2026-07-20 09:51:15.148290 | Job console starting 2026-07-20 09:51:15.171727 | Updating git repos 2026-07-20 09:51:15.218516 | Cloning repos into workspace 2026-07-20 09:51:15.298365 | Restoring repo states 2026-07-20 09:51:15.323638 | Merging changes 2026-07-20 09:51:16.244675 | Checking out repos 2026-07-20 09:51:16.295911 | Preparing playbooks 2026-07-20 09:51:17.107450 | Running Ansible setup 2026-07-20 09:51:23.887693 | PRE-RUN START: [trusted : github.com/osism/zuul-config/playbooks/base/pre.yaml@main] 2026-07-20 09:51:24.801030 | 2026-07-20 09:51:24.801214 | PLAY [Base pre] 2026-07-20 09:51:24.820393 | 2026-07-20 09:51:24.820524 | TASK [Setup log path fact] 2026-07-20 09:51:24.852101 | debian-bookworm | ok 2026-07-20 09:51:24.868335 | 2026-07-20 09:51:24.868483 | TASK [set-zuul-log-path-fact : Set log path for a build] 2026-07-20 09:51:24.910532 | debian-bookworm | ok 2026-07-20 09:51:24.923592 | 2026-07-20 09:51:24.923770 | TASK [emit-job-header : Print job information] 2026-07-20 09:51:24.965423 | # Job Information 2026-07-20 09:51:24.965657 | Ansible Version: 2.16.14 2026-07-20 09:51:24.965695 | Job: ansible-collection-services-molecule-auditd 2026-07-20 09:51:24.965729 | Pipeline: check 2026-07-20 09:51:24.965753 | Executor: 521e9411259a 2026-07-20 09:51:24.965775 | Triggered by: https://github.com/osism/ansible-collection-services/pull/2145 2026-07-20 09:51:24.965798 | Event ID: 9f86ddd0-841d-11f1-95fe-15856f1ae0ba 2026-07-20 09:51:24.971201 | 2026-07-20 09:51:24.971325 | LOOP [emit-job-header : Print node information] 2026-07-20 09:51:25.086321 | debian-bookworm | ok: 2026-07-20 09:51:25.086779 | debian-bookworm | # Node Information 2026-07-20 09:51:25.086874 | debian-bookworm | Inventory Hostname: debian-bookworm 2026-07-20 09:51:25.086919 | debian-bookworm | Hostname: debian 2026-07-20 09:51:25.086955 | debian-bookworm | Username: zuul 2026-07-20 09:51:25.086989 | debian-bookworm | Distro: Debian 12.15 2026-07-20 09:51:25.087028 | debian-bookworm | Provider: regiocloud-a 2026-07-20 09:51:25.087064 | debian-bookworm | Region: 2026-07-20 09:51:25.087099 | debian-bookworm | Label: debian-bookworm 2026-07-20 09:51:25.087133 | debian-bookworm | Product Name: OpenStack Nova 2026-07-20 09:51:25.087166 | debian-bookworm | Interface IP: 2a13:1a81:8000:3124:f816:3eff:fee5:2c70 2026-07-20 09:51:25.135686 | debian-bookworm | ok: 2026-07-20 09:51:25.135898 | debian-bookworm | # Node Information 2026-07-20 09:51:25.135965 | debian-bookworm | Inventory Hostname: ubuntu-noble 2026-07-20 09:51:25.136017 | debian-bookworm | Hostname: ubuntu 2026-07-20 09:51:25.136070 | debian-bookworm | Username: zuul 2026-07-20 09:51:25.136110 | debian-bookworm | Distro: Ubuntu 24.04 2026-07-20 09:51:25.136144 | debian-bookworm | Provider: regiocloud-a 2026-07-20 09:51:25.136180 | debian-bookworm | Region: 2026-07-20 09:51:25.136214 | debian-bookworm | Label: ubuntu-noble 2026-07-20 09:51:25.136249 | debian-bookworm | Product Name: OpenStack Nova 2026-07-20 09:51:25.136282 | debian-bookworm | Interface IP: 2a13:1a81:8000:3124:f816:3eff:fec0:c632 2026-07-20 09:51:25.170232 | 2026-07-20 09:51:25.170445 | TASK [log-inventory : Ensure Zuul Ansible directory exists] 2026-07-20 09:51:25.712106 | debian-bookworm -> localhost | changed 2026-07-20 09:51:25.730368 | 2026-07-20 09:51:25.730531 | TASK [log-inventory : Copy ansible inventory to logs dir] 2026-07-20 09:51:27.252243 | ubuntu-noble -> localhost | changed 2026-07-20 09:51:27.385319 | debian-bookworm -> localhost | ok 2026-07-20 09:51:27.409556 | 2026-07-20 09:51:27.409734 | TASK [add-build-sshkey : Check to see if ssh key was already created for this build] 2026-07-20 09:51:27.828831 | debian-bookworm -> localhost | ok 2026-07-20 09:51:27.838028 | 2026-07-20 09:51:27.838348 | TASK [add-build-sshkey : Create a new key in workspace based on build UUID] 2026-07-20 09:51:27.879250 | debian-bookworm | ok 2026-07-20 09:51:27.885363 | ubuntu-noble | ok 2026-07-20 09:51:27.909303 | debian-bookworm | included: /var/lib/zuul/builds/b862409980db4f3f8cced97a2b0fd663/trusted/project_1/github.com/osism/openinfra-zuul-jobs/roles/add-build-sshkey/tasks/create-key-and-replace.yaml 2026-07-20 09:51:27.909420 | ubuntu-noble | included: /var/lib/zuul/builds/b862409980db4f3f8cced97a2b0fd663/trusted/project_1/github.com/osism/openinfra-zuul-jobs/roles/add-build-sshkey/tasks/create-key-and-replace.yaml 2026-07-20 09:51:27.918119 | 2026-07-20 09:51:27.918227 | TASK [add-build-sshkey : Create Temp SSH key] 2026-07-20 09:51:30.099220 | debian-bookworm -> localhost | Generating public/private rsa key pair. 2026-07-20 09:51:30.099486 | debian-bookworm -> localhost | Your identification has been saved in /var/lib/zuul/builds/b862409980db4f3f8cced97a2b0fd663/work/b862409980db4f3f8cced97a2b0fd663_id_rsa 2026-07-20 09:51:30.099523 | debian-bookworm -> localhost | Your public key has been saved in /var/lib/zuul/builds/b862409980db4f3f8cced97a2b0fd663/work/b862409980db4f3f8cced97a2b0fd663_id_rsa.pub 2026-07-20 09:51:30.099551 | debian-bookworm -> localhost | The key fingerprint is: 2026-07-20 09:51:30.099623 | debian-bookworm -> localhost | SHA256:lu0jQFA33Eyw77BgZHUz2HmDWBsqum+bG3oeDD+/NTY zuul-build-sshkey 2026-07-20 09:51:30.099649 | debian-bookworm -> localhost | The key's randomart image is: 2026-07-20 09:51:30.099676 | debian-bookworm -> localhost | +---[RSA 3072]----+ 2026-07-20 09:51:30.099699 | debian-bookworm -> localhost | | ....=XBo | 2026-07-20 09:51:30.099722 | debian-bookworm -> localhost | | . o+=*=o | 2026-07-20 09:51:30.099743 | debian-bookworm -> localhost | | = o .. . | 2026-07-20 09:51:30.099764 | debian-bookworm -> localhost | | = . + | 2026-07-20 09:51:30.099784 | debian-bookworm -> localhost | | o + S o | 2026-07-20 09:51:30.099804 | debian-bookworm -> localhost | | * + = | 2026-07-20 09:51:30.099824 | debian-bookworm -> localhost | | . * o E | 2026-07-20 09:51:30.099844 | debian-bookworm -> localhost | | oo* + + | 2026-07-20 09:51:30.099863 | debian-bookworm -> localhost | | .+*oo. | 2026-07-20 09:51:30.099883 | debian-bookworm -> localhost | +----[SHA256]-----+ 2026-07-20 09:51:30.099940 | debian-bookworm -> localhost | ok: Runtime: 0:00:01.339013 2026-07-20 09:51:30.106955 | 2026-07-20 09:51:30.107072 | TASK [add-build-sshkey : Remote setup ssh keys (linux)] 2026-07-20 09:51:30.140856 | debian-bookworm | ok 2026-07-20 09:51:30.145712 | ubuntu-noble | ok 2026-07-20 09:51:30.160080 | debian-bookworm | included: /var/lib/zuul/builds/b862409980db4f3f8cced97a2b0fd663/trusted/project_1/github.com/osism/openinfra-zuul-jobs/roles/add-build-sshkey/tasks/remote-linux.yaml 2026-07-20 09:51:30.160181 | ubuntu-noble | included: /var/lib/zuul/builds/b862409980db4f3f8cced97a2b0fd663/trusted/project_1/github.com/osism/openinfra-zuul-jobs/roles/add-build-sshkey/tasks/remote-linux.yaml 2026-07-20 09:51:30.171837 | 2026-07-20 09:51:30.171951 | TASK [add-build-sshkey : Remove previously added zuul-build-sshkey] 2026-07-20 09:51:30.199423 | debian-bookworm | skipping: Conditional result was False 2026-07-20 09:51:30.210518 | ubuntu-noble | skipping: Conditional result was False 2026-07-20 09:51:30.218096 | 2026-07-20 09:51:30.218223 | TASK [add-build-sshkey : Enable access via build key on all nodes] 2026-07-20 09:51:30.936439 | debian-bookworm | changed 2026-07-20 09:51:31.016187 | ubuntu-noble | changed 2026-07-20 09:51:31.026635 | 2026-07-20 09:51:31.026859 | TASK [add-build-sshkey : Make sure user has a .ssh] 2026-07-20 09:51:31.305121 | debian-bookworm | ok 2026-07-20 09:51:31.345146 | ubuntu-noble | ok 2026-07-20 09:51:31.353928 | 2026-07-20 09:51:31.354067 | TASK [add-build-sshkey : Install build private key as SSH key on all nodes] 2026-07-20 09:51:32.065735 | debian-bookworm | changed 2026-07-20 09:51:32.099840 | ubuntu-noble | changed 2026-07-20 09:51:32.109896 | 2026-07-20 09:51:32.110059 | TASK [add-build-sshkey : Install build public key as SSH key on all nodes] 2026-07-20 09:51:32.833746 | debian-bookworm | changed 2026-07-20 09:51:32.838679 | ubuntu-noble | changed 2026-07-20 09:51:32.843902 | 2026-07-20 09:51:32.844003 | TASK [add-build-sshkey : Remote setup ssh keys (windows)] 2026-07-20 09:51:32.870214 | debian-bookworm | skipping: Conditional result was False 2026-07-20 09:51:32.881347 | ubuntu-noble | skipping: Conditional result was False 2026-07-20 09:51:32.887698 | 2026-07-20 09:51:32.887811 | TASK [remove-zuul-sshkey : Remove master key from local agent] 2026-07-20 09:51:33.299898 | debian-bookworm -> localhost | changed 2026-07-20 09:51:33.318152 | 2026-07-20 09:51:33.318284 | TASK [add-build-sshkey : Add back temp key] 2026-07-20 09:51:33.681375 | debian-bookworm -> localhost | Identity added: /var/lib/zuul/builds/b862409980db4f3f8cced97a2b0fd663/work/b862409980db4f3f8cced97a2b0fd663_id_rsa (zuul-build-sshkey) 2026-07-20 09:51:33.682121 | debian-bookworm -> localhost | ok: Runtime: 0:00:00.021421 2026-07-20 09:51:33.696518 | 2026-07-20 09:51:33.696714 | TASK [add-build-sshkey : Verify we can still SSH to all nodes] 2026-07-20 09:51:34.076502 | debian-bookworm | ok 2026-07-20 09:51:34.081226 | ubuntu-noble | ok 2026-07-20 09:51:34.086555 | 2026-07-20 09:51:34.086668 | TASK [add-build-sshkey : Verify we can still SSH to all nodes (windows)] 2026-07-20 09:51:34.112891 | debian-bookworm | skipping: Conditional result was False 2026-07-20 09:51:34.124019 | ubuntu-noble | skipping: Conditional result was False 2026-07-20 09:51:34.142451 | 2026-07-20 09:51:34.142621 | TASK [start-zuul-console : Start zuul_console daemon.] 2026-07-20 09:51:34.549402 | debian-bookworm | ok 2026-07-20 09:51:34.558289 | ubuntu-noble | ok 2026-07-20 09:51:34.574738 | 2026-07-20 09:51:34.574904 | TASK [validate-host : Define zuul_info_dir fact] 2026-07-20 09:51:34.617248 | debian-bookworm | ok 2026-07-20 09:51:34.643127 | ubuntu-noble | ok 2026-07-20 09:51:34.648796 | 2026-07-20 09:51:34.648914 | TASK [validate-host : Ensure Zuul Ansible directory exists] 2026-07-20 09:51:35.035381 | debian-bookworm -> localhost | ok 2026-07-20 09:51:35.042539 | 2026-07-20 09:51:35.042673 | TASK [validate-host : Collect information about the host] 2026-07-20 09:51:36.196978 | debian-bookworm | ok 2026-07-20 09:51:36.271736 | ubuntu-noble | ok 2026-07-20 09:51:36.288950 | 2026-07-20 09:51:36.289100 | TASK [validate-host : Sanitize hostname] 2026-07-20 09:51:36.445277 | debian-bookworm | ok 2026-07-20 09:51:36.481818 | ubuntu-noble | ok 2026-07-20 09:51:36.487784 | 2026-07-20 09:51:36.487906 | TASK [validate-host : Write out all ansible variables/facts known for each host] 2026-07-20 09:51:37.368319 | debian-bookworm -> localhost | changed 2026-07-20 09:51:37.451279 | ubuntu-noble -> localhost | changed 2026-07-20 09:51:37.461158 | 2026-07-20 09:51:37.461397 | TASK [validate-host : Collect information about zuul worker] 2026-07-20 09:51:38.044219 | debian-bookworm | ok 2026-07-20 09:51:38.089785 | ubuntu-noble | ok 2026-07-20 09:51:38.103939 | 2026-07-20 09:51:38.104389 | TASK [validate-host : Write out all zuul information for each host] 2026-07-20 09:51:38.770904 | debian-bookworm -> localhost | changed 2026-07-20 09:51:38.772181 | ubuntu-noble -> localhost | changed 2026-07-20 09:51:38.789500 | 2026-07-20 09:51:38.789688 | TASK [prepare-workspace-log : Start zuul_console daemon.] 2026-07-20 09:51:39.051074 | debian-bookworm | ok 2026-07-20 09:51:39.141841 | ubuntu-noble | ok 2026-07-20 09:51:39.147967 | 2026-07-20 09:51:39.148089 | TASK [prepare-workspace-log : Synchronize src repos to workspace directory.] 2026-07-20 09:51:40.340114 | debian-bookworm | changed: 2026-07-20 09:51:40.340520 | debian-bookworm | cd+++++++++ src/ 2026-07-20 09:51:40.340593 | debian-bookworm | cd+++++++++ src/github.com/ 2026-07-20 09:51:40.340629 | debian-bookworm | cd+++++++++ src/github.com/osism/ 2026-07-20 09:51:40.340660 | debian-bookworm | cd+++++++++ src/github.com/osism/ansible-collection-services/ 2026-07-20 09:51:40.340690 | debian-bookworm | config] provisioner.env found in /home/zuul/src/github.com/osism/ansible-collection-services/molecule/delegated/molecule.yml, this can be defined in ansible.env 2026-07-20 09:53:13.114176 | debian-bookworm | WARNING Molecule scenarios should migrate to 'extensions/molecule' 2026-07-20 09:53:13.138802 | debian-bookworm | DEBUG [unknown > config] provisioner.env found in /home/zuul/src/github.com/osism/ansible-collection-services/molecule/delegated/molecule.yml, this can be defined in ansible.env 2026-07-20 09:53:14.055856 | ubuntu-noble | DEBUG [unknown > config] provisioner.env found in /home/zuul/src/github.com/osism/ansible-collection-services/molecule/delegated/molecule.yml, this can be defined in ansible.env 2026-07-20 09:53:14.056457 | ubuntu-noble | DEBUG [delegated > validate] Validating schema /home/zuul/src/github.com/osism/ansible-collection-services/molecule/delegated/molecule.yml. 2026-07-20 09:53:14.080747 | ubuntu-noble | DEBUG [default > validate] Validating schema /home/zuul/src/github.com/osism/ansible-collection-services/molecule/default/molecule.yml. 2026-07-20 09:53:14.086690 | ubuntu-noble | INFO [delegated > discovery] scenario test matrix: dependency 2026-07-20 09:53:14.086757 | ubuntu-noble | INFO [delegated > prerun] Performing prerun with role_name_check=0... 2026-07-20 09:53:13.752552 | debian-bookworm | DEBUG [unknown > config] provisioner.env found in /home/zuul/src/github.com/osism/ansible-collection-services/molecule/delegated/molecule.yml, this can be defined in ansible.env 2026-07-20 09:53:13.753137 | debian-bookworm | DEBUG [delegated > validate] Validating schema /home/zuul/src/github.com/osism/ansible-collection-services/molecule/delegated/molecule.yml. 2026-07-20 09:53:13.771860 | debian-bookworm | DEBUG [default > validate] Validating schema /home/zuul/src/github.com/osism/ansible-collection-services/molecule/default/molecule.yml. 2026-07-20 09:53:13.777138 | debian-bookworm | INFO [delegated > discovery] scenario test matrix: dependency 2026-07-20 09:53:13.777242 | debian-bookworm | INFO [delegated > prerun] Performing prerun with role_name_check=0... 2026-07-20 09:53:14.947786 | debian-bookworm | INFO [delegated > dependency] Executing 2026-07-20 09:53:14.948184 | debian-bookworm | WARNING [delegated > dependency] Missing roles requirements file: requirements.yml 2026-07-20 09:53:15.348161 | debian-bookworm | ansible-galaxy [core 2.19.11] 2026-07-20 09:53:15.348613 | debian-bookworm | config file = None 2026-07-20 09:53:15.349033 | debian-bookworm | configured module search path = ['/home/zuul/src/github.com/osism/ansible-collection-services/plugins/modules', '/home/zuul/.ansible/plugins/modules', '/usr/share/ansible/plugins/modules'] 2026-07-20 09:53:15.349514 | debian-bookworm | ansible python module location = /home/zuul/venv/lib/python3.11/site-packages/ansible 2026-07-20 09:53:15.349922 | debian-bookworm | ansible collection location = /home/zuul/.ansible/collections:/usr/share/ansible/collections:/home/zuul/venv/lib/python3.11/site-packages:/home/zuul/venv/lib/python3.11/dist-packages:/home/zuul/venv/lib/python3/dist-packages:/home/zuul/venv/local/lib/python3.11/dist-packages 2026-07-20 09:53:15.350293 | debian-bookworm | executable location = /home/zuul/venv/bin/ansible-galaxy 2026-07-20 09:53:15.350658 | debian-bookworm | python version = 3.11.2 (main, May 12 2026, 05:17:27) [GCC 12.2.0] (/home/zuul/venv/bin/python3) 2026-07-20 09:53:15.351013 | debian-bookworm | jinja version = 3.1.6 2026-07-20 09:53:15.351398 | debian-bookworm | pyyaml version = 6.0.3 (with libyaml v0.2.5) 2026-07-20 09:53:15.351696 | debian-bookworm | No config file found; using defaults 2026-07-20 09:53:15.352169 | debian-bookworm | Reading requirement file at '/home/zuul/src/github.com/osism/ansible-collection-services/molecule/delegated/collections.yml' 2026-07-20 09:53:15.353424 | debian-bookworm | Loading collection community.sap_libs from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/sap_libs 2026-07-20 09:53:15.353824 | debian-bookworm | Found installed collection community.sap_libs:1.5.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/sap_libs' 2026-07-20 09:53:15.354236 | debian-bookworm | Loading collection infinidat.infinibox from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/infinidat/infinibox 2026-07-20 09:53:15.354597 | debian-bookworm | Found installed collection infinidat.infinibox:1.6.3 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/infinidat/infinibox' 2026-07-20 09:53:15.354994 | debian-bookworm | Loading collection purestorage.flasharray from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/purestorage/flasharray 2026-07-20 09:53:15.355339 | debian-bookworm | Found installed collection purestorage.flasharray:1.40.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/purestorage/flasharray' 2026-07-20 09:53:15.357231 | debian-bookworm | Loading collection theforeman.foreman from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/theforeman/foreman 2026-07-20 09:53:15.357593 | debian-bookworm | Found installed collection theforeman.foreman:5.7.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/theforeman/foreman' 2026-07-20 09:53:15.358031 | debian-bookworm | Loading collection telekom_mms.icinga_director from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/telekom_mms/icinga_director 2026-07-20 09:53:15.358410 | debian-bookworm | Found installed collection telekom_mms.icinga_director:2.5.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/telekom_mms/icinga_director' 2026-07-20 09:53:15.358750 | debian-bookworm | Loading collection chocolatey.chocolatey from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/chocolatey/chocolatey 2026-07-20 09:53:15.359086 | debian-bookworm | Found installed collection chocolatey.chocolatey:1.5.3 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/chocolatey/chocolatey' 2026-07-20 09:53:15.359552 | debian-bookworm | Loading collection kubernetes.core from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/kubernetes/core 2026-07-20 09:53:15.359879 | debian-bookworm | Found installed collection kubernetes.core:6.2.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/kubernetes/core' 2026-07-20 09:53:15.360237 | debian-bookworm | Loading collection ravendb.ravendb from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/ravendb/ravendb 2026-07-20 09:53:15.360566 | debian-bookworm | Found installed collection ravendb.ravendb:1.0.4 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/ravendb/ravendb' 2026-07-20 09:53:15.360903 | debian-bookworm | Loading collection vmware.vmware from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/vmware/vmware 2026-07-20 09:53:15.361253 | debian-bookworm | Found installed collection vmware.vmware:2.6.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/vmware/vmware' 2026-07-20 09:53:15.361714 | debian-bookworm | Loading collection arista.eos from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/arista/eos 2026-07-20 09:53:15.361994 | debian-bookworm | Found installed collection arista.eos:12.0.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/arista/eos' 2026-07-20 09:53:15.362279 | debian-bookworm | Loading collection community.proxysql from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/proxysql 2026-07-20 09:53:15.362586 | debian-bookworm | Found installed collection community.proxysql:1.7.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/proxysql' 2026-07-20 09:53:15.362862 | debian-bookworm | Loading collection cisco.dnac from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/cisco/dnac 2026-07-20 09:53:15.363157 | debian-bookworm | Found installed collection cisco.dnac:6.43.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/cisco/dnac' 2026-07-20 09:53:15.363709 | debian-bookworm | Loading collection vyos.vyos from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/vyos/vyos 2026-07-20 09:53:15.363933 | debian-bookworm | Found installed collection vyos.vyos:6.0.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/vyos/vyos' 2026-07-20 09:53:15.364736 | debian-bookworm | Loading collection junipernetworks.junos from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/junipernetworks/junos 2026-07-20 09:53:15.364996 | debian-bookworm | Found installed collection junipernetworks.junos:11.0.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/junipernetworks/junos' 2026-07-20 09:53:15.365277 | debian-bookworm | Loading collection cyberark.conjur from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/cyberark/conjur 2026-07-20 09:53:15.365508 | debian-bookworm | Found installed collection cyberark.conjur:1.3.9 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/cyberark/conjur' 2026-07-20 09:53:15.366918 | debian-bookworm | Loading collection community.windows from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/windows 2026-07-20 09:53:15.367154 | debian-bookworm | Found installed collection community.windows:3.1.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/windows' 2026-07-20 09:53:15.367479 | debian-bookworm | Loading collection inspur.ispim from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/inspur/ispim 2026-07-20 09:53:15.367715 | debian-bookworm | Found installed collection inspur.ispim:2.2.4 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/inspur/ispim' 2026-07-20 09:53:15.368073 | debian-bookworm | Loading collection community.postgresql from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/postgresql 2026-07-20 09:53:15.368312 | debian-bookworm | Found installed collection community.postgresql:4.2.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/postgresql' 2026-07-20 09:53:15.369752 | debian-bookworm | Loading collection cisco.meraki from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/cisco/meraki 2026-07-20 09:53:15.370541 | debian-bookworm | Found installed collection cisco.meraki:2.21.9 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/cisco/meraki' 2026-07-20 09:53:15.371194 | debian-bookworm | Loading collection hetzner.hcloud from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/hetzner/hcloud 2026-07-20 09:53:15.371570 | debian-bookworm | Found installed collection hetzner.hcloud:5.4.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/hetzner/hcloud' 2026-07-20 09:53:15.371935 | debian-bookworm | Loading collection community.proxmox from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/proxmox 2026-07-20 09:53:15.372229 | debian-bookworm | Found installed collection community.proxmox:1.4.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/proxmox' 2026-07-20 09:53:15.372569 | debian-bookworm | Loading collection cloudscale_ch.cloud from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/cloudscale_ch/cloud 2026-07-20 09:53:15.372895 | debian-bookworm | Found installed collection cloudscale_ch.cloud:2.5.2 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/cloudscale_ch/cloud' 2026-07-20 09:53:15.373662 | debian-bookworm | Loading collection netapp.ontap from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/netapp/ontap 2026-07-20 09:53:15.373939 | debian-bookworm | Found installed collection netapp.ontap:23.2.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/netapp/ontap' 2026-07-20 09:53:15.375596 | debian-bookworm | Loading collection azure.azcollection from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/azure/azcollection 2026-07-20 09:53:15.375873 | debian-bookworm | Found installed collection azure.azcollection:3.12.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/azure/azcollection' 2026-07-20 09:53:15.376166 | debian-bookworm | Loading collection community.libvirt from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/libvirt 2026-07-20 09:53:15.376449 | debian-bookworm | Found installed collection community.libvirt:2.0.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/libvirt' 2026-07-20 09:53:15.376718 | debian-bookworm | Loading collection lowlydba.sqlserver from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/lowlydba/sqlserver 2026-07-20 09:53:15.376931 | debian-bookworm | Found installed collection lowlydba.sqlserver:2.7.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/lowlydba/sqlserver' 2026-07-20 09:53:15.377228 | debian-bookworm | Loading collection netapp_eseries.santricity from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/netapp_eseries/santricity 2026-07-20 09:53:15.377438 | debian-bookworm | Found installed collection netapp_eseries.santricity:1.4.1 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/netapp_eseries/santricity' 2026-07-20 09:53:15.378534 | debian-bookworm | Loading collection community.vmware from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/vmware 2026-07-20 09:53:15.378811 | debian-bookworm | Found installed collection community.vmware:5.10.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/vmware' 2026-07-20 09:53:15.379092 | debian-bookworm | Loading collection community.zabbix from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/zabbix 2026-07-20 09:53:15.379361 | debian-bookworm | Found installed collection community.zabbix:4.1.1 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/zabbix' 2026-07-20 09:53:15.379631 | debian-bookworm | Loading collection wti.remote from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/wti/remote 2026-07-20 09:53:15.379895 | debian-bookworm | Found installed collection wti.remote:1.0.10 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/wti/remote' 2026-07-20 09:53:15.380993 | debian-bookworm | Loading collection amazon.aws from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/amazon/aws 2026-07-20 09:53:15.381278 | debian-bookworm | Found installed collection amazon.aws:10.1.2 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/amazon/aws' 2026-07-20 09:53:15.383190 | debian-bookworm | Loading collection awx.awx from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/awx/awx 2026-07-20 09:53:15.383458 | debian-bookworm | Found installed collection awx.awx:24.6.1 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/awx/awx' 2026-07-20 09:53:15.383724 | debian-bookworm | Loading collection ansible.netcommon from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/ansible/netcommon 2026-07-20 09:53:15.383993 | debian-bookworm | Found installed collection ansible.netcommon:8.2.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/ansible/netcommon' 2026-07-20 09:53:15.386852 | debian-bookworm | Loading collection community.aws from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/aws 2026-07-20 09:53:15.387171 | debian-bookworm | Found installed collection community.aws:10.0.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/aws' 2026-07-20 09:53:15.387498 | debian-bookworm | Loading collection community.mongodb from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/mongodb 2026-07-20 09:53:15.387791 | debian-bookworm | Found installed collection community.mongodb:1.7.10 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/mongodb' 2026-07-20 09:53:15.388111 | debian-bookworm | Loading collection purestorage.flashblade from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/purestorage/flashblade 2026-07-20 09:53:15.388399 | debian-bookworm | Found installed collection purestorage.flashblade:1.22.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/purestorage/flashblade' 2026-07-20 09:53:15.388628 | debian-bookworm | Loading collection cisco.ucs from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/cisco/ucs 2026-07-20 09:53:15.388933 | debian-bookworm | Found installed collection cisco.ucs:1.16.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/cisco/ucs' 2026-07-20 09:53:15.390129 | debian-bookworm | Loading collection cisco.aci from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/cisco/aci 2026-07-20 09:53:15.390428 | debian-bookworm | Found installed collection cisco.aci:2.13.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/cisco/aci' 2026-07-20 09:53:15.391868 | debian-bookworm | Loading collection dellemc.enterprise_sonic from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/dellemc/enterprise_sonic 2026-07-20 09:53:15.392152 | debian-bookworm | Found installed collection dellemc.enterprise_sonic:3.2.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/dellemc/enterprise_sonic' 2026-07-20 09:53:15.392428 | debian-bookworm | Loading collection netapp.storagegrid from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/netapp/storagegrid 2026-07-20 09:53:15.392700 | debian-bookworm | Found installed collection netapp.storagegrid:21.15.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/netapp/storagegrid' 2026-07-20 09:53:15.392971 | debian-bookworm | Loading collection microsoft.iis from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/microsoft/iis 2026-07-20 09:53:15.393265 | debian-bookworm | Found installed collection microsoft.iis:1.1.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/microsoft/iis' 2026-07-20 09:53:15.393714 | debian-bookworm | Loading collection ovirt.ovirt from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/ovirt/ovirt 2026-07-20 09:53:15.393980 | debian-bookworm | Found installed collection ovirt.ovirt:3.2.1 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/ovirt/ovirt' 2026-07-20 09:53:15.394277 | debian-bookworm | Loading collection hitachivantara.vspone_object from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/hitachivantara/vspone_object 2026-07-20 09:53:15.394577 | debian-bookworm | Found installed collection hitachivantara.vspone_object:1.1.1 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/hitachivantara/vspone_object' 2026-07-20 09:53:15.394847 | debian-bookworm | Loading collection hitachivantara.vspone_block from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/hitachivantara/vspone_block 2026-07-20 09:53:15.395147 | debian-bookworm | Found installed collection hitachivantara.vspone_block:4.5.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/hitachivantara/vspone_block' 2026-07-20 09:53:15.395396 | debian-bookworm | Loading collection kubevirt.core from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/kubevirt/core 2026-07-20 09:53:15.395648 | debian-bookworm | Found installed collection kubevirt.core:2.2.3 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/kubevirt/core' 2026-07-20 09:53:15.403867 | debian-bookworm | Loading collection community.general from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/general 2026-07-20 09:53:15.404137 | debian-bookworm | Found installed collection community.general:11.4.2 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/general' 2026-07-20 09:53:15.404387 | debian-bookworm | Loading collection community.rabbitmq from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/rabbitmq 2026-07-20 09:53:15.404637 | debian-bookworm | Found installed collection community.rabbitmq:1.6.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/rabbitmq' 2026-07-20 09:53:15.404886 | debian-bookworm | Loading collection ansible.posix from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/ansible/posix 2026-07-20 09:53:15.405158 | debian-bookworm | Found installed collection ansible.posix:2.1.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/ansible/posix' 2026-07-20 09:53:15.405602 | debian-bookworm | Loading collection ibm.qradar from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/ibm/qradar 2026-07-20 09:53:15.405850 | debian-bookworm | Found installed collection ibm.qradar:4.0.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/ibm/qradar' 2026-07-20 09:53:15.406118 | debian-bookworm | Loading collection community.hashi_vault from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/hashi_vault 2026-07-20 09:53:15.406367 | debian-bookworm | Found installed collection community.hashi_vault:7.1.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/hashi_vault' 2026-07-20 09:53:15.407283 | debian-bookworm | Loading collection community.digitalocean from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/digitalocean 2026-07-20 09:53:15.407509 | debian-bookworm | Found installed collection community.digitalocean:1.27.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/digitalocean' 2026-07-20 09:53:15.408364 | debian-bookworm | Loading collection google.cloud from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/google/cloud 2026-07-20 09:53:15.408592 | debian-bookworm | Found installed collection google.cloud:1.10.2 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/google/cloud' 2026-07-20 09:53:15.408820 | debian-bookworm | Loading collection cisco.intersight from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/cisco/intersight 2026-07-20 09:53:15.409047 | debian-bookworm | Found installed collection cisco.intersight:2.12.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/cisco/intersight' 2026-07-20 09:53:15.409290 | debian-bookworm | Loading collection ibm.storage_virtualize from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/ibm/storage_virtualize 2026-07-20 09:53:15.409522 | debian-bookworm | Found installed collection ibm.storage_virtualize:2.7.4 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/ibm/storage_virtualize' 2026-07-20 09:53:15.409751 | debian-bookworm | Loading collection vultr.cloud from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/vultr/cloud 2026-07-20 09:53:15.409990 | debian-bookworm | Found installed collection vultr.cloud:1.13.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/vultr/cloud' 2026-07-20 09:53:15.412004 | debian-bookworm | Loading collection vmware.vmware_rest from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/vmware/vmware_rest 2026-07-20 09:53:15.412230 | debian-bookworm | Found installed collection vmware.vmware_rest:4.9.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/vmware/vmware_rest' 2026-07-20 09:53:15.416662 | debian-bookworm | Loading collection fortinet.fortimanager from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/fortinet/fortimanager 2026-07-20 09:53:15.416883 | debian-bookworm | Found installed collection fortinet.fortimanager:2.11.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/fortinet/fortimanager' 2026-07-20 09:53:15.417231 | debian-bookworm | Loading collection community.grafana from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/grafana 2026-07-20 09:53:15.417442 | debian-bookworm | Found installed collection community.grafana:2.3.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/grafana' 2026-07-20 09:53:15.418140 | debian-bookworm | Loading collection cisco.ios from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/cisco/ios 2026-07-20 09:53:15.418429 | debian-bookworm | Found installed collection cisco.ios:11.1.1 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/cisco/ios' 2026-07-20 09:53:15.419086 | debian-bookworm | Loading collection cisco.iosxr from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/cisco/iosxr 2026-07-20 09:53:15.419303 | debian-bookworm | Found installed collection cisco.iosxr:12.1.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/cisco/iosxr' 2026-07-20 09:53:15.419832 | debian-bookworm | Loading collection dellemc.openmanage from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/dellemc/openmanage 2026-07-20 09:53:15.420104 | debian-bookworm | Found installed collection dellemc.openmanage:9.12.3 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/dellemc/openmanage' 2026-07-20 09:53:15.420314 | debian-bookworm | Loading collection cyberark.pas from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/cyberark/pas 2026-07-20 09:53:15.420530 | debian-bookworm | Found installed collection cyberark.pas:1.0.36 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/cyberark/pas' 2026-07-20 09:53:15.420739 | debian-bookworm | Loading collection community.ciscosmb from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/ciscosmb 2026-07-20 09:53:15.420949 | debian-bookworm | Found installed collection community.ciscosmb:1.0.11 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/ciscosmb' 2026-07-20 09:53:15.421508 | debian-bookworm | Loading collection openstack.cloud from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/openstack/cloud 2026-07-20 09:53:15.421719 | debian-bookworm | Found installed collection openstack.cloud:2.5.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/openstack/cloud' 2026-07-20 09:53:15.421977 | debian-bookworm | Loading collection community.mysql from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/mysql 2026-07-20 09:53:15.422230 | debian-bookworm | Found installed collection community.mysql:3.16.1 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/mysql' 2026-07-20 09:53:15.422460 | debian-bookworm | Loading collection community.routeros from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/routeros 2026-07-20 09:53:15.422730 | debian-bookworm | Found installed collection community.routeros:3.14.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/routeros' 2026-07-20 09:53:15.423272 | debian-bookworm | Loading collection ngine_io.cloudstack from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/ngine_io/cloudstack 2026-07-20 09:53:15.423485 | debian-bookworm | Found installed collection ngine_io.cloudstack:2.5.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/ngine_io/cloudstack' 2026-07-20 09:53:15.423800 | debian-bookworm | Loading collection ansible.windows from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/ansible/windows 2026-07-20 09:53:15.424011 | debian-bookworm | Found installed collection ansible.windows:3.3.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/ansible/windows' 2026-07-20 09:53:15.424239 | debian-bookworm | Loading collection community.library_inventory_filtering_v1 from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/library_inventory_filtering_v1 2026-07-20 09:53:15.424456 | debian-bookworm | Found installed collection community.library_inventory_filtering_v1:1.1.5 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/library_inventory_filtering_v1' 2026-07-20 09:53:15.425111 | debian-bookworm | Loading collection splunk.es from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/splunk/es 2026-07-20 09:53:15.425376 | debian-bookworm | Found installed collection splunk.es:4.0.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/splunk/es' 2026-07-20 09:53:15.425696 | debian-bookworm | Loading collection community.dns from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/dns 2026-07-20 09:53:15.425947 | debian-bookworm | Found installed collection community.dns:3.4.1 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/dns' 2026-07-20 09:53:15.426231 | debian-bookworm | Loading collection ieisystem.inmanage from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/ieisystem/inmanage 2026-07-20 09:53:15.426457 | debian-bookworm | Found installed collection ieisystem.inmanage:3.0.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/ieisystem/inmanage' 2026-07-20 09:53:15.426846 | debian-bookworm | Loading collection community.docker from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/docker 2026-07-20 09:53:15.427065 | debian-bookworm | Found installed collection community.docker:4.8.5 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/docker' 2026-07-20 09:53:15.427323 | debian-bookworm | Loading collection kaytus.ksmanage from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/kaytus/ksmanage 2026-07-20 09:53:15.427559 | debian-bookworm | Found installed collection kaytus.ksmanage:2.0.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/kaytus/ksmanage' 2026-07-20 09:53:15.427955 | debian-bookworm | Loading collection dellemc.powerflex from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/dellemc/powerflex 2026-07-20 09:53:15.428193 | debian-bookworm | Found installed collection dellemc.powerflex:2.6.1 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/dellemc/powerflex' 2026-07-20 09:53:15.428772 | debian-bookworm | Loading collection dellemc.unity from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/dellemc/unity 2026-07-20 09:53:15.429015 | debian-bookworm | Found installed collection dellemc.unity:2.1.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/dellemc/unity' 2026-07-20 09:53:15.429312 | debian-bookworm | Loading collection containers.podman from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/containers/podman 2026-07-20 09:53:15.429550 | debian-bookworm | Found installed collection containers.podman:1.18.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/containers/podman' 2026-07-20 09:53:15.430145 | debian-bookworm | Loading collection netbox.netbox from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/netbox/netbox 2026-07-20 09:53:15.430420 | debian-bookworm | Found installed collection netbox.netbox:3.21.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/netbox/netbox' 2026-07-20 09:53:15.430672 | debian-bookworm | Loading collection infoblox.nios_modules from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/infoblox/nios_modules 2026-07-20 09:53:15.430912 | debian-bookworm | Found installed collection infoblox.nios_modules:1.8.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/infoblox/nios_modules' 2026-07-20 09:53:15.433678 | debian-bookworm | Loading collection fortinet.fortios from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/fortinet/fortios 2026-07-20 09:53:15.433956 | debian-bookworm | Found installed collection fortinet.fortios:2.4.2 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/fortinet/fortios' 2026-07-20 09:53:15.435214 | debian-bookworm | Loading collection cisco.mso from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/cisco/mso 2026-07-20 09:53:15.435471 | debian-bookworm | Found installed collection cisco.mso:2.12.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/cisco/mso' 2026-07-20 09:53:15.435649 | debian-bookworm | Loading collection ansible.utils from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/ansible/utils 2026-07-20 09:53:15.435915 | debian-bookworm | Found installed collection ansible.utils:6.0.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/ansible/utils' 2026-07-20 09:53:15.436191 | debian-bookworm | Loading collection grafana.grafana from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/grafana/grafana 2026-07-20 09:53:15.436490 | debian-bookworm | Found installed collection grafana.grafana:6.0.6 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/grafana/grafana' 2026-07-20 09:53:15.436664 | debian-bookworm | Loading collection community.sops from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/sops 2026-07-20 09:53:15.436914 | debian-bookworm | Found installed collection community.sops:2.2.7 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/sops' 2026-07-20 09:53:15.437352 | debian-bookworm | Loading collection community.crypto from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/crypto 2026-07-20 09:53:15.437606 | debian-bookworm | Found installed collection community.crypto:3.0.5 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/crypto' 2026-07-20 09:53:15.437837 | debian-bookworm | Loading collection microsoft.ad from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/microsoft/ad 2026-07-20 09:53:15.438099 | debian-bookworm | Found installed collection microsoft.ad:1.10.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/microsoft/ad' 2026-07-20 09:53:15.438357 | debian-bookworm | Loading collection netapp.cloudmanager from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/netapp/cloudmanager 2026-07-20 09:53:15.438609 | debian-bookworm | Found installed collection netapp.cloudmanager:21.24.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/netapp/cloudmanager' 2026-07-20 09:53:15.438951 | debian-bookworm | Loading collection community.okd from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/okd 2026-07-20 09:53:15.439185 | debian-bookworm | Found installed collection community.okd:5.0.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/okd' 2026-07-20 09:53:15.439507 | debian-bookworm | Loading collection f5networks.f5_modules from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/f5networks/f5_modules 2026-07-20 09:53:15.439742 | debian-bookworm | Found installed collection f5networks.f5_modules:1.39.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/f5networks/f5_modules' 2026-07-20 09:53:15.441042 | debian-bookworm | Loading collection cisco.nxos from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/cisco/nxos 2026-07-20 09:53:15.441322 | debian-bookworm | Found installed collection cisco.nxos:11.1.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/cisco/nxos' 2026-07-20 09:53:15.441742 | debian-bookworm | Loading collection check_point.mgmt from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/check_point/mgmt 2026-07-20 09:53:15.441999 | debian-bookworm | Found installed collection check_point.mgmt:6.7.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/check_point/mgmt' 2026-07-20 09:53:15.442338 | debian-bookworm | Loading collection community.hrobot from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/hrobot 2026-07-20 09:53:15.442608 | debian-bookworm | Found installed collection community.hrobot:2.7.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/hrobot' 2026-07-20 09:53:15.446816 | debian-bookworm | Loading collection osism.services from /home/zuul/.ansible/collections/ansible_collections/osism/services 2026-07-20 09:53:15.447106 | debian-bookworm | Found installed collection osism.services:999.0.0 at '/home/zuul/.ansible/collections/ansible_collections/osism/services' 2026-07-20 09:53:15.451457 | debian-bookworm | Loading collection ansible._protomatter from /home/zuul/venv/lib/python3.11/site-packages/ansible/_internal/ansible_collections/ansible/_protomatter 2026-07-20 09:53:15.451618 | debian-bookworm | Found installed collection ansible._protomatter:2.19.11 at '/home/zuul/venv/lib/python3.11/site-packages/ansible/_internal/ansible_collections/ansible/_protomatter' 2026-07-20 09:53:15.454861 | debian-bookworm | Initial connection to galaxy_server: https://galaxy.ansible.com 2026-07-20 09:53:15.455257 | debian-bookworm | Created /home/zuul/.ansible/galaxy_token 2026-07-20 09:53:15.455444 | debian-bookworm | Calling Galaxy at https://galaxy.ansible.com/api/ 2026-07-20 09:53:15.814461 | ubuntu-noble | INFO [delegated > dependency] Executing 2026-07-20 09:53:15.815205 | ubuntu-noble | WARNING [delegated > dependency] Missing roles requirements file: requirements.yml 2026-07-20 09:53:16.029376 | debian-bookworm | Found API version 'v3, pulp-v3, v1' with Galaxy server default (https://galaxy.ansible.com/api/) 2026-07-20 09:53:16.029762 | debian-bookworm | Calling Galaxy at https://galaxy.ansible.com/api/v3/collections/osism/commons/ 2026-07-20 09:53:16.388678 | ubuntu-noble | ansible-galaxy [core 2.19.11] 2026-07-20 09:53:16.388729 | ubuntu-noble | config file = None 2026-07-20 09:53:16.388737 | ubuntu-noble | configured module search path = ['/home/zuul/src/github.com/osism/ansible-collection-services/plugins/modules', '/home/zuul/.ansible/plugins/modules', '/usr/share/ansible/plugins/modules'] 2026-07-20 09:53:16.388743 | ubuntu-noble | ansible python module location = /home/zuul/venv/lib/python3.12/site-packages/ansible 2026-07-20 09:53:16.388753 | ubuntu-noble | ansible collection location = /home/zuul/.ansible/collections:/usr/share/ansible/collections:/home/zuul/venv/lib/python3.12/site-packages:/home/zuul/venv/lib/python3.12/dist-packages:/home/zuul/venv/lib/python3/dist-packages:/home/zuul/venv/local/lib/python3.12/dist-packages 2026-07-20 09:53:16.389246 | ubuntu-noble | executable location = /home/zuul/venv/bin/ansible-galaxy 2026-07-20 09:53:16.389846 | ubuntu-noble | python version = 3.12.3 (main, Jun 19 2026, 12:46:00) [GCC 13.3.0] (/home/zuul/venv/bin/python3) 2026-07-20 09:53:16.390381 | ubuntu-noble | jinja version = 3.1.6 2026-07-20 09:53:16.391707 | ubuntu-noble | pyyaml version = 6.0.3 (with libyaml v0.2.5) 2026-07-20 09:53:16.392336 | ubuntu-noble | No config file found; using defaults 2026-07-20 09:53:16.393219 | ubuntu-noble | Reading requirement file at '/home/zuul/src/github.com/osism/ansible-collection-services/molecule/delegated/collections.yml' 2026-07-20 09:53:16.401090 | ubuntu-noble | Loading collection osism.services from /home/zuul/.ansible/collections/ansible_collections/osism/services 2026-07-20 09:53:16.401416 | ubuntu-noble | Found installed collection osism.services:999.0.0 at '/home/zuul/.ansible/collections/ansible_collections/osism/services' 2026-07-20 09:53:16.415910 | ubuntu-noble | Loading collection ansible._protomatter from /home/zuul/venv/lib/python3.12/site-packages/ansible/_internal/ansible_collections/ansible/_protomatter 2026-07-20 09:53:16.416441 | ubuntu-noble | Found installed collection ansible._protomatter:2.19.11 at '/home/zuul/venv/lib/python3.12/site-packages/ansible/_internal/ansible_collections/ansible/_protomatter' 2026-07-20 09:53:16.426968 | ubuntu-noble | Loading collection cisco.intersight from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/cisco/intersight 2026-07-20 09:53:16.427432 | ubuntu-noble | Found installed collection cisco.intersight:2.12.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/cisco/intersight' 2026-07-20 09:53:16.427976 | ubuntu-noble | Loading collection purestorage.flasharray from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/purestorage/flasharray 2026-07-20 09:53:16.428549 | ubuntu-noble | Found installed collection purestorage.flasharray:1.40.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/purestorage/flasharray' 2026-07-20 09:53:16.429141 | ubuntu-noble | Loading collection vultr.cloud from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/vultr/cloud 2026-07-20 09:53:16.429547 | ubuntu-noble | Found installed collection vultr.cloud:1.13.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/vultr/cloud' 2026-07-20 09:53:16.430170 | ubuntu-noble | Loading collection community.mysql from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/mysql 2026-07-20 09:53:16.430452 | ubuntu-noble | Found installed collection community.mysql:3.16.1 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/mysql' 2026-07-20 09:53:16.433277 | ubuntu-noble | Loading collection cisco.mso from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/cisco/mso 2026-07-20 09:53:16.433586 | ubuntu-noble | Found installed collection cisco.mso:2.12.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/cisco/mso' 2026-07-20 09:53:16.433959 | ubuntu-noble | Loading collection infoblox.nios_modules from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/infoblox/nios_modules 2026-07-20 09:53:16.434304 | ubuntu-noble | Found installed collection infoblox.nios_modules:1.8.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/infoblox/nios_modules' 2026-07-20 09:53:16.434651 | ubuntu-noble | Loading collection community.proxysql from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/proxysql 2026-07-20 09:53:16.434998 | ubuntu-noble | Found installed collection community.proxysql:1.7.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/proxysql' 2026-07-20 09:53:16.436612 | ubuntu-noble | Loading collection community.vmware from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/vmware 2026-07-20 09:53:16.436957 | ubuntu-noble | Found installed collection community.vmware:5.10.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/vmware' 2026-07-20 09:53:16.438438 | ubuntu-noble | Loading collection amazon.aws from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/amazon/aws 2026-07-20 09:53:16.438757 | ubuntu-noble | Found installed collection amazon.aws:10.1.2 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/amazon/aws' 2026-07-20 09:53:16.439060 | ubuntu-noble | Loading collection community.libvirt from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/libvirt 2026-07-20 09:53:16.439346 | ubuntu-noble | Found installed collection community.libvirt:2.0.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/libvirt' 2026-07-20 09:53:16.440019 | ubuntu-noble | Loading collection wti.remote from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/wti/remote 2026-07-20 09:53:16.440311 | ubuntu-noble | Found installed collection wti.remote:1.0.10 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/wti/remote' 2026-07-20 09:53:16.440789 | ubuntu-noble | Loading collection telekom_mms.icinga_director from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/telekom_mms/icinga_director 2026-07-20 09:53:16.441051 | ubuntu-noble | Found installed collection telekom_mms.icinga_director:2.5.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/telekom_mms/icinga_director' 2026-07-20 09:53:16.441473 | ubuntu-noble | Loading collection community.okd from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/okd 2026-07-20 09:53:16.441784 | ubuntu-noble | Found installed collection community.okd:5.0.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/okd' 2026-07-20 09:53:16.443741 | ubuntu-noble | Loading collection dellemc.enterprise_sonic from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/dellemc/enterprise_sonic 2026-07-20 09:53:16.444122 | ubuntu-noble | Found installed collection dellemc.enterprise_sonic:3.2.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/dellemc/enterprise_sonic' 2026-07-20 09:53:16.445127 | ubuntu-noble | Loading collection junipernetworks.junos from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/junipernetworks/junos 2026-07-20 09:53:16.446654 | ubuntu-noble | Found installed collection junipernetworks.junos:11.0.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/junipernetworks/junos' 2026-07-20 09:53:16.446676 | ubuntu-noble | Loading collection netapp.storagegrid from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/netapp/storagegrid 2026-07-20 09:53:16.446681 | ubuntu-noble | Found installed collection netapp.storagegrid:21.15.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/netapp/storagegrid' 2026-07-20 09:53:16.446699 | ubuntu-noble | Loading collection ravendb.ravendb from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/ravendb/ravendb 2026-07-20 09:53:16.446737 | ubuntu-noble | Found installed collection ravendb.ravendb:1.0.4 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/ravendb/ravendb' 2026-07-20 09:53:16.447099 | ubuntu-noble | Loading collection cyberark.pas from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/cyberark/pas 2026-07-20 09:53:16.447374 | ubuntu-noble | Found installed collection cyberark.pas:1.0.36 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/cyberark/pas' 2026-07-20 09:53:16.447786 | ubuntu-noble | Loading collection community.hrobot from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/hrobot 2026-07-20 09:53:16.448177 | ubuntu-noble | Found installed collection community.hrobot:2.7.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/hrobot' 2026-07-20 09:53:16.448672 | ubuntu-noble | Loading collection hitachivantara.vspone_block from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/hitachivantara/vspone_block 2026-07-20 09:53:16.448951 | ubuntu-noble | Found installed collection hitachivantara.vspone_block:4.5.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/hitachivantara/vspone_block' 2026-07-20 09:53:16.449564 | ubuntu-noble | Loading collection openstack.cloud from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/openstack/cloud 2026-07-20 09:53:16.449944 | ubuntu-noble | Found installed collection openstack.cloud:2.5.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/openstack/cloud' 2026-07-20 09:53:16.451950 | ubuntu-noble | Loading collection cisco.aci from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/cisco/aci 2026-07-20 09:53:16.452166 | ubuntu-noble | Found installed collection cisco.aci:2.13.