UTC", "InactiveExitTimestampMonotonic": "4516541319", "InvocationID": "cac833f8b3bd496baaa562fee120f0cd", "JobRunningTimeoutUSec": "infinity", "JobTimeoutAction": "none", "JobTimeoutUSec": "infinity", "KeyringMode": "private", "KillMode": "control-group", "KillSignal": "15", "LimitAS": "infinity", "LimitASSoft": "infinity", "LimitCORE": "infinity", "LimitCORESoft": "0", "LimitCPU": "infinity", "LimitCPUSoft": "infinity", "LimitDATA": "infinity", "LimitDATASoft": "infinity", "LimitFSIZE": "infinity", "LimitFSIZESoft": "infinity", "LimitLOCKS": "infinity", "LimitLOCKSSoft": "infinity", "LimitMEMLOCK": "8388608", "LimitMEMLOCKSoft": "8388608", "LimitMSGQUEUE": "819200", "LimitMSGQUEUESoft": "819200", "LimitNICE": "0", "LimitNICESoft": "0", "LimitNOFILE": "524288", "LimitNOFILESoft": "1024", "LimitNPROC": "15372", "LimitNPROCSoft": "15372", "LimitRSS": "infinity", "LimitRSSSoft": "infinity", "LimitRTPRIO": "0", "LimitRTPRIOSoft": "0", "LimitRTTIME": "infinity", "LimitRTTIMESoft": "infinity", "LimitSIGPENDING": "15372", "LimitSIGPENDINGSoft": "15372", "LimitSTACK": "infinity", "LimitSTACKSoft": "8388608", "LoadState": "loaded", "LockPersonality": "yes", "LogLevelMax": "-1", "LogRateLimitBurst": "0", "LogRateLimitIntervalUSec": "0", "LogsDirectoryMode": "0755", "MainPID": "2584", "ManagedOOMMemoryPressure": "auto", "ManagedOOMMemoryPressureLimit": "0", "ManagedOOMPreference": "none", "ManagedOOMSwap": "auto", "MemoryAccounting": "yes", "MemoryAvailable": "3485216768", "MemoryCurrent": "1863680", "MemoryDenyWriteExecute": "yes", "MemoryHigh": "infinity", "MemoryKSM": "no", "MemoryLimit": "infinity", "MemoryLow": "0", "MemoryMax": "infinity", "MemoryMin": "0", "MemoryPeak": "2244608", "MemoryPressureThresholdUSec": "200ms", "MemoryPressureWatch": "auto", "MemorySwapCurrent": "0", "MemorySwapMax": "infinity", "MemorySwapPeak": "0", "MemoryZSwapCurrent": "0", "MemoryZSwapMax": "infinity", "MountAPIVFS": "no", "MountImagePolicy": "root=verity+signed+encrypted+unprotected+absent:usr=verity+signed+encrypted+unprotected+absent:home=encrypted+unprotected+absent:srv=encrypted+unprotected+absent:tmp=encrypted+unprotected+absent:var=encrypted+unprotected+absent", "NFileDescriptorStore": "0", "NRestarts": "0", "NUMAPolicy": "n/a", "Names": "auditd.service", "NeedDaemonReload": "no", "Nice": "0", "NoNewPrivileges": "no", "NonBlocking": "no", "NotifyAccess": "none", "OOMPolicy": "stop", "OOMScoreAdjust": "0", "OnFailureJobMode": "replace", "OnSuccessJobMode": "fail", "PIDFile": "/run/auditd.pid", "Perpetual": "no", "PrivateDevices": "no", "PrivateIPC": "no", "PrivateMounts": "no", "PrivateNetwork": "no", "PrivateTmp": "no", "PrivateUsers": "no", "ProcSubset": "all", "ProtectClock": "no", "ProtectControlGroups": "no", "ProtectHome": "no", "ProtectHostname": "no", "ProtectKernelLogs": "no", "ProtectKernelModules": "yes", "ProtectKernelTunables": "no", "ProtectProc": "default", "ProtectSystem": "no", "RefuseManualStart": "no", "RefuseManualStop": "no", "ReloadResult": "success", "ReloadSignal": "1", "RemainAfterExit": "no", "RemoveIPC": "no", "Requires": "system.slice", "Restart": "on-failure", "RestartKillSignal": "15", "RestartMaxDelayUSec": "infinity", "RestartMode": "normal", "RestartPreventExitStatus": "2 4 6", "RestartSteps": "0", "RestartUSec": "100ms", "RestartUSecNext": "100ms", "RestrictNamespaces": "no", "RestrictRealtime": "yes", "RestrictSUIDSGID": "no", "Result": "success", "RootDirectoryStartOnly": "no", "RootEphemeral": "no", "RootImagePolicy": "root=verity+signed+encrypted+unprotected+absent:usr=verity+signed+encrypted+unprotected+absent:home=encrypted+unprotected+absent:srv=encrypted+unprotected+absent:tmp=encrypted+unprotected+absent:var=encrypted+unprotected+absent", "RuntimeDirectoryMode": "0755", "RuntimeDirectoryPreserve": "no", "RuntimeMaxUSec": "infinity", "RuntimeRandomizedExtraUSec": "0", "SameProcessGroup": "no", "SecureBits": "0", "SendSIGHUP": "no", "SendSIGKILL": "yes", "SetLoginEnvironment": "no", "Slice": "system.slice", "StandardError": "inherit", "StandardInput": "null", "StandardOutput": "journal", "StartLimitAction": "none", "StartLimitBurst": "5", "StartLimitIntervalUSec": "10s", "StartupBlockIOWeight": "[not