2026-06-19 15:41:39.235271 | Job console starting 2026-06-19 15:41:39.269990 | Updating git repos 2026-06-19 15:41:39.709107 | Cloning repos into workspace 2026-06-19 15:41:39.770775 | Restoring repo states 2026-06-19 15:41:39.800483 | Merging changes 2026-06-19 15:41:40.435098 | Checking out repos 2026-06-19 15:41:40.497454 | Preparing playbooks 2026-06-19 15:41:41.473385 | Running Ansible setup 2026-06-19 15:41:47.481066 | PRE-RUN START: [trusted : github.com/osism/zuul-config/playbooks/base/pre.yaml@main] 2026-06-19 15:41:48.305429 | 2026-06-19 15:41:48.305601 | PLAY [Base pre] 2026-06-19 15:41:48.324951 | 2026-06-19 15:41:48.325114 | TASK [Setup log path fact] 2026-06-19 15:41:48.347148 | debian-bookworm | ok 2026-06-19 15:41:48.362798 | 2026-06-19 15:41:48.362996 | TASK [set-zuul-log-path-fact : Set log path for a build] 2026-06-19 15:41:48.392028 | debian-bookworm | ok 2026-06-19 15:41:48.402136 | 2026-06-19 15:41:48.402319 | TASK [emit-job-header : Print job information] 2026-06-19 15:41:48.445378 | # Job Information 2026-06-19 15:41:48.445647 | Ansible Version: 2.16.14 2026-06-19 15:41:48.445685 | Job: ansible-collection-services-molecule-auditd 2026-06-19 15:41:48.445729 | Pipeline: check 2026-06-19 15:41:48.445758 | Executor: 521e9411259a 2026-06-19 15:41:48.445779 | Triggered by: https://github.com/osism/ansible-collection-services/pull/2117 2026-06-19 15:41:48.445803 | Event ID: 54314270-6bf5-11f1-8efe-63c3824719ab 2026-06-19 15:41:48.453537 | 2026-06-19 15:41:48.453680 | LOOP [emit-job-header : Print node information] 2026-06-19 15:41:48.580411 | debian-bookworm | ok: 2026-06-19 15:41:48.580971 | debian-bookworm | # Node Information 2026-06-19 15:41:48.581046 | debian-bookworm | Inventory Hostname: debian-bookworm 2026-06-19 15:41:48.581078 | debian-bookworm | Hostname: debian 2026-06-19 15:41:48.581127 | debian-bookworm | Username: zuul 2026-06-19 15:41:48.581357 | debian-bookworm | Distro: Debian 12.14 2026-06-19 15:41:48.581417 | debian-bookworm | Provider: regiocloud-a 2026-06-19 15:41:48.581454 | debian-bookworm | Region: 2026-06-19 15:41:48.581481 | debian-bookworm | Label: debian-bookworm 2026-06-19 15:41:48.581506 | debian-bookworm | Product Name: OpenStack Nova 2026-06-19 15:41:48.581530 | debian-bookworm | Interface IP: 2a13:1a81:8000:3124:f816:3eff:fe97:7055 2026-06-19 15:41:48.628521 | debian-bookworm | ok: 2026-06-19 15:41:48.628728 | debian-bookworm | # Node Information 2026-06-19 15:41:48.628794 | debian-bookworm | Inventory Hostname: ubuntu-noble 2026-06-19 15:41:48.628874 | debian-bookworm | Hostname: ubuntu 2026-06-19 15:41:48.628921 | debian-bookworm | Username: zuul 2026-06-19 15:41:48.628954 | debian-bookworm | Distro: Ubuntu 24.04 2026-06-19 15:41:48.628983 | debian-bookworm | Provider: regiocloud-a 2026-06-19 15:41:48.629356 | debian-bookworm | Region: 2026-06-19 15:41:48.629407 | debian-bookworm | Label: ubuntu-noble 2026-06-19 15:41:48.629448 | debian-bookworm | Product Name: OpenStack Nova 2026-06-19 15:41:48.629478 | debian-bookworm | Interface IP: 2a13:1a81:8000:3124:f816:3eff:fe1d:8a55 2026-06-19 15:41:48.657061 | 2026-06-19 15:41:48.657265 | TASK [log-inventory : Ensure Zuul Ansible directory exists] 2026-06-19 15:41:49.193774 | debian-bookworm -> localhost | changed 2026-06-19 15:41:49.203766 | 2026-06-19 15:41:49.203912 | TASK [log-inventory : Copy ansible inventory to logs dir] 2026-06-19 15:41:50.468213 | ubuntu-noble -> localhost | changed 2026-06-19 15:41:50.481851 | debian-bookworm -> localhost | ok 2026-06-19 15:41:50.501404 | 2026-06-19 15:41:50.501586 | TASK [add-build-sshkey : Check to see if ssh key was already created for this build] 2026-06-19 15:41:50.835310 | debian-bookworm -> localhost | ok 2026-06-19 15:41:50.851991 | 2026-06-19 15:41:50.852159 | TASK [add-build-sshkey : Create a new key in workspace based on build UUID] 2026-06-19 15:41:50.881605 | debian-bookworm | ok 2026-06-19 15:41:50.898732 | ubuntu-noble | ok 2026-06-19 15:41:50.927553 | debian-bookworm | included: /var/lib/zuul/builds/bff939a964774a62ba18a41d490c3f3f/trusted/project_1/github.com/osism/openinfra-zuul-jobs/roles/add-build-sshkey/tasks/create-key-and-replace.yaml 2026-06-19 15:41:50.927695 | ubuntu-noble | included: /var/lib/zuul/builds/bff939a964774a62ba18a41d490c3f3f/trusted/project_1/github.com/osism/openinfra-zuul-jobs/roles/add-build-sshkey/tasks/create-key-and-replace.yaml 2026-06-19 15:41:50.936594 | 2026-06-19 15:41:50.936732 | TASK [add-build-sshkey : Create Temp SSH key] 2026-06-19 15:41:51.877211 | debian-bookworm -> localhost | Generating public/private rsa key pair. 2026-06-19 15:41:51.877555 | debian-bookworm -> localhost | Your identification has been saved in /var/lib/zuul/builds/bff939a964774a62ba18a41d490c3f3f/work/bff939a964774a62ba18a41d490c3f3f_id_rsa 2026-06-19 15:41:51.877597 | debian-bookworm -> localhost | Your public key has been saved in /var/lib/zuul/builds/bff939a964774a62ba18a41d490c3f3f/work/bff939a964774a62ba18a41d490c3f3f_id_rsa.pub 2026-06-19 15:41:51.877626 | debian-bookworm -> localhost | The key fingerprint is: 2026-06-19 15:41:51.877653 | debian-bookworm -> localhost | SHA256:yBq3kxEERMC2T6qJBbw45JRPL/2NqcXHA86UheN8Plc zuul-build-sshkey 2026-06-19 15:41:51.877679 | debian-bookworm -> localhost | The key's randomart image is: 2026-06-19 15:41:51.877706 | debian-bookworm -> localhost | +---[RSA 3072]----+ 2026-06-19 15:41:51.877729 | debian-bookworm -> localhost | | ..++.. | 2026-06-19 15:41:51.877752 | debian-bookworm -> localhost | | o . . | 2026-06-19 15:41:51.877774 | debian-bookworm -> localhost | |.... .o . | 2026-06-19 15:41:51.877795 | debian-bookworm -> localhost | |.=....oo+ | 2026-06-19 15:41:51.877816 | debian-bookworm -> localhost | |=.+++ =*S. E | 2026-06-19 15:41:51.877836 | debian-bookworm -> localhost | |oooo.*=+= . | 2026-06-19 15:41:51.877856 | debian-bookworm -> localhost | |.= o ==+* . | 2026-06-19 15:41:51.877878 | debian-bookworm -> localhost | |+ .=..+ | 2026-06-19 15:41:51.877899 | debian-bookworm -> localhost | | .. | 2026-06-19 15:41:51.877920 | debian-bookworm -> localhost | +----[SHA256]-----+ 2026-06-19 15:41:51.877975 | debian-bookworm -> localhost | ok: Runtime: 0:00:00.317020 2026-06-19 15:41:51.885161 | 2026-06-19 15:41:51.885331 | TASK [add-build-sshkey : Remote setup ssh keys (linux)] 2026-06-19 15:41:51.920517 | debian-bookworm | ok 2026-06-19 15:41:51.935518 | ubuntu-noble | ok 2026-06-19 15:41:51.949943 | debian-bookworm | included: /var/lib/zuul/builds/bff939a964774a62ba18a41d490c3f3f/trusted/project_1/github.com/osism/openinfra-zuul-jobs/roles/add-build-sshkey/tasks/remote-linux.yaml 2026-06-19 15:41:51.950061 | ubuntu-noble | included: /var/lib/zuul/builds/bff939a964774a62ba18a41d490c3f3f/trusted/project_1/github.com/osism/openinfra-zuul-jobs/roles/add-build-sshkey/tasks/remote-linux.yaml 2026-06-19 15:41:51.961646 | 2026-06-19 15:41:51.961771 | TASK [add-build-sshkey : Remove previously added zuul-build-sshkey] 2026-06-19 15:41:51.988662 | debian-bookworm | skipping: Conditional result was False 2026-06-19 15:41:52.000986 | ubuntu-noble | skipping: Conditional result was False 2026-06-19 15:41:52.016080 | 2026-06-19 15:41:52.016306 | TASK [add-build-sshkey : Enable access via build key on all nodes] 2026-06-19 15:41:52.759267 | debian-bookworm | changed 2026-06-19 15:41:52.812709 | ubuntu-noble | changed 2026-06-19 15:41:52.822249 | 2026-06-19 15:41:52.822414 | TASK [add-build-sshkey : Make sure user has a .ssh] 2026-06-19 15:41:53.111591 | debian-bookworm | ok 2026-06-19 15:41:53.129570 | ubuntu-noble | ok 2026-06-19 15:41:53.145945 | 2026-06-19 15:41:53.146335 | TASK [add-build-sshkey : Install build private key as SSH key on all nodes] 2026-06-19 15:41:53.883559 | debian-bookworm | changed 2026-06-19 15:41:53.968899 | ubuntu-noble | changed 2026-06-19 15:41:53.981912 | 2026-06-19 15:41:53.982109 | TASK [add-build-sshkey : Install build public key as SSH key on all nodes] 2026-06-19 15:41:54.752330 | debian-bookworm | changed 2026-06-19 15:41:54.757209 | ubuntu-noble | changed 2026-06-19 15:41:54.762647 | 2026-06-19 15:41:54.762753 | TASK [add-build-sshkey : Remote setup ssh keys (windows)] 2026-06-19 15:41:54.791537 | debian-bookworm | skipping: Conditional result was False 2026-06-19 15:41:54.812871 | ubuntu-noble | skipping: Conditional result was False 2026-06-19 15:41:54.819967 | 2026-06-19 15:41:54.820096 | TASK [remove-zuul-sshkey : Remove master key from local agent] 2026-06-19 15:41:55.356573 | debian-bookworm -> localhost | changed 2026-06-19 15:41:55.383537 | 2026-06-19 15:41:55.383717 | TASK [add-build-sshkey : Add back temp key] 2026-06-19 15:41:55.732253 | debian-bookworm -> localhost | Identity added: /var/lib/zuul/builds/bff939a964774a62ba18a41d490c3f3f/work/bff939a964774a62ba18a41d490c3f3f_id_rsa (zuul-build-sshkey) 2026-06-19 15:41:55.732879 | debian-bookworm -> localhost | ok: Runtime: 0:00:00.018764 2026-06-19 15:41:55.753152 | 2026-06-19 15:41:55.753677 | TASK [add-build-sshkey : Verify we can still SSH to all nodes] 2026-06-19 15:41:56.176583 | debian-bookworm | ok 2026-06-19 15:41:56.231860 | ubuntu-noble | ok 2026-06-19 15:41:56.242800 | 2026-06-19 15:41:56.243054 | TASK [add-build-sshkey : Verify we can still SSH to all nodes (windows)] 2026-06-19 15:41:56.271308 | debian-bookworm | skipping: Conditional result was False 2026-06-19 15:41:56.292732 | ubuntu-noble | skipping: Conditional result was False 2026-06-19 15:41:56.320610 | 2026-06-19 15:41:56.320788 | TASK [start-zuul-console : Start zuul_console daemon.] 2026-06-19 15:41:56.784268 | debian-bookworm | ok 2026-06-19 15:41:56.821740 | ubuntu-noble | ok 2026-06-19 15:41:56.866799 | 2026-06-19 15:41:56.867168 | TASK [validate-host : Define zuul_info_dir fact] 2026-06-19 15:41:56.913595 | debian-bookworm | ok 2026-06-19 15:41:56.932831 | ubuntu-noble | ok 2026-06-19 15:41:56.943635 | 2026-06-19 15:41:56.943790 | TASK [validate-host : Ensure Zuul Ansible directory exists] 2026-06-19 15:41:57.286727 | debian-bookworm -> localhost | ok 2026-06-19 15:41:57.293887 | 2026-06-19 15:41:57.294002 | TASK [validate-host : Collect information about the host] 2026-06-19 15:41:58.520569 | debian-bookworm | ok 2026-06-19 15:41:58.545209 | ubuntu-noble | ok 2026-06-19 15:41:58.555942 | 2026-06-19 15:41:58.556097 | TASK [validate-host : Sanitize hostname] 2026-06-19 15:41:58.622015 | debian-bookworm | ok 2026-06-19 15:41:58.640984 | ubuntu-noble | ok 2026-06-19 15:41:58.647736 | 2026-06-19 15:41:58.647904 | TASK [validate-host : Write out all ansible variables/facts known for each host] 2026-06-19 15:41:59.359487 | debian-bookworm -> localhost | changed 2026-06-19 15:41:59.391704 | ubuntu-noble -> localhost | changed 2026-06-19 15:41:59.398784 | 2026-06-19 15:41:59.398967 | TASK [validate-host : Collect information about zuul worker] 2026-06-19 15:41:59.900852 | debian-bookworm | ok 2026-06-19 15:41:59.953483 | ubuntu-noble | ok 2026-06-19 15:41:59.959815 | 2026-06-19 15:41:59.959960 | TASK [validate-host : Write out all zuul information for each host] 2026-06-19 15:42:00.594427 | debian-bookworm -> localhost | changed 2026-06-19 15:42:00.637171 | ubuntu-noble -> localhost | changed 2026-06-19 15:42:00.651078 | 2026-06-19 15:42:00.651207 | TASK [prepare-workspace-log : Start zuul_console daemon.] 2026-06-19 15:42:00.964785 | debian-bookworm | ok 2026-06-19 15:42:00.991062 | ubuntu-noble | ok 2026-06-19 15:42:00.997065 | 2026-06-19 15:42:00.997174 | TASK [prepare-workspace-log : Synchronize src repos to workspace directory.] 2026-06-19 15:42:02.369533 | ubuntu-noble | changed: 2026-06-19 15:42:02.369809 | ubuntu-noble | cd+++++++++ src/ 2026-06-19 15:42:02.369845 | ubuntu-noble | cd+++++++++ src/github.com/ 2026-06-19 15:42:02.369869 | ubuntu-noble | cd+++++++++ src/github.com/osism/ 2026-06-19 15:42:02.369891 | ubuntu-noble | cd+++++++++ src/github.com/osism/ansible-collection-services/ 2026-06-19 15:42:02.369911 | ubuntu-noble | config] provisioner.env found in /home/zuul/src/github.com/osism/ansible-collection-services/molecule/delegated/molecule.yml, this can be defined in ansible.env 2026-06-19 15:43:47.359201 | ubuntu-noble | WARNING Molecule scenarios should migrate to 'extensions/molecule' 2026-06-19 15:43:47.399191 | ubuntu-noble | DEBUG [unknown > config] provisioner.env found in /home/zuul/src/github.com/osism/ansible-collection-services/molecule/delegated/molecule.yml, this can be defined in ansible.env 2026-06-19 15:43:48.080826 | debian-bookworm | DEBUG [unknown > config] provisioner.env found in /home/zuul/src/github.com/osism/ansible-collection-services/molecule/delegated/molecule.yml, this can be defined in ansible.env 2026-06-19 15:43:48.081469 | debian-bookworm | DEBUG [delegated > validate] Validating schema /home/zuul/src/github.com/osism/ansible-collection-services/molecule/delegated/molecule.yml. 2026-06-19 15:43:48.102382 | debian-bookworm | DEBUG [default > validate] Validating schema /home/zuul/src/github.com/osism/ansible-collection-services/molecule/default/molecule.yml. 2026-06-19 15:43:48.108607 | debian-bookworm | INFO [delegated > discovery] scenario test matrix: dependency 2026-06-19 15:43:48.108729 | debian-bookworm | INFO [delegated > prerun] Performing prerun with role_name_check=0... 2026-06-19 15:43:48.143390 | ubuntu-noble | DEBUG [unknown > config] provisioner.env found in /home/zuul/src/github.com/osism/ansible-collection-services/molecule/delegated/molecule.yml, this can be defined in ansible.env 2026-06-19 15:43:48.144045 | ubuntu-noble | DEBUG [delegated > validate] Validating schema /home/zuul/src/github.com/osism/ansible-collection-services/molecule/delegated/molecule.yml. 2026-06-19 15:43:48.179095 | ubuntu-noble | DEBUG [default > validate] Validating schema /home/zuul/src/github.com/osism/ansible-collection-services/molecule/default/molecule.yml. 2026-06-19 15:43:48.186213 | ubuntu-noble | INFO [delegated > discovery] scenario test matrix: dependency 2026-06-19 15:43:48.186310 | ubuntu-noble | INFO [delegated > prerun] Performing prerun with role_name_check=0... 2026-06-19 15:43:49.345373 | debian-bookworm | INFO [delegated > dependency] Executing 2026-06-19 15:43:49.345739 | debian-bookworm | WARNING [delegated > dependency] Missing roles requirements file: requirements.yml 2026-06-19 15:43:49.757888 | debian-bookworm | ansible-galaxy [core 2.19.11] 2026-06-19 15:43:49.758380 | debian-bookworm | config file = None 2026-06-19 15:43:49.758810 | debian-bookworm | configured module search path = ['/home/zuul/src/github.com/osism/ansible-collection-services/plugins/modules', '/home/zuul/.ansible/plugins/modules', '/usr/share/ansible/plugins/modules'] 2026-06-19 15:43:49.759355 | debian-bookworm | ansible python module location = /home/zuul/venv/lib/python3.11/site-packages/ansible 2026-06-19 15:43:49.759762 | debian-bookworm | ansible collection location = /home/zuul/.ansible/collections:/usr/share/ansible/collections:/home/zuul/venv/lib/python3.11/site-packages:/home/zuul/venv/lib/python3.11/dist-packages:/home/zuul/venv/lib/python3/dist-packages:/home/zuul/venv/local/lib/python3.11/dist-packages 2026-06-19 15:43:49.760157 | debian-bookworm | executable location = /home/zuul/venv/bin/ansible-galaxy 2026-06-19 15:43:49.760483 | debian-bookworm | python version = 3.11.2 (main, Apr 8 2026, 01:58:00) [GCC 12.2.0] (/home/zuul/venv/bin/python3) 2026-06-19 15:43:49.760872 | debian-bookworm | jinja version = 3.1.6 2026-06-19 15:43:49.761189 | debian-bookworm | pyyaml version = 6.0.3 (with libyaml v0.2.5) 2026-06-19 15:43:49.761480 | debian-bookworm | No config file found; using defaults 2026-06-19 15:43:49.761944 | debian-bookworm | Reading requirement file at '/home/zuul/src/github.com/osism/ansible-collection-services/molecule/delegated/collections.yml' 2026-06-19 15:43:49.764001 | debian-bookworm | Loading collection ansible._protomatter from /home/zuul/venv/lib/python3.11/site-packages/ansible/_internal/ansible_collections/ansible/_protomatter 2026-06-19 15:43:49.764363 | debian-bookworm | Found installed collection ansible._protomatter:2.19.11 at '/home/zuul/venv/lib/python3.11/site-packages/ansible/_internal/ansible_collections/ansible/_protomatter' 2026-06-19 15:43:49.771079 | debian-bookworm | Loading collection dellemc.enterprise_sonic from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/dellemc/enterprise_sonic 2026-06-19 15:43:49.771524 | debian-bookworm | Found installed collection dellemc.enterprise_sonic:3.2.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/dellemc/enterprise_sonic' 2026-06-19 15:43:49.771936 | debian-bookworm | Loading collection hitachivantara.vspone_block from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/hitachivantara/vspone_block 2026-06-19 15:43:49.772357 | debian-bookworm | Found installed collection hitachivantara.vspone_block:4.4.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/hitachivantara/vspone_block' 2026-06-19 15:43:49.772747 | debian-bookworm | Loading collection containers.podman from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/containers/podman 2026-06-19 15:43:49.773055 | debian-bookworm | Found installed collection containers.podman:1.18.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/containers/podman' 2026-06-19 15:43:49.775707 | debian-bookworm | Loading collection fortinet.fortios from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/fortinet/fortios 2026-06-19 15:43:49.776108 | debian-bookworm | Found installed collection fortinet.fortios:2.4.2 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/fortinet/fortios' 2026-06-19 15:43:49.776483 | debian-bookworm | Loading collection community.proxmox from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/proxmox 2026-06-19 15:43:49.776854 | debian-bookworm | Found installed collection community.proxmox:1.4.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/proxmox' 2026-06-19 15:43:49.777384 | debian-bookworm | Loading collection splunk.es from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/splunk/es 2026-06-19 15:43:49.777759 | debian-bookworm | Found installed collection splunk.es:4.0.