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/cisco/aci' 2026-07-20 09:53:16.452479 | ubuntu-noble | Loading collection community.library_inventory_filtering_v1 from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/library_inventory_filtering_v1 2026-07-20 09:53:16.452932 | ubuntu-noble | Found installed collection community.library_inventory_filtering_v1:1.1.5 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/library_inventory_filtering_v1' 2026-07-20 09:53:16.453581 | ubuntu-noble | Loading collection dellemc.unity from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/dellemc/unity 2026-07-20 09:53:16.454590 | ubuntu-noble | Found installed collection dellemc.unity:2.1.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/dellemc/unity' 2026-07-20 09:53:16.455469 | ubuntu-noble | Loading collection hetzner.hcloud from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/hetzner/hcloud 2026-07-20 09:53:16.455957 | ubuntu-noble | Found installed collection hetzner.hcloud:5.4.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/hetzner/hcloud' 2026-07-20 09:53:16.456382 | ubuntu-noble | Loading collection ngine_io.cloudstack from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/ngine_io/cloudstack 2026-07-20 09:53:16.456823 | ubuntu-noble | Found installed collection ngine_io.cloudstack:2.5.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/ngine_io/cloudstack' 2026-07-20 09:53:16.457311 | ubuntu-noble | Loading collection community.rabbitmq from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/rabbitmq 2026-07-20 09:53:16.457752 | ubuntu-noble | Found installed collection community.rabbitmq:1.6.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/rabbitmq' 2026-07-20 09:53:16.458243 | ubuntu-noble | Loading collection ansible.utils from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/ansible/utils 2026-07-20 09:53:16.458547 | ubuntu-noble | Found installed collection ansible.utils:6.0.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/ansible/utils' 2026-07-20 09:53:16.458860 | ubuntu-noble | Loading collection ansible.windows from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/ansible/windows 2026-07-20 09:53:16.459258 | ubuntu-noble | Found installed collection ansible.windows:3.3.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/ansible/windows' 2026-07-20 09:53:16.459545 | ubuntu-noble | Loading collection netapp.cloudmanager from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/netapp/cloudmanager 2026-07-20 09:53:16.459854 | ubuntu-noble | Found installed collection netapp.cloudmanager:21.24.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/netapp/cloudmanager' 2026-07-20 09:53:16.460243 | ubuntu-noble | Loading collection ovirt.ovirt from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/ovirt/ovirt 2026-07-20 09:53:16.460526 | ubuntu-noble | Found installed collection ovirt.ovirt:3.2.1 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/ovirt/ovirt' 2026-07-20 09:53:16.460949 | ubuntu-noble | Loading collection ibm.qradar from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/ibm/qradar 2026-07-20 09:53:16.461267 | ubuntu-noble | Found installed collection ibm.qradar:4.0.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/ibm/qradar' 2026-07-20 09:53:16.461649 | ubuntu-noble | Loading collection kubernetes.core from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/kubernetes/core 2026-07-20 09:53:16.462035 | ubuntu-noble | Found installed collection kubernetes.core:6.2.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/kubernetes/core' 2026-07-20 09:53:16.463660 | ubuntu-noble | Loading collection ibm.storage_virtualize from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/ibm/storage_virtualize 2026-07-20 09:53:16.463688 | ubuntu-noble | Found installed collection ibm.storage_virtualize:2.7.4 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/ibm/storage_virtualize' 2026-07-20 09:53:16.463696 | ubuntu-noble | Loading collection containers.podman from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/containers/podman 2026-07-20 09:53:16.463702 | ubuntu-noble | Found installed collection containers.podman:1.18.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/containers/podman' 2026-07-20 09:53:16.463711 | ubuntu-noble | Loading collection microsoft.iis from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/microsoft/iis 2026-07-20 09:53:16.464120 | ubuntu-noble | Found installed collection microsoft.iis:1.1.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/microsoft/iis' 2026-07-20 09:53:16.464394 | ubuntu-noble | Loading collection inspur.ispim from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/inspur/ispim 2026-07-20 09:53:16.464746 | ubuntu-noble | Found installed collection inspur.ispim:2.2.4 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/inspur/ispim' 2026-07-20 09:53:16.465905 | ubuntu-noble | Loading collection cisco.nxos from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/cisco/nxos 2026-07-20 09:53:16.466240 | ubuntu-noble | Found installed collection cisco.nxos:11.1.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/cisco/nxos' 2026-07-20 09:53:16.468759 | ubuntu-noble | Loading collection awx.awx from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/awx/awx 2026-07-20 09:53:16.469037 | ubuntu-noble | Found installed collection awx.awx:24.6.1 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/awx/awx' 2026-07-20 09:53:16.471858 | ubuntu-noble | Loading collection azure.azcollection from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/azure/azcollection 2026-07-20 09:53:16.472453 | ubuntu-noble | Found installed collection azure.azcollection:3.12.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/azure/azcollection' 2026-07-20 09:53:16.472805 | ubuntu-noble | Loading collection community.sops from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/sops 2026-07-20 09:53:16.473182 | ubuntu-noble | Found installed collection community.sops:2.2.7 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/sops' 2026-07-20 09:53:16.473579 | ubuntu-noble | Loading collection purestorage.flashblade from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/purestorage/flashblade 2026-07-20 09:53:16.473938 | ubuntu-noble | Found installed collection purestorage.flashblade:1.22.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/purestorage/flashblade' 2026-07-20 09:53:16.476826 | ubuntu-noble | Loading collection fortinet.fortios from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/fortinet/fortios 2026-07-20 09:53:16.477229 | ubuntu-noble | Found installed collection fortinet.fortios:2.4.2 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/fortinet/fortios' 2026-07-20 09:53:16.477827 | ubuntu-noble | Loading collection cloudscale_ch.cloud from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/cloudscale_ch/cloud 2026-07-20 09:53:16.478200 | ubuntu-noble | Found installed collection cloudscale_ch.cloud:2.5.2 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/cloudscale_ch/cloud' 2026-07-20 09:53:16.478546 | ubuntu-noble | Loading collection microsoft.ad from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/microsoft/ad 2026-07-20 09:53:16.479098 | ubuntu-noble | Found installed collection microsoft.ad:1.10.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/microsoft/ad' 2026-07-20 09:53:16.479464 | ubuntu-noble | Loading collection netapp_eseries.santricity from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/netapp_eseries/santricity 2026-07-20 09:53:16.479717 | ubuntu-noble | Found installed collection netapp_eseries.santricity:1.4.1 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/netapp_eseries/santricity' 2026-07-20 09:53:16.482043 | ubuntu-noble | Loading collection vmware.vmware_rest from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/vmware/vmware_rest 2026-07-20 09:53:16.482332 | ubuntu-noble | Found installed collection vmware.vmware_rest:4.9.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/vmware/vmware_rest' 2026-07-20 09:53:16.482722 | ubuntu-noble | Loading collection ansible.posix from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/ansible/posix 2026-07-20 09:53:16.483112 | ubuntu-noble | Found installed collection ansible.posix:2.1.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/ansible/posix' 2026-07-20 09:53:16.484740 | ubuntu-noble | Loading collection community.windows from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/windows 2026-07-20 09:53:16.485054 | ubuntu-noble | Found installed collection community.windows:3.1.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/windows' 2026-07-20 09:53:16.485359 | ubuntu-noble | Loading collection cyberark.conjur from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/cyberark/conjur 2026-07-20 09:53:16.485665 | ubuntu-noble | Found installed collection cyberark.conjur:1.3.9 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/cyberark/conjur' 2026-07-20 09:53:16.486004 | ubuntu-noble | Loading collection community.dns from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/dns 2026-07-20 09:53:16.486285 | ubuntu-noble | Found installed collection community.dns:3.4.1 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/dns' 2026-07-20 09:53:16.486569 | ubuntu-noble | Loading collection kaytus.ksmanage from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/kaytus/ksmanage 2026-07-20 09:53:16.486958 | ubuntu-noble | Found installed collection kaytus.ksmanage:2.0.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/kaytus/ksmanage' 2026-07-20 09:53:16.487339 | ubuntu-noble | Loading collection f5networks.f5_modules from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/f5networks/f5_modules 2026-07-20 09:53:16.487683 | ubuntu-noble | Found installed collection f5networks.f5_modules:1.39.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/f5networks/f5_modules' 2026-07-20 09:53:16.489211 | ubuntu-noble | Loading collection theforeman.foreman from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/theforeman/foreman 2026-07-20 09:53:16.489597 | ubuntu-noble | Found installed collection theforeman.foreman:5.7.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/theforeman/foreman' 2026-07-20 09:53:16.492658 | ubuntu-noble | Loading collection cisco.ios from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/cisco/ios 2026-07-20 09:53:16.492680 | ubuntu-noble | Found installed collection cisco.ios:11.1.1 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/cisco/ios' 2026-07-20 09:53:16.492685 | ubuntu-noble | Loading collection splunk.es from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/splunk/es 2026-07-20 09:53:16.492689 | ubuntu-noble | Found installed collection splunk.es:4.0.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/splunk/es' 2026-07-20 09:53:16.492692 | ubuntu-noble | Loading collection hitachivantara.vspone_object from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/hitachivantara/vspone_object 2026-07-20 09:53:16.492697 | ubuntu-noble | Found installed collection hitachivantara.vspone_object:1.1.1 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/hitachivantara/vspone_object' 2026-07-20 09:53:16.492701 | ubuntu-noble | Loading collection chocolatey.chocolatey from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/chocolatey/chocolatey 2026-07-20 09:53:16.492919 | ubuntu-noble | Found installed collection chocolatey.chocolatey:1.5.3 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/chocolatey/chocolatey' 2026-07-20 09:53:16.493161 | ubuntu-noble | Loading collection community.grafana from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/grafana 2026-07-20 09:53:16.493549 | ubuntu-noble | Found installed collection community.grafana:2.3.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/grafana' 2026-07-20 09:53:16.494433 | ubuntu-noble | Loading collection kubevirt.core from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/kubevirt/core 2026-07-20 09:53:16.494977 | ubuntu-noble | Found installed collection kubevirt.core:2.2.3 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/kubevirt/core' 2026-07-20 09:53:16.495300 | ubuntu-noble | Loading collection community.ciscosmb from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/ciscosmb 2026-07-20 09:53:16.495610 | ubuntu-noble | Found installed collection community.ciscosmb:1.0.11 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/ciscosmb' 2026-07-20 09:53:16.496074 | ubuntu-noble | Loading collection dellemc.powerflex from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/dellemc/powerflex 2026-07-20 09:53:16.496394 | ubuntu-noble | Found installed collection dellemc.powerflex:2.6.1 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/dellemc/powerflex' 2026-07-20 09:53:16.496822 | ubuntu-noble | Loading collection arista.eos from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/arista/eos 2026-07-20 09:53:16.497285 | ubuntu-noble | Found installed collection arista.eos:12.0.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/arista/eos' 2026-07-20 09:53:16.497585 | ubuntu-noble | Loading collection cisco.ucs from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/cisco/ucs 2026-07-20 09:53:16.498073 | ubuntu-noble | Found installed collection cisco.ucs:1.16.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/cisco/ucs' 2026-07-20 09:53:16.501253 | ubuntu-noble | Loading collection community.aws from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/aws 2026-07-20 09:53:16.501605 | ubuntu-noble | Found installed collection community.aws:10.0.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/aws' 2026-07-20 09:53:16.502014 | ubuntu-noble | Loading collection community.docker from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/docker 2026-07-20 09:53:16.502367 | ubuntu-noble | Found installed collection community.docker:4.8.5 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/docker' 2026-07-20 09:53:16.502767 | ubuntu-noble | Loading collection community.routeros from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/routeros 2026-07-20 09:53:16.503103 | ubuntu-noble | Found installed collection community.routeros:3.14.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/routeros' 2026-07-20 09:53:16.508695 | ubuntu-noble | Loading collection fortinet.fortimanager from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/fortinet/fortimanager 2026-07-20 09:53:16.509077 | ubuntu-noble | Found installed collection fortinet.fortimanager:2.11.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/fortinet/fortimanager' 2026-07-20 09:53:16.509796 | ubuntu-noble | Loading collection netapp.ontap from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/netapp/ontap 2026-07-20 09:53:16.510143 | ubuntu-noble | Found installed collection netapp.ontap:23.2.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/netapp/ontap' 2026-07-20 09:53:16.510460 | ubuntu-noble | Loading collection grafana.grafana from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/grafana/grafana 2026-07-20 09:53:16.510800 | ubuntu-noble | Found installed collection grafana.grafana:6.0.6 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/grafana/grafana' 2026-07-20 09:53:16.511243 | ubuntu-noble | Loading collection community.sap_libs from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/sap_libs 2026-07-20 09:53:16.511565 | ubuntu-noble | Found installed collection community.sap_libs:1.5.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/sap_libs' 2026-07-20 09:53:16.515141 | ubuntu-noble | Loading collection community.digitalocean from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/digitalocean 2026-07-20 09:53:16.515346 | ubuntu-noble | Found installed collection community.digitalocean:1.27.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/digitalocean' 2026-07-20 09:53:16.515716 | ubuntu-noble | Loading collection google.cloud from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/google/cloud 2026-07-20 09:53:16.515972 | ubuntu-noble | Found installed collection google.cloud:1.10.2 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/google/cloud' 2026-07-20 09:53:16.516193 | ubuntu-noble | Loading collection check_point.mgmt from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/check_point/mgmt 2026-07-20 09:53:16.516416 | ubuntu-noble | Found installed collection check_point.mgmt:6.7.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/check_point/mgmt' 2026-07-20 09:53:16.517133 | ubuntu-noble | Loading collection community.postgresql from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/postgresql 2026-07-20 09:53:16.517346 | ubuntu-noble | Found installed collection community.postgresql:4.2.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/postgresql' 2026-07-20 09:53:16.518178 | ubuntu-noble | Loading collection community.mongodb from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/mongodb 2026-07-20 09:53:16.518374 | ubuntu-noble | Found installed collection community.mongodb:1.7.10 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/mongodb' 2026-07-20 09:53:16.527715 | ubuntu-noble | Loading collection community.general from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/general 2026-07-20 09:53:16.528057 | ubuntu-noble | Found installed collection community.general:11.4.2 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/general' 2026-07-20 09:53:16.528853 | ubuntu-noble | Loading collection cisco.iosxr from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/cisco/iosxr 2026-07-20 09:53:16.529793 | ubuntu-noble | Found installed collection cisco.iosxr:12.1.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/cisco/iosxr' 2026-07-20 09:53:16.530253 | ubuntu-noble | Loading collection dellemc.openmanage from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/dellemc/openmanage 2026-07-20 09:53:16.530715 | ubuntu-noble | Found installed collection dellemc.openmanage:9.12.3 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/dellemc/openmanage' 2026-07-20 09:53:16.531096 | ubuntu-noble | Loading collection infinidat.infinibox from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/infinidat/infinibox 2026-07-20 09:53:16.531448 | ubuntu-noble | Found installed collection infinidat.infinibox:1.6.3 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/infinidat/infinibox' 2026-07-20 09:53:16.531812 | ubuntu-noble | Loading collection vyos.vyos from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/vyos/vyos 2026-07-20 09:53:16.532159 | ubuntu-noble | Found installed collection vyos.vyos:6.0.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/vyos/vyos' 2026-07-20 09:53:16.532802 | ubuntu-noble | Loading collection lowlydba.sqlserver from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/lowlydba/sqlserver 2026-07-20 09:53:16.533335 | ubuntu-noble | Found installed collection lowlydba.sqlserver:2.7.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/lowlydba/sqlserver' 2026-07-20 09:53:16.533575 | ubuntu-noble | Loading collection community.zabbix from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/zabbix 2026-07-20 09:53:16.535279 | ubuntu-noble | Found installed collection community.zabbix:4.1.1 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/zabbix' 2026-07-20 09:53:16.535679 | ubuntu-noble | Loading collection netbox.netbox from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/netbox/netbox 2026-07-20 09:53:16.535985 | ubuntu-noble | Found installed collection netbox.netbox:3.21.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/netbox/netbox' 2026-07-20 09:53:16.536220 | ubuntu-noble | Loading collection community.crypto from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/crypto 2026-07-20 09:53:16.536451 | ubuntu-noble | Found installed collection community.crypto:3.0.5 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/crypto' 2026-07-20 09:53:16.536698 | ubuntu-noble | Loading collection community.proxmox from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/proxmox 2026-07-20 09:53:16.537035 | ubuntu-noble | Found installed collection community.proxmox:1.4.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/proxmox' 2026-07-20 09:53:16.537260 | ubuntu-noble | Loading collection ansible.netcommon from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/ansible/netcommon 2026-07-20 09:53:16.537486 | ubuntu-noble | Found installed collection ansible.netcommon:8.2.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/ansible/netcommon' 2026-07-20 09:53:16.537739 | ubuntu-noble | Loading collection community.hashi_vault from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/hashi_vault 2026-07-20 09:53:16.538062 | ubuntu-noble | Found installed collection community.hashi_vault:7.1.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/hashi_vault' 2026-07-20 09:53:16.538287 | ubuntu-noble | Loading collection ieisystem.inmanage from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/ieisystem/inmanage 2026-07-20 09:53:16.538516 | ubuntu-noble | Found installed collection ieisystem.inmanage:3.0.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/ieisystem/inmanage' 2026-07-20 09:53:16.538863 | ubuntu-noble | Loading collection vmware.vmware from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/vmware/vmware 2026-07-20 09:53:16.539201 | ubuntu-noble | Found installed collection vmware.vmware:2.6.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/vmware/vmware' 2026-07-20 09:53:16.540539 | ubuntu-noble | Loading collection cisco.meraki from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/cisco/meraki 2026-07-20 09:53:16.540992 | ubuntu-noble | Found installed collection cisco.meraki:2.21.9 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/cisco/meraki' 2026-07-20 09:53:16.541247 | ubuntu-noble | Loading collection cisco.dnac from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/cisco/dnac 2026-07-20 09:53:16.541497 | ubuntu-noble | Found installed collection cisco.dnac:6.43.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/cisco/dnac' 2026-07-20 09:53:16.546548 | ubuntu-noble | Initial connection to galaxy_server: https://galaxy.ansible.com 2026-07-20 09:53:16.547770 | ubuntu-noble | Created /home/zuul/.ansible/galaxy_token 2026-07-20 09:53:16.547850 | ubuntu-noble | Calling Galaxy at https://galaxy.ansible.com/api/ 2026-07-20 09:53:16.775738 | ubuntu-noble | Found API version 'v3, pulp-v3, v1' with Galaxy server default (https://galaxy.ansible.com/api/) 2026-07-20 09:53:16.776079 | ubuntu-noble | Calling Galaxy at https://galaxy.ansible.com/api/v3/collections/osism/commons/ 2026-07-20 09:53:17.580073 | ubuntu-noble | Calling Galaxy at https://galaxy.ansible.com/api/v3/collections/osism/commons/versions/?limit=100 2026-07-20 09:53:17.395805 | debian-bookworm | Calling Galaxy at https://galaxy.ansible.com/api/v3/collections/osism/commons/versions/?limit=100 2026-07-20 09:53:19.112150 | debian-bookworm | Calling Galaxy at https://galaxy.ansible.com/api/v3/collections/osism/commons/versions/0.20260712.0/ 2026-07-20 09:53:19.357234 | ubuntu-noble | Calling Galaxy at https://galaxy.ansible.com/api/v3/collections/osism/commons/versions/0.20260712.0/ 2026-07-20 09:53:19.936128 | debian-bookworm | Server https://galaxy.ansible.com/api/ has not signed osism.commons:0.20260712.0 2026-07-20 09:53:19.936464 | debian-bookworm | Fetching a collection tarball for 'osism.commons:0.20260712.0' from Ansible Galaxy 2026-07-20 09:53:20.330642 | ubuntu-noble | Server https://galaxy.ansible.com/api/ has not signed osism.commons:0.20260712.0 2026-07-20 09:53:20.330701 | ubuntu-noble | Fetching a collection tarball for 'osism.commons:0.20260712.0' from Ansible Galaxy 2026-07-20 09:53:21.221601 | ubuntu-noble | Validating downloaded file hash 35b9909f5629f2c3887ea082fabdacce386e6921aacb19a4617336dec0edfc3c with expected hash 35b9909f5629f2c3887ea082fabdacce386e6921aacb19a4617336dec0edfc3c 2026-07-20 09:53:21.222251 | ubuntu-noble | Collection 'osism.commons:0.20260712.0' obtained from server default https://galaxy.ansible.com/api/ 2026-07-20 09:53:21.404715 | ubuntu-noble | Starting galaxy collection install process 2026-07-20 09:53:21.404787 | ubuntu-noble | Process install dependency map 2026-07-20 09:53:21.404932 | ubuntu-noble | Starting collection install process 2026-07-20 09:53:21.405371 | ubuntu-noble | 'ansible.posix:2.1.0' is already installed, skipping. 2026-07-20 09:53:21.406055 | ubuntu-noble | 'community.docker:4.8.5' is already installed, skipping. 2026-07-20 09:53:21.406469 | ubuntu-noble | 'community.general:11.4.2' is already installed, skipping. 2026-07-20 09:53:21.406931 | ubuntu-noble | 'community.library_inventory_filtering_v1:1.1.5' is already installed, skipping. 2026-07-20 09:53:21.407343 | ubuntu-noble | Downloading https://galaxy.ansible.com/api/v3/plugin/ansible/content/published/collections/artifacts/osism-commons-0.20260712.0.tar.gz to /home/zuul/.ansible/tmp/ansible-local-1765cstekjsz/tmpzo1j3s6l/osism-commons-0.20260712.0-q_ezffre 2026-07-20 09:53:21.407879 | ubuntu-noble | Installing 'osism.commons:0.20260712.0' to '/home/zuul/.ansible/collections/ansible_collections/osism/commons' 2026-07-20 09:53:21.408282 | ubuntu-noble | osism.commons:0.20260712.0 was installed successfully 2026-07-20 09:53:21.529085 | ubuntu-noble | INFO [delegated > dependency] Dependency completed successfully. 2026-07-20 09:53:21.531810 | ubuntu-noble | WARNING [delegated > dependency] Executed: Missing roles requirements file: requirements.yml (Remove from dependency_sequence to suppress) 2026-07-20 09:53:21.532948 | ubuntu-noble | WARNING Molecule executed 1 scenario (1 missing files) 2026-07-20 09:53:21.533075 | ubuntu-noble | 2026-07-20 09:53:21.533111 | ubuntu-noble | DETAILS 2026-07-20 09:53:21.533205 | ubuntu-noble | delegated > dependency: Executed: Missing roles requirements file: requirements.yml (Remove from dependency_sequence to suppress) 2026-07-20 09:53:21.533234 | ubuntu-noble | 2026-07-20 09:53:21.533603 | ubuntu-noble | SCENARIO RECAP 2026-07-20 09:53:21.533707 | ubuntu-noble | delegated : actions=1 successful=0 disabled=0 skipped=0 missing=1 failed=0 2026-07-20 09:53:21.533724 | ubuntu-noble | 2026-07-20 09:53:21.230254 | debian-bookworm | Validating downloaded file hash 35b9909f5629f2c3887ea082fabdacce386e6921aacb19a4617336dec0edfc3c with expected hash 35b9909f5629f2c3887ea082fabdacce386e6921aacb19a4617336dec0edfc3c 2026-07-20 09:53:21.230560 | debian-bookworm | Collection 'osism.commons:0.20260712.0' obtained from server default https://galaxy.ansible.com/api/ 2026-07-20 09:53:21.401748 | debian-bookworm | Starting galaxy collection install process 2026-07-20 09:53:21.402067 | debian-bookworm | Process install dependency map 2026-07-20 09:53:21.402359 | debian-bookworm | Starting collection install process 2026-07-20 09:53:21.402700 | debian-bookworm | 'ansible.posix:2.1.0' is already installed, skipping. 2026-07-20 09:53:21.403011 | debian-bookworm | 'community.docker:4.8.5' is already installed, skipping. 2026-07-20 09:53:21.403307 | debian-bookworm | 'community.general:11.4.2' is already installed, skipping. 2026-07-20 09:53:21.403595 | debian-bookworm | 'community.library_inventory_filtering_v1:1.1.5' is already installed, skipping. 2026-07-20 09:53:21.404273 | debian-bookworm | Downloading https://galaxy.ansible.com/api/v3/plugin/ansible/content/published/collections/artifacts/osism-commons-0.20260712.0.tar.gz to /home/zuul/.ansible/tmp/ansible-local-1934on_tsok7/tmpi4yg9dbu/osism-commons-0.20260712.0-fh53otof 2026-07-20 09:53:21.404590 | debian-bookworm | Installing 'osism.commons:0.20260712.0' to '/home/zuul/.ansible/collections/ansible_collections/osism/commons' 2026-07-20 09:53:21.404887 | debian-bookworm | osism.commons:0.20260712.0 was installed successfully 2026-07-20 09:53:21.463196 | debian-bookworm | INFO [delegated > dependency] Dependency completed successfully. 2026-07-20 09:53:21.463449 | debian-bookworm | WARNING [delegated > dependency] Executed: Missing roles requirements file: requirements.yml (Remove from dependency_sequence to suppress) 2026-07-20 09:53:21.464336 | debian-bookworm | WARNING Molecule executed 1 scenario (1 missing files) 2026-07-20 09:53:21.464409 | debian-bookworm | 2026-07-20 09:53:21.464425 | debian-bookworm | DETAILS 2026-07-20 09:53:21.464448 | debian-bookworm | delegated > dependency: Executed: Missing roles requirements file: requirements.yml (Remove from dependency_sequence to suppress) 2026-07-20 09:53:21.464461 | debian-bookworm | 2026-07-20 09:53:21.464472 | debian-bookworm | SCENARIO RECAP 2026-07-20 09:53:21.464484 | debian-bookworm | delegated : actions=1 successful=0 disabled=0 skipped=0 missing=1 failed=0 2026-07-20 09:53:21.464495 | debian-bookworm | 2026-07-20 09:53:21.627211 | debian-bookworm | ok: Runtime: 0:00:08.673834 2026-07-20 09:53:21.685704 | ubuntu-noble | ok: Runtime: 0:00:08.701856 2026-07-20 09:53:21.700839 | 2026-07-20 09:53:21.701024 | TASK [ansible-molecule : Run molecule create action with scenario delegated] 2026-07-20 09:53:22.256633 | debian-bookworm | skipping: Conditional result was False 2026-07-20 09:53:22.258162 | ubuntu-noble | skipping: Conditional result was False 2026-07-20 09:53:22.272316 | 2026-07-20 09:53:22.272516 | TASK [ansible-molecule : Run molecule prepare action with scenario delegated] 2026-07-20 09:53:23.027657 | ubuntu-noble | WARNING Molecule scenarios should migrate to 'extensions/molecule' 2026-07-20 09:53:23.037217 | ubuntu-noble | DEBUG [unknown > config] provisioner.env found in /home/zuul/src/github.com/osism/ansible-collection-services/molecule/delegated/molecule.yml, this can be defined in ansible.env 2026-07-20 09:53:22.829452 | debian-bookworm | WARNING Molecule scenarios should migrate to 'extensions/molecule' 2026-07-20 09:53:22.838021 | debian-bookworm | DEBUG [unknown > config] provisioner.env found in /home/zuul/src/github.com/osism/ansible-collection-services/molecule/delegated/molecule.yml, this can be defined in ansible.env 2026-07-20 09:53:23.763270 | ubuntu-noble | DEBUG [unknown > config] provisioner.env found in /home/zuul/src/github.com/osism/ansible-collection-services/molecule/delegated/molecule.yml, this can be defined in ansible.env 2026-07-20 09:53:23.763934 | ubuntu-noble | DEBUG [delegated > validate] Validating schema /home/zuul/src/github.com/osism/ansible-collection-services/molecule/delegated/molecule.yml. 2026-07-20 09:53:23.788469 | ubuntu-noble | DEBUG [default > validate] Validating schema /home/zuul/src/github.com/osism/ansible-collection-services/molecule/default/molecule.yml. 2026-07-20 09:53:23.794498 | ubuntu-noble | INFO [delegated > discovery] scenario test matrix: prepare 2026-07-20 09:53:23.794555 | ubuntu-noble | INFO [delegated > prerun] Performing prerun with role_name_check=0... 2026-07-20 09:53:23.364881 | debian-bookworm | DEBUG [unknown > config] provisioner.env found in /home/zuul/src/github.com/osism/ansible-collection-services/molecule/delegated/molecule.yml, this can be defined in ansible.env 2026-07-20 09:53:23.365450 | debian-bookworm | DEBUG [delegated > validate] Validating schema /home/zuul/src/github.com/osism/ansible-collection-services/molecule/delegated/molecule.yml. 2026-07-20 09:53:23.384046 | debian-bookworm | DEBUG [default > validate] Validating schema /home/zuul/src/github.com/osism/ansible-collection-services/molecule/default/molecule.yml. 2026-07-20 09:53:23.389200 | debian-bookworm | INFO [delegated > discovery] scenario test matrix: prepare 2026-07-20 09:53:23.389302 | debian-bookworm | INFO [delegated > prerun] Performing prerun with role_name_check=0... 2026-07-20 09:53:24.578038 | debian-bookworm | INFO [delegated > prepare] Executing 2026-07-20 09:53:24.961554 | debian-bookworm | DEBUG [delegated > prepare] ansible-playbook version: ansible-playbook 2026-07-20 09:53:24.961599 | debian-bookworm | config file = None 2026-07-20 09:53:24.961613 | debian-bookworm | configured module search path = 2026-07-20 09:53:24.961617 | debian-bookworm | ansible python module location = /home/zuul/venv/lib/python3.11/site-packages/ansible 2026-07-20 09:53:24.961624 | debian-bookworm | ansible collection location = /home/zuul/.ansible/collections:/usr/share/ansible/collections 2026-07-20 09:53:24.961628 | debian-bookworm | executable location = /home/zuul/venv/bin/ansible-playbook 2026-07-20 09:53:24.961632 | debian-bookworm | python version = 3.11.2 (main, May 12 2026, 05:17:27) (/home/zuul/venv/bin/python3) 2026-07-20 09:53:24.961636 | debian-bookworm | jinja version = 3.1.6 2026-07-20 09:53:24.961640 | debian-bookworm | pyyaml version = 6.0.3 (with libyaml v0.2.5) 2026-07-20 09:53:24.961827 | debian-bookworm | DEBUG ANSIBLE ENVIRONMENT: 2026-07-20 09:53:24.961833 | debian-bookworm | ANSIBLE_COLLECTIONS_PATH: /home/zuul/venv/.ansible/collections:/home/zuul/.ansible/collections 2026-07-20 09:53:24.961837 | debian-bookworm | ANSIBLE_CONFIG: /home/zuul/.ansible/tmp/molecule.oWZD.delegated/ansible.cfg 2026-07-20 09:53:24.961841 | debian-bookworm | ANSIBLE_LIBRARY: ../../plugins 2026-07-20 09:53:24.961845 | debian-bookworm | ANSIBLE_PYTHON_INTERPRETER: /home/zuul/venv/bin/python 2026-07-20 09:53:24.961849 | debian-bookworm | ANSIBLE_ROLE: auditd 2026-07-20 09:53:24.961853 | debian-bookworm | ANSIBLE_ROLES_PATH: ../../roles 2026-07-20 09:53:24.961857 | debian-bookworm | ANSIBLE_VERBOSITY: 1 2026-07-20 09:53:24.961860 | debian-bookworm | 2026-07-20 09:53:24.962069 | debian-bookworm | DEBUG MOLECULE ENVIRONMENT: 2026-07-20 09:53:24.962075 | debian-bookworm | MOLECULE_DEBUG: True 2026-07-20 09:53:24.962079 | debian-bookworm | MOLECULE_DEPENDENCY_NAME: galaxy 2026-07-20 09:53:24.962083 | debian-bookworm | MOLECULE_DRIVER_NAME: default 2026-07-20 09:53:24.962087 | debian-bookworm | MOLECULE_ENV_FILE: /home/zuul/src/github.com/osism/ansible-collection-services/.env.yml 2026-07-20 09:53:24.962090 | debian-bookworm | MOLECULE_EPHEMERAL_DIRECTORY: /home/zuul/.ansible/tmp/molecule.oWZD.delegated 2026-07-20 09:53:24.962094 | debian-bookworm | MOLECULE_FILE: /home/zuul/.ansible/tmp/molecule.oWZD.delegated/molecule.yml 2026-07-20 09:53:24.962098 | debian-bookworm | MOLECULE_INSTANCE_CONFIG: /home/zuul/.ansible/tmp/molecule.oWZD.delegated/instance_config.yml 2026-07-20 09:53:24.962102 | debian-bookworm | MOLECULE_INVENTORY_FILE: /home/zuul/.ansible/tmp/molecule.oWZD.delegated/inventory/ansible_inventory.yml 2026-07-20 09:53:24.962107 | debian-bookworm | MOLECULE_PROJECT_DIRECTORY: /home/zuul/src/github.com/osism/ansible-collection-services 2026-07-20 09:53:24.962111 | debian-bookworm | MOLECULE_PROVISIONER_NAME: ansible 2026-07-20 09:53:24.962115 | debian-bookworm | MOLECULE_SCENARIO_DIRECTORY: /home/zuul/src/github.com/osism/ansible-collection-services/molecule/delegated 2026-07-20 09:53:24.962118 | debian-bookworm | MOLECULE_SCENARIO_NAME: delegated 2026-07-20 09:53:24.962122 | debian-bookworm | MOLECULE_STATE_FILE: /home/zuul/.ansible/tmp/molecule.oWZD.delegated/state.yml 2026-07-20 09:53:24.962126 | debian-bookworm | MOLECULE_VERIFIER_NAME: testinfra 2026-07-20 09:53:24.962130 | debian-bookworm | MOLECULE_VERIFIER_TEST_DIRECTORY: /home/zuul/src/github.com/osism/ansible-collection-services/molecule/delegated/tests 2026-07-20 09:53:24.962134 | debian-bookworm | 2026-07-20 09:53:24.962262 | debian-bookworm | DEBUG SHELL REPLAY: ANSIBLE_COLLECTIONS_PATH=/home/zuul/venv/.ansible/collections:/home/zuul/.ansible/collections ANSIBLE_CONFIG=/home/zuul/.ansible/tmp/molecule.oWZD.delegated/ansible.cfg ANSIBLE_LIBRARY=../../plugins ANSIBLE_PYTHON_INTERPRETER=/home/zuul/venv/bin/python ANSIBLE_ROLE=auditd ANSIBLE_ROLES_PATH=../../roles ANSIBLE_VERBOSITY=1 MOLECULE_DEBUG=True MOLECULE_DEPENDENCY_NAME=galaxy MOLECULE_DRIVER_NAME=default MOLECULE_ENV_FILE=/home/zuul/src/github.com/osism/ansible-collection-services/.env.yml MOLECULE_EPHEMERAL_DIRECTORY=/home/zuul/.ansible/tmp/molecule.oWZD.delegated MOLECULE_FILE=/home/zuul/.ansible/tmp/molecule.oWZD.delegated/molecule.yml MOLECULE_INSTANCE_CONFIG=/home/zuul/.ansible/tmp/molecule.oWZD.delegated/instance_config.yml MOLECULE_INVENTORY_FILE=/home/zuul/.ansible/tmp/molecule.oWZD.delegated/inventory/ansible_inventory.yml MOLECULE_PROJECT_DIRECTORY=/home/zuul/src/github.com/osism/ansible-collection-services MOLECULE_PROVISIONER_NAME=ansible MOLECULE_SCENARIO_DIRECTORY=/home/zuul/src/github.com/osism/ansible-collection-services/molecule/delegated MOLECULE_SCENARIO_NAME=delegated MOLECULE_STATE_FILE=/home/zuul/.ansible/tmp/molecule.oWZD.delegated/state.yml MOLECULE_VERIFIER_NAME=testinfra MOLECULE_VERIFIER_TEST_DIRECTORY=/home/zuul/src/github.com/osism/ansible-collection-services/molecule/delegated/tests 2026-07-20 09:53:25.302134 | debian-bookworm | Using /home/zuul/.ansible/tmp/molecule.oWZD.delegated/ansible.cfg as config file 2026-07-20 09:53:25.569272 | ubuntu-noble | INFO [delegated > prepare] Executing 2026-07-20 09:53:25.528603 | debian-bookworm | 2026-07-20 09:53:25.529064 | debian-bookworm | PLAY [Prepare] ***************************************************************** 2026-07-20 09:53:25.529467 | debian-bookworm | 2026-07-20 09:53:25.529836 | debian-bookworm | TASK [Gathering Facts] ********************************************************* 2026-07-20 09:53:26.098331 | ubuntu-noble | DEBUG [delegated > prepare] ansible-playbook version: ansible-playbook 2026-07-20 09:53:26.098395 | ubuntu-noble | config file = None 2026-07-20 09:53:26.098413 | ubuntu-noble | configured module search path = 2026-07-20 09:53:26.098420 | ubuntu-noble | ansible python module location = /home/zuul/venv/lib/python3.12/site-packages/ansible 2026-07-20 09:53:26.098425 | ubuntu-noble | ansible collection location = /home/zuul/.ansible/collections:/usr/share/ansible/collections 2026-07-20 09:53:26.098429 | ubuntu-noble | executable location = /home/zuul/venv/bin/ansible-playbook 2026-07-20 09:53:26.098434 | ubuntu-noble | python version = 3.12.3 (main, Jun 19 2026, 12:46:00) (/home/zuul/venv/bin/python3) 2026-07-20 09:53:26.098437 | ubuntu-noble | jinja version = 3.1.6 2026-07-20 09:53:26.098441 | ubuntu-noble | pyyaml version = 6.0.3 (with libyaml v0.2.5) 2026-07-20 09:53:26.098980 | ubuntu-noble | DEBUG ANSIBLE ENVIRONMENT: 2026-07-20 09:53:26.098995 | ubuntu-noble | ANSIBLE_COLLECTIONS_PATH: /home/zuul/venv/.ansible/collections:/home/zuul/.ansible/collections 2026-07-20 09:53:26.099000 | ubuntu-noble | ANSIBLE_CONFIG: /home/zuul/.ansible/tmp/molecule.oWZD.delegated/ansible.cfg 2026-07-20 09:53:26.099003 | ubuntu-noble | ANSIBLE_LIBRARY: ../../plugins 2026-07-20 09:53:26.099007 | ubuntu-noble | ANSIBLE_PYTHON_INTERPRETER: /home/zuul/venv/bin/python 2026-07-20 09:53:26.099011 | ubuntu-noble | ANSIBLE_ROLE: auditd 2026-07-20 09:53:26.099015 | ubuntu-noble | ANSIBLE_ROLES_PATH: ../../roles 2026-07-20 09:53:26.099018 | ubuntu-noble | ANSIBLE_VERBOSITY: 1 2026-07-20 09:53:26.099022 | ubuntu-noble | 2026-07-20 09:53:26.099255 | ubuntu-noble | DEBUG MOLECULE ENVIRONMENT: 2026-07-20 09:53:26.099261 | ubuntu-noble | MOLECULE_DEBUG: True 2026-07-20 09:53:26.099265 | ubuntu-noble | MOLECULE_DEPENDENCY_NAME: galaxy 2026-07-20 09:53:26.099268 | ubuntu-noble | MOLECULE_DRIVER_NAME: default 2026-07-20 09:53:26.099272 | ubuntu-noble | MOLECULE_ENV_FILE: /home/zuul/src/github.com/osism/ansible-collection-services/.env.yml 2026-07-20 09:53:26.099275 | ubuntu-noble | MOLECULE_EPHEMERAL_DIRECTORY: /home/zuul/.ansible/tmp/molecule.oWZD.delegated 2026-07-20 09:53:26.099279 | ubuntu-noble | MOLECULE_FILE: /home/zuul/.ansible/tmp/molecule.oWZD.delegated/molecule.yml 2026-07-20 09:53:26.099283 | ubuntu-noble | MOLECULE_INSTANCE_CONFIG: /home/zuul/.ansible/tmp/molecule.oWZD.delegated/instance_config.yml 2026-07-20 09:53:26.099286 | ubuntu-noble | MOLECULE_INVENTORY_FILE: /home/zuul/.ansible/tmp/molecule.oWZD.delegated/inventory/ansible_inventory.yml 2026-07-20 09:53:26.099290 | ubuntu-noble | MOLECULE_PROJECT_DIRECTORY: /home/zuul/src/github.com/osism/ansible-collection-services 2026-07-20 09:53:26.099293 | ubuntu-noble | MOLECULE_PROVISIONER_NAME: ansible 2026-07-20 09:53:26.099297 | ubuntu-noble | MOLECULE_SCENARIO_DIRECTORY: /home/zuul/src/github.com/osism/ansible-collection-services/molecule/delegated 2026-07-20 09:53:26.099300 | ubuntu-noble | MOLECULE_SCENARIO_NAME: delegated 2026-07-20 09:53:26.099303 | ubuntu-noble | MOLECULE_STATE_FILE: /home/zuul/.ansible/tmp/molecule.oWZD.delegated/state.yml 2026-07-20 09:53:26.099307 | ubuntu-noble | MOLECULE_VERIFIER_NAME: testinfra 2026-07-20 09:53:26.099310 | ubuntu-noble | MOLECULE_VERIFIER_TEST_DIRECTORY: /home/zuul/src/github.com/osism/ansible-collection-services/molecule/delegated/tests 2026-07-20 09:53:26.099314 | ubuntu-noble | 2026-07-20 09:53:26.099544 | ubuntu-noble | DEBUG SHELL REPLAY: ANSIBLE_COLLECTIONS_PATH=/home/zuul/venv/.ansible/collections:/home/zuul/.ansible/collections ANSIBLE_CONFIG=/home/zuul/.ansible/tmp/molecule.oWZD.delegated/ansible.cfg ANSIBLE_LIBRARY=../../plugins ANSIBLE_PYTHON_INTERPRETER=/home/zuul/venv/bin/python ANSIBLE_ROLE=auditd ANSIBLE_ROLES_PATH=../../roles ANSIBLE_VERBOSITY=1 MOLECULE_DEBUG=True MOLECULE_DEPENDENCY_NAME=galaxy MOLECULE_DRIVER_NAME=default MOLECULE_ENV_FILE=/home/zuul/src/github.com/osism/ansible-collection-services/.env.yml MOLECULE_EPHEMERAL_DIRECTORY=/home/zuul/.ansible/tmp/molecule.oWZD.delegated MOLECULE_FILE=/home/zuul/.ansible/tmp/molecule.oWZD.delegated/molecule.yml MOLECULE_INSTANCE_CONFIG=/home/zuul/.ansible/tmp/molecule.oWZD.delegated/instance_config.yml MOLECULE_INVENTORY_FILE=/home/zuul/.ansible/tmp/molecule.oWZD.delegated/inventory/ansible_inventory.yml MOLECULE_PROJECT_DIRECTORY=/home/zuul/src/github.com/osism/ansible-collection-services MOLECULE_PROVISIONER_NAME=ansible MOLECULE_SCENARIO_DIRECTORY=/home/zuul/src/github.com/osism/ansible-collection-services/molecule/delegated MOLECULE_SCENARIO_NAME=delegated MOLECULE_STATE_FILE=/home/zuul/.ansible/tmp/molecule.oWZD.delegated/state.yml MOLECULE_VERIFIER_NAME=testinfra MOLECULE_VERIFIER_TEST_DIRECTORY=/home/zuul/src/github.com/osism/ansible-collection-services/molecule/delegated/tests 2026-07-20 09:53:26.548473 | ubuntu-noble | Using /home/zuul/.ansible/tmp/molecule.oWZD.delegated/ansible.cfg as config file 2026-07-20 09:53:26.659141 | debian-bookworm | ok: [molecule-auditd] 2026-07-20 09:53:26.659288 | debian-bookworm | 2026-07-20 09:53:26.659479 | debian-bookworm | TASK [Install packages in venv] ************************************************ 2026-07-20 09:53:26.851599 | ubuntu-noble | 2026-07-20 09:53:26.852176 | ubuntu-noble | PLAY [Prepare] ***************************************************************** 2026-07-20 09:53:26.853727 | ubuntu-noble | 2026-07-20 09:53:26.854038 | ubuntu-noble | TASK [Gathering Facts] ********************************************************* 2026-07-20 09:53:28.287213 | ubuntu-noble | ok: [molecule-auditd] 2026-07-20 09:53:28.287288 | ubuntu-noble | 2026-07-20 09:53:28.287778 | ubuntu-noble | TASK [Install packages in venv] ************************************************ 2026-07-20 09:53:30.818719 | debian-bookworm | changed: [molecule-auditd] => (item=docker) => {"ansible_loop_var": "item", "changed": true, "cmd": ["/home/zuul/venv/bin/pip3", "install", "docker"], "item": "docker", "name": ["docker"], "requirements": null, "state": "present", "stderr": "", "stderr_lines": [], "stdout": "Collecting docker\n Downloading docker-7.2.0-py3-none-any.whl (148 kB)\n ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ 148.8/148.8 kB 4.3 MB/s eta 0:00:00\nRequirement already satisfied: requests>=2.26.0 in /home/zuul/venv/lib/python3.11/site-packages (from docker) (2.34.2)\nRequirement already satisfied: urllib3>=1.26.0 in /home/zuul/venv/lib/python3.11/site-packages (from docker) (2.7.0)\nRequirement already satisfied: charset_normalizer<4,>=2 in /home/zuul/venv/lib/python3.11/site-packages (from requests>=2.26.0->docker) (3.4.9)\nRequirement already satisfied: idna<4,>=2.5 in /home/zuul/venv/lib/python3.11/site-packages (from requests>=2.26.0->docker) (3.18)\nRequirement already satisfied: certifi>=2023.5.7 in /home/zuul/venv/lib/python3.11/site-packages (from requests>=2.26.0->docker) (2026.6.17)\nInstalling collected packages: docker\nSuccessfully installed docker-7.2.0\n", "stdout_lines": ["Collecting docker", " Downloading docker-7.2.0-py3-none-any.whl (148 kB)", " ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ 148.8/148.8 kB 4.3 MB/s eta 0:00:00", "Requirement already satisfied: requests>=2.26.0 in /home/zuul/venv/lib/python3.11/site-packages (from docker) (2.34.2)", "Requirement already satisfied: urllib3>=1.26.0 in /home/zuul/venv/lib/python3.11/site-packages (from docker) (2.7.0)", "Requirement already satisfied: charset_normalizer<4,>=2 in /home/zuul/venv/lib/python3.11/site-packages (from requests>=2.26.0->docker) (3.4.9)", "Requirement already satisfied: idna<4,>=2.5 in /home/zuul/venv/lib/python3.11/site-packages (from requests>=2.26.0->docker) (3.18)", "Requirement already satisfied: certifi>=2023.5.7 in /home/zuul/venv/lib/python3.11/site-packages (from requests>=2.26.0->docker) (2026.6.17)", "Installing collected packages: docker", "Successfully installed docker-7.2.0"], "version": null, "virtualenv": "/home/zuul/venv"} 2026-07-20 09:53:30.819249 | debian-bookworm | changed: [molecule-auditd] => (item=netaddr) => {"ansible_loop_var": "item", "changed": true, "cmd": ["/home/zuul/venv/bin/pip3", "install", "netaddr"], "item": "netaddr", "name": ["netaddr"], "requirements": null, "state": "present", "stderr": "", "stderr_lines": [], "stdout": "Collecting netaddr\n Downloading netaddr-1.3.0-py3-none-any.whl (2.3 MB)\n ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ 2.3/2.3 MB 10.9 MB/s eta 0:00:00\nInstalling collected packages: netaddr\nSuccessfully installed netaddr-1.3.0\n", "stdout_lines": ["Collecting netaddr", " Downloading netaddr-1.3.0-py3-none-any.whl (2.3 MB)", " ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ 2.3/2.3 MB 10.9 MB/s eta 0:00:00", "Installing collected packages: netaddr", "Successfully installed netaddr-1.3.0"], "version": null, "virtualenv": "/home/zuul/venv"} 2026-07-20 09:53:30.819449 | debian-bookworm | ok: [molecule-auditd] => (item=requests) => {"ansible_loop_var": "item", "changed": false, "cmd": ["/home/zuul/venv/bin/pip3", "install", "requests"], "item": "requests", "name": ["requests"], "requirements": null, "state": "present", "stderr": "", "stderr_lines": [], "stdout": "Requirement already satisfied: requests in /home/zuul/venv/lib/python3.11/site-packages (2.34.2)\nRequirement already satisfied: charset_normalizer<4,>=2 in /home/zuul/venv/lib/python3.11/site-packages (from requests) (3.4.9)\nRequirement already satisfied: idna<4,>=2.5 in /home/zuul/venv/lib/python3.11/site-packages (from requests) (3.18)\nRequirement already satisfied: urllib3<3,>=1.26 in /home/zuul/venv/lib/python3.11/site-packages (from requests) (2.7.0)\nRequirement already satisfied: certifi>=2023.5.7 in /home/zuul/venv/lib/python3.11/site-packages (from requests) (2026.6.17)\n", "stdout_lines": ["Requirement already satisfied: requests in /home/zuul/venv/lib/python3.11/site-packages (2.34.2)", "Requirement already satisfied: charset_normalizer<4,>=2 in /home/zuul/venv/lib/python3.11/site-packages (from requests) (3.4.9)", "Requirement already satisfied: idna<4,>=2.5 in /home/zuul/venv/lib/python3.11/site-packages (from requests) (3.18)", "Requirement already satisfied: urllib3<3,>=1.26 in /home/zuul/venv/lib/python3.11/site-packages (from requests) (2.7.0)", "Requirement already satisfied: certifi>=2023.5.7 in /home/zuul/venv/lib/python3.11/site-packages (from requests) (2026.6.17)"], "version": null, "virtualenv": "/home/zuul/venv"} 2026-07-20 09:53:30.819595 | debian-bookworm | 2026-07-20 09:53:30.819755 | debian-bookworm | TASK [Include required prepare tasks] ****************************************** 2026-07-20 09:53:30.835639 | debian-bookworm | included: /home/zuul/src/github.com/osism/ansible-collection-services/molecule/delegated/prepare/auditd.yml for molecule-auditd 2026-07-20 09:53:30.835813 | debian-bookworm | 2026-07-20 09:53:30.836048 | debian-bookworm | PLAY RECAP ********************************************************************* 2026-07-20 09:53:30.836251 | debian-bookworm | molecule-auditd : ok=3 changed=1 unreachable=0 failed=0 skipped=0 rescued=0 ignored=0 2026-07-20 09:53:30.836426 | debian-bookworm | 2026-07-20 09:53:30.912738 | debian-bookworm | INFO [delegated > prepare] Executed: Successful 2026-07-20 09:53:30.913263 | debian-bookworm | INFO Molecule executed 1 scenario (1 successful) 2026-07-20 09:53:30.913330 | debian-bookworm | 2026-07-20 09:53:30.913339 | debian-bookworm | DETAILS 2026-07-20 09:53:30.913418 | debian-bookworm | delegated > prepare: Executed: Successful 2026-07-20 09:53:30.913426 | debian-bookworm | 2026-07-20 09:53:30.913622 | debian-bookworm | SCENARIO RECAP 2026-07-20 09:53:30.913629 | debian-bookworm | delegated : actions=1 successful=1 disabled=0 skipped=0 missing=0 failed=0 2026-07-20 09:53:30.913634 | debian-bookworm | 2026-07-20 09:53:31.337316 | debian-bookworm | ok: Runtime: 0:00:08.399582 2026-07-20 09:53:33.684272 | ubuntu-noble | changed: [molecule-auditd] => (item=docker) => {"ansible_loop_var": "item", "changed": true, "cmd": ["/home/zuul/venv/bin/pip3", "install", "docker"], "item": "docker", "name": ["docker"], "requirements": null, "state": "present", "stderr": "", "stderr_lines": [], "stdout": "Collecting docker\n Downloading docker-7.2.0-py3-none-any.whl.metadata (3.8 kB)\nRequirement already satisfied: requests>=2.26.0 in /home/zuul/venv/lib/python3.12/site-packages (from docker) (2.34.2)\nRequirement already satisfied: urllib3>=1.26.0 in /home/zuul/venv/lib/python3.12/site-packages (from docker) (2.7.0)\nRequirement already satisfied: charset_normalizer<4,>=2 in /home/zuul/venv/lib/python3.12/site-packages (from requests>=2.26.0->docker) (3.4.9)\nRequirement already satisfied: idna<4,>=2.5 in /home/zuul/venv/lib/python3.12/site-packages (from requests>=2.26.0->docker) (3.18)\nRequirement already satisfied: certifi>=2023.5.7 in /home/zuul/venv/lib/python3.12/site-packages (from requests>=2.26.0->docker) (2026.6.17)\nDownloading docker-7.2.0-py3-none-any.whl (148 kB)\n ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ 148.8/148.8 kB 4.0 MB/s eta 0:00:00\nInstalling collected packages: docker\nSuccessfully installed docker-7.2.0\n", "stdout_lines": ["Collecting docker", " Downloading docker-7.2.0-py3-none-any.whl.metadata (3.8 kB)", "Requirement already satisfied: requests>=2.26.0 in /home/zuul/venv/lib/python3.12/site-packages (from docker) (2.34.2)", "Requirement already satisfied: urllib3>=1.26.0 in /home/zuul/venv/lib/python3.12/site-packages (from docker) (2.7.0)", "Requirement already satisfied: charset_normalizer<4,>=2 in /home/zuul/venv/lib/python3.12/site-packages (from requests>=2.26.0->docker) (3.4.9)", "Requirement already satisfied: idna<4,>=2.5 in /home/zuul/venv/lib/python3.12/site-packages (from requests>=2.26.0->docker) (3.18)", "Requirement already satisfied: certifi>=2023.5.7 in /home/zuul/venv/lib/python3.12/site-packages (from requests>=2.26.0->docker) (2026.6.17)", "Downloading docker-7.2.0-py3-none-any.whl (148 kB)", " ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ 148.8/148.8 kB 4.0 MB/s eta 0:00:00", "Installing collected packages: docker", "Successfully installed docker-7.2.0"], "version": null, "virtualenv": "/home/zuul/venv"} 2026-07-20 09:53:33.685971 | ubuntu-noble | changed: [molecule-auditd] => (item=netaddr) => {"ansible_loop_var": "item", "changed": true, "cmd": ["/home/zuul/venv/bin/pip3", "install", "netaddr"], "item": "netaddr", "name": ["netaddr"], "requirements": null, "state": "present", "stderr": "", "stderr_lines": [], "stdout": "Collecting netaddr\n Downloading netaddr-1.3.0-py3-none-any.whl.metadata (5.0 kB)\nDownloading netaddr-1.3.0-py3-none-any.whl (2.3 MB)\n ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ 2.3/2.3 MB 21.9 MB/s eta 0:00:00\nInstalling collected packages: netaddr\nSuccessfully installed netaddr-1.3.0\n", "stdout_lines": ["Collecting netaddr", " Downloading netaddr-1.3.0-py3-none-any.whl.metadata (5.0 kB)", "Downloading netaddr-1.3.0-py3-none-any.whl (2.3 MB)", " ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ 2.3/2.3 MB 21.9 MB/s eta 0:00:00", "Installing collected packages: netaddr", "Successfully installed netaddr-1.3.0"], "version": null, "virtualenv": "/home/zuul/venv"} 2026-07-20 09:53:33.686463 | ubuntu-noble | ok: [molecule-auditd] => (item=requests) => {"ansible_loop_var": "item", "changed": false, "cmd": ["/home/zuul/venv/bin/pip3", "install", "requests"], "item": "requests", "name": ["requests"], "requirements": null, "state": "present", "stderr": "", "stderr_lines": [], "stdout": "Requirement already satisfied: requests in /home/zuul/venv/lib/python3.12/site-packages (2.34.2)\nRequirement already satisfied: charset_normalizer<4,>=2 in /home/zuul/venv/lib/python3.12/site-packages (from requests) (3.4.9)\nRequirement already satisfied: idna<4,>=2.5 in /home/zuul/venv/lib/python3.12/site-packages (from requests) (3.18)\nRequirement already satisfied: urllib3<3,>=1.26 in /home/zuul/venv/lib/python3.12/site-packages (from requests) (2.7.0)\nRequirement already satisfied: certifi>=2023.5.7 in /home/zuul/venv/lib/python3.12/site-packages (from requests) (2026.6.17)\n", "stdout_lines": ["Requirement already satisfied: requests in /home/zuul/venv/lib/python3.12/site-packages (2.34.2)", "Requirement already satisfied: charset_normalizer<4,>=2 in /home/zuul/venv/lib/python3.12/site-packages (from requests) (3.4.9)", "Requirement already satisfied: idna<4,>=2.5 in /home/zuul/venv/lib/python3.12/site-packages (from requests) (3.18)", "Requirement already satisfied: urllib3<3,>=1.26 in /home/zuul/venv/lib/python3.12/site-packages (from requests) (2.7.0)", "Requirement already satisfied: certifi>=2023.5.7 in /home/zuul/venv/lib/python3.12/site-packages (from requests) (2026.6.17)"], "version": null, "virtualenv": "/home/zuul/venv"} 2026-07-20 09:53:33.686922 | ubuntu-noble | 2026-07-20 09:53:33.687299 | ubuntu-noble | TASK [Include required prepare tasks] ****************************************** 2026-07-20 09:53:33.716489 | ubuntu-noble | included: /home/zuul/src/github.com/osism/ansible-collection-services/molecule/delegated/prepare/auditd.yml for molecule-auditd 2026-07-20 09:53:33.717294 | ubuntu-noble | 2026-07-20 09:53:33.717802 | ubuntu-noble | PLAY RECAP ********************************************************************* 2026-07-20 09:53:33.718296 | ubuntu-noble | molecule-auditd : ok=3 changed=1 unreachable=0 failed=0 skipped=0 rescued=0 ignored=0 2026-07-20 09:53:33.718834 | ubuntu-noble | 2026-07-20 09:53:34.098755 | ubuntu-noble | ok: Runtime: 0:00:11.382559 2026-07-20 09:53:34.106141 | 2026-07-20 09:53:34.106295 | TASK [ansible-molecule : Reset connection] 2026-07-20 09:53:34.136759 | 2026-07-20 09:53:34.136901 | TASK [ansible-molecule : Reset connection] 2026-07-20 09:53:34.163642 | 2026-07-20 09:53:34.163863 | TASK [ansible-molecule : Run molecule converge action with scenario delegated] 2026-07-20 09:53:33.940424 | ubuntu-noble | INFO [delegated > prepare] Executed: Successful 2026-07-20 09:53:33.941374 | ubuntu-noble | INFO Molecule executed 1 scenario (1 successful) 2026-07-20 09:53:33.941516 | ubuntu-noble | 2026-07-20 09:53:33.941562 | ubuntu-noble | DETAILS 2026-07-20 09:53:33.941744 | ubuntu-noble | delegated > prepare: Executed: Successful 2026-07-20 09:53:33.941791 | ubuntu-noble | 2026-07-20 09:53:33.942067 | ubuntu-noble | SCENARIO RECAP 2026-07-20 09:53:33.942134 | ubuntu-noble | delegated : actions=1 successful=1 disabled=0 skipped=0 missing=0 failed=0 2026-07-20 09:53:33.942147 | ubuntu-noble | 2026-07-20 09:53:35.123840 | ubuntu-noble | WARNING Molecule scenarios should migrate to 'extensions/molecule' 2026-07-20 09:53:35.131673 | ubuntu-noble | DEBUG [unknown > config] provisioner.env found in /home/zuul/src/github.com/osism/ansible-collection-services/molecule/delegated/molecule.yml, this can be defined in ansible.env 2026-07-20 09:53:34.990967 | debian-bookworm | WARNING Molecule scenarios should migrate to 'extensions/molecule' 2026-07-20 09:53:35.000383 | debian-bookworm | DEBUG [unknown > config] provisioner.env found in /home/zuul/src/github.com/osism/ansible-collection-services/molecule/delegated/molecule.yml, this can be defined in ansible.env 2026-07-20 09:53:35.608510 | debian-bookworm | DEBUG [unknown > config] provisioner.env found in /home/zuul/src/github.com/osism/ansible-collection-services/molecule/delegated/molecule.yml, this can be defined in ansible.env 2026-07-20 09:53:35.609138 | debian-bookworm | DEBUG [delegated > validate] Validating schema /home/zuul/src/github.com/osism/ansible-collection-services/molecule/delegated/molecule.yml. 2026-07-20 09:53:35.629332 | debian-bookworm | DEBUG [default > validate] Validating schema /home/zuul/src/github.com/osism/ansible-collection-services/molecule/default/molecule.yml. 2026-07-20 09:53:35.634719 | debian-bookworm | INFO [delegated > discovery] scenario test matrix: dependency, create, prepare, converge 2026-07-20 09:53:35.634974 | debian-bookworm | INFO [delegated > prerun] Performing prerun with role_name_check=0... 