set]", "StartupCPUShares": "[not set]", "StartupCPUWeight": "[not set]", "StartupIOWeight": "[not set]", "StartupMemoryHigh": "infinity", "StartupMemoryLow": "0", "StartupMemoryMax": "infinity", "StartupMemorySwapMax": "infinity", "StartupMemoryZSwapMax": "infinity", "StateChangeTimestamp": "Tue 2026-06-02 13:02:12 UTC", "StateChangeTimestampMonotonic": "4516636595", "StateDirectoryMode": "0755", "StatusErrno": "0", "StopWhenUnneeded": "no", "SubState": "running", "SuccessAction": "none", "SurviveFinalKillSignal": "no", "SyslogFacility": "3", "SyslogLevel": "6", "SyslogLevelPrefix": "yes", "SyslogPriority": "30", "SystemCallErrorNumber": "2147483646", "TTYReset": "no", "TTYVHangup": "no", "TTYVTDisallocate": "no", "TasksAccounting": "yes", "TasksCurrent": "2", "TasksMax": "4611", "TimeoutAbortUSec": "1min 30s", "TimeoutCleanUSec": "infinity", "TimeoutStartFailureMode": "terminate", "TimeoutStartUSec": "1min 30s", "TimeoutStopFailureMode": "terminate", "TimeoutStopUSec": "1min 30s", "TimerSlackNSec": "50000", "Transient": "no", "Type": "forking", "UID": "[not set]", "UMask": "0022", "UnitFilePreset": "enabled", "UnitFileState": "enabled", "UtmpMode": "init", "WantedBy": "multi-user.target", "WatchdogSignal": "6", "WatchdogTimestampMonotonic": "0", "WatchdogUSec": "0"}} 2026-06-02 13:02:13.626447 | ubuntu-noble | 2026-06-02 13:02:13.626554 | ubuntu-noble | PLAY RECAP ********************************************************************* 2026-06-02 13:02:13.626665 | ubuntu-noble | molecule-auditd : ok=15 changed=8 unreachable=0 failed=0 skipped=0 rescued=0 ignored=0 2026-06-02 13:02:13.626762 | ubuntu-noble | 2026-06-02 13:02:13.720530 | ubuntu-noble | INFO [delegated > converge] Executed: Successful 2026-06-02 13:02:13.721466 | ubuntu-noble | WARNING Molecule executed 1 scenario (1 missing files) 2026-06-02 13:02:14.652093 | ubuntu-noble | WARNING Molecule scenarios should migrate to 'extensions/molecule' 2026-06-02 13:02:14.664692 | ubuntu-noble | DEBUG [unknown > config] provisioner.env found in /home/zuul/src/github.com/osism/ansible-collection-services/molecule/delegated/molecule.yml, this can be defined in ansible.env 2026-06-02 13:02:14.477370 | debian-bookworm | WARNING Molecule scenarios should migrate to 'extensions/molecule' 2026-06-02 13:02:14.487085 | debian-bookworm | DEBUG [unknown > config] provisioner.env found in /home/zuul/src/github.com/osism/ansible-collection-services/molecule/delegated/molecule.yml, this can be defined in ansible.env 2026-06-02 13:02:14.909889 | debian-bookworm | DEBUG [unknown > config] provisioner.env found in /home/zuul/src/github.com/osism/ansible-collection-services/molecule/delegated/molecule.yml, this can be defined in ansible.env 2026-06-02 13:02:14.910525 | debian-bookworm | DEBUG [delegated > validate] Validating schema /home/zuul/src/github.com/osism/ansible-collection-services/molecule/delegated/molecule.yml. 2026-06-02 13:02:14.932650 | debian-bookworm | DEBUG [default > validate] Validating schema /home/zuul/src/github.com/osism/ansible-collection-services/molecule/default/molecule.yml. 2026-06-02 13:02:14.938096 | debian-bookworm | INFO [delegated > discovery] scenario test matrix: verify 2026-06-02 13:02:14.938163 | debian-bookworm | INFO [delegated > prerun] Performing prerun with role_name_check=0... 2026-06-02 13:02:15.179319 | ubuntu-noble | DEBUG [unknown > config] provisioner.env found in /home/zuul/src/github.com/osism/ansible-collection-services/molecule/delegated/molecule.yml, this can be defined in ansible.env 2026-06-02 13:02:15.180170 | ubuntu-noble | DEBUG [delegated > validate] Validating schema /home/zuul/src/github.com/osism/ansible-collection-services/molecule/delegated/molecule.yml. 2026-06-02 13:02:15.203119 | ubuntu-noble | DEBUG [default > validate] Validating schema /home/zuul/src/github.com/osism/ansible-collection-services/molecule/default/molecule.yml. 2026-06-02 13:02:15.208894 | ubuntu-noble | INFO [delegated > discovery] scenario test matrix: verify 2026-06-02 13:02:15.209070 | ubuntu-noble | INFO [delegated > prerun] Performing prerun with role_name_check=0... 