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/splunk/es' 2026-06-19 15:43:49.778296 | debian-bookworm | Loading collection dellemc.unity from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/dellemc/unity 2026-06-19 15:43:49.778629 | debian-bookworm | Found installed collection dellemc.unity:2.1.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/dellemc/unity' 2026-06-19 15:43:49.783083 | debian-bookworm | Loading collection fortinet.fortimanager from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/fortinet/fortimanager 2026-06-19 15:43:49.783467 | debian-bookworm | Found installed collection fortinet.fortimanager:2.11.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/fortinet/fortimanager' 2026-06-19 15:43:49.783827 | debian-bookworm | Loading collection community.ciscosmb from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/ciscosmb 2026-06-19 15:43:49.784162 | debian-bookworm | Found installed collection community.ciscosmb:1.0.11 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/ciscosmb' 2026-06-19 15:43:49.784484 | debian-bookworm | Loading collection ansible.netcommon from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/ansible/netcommon 2026-06-19 15:43:49.784746 | debian-bookworm | Found installed collection ansible.netcommon:8.1.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/ansible/netcommon' 2026-06-19 15:43:49.785105 | debian-bookworm | Loading collection vmware.vmware from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/vmware/vmware 2026-06-19 15:43:49.785352 | debian-bookworm | Found installed collection vmware.vmware:2.4.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/vmware/vmware' 2026-06-19 15:43:49.786458 | debian-bookworm | Loading collection cisco.nxos from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/cisco/nxos 2026-06-19 15:43:49.786730 | debian-bookworm | Found installed collection cisco.nxos:11.0.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/cisco/nxos' 2026-06-19 15:43:49.787048 | debian-bookworm | Loading collection community.hrobot from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/hrobot 2026-06-19 15:43:49.787341 | debian-bookworm | Found installed collection community.hrobot:2.7.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/hrobot' 2026-06-19 15:43:49.787614 | debian-bookworm | Loading collection kaytus.ksmanage from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/kaytus/ksmanage 2026-06-19 15:43:49.787882 | debian-bookworm | Found installed collection kaytus.ksmanage:2.0.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/kaytus/ksmanage' 2026-06-19 15:43:49.788193 | debian-bookworm | Loading collection community.routeros from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/routeros 2026-06-19 15:43:49.788457 | debian-bookworm | Found installed collection community.routeros:3.13.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/routeros' 2026-06-19 15:43:49.790403 | debian-bookworm | Loading collection vmware.vmware_rest from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/vmware/vmware_rest 2026-06-19 15:43:49.790677 | debian-bookworm | Found installed collection vmware.vmware_rest:4.9.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/vmware/vmware_rest' 2026-06-19 15:43:49.790965 | debian-bookworm | Loading collection netapp_eseries.santricity from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/netapp_eseries/santricity 2026-06-19 15:43:49.791378 | debian-bookworm | Found installed collection netapp_eseries.santricity:1.4.1 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/netapp_eseries/santricity' 2026-06-19 15:43:49.791666 | debian-bookworm | Loading collection lowlydba.sqlserver from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/lowlydba/sqlserver 2026-06-19 15:43:49.791955 | debian-bookworm | Found installed collection lowlydba.sqlserver:2.7.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/lowlydba/sqlserver' 2026-06-19 15:43:49.799971 | debian-bookworm | Loading collection community.general from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/general 2026-06-19 15:43:49.800353 | debian-bookworm | Found installed collection community.general:11.4.1 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/general' 2026-06-19 15:43:49.800795 | debian-bookworm | Loading collection telekom_mms.icinga_director from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/telekom_mms/icinga_director 2026-06-19 15:43:49.801203 | debian-bookworm | Found installed collection telekom_mms.icinga_director:2.4.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/telekom_mms/icinga_director' 2026-06-19 15:43:49.801551 | debian-bookworm | Loading collection community.sops from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/sops 2026-06-19 15:43:49.801836 | debian-bookworm | Found installed collection community.sops:2.2.7 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/sops' 2026-06-19 15:43:49.802245 | debian-bookworm | Loading collection cisco.ios from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/cisco/ios 2026-06-19 15:43:49.802598 | debian-bookworm | Found installed collection cisco.ios:11.1.1 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/cisco/ios' 2026-06-19 15:43:49.802978 | debian-bookworm | Loading collection ibm.storage_virtualize from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/ibm/storage_virtualize 2026-06-19 15:43:49.803291 | debian-bookworm | Found installed collection ibm.storage_virtualize:2.7.4 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/ibm/storage_virtualize' 2026-06-19 15:43:49.803663 | debian-bookworm | Loading collection community.postgresql from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/postgresql 2026-06-19 15:43:49.804010 | debian-bookworm | Found installed collection community.postgresql:4.1.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/postgresql' 2026-06-19 15:43:49.805336 | debian-bookworm | Loading collection azure.azcollection from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/azure/azcollection 2026-06-19 15:43:49.805669 | debian-bookworm | Found installed collection azure.azcollection:3.10.1 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/azure/azcollection' 2026-06-19 15:43:49.806739 | debian-bookworm | Loading collection amazon.aws from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/amazon/aws 2026-06-19 15:43:49.807096 | debian-bookworm | Found installed collection amazon.aws:10.1.2 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/amazon/aws' 2026-06-19 15:43:49.808251 | debian-bookworm | Loading collection cisco.mso from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/cisco/mso 2026-06-19 15:43:49.808580 | debian-bookworm | Found installed collection cisco.mso:2.11.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/cisco/mso' 2026-06-19 15:43:49.808823 | debian-bookworm | Loading collection ansible.posix from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/ansible/posix 2026-06-19 15:43:49.809165 | debian-bookworm | Found installed collection ansible.posix:2.1.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/ansible/posix' 2026-06-19 15:43:49.809720 | debian-bookworm | Loading collection google.cloud from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/google/cloud 2026-06-19 15:43:49.810081 | debian-bookworm | Found installed collection google.cloud:1.9.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/google/cloud' 2026-06-19 15:43:49.810409 | debian-bookworm | Loading collection community.sap_libs from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/sap_libs 2026-06-19 15:43:49.810739 | debian-bookworm | Found installed collection community.sap_libs:1.5.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/sap_libs' 2026-06-19 15:43:49.811665 | debian-bookworm | Loading collection netbox.netbox from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/netbox/netbox 2026-06-19 15:43:49.812195 | debian-bookworm | Found installed collection netbox.netbox:3.21.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/netbox/netbox' 2026-06-19 15:43:49.812613 | debian-bookworm | Loading collection junipernetworks.junos from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/junipernetworks/junos 2026-06-19 15:43:49.812935 | debian-bookworm | Found installed collection junipernetworks.junos:11.0.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/junipernetworks/junos' 2026-06-19 15:43:49.813315 | debian-bookworm | Loading collection microsoft.iis from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/microsoft/iis 2026-06-19 15:43:49.813606 | debian-bookworm | Found installed collection microsoft.iis:1.0.3 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/microsoft/iis' 2026-06-19 15:43:49.814023 | debian-bookworm | Loading collection community.dns from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/dns 2026-06-19 15:43:49.814313 | debian-bookworm | Found installed collection community.dns:3.4.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/dns' 2026-06-19 15:43:49.814691 | debian-bookworm | Loading collection community.crypto from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/crypto 2026-06-19 15:43:49.814984 | debian-bookworm | Found installed collection community.crypto:3.0.5 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/crypto' 2026-06-19 15:43:49.815301 | debian-bookworm | Loading collection hitachivantara.vspone_object from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/hitachivantara/vspone_object 2026-06-19 15:43:49.815701 | debian-bookworm | Found installed collection hitachivantara.vspone_object:1.0.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/hitachivantara/vspone_object' 2026-06-19 15:43:49.816577 | debian-bookworm | Loading collection community.windows from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/windows 2026-06-19 15:43:49.817047 | debian-bookworm | Found installed collection community.windows:3.0.1 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/windows' 2026-06-19 15:43:49.817346 | debian-bookworm | Loading collection cisco.intersight from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/cisco/intersight 2026-06-19 15:43:49.817700 | debian-bookworm | Found installed collection cisco.intersight:2.7.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/cisco/intersight' 2026-06-19 15:43:49.818078 | debian-bookworm | Loading collection community.okd from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/okd 2026-06-19 15:43:49.818362 | debian-bookworm | Found installed collection community.okd:5.0.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/okd' 2026-06-19 15:43:49.818644 | debian-bookworm | Loading collection netapp.cloudmanager from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/netapp/cloudmanager 2026-06-19 15:43:49.819073 | debian-bookworm | Found installed collection netapp.cloudmanager:21.24.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/netapp/cloudmanager' 2026-06-19 15:43:49.819416 | debian-bookworm | Loading collection community.library_inventory_filtering_v1 from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/library_inventory_filtering_v1 2026-06-19 15:43:49.819696 | debian-bookworm | Found installed collection community.library_inventory_filtering_v1:1.1.5 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/library_inventory_filtering_v1' 2026-06-19 15:43:49.820031 | debian-bookworm | Loading collection check_point.mgmt from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/check_point/mgmt 2026-06-19 15:43:49.820433 | debian-bookworm | Found installed collection check_point.mgmt:6.6.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/check_point/mgmt' 2026-06-19 15:43:49.820714 | debian-bookworm | Loading collection cyberark.pas from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/cyberark/pas 2026-06-19 15:43:49.821031 | debian-bookworm | Found installed collection cyberark.pas:1.0.36 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/cyberark/pas' 2026-06-19 15:43:49.821315 | debian-bookworm | Loading collection kubernetes.core from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/kubernetes/core 2026-06-19 15:43:49.821691 | debian-bookworm | Found installed collection kubernetes.core:6.2.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/kubernetes/core' 2026-06-19 15:43:49.821983 | debian-bookworm | Loading collection community.docker from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/docker 2026-06-19 15:43:49.822255 | debian-bookworm | Found installed collection community.docker:4.8.2 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/docker' 2026-06-19 15:43:49.822535 | debian-bookworm | Loading collection cyberark.conjur from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/cyberark/conjur 2026-06-19 15:43:49.822813 | debian-bookworm | Found installed collection cyberark.conjur:1.3.8 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/cyberark/conjur' 2026-06-19 15:43:49.823231 | debian-bookworm | Loading collection purestorage.flasharray from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/purestorage/flasharray 2026-06-19 15:43:49.823524 | debian-bookworm | Found installed collection purestorage.flasharray:1.39.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/purestorage/flasharray' 2026-06-19 15:43:49.823904 | debian-bookworm | Loading collection cisco.meraki from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/cisco/meraki 2026-06-19 15:43:49.824303 | debian-bookworm | Found installed collection cisco.meraki:2.21.8 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/cisco/meraki' 2026-06-19 15:43:49.824669 | debian-bookworm | Loading collection ovirt.ovirt from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/ovirt/ovirt 2026-06-19 15:43:49.825048 | debian-bookworm | Found installed collection ovirt.ovirt:3.2.1 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/ovirt/ovirt' 2026-06-19 15:43:49.825531 | debian-bookworm | Loading collection cisco.iosxr from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/cisco/iosxr 2026-06-19 15:43:49.825857 | debian-bookworm | Found installed collection cisco.iosxr:12.1.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/cisco/iosxr' 2026-06-19 15:43:49.826251 | debian-bookworm | Loading collection ibm.qradar from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/ibm/qradar 2026-06-19 15:43:49.826564 | debian-bookworm | Found installed collection ibm.qradar:4.0.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/ibm/qradar' 2026-06-19 15:43:49.826831 | debian-bookworm | Loading collection community.rabbitmq from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/rabbitmq 2026-06-19 15:43:49.827054 | debian-bookworm | Found installed collection community.rabbitmq:1.6.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/rabbitmq' 2026-06-19 15:43:49.827367 | debian-bookworm | Loading collection community.hashi_vault from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/hashi_vault 2026-06-19 15:43:49.827646 | debian-bookworm | Found installed collection community.hashi_vault:7.1.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/hashi_vault' 2026-06-19 15:43:49.828795 | debian-bookworm | Loading collection community.vmware from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/vmware 2026-06-19 15:43:49.829082 | debian-bookworm | Found installed collection community.vmware:5.10.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/vmware' 2026-06-19 15:43:49.829354 | debian-bookworm | Loading collection purestorage.flashblade from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/purestorage/flashblade 2026-06-19 15:43:49.829620 | debian-bookworm | Found installed collection purestorage.flashblade:1.22.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/purestorage/flashblade' 2026-06-19 15:43:49.829924 | debian-bookworm | Loading collection community.mysql from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/mysql 2026-06-19 15:43:49.830181 | debian-bookworm | Found installed collection community.mysql:3.16.1 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/mysql' 2026-06-19 15:43:49.831400 | debian-bookworm | Loading collection cisco.aci from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/cisco/aci 2026-06-19 15:43:49.831675 | debian-bookworm | Found installed collection cisco.aci:2.12.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/cisco/aci' 2026-06-19 15:43:49.832382 | debian-bookworm | Loading collection arista.eos from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/arista/eos 2026-06-19 15:43:49.832653 | debian-bookworm | Found installed collection arista.eos:12.0.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/arista/eos' 2026-06-19 15:43:49.832948 | debian-bookworm | Loading collection community.proxysql from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/proxysql 2026-06-19 15:43:49.833220 | debian-bookworm | Found installed collection community.proxysql:1.7.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/proxysql' 2026-06-19 15:43:49.833487 | debian-bookworm | Loading collection community.zabbix from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/zabbix 2026-06-19 15:43:49.833757 | debian-bookworm | Found installed collection community.zabbix:4.1.1 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/zabbix' 2026-06-19 15:43:49.834067 | debian-bookworm | Loading collection ravendb.ravendb from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/ravendb/ravendb 2026-06-19 15:43:49.834315 | debian-bookworm | Found installed collection ravendb.ravendb:1.0.4 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/ravendb/ravendb' 2026-06-19 15:43:49.834540 | debian-bookworm | Loading collection chocolatey.chocolatey from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/chocolatey/chocolatey 2026-06-19 15:43:49.834770 | debian-bookworm | Found installed collection chocolatey.chocolatey:1.5.3 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/chocolatey/chocolatey' 2026-06-19 15:43:49.835012 | debian-bookworm | Loading collection inspur.ispim from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/inspur/ispim 2026-06-19 15:43:49.835269 | debian-bookworm | Found installed collection inspur.ispim:2.2.3 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/inspur/ispim' 2026-06-19 15:43:49.835777 | debian-bookworm | Loading collection openstack.cloud from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/openstack/cloud 2026-06-19 15:43:49.836032 | debian-bookworm | Found installed collection openstack.cloud:2.5.