2026-07-20 09:53:35.914147 | ubuntu-noble | DEBUG [unknown > config] provisioner.env found in /home/zuul/src/github.com/osism/ansible-collection-services/molecule/delegated/molecule.yml, this can be defined in ansible.env 2026-07-20 09:53:35.915165 | ubuntu-noble | DEBUG [delegated > validate] Validating schema /home/zuul/src/github.com/osism/ansible-collection-services/molecule/delegated/molecule.yml. 2026-07-20 09:53:35.941144 | ubuntu-noble | DEBUG [default > validate] Validating schema /home/zuul/src/github.com/osism/ansible-collection-services/molecule/default/molecule.yml. 2026-07-20 09:53:35.949810 | ubuntu-noble | INFO [delegated > discovery] scenario test matrix: dependency, create, prepare, converge 2026-07-20 09:53:35.949915 | ubuntu-noble | INFO [delegated > prerun] Performing prerun with role_name_check=0... 2026-07-20 09:53:37.011752 | debian-bookworm | INFO [delegated > dependency] Executing 2026-07-20 09:53:37.012094 | debian-bookworm | WARNING [delegated > dependency] Missing roles requirements file: requirements.yml 2026-07-20 09:53:37.463475 | ubuntu-noble | INFO [delegated > dependency] Executing 2026-07-20 09:53:37.464036 | ubuntu-noble | WARNING [delegated > dependency] Missing roles requirements file: requirements.yml 2026-07-20 09:53:37.450920 | debian-bookworm | ansible-galaxy [core 2.19.11] 2026-07-20 09:53:37.451310 | debian-bookworm | config file = None 2026-07-20 09:53:37.451771 | debian-bookworm | configured module search path = ['/home/zuul/src/github.com/osism/ansible-collection-services/plugins/modules', '/home/zuul/.ansible/plugins/modules', '/usr/share/ansible/plugins/modules'] 2026-07-20 09:53:37.452231 | debian-bookworm | ansible python module location = /home/zuul/venv/lib/python3.11/site-packages/ansible 2026-07-20 09:53:37.452642 | debian-bookworm | ansible collection location = /home/zuul/.ansible/collections:/usr/share/ansible/collections:/home/zuul/venv/lib/python3.11/site-packages:/home/zuul/venv/lib/python3.11/dist-packages:/home/zuul/venv/lib/python3/dist-packages:/home/zuul/venv/local/lib/python3.11/dist-packages 2026-07-20 09:53:37.453025 | debian-bookworm | executable location = /home/zuul/venv/bin/ansible-galaxy 2026-07-20 09:53:37.453338 | debian-bookworm | python version = 3.11.2 (main, May 12 2026, 05:17:27) [GCC 12.2.0] (/home/zuul/venv/bin/python3) 2026-07-20 09:53:37.453686 | debian-bookworm | jinja version = 3.1.6 2026-07-20 09:53:37.454011 | debian-bookworm | pyyaml version = 6.0.3 (with libyaml v0.2.5) 2026-07-20 09:53:37.454302 | debian-bookworm | No config file found; using defaults 2026-07-20 09:53:37.454819 | debian-bookworm | Reading requirement file at '/home/zuul/src/github.com/osism/ansible-collection-services/molecule/delegated/collections.yml' 2026-07-20 09:53:37.458849 | debian-bookworm | Loading collection ansible._protomatter from /home/zuul/venv/lib/python3.11/site-packages/ansible/_internal/ansible_collections/ansible/_protomatter 2026-07-20 09:53:37.459160 | debian-bookworm | Found installed collection ansible._protomatter:2.19.11 at '/home/zuul/venv/lib/python3.11/site-packages/ansible/_internal/ansible_collections/ansible/_protomatter' 2026-07-20 09:53:37.464736 | debian-bookworm | Loading collection theforeman.foreman from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/theforeman/foreman 2026-07-20 09:53:37.465111 | debian-bookworm | Found installed collection theforeman.foreman:5.7.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/theforeman/foreman' 2026-07-20 09:53:37.465862 | debian-bookworm | Loading collection cloudscale_ch.cloud from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/cloudscale_ch/cloud 2026-07-20 09:53:37.466218 | debian-bookworm | Found installed collection cloudscale_ch.cloud:2.5.2 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/cloudscale_ch/cloud' 2026-07-20 09:53:37.471880 | debian-bookworm | Loading collection fortinet.fortimanager from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/fortinet/fortimanager 2026-07-20 09:53:37.472364 | debian-bookworm | Found installed collection fortinet.fortimanager:2.11.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/fortinet/fortimanager' 2026-07-20 09:53:37.472677 | debian-bookworm | Loading collection microsoft.ad from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/microsoft/ad 2026-07-20 09:53:37.473035 | debian-bookworm | Found installed collection microsoft.ad:1.10.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/microsoft/ad' 2026-07-20 09:53:37.473933 | debian-bookworm | Loading collection cisco.aci from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/cisco/aci 2026-07-20 09:53:37.474286 | debian-bookworm | Found installed collection cisco.aci:2.13.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/cisco/aci' 2026-07-20 09:53:37.476001 | debian-bookworm | Loading collection community.crypto from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/crypto 2026-07-20 09:53:37.476335 | debian-bookworm | Found installed collection community.crypto:3.0.5 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/crypto' 2026-07-20 09:53:37.476639 | debian-bookworm | Loading collection community.zabbix from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/zabbix 2026-07-20 09:53:37.477055 | debian-bookworm | Found installed collection community.zabbix:4.1.1 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/zabbix' 2026-07-20 09:53:37.477317 | debian-bookworm | Loading collection infoblox.nios_modules from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/infoblox/nios_modules 2026-07-20 09:53:37.477584 | debian-bookworm | Found installed collection infoblox.nios_modules:1.8.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/infoblox/nios_modules' 2026-07-20 09:53:37.477967 | debian-bookworm | Loading collection community.windows from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/windows 2026-07-20 09:53:37.478572 | debian-bookworm | Found installed collection community.windows:3.1.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/windows' 2026-07-20 09:53:37.479065 | debian-bookworm | Loading collection cisco.ios from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/cisco/ios 2026-07-20 09:53:37.479347 | debian-bookworm | Found installed collection cisco.ios:11.1.1 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/cisco/ios' 2026-07-20 09:53:37.479793 | debian-bookworm | Loading collection vultr.cloud from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/vultr/cloud 2026-07-20 09:53:37.480078 | debian-bookworm | Found installed collection vultr.cloud:1.13.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/vultr/cloud' 2026-07-20 09:53:37.481464 | debian-bookworm | Loading collection cisco.nxos from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/cisco/nxos 2026-07-20 09:53:37.481765 | debian-bookworm | Found installed collection cisco.nxos:11.1.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/cisco/nxos' 2026-07-20 09:53:37.482634 | debian-bookworm | Loading collection arista.eos from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/arista/eos 2026-07-20 09:53:37.482929 | debian-bookworm | Found installed collection arista.eos:12.0.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/arista/eos' 2026-07-20 09:53:37.485012 | debian-bookworm | Loading collection awx.awx from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/awx/awx 2026-07-20 09:53:37.485364 | debian-bookworm | Found installed collection awx.awx:24.6.1 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/awx/awx' 2026-07-20 09:53:37.485646 | debian-bookworm | Loading collection grafana.grafana from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/grafana/grafana 2026-07-20 09:53:37.485945 | debian-bookworm | Found installed collection grafana.grafana:6.0.6 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/grafana/grafana' 2026-07-20 09:53:37.487592 | debian-bookworm | Loading collection community.vmware from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/vmware 2026-07-20 09:53:37.487892 | debian-bookworm | Found installed collection community.vmware:5.10.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/vmware' 2026-07-20 09:53:37.488168 | debian-bookworm | Loading collection ibm.storage_virtualize from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/ibm/storage_virtualize 2026-07-20 09:53:37.488443 | debian-bookworm | Found installed collection ibm.storage_virtualize:2.7.4 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/ibm/storage_virtualize' 2026-07-20 09:53:37.488737 | debian-bookworm | Loading collection ieisystem.inmanage from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/ieisystem/inmanage 2026-07-20 09:53:37.489647 | debian-bookworm | Found installed collection ieisystem.inmanage:3.0.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/ieisystem/inmanage' 2026-07-20 09:53:37.490198 | debian-bookworm | Loading collection check_point.mgmt from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/check_point/mgmt 2026-07-20 09:53:37.490622 | debian-bookworm | Found installed collection check_point.mgmt:6.7.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/check_point/mgmt' 2026-07-20 09:53:37.491064 | debian-bookworm | Loading collection community.rabbitmq from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/rabbitmq 2026-07-20 09:53:37.491367 | debian-bookworm | Found installed collection community.rabbitmq:1.6.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/rabbitmq' 2026-07-20 09:53:37.491660 | debian-bookworm | Loading collection inspur.ispim from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/inspur/ispim 2026-07-20 09:53:37.491972 | debian-bookworm | Found installed collection inspur.ispim:2.2.4 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/inspur/ispim' 2026-07-20 09:53:37.492362 | debian-bookworm | Loading collection infinidat.infinibox from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/infinidat/infinibox 2026-07-20 09:53:37.492654 | debian-bookworm | Found installed collection infinidat.infinibox:1.6.3 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/infinidat/infinibox' 2026-07-20 09:53:37.492963 | debian-bookworm | Loading collection cyberark.pas from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/cyberark/pas 2026-07-20 09:53:37.493256 | debian-bookworm | Found installed collection cyberark.pas:1.0.36 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/cyberark/pas' 2026-07-20 09:53:37.493641 | debian-bookworm | Loading collection netapp.ontap from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/netapp/ontap 2026-07-20 09:53:37.493972 | debian-bookworm | Found installed collection netapp.ontap:23.2.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/netapp/ontap' 2026-07-20 09:53:37.494367 | debian-bookworm | Loading collection vyos.vyos from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/vyos/vyos 2026-07-20 09:53:37.494695 | debian-bookworm | Found installed collection vyos.vyos:6.0.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/vyos/vyos' 2026-07-20 09:53:37.495503 | debian-bookworm | Loading collection hetzner.hcloud from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/hetzner/hcloud 2026-07-20 09:53:37.495887 | debian-bookworm | Found installed collection hetzner.hcloud:5.4.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/hetzner/hcloud' 2026-07-20 09:53:37.497608 | debian-bookworm | Loading collection azure.azcollection from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/azure/azcollection 2026-07-20 09:53:37.498005 | debian-bookworm | Found installed collection azure.azcollection:3.12.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/azure/azcollection' 2026-07-20 09:53:37.498341 | debian-bookworm | Loading collection community.proxmox from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/proxmox 2026-07-20 09:53:37.498765 | debian-bookworm | Found installed collection community.proxmox:1.4.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/proxmox' 2026-07-20 09:53:37.499112 | debian-bookworm | Loading collection community.postgresql from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/postgresql 2026-07-20 09:53:37.499450 | debian-bookworm | Found installed collection community.postgresql:4.2.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/postgresql' 2026-07-20 09:53:37.499908 | debian-bookworm | Loading collection dellemc.openmanage from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/dellemc/openmanage 2026-07-20 09:53:37.500246 | debian-bookworm | Found installed collection dellemc.openmanage:9.12.3 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/dellemc/openmanage' 2026-07-20 09:53:37.500584 | debian-bookworm | Loading collection community.mongodb from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/mongodb 2026-07-20 09:53:37.500941 | debian-bookworm | Found installed collection community.mongodb:1.7.10 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/mongodb' 2026-07-20 09:53:37.509975 | debian-bookworm | Loading collection community.general from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/general 2026-07-20 09:53:37.510320 | debian-bookworm | Found installed collection community.general:11.4.2 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/general' 2026-07-20 09:53:37.510752 | debian-bookworm | Loading collection community.libvirt from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/libvirt 2026-07-20 09:53:37.510989 | debian-bookworm | Found installed collection community.libvirt:2.0.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/libvirt' 2026-07-20 09:53:37.511740 | debian-bookworm | Loading collection google.cloud from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/google/cloud 2026-07-20 09:53:37.512090 | debian-bookworm | Found installed collection google.cloud:1.10.2 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/google/cloud' 2026-07-20 09:53:37.512421 | debian-bookworm | Loading collection community.docker from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/docker 2026-07-20 09:53:37.512777 | debian-bookworm | Found installed collection community.docker:4.8.5 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/docker' 2026-07-20 09:53:37.514055 | debian-bookworm | Loading collection cisco.mso from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/cisco/mso 2026-07-20 09:53:37.514341 | debian-bookworm | Found installed collection cisco.mso:2.12.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/cisco/mso' 2026-07-20 09:53:37.514673 | debian-bookworm | Loading collection ravendb.ravendb from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/ravendb/ravendb 2026-07-20 09:53:37.514968 | debian-bookworm | Found installed collection ravendb.ravendb:1.0.4 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/ravendb/ravendb' 2026-07-20 09:53:37.515247 | debian-bookworm | Loading collection community.routeros from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/routeros 2026-07-20 09:53:37.515523 | debian-bookworm | Found installed collection community.routeros:3.14.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/routeros' 2026-07-20 09:53:37.516371 | debian-bookworm | Loading collection community.digitalocean from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/digitalocean 2026-07-20 09:53:37.516641 | debian-bookworm | Found installed collection community.digitalocean:1.27.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/digitalocean' 2026-07-20 09:53:37.517131 | debian-bookworm | Loading collection wti.remote from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/wti/remote 2026-07-20 09:53:37.517405 | debian-bookworm | Found installed collection wti.remote:1.0.10 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/wti/remote' 2026-07-20 09:53:37.517897 | debian-bookworm | Loading collection ibm.qradar from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/ibm/qradar 2026-07-20 09:53:37.518172 | debian-bookworm | Found installed collection ibm.qradar:4.0.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/ibm/qradar' 2026-07-20 09:53:37.519800 | debian-bookworm | Loading collection dellemc.enterprise_sonic from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/dellemc/enterprise_sonic 2026-07-20 09:53:37.520228 | debian-bookworm | Found installed collection dellemc.enterprise_sonic:3.2.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/dellemc/enterprise_sonic' 2026-07-20 09:53:37.520546 | debian-bookworm | Loading collection microsoft.iis from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/microsoft/iis 2026-07-20 09:53:37.520847 | debian-bookworm | Found installed collection microsoft.iis:1.1.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/microsoft/iis' 2026-07-20 09:53:37.521129 | debian-bookworm | Loading collection ansible.netcommon from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/ansible/netcommon 2026-07-20 09:53:37.521341 | debian-bookworm | Found installed collection ansible.netcommon:8.2.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/ansible/netcommon' 2026-07-20 09:53:37.521618 | debian-bookworm | Loading collection netapp_eseries.santricity from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/netapp_eseries/santricity 2026-07-20 09:53:37.521919 | debian-bookworm | Found installed collection netapp_eseries.santricity:1.4.1 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/netapp_eseries/santricity' 2026-07-20 09:53:37.522486 | debian-bookworm | Loading collection dellemc.unity from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/dellemc/unity 2026-07-20 09:53:37.522793 | debian-bookworm | Found installed collection dellemc.unity:2.1.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/dellemc/unity' 2026-07-20 09:53:37.523425 | debian-bookworm | Loading collection splunk.es from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/splunk/es 2026-07-20 09:53:37.523706 | debian-bookworm | Found installed collection splunk.es:4.0.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/splunk/es' 2026-07-20 09:53:37.524074 | debian-bookworm | Loading collection netapp.storagegrid from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/netapp/storagegrid 2026-07-20 09:53:37.524351 | debian-bookworm | Found installed collection netapp.storagegrid:21.15.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/netapp/storagegrid' 2026-07-20 09:53:37.524626 | debian-bookworm | Loading collection hitachivantara.vspone_object from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/hitachivantara/vspone_object 2026-07-20 09:53:37.524929 | debian-bookworm | Found installed collection hitachivantara.vspone_object:1.1.1 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/hitachivantara/vspone_object' 2026-07-20 09:53:37.525200 | debian-bookworm | Loading collection community.hrobot from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/hrobot 2026-07-20 09:53:37.525473 | debian-bookworm | Found installed collection community.hrobot:2.7.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/hrobot' 2026-07-20 09:53:37.525962 | debian-bookworm | Loading collection vmware.vmware from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/vmware/vmware 2026-07-20 09:53:37.526235 | debian-bookworm | Found installed collection vmware.vmware:2.6.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/vmware/vmware' 2026-07-20 09:53:37.526892 | debian-bookworm | Loading collection ngine_io.cloudstack from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/ngine_io/cloudstack 2026-07-20 09:53:37.527168 | debian-bookworm | Found installed collection ngine_io.cloudstack:2.5.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/ngine_io/cloudstack' 2026-07-20 09:53:37.529384 | debian-bookworm | Loading collection vmware.vmware_rest from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/vmware/vmware_rest 2026-07-20 09:53:37.529653 | debian-bookworm | Found installed collection vmware.vmware_rest:4.9.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/vmware/vmware_rest' 2026-07-20 09:53:37.530629 | debian-bookworm | Loading collection junipernetworks.junos from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/junipernetworks/junos 2026-07-20 09:53:37.530953 | debian-bookworm | Found installed collection junipernetworks.junos:11.0.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/junipernetworks/junos' 2026-07-20 09:53:37.532455 | debian-bookworm | Loading collection cisco.meraki from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/cisco/meraki 2026-07-20 09:53:37.532748 | debian-bookworm | Found installed collection cisco.meraki:2.21.9 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/cisco/meraki' 2026-07-20 09:53:37.533041 | debian-bookworm | Loading collection chocolatey.chocolatey from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/chocolatey/chocolatey 2026-07-20 09:53:37.533337 | debian-bookworm | Found installed collection chocolatey.chocolatey:1.5.3 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/chocolatey/chocolatey' 2026-07-20 09:53:37.533820 | debian-bookworm | Loading collection telekom_mms.icinga_director from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/telekom_mms/icinga_director 2026-07-20 09:53:37.534099 | debian-bookworm | Found installed collection telekom_mms.icinga_director:2.5.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/telekom_mms/icinga_director' 2026-07-20 09:53:37.534482 | debian-bookworm | Loading collection ansible.windows from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/ansible/windows 2026-07-20 09:53:37.534736 | debian-bookworm | Found installed collection ansible.windows:3.3.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/ansible/windows' 2026-07-20 09:53:37.535933 | debian-bookworm | Loading collection amazon.aws from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/amazon/aws 2026-07-20 09:53:37.536250 | debian-bookworm | Found installed collection amazon.aws:10.1.2 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/amazon/aws' 2026-07-20 09:53:37.536841 | debian-bookworm | Loading collection ovirt.ovirt from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/ovirt/ovirt 2026-07-20 09:53:37.537170 | debian-bookworm | Found installed collection ovirt.ovirt:3.2.1 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/ovirt/ovirt' 2026-07-20 09:53:37.537400 | debian-bookworm | Loading collection containers.podman from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/containers/podman 2026-07-20 09:53:37.537740 | debian-bookworm | Found installed collection containers.podman:1.18.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/containers/podman' 2026-07-20 09:53:37.537971 | debian-bookworm | Loading collection community.proxysql from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/proxysql 2026-07-20 09:53:37.538201 | debian-bookworm | Found installed collection community.proxysql:1.7.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/proxysql' 2026-07-20 09:53:37.538694 | debian-bookworm | Loading collection dellemc.powerflex from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/dellemc/powerflex 2026-07-20 09:53:37.538954 | debian-bookworm | Found installed collection dellemc.powerflex:2.6.1 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/dellemc/powerflex' 2026-07-20 09:53:37.539184 | debian-bookworm | Loading collection community.sops from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/sops 2026-07-20 09:53:37.539531 | debian-bookworm | Found installed collection community.sops:2.2.7 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/sops' 2026-07-20 09:53:37.539815 | debian-bookworm | Loading collection hitachivantara.vspone_block from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/hitachivantara/vspone_block 2026-07-20 09:53:37.540134 | debian-bookworm | Found installed collection hitachivantara.vspone_block:4.5.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/hitachivantara/vspone_block' 2026-07-20 09:53:37.540419 | debian-bookworm | Loading collection lowlydba.sqlserver from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/lowlydba/sqlserver 2026-07-20 09:53:37.540692 | debian-bookworm | Found installed collection lowlydba.sqlserver:2.7.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/lowlydba/sqlserver' 2026-07-20 09:53:37.541312 | debian-bookworm | Loading collection kubernetes.core from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/kubernetes/core 2026-07-20 09:53:37.541603 | debian-bookworm | Found installed collection kubernetes.core:6.2.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/kubernetes/core' 2026-07-20 09:53:37.541913 | debian-bookworm | Loading collection netapp.cloudmanager from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/netapp/cloudmanager 2026-07-20 09:53:37.542131 | debian-bookworm | Found installed collection netapp.cloudmanager:21.24.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/netapp/cloudmanager' 2026-07-20 09:53:37.542347 | debian-bookworm | Loading collection ansible.posix from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/ansible/posix 2026-07-20 09:53:37.542676 | debian-bookworm | Found installed collection ansible.posix:2.1.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/ansible/posix' 2026-07-20 09:53:37.542914 | debian-bookworm | Loading collection community.mysql from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/mysql 2026-07-20 09:53:37.543216 | debian-bookworm | Found installed collection community.mysql:3.16.1 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/mysql' 2026-07-20 09:53:37.543404 | debian-bookworm | Loading collection community.ciscosmb from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/ciscosmb 2026-07-20 09:53:37.543687 | debian-bookworm | Found installed collection community.ciscosmb:1.0.11 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/ciscosmb' 2026-07-20 09:53:37.546772 | debian-bookworm | Loading collection fortinet.fortios from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/fortinet/fortios 2026-07-20 09:53:37.547115 | debian-bookworm | Found installed collection fortinet.fortios:2.4.2 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/fortinet/fortios' 2026-07-20 09:53:37.547489 | debian-bookworm | Loading collection purestorage.flasharray from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/purestorage/flasharray 2026-07-20 09:53:37.547796 | debian-bookworm | Found installed collection purestorage.flasharray:1.40.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/purestorage/flasharray' 2026-07-20 09:53:37.548031 | debian-bookworm | Loading collection cisco.dnac from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/cisco/dnac 2026-07-20 09:53:37.548350 | debian-bookworm | Found installed collection cisco.dnac:6.43.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/cisco/dnac' 2026-07-20 09:53:37.549050 | debian-bookworm | Loading collection cisco.iosxr from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/cisco/iosxr 2026-07-20 09:53:37.549335 | debian-bookworm | Found installed collection cisco.iosxr:12.1.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/cisco/iosxr' 2026-07-20 09:53:37.549521 | debian-bookworm | Loading collection cisco.ucs from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/cisco/ucs 2026-07-20 09:53:37.549833 | debian-bookworm | Found installed collection cisco.ucs:1.16.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/cisco/ucs' 2026-07-20 09:53:37.550447 | debian-bookworm | Loading collection openstack.cloud from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/openstack/cloud 2026-07-20 09:53:37.550777 | debian-bookworm | Found installed collection openstack.cloud:2.5.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/openstack/cloud' 2026-07-20 09:53:37.551124 | debian-bookworm | Loading collection community.dns from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/dns 2026-07-20 09:53:37.551413 | debian-bookworm | Found installed collection community.dns:3.4.1 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/dns' 2026-07-20 09:53:37.551585 | debian-bookworm | Loading collection community.library_inventory_filtering_v1 from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/library_inventory_filtering_v1 2026-07-20 09:53:37.551897 | debian-bookworm | Found installed collection community.library_inventory_filtering_v1:1.1.5 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/library_inventory_filtering_v1' 2026-07-20 09:53:37.552577 | debian-bookworm | Loading collection netbox.netbox from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/netbox/netbox 2026-07-20 09:53:37.552875 | debian-bookworm | Found installed collection netbox.netbox:3.21.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/netbox/netbox' 2026-07-20 09:53:37.553049 | debian-bookworm | Loading collection cisco.intersight from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/cisco/intersight 2026-07-20 09:53:37.553348 | debian-bookworm | Found installed collection cisco.intersight:2.12.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/cisco/intersight' 2026-07-20 09:53:37.553630 | debian-bookworm | Loading collection kubevirt.core from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/kubevirt/core 2026-07-20 09:53:37.553919 | debian-bookworm | Found installed collection kubevirt.core:2.2.3 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/kubevirt/core' 2026-07-20 09:53:37.554096 | debian-bookworm | Loading collection ansible.utils from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/ansible/utils 2026-07-20 09:53:37.554410 | debian-bookworm | Found installed collection ansible.utils:6.0.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/ansible/utils' 2026-07-20 09:53:37.554814 | debian-bookworm | Loading collection community.okd from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/okd 2026-07-20 09:53:37.555135 | debian-bookworm | Found installed collection community.okd:5.0.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/okd' 2026-07-20 09:53:37.555412 | debian-bookworm | Loading collection kaytus.ksmanage from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/kaytus/ksmanage 2026-07-20 09:53:37.555692 | debian-bookworm | Found installed collection kaytus.ksmanage:2.0.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/kaytus/ksmanage' 2026-07-20 09:53:37.556040 | debian-bookworm | Loading collection community.grafana from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/grafana 2026-07-20 09:53:37.556321 | debian-bookworm | Found installed collection community.grafana:2.3.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/grafana' 2026-07-20 09:53:37.556534 | debian-bookworm | Loading collection cyberark.conjur from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/cyberark/conjur 2026-07-20 09:53:37.556838 | debian-bookworm | Found installed collection cyberark.conjur:1.3.9 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/cyberark/conjur' 2026-07-20 09:53:37.560019 | debian-bookworm | Loading collection community.aws from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/aws 2026-07-20 09:53:37.560353 | debian-bookworm | Found installed collection community.aws:10.0.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/aws' 2026-07-20 09:53:37.560698 | debian-bookworm | Loading collection community.hashi_vault from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/hashi_vault 2026-07-20 09:53:37.561052 | debian-bookworm | Found installed collection community.hashi_vault:7.1.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/hashi_vault' 2026-07-20 09:53:37.561383 | debian-bookworm | Loading collection community.sap_libs from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/sap_libs 2026-07-20 09:53:37.561668 | debian-bookworm | Found installed collection community.sap_libs:1.5.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/sap_libs' 2026-07-20 09:53:37.561890 | debian-bookworm | Loading collection purestorage.flashblade from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/purestorage/flashblade 2026-07-20 09:53:37.562169 | debian-bookworm | Found installed collection purestorage.flashblade:1.22.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/purestorage/flashblade' 2026-07-20 09:53:37.562579 | debian-bookworm | Loading collection f5networks.f5_modules from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/f5networks/f5_modules 2026-07-20 09:53:37.562857 | debian-bookworm | Found installed collection f5networks.f5_modules:1.39.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/f5networks/f5_modules' 2026-07-20 09:53:37.567454 | debian-bookworm | Loading collection osism.commons from /home/zuul/.ansible/collections/ansible_collections/osism/commons 2026-07-20 09:53:37.569093 | debian-bookworm | Found installed collection osism.commons:0.20260712.0 at '/home/zuul/.ansible/collections/ansible_collections/osism/commons' 2026-07-20 09:53:37.570450 | debian-bookworm | Loading collection osism.services from /home/zuul/.ansible/collections/ansible_collections/osism/services 2026-07-20 09:53:37.570801 | debian-bookworm | Found installed collection osism.services:999.0.0 at '/home/zuul/.ansible/collections/ansible_collections/osism/services' 2026-07-20 09:53:37.571347 | debian-bookworm | Starting galaxy collection install process 2026-07-20 09:53:37.571468 | debian-bookworm | Nothing to do. All requested collections are already installed. If you want to reinstall them, consider using `--force`. 2026-07-20 09:53:37.656313 | debian-bookworm | INFO [delegated > dependency] Dependency completed successfully. 2026-07-20 09:53:37.656511 | debian-bookworm | WARNING [delegated > dependency] Executed: Missing roles requirements file: requirements.yml (Remove from converge_sequence to suppress) 2026-07-20 09:53:37.677869 | debian-bookworm | INFO [delegated > create] Executing 2026-07-20 09:53:37.682023 | debian-bookworm | WARNING [delegated > create] Executed: Missing playbook (Remove from converge_sequence to suppress) 2026-07-20 09:53:37.694417 | debian-bookworm | INFO [delegated > prepare] Executing 2026-07-20 09:53:37.694556 | debian-bookworm | WARNING [delegated > prepare] Skipping, instances already prepared. 2026-07-20 09:53:37.694668 | debian-bookworm | INFO [delegated > prepare] Executed: Successful 2026-07-20 09:53:37.703570 | debian-bookworm | INFO [delegated > converge] Executing 2026-07-20 09:53:37.939659 | ubuntu-noble | ansible-galaxy [core 2.19.11] 2026-07-20 09:53:37.939689 | ubuntu-noble | config file = None 2026-07-20 09:53:37.939724 | ubuntu-noble | configured module search path = ['/home/zuul/src/github.com/osism/ansible-collection-services/plugins/modules', '/home/zuul/.ansible/plugins/modules', '/usr/share/ansible/plugins/modules'] 2026-07-20 09:53:37.940052 | ubuntu-noble | ansible python module location = /home/zuul/venv/lib/python3.12/site-packages/ansible 2026-07-20 09:53:37.940394 | ubuntu-noble | ansible collection location = /home/zuul/.ansible/collections:/usr/share/ansible/collections:/home/zuul/venv/lib/python3.12/site-packages:/home/zuul/venv/lib/python3.12/dist-packages:/home/zuul/venv/lib/python3/dist-packages:/home/zuul/venv/local/lib/python3.12/dist-packages 2026-07-20 09:53:37.940696 | ubuntu-noble | executable location = /home/zuul/venv/bin/ansible-galaxy 2026-07-20 09:53:37.941434 | ubuntu-noble | python version = 3.12.3 (main, Jun 19 2026, 12:46:00) [GCC 13.3.0] (/home/zuul/venv/bin/python3) 2026-07-20 09:53:37.941758 | ubuntu-noble | jinja version = 3.1.6 2026-07-20 09:53:37.942113 | ubuntu-noble | pyyaml version = 6.0.3 (with libyaml v0.2.5) 2026-07-20 09:53:37.942382 | ubuntu-noble | No config file found; using defaults 2026-07-20 09:53:37.942889 | ubuntu-noble | Reading requirement file at '/home/zuul/src/github.com/osism/ansible-collection-services/molecule/delegated/collections.yml' 2026-07-20 09:53:37.951543 | ubuntu-noble | Loading collection infoblox.nios_modules from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/infoblox/nios_modules 2026-07-20 09:53:37.951996 | ubuntu-noble | Found installed collection infoblox.nios_modules:1.8.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/infoblox/nios_modules' 2026-07-20 09:53:37.952372 | ubuntu-noble | Loading collection microsoft.ad from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/microsoft/ad 2026-07-20 09:53:37.952772 | ubuntu-noble | Found installed collection microsoft.ad:1.10.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/microsoft/ad' 2026-07-20 09:53:37.953118 | ubuntu-noble | Loading collection netapp_eseries.santricity from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/netapp_eseries/santricity 2026-07-20 09:53:37.953502 | ubuntu-noble | Found installed collection netapp_eseries.santricity:1.4.1 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/netapp_eseries/santricity' 2026-07-20 09:53:37.953819 | ubuntu-noble | Loading collection community.grafana from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/grafana 2026-07-20 09:53:37.954214 | ubuntu-noble | Found installed collection community.grafana:2.3.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/grafana' 2026-07-20 09:53:37.954540 | ubuntu-noble | Loading collection ravendb.ravendb from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/ravendb/ravendb 2026-07-20 09:53:37.954977 | ubuntu-noble | Found installed collection ravendb.ravendb:1.0.4 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/ravendb/ravendb' 2026-07-20 09:53:37.957204 | ubuntu-noble | Loading collection vyos.vyos from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/vyos/vyos 2026-07-20 09:53:37.957763 | ubuntu-noble | Found installed collection vyos.vyos:6.0.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/vyos/vyos' 2026-07-20 09:53:37.958169 | ubuntu-noble | Loading collection ibm.storage_virtualize from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/ibm/storage_virtualize 2026-07-20 09:53:37.958499 | ubuntu-noble | Found installed collection ibm.storage_virtualize:2.7.4 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/ibm/storage_virtualize' 2026-07-20 09:53:37.959140 | ubuntu-noble | Loading collection cisco.dnac from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/cisco/dnac 2026-07-20 09:53:37.959513 | ubuntu-noble | Found installed collection cisco.dnac:6.43.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/cisco/dnac' 2026-07-20 09:53:37.960007 | ubuntu-noble | Loading collection microsoft.iis from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/microsoft/iis 2026-07-20 09:53:37.960338 | ubuntu-noble | Found installed collection microsoft.iis:1.1.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/microsoft/iis' 2026-07-20 09:53:37.968560 | ubuntu-noble | Loading collection community.general from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/general 2026-07-20 09:53:37.969634 | ubuntu-noble | Found installed collection community.general:11.4.2 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/general' 2026-07-20 09:53:37.974201 | ubuntu-noble | Loading collection fortinet.fortimanager from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/fortinet/fortimanager 2026-07-20 09:53:37.974629 | ubuntu-noble | Found installed collection fortinet.fortimanager:2.11.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/fortinet/fortimanager' 2026-07-20 09:53:37.978104 | ubuntu-noble | Loading collection community.aws from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/aws 2026-07-20 09:53:37.978532 | ubuntu-noble | Found installed collection community.aws:10.0.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/aws' 2026-07-20 09:53:37.979071 | ubuntu-noble | Loading collection netapp.storagegrid from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/netapp/storagegrid 2026-07-20 09:53:37.979391 | ubuntu-noble | Found installed collection netapp.storagegrid:21.15.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/netapp/storagegrid' 2026-07-20 09:53:37.979858 | ubuntu-noble | Loading collection kubernetes.core from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/kubernetes/core 2026-07-20 09:53:37.980306 | ubuntu-noble | Found installed collection kubernetes.core:6.2.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/kubernetes/core' 2026-07-20 09:53:37.983120 | ubuntu-noble | Loading collection fortinet.fortios from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/fortinet/fortios 2026-07-20 09:53:37.983521 | ubuntu-noble | Found installed collection fortinet.fortios:2.4.2 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/fortinet/fortios' 2026-07-20 09:53:37.986008 | ubuntu-noble | Loading collection vmware.vmware_rest from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/vmware/vmware_rest 2026-07-20 09:53:37.986504 | ubuntu-noble | Found installed collection vmware.vmware_rest:4.9.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/vmware/vmware_rest' 2026-07-20 09:53:37.987047 | ubuntu-noble | Loading collection dellemc.openmanage from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/dellemc/openmanage 2026-07-20 09:53:37.987469 | ubuntu-noble | Found installed collection dellemc.openmanage:9.12.3 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/dellemc/openmanage' 2026-07-20 09:53:37.987813 | ubuntu-noble | Loading collection containers.podman from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/containers/podman 2026-07-20 09:53:37.988243 | ubuntu-noble | Found installed collection containers.podman:1.18.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/containers/podman' 2026-07-20 09:53:37.988607 | ubuntu-noble | Loading collection community.rabbitmq from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/rabbitmq 2026-07-20 09:53:37.989026 | ubuntu-noble | Found installed collection community.rabbitmq:1.6.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/rabbitmq' 2026-07-20 09:53:37.989440 | ubuntu-noble | Loading collection ansible.windows from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/ansible/windows 2026-07-20 09:53:37.989783 | ubuntu-noble | Found installed collection ansible.windows:3.3.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/ansible/windows' 2026-07-20 09:53:37.990105 | ubuntu-noble | Loading collection inspur.ispim from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/inspur/ispim 2026-07-20 09:53:37.990438 | ubuntu-noble | Found installed collection inspur.ispim:2.2.4 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/inspur/ispim' 2026-07-20 09:53:37.991637 | ubuntu-noble | Loading collection community.dns from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/dns 2026-07-20 09:53:38.176620 | debian-bookworm | DEBUG [delegated > converge] ansible-playbook version: ansible-playbook 2026-07-20 09:53:38.176734 | debian-bookworm | config file = None 2026-07-20 09:53:38.176750 | debian-bookworm | configured module search path = 2026-07-20 09:53:38.176764 | debian-bookworm | ansible python module location = /home/zuul/venv/lib/python3.11/site-packages/ansible 2026-07-20 09:53:38.176778 | debian-bookworm | ansible collection location = /home/zuul/.ansible/collections:/usr/share/ansible/collections 2026-07-20 09:53:38.176789 | debian-bookworm | executable location = /home/zuul/venv/bin/ansible-playbook 2026-07-20 09:53:38.176801 | debian-bookworm | python version = 3.11.2 (main, May 12 2026, 05:17:27) (/home/zuul/venv/bin/python3) 2026-07-20 09:53:38.176814 | debian-bookworm | jinja version = 3.1.6 2026-07-20 09:53:38.176826 | debian-bookworm | pyyaml version = 6.0.3 (with libyaml v0.2.5) 2026-07-20 09:53:38.176857 | debian-bookworm | DEBUG ANSIBLE ENVIRONMENT: 2026-07-20 09:53:38.176870 | debian-bookworm | ANSIBLE_COLLECTIONS_PATH: /home/zuul/venv/.ansible/collections:/home/zuul/.ansible/collections 2026-07-20 09:53:38.176882 | debian-bookworm | ANSIBLE_CONFIG: /home/zuul/.ansible/tmp/molecule.oWZD.delegated/ansible.cfg 2026-07-20 09:53:37.991652 | ubuntu-noble | Found installed collection community.dns:3.4.1 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/dns' 2026-07-20 09:53:37.991657 | ubuntu-noble | Loading collection community.docker from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/docker 2026-07-20 09:53:37.991824 | ubuntu-noble | Found installed collection community.docker:4.8.5 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/docker' 2026-07-20 09:53:37.992228 | ubuntu-noble | Loading collection amazon.aws from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/amazon/aws 2026-07-20 09:53:37.992500 | ubuntu-noble | Found installed collection amazon.aws:10.1.2 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/amazon/aws' 2026-07-20 09:53:38.176894 | debian-bookworm | ANSIBLE_LIBRARY: ../../plugins 2026-07-20 09:53:37.993098 | ubuntu-noble | Loading collection cisco.ios from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/cisco/ios 2026-07-20 09:53:38.176905 | debian-bookworm | ANSIBLE_PYTHON_INTERPRETER: /home/zuul/venv/bin/python 2026-07-20 09:53:37.993452 | ubuntu-noble | Found installed collection cisco.ios:11.1.1 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/cisco/ios' 2026-07-20 09:53:38.176917 | debian-bookworm | ANSIBLE_ROLE: auditd 2026-07-20 09:53:37.993732 | ubuntu-noble | Loading collection community.library_inventory_filtering_v1 from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/library_inventory_filtering_v1 2026-07-20 09:53:38.176929 | debian-bookworm | ANSIBLE_ROLES_PATH: ../../roles 2026-07-20 09:53:37.994098 | ubuntu-noble | Found installed collection community.library_inventory_filtering_v1:1.1.5 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/library_inventory_filtering_v1' 2026-07-20 09:53:38.176940 | debian-bookworm | ANSIBLE_VERBOSITY: 1 2026-07-20 09:53:37.994397 | ubuntu-noble | Loading collection dellemc.powerflex from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/dellemc/powerflex 2026-07-20 09:53:38.176952 | debian-bookworm | 2026-07-20 09:53:37.994643 | ubuntu-noble | Found installed collection dellemc.powerflex:2.6.1 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/dellemc/powerflex' 2026-07-20 09:53:38.176965 | debian-bookworm | DEBUG MOLECULE ENVIRONMENT: 2026-07-20 09:53:37.995022 | ubuntu-noble | Loading collection community.proxmox from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/proxmox 2026-07-20 09:53:38.176976 | debian-bookworm | MOLECULE_DEBUG: True 2026-07-20 09:53:37.995306 | ubuntu-noble | Found installed collection community.proxmox:1.4.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/proxmox' 2026-07-20 09:53:38.176988 | debian-bookworm | MOLECULE_DEPENDENCY_NAME: galaxy 2026-07-20 09:53:37.995527 | ubuntu-noble | Loading collection ansible.utils from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/ansible/utils 2026-07-20 09:53:37.995838 | ubuntu-noble | Found installed collection ansible.utils:6.0.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/ansible/utils' 2026-07-20 09:53:37.996076 | ubuntu-noble | Loading collection cisco.ucs from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/cisco/ucs 2026-07-20 09:53:37.996367 | ubuntu-noble | Found installed collection cisco.ucs:1.16.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/cisco/ucs' 2026-07-20 09:53:37.996679 | ubuntu-noble | Loading collection dellemc.unity from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/dellemc/unity 2026-07-20 09:53:37.997024 | ubuntu-noble | Found installed collection dellemc.unity:2.1.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/dellemc/unity' 2026-07-20 09:53:37.997395 | ubuntu-noble | Loading collection community.sap_libs from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/sap_libs 2026-07-20 09:53:37.997706 | ubuntu-noble | Found installed collection community.sap_libs:1.5.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/sap_libs' 2026-07-20 09:53:37.997917 | ubuntu-noble | Loading collection community.mysql from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/mysql 2026-07-20 09:53:37.998179 | ubuntu-noble | Found installed collection community.mysql:3.16.1 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/mysql' 2026-07-20 09:53:37.998516 | ubuntu-noble | Loading collection vmware.vmware from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/vmware/vmware 2026-07-20 09:53:37.998862 | ubuntu-noble | Found installed collection vmware.vmware:2.6.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/vmware/vmware' 2026-07-20 09:53:37.999138 | ubuntu-noble | Loading collection ansible.netcommon from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/ansible/netcommon 2026-07-20 09:53:38.176999 | debian-bookworm | MOLECULE_DRIVER_NAME: default 2026-07-20 09:53:37.999370 | ubuntu-noble | Found installed collection ansible.netcommon:8.2.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/ansible/netcommon' 2026-07-20 09:53:37.999664 | ubuntu-noble | Loading collection cyberark.conjur from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/cyberark/conjur 2026-07-20 09:53:37.999860 | ubuntu-noble | Found installed collection cyberark.conjur:1.3.9 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/cyberark/conjur' 2026-07-20 09:53:38.001435 | ubuntu-noble | Loading collection community.windows from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/windows 2026-07-20 09:53:38.177011 | debian-bookworm | MOLECULE_ENV_FILE: /home/zuul/src/github.com/osism/ansible-collection-services/.env.yml 2026-07-20 09:53:38.001679 | ubuntu-noble | Found installed collection community.windows:3.1.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/windows' 2026-07-20 09:53:38.001957 | ubuntu-noble | Loading collection ansible.posix from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/ansible/posix 2026-07-20 09:53:38.002183 | ubuntu-noble | Found installed collection ansible.posix:2.1.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/ansible/posix' 2026-07-20 09:53:38.005640 | ubuntu-noble | Loading collection cisco.mso from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/cisco/mso 2026-07-20 09:53:38.005657 | ubuntu-noble | Found installed collection cisco.mso:2.12.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/cisco/mso' 2026-07-20 09:53:38.005661 | ubuntu-noble | Loading collection ovirt.ovirt from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/ovirt/ovirt 2026-07-20 09:53:38.005665 | ubuntu-noble | Found installed collection ovirt.ovirt:3.2.1 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/ovirt/ovirt' 2026-07-20 09:53:38.005669 | ubuntu-noble | Loading collection kubevirt.core from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/kubevirt/core 2026-07-20 09:53:38.177022 | debian-bookworm | MOLECULE_EPHEMERAL_DIRECTORY: /home/zuul/.ansible/tmp/molecule.oWZD.delegated 2026-07-20 09:53:38.177034 | debian-bookworm | MOLECULE_FILE: /home/zuul/.ansible/tmp/molecule.oWZD.delegated/molecule.yml 2026-07-20 09:53:38.005673 | ubuntu-noble | Found installed collection kubevirt.core:2.2.3 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/kubevirt/core' 2026-07-20 09:53:38.177045 | debian-bookworm | MOLECULE_INSTANCE_CONFIG: /home/zuul/.ansible/tmp/molecule.oWZD.delegated/instance_config.yml 2026-07-20 09:53:38.005767 | ubuntu-noble | Loading collection openstack.cloud from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/openstack/cloud 2026-07-20 09:53:38.177057 | debian-bookworm | MOLECULE_INVENTORY_FILE: /home/zuul/.ansible/tmp/molecule.oWZD.delegated/inventory/ansible_inventory.yml 2026-07-20 09:53:38.006081 | ubuntu-noble | Found installed collection openstack.cloud:2.5.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/openstack/cloud' 2026-07-20 09:53:38.177069 | debian-bookworm | MOLECULE_PROJECT_DIRECTORY: /home/zuul/src/github.com/osism/ansible-collection-services 2026-07-20 09:53:38.006437 | ubuntu-noble | Loading collection community.hrobot from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/hrobot 2026-07-20 09:53:38.177080 | debian-bookworm | MOLECULE_PROVISIONER_NAME: ansible 2026-07-20 09:53:38.006693 | ubuntu-noble | Found installed collection community.hrobot:2.7.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/hrobot' 2026-07-20 09:53:38.007573 | ubuntu-noble | Loading collection netapp.ontap from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/netapp/ontap 2026-07-20 09:53:38.007815 | ubuntu-noble | Found installed collection netapp.ontap:23.2.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/netapp/ontap' 2026-07-20 09:53:38.177092 | debian-bookworm | MOLECULE_SCENARIO_DIRECTORY: /home/zuul/src/github.com/osism/ansible-collection-services/molecule/delegated 2026-07-20 09:53:38.009675 | ubuntu-noble | Loading collection dellemc.enterprise_sonic from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/dellemc/enterprise_sonic 2026-07-20 09:53:38.009863 | ubuntu-noble | Found installed collection dellemc.enterprise_sonic:3.2.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/dellemc/enterprise_sonic' 2026-07-20 09:53:38.010243 | ubuntu-noble | Loading collection vultr.cloud from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/vultr/cloud 2026-07-20 09:53:38.010550 | ubuntu-noble | Found installed collection vultr.cloud:1.13.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/vultr/cloud' 2026-07-20 09:53:38.010975 | ubuntu-noble | Loading collection community.hashi_vault from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/hashi_vault 2026-07-20 09:53:38.011164 | ubuntu-noble | Found installed collection community.hashi_vault:7.1.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/hashi_vault' 2026-07-20 09:53:38.011359 | ubuntu-noble | Loading collection community.routeros from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/routeros 2026-07-20 09:53:38.011632 | ubuntu-noble | Found installed collection community.routeros:3.14.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/routeros' 2026-07-20 09:53:38.013117 | ubuntu-noble | Loading collection community.vmware from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/vmware 2026-07-20 09:53:38.013393 | ubuntu-noble | Found installed collection community.vmware:5.10.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/vmware' 2026-07-20 09:53:38.177103 | debian-bookworm | MOLECULE_SCENARIO_NAME: delegated 2026-07-20 09:53:38.013761 | ubuntu-noble | Loading collection hitachivantara.vspone_block from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/hitachivantara/vspone_block 2026-07-20 09:53:38.014046 | ubuntu-noble | Found installed collection hitachivantara.vspone_block:4.5.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/hitachivantara/vspone_block' 2026-07-20 09:53:38.014740 | ubuntu-noble | Loading collection netbox.netbox from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/netbox/netbox 2026-07-20 09:53:38.015014 | ubuntu-noble | Found installed collection netbox.netbox:3.21.