2026-06-02 13:02:16.138101 | debian-bookworm | INFO [delegated > verify] Executing 2026-06-02 13:02:16.139399 | debian-bookworm | INFO [delegated > verify] Executing Testinfra tests found in /home/zuul/src/github.com/osism/ansible-collection-services/molecule/delegated/tests/... 2026-06-02 13:02:16.140495 | debian-bookworm | DEBUG ANSIBLE ENVIRONMENT: 2026-06-02 13:02:16.140512 | debian-bookworm | ANSIBLE_COLLECTIONS_PATH: /home/zuul/venv/.ansible/collections:/home/zuul/.ansible/collections 2026-06-02 13:02:16.140521 | debian-bookworm | ANSIBLE_CONFIG: /home/zuul/.ansible/tmp/molecule.oWZD.delegated/ansible.cfg 2026-06-02 13:02:16.140529 | debian-bookworm | ANSIBLE_LIBRARY: ../../plugins 2026-06-02 13:02:16.140535 | debian-bookworm | ANSIBLE_PYTHON_INTERPRETER: /home/zuul/venv/bin/python 2026-06-02 13:02:16.140542 | debian-bookworm | ANSIBLE_ROLE: auditd 2026-06-02 13:02:16.140548 | debian-bookworm | ANSIBLE_ROLES_PATH: ../../roles 2026-06-02 13:02:16.140554 | debian-bookworm | ANSIBLE_VERBOSITY: 1 2026-06-02 13:02:16.140560 | debian-bookworm | 2026-06-02 13:02:16.140644 | debian-bookworm | DEBUG MOLECULE ENVIRONMENT: 2026-06-02 13:02:16.140652 | debian-bookworm | MOLECULE_DEBUG: True 2026-06-02 13:02:16.140659 | debian-bookworm | MOLECULE_DEPENDENCY_NAME: galaxy 2026-06-02 13:02:16.140665 | debian-bookworm | MOLECULE_DRIVER_NAME: default 2026-06-02 13:02:16.140671 | debian-bookworm | MOLECULE_ENV_FILE: /home/zuul/src/github.com/osism/ansible-collection-services/.env.yml 2026-06-02 13:02:16.140677 | debian-bookworm | MOLECULE_EPHEMERAL_DIRECTORY: /home/zuul/.ansible/tmp/molecule.oWZD.delegated 2026-06-02 13:02:16.140684 | debian-bookworm | MOLECULE_FILE: /home/zuul/.ansible/tmp/molecule.oWZD.delegated/molecule.yml 2026-06-02 13:02:16.140690 | debian-bookworm | MOLECULE_INSTANCE_CONFIG: /home/zuul/.ansible/tmp/molecule.oWZD.delegated/instance_config.yml 2026-06-02 13:02:16.140696 | debian-bookworm | MOLECULE_INVENTORY_FILE: /home/zuul/.ansible/tmp/molecule.oWZD.delegated/inventory/ansible_inventory.yml 2026-06-02 13:02:16.140703 | debian-bookworm | MOLECULE_PROJECT_DIRECTORY: /home/zuul/src/github.com/osism/ansible-collection-services 2026-06-02 13:02:16.140709 | debian-bookworm | MOLECULE_PROVISIONER_NAME: ansible 2026-06-02 13:02:16.140715 | debian-bookworm | MOLECULE_SCENARIO_DIRECTORY: /home/zuul/src/github.com/osism/ansible-collection-services/molecule/delegated 2026-06-02 13:02:16.140721 | debian-bookworm | MOLECULE_SCENARIO_NAME: delegated 2026-06-02 13:02:16.140727 | debian-bookworm | MOLECULE_STATE_FILE: /home/zuul/.ansible/tmp/molecule.oWZD.delegated/state.yml 2026-06-02 13:02:16.140734 | debian-bookworm | MOLECULE_VERIFIER_NAME: testinfra 2026-06-02 13:02:16.140740 | debian-bookworm | MOLECULE_VERIFIER_TEST_DIRECTORY: /home/zuul/src/github.com/osism/ansible-collection-services/molecule/delegated/tests 2026-06-02 13:02:16.140747 | debian-bookworm | 2026-06-02 13:02:16.140805 | debian-bookworm | DEBUG SHELL REPLAY: ANSIBLE_COLLECTIONS_PATH=/home/zuul/venv/.ansible/collections:/home/zuul/.ansible/collections ANSIBLE_CONFIG=/home/zuul/.ansible/tmp/molecule.oWZD.delegated/ansible.cfg ANSIBLE_LIBRARY=../../plugins ANSIBLE_PYTHON_INTERPRETER=/home/zuul/venv/bin/python ANSIBLE_ROLE=auditd ANSIBLE_ROLES_PATH=../../roles ANSIBLE_VERBOSITY=1 MOLECULE_DEBUG=True MOLECULE_DEPENDENCY_NAME=galaxy MOLECULE_DRIVER_NAME=default MOLECULE_ENV_FILE=/home/zuul/src/github.com/osism/ansible-collection-services/.env.yml MOLECULE_EPHEMERAL_DIRECTORY=/home/zuul/.ansible/tmp/molecule.oWZD.delegated MOLECULE_FILE=/home/zuul/.ansible/tmp/molecule.oWZD.delegated/molecule.yml MOLECULE_INSTANCE_CONFIG=/home/zuul/.ansible/tmp/molecule.oWZD.delegated/instance_config.yml MOLECULE_INVENTORY_FILE=/home/zuul/.ansible/tmp/molecule.oWZD.delegated/inventory/ansible_inventory.yml MOLECULE_PROJECT_DIRECTORY=/home/zuul/src/github.com/osism/ansible-collection-services MOLECULE_PROVISIONER_NAME=ansible