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/openstack/cloud' 2026-06-19 15:43:49.836266 | debian-bookworm | Loading collection cisco.ucs from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/cisco/ucs 2026-06-19 15:43:49.836497 | debian-bookworm | Found installed collection cisco.ucs:1.16.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/cisco/ucs' 2026-06-19 15:43:49.837221 | debian-bookworm | Loading collection f5networks.f5_modules from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/f5networks/f5_modules 2026-06-19 15:43:49.837661 | debian-bookworm | Found installed collection f5networks.f5_modules:1.39.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/f5networks/f5_modules' 2026-06-19 15:43:49.838043 | debian-bookworm | Loading collection ansible.utils from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/ansible/utils 2026-06-19 15:43:49.838343 | debian-bookworm | Found installed collection ansible.utils:6.0.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/ansible/utils' 2026-06-19 15:43:49.838737 | debian-bookworm | Loading collection community.grafana from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/grafana 2026-06-19 15:43:49.839064 | debian-bookworm | Found installed collection community.grafana:2.3.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/grafana' 2026-06-19 15:43:49.840215 | debian-bookworm | Loading collection awx.awx from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/awx/awx 2026-06-19 15:43:49.840616 | debian-bookworm | Found installed collection awx.awx:24.6.1 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/awx/awx' 2026-06-19 15:43:49.841016 | debian-bookworm | Loading collection dellemc.openmanage from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/dellemc/openmanage 2026-06-19 15:43:49.841398 | debian-bookworm | Found installed collection dellemc.openmanage:9.12.3 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/dellemc/openmanage' 2026-06-19 15:43:49.841781 | debian-bookworm | Loading collection ngine_io.cloudstack from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/ngine_io/cloudstack 2026-06-19 15:43:49.842178 | debian-bookworm | Found installed collection ngine_io.cloudstack:2.5.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/ngine_io/cloudstack' 2026-06-19 15:43:49.842698 | debian-bookworm | Loading collection vyos.vyos from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/vyos/vyos 2026-06-19 15:43:49.843064 | debian-bookworm | Found installed collection vyos.vyos:6.0.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/vyos/vyos' 2026-06-19 15:43:49.843424 | debian-bookworm | Loading collection microsoft.ad from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/microsoft/ad 2026-06-19 15:43:49.843680 | debian-bookworm | Found installed collection microsoft.ad:1.9.2 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/microsoft/ad' 2026-06-19 15:43:49.844041 | debian-bookworm | Loading collection grafana.grafana from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/grafana/grafana 2026-06-19 15:43:49.844622 | debian-bookworm | Found installed collection grafana.grafana:6.0.6 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/grafana/grafana' 2026-06-19 15:43:49.845064 | debian-bookworm | Loading collection ieisystem.inmanage from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/ieisystem/inmanage 2026-06-19 15:43:49.845338 | debian-bookworm | Found installed collection ieisystem.inmanage:3.0.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/ieisystem/inmanage' 2026-06-19 15:43:49.845597 | debian-bookworm | Loading collection community.mongodb from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/mongodb 2026-06-19 15:43:49.845959 | debian-bookworm | Found installed collection community.mongodb:1.7.10 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/mongodb' 2026-06-19 15:43:49.846211 | debian-bookworm | Loading collection netapp.storagegrid from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/netapp/storagegrid 2026-06-19 15:43:49.846466 | debian-bookworm | Found installed collection netapp.storagegrid:21.15.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/netapp/storagegrid' 2026-06-19 15:43:49.846787 | debian-bookworm | Loading collection vultr.cloud from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/vultr/cloud 2026-06-19 15:43:49.847103 | debian-bookworm | Found installed collection vultr.cloud:1.13.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/vultr/cloud' 2026-06-19 15:43:49.847386 | debian-bookworm | Loading collection wti.remote from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/wti/remote 2026-06-19 15:43:49.847681 | debian-bookworm | Found installed collection wti.remote:1.0.10 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/wti/remote' 2026-06-19 15:43:49.847896 | debian-bookworm | Loading collection community.libvirt from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/libvirt 2026-06-19 15:43:49.848126 | debian-bookworm | Found installed collection community.libvirt:2.0.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/libvirt' 2026-06-19 15:43:49.848684 | debian-bookworm | Loading collection theforeman.foreman from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/theforeman/foreman 2026-06-19 15:43:49.849008 | debian-bookworm | Found installed collection theforeman.foreman:5.7.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/theforeman/foreman' 2026-06-19 15:43:49.849731 | debian-bookworm | Loading collection netapp.ontap from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/netapp/ontap 2026-06-19 15:43:49.849978 | debian-bookworm | Found installed collection netapp.ontap:23.2.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/netapp/ontap' 2026-06-19 15:43:49.850308 | debian-bookworm | Loading collection ansible.windows from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/ansible/windows 2026-06-19 15:43:49.850546 | debian-bookworm | Found installed collection ansible.windows:3.2.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/ansible/windows' 2026-06-19 15:43:49.850835 | debian-bookworm | Loading collection infinidat.infinibox from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/infinidat/infinibox 2026-06-19 15:43:49.851090 | debian-bookworm | Found installed collection infinidat.infinibox:1.6.3 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/infinidat/infinibox' 2026-06-19 15:43:49.851377 | debian-bookworm | Loading collection infoblox.nios_modules from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/infoblox/nios_modules 2026-06-19 15:43:49.851616 | debian-bookworm | Found installed collection infoblox.nios_modules:1.8.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/infoblox/nios_modules' 2026-06-19 15:43:49.852570 | debian-bookworm | Loading collection community.digitalocean from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/digitalocean 2026-06-19 15:43:49.852804 | debian-bookworm | Found installed collection community.digitalocean:1.27.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/digitalocean' 2026-06-19 15:43:49.853147 | debian-bookworm | Loading collection kubevirt.core from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/kubevirt/core 2026-06-19 15:43:49.853383 | debian-bookworm | Found installed collection kubevirt.core:2.2.3 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/kubevirt/core' 2026-06-19 15:43:49.856692 | debian-bookworm | Loading collection community.aws from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/aws 2026-06-19 15:43:49.856949 | debian-bookworm | Found installed collection community.aws:10.0.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/aws' 2026-06-19 15:43:49.857499 | debian-bookworm | Loading collection cloudscale_ch.cloud from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/cloudscale_ch/cloud 2026-06-19 15:43:49.857729 | debian-bookworm | Found installed collection cloudscale_ch.cloud:2.5.2 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/cloudscale_ch/cloud' 2026-06-19 15:43:49.858171 | debian-bookworm | Loading collection dellemc.powerflex from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/dellemc/powerflex 2026-06-19 15:43:49.858409 | debian-bookworm | Found installed collection dellemc.powerflex:2.6.1 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/dellemc/powerflex' 2026-06-19 15:43:49.858637 | debian-bookworm | Loading collection cisco.dnac from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/cisco/dnac 2026-06-19 15:43:49.858867 | debian-bookworm | Found installed collection cisco.dnac:6.41.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/cisco/dnac' 2026-06-19 15:43:49.859903 | debian-bookworm | Loading collection hetzner.hcloud from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/hetzner/hcloud 2026-06-19 15:43:49.860152 | debian-bookworm | Found installed collection hetzner.hcloud:5.4.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/hetzner/hcloud' 2026-06-19 15:43:49.864447 | debian-bookworm | Loading collection osism.services from /home/zuul/.ansible/collections/ansible_collections/osism/services 2026-06-19 15:43:49.864673 | debian-bookworm | Found installed collection osism.services:999.0.0 at '/home/zuul/.ansible/collections/ansible_collections/osism/services' 2026-06-19 15:43:49.868177 | debian-bookworm | Initial connection to galaxy_server: https://galaxy.ansible.com 2026-06-19 15:43:49.868429 | debian-bookworm | Created /home/zuul/.ansible/galaxy_token 2026-06-19 15:43:49.868616 | debian-bookworm | Calling Galaxy at https://galaxy.ansible.com/api/ 2026-06-19 15:43:49.846097 | ubuntu-noble | INFO [delegated > dependency] Executing 2026-06-19 15:43:49.846656 | ubuntu-noble | WARNING [delegated > dependency] Missing roles requirements file: requirements.yml 2026-06-19 15:43:50.271304 | debian-bookworm | Found API version 'v3, pulp-v3, v1' with Galaxy server default (https://galaxy.ansible.com/api/) 2026-06-19 15:43:50.271750 | debian-bookworm | Calling Galaxy at https://galaxy.ansible.com/api/v3/collections/osism/commons/ 2026-06-19 15:43:50.387368 | ubuntu-noble | ansible-galaxy [core 2.19.11] 2026-06-19 15:43:50.387418 | ubuntu-noble | config file = None 2026-06-19 15:43:50.387426 | ubuntu-noble | configured module search path = ['/home/zuul/src/github.com/osism/ansible-collection-services/plugins/modules', '/home/zuul/.ansible/plugins/modules', '/usr/share/ansible/plugins/modules'] 2026-06-19 15:43:50.387909 | ubuntu-noble | ansible python module location = /home/zuul/venv/lib/python3.12/site-packages/ansible 2026-06-19 15:43:50.388394 | ubuntu-noble | ansible collection location = /home/zuul/.ansible/collections:/usr/share/ansible/collections:/home/zuul/venv/lib/python3.12/site-packages:/home/zuul/venv/lib/python3.12/dist-packages:/home/zuul/venv/lib/python3/dist-packages:/home/zuul/venv/local/lib/python3.12/dist-packages 2026-06-19 15:43:50.388766 | ubuntu-noble | executable location = /home/zuul/venv/bin/ansible-galaxy 2026-06-19 15:43:50.389097 | ubuntu-noble | python version = 3.12.3 (main, Mar 23 2026, 19:04:32) [GCC 13.3.0] (/home/zuul/venv/bin/python3) 2026-06-19 15:43:50.389412 | ubuntu-noble | jinja version = 3.1.6 2026-06-19 15:43:50.389735 | ubuntu-noble | pyyaml version = 6.0.3 (with libyaml v0.2.5) 2026-06-19 15:43:50.390029 | ubuntu-noble | No config file found; using defaults 2026-06-19 15:43:50.390570 | ubuntu-noble | Reading requirement file at '/home/zuul/src/github.com/osism/ansible-collection-services/molecule/delegated/collections.yml' 2026-06-19 15:43:50.399632 | ubuntu-noble | Loading collection osism.services from /home/zuul/.ansible/collections/ansible_collections/osism/services 2026-06-19 15:43:50.400150 | ubuntu-noble | Found installed collection osism.services:999.0.0 at '/home/zuul/.ansible/collections/ansible_collections/osism/services' 2026-06-19 15:43:50.413810 | ubuntu-noble | Loading collection ansible._protomatter from /home/zuul/venv/lib/python3.12/site-packages/ansible/_internal/ansible_collections/ansible/_protomatter 2026-06-19 15:43:50.414227 | ubuntu-noble | Found installed collection ansible._protomatter:2.19.11 at '/home/zuul/venv/lib/python3.12/site-packages/ansible/_internal/ansible_collections/ansible/_protomatter' 2026-06-19 15:43:50.428204 | ubuntu-noble | Loading collection cisco.nxos from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/cisco/nxos 2026-06-19 15:43:50.428749 | ubuntu-noble | Found installed collection cisco.nxos:11.0.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/cisco/nxos' 2026-06-19 15:43:50.429941 | ubuntu-noble | Loading collection junipernetworks.junos from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/junipernetworks/junos 2026-06-19 15:43:50.430493 | ubuntu-noble | Found installed collection junipernetworks.junos:11.0.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/junipernetworks/junos' 2026-06-19 15:43:50.430881 | ubuntu-noble | Loading collection ansible.netcommon from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/ansible/netcommon 2026-06-19 15:43:50.431300 | ubuntu-noble | Found installed collection ansible.netcommon:8.1.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/ansible/netcommon' 2026-06-19 15:43:50.432093 | ubuntu-noble | Loading collection purestorage.flasharray from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/purestorage/flasharray 2026-06-19 15:43:50.432717 | ubuntu-noble | Found installed collection purestorage.flasharray:1.39.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/purestorage/flasharray' 2026-06-19 15:43:50.433532 | ubuntu-noble | Loading collection cisco.aci from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/cisco/aci 2026-06-19 15:43:50.434263 | ubuntu-noble | Found installed collection cisco.aci:2.12.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/cisco/aci' 2026-06-19 15:43:50.434850 | ubuntu-noble | Loading collection wti.remote from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/wti/remote 2026-06-19 15:43:50.435413 | ubuntu-noble | Found installed collection wti.remote:1.0.10 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/wti/remote' 2026-06-19 15:43:50.435727 | ubuntu-noble | Loading collection splunk.es from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/splunk/es 2026-06-19 15:43:50.436009 | ubuntu-noble | Found installed collection splunk.es:4.0.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/splunk/es' 2026-06-19 15:43:50.436424 | ubuntu-noble | Loading collection microsoft.iis from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/microsoft/iis 2026-06-19 15:43:50.436757 | ubuntu-noble | Found installed collection microsoft.iis:1.0.3 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/microsoft/iis' 2026-06-19 15:43:50.437153 | ubuntu-noble | Loading collection vyos.vyos from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/vyos/vyos 2026-06-19 15:43:50.437444 | ubuntu-noble | Found installed collection vyos.vyos:6.0.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/vyos/vyos' 2026-06-19 15:43:50.438145 | ubuntu-noble | Loading collection dellemc.unity from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/dellemc/unity 2026-06-19 15:43:50.438471 | ubuntu-noble | Found installed collection dellemc.unity:2.1.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/dellemc/unity' 2026-06-19 15:43:50.438792 | ubuntu-noble | Loading collection community.okd from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/okd 2026-06-19 15:43:50.439103 | ubuntu-noble | Found installed collection community.okd:5.0.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/okd' 2026-06-19 15:43:50.439413 | ubuntu-noble | Loading collection containers.podman from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/containers/podman 2026-06-19 15:43:50.439723 | ubuntu-noble | Found installed collection containers.podman:1.18.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/containers/podman' 2026-06-19 15:43:50.440812 | ubuntu-noble | Loading collection netapp.ontap from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/netapp/ontap 2026-06-19 15:43:50.441352 | ubuntu-noble | Found installed collection netapp.ontap:23.2.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/netapp/ontap' 2026-06-19 15:43:50.441849 | ubuntu-noble | Loading collection ngine_io.cloudstack from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/ngine_io/cloudstack 2026-06-19 15:43:50.442202 | ubuntu-noble | Found installed collection ngine_io.cloudstack:2.5.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/ngine_io/cloudstack' 2026-06-19 15:43:50.445939 | ubuntu-noble | Loading collection community.aws from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/aws 2026-06-19 15:43:50.446221 | ubuntu-noble | Found installed collection community.aws:10.0.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/aws' 2026-06-19 15:43:50.446609 | ubuntu-noble | Loading collection community.rabbitmq from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/rabbitmq 2026-06-19 15:43:50.447412 | ubuntu-noble | Found installed collection community.rabbitmq:1.6.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/rabbitmq' 2026-06-19 15:43:50.448145 | ubuntu-noble | Loading collection arista.eos from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/arista/eos 2026-06-19 15:43:50.448192 | ubuntu-noble | Found installed collection arista.eos:12.0.