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/netbox/netbox' 2026-07-20 09:53:38.015983 | ubuntu-noble | Loading collection community.digitalocean from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/digitalocean 2026-07-20 09:53:38.016225 | ubuntu-noble | Found installed collection community.digitalocean:1.27.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/digitalocean' 2026-07-20 09:53:38.016427 | ubuntu-noble | Loading collection community.sops from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/sops 2026-07-20 09:53:38.016693 | ubuntu-noble | Found installed collection community.sops:2.2.7 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/sops' 2026-07-20 09:53:38.018253 | ubuntu-noble | Loading collection theforeman.foreman from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/theforeman/foreman 2026-07-20 09:53:38.018574 | ubuntu-noble | Found installed collection theforeman.foreman:5.7.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/theforeman/foreman' 2026-07-20 09:53:38.177115 | debian-bookworm | MOLECULE_STATE_FILE: /home/zuul/.ansible/tmp/molecule.oWZD.delegated/state.yml 2026-07-20 09:53:38.019337 | ubuntu-noble | Loading collection cisco.iosxr from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/cisco/iosxr 2026-07-20 09:53:38.019691 | ubuntu-noble | Found installed collection cisco.iosxr:12.1.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/cisco/iosxr' 2026-07-20 09:53:38.020417 | ubuntu-noble | Loading collection arista.eos from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/arista/eos 2026-07-20 09:53:38.020735 | ubuntu-noble | Found installed collection arista.eos:12.0.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/arista/eos' 2026-07-20 09:53:38.021045 | ubuntu-noble | Loading collection community.zabbix from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/zabbix 2026-07-20 09:53:38.021414 | ubuntu-noble | Found installed collection community.zabbix:4.1.1 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/zabbix' 2026-07-20 09:53:38.021562 | ubuntu-noble | Loading collection cyberark.pas from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/cyberark/pas 2026-07-20 09:53:38.021868 | ubuntu-noble | Found installed collection cyberark.pas:1.0.36 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/cyberark/pas' 2026-07-20 09:53:38.022370 | ubuntu-noble | Loading collection ibm.qradar from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/ibm/qradar 2026-07-20 09:53:38.022606 | ubuntu-noble | Found installed collection ibm.qradar:4.0.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/ibm/qradar' 2026-07-20 09:53:38.023291 | ubuntu-noble | Loading collection splunk.es from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/splunk/es 2026-07-20 09:53:38.023594 | ubuntu-noble | Found installed collection splunk.es:4.0.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/splunk/es' 2026-07-20 09:53:38.025567 | ubuntu-noble | Loading collection azure.azcollection from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/azure/azcollection 2026-07-20 09:53:38.025911 | ubuntu-noble | Found installed collection azure.azcollection:3.12.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/azure/azcollection' 2026-07-20 09:53:38.026328 | ubuntu-noble | Loading collection kaytus.ksmanage from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/kaytus/ksmanage 2026-07-20 09:53:38.026522 | ubuntu-noble | Found installed collection kaytus.ksmanage:2.0.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/kaytus/ksmanage' 2026-07-20 09:53:38.026856 | ubuntu-noble | Loading collection community.postgresql from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/postgresql 2026-07-20 09:53:38.027165 | ubuntu-noble | Found installed collection community.postgresql:4.2.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/postgresql' 2026-07-20 09:53:38.177126 | debian-bookworm | MOLECULE_VERIFIER_NAME: testinfra 2026-07-20 09:53:38.029465 | ubuntu-noble | Loading collection awx.awx from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/awx/awx 2026-07-20 09:53:38.029742 | ubuntu-noble | Found installed collection awx.awx:24.6.1 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/awx/awx' 2026-07-20 09:53:38.030076 | ubuntu-noble | Loading collection purestorage.flasharray from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/purestorage/flasharray 2026-07-20 09:53:38.030355 | ubuntu-noble | Found installed collection purestorage.flasharray:1.40.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/purestorage/flasharray' 2026-07-20 09:53:38.030750 | ubuntu-noble | Loading collection community.okd from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/okd 2026-07-20 09:53:38.030998 | ubuntu-noble | Found installed collection community.okd:5.0.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/okd' 2026-07-20 09:53:38.031468 | ubuntu-noble | Loading collection check_point.mgmt from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/check_point/mgmt 2026-07-20 09:53:38.031753 | ubuntu-noble | Found installed collection check_point.mgmt:6.7.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/check_point/mgmt' 2026-07-20 09:53:38.032395 | ubuntu-noble | Loading collection cloudscale_ch.cloud from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/cloudscale_ch/cloud 2026-07-20 09:53:38.032674 | ubuntu-noble | Found installed collection cloudscale_ch.cloud:2.5.2 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/cloudscale_ch/cloud' 2026-07-20 09:53:38.032864 | ubuntu-noble | Loading collection community.libvirt from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/libvirt 2026-07-20 09:53:38.033244 | ubuntu-noble | Found installed collection community.libvirt:2.0.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/libvirt' 2026-07-20 09:53:38.033722 | ubuntu-noble | Loading collection community.crypto from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/crypto 2026-07-20 09:53:38.033977 | ubuntu-noble | Found installed collection community.crypto:3.0.5 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/crypto' 2026-07-20 09:53:38.034201 | ubuntu-noble | Loading collection lowlydba.sqlserver from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/lowlydba/sqlserver 2026-07-20 09:53:38.034457 | ubuntu-noble | Found installed collection lowlydba.sqlserver:2.7.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/lowlydba/sqlserver' 2026-07-20 09:53:38.034990 | ubuntu-noble | Loading collection telekom_mms.icinga_director from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/telekom_mms/icinga_director 2026-07-20 09:53:38.035345 | ubuntu-noble | Found installed collection telekom_mms.icinga_director:2.5.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/telekom_mms/icinga_director' 2026-07-20 09:53:38.036661 | ubuntu-noble | Loading collection junipernetworks.junos from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/junipernetworks/junos 2026-07-20 09:53:38.177138 | debian-bookworm | MOLECULE_VERIFIER_TEST_DIRECTORY: /home/zuul/src/github.com/osism/ansible-collection-services/molecule/delegated/tests 2026-07-20 09:53:38.036954 | ubuntu-noble | Found installed collection junipernetworks.junos:11.0.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/junipernetworks/junos' 2026-07-20 09:53:38.037174 | ubuntu-noble | Loading collection community.ciscosmb from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/ciscosmb 2026-07-20 09:53:38.037412 | ubuntu-noble | Found installed collection community.ciscosmb:1.0.11 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/ciscosmb' 2026-07-20 09:53:38.037659 | ubuntu-noble | Loading collection hitachivantara.vspone_object from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/hitachivantara/vspone_object 2026-07-20 09:53:38.037953 | ubuntu-noble | Found installed collection hitachivantara.vspone_object:1.1.1 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/hitachivantara/vspone_object' 2026-07-20 09:53:38.039371 | ubuntu-noble | Loading collection cisco.meraki from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/cisco/meraki 2026-07-20 09:53:38.039586 | ubuntu-noble | Found installed collection cisco.meraki:2.21.9 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/cisco/meraki' 2026-07-20 09:53:38.039868 | ubuntu-noble | Loading collection cisco.intersight from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/cisco/intersight 2026-07-20 09:53:38.040134 | ubuntu-noble | Found installed collection cisco.intersight:2.12.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/cisco/intersight' 2026-07-20 09:53:38.040380 | ubuntu-noble | Loading collection grafana.grafana from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/grafana/grafana 2026-07-20 09:53:38.040701 | ubuntu-noble | Found installed collection grafana.grafana:6.0.6 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/grafana/grafana' 2026-07-20 09:53:38.041121 | ubuntu-noble | Loading collection wti.remote from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/wti/remote 2026-07-20 09:53:38.041347 | ubuntu-noble | Found installed collection wti.remote:1.0.10 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/wti/remote' 2026-07-20 09:53:38.041743 | ubuntu-noble | Loading collection infinidat.infinibox from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/infinidat/infinibox 2026-07-20 09:53:38.041983 | ubuntu-noble | Found installed collection infinidat.infinibox:1.6.3 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/infinidat/infinibox' 2026-07-20 09:53:38.043431 | ubuntu-noble | Loading collection cisco.nxos from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/cisco/nxos 2026-07-20 09:53:38.043694 | ubuntu-noble | Found installed collection cisco.nxos:11.1.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/cisco/nxos' 2026-07-20 09:53:38.043971 | ubuntu-noble | Loading collection chocolatey.chocolatey from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/chocolatey/chocolatey 2026-07-20 09:53:38.044237 | ubuntu-noble | Found installed collection chocolatey.chocolatey:1.5.3 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/chocolatey/chocolatey' 2026-07-20 09:53:38.046639 | ubuntu-noble | Loading collection google.cloud from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/google/cloud 2026-07-20 09:53:38.046656 | ubuntu-noble | Found installed collection google.cloud:1.10.2 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/google/cloud' 2026-07-20 09:53:38.046660 | ubuntu-noble | Loading collection ngine_io.cloudstack from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/ngine_io/cloudstack 2026-07-20 09:53:38.046664 | ubuntu-noble | Found installed collection ngine_io.cloudstack:2.5.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/ngine_io/cloudstack' 2026-07-20 09:53:38.046668 | ubuntu-noble | Loading collection ieisystem.inmanage from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/ieisystem/inmanage 2026-07-20 09:53:38.046758 | ubuntu-noble | Found installed collection ieisystem.inmanage:3.0.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/ieisystem/inmanage' 2026-07-20 09:53:38.047892 | ubuntu-noble | Loading collection hetzner.hcloud from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/hetzner/hcloud 2026-07-20 09:53:38.048186 | ubuntu-noble | Found installed collection hetzner.hcloud:5.4.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/hetzner/hcloud' 2026-07-20 09:53:38.048628 | ubuntu-noble | Loading collection community.mongodb from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/mongodb 2026-07-20 09:53:38.048939 | ubuntu-noble | Found installed collection community.mongodb:1.7.10 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/mongodb' 2026-07-20 09:53:38.049282 | ubuntu-noble | Loading collection netapp.cloudmanager from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/netapp/cloudmanager 2026-07-20 09:53:38.049490 | ubuntu-noble | Found installed collection netapp.cloudmanager:21.24.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/netapp/cloudmanager' 2026-07-20 09:53:38.049716 | ubuntu-noble | Loading collection community.proxysql from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/proxysql 2026-07-20 09:53:38.050007 | ubuntu-noble | Found installed collection community.proxysql:1.7.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/proxysql' 2026-07-20 09:53:38.050196 | ubuntu-noble | Loading collection purestorage.flashblade from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/purestorage/flashblade 2026-07-20 09:53:38.050383 | ubuntu-noble | Found installed collection purestorage.flashblade:1.22.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/purestorage/flashblade' 2026-07-20 09:53:38.050767 | ubuntu-noble | Loading collection f5networks.f5_modules from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/f5networks/f5_modules 2026-07-20 09:53:38.051025 | ubuntu-noble | Found installed collection f5networks.f5_modules:1.39.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/f5networks/f5_modules' 2026-07-20 09:53:38.052728 | ubuntu-noble | Loading collection cisco.aci from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/cisco/aci 2026-07-20 09:53:38.177155 | debian-bookworm | 2026-07-20 09:53:38.053002 | ubuntu-noble | Found installed collection cisco.aci:2.13.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/cisco/aci' 2026-07-20 09:53:38.067167 | ubuntu-noble | Loading collection ansible._protomatter from /home/zuul/venv/lib/python3.12/site-packages/ansible/_internal/ansible_collections/ansible/_protomatter 2026-07-20 09:53:38.067500 | ubuntu-noble | Found installed collection ansible._protomatter:2.19.11 at '/home/zuul/venv/lib/python3.12/site-packages/ansible/_internal/ansible_collections/ansible/_protomatter' 2026-07-20 09:53:38.079982 | ubuntu-noble | Loading collection osism.services from /home/zuul/.ansible/collections/ansible_collections/osism/services 2026-07-20 09:53:38.080706 | ubuntu-noble | Found installed collection osism.services:999.0.0 at '/home/zuul/.ansible/collections/ansible_collections/osism/services' 2026-07-20 09:53:38.081237 | ubuntu-noble | Loading collection osism.commons from /home/zuul/.ansible/collections/ansible_collections/osism/commons 2026-07-20 09:53:38.081854 | ubuntu-noble | Found installed collection osism.commons:0.20260712.0 at '/home/zuul/.ansible/collections/ansible_collections/osism/commons' 2026-07-20 09:53:38.083167 | ubuntu-noble | Starting galaxy collection install process 2026-07-20 09:53:38.083503 | ubuntu-noble | Nothing to do. All requested collections are already installed. If you want to reinstall them, consider using `--force`. 2026-07-20 09:53:38.148052 | ubuntu-noble | INFO [delegated > dependency] Dependency completed successfully. 2026-07-20 09:53:38.148367 | ubuntu-noble | WARNING [delegated > dependency] Executed: Missing roles requirements file: requirements.yml (Remove from converge_sequence to suppress) 2026-07-20 09:53:38.164785 | ubuntu-noble | INFO [delegated > create] Executing 2026-07-20 09:53:38.167394 | ubuntu-noble | WARNING [delegated > create] Executed: Missing playbook (Remove from converge_sequence to suppress) 2026-07-20 09:53:38.176840 | ubuntu-noble | INFO [delegated > prepare] Executing 2026-07-20 09:53:38.176916 | ubuntu-noble | WARNING [delegated > prepare] Skipping, instances already prepared. 2026-07-20 09:53:38.177012 | ubuntu-noble | INFO [delegated > prepare] Executed: Successful 2026-07-20 09:53:38.185350 | ubuntu-noble | INFO [delegated > converge] Executing 2026-07-20 09:53:38.177225 | debian-bookworm | DEBUG SHELL REPLAY: ANSIBLE_COLLECTIONS_PATH=/home/zuul/venv/.ansible/collections:/home/zuul/.ansible/collections ANSIBLE_CONFIG=/home/zuul/.ansible/tmp/molecule.oWZD.delegated/ansible.cfg ANSIBLE_LIBRARY=../../plugins ANSIBLE_PYTHON_INTERPRETER=/home/zuul/venv/bin/python ANSIBLE_ROLE=auditd ANSIBLE_ROLES_PATH=../../roles ANSIBLE_VERBOSITY=1 MOLECULE_DEBUG=True MOLECULE_DEPENDENCY_NAME=galaxy MOLECULE_DRIVER_NAME=default MOLECULE_ENV_FILE=/home/zuul/src/github.com/osism/ansible-collection-services/.env.yml MOLECULE_EPHEMERAL_DIRECTORY=/home/zuul/.ansible/tmp/molecule.oWZD.delegated MOLECULE_FILE=/home/zuul/.ansible/tmp/molecule.oWZD.delegated/molecule.yml MOLECULE_INSTANCE_CONFIG=/home/zuul/.ansible/tmp/molecule.oWZD.delegated/instance_config.yml MOLECULE_INVENTORY_FILE=/home/zuul/.ansible/tmp/molecule.oWZD.delegated/inventory/ansible_inventory.yml MOLECULE_PROJECT_DIRECTORY=/home/zuul/src/github.com/osism/ansible-collection-services MOLECULE_PROVISIONER_NAME=ansible MOLECULE_SCENARIO_DIRECTORY=/home/zuul/src/github.com/osism/ansible-collection-services/molecule/delegated MOLECULE_SCENARIO_NAME=delegated MOLECULE_STATE_FILE=/home/zuul/.ansible/tmp/molecule.oWZD.delegated/state.yml MOLECULE_VERIFIER_NAME=testinfra MOLECULE_VERIFIER_TEST_DIRECTORY=/home/zuul/src/github.com/osism/ansible-collection-services/molecule/delegated/tests 2026-07-20 09:53:38.651367 | ubuntu-noble | DEBUG [delegated > converge] ansible-playbook version: ansible-playbook 2026-07-20 09:53:38.651413 | ubuntu-noble | config file = None 2026-07-20 09:53:38.651418 | ubuntu-noble | configured module search path = 2026-07-20 09:53:38.651422 | ubuntu-noble | ansible python module location = /home/zuul/venv/lib/python3.12/site-packages/ansible 2026-07-20 09:53:38.651426 | ubuntu-noble | ansible collection location = /home/zuul/.ansible/collections:/usr/share/ansible/collections 2026-07-20 09:53:38.651430 | ubuntu-noble | executable location = /home/zuul/venv/bin/ansible-playbook 2026-07-20 09:53:38.651434 | ubuntu-noble | python version = 3.12.3 (main, Jun 19 2026, 12:46:00) (/home/zuul/venv/bin/python3) 2026-07-20 09:53:38.651437 | ubuntu-noble | jinja version = 3.1.6 2026-07-20 09:53:38.651441 | ubuntu-noble | pyyaml version = 6.0.3 (with libyaml v0.2.5) 2026-07-20 09:53:38.651777 | ubuntu-noble | DEBUG ANSIBLE ENVIRONMENT: 2026-07-20 09:53:38.651786 | ubuntu-noble | ANSIBLE_COLLECTIONS_PATH: /home/zuul/venv/.ansible/collections:/home/zuul/.ansible/collections 2026-07-20 09:53:38.651790 | ubuntu-noble | ANSIBLE_CONFIG: /home/zuul/.ansible/tmp/molecule.oWZD.delegated/ansible.cfg 2026-07-20 09:53:38.651793 | ubuntu-noble | ANSIBLE_LIBRARY: ../../plugins 2026-07-20 09:53:38.651797 | ubuntu-noble | ANSIBLE_PYTHON_INTERPRETER: /home/zuul/venv/bin/python 2026-07-20 09:53:38.651800 | ubuntu-noble | ANSIBLE_ROLE: auditd 2026-07-20 09:53:38.651804 | ubuntu-noble | ANSIBLE_ROLES_PATH: ../../roles 2026-07-20 09:53:38.651807 | ubuntu-noble | ANSIBLE_VERBOSITY: 1 2026-07-20 09:53:38.651811 | ubuntu-noble | 2026-07-20 09:53:38.652061 | ubuntu-noble | DEBUG MOLECULE ENVIRONMENT: 2026-07-20 09:53:38.652066 | ubuntu-noble | MOLECULE_DEBUG: True 2026-07-20 09:53:38.652070 | ubuntu-noble | MOLECULE_DEPENDENCY_NAME: galaxy 2026-07-20 09:53:38.652073 | ubuntu-noble | MOLECULE_DRIVER_NAME: default 2026-07-20 09:53:38.652077 | ubuntu-noble | MOLECULE_ENV_FILE: /home/zuul/src/github.com/osism/ansible-collection-services/.env.yml 2026-07-20 09:53:38.652081 | ubuntu-noble | MOLECULE_EPHEMERAL_DIRECTORY: /home/zuul/.ansible/tmp/molecule.oWZD.delegated 2026-07-20 09:53:38.652084 | ubuntu-noble | MOLECULE_FILE: /home/zuul/.ansible/tmp/molecule.oWZD.delegated/molecule.yml 2026-07-20 09:53:38.652088 | ubuntu-noble | MOLECULE_INSTANCE_CONFIG: /home/zuul/.ansible/tmp/molecule.oWZD.delegated/instance_config.yml 2026-07-20 09:53:38.652091 | ubuntu-noble | MOLECULE_INVENTORY_FILE: /home/zuul/.ansible/tmp/molecule.oWZD.delegated/inventory/ansible_inventory.yml 2026-07-20 09:53:38.652096 | ubuntu-noble | MOLECULE_PROJECT_DIRECTORY: /home/zuul/src/github.com/osism/ansible-collection-services 2026-07-20 09:53:38.652100 | ubuntu-noble | MOLECULE_PROVISIONER_NAME: ansible 2026-07-20 09:53:38.652104 | ubuntu-noble | MOLECULE_SCENARIO_DIRECTORY: /home/zuul/src/github.com/osism/ansible-collection-services/molecule/delegated 2026-07-20 09:53:38.652107 | ubuntu-noble | MOLECULE_SCENARIO_NAME: delegated 2026-07-20 09:53:38.652111 | ubuntu-noble | MOLECULE_STATE_FILE: /home/zuul/.ansible/tmp/molecule.oWZD.delegated/state.yml 2026-07-20 09:53:38.652114 | ubuntu-noble | MOLECULE_VERIFIER_NAME: testinfra 2026-07-20 09:53:38.652118 | ubuntu-noble | MOLECULE_VERIFIER_TEST_DIRECTORY: /home/zuul/src/github.com/osism/ansible-collection-services/molecule/delegated/tests 2026-07-20 09:53:38.652121 | ubuntu-noble | 2026-07-20 09:53:38.652275 | ubuntu-noble | DEBUG SHELL REPLAY: ANSIBLE_COLLECTIONS_PATH=/home/zuul/venv/.ansible/collections:/home/zuul/.ansible/collections ANSIBLE_CONFIG=/home/zuul/.ansible/tmp/molecule.oWZD.delegated/ansible.cfg ANSIBLE_LIBRARY=../../plugins ANSIBLE_PYTHON_INTERPRETER=/home/zuul/venv/bin/python ANSIBLE_ROLE=auditd ANSIBLE_ROLES_PATH=../../roles ANSIBLE_VERBOSITY=1 MOLECULE_DEBUG=True MOLECULE_DEPENDENCY_NAME=galaxy MOLECULE_DRIVER_NAME=default MOLECULE_ENV_FILE=/home/zuul/src/github.com/osism/ansible-collection-services/.env.yml MOLECULE_EPHEMERAL_DIRECTORY=/home/zuul/.ansible/tmp/molecule.oWZD.delegated MOLECULE_FILE=/home/zuul/.ansible/tmp/molecule.oWZD.delegated/molecule.yml MOLECULE_INSTANCE_CONFIG=/home/zuul/.ansible/tmp/molecule.oWZD.delegated/instance_config.yml MOLECULE_INVENTORY_FILE=/home/zuul/.ansible/tmp/molecule.oWZD.delegated/inventory/ansible_inventory.yml MOLECULE_PROJECT_DIRECTORY=/home/zuul/src/github.com/osism/ansible-collection-services MOLECULE_PROVISIONER_NAME=ansible MOLECULE_SCENARIO_DIRECTORY=/home/zuul/src/github.com/osism/ansible-collection-services/molecule/delegated MOLECULE_SCENARIO_NAME=delegated MOLECULE_STATE_FILE=/home/zuul/.ansible/tmp/molecule.oWZD.delegated/state.yml MOLECULE_VERIFIER_NAME=testinfra MOLECULE_VERIFIER_TEST_DIRECTORY=/home/zuul/src/github.com/osism/ansible-collection-services/molecule/delegated/tests 2026-07-20 09:53:38.563047 | debian-bookworm | Using /home/zuul/.ansible/tmp/molecule.oWZD.delegated/ansible.cfg as config file 2026-07-20 09:53:39.044779 | ubuntu-noble | Using /home/zuul/.ansible/tmp/molecule.oWZD.delegated/ansible.cfg as config file 2026-07-20 09:53:38.779896 | debian-bookworm | 2026-07-20 09:53:38.780166 | debian-bookworm | PLAY [Converge] **************************************************************** 2026-07-20 09:53:38.780407 | debian-bookworm | 2026-07-20 09:53:38.780674 | debian-bookworm | TASK [Gathering Facts] ********************************************************* 2026-07-20 09:53:39.282691 | ubuntu-noble | 2026-07-20 09:53:39.282776 | ubuntu-noble | PLAY [Converge] **************************************************************** 2026-07-20 09:53:39.282793 | ubuntu-noble | 2026-07-20 09:53:39.285156 | ubuntu-noble | TASK [Gathering Facts] ********************************************************* 2026-07-20 09:53:39.977530 | debian-bookworm | ok: [molecule-auditd] 2026-07-20 09:53:39.977607 | debian-bookworm | 2026-07-20 09:53:39.977739 | debian-bookworm | TASK [Include required variables] ********************************************** 2026-07-20 09:53:40.009936 | debian-bookworm | ok: [molecule-auditd] => {"ansible_facts": {}, "ansible_included_var_files": ["/home/zuul/src/github.com/osism/ansible-collection-services/molecule/delegated/vars/auditd.yml"], "changed": false} 2026-07-20 09:53:40.010003 | debian-bookworm | 2026-07-20 09:53:40.010117 | debian-bookworm | TASK [Include role auditd] ***************************************************** 2026-07-20 09:53:40.055944 | debian-bookworm | included: auditd for molecule-auditd 2026-07-20 09:53:40.056067 | debian-bookworm | 2026-07-20 09:53:40.056217 | debian-bookworm | TASK [auditd : Include distribution specific install tasks] ******************** 2026-07-20 09:53:40.082428 | debian-bookworm | included: /home/zuul/src/github.com/osism/ansible-collection-services/roles/auditd/tasks/install-Debian-family.yml for molecule-auditd 2026-07-20 09:53:40.082531 | debian-bookworm | 2026-07-20 09:53:40.082651 | debian-bookworm | TASK [auditd : Install auditd package] ***************************************** 2026-07-20 09:53:41.561076 | ubuntu-noble | ok: [molecule-auditd] 2026-07-20 09:53:41.561346 | ubuntu-noble | 2026-07-20 09:53:41.561575 | ubuntu-noble | TASK [Include required variables] ********************************************** 2026-07-20 09:53:41.586207 | ubuntu-noble | ok: [molecule-auditd] => {"ansible_facts": {}, "ansible_included_var_files": ["/home/zuul/src/github.com/osism/ansible-collection-services/molecule/delegated/vars/auditd.yml"], "changed": false} 2026-07-20 09:53:41.586461 | ubuntu-noble | 2026-07-20 09:53:41.586741 | ubuntu-noble | TASK [Include role auditd] ***************************************************** 2026-07-20 09:53:41.640234 | ubuntu-noble | included: auditd for molecule-auditd 2026-07-20 09:53:41.640268 | ubuntu-noble | 2026-07-20 09:53:41.640274 | ubuntu-noble | TASK [auditd : Include distribution specific install tasks] ******************** 2026-07-20 09:53:41.674748 | ubuntu-noble | included: /home/zuul/src/github.com/osism/ansible-collection-services/roles/auditd/tasks/install-Debian-family.yml for molecule-auditd 2026-07-20 09:53:41.676996 | ubuntu-noble | 2026-07-20 09:53:41.677033 | ubuntu-noble | TASK [auditd : Install auditd package] ***************************************** 2026-07-20 09:53:44.282210 | debian-bookworm | The following additional packages will be installed: 2026-07-20 09:53:44.282295 | debian-bookworm | libauparse0 2026-07-20 09:53:44.282417 | debian-bookworm | Suggested packages: 2026-07-20 09:53:44.282518 | debian-bookworm | audispd-plugins 2026-07-20 09:53:44.282641 | debian-bookworm | The following NEW packages will be installed: 2026-07-20 09:53:44.282741 | debian-bookworm | auditd libauparse0 2026-07-20 09:53:44.282840 | debian-bookworm | 0 upgraded, 2 newly installed, 0 to remove and 0 not upgraded. 2026-07-20 09:53:44.283576 | debian-bookworm | changed: [molecule-auditd] => {"cache_update_time": 1784541119, "cache_updated": false, "changed": true, "stderr": "debconf: delaying package configuration, since apt-utils is not installed\n", "stderr_lines": ["debconf: delaying package configuration, since apt-utils is not installed"], "stdout": "Reading package lists...\nBuilding dependency tree...\nReading state information...\nThe following additional packages will be installed:\n libauparse0\nSuggested packages:\n audispd-plugins\nThe following NEW packages will be installed:\n auditd libauparse0\n0 upgraded, 2 newly installed, 0 to remove and 0 not upgraded.\nNeed to get 279 kB of archives.\nAfter this operation, 934 kB of additional disk space will be used.\nGet:1 http://deb.debian.org/debian bookworm/main amd64 libauparse0 amd64 1:3.0.9-1 [61.9 kB]\nGet:2 http://deb.debian.org/debian bookworm/main amd64 auditd amd64 1:3.0.9-1 [218 kB]\nFetched 279 kB in 0s (4119 kB/s)\nSelecting previously unselected package libauparse0:amd64.\r\n(Reading database ... \r(Reading database ... 5%\r(Reading database ... 10%\r(Reading database ... 15%\r(Reading database ... 20%\r(Reading database ... 25%\r(Reading database ... 30%\r(Reading database ... 35%\r(Reading database ... 40%\r(Reading database ... 45%\r(Reading database ... 50%\r(Reading database ... 55%\r(Reading database ... 60%\r(Reading database ... 65%\r(Reading database ... 70%\r(Reading database ... 75%\r(Reading database ... 80%\r(Reading database ... 85%\r(Reading database ... 90%\r(Reading database ... 95%\r(Reading database ... 100%\r(Reading database ... 28692 files and directories currently installed.)\r\nPreparing to unpack .../libauparse0_1%3a3.0.9-1_amd64.deb ...\r\nUnpacking libauparse0:amd64 (1:3.0.9-1) ...\r\nSelecting previously unselected package auditd.\r\nPreparing to unpack .../auditd_1%3a3.0.9-1_amd64.deb ...\r\nUnpacking auditd (1:3.0.9-1) ...\r\nSetting up libauparse0:amd64 (1:3.0.9-1) ...\r\nSetting up auditd (1:3.0.9-1) ...\r\nCreated symlink /etc/systemd/system/multi-user.target.wants/auditd.service → /lib/systemd/system/auditd.service.\r\r\nProcessing triggers for libc-bin (2.36-9+deb12u14) ...\r\n", "stdout_lines": ["Reading package lists...", "Building dependency tree...", "Reading state information...", "The following additional packages will be installed:", " libauparse0", "Suggested packages:", " audispd-plugins", "The following NEW packages will be installed:", " auditd libauparse0", "0 upgraded, 2 newly installed, 0 to remove and 0 not upgraded.", "Need to get 279 kB of archives.", "After this operation, 934 kB of additional disk space will be used.", "Get:1 http://deb.debian.org/debian bookworm/main amd64 libauparse0 amd64 1:3.0.9-1 [61.9 kB]", "Get:2 http://deb.debian.org/debian bookworm/main amd64 auditd amd64 1:3.0.9-1 [218 kB]", "Fetched 279 kB in 0s (4119 kB/s)", "Selecting previously unselected package libauparse0:amd64.", "(Reading database ... ", "(Reading database ... 5%", "(Reading database ... 10%", "(Reading database ... 15%", "(Reading database ... 20%", "(Reading database ... 25%", "(Reading database ... 30%", "(Reading database ... 35%", "(Reading database ... 40%", "(Reading database ... 45%", "(Reading database ... 50%", "(Reading database ... 55%", "(Reading database ... 60%", "(Reading database ... 65%", "(Reading database ... 70%", "(Reading database ... 75%", "(Reading database ... 80%", "(Reading database ... 85%", "(Reading database ... 90%", "(Reading database ... 95%", "(Reading database ... 100%", "(Reading database ... 28692 files and directories currently installed.)", "Preparing to unpack .../libauparse0_1%3a3.0.9-1_amd64.deb ...", "Unpacking libauparse0:amd64 (1:3.0.9-1) ...", "Selecting previously unselected package auditd.", "Preparing to unpack .../auditd_1%3a3.0.9-1_amd64.deb ...", "Unpacking auditd (1:3.0.9-1) ...", "Setting up libauparse0:amd64 (1:3.0.9-1) ...", "Setting up auditd (1:3.0.9-1) ...", "Created symlink /etc/systemd/system/multi-user.target.wants/auditd.service → /lib/systemd/system/auditd.service.", "", "Processing triggers for libc-bin (2.36-9+deb12u14) ..."]} 2026-07-20 09:53:44.283738 | debian-bookworm | 2026-07-20 09:53:44.283836 | debian-bookworm | TASK [auditd : Install audispd-plugins package] ******************************** 2026-07-20 09:53:46.245604 | ubuntu-noble | The following additional packages will be installed: 2026-07-20 09:53:46.245820 | ubuntu-noble | libauparse0t64 2026-07-20 09:53:46.247541 | ubuntu-noble | Suggested packages: 2026-07-20 09:53:46.247713 | ubuntu-noble | audispd-plugins 2026-07-20 09:53:46.247847 | ubuntu-noble | The following NEW packages will be installed: 2026-07-20 09:53:46.247984 | ubuntu-noble | auditd libauparse0t64 2026-07-20 09:53:46.248108 | ubuntu-noble | 0 upgraded, 2 newly installed, 0 to remove and 0 not upgraded. 2026-07-20 09:53:46.249871 | ubuntu-noble | changed: [molecule-auditd] => {"cache_update_time": 1784541121, "cache_updated": false, "changed": true, "stderr": "debconf: delaying package configuration, since apt-utils is not installed\n", "stderr_lines": ["debconf: delaying package configuration, since apt-utils is not installed"], "stdout": "Reading package lists...\nBuilding dependency tree...\nReading state information...\nThe following additional packages will be installed:\n libauparse0t64\nSuggested packages:\n audispd-plugins\nThe following NEW packages will be installed:\n auditd libauparse0t64\n0 upgraded, 2 newly installed, 0 to remove and 0 not upgraded.\nNeed to get 274 kB of archives.\nAfter this operation, 893 kB of additional disk space will be used.\nGet:1 http://archive.ubuntu.com/ubuntu noble-updates/main amd64 libauparse0t64 amd64 1:3.1.2-2.1build1.1 [58.9 kB]\nGet:2 http://archive.ubuntu.com/ubuntu noble-updates/main amd64 auditd amd64 1:3.1.2-2.1build1.1 [215 kB]\nFetched 274 kB in 0s (1110 kB/s)\nSelecting previously unselected package libauparse0t64:amd64.\r\n(Reading database ... \r(Reading database ... 5%\r(Reading database ... 10%\r(Reading database ... 15%\r(Reading database ... 20%\r(Reading database ... 25%\r(Reading database ... 30%\r(Reading database ... 35%\r(Reading database ... 40%\r(Reading database ... 45%\r(Reading database ... 50%\r(Reading database ... 55%\r(Reading database ... 60%\r(Reading database ... 65%\r(Reading database ... 70%\r(Reading database ... 75%\r(Reading database ... 80%\r(Reading database ... 85%\r(Reading database ... 90%\r(Reading database ... 95%\r(Reading database ... 100%\r(Reading database ... 36098 files and directories currently installed.)\r\nPreparing to unpack .../libauparse0t64_1%3a3.1.2-2.1build1.1_amd64.deb ...\r\nAdding 'diversion of /lib/x86_64-linux-gnu/libauparse.so.0 to /lib/x86_64-linux-gnu/libauparse.so.0.usr-is-merged by libauparse0t64'\r\nAdding 'diversion of /lib/x86_64-linux-gnu/libauparse.so.0.0.0 to /lib/x86_64-linux-gnu/libauparse.so.0.0.0.usr-is-merged by libauparse0t64'\r\nUnpacking libauparse0t64:amd64 (1:3.1.2-2.1build1.1) ...\r\nSelecting previously unselected package auditd.\r\nPreparing to unpack .../auditd_1%3a3.1.2-2.1build1.1_amd64.deb ...\r\nUnpacking auditd (1:3.1.2-2.1build1.1) ...\r\nSetting up libauparse0t64:amd64 (1:3.1.2-2.1build1.1) ...\r\nSetting up auditd (1:3.1.2-2.1build1.1) ...\r\nCreated symlink /etc/systemd/system/multi-user.target.wants/auditd.service → /usr/lib/systemd/system/auditd.service.\r\r\nProcessing triggers for libc-bin (2.39-0ubuntu8.7) ...\r\n", "stdout_lines": ["Reading package lists...", "Building dependency tree...", "Reading state information...", "The following additional packages will be installed:", " libauparse0t64", "Suggested packages:", " audispd-plugins", "The following NEW packages will be installed:", " auditd libauparse0t64", "0 upgraded, 2 newly installed, 0 to remove and 0 not upgraded.", "Need to get 274 kB of archives.", "After this operation, 893 kB of additional disk space will be used.", "Get:1 http://archive.ubuntu.com/ubuntu noble-updates/main amd64 libauparse0t64 amd64 1:3.1.2-2.1build1.1 [58.9 kB]", "Get:2 http://archive.ubuntu.com/ubuntu noble-updates/main amd64 auditd amd64 1:3.1.2-2.1build1.1 [215 kB]", "Fetched 274 kB in 0s (1110 kB/s)", "Selecting previously unselected package libauparse0t64:amd64.", "(Reading database ... ", "(Reading database ... 5%", "(Reading database ... 10%", "(Reading database ... 15%", "(Reading database ... 20%", "(Reading database ... 25%", "(Reading database ... 30%", "(Reading database ... 35%", "(Reading database ... 40%", "(Reading database ... 45%", "(Reading database ... 50%", "(Reading database ... 55%", "(Reading database ... 60%", "(Reading database ... 65%", "(Reading database ... 70%", "(Reading database ... 75%", "(Reading database ... 80%", "(Reading database ... 85%", "(Reading database ... 90%", "(Reading database ... 95%", "(Reading database ... 100%", "(Reading database ... 36098 files and directories currently installed.)", "Preparing to unpack .../libauparse0t64_1%3a3.1.2-2.1build1.1_amd64.deb ...", "Adding 'diversion of /lib/x86_64-linux-gnu/libauparse.so.0 to /lib/x86_64-linux-gnu/libauparse.so.0.usr-is-merged by libauparse0t64'", "Adding 'diversion of /lib/x86_64-linux-gnu/libauparse.so.0.0.0 to /lib/x86_64-linux-gnu/libauparse.so.0.0.0.usr-is-merged by libauparse0t64'", "Unpacking libauparse0t64:amd64 (1:3.1.2-2.1build1.1) ...", "Selecting previously unselected package auditd.", "Preparing to unpack .../auditd_1%3a3.1.2-2.1build1.1_amd64.deb ...", "Unpacking auditd (1:3.1.2-2.1build1.1) ...", "Setting up libauparse0t64:amd64 (1:3.1.2-2.1build1.1) ...", "Setting up auditd (1:3.1.2-2.1build1.1) ...", "Created symlink /etc/systemd/system/multi-user.target.wants/auditd.service → /usr/lib/systemd/system/auditd.service.", "", "Processing triggers for libc-bin (2.39-0ubuntu8.7) ..."]} 2026-07-20 09:53:46.250146 | ubuntu-noble | 2026-07-20 09:53:46.250289 | ubuntu-noble | TASK [auditd : Install audispd-plugins package] ******************************** 2026-07-20 09:53:46.966851 | debian-bookworm | The following NEW packages will be installed: 2026-07-20 09:53:46.966952 | debian-bookworm | audispd-plugins 2026-07-20 09:53:46.967044 | debian-bookworm | 0 upgraded, 1 newly installed, 0 to remove and 0 not upgraded. 2026-07-20 09:53:46.967188 | debian-bookworm | changed: [molecule-auditd] => {"cache_update_time": 1784541119, "cache_updated": false, "changed": true, "stderr": "debconf: delaying package configuration, since apt-utils is not installed\n", "stderr_lines": ["debconf: delaying package configuration, since apt-utils is not installed"], "stdout": "Reading package lists...\nBuilding dependency tree...\nReading state information...\nThe following NEW packages will be installed:\n audispd-plugins\n0 upgraded, 1 newly installed, 0 to remove and 0 not upgraded.\nNeed to get 45.6 kB of archives.\nAfter this operation, 132 kB of additional disk space will be used.\nGet:1 http://deb.debian.org/debian bookworm/main amd64 audispd-plugins amd64 1:3.0.9-1 [45.6 kB]\nFetched 45.6 kB in 0s (1010 kB/s)\nSelecting previously unselected package audispd-plugins.\r\n(Reading database ... \r(Reading database ... 5%\r(Reading database ... 10%\r(Reading database ... 15%\r(Reading database ... 20%\r(Reading database ... 25%\r(Reading database ... 30%\r(Reading database ... 35%\r(Reading database ... 40%\r(Reading database ... 45%\r(Reading database ... 50%\r(Reading database ... 55%\r(Reading database ... 60%\r(Reading database ... 65%\r(Reading database ... 70%\r(Reading database ... 75%\r(Reading database ... 80%\r(Reading database ... 85%\r(Reading database ... 90%\r(Reading database ... 95%\r(Reading database ... 100%\r(Reading database ... 28783 files and directories currently installed.)\r\nPreparing to unpack .../audispd-plugins_1%3a3.0.9-1_amd64.deb ...\r\nUnpacking audispd-plugins (1:3.0.9-1) ...\r\nSetting up audispd-plugins (1:3.0.9-1) ...\r\n", "stdout_lines": ["Reading package lists...", "Building dependency tree...", "Reading state information...", "The following NEW packages will be installed:", " audispd-plugins", "0 upgraded, 1 newly installed, 0 to remove and 0 not upgraded.", "Need to get 45.6 kB of archives.", "After this operation, 132 kB of additional disk space will be used.", "Get:1 http://deb.debian.org/debian bookworm/main amd64 audispd-plugins amd64 1:3.0.9-1 [45.6 kB]", "Fetched 45.6 kB in 0s (1010 kB/s)", "Selecting previously unselected package audispd-plugins.", "(Reading database ... ", "(Reading database ... 5%", "(Reading database ... 10%", "(Reading database ... 15%", "(Reading database ... 20%", "(Reading database ... 25%", "(Reading database ... 30%", "(Reading database ... 35%", "(Reading database ... 40%", "(Reading database ... 45%", "(Reading database ... 50%", "(Reading database ... 55%", "(Reading database ... 60%", "(Reading database ... 65%", "(Reading database ... 70%", "(Reading database ... 75%", "(Reading database ... 80%", "(Reading database ... 85%", "(Reading database ... 90%", "(Reading database ... 95%", "(Reading database ... 100%", "(Reading database ... 28783 files and directories currently installed.)", "Preparing to unpack .../audispd-plugins_1%3a3.0.9-1_amd64.deb ...", "Unpacking audispd-plugins (1:3.0.9-1) ...", "Setting up audispd-plugins (1:3.0.9-1) ..."]} 2026-07-20 09:53:46.967278 | debian-bookworm | 2026-07-20 09:53:46.967382 | debian-bookworm | TASK [auditd : Copy auditd.conf configuration files] *************************** 2026-07-20 09:53:48.558045 | debian-bookworm | --- before 2026-07-20 09:53:48.558146 | debian-bookworm | +++ after: /home/zuul/.ansible/tmp/ansible-local-2190j_21n29n/tmpp916z1yn/auditd.conf.j2 2026-07-20 09:53:48.558161 | debian-bookworm | @@ -0,0 +1,37 @@ 2026-07-20 09:53:48.558171 | debian-bookworm | +# 2026-07-20 09:53:48.558186 | debian-bookworm | +# This file controls the configuration of the audit daemon 2026-07-20 09:53:48.558195 | debian-bookworm | +# 2026-07-20 09:53:48.558279 | debian-bookworm | + 2026-07-20 09:53:48.558367 | debian-bookworm | +local_events = yes 2026-07-20 09:53:48.558503 | debian-bookworm | +write_logs = yes 2026-07-20 09:53:48.558634 | debian-bookworm | +log_file = /var/log/audit/audit.log 2026-07-20 09:53:48.558722 | debian-bookworm | +log_group = adm 2026-07-20 09:53:48.558815 | debian-bookworm | +log_format = RAW 2026-07-20 09:53:48.558915 | debian-bookworm | +flush = INCREMENTAL_ASYNC 2026-07-20 09:53:48.559012 | debian-bookworm | +freq = 50 2026-07-20 09:53:48.559111 | debian-bookworm | +max_log_file = 8 2026-07-20 09:53:48.559211 | debian-bookworm | +num_logs = 5 2026-07-20 09:53:48.559305 | debian-bookworm | +priority_boost = 4 2026-07-20 09:53:48.559399 | debian-bookworm | +disp_qos = lossy 2026-07-20 09:53:48.559500 | debian-bookworm | +dispatcher = /sbin/audispd 2026-07-20 09:53:48.559625 | debian-bookworm | +name_format = NONE 2026-07-20 09:53:48.559713 | debian-bookworm | +##name = mydomain 2026-07-20 09:53:48.559809 | debian-bookworm | +max_log_file_action = ROTATE 2026-07-20 09:53:48.559907 | debian-bookworm | +space_left = 12361 2026-07-20 09:53:48.560004 | debian-bookworm | +space_left_action = email 2026-07-20 09:53:48.560097 | debian-bookworm | +verify_email = yes 2026-07-20 09:53:48.560193 | debian-bookworm | +action_mail_acct = root 2026-07-20 09:53:48.560290 | debian-bookworm | +admin_space_left = 50 2026-07-20 09:53:48.560389 | debian-bookworm | +admin_space_left_action = SUSPEND 2026-07-20 09:53:48.560487 | debian-bookworm | +disk_full_action = SUSPEND 2026-07-20 09:53:48.560605 | debian-bookworm | +disk_error_action = SUSPEND 2026-07-20 09:53:48.560693 | debian-bookworm | +use_libwrap = yes 2026-07-20 09:53:48.560788 | debian-bookworm | +##tcp_listen_port = 60 2026-07-20 09:53:48.560884 | debian-bookworm | +tcp_listen_queue = 5 2026-07-20 09:53:48.560979 | debian-bookworm | +tcp_max_per_addr = 1 2026-07-20 09:53:48.561078 | debian-bookworm | +##tcp_client_ports = 1024-65535 2026-07-20 09:53:48.561175 | debian-bookworm | +tcp_client_max_idle = 0 2026-07-20 09:53:48.561268 | debian-bookworm | +enable_krb5 = no 2026-07-20 09:53:48.561363 | debian-bookworm | +krb5_principal = auditd 2026-07-20 09:53:48.561459 | debian-bookworm | +##krb5_key_file = /etc/audit/audit.key 2026-07-20 09:53:48.561564 | debian-bookworm | +distribute_network = no 2026-07-20 09:53:48.561657 | debian-bookworm | 2026-07-20 09:53:48.561785 | debian-bookworm | changed: [molecule-auditd] => {"changed": true, "checksum": "e902cc6bebf86c17087d153e359a2cc1231672e0", "dest": "/etc/audit/audit.conf", "gid": 0, "group": "root", "md5sum": "69dfd768317bae876a6a78c8aeb5cce1", "mode": "0640", "owner": "root", "size": 806, "src": "/home/zuul/.ansible/tmp/ansible-tmp-1784541226.9866107-2560-13006651892478/.source.conf", "state": "file", "uid": 0} 2026-07-20 09:53:48.561857 | debian-bookworm | 2026-07-20 09:53:48.561956 | debian-bookworm | TASK [auditd : Adjust auditd/audispd configurations] *************************** 2026-07-20 09:53:49.123565 | debian-bookworm | ok: [molecule-auditd] => (item={'parameter': 'active', 'value': 'no', 'config': '/etc/audit/plugins.d/syslog.conf'}) => {"ansible_loop_var": "item", "backup": "", "changed": false, "item": {"config": "/etc/audit/plugins.d/syslog.conf", "parameter": "active", "value": "no"}, "msg": ""} 2026-07-20 09:53:49.123619 | debian-bookworm | 2026-07-20 09:53:49.123781 | debian-bookworm | TASK [auditd : Deploy rules for auditd] **************************************** 2026-07-20 09:53:49.493391 | ubuntu-noble | The following NEW packages will be installed: 2026-07-20 09:53:49.493597 | ubuntu-noble | audispd-plugins 2026-07-20 09:53:49.493785 | ubuntu-noble | 0 upgraded, 1 newly installed, 0 to remove and 0 not upgraded. 2026-07-20 09:53:49.493997 | ubuntu-noble | changed: [molecule-auditd] => {"cache_update_time": 1784541121, "cache_updated": false, "changed": true, "stderr": "debconf: delaying package configuration, since apt-utils is not installed\n", "stderr_lines": ["debconf: delaying package configuration, since apt-utils is not installed"], "stdout": "Reading package lists...\nBuilding dependency tree...\nReading state information...\nThe following NEW packages will be installed:\n audispd-plugins\n0 upgraded, 1 newly installed, 0 to remove and 0 not upgraded.\nNeed to get 38.8 kB of archives.\nAfter this operation, 131 kB of additional disk space will be used.\nGet:1 http://archive.ubuntu.com/ubuntu noble-updates/universe amd64 audispd-plugins amd64 1:3.1.2-2.1build1.1 [38.8 kB]\nFetched 38.8 kB in 0s (324 kB/s)\nSelecting previously unselected package audispd-plugins.\r\n(Reading database ... \r(Reading database ... 5%\r(Reading database ... 10%\r(Reading database ... 15%\r(Reading database ... 20%\r(Reading database ... 25%\r(Reading database ... 30%\r(Reading database ... 35%\r(Reading database ... 40%\r(Reading database ... 45%\r(Reading database ... 50%\r(Reading database ... 55%\r(Reading database ... 60%\r(Reading database ... 65%\r(Reading database ... 70%\r(Reading database ... 75%\r(Reading database ... 80%\r(Reading database ... 85%\r(Reading database ... 90%\r(Reading database ... 95%\r(Reading database ... 100%\r(Reading database ... 36194 files and directories currently installed.)\r\nPreparing to unpack .../audispd-plugins_1%3a3.1.2-2.1build1.1_amd64.deb ...\r\nUnpacking audispd-plugins (1:3.1.2-2.1build1.1) ...\r\nSetting up audispd-plugins (1:3.1.2-2.1build1.1) ...\r\n", "stdout_lines": ["Reading package lists...", "Building dependency tree...", "Reading state information...", "The following NEW packages will be installed:", " audispd-plugins", "0 upgraded, 1 newly installed, 0 to remove and 0 not upgraded.", "Need to get 38.8 kB of archives.", "After this operation, 131 kB of additional disk space will be used.", "Get:1 http://archive.ubuntu.com/ubuntu noble-updates/universe amd64 audispd-plugins amd64 1:3.1.2-2.1build1.1 [38.8 kB]", "Fetched 38.8 kB in 0s (324 kB/s)", "Selecting previously unselected package audispd-plugins.", "(Reading database ... ", "(Reading database ... 5%", "(Reading database ... 10%", "(Reading database ... 15%", "(Reading database ... 20%", "(Reading database ... 25%", "(Reading database ... 30%", "(Reading database ... 35%", "(Reading database ... 40%", "(Reading database ... 45%", "(Reading database ... 50%", "(Reading database ... 55%", "(Reading database ... 60%", "(Reading database ... 65%", "(Reading database ... 70%", "(Reading database ... 75%", "(Reading database ... 80%", "(Reading database ... 85%", "(Reading database ... 90%", "(Reading database ... 95%", "(Reading database ... 100%", "(Reading database ... 36194 files and directories currently installed.)", "Preparing to unpack .../audispd-plugins_1%3a3.1.2-2.1build1.1_amd64.deb ...", "Unpacking audispd-plugins (1:3.1.2-2.1build1.1) ...", "Setting up audispd-plugins (1:3.1.2-2.1build1.1) ..."]} 2026-07-20 09:53:49.494136 | ubuntu-noble | 2026-07-20 09:53:49.494281 | ubuntu-noble | TASK [auditd : Copy auditd.conf configuration files] *************************** 2026-07-20 09:53:50.195706 | debian-bookworm | --- before 2026-07-20 09:53:50.195819 | debian-bookworm | +++ after: /home/zuul/.ansible/tmp/ansible-local-2190j_21n29n/tmptr53m7a6/20-neo23x0.rules.j2 2026-07-20 09:53:50.195901 | debian-bookworm | @@ -0,0 +1,750 @@ 2026-07-20 09:53:50.196099 | debian-bookworm | +# ___ ___ __ __ 2026-07-20 09:53:50.196302 | debian-bookworm | +# / | __ ______/ (_) /_____/ / 2026-07-20 09:53:50.196498 | debian-bookworm | +# / /| |/ / / / __ / / __/ __ / 2026-07-20 09:53:50.196714 | debian-bookworm | +# / ___ / /_/ / /_/ / / /_/ /_/ / 2026-07-20 09:53:50.196899 | debian-bookworm | +# /_/ |_\__,_/\__,_/_/\__/\__,_/ 2026-07-20 09:53:50.197120 | debian-bookworm | +# 2026-07-20 09:53:50.197318 | debian-bookworm | +# Linux Audit Daemon - Best Practice Configuration 2026-07-20 09:53:50.197555 | debian-bookworm | +# /etc/audit/audit.rules 2026-07-20 09:53:50.197760 | debian-bookworm | +# 2026-07-20 09:53:50.197958 | debian-bookworm | +# Compiled by Florian Roth 2026-07-20 09:53:50.198124 | debian-bookworm | +# 2026-07-20 09:53:50.198297 | debian-bookworm | +# Created : 2017/12/05 2026-07-20 09:53:50.198501 | debian-bookworm | +# Modified : 2023/01/25 2026-07-20 09:53:50.198725 | debian-bookworm | +# 2026-07-20 09:53:50.198895 | debian-bookworm | +# Based on rules published here: 2026-07-20 09:53:50.199065 | debian-bookworm | +# Gov.uk auditd rules 2026-07-20 09:53:50.199476 | debian-bookworm | +# https://github.com/gds-operations/puppet-auditd/pull/1 2026-07-20 09:53:50.199759 | debian-bookworm | +# CentOS 7 hardening 2026-07-20 09:53:50.200042 | debian-bookworm | +# https://highon.coffee/blog/security-harden-centos-7/#auditd---audit-daemon 2026-07-20 09:53:50.200288 | debian-bookworm | +# Linux audit repo 2026-07-20 09:53:50.200593 | debian-bookworm | +# https://github.com/linux-audit/audit-userspace/tree/master/rules 2026-07-20 09:53:50.200844 | debian-bookworm | +# Auditd high performance linux auditing 2026-07-20 09:53:50.201081 | debian-bookworm | +# https://linux-audit.com/tuning-auditd-high-performance-linux-auditing/ 2026-07-20 09:53:50.201242 | debian-bookworm | +# 2026-07-20 09:53:50.201402 | debian-bookworm | +# Further rules 2026-07-20 09:53:50.201644 | debian-bookworm | +# For PCI DSS compliance see: 2026-07-20 09:53:50.201880 | debian-bookworm | +# https://github.com/linux-audit/audit-userspace/blob/master/rules/30-pci-dss-v31.rules 2026-07-20 09:53:50.202098 | debian-bookworm | +# For NISPOM compliance see: 2026-07-20 09:53:50.202325 | debian-bookworm | +# https://github.com/linux-audit/audit-userspace/blob/master/rules/30-nispom.rules 2026-07-20 09:53:50.206436 | debian-bookworm | + 2026-07-20 09:53:50.206471 | debian-bookworm | +# Remove any existing rules 2026-07-20 09:53:50.206479 | debian-bookworm | +-D 2026-07-20 09:53:50.206524 | debian-bookworm | + 2026-07-20 09:53:50.206532 | debian-bookworm | +# Buffer Size 2026-07-20 09:53:50.206539 | debian-bookworm | +## Feel free to increase this if the machine panic's 2026-07-20 09:53:50.206545 | debian-bookworm | +-b 8192 2026-07-20 09:53:50.206552 | debian-bookworm | + 2026-07-20 09:53:50.206558 | debian-bookworm | +# Failure Mode 2026-07-20 09:53:50.206565 | debian-bookworm | +## Possible values: 0 (silent), 1 (printk, print a failure message), 2 (panic, halt the system) 2026-07-20 09:53:50.206572 | debian-bookworm | +-f 1 2026-07-20 09:53:50.206578 | debian-bookworm | + 2026-07-20 09:53:50.206585 | debian-bookworm | +# Ignore errors 2026-07-20 09:53:50.206592 | debian-bookworm | +## e.g. caused by users or files not found in the local environment 2026-07-20 09:53:50.206598 | debian-bookworm | +-i 2026-07-20 09:53:50.206605 | debian-bookworm | + 2026-07-20 09:53:50.206612 | debian-bookworm | +# Self Auditing --------------------------------------------------------------- 2026-07-20 09:53:50.206618 | debian-bookworm | + 2026-07-20 09:53:50.206625 | debian-bookworm | +## Audit the audit logs 2026-07-20 09:53:50.206632 | debian-bookworm | +### Successful and unsuccessful attempts to read information from the audit records 2026-07-20 09:53:50.206638 | debian-bookworm | +-w /var/log/audit/ -p wra -k auditlog 2026-07-20 09:53:50.206645 | debian-bookworm | +-w /var/audit/ -p wra -k auditlog 2026-07-20 09:53:50.206652 | debian-bookworm | + 2026-07-20 09:53:50.206659 | debian-bookworm | +## Auditd configuration 2026-07-20 09:53:50.206666 | debian-bookworm | +### Modifications to audit configuration that occur while the audit collection functions are operating 2026-07-20 09:53:50.206672 | debian-bookworm | +-w /etc/audit/ -p wa -k auditconfig 2026-07-20 09:53:50.206679 | debian-bookworm | +-w /etc/libaudit.conf -p wa -k auditconfig 2026-07-20 09:53:50.206686 | debian-bookworm | +-w /etc/audisp/ -p wa -k audispconfig 2026-07-20 09:53:50.206692 | debian-bookworm | + 2026-07-20 09:53:50.206704 | debian-bookworm | +## Monitor for use of audit management tools 2026-07-20 09:53:50.206711 | debian-bookworm | +-w /sbin/auditctl -p x -k audittools 2026-07-20 09:53:50.206719 | debian-bookworm | +-w /sbin/auditd -p x -k audittools 2026-07-20 09:53:50.206847 | debian-bookworm | +-w /usr/sbin/auditd -p x -k audittools 2026-07-20 09:53:50.206971 | debian-bookworm | +-w /usr/sbin/augenrules -p x -k audittools 2026-07-20 09:53:50.207092 | debian-bookworm | + 2026-07-20 09:53:50.207219 | debian-bookworm | +## Access to all audit trails 2026-07-20 09:53:50.207337 | debian-bookworm | + 2026-07-20 09:53:50.207467 | debian-bookworm | +-a always,exit -F path=/usr/sbin/ausearch -F perm=x -k audittools 2026-07-20 09:53:50.207603 | debian-bookworm | +-a always,exit -F path=/usr/sbin/aureport -F perm=x -k audittools 2026-07-20 09:53:50.207731 | debian-bookworm | +-a always,exit -F path=/usr/sbin/aulast -F perm=x -k audittools 2026-07-20 09:53:50.207857 | debian-bookworm | +-a always,exit -F path=/usr/sbin/aulastlogin -F perm=x -k audittools 2026-07-20 09:53:50.207977 | debian-bookworm | +-a always,exit -F path=/usr/sbin/auvirt -F perm=x -k audittools 2026-07-20 09:53:50.208098 | debian-bookworm | + 2026-07-20 09:53:50.208222 | debian-bookworm | +# Filters --------------------------------------------------------------------- 2026-07-20 09:53:50.208339 | debian-bookworm | + 2026-07-20 09:53:50.208469 | debian-bookworm | +### We put these early because audit is a first match wins system. 2026-07-20 09:53:50.208599 | debian-bookworm | + 2026-07-20 09:53:50.208724 | debian-bookworm | +## Ignore SELinux AVC records 2026-07-20 09:53:50.208850 | debian-bookworm | +-a always,exclude -F msgtype=AVC 2026-07-20 09:53:50.208970 | debian-bookworm | + 2026-07-20 09:53:50.209101 | debian-bookworm | +## Ignore current working directory records 2026-07-20 09:53:50.209225 | debian-bookworm | +-a always,exclude -F msgtype=CWD 2026-07-20 09:53:50.209343 | debian-bookworm | + 2026-07-20 09:53:50.209480 | debian-bookworm | +## Cron jobs fill the logs with stuff we normally don't want (works with SELinux) 2026-07-20 09:53:50.209608 | debian-bookworm | +-a never,user -F subj_type=crond_t 2026-07-20 09:53:50.209730 | debian-bookworm | +-a never,exit -F subj_type=crond_t 2026-07-20 09:53:50.209859 | debian-bookworm | + 2026-07-20 09:53:50.209980 | debian-bookworm | +## This prevents chrony from overwhelming the logs 2026-07-20 09:53:50.210105 | debian-bookworm | +-a never,exit -F arch=b64 -S adjtimex -F auid=-1 -F uid=chrony -F subj_type=chronyd_t 2026-07-20 09:53:50.210222 | debian-bookworm | + 2026-07-20 09:53:50.210347 | debian-bookworm | +## This is not very interesting and wastes a lot of space if the server is public facing 2026-07-20 09:53:50.210543 | debian-bookworm | +-a always,exclude -F msgtype=CRYPTO_KEY_USER 2026-07-20 09:53:50.210670 | debian-bookworm | + 2026-07-20 09:53:50.210791 | debian-bookworm | +## Open VM Tools 2026-07-20 09:53:50.210915 | debian-bookworm | +-a exit,never -F arch=b64 -S all -F exe=/usr/bin/vmtoolsd 2026-07-20 09:53:50.211035 | debian-bookworm | + 2026-07-20 09:53:50.211157 | debian-bookworm | +## High Volume Event Filter (especially on Linux Workstations) 2026-07-20 09:53:50.211275 | debian-bookworm | +-a never,exit -F arch=b64 -F dir=/dev/shm -k sharedmemaccess 2026-07-20 09:53:50.211393 | debian-bookworm | +-a never,exit -F arch=b64 -F dir=/var/lock/lvm -k locklvm 2026-07-20 09:53:50.211525 | debian-bookworm | + 2026-07-20 09:53:50.211633 | debian-bookworm | +## FileBeat 2026-07-20 09:53:50.211750 | debian-bookworm | +-a never,exit -F arch=b64 -F path=/opt/filebeat -k filebeat 2026-07-20 09:53:50.211865 | debian-bookworm | + 2026-07-20 09:53:50.211979 | debian-bookworm | +## More information on how to filter events 2026-07-20 09:53:50.212098 | debian-bookworm | +### https://access.redhat.com/solutions/2482221 2026-07-20 09:53:50.212208 | debian-bookworm | + 2026-07-20 09:53:50.212325 | debian-bookworm | +# Rules ----------------------------------------------------------------------- 2026-07-20 09:53:50.212439 | debian-bookworm | + 2026-07-20 09:53:50.212774 | debian-bookworm | +## Kernel parameters 2026-07-20 09:53:50.212914 | debian-bookworm | +-w /etc/sysctl.conf -p wa -k sysctl 2026-07-20 09:53:50.213036 | debian-bookworm | +-w /etc/sysctl.d -p wa -k sysctl 2026-07-20 09:53:50.213151 | debian-bookworm | + 2026-07-20 09:53:50.213275 | debian-bookworm | +## Kernel module loading and unloading 2026-07-20 09:53:50.213400 | debian-bookworm | +-a always,exit -F perm=x -F auid!