MOLECULE_SCENARIO_DIRECTORY=/home/zuul/src/github.com/osism/ansible-collection-services/molecule/delegated MOLECULE_SCENARIO_NAME=delegated MOLECULE_STATE_FILE=/home/zuul/.ansible/tmp/molecule.oWZD.delegated/state.yml MOLECULE_VERIFIER_NAME=testinfra MOLECULE_VERIFIER_TEST_DIRECTORY=/home/zuul/src/github.com/osism/ansible-collection-services/molecule/delegated/tests 2026-06-02 13:02:16.355211 | debian-bookworm | writing pytest debug information to pytestdebug.log 2026-06-02 13:02:16.368795 | debian-bookworm | ============================= test session starts ============================== 2026-06-02 13:02:16.369303 | debian-bookworm | platform linux -- Python 3.11.2, pytest-8.4.2, pluggy-1.6.0 -- /home/zuul/venv/bin/python3 2026-06-02 13:02:16.369764 | debian-bookworm | using: pytest-8.4.2 2026-06-02 13:02:16.370158 | debian-bookworm | registered third-party plugins: 2026-06-02 13:02:16.370895 | debian-bookworm | pytest-testinfra-10.2.2 at /home/zuul/venv/lib/python3.11/site-packages/testinfra/plugin.py 2026-06-02 13:02:16.371285 | debian-bookworm | rootdir: /home/zuul 2026-06-02 13:02:16.371665 | debian-bookworm | plugins: testinfra-10.2.2 2026-06-02 13:02:16.783901 | ubuntu-noble | INFO [delegated > verify] Executing 2026-06-02 13:02:16.785966 | ubuntu-noble | INFO [delegated > verify] Executing Testinfra tests found in /home/zuul/src/github.com/osism/ansible-collection-services/molecule/delegated/tests/... 2026-06-02 13:02:16.787323 | ubuntu-noble | DEBUG ANSIBLE ENVIRONMENT: 2026-06-02 13:02:16.787351 | ubuntu-noble | ANSIBLE_COLLECTIONS_PATH: /home/zuul/venv/.ansible/collections:/home/zuul/.ansible/collections 2026-06-02 13:02:16.787361 | ubuntu-noble | ANSIBLE_CONFIG: /home/zuul/.ansible/tmp/molecule.oWZD.delegated/ansible.cfg 2026-06-02 13:02:16.787368 | ubuntu-noble | ANSIBLE_LIBRARY: ../../plugins 2026-06-02 13:02:16.787374 | ubuntu-noble | ANSIBLE_PYTHON_INTERPRETER: /home/zuul/venv/bin/python 2026-06-02 13:02:16.787381 | ubuntu-noble | ANSIBLE_ROLE: auditd 2026-06-02 13:02:16.787386 | ubuntu-noble | ANSIBLE_ROLES_PATH: ../../roles 2026-06-02 13:02:16.787392 | ubuntu-noble | ANSIBLE_VERBOSITY: 1 2026-06-02 13:02:16.787399 | ubuntu-noble | 2026-06-02 13:02:16.787598 | ubuntu-noble | DEBUG MOLECULE ENVIRONMENT: 2026-06-02 13:02:16.787608 | ubuntu-noble | MOLECULE_DEBUG: True 2026-06-02 13:02:16.787614 | ubuntu-noble | MOLECULE_DEPENDENCY_NAME: galaxy 2026-06-02 13:02:16.787620 | ubuntu-noble | MOLECULE_DRIVER_NAME: default 2026-06-02 13:02:16.787626 | ubuntu-noble | MOLECULE_ENV_FILE: /home/zuul/src/github.com/osism/ansible-collection-services/.env.yml 2026-06-02 13:02:16.787633 | ubuntu-noble | MOLECULE_EPHEMERAL_DIRECTORY: /home/zuul/.ansible/tmp/molecule.oWZD.delegated 2026-06-02 13:02:16.787640 | ubuntu-noble | MOLECULE_FILE: /home/zuul/.ansible/tmp/molecule.oWZD.delegated/molecule.yml 2026-06-02 13:02:16.787645 | ubuntu-noble | MOLECULE_INSTANCE_CONFIG: /home/zuul/.ansible/tmp/molecule.oWZD.delegated/instance_config.yml 2026-06-02 13:02:16.787652 | ubuntu-noble | MOLECULE_INVENTORY_FILE: /home/zuul/.ansible/tmp/molecule.oWZD.delegated/inventory/ansible_inventory.yml 2026-06-02 13:02:16.787659 | ubuntu-noble | MOLECULE_PROJECT_DIRECTORY: /home/zuul/src/github.com/osism/ansible-collection-services 2026-06-02 13:02:16.787665 | ubuntu-noble | MOLECULE_PROVISIONER_NAME: ansible 2026-06-02 13:02:16.787670 | ubuntu-noble | MOLECULE_SCENARIO_DIRECTORY: /home/zuul/src/github.com/osism/ansible-collection-services/molecule/delegated 2026-06-02 13:02:16.787676 | ubuntu-noble | MOLECULE_SCENARIO_NAME: delegated 2026-06-02 13:02:16.787682 | ubuntu-noble | MOLECULE_STATE_FILE: /home/zuul/.ansible/tmp/molecule.oWZD.delegated/state.yml 2026-06-02 13:02:16.787688 | ubuntu-noble | MOLECULE_VERIFIER_NAME: testinfra 2026-06-02 13:02:16.787694 | ubuntu-noble | MOLECULE_VERIFIER_TEST_DIRECTORY: /home/zuul/src/github.com/osism/ansible-collection-services/molecule/delegated/tests 2026-06-02 13:02:16.787700 | ubuntu-noble | 2026-06-02 13:02:16.787943 | ubuntu-noble | DEBUG SHELL REPLAY: ANSIBLE_COLLECTIONS_PATH=/home/zuul/venv/.ansible/collections:/home/zuul/.ansible/collections