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/arista/eos' 2026-06-19 15:43:50.448522 | ubuntu-noble | Loading collection hitachivantara.vspone_block from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/hitachivantara/vspone_block 2026-06-19 15:43:50.448913 | ubuntu-noble | Found installed collection hitachivantara.vspone_block:4.4.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/hitachivantara/vspone_block' 2026-06-19 15:43:50.449221 | ubuntu-noble | Loading collection cisco.intersight from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/cisco/intersight 2026-06-19 15:43:50.449487 | ubuntu-noble | Found installed collection cisco.intersight:2.7.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/cisco/intersight' 2026-06-19 15:43:50.449834 | ubuntu-noble | Loading collection telekom_mms.icinga_director from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/telekom_mms/icinga_director 2026-06-19 15:43:50.450161 | ubuntu-noble | Found installed collection telekom_mms.icinga_director:2.4.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/telekom_mms/icinga_director' 2026-06-19 15:43:50.451412 | ubuntu-noble | Loading collection community.vmware from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/vmware 2026-06-19 15:43:50.451748 | ubuntu-noble | Found installed collection community.vmware:5.10.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/vmware' 2026-06-19 15:43:50.453351 | ubuntu-noble | Loading collection f5networks.f5_modules from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/f5networks/f5_modules 2026-06-19 15:43:50.453376 | ubuntu-noble | Found installed collection f5networks.f5_modules:1.39.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/f5networks/f5_modules' 2026-06-19 15:43:50.453383 | ubuntu-noble | Loading collection community.proxysql from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/proxysql 2026-06-19 15:43:50.453389 | ubuntu-noble | Found installed collection community.proxysql:1.7.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/proxysql' 2026-06-19 15:43:50.453395 | ubuntu-noble | Loading collection community.library_inventory_filtering_v1 from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/library_inventory_filtering_v1 2026-06-19 15:43:50.453403 | ubuntu-noble | Found installed collection community.library_inventory_filtering_v1:1.1.5 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/library_inventory_filtering_v1' 2026-06-19 15:43:50.453558 | ubuntu-noble | Loading collection grafana.grafana from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/grafana/grafana 2026-06-19 15:43:50.453857 | ubuntu-noble | Found installed collection grafana.grafana:6.0.6 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/grafana/grafana' 2026-06-19 15:43:50.454967 | ubuntu-noble | Loading collection hetzner.hcloud from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/hetzner/hcloud 2026-06-19 15:43:50.455257 | ubuntu-noble | Found installed collection hetzner.hcloud:5.4.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/hetzner/hcloud' 2026-06-19 15:43:50.456738 | ubuntu-noble | Loading collection theforeman.foreman from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/theforeman/foreman 2026-06-19 15:43:50.457072 | ubuntu-noble | Found installed collection theforeman.foreman:5.7.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/theforeman/foreman' 2026-06-19 15:43:50.458350 | ubuntu-noble | Loading collection amazon.aws from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/amazon/aws 2026-06-19 15:43:50.458619 | ubuntu-noble | Found installed collection amazon.aws:10.1.2 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/amazon/aws' 2026-06-19 15:43:50.458914 | ubuntu-noble | Loading collection kaytus.ksmanage from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/kaytus/ksmanage 2026-06-19 15:43:50.459185 | ubuntu-noble | Found installed collection kaytus.ksmanage:2.0.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/kaytus/ksmanage' 2026-06-19 15:43:50.459860 | ubuntu-noble | Loading collection kubernetes.core from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/kubernetes/core 2026-06-19 15:43:50.460122 | ubuntu-noble | Found installed collection kubernetes.core:6.2.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/kubernetes/core' 2026-06-19 15:43:50.461448 | ubuntu-noble | Loading collection cisco.mso from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/cisco/mso 2026-06-19 15:43:50.461732 | ubuntu-noble | Found installed collection cisco.mso:2.11.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/cisco/mso' 2026-06-19 15:43:50.462118 | ubuntu-noble | Loading collection community.zabbix from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/zabbix 2026-06-19 15:43:50.462395 | ubuntu-noble | Found installed collection community.zabbix:4.1.1 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/zabbix' 2026-06-19 15:43:50.463175 | ubuntu-noble | Loading collection cisco.ios from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/cisco/ios 2026-06-19 15:43:50.463454 | ubuntu-noble | Found installed collection cisco.ios:11.1.1 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/cisco/ios' 2026-06-19 15:43:50.463763 | ubuntu-noble | Loading collection community.proxmox from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/proxmox 2026-06-19 15:43:50.464022 | ubuntu-noble | Found installed collection community.proxmox:1.4.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/proxmox' 2026-06-19 15:43:50.466663 | ubuntu-noble | Loading collection awx.awx from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/awx/awx 2026-06-19 15:43:50.466949 | ubuntu-noble | Found installed collection awx.awx:24.6.1 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/awx/awx' 2026-06-19 15:43:50.468984 | ubuntu-noble | Loading collection azure.azcollection from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/azure/azcollection 2026-06-19 15:43:50.469292 | ubuntu-noble | Found installed collection azure.azcollection:3.10.1 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/azure/azcollection' 2026-06-19 15:43:50.469936 | ubuntu-noble | Loading collection vultr.cloud from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/vultr/cloud 2026-06-19 15:43:50.470402 | ubuntu-noble | Found installed collection vultr.cloud:1.13.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/vultr/cloud' 2026-06-19 15:43:50.470819 | ubuntu-noble | Loading collection openstack.cloud from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/openstack/cloud 2026-06-19 15:43:50.471224 | ubuntu-noble | Found installed collection openstack.cloud:2.5.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/openstack/cloud' 2026-06-19 15:43:50.471547 | ubuntu-noble | Loading collection cisco.ucs from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/cisco/ucs 2026-06-19 15:43:50.471888 | ubuntu-noble | Found installed collection cisco.ucs:1.16.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/cisco/ucs' 2026-06-19 15:43:50.472101 | ubuntu-noble | Loading collection vmware.vmware from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/vmware/vmware 2026-06-19 15:43:50.472386 | ubuntu-noble | Found installed collection vmware.vmware:2.4.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/vmware/vmware' 2026-06-19 15:43:50.472788 | ubuntu-noble | Loading collection netbox.netbox from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/netbox/netbox 2026-06-19 15:43:50.473053 | ubuntu-noble | Found installed collection netbox.netbox:3.21.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/netbox/netbox' 2026-06-19 15:43:50.473307 | ubuntu-noble | Loading collection ansible.utils from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/ansible/utils 2026-06-19 15:43:50.473591 | ubuntu-noble | Found installed collection ansible.utils:6.0.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/ansible/utils' 2026-06-19 15:43:50.474345 | ubuntu-noble | Loading collection netapp.storagegrid from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/netapp/storagegrid 2026-06-19 15:43:50.474365 | ubuntu-noble | Found installed collection netapp.storagegrid:21.15.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/netapp/storagegrid' 2026-06-19 15:43:50.474406 | ubuntu-noble | Loading collection netapp.cloudmanager from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/netapp/cloudmanager 2026-06-19 15:43:50.474660 | ubuntu-noble | Found installed collection netapp.cloudmanager:21.24.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/netapp/cloudmanager' 2026-06-19 15:43:50.476276 | ubuntu-noble | Loading collection community.windows from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/windows 2026-06-19 15:43:50.476534 | ubuntu-noble | Found installed collection community.windows:3.0.1 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/windows' 2026-06-19 15:43:50.476890 | ubuntu-noble | Loading collection community.sap_libs from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/sap_libs 2026-06-19 15:43:50.477114 | ubuntu-noble | Found installed collection community.sap_libs:1.5.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/sap_libs' 2026-06-19 15:43:50.477352 | ubuntu-noble | Loading collection community.routeros from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/routeros 2026-06-19 15:43:50.477590 | ubuntu-noble | Found installed collection community.routeros:3.13.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/routeros' 2026-06-19 15:43:50.477837 | ubuntu-noble | Loading collection infinidat.infinibox from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/infinidat/infinibox 2026-06-19 15:43:50.478110 | ubuntu-noble | Found installed collection infinidat.infinibox:1.6.3 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/infinidat/infinibox' 2026-06-19 15:43:50.478358 | ubuntu-noble | Loading collection ansible.posix from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/ansible/posix 2026-06-19 15:43:50.478599 | ubuntu-noble | Found installed collection ansible.posix:2.1.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/ansible/posix' 2026-06-19 15:43:50.478921 | ubuntu-noble | Loading collection community.grafana from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/grafana 2026-06-19 15:43:50.479181 | ubuntu-noble | Found installed collection community.grafana:2.3.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/grafana' 2026-06-19 15:43:50.479460 | ubuntu-noble | Loading collection inspur.ispim from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/inspur/ispim 2026-06-19 15:43:50.479704 | ubuntu-noble | Found installed collection inspur.ispim:2.2.3 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/inspur/ispim' 2026-06-19 15:43:50.479987 | ubuntu-noble | Loading collection cyberark.conjur from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/cyberark/conjur 2026-06-19 15:43:50.480211 | ubuntu-noble | Found installed collection cyberark.conjur:1.3.8 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/cyberark/conjur' 2026-06-19 15:43:50.480655 | ubuntu-noble | Loading collection community.docker from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/docker 2026-06-19 15:43:50.480929 | ubuntu-noble | Found installed collection community.docker:4.8.2 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/docker' 2026-06-19 15:43:50.481526 | ubuntu-noble | Loading collection community.hrobot from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/hrobot 2026-06-19 15:43:50.481545 | ubuntu-noble | Found installed collection community.hrobot:2.7.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/hrobot' 2026-06-19 15:43:50.483408 | ubuntu-noble | Loading collection dellemc.enterprise_sonic from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/dellemc/enterprise_sonic 2026-06-19 15:43:50.483881 | ubuntu-noble | Found installed collection dellemc.enterprise_sonic:3.2.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/dellemc/enterprise_sonic' 2026-06-19 15:43:50.483907 | ubuntu-noble | Loading collection cisco.dnac from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/cisco/dnac 2026-06-19 15:43:50.484146 | ubuntu-noble | Found installed collection cisco.dnac:6.41.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/cisco/dnac' 2026-06-19 15:43:50.484434 | ubuntu-noble | Loading collection infoblox.nios_modules from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/infoblox/nios_modules 2026-06-19 15:43:50.484656 | ubuntu-noble | Found installed collection infoblox.nios_modules:1.8.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/infoblox/nios_modules' 2026-06-19 15:43:50.485030 | ubuntu-noble | Loading collection community.dns from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/dns 2026-06-19 15:43:50.485237 | ubuntu-noble | Found installed collection community.dns:3.4.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/dns' 2026-06-19 15:43:50.485446 | ubuntu-noble | Loading collection community.sops from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/sops 2026-06-19 15:43:50.485727 | ubuntu-noble | Found installed collection community.sops:2.2.7 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/sops' 2026-06-19 15:43:50.486285 | ubuntu-noble | Loading collection ovirt.ovirt from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/ovirt/ovirt 2026-06-19 15:43:50.486498 | ubuntu-noble | Found installed collection ovirt.ovirt:3.2.1 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/ovirt/ovirt' 2026-06-19 15:43:50.487231 | ubuntu-noble | Loading collection cloudscale_ch.cloud from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/cloudscale_ch/cloud 2026-06-19 15:43:50.487468 | ubuntu-noble | Found installed collection cloudscale_ch.cloud:2.5.2 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/cloudscale_ch/cloud' 2026-06-19 15:43:50.493435 | ubuntu-noble | Loading collection fortinet.fortimanager from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/fortinet/fortimanager 2026-06-19 15:43:50.493467 | ubuntu-noble | Found installed collection fortinet.fortimanager:2.11.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/fortinet/fortimanager' 2026-06-19 15:43:50.498388 | ubuntu-noble | Loading collection fortinet.fortios from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/fortinet/fortios 2026-06-19 15:43:50.498450 | ubuntu-noble | Found installed collection fortinet.fortios:2.4.2 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/fortinet/fortios' 2026-06-19 15:43:50.498465 | ubuntu-noble | Loading collection purestorage.flashblade from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/purestorage/flashblade 2026-06-19 15:43:50.498798 | ubuntu-noble | Found installed collection purestorage.flashblade:1.22.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/purestorage/flashblade' 2026-06-19 15:43:50.499300 | ubuntu-noble | Loading collection community.hashi_vault from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/hashi_vault 2026-06-19 15:43:50.499932 | ubuntu-noble | Found installed collection community.hashi_vault:7.1.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/hashi_vault' 2026-06-19 15:43:50.500286 | ubuntu-noble | Loading collection ravendb.ravendb from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/ravendb/ravendb 2026-06-19 15:43:50.500639 | ubuntu-noble | Found installed collection ravendb.ravendb:1.0.4 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/ravendb/ravendb' 2026-06-19 15:43:50.501096 | ubuntu-noble | Loading collection community.digitalocean from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/digitalocean 2026-06-19 15:43:50.501444 | ubuntu-noble | Found installed collection community.digitalocean:1.27.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/digitalocean' 2026-06-19 15:43:50.501876 | ubuntu-noble | Loading collection cisco.meraki from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/cisco/meraki 2026-06-19 15:43:50.502312 | ubuntu-noble | Found installed collection cisco.meraki:2.21.8 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/cisco/meraki' 2026-06-19 15:43:50.502816 | ubuntu-noble | Loading collection community.postgresql from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/postgresql 2026-06-19 15:43:50.503092 | ubuntu-noble | Found installed collection community.postgresql:4.1.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/postgresql' 2026-06-19 15:43:50.503458 | ubuntu-noble | Loading collection kubevirt.core from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/kubevirt/core 2026-06-19 15:43:50.503747 | ubuntu-noble | Found installed collection kubevirt.core:2.2.3 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/kubevirt/core' 2026-06-19 15:43:50.504191 | ubuntu-noble | Loading collection google.cloud from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/google/cloud 2026-06-19 15:43:50.504558 | ubuntu-noble | Found installed collection google.cloud:1.9.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/google/cloud' 2026-06-19 15:43:50.504968 | ubuntu-noble | Loading collection community.mongodb from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/mongodb 2026-06-19 15:43:50.505248 | ubuntu-noble | Found installed collection community.mongodb:1.7.10 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/mongodb' 2026-06-19 15:43:50.505540 | ubuntu-noble | Loading collection lowlydba.sqlserver from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/lowlydba/sqlserver 2026-06-19 15:43:50.505849 | ubuntu-noble | Found installed collection lowlydba.sqlserver:2.7.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/lowlydba/sqlserver' 2026-06-19 15:43:50.506843 | ubuntu-noble | Loading collection microsoft.ad from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/microsoft/ad 2026-06-19 15:43:50.506863 | ubuntu-noble | Found installed collection microsoft.ad:1.9.2 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/microsoft/ad' 2026-06-19 15:43:50.506871 | ubuntu-noble | Loading collection check_point.mgmt from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/check_point/mgmt 2026-06-19 15:43:50.506877 | ubuntu-noble | Found installed collection check_point.mgmt:6.6.