=-1 -F path=/sbin/insmod -k modules 2026-07-20 09:53:50.213559 | debian-bookworm | +-a always,exit -F perm=x -F auid!=-1 -F path=/sbin/modprobe -k modules 2026-07-20 09:53:50.213697 | debian-bookworm | +-a always,exit -F perm=x -F auid!=-1 -F path=/sbin/rmmod -k modules 2026-07-20 09:53:50.213798 | debian-bookworm | +-a always,exit -F arch=b64 -S finit_module -S init_module -S delete_module -F auid!=-1 -k modules 2026-07-20 09:53:50.213901 | debian-bookworm | + 2026-07-20 09:53:50.214007 | debian-bookworm | +## Modprobe configuration 2026-07-20 09:53:50.214118 | debian-bookworm | +-w /etc/modprobe.conf -p wa -k modprobe 2026-07-20 09:53:50.214223 | debian-bookworm | +-w /etc/modprobe.d -p wa -k modprobe 2026-07-20 09:53:50.214331 | debian-bookworm | + 2026-07-20 09:53:50.214467 | debian-bookworm | +## KExec usage (all actions) 2026-07-20 09:53:50.214587 | debian-bookworm | +-a always,exit -F arch=b64 -S kexec_load -k KEXEC 2026-07-20 09:53:50.214694 | debian-bookworm | + 2026-07-20 09:53:50.214835 | debian-bookworm | +## Special files 2026-07-20 09:53:50.214912 | debian-bookworm | +-a always,exit -F arch=b64 -S mknod -S mknodat -k specialfiles 2026-07-20 09:53:50.215009 | debian-bookworm | + 2026-07-20 09:53:50.215114 | debian-bookworm | +## Mount operations (only attributable) 2026-07-20 09:53:50.215226 | debian-bookworm | +-a always,exit -F arch=b64 -S mount -S umount2 -F auid!=-1 -k mount 2026-07-20 09:53:50.215330 | debian-bookworm | + 2026-07-20 09:53:50.215436 | debian-bookworm | +### NFS mount 2026-07-20 09:53:50.215560 | debian-bookworm | +-a always,exit -F path=/sbin/mount.nfs -F perm=x -F auid>=500 -F auid!=4294967295 -k T1078_Valid_Accounts 2026-07-20 09:53:50.215673 | debian-bookworm | +-a always,exit -F path=/usr/sbin/mount.nfs -F perm=x -F auid>=500 -F auid!=4294967295 -k T1078_Valid_Accounts 2026-07-20 09:53:50.215773 | debian-bookworm | + 2026-07-20 09:53:50.215898 | debian-bookworm | +## Change swap (only attributable) 2026-07-20 09:53:50.215989 | debian-bookworm | +-a always,exit -F arch=b64 -S swapon -S swapoff -F auid!=-1 -k swap 2026-07-20 09:53:50.216091 | debian-bookworm | + 2026-07-20 09:53:50.216199 | debian-bookworm | +## Time 2026-07-20 09:53:50.216311 | debian-bookworm | +-a always,exit -F arch=b64 -F uid!=ntp -S adjtimex -S settimeofday -S clock_settime -k time 2026-07-20 09:53:50.216418 | debian-bookworm | +### Local time zone 2026-07-20 09:53:50.216559 | debian-bookworm | +-w /etc/localtime -p wa -k localtime 2026-07-20 09:53:50.216665 | debian-bookworm | + 2026-07-20 09:53:50.216770 | debian-bookworm | +## Stunnel 2026-07-20 09:53:50.216878 | debian-bookworm | +-w /usr/sbin/stunnel -p x -k stunnel 2026-07-20 09:53:50.217000 | debian-bookworm | +-w /usr/bin/stunnel -p x -k stunnel 2026-07-20 09:53:50.217090 | debian-bookworm | + 2026-07-20 09:53:50.217189 | debian-bookworm | +## Cron configuration & scheduled jobs 2026-07-20 09:53:50.217288 | debian-bookworm | +-w /etc/cron.allow -p wa -k cron 2026-07-20 09:53:50.217383 | debian-bookworm | +-w /etc/cron.deny -p wa -k cron 2026-07-20 09:53:50.217481 | debian-bookworm | +-w /etc/cron.d/ -p wa -k cron 2026-07-20 09:53:50.217586 | debian-bookworm | +-w /etc/cron.daily/ -p wa -k cron 2026-07-20 09:53:50.217688 | debian-bookworm | +-w /etc/cron.hourly/ -p wa -k cron 2026-07-20 09:53:50.217776 | debian-bookworm | +-w /etc/cron.monthly/ -p wa -k cron 2026-07-20 09:53:50.217873 | debian-bookworm | +-w /etc/cron.weekly/ -p wa -k cron 2026-07-20 09:53:50.217969 | debian-bookworm | +-w /etc/crontab -p wa -k cron 2026-07-20 09:53:50.218066 | debian-bookworm | +-w /var/spool/cron/ -p wa -k cron 2026-07-20 09:53:50.218161 | debian-bookworm | + 2026-07-20 09:53:50.218258 | debian-bookworm | +## User, group, password databases 2026-07-20 09:53:50.218358 | debian-bookworm | +-w /etc/group -p wa -k etcgroup 2026-07-20 09:53:50.218473 | debian-bookworm | +-w /etc/passwd -p wa -k etcpasswd 2026-07-20 09:53:50.218605 | debian-bookworm | +-w /etc/gshadow -k etcgroup 2026-07-20 09:53:50.218701 | debian-bookworm | +-w /etc/shadow -k etcpasswd 2026-07-20 09:53:50.218799 | debian-bookworm | +-w /etc/security/opasswd -k opasswd 2026-07-20 09:53:50.218894 | debian-bookworm | + 2026-07-20 09:53:50.218993 | debian-bookworm | +## Sudoers file changes 2026-07-20 09:53:50.219213 | debian-bookworm | +-w /etc/sudoers -p wa -k actions 2026-07-20 09:53:50.219223 | debian-bookworm | +-w /etc/sudoers.d/ -p wa -k actions 2026-07-20 09:53:50.219277 | debian-bookworm | + 2026-07-20 09:53:50.219390 | debian-bookworm | +## Passwd 2026-07-20 09:53:50.219493 | debian-bookworm | +-w /usr/bin/passwd -p x -k passwd_modification 2026-07-20 09:53:50.219606 | debian-bookworm | + 2026-07-20 09:53:50.219701 | debian-bookworm | +## Tools to change group identifiers 2026-07-20 09:53:50.219801 | debian-bookworm | +-w /usr/sbin/groupadd -p x -k group_modification 2026-07-20 09:53:50.219903 | debian-bookworm | +-w /usr/sbin/groupmod -p x -k group_modification 2026-07-20 09:53:50.220085 | debian-bookworm | +-w /usr/sbin/addgroup -p x -k group_modification 2026-07-20 09:53:50.220183 | debian-bookworm | +-w /usr/sbin/useradd -p x -k user_modification 2026-07-20 09:53:50.220282 | debian-bookworm | +-w /usr/sbin/userdel -p x -k user_modification 2026-07-20 09:53:50.220397 | debian-bookworm | +-w /usr/sbin/usermod -p x -k user_modification 2026-07-20 09:53:50.220495 | debian-bookworm | +-w /usr/sbin/adduser -p x -k user_modification 2026-07-20 09:53:50.220628 | debian-bookworm | + 2026-07-20 09:53:50.220725 | debian-bookworm | +## Login configuration and information 2026-07-20 09:53:50.220823 | debian-bookworm | +-w /etc/login.defs -p wa -k login 2026-07-20 09:53:50.220921 | debian-bookworm | +-w /etc/securetty -p wa -k login 2026-07-20 09:53:50.221022 | debian-bookworm | +-w /var/log/faillog -p wa -k login 2026-07-20 09:53:50.221118 | debian-bookworm | +-w /var/log/lastlog -p wa -k login 2026-07-20 09:53:50.221215 | debian-bookworm | +-w /var/log/tallylog -p wa -k login 2026-07-20 09:53:50.221310 | debian-bookworm | + 2026-07-20 09:53:50.221431 | debian-bookworm | +## Network Environment 2026-07-20 09:53:50.221550 | debian-bookworm | +### Changes to hostname 2026-07-20 09:53:50.221619 | debian-bookworm | +-a always,exit -F arch=b64 -S sethostname -S setdomainname -k network_modifications 2026-07-20 09:53:50.221714 | debian-bookworm | + 2026-07-20 09:53:50.221811 | debian-bookworm | +### Detect Remote Shell Use 2026-07-20 09:53:50.221912 | debian-bookworm | +-a always,exit -F arch=b64 -F exe=/bin/bash -F success=1 -S connect -k "remote_shell" 2026-07-20 09:53:50.222014 | debian-bookworm | +-a always,exit -F arch=b64 -F exe=/usr/bin/bash -F success=1 -S connect -k "remote_shell" 2026-07-20 09:53:50.222109 | debian-bookworm | + 2026-07-20 09:53:50.222209 | debian-bookworm | +### Successful IPv4 Connections 2026-07-20 09:53:50.222310 | debian-bookworm | +-a always,exit -F arch=b64 -S connect -F a2=16 -F success=1 -F key=network_connect_4 2026-07-20 09:53:50.222426 | debian-bookworm | + 2026-07-20 09:53:50.222536 | debian-bookworm | +### Successful IPv6 Connections 2026-07-20 09:53:50.222640 | debian-bookworm | +-a always,exit -F arch=b64 -S connect -F a2=28 -F success=1 -F key=network_connect_6 2026-07-20 09:53:50.222733 | debian-bookworm | + 2026-07-20 09:53:50.222830 | debian-bookworm | +### Changes to other files 2026-07-20 09:53:50.222928 | debian-bookworm | +-w /etc/hosts -p wa -k network_modifications 2026-07-20 09:53:50.223029 | debian-bookworm | +-w /etc/sysconfig/network -p wa -k network_modifications 2026-07-20 09:53:50.223130 | debian-bookworm | +-w /etc/sysconfig/network-scripts -p w -k network_modifications 2026-07-20 09:53:50.223228 | debian-bookworm | +-w /etc/network/ -p wa -k network 2026-07-20 09:53:50.223327 | debian-bookworm | +-a always,exit -F dir=/etc/NetworkManager/ -F perm=wa -k network_modifications 2026-07-20 09:53:50.223421 | debian-bookworm | + 2026-07-20 09:53:50.223567 | debian-bookworm | +### Changes to issue 2026-07-20 09:53:50.223644 | debian-bookworm | +-w /etc/issue -p wa -k etcissue 2026-07-20 09:53:50.223741 | debian-bookworm | +-w /etc/issue.net -p wa -k etcissue 2026-07-20 09:53:50.223838 | debian-bookworm | + 2026-07-20 09:53:50.223934 | debian-bookworm | +## System startup scripts 2026-07-20 09:53:50.224028 | debian-bookworm | +-w /etc/inittab -p wa -k init 2026-07-20 09:53:50.224126 | debian-bookworm | +-w /etc/init.d/ -p wa -k init 2026-07-20 09:53:50.224223 | debian-bookworm | +-w /etc/init/ -p wa -k init 2026-07-20 09:53:50.224315 | debian-bookworm | + 2026-07-20 09:53:50.224413 | debian-bookworm | +## Library search paths 2026-07-20 09:53:50.224529 | debian-bookworm | +-w /etc/ld.so.conf -p wa -k libpath 2026-07-20 09:53:50.224619 | debian-bookworm | +-w /etc/ld.so.conf.d -p wa -k libpath 2026-07-20 09:53:50.224717 | debian-bookworm | + 2026-07-20 09:53:50.224818 | debian-bookworm | +## Systemwide library preloads (LD_PRELOAD) 2026-07-20 09:53:50.224917 | debian-bookworm | +-w /etc/ld.so.preload -p wa -k systemwide_preloads 2026-07-20 09:53:50.225013 | debian-bookworm | + 2026-07-20 09:53:50.225114 | debian-bookworm | +## Pam configuration 2026-07-20 09:53:50.225214 | debian-bookworm | +-w /etc/pam.d/ -p wa -k pam 2026-07-20 09:53:50.225310 | debian-bookworm | +-w /etc/security/limits.conf -p wa -k pam 2026-07-20 09:53:50.225407 | debian-bookworm | +-w /etc/security/limits.d -p wa -k pam 2026-07-20 09:53:50.225527 | debian-bookworm | +-w /etc/security/pam_env.conf -p wa -k pam 2026-07-20 09:53:50.225613 | debian-bookworm | +-w /etc/security/namespace.conf -p wa -k pam 2026-07-20 09:53:50.225713 | debian-bookworm | +-w /etc/security/namespace.d -p wa -k pam 2026-07-20 09:53:50.225809 | debian-bookworm | +-w /etc/security/namespace.init -p wa -k pam 2026-07-20 09:53:50.225905 | debian-bookworm | + 2026-07-20 09:53:50.225999 | debian-bookworm | +## Mail configuration 2026-07-20 09:53:50.226095 | debian-bookworm | +-w /etc/aliases -p wa -k mail 2026-07-20 09:53:50.226193 | debian-bookworm | +-w /etc/postfix/ -p wa -k mail 2026-07-20 09:53:50.226318 | debian-bookworm | +-w /etc/exim4/ -p wa -k mail 2026-07-20 09:53:50.226460 | debian-bookworm | + 2026-07-20 09:53:50.226595 | debian-bookworm | +## SSH configuration 2026-07-20 09:53:50.226700 | debian-bookworm | +-w /etc/ssh/sshd_config -k sshd 2026-07-20 09:53:50.226795 | debian-bookworm | +-w /etc/ssh/sshd_config.d -k sshd 2026-07-20 09:53:50.226891 | debian-bookworm | + 2026-07-20 09:53:50.226987 | debian-bookworm | +## root ssh key tampering 2026-07-20 09:53:50.227086 | debian-bookworm | +-w /root/.ssh -p wa -k rootkey 2026-07-20 09:53:50.227181 | debian-bookworm | + 2026-07-20 09:53:50.227279 | debian-bookworm | +# Systemd 2026-07-20 09:53:50.227378 | debian-bookworm | +-w /bin/systemctl -p x -k systemd 2026-07-20 09:53:50.227475 | debian-bookworm | +-w /etc/systemd/ -p wa -k systemd 2026-07-20 09:53:50.227585 | debian-bookworm | +-w /usr/lib/systemd -p wa -k systemd 2026-07-20 09:53:50.227682 | debian-bookworm | + 2026-07-20 09:53:50.227782 | debian-bookworm | +## https://systemd.network/systemd.generator.html 2026-07-20 09:53:50.227883 | debian-bookworm | +-w /etc/systemd/system-generators/ -p wa -k systemd_generator 2026-07-20 09:53:50.227984 | debian-bookworm | +-w /usr/local/lib/systemd/system-generators/ -p wa -k systemd_generator 2026-07-20 09:53:50.228081 | debian-bookworm | +-w /usr/lib/systemd/system-generators -p wa -k systemd_generator 2026-07-20 09:53:50.228178 | debian-bookworm | + 2026-07-20 09:53:50.228275 | debian-bookworm | +-w /etc/systemd/user-generators/ -p wa -k systemd_generator 2026-07-20 09:53:50.228375 | debian-bookworm | +-w /usr/local/lib/systemd/user-generators/ -p wa -k systemd_generator 2026-07-20 09:53:50.228474 | debian-bookworm | +-w /lib/systemd/system-generators/ -p wa -k systemd_generator 2026-07-20 09:53:50.228582 | debian-bookworm | + 2026-07-20 09:53:50.228685 | debian-bookworm | +## SELinux events that modify the system's Mandatory Access Controls (MAC) 2026-07-20 09:53:50.228785 | debian-bookworm | +-w /etc/selinux/ -p wa -k mac_policy 2026-07-20 09:53:50.228883 | debian-bookworm | + 2026-07-20 09:53:50.228979 | debian-bookworm | +## Critical elements access failures 2026-07-20 09:53:50.229080 | debian-bookworm | +-a always,exit -F arch=b64 -S open -F dir=/etc -F success=0 -k unauthedfileaccess 2026-07-20 09:53:50.229184 | debian-bookworm | +-a always,exit -F arch=b64 -S open -F dir=/bin -F success=0 -k unauthedfileaccess 2026-07-20 09:53:50.229297 | debian-bookworm | +-a always,exit -F arch=b64 -S open -F dir=/sbin -F success=0 -k unauthedfileaccess 2026-07-20 09:53:50.229397 | debian-bookworm | +-a always,exit -F arch=b64 -S open -F dir=/usr/bin -F success=0 -k unauthedfileaccess 2026-07-20 09:53:50.229499 | debian-bookworm | +-a always,exit -F arch=b64 -S open -F dir=/usr/sbin -F success=0 -k unauthedfileaccess 2026-07-20 09:53:50.229609 | debian-bookworm | +-a always,exit -F arch=b64 -S open -F dir=/var -F success=0 -k unauthedfileaccess 2026-07-20 09:53:50.229708 | debian-bookworm | +-a always,exit -F arch=b64 -S open -F dir=/home -F success=0 -k unauthedfileaccess 2026-07-20 09:53:50.229813 | debian-bookworm | +-a always,exit -F arch=b64 -S open -F dir=/srv -F success=0 -k unauthedfileaccess 2026-07-20 09:53:50.229911 | debian-bookworm | + 2026-07-20 09:53:50.230009 | debian-bookworm | +## Process ID change (switching accounts) applications 2026-07-20 09:53:50.230128 | debian-bookworm | +-w /bin/su -p x -k priv_esc 2026-07-20 09:53:50.230205 | debian-bookworm | +-w /usr/bin/sudo -p x -k priv_esc 2026-07-20 09:53:50.230299 | debian-bookworm | + 2026-07-20 09:53:50.230420 | debian-bookworm | +## Power state 2026-07-20 09:53:50.230547 | debian-bookworm | +-w /sbin/shutdown -p x -k power 2026-07-20 09:53:50.230649 | debian-bookworm | +-w /sbin/poweroff -p x -k power 2026-07-20 09:53:50.230746 | debian-bookworm | +-w /sbin/reboot -p x -k power 2026-07-20 09:53:50.230843 | debian-bookworm | +-w /sbin/halt -p x -k power 2026-07-20 09:53:50.230938 | debian-bookworm | + 2026-07-20 09:53:50.231036 | debian-bookworm | +## Session initiation information 2026-07-20 09:53:50.231133 | debian-bookworm | +-w /var/run/utmp -p wa -k session 2026-07-20 09:53:50.231232 | debian-bookworm | +-w /var/log/btmp -p wa -k session 2026-07-20 09:53:50.231330 | debian-bookworm | +-w /var/log/wtmp -p wa -k session 2026-07-20 09:53:50.231426 | debian-bookworm | + 2026-07-20 09:53:50.231542 | debian-bookworm | +## Discretionary Access Control (DAC) modifications 2026-07-20 09:53:50.231640 | debian-bookworm | +-a always,exit -F arch=b64 -S chmod -F auid>=1000 -F auid!=-1 -k perm_mod 2026-07-20 09:53:50.231738 | debian-bookworm | +-a always,exit -F arch=b64 -S chown -F auid>=1000 -F auid!=-1 -k perm_mod 2026-07-20 09:53:50.231837 | debian-bookworm | +-a always,exit -F arch=b64 -S fchmod -F auid>=1000 -F auid!=-1 -k perm_mod 2026-07-20 09:53:50.231937 | debian-bookworm | +-a always,exit -F arch=b64 -S fchmodat -F auid>=1000 -F auid!=-1 -k perm_mod 2026-07-20 09:53:50.232036 | debian-bookworm | +-a always,exit -F arch=b64 -S fchown -F auid>=1000 -F auid!=-1 -k perm_mod 2026-07-20 09:53:50.232133 | debian-bookworm | +-a always,exit -F arch=b64 -S fchownat -F auid>=1000 -F auid!=-1 -k perm_mod 2026-07-20 09:53:50.232231 | debian-bookworm | +-a always,exit -F arch=b64 -S fremovexattr -F auid>=1000 -F auid!=-1 -k perm_mod 2026-07-20 09:53:50.232327 | debian-bookworm | +-a always,exit -F arch=b64 -S fsetxattr -F auid>=1000 -F auid!=-1 -k perm_mod 2026-07-20 09:53:50.232424 | debian-bookworm | +-a always,exit -F arch=b64 -S lchown -F auid>=1000 -F auid!=-1 -k perm_mod 2026-07-20 09:53:50.232553 | debian-bookworm | +-a always,exit -F arch=b64 -S lremovexattr -F auid>=1000 -F auid!=-1 -k perm_mod 2026-07-20 09:53:50.232630 | debian-bookworm | +-a always,exit -F arch=b64 -S lsetxattr -F auid>=1000 -F auid!=-1 -k perm_mod 2026-07-20 09:53:50.232728 | debian-bookworm | +-a always,exit -F arch=b64 -S removexattr -F auid>=1000 -F auid!=-1 -k perm_mod 2026-07-20 09:53:50.232828 | debian-bookworm | +-a always,exit -F arch=b64 -S setxattr -F auid>=1000 -F auid!=-1 -k perm_mod 2026-07-20 09:53:50.232921 | debian-bookworm | + 2026-07-20 09:53:50.233018 | debian-bookworm | +# Special Rules --------------------------------------------------------------- 2026-07-20 09:53:50.233111 | debian-bookworm | + 2026-07-20 09:53:50.233211 | debian-bookworm | +## Reconnaissance 2026-07-20 09:53:50.233308 | debian-bookworm | +-w /usr/bin/whoami -p x -k recon 2026-07-20 09:53:50.233407 | debian-bookworm | +-w /usr/bin/id -p x -k recon 2026-07-20 09:53:50.233544 | debian-bookworm | +-w /bin/hostname -p x -k recon 2026-07-20 09:53:50.233632 | debian-bookworm | +-w /bin/uname -p x -k recon 2026-07-20 09:53:50.233732 | debian-bookworm | +-w /etc/issue -p r -k recon 2026-07-20 09:53:50.233828 | debian-bookworm | +-w /etc/hostname -p r -k recon 2026-07-20 09:53:50.233922 | debian-bookworm | + 2026-07-20 09:53:50.234019 | debian-bookworm | +## Suspicious activity 2026-07-20 09:53:50.234118 | debian-bookworm | +-w /usr/bin/wget -p x -k susp_activity 2026-07-20 09:53:50.234216 | debian-bookworm | +-w /usr/bin/curl -p x -k susp_activity 2026-07-20 09:53:50.234315 | debian-bookworm | +-w /usr/bin/base64 -p x -k susp_activity 2026-07-20 09:53:50.234431 | debian-bookworm | +-w /bin/nc -p x -k susp_activity 2026-07-20 09:53:50.234555 | debian-bookworm | +-w /bin/netcat -p x -k susp_activity 2026-07-20 09:53:50.234641 | debian-bookworm | +-w /usr/bin/ncat -p x -k susp_activity 2026-07-20 09:53:50.234742 | debian-bookworm | +-w /usr/bin/ss -p x -k susp_activity 2026-07-20 09:53:50.234838 | debian-bookworm | +-w /usr/bin/netstat -p x -k susp_activity 2026-07-20 09:53:50.234934 | debian-bookworm | +-w /usr/bin/ssh -p x -k susp_activity 2026-07-20 09:53:50.235032 | debian-bookworm | +-w /usr/bin/scp -p x -k susp_activity 2026-07-20 09:53:50.235137 | debian-bookworm | +-w /usr/bin/sftp -p x -k susp_activity 2026-07-20 09:53:50.235229 | debian-bookworm | +-w /usr/bin/ftp -p x -k susp_activity 2026-07-20 09:53:50.235326 | debian-bookworm | +-w /usr/bin/socat -p x -k susp_activity 2026-07-20 09:53:50.235422 | debian-bookworm | +-w /usr/bin/wireshark -p x -k susp_activity 2026-07-20 09:53:50.235579 | debian-bookworm | +-w /usr/bin/tshark -p x -k susp_activity 2026-07-20 09:53:50.235651 | debian-bookworm | +-w /usr/bin/rawshark -p x -k susp_activity 2026-07-20 09:53:50.235748 | debian-bookworm | +-w /usr/bin/rdesktop -p x -k susp_activity 2026-07-20 09:53:50.235845 | debian-bookworm | +-w /usr/local/bin/rdesktop -p x -k susp_activity 2026-07-20 09:53:50.235942 | debian-bookworm | +-w /usr/bin/wlfreerdp -p x -k susp_activity 2026-07-20 09:53:50.236045 | debian-bookworm | +-w /usr/bin/xfreerdp -p x -k susp_activity 2026-07-20 09:53:50.236141 | debian-bookworm | +-w /usr/local/bin/xfreerdp -p x -k susp_activity 2026-07-20 09:53:50.236237 | debian-bookworm | +-w /usr/bin/nmap -p x -k susp_activity 2026-07-20 09:53:50.236333 | debian-bookworm | + 2026-07-20 09:53:50.236426 | debian-bookworm | +## sssd 2026-07-20 09:53:50.236539 | debian-bookworm | +-a always,exit -F path=/usr/libexec/sssd/p11_child -F perm=x -F auid>=500 -F auid!=4294967295 -k T1078_Valid_Accounts 2026-07-20 09:53:50.236660 | debian-bookworm | +-a always,exit -F path=/usr/libexec/sssd/krb5_child -F perm=x -F auid>=500 -F auid!=4294967295 -k T1078_Valid_Accounts 2026-07-20 09:53:50.236744 | debian-bookworm | +-a always,exit -F path=/usr/libexec/sssd/ldap_child -F perm=x -F auid>=500 -F auid!=4294967295 -k T1078_Valid_Accounts 2026-07-20 09:53:50.236845 | debian-bookworm | +-a always,exit -F path=/usr/libexec/sssd/selinux_child -F perm=x -F auid>=500 -F auid!=4294967295 -k T1078_Valid_Accounts 2026-07-20 09:53:50.236944 | debian-bookworm | +-a always,exit -F path=/usr/libexec/sssd/proxy_child -F perm=x -F auid>=500 -F auid!=4294967295 -k T1078_Valid_Accounts 2026-07-20 09:53:50.237039 | debian-bookworm | + 2026-07-20 09:53:50.237141 | debian-bookworm | +## T1002 Data Compressed 2026-07-20 09:53:50.237234 | debian-bookworm | + 2026-07-20 09:53:50.237334 | debian-bookworm | +-w /usr/bin/zip -p x -k Data_Compressed 2026-07-20 09:53:50.237442 | debian-bookworm | +-w /usr/bin/gzip -p x -k Data_Compressed 2026-07-20 09:53:50.237568 | debian-bookworm | +-w /usr/bin/tar -p x -k Data_Compressed 2026-07-20 09:53:50.237652 | debian-bookworm | +-w /usr/bin/bzip2 -p x -k Data_Compressed 2026-07-20 09:53:50.237748 | debian-bookworm | + 2026-07-20 09:53:50.237892 | debian-bookworm | +-w /usr/bin/lzip -p x -k Data_Compressed 2026-07-20 09:53:50.237947 | debian-bookworm | +-w /usr/local/bin/lzip -p x -k Data_Compressed 2026-07-20 09:53:50.238215 | debian-bookworm | + 2026-07-20 09:53:50.238226 | debian-bookworm | +-w /usr/bin/lz4 -p x -k Data_Compressed 2026-07-20 09:53:50.238232 | debian-bookworm | +-w /usr/local/bin/lz4 -p x -k Data_Compressed 2026-07-20 09:53:50.238326 | debian-bookworm | + 2026-07-20 09:53:50.238443 | debian-bookworm | +-w /usr/bin/lzop -p x -k Data_Compressed 2026-07-20 09:53:50.238568 | debian-bookworm | +-w /usr/local/bin/lzop -p x -k Data_Compressed 2026-07-20 09:53:50.238663 | debian-bookworm | + 2026-07-20 09:53:50.238761 | debian-bookworm | +-w /usr/bin/plzip -p x -k Data_Compressed 2026-07-20 09:53:50.238862 | debian-bookworm | +-w /usr/local/bin/plzip -p x -k Data_Compressed 2026-07-20 09:53:50.238955 | debian-bookworm | + 2026-07-20 09:53:50.239057 | debian-bookworm | +-w /usr/bin/pbzip2 -p x -k Data_Compressed 2026-07-20 09:53:50.239152 | debian-bookworm | +-w /usr/local/bin/pbzip2 -p x -k Data_Compressed 2026-07-20 09:53:50.239245 | debian-bookworm | + 2026-07-20 09:53:50.239343 | debian-bookworm | +-w /usr/bin/lbzip2 -p x -k Data_Compressed 2026-07-20 09:53:50.239442 | debian-bookworm | +-w /usr/local/bin/lbzip2 -p x -k Data_Compressed 2026-07-20 09:53:50.239548 | debian-bookworm | + 2026-07-20 09:53:50.239645 | debian-bookworm | +-w /usr/bin/pixz -p x -k Data_Compressed 2026-07-20 09:53:50.239742 | debian-bookworm | +-w /usr/local/bin/pixz -p x -k Data_Compressed 2026-07-20 09:53:50.239838 | debian-bookworm | + 2026-07-20 09:53:50.239943 | debian-bookworm | +-w /usr/bin/pigz -p x -k Data_Compressed 2026-07-20 09:53:50.240040 | debian-bookworm | +-w /usr/local/bin/pigz -p x -k Data_Compressed 2026-07-20 09:53:50.240138 | debian-bookworm | +-w /usr/bin/unpigz -p x -k Data_Compressed 2026-07-20 09:53:50.240238 | debian-bookworm | +-w /usr/local/bin/unpigz -p x -k Data_Compressed 2026-07-20 09:53:50.240333 | debian-bookworm | + 2026-07-20 09:53:50.240431 | debian-bookworm | +-w /usr/bin/zstd -p x -k Data_Compressed 2026-07-20 09:53:50.240676 | debian-bookworm | +-w /usr/local/bin/zstd -p x -k Data_Compressed 2026-07-20 09:53:50.240748 | debian-bookworm | + 2026-07-20 09:53:50.240771 | debian-bookworm | +## Added to catch netcat on Ubuntu 2026-07-20 09:53:50.240838 | debian-bookworm | +-w /bin/nc.openbsd -p x -k susp_activity 2026-07-20 09:53:50.240938 | debian-bookworm | +-w /bin/nc.traditional -p x -k susp_activity 2026-07-20 09:53:50.241062 | debian-bookworm | + 2026-07-20 09:53:50.241129 | debian-bookworm | +## Sbin suspicious activity 2026-07-20 09:53:50.241224 | debian-bookworm | +-w /sbin/iptables -p x -k sbin_susp 2026-07-20 09:53:50.241318 | debian-bookworm | +-w /sbin/ip6tables -p x -k sbin_susp 2026-07-20 09:53:50.241413 | debian-bookworm | +-w /sbin/ifconfig -p x -k sbin_susp 2026-07-20 09:53:50.241530 | debian-bookworm | +-w /usr/sbin/arptables -p x -k sbin_susp 2026-07-20 09:53:50.241633 | debian-bookworm | +-w /usr/sbin/ebtables -p x -k sbin_susp 2026-07-20 09:53:50.241730 | debian-bookworm | +-w /sbin/xtables-nft-multi -p x -k sbin_susp 2026-07-20 09:53:50.241828 | debian-bookworm | +-w /usr/sbin/nft -p x -k sbin_susp 2026-07-20 09:53:50.241927 | debian-bookworm | +-w /usr/sbin/tcpdump -p x -k sbin_susp 2026-07-20 09:53:50.242026 | debian-bookworm | +-w /usr/sbin/traceroute -p x -k sbin_susp 2026-07-20 09:53:50.242142 | debian-bookworm | +-w /usr/sbin/ufw -p x -k sbin_susp 2026-07-20 09:53:50.242220 | debian-bookworm | + 2026-07-20 09:53:50.242316 | debian-bookworm | +### kde4 2026-07-20 09:53:50.242440 | debian-bookworm | +-a always,exit -F path=/usr/libexec/kde4/kpac_dhcp_helper -F perm=x -F auid>=1000 -F auid!=4294967295 -k T1078_Valid_Accounts 2026-07-20 09:53:50.242553 | debian-bookworm | +-a always,exit -F path=/usr/libexec/kde4/kdesud -F perm=x -F auid>=1000 -F auid!=4294967295 -k T1078_Valid_Accounts 2026-07-20 09:53:50.242648 | debian-bookworm | + 2026-07-20 09:53:50.242750 | debian-bookworm | +## dbus-send invocation 2026-07-20 09:53:50.242848 | debian-bookworm | +### may indicate privilege escalation CVE-2021-3560 2026-07-20 09:53:50.242943 | debian-bookworm | +-w /usr/bin/dbus-send -p x -k dbus_send 2026-07-20 09:53:50.243039 | debian-bookworm | +-w /usr/bin/gdbus -p x -k gdubs_call 2026-07-20 09:53:50.243131 | debian-bookworm | + 2026-07-20 09:53:50.243256 | debian-bookworm | +## pkexec invocation 2026-07-20 09:53:50.243324 | debian-bookworm | +### may indicate privilege escalation CVE-2021-4034 2026-07-20 09:53:50.243424 | debian-bookworm | +-w /usr/bin/pkexec -p x -k pkexec 2026-07-20 09:53:50.243554 | debian-bookworm | + 2026-07-20 09:53:50.243638 | debian-bookworm | +## Suspicious shells 2026-07-20 09:53:50.243738 | debian-bookworm | +-w /bin/ash -p x -k susp_shell 2026-07-20 09:53:50.243831 | debian-bookworm | +-w /bin/csh -p x -k susp_shell 2026-07-20 09:53:50.243929 | debian-bookworm | +-w /bin/fish -p x -k susp_shell 2026-07-20 09:53:50.244026 | debian-bookworm | +-w /bin/tcsh -p x -k susp_shell 2026-07-20 09:53:50.244124 | debian-bookworm | +-w /bin/tclsh -p x -k susp_shell 2026-07-20 09:53:50.244222 | debian-bookworm | +-w /bin/xonsh -p x -k susp_shell 2026-07-20 09:53:50.244362 | debian-bookworm | +-w /usr/local/bin/xonsh -p x -k susp_shell 2026-07-20 09:53:50.244414 | debian-bookworm | +-w /bin/open -p x -k susp_shell 2026-07-20 09:53:50.244577 | debian-bookworm | +-w /bin/rbash -p x -k susp_shell 2026-07-20 09:53:50.244616 | debian-bookworm | + 2026-07-20 09:53:50.244712 | debian-bookworm | +# Web Server Actvity 2026-07-20 09:53:50.244814 | debian-bookworm | +## Change the number "33" to the ID of your WebServer user. Default: www-data:x:33:33 2026-07-20 09:53:50.244913 | debian-bookworm | +-a always,exit -F arch=b64 -S execve -F euid=33 -k detect_execve_www 2026-07-20 09:53:50.245005 | debian-bookworm | + 2026-07-20 09:53:50.245181 | debian-bookworm | +### https://clustershell.readthedocs.io/ 2026-07-20 09:53:50.245203 | debian-bookworm | +-w /bin/clush -p x -k susp_shell 2026-07-20 09:53:50.245297 | debian-bookworm | +-w /usr/local/bin/clush -p x -k susp_shell 2026-07-20 09:53:50.245419 | debian-bookworm | +-w /etc/clustershell/clush.conf -p x -k susp_shell 2026-07-20 09:53:50.245496 | debian-bookworm | + 2026-07-20 09:53:50.245596 | debian-bookworm | +### https://github.com/tmux/tmux 2026-07-20 09:53:50.245691 | debian-bookworm | +-w /bin/tmux -p x -k susp_shell 2026-07-20 09:53:50.245788 | debian-bookworm | +-w /usr/local/bin/tmux -p x -k susp_shell 2026-07-20 09:53:50.245882 | debian-bookworm | + 2026-07-20 09:53:50.245979 | debian-bookworm | +## Shell/profile configurations 2026-07-20 09:53:50.246077 | debian-bookworm | +-w /etc/profile.d/ -p wa -k shell_profiles 2026-07-20 09:53:50.246172 | debian-bookworm | +-w /etc/profile -p wa -k shell_profiles 2026-07-20 09:53:50.246268 | debian-bookworm | +-w /etc/shells -p wa -k shell_profiles 2026-07-20 09:53:50.246366 | debian-bookworm | +-w /etc/bashrc -p wa -k shell_profiles 2026-07-20 09:53:50.246489 | debian-bookworm | +-w /etc/csh.cshrc -p wa -k shell_profiles 2026-07-20 09:53:50.246637 | debian-bookworm | +-w /etc/csh.login -p wa -k shell_profiles 2026-07-20 09:53:50.246735 | debian-bookworm | +-w /etc/fish/ -p wa -k shell_profiles 2026-07-20 09:53:50.246899 | debian-bookworm | +-w /etc/zsh/ -p wa -k shell_profiles 2026-07-20 09:53:50.246994 | debian-bookworm | + 2026-07-20 09:53:50.247112 | debian-bookworm | +### https://github.com/xxh/xxh 2026-07-20 09:53:50.247211 | debian-bookworm | +-w /usr/local/bin/xxh.bash -p x -k susp_shell 2026-07-20 09:53:50.247308 | debian-bookworm | +-w /usr/local/bin/xxh.xsh -p x -k susp_shell 2026-07-20 09:53:50.247407 | debian-bookworm | +-w /usr/local/bin/xxh.zsh -p x -k susp_shell 2026-07-20 09:53:50.247499 | debian-bookworm | + 2026-07-20 09:53:50.247609 | debian-bookworm | +## Injection 2026-07-20 09:53:50.247720 | debian-bookworm | +### These rules watch for code injection by the ptrace facility. 2026-07-20 09:53:50.247810 | debian-bookworm | +### This could indicate someone trying to do something bad or just debugging 2026-07-20 09:53:50.247909 | debian-bookworm | +-a always,exit -F arch=b64 -S ptrace -F a0=0x4 -k code_injection 2026-07-20 09:53:50.248008 | debian-bookworm | +-a always,exit -F arch=b64 -S ptrace -F a0=0x5 -k data_injection 2026-07-20 09:53:50.248106 | debian-bookworm | +-a always,exit -F arch=b64 -S ptrace -F a0=0x6 -k register_injection 2026-07-20 09:53:50.248205 | debian-bookworm | +-a always,exit -F arch=b64 -S ptrace -k tracing 2026-07-20 09:53:50.248297 | debian-bookworm | + 2026-07-20 09:53:50.248392 | debian-bookworm | +## Anonymous File Creation 2026-07-20 09:53:50.248489 | debian-bookworm | +### These rules watch the use of memfd_create 2026-07-20 09:53:50.248617 | debian-bookworm | +### "memfd_create" creates anonymous file and returns a file descriptor to access it 2026-07-20 09:53:50.248719 | debian-bookworm | +### When combined with "fexecve" can be used to stealthily run binaries in memory without touching disk 2026-07-20 09:53:50.248820 | debian-bookworm | +-a always,exit -F arch=b64 -S memfd_create -F key=anon_file_create 2026-07-20 09:53:50.248914 | debian-bookworm | + 2026-07-20 09:53:50.249011 | debian-bookworm | +## Privilege Abuse 2026-07-20 09:53:50.249110 | debian-bookworm | +### The purpose of this rule is to detect when an admin may be abusing power by looking in user's home dir. 2026-07-20 09:53:50.249210 | debian-bookworm | +-a always,exit -F dir=/home -F uid=0 -F auid>=1000 -F auid!=-1 -C auid!=obj_uid -k power_abuse 2026-07-20 09:53:50.249304 | debian-bookworm | + 2026-07-20 09:53:50.249400 | debian-bookworm | +# Socket Creations 2026-07-20 09:53:50.249497 | debian-bookworm | +# will catch both IPv4 and IPv6 2026-07-20 09:53:50.249606 | debian-bookworm | + 2026-07-20 09:53:50.249701 | debian-bookworm | +-a always,exit -F arch=b32 -S socket -F a0=2 -k network_socket_created 2026-07-20 09:53:50.249797 | debian-bookworm | +-a always,exit -F arch=b64 -S socket -F a0=2 -k network_socket_created 2026-07-20 09:53:50.249892 | debian-bookworm | + 2026-07-20 09:53:50.249989 | debian-bookworm | +-a always,exit -F arch=b32 -S socket -F a0=10 -k network_socket_created 2026-07-20 09:53:50.250087 | debian-bookworm | +-a always,exit -F arch=b64 -S socket -F a0=10 -k network_socket_created 2026-07-20 09:53:50.250182 | debian-bookworm | + 2026-07-20 09:53:50.250278 | debian-bookworm | +# Software Management --------------------------------------------------------- 2026-07-20 09:53:50.250401 | debian-bookworm | + 2026-07-20 09:53:50.250491 | debian-bookworm | +# RPM (Redhat/CentOS) 2026-07-20 09:53:50.250619 | debian-bookworm | +-w /usr/bin/rpm -p x -k software_mgmt 2026-07-20 09:53:50.250728 | debian-bookworm | +-w /usr/bin/yum -p x -k software_mgmt 2026-07-20 09:53:50.250819 | debian-bookworm | + 2026-07-20 09:53:50.250920 | debian-bookworm | +# DNF (Fedora/RedHat 8/CentOS 8) 2026-07-20 09:53:50.251017 | debian-bookworm | +-w /usr/bin/dnf -p x -k software_mgmt 2026-07-20 09:53:50.251112 | debian-bookworm | + 2026-07-20 09:53:50.251210 | debian-bookworm | +# YAST/Zypper/RPM (SuSE) 2026-07-20 09:53:50.251308 | debian-bookworm | +-w /sbin/yast -p x -k software_mgmt 2026-07-20 09:53:50.251406 | debian-bookworm | +-w /sbin/yast2 -p x -k software_mgmt 2026-07-20 09:53:50.251512 | debian-bookworm | +-w /bin/rpm -p x -k software_mgmt 2026-07-20 09:53:50.251611 | debian-bookworm | +-w /usr/bin/zypper -k software_mgmt 2026-07-20 09:53:50.251704 | debian-bookworm | + 2026-07-20 09:53:50.251802 | debian-bookworm | +# DPKG / APT-GET (Debian/Ubuntu) 2026-07-20 09:53:50.251900 | debian-bookworm | +-w /usr/bin/dpkg -p x -k software_mgmt 2026-07-20 09:53:50.251999 | debian-bookworm | +-w /usr/bin/apt -p x -k software_mgmt 2026-07-20 09:53:50.252097 | debian-bookworm | +-w /usr/bin/apt-add-repository -p x -k software_mgmt 2026-07-20 09:53:50.252194 | debian-bookworm | +-w /usr/bin/apt-get -p x -k software_mgmt 2026-07-20 09:53:50.252293 | debian-bookworm | +-w /usr/bin/aptitude -p x -k software_mgmt 2026-07-20 09:53:50.252391 | debian-bookworm | +-w /usr/bin/wajig -p x -k software_mgmt 2026-07-20 09:53:50.252489 | debian-bookworm | +-w /usr/bin/snap -p x -k software_mgmt 2026-07-20 09:53:50.252599 | debian-bookworm | + 2026-07-20 09:53:50.252695 | debian-bookworm | +# PIP(3) (Python installs) 2026-07-20 09:53:50.252794 | debian-bookworm | +-w /usr/bin/pip -p x -k third_party_software_mgmt 2026-07-20 09:53:50.252894 | debian-bookworm | +-w /usr/local/bin/pip -p x -k third_party_software_mgmt 2026-07-20 09:53:50.252991 | debian-bookworm | +-w /usr/bin/pip3 -p x -k third_party_software_mgmt 2026-07-20 09:53:50.253091 | debian-bookworm | +-w /usr/local/bin/pip3 -p x -k third_party_software_mgmt 2026-07-20 09:53:50.253188 | debian-bookworm | +-w /usr/bin/pipx -p x -k third_party_software_mgmt 2026-07-20 09:53:50.253284 | debian-bookworm | +-w /usr/local/bin/pipx -p x -k third_party_software_mgmt 2026-07-20 09:53:50.253382 | debian-bookworm | + 2026-07-20 09:53:50.253477 | debian-bookworm | +# npm 2026-07-20 09:53:50.253595 | debian-bookworm | +## T1072 third party software 2026-07-20 09:53:50.253692 | debian-bookworm | +## https://www.npmjs.com 2026-07-20 09:53:50.253793 | debian-bookworm | +## https://docs.npmjs.com/cli/v6/commands/npm-audit 2026-07-20 09:53:50.253892 | debian-bookworm | +-w /usr/bin/npm -p x -k third_party_software_mgmt 2026-07-20 09:53:50.253986 | debian-bookworm | + 2026-07-20 09:53:50.254085 | debian-bookworm | +# Comprehensive Perl Archive Network (CPAN) (CPAN installs) 2026-07-20 09:53:50.254184 | debian-bookworm | +## T1072 third party software 2026-07-20 09:53:50.254279 | debian-bookworm | +## https://www.cpan.org 2026-07-20 09:53:50.254397 | debian-bookworm | +-w /usr/bin/cpan -p x -k third_party_software_mgmt 2026-07-20 09:53:50.254617 | debian-bookworm | + 2026-07-20 09:53:50.254708 | debian-bookworm | +# Ruby (RubyGems installs) 2026-07-20 09:53:50.254810 | debian-bookworm | +## T1072 third party software 2026-07-20 09:53:50.254903 | debian-bookworm | +## https://rubygems.org 2026-07-20 09:53:50.255006 | debian-bookworm | +-w /usr/bin/gem -p x -k third_party_software_mgmt 2026-07-20 09:53:50.255099 | debian-bookworm | + 2026-07-20 09:53:50.255224 | debian-bookworm | +# LuaRocks (Lua installs) 2026-07-20 09:53:50.255295 | debian-bookworm | +## T1072 third party software 2026-07-20 09:53:50.255393 | debian-bookworm | +## https://luarocks.org 2026-07-20 09:53:50.255490 | debian-bookworm | +-w /usr/bin/luarocks -p x -k third_party_software_mgmt 2026-07-20 09:53:50.255594 | debian-bookworm | + 2026-07-20 09:53:50.255689 | debian-bookworm | +# Pacman (Arch Linux) 2026-07-20 09:53:50.255788 | debian-bookworm | +## https://wiki.archlinux.org/title/Pacman 2026-07-20 09:53:50.255889 | debian-bookworm | +## T1072 third party software 2026-07-20 09:53:50.255983 | debian-bookworm | +-w /etc/pacman.conf -p x -k third_party_software_mgmt 2026-07-20 09:53:50.256089 | debian-bookworm | +-w /etc/pacman.d -p x -k third_party_software_mgmt 2026-07-20 09:53:50.256182 | debian-bookworm | + 2026-07-20 09:53:50.257218 | debian-bookworm | +# Special Software ------------------------------------------------------------ 2026-07-20 09:53:50.257249 | debian-bookworm | + 2026-07-20 09:53:50.257255 | debian-bookworm | +## GDS specific secrets 2026-07-20 09:53:50.257261 | debian-bookworm | +-w /etc/puppet/ssl -p wa -k puppet_ssl 2026-07-20 09:53:50.257267 | debian-bookworm | + 2026-07-20 09:53:50.257272 | debian-bookworm | +## IBM Bigfix BESClient 2026-07-20 09:53:50.257277 | debian-bookworm | +-a always,exit -F arch=b64 -S open -F dir=/opt/BESClient -F success=0 -k soft_besclient 2026-07-20 09:53:50.257283 | debian-bookworm | +-w /var/opt/BESClient/ -p wa -k soft_besclient 2026-07-20 09:53:50.257288 | debian-bookworm | + 2026-07-20 09:53:50.257293 | debian-bookworm | +## CHEF https://www.chef.io/chef/ 2026-07-20 09:53:50.257302 | debian-bookworm | +-w /etc/chef -p wa -k soft_chef 2026-07-20 09:53:50.257308 | debian-bookworm | + 2026-07-20 09:53:50.257403 | debian-bookworm | +## Salt 2026-07-20 09:53:50.257565 | debian-bookworm | +## https://saltproject.io/ 2026-07-20 09:53:50.257613 | debian-bookworm | +## https://docs.saltproject.io/en/latest/ref/configuration/master.html 2026-07-20 09:53:50.257774 | debian-bookworm | +-w /etc/salt -p wa -k soft_salt 2026-07-20 09:53:50.257804 | debian-bookworm | +-w /usr/local/etc/salt -p wa -k soft_salt 2026-07-20 09:53:50.257897 | debian-bookworm | + 2026-07-20 09:53:50.257995 | debian-bookworm | +## Otter 2026-07-20 09:53:50.258087 | debian-bookworm | +## https://inedo.com/otter 2026-07-20 09:53:50.258183 | debian-bookworm | +-w /etc/otter -p wa -k soft_otter 2026-07-20 09:53:50.258274 | debian-bookworm | + 2026-07-20 09:53:50.258426 | debian-bookworm | +## T1081 Credentials In Files 2026-07-20 09:53:50.258491 | debian-bookworm | +-w /usr/bin/grep -p x -k string_search 2026-07-20 09:53:50.258601 | debian-bookworm | +-w /usr/bin/egrep -p x -k string_search 2026-07-20 09:53:50.258700 | debian-bookworm | +-w /usr/bin/ugrep -p x -k string_search 2026-07-20 09:53:50.258799 | debian-bookworm | +### macOS 2026-07-20 09:53:50.258895 | debian-bookworm | +-w /usr/local/bin/grep -p x -k string_search 2026-07-20 09:53:50.258993 | debian-bookworm | +-w /usr/local/bin/egrep -p x -k string_search 2026-07-20 09:53:50.259093 | debian-bookworm | +-w /usr/local/bin/ugrep -p x -k string_search 2026-07-20 09:53:50.259187 | debian-bookworm | + 2026-07-20 09:53:50.259286 | debian-bookworm | +### https://github.com/tmbinc/bgrep 2026-07-20 09:53:50.259383 | debian-bookworm | +-w /usr/bin/bgrep -p x -k string_search 2026-07-20 09:53:50.259481 | debian-bookworm | +### macOS 2026-07-20 09:53:50.259606 | debian-bookworm | +-w /usr/local/bin/bgrep -p x -k string_search 2026-07-20 09:53:50.259697 | debian-bookworm | + 2026-07-20 09:53:50.259798 | debian-bookworm | +### https://github.com/BurntSushi/ripgrep 2026-07-20 09:53:50.259894 | debian-bookworm | +-w /usr/bin/rg -p x -k string_search 2026-07-20 09:53:50.259989 | debian-bookworm | +### macOS 2026-07-20 09:53:50.260085 | debian-bookworm | +-w /usr/local/bin/rg -p x -k string_search 2026-07-20 09:53:50.260178 | debian-bookworm | + 2026-07-20 09:53:50.260277 | debian-bookworm | +### https://github.com/awgn/cgrep 2026-07-20 09:53:50.260369 | debian-bookworm | + 2026-07-20 09:53:50.260465 | debian-bookworm | +-w /usr/bin/cgrep -p x -k string_search 2026-07-20 09:53:50.260586 | debian-bookworm | +### macOS 2026-07-20 09:53:50.260668 | debian-bookworm | +-w /usr/local/bin/cgrep -p x -k string_search 2026-07-20 09:53:50.260760 | debian-bookworm | + 2026-07-20 09:53:50.260856 | debian-bookworm | +### https://github.com/jpr5/ngrep 2026-07-20 09:53:50.260952 | debian-bookworm | +-w /usr/bin/ngrep -p x -k string_search 2026-07-20 09:53:50.261046 | debian-bookworm | +### macOS 2026-07-20 09:53:50.261144 | debian-bookworm | +-w /usr/local/bin/ngrep -p x -k string_search 2026-07-20 09:53:50.261238 | debian-bookworm | + 2026-07-20 09:53:50.261334 | debian-bookworm | +### https://github.com/vrothberg/vgrep 2026-07-20 09:53:50.261430 | debian-bookworm | +-w /usr/bin/vgrep -p x -k string_search 2026-07-20 09:53:50.261534 | debian-bookworm | +### macOS 2026-07-20 09:53:50.261628 | debian-bookworm | +-w /usr/local/bin/vgrep -p x -k string_search 2026-07-20 09:53:50.261722 | debian-bookworm | + 2026-07-20 09:53:50.261822 | debian-bookworm | +### https://github.com/monochromegane/the_platinum_searcher 2026-07-20 09:53:50.261924 | debian-bookworm | +-w /usr/bin/pt -p x -k string_search 2026-07-20 09:53:50.262021 | debian-bookworm | +### macOS 2026-07-20 09:53:50.262117 | debian-bookworm | +-w /usr/local/bin/pt -p x -k string_search 2026-07-20 09:53:50.262211 | debian-bookworm | + 2026-07-20 09:53:50.262307 | debian-bookworm | +### https://github.com/gvansickle/ucg 2026-07-20 09:53:50.262424 | debian-bookworm | +-w /usr/bin/ucg -p x -k string_search 2026-07-20 09:53:50.262529 | debian-bookworm | +### macOS 2026-07-20 09:53:50.262625 | debian-bookworm | +-w /usr/local/bin/ucg -p x -k string_search 2026-07-20 09:53:50.262718 | debian-bookworm | + 2026-07-20 09:53:50.262816 | debian-bookworm | +### https://github.com/ggreer/the_silver_searcher 2026-07-20 09:53:50.262912 | debian-bookworm | +-w /usr/bin/ag -p x -k string_search 2026-07-20 09:53:50.263008 | debian-bookworm | +### macOS 2026-07-20 09:53:50.263103 | debian-bookworm | +-w /usr/local/bin/ag -p x -k string_search 2026-07-20 09:53:50.263195 | debian-bookworm | + 2026-07-20 09:53:50.263291 | debian-bookworm | +### https://github.com/beyondgrep/ack3 2026-07-20 09:53:50.263387 | debian-bookworm | +### https://beyondgrep.com 2026-07-20 09:53:50.263483 | debian-bookworm | +-w /usr/bin/ack -p x -k string_search 2026-07-20 09:53:50.263616 | debian-bookworm | +-w /usr/local/bin/ack -p x -k string_search 2026-07-20 09:53:50.263704 | debian-bookworm | +-w /usr/bin/semgrep -p x -k string_search 2026-07-20 09:53:50.263801 | debian-bookworm | +### macOS 2026-07-20 09:53:50.263899 | debian-bookworm | +-w /usr/local/bin/semgrep -p x -k string_search 2026-07-20 09:53:50.264002 | debian-bookworm | + 2026-07-20 09:53:50.264088 | debian-bookworm | +## Docker 2026-07-20 09:53:50.264184 | debian-bookworm | +-w /usr/bin/dockerd -k docker 2026-07-20 09:53:50.264278 | debian-bookworm | +-w /usr/bin/docker -k docker 2026-07-20 09:53:50.264374 | debian-bookworm | +-w /usr/bin/docker-containerd -k docker 2026-07-20 09:53:50.264468 | debian-bookworm | +-w /usr/bin/docker-runc -k docker 2026-07-20 09:53:50.264578 | debian-bookworm | +-w /var/lib/docker -p wa -k docker 2026-07-20 09:53:50.264675 | debian-bookworm | +-w /etc/docker -k docker 2026-07-20 09:53:50.264770 | debian-bookworm | +-w /etc/sysconfig/docker -k docker 2026-07-20 09:53:50.264865 | debian-bookworm | +-w /etc/sysconfig/docker-storage -k docker 2026-07-20 09:53:50.264963 | debian-bookworm | +-w /usr/lib/systemd/system/docker.service -k docker 2026-07-20 09:53:50.265061 | debian-bookworm | +-w /usr/lib/systemd/system/docker.socket -k docker 2026-07-20 09:53:50.265156 | debian-bookworm | + 2026-07-20 09:53:50.265252 | debian-bookworm | +## Virtualization stuff 2026-07-20 09:53:50.265349 | debian-bookworm | +-w /usr/bin/qemu-system-x86_64 -p x -k qemu-system-x86_64 2026-07-20 09:53:50.265443 | debian-bookworm | +-w /usr/bin/qemu-img -p x -k qemu-img 2026-07-20 09:53:50.265549 | debian-bookworm | +-w /usr/bin/qemu-kvm -p x -k qemu-kvm 2026-07-20 09:53:50.265643 | debian-bookworm | +-w /usr/bin/qemu -p x -k qemu 2026-07-20 09:53:50.265738 | debian-bookworm | +-w /usr/bin/virtualbox -p x -k virtualbox 2026-07-20 09:53:50.265834 | debian-bookworm | +-w /usr/bin/virt-manager -p x -k virt-manager 2026-07-20 09:53:50.265930 | debian-bookworm | +-w /usr/bin/VBoxManage -p x -k VBoxManage 2026-07-20 09:53:50.266022 | debian-bookworm | + 2026-07-20 09:53:50.266118 | debian-bookworm | +#### VirtualBox on macOS 2026-07-20 09:53:50.266211 | debian-bookworm | + 2026-07-20 09:53:50.266311 | debian-bookworm | +-w /usr/local/bin/VirtualBox -p x -k virt_tool 2026-07-20 09:53:50.266687 | debian-bookworm | +-w /usr/local/bin/VirtualBoxVM -p x -k virt_tool 2026-07-20 09:53:50.266825 | debian-bookworm | +-w /usr/local/bin/VBoxManage -p x -k virt_tool 2026-07-20 09:53:50.266928 | debian-bookworm | +-w /usr/local/bin/VBoxVRDP -p x -k virt_tool 2026-07-20 09:53:50.267023 | debian-bookworm | +-w /usr/local/bin/VBoxHeadless -p x -k virt_tool 2026-07-20 09:53:50.267121 | debian-bookworm | +-w /usr/local/bin/vboxwebsrv -p x -k virt_tool 2026-07-20 09:53:50.267238 | debian-bookworm | +-w /usr/local/bin/VBoxBugReport -p x -k virt_tool 2026-07-20 09:53:50.267313 | debian-bookworm | +-w /usr/local/bin/VBoxBalloonCtrl -p x -k virt_tool 2026-07-20 09:53:50.267419 | debian-bookworm | +-w /usr/local/bin/VBoxAutostart -p x -k virt_tool 2026-07-20 09:53:50.267538 | debian-bookworm | +-w /usr/local/bin/VBoxDTrace -p x -k virt_tool 2026-07-20 09:53:50.267638 | debian-bookworm | +-w /usr/local/bin/vbox-img -p x -k virt_tool 2026-07-20 09:53:50.267739 | debian-bookworm | +-w /Library/LaunchDaemons/org.virtualbox.startup.plist -p x -k virt_tool 2026-07-20 09:53:50.267839 | debian-bookworm | +-w /Library/Application Support/VirtualBox/LaunchDaemons/ -p x -k virt_tool 2026-07-20 09:53:50.267938 | debian-bookworm | +-w /Library/Application Support/VirtualBox/VBoxDrv.kext/ -p x -k virt_tool 2026-07-20 09:53:50.268035 | debian-bookworm | +-w /Library/Application Support/VirtualBox/VBoxUSB.kext/ -p x -k virt_tool 2026-07-20 09:53:50.268136 | debian-bookworm | +-w /Library/Application Support/VirtualBox/VBoxNetFlt.kext/ -p x -k virt_tool 2026-07-20 09:53:50.268239 | debian-bookworm | +-w /Library/Application Support/VirtualBox/VBoxNetAdp.kext/ -p x -k virt_tool 2026-07-20 09:53:50.268331 | debian-bookworm | + 2026-07-20 09:53:50.268428 | debian-bookworm | +### Parallels Desktop on macOS 2026-07-20 09:53:50.268533 | debian-bookworm | + 2026-07-20 09:53:50.268631 | debian-bookworm | +-w /usr/local/bin/prl_convert -p x -k virt_tool 2026-07-20 09:53:50.268729 | debian-bookworm | +-w /usr/local/bin/prl_disk_tool -p x -k virt_tool 2026-07-20 09:53:50.268824 | debian-bookworm | +-w /usr/local/bin/prl_perf_ctl -p x -k virt_tool 2026-07-20 09:53:50.268922 | debian-bookworm | +-w /usr/local/bin/prlcore2dmp -p x -k virt_tool 2026-07-20 09:53:50.269019 | debian-bookworm | +-w /usr/local/bin/prlctl -p x -k virt_tool 2026-07-20 09:53:50.269113 | debian-bookworm | +-w /usr/local/bin/prlexec -p x -k virt_tool 2026-07-20 09:53:50.269209 | debian-bookworm | +-w /usr/local/bin/prlsrvctl -p x -k virt_tool 2026-07-20 09:53:50.269308 | debian-bookworm | +-w /Library/Preferences/Parallels -p x -k virt_tool 2026-07-20 09:53:50.269403 | debian-bookworm | + 2026-07-20 09:53:50.269499 | debian-bookworm | +### qemu on macOS 2026-07-20 09:53:50.269605 | debian-bookworm | + 2026-07-20 09:53:50.269702 | debian-bookworm | +-w /usr/local/bin/qemu-edid -p x -k virt_tool 2026-07-20 09:53:50.269797 | debian-bookworm | +-w /usr/local/bin/qemu-img -p x -k virt_tool 2026-07-20 09:53:50.269897 | debian-bookworm | +-w /usr/local/bin/qemu-io -p x -k virt_tool 2026-07-20 09:53:50.269994 | debian-bookworm | +-w /usr/local/bin/qemu-nbd -p x -k virt_tool 2026-07-20 09:53:50.270090 | debian-bookworm | +-w /usr/local/bin/qemu-system-x86_64 -p x -k virt_tool 2026-07-20 09:53:50.270182 | debian-bookworm | + 2026-07-20 09:53:50.270277 | debian-bookworm | +## Kubelet 2026-07-20 09:53:50.270371 | debian-bookworm | +-w /usr/bin/kubelet -k kubelet 2026-07-20 09:53:50.270483 | debian-bookworm | + 2026-07-20 09:53:50.270590 | debian-bookworm | +# ipc system call 2026-07-20 09:53:50.270686 | debian-bookworm | +# /usr/include/linux/ipc.h 2026-07-20 09:53:50.270779 | debian-bookworm | + 2026-07-20 09:53:50.270873 | debian-bookworm | +## msgctl 2026-07-20 09:53:50.270980 | debian-bookworm | +#-a always,exit -S ipc -F a0=14 -k Inter-Process_Communication 2026-07-20 09:53:50.271077 | debian-bookworm | +## msgget 2026-07-20 09:53:50.271175 | debian-bookworm | +#-a always,exit -S ipc -F a0=13 -k Inter-Process_Communication 2026-07-20 09:53:50.271272 | debian-bookworm | +## Use these lines on x86_64, ia64 instead 2026-07-20 09:53:50.271371 | debian-bookworm | +-a always,exit -F arch=b64 -S msgctl -k Inter-Process_Communication 2026-07-20 09:53:50.271471 | debian-bookworm | +-a always,exit -F arch=b64 -S msgget -k Inter-Process_Communication 2026-07-20 09:53:50.271589 | debian-bookworm | + 2026-07-20 09:53:50.271683 | debian-bookworm | +## semctl 2026-07-20 09:53:50.271780 | debian-bookworm | +#-a always,exit -S ipc -F a0=3 -k Inter-Process_Communication 2026-07-20 09:53:50.271873 | debian-bookworm | +## semget 2026-07-20 09:53:50.271972 | debian-bookworm | +#-a always,exit -S ipc -F a0=2 -k Inter-Process_Communication 2026-07-20 09:53:50.272067 | debian-bookworm | +## semop 2026-07-20 09:53:50.272163 | debian-bookworm | +#-a always,exit -S ipc -F a0=1 -k Inter-Process_Communication 2026-07-20 09:53:50.272259 | debian-bookworm | +## semtimedop 2026-07-20 09:53:50.272359 | debian-bookworm | +#-a always,exit -S ipc -F a0=4 -k Inter-Process_Communication 2026-07-20 09:53:50.272455 | debian-bookworm | +## Use these lines on x86_64, ia64 instead 2026-07-20 09:53:50.272579 | debian-bookworm | +-a always,exit -F arch=b64 -S semctl -k Inter-Process_Communication 2026-07-20 09:53:50.272665 | debian-bookworm | +-a always,exit -F arch=b64 -S semget -k Inter-Process_Communication 2026-07-20 09:53:50.272762 | debian-bookworm | +-a always,exit -F arch=b64 -S semop -k Inter-Process_Communication 2026-07-20 09:53:50.272860 | debian-bookworm | +-a always,exit -F arch=b64 -S semtimedop -k Inter-Process_Communication 2026-07-20 09:53:50.272953 | debian-bookworm | + 2026-07-20 09:53:50.273046 | debian-bookworm | +## shmctl 2026-07-20 09:53:50.273144 | debian-bookworm | +#-a always,exit -S ipc -F a0=24 -k Inter-Process_Communication 2026-07-20 09:53:50.273238 | debian-bookworm | +## shmget 2026-07-20 09:53:50.273335 | debian-bookworm | +#-a always,exit -S ipc -F a0=23 -k Inter-Process_Communication 2026-07-20 09:53:50.273431 | debian-bookworm | +## Use these lines on x86_64, ia64 instead 2026-07-20 09:53:50.273541 | debian-bookworm | +-a always,exit -F arch=b64 -S shmctl -k Inter-Process_Communication 2026-07-20 09:53:50.273640 | debian-bookworm | +-a always,exit -F arch=b64 -S shmget -k Inter-Process_Communication 2026-07-20 09:53:50.273733 | debian-bookworm | + 2026-07-20 09:53:50.273830 | debian-bookworm | +# High Volume Events ---------------------------------------------------------- 2026-07-20 09:53:50.273923 | debian-bookworm | + 2026-07-20 09:53:50.274023 | debian-bookworm | +## Disable these rules if they create too many events in your environment 2026-07-20 09:53:50.274117 | debian-bookworm | + 2026-07-20 09:53:50.274212 | debian-bookworm | +## Common Shells 2026-07-20 09:53:50.274309 | debian-bookworm | +-w /bin/bash -p x -k susp_shell 2026-07-20 09:53:50.274431 | debian-bookworm | +-w /bin/dash -p x -k susp_shell 2026-07-20 09:53:50.274558 | debian-bookworm | +-w /bin/busybox -p x -k susp_shell 2026-07-20 09:53:50.274653 | debian-bookworm | +-w /bin/zsh -p x -k susp_shell 2026-07-20 09:53:50.274755 | debian-bookworm | +-w /bin/sh -p x -k susp_shell 2026-07-20 09:53:50.274849 | debian-bookworm | +-w /bin/ksh -p x -k susp_shell 2026-07-20 09:53:50.274941 | debian-bookworm | + 2026-07-20 09:53:50.275036 | debian-bookworm | +## Root command executions 2026-07-20 09:53:50.275133 | debian-bookworm | +-a always,exit -F arch=b64 -F euid=0 -F auid>=1000 -F auid!=-1 -S execve -k rootcmd 2026-07-20 09:53:50.275227 | debian-bookworm | + 2026-07-20 09:53:50.275325 | debian-bookworm | +## File Deletion Events by User 2026-07-20 09:53:50.275427 | debian-bookworm | +-a always,exit -F arch=b64 -S rmdir -S unlink -S unlinkat -S rename -S renameat -F auid>=1000 -F auid!=-1 -k delete 2026-07-20 09:53:50.275533 | debian-bookworm | + 2026-07-20 09:53:50.275630 | debian-bookworm | +## File Access 2026-07-20 09:53:50.275728 | debian-bookworm | +### Unauthorized Access (unsuccessful) 2026-07-20 09:53:50.275832 | debian-bookworm | +-a always,exit -F arch=b64 -S creat -S open -S openat -S open_by_handle_at -S truncate -S ftruncate -F exit=-EACCES -F auid>=1000 -F auid!=-1 -k file_access 2026-07-20 09:53:50.275937 | debian-bookworm | +-a always,exit -F arch=b64 -S creat -S open -S openat -S open_by_handle_at -S truncate -S ftruncate -F exit=-EPERM -F auid>=1000 -F auid!