ANSIBLE_CONFIG=/home/zuul/.ansible/tmp/molecule.oWZD.delegated/ansible.cfg ANSIBLE_LIBRARY=../../plugins ANSIBLE_PYTHON_INTERPRETER=/home/zuul/venv/bin/python ANSIBLE_ROLE=auditd ANSIBLE_ROLES_PATH=../../roles ANSIBLE_VERBOSITY=1 MOLECULE_DEBUG=True MOLECULE_DEPENDENCY_NAME=galaxy MOLECULE_DRIVER_NAME=default MOLECULE_ENV_FILE=/home/zuul/src/github.com/osism/ansible-collection-services/.env.yml MOLECULE_EPHEMERAL_DIRECTORY=/home/zuul/.ansible/tmp/molecule.oWZD.delegated MOLECULE_FILE=/home/zuul/.ansible/tmp/molecule.oWZD.delegated/molecule.yml MOLECULE_INSTANCE_CONFIG=/home/zuul/.ansible/tmp/molecule.oWZD.delegated/instance_config.yml MOLECULE_INVENTORY_FILE=/home/zuul/.ansible/tmp/molecule.oWZD.delegated/inventory/ansible_inventory.yml MOLECULE_PROJECT_DIRECTORY=/home/zuul/src/github.com/osism/ansible-collection-services MOLECULE_PROVISIONER_NAME=ansible MOLECULE_SCENARIO_DIRECTORY=/home/zuul/src/github.com/osism/ansible-collection-services/molecule/delegated MOLECULE_SCENARIO_NAME=delegated MOLECULE_STATE_FILE=/home/zuul/.ansible/tmp/molecule.oWZD.delegated/state.yml MOLECULE_VERIFIER_NAME=testinfra MOLECULE_VERIFIER_TEST_DIRECTORY=/home/zuul/src/github.com/osism/ansible-collection-services/molecule/delegated/tests 2026-06-02 13:02:17.058791 | ubuntu-noble | writing pytest debug information to pytestdebug.log 2026-06-02 13:02:17.074675 | ubuntu-noble | ============================= test session starts ============================== 2026-06-02 13:02:17.076905 | ubuntu-noble | platform linux -- Python 3.12.3, pytest-8.4.2, pluggy-1.6.0 -- /home/zuul/venv/bin/python3 2026-06-02 13:02:17.076959 | ubuntu-noble | using: pytest-8.4.2 2026-06-02 13:02:17.076976 | ubuntu-noble | registered third-party plugins: 2026-06-02 13:02:17.076989 | ubuntu-noble | pytest-testinfra-10.2.2 at /home/zuul/venv/lib/python3.12/site-packages/testinfra/plugin.py 2026-06-02 13:02:17.077452 | ubuntu-noble | rootdir: /home/zuul 2026-06-02 13:02:17.077936 | ubuntu-noble | plugins: testinfra-10.2.2 2026-06-02 13:02:17.219926 | debian-bookworm | collecting ... collected 6 items 2026-06-02 13:02:17.220353 | debian-bookworm | 2026-06-02 13:02:18.147414 | ubuntu-noble | collecting ... collected 6 items 2026-06-02 13:02:18.147941 | ubuntu-noble | 2026-06-02 13:02:21.078671 | debian-bookworm | tests/auditd.py::test_pkg[ansible://molecule-auditd] PASSED [ 16%] 2026-06-02 13:02:21.127810 | debian-bookworm | tests/auditd.py::test_conffile[ansible://molecule-auditd] PASSED [ 33%] 2026-06-02 13:02:22.731076 | ubuntu-noble | tests/auditd.py::test_pkg[ansible://molecule-auditd] PASSED [ 16%] 2026-06-02 13:02:22.784293 | ubuntu-noble | tests/auditd.py::test_conffile[ansible://molecule-auditd] PASSED [ 33%] 2026-06-02 13:02:23.276576 | debian-bookworm | tests/auditd.py::test_adjustment[ansible://molecule-auditd] PASSED [ 50%] 2026-06-02 13:02:25.463961 | ubuntu-noble | tests/auditd.py::test_adjustment[ansible://molecule-auditd] PASSED [ 50%] 2026-06-02 13:02:27.560095 | debian-bookworm | tests/auditd.py::test_rulefiles[ansible://molecule-auditd] PASSED [ 66%] 2026-06-02 13:02:28.640739 | debian-bookworm | tests/auditd.py::test_srv[ansible://molecule-auditd] PASSED [ 83%] 2026-06-02 13:02:28.685139 | debian-bookworm | wrote pytest debug information to pytestdebug.log 2026-06-02 13:02:28.685569 | debian-bookworm | tests/auditd.py::test_function[ansible://molecule-auditd] PASSED [100%] 2026-06-02 13:02:28.685829 | debian-bookworm | 2026-06-02 13:02:28.686142 | debian-bookworm | ============================== 6 passed in 12.29s ============================== 2026-06-02 13:02:28.709243 | debian-bookworm | INFO [delegated > verify] Verifier completed successfully. 