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/check_point/mgmt' 2026-06-19 15:43:50.507869 | ubuntu-noble | Loading collection ibm.qradar from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/ibm/qradar 2026-06-19 15:43:50.507893 | ubuntu-noble | Found installed collection ibm.qradar:4.0.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/ibm/qradar' 2026-06-19 15:43:50.507900 | ubuntu-noble | Loading collection community.mysql from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/mysql 2026-06-19 15:43:50.508155 | ubuntu-noble | Found installed collection community.mysql:3.16.1 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/mysql' 2026-06-19 15:43:50.508443 | ubuntu-noble | Loading collection netapp_eseries.santricity from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/netapp_eseries/santricity 2026-06-19 15:43:50.508721 | ubuntu-noble | Found installed collection netapp_eseries.santricity:1.4.1 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/netapp_eseries/santricity' 2026-06-19 15:43:50.511434 | ubuntu-noble | Loading collection vmware.vmware_rest from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/vmware/vmware_rest 2026-06-19 15:43:50.511824 | ubuntu-noble | Found installed collection vmware.vmware_rest:4.9.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/vmware/vmware_rest' 2026-06-19 15:43:50.512104 | ubuntu-noble | Loading collection ansible.windows from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/ansible/windows 2026-06-19 15:43:50.512312 | ubuntu-noble | Found installed collection ansible.windows:3.2.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/ansible/windows' 2026-06-19 15:43:50.512640 | ubuntu-noble | Loading collection dellemc.openmanage from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/dellemc/openmanage 2026-06-19 15:43:50.512958 | ubuntu-noble | Found installed collection dellemc.openmanage:9.12.3 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/dellemc/openmanage' 2026-06-19 15:43:50.513223 | ubuntu-noble | Loading collection ieisystem.inmanage from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/ieisystem/inmanage 2026-06-19 15:43:50.513514 | ubuntu-noble | Found installed collection ieisystem.inmanage:3.0.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/ieisystem/inmanage' 2026-06-19 15:43:50.514204 | ubuntu-noble | Loading collection cisco.iosxr from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/cisco/iosxr 2026-06-19 15:43:50.514486 | ubuntu-noble | Found installed collection cisco.iosxr:12.1.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/cisco/iosxr' 2026-06-19 15:43:50.514871 | ubuntu-noble | Loading collection dellemc.powerflex from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/dellemc/powerflex 2026-06-19 15:43:50.515550 | ubuntu-noble | Found installed collection dellemc.powerflex:2.6.1 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/dellemc/powerflex' 2026-06-19 15:43:50.515568 | ubuntu-noble | Loading collection community.libvirt from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/libvirt 2026-06-19 15:43:50.515575 | ubuntu-noble | Found installed collection community.libvirt:2.0.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/libvirt' 2026-06-19 15:43:50.515815 | ubuntu-noble | Loading collection ibm.storage_virtualize from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/ibm/storage_virtualize 2026-06-19 15:43:50.516050 | ubuntu-noble | Found installed collection ibm.storage_virtualize:2.7.4 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/ibm/storage_virtualize' 2026-06-19 15:43:50.516282 | ubuntu-noble | Loading collection chocolatey.chocolatey from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/chocolatey/chocolatey 2026-06-19 15:43:50.516537 | ubuntu-noble | Found installed collection chocolatey.chocolatey:1.5.3 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/chocolatey/chocolatey' 2026-06-19 15:43:50.516798 | ubuntu-noble | Loading collection hitachivantara.vspone_object from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/hitachivantara/vspone_object 2026-06-19 15:43:50.517035 | ubuntu-noble | Found installed collection hitachivantara.vspone_object:1.0.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/hitachivantara/vspone_object' 2026-06-19 15:43:50.517270 | ubuntu-noble | Loading collection cyberark.pas from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/cyberark/pas 2026-06-19 15:43:50.517527 | ubuntu-noble | Found installed collection cyberark.pas:1.0.36 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/cyberark/pas' 2026-06-19 15:43:50.517824 | ubuntu-noble | Loading collection community.crypto from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/crypto 2026-06-19 15:43:50.518719 | ubuntu-noble | Found installed collection community.crypto:3.0.5 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/crypto' 2026-06-19 15:43:50.529100 | ubuntu-noble | Loading collection community.general from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/general 2026-06-19 15:43:50.530376 | ubuntu-noble | Found installed collection community.general:11.4.1 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/general' 2026-06-19 15:43:50.530444 | ubuntu-noble | Loading collection community.ciscosmb from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/ciscosmb 2026-06-19 15:43:50.530670 | ubuntu-noble | Found installed collection community.ciscosmb:1.0.11 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/ciscosmb' 2026-06-19 15:43:50.537841 | ubuntu-noble | Initial connection to galaxy_server: https://galaxy.ansible.com 2026-06-19 15:43:50.538452 | ubuntu-noble | Created /home/zuul/.ansible/galaxy_token 2026-06-19 15:43:50.538910 | ubuntu-noble | Calling Galaxy at https://galaxy.ansible.com/api/ 2026-06-19 15:43:50.806799 | debian-bookworm | Calling Galaxy at https://galaxy.ansible.com/api/v3/collections/osism/commons/versions/?limit=100 2026-06-19 15:43:50.763863 | ubuntu-noble | Found API version 'v3, pulp-v3, v1' with Galaxy server default (https://galaxy.ansible.com/api/) 2026-06-19 15:43:50.764616 | ubuntu-noble | Calling Galaxy at https://galaxy.ansible.com/api/v3/collections/osism/commons/ 2026-06-19 15:43:51.527663 | debian-bookworm | Calling Galaxy at https://galaxy.ansible.com/api/v3/collections/osism/commons/versions/0.20260601.0/ 2026-06-19 15:43:51.468777 | ubuntu-noble | Calling Galaxy at https://galaxy.ansible.com/api/v3/collections/osism/commons/versions/?limit=100 2026-06-19 15:43:52.111348 | debian-bookworm | Server https://galaxy.ansible.com/api/ has not signed osism.commons:0.20260601.0 2026-06-19 15:43:52.111702 | debian-bookworm | Fetching a collection tarball for 'osism.commons:0.20260601.0' from Ansible Galaxy 2026-06-19 15:43:52.211131 | ubuntu-noble | Calling Galaxy at https://galaxy.ansible.com/api/v3/collections/osism/commons/versions/0.20260601.0/ 2026-06-19 15:43:52.754169 | ubuntu-noble | Server https://galaxy.ansible.com/api/ has not signed osism.commons:0.20260601.0 2026-06-19 15:43:52.754206 | ubuntu-noble | Fetching a collection tarball for 'osism.commons:0.20260601.0' from Ansible Galaxy 2026-06-19 15:43:53.489143 | debian-bookworm | Validating downloaded file hash 1d41d3b5d145afda8cce7ec8515d5495c0afe9a3787ce4d2ea101956f5f7e2b1 with expected hash 1d41d3b5d145afda8cce7ec8515d5495c0afe9a3787ce4d2ea101956f5f7e2b1 2026-06-19 15:43:53.489648 | debian-bookworm | Collection 'osism.commons:0.20260601.0' obtained from server default https://galaxy.ansible.com/api/ 2026-06-19 15:43:53.666924 | debian-bookworm | Starting galaxy collection install process 2026-06-19 15:43:53.667284 | debian-bookworm | Process install dependency map 2026-06-19 15:43:53.667575 | debian-bookworm | Starting collection install process 2026-06-19 15:43:53.667866 | debian-bookworm | 'ansible.posix:2.1.0' is already installed, skipping. 2026-06-19 15:43:53.668175 | debian-bookworm | 'community.docker:4.8.2' is already installed, skipping. 2026-06-19 15:43:53.668452 | debian-bookworm | 'community.general:11.4.1' is already installed, skipping. 2026-06-19 15:43:53.668735 | debian-bookworm | 'community.library_inventory_filtering_v1:1.1.5' is already installed, skipping. 2026-06-19 15:43:53.669051 | debian-bookworm | Downloading https://galaxy.ansible.com/api/v3/plugin/ansible/content/published/collections/artifacts/osism-commons-0.20260601.0.tar.gz to /home/zuul/.ansible/tmp/ansible-local-19474i6pgauo/tmpp7hj5u9r/osism-commons-0.20260601.0-zinz3od_ 2026-06-19 15:43:53.669338 | debian-bookworm | Installing 'osism.commons:0.20260601.0' to '/home/zuul/.ansible/collections/ansible_collections/osism/commons' 2026-06-19 15:43:53.669615 | debian-bookworm | osism.commons:0.20260601.0 was installed successfully 2026-06-19 15:43:53.733909 | debian-bookworm | INFO [delegated > dependency] Dependency completed successfully. 2026-06-19 15:43:53.734100 | debian-bookworm | WARNING [delegated > dependency] Executed: Missing roles requirements file: requirements.yml (Remove from dependency_sequence to suppress) 2026-06-19 15:43:53.734635 | debian-bookworm | WARNING Molecule executed 1 scenario (1 missing files) 2026-06-19 15:43:54.304420 | ubuntu-noble | Validating downloaded file hash 1d41d3b5d145afda8cce7ec8515d5495c0afe9a3787ce4d2ea101956f5f7e2b1 with expected hash 1d41d3b5d145afda8cce7ec8515d5495c0afe9a3787ce4d2ea101956f5f7e2b1 2026-06-19 15:43:54.304490 | ubuntu-noble | Collection 'osism.commons:0.20260601.0' obtained from server default https://galaxy.ansible.com/api/ 2026-06-19 15:43:54.479172 | ubuntu-noble | Starting galaxy collection install process 2026-06-19 15:43:54.479532 | ubuntu-noble | Process install dependency map 2026-06-19 15:43:54.479861 | ubuntu-noble | Starting collection install process 2026-06-19 15:43:54.480166 | ubuntu-noble | 'ansible.posix:2.1.0' is already installed, skipping. 2026-06-19 15:43:54.480536 | ubuntu-noble | 'community.docker:4.8.2' is already installed, skipping. 2026-06-19 15:43:54.480854 | ubuntu-noble | 'community.general:11.4.1' is already installed, skipping. 2026-06-19 15:43:54.481165 | ubuntu-noble | 'community.library_inventory_filtering_v1:1.1.5' is already installed, skipping. 2026-06-19 15:43:54.481543 | ubuntu-noble | Downloading https://galaxy.ansible.com/api/v3/plugin/ansible/content/published/collections/artifacts/osism-commons-0.20260601.0.tar.gz to /home/zuul/.ansible/tmp/ansible-local-1779gfwgl_mb/tmp0b2y2iui/osism-commons-0.20260601.0-tls_mpdh 2026-06-19 15:43:54.481907 | ubuntu-noble | Installing 'osism.commons:0.20260601.0' to '/home/zuul/.ansible/collections/ansible_collections/osism/commons' 2026-06-19 15:43:54.482193 | ubuntu-noble | osism.commons:0.20260601.0 was installed successfully 2026-06-19 15:43:54.580724 | ubuntu-noble | INFO [delegated > dependency] Dependency completed successfully. 2026-06-19 15:43:54.580917 | ubuntu-noble | WARNING [delegated > dependency] Executed: Missing roles requirements file: requirements.yml (Remove from dependency_sequence to suppress) 2026-06-19 15:43:54.581751 | ubuntu-noble | WARNING Molecule executed 1 scenario (1 missing files) 2026-06-19 15:43:54.707116 | debian-bookworm | ok: Runtime: 0:00:06.843405 2026-06-19 15:43:54.715237 | ubuntu-noble | ok: Runtime: 0:00:07.672247 2026-06-19 15:43:54.722808 | 2026-06-19 15:43:54.722941 | TASK [ansible-molecule : Run molecule create action with scenario delegated] 2026-06-19 15:43:55.280344 | debian-bookworm | skipping: Conditional result was False 2026-06-19 15:43:55.281042 | ubuntu-noble | skipping: Conditional result was False 2026-06-19 15:43:55.287803 | 2026-06-19 15:43:55.287942 | TASK [ansible-molecule : Run molecule prepare action with scenario delegated] 2026-06-19 15:43:55.883973 | debian-bookworm | WARNING Molecule scenarios should migrate to 'extensions/molecule' 2026-06-19 15:43:55.892919 | debian-bookworm | DEBUG [unknown > config] provisioner.env found in /home/zuul/src/github.com/osism/ansible-collection-services/molecule/delegated/molecule.yml, this can be defined in ansible.env 2026-06-19 15:43:56.080126 | ubuntu-noble | WARNING Molecule scenarios should migrate to 'extensions/molecule' 2026-06-19 15:43:56.088521 | ubuntu-noble | DEBUG [unknown > config] provisioner.env found in /home/zuul/src/github.com/osism/ansible-collection-services/molecule/delegated/molecule.yml, this can be defined in ansible.env 2026-06-19 15:43:56.440264 | debian-bookworm | DEBUG [unknown > config] provisioner.env found in /home/zuul/src/github.com/osism/ansible-collection-services/molecule/delegated/molecule.yml, this can be defined in ansible.env 2026-06-19 15:43:56.440837 | debian-bookworm | DEBUG [delegated > validate] Validating schema /home/zuul/src/github.com/osism/ansible-collection-services/molecule/delegated/molecule.yml. 2026-06-19 15:43:56.460075 | debian-bookworm | DEBUG [default > validate] Validating schema /home/zuul/src/github.com/osism/ansible-collection-services/molecule/default/molecule.yml. 2026-06-19 15:43:56.465865 | debian-bookworm | INFO [delegated > discovery] scenario test matrix: prepare 2026-06-19 15:43:56.465944 | debian-bookworm | INFO [delegated > prerun] Performing prerun with role_name_check=0... 2026-06-19 15:43:56.782258 | ubuntu-noble | DEBUG [unknown > config] provisioner.env found in /home/zuul/src/github.com/osism/ansible-collection-services/molecule/delegated/molecule.yml, this can be defined in ansible.env 2026-06-19 15:43:56.782936 | ubuntu-noble | DEBUG [delegated > validate] Validating schema /home/zuul/src/github.com/osism/ansible-collection-services/molecule/delegated/molecule.yml. 2026-06-19 15:43:56.805727 | ubuntu-noble | DEBUG [default > validate] Validating schema /home/zuul/src/github.com/osism/ansible-collection-services/molecule/default/molecule.yml. 2026-06-19 15:43:56.812123 | ubuntu-noble | INFO [delegated > discovery] scenario test matrix: prepare 2026-06-19 15:43:56.812187 | ubuntu-noble | INFO [delegated > prerun] Performing prerun with role_name_check=0... 2026-06-19 15:43:57.706983 | debian-bookworm | INFO [delegated > prepare] Executing 2026-06-19 15:43:58.091416 | debian-bookworm | DEBUG [delegated > prepare] ansible-playbook version: ansible-playbook 2026-06-19 15:43:58.091463 | debian-bookworm | config file = None 2026-06-19 15:43:58.091476 | debian-bookworm | configured module search path = 2026-06-19 15:43:58.091481 | debian-bookworm | ansible python module location = /home/zuul/venv/lib/python3.11/site-packages/ansible 2026-06-19 15:43:58.091488 | debian-bookworm | ansible collection location = /home/zuul/.ansible/collections:/usr/share/ansible/collections 2026-06-19 15:43:58.091492 | debian-bookworm | executable location = /home/zuul/venv/bin/ansible-playbook 2026-06-19 15:43:58.091496 | debian-bookworm | python version = 3.11.2 (main, Apr 8 2026, 01:58:00) (/home/zuul/venv/bin/python3) 2026-06-19 15:43:58.091500 | debian-bookworm | jinja version = 3.1.6 2026-06-19 15:43:58.091504 | debian-bookworm | pyyaml version = 6.0.3 (with libyaml v0.2.5) 2026-06-19 15:43:58.091706 | debian-bookworm | DEBUG ANSIBLE ENVIRONMENT: 2026-06-19 15:43:58.091712 | debian-bookworm | ANSIBLE_COLLECTIONS_PATH: /home/zuul/venv/.ansible/collections:/home/zuul/.ansible/collections 2026-06-19 15:43:58.091717 | debian-bookworm | ANSIBLE_CONFIG: /home/zuul/.ansible/tmp/molecule.oWZD.delegated/ansible.cfg 2026-06-19 15:43:58.091720 | debian-bookworm | ANSIBLE_LIBRARY: ../../plugins 2026-06-19 15:43:58.091724 | debian-bookworm | ANSIBLE_PYTHON_INTERPRETER: /home/zuul/venv/bin/python 2026-06-19 15:43:58.091728 | debian-bookworm | ANSIBLE_ROLE: auditd 2026-06-19 15:43:58.091732 | debian-bookworm | ANSIBLE_ROLES_PATH: ../../roles 2026-06-19 15:43:58.091736 | debian-bookworm | ANSIBLE_VERBOSITY: 1 2026-06-19 15:43:58.091740 | debian-bookworm | 2026-06-19 15:43:58.091963 | debian-bookworm | DEBUG MOLECULE ENVIRONMENT: 2026-06-19 15:43:58.091969 | debian-bookworm | MOLECULE_DEBUG: True 2026-06-19 15:43:58.091973 | debian-bookworm | MOLECULE_DEPENDENCY_NAME: galaxy 2026-06-19 15:43:58.091977 | debian-bookworm | MOLECULE_DRIVER_NAME: default 2026-06-19 15:43:58.091981 | debian-bookworm | MOLECULE_ENV_FILE: /home/zuul/src/github.com/osism/ansible-collection-services/.env.yml 2026-06-19 15:43:58.091985 | debian-bookworm | MOLECULE_EPHEMERAL_DIRECTORY: /home/zuul/.ansible/tmp/molecule.oWZD.delegated 2026-06-19 15:43:58.091988 | debian-bookworm | MOLECULE_FILE: /home/zuul/.ansible/tmp/molecule.oWZD.delegated/molecule.yml 2026-06-19 15:43:58.091992 | debian-bookworm | MOLECULE_INSTANCE_CONFIG: /home/zuul/.ansible/tmp/molecule.oWZD.delegated/instance_config.yml 2026-06-19 15:43:58.091996 | debian-bookworm | MOLECULE_INVENTORY_FILE: /home/zuul/.ansible/tmp/molecule.oWZD.delegated/inventory/ansible_inventory.yml 2026-06-19 15:43:58.092001 | debian-bookworm | MOLECULE_PROJECT_DIRECTORY: /home/zuul/src/github.com/osism/ansible-collection-services 2026-06-19 15:43:58.092004 | debian-bookworm | MOLECULE_PROVISIONER_NAME: ansible 2026-06-19 15:43:58.092008 | debian-bookworm | MOLECULE_SCENARIO_DIRECTORY: /home/zuul/src/github.com/osism/ansible-collection-services/molecule/delegated 2026-06-19 15:43:58.092012 | debian-bookworm | MOLECULE_SCENARIO_NAME: delegated 2026-06-19 15:43:58.092016 | debian-bookworm | MOLECULE_STATE_FILE: /home/zuul/.ansible/tmp/molecule.oWZD.delegated/state.yml 2026-06-19 15:43:58.092020 | debian-bookworm | MOLECULE_VERIFIER_NAME: testinfra 2026-06-19 15:43:58.092024 | debian-bookworm | MOLECULE_VERIFIER_TEST_DIRECTORY: /home/zuul/src/github.com/osism/ansible-collection-services/molecule/delegated/tests 2026-06-19 15:43:58.092028 | debian-bookworm | 2026-06-19 15:43:58.092256 | debian-bookworm | DEBUG SHELL REPLAY: ANSIBLE_COLLECTIONS_PATH=/home/zuul/venv/.ansible/collections:/home/zuul/.ansible/collections ANSIBLE_CONFIG=/home/zuul/.ansible/tmp/molecule.oWZD.delegated/ansible.cfg ANSIBLE_LIBRARY=../../plugins ANSIBLE_PYTHON_INTERPRETER=/home/zuul/venv/bin/python ANSIBLE_ROLE=auditd ANSIBLE_ROLES_PATH=../../roles ANSIBLE_VERBOSITY=1 MOLECULE_DEBUG=True