=-1 -k file_access 2026-07-20 09:53:50.276033 | debian-bookworm | + 2026-07-20 09:53:50.276128 | debian-bookworm | +### Unsuccessful Creation 2026-07-20 09:53:50.276227 | debian-bookworm | +-a always,exit -F arch=b64 -S mkdir,creat,link,symlink,mknod,mknodat,linkat,symlinkat -F exit=-EACCES -k file_creation 2026-07-20 09:53:50.276327 | debian-bookworm | +-a always,exit -F arch=b64 -S mkdir,link,symlink,mkdirat -F exit=-EPERM -k file_creation 2026-07-20 09:53:50.276424 | debian-bookworm | + 2026-07-20 09:53:50.276606 | debian-bookworm | +### Unsuccessful Modification 2026-07-20 09:53:50.276649 | debian-bookworm | +-a always,exit -F arch=b64 -S rename -S renameat -S truncate -S chmod -S setxattr -S lsetxattr -S removexattr -S lremovexattr -F exit=-EACCES -k file_modification 2026-07-20 09:53:50.276748 | debian-bookworm | +-a always,exit -F arch=b64 -S rename -S renameat -S truncate -S chmod -S setxattr -S lsetxattr -S removexattr -S lremovexattr -F exit=-EPERM -k file_modification 2026-07-20 09:53:50.276868 | debian-bookworm | + 2026-07-20 09:53:50.276938 | debian-bookworm | +## 32bit API Exploitation 2026-07-20 09:53:50.277039 | debian-bookworm | +### If you are on a 64 bit platform, everything _should_ be running 2026-07-20 09:53:50.277140 | debian-bookworm | +### in 64 bit mode. This rule will detect any use of the 32 bit syscalls 2026-07-20 09:53:50.277239 | debian-bookworm | +### because this might be a sign of someone exploiting a hole in the 32 2026-07-20 09:53:50.277336 | debian-bookworm | +### bit API. 2026-07-20 09:53:50.277441 | debian-bookworm | +-a always,exit -F arch=b32 -S all -k 32bit_api 2026-07-20 09:53:50.277558 | debian-bookworm | + 2026-07-20 09:53:50.277649 | debian-bookworm | +# Make The Configuration Immutable -------------------------------------------- 2026-07-20 09:53:50.277743 | debian-bookworm | + 2026-07-20 09:53:50.277840 | debian-bookworm | +##-e 2 2026-07-20 09:53:50.277935 | debian-bookworm | 2026-07-20 09:53:50.278162 | debian-bookworm | changed: [molecule-auditd] => (item=20-neo23x0.rules) => {"ansible_loop_var": "item", "changed": true, "checksum": "9f99ce5c4f891fbf3e2bce06ed4cb97fb9e01f41", "dest": "/etc/audit/rules.d/20-neo23x0.rules", "gid": 0, "group": "root", "item": "20-neo23x0.rules", "md5sum": "6ac57206fd77de34805c3f4d50ef8b1d", "mode": "0644", "owner": "root", "size": 27367, "src": "/home/zuul/.ansible/tmp/ansible-tmp-1784541229.149518-2638-8019829684372/.source.rules", "state": "file", "uid": 0} 2026-07-20 09:53:50.278242 | debian-bookworm | 2026-07-20 09:53:50.278342 | debian-bookworm | TASK [auditd : Manage auditd service] ****************************************** 2026-07-20 09:53:51.137999 | debian-bookworm | ok: [molecule-auditd] => {"changed": false, "enabled": true, "name": "auditd", "state": "started", "status": {"ActiveEnterTimestamp": "Mon 2026-07-20 09:53:43 UTC", "ActiveEnterTimestampMonotonic": "189773012", "ActiveExitTimestampMonotonic": "0", "ActiveState": "active", "After": "system.slice systemd-tmpfiles-setup.service systemd-journald.socket local-fs.target", "AllowIsolate": "no", "AssertResult": "yes", "AssertTimestamp": "Mon 2026-07-20 09:53:43 UTC", "AssertTimestampMonotonic": "189685183", "Before": "sysinit.target systemd-update-utmp.service shutdown.target ssh.service", "BlockIOAccounting": "no", "BlockIOWeight": "[not set]", "CPUAccounting": "yes", "CPUAffinityFromNUMA": "no", "CPUQuotaPerSecUSec": "infinity", "CPUQuotaPeriodUSec": "infinity", "CPUSchedulingPolicy": "0", "CPUSchedulingPriority": "0", "CPUSchedulingResetOnFork": "no", "CPUShares": "[not set]", "CPUUsageNSec": "50394000", "CPUWeight": "[not set]", "CacheDirectoryMode": "0755", "CanFreeze": "yes", "CanIsolate": "no", "CanReload": "no", "CanStart": "yes", "CanStop": "yes", "CapabilityBoundingSet": "cap_chown cap_dac_override cap_dac_read_search cap_fowner cap_fsetid cap_kill cap_setgid cap_setuid cap_setpcap cap_linux_immutable cap_net_bind_service cap_net_broadcast cap_net_admin cap_net_raw cap_ipc_lock cap_ipc_owner cap_sys_rawio cap_sys_chroot cap_sys_ptrace cap_sys_pacct cap_sys_admin cap_sys_boot cap_sys_nice cap_sys_resource cap_sys_time cap_sys_tty_config cap_mknod cap_lease cap_audit_write cap_audit_control cap_setfcap cap_mac_override cap_mac_admin cap_syslog cap_wake_alarm cap_block_suspend cap_audit_read cap_perfmon cap_bpf cap_checkpoint_restore", "CleanResult": "success", "CollectMode": "inactive", "ConditionResult": "yes", "ConditionTimestamp": "Mon 2026-07-20 09:53:43 UTC", "ConditionTimestampMonotonic": "189685143", "ConfigurationDirectoryMode": "0755", "Conflicts": "shutdown.target", "ControlGroup": "/system.slice/auditd.service", "ControlGroupId": "3289", "ControlPID": "0", "CoredumpFilter": "0x33", "DefaultDependencies": "no", "DefaultMemoryLow": "0", "DefaultMemoryMin": "0", "Delegate": "no", "Description": "Security Auditing Service", "DevicePolicy": "auto", "Documentation": "\"man:auditd(8)\" https://github.com/linux-audit/audit-documentation", "DynamicUser": "no", "ExecMainCode": "0", "ExecMainExitTimestampMonotonic": "0", "ExecMainPID": "2410", "ExecMainStartTimestamp": "Mon 2026-07-20 09:53:43 UTC", "ExecMainStartTimestampMonotonic": "189733094", "ExecMainStatus": "0", "ExecStart": "{ path=/sbin/auditd ; argv[]=/sbin/auditd ; ignore_errors=no ; start_time=[Mon 2026-07-20 09:53:43 UTC] ; stop_time=[Mon 2026-07-20 09:53:43 UTC] ; pid=2409 ; code=exited ; status=0 }", "ExecStartEx": "{ path=/sbin/auditd ; argv[]=/sbin/auditd ; flags= ; start_time=[Mon 2026-07-20 09:53:43 UTC] ; stop_time=[Mon 2026-07-20 09:53:43 UTC] ; pid=2409 ; code=exited ; status=0 }", "ExecStartPost": "{ path=/sbin/augenrules ; argv[]=/sbin/augenrules --load ; ignore_errors=yes ; start_time=[Mon 2026-07-20 09:53:43 UTC] ; stop_time=[Mon 2026-07-20 09:53:43 UTC] ; pid=2413 ; code=exited ; status=0 }", "ExecStartPostEx": "{ path=/sbin/augenrules ; argv[]=/sbin/augenrules --load ; flags=ignore-failure ; start_time=[Mon 2026-07-20 09:53:43 UTC] ; stop_time=[Mon 2026-07-20 09:53:43 UTC] ; pid=2413 ; code=exited ; status=0 }", "ExitType": "main", "FailureAction": "none", "FileDescriptorStoreMax": "0", "FinalKillSignal": "9", "FragmentPath": "/lib/systemd/system/auditd.service", "FreezerState": "running", "GID": "[not set]", "GuessMainPID": "yes", "IOAccounting": "no", "IOReadBytes": "18446744073709551615", "IOReadOperations": "18446744073709551615", "IOSchedulingClass": "2", "IOSchedulingPriority": "4", "IOWeight": "[not set]", "IOWriteBytes": "18446744073709551615", "IOWriteOperations": "18446744073709551615", "IPAccounting": "no", "IPEgressBytes": "[no data]", "IPEgressPackets": "[no data]", "IPIngressBytes": "[no data]", "IPIngressPackets": "[no data]", "Id": "auditd.service", "IgnoreOnIsolate": "no", "IgnoreSIGPIPE": "yes", "InactiveEnterTimestampMonotonic": "0", "InactiveExitTimestamp": "Mon 2026-07-20 09:53:43 UTC", "InactiveExitTimestampMonotonic": "189712958", "InvocationID": "310eb3ffe22947a1b9b9e987036c63c2", "JobRunningTimeoutUSec": "infinity", "JobTimeoutAction": "none", "JobTimeoutUSec": "infinity", "KeyringMode": "private", "KillMode": "control-group", "KillSignal": "15", "LimitAS": "infinity", "LimitASSoft": "infinity", "LimitCORE": "infinity", "LimitCORESoft": "0", "LimitCPU": "infinity", "LimitCPUSoft": "infinity", "LimitDATA": "infinity", "LimitDATASoft": "infinity", "LimitFSIZE": "infinity", "LimitFSIZESoft": "infinity", "LimitLOCKS": "infinity", "LimitLOCKSSoft": "infinity", "LimitMEMLOCK": "8388608", "LimitMEMLOCKSoft": "8388608", "LimitMSGQUEUE": "819200", "LimitMSGQUEUESoft": "819200", "LimitNICE": "0", "LimitNICESoft": "0", "LimitNOFILE": "524288", "LimitNOFILESoft": "1024", "LimitNPROC": "15480", "LimitNPROCSoft": "15480", "LimitRSS": "infinity", "LimitRSSSoft": "infinity", "LimitRTPRIO": "0", "LimitRTPRIOSoft": "0", "LimitRTTIME": "infinity", "LimitRTTIMESoft": "infinity", "LimitSIGPENDING": "15480", "LimitSIGPENDINGSoft": "15480", "LimitSTACK": "infinity", "LimitSTACKSoft": "8388608", "LoadState": "loaded", "LockPersonality": "yes", "LogLevelMax": "-1", "LogRateLimitBurst": "0", "LogRateLimitIntervalUSec": "0", "LogsDirectoryMode": "0755", "MainPID": "2410", "ManagedOOMMemoryPressure": "auto", "ManagedOOMMemoryPressureLimit": "0", "ManagedOOMPreference": "none", "ManagedOOMSwap": "auto", "MemoryAccounting": "yes", "MemoryAvailable": "infinity", "MemoryCurrent": "716800", "MemoryDenyWriteExecute": "yes", "MemoryHigh": "infinity", "MemoryLimit": "infinity", "MemoryLow": "0", "MemoryMax": "infinity", "MemoryMin": "0", "MemorySwapMax": "infinity", "MountAPIVFS": "no", "NFileDescriptorStore": "0", "NRestarts": "0", "NUMAPolicy": "n/a", "Names": "auditd.service", "NeedDaemonReload": "no", "Nice": "0", "NoNewPrivileges": "no", "NonBlocking": "no", "NotifyAccess": "none", "OOMPolicy": "stop", "OOMScoreAdjust": "0", "OnFailureJobMode": "replace", "OnSuccessJobMode": "fail", "PIDFile": "/run/auditd.pid", "Perpetual": "no", "PrivateDevices": "no", "PrivateIPC": "no", "PrivateMounts": "no", "PrivateNetwork": "no", "PrivateTmp": "no", "PrivateUsers": "no", "ProcSubset": "all", "ProtectClock": "no", "ProtectControlGroups": "yes", "ProtectHome": "no", "ProtectHostname": "no", "ProtectKernelLogs": "no", "ProtectKernelModules": "yes", "ProtectKernelTunables": "no", "ProtectProc": "default", "ProtectSystem": "no", "RefuseManualStart": "no", "RefuseManualStop": "no", "ReloadResult": "success", "RemainAfterExit": "no", "RemoveIPC": "no", "Requires": "system.slice", "Restart": "on-failure", "RestartKillSignal": "15", "RestartPreventExitStatus": "2 4 6", "RestartUSec": "100ms", "RestrictNamespaces": "no", "RestrictRealtime": "yes", "RestrictSUIDSGID": "no", "Result": "success", "RootDirectoryStartOnly": "no", "RuntimeDirectoryMode": "0755", "RuntimeDirectoryPreserve": "no", "RuntimeMaxUSec": "infinity", "RuntimeRandomizedExtraUSec": "0", "SameProcessGroup": "no", "SecureBits": "0", "SendSIGHUP": "no", "SendSIGKILL": "yes", "Slice": "system.slice", "StandardError": "inherit", "StandardInput": "null", "StandardOutput": "journal", "StartLimitAction": "none", "StartLimitBurst": "5", "StartLimitIntervalUSec": "10s", "StartupBlockIOWeight": "[not set]", "StartupCPUShares": "[not set]", "StartupCPUWeight": "[not set]", "StartupIOWeight": "[not set]", "StateChangeTimestamp": "Mon 2026-07-20 09:53:43 UTC", "StateChangeTimestampMonotonic": "189773012", "StateDirectoryMode": "0755", "StatusErrno": "0", "StopWhenUnneeded": "no", "SubState": "running", "SuccessAction": "none", "SyslogFacility": "3", "SyslogLevel": "6", "SyslogLevelPrefix": "yes", "SyslogPriority": "30", "SystemCallErrorNumber": "2147483646", "TTYReset": "no", "TTYVHangup": "no", "TTYVTDisallocate": "no", "TasksAccounting": "yes", "TasksCurrent": "2", "TasksMax": "4644", "TimeoutAbortUSec": "1min 30s", "TimeoutCleanUSec": "infinity", "TimeoutStartFailureMode": "terminate", "TimeoutStartUSec": "1min 30s", "TimeoutStopFailureMode": "terminate", "TimeoutStopUSec": "1min 30s", "TimerSlackNSec": "50000", "Transient": "no", "Type": "forking", "UID": "[not set]", "UMask": "0022", "UnitFilePreset": "enabled", "UnitFileState": "enabled", "UtmpMode": "init", "WantedBy": "multi-user.target", "WatchdogSignal": "6", "WatchdogTimestampMonotonic": "0", "WatchdogUSec": "0"}} 2026-07-20 09:53:51.144799 | debian-bookworm | 2026-07-20 09:53:51.144949 | debian-bookworm | TASK [auditd : List existing rules files] ************************************** 2026-07-20 09:53:51.381724 | ubuntu-noble | --- before 2026-07-20 09:53:51.381780 | ubuntu-noble | +++ after: /home/zuul/.ansible/tmp/ansible-local-2032ayl1niwq/tmprumqhzbu/auditd.conf.j2 2026-07-20 09:53:51.381787 | ubuntu-noble | @@ -0,0 +1,37 @@ 2026-07-20 09:53:51.381792 | ubuntu-noble | +# 2026-07-20 09:53:51.381797 | ubuntu-noble | +# This file controls the configuration of the audit daemon 2026-07-20 09:53:51.381802 | ubuntu-noble | +# 2026-07-20 09:53:51.381806 | ubuntu-noble | + 2026-07-20 09:53:51.381811 | ubuntu-noble | +local_events = yes 2026-07-20 09:53:51.381816 | ubuntu-noble | +write_logs = yes 2026-07-20 09:53:51.381833 | ubuntu-noble | +log_file = /var/log/audit/audit.log 2026-07-20 09:53:51.381837 | ubuntu-noble | +log_group = adm 2026-07-20 09:53:51.381841 | ubuntu-noble | +log_format = RAW 2026-07-20 09:53:51.381897 | ubuntu-noble | +flush = INCREMENTAL_ASYNC 2026-07-20 09:53:51.382076 | ubuntu-noble | +freq = 50 2026-07-20 09:53:51.382199 | ubuntu-noble | +max_log_file = 8 2026-07-20 09:53:51.382316 | ubuntu-noble | +num_logs = 5 2026-07-20 09:53:51.382431 | ubuntu-noble | +priority_boost = 4 2026-07-20 09:53:51.382547 | ubuntu-noble | +disp_qos = lossy 2026-07-20 09:53:51.382689 | ubuntu-noble | +dispatcher = /sbin/audispd 2026-07-20 09:53:51.382813 | ubuntu-noble | +name_format = NONE 2026-07-20 09:53:51.382936 | ubuntu-noble | +##name = mydomain 2026-07-20 09:53:51.383070 | ubuntu-noble | +max_log_file_action = ROTATE 2026-07-20 09:53:51.383195 | ubuntu-noble | +space_left = 12361 2026-07-20 09:53:51.383313 | ubuntu-noble | +space_left_action = email 2026-07-20 09:53:51.383427 | ubuntu-noble | +verify_email = yes 2026-07-20 09:53:51.383544 | ubuntu-noble | +action_mail_acct = root 2026-07-20 09:53:51.383690 | ubuntu-noble | +admin_space_left = 50 2026-07-20 09:53:51.383818 | ubuntu-noble | +admin_space_left_action = SUSPEND 2026-07-20 09:53:51.383978 | ubuntu-noble | +disk_full_action = SUSPEND 2026-07-20 09:53:51.384126 | ubuntu-noble | +disk_error_action = SUSPEND 2026-07-20 09:53:51.384246 | ubuntu-noble | +use_libwrap = yes 2026-07-20 09:53:51.385323 | ubuntu-noble | +##tcp_listen_port = 60 2026-07-20 09:53:51.385580 | ubuntu-noble | +tcp_listen_queue = 5 2026-07-20 09:53:51.385758 | ubuntu-noble | +tcp_max_per_addr = 1 2026-07-20 09:53:51.385895 | ubuntu-noble | +##tcp_client_ports = 1024-65535 2026-07-20 09:53:51.386039 | ubuntu-noble | +tcp_client_max_idle = 0 2026-07-20 09:53:51.386162 | ubuntu-noble | +enable_krb5 = no 2026-07-20 09:53:51.386281 | ubuntu-noble | +krb5_principal = auditd 2026-07-20 09:53:51.386404 | ubuntu-noble | +##krb5_key_file = /etc/audit/audit.key 2026-07-20 09:53:51.386524 | ubuntu-noble | +distribute_network = no 2026-07-20 09:53:51.386653 | ubuntu-noble | 2026-07-20 09:53:51.386830 | ubuntu-noble | changed: [molecule-auditd] => {"changed": true, "checksum": "e902cc6bebf86c17087d153e359a2cc1231672e0", "dest": "/etc/audit/audit.conf", "gid": 0, "group": "root", "md5sum": "69dfd768317bae876a6a78c8aeb5cce1", "mode": "0640", "owner": "root", "size": 806, "src": "/home/zuul/.ansible/tmp/ansible-tmp-1784541229.5095813-2429-78314912380623/.source.conf", "state": "file", "uid": 0} 2026-07-20 09:53:51.386947 | ubuntu-noble | 2026-07-20 09:53:51.387091 | ubuntu-noble | TASK [auditd : Adjust auditd/audispd configurations] *************************** 2026-07-20 09:53:52.053954 | ubuntu-noble | ok: [molecule-auditd] => (item={'parameter': 'active', 'value': 'no', 'config': '/etc/audit/plugins.d/syslog.conf'}) => {"ansible_loop_var": "item", "backup": "", "changed": false, "item": {"config": "/etc/audit/plugins.d/syslog.conf", "parameter": "active", "value": "no"}, "msg": ""} 2026-07-20 09:53:52.054277 | ubuntu-noble | 2026-07-20 09:53:52.054515 | ubuntu-noble | TASK [auditd : Deploy rules for auditd] **************************************** 2026-07-20 09:53:51.721305 | debian-bookworm | ok: [molecule-auditd] => {"changed": false, "cmd": ["find", "/etc/audit/rules.d", "-type", "f", "-printf", "%f\n"], "delta": "0:00:00.007167", "end": "2026-07-20 09:53:51.671748", "msg": "", "rc": 0, "start": "2026-07-20 09:53:51.664581", "stderr": "", "stderr_lines": [], "stdout": "audit.rules\n20-neo23x0.rules", "stdout_lines": ["audit.rules", "20-neo23x0.rules"]} 2026-07-20 09:53:51.721393 | debian-bookworm | 2026-07-20 09:53:51.721501 | debian-bookworm | TASK [auditd : Remove unmanaged rules files] *********************************** 2026-07-20 09:53:52.143094 | debian-bookworm | --- before 2026-07-20 09:53:52.143146 | debian-bookworm | +++ after 2026-07-20 09:53:52.143158 | debian-bookworm | @@ -1,4 +1,4 @@ 2026-07-20 09:53:52.143246 | debian-bookworm | { 2026-07-20 09:53:52.143369 | debian-bookworm | "path": "/etc/audit/rules.d/audit.rules", 2026-07-20 09:53:52.143506 | debian-bookworm | - "state": "file" 2026-07-20 09:53:52.143623 | debian-bookworm | + "state": "absent" 2026-07-20 09:53:52.143738 | debian-bookworm | } 2026-07-20 09:53:52.143845 | debian-bookworm | 2026-07-20 09:53:52.143972 | debian-bookworm | changed: [molecule-auditd] => (item=audit.rules) => {"ansible_loop_var": "item", "changed": true, "item": "audit.rules", "path": "/etc/audit/rules.d/audit.rules", "state": "absent"} 2026-07-20 09:53:52.144097 | debian-bookworm | skipping: [molecule-auditd] => (item=20-neo23x0.rules) => {"ansible_loop_var": "item", "changed": false, "false_condition": "item not in auditd_rules_files", "item": "20-neo23x0.rules", "skip_reason": "Conditional result was False"} 2026-07-20 09:53:52.144206 | debian-bookworm | 2026-07-20 09:53:52.144330 | debian-bookworm | RUNNING HANDLER [auditd : Restart auditd service] ****************************** 2026-07-20 09:53:52.923036 | debian-bookworm | changed: [molecule-auditd] => {"changed": true, "name": "auditd", "state": "started", "status": {"ActiveEnterTimestamp": "Mon 2026-07-20 09:53:43 UTC", "ActiveEnterTimestampMonotonic": "189773012", "ActiveExitTimestampMonotonic": "0", "ActiveState": "active", "After": "system.slice systemd-tmpfiles-setup.service systemd-journald.socket local-fs.target", "AllowIsolate": "no", "AssertResult": "yes", "AssertTimestamp": "Mon 2026-07-20 09:53:43 UTC", "AssertTimestampMonotonic": "189685183", "Before": "sysinit.target systemd-update-utmp.service shutdown.target ssh.service", "BlockIOAccounting": "no", "BlockIOWeight": "[not set]", "CPUAccounting": "yes", "CPUAffinityFromNUMA": "no", "CPUQuotaPerSecUSec": "infinity", "CPUQuotaPeriodUSec": "infinity", "CPUSchedulingPolicy": "0", "CPUSchedulingPriority": "0", "CPUSchedulingResetOnFork": "no", "CPUShares": "[not set]", "CPUUsageNSec": "51735000", "CPUWeight": "[not set]", "CacheDirectoryMode": "0755", "CanFreeze": "yes", "CanIsolate": "no", "CanReload": "no", "CanStart": "yes", "CanStop": "yes", "CapabilityBoundingSet": "cap_chown cap_dac_override cap_dac_read_search cap_fowner cap_fsetid cap_kill cap_setgid cap_setuid cap_setpcap cap_linux_immutable cap_net_bind_service cap_net_broadcast cap_net_admin cap_net_raw cap_ipc_lock cap_ipc_owner cap_sys_rawio cap_sys_chroot cap_sys_ptrace cap_sys_pacct cap_sys_admin cap_sys_boot cap_sys_nice cap_sys_resource cap_sys_time cap_sys_tty_config cap_mknod cap_lease cap_audit_write cap_audit_control cap_setfcap cap_mac_override cap_mac_admin cap_syslog cap_wake_alarm cap_block_suspend cap_audit_read cap_perfmon cap_bpf cap_checkpoint_restore", "CleanResult": "success", "CollectMode": "inactive", "ConditionResult": "yes", "ConditionTimestamp": "Mon 2026-07-20 09:53:43 UTC", "ConditionTimestampMonotonic": "189685143", "ConfigurationDirectoryMode": "0755", "Conflicts": "shutdown.target", "ControlGroup": "/system.slice/auditd.service", "ControlGroupId": "3289", "ControlPID": "0", "CoredumpFilter": "0x33", "DefaultDependencies": "no", "DefaultMemoryLow": "0", "DefaultMemoryMin": "0", "Delegate": "no", "Description": "Security Auditing Service", "DevicePolicy": "auto", "Documentation": "\"man:auditd(8)\" https://github.com/linux-audit/audit-documentation", "DynamicUser": "no", "ExecMainCode": "0", "ExecMainExitTimestampMonotonic": "0", "ExecMainPID": "2410", "ExecMainStartTimestamp": "Mon 2026-07-20 09:53:43 UTC", "ExecMainStartTimestampMonotonic": "189733094", "ExecMainStatus": "0", "ExecStart": "{ path=/sbin/auditd ; argv[]=/sbin/auditd ; ignore_errors=no ; start_time=[Mon 2026-07-20 09:53:43 UTC] ; stop_time=[Mon 2026-07-20 09:53:43 UTC] ; pid=2409 ; code=exited ; status=0 }", "ExecStartEx": "{ path=/sbin/auditd ; argv[]=/sbin/auditd ; flags= ; start_time=[Mon 2026-07-20 09:53:43 UTC] ; stop_time=[Mon 2026-07-20 09:53:43 UTC] ; pid=2409 ; code=exited ; status=0 }", "ExecStartPost": "{ path=/sbin/augenrules ; argv[]=/sbin/augenrules --load ; ignore_errors=yes ; start_time=[Mon 2026-07-20 09:53:43 UTC] ; stop_time=[Mon 2026-07-20 09:53:43 UTC] ; pid=2413 ; code=exited ; status=0 }", "ExecStartPostEx": "{ path=/sbin/augenrules ; argv[]=/sbin/augenrules --load ; flags=ignore-failure ; start_time=[Mon 2026-07-20 09:53:43 UTC] ; stop_time=[Mon 2026-07-20 09:53:43 UTC] ; pid=2413 ; code=exited ; status=0 }", "ExitType": "main", "FailureAction": "none", "FileDescriptorStoreMax": "0", "FinalKillSignal": "9", "FragmentPath": "/lib/systemd/system/auditd.service", "FreezerState": "running", "GID": "[not set]", "GuessMainPID": "yes", "IOAccounting": "no", "IOReadBytes": "18446744073709551615", "IOReadOperations": "18446744073709551615", "IOSchedulingClass": "2", "IOSchedulingPriority": "4", "IOWeight": "[not set]", "IOWriteBytes": "18446744073709551615", "IOWriteOperations": "18446744073709551615", "IPAccounting": "no", "IPEgressBytes": "[no data]", "IPEgressPackets": "[no data]", "IPIngressBytes": "[no data]", "IPIngressPackets": "[no data]", "Id": "auditd.service", "IgnoreOnIsolate": "no", "IgnoreSIGPIPE": "yes", "InactiveEnterTimestampMonotonic": "0", "InactiveExitTimestamp": "Mon 2026-07-20 09:53:43 UTC", "InactiveExitTimestampMonotonic": "189712958", "InvocationID": "310eb3ffe22947a1b9b9e987036c63c2", "JobRunningTimeoutUSec": "infinity", "JobTimeoutAction": "none", "JobTimeoutUSec": "infinity", "KeyringMode": "private", "KillMode": "control-group", "KillSignal": "15", "LimitAS": "infinity", "LimitASSoft": "infinity", "LimitCORE": "infinity", "LimitCORESoft": "0", "LimitCPU": "infinity", "LimitCPUSoft": "infinity", "LimitDATA": "infinity", "LimitDATASoft": "infinity", "LimitFSIZE": "infinity", "LimitFSIZESoft": "infinity", "LimitLOCKS": "infinity", "LimitLOCKSSoft": "infinity", "LimitMEMLOCK": "8388608", "LimitMEMLOCKSoft": "8388608", "LimitMSGQUEUE": "819200", "LimitMSGQUEUESoft": "819200", "LimitNICE": "0", "LimitNICESoft": "0", "LimitNOFILE": "524288", "LimitNOFILESoft": "1024", "LimitNPROC": "15480", "LimitNPROCSoft": "15480", "LimitRSS": "infinity", "LimitRSSSoft": "infinity", "LimitRTPRIO": "0", "LimitRTPRIOSoft": "0", "LimitRTTIME": "infinity", "LimitRTTIMESoft": "infinity", "LimitSIGPENDING": "15480", "LimitSIGPENDINGSoft": "15480", "LimitSTACK": "infinity", "LimitSTACKSoft": "8388608", "LoadState": "loaded", "LockPersonality": "yes", "LogLevelMax": "-1", "LogRateLimitBurst": "0", "LogRateLimitIntervalUSec": "0", "LogsDirectoryMode": "0755", "MainPID": "2410", "ManagedOOMMemoryPressure": "auto", "ManagedOOMMemoryPressureLimit": "0", "ManagedOOMPreference": "none", "ManagedOOMSwap": "auto", "MemoryAccounting": "yes", "MemoryAvailable": "infinity", "MemoryCurrent": "724992", "MemoryDenyWriteExecute": "yes", "MemoryHigh": "infinity", "MemoryLimit": "infinity", "MemoryLow": "0", "MemoryMax": "infinity", "MemoryMin": "0", "MemorySwapMax": "infinity", "MountAPIVFS": "no", "NFileDescriptorStore": "0", "NRestarts": "0", "NUMAPolicy": "n/a", "Names": "auditd.service", "NeedDaemonReload": "no", "Nice": "0", "NoNewPrivileges": "no", "NonBlocking": "no", "NotifyAccess": "none", "OOMPolicy": "stop", "OOMScoreAdjust": "0", "OnFailureJobMode": "replace", "OnSuccessJobMode": "fail", "PIDFile": "/run/auditd.pid", "Perpetual": "no", "PrivateDevices": "no", "PrivateIPC": "no", "PrivateMounts": "no", "PrivateNetwork": "no", "PrivateTmp": "no", "PrivateUsers": "no", "ProcSubset": "all", "ProtectClock": "no", "ProtectControlGroups": "yes", "ProtectHome": "no", "ProtectHostname": "no", "ProtectKernelLogs": "no", "ProtectKernelModules": "yes", "ProtectKernelTunables": "no", "ProtectProc": "default", "ProtectSystem": "no", "RefuseManualStart": "no", "RefuseManualStop": "no", "ReloadResult": "success", "RemainAfterExit": "no", "RemoveIPC": "no", "Requires": "system.slice", "Restart": "on-failure", "RestartKillSignal": "15", "RestartPreventExitStatus": "2 4 6", "RestartUSec": "100ms", "RestrictNamespaces": "no", "RestrictRealtime": "yes", "RestrictSUIDSGID": "no", "Result": "success", "RootDirectoryStartOnly": "no", "RuntimeDirectoryMode": "0755", "RuntimeDirectoryPreserve": "no", "RuntimeMaxUSec": "infinity", "RuntimeRandomizedExtraUSec": "0", "SameProcessGroup": "no", "SecureBits": "0", "SendSIGHUP": "no", "SendSIGKILL": "yes", "Slice": "system.slice", "StandardError": "inherit", "StandardInput": "null", "StandardOutput": "journal", "StartLimitAction": "none", "StartLimitBurst": "5", "StartLimitIntervalUSec": "10s", "StartupBlockIOWeight": "[not set]", "StartupCPUShares": "[not set]", "StartupCPUWeight": "[not set]", "StartupIOWeight": "[not set]", "StateChangeTimestamp": "Mon 2026-07-20 09:53:43 UTC", "StateChangeTimestampMonotonic": "189773012", "StateDirectoryMode": "0755", "StatusErrno": "0", "StopWhenUnneeded": "no", "SubState": "running", "SuccessAction": "none", "SyslogFacility": "3", "SyslogLevel": "6", "SyslogLevelPrefix": "yes", "SyslogPriority": "30", "SystemCallErrorNumber": "2147483646", "TTYReset": "no", "TTYVHangup": "no", "TTYVTDisallocate": "no", "TasksAccounting": "yes", "TasksCurrent": "2", "TasksMax": "4644", "TimeoutAbortUSec": "1min 30s", "TimeoutCleanUSec": "infinity", "TimeoutStartFailureMode": "terminate", "TimeoutStartUSec": "1min 30s", "TimeoutStopFailureMode": "terminate", "TimeoutStopUSec": "1min 30s", "TimerSlackNSec": "50000", "Transient": "no", "Type": "forking", "UID": "[not set]", "UMask": "0022", "UnitFilePreset": "enabled", "UnitFileState": "enabled", "UtmpMode": "init", "WantedBy": "multi-user.target", "WatchdogSignal": "6", "WatchdogTimestampMonotonic": "0", "WatchdogUSec": "0"}} 2026-07-20 09:53:52.927181 | debian-bookworm | 2026-07-20 09:53:52.927396 | debian-bookworm | RUNNING HANDLER [auditd : Generate auditd rules] ******************************* 2026-07-20 09:53:53.361735 | ubuntu-noble | --- before 2026-07-20 09:53:53.361825 | ubuntu-noble | +++ after: /home/zuul/.ansible/tmp/ansible-local-2032ayl1niwq/tmpsoqtbtc9/20-neo23x0.rules.j2 2026-07-20 09:53:53.361835 | ubuntu-noble | @@ -0,0 +1,750 @@ 2026-07-20 09:53:53.361843 | ubuntu-noble | +# ___ ___ __ __ 2026-07-20 09:53:53.361850 | ubuntu-noble | +# / | __ ______/ (_) /_____/ / 2026-07-20 09:53:53.361855 | ubuntu-noble | +# / /| |/ / / / __ / / __/ __ / 2026-07-20 09:53:53.361861 | ubuntu-noble | +# / ___ / /_/ / /_/ / / /_/ /_/ / 2026-07-20 09:53:53.361867 | ubuntu-noble | +# /_/ |_\__,_/\__,_/_/\__/\__,_/ 2026-07-20 09:53:53.361873 | ubuntu-noble | +# 2026-07-20 09:53:53.361880 | ubuntu-noble | +# Linux Audit Daemon - Best Practice Configuration 2026-07-20 09:53:53.361885 | ubuntu-noble | +# /etc/audit/audit.rules 2026-07-20 09:53:53.361891 | ubuntu-noble | +# 2026-07-20 09:53:53.361897 | ubuntu-noble | +# Compiled by Florian Roth 2026-07-20 09:53:53.361903 | ubuntu-noble | +# 2026-07-20 09:53:53.361908 | ubuntu-noble | +# Created : 2017/12/05 2026-07-20 09:53:53.361914 | ubuntu-noble | +# Modified : 2023/01/25 2026-07-20 09:53:53.363224 | ubuntu-noble | +# 2026-07-20 09:53:53.363358 | ubuntu-noble | +# Based on rules published here: 2026-07-20 09:53:53.365873 | ubuntu-noble | +# Gov.uk auditd rules 2026-07-20 09:53:53.366208 | ubuntu-noble | +# https://github.com/gds-operations/puppet-auditd/pull/1 2026-07-20 09:53:53.366385 | ubuntu-noble | +# CentOS 7 hardening 2026-07-20 09:53:53.366560 | ubuntu-noble | +# https://highon.coffee/blog/security-harden-centos-7/#auditd---audit-daemon 2026-07-20 09:53:53.369671 | ubuntu-noble | +# Linux audit repo 2026-07-20 09:53:53.369734 | ubuntu-noble | +# https://github.com/linux-audit/audit-userspace/tree/master/rules 2026-07-20 09:53:53.369743 | ubuntu-noble | +# Auditd high performance linux auditing 2026-07-20 09:53:53.369750 | ubuntu-noble | +# https://linux-audit.com/tuning-auditd-high-performance-linux-auditing/ 2026-07-20 09:53:53.369757 | ubuntu-noble | +# 2026-07-20 09:53:53.369764 | ubuntu-noble | +# Further rules 2026-07-20 09:53:53.369911 | ubuntu-noble | +# For PCI DSS compliance see: 2026-07-20 09:53:53.370429 | ubuntu-noble | +# https://github.com/linux-audit/audit-userspace/blob/master/rules/30-pci-dss-v31.rules 2026-07-20 09:53:53.370873 | ubuntu-noble | +# For NISPOM compliance see: 2026-07-20 09:53:53.371401 | ubuntu-noble | +# https://github.com/linux-audit/audit-userspace/blob/master/rules/30-nispom.rules 2026-07-20 09:53:53.371666 | ubuntu-noble | + 2026-07-20 09:53:53.371892 | ubuntu-noble | +# Remove any existing rules 2026-07-20 09:53:53.372116 | ubuntu-noble | +-D 2026-07-20 09:53:53.372313 | ubuntu-noble | + 2026-07-20 09:53:53.372513 | ubuntu-noble | +# Buffer Size 2026-07-20 09:53:53.372752 | ubuntu-noble | +## Feel free to increase this if the machine panic's 2026-07-20 09:53:53.372953 | ubuntu-noble | +-b 8192 2026-07-20 09:53:53.373160 | ubuntu-noble | + 2026-07-20 09:53:53.373359 | ubuntu-noble | +# Failure Mode 2026-07-20 09:53:53.373567 | ubuntu-noble | +## Possible values: 0 (silent), 1 (printk, print a failure message), 2 (panic, halt the system) 2026-07-20 09:53:53.373777 | ubuntu-noble | +-f 1 2026-07-20 09:53:53.373973 | ubuntu-noble | + 2026-07-20 09:53:53.374197 | ubuntu-noble | +# Ignore errors 2026-07-20 09:53:53.374404 | ubuntu-noble | +## e.g. caused by users or files not found in the local environment 2026-07-20 09:53:53.374594 | ubuntu-noble | +-i 2026-07-20 09:53:53.374897 | ubuntu-noble | + 2026-07-20 09:53:53.375279 | ubuntu-noble | +# Self Auditing --------------------------------------------------------------- 2026-07-20 09:53:53.375504 | ubuntu-noble | + 2026-07-20 09:53:53.375825 | ubuntu-noble | +## Audit the audit logs 2026-07-20 09:53:53.376085 | ubuntu-noble | +### Successful and unsuccessful attempts to read information from the audit records 2026-07-20 09:53:53.376327 | ubuntu-noble | +-w /var/log/audit/ -p wra -k auditlog 2026-07-20 09:53:53.376527 | ubuntu-noble | +-w /var/audit/ -p wra -k auditlog 2026-07-20 09:53:53.376738 | ubuntu-noble | + 2026-07-20 09:53:53.376941 | ubuntu-noble | +## Auditd configuration 2026-07-20 09:53:53.377218 | ubuntu-noble | +### Modifications to audit configuration that occur while the audit collection functions are operating 2026-07-20 09:53:53.377524 | ubuntu-noble | +-w /etc/audit/ -p wa -k auditconfig 2026-07-20 09:53:53.377770 | ubuntu-noble | +-w /etc/libaudit.conf -p wa -k auditconfig 2026-07-20 09:53:53.377981 | ubuntu-noble | +-w /etc/audisp/ -p wa -k audispconfig 2026-07-20 09:53:53.378194 | ubuntu-noble | + 2026-07-20 09:53:53.378392 | ubuntu-noble | +## Monitor for use of audit management tools 2026-07-20 09:53:53.378594 | ubuntu-noble | +-w /sbin/auditctl -p x -k audittools 2026-07-20 09:53:53.378810 | ubuntu-noble | +-w /sbin/auditd -p x -k audittools 2026-07-20 09:53:53.379010 | ubuntu-noble | +-w /usr/sbin/auditd -p x -k audittools 2026-07-20 09:53:53.379258 | ubuntu-noble | +-w /usr/sbin/augenrules -p x -k audittools 2026-07-20 09:53:53.379445 | ubuntu-noble | + 2026-07-20 09:53:53.379665 | ubuntu-noble | +## Access to all audit trails 2026-07-20 09:53:53.379859 | ubuntu-noble | + 2026-07-20 09:53:53.380088 | ubuntu-noble | +-a always,exit -F path=/usr/sbin/ausearch -F perm=x -k audittools 2026-07-20 09:53:53.380295 | ubuntu-noble | +-a always,exit -F path=/usr/sbin/aureport -F perm=x -k audittools 2026-07-20 09:53:53.380495 | ubuntu-noble | +-a always,exit -F path=/usr/sbin/aulast -F perm=x -k audittools 2026-07-20 09:53:53.380863 | ubuntu-noble | +-a always,exit -F path=/usr/sbin/aulastlogin -F perm=x -k audittools 2026-07-20 09:53:53.381155 | ubuntu-noble | +-a always,exit -F path=/usr/sbin/auvirt -F perm=x -k audittools 2026-07-20 09:53:53.381351 | ubuntu-noble | + 2026-07-20 09:53:53.381546 | ubuntu-noble | +# Filters --------------------------------------------------------------------- 2026-07-20 09:53:53.381734 | ubuntu-noble | + 2026-07-20 09:53:53.383644 | ubuntu-noble | +### We put these early because audit is a first match wins system. 2026-07-20 09:53:53.383664 | ubuntu-noble | + 2026-07-20 09:53:53.383670 | ubuntu-noble | +## Ignore SELinux AVC records 2026-07-20 09:53:53.383676 | ubuntu-noble | +-a always,exclude -F msgtype=AVC 2026-07-20 09:53:53.383682 | ubuntu-noble | + 2026-07-20 09:53:53.383687 | ubuntu-noble | +## Ignore current working directory records 2026-07-20 09:53:53.383693 | ubuntu-noble | +-a always,exclude -F msgtype=CWD 2026-07-20 09:53:53.383698 | ubuntu-noble | + 2026-07-20 09:53:53.383704 | ubuntu-noble | +## Cron jobs fill the logs with stuff we normally don't want (works with SELinux) 2026-07-20 09:53:53.383730 | ubuntu-noble | +-a never,user -F subj_type=crond_t 2026-07-20 09:53:53.383736 | ubuntu-noble | +-a never,exit -F subj_type=crond_t 2026-07-20 09:53:53.383741 | ubuntu-noble | + 2026-07-20 09:53:53.383827 | ubuntu-noble | +## This prevents chrony from overwhelming the logs 2026-07-20 09:53:53.384013 | ubuntu-noble | +-a never,exit -F arch=b64 -S adjtimex -F auid=-1 -F uid=chrony -F subj_type=chronyd_t 2026-07-20 09:53:53.384197 | ubuntu-noble | + 2026-07-20 09:53:53.384432 | ubuntu-noble | +## This is not very interesting and wastes a lot of space if the server is public facing 2026-07-20 09:53:53.384765 | ubuntu-noble | +-a always,exclude -F msgtype=CRYPTO_KEY_USER 2026-07-20 09:53:53.384955 | ubuntu-noble | + 2026-07-20 09:53:53.385187 | ubuntu-noble | +## Open VM Tools 2026-07-20 09:53:53.385367 | ubuntu-noble | +-a exit,never -F arch=b64 -S all -F exe=/usr/bin/vmtoolsd 2026-07-20 09:53:53.385511 | ubuntu-noble | + 2026-07-20 09:53:53.385691 | ubuntu-noble | +## High Volume Event Filter (especially on Linux Workstations) 2026-07-20 09:53:53.385856 | ubuntu-noble | +-a never,exit -F arch=b64 -F dir=/dev/shm -k sharedmemaccess 2026-07-20 09:53:53.386014 | ubuntu-noble | +-a never,exit -F arch=b64 -F dir=/var/lock/lvm -k locklvm 2026-07-20 09:53:53.386176 | ubuntu-noble | + 2026-07-20 09:53:53.386325 | ubuntu-noble | +## FileBeat 2026-07-20 09:53:53.386479 | ubuntu-noble | +-a never,exit -F arch=b64 -F path=/opt/filebeat -k filebeat 2026-07-20 09:53:53.386640 | ubuntu-noble | + 2026-07-20 09:53:53.386801 | ubuntu-noble | +## More information on how to filter events 2026-07-20 09:53:53.386958 | ubuntu-noble | +### https://access.redhat.com/solutions/2482221 2026-07-20 09:53:53.387118 | ubuntu-noble | + 2026-07-20 09:53:53.387269 | ubuntu-noble | +# Rules ----------------------------------------------------------------------- 2026-07-20 09:53:53.387412 | ubuntu-noble | + 2026-07-20 09:53:53.387563 | ubuntu-noble | +## Kernel parameters 2026-07-20 09:53:53.387730 | ubuntu-noble | +-w /etc/sysctl.conf -p wa -k sysctl 2026-07-20 09:53:53.387888 | ubuntu-noble | +-w /etc/sysctl.d -p wa -k sysctl 2026-07-20 09:53:53.388043 | ubuntu-noble | + 2026-07-20 09:53:53.388202 | ubuntu-noble | +## Kernel module loading and unloading 2026-07-20 09:53:53.388358 | ubuntu-noble | +-a always,exit -F perm=x -F auid!=-1 -F path=/sbin/insmod -k modules 2026-07-20 09:53:53.388514 | ubuntu-noble | +-a always,exit -F perm=x -F auid!=-1 -F path=/sbin/modprobe -k modules 2026-07-20 09:53:53.388684 | ubuntu-noble | +-a always,exit -F perm=x -F auid!=-1 -F path=/sbin/rmmod -k modules 2026-07-20 09:53:53.388848 | ubuntu-noble | +-a always,exit -F arch=b64 -S finit_module -S init_module -S delete_module -F auid!=-1 -k modules 2026-07-20 09:53:53.388991 | ubuntu-noble | + 2026-07-20 09:53:53.389189 | ubuntu-noble | +## Modprobe configuration 2026-07-20 09:53:53.389338 | ubuntu-noble | +-w /etc/modprobe.conf -p wa -k modprobe 2026-07-20 09:53:53.389480 | ubuntu-noble | +-w /etc/modprobe.d -p wa -k modprobe 2026-07-20 09:53:53.389634 | ubuntu-noble | + 2026-07-20 09:53:53.389792 | ubuntu-noble | +## KExec usage (all actions) 2026-07-20 09:53:53.389944 | ubuntu-noble | +-a always,exit -F arch=b64 -S kexec_load -k KEXEC 2026-07-20 09:53:53.390099 | ubuntu-noble | + 2026-07-20 09:53:53.390244 | ubuntu-noble | +## Special files 2026-07-20 09:53:53.390395 | ubuntu-noble | +-a always,exit -F arch=b64 -S mknod -S mknodat -k specialfiles 2026-07-20 09:53:53.390535 | ubuntu-noble | + 2026-07-20 09:53:53.390697 | ubuntu-noble | +## Mount operations (only attributable) 2026-07-20 09:53:53.390854 | ubuntu-noble | +-a always,exit -F arch=b64 -S mount -S umount2 -F auid!=-1 -k mount 2026-07-20 09:53:53.391008 | ubuntu-noble | + 2026-07-20 09:53:53.391170 | ubuntu-noble | +### NFS mount 2026-07-20 09:53:53.391329 | ubuntu-noble | +-a always,exit -F path=/sbin/mount.nfs -F perm=x -F auid>=500 -F auid!=4294967295 -k T1078_Valid_Accounts 2026-07-20 09:53:53.391491 | ubuntu-noble | +-a always,exit -F path=/usr/sbin/mount.nfs -F perm=x -F auid>=500 -F auid!=4294967295 -k T1078_Valid_Accounts 2026-07-20 09:53:53.391644 | ubuntu-noble | + 2026-07-20 09:53:53.391799 | ubuntu-noble | +## Change swap (only attributable) 2026-07-20 09:53:53.391953 | ubuntu-noble | +-a always,exit -F arch=b64 -S swapon -S swapoff -F auid!=-1 -k swap 2026-07-20 09:53:53.392132 | ubuntu-noble | + 2026-07-20 09:53:53.392269 | ubuntu-noble | +## Time 2026-07-20 09:53:53.392409 | ubuntu-noble | +-a always,exit -F arch=b64 -F uid!=ntp -S adjtimex -S settimeofday -S clock_settime -k time 2026-07-20 09:53:53.392541 | ubuntu-noble | +### Local time zone 2026-07-20 09:53:53.392695 | ubuntu-noble | +-w /etc/localtime -p wa -k localtime 2026-07-20 09:53:53.392824 | ubuntu-noble | + 2026-07-20 09:53:53.392951 | ubuntu-noble | +## Stunnel 2026-07-20 09:53:53.393098 | ubuntu-noble | +-w /usr/sbin/stunnel -p x -k stunnel 2026-07-20 09:53:53.393254 | ubuntu-noble | +-w /usr/bin/stunnel -p x -k stunnel 2026-07-20 09:53:53.393380 | ubuntu-noble | + 2026-07-20 09:53:53.393514 | ubuntu-noble | +## Cron configuration & scheduled jobs 2026-07-20 09:53:53.393662 | ubuntu-noble | +-w /etc/cron.allow -p wa -k cron 2026-07-20 09:53:53.393801 | ubuntu-noble | +-w /etc/cron.deny -p wa -k cron 2026-07-20 09:53:53.393935 | ubuntu-noble | +-w /etc/cron.d/ -p wa -k cron 2026-07-20 09:53:53.394104 | ubuntu-noble | +-w /etc/cron.daily/ -p wa -k cron 2026-07-20 09:53:53.394236 | ubuntu-noble | +-w /etc/cron.hourly/ -p wa -k cron 2026-07-20 09:53:53.394356 | ubuntu-noble | +-w /etc/cron.monthly/ -p wa -k cron 2026-07-20 09:53:53.394472 | ubuntu-noble | +-w /etc/cron.weekly/ -p wa -k cron 2026-07-20 09:53:53.394589 | ubuntu-noble | +-w /etc/crontab -p wa -k cron 2026-07-20 09:53:53.394720 | ubuntu-noble | +-w /var/spool/cron/ -p wa -k cron 2026-07-20 09:53:53.394841 | ubuntu-noble | + 2026-07-20 09:53:53.395124 | ubuntu-noble | +## User, group, password databases 2026-07-20 09:53:53.395250 | ubuntu-noble | +-w /etc/group -p wa -k etcgroup 2026-07-20 09:53:53.395370 | ubuntu-noble | +-w /etc/passwd -p wa -k etcpasswd 2026-07-20 09:53:53.395490 | ubuntu-noble | +-w /etc/gshadow -k etcgroup 2026-07-20 09:53:53.395609 | ubuntu-noble | +-w /etc/shadow -k etcpasswd 2026-07-20 09:53:53.395748 | ubuntu-noble | +-w /etc/security/opasswd -k opasswd 2026-07-20 09:53:53.395867 | ubuntu-noble | + 2026-07-20 09:53:53.397652 | ubuntu-noble | +## Sudoers file changes 2026-07-20 09:53:53.397670 | ubuntu-noble | +-w /etc/sudoers -p wa -k actions 2026-07-20 09:53:53.397674 | ubuntu-noble | +-w /etc/sudoers.d/ -p wa -k actions 2026-07-20 09:53:53.397678 | ubuntu-noble | + 2026-07-20 09:53:53.397682 | ubuntu-noble | +## Passwd 2026-07-20 09:53:53.397686 | ubuntu-noble | +-w /usr/bin/passwd -p x -k passwd_modification 2026-07-20 09:53:53.397690 | ubuntu-noble | + 2026-07-20 09:53:53.397694 | ubuntu-noble | +## Tools to change group identifiers 2026-07-20 09:53:53.397698 | ubuntu-noble | +-w /usr/sbin/groupadd -p x -k group_modification 2026-07-20 09:53:53.397701 | ubuntu-noble | +-w /usr/sbin/groupmod -p x -k group_modification 2026-07-20 09:53:53.397705 | ubuntu-noble | +-w /usr/sbin/addgroup -p x -k group_modification 2026-07-20 09:53:53.397708 | ubuntu-noble | +-w /usr/sbin/useradd -p x -k user_modification 2026-07-20 09:53:53.397712 | ubuntu-noble | +-w /usr/sbin/userdel -p x -k user_modification 2026-07-20 09:53:53.397716 | ubuntu-noble | +-w /usr/sbin/usermod -p x -k user_modification 2026-07-20 09:53:53.397720 | ubuntu-noble | +-w /usr/sbin/adduser -p x -k user_modification 2026-07-20 09:53:53.397723 | ubuntu-noble | + 2026-07-20 09:53:53.397749 | ubuntu-noble | +## Login configuration and information 2026-07-20 09:53:53.397873 | ubuntu-noble | +-w /etc/login.defs -p wa -k login 2026-07-20 09:53:53.397992 | ubuntu-noble | +-w /etc/securetty -p wa -k login 2026-07-20 09:53:53.398123 | ubuntu-noble | +-w /var/log/faillog -p wa -k login 2026-07-20 09:53:53.398240 | ubuntu-noble | +-w /var/log/lastlog -p wa -k login 2026-07-20 09:53:53.398357 | ubuntu-noble | +-w /var/log/tallylog -p wa -k login 2026-07-20 09:53:53.398469 | ubuntu-noble | + 2026-07-20 09:53:53.398586 | ubuntu-noble | +## Network Environment 2026-07-20 09:53:53.398715 | ubuntu-noble | +### Changes to hostname 2026-07-20 09:53:53.398845 | ubuntu-noble | +-a always,exit -F arch=b64 -S sethostname -S setdomainname -k network_modifications 2026-07-20 09:53:53.398959 | ubuntu-noble | + 2026-07-20 09:53:53.399090 | ubuntu-noble | +### Detect Remote Shell Use 2026-07-20 09:53:53.399216 | ubuntu-noble | +-a always,exit -F arch=b64 -F exe=/bin/bash -F success=1 -S connect -k "remote_shell" 2026-07-20 09:53:53.399339 | ubuntu-noble | +-a always,exit -F arch=b64 -F exe=/usr/bin/bash -F success=1 -S connect -k "remote_shell" 2026-07-20 09:53:53.399451 | ubuntu-noble | + 2026-07-20 09:53:53.399567 | ubuntu-noble | +### Successful IPv4 Connections 2026-07-20 09:53:53.399716 | ubuntu-noble | +-a always,exit -F arch=b64 -S connect -F a2=16 -F success=1 -F key=network_connect_4 2026-07-20 09:53:53.399834 | ubuntu-noble | + 2026-07-20 09:53:53.399952 | ubuntu-noble | +### Successful IPv6 Connections 2026-07-20 09:53:53.400087 | ubuntu-noble | +-a always,exit -F arch=b64 -S connect -F a2=28 -F success=1 -F key=network_connect_6 2026-07-20 09:53:53.400215 | ubuntu-noble | + 2026-07-20 09:53:53.400332 | ubuntu-noble | +### Changes to other files 2026-07-20 09:53:53.400453 | ubuntu-noble | +-w /etc/hosts -p wa -k network_modifications 2026-07-20 09:53:53.400575 | ubuntu-noble | +-w /etc/sysconfig/network -p wa -k network_modifications 2026-07-20 09:53:53.400828 | ubuntu-noble | +-w /etc/sysconfig/network-scripts -p w -k network_modifications 2026-07-20 09:53:53.400957 | ubuntu-noble | +-w /etc/network/ -p wa -k network 2026-07-20 09:53:53.401134 | ubuntu-noble | +-a always,exit -F dir=/etc/NetworkManager/ -F perm=wa -k network_modifications 2026-07-20 09:53:53.401250 | ubuntu-noble | + 2026-07-20 09:53:53.401383 | ubuntu-noble | +### Changes to issue 2026-07-20 09:53:53.401503 | ubuntu-noble | +-w /etc/issue -p wa -k etcissue 2026-07-20 09:53:53.401646 | ubuntu-noble | +-w /etc/issue.net -p wa -k etcissue 2026-07-20 09:53:53.402112 | ubuntu-noble | + 2026-07-20 09:53:53.402375 | ubuntu-noble | +## System startup scripts 2026-07-20 09:53:53.402520 | ubuntu-noble | +-w /etc/inittab -p wa -k init 2026-07-20 09:53:53.402659 | ubuntu-noble | +-w /etc/init.d/ -p wa -k init 2026-07-20 09:53:53.402782 | ubuntu-noble | +-w /etc/init/ -p wa -k init 2026-07-20 09:53:53.402903 | ubuntu-noble | + 2026-07-20 09:53:53.403034 | ubuntu-noble | +## Library search paths 2026-07-20 09:53:53.403156 | ubuntu-noble | +-w /etc/ld.so.conf -p wa -k libpath 2026-07-20 09:53:53.403274 | ubuntu-noble | +-w /etc/ld.so.conf.d -p wa -k libpath 2026-07-20 09:53:53.403387 | ubuntu-noble | + 2026-07-20 09:53:53.403509 | ubuntu-noble | +## Systemwide library preloads (LD_PRELOAD) 2026-07-20 09:53:53.403651 | ubuntu-noble | +-w /etc/ld.so.preload -p wa -k systemwide_preloads 2026-07-20 09:53:53.403768 | ubuntu-noble | + 2026-07-20 09:53:53.403888 | ubuntu-noble | +## Pam configuration 2026-07-20 09:53:53.404004 | ubuntu-noble | +-w /etc/pam.d/ -p wa -k pam 2026-07-20 09:53:53.404141 | ubuntu-noble | +-w /etc/security/limits.conf -p wa -k pam 2026-07-20 09:53:53.404464 | ubuntu-noble | +-w /etc/security/limits.d -p wa -k pam 2026-07-20 09:53:53.404716 | ubuntu-noble | +-w /etc/security/pam_env.conf -p wa -k pam 2026-07-20 09:53:53.404865 | ubuntu-noble | +-w /etc/security/namespace.conf -p wa -k pam 2026-07-20 09:53:53.404984 | ubuntu-noble | +-w /etc/security/namespace.d -p wa -k pam 2026-07-20 09:53:53.405152 | ubuntu-noble | +-w /etc/security/namespace.init -p wa -k pam 2026-07-20 09:53:53.405267 | ubuntu-noble | + 2026-07-20 09:53:53.405386 | ubuntu-noble | +## Mail configuration 2026-07-20 09:53:53.405503 | ubuntu-noble | +-w /etc/aliases -p wa -k mail 2026-07-20 09:53:53.405646 | ubuntu-noble | +-w /etc/postfix/ -p wa -k mail 2026-07-20 09:53:53.405772 | ubuntu-noble | +-w /etc/exim4/ -p wa -k mail 2026-07-20 09:53:53.405885 | ubuntu-noble | + 2026-07-20 09:53:53.406001 | ubuntu-noble | +## SSH configuration 2026-07-20 09:53:53.406158 | ubuntu-noble | +-w /etc/ssh/sshd_config -k sshd 2026-07-20 09:53:53.406277 | ubuntu-noble | +-w /etc/ssh/sshd_config.d -k sshd 2026-07-20 09:53:53.406389 | ubuntu-noble | + 2026-07-20 09:53:53.406508 | ubuntu-noble | +## root ssh key tampering 2026-07-20 09:53:53.407265 | ubuntu-noble | +-w /root/.ssh -p wa -k rootkey 2026-07-20 09:53:53.407463 | ubuntu-noble | + 2026-07-20 09:53:53.407713 | ubuntu-noble | +# Systemd 2026-07-20 09:53:53.407920 | ubuntu-noble | +-w /bin/systemctl -p x -k systemd 2026-07-20 09:53:53.408256 | ubuntu-noble | +-w /etc/systemd/ -p wa -k systemd 2026-07-20 09:53:53.408415 | ubuntu-noble | +-w /usr/lib/systemd -p wa -k systemd 2026-07-20 09:53:53.409423 | ubuntu-noble | + 2026-07-20 09:53:53.409645 | ubuntu-noble | +## https://systemd.network/systemd.generator.html 2026-07-20 09:53:53.412685 | ubuntu-noble | +-w /etc/systemd/system-generators/ -p wa -k systemd_generator 2026-07-20 09:53:53.412718 | ubuntu-noble | +-w /usr/local/lib/systemd/system-generators/ -p wa -k systemd_generator 2026-07-20 09:53:53.422105 | debian-bookworm | changed: [molecule-auditd] => {"changed": true, "cmd": ["augenrules", "--load"], "delta": "0:00:00.084161", "end": "2026-07-20 09:53:53.366819", "msg": "", "rc": 0, "start": "2026-07-20 09:53:53.282658", "stderr": "Unknown user: chrony\nThere was an error in line 24 of /etc/audit/audit.rules\nError sending add rule data request (No such file or directory)\nThere was an error in line 28 of /etc/audit/audit.rules\nUnknown user: ntp\nThere was an error in line 44 of /etc/audit/audit.rules\nError sending add rule data request (No such file or directory)\nThere was an error in line 83 of /etc/audit/audit.rules\nError sending add rule data request (No such file or directory)\nThere was an error in line 84 of /etc/audit/audit.rules\nError sending add rule data request (No such file or directory)\nThere was an error in line 112 of /etc/audit/audit.rules\nError sending add rule data request (No such file or directory)\nThere was an error in line 115 of /etc/audit/audit.rules\nError sending add rule data request (No such file or directory)\nThere was an error in line 176 of /etc/audit/audit.rules\nError sending add rule data request (No such file or directory)\nThere was an error in line 177 of /etc/audit/audit.rules\nError sending add rule data request (No such file or directory)\nThere was an error in line 178 of /etc/audit/audit.rules\nError sending add rule data request (No such file or directory)\nThere was an error in line 179 of /etc/audit/audit.rules\nError sending add rule data request (No such file or directory)\nThere was an error in line 180 of /etc/audit/audit.rules\nError sending add rule data request (No such file or directory)\nThere was an error in line 217 of /etc/audit/audit.rules\nError sending add rule data request (No such file or directory)\nThere was an error in line 218 of /etc/audit/audit.rules\nError sending add rule data request (No such file or directory)\nThere was an error in line 234 of /etc/audit/audit.rules\nError sending add rule data request (No such file or directory)\nThere was an error in line 285 of /etc/audit/audit.rules\nError sending add rule data request (No such file or directory)\nThere was an error in line 286 of /etc/audit/audit.rules\nError sending add rule data request (No such file or directory)\nThere was an error in line 324 of /etc/audit/audit.rules\nError sending add rule data request (No such file or directory)\nThere was an error in line 325 of /etc/audit/audit.rules\nError sending add rule data request (No such file or directory)\nThere was an error in line 346 of /etc/audit/audit.rules\nparameter passed without an option given\nThere was an error in line 347 of /etc/audit/audit.rules\nparameter passed without an option given\nThere was an error in line 348 of /etc/audit/audit.rules\nparameter passed without an option given\nThere was an error in line 349 of /etc/audit/audit.rules\nparameter passed without an option given\nThere was an error in line 350 of /etc/audit/audit.rules\nparameter passed without an option given\nThere was an error in line 351 of /etc/audit/audit.rules\nError sending add rule data request (No such file or directory)\nThere was an error in line 359 of /etc/audit/audit.rules", "stderr_lines": ["Unknown user: chrony", "There was an error in line 24 of /etc/audit/audit.rules", "Error sending add rule data request (No such file or directory)", "There was an error in line 28 of /etc/audit/audit.rules", "Unknown user: ntp", "There was an error in line 44 of /etc/audit/audit.rules", "Error sending add rule data request (No such file or directory)", "There was an error in line 83 of /etc/audit/audit.rules", "Error sending add rule data request (No such file or directory)", "There was an error in line 84 of /etc/audit/audit.rules", "Error sending add rule data request (No such file or directory)", "There was an error in line 112 of /etc/audit/audit.rules", "Error sending add rule data request (No such file or directory)", "There was an error in line 115 of /etc/audit/audit.rules", "Error sending add rule data request (No such file or directory)", "There was an error in line 176 of /etc/audit/audit.rules", "Error sending add rule data request (No such file or directory)", "There was an error in line 177 of /etc/audit/audit.rules", "Error sending add rule data request (No such file or directory)", "There was an error in line 178 of /etc/audit/audit.rules", "Error sending add rule data request (No such file or directory)", "There was an error in line 179 of /etc/audit/audit.rules", "Error sending add rule data request (No such file or directory)", "There was an error in line 180 of /etc/audit/audit.rules", "Error sending add rule data request (No such file or directory)", "There was an error in line 217 of /etc/audit/audit.rules", "Error sending add rule data request (No such file or directory)", "There was an error in line 218 of /etc/audit/audit.rules", "Error sending add rule data request (No such file or directory)", "There was an error in line 234 of /etc/audit/audit.rules", "Error sending add rule data request (No such file or directory)", "There was an error in line 285 of /etc/audit/audit.rules", "Error sending add rule data request (No such file or directory)", "There was an error in line 286 of /etc/audit/audit.rules", "Error sending add rule data request (No such file or directory)", "There was an error in line 324 of /etc/audit/audit.rules", "Error sending add rule data request (No such file or directory)", "There was an error in line 325 of /etc/audit/audit.rules", "Error sending add rule data request (No such file or directory)", "There was an error in line 346 of /etc/audit/audit.rules", "parameter passed without an option given", "There was an error in line 347 of /etc/audit/audit.rules", "parameter passed without an option given", "There was an error in line 348 of /etc/audit/audit.rules", "parameter passed without an option given", "There was an error in line 349 of /etc/audit/audit.rules", "parameter passed without an option given", "There was an error in line 350 of /etc/audit/audit.rules", "parameter passed without an option given", "There was an error in line 351 of /etc/audit/audit.rules", "Error sending add rule data request (No such file or directory)", "There was an error in line 359 of /etc/audit/audit.rules"], "stdout": "/usr/sbin/augenrules: No change\nNo rules\nenabled 1\nfailure 1\npid 2799\nrate_limit 0\nbacklog_limit 8192\nlost 0\nbacklog 4\nbacklog_wait_time 60000\nbacklog_wait_time_actual 0\nenabled 1\nfailure 1\npid 2799\nrate_limit 0\nbacklog_limit 8192\nlost 0\nbacklog 4\nbacklog_wait_time 60000\nbacklog_wait_time_actual 0", "stdout_lines": ["/usr/sbin/augenrules: No change", "No rules", "enabled 1", "failure 1", "pid 2799", "rate_limit 0", "backlog_limit 8192", "lost 0", "backlog 4", "backlog_wait_time 60000", "backlog_wait_time_actual 0", "enabled 1", "failure 1", "pid 2799", "rate_limit 0", "backlog_limit 8192", "lost 0", "backlog 4", "backlog_wait_time 60000", "backlog_wait_time_actual 0"]} 2026-07-20 09:53:53.412724 | ubuntu-noble | +-w /usr/lib/systemd/system-generators -p wa -k systemd_generator 2026-07-20 09:53:53.422160 | debian-bookworm | 2026-07-20 09:53:53.412728 | ubuntu-noble | + 2026-07-20 09:53:53.422266 | debian-bookworm | RUNNING HANDLER [auditd : Restart auditd service] ****************************** 2026-07-20 09:53:53.412732 | ubuntu-noble | +-w /etc/systemd/user-generators/ -p wa -k systemd_generator 2026-07-20 09:53:53.412736 | ubuntu-noble | +-w /usr/local/lib/systemd/user-generators/ -p wa -k systemd_generator 2026-07-20 09:53:53.412740 | ubuntu-noble | +-w /lib/systemd/system-generators/ -p wa -k systemd_generator 2026-07-20 09:53:53.412744 | ubuntu-noble | + 2026-07-20 09:53:53.412748 | ubuntu-noble | +## SELinux events that modify the system's Mandatory Access Controls (MAC) 2026-07-20 09:53:53.412751 | ubuntu-noble | +-w /etc/selinux/ -p wa -k mac_policy 2026-07-20 09:53:53.412755 | ubuntu-noble | + 2026-07-20 09:53:53.412759 | ubuntu-noble | +## Critical elements access failures 2026-07-20 09:53:53.412763 | ubuntu-noble | +-a always,exit -F arch=b64 -S open -F dir=/etc -F success=0 -k unauthedfileaccess 2026-07-20 09:53:53.412767 | ubuntu-noble | +-a always,exit -F arch=b64 -S open -F dir=/bin -F success=0 -k unauthedfileaccess 2026-07-20 09:53:53.412870 | ubuntu-noble | +-a always,exit -F arch=b64 -S open -F dir=/sbin -F success=0 -k unauthedfileaccess 2026-07-20 09:53:53.413002 | ubuntu-noble | +-a always,exit -F arch=b64 -S open -F dir=/usr/bin -F success=0 -k unauthedfileaccess 2026-07-20 09:53:53.413148 | ubuntu-noble | +-a always,exit -F arch=b64 -S open -F dir=/usr/sbin -F success=0 -k unauthedfileaccess 2026-07-20 09:53:53.413286 | ubuntu-noble | +-a always,exit -F arch=b64 -S open -F dir=/var -F success=0 -k unauthedfileaccess 2026-07-20 09:53:53.413411 | ubuntu-noble | +-a always,exit -F arch=b64 -S open -F dir=/home -F success=0 -k unauthedfileaccess 2026-07-20 09:53:53.413549 | ubuntu-noble | +-a always,exit -F arch=b64 -S open -F dir=/srv -F success=0 -k unauthedfileaccess 2026-07-20 09:53:53.413684 | ubuntu-noble | + 2026-07-20 09:53:53.413814 | ubuntu-noble | +## Process ID change (switching accounts) applications 2026-07-20 09:53:53.413971 | ubuntu-noble | +-w /bin/su -p x -k priv_esc 2026-07-20 09:53:53.414134 | ubuntu-noble | +-w /usr/bin/sudo -p x -k priv_esc 2026-07-20 09:53:53.414248 | ubuntu-noble | + 2026-07-20 09:53:53.414370 | ubuntu-noble | +## Power state 2026-07-20 09:53:53.414492 | ubuntu-noble | +-w /sbin/shutdown -p x -k power 2026-07-20 09:53:53.414611 | ubuntu-noble | +-w /sbin/poweroff -p x -k power 2026-07-20 09:53:53.414762 | ubuntu-noble | +-w /sbin/reboot -p x -k power 2026-07-20 09:53:53.414881 | ubuntu-noble | +-w /sbin/halt -p x -k power 2026-07-20 09:53:53.415072 | ubuntu-noble | + 2026-07-20 09:53:53.415199 | ubuntu-noble | +## Session initiation information 2026-07-20 09:53:53.415318 | ubuntu-noble | +-w /var/run/utmp -p wa -k session 2026-07-20 09:53:53.415437 | ubuntu-noble | +-w /var/log/btmp -p wa -k session 2026-07-20 09:53:53.415554 | ubuntu-noble | +-w /var/log/wtmp -p wa -k session 2026-07-20 09:53:53.415689 | ubuntu-noble | + 2026-07-20 09:53:53.415817 | ubuntu-noble | +## Discretionary Access Control (DAC) modifications 2026-07-20 09:53:53.415941 | ubuntu-noble | +-a always,exit -F arch=b64 -S chmod -F auid>=1000 -F auid!=-1 -k perm_mod 2026-07-20 09:53:53.416116 | ubuntu-noble | +-a always,exit -F arch=b64 -S chown -F auid>=1000 -F auid!=-1 -k perm_mod 2026-07-20 09:53:53.416253 | ubuntu-noble | +-a always,exit -F arch=b64 -S fchmod -F auid>=1000 -F auid!=-1 -k perm_mod 2026-07-20 09:53:53.416378 | ubuntu-noble | +-a always,exit -F arch=b64 -S fchmodat -F auid>=1000 -F auid!=-1 -k perm_mod 2026-07-20 09:53:53.416499 | ubuntu-noble | +-a always,exit -F arch=b64 -S fchown -F auid>=1000 -F auid!=-1 -k perm_mod 2026-07-20 09:53:53.416637 | ubuntu-noble | +-a always,exit -F arch=b64 -S fchownat -F auid>=1000 -F auid!=-1 -k perm_mod 2026-07-20 09:53:53.416777 | ubuntu-noble | +-a always,exit -F arch=b64 -S fremovexattr -F auid>=1000 -F auid!=-1 -k perm_mod 2026-07-20 09:53:53.416900 | ubuntu-noble | +-a always,exit -F arch=b64 -S fsetxattr -F auid>=1000 -F auid!=-1 -k perm_mod 2026-07-20 09:53:53.417039 | ubuntu-noble | +-a always,exit -F arch=b64 -S lchown -F auid>=1000 -F auid!=-1 -k perm_mod 2026-07-20 09:53:53.417196 | ubuntu-noble | +-a always,exit -F arch=b64 -S lremovexattr -F auid>=1000 -F auid!=-1 -k perm_mod 2026-07-20 09:53:53.417319 | ubuntu-noble | +-a always,exit -F arch=b64 -S lsetxattr -F auid>=1000 -F auid!=-1 -k perm_mod 2026-07-20 09:53:53.417442 | ubuntu-noble | +-a always,exit -F arch=b64 -S removexattr -F auid>=1000 -F auid!=-1 -k perm_mod 2026-07-20 09:53:53.417565 | ubuntu-noble | +-a always,exit -F arch=b64 -S setxattr -F auid>=1000 -F auid!=-1 -k perm_mod 2026-07-20 09:53:53.417693 | ubuntu-noble | + 2026-07-20 09:53:53.417816 | ubuntu-noble | +# Special Rules --------------------------------------------------------------- 2026-07-20 09:53:53.417928 | ubuntu-noble | + 2026-07-20 09:53:53.418086 | ubuntu-noble | +## Reconnaissance 2026-07-20 09:53:53.418246 | ubuntu-noble | +-w /usr/bin/whoami -p x -k recon 2026-07-20 09:53:53.418368 | ubuntu-noble | +-w /usr/bin/id -p x -k recon 2026-07-20 09:53:53.418488 | ubuntu-noble | +-w /bin/hostname -p x -k recon 2026-07-20 09:53:53.418608 | ubuntu-noble | +-w /bin/uname -p x -k recon 2026-07-20 09:53:53.418743 | ubuntu-noble | +-w /etc/issue -p r -k recon 2026-07-20 09:53:53.418868 | ubuntu-noble | +-w /etc/hostname -p r -k recon 2026-07-20 09:53:53.418986 | ubuntu-noble | + 2026-07-20 09:53:53.419122 | ubuntu-noble | +## Suspicious activity 2026-07-20 09:53:53.419276 | ubuntu-noble | +-w /usr/bin/wget -p x -k susp_activity 2026-07-20 09:53:53.419492 | ubuntu-noble | +-w /usr/bin/curl -p x -k susp_activity 2026-07-20 09:53:53.419634 | ubuntu-noble | +-w /usr/bin/base64 -p x -k susp_activity 2026-07-20 09:53:53.419763 | ubuntu-noble | +-w /bin/nc -p x -k susp_activity 2026-07-20 09:53:53.419884 | ubuntu-noble | +-w /bin/netcat -p x -k susp_activity 2026-07-20 09:53:53.420011 | ubuntu-noble | +-w /usr/bin/ncat -p x -k susp_activity 2026-07-20 09:53:53.420340 | ubuntu-noble | +-w /usr/bin/ss -p x -k susp_activity 2026-07-20 09:53:53.420349 | ubuntu-noble | +-w /usr/bin/netstat -p x -k susp_activity 2026-07-20 09:53:53.420446 | ubuntu-noble | +-w /usr/bin/ssh -p x -k susp_activity 2026-07-20 09:53:53.420567 | ubuntu-noble | +-w /usr/bin/scp -p x -k susp_activity 2026-07-20 09:53:53.420702 | ubuntu-noble | +-w /usr/bin/sftp -p x -k susp_activity 2026-07-20 09:53:53.420827 | ubuntu-noble | +-w /usr/bin/ftp -p x -k susp_activity 2026-07-20 09:53:53.420948 | ubuntu-noble | +-w /usr/bin/socat -p x -k susp_activity 2026-07-20 09:53:53.421084 | ubuntu-noble | +-w /usr/bin/wireshark -p x -k susp_activity 2026-07-20 09:53:53.421418 | ubuntu-noble | +-w /usr/bin/tshark -p x -k susp_activity 2026-07-20 09:53:53.421427 | ubuntu-noble | +-w /usr/bin/rawshark -p x -k susp_activity 2026-07-20 09:53:53.421492 | ubuntu-noble | +-w /usr/bin/rdesktop -p x -k susp_activity 2026-07-20 09:53:53.421613 | ubuntu-noble | +-w /usr/local/bin/rdesktop -p x -k susp_activity 2026-07-20 09:53:53.421752 | ubuntu-noble | +-w /usr/bin/wlfreerdp -p x -k susp_activity 2026-07-20 09:53:53.421872 | ubuntu-noble | +-w /usr/bin/xfreerdp -p x -k susp_activity 2026-07-20 09:53:53.421993 | ubuntu-noble | +-w /usr/local/bin/xfreerdp -p x -k susp_activity 2026-07-20 09:53:53.422130 | ubuntu-noble | +-w /usr/bin/nmap -p x -k susp_activity 2026-07-20 09:53:53.422248 | ubuntu-noble | + 2026-07-20 09:53:53.422364 | ubuntu-noble | +## sssd 2026-07-20 09:53:53.422529 | ubuntu-noble | +-a always,exit -F path=/usr/libexec/sssd/p11_child -F perm=x -F auid>=500 -F auid!