2026-06-02 13:02:28.709355 | debian-bookworm | INFO [delegated > verify] Executed: Successful 2026-06-02 13:02:28.709998 | debian-bookworm | INFO Molecule executed 1 scenario (1 successful) 2026-06-02 13:02:28.960634 | debian-bookworm | ok: Runtime: 0:00:14.578886 2026-06-02 13:02:30.835598 | ubuntu-noble | tests/auditd.py::test_rulefiles[ansible://molecule-auditd] PASSED [ 66%] 2026-06-02 13:02:32.370487 | ubuntu-noble | ok: Runtime: 0:00:18.064806 2026-06-02 13:02:32.380847 | 2026-06-02 13:02:32.381053 | TASK [ansible-molecule : Run molecule destroy action with scenario delegated] 2026-06-02 13:02:32.149433 | ubuntu-noble | tests/auditd.py::test_srv[ansible://molecule-auditd] PASSED [ 83%] 2026-06-02 13:02:32.225894 | ubuntu-noble | wrote pytest debug information to pytestdebug.log 2026-06-02 13:02:32.225942 | ubuntu-noble | tests/auditd.py::test_function[ansible://molecule-auditd] PASSED [100%] 2026-06-02 13:02:32.225955 | ubuntu-noble | 2026-06-02 13:02:32.227018 | ubuntu-noble | ============================== 6 passed in 15.11s ============================== 2026-06-02 13:02:32.274137 | ubuntu-noble | INFO [delegated > verify] Verifier completed successfully. 2026-06-02 13:02:32.274447 | ubuntu-noble | INFO [delegated > verify] Executed: Successful 2026-06-02 13:02:32.275407 | ubuntu-noble | INFO Molecule executed 1 scenario (1 successful) 2026-06-02 13:02:32.940749 | debian-bookworm | skipping: Conditional result was False 2026-06-02 13:02:32.941405 | ubuntu-noble | skipping: Conditional result was False 2026-06-02 13:02:32.955225 | 2026-06-02 13:02:32.955337 | PLAY RECAP 2026-06-02 13:02:32.955397 | debian-bookworm | ok: 17 changed: 12 unreachable: 0 failed: 0 skipped: 16 rescued: 0 ignored: 0 2026-06-02 13:02:32.955429 | ubuntu-noble | ok: 17 changed: 12 unreachable: 0 failed: 0 skipped: 16 rescued: 0 ignored: 0 2026-06-02 13:02:32.955464 | 2026-06-02 13:02:33.123261 | RUN END RESULT_NORMAL: [untrusted : github.com/osism/zuul-jobs/playbooks/ansible-molecule/run.yaml@main] 2026-06-02 13:02:33.125672 | POST-RUN START: [untrusted : github.com/osism/ansible-collection-services/playbooks/collect-container-logs.yml@main] 2026-06-02 13:02:33.968843 | 2026-06-02 13:02:33.969037 | PLAY [Collect container logs] 2026-06-02 13:02:33.984133 | 2026-06-02 13:02:33.984302 | TASK [Create container log directory] 2026-06-02 13:02:34.636376 | debian-bookworm | changed 2026-06-02 13:02:34.657613 | ubuntu-noble | changed 2026-06-02 13:02:34.665334 | 2026-06-02 13:02:34.665495 | TASK [Capture container overview] 2026-06-02 13:02:35.229234 | debian-bookworm | ok: Runtime: 0:00:00.010760 2026-06-02 13:02:35.241110 | ubuntu-noble | ok: Runtime: 0:00:00.011677 2026-06-02 13:02:35.250176 | 2026-06-02 13:02:35.250293 | TASK [List containers] 2026-06-02 13:02:35.826074 | debian-bookworm | ok: ERROR (ignored) 2026-06-02 13:02:35.826548 | debian-bookworm | { 2026-06-02 13:02:35.826623 | debian-bookworm | "failed_when_result": false, 2026-06-02 13:02:35.826695 | debian-bookworm | "msg": "[Errno 2] No such file or directory: b'docker'", 2026-06-02 13:02:35.826743 | debian-bookworm | "rc": 2 2026-06-02 13:02:35.826782 | debian-bookworm | } 2026-06-02 13:02:35.836914 | ubuntu-noble | ok: ERROR (ignored) 2026-06-02 13:02:35.837104 | ubuntu-noble | { 2026-06-02 13:02:35.837159 | ubuntu-noble | "failed_when_result": false, 2026-06-02 13:02:35.837197 | ubuntu-noble | "msg": "[Errno 2] No such file or directory: b'docker'", 2026-06-02 13:02:35.837231 | ubuntu-noble | "rc": 2 2026-06-02 13:02:35.837262 | ubuntu-noble | } 2026-06-02 13:02:35.845374 | 2026-06-02 13:02:35.845498 | LOOP [Save per-container logs] 2026-06-02 13:02:35.919610 | 2026-06-02 13:02:35.919844 | LOOP [Save per-container inspect (state and health)] 2026-06-02 13:02:35.980042 | 2026-06-02 13:02:35.980249 | TASK [Capture netbox systemd unit journal] 2026-06-02 13:02:36.557007 | debian-bookworm | ok: Runtime: 0:00:00.015315 2026-06-02 13:02:36.568489 | ubuntu-noble | ok: Runtime: 0:00:00.016391 2026-06-02 13:02:36.575923 | 2026-06-02 13:02:36.576049 | TASK [Capture netbox service state] 2026-06-02 13:02:37.178236 | debian-bookworm | ok: Runtime: 0:00:00.028113 2026-06-02 13:02:37.193713 | ubuntu-noble | ok: Runtime: 0:00:00.030184 2026-06-02 13:02:37.205744 | 2026-06-02 13:02:37.205912 | TASK [Capture docker compose version] 2026-06-02 13:02:37.770818 | debian-bookworm | ok: Runtime: 0:00:00.010721 2026-06-02 13:02:37.783418 | ubuntu-noble | ok: Runtime: 0:00:00.007850 2026-06-02 13:02:37.791205 | 