MOLECULE_DEPENDENCY_NAME=galaxy MOLECULE_DRIVER_NAME=default MOLECULE_ENV_FILE=/home/zuul/src/github.com/osism/ansible-collection-services/.env.yml MOLECULE_EPHEMERAL_DIRECTORY=/home/zuul/.ansible/tmp/molecule.oWZD.delegated MOLECULE_FILE=/home/zuul/.ansible/tmp/molecule.oWZD.delegated/molecule.yml MOLECULE_INSTANCE_CONFIG=/home/zuul/.ansible/tmp/molecule.oWZD.delegated/instance_config.yml MOLECULE_INVENTORY_FILE=/home/zuul/.ansible/tmp/molecule.oWZD.delegated/inventory/ansible_inventory.yml MOLECULE_PROJECT_DIRECTORY=/home/zuul/src/github.com/osism/ansible-collection-services MOLECULE_PROVISIONER_NAME=ansible MOLECULE_SCENARIO_DIRECTORY=/home/zuul/src/github.com/osism/ansible-collection-services/molecule/delegated MOLECULE_SCENARIO_NAME=delegated MOLECULE_STATE_FILE=/home/zuul/.ansible/tmp/molecule.oWZD.delegated/state.yml MOLECULE_VERIFIER_NAME=testinfra MOLECULE_VERIFIER_TEST_DIRECTORY=/home/zuul/src/github.com/osism/ansible-collection-services/molecule/delegated/tests 2026-06-19 15:43:58.459625 | debian-bookworm | Using /home/zuul/.ansible/tmp/molecule.oWZD.delegated/ansible.cfg as config file 2026-06-19 15:43:58.693334 | debian-bookworm | 2026-06-19 15:43:58.693796 | debian-bookworm | PLAY [Prepare] ***************************************************************** 2026-06-19 15:43:58.694310 | debian-bookworm | 2026-06-19 15:43:58.694698 | debian-bookworm | TASK [Gathering Facts] ********************************************************* 2026-06-19 15:43:58.376511 | ubuntu-noble | INFO [delegated > prepare] Executing 2026-06-19 15:43:58.804968 | ubuntu-noble | DEBUG [delegated > prepare] ansible-playbook version: ansible-playbook 2026-06-19 15:43:58.805006 | ubuntu-noble | config file = None 2026-06-19 15:43:58.805019 | ubuntu-noble | configured module search path = 2026-06-19 15:43:58.805025 | ubuntu-noble | ansible python module location = /home/zuul/venv/lib/python3.12/site-packages/ansible 2026-06-19 15:43:58.805030 | ubuntu-noble | ansible collection location = /home/zuul/.ansible/collections:/usr/share/ansible/collections 2026-06-19 15:43:58.805034 | ubuntu-noble | executable location = /home/zuul/venv/bin/ansible-playbook 2026-06-19 15:43:58.805038 | ubuntu-noble | python version = 3.12.3 (main, Mar 23 2026, 19:04:32) (/home/zuul/venv/bin/python3) 2026-06-19 15:43:58.805042 | ubuntu-noble | jinja version = 3.1.6 2026-06-19 15:43:58.805045 | ubuntu-noble | pyyaml version = 6.0.3 (with libyaml v0.2.5) 2026-06-19 15:43:58.805487 | ubuntu-noble | DEBUG ANSIBLE ENVIRONMENT: 2026-06-19 15:43:58.805495 | ubuntu-noble | ANSIBLE_COLLECTIONS_PATH: /home/zuul/venv/.ansible/collections:/home/zuul/.ansible/collections 2026-06-19 15:43:58.805499 | ubuntu-noble | ANSIBLE_CONFIG: /home/zuul/.ansible/tmp/molecule.oWZD.delegated/ansible.cfg 2026-06-19 15:43:58.805502 | ubuntu-noble | ANSIBLE_LIBRARY: ../../plugins 2026-06-19 15:43:58.805505 | ubuntu-noble | ANSIBLE_PYTHON_INTERPRETER: /home/zuul/venv/bin/python 2026-06-19 15:43:58.805509 | ubuntu-noble | ANSIBLE_ROLE: auditd 2026-06-19 15:43:58.805512 | ubuntu-noble | ANSIBLE_ROLES_PATH: ../../roles 2026-06-19 15:43:58.805516 | ubuntu-noble | ANSIBLE_VERBOSITY: 1 2026-06-19 15:43:58.805520 | ubuntu-noble | 2026-06-19 15:43:58.805790 | ubuntu-noble | DEBUG MOLECULE ENVIRONMENT: 2026-06-19 15:43:58.805796 | ubuntu-noble | MOLECULE_DEBUG: True 2026-06-19 15:43:58.805799 | ubuntu-noble | MOLECULE_DEPENDENCY_NAME: galaxy 2026-06-19 15:43:58.805802 | ubuntu-noble | MOLECULE_DRIVER_NAME: default 2026-06-19 15:43:58.805806 | ubuntu-noble | MOLECULE_ENV_FILE: /home/zuul/src/github.com/osism/ansible-collection-services/.env.yml 2026-06-19 15:43:58.805809 | ubuntu-noble | MOLECULE_EPHEMERAL_DIRECTORY: /home/zuul/.ansible/tmp/molecule.oWZD.delegated 2026-06-19 15:43:58.805813 | ubuntu-noble | MOLECULE_FILE: /home/zuul/.ansible/tmp/molecule.oWZD.delegated/molecule.yml 2026-06-19 15:43:58.805816 | ubuntu-noble | MOLECULE_INSTANCE_CONFIG: /home/zuul/.ansible/tmp/molecule.oWZD.delegated/instance_config.yml 2026-06-19 15:43:58.805820 | ubuntu-noble | MOLECULE_INVENTORY_FILE: /home/zuul/.ansible/tmp/molecule.oWZD.delegated/inventory/ansible_inventory.yml 2026-06-19 15:43:58.805824 | ubuntu-noble | MOLECULE_PROJECT_DIRECTORY: /home/zuul/src/github.com/osism/ansible-collection-services 2026-06-19 15:43:58.805827 | ubuntu-noble | MOLECULE_PROVISIONER_NAME: ansible 2026-06-19 15:43:58.805830 | ubuntu-noble | MOLECULE_SCENARIO_DIRECTORY: /home/zuul/src/github.com/osism/ansible-collection-services/molecule/delegated 2026-06-19 15:43:58.805834 | ubuntu-noble | MOLECULE_SCENARIO_NAME: delegated 2026-06-19 15:43:58.805837 | ubuntu-noble | MOLECULE_STATE_FILE: /home/zuul/.ansible/tmp/molecule.oWZD.delegated/state.yml 2026-06-19 15:43:58.805841 | ubuntu-noble | MOLECULE_VERIFIER_NAME: testinfra 2026-06-19 15:43:58.805844 | ubuntu-noble | MOLECULE_VERIFIER_TEST_DIRECTORY: /home/zuul/src/github.com/osism/ansible-collection-services/molecule/delegated/tests 2026-06-19 15:43:58.805848 | ubuntu-noble | 2026-06-19 15:43:58.806074 | ubuntu-noble | DEBUG SHELL REPLAY: ANSIBLE_COLLECTIONS_PATH=/home/zuul/venv/.ansible/collections:/home/zuul/.ansible/collections ANSIBLE_CONFIG=/home/zuul/.ansible/tmp/molecule.oWZD.delegated/ansible.cfg ANSIBLE_LIBRARY=../../plugins ANSIBLE_PYTHON_INTERPRETER=/home/zuul/venv/bin/python ANSIBLE_ROLE=auditd ANSIBLE_ROLES_PATH=../../roles ANSIBLE_VERBOSITY=1 MOLECULE_DEBUG=True MOLECULE_DEPENDENCY_NAME=galaxy MOLECULE_DRIVER_NAME=default MOLECULE_ENV_FILE=/home/zuul/src/github.com/osism/ansible-collection-services/.env.yml MOLECULE_EPHEMERAL_DIRECTORY=/home/zuul/.ansible/tmp/molecule.oWZD.delegated MOLECULE_FILE=/home/zuul/.ansible/tmp/molecule.oWZD.delegated/molecule.yml MOLECULE_INSTANCE_CONFIG=/home/zuul/.ansible/tmp/molecule.oWZD.delegated/instance_config.yml MOLECULE_INVENTORY_FILE=/home/zuul/.ansible/tmp/molecule.oWZD.delegated/inventory/ansible_inventory.yml MOLECULE_PROJECT_DIRECTORY=/home/zuul/src/github.com/osism/ansible-collection-services MOLECULE_PROVISIONER_NAME=ansible MOLECULE_SCENARIO_DIRECTORY=/home/zuul/src/github.com/osism/ansible-collection-services/molecule/delegated MOLECULE_SCENARIO_NAME=delegated MOLECULE_STATE_FILE=/home/zuul/.ansible/tmp/molecule.oWZD.delegated/state.yml MOLECULE_VERIFIER_NAME=testinfra MOLECULE_VERIFIER_TEST_DIRECTORY=/home/zuul/src/github.com/osism/ansible-collection-services/molecule/delegated/tests 2026-06-19 15:43:59.192392 | ubuntu-noble | Using /home/zuul/.ansible/tmp/molecule.oWZD.delegated/ansible.cfg as config file 2026-06-19 15:43:59.813986 | debian-bookworm | ok: [molecule-auditd] 2026-06-19 15:43:59.814180 | debian-bookworm | 2026-06-19 15:43:59.814433 | debian-bookworm | TASK [Install packages in venv] ************************************************ 2026-06-19 15:43:59.481397 | ubuntu-noble | 2026-06-19 15:43:59.481457 | ubuntu-noble | PLAY [Prepare] ***************************************************************** 2026-06-19 15:43:59.481473 | ubuntu-noble | 2026-06-19 15:43:59.482594 | ubuntu-noble | TASK [Gathering Facts] ********************************************************* 2026-06-19 15:44:00.733406 | ubuntu-noble | ok: [molecule-auditd] 2026-06-19 15:44:00.733852 | ubuntu-noble | 2026-06-19 15:44:00.734496 | ubuntu-noble | TASK [Install packages in venv] ************************************************ 2026-06-19 15:44:04.123465 | debian-bookworm | changed: [molecule-auditd] => (item=docker) => {"ansible_loop_var": "item", "changed": true, "cmd": ["/home/zuul/venv/bin/pip3", "install", "docker"], "item": "docker", "name": ["docker"], "requirements": null, "state": "present", "stderr": "", "stderr_lines": [], "stdout": "Collecting docker\n Downloading docker-7.1.0-py3-none-any.whl (147 kB)\n ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ 147.8/147.8 kB 3.7 MB/s eta 0:00:00\nRequirement already satisfied: requests>=2.26.0 in /home/zuul/venv/lib/python3.11/site-packages (from docker) (2.34.2)\nRequirement already satisfied: urllib3>=1.26.0 in /home/zuul/venv/lib/python3.11/site-packages (from docker) (2.7.0)\nRequirement already satisfied: charset_normalizer<4,>=2 in /home/zuul/venv/lib/python3.11/site-packages (from requests>=2.26.0->docker) (3.4.7)\nRequirement already satisfied: idna<4,>=2.5 in /home/zuul/venv/lib/python3.11/site-packages (from requests>=2.26.0->docker) (3.18)\nRequirement already satisfied: certifi>=2023.5.7 in /home/zuul/venv/lib/python3.11/site-packages (from requests>=2.26.0->docker) (2026.6.17)\nInstalling collected packages: docker\nSuccessfully installed docker-7.1.0\n", "stdout_lines": ["Collecting docker", " Downloading docker-7.1.0-py3-none-any.whl (147 kB)", " ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ 147.8/147.8 kB 3.7 MB/s eta 0:00:00", "Requirement already satisfied: requests>=2.26.0 in /home/zuul/venv/lib/python3.11/site-packages (from docker) (2.34.2)", "Requirement already satisfied: urllib3>=1.26.0 in /home/zuul/venv/lib/python3.11/site-packages (from docker) (2.7.0)", "Requirement already satisfied: charset_normalizer<4,>=2 in /home/zuul/venv/lib/python3.11/site-packages (from requests>=2.26.0->docker) (3.4.7)", "Requirement already satisfied: idna<4,>=2.5 in /home/zuul/venv/lib/python3.11/site-packages (from requests>=2.26.0->docker) (3.18)", "Requirement already satisfied: certifi>=2023.5.7 in /home/zuul/venv/lib/python3.11/site-packages (from requests>=2.26.0->docker) (2026.6.17)", "Installing collected packages: docker", "Successfully installed docker-7.1.0"], "version": null, "virtualenv": "/home/zuul/venv"} 2026-06-19 15:44:04.123708 | debian-bookworm | changed: [molecule-auditd] => (item=netaddr) => {"ansible_loop_var": "item", "changed": true, "cmd": ["/home/zuul/venv/bin/pip3", "install", "netaddr"], "item": "netaddr", "name": ["netaddr"], "requirements": null, "state": "present", "stderr": "", "stderr_lines": [], "stdout": "Collecting netaddr\n Downloading netaddr-1.3.0-py3-none-any.whl (2.3 MB)\n ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ 2.3/2.3 MB 13.7 MB/s eta 0:00:00\nInstalling collected packages: netaddr\nSuccessfully installed netaddr-1.3.0\n", "stdout_lines": ["Collecting netaddr", " Downloading netaddr-1.3.0-py3-none-any.whl (2.3 MB)", " ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ 2.3/2.3 MB 13.7 MB/s eta 0:00:00", "Installing collected packages: netaddr", "Successfully installed netaddr-1.3.0"], "version": null, "virtualenv": "/home/zuul/venv"} 2026-06-19 15:44:04.123877 | debian-bookworm | ok: [molecule-auditd] => (item=requests) => {"ansible_loop_var": "item", "changed": false, "cmd": ["/home/zuul/venv/bin/pip3", "install", "requests"], "item": "requests", "name": ["requests"], "requirements": null, "state": "present", "stderr": "", "stderr_lines": [], "stdout": "Requirement already satisfied: requests in /home/zuul/venv/lib/python3.11/site-packages (2.34.2)\nRequirement already satisfied: charset_normalizer<4,>=2 in /home/zuul/venv/lib/python3.11/site-packages (from requests) (3.4.7)\nRequirement already satisfied: idna<4,>=2.5 in /home/zuul/venv/lib/python3.11/site-packages (from requests) (3.18)\nRequirement already satisfied: urllib3<3,>=1.26 in /home/zuul/venv/lib/python3.11/site-packages (from requests) (2.7.0)\nRequirement already satisfied: certifi>=2023.5.7 in /home/zuul/venv/lib/python3.11/site-packages (from requests) (2026.6.17)\n", "stdout_lines": ["Requirement already satisfied: requests in /home/zuul/venv/lib/python3.11/site-packages (2.34.2)", "Requirement already satisfied: charset_normalizer<4,>=2 in /home/zuul/venv/lib/python3.11/site-packages (from requests) (3.4.7)", "Requirement already satisfied: idna<4,>=2.5 in /home/zuul/venv/lib/python3.11/site-packages (from requests) (3.18)", "Requirement already satisfied: urllib3<3,>=1.26 in /home/zuul/venv/lib/python3.11/site-packages (from requests) (2.7.0)", "Requirement already satisfied: certifi>=2023.5.7 in /home/zuul/venv/lib/python3.11/site-packages (from requests) (2026.6.17)"], "version": null, "virtualenv": "/home/zuul/venv"} 2026-06-19 15:44:04.123953 | debian-bookworm | 2026-06-19 15:44:04.124058 | debian-bookworm | TASK [Include required prepare tasks] ****************************************** 2026-06-19 15:44:04.146994 | debian-bookworm | included: /home/zuul/src/github.com/osism/ansible-collection-services/molecule/delegated/prepare/auditd.yml for molecule-auditd 2026-06-19 15:44:04.147077 | debian-bookworm | 2026-06-19 15:44:04.147215 | debian-bookworm | PLAY RECAP ********************************************************************* 2026-06-19 15:44:04.147328 | debian-bookworm | molecule-auditd : ok=3 changed=1 unreachable=0 failed=0 skipped=0 rescued=0 ignored=0 2026-06-19 15:44:04.147423 | debian-bookworm | 2026-06-19 15:44:04.227521 | debian-bookworm | INFO [delegated > prepare] Executed: Successful 2026-06-19 15:44:04.228169 | debian-bookworm | INFO Molecule executed 1 scenario (1 successful) 2026-06-19 15:44:05.842250 | ubuntu-noble | changed: [molecule-auditd] => (item=docker) => {"ansible_loop_var": "item", "changed": true, "cmd": ["/home/zuul/venv/bin/pip3", "install", "docker"], "item": "docker", "name": ["docker"], "requirements": null, "state": "present", "stderr": "", "stderr_lines": [], "stdout": "Collecting docker\n Downloading docker-7.1.0-py3-none-any.whl.metadata (3.8 kB)\nRequirement already satisfied: requests>=2.26.0 in /home/zuul/venv/lib/python3.12/site-packages (from docker) (2.34.2)\nRequirement already satisfied: urllib3>=1.26.0 in /home/zuul/venv/lib/python3.12/site-packages (from docker) (2.7.0)\nRequirement already satisfied: charset_normalizer<4,>=2 in /home/zuul/venv/lib/python3.12/site-packages (from requests>=2.26.0->docker) (3.4.7)\nRequirement already satisfied: idna<4,>=2.5 in /home/zuul/venv/lib/python3.12/site-packages (from requests>=2.26.0->docker) (3.18)\nRequirement already satisfied: certifi>=2023.5.7 in /home/zuul/venv/lib/python3.12/site-packages (from requests>=2.26.0->docker) (2026.6.17)\nDownloading docker-7.1.0-py3-none-any.whl (147 kB)\n ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ 147.8/147.8 kB 3.2 MB/s eta 0:00:00\nInstalling collected packages: docker\nSuccessfully installed docker-7.1.0\n", "stdout_lines": ["Collecting docker", " Downloading docker-7.1.0-py3-none-any.whl.metadata (3.8 kB)", "Requirement already satisfied: requests>=2.26.0 in /home/zuul/venv/lib/python3.12/site-packages (from docker) (2.34.2)", "Requirement already satisfied: urllib3>=1.26.0 in /home/zuul/venv/lib/python3.12/site-packages (from docker) (2.7.0)", "Requirement already satisfied: charset_normalizer<4,>=2 in /home/zuul/venv/lib/python3.12/site-packages (from requests>=2.26.0->docker) (3.4.7)", "Requirement already satisfied: idna<4,>=2.5 in /home/zuul/venv/lib/python3.12/site-packages (from requests>=2.26.0->docker) (3.18)", "Requirement already satisfied: certifi>=2023.5.7 in /home/zuul/venv/lib/python3.12/site-packages (from requests>=2.26.0->docker) (2026.6.17)", "Downloading docker-7.1.0-py3-none-any.whl (147 kB)", " ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ 147.8/147.8 kB 3.2 MB/s eta 0:00:00", "Installing collected packages: docker", "Successfully installed docker-7.1.0"], "version": null, "virtualenv": "/home/zuul/venv"} 2026-06-19 15:44:05.842938 | ubuntu-noble | changed: [molecule-auditd] => (item=netaddr) => {"ansible_loop_var": "item", "changed": true, "cmd": ["/home/zuul/venv/bin/pip3", "install", "netaddr"], "item": "netaddr", "name": ["netaddr"], "requirements": null, "state": "present", "stderr": "", "stderr_lines": [], "stdout": "Collecting netaddr\n Downloading netaddr-1.3.0-py3-none-any.whl.metadata (5.0 kB)\nDownloading netaddr-1.3.0-py3-none-any.whl (2.3 MB)\n ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ 2.3/2.3 MB 12.9 MB/s eta 0:00:00\nInstalling collected packages: netaddr\nSuccessfully installed netaddr-1.3.0\n", "stdout_lines": ["Collecting netaddr", " Downloading netaddr-1.3.0-py3-none-any.whl.metadata (5.0 kB)", "Downloading netaddr-1.3.0-py3-none-any.whl (2.3 MB)", " ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ 2.3/2.3 MB 12.9 MB/s eta 0:00:00", "Installing collected packages: netaddr", "Successfully installed netaddr-1.3.0"], "version": null, "virtualenv": "/home/zuul/venv"} 2026-06-19 15:44:05.843199 | ubuntu-noble | ok: [molecule-auditd] => (item=requests) => {"ansible_loop_var": "item", "changed": false, "cmd": ["/home/zuul/venv/bin/pip3", "install", "requests"], "item": "requests", "name": ["requests"], "requirements": null, "state": "present", "stderr": "", "stderr_lines": [], "stdout": "Requirement already satisfied: requests in /home/zuul/venv/lib/python3.12/site-packages (2.34.2)\nRequirement already satisfied: charset_normalizer<4,>=2 in /home/zuul/venv/lib/python3.12/site-packages (from requests) (3.4.7)\nRequirement already satisfied: idna<4,>=2.5 in /home/zuul/venv/lib/python3.12/site-packages (from requests) (3.18)\nRequirement already satisfied: urllib3<3,>=1.26 in /home/zuul/venv/lib/python3.12/site-packages (from requests) (2.7.0)\nRequirement already satisfied: certifi>=2023.5.7 in /home/zuul/venv/lib/python3.12/site-packages (from requests) (2026.6.17)\n", "stdout_lines": ["Requirement already satisfied: requests in /home/zuul/venv/lib/python3.12/site-packages (2.34.2)", "Requirement already satisfied: charset_normalizer<4,>=2 in /home/zuul/venv/lib/python3.12/site-packages (from requests) (3.4.7)", "Requirement already satisfied: idna<4,>=2.5 in /home/zuul/venv/lib/python3.12/site-packages (from requests) (3.18)", "Requirement already satisfied: urllib3<3,>=1.26 in /home/zuul/venv/lib/python3.12/site-packages (from requests) (2.7.0)", "Requirement already satisfied: certifi>=2023.5.7 in /home/zuul/venv/lib/python3.12/site-packages (from requests) (2026.6.17)"], "version": null, "virtualenv": "/home/zuul/venv"} 2026-06-19 15:44:05.843408 | ubuntu-noble | 2026-06-19 15:44:05.843602 | ubuntu-noble | TASK [Include required prepare tasks] ****************************************** 2026-06-19 15:44:05.864079 | ubuntu-noble | included: /home/zuul/src/github.com/osism/ansible-collection-services/molecule/delegated/prepare/auditd.yml for molecule-auditd 2026-06-19 15:44:05.864258 | ubuntu-noble | 2026-06-19 15:44:05.864471 | ubuntu-noble | PLAY RECAP ********************************************************************* 2026-06-19 15:44:05.864654 | ubuntu-noble | molecule-auditd : ok=3 changed=1 unreachable=0 failed=0 skipped=0 rescued=0 ignored=0 2026-06-19 15:44:05.864809 | ubuntu-noble | 2026-06-19 15:44:05.987189 | ubuntu-noble | INFO [delegated > prepare] Executed: Successful 2026-06-19 15:44:05.988016 | ubuntu-noble | INFO Molecule executed 1 scenario (1 successful) 2026-06-19 15:44:06.376743 | debian-bookworm | ok: Runtime: 0:00:08.670192 2026-06-19 15:44:06.392502 | ubuntu-noble | ok: Runtime: 0:00:10.384593 2026-06-19 15:44:06.401182 | 2026-06-19 15:44:06.401331 | TASK [ansible-molecule : Reset connection] 2026-06-19 15:44:06.451337 | 2026-06-19 15:44:06.451516 | TASK [ansible-molecule : Reset connection] 2026-06-19 15:44:06.503045 | 2026-06-19 15:44:06.503242 | TASK [ansible-molecule : Run molecule converge action with scenario delegated] 2026-06-19 15:44:07.282939 | debian-bookworm | WARNING Molecule scenarios should migrate to 'extensions/molecule' 2026-06-19 15:44:07.292034 | debian-bookworm | DEBUG [unknown > config] provisioner.env found in /home/zuul/src/github.com/osism/ansible-collection-services/molecule/delegated/molecule.yml, this can be defined in ansible.env 2026-06-19 15:44:07.442392 | ubuntu-noble | WARNING Molecule scenarios should migrate to 'extensions/molecule' 2026-06-19 15:44:07.453996 | ubuntu-noble | DEBUG [unknown > config] provisioner.env found in /home/zuul/src/github.com/osism/ansible-collection-services/molecule/delegated/molecule.yml, this can be defined in ansible.env 2026-06-19 15:44:07.856624 | debian-bookworm | DEBUG [unknown > config] provisioner.env found in /home/zuul/src/github.com/osism/ansible-collection-services/molecule/delegated/molecule.yml, this can be defined in ansible.env 2026-06-19 15:44:07.857343 | debian-bookworm | DEBUG [delegated > validate] Validating schema /home/zuul/src/github.com/osism/ansible-collection-services/molecule/delegated/molecule.yml. 2026-06-19 15:44:07.876267 | debian-bookworm | DEBUG [default > validate] Validating schema /home/zuul/src/github.com/osism/ansible-collection-services/molecule/default/molecule.yml. 2026-06-19 15:44:07.882162 | debian-bookworm | INFO [delegated > discovery] scenario test matrix: dependency, create, prepare, converge 2026-06-19 15:44:07.882313 | debian-bookworm | INFO [delegated > prerun] Performing prerun with role_name_check=0... 