=4294967295 -k T1078_Valid_Accounts 2026-07-20 09:53:53.423569 | ubuntu-noble | +-a always,exit -F path=/usr/libexec/sssd/krb5_child -F perm=x -F auid>=500 -F auid!=4294967295 -k T1078_Valid_Accounts 2026-07-20 09:53:53.423586 | ubuntu-noble | +-a always,exit -F path=/usr/libexec/sssd/ldap_child -F perm=x -F auid>=500 -F auid!=4294967295 -k T1078_Valid_Accounts 2026-07-20 09:53:53.423590 | ubuntu-noble | +-a always,exit -F path=/usr/libexec/sssd/selinux_child -F perm=x -F auid>=500 -F auid!=4294967295 -k T1078_Valid_Accounts 2026-07-20 09:53:53.423593 | ubuntu-noble | +-a always,exit -F path=/usr/libexec/sssd/proxy_child -F perm=x -F auid>=500 -F auid!=4294967295 -k T1078_Valid_Accounts 2026-07-20 09:53:53.423597 | ubuntu-noble | + 2026-07-20 09:53:53.423601 | ubuntu-noble | +## T1002 Data Compressed 2026-07-20 09:53:53.423604 | ubuntu-noble | + 2026-07-20 09:53:53.423608 | ubuntu-noble | +-w /usr/bin/zip -p x -k Data_Compressed 2026-07-20 09:53:53.423648 | ubuntu-noble | +-w /usr/bin/gzip -p x -k Data_Compressed 2026-07-20 09:53:53.423778 | ubuntu-noble | +-w /usr/bin/tar -p x -k Data_Compressed 2026-07-20 09:53:53.423901 | ubuntu-noble | +-w /usr/bin/bzip2 -p x -k Data_Compressed 2026-07-20 09:53:53.424052 | ubuntu-noble | + 2026-07-20 09:53:53.424180 | ubuntu-noble | +-w /usr/bin/lzip -p x -k Data_Compressed 2026-07-20 09:53:53.424301 | ubuntu-noble | +-w /usr/local/bin/lzip -p x -k Data_Compressed 2026-07-20 09:53:53.424411 | ubuntu-noble | + 2026-07-20 09:53:53.424530 | ubuntu-noble | +-w /usr/bin/lz4 -p x -k Data_Compressed 2026-07-20 09:53:53.424696 | ubuntu-noble | +-w /usr/local/bin/lz4 -p x -k Data_Compressed 2026-07-20 09:53:53.424816 | ubuntu-noble | + 2026-07-20 09:53:53.424938 | ubuntu-noble | +-w /usr/bin/lzop -p x -k Data_Compressed 2026-07-20 09:53:53.425078 | ubuntu-noble | +-w /usr/local/bin/lzop -p x -k Data_Compressed 2026-07-20 09:53:53.425193 | ubuntu-noble | + 2026-07-20 09:53:53.425316 | ubuntu-noble | +-w /usr/bin/plzip -p x -k Data_Compressed 2026-07-20 09:53:53.425436 | ubuntu-noble | +-w /usr/local/bin/plzip -p x -k Data_Compressed 2026-07-20 09:53:53.425549 | ubuntu-noble | + 2026-07-20 09:53:53.425683 | ubuntu-noble | +-w /usr/bin/pbzip2 -p x -k Data_Compressed 2026-07-20 09:53:53.425848 | ubuntu-noble | +-w /usr/local/bin/pbzip2 -p x -k Data_Compressed 2026-07-20 09:53:53.425960 | ubuntu-noble | + 2026-07-20 09:53:53.426119 | ubuntu-noble | +-w /usr/bin/lbzip2 -p x -k Data_Compressed 2026-07-20 09:53:53.426242 | ubuntu-noble | +-w /usr/local/bin/lbzip2 -p x -k Data_Compressed 2026-07-20 09:53:53.426354 | ubuntu-noble | + 2026-07-20 09:53:53.426472 | ubuntu-noble | +-w /usr/bin/pixz -p x -k Data_Compressed 2026-07-20 09:53:53.426594 | ubuntu-noble | +-w /usr/local/bin/pixz -p x -k Data_Compressed 2026-07-20 09:53:53.426726 | ubuntu-noble | + 2026-07-20 09:53:53.426891 | ubuntu-noble | +-w /usr/bin/pigz -p x -k Data_Compressed 2026-07-20 09:53:53.427013 | ubuntu-noble | +-w /usr/local/bin/pigz -p x -k Data_Compressed 2026-07-20 09:53:53.427148 | ubuntu-noble | +-w /usr/bin/unpigz -p x -k Data_Compressed 2026-07-20 09:53:53.427270 | ubuntu-noble | +-w /usr/local/bin/unpigz -p x -k Data_Compressed 2026-07-20 09:53:53.427381 | ubuntu-noble | + 2026-07-20 09:53:53.427503 | ubuntu-noble | +-w /usr/bin/zstd -p x -k Data_Compressed 2026-07-20 09:53:53.427636 | ubuntu-noble | +-w /usr/local/bin/zstd -p x -k Data_Compressed 2026-07-20 09:53:53.427755 | ubuntu-noble | + 2026-07-20 09:53:53.427906 | ubuntu-noble | +## Added to catch netcat on Ubuntu 2026-07-20 09:53:53.428043 | ubuntu-noble | +-w /bin/nc.openbsd -p x -k susp_activity 2026-07-20 09:53:53.428176 | ubuntu-noble | +-w /bin/nc.traditional -p x -k susp_activity 2026-07-20 09:53:53.428297 | ubuntu-noble | + 2026-07-20 09:53:53.428416 | ubuntu-noble | +## Sbin suspicious activity 2026-07-20 09:53:53.428535 | ubuntu-noble | +-w /sbin/iptables -p x -k sbin_susp 2026-07-20 09:53:53.428672 | ubuntu-noble | +-w /sbin/ip6tables -p x -k sbin_susp 2026-07-20 09:53:53.428798 | ubuntu-noble | +-w /sbin/ifconfig -p x -k sbin_susp 2026-07-20 09:53:53.428967 | ubuntu-noble | +-w /usr/sbin/arptables -p x -k sbin_susp 2026-07-20 09:53:53.429130 | ubuntu-noble | +-w /usr/sbin/ebtables -p x -k sbin_susp 2026-07-20 09:53:53.429251 | ubuntu-noble | +-w /sbin/xtables-nft-multi -p x -k sbin_susp 2026-07-20 09:53:53.429369 | ubuntu-noble | +-w /usr/sbin/nft -p x -k sbin_susp 2026-07-20 09:53:53.429487 | ubuntu-noble | +-w /usr/sbin/tcpdump -p x -k sbin_susp 2026-07-20 09:53:53.429606 | ubuntu-noble | +-w /usr/sbin/traceroute -p x -k sbin_susp 2026-07-20 09:53:53.430012 | ubuntu-noble | +-w /usr/sbin/ufw -p x -k sbin_susp 2026-07-20 09:53:53.430040 | ubuntu-noble | + 2026-07-20 09:53:53.430044 | ubuntu-noble | +### kde4 2026-07-20 09:53:53.430124 | ubuntu-noble | +-a always,exit -F path=/usr/libexec/kde4/kpac_dhcp_helper -F perm=x -F auid>=1000 -F auid!=4294967295 -k T1078_Valid_Accounts 2026-07-20 09:53:53.430258 | ubuntu-noble | +-a always,exit -F path=/usr/libexec/kde4/kdesud -F perm=x -F auid>=1000 -F auid!=4294967295 -k T1078_Valid_Accounts 2026-07-20 09:53:53.430373 | ubuntu-noble | + 2026-07-20 09:53:53.430491 | ubuntu-noble | +## dbus-send invocation 2026-07-20 09:53:53.430626 | ubuntu-noble | +### may indicate privilege escalation CVE-2021-3560 2026-07-20 09:53:53.430753 | ubuntu-noble | +-w /usr/bin/dbus-send -p x -k dbus_send 2026-07-20 09:53:53.430873 | ubuntu-noble | +-w /usr/bin/gdbus -p x -k gdubs_call 2026-07-20 09:53:53.430985 | ubuntu-noble | + 2026-07-20 09:53:53.431152 | ubuntu-noble | +## pkexec invocation 2026-07-20 09:53:53.431276 | ubuntu-noble | +### may indicate privilege escalation CVE-2021-4034 2026-07-20 09:53:53.431396 | ubuntu-noble | +-w /usr/bin/pkexec -p x -k pkexec 2026-07-20 09:53:53.431509 | ubuntu-noble | + 2026-07-20 09:53:53.431638 | ubuntu-noble | +## Suspicious shells 2026-07-20 09:53:53.432162 | ubuntu-noble | +-w /bin/ash -p x -k susp_shell 2026-07-20 09:53:53.432172 | ubuntu-noble | +-w /bin/csh -p x -k susp_shell 2026-07-20 09:53:53.432176 | ubuntu-noble | +-w /bin/fish -p x -k susp_shell 2026-07-20 09:53:53.432179 | ubuntu-noble | +-w /bin/tcsh -p x -k susp_shell 2026-07-20 09:53:53.432258 | ubuntu-noble | +-w /bin/tclsh -p x -k susp_shell 2026-07-20 09:53:53.432378 | ubuntu-noble | +-w /bin/xonsh -p x -k susp_shell 2026-07-20 09:53:53.432498 | ubuntu-noble | +-w /usr/local/bin/xonsh -p x -k susp_shell 2026-07-20 09:53:53.432629 | ubuntu-noble | +-w /bin/open -p x -k susp_shell 2026-07-20 09:53:53.432753 | ubuntu-noble | +-w /bin/rbash -p x -k susp_shell 2026-07-20 09:53:53.432866 | ubuntu-noble | + 2026-07-20 09:53:53.432987 | ubuntu-noble | +# Web Server Actvity 2026-07-20 09:53:53.433131 | ubuntu-noble | +## Change the number "33" to the ID of your WebServer user. Default: www-data:x:33:33 2026-07-20 09:53:53.433288 | ubuntu-noble | +-a always,exit -F arch=b64 -S execve -F euid=33 -k detect_execve_www 2026-07-20 09:53:53.433404 | ubuntu-noble | + 2026-07-20 09:53:53.433524 | ubuntu-noble | +### https://clustershell.readthedocs.io/ 2026-07-20 09:53:53.433654 | ubuntu-noble | +-w /bin/clush -p x -k susp_shell 2026-07-20 09:53:53.433789 | ubuntu-noble | +-w /usr/local/bin/clush -p x -k susp_shell 2026-07-20 09:53:53.433910 | ubuntu-noble | +-w /etc/clustershell/clush.conf -p x -k susp_shell 2026-07-20 09:53:53.434089 | ubuntu-noble | + 2026-07-20 09:53:53.434215 | ubuntu-noble | +### https://github.com/tmux/tmux 2026-07-20 09:53:53.434367 | ubuntu-noble | +-w /bin/tmux -p x -k susp_shell 2026-07-20 09:53:53.435385 | ubuntu-noble | +-w /usr/local/bin/tmux -p x -k susp_shell 2026-07-20 09:53:53.435402 | ubuntu-noble | + 2026-07-20 09:53:53.435406 | ubuntu-noble | +## Shell/profile configurations 2026-07-20 09:53:53.435410 | ubuntu-noble | +-w /etc/profile.d/ -p wa -k shell_profiles 2026-07-20 09:53:53.435413 | ubuntu-noble | +-w /etc/profile -p wa -k shell_profiles 2026-07-20 09:53:53.435417 | ubuntu-noble | +-w /etc/shells -p wa -k shell_profiles 2026-07-20 09:53:53.435421 | ubuntu-noble | +-w /etc/bashrc -p wa -k shell_profiles 2026-07-20 09:53:53.435425 | ubuntu-noble | +-w /etc/csh.cshrc -p wa -k shell_profiles 2026-07-20 09:53:53.435441 | ubuntu-noble | +-w /etc/csh.login -p wa -k shell_profiles 2026-07-20 09:53:53.435563 | ubuntu-noble | +-w /etc/fish/ -p wa -k shell_profiles 2026-07-20 09:53:53.435695 | ubuntu-noble | +-w /etc/zsh/ -p wa -k shell_profiles 2026-07-20 09:53:53.435811 | ubuntu-noble | + 2026-07-20 09:53:53.435930 | ubuntu-noble | +### https://github.com/xxh/xxh 2026-07-20 09:53:53.436064 | ubuntu-noble | +-w /usr/local/bin/xxh.bash -p x -k susp_shell 2026-07-20 09:53:53.436187 | ubuntu-noble | +-w /usr/local/bin/xxh.xsh -p x -k susp_shell 2026-07-20 09:53:53.436305 | ubuntu-noble | +-w /usr/local/bin/xxh.zsh -p x -k susp_shell 2026-07-20 09:53:53.436418 | ubuntu-noble | + 2026-07-20 09:53:53.436564 | ubuntu-noble | +## Injection 2026-07-20 09:53:53.436701 | ubuntu-noble | +### These rules watch for code injection by the ptrace facility. 2026-07-20 09:53:53.436826 | ubuntu-noble | +### This could indicate someone trying to do something bad or just debugging 2026-07-20 09:53:53.436965 | ubuntu-noble | +-a always,exit -F arch=b64 -S ptrace -F a0=0x4 -k code_injection 2026-07-20 09:53:53.437125 | ubuntu-noble | +-a always,exit -F arch=b64 -S ptrace -F a0=0x5 -k data_injection 2026-07-20 09:53:53.437249 | ubuntu-noble | +-a always,exit -F arch=b64 -S ptrace -F a0=0x6 -k register_injection 2026-07-20 09:53:53.437370 | ubuntu-noble | +-a always,exit -F arch=b64 -S ptrace -k tracing 2026-07-20 09:53:53.437481 | ubuntu-noble | + 2026-07-20 09:53:53.437654 | ubuntu-noble | +## Anonymous File Creation 2026-07-20 09:53:53.437786 | ubuntu-noble | +### These rules watch the use of memfd_create 2026-07-20 09:53:53.437908 | ubuntu-noble | +### "memfd_create" creates anonymous file and returns a file descriptor to access it 2026-07-20 09:53:53.438049 | ubuntu-noble | +### When combined with "fexecve" can be used to stealthily run binaries in memory without touching disk 2026-07-20 09:53:53.438177 | ubuntu-noble | +-a always,exit -F arch=b64 -S memfd_create -F key=anon_file_create 2026-07-20 09:53:53.438605 | ubuntu-noble | + 2026-07-20 09:53:53.438613 | ubuntu-noble | +## Privilege Abuse 2026-07-20 09:53:53.438633 | ubuntu-noble | +### The purpose of this rule is to detect when an admin may be abusing power by looking in user's home dir. 2026-07-20 09:53:53.438673 | ubuntu-noble | +-a always,exit -F dir=/home -F uid=0 -F auid>=1000 -F auid!=-1 -C auid!=obj_uid -k power_abuse 2026-07-20 09:53:53.438790 | ubuntu-noble | + 2026-07-20 09:53:53.438910 | ubuntu-noble | +# Socket Creations 2026-07-20 09:53:53.439070 | ubuntu-noble | +# will catch both IPv4 and IPv6 2026-07-20 09:53:53.439190 | ubuntu-noble | + 2026-07-20 09:53:53.439318 | ubuntu-noble | +-a always,exit -F arch=b32 -S socket -F a0=2 -k network_socket_created 2026-07-20 09:53:53.439441 | ubuntu-noble | +-a always,exit -F arch=b64 -S socket -F a0=2 -k network_socket_created 2026-07-20 09:53:53.439555 | ubuntu-noble | + 2026-07-20 09:53:53.439720 | ubuntu-noble | +-a always,exit -F arch=b32 -S socket -F a0=10 -k network_socket_created 2026-07-20 09:53:53.439852 | ubuntu-noble | +-a always,exit -F arch=b64 -S socket -F a0=10 -k network_socket_created 2026-07-20 09:53:53.439966 | ubuntu-noble | + 2026-07-20 09:53:53.440105 | ubuntu-noble | +# Software Management --------------------------------------------------------- 2026-07-20 09:53:53.440219 | ubuntu-noble | + 2026-07-20 09:53:53.440338 | ubuntu-noble | +# RPM (Redhat/CentOS) 2026-07-20 09:53:53.440456 | ubuntu-noble | +-w /usr/bin/rpm -p x -k software_mgmt 2026-07-20 09:53:53.440576 | ubuntu-noble | +-w /usr/bin/yum -p x -k software_mgmt 2026-07-20 09:53:53.440729 | ubuntu-noble | + 2026-07-20 09:53:53.441797 | ubuntu-noble | +# DNF (Fedora/RedHat 8/CentOS 8) 2026-07-20 09:53:53.441809 | ubuntu-noble | +-w /usr/bin/dnf -p x -k software_mgmt 2026-07-20 09:53:53.441813 | ubuntu-noble | + 2026-07-20 09:53:53.441817 | ubuntu-noble | +# YAST/Zypper/RPM (SuSE) 2026-07-20 09:53:53.441821 | ubuntu-noble | +-w /sbin/yast -p x -k software_mgmt 2026-07-20 09:53:53.441824 | ubuntu-noble | +-w /sbin/yast2 -p x -k software_mgmt 2026-07-20 09:53:53.441828 | ubuntu-noble | +-w /bin/rpm -p x -k software_mgmt 2026-07-20 09:53:53.441832 | ubuntu-noble | +-w /usr/bin/zypper -k software_mgmt 2026-07-20 09:53:53.441835 | ubuntu-noble | + 2026-07-20 09:53:53.441839 | ubuntu-noble | +# DPKG / APT-GET (Debian/Ubuntu) 2026-07-20 09:53:53.441946 | ubuntu-noble | +-w /usr/bin/dpkg -p x -k software_mgmt 2026-07-20 09:53:53.442079 | ubuntu-noble | +-w /usr/bin/apt -p x -k software_mgmt 2026-07-20 09:53:53.442202 | ubuntu-noble | +-w /usr/bin/apt-add-repository -p x -k software_mgmt 2026-07-20 09:53:53.442321 | ubuntu-noble | +-w /usr/bin/apt-get -p x -k software_mgmt 2026-07-20 09:53:53.442439 | ubuntu-noble | +-w /usr/bin/aptitude -p x -k software_mgmt 2026-07-20 09:53:53.442559 | ubuntu-noble | +-w /usr/bin/wajig -p x -k software_mgmt 2026-07-20 09:53:53.442701 | ubuntu-noble | +-w /usr/bin/snap -p x -k software_mgmt 2026-07-20 09:53:53.442817 | ubuntu-noble | + 2026-07-20 09:53:53.442966 | ubuntu-noble | +# PIP(3) (Python installs) 2026-07-20 09:53:53.443129 | ubuntu-noble | +-w /usr/bin/pip -p x -k third_party_software_mgmt 2026-07-20 09:53:53.443254 | ubuntu-noble | +-w /usr/local/bin/pip -p x -k third_party_software_mgmt 2026-07-20 09:53:53.443375 | ubuntu-noble | +-w /usr/bin/pip3 -p x -k third_party_software_mgmt 2026-07-20 09:53:53.443498 | ubuntu-noble | +-w /usr/local/bin/pip3 -p x -k third_party_software_mgmt 2026-07-20 09:53:53.443636 | ubuntu-noble | +-w /usr/bin/pipx -p x -k third_party_software_mgmt 2026-07-20 09:53:53.443766 | ubuntu-noble | +-w /usr/local/bin/pipx -p x -k third_party_software_mgmt 2026-07-20 09:53:53.443880 | ubuntu-noble | + 2026-07-20 09:53:53.444041 | ubuntu-noble | +# npm 2026-07-20 09:53:53.444163 | ubuntu-noble | +## T1072 third party software 2026-07-20 09:53:53.444296 | ubuntu-noble | +## https://www.npmjs.com 2026-07-20 09:53:53.444418 | ubuntu-noble | +## https://docs.npmjs.com/cli/v6/commands/npm-audit 2026-07-20 09:53:53.444541 | ubuntu-noble | +-w /usr/bin/npm -p x -k third_party_software_mgmt 2026-07-20 09:53:53.444667 | ubuntu-noble | + 2026-07-20 09:53:53.444796 | ubuntu-noble | +# Comprehensive Perl Archive Network (CPAN) (CPAN installs) 2026-07-20 09:53:53.444914 | ubuntu-noble | +## T1072 third party software 2026-07-20 09:53:53.445076 | ubuntu-noble | +## https://www.cpan.org 2026-07-20 09:53:53.445239 | ubuntu-noble | +-w /usr/bin/cpan -p x -k third_party_software_mgmt 2026-07-20 09:53:53.445355 | ubuntu-noble | + 2026-07-20 09:53:53.445474 | ubuntu-noble | +# Ruby (RubyGems installs) 2026-07-20 09:53:53.445594 | ubuntu-noble | +## T1072 third party software 2026-07-20 09:53:53.445725 | ubuntu-noble | +## https://rubygems.org 2026-07-20 09:53:53.445850 | ubuntu-noble | +-w /usr/bin/gem -p x -k third_party_software_mgmt 2026-07-20 09:53:53.445962 | ubuntu-noble | + 2026-07-20 09:53:53.446154 | ubuntu-noble | +# LuaRocks (Lua installs) 2026-07-20 09:53:53.446280 | ubuntu-noble | +## T1072 third party software 2026-07-20 09:53:53.446398 | ubuntu-noble | +## https://luarocks.org 2026-07-20 09:53:53.446521 | ubuntu-noble | +-w /usr/bin/luarocks -p x -k third_party_software_mgmt 2026-07-20 09:53:53.446646 | ubuntu-noble | + 2026-07-20 09:53:53.446772 | ubuntu-noble | +# Pacman (Arch Linux) 2026-07-20 09:53:53.446894 | ubuntu-noble | +## https://wiki.archlinux.org/title/Pacman 2026-07-20 09:53:53.447014 | ubuntu-noble | +## T1072 third party software 2026-07-20 09:53:53.447185 | ubuntu-noble | +-w /etc/pacman.conf -p x -k third_party_software_mgmt 2026-07-20 09:53:53.447309 | ubuntu-noble | +-w /etc/pacman.d -p x -k third_party_software_mgmt 2026-07-20 09:53:53.447422 | ubuntu-noble | + 2026-07-20 09:53:53.447541 | ubuntu-noble | +# Special Software ------------------------------------------------------------ 2026-07-20 09:53:53.447670 | ubuntu-noble | + 2026-07-20 09:53:53.447792 | ubuntu-noble | +## GDS specific secrets 2026-07-20 09:53:53.447911 | ubuntu-noble | +-w /etc/puppet/ssl -p wa -k puppet_ssl 2026-07-20 09:53:53.448038 | ubuntu-noble | + 2026-07-20 09:53:53.448159 | ubuntu-noble | +## IBM Bigfix BESClient 2026-07-20 09:53:53.448318 | ubuntu-noble | +-a always,exit -F arch=b64 -S open -F dir=/opt/BESClient -F success=0 -k soft_besclient 2026-07-20 09:53:53.448440 | ubuntu-noble | +-w /var/opt/BESClient/ -p wa -k soft_besclient 2026-07-20 09:53:53.448552 | ubuntu-noble | + 2026-07-20 09:53:53.448683 | ubuntu-noble | +## CHEF https://www.chef.io/chef/ 2026-07-20 09:53:53.448805 | ubuntu-noble | +-w /etc/chef -p wa -k soft_chef 2026-07-20 09:53:53.449299 | ubuntu-noble | + 2026-07-20 09:53:53.449308 | ubuntu-noble | +## Salt 2026-07-20 09:53:53.449319 | ubuntu-noble | +## https://saltproject.io/ 2026-07-20 09:53:53.449323 | ubuntu-noble | +## https://docs.saltproject.io/en/latest/ref/configuration/master.html 2026-07-20 09:53:53.449390 | ubuntu-noble | +-w /etc/salt -p wa -k soft_salt 2026-07-20 09:53:53.449533 | ubuntu-noble | +-w /usr/local/etc/salt -p wa -k soft_salt 2026-07-20 09:53:53.449683 | ubuntu-noble | + 2026-07-20 09:53:53.449806 | ubuntu-noble | +## Otter 2026-07-20 09:53:53.449924 | ubuntu-noble | +## https://inedo.com/otter 2026-07-20 09:53:53.450082 | ubuntu-noble | +-w /etc/otter -p wa -k soft_otter 2026-07-20 09:53:53.450198 | ubuntu-noble | + 2026-07-20 09:53:53.450319 | ubuntu-noble | +## T1081 Credentials In Files 2026-07-20 09:53:53.450476 | ubuntu-noble | +-w /usr/bin/grep -p x -k string_search 2026-07-20 09:53:53.450598 | ubuntu-noble | +-w /usr/bin/egrep -p x -k string_search 2026-07-20 09:53:53.450732 | ubuntu-noble | +-w /usr/bin/ugrep -p x -k string_search 2026-07-20 09:53:53.450853 | ubuntu-noble | +### macOS 2026-07-20 09:53:53.450972 | ubuntu-noble | +-w /usr/local/bin/grep -p x -k string_search 2026-07-20 09:53:53.451139 | ubuntu-noble | +-w /usr/local/bin/egrep -p x -k string_search 2026-07-20 09:53:53.451284 | ubuntu-noble | +-w /usr/local/bin/ugrep -p x -k string_search 2026-07-20 09:53:53.451458 | ubuntu-noble | + 2026-07-20 09:53:53.451591 | ubuntu-noble | +### https://github.com/tmbinc/bgrep 2026-07-20 09:53:53.451728 | ubuntu-noble | +-w /usr/bin/bgrep -p x -k string_search 2026-07-20 09:53:53.451852 | ubuntu-noble | +### macOS 2026-07-20 09:53:53.452538 | ubuntu-noble | +-w /usr/local/bin/bgrep -p x -k string_search 2026-07-20 09:53:53.452549 | ubuntu-noble | + 2026-07-20 09:53:53.452554 | ubuntu-noble | +### https://github.com/BurntSushi/ripgrep 2026-07-20 09:53:53.452557 | ubuntu-noble | +-w /usr/bin/rg -p x -k string_search 2026-07-20 09:53:53.452561 | ubuntu-noble | +### macOS 2026-07-20 09:53:53.452565 | ubuntu-noble | +-w /usr/local/bin/rg -p x -k string_search 2026-07-20 09:53:53.452692 | ubuntu-noble | + 2026-07-20 09:53:53.452821 | ubuntu-noble | +### https://github.com/awgn/cgrep 2026-07-20 09:53:53.452939 | ubuntu-noble | + 2026-07-20 09:53:53.453077 | ubuntu-noble | +-w /usr/bin/cgrep -p x -k string_search 2026-07-20 09:53:53.453215 | ubuntu-noble | +### macOS 2026-07-20 09:53:53.453356 | ubuntu-noble | +-w /usr/local/bin/cgrep -p x -k string_search 2026-07-20 09:53:53.453469 | ubuntu-noble | + 2026-07-20 09:53:53.453628 | ubuntu-noble | +### https://github.com/jpr5/ngrep 2026-07-20 09:53:53.453755 | ubuntu-noble | +-w /usr/bin/ngrep -p x -k string_search 2026-07-20 09:53:53.453872 | ubuntu-noble | +### macOS 2026-07-20 09:53:53.453993 | ubuntu-noble | +-w /usr/local/bin/ngrep -p x -k string_search 2026-07-20 09:53:53.454122 | ubuntu-noble | + 2026-07-20 09:53:53.454245 | ubuntu-noble | +### https://github.com/vrothberg/vgrep 2026-07-20 09:53:53.454366 | ubuntu-noble | +-w /usr/bin/vgrep -p x -k string_search 2026-07-20 09:53:53.454481 | ubuntu-noble | +### macOS 2026-07-20 09:53:53.454611 | ubuntu-noble | +-w /usr/local/bin/vgrep -p x -k string_search 2026-07-20 09:53:53.454783 | ubuntu-noble | + 2026-07-20 09:53:53.454908 | ubuntu-noble | +### https://github.com/monochromegane/the_platinum_searcher 2026-07-20 09:53:53.455066 | ubuntu-noble | +-w /usr/bin/pt -p x -k string_search 2026-07-20 09:53:53.455189 | ubuntu-noble | +### macOS 2026-07-20 09:53:53.455311 | ubuntu-noble | +-w /usr/local/bin/pt -p x -k string_search 2026-07-20 09:53:53.455422 | ubuntu-noble | + 2026-07-20 09:53:53.455541 | ubuntu-noble | +### https://github.com/gvansickle/ucg 2026-07-20 09:53:53.455677 | ubuntu-noble | +-w /usr/bin/ucg -p x -k string_search 2026-07-20 09:53:53.455828 | ubuntu-noble | +### macOS 2026-07-20 09:53:53.455948 | ubuntu-noble | +-w /usr/local/bin/ucg -p x -k string_search 2026-07-20 09:53:53.456076 | ubuntu-noble | + 2026-07-20 09:53:53.456198 | ubuntu-noble | +### https://github.com/ggreer/the_silver_searcher 2026-07-20 09:53:53.456318 | ubuntu-noble | +-w /usr/bin/ag -p x -k string_search 2026-07-20 09:53:53.456792 | ubuntu-noble | +### macOS 2026-07-20 09:53:53.456803 | ubuntu-noble | +-w /usr/local/bin/ag -p x -k string_search 2026-07-20 09:53:53.456808 | ubuntu-noble | + 2026-07-20 09:53:53.456811 | ubuntu-noble | +### https://github.com/beyondgrep/ack3 2026-07-20 09:53:53.456910 | ubuntu-noble | +### https://beyondgrep.com 2026-07-20 09:53:53.457044 | ubuntu-noble | +-w /usr/bin/ack -p x -k string_search 2026-07-20 09:53:53.457166 | ubuntu-noble | +-w /usr/local/bin/ack -p x -k string_search 2026-07-20 09:53:53.457284 | ubuntu-noble | +-w /usr/bin/semgrep -p x -k string_search 2026-07-20 09:53:53.457398 | ubuntu-noble | +### macOS 2026-07-20 09:53:53.457521 | ubuntu-noble | +-w /usr/local/bin/semgrep -p x -k string_search 2026-07-20 09:53:53.457656 | ubuntu-noble | + 2026-07-20 09:53:53.457778 | ubuntu-noble | +## Docker 2026-07-20 09:53:53.457927 | ubuntu-noble | +-w /usr/bin/dockerd -k docker 2026-07-20 09:53:53.458086 | ubuntu-noble | +-w /usr/bin/docker -k docker 2026-07-20 09:53:53.458212 | ubuntu-noble | +-w /usr/bin/docker-containerd -k docker 2026-07-20 09:53:53.458331 | ubuntu-noble | +-w /usr/bin/docker-runc -k docker 2026-07-20 09:53:53.458449 | ubuntu-noble | +-w /var/lib/docker -p wa -k docker 2026-07-20 09:53:53.458565 | ubuntu-noble | +-w /etc/docker -k docker 2026-07-20 09:53:53.458699 | ubuntu-noble | +-w /etc/sysconfig/docker -k docker 2026-07-20 09:53:53.458823 | ubuntu-noble | +-w /etc/sysconfig/docker-storage -k docker 2026-07-20 09:53:53.458975 | ubuntu-noble | +-w /usr/lib/systemd/system/docker.service -k docker 2026-07-20 09:53:53.459113 | ubuntu-noble | +-w /usr/lib/systemd/system/docker.socket -k docker 2026-07-20 09:53:53.459227 | ubuntu-noble | + 2026-07-20 09:53:53.459345 | ubuntu-noble | +## Virtualization stuff 2026-07-20 09:53:53.459659 | ubuntu-noble | +-w /usr/bin/qemu-system-x86_64 -p x -k qemu-system-x86_64 2026-07-20 09:53:53.459670 | ubuntu-noble | +-w /usr/bin/qemu-img -p x -k qemu-img 2026-07-20 09:53:53.459712 | ubuntu-noble | +-w /usr/bin/qemu-kvm -p x -k qemu-kvm 2026-07-20 09:53:53.459829 | ubuntu-noble | +-w /usr/bin/qemu -p x -k qemu 2026-07-20 09:53:53.459947 | ubuntu-noble | +-w /usr/bin/virtualbox -p x -k virtualbox 2026-07-20 09:53:53.460109 | ubuntu-noble | +-w /usr/bin/virt-manager -p x -k virt-manager 2026-07-20 09:53:53.460229 | ubuntu-noble | +-w /usr/bin/VBoxManage -p x -k VBoxManage 2026-07-20 09:53:53.460339 | ubuntu-noble | + 2026-07-20 09:53:53.460457 | ubuntu-noble | +#### VirtualBox on macOS 2026-07-20 09:53:53.460568 | ubuntu-noble | + 2026-07-20 09:53:53.460703 | ubuntu-noble | +-w /usr/local/bin/VirtualBox -p x -k virt_tool 2026-07-20 09:53:53.460826 | ubuntu-noble | +-w /usr/local/bin/VirtualBoxVM -p x -k virt_tool 2026-07-20 09:53:53.460946 | ubuntu-noble | +-w /usr/local/bin/VBoxManage -p x -k virt_tool 2026-07-20 09:53:53.462638 | ubuntu-noble | +-w /usr/local/bin/VBoxVRDP -p x -k virt_tool 2026-07-20 09:53:53.462656 | ubuntu-noble | +-w /usr/local/bin/VBoxHeadless -p x -k virt_tool 2026-07-20 09:53:53.462660 | ubuntu-noble | +-w /usr/local/bin/vboxwebsrv -p x -k virt_tool 2026-07-20 09:53:53.462664 | ubuntu-noble | +-w /usr/local/bin/VBoxBugReport -p x -k virt_tool 2026-07-20 09:53:53.462667 | ubuntu-noble | +-w /usr/local/bin/VBoxBalloonCtrl -p x -k virt_tool 2026-07-20 09:53:53.462681 | ubuntu-noble | +-w /usr/local/bin/VBoxAutostart -p x -k virt_tool 2026-07-20 09:53:53.462685 | ubuntu-noble | +-w /usr/local/bin/VBoxDTrace -p x -k virt_tool 2026-07-20 09:53:53.462688 | ubuntu-noble | +-w /usr/local/bin/vbox-img -p x -k virt_tool 2026-07-20 09:53:53.462692 | ubuntu-noble | +-w /Library/LaunchDaemons/org.virtualbox.startup.plist -p x -k virt_tool 2026-07-20 09:53:53.462696 | ubuntu-noble | +-w /Library/Application Support/VirtualBox/LaunchDaemons/ -p x -k virt_tool 2026-07-20 09:53:53.462700 | ubuntu-noble | +-w /Library/Application Support/VirtualBox/VBoxDrv.kext/ -p x -k virt_tool 2026-07-20 09:53:53.462704 | ubuntu-noble | +-w /Library/Application Support/VirtualBox/VBoxUSB.kext/ -p x -k virt_tool 2026-07-20 09:53:53.462707 | ubuntu-noble | +-w /Library/Application Support/VirtualBox/VBoxNetFlt.kext/ -p x -k virt_tool 2026-07-20 09:53:53.462711 | ubuntu-noble | +-w /Library/Application Support/VirtualBox/VBoxNetAdp.kext/ -p x -k virt_tool 2026-07-20 09:53:53.462789 | ubuntu-noble | + 2026-07-20 09:53:53.462914 | ubuntu-noble | +### Parallels Desktop on macOS 2026-07-20 09:53:53.463059 | ubuntu-noble | + 2026-07-20 09:53:53.463184 | ubuntu-noble | +-w /usr/local/bin/prl_convert -p x -k virt_tool 2026-07-20 09:53:53.463304 | ubuntu-noble | +-w /usr/local/bin/prl_disk_tool -p x -k virt_tool 2026-07-20 09:53:53.463425 | ubuntu-noble | +-w /usr/local/bin/prl_perf_ctl -p x -k virt_tool 2026-07-20 09:53:53.463546 | ubuntu-noble | +-w /usr/local/bin/prlcore2dmp -p x -k virt_tool 2026-07-20 09:53:53.463681 | ubuntu-noble | +-w /usr/local/bin/prlctl -p x -k virt_tool 2026-07-20 09:53:53.463836 | ubuntu-noble | +-w /usr/local/bin/prlexec -p x -k virt_tool 2026-07-20 09:53:53.463958 | ubuntu-noble | +-w /usr/local/bin/prlsrvctl -p x -k virt_tool 2026-07-20 09:53:53.464094 | ubuntu-noble | +-w /Library/Preferences/Parallels -p x -k virt_tool 2026-07-20 09:53:53.464206 | ubuntu-noble | + 2026-07-20 09:53:53.464325 | ubuntu-noble | +### qemu on macOS 2026-07-20 09:53:53.464438 | ubuntu-noble | + 2026-07-20 09:53:53.464559 | ubuntu-noble | +-w /usr/local/bin/qemu-edid -p x -k virt_tool 2026-07-20 09:53:53.464700 | ubuntu-noble | +-w /usr/local/bin/qemu-img -p x -k virt_tool 2026-07-20 09:53:53.464830 | ubuntu-noble | +-w /usr/local/bin/qemu-io -p x -k virt_tool 2026-07-20 09:53:53.464981 | ubuntu-noble | +-w /usr/local/bin/qemu-nbd -p x -k virt_tool 2026-07-20 09:53:53.465159 | ubuntu-noble | +-w /usr/local/bin/qemu-system-x86_64 -p x -k virt_tool 2026-07-20 09:53:53.465272 | ubuntu-noble | + 2026-07-20 09:53:53.465386 | ubuntu-noble | +## Kubelet 2026-07-20 09:53:53.465507 | ubuntu-noble | +-w /usr/bin/kubelet -k kubelet 2026-07-20 09:53:53.465633 | ubuntu-noble | + 2026-07-20 09:53:53.465757 | ubuntu-noble | +# ipc system call 2026-07-20 09:53:53.465877 | ubuntu-noble | +# /usr/include/linux/ipc.h 2026-07-20 09:53:53.466056 | ubuntu-noble | + 2026-07-20 09:53:53.466180 | ubuntu-noble | +## msgctl 2026-07-20 09:53:53.466305 | ubuntu-noble | +#-a always,exit -S ipc -F a0=14 -k Inter-Process_Communication 2026-07-20 09:53:53.466420 | ubuntu-noble | +## msgget 2026-07-20 09:53:53.466544 | ubuntu-noble | +#-a always,exit -S ipc -F a0=13 -k Inter-Process_Communication 2026-07-20 09:53:53.466679 | ubuntu-noble | +## Use these lines on x86_64, ia64 instead 2026-07-20 09:53:53.466808 | ubuntu-noble | +-a always,exit -F arch=b64 -S msgctl -k Inter-Process_Communication 2026-07-20 09:53:53.466941 | ubuntu-noble | +-a always,exit -F arch=b64 -S msgget -k Inter-Process_Communication 2026-07-20 09:53:53.467099 | ubuntu-noble | + 2026-07-20 09:53:53.467217 | ubuntu-noble | +## semctl 2026-07-20 09:53:53.467342 | ubuntu-noble | +#-a always,exit -S ipc -F a0=3 -k Inter-Process_Communication 2026-07-20 09:53:53.467457 | ubuntu-noble | +## semget 2026-07-20 09:53:53.467580 | ubuntu-noble | +#-a always,exit -S ipc -F a0=2 -k Inter-Process_Communication 2026-07-20 09:53:53.467708 | ubuntu-noble | +## semop 2026-07-20 09:53:53.467835 | ubuntu-noble | +#-a always,exit -S ipc -F a0=1 -k Inter-Process_Communication 2026-07-20 09:53:53.467952 | ubuntu-noble | +## semtimedop 2026-07-20 09:53:53.468134 | ubuntu-noble | +#-a always,exit -S ipc -F a0=4 -k Inter-Process_Communication 2026-07-20 09:53:53.468261 | ubuntu-noble | +## Use these lines on x86_64, ia64 instead 2026-07-20 09:53:53.468383 | ubuntu-noble | +-a always,exit -F arch=b64 -S semctl -k Inter-Process_Communication 2026-07-20 09:53:53.468508 | ubuntu-noble | +-a always,exit -F arch=b64 -S semget -k Inter-Process_Communication 2026-07-20 09:53:53.468644 | ubuntu-noble | +-a always,exit -F arch=b64 -S semop -k Inter-Process_Communication 2026-07-20 09:53:53.468775 | ubuntu-noble | +-a always,exit -F arch=b64 -S semtimedop -k Inter-Process_Communication 2026-07-20 09:53:53.468887 | ubuntu-noble | + 2026-07-20 09:53:53.469003 | ubuntu-noble | +## shmctl 2026-07-20 09:53:53.469187 | ubuntu-noble | +#-a always,exit -S ipc -F a0=24 -k Inter-Process_Communication 2026-07-20 09:53:53.469320 | ubuntu-noble | +## shmget 2026-07-20 09:53:53.469445 | ubuntu-noble | +#-a always,exit -S ipc -F a0=23 -k Inter-Process_Communication 2026-07-20 09:53:53.469565 | ubuntu-noble | +## Use these lines on x86_64, ia64 instead 2026-07-20 09:53:53.469702 | ubuntu-noble | +-a always,exit -F arch=b64 -S shmctl -k Inter-Process_Communication 2026-07-20 09:53:53.469829 | ubuntu-noble | +-a always,exit -F arch=b64 -S shmget -k Inter-Process_Communication 2026-07-20 09:53:53.469942 | ubuntu-noble | + 2026-07-20 09:53:53.470133 | ubuntu-noble | +# High Volume Events ---------------------------------------------------------- 2026-07-20 09:53:53.470286 | ubuntu-noble | + 2026-07-20 09:53:53.470410 | ubuntu-noble | +## Disable these rules if they create too many events in your environment 2026-07-20 09:53:53.470522 | ubuntu-noble | + 2026-07-20 09:53:53.470650 | ubuntu-noble | +## Common Shells 2026-07-20 09:53:53.471338 | ubuntu-noble | +-w /bin/bash -p x -k susp_shell 2026-07-20 09:53:53.471347 | ubuntu-noble | +-w /bin/dash -p x -k susp_shell 2026-07-20 09:53:53.471351 | ubuntu-noble | +-w /bin/busybox -p x -k susp_shell 2026-07-20 09:53:53.471355 | ubuntu-noble | +-w /bin/zsh -p x -k susp_shell 2026-07-20 09:53:53.471359 | ubuntu-noble | +-w /bin/sh -p x -k susp_shell 2026-07-20 09:53:53.471363 | ubuntu-noble | +-w /bin/ksh -p x -k susp_shell 2026-07-20 09:53:53.471464 | ubuntu-noble | + 2026-07-20 09:53:53.471584 | ubuntu-noble | +## Root command executions 2026-07-20 09:53:53.471721 | ubuntu-noble | +-a always,exit -F arch=b64 -F euid=0 -F auid>=1000 -F auid!=-1 -S execve -k rootcmd 2026-07-20 09:53:53.471839 | ubuntu-noble | + 2026-07-20 09:53:53.471959 | ubuntu-noble | +## File Deletion Events by User 2026-07-20 09:53:53.472098 | ubuntu-noble | +-a always,exit -F arch=b64 -S rmdir -S unlink -S unlinkat -S rename -S renameat -F auid>=1000 -F auid!=-1 -k delete 2026-07-20 09:53:53.472211 | ubuntu-noble | + 2026-07-20 09:53:53.472336 | ubuntu-noble | +## File Access 2026-07-20 09:53:53.472488 | ubuntu-noble | +### Unauthorized Access (unsuccessful) 2026-07-20 09:53:53.472627 | ubuntu-noble | +-a always,exit -F arch=b64 -S creat -S open -S openat -S open_by_handle_at -S truncate -S ftruncate -F exit=-EACCES -F auid>=1000 -F auid!=-1 -k file_access 2026-07-20 09:53:53.472760 | ubuntu-noble | +-a always,exit -F arch=b64 -S creat -S open -S openat -S open_by_handle_at -S truncate -S ftruncate -F exit=-EPERM -F auid>=1000 -F auid!=-1 -k file_access 2026-07-20 09:53:53.472883 | ubuntu-noble | + 2026-07-20 09:53:53.473174 | ubuntu-noble | +### Unsuccessful Creation 2026-07-20 09:53:53.473331 | ubuntu-noble | +-a always,exit -F arch=b64 -S mkdir,creat,link,symlink,mknod,mknodat,linkat,symlinkat -F exit=-EACCES -k file_creation 2026-07-20 09:53:53.473503 | ubuntu-noble | +-a always,exit -F arch=b64 -S mkdir,link,symlink,mkdirat -F exit=-EPERM -k file_creation 2026-07-20 09:53:53.473632 | ubuntu-noble | + 2026-07-20 09:53:53.473759 | ubuntu-noble | +### Unsuccessful Modification 2026-07-20 09:53:53.473887 | ubuntu-noble | +-a always,exit -F arch=b64 -S rename -S renameat -S truncate -S chmod -S setxattr -S lsetxattr -S removexattr -S lremovexattr -F exit=-EACCES -k file_modification 2026-07-20 09:53:53.474013 | ubuntu-noble | +-a always,exit -F arch=b64 -S rename -S renameat -S truncate -S chmod -S setxattr -S lsetxattr -S removexattr -S lremovexattr -F exit=-EPERM -k file_modification 2026-07-20 09:53:53.474148 | ubuntu-noble | + 2026-07-20 09:53:53.474267 | ubuntu-noble | +## 32bit API Exploitation 2026-07-20 09:53:53.474389 | ubuntu-noble | +### If you are on a 64 bit platform, everything _should_ be running 2026-07-20 09:53:53.474510 | ubuntu-noble | +### in 64 bit mode. This rule will detect any use of the 32 bit syscalls 2026-07-20 09:53:53.474672 | ubuntu-noble | +### because this might be a sign of someone exploiting a hole in the 32 2026-07-20 09:53:53.474793 | ubuntu-noble | +### bit API. 2026-07-20 09:53:53.474926 | ubuntu-noble | +-a always,exit -F arch=b32 -S all -k 32bit_api 2026-07-20 09:53:53.475078 | ubuntu-noble | + 2026-07-20 09:53:53.475204 | ubuntu-noble | +# Make The Configuration Immutable -------------------------------------------- 2026-07-20 09:53:53.475657 | ubuntu-noble | + 2026-07-20 09:53:53.475671 | ubuntu-noble | +##-e 2 2026-07-20 09:53:53.475676 | ubuntu-noble | 2026-07-20 09:53:53.475821 | ubuntu-noble | changed: [molecule-auditd] => (item=20-neo23x0.rules) => {"ansible_loop_var": "item", "changed": true, "checksum": "9f99ce5c4f891fbf3e2bce06ed4cb97fb9e01f41", "dest": "/etc/audit/rules.d/20-neo23x0.rules", "gid": 0, "group": "root", "item": "20-neo23x0.rules", "md5sum": "6ac57206fd77de34805c3f4d50ef8b1d", "mode": "0644", "owner": "root", "size": 27367, "src": "/home/zuul/.ansible/tmp/ansible-tmp-1784541232.0883112-2507-182778014934037/.source.rules", "state": "file", "uid": 0} 2026-07-20 09:53:53.476003 | ubuntu-noble | 2026-07-20 09:53:53.476205 | ubuntu-noble | TASK [auditd : Manage auditd service] ****************************************** 2026-07-20 09:53:54.219159 | debian-bookworm | changed: [molecule-auditd] => {"changed": true, "name": "auditd", "state": "started", "status": {"ActiveEnterTimestamp": "Mon 2026-07-20 09:53:52 UTC", "ActiveEnterTimestampMonotonic": "199100413", "ActiveExitTimestamp": "Mon 2026-07-20 09:53:52 UTC", "ActiveExitTimestampMonotonic": "198921551", "ActiveState": "active", "After": "system.slice systemd-tmpfiles-setup.service systemd-journald.socket local-fs.target", "AllowIsolate": "no", "AssertResult": "yes", "AssertTimestamp": "Mon 2026-07-20 09:53:52 UTC", "AssertTimestampMonotonic": "198964834", "Before": "sysinit.target systemd-update-utmp.service shutdown.target ssh.service", "BlockIOAccounting": "no", "BlockIOWeight": "[not set]", "CPUAccounting": "yes", "CPUAffinityFromNUMA": "no", "CPUQuotaPerSecUSec": "infinity", "CPUQuotaPeriodUSec": "infinity", "CPUSchedulingPolicy": "0", "CPUSchedulingPriority": "0", "CPUSchedulingResetOnFork": "no", "CPUShares": "[not set]", "CPUUsageNSec": "140417000", "CPUWeight": "[not set]", "CacheDirectoryMode": "0755", "CanFreeze": "yes", "CanIsolate": "no", "CanReload": "no", "CanStart": "yes", "CanStop": "yes", "CapabilityBoundingSet": "cap_chown cap_dac_override cap_dac_read_search cap_fowner cap_fsetid cap_kill cap_setgid cap_setuid cap_setpcap cap_linux_immutable cap_net_bind_service cap_net_broadcast cap_net_admin cap_net_raw cap_ipc_lock cap_ipc_owner cap_sys_rawio cap_sys_chroot cap_sys_ptrace cap_sys_pacct cap_sys_admin cap_sys_boot cap_sys_nice cap_sys_resource cap_sys_time cap_sys_tty_config cap_mknod cap_lease cap_audit_write cap_audit_control cap_setfcap cap_mac_override cap_mac_admin cap_syslog cap_wake_alarm cap_block_suspend cap_audit_read cap_perfmon cap_bpf cap_checkpoint_restore", "CleanResult": "success", "CollectMode": "inactive", "ConditionResult": "yes", "ConditionTimestamp": "Mon 2026-07-20 09:53:52 UTC", "ConditionTimestampMonotonic": "198964734", "ConfigurationDirectoryMode": "0755", "Conflicts": "shutdown.target", "ControlGroup": "/system.slice/auditd.service", "ControlGroupId": "3328", "ControlPID": "0", "CoredumpFilter": "0x33", "DefaultDependencies": "no", "DefaultMemoryLow": "0", "DefaultMemoryMin": "0", "Delegate": "no", "Description": "Security Auditing Service", "DevicePolicy": "auto", "Documentation": "\"man:auditd(8)\" https://github.com/linux-audit/audit-documentation", "DynamicUser": "no", "ExecMainCode": "0", "ExecMainExitTimestampMonotonic": "0", "ExecMainPID": "2799", "ExecMainStartTimestamp": "Mon 2026-07-20 09:53:52 UTC", "ExecMainStartTimestampMonotonic": "199005737", "ExecMainStatus": "0", "ExecStart": "{ path=/sbin/auditd ; argv[]=/sbin/auditd ; ignore_errors=no ; start_time=[Mon 2026-07-20 09:53:52 UTC] ; stop_time=[Mon 2026-07-20 09:53:52 UTC] ; pid=2798 ; code=exited ; status=0 }", "ExecStartEx": "{ path=/sbin/auditd ; argv[]=/sbin/auditd ; flags= ; start_time=[Mon 2026-07-20 09:53:52 UTC] ; stop_time=[Mon 2026-07-20 09:53:52 UTC] ; pid=2798 ; code=exited ; status=0 }", "ExecStartPost": "{ path=/sbin/augenrules ; argv[]=/sbin/augenrules --load ; ignore_errors=yes ; start_time=[Mon 2026-07-20 09:53:52 UTC] ; stop_time=[Mon 2026-07-20 09:53:52 UTC] ; pid=2802 ; code=exited ; status=0 }", "ExecStartPostEx": "{ path=/sbin/augenrules ; argv[]=/sbin/augenrules --load ; flags=ignore-failure ; start_time=[Mon 2026-07-20 09:53:52 UTC] ; stop_time=[Mon 2026-07-20 09:53:52 UTC] ; pid=2802 ; code=exited ; status=0 }", "ExitType": "main", "FailureAction": "none", "FileDescriptorStoreMax": "0", "FinalKillSignal": "9", "FragmentPath": "/lib/systemd/system/auditd.service", "FreezerState": "running", "GID": "[not set]", "GuessMainPID": "yes", "IOAccounting": "no", "IOReadBytes": "18446744073709551615", "IOReadOperations": "18446744073709551615", "IOSchedulingClass": "2", "IOSchedulingPriority": "4", "IOWeight": "[not set]", "IOWriteBytes": "18446744073709551615", "IOWriteOperations": "18446744073709551615", "IPAccounting": "no", "IPEgressBytes": "[no data]", "IPEgressPackets": "[no data]", "IPIngressBytes": "[no data]", "IPIngressPackets": "[no data]", "Id": "auditd.service", "IgnoreOnIsolate": "no", "IgnoreSIGPIPE": "yes", "InactiveEnterTimestamp": "Mon 2026-07-20 09:53:52 UTC", "InactiveEnterTimestampMonotonic": "198961513", "InactiveExitTimestamp": "Mon 2026-07-20 09:53:52 UTC", "InactiveExitTimestampMonotonic": "198984898", "InvocationID": "26976488da044adba0c1de63657250ab", "JobRunningTimeoutUSec": "infinity", "JobTimeoutAction": "none", "JobTimeoutUSec": "infinity", "KeyringMode": "private", "KillMode": "control-group", "KillSignal": "15", "LimitAS": "infinity", "LimitASSoft": "infinity", "LimitCORE": "infinity", "LimitCORESoft": "0", "LimitCPU": "infinity", "LimitCPUSoft": "infinity", "LimitDATA": "infinity", "LimitDATASoft": "infinity", "LimitFSIZE": "infinity", "LimitFSIZESoft": "infinity", "LimitLOCKS": "infinity", "LimitLOCKSSoft": "infinity", "LimitMEMLOCK": "8388608", "LimitMEMLOCKSoft": "8388608", "LimitMSGQUEUE": "819200", "LimitMSGQUEUESoft": "819200", "LimitNICE": "0", "LimitNICESoft": "0", "LimitNOFILE": "524288", "LimitNOFILESoft": "1024", "LimitNPROC": "15480", "LimitNPROCSoft": "15480", "LimitRSS": "infinity", "LimitRSSSoft": "infinity", "LimitRTPRIO": "0", "LimitRTPRIOSoft": "0", "LimitRTTIME": "infinity", "LimitRTTIMESoft": "infinity", "LimitSIGPENDING": "15480", "LimitSIGPENDINGSoft": "15480", "LimitSTACK": "infinity", "LimitSTACKSoft": "8388608", "LoadState": "loaded", "LockPersonality": "yes", "LogLevelMax": "-1", "LogRateLimitBurst": "0", "LogRateLimitIntervalUSec": "0", "LogsDirectoryMode": "0755", "MainPID": "2799", "ManagedOOMMemoryPressure": "auto", "ManagedOOMMemoryPressureLimit": "0", "ManagedOOMPreference": "none", "ManagedOOMSwap": "auto", "MemoryAccounting": "yes", "MemoryAvailable": "infinity", "MemoryCurrent": "2072576", "MemoryDenyWriteExecute": "yes", "MemoryHigh": "infinity", "MemoryLimit": "infinity", "MemoryLow": "0", "MemoryMax": "infinity", "MemoryMin": "0", "MemorySwapMax": "infinity", "MountAPIVFS": "no", "NFileDescriptorStore": "0", "NRestarts": "0", "NUMAPolicy": "n/a", "Names": "auditd.service", "NeedDaemonReload": "no", "Nice": "0", "NoNewPrivileges": "no", "NonBlocking": "no", "NotifyAccess": "none", "OOMPolicy": "stop", "OOMScoreAdjust": "0", "OnFailureJobMode": "replace", "OnSuccessJobMode": "fail", "PIDFile": "/run/auditd.pid", "Perpetual": "no", "PrivateDevices": "no", "PrivateIPC": "no", "PrivateMounts": "no", "PrivateNetwork": "no", "PrivateTmp": "no", "PrivateUsers": "no", "ProcSubset": "all", "ProtectClock": "no", "ProtectControlGroups": "yes", "ProtectHome": "no", "ProtectHostname": "no", "ProtectKernelLogs": "no", "ProtectKernelModules": "yes", "ProtectKernelTunables": "no", "ProtectProc": "default", "ProtectSystem": "no", "RefuseManualStart": "no", "RefuseManualStop": "no", "ReloadResult": "success", "RemainAfterExit": "no", "RemoveIPC": "no", "Requires": "system.slice", "Restart": "on-failure", "RestartKillSignal": "15", "RestartPreventExitStatus": "2 4 6", "RestartUSec": "100ms", "RestrictNamespaces": "no", "RestrictRealtime": "yes", "RestrictSUIDSGID": "no", "Result": "success", "RootDirectoryStartOnly": "no", "RuntimeDirectoryMode": "0755", "RuntimeDirectoryPreserve": "no", "RuntimeMaxUSec": "infinity", "RuntimeRandomizedExtraUSec": "0", "SameProcessGroup": "no", "SecureBits": "0", "SendSIGHUP": "no", "SendSIGKILL": "yes", "Slice": "system.slice", "StandardError": "inherit", "StandardInput": "null", "StandardOutput": "journal", "StartLimitAction": "none", "StartLimitBurst": "5", "StartLimitIntervalUSec": "10s", "StartupBlockIOWeight": "[not set]", "StartupCPUShares": "[not set]", "StartupCPUWeight": "[not set]", "StartupIOWeight": "[not set]", "StateChangeTimestamp": "Mon 2026-07-20 09:53:52 UTC", "StateChangeTimestampMonotonic": "199100413", "StateDirectoryMode": "0755", "StatusErrno": "0", "StopWhenUnneeded": "no", "SubState": "running", "SuccessAction": "none", "SyslogFacility": "3", "SyslogLevel": "6", "SyslogLevelPrefix": "yes", "SyslogPriority": "30", "SystemCallErrorNumber": "2147483646", "TTYReset": "no", "TTYVHangup": "no", "TTYVTDisallocate": "no", "TasksAccounting": "yes", "TasksCurrent": "2", "TasksMax": "4644", "TimeoutAbortUSec": "1min 30s", "TimeoutCleanUSec": "infinity", "TimeoutStartFailureMode": "terminate", "TimeoutStartUSec": "1min 30s", "TimeoutStopFailureMode": "terminate", "TimeoutStopUSec": "1min 30s", "TimerSlackNSec": "50000", "Transient": "no", "Type": "forking", "UID": "[not set]", "UMask": "0022", "UnitFilePreset": "enabled", "UnitFileState": "enabled", "UtmpMode": "init", "WantedBy": "multi-user.target", "WatchdogSignal": "6", "WatchdogTimestampMonotonic": "0", "WatchdogUSec": "0"}} 2026-07-20 09:53:54.220302 | debian-bookworm | 2026-07-20 09:53:54.220419 | debian-bookworm | PLAY RECAP ********************************************************************* 2026-07-20 09:53:54.220570 | debian-bookworm | molecule-auditd : ok=15 changed=8 unreachable=0 failed=0 skipped=0 rescued=0 ignored=0 2026-07-20 09:53:54.220665 | debian-bookworm | 2026-07-20 09:53:54.474950 | ubuntu-noble | ok: [molecule-auditd] => {"changed": false, "enabled": true, "name": "auditd", "state": "started", "status": {"ActiveEnterTimestamp": "Mon 2026-07-20 09:53:45 UTC", "ActiveEnterTimestampMonotonic": "166883452", "ActiveExitTimestampMonotonic": "0", "ActiveState": "active", "After": "systemd-tmpfiles-setup.service local-fs.target system.slice systemd-journald.socket", "AllowIsolate": "no", "AssertResult": "yes", "AssertTimestamp": "Mon 2026-07-20 09:53:45 UTC", "AssertTimestampMonotonic": "166828437", "Before": "systemd-update-utmp.service shutdown.target sysinit.target ssh.service", "BlockIOAccounting": "no", "BlockIOWeight": "[not set]", "CPUAccounting": "yes", "CPUAffinityFromNUMA": "no", "CPUQuotaPerSecUSec": "infinity", "CPUQuotaPeriodUSec": "infinity", "CPUSchedulingPolicy": "0", "CPUSchedulingPriority": "0", "CPUSchedulingResetOnFork": "no", "CPUShares": "[not set]", "CPUUsageNSec": "36717000", "CPUWeight": "[not set]", "CacheDirectoryMode": "0755", "CanFreeze": "yes", "CanIsolate": "no", "CanReload": "no", "CanStart": "yes", "CanStop": "yes", "CapabilityBoundingSet": "cap_chown cap_dac_override cap_dac_read_search cap_fowner cap_fsetid cap_kill cap_setgid cap_setuid cap_setpcap cap_linux_immutable cap_net_bind_service cap_net_broadcast cap_net_admin cap_net_raw cap_ipc_lock cap_ipc_owner cap_sys_rawio cap_sys_chroot cap_sys_ptrace cap_sys_pacct cap_sys_admin cap_sys_boot cap_sys_nice cap_sys_resource cap_sys_time cap_sys_tty_config cap_mknod cap_lease cap_audit_write cap_audit_control cap_setfcap cap_mac_override cap_mac_admin cap_syslog cap_wake_alarm cap_block_suspend cap_audit_read cap_perfmon cap_bpf cap_checkpoint_restore", "CleanResult": "success", "CollectMode": "inactive", "ConditionResult": "yes", "ConditionTimestamp": "Mon 2026-07-20 09:53:45 UTC", "ConditionTimestampMonotonic": "166828365", "ConfigurationDirectoryMode": "0755", "Conflicts": "shutdown.target", "ControlGroup": "/system.slice/auditd.service", "ControlGroupId": "3826", "ControlPID": "0", "CoredumpFilter": "0x33", "CoredumpReceive": "no", "DefaultDependencies": "no", "DefaultMemoryLow": "0", "DefaultMemoryMin": "0", "DefaultStartupMemoryLow": "0", "Delegate": "no", "Description": "Security Auditing Service", "DevicePolicy": "auto", "Documentation": "\"man:auditd(8)\" https://github.com/linux-audit/audit-documentation", "DynamicUser": "no", "ExecMainCode": "0", "ExecMainExitTimestampMonotonic": "0", "ExecMainPID": "2276", "ExecMainStartTimestamp": "Mon 2026-07-20 09:53:45 UTC", "ExecMainStartTimestampMonotonic": "166853263", "ExecMainStatus": "0", "ExecStart": "{ path=/sbin/auditd ; argv[]=/sbin/auditd ; ignore_errors=no ; start_time=[Mon 2026-07-20 09:53:45 UTC] ; stop_time=[Mon 2026-07-20 09:53:45 UTC] ; pid=2275 ; code=exited ; status=0 }", "ExecStartEx": "{ path=/sbin/auditd ; argv[]=/sbin/auditd ; flags= ; start_time=[Mon 2026-07-20 09:53:45 UTC] ; stop_time=[Mon 2026-07-20 09:53:45 UTC] ; pid=2275 ; code=exited ; status=0 }", "ExecStartPost": "{ path=/sbin/augenrules ; argv[]=/sbin/augenrules --load ; ignore_errors=yes ; start_time=[Mon 2026-07-20 09:53:45 UTC] ; stop_time=[Mon 2026-07-20 09:53:45 UTC] ; pid=2279 ; code=exited ; status=0 }", "ExecStartPostEx": "{ path=/sbin/augenrules ; argv[]=/sbin/augenrules --load ; flags=ignore-failure ; start_time=[Mon 2026-07-20 09:53:45 UTC] ; stop_time=[Mon 2026-07-20 09:53:45 UTC] ; pid=2279 ; code=exited ; status=0 }", "ExitType": "main", "ExtensionImagePolicy": "root=verity+signed+encrypted+unprotected+absent:usr=verity+signed+encrypted+unprotected+absent:home=encrypted+unprotected+absent:srv=encrypted+unprotected+absent:tmp=encrypted+unprotected+absent:var=encrypted+unprotected+absent", "FailureAction": "none", "FileDescriptorStoreMax": "0", "FileDescriptorStorePreserve": "restart", "FinalKillSignal": "9", "FragmentPath": "/usr/lib/systemd/system/auditd.service", "FreezerState": "running", "GID": "[not set]", "GuessMainPID": "yes", "IOAccounting": "no", "IOReadBytes": "[not set]", "IOReadOperations": "[not set]", "IOSchedulingClass": "2", "IOSchedulingPriority": "4", "IOWeight": "[not set]", "IOWriteBytes": "[not set]", "IOWriteOperations": "[not set]", "IPAccounting": "no", "IPEgressBytes": "[no data]", "IPEgressPackets": "[no data]", "IPIngressBytes": "[no data]", "IPIngressPackets": "[no data]", "Id": "auditd.service", "IgnoreOnIsolate": "no", "IgnoreSIGPIPE": "yes", "InactiveEnterTimestampMonotonic": "0", "InactiveExitTimestamp": "Mon 2026-07-20 09:53:45 UTC", "InactiveExitTimestampMonotonic": "166840702", "InvocationID": "56d75f661a1947b8a93d4e13721fc18b", "JobRunningTimeoutUSec": "infinity", "JobTimeoutAction": "none", "JobTimeoutUSec": "infinity", "KeyringMode": "private", "KillMode": "control-group", "KillSignal": "15", "LimitAS": "infinity", "LimitASSoft": "infinity", "LimitCORE": "infinity", "LimitCORESoft": "0", "LimitCPU": "infinity", "LimitCPUSoft": "infinity", "LimitDATA": "infinity", "LimitDATASoft": "infinity", "LimitFSIZE": "infinity", "LimitFSIZESoft": "infinity", "LimitLOCKS": "infinity", "LimitLOCKSSoft": "infinity", "LimitMEMLOCK": "8388608", "LimitMEMLOCKSoft": "8388608", "LimitMSGQUEUE": "819200", "LimitMSGQUEUESoft": "819200", "LimitNICE": "0", "LimitNICESoft": "0", "LimitNOFILE": "524288", "LimitNOFILESoft": "1024", "LimitNPROC": "15372", "LimitNPROCSoft": "15372", "LimitRSS": "infinity", "LimitRSSSoft": "infinity", "LimitRTPRIO": "0", "LimitRTPRIOSoft": "0", "LimitRTTIME": "infinity", "LimitRTTIMESoft": "infinity", "LimitSIGPENDING": "15372", "LimitSIGPENDINGSoft": "15372", "LimitSTACK": "infinity", "LimitSTACKSoft": "8388608", "LoadState": "loaded", "LockPersonality": "yes", "LogLevelMax": "-1", "LogRateLimitBurst": "0", "LogRateLimitIntervalUSec": "0", "LogsDirectoryMode": "0755", "MainPID": "2276", "ManagedOOMMemoryPressure": "auto", "ManagedOOMMemoryPressureLimit": "0", "ManagedOOMPreference": "none", "ManagedOOMSwap": "auto", "MemoryAccounting": "yes", "MemoryAvailable": "3540275200", "MemoryCurrent": "499712", "MemoryDenyWriteExecute": "yes", "MemoryHigh": "infinity", "MemoryKSM": "no", "MemoryLimit": "infinity", "MemoryLow": "0", "MemoryMax": "infinity", "MemoryMin": "0", "MemoryPeak": "2134016", "MemoryPressureThresholdUSec": "200ms", "MemoryPressureWatch": "auto", "MemorySwapCurrent": "0", "MemorySwapMax": "infinity", "MemorySwapPeak": "0", "MemoryZSwapCurrent": "0", "MemoryZSwapMax": "infinity", "MountAPIVFS": "no", "MountImagePolicy": "root=verity+signed+encrypted+unprotected+absent:usr=verity+signed+encrypted+unprotected+absent:home=encrypted+unprotected+absent:srv=encrypted+unprotected+absent:tmp=encrypted+unprotected+absent:var=encrypted+unprotected+absent", "NFileDescriptorStore": "0", "NRestarts": "0", "NUMAPolicy": "n/a", "Names": "auditd.service", "NeedDaemonReload": "no", "Nice": "0", "NoNewPrivileges": "no", "NonBlocking": "no", "NotifyAccess": "none", "OOMPolicy": "stop", "OOMScoreAdjust": "0", "OnFailureJobMode": "replace", "OnSuccessJobMode": "fail", "PIDFile": "/run/auditd.pid", "Perpetual": "no", "PrivateDevices": "no", "PrivateIPC": "no", "PrivateMounts": "no", "PrivateNetwork": "no", "PrivateTmp": "no", "PrivateUsers": "no", "ProcSubset": "all", "ProtectClock": "no", "ProtectControlGroups": "no", "ProtectHome": "no", "ProtectHostname": "no", "ProtectKernelLogs": "no", "ProtectKernelModules": "yes", "ProtectKernelTunables": "no", "ProtectProc": "default", "ProtectSystem": "no", "RefuseManualStart": "no", "RefuseManualStop": "no", "ReloadResult": "success", "ReloadSignal": "1", "RemainAfterExit": "no", "RemoveIPC": "no", "Requires": "system.slice", "Restart": "on-failure", "RestartKillSignal": "15", "RestartMaxDelayUSec": "infinity", "RestartMode": "normal", "RestartPreventExitStatus": "2 4 6", "RestartSteps": "0", "RestartUSec": "100ms", "RestartUSecNext": "100ms", "RestrictNamespaces": "no", "RestrictRealtime": "yes", "RestrictSUIDSGID": "no", "Result": "success", "RootDirectoryStartOnly": "no", "RootEphemeral": "no", "RootImagePolicy": "root=verity+signed+encrypted+unprotected+absent:usr=verity+signed+encrypted+unprotected+absent:home=encrypted+unprotected+absent:srv=encrypted+unprotected+absent:tmp=encrypted+unprotected+absent:var=encrypted+unprotected+absent", "RuntimeDirectoryMode": "0755", "RuntimeDirectoryPreserve": "no", "RuntimeMaxUSec": "infinity", "RuntimeRandomizedExtraUSec": "0", "SameProcessGroup": "no", "SecureBits": "0", "SendSIGHUP": "no", "SendSIGKILL": "yes", "SetLoginEnvironment": "no", "Slice": "system.slice", "StandardError": "inherit", "StandardInput": "null", "StandardOutput": "journal", "StartLimitAction": "none", "StartLimitBurst": "5", "StartLimitIntervalUSec": "10s", "StartupBlockIOWeight": "[not set]", "StartupCPUShares": "[not set]", "StartupCPUWeight": "[not set]", "StartupIOWeight": "[not set]", "StartupMemoryHigh": "infinity", "StartupMemoryLow": "0", "StartupMemoryMax": "infinity", "StartupMemorySwapMax": "infinity", "StartupMemoryZSwapMax": "infinity", "StateChangeTimestamp": "Mon 2026-07-20 09:53:45 UTC", "StateChangeTimestampMonotonic": "166883452", "StateDirectoryMode": "0755", "StatusErrno": "0", "StopWhenUnneeded": "no", "SubState": "running", "SuccessAction": "none", "SurviveFinalKillSignal": "no", "SyslogFacility": "3", "SyslogLevel": "6", "SyslogLevelPrefix": "yes", "SyslogPriority": "30", "SystemCallErrorNumber": "2147483646", "TTYReset": "no", "TTYVHangup": "no", "TTYVTDisallocate": "no", "TasksAccounting": "yes", "TasksCurrent": "2", "TasksMax": "4611", "TimeoutAbortUSec": "1min 30s", "TimeoutCleanUSec": "infinity", "TimeoutStartFailureMode": "terminate", "TimeoutStartUSec": "1min 30s", "TimeoutStopFailureMode": "terminate", "TimeoutStopUSec": "1min 30s", "TimerSlackNSec": "50000", "Transient": "no", "Type": "forking", "UID": "[not set]", "UMask": "0022", "UnitFilePreset": "enabled", "UnitFileState": "enabled", "UtmpMode": "init", "WantedBy": "multi-user.target", "WatchdogSignal": "6", "WatchdogTimestampMonotonic": "0", "WatchdogUSec": "0"}} 2026-07-20 09:53:54.481424 | ubuntu-noble | 2026-07-20 09:53:54.481696 | ubuntu-noble | TASK [auditd : List existing rules files] ************************************** 2026-07-20 09:53:54.326230 | debian-bookworm | INFO [delegated > converge] Executed: Successful 2026-07-20 09:53:54.326623 | debian-bookworm | WARNING Molecule executed 1 scenario (1 missing files) 2026-07-20 09:53:54.326649 | debian-bookworm | 2026-07-20 09:53:54.326662 | debian-bookworm | DETAILS 2026-07-20 09:53:54.326680 | debian-bookworm | delegated > dependency: Executed: Missing roles requirements file: requirements.yml (Remove from converge_sequence to suppress) 2026-07-20 09:53:54.326693 | debian-bookworm | delegated > create: Executed: Missing playbook (Remove from converge_sequence to suppress) 2026-07-20 09:53:54.326707 | debian-bookworm | delegated > prepare: Executed: Successful 2026-07-20 09:53:54.326723 | debian-bookworm | delegated > converge: Executed: Successful 2026-07-20 09:53:54.326734 | debian-bookworm | 2026-07-20 09:53:54.326847 | debian-bookworm | SCENARIO RECAP 2026-07-20 09:53:54.326862 | debian-bookworm | delegated : actions=4 successful=1 disabled=0 skipped=0 missing=2 failed=0 2026-07-20 09:53:54.326873 | debian-bookworm | 2026-07-20 09:53:54.730559 | debian-bookworm | ok: Runtime: 0:00:19.703847 2026-07-20 