2026-06-02 13:02:37.791336 | TASK [Open container log permissions] 2026-06-02 13:02:38.088534 | debian-bookworm | changed 2026-06-02 13:02:38.151595 | ubuntu-noble | changed 2026-06-02 13:02:38.153698 | 2026-06-02 13:02:38.153799 | PLAY RECAP 2026-06-02 13:02:38.153860 | debian-bookworm | ok: 7 changed: 2 unreachable: 0 failed: 0 skipped: 2 rescued: 0 ignored: 0 2026-06-02 13:02:38.153897 | ubuntu-noble | ok: 7 changed: 2 unreachable: 0 failed: 0 skipped: 2 rescued: 0 ignored: 0 2026-06-02 13:02:38.153922 | 2026-06-02 13:02:38.300901 | POST-RUN END RESULT_NORMAL: [untrusted : github.com/osism/ansible-collection-services/playbooks/collect-container-logs.yml@main] 2026-06-02 13:02:38.302320 | POST-RUN START: [trusted : github.com/osism/zuul-config/playbooks/base/post-fetch.yaml@main] 2026-06-02 13:02:39.106681 | 2026-06-02 13:02:39.106911 | PLAY [Base post-fetch] 2026-06-02 13:02:39.122827 | 2026-06-02 13:02:39.123032 | TASK [fetch-output : Set log path for multiple nodes] 2026-06-02 13:02:39.201167 | debian-bookworm | ok 2026-06-02 13:02:39.208524 | ubuntu-noble | ok 2026-06-02 13:02:39.214908 | 2026-06-02 13:02:39.215056 | TASK [fetch-output : Set log path for single node] 2026-06-02 13:02:39.241401 | debian-bookworm | skipping: Conditional result was False 2026-06-02 13:02:39.263330 | ubuntu-noble | skipping: Conditional result was False 2026-06-02 13:02:39.276436 | 2026-06-02 13:02:39.276613 | LOOP [fetch-output : Ensure local output dirs] 2026-06-02 13:02:39.793538 | debian-bookworm -> localhost | changed: "/var/lib/zuul/builds/bafe5455e936492ebabe791aa3467240/work/logs/debian-bookworm" 2026-06-02 13:02:39.841794 | ubuntu-noble -> localhost | changed: "/var/lib/zuul/builds/bafe5455e936492ebabe791aa3467240/work/logs/ubuntu-noble" 2026-06-02 13:02:40.059409 | debian-bookworm -> localhost | changed: "/var/lib/zuul/builds/bafe5455e936492ebabe791aa3467240/work/artifacts" 2026-06-02 13:02:40.149470 | ubuntu-noble -> localhost | ok: "/var/lib/zuul/builds/bafe5455e936492ebabe791aa3467240/work/artifacts" 2026-06-02 13:02:40.331168 | debian-bookworm -> localhost | changed: "/var/lib/zuul/builds/bafe5455e936492ebabe791aa3467240/work/docs" 2026-06-02 13:02:40.418557 | ubuntu-noble -> localhost | ok: "/var/lib/zuul/builds/bafe5455e936492ebabe791aa3467240/work/docs" 2026-06-02 13:02:40.418911 | ubuntu-noble -> localhost | changed: All items complete 2026-06-02 13:02:40.419038 | 2026-06-02 13:02:40.434124 | 2026-06-02 13:02:40.434305 | LOOP [fetch-output : Collect logs, artifacts and docs] 2026-06-02 13:02:41.229152 | debian-bookworm | changed: 2026-06-02 13:02:41.229577 | debian-bookworm | .d..t...... ./ 2026-06-02 13:02:41.229698 | debian-bookworm | >f+++++++++ sudo-debug.txt 2026-06-02 13:02:41.229746 | debian-bookworm | >f+++++++++ sudo-strace.log 2026-06-02 13:02:41.229785 | debian-bookworm | >f+++++++++ sudo-strace.log.time 2026-06-02 13:02:41.229821 | debian-bookworm | cd+++++++++ container-logs/ 2026-06-02 13:02:41.229857 | debian-bookworm | >f+++++++++ container-logs/_compose-version.txt 2026-06-02 13:02:41.229894 | debian-bookworm | >f+++++++++ container-logs/_overview.txt 2026-06-02 13:02:41.229929 | debian-bookworm | >f+++++++++ container-logs/netbox.service.journal.txt 2026-06-02 13:02:41.229961 | debian-bookworm | >f+++++++++ container-logs/netbox.service.status.txt 2026-06-02 13:02:41.239516 | ubuntu-noble | changed: 2026-06-02 13:02:41.239755 | ubuntu-noble | .d..t...... ./ 2026-06-02 13:02:41.239811 | ubuntu-noble | >f+++++++++ sudo-debug.txt 2026-06-02 13:02:41.239854 | ubuntu-noble | >f+++++++++ sudo-strace.log 2026-06-02 13:02:41.239892 | ubuntu-noble | >f+++++++++ sudo-strace.log.time 2026-06-02 13:02:41.239931 | ubuntu-noble | cd+++++++++ container-logs/ 2026-06-02 13:02:41.239964 | ubuntu-noble | >f+++++++++ container-logs/_compose-version.txt 2026-06-02 13:02:41.239998 | ubuntu-noble | >f+++++++++ container-logs/_overview.txt 2026-06-02 13:02:41.240033 | ubuntu-noble | >f+++++++++ container-logs/netbox.service.journal.txt 2026-06-02 13:02:41.240066 | ubuntu-noble | >f+++++++++ container-logs/netbox.service.status.txt 