2026-06-19 15:44:08.168042 | ubuntu-noble | DEBUG [unknown > config] provisioner.env found in /home/zuul/src/github.com/osism/ansible-collection-services/molecule/delegated/molecule.yml, this can be defined in ansible.env 2026-06-19 15:44:08.168927 | ubuntu-noble | DEBUG [delegated > validate] Validating schema /home/zuul/src/github.com/osism/ansible-collection-services/molecule/delegated/molecule.yml. 2026-06-19 15:44:08.192586 | ubuntu-noble | DEBUG [default > validate] Validating schema /home/zuul/src/github.com/osism/ansible-collection-services/molecule/default/molecule.yml. 2026-06-19 15:44:08.198587 | ubuntu-noble | INFO [delegated > discovery] scenario test matrix: dependency, create, prepare, converge 2026-06-19 15:44:08.198742 | ubuntu-noble | INFO [delegated > prerun] Performing prerun with role_name_check=0... 2026-06-19 15:44:09.142019 | debian-bookworm | INFO [delegated > dependency] Executing 2026-06-19 15:44:09.142593 | debian-bookworm | WARNING [delegated > dependency] Missing roles requirements file: requirements.yml 2026-06-19 15:44:09.599299 | debian-bookworm | ansible-galaxy [core 2.19.11] 2026-06-19 15:44:09.599390 | debian-bookworm | config file = None 2026-06-19 15:44:09.599411 | debian-bookworm | configured module search path = ['/home/zuul/src/github.com/osism/ansible-collection-services/plugins/modules', '/home/zuul/.ansible/plugins/modules', '/usr/share/ansible/plugins/modules'] 2026-06-19 15:44:09.599426 | debian-bookworm | ansible python module location = /home/zuul/venv/lib/python3.11/site-packages/ansible 2026-06-19 15:44:09.599560 | debian-bookworm | ansible collection location = /home/zuul/.ansible/collections:/usr/share/ansible/collections:/home/zuul/venv/lib/python3.11/site-packages:/home/zuul/venv/lib/python3.11/dist-packages:/home/zuul/venv/lib/python3/dist-packages:/home/zuul/venv/local/lib/python3.11/dist-packages 2026-06-19 15:44:09.600044 | debian-bookworm | executable location = /home/zuul/venv/bin/ansible-galaxy 2026-06-19 15:44:09.600428 | debian-bookworm | python version = 3.11.2 (main, Apr 8 2026, 01:58:00) [GCC 12.2.0] (/home/zuul/venv/bin/python3) 2026-06-19 15:44:09.600870 | debian-bookworm | jinja version = 3.1.6 2026-06-19 15:44:09.601238 | debian-bookworm | pyyaml version = 6.0.3 (with libyaml v0.2.5) 2026-06-19 15:44:09.601576 | debian-bookworm | No config file found; using defaults 2026-06-19 15:44:09.602137 | debian-bookworm | Reading requirement file at '/home/zuul/src/github.com/osism/ansible-collection-services/molecule/delegated/collections.yml' 2026-06-19 15:44:09.605550 | debian-bookworm | Loading collection ansible._protomatter from /home/zuul/venv/lib/python3.11/site-packages/ansible/_internal/ansible_collections/ansible/_protomatter 2026-06-19 15:44:09.606082 | debian-bookworm | Found installed collection ansible._protomatter:2.19.11 at '/home/zuul/venv/lib/python3.11/site-packages/ansible/_internal/ansible_collections/ansible/_protomatter' 2026-06-19 15:44:09.609959 | debian-bookworm | Loading collection osism.commons from /home/zuul/.ansible/collections/ansible_collections/osism/commons 2026-06-19 15:44:09.611840 | debian-bookworm | Found installed collection osism.commons:0.20260601.0 at '/home/zuul/.ansible/collections/ansible_collections/osism/commons' 2026-06-19 15:44:09.614112 | debian-bookworm | Loading collection osism.services from /home/zuul/.ansible/collections/ansible_collections/osism/services 2026-06-19 15:44:09.614886 | debian-bookworm | Found installed collection osism.services:999.0.0 at '/home/zuul/.ansible/collections/ansible_collections/osism/services' 2026-06-19 15:44:09.618374 | debian-bookworm | Loading collection cisco.ucs from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/cisco/ucs 2026-06-19 15:44:09.618866 | debian-bookworm | Found installed collection cisco.ucs:1.16.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/cisco/ucs' 2026-06-19 15:44:09.619347 | debian-bookworm | Loading collection f5networks.f5_modules from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/f5networks/f5_modules 2026-06-19 15:44:09.619772 | debian-bookworm | Found installed collection f5networks.f5_modules:1.39.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/f5networks/f5_modules' 2026-06-19 15:44:09.620292 | debian-bookworm | Loading collection ansible.windows from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/ansible/windows 2026-06-19 15:44:09.620620 | debian-bookworm | Found installed collection ansible.windows:3.2.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/ansible/windows' 2026-06-19 15:44:09.622038 | debian-bookworm | Loading collection cisco.meraki from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/cisco/meraki 2026-06-19 15:44:09.622441 | debian-bookworm | Found installed collection cisco.meraki:2.21.8 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/cisco/meraki' 2026-06-19 15:44:09.622850 | debian-bookworm | Loading collection community.routeros from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/routeros 2026-06-19 15:44:09.623163 | debian-bookworm | Found installed collection community.routeros:3.13.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/routeros' 2026-06-19 15:44:09.623619 | debian-bookworm | Loading collection cisco.dnac from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/cisco/dnac 2026-06-19 15:44:09.623956 | debian-bookworm | Found installed collection cisco.dnac:6.41.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/cisco/dnac' 2026-06-19 15:44:09.624353 | debian-bookworm | Loading collection community.grafana from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/grafana 2026-06-19 15:44:09.624664 | debian-bookworm | Found installed collection community.grafana:2.3.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/grafana' 2026-06-19 15:44:09.625078 | debian-bookworm | Loading collection arista.eos from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/arista/eos 2026-06-19 15:44:09.625384 | debian-bookworm | Found installed collection arista.eos:12.0.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/arista/eos' 2026-06-19 15:44:09.627303 | debian-bookworm | Loading collection vmware.vmware_rest from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/vmware/vmware_rest 2026-06-19 15:44:09.627650 | debian-bookworm | Found installed collection vmware.vmware_rest:4.9.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/vmware/vmware_rest' 2026-06-19 15:44:09.628041 | debian-bookworm | Loading collection community.mysql from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/mysql 2026-06-19 15:44:09.628355 | debian-bookworm | Found installed collection community.mysql:3.16.1 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/mysql' 2026-06-19 15:44:09.628767 | debian-bookworm | Loading collection dellemc.unity from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/dellemc/unity 2026-06-19 15:44:09.629116 | debian-bookworm | Found installed collection dellemc.unity:2.1.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/dellemc/unity' 2026-06-19 15:44:09.630238 | debian-bookworm | Loading collection amazon.aws from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/amazon/aws 2026-06-19 15:44:09.630569 | debian-bookworm | Found installed collection amazon.aws:10.1.2 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/amazon/aws' 2026-06-19 15:44:09.631023 | debian-bookworm | Loading collection purestorage.flasharray from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/purestorage/flasharray 2026-06-19 15:44:09.631435 | debian-bookworm | Found installed collection purestorage.flasharray:1.39.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/purestorage/flasharray' 2026-06-19 15:44:09.631695 | debian-bookworm | Loading collection community.mongodb from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/mongodb 2026-06-19 15:44:09.632039 | debian-bookworm | Found installed collection community.mongodb:1.7.10 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/mongodb' 2026-06-19 15:44:09.632357 | debian-bookworm | Loading collection vyos.vyos from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/vyos/vyos 2026-06-19 15:44:09.632672 | debian-bookworm | Found installed collection vyos.vyos:6.0.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/vyos/vyos' 2026-06-19 15:44:09.633069 | debian-bookworm | Loading collection dellemc.openmanage from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/dellemc/openmanage 2026-06-19 15:44:09.633386 | debian-bookworm | Found installed collection dellemc.openmanage:9.12.3 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/dellemc/openmanage' 2026-06-19 15:44:09.633695 | debian-bookworm | Loading collection community.postgresql from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/postgresql 2026-06-19 15:44:09.634069 | debian-bookworm | Found installed collection community.postgresql:4.1.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/postgresql' 2026-06-19 15:44:09.634389 | debian-bookworm | Loading collection vultr.cloud from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/vultr/cloud 2026-06-19 15:44:09.634643 | debian-bookworm | Found installed collection vultr.cloud:1.13.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/vultr/cloud' 2026-06-19 15:44:09.635388 | debian-bookworm | Loading collection google.cloud from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/google/cloud 2026-06-19 15:44:09.635674 | debian-bookworm | Found installed collection google.cloud:1.9.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/google/cloud' 2026-06-19 15:44:09.635952 | debian-bookworm | Loading collection community.dns from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/dns 2026-06-19 15:44:09.636209 | debian-bookworm | Found installed collection community.dns:3.4.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/dns' 2026-06-19 15:44:09.636765 | debian-bookworm | Loading collection cloudscale_ch.cloud from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/cloudscale_ch/cloud 2026-06-19 15:44:09.637046 | debian-bookworm | Found installed collection cloudscale_ch.cloud:2.5.2 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/cloudscale_ch/cloud' 2026-06-19 15:44:09.637296 | debian-bookworm | Loading collection grafana.grafana from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/grafana/grafana 2026-06-19 15:44:09.637552 | debian-bookworm | Found installed collection grafana.grafana:6.0.6 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/grafana/grafana' 2026-06-19 15:44:09.637829 | debian-bookworm | Loading collection hitachivantara.vspone_block from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/hitachivantara/vspone_block 2026-06-19 15:44:09.638085 | debian-bookworm | Found installed collection hitachivantara.vspone_block:4.4.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/hitachivantara/vspone_block' 2026-06-19 15:44:09.638615 | debian-bookworm | Loading collection splunk.es from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/splunk/es 2026-06-19 15:44:09.638870 | debian-bookworm | Found installed collection splunk.es:4.0.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/splunk/es' 2026-06-19 15:44:09.639092 | debian-bookworm | Loading collection infoblox.nios_modules from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/infoblox/nios_modules 2026-06-19 15:44:09.639360 | debian-bookworm | Found installed collection infoblox.nios_modules:1.8.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/infoblox/nios_modules' 2026-06-19 15:44:09.639583 | debian-bookworm | Loading collection containers.podman from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/containers/podman 2026-06-19 15:44:09.639802 | debian-bookworm | Found installed collection containers.podman:1.18.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/containers/podman' 2026-06-19 15:44:09.640047 | debian-bookworm | Loading collection microsoft.iis from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/microsoft/iis 2026-06-19 15:44:09.640297 | debian-bookworm | Found installed collection microsoft.iis:1.0.3 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/microsoft/iis' 2026-06-19 15:44:09.640592 | debian-bookworm | Loading collection check_point.mgmt from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/check_point/mgmt 2026-06-19 15:44:09.640877 | debian-bookworm | Found installed collection check_point.mgmt:6.6.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/check_point/mgmt' 2026-06-19 15:44:09.641129 | debian-bookworm | Loading collection ibm.storage_virtualize from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/ibm/storage_virtualize 2026-06-19 15:44:09.641331 | debian-bookworm | Found installed collection ibm.storage_virtualize:2.7.4 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/ibm/storage_virtualize' 2026-06-19 15:44:09.641621 | debian-bookworm | Loading collection lowlydba.sqlserver from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/lowlydba/sqlserver 2026-06-19 15:44:09.641984 | debian-bookworm | Found installed collection lowlydba.sqlserver:2.7.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/lowlydba/sqlserver' 2026-06-19 15:44:09.642514 | debian-bookworm | Loading collection vmware.vmware from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/vmware/vmware 2026-06-19 15:44:09.642865 | debian-bookworm | Found installed collection vmware.vmware:2.4.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/vmware/vmware' 2026-06-19 15:44:09.643210 | debian-bookworm | Loading collection ansible.netcommon from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/ansible/netcommon 2026-06-19 15:44:09.643540 | debian-bookworm | Found installed collection ansible.netcommon:8.1.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/ansible/netcommon' 2026-06-19 15:44:09.644021 | debian-bookworm | Loading collection community.hrobot from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/hrobot 2026-06-19 15:44:09.644370 | debian-bookworm | Found installed collection community.hrobot:2.7.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/hrobot' 2026-06-19 15:44:09.644595 | debian-bookworm | Loading collection community.proxysql from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/proxysql 2026-06-19 15:44:09.644961 | debian-bookworm | Found installed collection community.proxysql:1.7.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/proxysql' 2026-06-19 15:44:09.645373 | debian-bookworm | Loading collection community.hashi_vault from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/hashi_vault 2026-06-19 15:44:09.645683 | debian-bookworm | Found installed collection community.hashi_vault:7.1.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/hashi_vault' 2026-06-19 15:44:09.645924 | debian-bookworm | Loading collection community.library_inventory_filtering_v1 from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/library_inventory_filtering_v1 2026-06-19 15:44:09.646250 | debian-bookworm | Found installed collection community.library_inventory_filtering_v1:1.1.5 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/library_inventory_filtering_v1' 2026-06-19 15:44:09.646480 | debian-bookworm | Loading collection chocolatey.chocolatey from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/chocolatey/chocolatey 2026-06-19 15:44:09.646770 | debian-bookworm | Found installed collection chocolatey.chocolatey:1.5.3 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/chocolatey/chocolatey' 2026-06-19 15:44:09.648534 | debian-bookworm | Loading collection community.windows from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/windows 2026-06-19 15:44:09.648852 | debian-bookworm | Found installed collection community.windows:3.0.1 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/windows' 2026-06-19 15:44:09.649060 | debian-bookworm | Loading collection cisco.intersight from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/cisco/intersight 2026-06-19 15:44:09.649271 | debian-bookworm | Found installed collection cisco.intersight:2.7.