09:53:55.178729 | ubuntu-noble | ok: [molecule-auditd] => {"changed": false, "cmd": ["find", "/etc/audit/rules.d", "-type", "f", "-printf", "%f\n"], "delta": "0:00:00.009069", "end": "2026-07-20 09:53:55.100525", "msg": "", "rc": 0, "start": "2026-07-20 09:53:55.091456", "stderr": "", "stderr_lines": [], "stdout": "audit.rules\n20-neo23x0.rules", "stdout_lines": ["audit.rules", "20-neo23x0.rules"]} 2026-07-20 09:53:55.178812 | ubuntu-noble | 2026-07-20 09:53:55.178824 | ubuntu-noble | TASK [auditd : Remove unmanaged rules files] *********************************** 2026-07-20 09:53:55.690179 | ubuntu-noble | --- before 2026-07-20 09:53:55.690824 | ubuntu-noble | +++ after 2026-07-20 09:53:55.691311 | ubuntu-noble | @@ -1,4 +1,4 @@ 2026-07-20 09:53:55.691787 | ubuntu-noble | { 2026-07-20 09:53:55.692312 | ubuntu-noble | "path": "/etc/audit/rules.d/audit.rules", 2026-07-20 09:53:55.692780 | ubuntu-noble | - "state": "file" 2026-07-20 09:53:55.694698 | ubuntu-noble | + "state": "absent" 2026-07-20 09:53:55.694738 | ubuntu-noble | } 2026-07-20 09:53:55.694749 | ubuntu-noble | 2026-07-20 09:53:55.694760 | ubuntu-noble | changed: [molecule-auditd] => (item=audit.rules) => {"ansible_loop_var": "item", "changed": true, "item": "audit.rules", "path": "/etc/audit/rules.d/audit.rules", "state": "absent"} 2026-07-20 09:53:55.694770 | ubuntu-noble | skipping: [molecule-auditd] => (item=20-neo23x0.rules) => {"ansible_loop_var": "item", "changed": false, "false_condition": "item not in auditd_rules_files", "item": "20-neo23x0.rules", "skip_reason": "Conditional result was False"} 2026-07-20 09:53:55.694997 | ubuntu-noble | 2026-07-20 09:53:55.695481 | ubuntu-noble | RUNNING HANDLER [auditd : Restart auditd service] ****************************** 2026-07-20 09:53:56.595094 | ubuntu-noble | changed: [molecule-auditd] => {"changed": true, "name": "auditd", "state": "started", "status": {"ActiveEnterTimestamp": "Mon 2026-07-20 09:53:45 UTC", "ActiveEnterTimestampMonotonic": "166883452", "ActiveExitTimestampMonotonic": "0", "ActiveState": "active", "After": "systemd-tmpfiles-setup.service local-fs.target system.slice systemd-journald.socket", "AllowIsolate": "no", "AssertResult": "yes", "AssertTimestamp": "Mon 2026-07-20 09:53:45 UTC", "AssertTimestampMonotonic": "166828437", "Before": "systemd-update-utmp.service shutdown.target sysinit.target ssh.service", "BlockIOAccounting": "no", "BlockIOWeight": "[not set]", "CPUAccounting": "yes", "CPUAffinityFromNUMA": "no", "CPUQuotaPerSecUSec": "infinity", "CPUQuotaPeriodUSec": "infinity", "CPUSchedulingPolicy": "0", "CPUSchedulingPriority": "0", "CPUSchedulingResetOnFork": "no", "CPUShares": "[not set]", "CPUUsageNSec": "38245000", "CPUWeight": "[not set]", "CacheDirectoryMode": "0755", "CanFreeze": "yes", "CanIsolate": "no", "CanReload": "no", "CanStart": "yes", "CanStop": "yes", "CapabilityBoundingSet": "cap_chown cap_dac_override cap_dac_read_search cap_fowner cap_fsetid cap_kill cap_setgid cap_setuid cap_setpcap cap_linux_immutable cap_net_bind_service cap_net_broadcast cap_net_admin cap_net_raw cap_ipc_lock cap_ipc_owner cap_sys_rawio cap_sys_chroot cap_sys_ptrace cap_sys_pacct cap_sys_admin cap_sys_boot cap_sys_nice cap_sys_resource cap_sys_time cap_sys_tty_config cap_mknod cap_lease cap_audit_write cap_audit_control cap_setfcap cap_mac_override cap_mac_admin cap_syslog cap_wake_alarm cap_block_suspend cap_audit_read cap_perfmon cap_bpf cap_checkpoint_restore", "CleanResult": "success", "CollectMode": "inactive", "ConditionResult": "yes", "ConditionTimestamp": "Mon 2026-07-20 09:53:45 UTC", "ConditionTimestampMonotonic": "166828365", "ConfigurationDirectoryMode": "0755", "Conflicts": "shutdown.target", "ControlGroup": "/system.slice/auditd.service", "ControlGroupId": "3826", "ControlPID": "0", "CoredumpFilter": "0x33", "CoredumpReceive": "no", "DefaultDependencies": "no", "DefaultMemoryLow": "0", "DefaultMemoryMin": "0", "DefaultStartupMemoryLow": "0", "Delegate": "no", "Description": "Security Auditing Service", "DevicePolicy": "auto", "Documentation": "\"man:auditd(8)\" https://github.com/linux-audit/audit-documentation", "DynamicUser": "no", "ExecMainCode": "0", "ExecMainExitTimestampMonotonic": "0", "ExecMainPID": "2276", "ExecMainStartTimestamp": "Mon 2026-07-20 09:53:45 UTC", "ExecMainStartTimestampMonotonic": "166853263", "ExecMainStatus": "0", "ExecStart": "{ path=/sbin/auditd ; argv[]=/sbin/auditd ; ignore_errors=no ; start_time=[Mon 2026-07-20 09:53:45 UTC] ; stop_time=[Mon 2026-07-20 09:53:45 UTC] ; pid=2275 ; code=exited ; status=0 }", "ExecStartEx": "{ path=/sbin/auditd ; argv[]=/sbin/auditd ; flags= ; start_time=[Mon 2026-07-20 09:53:45 UTC] ; stop_time=[Mon 2026-07-20 09:53:45 UTC] ; pid=2275 ; code=exited ; status=0 }", "ExecStartPost": "{ path=/sbin/augenrules ; argv[]=/sbin/augenrules --load ; ignore_errors=yes ; start_time=[Mon 2026-07-20 09:53:45 UTC] ; stop_time=[Mon 2026-07-20 09:53:45 UTC] ; pid=2279 ; code=exited ; status=0 }", "ExecStartPostEx": "{ path=/sbin/augenrules ; argv[]=/sbin/augenrules --load ; flags=ignore-failure ; start_time=[Mon 2026-07-20 09:53:45 UTC] ; stop_time=[Mon 2026-07-20 09:53:45 UTC] ; pid=2279 ; code=exited ; status=0 }", "ExitType": "main", "ExtensionImagePolicy": "root=verity+signed+encrypted+unprotected+absent:usr=verity+signed+encrypted+unprotected+absent:home=encrypted+unprotected+absent:srv=encrypted+unprotected+absent:tmp=encrypted+unprotected+absent:var=encrypted+unprotected+absent", "FailureAction": "none", "FileDescriptorStoreMax": "0", "FileDescriptorStorePreserve": "restart", "FinalKillSignal": "9", "FragmentPath": "/usr/lib/systemd/system/auditd.service", "FreezerState": "running", "GID": "[not set]", "GuessMainPID": "yes", "IOAccounting": "no", "IOReadBytes": "[not set]", "IOReadOperations": "[not set]", "IOSchedulingClass": "2", "IOSchedulingPriority": "4", "IOWeight": "[not set]", "IOWriteBytes": "[not set]", "IOWriteOperations": "[not set]", "IPAccounting": "no", "IPEgressBytes": "[no data]", "IPEgressPackets": "[no data]", "IPIngressBytes": "[no data]", "IPIngressPackets": "[no data]", "Id": "auditd.service", "IgnoreOnIsolate": "no", "IgnoreSIGPIPE": "yes", "InactiveEnterTimestampMonotonic": "0", "InactiveExitTimestamp": "Mon 2026-07-20 09:53:45 UTC", "InactiveExitTimestampMonotonic": "166840702", "InvocationID": "56d75f661a1947b8a93d4e13721fc18b", "JobRunningTimeoutUSec": "infinity", "JobTimeoutAction": "none", "JobTimeoutUSec": "infinity", "KeyringMode": "private", "KillMode": "control-group", "KillSignal": "15", "LimitAS": "infinity", "LimitASSoft": "infinity", "LimitCORE": "infinity", "LimitCORESoft": "0", "LimitCPU": "infinity", "LimitCPUSoft": "infinity", "LimitDATA": "infinity", "LimitDATASoft": "infinity", "LimitFSIZE": "infinity", "LimitFSIZESoft": "infinity", "LimitLOCKS": "infinity", "LimitLOCKSSoft": "infinity", "LimitMEMLOCK": "8388608", "LimitMEMLOCKSoft": "8388608", "LimitMSGQUEUE": "819200", "LimitMSGQUEUESoft": "819200", "LimitNICE": "0", "LimitNICESoft": "0", "LimitNOFILE": "524288", "LimitNOFILESoft": "1024", "LimitNPROC": "15372", "LimitNPROCSoft": "15372", "LimitRSS": "infinity", "LimitRSSSoft": "infinity", "LimitRTPRIO": "0", "LimitRTPRIOSoft": "0", "LimitRTTIME": "infinity", "LimitRTTIMESoft": "infinity", "LimitSIGPENDING": "15372", "LimitSIGPENDINGSoft": "15372", "LimitSTACK": "infinity", "LimitSTACKSoft": "8388608", "LoadState": "loaded", "LockPersonality": "yes", "LogLevelMax": "-1", "LogRateLimitBurst": "0", "LogRateLimitIntervalUSec": "0", "LogsDirectoryMode": "0755", "MainPID": "2276", "ManagedOOMMemoryPressure": "auto", "ManagedOOMMemoryPressureLimit": "0", "ManagedOOMPreference": "none", "ManagedOOMSwap": "auto", "MemoryAccounting": "yes", "MemoryAvailable": "3543289856", "MemoryCurrent": "507904", "MemoryDenyWriteExecute": "yes", "MemoryHigh": "infinity", "MemoryKSM": "no", "MemoryLimit": "infinity", "MemoryLow": "0", "MemoryMax": "infinity", "MemoryMin": "0", "MemoryPeak": "2134016", "MemoryPressureThresholdUSec": "200ms", "MemoryPressureWatch": "auto", "MemorySwapCurrent": "0", "MemorySwapMax": "infinity", "MemorySwapPeak": "0", "MemoryZSwapCurrent": "0", "MemoryZSwapMax": "infinity", "MountAPIVFS": "no", "MountImagePolicy": "root=verity+signed+encrypted+unprotected+absent:usr=verity+signed+encrypted+unprotected+absent:home=encrypted+unprotected+absent:srv=encrypted+unprotected+absent:tmp=encrypted+unprotected+absent:var=encrypted+unprotected+absent", "NFileDescriptorStore": "0", "NRestarts": "0", "NUMAPolicy": "n/a", "Names": "auditd.service", "NeedDaemonReload": "no", "Nice": "0", "NoNewPrivileges": "no", "NonBlocking": "no", "NotifyAccess": "none", "OOMPolicy": "stop", "OOMScoreAdjust": "0", "OnFailureJobMode": "replace", "OnSuccessJobMode": "fail", "PIDFile": "/run/auditd.pid", "Perpetual": "no", "PrivateDevices": "no", "PrivateIPC": "no", "PrivateMounts": "no", "PrivateNetwork": "no", "PrivateTmp": "no", "PrivateUsers": "no", "ProcSubset": "all", "ProtectClock": "no", "ProtectControlGroups": "no", "ProtectHome": "no", "ProtectHostname": "no", "ProtectKernelLogs": "no", "ProtectKernelModules": "yes", "ProtectKernelTunables": "no", "ProtectProc": "default", "ProtectSystem": "no", "RefuseManualStart": "no", "RefuseManualStop": "no", "ReloadResult": "success", "ReloadSignal": "1", "RemainAfterExit": "no", "RemoveIPC": "no", "Requires": "system.slice", "Restart": "on-failure", "RestartKillSignal": "15", "RestartMaxDelayUSec": "infinity", "RestartMode": "normal", "RestartPreventExitStatus": "2 4 6", "RestartSteps": "0", "RestartUSec": "100ms", "RestartUSecNext": "100ms", "RestrictNamespaces": "no", "RestrictRealtime": "yes", "RestrictSUIDSGID": "no", "Result": "success", "RootDirectoryStartOnly": "no", "RootEphemeral": "no", "RootImagePolicy": "root=verity+signed+encrypted+unprotected+absent:usr=verity+signed+encrypted+unprotected+absent:home=encrypted+unprotected+absent:srv=encrypted+unprotected+absent:tmp=encrypted+unprotected+absent:var=encrypted+unprotected+absent", "RuntimeDirectoryMode": "0755", "RuntimeDirectoryPreserve": "no", "RuntimeMaxUSec": "infinity", "RuntimeRandomizedExtraUSec": "0", "SameProcessGroup": "no", "SecureBits": "0", "SendSIGHUP": "no", "SendSIGKILL": "yes", "SetLoginEnvironment": "no", "Slice": "system.slice", "StandardError": "inherit", "StandardInput": "null", "StandardOutput": "journal", "StartLimitAction": "none", "StartLimitBurst": "5", "StartLimitIntervalUSec": "10s", "StartupBlockIOWeight": "[not set]", "StartupCPUShares": "[not set]", "StartupCPUWeight": "[not set]", "StartupIOWeight": "[not set]", "StartupMemoryHigh": "infinity", "StartupMemoryLow": "0", "StartupMemoryMax": "infinity", "StartupMemorySwapMax": "infinity", "StartupMemoryZSwapMax": "infinity", "StateChangeTimestamp": "Mon 2026-07-20 09:53:45 UTC", "StateChangeTimestampMonotonic": "166883452", "StateDirectoryMode": "0755", "StatusErrno": "0", "StopWhenUnneeded": "no", "SubState": "running", "SuccessAction": "none", "SurviveFinalKillSignal": "no", "SyslogFacility": "3", "SyslogLevel": "6", "SyslogLevelPrefix": "yes", "SyslogPriority": "30", "SystemCallErrorNumber": "2147483646", "TTYReset": "no", "TTYVHangup": "no", "TTYVTDisallocate": "no", "TasksAccounting": "yes", "TasksCurrent": "2", "TasksMax": "4611", "TimeoutAbortUSec": "1min 30s", "TimeoutCleanUSec": "infinity", "TimeoutStartFailureMode": "terminate", "TimeoutStartUSec": "1min 30s", "TimeoutStopFailureMode": "terminate", "TimeoutStopUSec": "1min 30s", "TimerSlackNSec": "50000", "Transient": "no", "Type": "forking", "UID": "[not set]", "UMask": "0022", "UnitFilePreset": "enabled", "UnitFileState": "enabled", "UtmpMode": "init", "WantedBy": "multi-user.target", "WatchdogSignal": "6", "WatchdogTimestampMonotonic": "0", "WatchdogUSec": "0"}} 2026-07-20 09:53:56.600898 | ubuntu-noble | 2026-07-20 09:53:56.601559 | ubuntu-noble | RUNNING HANDLER [auditd : Generate auditd rules] ******************************* 2026-07-20 09:53:57.201173 | ubuntu-noble | changed: [molecule-auditd] => {"changed": true, "cmd": ["augenrules", "--load"], "delta": "0:00:00.091810", "end": "2026-07-20 09:53:57.121163", "msg": "", "rc": 0, "start": "2026-07-20 09:53:57.029353", "stderr": "Unknown user: chrony\nThere was an error in line 24 of /etc/audit/audit.rules\nError sending add rule data request (No such file or directory)\nThere was an error in line 28 of /etc/audit/audit.rules\nUnknown user: ntp\nThere was an error in line 44 of /etc/audit/audit.rules\nError sending add rule data request (No such file or directory)\nThere was an error in line 83 of /etc/audit/audit.rules\nError sending add rule data request (No such file or directory)\nThere was an error in line 84 of /etc/audit/audit.rules\nError sending add rule data request (No such file or directory)\nThere was an error in line 86 of /etc/audit/audit.rules\nError sending add rule data request (No such file or directory)\nThere was an error in line 112 of /etc/audit/audit.rules\nError sending add rule data request (No such file or directory)\nThere was an error in line 115 of /etc/audit/audit.rules\nError sending add rule data request (No such file or directory)\nThere was an error in line 176 of /etc/audit/audit.rules\nError sending add rule data request (No such file or directory)\nThere was an error in line 177 of /etc/audit/audit.rules\nError sending add rule data request (No such file or directory)\nThere was an error in line 178 of /etc/audit/audit.rules\nError sending add rule data request (No such file or directory)\nThere was an error in line 179 of /etc/audit/audit.rules\nError sending add rule data request (No such file or directory)\nThere was an error in line 180 of /etc/audit/audit.rules\nError sending add rule data request (No such file or directory)\nThere was an error in line 217 of /etc/audit/audit.rules\nError sending add rule data request (No such file or directory)\nThere was an error in line 218 of /etc/audit/audit.rules\nError sending add rule data request (No such file or directory)\nThere was an error in line 234 of /etc/audit/audit.rules\nError sending add rule data request (No such file or directory)\nThere was an error in line 285 of /etc/audit/audit.rules\nError sending add rule data request (No such file or directory)\nThere was an error in line 286 of /etc/audit/audit.rules\nError sending add rule data request (No such file or directory)\nThere was an error in line 324 of /etc/audit/audit.rules\nError sending add rule data request (No such file or directory)\nThere was an error in line 325 of /etc/audit/audit.rules\nError sending add rule data request (No such file or directory)\nThere was an error in line 346 of /etc/audit/audit.rules\nparameter passed without an option given\nThere was an error in line 347 of /etc/audit/audit.rules\nparameter passed without an option given\nThere was an error in line 348 of /etc/audit/audit.rules\nparameter passed without an option given\nThere was an error in line 349 of /etc/audit/audit.rules\nparameter passed without an option given\nThere was an error in line 350 of /etc/audit/audit.rules\nparameter passed without an option given\nThere was an error in line 351 of /etc/audit/audit.rules\nError sending add rule data request (No such file or directory)\nThere was an error in line 359 of /etc/audit/audit.rules", "stderr_lines": ["Unknown user: chrony", "There was an error in line 24 of /etc/audit/audit.rules", "Error sending add rule data request (No such file or directory)", "There was an error in line 28 of /etc/audit/audit.rules", "Unknown user: ntp", "There was an error in line 44 of /etc/audit/audit.rules", "Error sending add rule data request (No such file or directory)", "There was an error in line 83 of /etc/audit/audit.rules", "Error sending add rule data request (No such file or directory)", "There was an error in line 84 of /etc/audit/audit.rules", "Error sending add rule data request (No such file or directory)", "There was an error in line 86 of /etc/audit/audit.rules", "Error sending add rule data request (No such file or directory)", "There was an error in line 112 of /etc/audit/audit.rules", "Error sending add rule data request (No such file or directory)", "There was an error in line 115 of /etc/audit/audit.rules", "Error sending add rule data request (No such file or directory)", "There was an error in line 176 of /etc/audit/audit.rules", "Error sending add rule data request (No such file or directory)", "There was an error in line 177 of /etc/audit/audit.rules", "Error sending add rule data request (No such file or directory)", "There was an error in line 178 of /etc/audit/audit.rules", "Error sending add rule data request (No such file or directory)", "There was an error in line 179 of /etc/audit/audit.rules", "Error sending add rule data request (No such file or directory)", "There was an error in line 180 of /etc/audit/audit.rules", "Error sending add rule data request (No such file or directory)", "There was an error in line 217 of /etc/audit/audit.rules", "Error sending add rule data request (No such file or directory)", "There was an error in line 218 of /etc/audit/audit.rules", "Error sending add rule data request (No such file or directory)", "There was an error in line 234 of /etc/audit/audit.rules", "Error sending add rule data request (No such file or directory)", "There was an error in line 285 of /etc/audit/audit.rules", "Error sending add rule data request (No such file or directory)", "There was an error in line 286 of /etc/audit/audit.rules", "Error sending add rule data request (No such file or directory)", "There was an error in line 324 of /etc/audit/audit.rules", "Error sending add rule data request (No such file or directory)", "There was an error in line 325 of /etc/audit/audit.rules", "Error sending add rule data request (No such file or directory)", "There was an error in line 346 of /etc/audit/audit.rules", "parameter passed without an option given", "There was an error in line 347 of /etc/audit/audit.rules", "parameter passed without an option given", "There was an error in line 348 of /etc/audit/audit.rules", "parameter passed without an option given", "There was an error in line 349 of /etc/audit/audit.rules", "parameter passed without an option given", "There was an error in line 350 of /etc/audit/audit.rules", "parameter passed without an option given", "There was an error in line 351 of /etc/audit/audit.rules", "Error sending add rule data request (No such file or directory)", "There was an error in line 359 of /etc/audit/audit.rules"], "stdout": "/usr/sbin/augenrules: No change\nNo rules\nenabled 1\nfailure 1\npid 2668\nrate_limit 0\nbacklog_limit 8192\nlost 0\nbacklog 675\nbacklog_wait_time 60000\nbacklog_wait_time_actual 0\nenabled 1\nfailure 1\npid 2668\nrate_limit 0\nbacklog_limit 8192\nlost 0\nbacklog 679\nbacklog_wait_time 60000\nbacklog_wait_time_actual 0", "stdout_lines": ["/usr/sbin/augenrules: No change", "No rules", "enabled 1", "failure 1", "pid 2668", "rate_limit 0", "backlog_limit 8192", "lost 0", "backlog 675", "backlog_wait_time 60000", "backlog_wait_time_actual 0", "enabled 1", "failure 1", "pid 2668", "rate_limit 0", "backlog_limit 8192", "lost 0", "backlog 679", "backlog_wait_time 60000", "backlog_wait_time_actual 0"]} 2026-07-20 09:53:57.201694 | ubuntu-noble | 2026-07-20 09:53:57.202025 | ubuntu-noble | RUNNING HANDLER [auditd : Restart auditd service] ****************************** 2026-07-20 09:53:58.097888 | ubuntu-noble | changed: [molecule-auditd] => {"changed": true, "name": "auditd", "state": "started", "status": {"ActiveEnterTimestamp": "Mon 2026-07-20 09:53:56 UTC", "ActiveEnterTimestampMonotonic": "177756944", "ActiveExitTimestamp": "Mon 2026-07-20 09:53:56 UTC", "ActiveExitTimestampMonotonic": "177583293", "ActiveState": "active", "After": "systemd-tmpfiles-setup.service local-fs.target system.slice systemd-journald.socket", "AllowIsolate": "no", "AssertResult": "yes", "AssertTimestamp": "Mon 2026-07-20 09:53:56 UTC", "AssertTimestampMonotonic": "177625394", "Before": "systemd-update-utmp.service shutdown.target sysinit.target ssh.service", "BlockIOAccounting": "no", "BlockIOWeight": "[not set]", "CPUAccounting": "yes", "CPUAffinityFromNUMA": "no", "CPUQuotaPerSecUSec": "infinity", "CPUQuotaPeriodUSec": "infinity", "CPUSchedulingPolicy": "0", "CPUSchedulingPriority": "0", "CPUSchedulingResetOnFork": "no", "CPUShares": "[not set]", "CPUUsageNSec": "191413000", "CPUWeight": "[not set]", "CacheDirectoryMode": "0755", "CanFreeze": "yes", "CanIsolate": "no", "CanReload": "no", "CanStart": "yes", "CanStop": "yes", "CapabilityBoundingSet": "cap_chown cap_dac_override cap_dac_read_search cap_fowner cap_fsetid cap_kill cap_setgid cap_setuid cap_setpcap cap_linux_immutable cap_net_bind_service cap_net_broadcast cap_net_admin cap_net_raw cap_ipc_lock cap_ipc_owner cap_sys_rawio cap_sys_chroot cap_sys_ptrace cap_sys_pacct cap_sys_admin cap_sys_boot cap_sys_nice cap_sys_resource cap_sys_time cap_sys_tty_config cap_mknod cap_lease cap_audit_write cap_audit_control cap_setfcap cap_mac_override cap_mac_admin cap_syslog cap_wake_alarm cap_block_suspend cap_audit_read cap_perfmon cap_bpf cap_checkpoint_restore", "CleanResult": "success", "CollectMode": "inactive", "ConditionResult": "yes", "ConditionTimestamp": "Mon 2026-07-20 09:53:56 UTC", "ConditionTimestampMonotonic": "177625290", "ConfigurationDirectoryMode": "0755", "Conflicts": "shutdown.target", "ControlGroup": "/system.slice/auditd.service", "ControlGroupId": "3868", "ControlPID": "0", "CoredumpFilter": "0x33", "CoredumpReceive": "no", "DefaultDependencies": "no", "DefaultMemoryLow": "0", "DefaultMemoryMin": "0", "DefaultStartupMemoryLow": "0", "Delegate": "no", "Description": "Security Auditing Service", "DevicePolicy": "auto", "Documentation": "\"man:auditd(8)\" https://github.com/linux-audit/audit-documentation", "DynamicUser": "no", "ExecMainCode": "0", "ExecMainExitTimestampMonotonic": "0", "ExecMainPID": "2668", "ExecMainStartTimestamp": "Mon 2026-07-20 09:53:56 UTC", "ExecMainStartTimestampMonotonic": "177658369", "ExecMainStatus": "0", "ExecStart": "{ path=/sbin/auditd ; argv[]=/sbin/auditd ; ignore_errors=no ; start_time=[Mon 2026-07-20 09:53:56 UTC] ; stop_time=[Mon 2026-07-20 09:53:56 UTC] ; pid=2667 ; code=exited ; status=0 }", "ExecStartEx": "{ path=/sbin/auditd ; argv[]=/sbin/auditd ; flags= ; start_time=[Mon 2026-07-20 09:53:56 UTC] ; stop_time=[Mon 2026-07-20 09:53:56 UTC] ; pid=2667 ; code=exited ; status=0 }", "ExecStartPost": "{ path=/sbin/augenrules ; argv[]=/sbin/augenrules --load ; ignore_errors=yes ; start_time=[Mon 2026-07-20 09:53:56 UTC] ; stop_time=[Mon 2026-07-20 09:53:56 UTC] ; pid=2671 ; code=exited ; status=0 }", "ExecStartPostEx": "{ path=/sbin/augenrules ; argv[]=/sbin/augenrules --load ; flags=ignore-failure ; start_time=[Mon 2026-07-20 09:53:56 UTC] ; stop_time=[Mon 2026-07-20 09:53:56 UTC] ; pid=2671 ; code=exited ; status=0 }", "ExitType": "main", "ExtensionImagePolicy": "root=verity+signed+encrypted+unprotected+absent:usr=verity+signed+encrypted+unprotected+absent:home=encrypted+unprotected+absent:srv=encrypted+unprotected+absent:tmp=encrypted+unprotected+absent:var=encrypted+unprotected+absent", "FailureAction": "none", "FileDescriptorStoreMax": "0", "FileDescriptorStorePreserve": "restart", "FinalKillSignal": "9", "FragmentPath": "/usr/lib/systemd/system/auditd.service", "FreezerState": "running", "GID": "[not set]", "GuessMainPID": "yes", "IOAccounting": "no", "IOReadBytes": "[not set]", "IOReadOperations": "[not set]", "IOSchedulingClass": "2", "IOSchedulingPriority": "4", "IOWeight": "[not set]", "IOWriteBytes": "[not set]", "IOWriteOperations": "[not set]", "IPAccounting": "no", "IPEgressBytes": "[no data]", "IPEgressPackets": "[no data]", "IPIngressBytes": "[no data]", "IPIngressPackets": "[no data]", "Id": "auditd.service", "IgnoreOnIsolate": "no", "IgnoreSIGPIPE": "yes", "InactiveEnterTimestamp": "Mon 2026-07-20 09:53:56 UTC", "InactiveEnterTimestampMonotonic": "177621573", "InactiveExitTimestamp": "Mon 2026-07-20 09:53:56 UTC", "InactiveExitTimestampMonotonic": "177633067", "InvocationID": "eb17500a52304ef799d2e66d58be5ba9", "JobRunningTimeoutUSec": "infinity", "JobTimeoutAction": "none", "JobTimeoutUSec": "infinity", "KeyringMode": "private", "KillMode": "control-group", "KillSignal": "15", "LimitAS": "infinity", "LimitASSoft": "infinity", "LimitCORE": "infinity", "LimitCORESoft": "0", "LimitCPU": "infinity", "LimitCPUSoft": "infinity", "LimitDATA": "infinity", "LimitDATASoft": "infinity", "LimitFSIZE": "infinity", "LimitFSIZESoft": "infinity", "LimitLOCKS": "infinity", "LimitLOCKSSoft": "infinity", "LimitMEMLOCK": "8388608", "LimitMEMLOCKSoft": "8388608", "LimitMSGQUEUE": "819200", "LimitMSGQUEUESoft": "819200", "LimitNICE": "0", "LimitNICESoft": "0", "LimitNOFILE": "524288", "LimitNOFILESoft": "1024", "LimitNPROC": "15372", "LimitNPROCSoft": "15372", "LimitRSS": "infinity", "LimitRSSSoft": "infinity", "LimitRTPRIO": "0", "LimitRTPRIOSoft": "0", "LimitRTTIME": "infinity", "LimitRTTIMESoft": "infinity", "LimitSIGPENDING": "15372", "LimitSIGPENDINGSoft": "15372", "LimitSTACK": "infinity", "LimitSTACKSoft": "8388608", "LoadState": "loaded", "LockPersonality": "yes", "LogLevelMax": "-1", "LogRateLimitBurst": "0", "LogRateLimitIntervalUSec": "0", "LogsDirectoryMode": "0755", "MainPID": "2668", "ManagedOOMMemoryPressure": "auto", "ManagedOOMMemoryPressureLimit": "0", "ManagedOOMPreference": "none", "ManagedOOMSwap": "auto", "MemoryAccounting": "yes", "MemoryAvailable": "3558240256", "MemoryCurrent": "1859584", "MemoryDenyWriteExecute": "yes", "MemoryHigh": "infinity", "MemoryKSM": "no", "MemoryLimit": "infinity", "MemoryLow": "0", "MemoryMax": "infinity", "MemoryMin": "0", "MemoryPeak": "2342912", "MemoryPressureThresholdUSec": "200ms", "MemoryPressureWatch": "auto", "MemorySwapCurrent": "0", "MemorySwapMax": "infinity", "MemorySwapPeak": "0", "MemoryZSwapCurrent": "0", "MemoryZSwapMax": "infinity", "MountAPIVFS": "no", "MountImagePolicy": "root=verity+signed+encrypted+unprotected+absent:usr=verity+signed+encrypted+unprotected+absent:home=encrypted+unprotected+absent:srv=encrypted+unprotected+absent:tmp=encrypted+unprotected+absent:var=encrypted+unprotected+absent", "NFileDescriptorStore": "0", "NRestarts": "0", "NUMAPolicy": "n/a", "Names": "auditd.service", "NeedDaemonReload": "no", "Nice": "0", "NoNewPrivileges": "no", "NonBlocking": "no", "NotifyAccess": "none", "OOMPolicy": "stop", "OOMScoreAdjust": "0", "OnFailureJobMode": "replace", "OnSuccessJobMode": "fail", "PIDFile": "/run/auditd.pid", "Perpetual": "no", "PrivateDevices": "no", "PrivateIPC": "no", "PrivateMounts": "no", "PrivateNetwork": "no", "PrivateTmp": "no", "PrivateUsers": "no", "ProcSubset": "all", "ProtectClock": "no", "ProtectControlGroups": "no", "ProtectHome": "no", "ProtectHostname": "no", "ProtectKernelLogs": "no", "ProtectKernelModules": "yes", "ProtectKernelTunables": "no", "ProtectProc": "default", "ProtectSystem": "no", "RefuseManualStart": "no", "RefuseManualStop": "no", "ReloadResult": "success", "ReloadSignal": "1", "RemainAfterExit": "no", "RemoveIPC": "no", "Requires": "system.slice", "Restart": "on-failure", "RestartKillSignal": "15", "RestartMaxDelayUSec": "infinity", "RestartMode": "normal", "RestartPreventExitStatus": "2 4 6", "RestartSteps": "0", "RestartUSec": "100ms", "RestartUSecNext": "100ms", "RestrictNamespaces": "no", "RestrictRealtime": "yes", "RestrictSUIDSGID": "no", "Result": "success", "RootDirectoryStartOnly": "no", "RootEphemeral": "no", "RootImagePolicy": "root=verity+signed+encrypted+unprotected+absent:usr=verity+signed+encrypted+unprotected+absent:home=encrypted+unprotected+absent:srv=encrypted+unprotected+absent:tmp=encrypted+unprotected+absent:var=encrypted+unprotected+absent", "RuntimeDirectoryMode": "0755", "RuntimeDirectoryPreserve": "no", "RuntimeMaxUSec": "infinity", "RuntimeRandomizedExtraUSec": "0", "SameProcessGroup": "no", "SecureBits": "0", "SendSIGHUP": "no", "SendSIGKILL": "yes", "SetLoginEnvironment": "no", "Slice": "system.slice", "StandardError": "inherit", "StandardInput": "null", "StandardOutput": "journal", "StartLimitAction": "none", "StartLimitBurst": "5", "StartLimitIntervalUSec": "10s", "StartupBlockIOWeight": "[not set]", "StartupCPUShares": "[not set]", "StartupCPUWeight": "[not set]", "StartupIOWeight": "[not set]", "StartupMemoryHigh": "infinity", "StartupMemoryLow": "0", "StartupMemoryMax": "infinity", "StartupMemorySwapMax": "infinity", "StartupMemoryZSwapMax": "infinity", "StateChangeTimestamp": "Mon 2026-07-20 09:53:56 UTC", "StateChangeTimestampMonotonic": "177756944", "StateDirectoryMode": "0755", "StatusErrno": "0", "StopWhenUnneeded": "no", "SubState": "running", "SuccessAction": "none", "SurviveFinalKillSignal": "no", "SyslogFacility": "3", "SyslogLevel": "6", "SyslogLevelPrefix": "yes", "SyslogPriority": "30", "SystemCallErrorNumber": "2147483646", "TTYReset": "no", "TTYVHangup": "no", "TTYVTDisallocate": "no", "TasksAccounting": "yes", "TasksCurrent": "2", "TasksMax": "4611", "TimeoutAbortUSec": "1min 30s", "TimeoutCleanUSec": "infinity", "TimeoutStartFailureMode": "terminate", "TimeoutStartUSec": "1min 30s", "TimeoutStopFailureMode": "terminate", "TimeoutStopUSec": "1min 30s", "TimerSlackNSec": "50000", "Transient": "no", "Type": "forking", "UID": "[not set]", "UMask": "0022", "UnitFilePreset": "enabled", "UnitFileState": "enabled", "UtmpMode": "init", "WantedBy": "multi-user.target", "WatchdogSignal": "6", "WatchdogTimestampMonotonic": "0", "WatchdogUSec": "0"}} 2026-07-20 09:53:58.098986 | ubuntu-noble | 2026-07-20 09:53:58.099498 | ubuntu-noble | PLAY RECAP ********************************************************************* 2026-07-20 09:53:58.100315 | ubuntu-noble | molecule-auditd : ok=15 changed=8 unreachable=0 failed=0 skipped=0 rescued=0 ignored=0 2026-07-20 09:53:58.100351 | ubuntu-noble | 2026-07-20 09:53:58.405046 | ubuntu-noble | ok: Runtime: 0:00:23.582439 2026-07-20 09:53:58.426158 | 2026-07-20 09:53:58.426318 | TASK [ansible-molecule : Run molecule verify action with scenario delegated] 2026-07-20 09:53:58.240721 | ubuntu-noble | INFO [delegated > converge] Executed: Successful 2026-07-20 09:53:58.240785 | ubuntu-noble | WARNING Molecule executed 1 scenario (1 missing files) 2026-07-20 09:53:58.240797 | ubuntu-noble | 2026-07-20 09:53:58.240808 | ubuntu-noble | DETAILS 2026-07-20 09:53:58.240819 | ubuntu-noble | delegated > dependency: Executed: Missing roles requirements file: requirements.yml (Remove from converge_sequence to suppress) 2026-07-20 09:53:58.240903 | ubuntu-noble | delegated > create: Executed: Missing playbook (Remove from converge_sequence to suppress) 2026-07-20 09:53:58.241010 | ubuntu-noble | delegated > prepare: Executed: Successful 2026-07-20 09:53:58.241131 | ubuntu-noble | delegated > converge: Executed: Successful 2026-07-20 09:53:58.241171 | ubuntu-noble | 2026-07-20 09:53:58.241442 | ubuntu-noble | SCENARIO RECAP 2026-07-20 09:53:58.241485 | ubuntu-noble | delegated : actions=4 successful=1 disabled=0 skipped=0 missing=2 failed=0 2026-07-20 09:53:58.241496 | ubuntu-noble | 2026-07-20 09:53:59.272012 | ubuntu-noble | WARNING Molecule scenarios should migrate to 'extensions/molecule' 2026-07-20 09:53:59.290514 | ubuntu-noble | DEBUG [unknown > config] provisioner.env found in /home/zuul/src/github.com/osism/ansible-collection-services/molecule/delegated/molecule.yml, this can be defined in ansible.env 2026-07-20 09:53:59.104994 | debian-bookworm | WARNING Molecule scenarios should migrate to 'extensions/molecule' 2026-07-20 09:53:59.116690 | debian-bookworm | DEBUG [unknown > config] provisioner.env found in /home/zuul/src/github.com/osism/ansible-collection-services/molecule/delegated/molecule.yml, this can be defined in ansible.env 2026-07-20 09:53:59.753476 | debian-bookworm | DEBUG [unknown > config] provisioner.env found in /home/zuul/src/github.com/osism/ansible-collection-services/molecule/delegated/molecule.yml, this can be defined in ansible.env 2026-07-20 09:53:59.754081 | debian-bookworm | DEBUG [delegated > validate] Validating schema /home/zuul/src/github.com/osism/ansible-collection-services/molecule/delegated/molecule.yml. 2026-07-20 09:53:59.776483 | debian-bookworm | DEBUG [default > validate] Validating schema /home/zuul/src/github.com/osism/ansible-collection-services/molecule/default/molecule.yml. 2026-07-20 09:53:59.781930 | debian-bookworm | INFO [delegated > discovery] scenario test matrix: verify 2026-07-20 09:53:59.782024 | debian-bookworm | INFO [delegated > prerun] Performing prerun with role_name_check=0... 2026-07-20 09:54:00.071926 | ubuntu-noble | DEBUG [unknown > config] provisioner.env found in /home/zuul/src/github.com/osism/ansible-collection-services/molecule/delegated/molecule.yml, this can be defined in ansible.env 2026-07-20 09:54:00.072512 | ubuntu-noble | DEBUG [delegated > validate] Validating schema /home/zuul/src/github.com/osism/ansible-collection-services/molecule/delegated/molecule.yml. 2026-07-20 09:54:00.115873 | ubuntu-noble | DEBUG [default > validate] Validating schema /home/zuul/src/github.com/osism/ansible-collection-services/molecule/default/molecule.yml. 2026-07-20 09:54:00.123716 | ubuntu-noble | INFO [delegated > discovery] scenario test matrix: verify 2026-07-20 09:54:00.123813 | ubuntu-noble | INFO [delegated > prerun] Performing prerun with role_name_check=0... 2026-07-20 09:54:01.373165 | debian-bookworm | INFO [delegated > verify] Executing 2026-07-20 09:54:01.374436 | debian-bookworm | INFO [delegated > verify] Executing Testinfra tests found in /home/zuul/src/github.com/osism/ansible-collection-services/molecule/delegated/tests/... 2026-07-20 09:54:01.375668 | debian-bookworm | DEBUG ANSIBLE ENVIRONMENT: 2026-07-20 09:54:01.375693 | debian-bookworm | ANSIBLE_COLLECTIONS_PATH: /home/zuul/venv/.ansible/collections:/home/zuul/.ansible/collections 2026-07-20 09:54:01.375710 | debian-bookworm | ANSIBLE_CONFIG: /home/zuul/.ansible/tmp/molecule.oWZD.delegated/ansible.cfg 2026-07-20 09:54:01.375725 | debian-bookworm | ANSIBLE_LIBRARY: ../../plugins 2026-07-20 09:54:01.375739 | debian-bookworm | ANSIBLE_PYTHON_INTERPRETER: /home/zuul/venv/bin/python 2026-07-20 09:54:01.375752 | debian-bookworm | ANSIBLE_ROLE: auditd 2026-07-20 09:54:01.375765 | debian-bookworm | ANSIBLE_ROLES_PATH: ../../roles 2026-07-20 09:54:01.375778 | debian-bookworm | ANSIBLE_VERBOSITY: 1 2026-07-20 09:54:01.375791 | debian-bookworm | 2026-07-20 09:54:01.375813 | debian-bookworm | DEBUG MOLECULE ENVIRONMENT: 2026-07-20 09:54:01.375827 | debian-bookworm | MOLECULE_DEBUG: True 2026-07-20 09:54:01.375840 | debian-bookworm | MOLECULE_DEPENDENCY_NAME: galaxy 2026-07-20 09:54:01.375853 | debian-bookworm | MOLECULE_DRIVER_NAME: default 2026-07-20 09:54:01.375866 | debian-bookworm | MOLECULE_ENV_FILE: /home/zuul/src/github.com/osism/ansible-collection-services/.env.yml 2026-07-20 09:54:01.375880 | debian-bookworm | MOLECULE_EPHEMERAL_DIRECTORY: /home/zuul/.ansible/tmp/molecule.oWZD.delegated 2026-07-20 09:54:01.375893 | debian-bookworm | MOLECULE_FILE: /home/zuul/.ansible/tmp/molecule.oWZD.delegated/molecule.yml 2026-07-20 09:54:01.375906 | debian-bookworm | MOLECULE_INSTANCE_CONFIG: /home/zuul/.ansible/tmp/molecule.oWZD.delegated/instance_config.yml 2026-07-20 09:54:01.375920 | debian-bookworm | MOLECULE_INVENTORY_FILE: /home/zuul/.ansible/tmp/molecule.oWZD.delegated/inventory/ansible_inventory.yml 2026-07-20 09:54:01.375934 | debian-bookworm | MOLECULE_PROJECT_DIRECTORY: /home/zuul/src/github.com/osism/ansible-collection-services 2026-07-20 09:54:01.375947 | debian-bookworm | MOLECULE_PROVISIONER_NAME: ansible 2026-07-20 09:54:01.375960 | debian-bookworm | MOLECULE_SCENARIO_DIRECTORY: /home/zuul/src/github.com/osism/ansible-collection-services/molecule/delegated 2026-07-20 09:54:01.375974 | debian-bookworm | MOLECULE_SCENARIO_NAME: delegated 2026-07-20 09:54:01.375987 | debian-bookworm | MOLECULE_STATE_FILE: /home/zuul/.ansible/tmp/molecule.oWZD.delegated/state.yml 2026-07-20 09:54:01.376000 | debian-bookworm | MOLECULE_VERIFIER_NAME: testinfra 2026-07-20 09:54:01.376014 | debian-bookworm | MOLECULE_VERIFIER_TEST_DIRECTORY: /home/zuul/src/github.com/osism/ansible-collection-services/molecule/delegated/tests 2026-07-20 09:54:01.376029 | debian-bookworm | 2026-07-20 09:54:01.376060 | debian-bookworm | DEBUG SHELL REPLAY: ANSIBLE_COLLECTIONS_PATH=/home/zuul/venv/.ansible/collections:/home/zuul/.ansible/collections ANSIBLE_CONFIG=/home/zuul/.ansible/tmp/molecule.oWZD.delegated/ansible.cfg ANSIBLE_LIBRARY=../../plugins ANSIBLE_PYTHON_INTERPRETER=/home/zuul/venv/bin/python ANSIBLE_ROLE=auditd ANSIBLE_ROLES_PATH=../../roles ANSIBLE_VERBOSITY=1 MOLECULE_DEBUG=True MOLECULE_DEPENDENCY_NAME=galaxy MOLECULE_DRIVER_NAME=default MOLECULE_ENV_FILE=/home/zuul/src/github.com/osism/ansible-collection-services/.env.yml MOLECULE_EPHEMERAL_DIRECTORY=/home/zuul/.ansible/tmp/molecule.oWZD.delegated MOLECULE_FILE=/home/zuul/.ansible/tmp/molecule.oWZD.delegated/molecule.yml MOLECULE_INSTANCE_CONFIG=/home/zuul/.ansible/tmp/molecule.oWZD.delegated/instance_config.yml MOLECULE_INVENTORY_FILE=/home/zuul/.ansible/tmp/molecule.oWZD.delegated/inventory/ansible_inventory.yml MOLECULE_PROJECT_DIRECTORY=/home/zuul/src/github.com/osism/ansible-collection-services MOLECULE_PROVISIONER_NAME=ansible MOLECULE_SCENARIO_DIRECTORY=/home/zuul/src/github.com/osism/ansible-collection-services/molecule/delegated MOLECULE_SCENARIO_NAME=delegated MOLECULE_STATE_FILE=/home/zuul/.ansible/tmp/molecule.oWZD.delegated/state.yml MOLECULE_VERIFIER_NAME=testinfra MOLECULE_VERIFIER_TEST_DIRECTORY=/home/zuul/src/github.com/osism/ansible-collection-services/molecule/delegated/tests 2026-07-20 09:54:01.622645 | debian-bookworm | writing pytest debug information to pytestdebug.log 2026-07-20 09:54:01.636688 | debian-bookworm | ============================= test session starts ============================== 2026-07-20 09:54:01.637108 | debian-bookworm | platform linux -- Python 3.11.2, pytest-9.1.1, pluggy-1.6.0 -- /home/zuul/venv/bin/python3 2026-07-20 09:54:01.637590 | debian-bookworm | using: pytest-9.1.1 2026-07-20 09:54:01.637964 | debian-bookworm | registered third-party plugins: 2026-07-20 09:54:01.638310 | debian-bookworm | pytest-testinfra-10.2.2 at /home/zuul/venv/lib/python3.11/site-packages/testinfra/plugin.py 2026-07-20 09:54:01.638727 | debian-bookworm | rootdir: /home/zuul 2026-07-20 09:54:01.639101 | debian-bookworm | plugins: testinfra-10.2.2 2026-07-20 09:54:02.056726 | ubuntu-noble | INFO [delegated > verify] Executing 2026-07-20 09:54:02.061307 | ubuntu-noble | INFO [delegated > verify] Executing Testinfra tests found in /home/zuul/src/github.com/osism/ansible-collection-services/molecule/delegated/tests/... 2026-07-20 09:54:02.064381 | ubuntu-noble | DEBUG ANSIBLE ENVIRONMENT: 2026-07-20 09:54:02.064417 | ubuntu-noble | ANSIBLE_COLLECTIONS_PATH: /home/zuul/venv/.ansible/collections:/home/zuul/.ansible/collections 2026-07-20 09:54:02.064434 | ubuntu-noble | ANSIBLE_CONFIG: /home/zuul/.ansible/tmp/molecule.oWZD.delegated/ansible.cfg 2026-07-20 09:54:02.064446 | ubuntu-noble | ANSIBLE_LIBRARY: ../../plugins 2026-07-20 09:54:02.064457 | ubuntu-noble | ANSIBLE_PYTHON_INTERPRETER: /home/zuul/venv/bin/python 2026-07-20 09:54:02.064467 | ubuntu-noble | ANSIBLE_ROLE: auditd 2026-07-20 09:54:02.064478 | ubuntu-noble | ANSIBLE_ROLES_PATH: ../../roles 2026-07-20 09:54:02.064487 | ubuntu-noble | ANSIBLE_VERBOSITY: 1 2026-07-20 09:54:02.064499 | ubuntu-noble | 2026-07-20 09:54:02.064807 | ubuntu-noble | DEBUG MOLECULE ENVIRONMENT: 2026-07-20 09:54:02.064828 | ubuntu-noble | MOLECULE_DEBUG: True 2026-07-20 09:54:02.064838 | ubuntu-noble | MOLECULE_DEPENDENCY_NAME: galaxy 2026-07-20 09:54:02.064848 | ubuntu-noble | MOLECULE_DRIVER_NAME: default 2026-07-20 09:54:02.064858 | ubuntu-noble | MOLECULE_ENV_FILE: /home/zuul/src/github.com/osism/ansible-collection-services/.env.yml 2026-07-20 09:54:02.064868 | ubuntu-noble | MOLECULE_EPHEMERAL_DIRECTORY: /home/zuul/.ansible/tmp/molecule.oWZD.delegated 2026-07-20 09:54:02.064877 | ubuntu-noble | MOLECULE_FILE: /home/zuul/.ansible/tmp/molecule.oWZD.delegated/molecule.yml 2026-07-20 09:54:02.064887 | ubuntu-noble | MOLECULE_INSTANCE_CONFIG: /home/zuul/.ansible/tmp/molecule.oWZD.delegated/instance_config.yml 2026-07-20 09:54:02.064897 | ubuntu-noble | MOLECULE_INVENTORY_FILE: /home/zuul/.ansible/tmp/molecule.oWZD.delegated/inventory/ansible_inventory.yml 2026-07-20 09:54:02.064908 | ubuntu-noble | MOLECULE_PROJECT_DIRECTORY: /home/zuul/src/github.com/osism/ansible-collection-services 2026-07-20 09:54:02.064917 | ubuntu-noble | MOLECULE_PROVISIONER_NAME: ansible 2026-07-20 09:54:02.064927 | ubuntu-noble | MOLECULE_SCENARIO_DIRECTORY: /home/zuul/src/github.com/osism/ansible-collection-services/molecule/delegated 2026-07-20 09:54:02.064937 | ubuntu-noble | MOLECULE_SCENARIO_NAME: delegated 2026-07-20 09:54:02.064946 | ubuntu-noble | MOLECULE_STATE_FILE: /home/zuul/.ansible/tmp/molecule.oWZD.delegated/state.yml 2026-07-20 09:54:02.064956 | ubuntu-noble | MOLECULE_VERIFIER_NAME: testinfra 2026-07-20 09:54:02.064965 | ubuntu-noble | MOLECULE_VERIFIER_TEST_DIRECTORY: /home/zuul/src/github.com/osism/ansible-collection-services/molecule/delegated/tests 2026-07-20 09:54:02.064975 | ubuntu-noble | 2026-07-20 09:54:02.065043 | ubuntu-noble | DEBUG SHELL REPLAY: ANSIBLE_COLLECTIONS_PATH=/home/zuul/venv/.ansible/collections:/home/zuul/.ansible/collections ANSIBLE_CONFIG=/home/zuul/.ansible/tmp/molecule.oWZD.delegated/ansible.cfg ANSIBLE_LIBRARY=../../plugins ANSIBLE_PYTHON_INTERPRETER=/home/zuul/venv/bin/python ANSIBLE_ROLE=auditd ANSIBLE_ROLES_PATH=../../roles ANSIBLE_VERBOSITY=1 MOLECULE_DEBUG=True MOLECULE_DEPENDENCY_NAME=galaxy MOLECULE_DRIVER_NAME=default MOLECULE_ENV_FILE=/home/zuul/src/github.com/osism/ansible-collection-services/.env.yml MOLECULE_EPHEMERAL_DIRECTORY=/home/zuul/.ansible/tmp/molecule.oWZD.delegated MOLECULE_FILE=/home/zuul/.ansible/tmp/molecule.oWZD.delegated/molecule.yml MOLECULE_INSTANCE_CONFIG=/home/zuul/.ansible/tmp/molecule.oWZD.delegated/instance_config.yml MOLECULE_INVENTORY_FILE=/home/zuul/.ansible/tmp/molecule.oWZD.delegated/inventory/ansible_inventory.yml MOLECULE_PROJECT_DIRECTORY=/home/zuul/src/github.com/osism/ansible-collection-services MOLECULE_PROVISIONER_NAME=ansible MOLECULE_SCENARIO_DIRECTORY=/home/zuul/src/github.com/osism/ansible-collection-services/molecule/delegated MOLECULE_SCENARIO_NAME=delegated MOLECULE_STATE_FILE=/home/zuul/.ansible/tmp/molecule.oWZD.delegated/state.yml MOLECULE_VERIFIER_NAME=testinfra MOLECULE_VERIFIER_TEST_DIRECTORY=/home/zuul/src/github.com/osism/ansible-collection-services/molecule/delegated/tests 2026-07-20 09:54:02.358303 | ubuntu-noble | writing pytest debug information to pytestdebug.log 2026-07-20 09:54:02.376685 | ubuntu-noble | ============================= test session starts ============================== 2026-07-20 09:54:02.376725 | ubuntu-noble | platform linux -- Python 3.12.3, pytest-9.1.1, pluggy-1.6.0 -- /home/zuul/venv/bin/python3 2026-07-20 09:54:02.376732 | ubuntu-noble | using: pytest-9.1.1 2026-07-20 09:54:02.376737 | ubuntu-noble | registered third-party plugins: 2026-07-20 09:54:02.376748 | ubuntu-noble | pytest-testinfra-10.2.2 at /home/zuul/venv/lib/python3.12/site-packages/testinfra/plugin.py 2026-07-20 09:54:02.376910 | ubuntu-noble | rootdir: /home/zuul 2026-07-20 09:54:02.377059 | ubuntu-noble | plugins: testinfra-10.2.2 2026-07-20 09:54:02.853157 | debian-bookworm | collecting ... collected 6 items 2026-07-20 09:54:02.853503 | debian-bookworm | 2026-07-20 09:54:03.839341 | ubuntu-noble | collecting ... collected 6 items 2026-07-20 09:54:03.839413 | ubuntu-noble | 2026-07-20 09:54:07.803904 | debian-bookworm | tests/auditd.py::test_pkg[ansible://molecule-auditd] PASSED [ 16%] 2026-07-20 09:54:07.848099 | debian-bookworm | tests/auditd.py::test_conffile[ansible://molecule-auditd] PASSED [ 33%] 2026-07-20 09:54:09.863257 | ubuntu-noble | tests/auditd.py::test_pkg[ansible://molecule-auditd] PASSED [ 16%] 2026-07-20 09:54:09.904002 | ubuntu-noble | tests/auditd.py::test_conffile[ansible://molecule-auditd] PASSED [ 33%] 2026-07-20 09:54:10.710143 | debian-bookworm | tests/auditd.py::test_adjustment[ansible://molecule-auditd] PASSED [ 50%] 2026-07-20 09:54:13.566871 | ubuntu-noble | tests/auditd.py::test_adjustment[ansible://molecule-auditd] PASSED [ 50%] 2026-07-20 09:54:16.519687 | debian-bookworm | tests/auditd.py::test_rulefiles[ansible://molecule-auditd] PASSED [ 66%] 2026-07-20 09:54:17.975807 | debian-bookworm | tests/auditd.py::test_srv[ansible://molecule-auditd] PASSED [ 83%] 2026-07-20 09:54:18.024149 | debian-bookworm | wrote pytest debug information to pytestdebug.log 2026-07-20 09:54:18.024958 | debian-bookworm | tests/auditd.py::test_function[ansible://molecule-auditd] PASSED [100%] 2026-07-20 09:54:18.025169 | debian-bookworm | 2026-07-20 09:54:18.025356 | debian-bookworm | ============================== 6 passed in 16.37s ============================== 2026-07-20 09:54:18.075888 | debian-bookworm | INFO [delegated > verify] Verifier completed successfully. 2026-07-20 09:54:18.076004 | debian-bookworm | INFO [delegated > verify] Executed: Successful 2026-07-20 09:54:18.076384 | debian-bookworm | INFO Molecule executed 1 scenario (1 successful) 2026-07-20 09:54:18.076404 | debian-bookworm | 2026-07-20 09:54:18.076416 | debian-bookworm | DETAILS 2026-07-20 09:54:18.076432 | debian-bookworm | delegated > verify: Executed: Successful 2026-07-20 09:54:18.076447 | debian-bookworm | 2026-07-20 09:54:18.076532 | debian-bookworm | SCENARIO RECAP 2026-07-20 09:54:18.076546 | debian-bookworm | delegated : actions=1 successful=0 disabled=0 skipped=0 missing=0 failed=0 2026-07-20 09:54:18.076561 | debian-bookworm | 2026-07-20 09:54:18.491647 | debian-bookworm | ok: Runtime: 0:00:19.362839 2026-07-20 09:54:19.626686 | ubuntu-noble | tests/auditd.py::test_rulefiles[ansible://molecule-auditd] PASSED [ 66%] 2026-07-20 09:54:21.421868 | ubuntu-noble | ok: Runtime: 0:00:22.486676 2026-07-20 09:54:21.429532 | 2026-07-20 09:54:21.429673 | TASK [ansible-molecule : Run molecule destroy action with scenario delegated] 2026-07-20 09:54:21.197553 | ubuntu-noble | tests/auditd.py::test_srv[ansible://molecule-auditd] PASSED [ 83%] 2026-07-20 09:54:21.259694 | ubuntu-noble | wrote pytest debug information to pytestdebug.log 2026-07-20 09:54:21.261403 | ubuntu-noble | tests/auditd.py::test_function[ansible://molecule-auditd] PASSED [100%] 2026-07-20 09:54:21.261497 | ubuntu-noble | 2026-07-20 09:54:21.261515 | ubuntu-noble | ============================== 6 passed in 18.86s ============================== 2026-07-20 09:54:21.306701 | ubuntu-noble | INFO [delegated > verify] Verifier completed successfully. 2026-07-20 09:54:21.306789 | ubuntu-noble | INFO [delegated > verify] Executed: Successful 2026-07-20 09:54:21.306811 | ubuntu-noble | INFO Molecule executed 1 scenario (1 successful) 2026-07-20 09:54:21.306870 | ubuntu-noble | 2026-07-20 09:54:21.306929 | ubuntu-noble | DETAILS 2026-07-20 09:54:21.307087 | ubuntu-noble | delegated > verify: Executed: Successful 2026-07-20 09:54:21.307141 | ubuntu-noble | 2026-07-20 09:54:21.307383 | ubuntu-noble | SCENARIO RECAP 2026-07-20 09:54:21.307475 | ubuntu-noble | delegated : actions=1 successful=0 disabled=0 skipped=0 missing=0 failed=0 2026-07-20 09:54:21.307502 | ubuntu-noble | 2026-07-20 09:54:22.001109 | debian-bookworm | skipping: Conditional result was False 2026-07-20 09:54:22.001887 | ubuntu-noble | skipping: Conditional result was False 2026-07-20 09:54:22.021071 | 2026-07-20 09:54:22.021183 | PLAY RECAP 2026-07-20 09:54:22.021242 | debian-bookworm | ok: 17 changed: 12 unreachable: 0 failed: 0 skipped: 16 rescued: 0 ignored: 0 2026-07-20 09:54:22.021276 | ubuntu-noble | ok: 17 changed: 12 unreachable: 0 failed: 0 skipped: 16 rescued: 0 ignored: 0 2026-07-20 09:54:22.021299 | 2026-07-20 09:54:22.236977 | RUN END RESULT_NORMAL: [untrusted : github.com/osism/zuul-jobs/playbooks/ansible-molecule/run.yaml@main] 2026-07-20 09:54:22.239306 | POST-RUN START: [trusted : github.com/osism/zuul-config/playbooks/base/post-fetch.yaml@main] 2026-07-20 09:54:23.161423 | 2026-07-20 09:54:23.161641 | PLAY [Base post-fetch] 2026-07-20 09:54:23.177660 | 2026-07-20 09:54:23.177836 | TASK [diagnose-network : Ensure log directory exists] 2026-07-20 09:54:23.872845 | ubuntu-noble | ok 2026-07-20 09:54:23.901790 | debian-bookworm | ok 2026-07-20 09:54:23.911452 | 2026-07-20 09:54:23.911659 | TASK [diagnose-network : Snapshot dual-stack network state (post)] 2026-07-20 09:54:35.761249 | debian-bookworm | ok: Runtime: 0:00:05.869817 2026-07-20 09:54:35.767721 | ubuntu-noble | ok: Runtime: 0:00:05.838456 2026-07-20 09:54:35.774018 | 2026-07-20 09:54:35.774186 | TASK [diagnose-network : Snapshot Docker/BuildKit IPv6 config (teardown)] 2026-07-20 09:54:41.852302 | debian-bookworm | ok: Runtime: 0:00:00.009453 2026-07-20 09:54:41.883323 | ubuntu-noble | ok: Runtime: 0:00:00.005115 2026-07-20 09:54:41.892029 | 2026-07-20 09:54:41.892199 | TASK [diagnose-network : Probe container network namespace (teardown)] 2026-07-20 09:54:47.920055 | debian-bookworm | ok: Runtime: 0:00:00.007478 2026-07-20 09:54:47.940938 | ubuntu-noble | ok: Runtime: 0:00:00.010476 2026-07-20 09:54:47.958586 | 2026-07-20 09:54:47.958743 | TASK [fetch-output : Set log path for multiple nodes] 2026-07-20 09:54:48.028633 | debian-bookworm | ok 2026-07-20 09:54:48.037809 | ubuntu-noble | ok 2026-07-20 09:54:48.047333 | 2026-07-20 09:54:48.047454 | TASK [fetch-output : Set log path for single node] 2026-07-20 09:54:48.074434 | debian-bookworm | skipping: Conditional result was False 2026-07-20 09:54:48.085988 | ubuntu-noble | skipping: Conditional result was False 2026-07-20 09:54:48.101308 | 2026-07-20 09:54:48.101529 | LOOP [fetch-output : Ensure local output dirs] 2026-07-20 09:54:48.394858 | debian-bookworm -> localhost | changed: "/var/lib/zuul/builds/b862409980db4f3f8cced97a2b0fd663/work/logs/debian-bookworm" 2026-07-20 09:54:48.413535 | ubuntu-noble -> localhost | changed: "/var/lib/zuul/builds/b862409980db4f3f8cced97a2b0fd663/work/logs/ubuntu-noble" 2026-07-20 09:54:48.679197 | debian-bookworm -> localhost | changed: "/var/lib/zuul/builds/b862409980db4f3f8cced97a2b0fd663/work/artifacts" 2026-07-20 09:54:48.717746 | ubuntu-noble -> localhost | ok: "/var/lib/zuul/builds/b862409980db4f3f8cced97a2b0fd663/work/artifacts" 2026-07-20 09:54:48.986988 | debian-bookworm -> localhost | changed: "/var/lib/zuul/builds/b862409980db4f3f8cced97a2b0fd663/work/docs" 2026-07-20 09:54:49.007344 | ubuntu-noble -> localhost | ok: "/var/lib/zuul/builds/b862409980db4f3f8cced97a2b0fd663/work/docs" 2026-07-20 09:54:49.007492 | ubuntu-noble -> localhost | changed: All items complete 2026-07-20 09:54:49.007526 | 2026-07-20 09:54:49.022621 | 2026-07-20 09:54:49.022794 | LOOP [fetch-output : Collect logs, artifacts and docs] 2026-07-20 09:54:49.865684 | ubuntu-noble | changed: 2026-07-20 09:54:49.865986 | ubuntu-noble | .d..t...... ./ 2026-07-20 09:54:49.866021 | ubuntu-noble | >f+++++++++ net-debug.post.txt 2026-07-20 09:54:49.866045 | ubuntu-noble | >f+++++++++ net-debug.pre.txt 2026-07-20 09:54:49.866067 | ubuntu-noble | >f+++++++++ sudo-debug.txt 2026-07-20 09:54:49.866090 | ubuntu-noble | >f+++++++++ sudo-strace.log 2026-07-20 09:54:49.866111 | ubuntu-noble | >f+++++++++ sudo-strace.log.time 2026-07-20 09:54:49.883126 | debian-bookworm | changed: 2026-07-20 09:54:49.883259 | debian-bookworm | .d..t...... ./ 2026-07-20 09:54:49.883291 | debian-bookworm | >f+++++++++ net-debug.post.txt 2026-07-20 09:54:49.883314 | debian-bookworm | >f+++++++++ net-debug.pre.txt 2026-07-20 09:54:49.883335 | debian-bookworm | >f+++++++++ sudo-debug.txt 2026-07-20 09:54:49.883355 | debian-bookworm | >f+++++++++ sudo-strace.log 2026-07-20 09:54:49.883374 | debian-bookworm | >f+++++++++ sudo-strace.log.time 2026-07-20 09:54:50.458642 | debian-bookworm | ok 2026-07-20 09:54:50.466077 | ubuntu-noble | changed: .d..t...... ./ 2026-07-20 09:54:51.072091 | debian-bookworm | ok 2026-07-20 09:54:51.079689 | ubuntu-noble | changed: .d..t...... ./ 2026-07-20 09:54:51.113311 | 2026-07-20 09:54:51.113520 | LOOP [merge-output-to-logs : Move artifacts and docs to logs dir] 2026-07-20 09:54:51.538102 | debian-bookworm -> localhost | ok: Item: artifacts Runtime: 0:00:00.008580 2026-07-20 09:54:51.538450 | debian-bookworm -> localhost | changed: All items complete 2026-07-20 09:54:51.538500 | 2026-07-20 09:54:51.934815 | debian-bookworm -> localhost | ok: Item: docs Runtime: 0:00:00.009122 2026-07-20 09:54:51.948652 | 2026-07-20 09:54:51.948777 | PLAY RECAP 2026-07-20 09:54:51.948840 | debian-bookworm | ok: 8 changed: 3 unreachable: 0 failed: 0 skipped: 1 rescued: 0 ignored: 0 2026-07-20 09:54:51.948875 | ubuntu-noble | ok: 7 changed: 2 unreachable: 0 failed: 0 skipped: 1 rescued: 0 ignored: 0 2026-07-20 09:54:51.948897 | 2026-07-20 09:54:52.104457 | POST-RUN END RESULT_NORMAL: [trusted : github.com/osism/zuul-config/playbooks/base/post-fetch.yaml@main] 2026-07-20 09:54:52.106234 | POST-RUN START: [trusted : github.com/osism/zuul-config/playbooks/base/post.yaml@main] 2026-07-20 09:54:52.883236 | 2026-07-20 09:54:52.883444 | PLAY [Base post] 2026-07-20 09:54:52.907963 | 2026-07-20 09:54:52.908260 | TASK [remove-build-sshkey : Remove the build SSH key from all nodes] 2026-07-20 09:54:53.729454 | debian-bookworm | changed 2026-07-20 09:54:53.860198 | ubuntu-noble | changed 2026-07-20 09:54:53.874687 | 2026-07-20 09:54:53.874822 | PLAY RECAP 2026-07-20 09:54:53.874942 | debian-bookworm | ok: 1 changed: 1 unreachable: 0 failed: 0 skipped: 0 rescued: 0 ignored: 0 2026-07-20 09:54:53.874983 | ubuntu-noble | ok: 1 changed: 1 unreachable: 0 failed: 0 skipped: 0 rescued: 0 ignored: 0 2026-07-20 09:54:53.875008 | 2026-07-20 09:54:54.037655 | POST-RUN END RESULT_NORMAL: [trusted : github.com/osism/zuul-config/playbooks/base/post.yaml@main] 2026-07-20 09:54:54.041125 | POST-RUN START: [trusted : github.com/osism/zuul-config/playbooks/base/post-logs.yaml@main] 2026-07-20 09:54:54.848405 | 2026-07-20 09:54:54.848610 | PLAY [Base post-logs] 2026-07-20 09:54:54.859956 | 2026-07-20 09:54:54.860096 | TASK [generate-zuul-manifest : Generate Zuul manifest] 2026-07-20 09:54:55.375337 | localhost | changed 2026-07-20 09:54:55.395589 | 2026-07-20 09:54:55.395831 | TASK [generate-zuul-manifest : Return Zuul manifest URL to Zuul] 2026-07-20 09:54:55.433703 | localhost | ok 2026-07-20 09:54:55.437512 | 2026-07-20 09:54:55.437679 | TASK [Set zuul-log-path fact] 2026-07-20 09:54:55.457791 | localhost | ok 2026-07-20 09:54:55.469177 | 2026-07-20 09:54:55.469321 | TASK [set-zuul-log-path-fact : Set log path for a build] 2026-07-20 09:54:55.510087 | localhost | ok 2026-07-20 09:54:55.516764 | 2026-07-20 09:54:55.516933 | TASK [upload-logs : Create log directories] 2026-07-20 09:54:56.069218 | localhost | changed 2026-07-20 09:54:56.076955 | 2026-07-20 09:54:56.077179 | TASK [upload-logs : Ensure logs are readable before uploading] 2026-07-20 09:54:56.621806 | localhost -> localhost | ok: Runtime: 0:00:00.013505 2026-07-20 09:54:56.626738 | 2026-07-20 09:54:56.626893 | TASK [upload-logs : Upload logs to log server] 2026-07-20 09:54:57.223400 | localhost | Output suppressed because no_log was given 2026-07-20 09:54:57.225589 | 2026-07-20 09:54:57.225726 | LOOP [upload-logs : Compress console log and json output] 2026-07-20 09:54:57.282099 | localhost | skipping: Conditional result was False 2026-07-20 09:54:57.287680 | localhost | skipping: Conditional result was False 2026-07-20 09:54:57.298032 | 2026-07-20 09:54:57.298191 | LOOP [upload-logs : Upload compressed console log and json output] 2026-07-20 09:54:57.362952 | localhost | skipping: Conditional result was False 2026-07-20 09:54:57.363403 | 2026-07-20 09:54:57.366630 | localhost | skipping: Conditional result was False 2026-07-20 09:54:57.379035 | 2026-07-20 09:54:57.379160 | LOOP [upload-logs : Upload console log and json output]