2026-06-02 13:02:41.844683 | debian-bookworm | changed: .d..t...... ./ 2026-06-02 13:02:41.883730 | ubuntu-noble | ok 2026-06-02 13:02:42.442103 | debian-bookworm | changed: .d..t...... ./ 2026-06-02 13:02:42.475584 | ubuntu-noble | ok 2026-06-02 13:02:42.475735 | ubuntu-noble | changed: All items complete 2026-06-02 13:02:42.475765 | 2026-06-02 13:02:42.495248 | 2026-06-02 13:02:42.495375 | LOOP [merge-output-to-logs : Move artifacts and docs to logs dir] 2026-06-02 13:02:43.040470 | debian-bookworm -> localhost | ok: Item: artifacts Runtime: 0:00:00.010490 2026-06-02 13:02:43.325746 | debian-bookworm -> localhost | ok: Item: docs Runtime: 0:00:00.014820 2026-06-02 13:02:43.350696 | 2026-06-02 13:02:43.350827 | PLAY RECAP 2026-06-02 13:02:43.350913 | debian-bookworm | ok: 4 changed: 3 unreachable: 0 failed: 0 skipped: 1 rescued: 0 ignored: 0 2026-06-02 13:02:43.350955 | ubuntu-noble | ok: 3 changed: 2 unreachable: 0 failed: 0 skipped: 1 rescued: 0 ignored: 0 2026-06-02 13:02:43.350983 | 2026-06-02 13:02:43.495320 | POST-RUN END RESULT_NORMAL: [trusted : github.com/osism/zuul-config/playbooks/base/post-fetch.yaml@main] 2026-06-02 13:02:43.497071 | POST-RUN START: [trusted : github.com/osism/zuul-config/playbooks/base/post.yaml@main] 2026-06-02 13:02:44.282298 | 2026-06-02 13:02:44.282466 | PLAY [Base post] 2026-06-02 13:02:44.296156 | 2026-06-02 13:02:44.296315 | TASK [remove-build-sshkey : Remove the build SSH key from all nodes] 2026-06-02 13:02:45.127807 | debian-bookworm | changed 2026-06-02 13:02:45.183485 | ubuntu-noble | changed 2026-06-02 13:02:45.198657 | 2026-06-02 13:02:45.198796 | PLAY RECAP 2026-06-02 13:02:45.198931 | debian-bookworm | ok: 1 changed: 1 unreachable: 0 failed: 0 skipped: 0 rescued: 0 ignored: 0 2026-06-02 13:02:45.198974 | ubuntu-noble | ok: 1 changed: 1 unreachable: 0 failed: 0 skipped: 0 rescued: 0 ignored: 0 2026-06-02 13:02:45.199001 | 2026-06-02 13:02:45.331042 | POST-RUN END RESULT_NORMAL: [trusted : github.com/osism/zuul-config/playbooks/base/post.yaml@main] 2026-06-02 13:02:45.332451 | POST-RUN START: [trusted : github.com/osism/zuul-config/playbooks/base/post-logs.yaml@main] 2026-06-02 13:02:46.194684 | 2026-06-02 13:02:46.194971 | PLAY [Base post-logs] 2026-06-02 13:02:46.207567 | 2026-06-02 13:02:46.207738 | TASK [generate-zuul-manifest : Generate Zuul manifest] 2026-06-02 13:02:46.706286 | localhost | changed 2026-06-02 13:02:46.726746 | 2026-06-02 13:02:46.727185 | TASK [generate-zuul-manifest : Return Zuul manifest URL to Zuul] 2026-06-02 13:02:46.756054 | localhost | ok 2026-06-02 13:02:46.764583 | 2026-06-02 13:02:46.764784 | TASK [Set zuul-log-path fact] 2026-06-02 13:02:46.784921 | localhost | ok 2026-06-02 13:02:46.801691 | 2026-06-02 13:02:46.801843 | TASK [set-zuul-log-path-fact : Set log path for a build] 2026-06-02 13:02:46.830678 | localhost | ok 2026-06-02 13:02:46.837481 | 2026-06-02 13:02:46.837730 | TASK [upload-logs : Create log directories] 2026-06-02 13:02:47.339674 | localhost | changed 2026-06-02 13:02:47.345539 | 2026-06-02 13:02:47.345735 | TASK [upload-logs : Ensure logs are readable before uploading] 2026-06-02 13:02:47.883059 | localhost -> localhost | ok: Runtime: 0:00:00.007769 2026-06-02 13:02:47.892593 | 2026-06-02 13:02:47.892815 | TASK [upload-logs : Upload logs to log server] 2026-06-02 13:02:48.489527 | localhost | Output suppressed because no_log was given 2026-06-02 13:02:48.491743 | 2026-06-02 13:02:48.492204 | LOOP [upload-logs : Compress console log and json output] 2026-06-02 13:02:48.544651 | localhost | skipping: Conditional result was False 2026-06-02 13:02:48.550421 | localhost | skipping: Conditional result was False 2026-06-02 13:02:48.561273 | 2026-06-02 13:02:48.561455 | LOOP [upload-logs : Upload compressed console log and json output] 2026-06-02 13:02:48.609324 | localhost | skipping: Conditional result was False 2026-06-02 13:02:48.609985 | 2026-06-02 13:02:48.613514 | localhost | skipping: Conditional result was False 2026-06-02 13:02:48.627471 | 2026-06-02 13:02:48.627762 | LOOP [upload-logs : Upload console log and json output]