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/cisco/intersight' 2026-06-19 15:44:09.650177 | debian-bookworm | Loading collection netapp_eseries.santricity from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/netapp_eseries/santricity 2026-06-19 15:44:09.650709 | debian-bookworm | Found installed collection netapp_eseries.santricity:1.4.1 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/netapp_eseries/santricity' 2026-06-19 15:44:09.651294 | debian-bookworm | Loading collection netapp.cloudmanager from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/netapp/cloudmanager 2026-06-19 15:44:09.651745 | debian-bookworm | Found installed collection netapp.cloudmanager:21.24.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/netapp/cloudmanager' 2026-06-19 15:44:09.652256 | debian-bookworm | Loading collection community.zabbix from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/zabbix 2026-06-19 15:44:09.652614 | debian-bookworm | Found installed collection community.zabbix:4.1.1 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/zabbix' 2026-06-19 15:44:09.653105 | debian-bookworm | Loading collection theforeman.foreman from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/theforeman/foreman 2026-06-19 15:44:09.653451 | debian-bookworm | Found installed collection theforeman.foreman:5.7.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/theforeman/foreman' 2026-06-19 15:44:09.653888 | debian-bookworm | Loading collection netapp.storagegrid from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/netapp/storagegrid 2026-06-19 15:44:09.654314 | debian-bookworm | Found installed collection netapp.storagegrid:21.15.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/netapp/storagegrid' 2026-06-19 15:44:09.654648 | debian-bookworm | Loading collection cyberark.pas from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/cyberark/pas 2026-06-19 15:44:09.655094 | debian-bookworm | Found installed collection cyberark.pas:1.0.36 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/cyberark/pas' 2026-06-19 15:44:09.655625 | debian-bookworm | Loading collection community.vmware from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/vmware 2026-06-19 15:44:09.656008 | debian-bookworm | Found installed collection community.vmware:5.10.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/vmware' 2026-06-19 15:44:09.656447 | debian-bookworm | Loading collection cisco.iosxr from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/cisco/iosxr 2026-06-19 15:44:09.656792 | debian-bookworm | Found installed collection cisco.iosxr:12.1.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/cisco/iosxr' 2026-06-19 15:44:09.657261 | debian-bookworm | Loading collection kubernetes.core from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/kubernetes/core 2026-06-19 15:44:09.657564 | debian-bookworm | Found installed collection kubernetes.core:6.2.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/kubernetes/core' 2026-06-19 15:44:09.657970 | debian-bookworm | Loading collection microsoft.ad from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/microsoft/ad 2026-06-19 15:44:09.658268 | debian-bookworm | Found installed collection microsoft.ad:1.9.2 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/microsoft/ad' 2026-06-19 15:44:09.661240 | debian-bookworm | Loading collection fortinet.fortios from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/fortinet/fortios 2026-06-19 15:44:09.661658 | debian-bookworm | Found installed collection fortinet.fortios:2.4.2 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/fortinet/fortios' 2026-06-19 15:44:09.661972 | debian-bookworm | Loading collection purestorage.flashblade from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/purestorage/flashblade 2026-06-19 15:44:09.662332 | debian-bookworm | Found installed collection purestorage.flashblade:1.22.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/purestorage/flashblade' 2026-06-19 15:44:09.662604 | debian-bookworm | Loading collection inspur.ispim from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/inspur/ispim 2026-06-19 15:44:09.662909 | debian-bookworm | Found installed collection inspur.ispim:2.2.3 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/inspur/ispim' 2026-06-19 15:44:09.664080 | debian-bookworm | Loading collection azure.azcollection from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/azure/azcollection 2026-06-19 15:44:09.664429 | debian-bookworm | Found installed collection azure.azcollection:3.10.1 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/azure/azcollection' 2026-06-19 15:44:09.665038 | debian-bookworm | Loading collection cisco.ios from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/cisco/ios 2026-06-19 15:44:09.665363 | debian-bookworm | Found installed collection cisco.ios:11.1.1 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/cisco/ios' 2026-06-19 15:44:09.665800 | debian-bookworm | Loading collection ngine_io.cloudstack from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/ngine_io/cloudstack 2026-06-19 15:44:09.666154 | debian-bookworm | Found installed collection ngine_io.cloudstack:2.5.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/ngine_io/cloudstack' 2026-06-19 15:44:09.667765 | debian-bookworm | Loading collection cisco.aci from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/cisco/aci 2026-06-19 15:44:09.668141 | debian-bookworm | Found installed collection cisco.aci:2.12.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/cisco/aci' 2026-06-19 15:44:09.668471 | debian-bookworm | Loading collection community.proxmox from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/proxmox 2026-06-19 15:44:09.668724 | debian-bookworm | Found installed collection community.proxmox:1.4.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/proxmox' 2026-06-19 15:44:09.669081 | debian-bookworm | Loading collection community.docker from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/docker 2026-06-19 15:44:09.669327 | debian-bookworm | Found installed collection community.docker:4.8.2 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/docker' 2026-06-19 15:44:09.669639 | debian-bookworm | Loading collection ansible.utils from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/ansible/utils 2026-06-19 15:44:09.669909 | debian-bookworm | Found installed collection ansible.utils:6.0.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/ansible/utils' 2026-06-19 15:44:09.670958 | debian-bookworm | Loading collection cisco.nxos from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/cisco/nxos 2026-06-19 15:44:09.671410 | debian-bookworm | Found installed collection cisco.nxos:11.0.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/cisco/nxos' 2026-06-19 15:44:09.673127 | debian-bookworm | Loading collection awx.awx from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/awx/awx 2026-06-19 15:44:09.673453 | debian-bookworm | Found installed collection awx.awx:24.6.1 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/awx/awx' 2026-06-19 15:44:09.673770 | debian-bookworm | Loading collection kubevirt.core from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/kubevirt/core 2026-06-19 15:44:09.674146 | debian-bookworm | Found installed collection kubevirt.core:2.2.3 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/kubevirt/core' 2026-06-19 15:44:09.674396 | debian-bookworm | Loading collection community.sap_libs from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/sap_libs 2026-06-19 15:44:09.674713 | debian-bookworm | Found installed collection community.sap_libs:1.5.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/sap_libs' 2026-06-19 15:44:09.674983 | debian-bookworm | Loading collection community.ciscosmb from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/ciscosmb 2026-06-19 15:44:09.675379 | debian-bookworm | Found installed collection community.ciscosmb:1.0.11 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/ciscosmb' 2026-06-19 15:44:09.675670 | debian-bookworm | Loading collection telekom_mms.icinga_director from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/telekom_mms/icinga_director 2026-06-19 15:44:09.676032 | debian-bookworm | Found installed collection telekom_mms.icinga_director:2.4.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/telekom_mms/icinga_director' 2026-06-19 15:44:09.676284 | debian-bookworm | Loading collection hitachivantara.vspone_object from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/hitachivantara/vspone_object 2026-06-19 15:44:09.676529 | debian-bookworm | Found installed collection hitachivantara.vspone_object:1.0.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/hitachivantara/vspone_object' 2026-06-19 15:44:09.676895 | debian-bookworm | Loading collection ibm.qradar from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/ibm/qradar 2026-06-19 15:44:09.677166 | debian-bookworm | Found installed collection ibm.qradar:4.0.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/ibm/qradar' 2026-06-19 15:44:09.677488 | debian-bookworm | Loading collection netapp.ontap from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/netapp/ontap 2026-06-19 15:44:09.677787 | debian-bookworm | Found installed collection netapp.ontap:23.2.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/netapp/ontap' 2026-06-19 15:44:09.682375 | debian-bookworm | Loading collection fortinet.fortimanager from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/fortinet/fortimanager 2026-06-19 15:44:09.682722 | debian-bookworm | Found installed collection fortinet.fortimanager:2.11.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/fortinet/fortimanager' 2026-06-19 15:44:09.683079 | debian-bookworm | Loading collection ansible.posix from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/ansible/posix 2026-06-19 15:44:09.683548 | debian-bookworm | Found installed collection ansible.posix:2.1.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/ansible/posix' 2026-06-19 15:44:09.683971 | debian-bookworm | Loading collection community.sops from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/sops 2026-06-19 15:44:09.684250 | debian-bookworm | Found installed collection community.sops:2.2.7 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/sops' 2026-06-19 15:44:09.684614 | debian-bookworm | Loading collection dellemc.powerflex from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/dellemc/powerflex 2026-06-19 15:44:09.685249 | debian-bookworm | Found installed collection dellemc.powerflex:2.6.1 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/dellemc/powerflex' 2026-06-19 15:44:09.685647 | debian-bookworm | Loading collection ieisystem.inmanage from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/ieisystem/inmanage 2026-06-19 15:44:09.685986 | debian-bookworm | Found installed collection ieisystem.inmanage:3.0.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/ieisystem/inmanage' 2026-06-19 15:44:09.686267 | debian-bookworm | Loading collection openstack.cloud from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/openstack/cloud 2026-06-19 15:44:09.686626 | debian-bookworm | Found installed collection openstack.cloud:2.5.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/openstack/cloud' 2026-06-19 15:44:09.686921 | debian-bookworm | Loading collection community.crypto from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/crypto 2026-06-19 15:44:09.687323 | debian-bookworm | Found installed collection community.crypto:3.0.5 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/crypto' 2026-06-19 15:44:09.687673 | debian-bookworm | Loading collection ovirt.ovirt from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/ovirt/ovirt 2026-06-19 15:44:09.688012 | debian-bookworm | Found installed collection ovirt.ovirt:3.2.1 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/ovirt/ovirt' 2026-06-19 15:44:09.688704 | debian-bookworm | Loading collection junipernetworks.junos from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/junipernetworks/junos 2026-06-19 15:44:09.689078 | debian-bookworm | Found installed collection junipernetworks.junos:11.0.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/junipernetworks/junos' 2026-06-19 15:44:09.689404 | debian-bookworm | Loading collection cyberark.conjur from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/cyberark/conjur 2026-06-19 15:44:09.689722 | debian-bookworm | Found installed collection cyberark.conjur:1.3.8 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/cyberark/conjur' 2026-06-19 15:44:09.690041 | debian-bookworm | Loading collection community.libvirt from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/libvirt 2026-06-19 15:44:09.690407 | debian-bookworm | Found installed collection community.libvirt:2.0.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/libvirt' 2026-06-19 15:44:09.693003 | debian-bookworm | Loading collection community.aws from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/aws 2026-06-19 15:44:09.693335 | debian-bookworm | Found installed collection community.aws:10.0.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/aws' 2026-06-19 15:44:09.693634 | debian-bookworm | Loading collection kaytus.ksmanage from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/kaytus/ksmanage 2026-06-19 15:44:09.693948 | debian-bookworm | Found installed collection kaytus.ksmanage:2.0.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/kaytus/ksmanage' 2026-06-19 15:44:09.694569 | debian-bookworm | Loading collection community.digitalocean from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/digitalocean 2026-06-19 15:44:09.694908 | debian-bookworm | Found installed collection community.digitalocean:1.27.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/digitalocean' 2026-06-19 15:44:09.695365 | debian-bookworm | Loading collection ravendb.ravendb from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/ravendb/ravendb 2026-06-19 15:44:09.695687 | debian-bookworm | Found installed collection ravendb.ravendb:1.0.4 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/ravendb/ravendb' 2026-06-19 15:44:09.695941 | debian-bookworm | Loading collection infinidat.infinibox from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/infinidat/infinibox 2026-06-19 15:44:09.696236 | debian-bookworm | Found installed collection infinidat.infinibox:1.6.3 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/infinidat/infinibox' 2026-06-19 15:44:09.697444 | debian-bookworm | Loading collection dellemc.enterprise_sonic from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/dellemc/enterprise_sonic 2026-06-19 15:44:09.697741 | debian-bookworm | Found installed collection dellemc.enterprise_sonic:3.2.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/dellemc/enterprise_sonic' 2026-06-19 15:44:09.698965 | debian-bookworm | Loading collection netbox.netbox from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/netbox/netbox 2026-06-19 15:44:09.699332 | debian-bookworm | Found installed collection netbox.netbox:3.21.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/netbox/netbox' 2026-06-19 15:44:09.699626 | debian-bookworm | Loading collection community.okd from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/okd 2026-06-19 15:44:09.699938 | debian-bookworm | Found installed collection community.okd:5.0.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/okd' 2026-06-19 15:44:09.700314 | debian-bookworm | Loading collection community.rabbitmq from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/rabbitmq 2026-06-19 15:44:09.700629 | debian-bookworm | Found installed collection community.rabbitmq:1.6.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/rabbitmq' 2026-06-19 15:44:09.709768 | debian-bookworm | Loading collection community.general from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/general 2026-06-19 15:44:09.710317 | debian-bookworm | Found installed collection community.general:11.4.1 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/general' 2026-06-19 15:44:09.710850 | debian-bookworm | Loading collection wti.remote from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/wti/remote 2026-06-19 15:44:09.711265 | debian-bookworm | Found installed collection wti.remote:1.0.10 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/wti/remote' 2026-06-19 15:44:09.711873 | debian-bookworm | Loading collection hetzner.hcloud from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/hetzner/hcloud 2026-06-19 15:44:09.712315 | debian-bookworm | Found installed collection hetzner.hcloud:5.4.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/hetzner/hcloud' 2026-06-19 15:44:09.713420 | debian-bookworm | Loading collection cisco.mso from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/cisco/mso 2026-06-19 15:44:09.713883 | debian-bookworm | Found installed collection cisco.mso:2.11.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/cisco/mso' 2026-06-19 15:44:09.714321 | debian-bookworm | Starting galaxy collection install process 2026-06-19 15:44:09.714626 | debian-bookworm | Nothing to do. All requested collections are already installed. If you want to reinstall them, consider using `--force`. 2026-06-19 15:44:09.806685 | debian-bookworm | INFO [delegated > dependency] Dependency completed successfully. 2026-06-19 15:44:09.807163 | debian-bookworm | WARNING [delegated > dependency] Executed: Missing roles requirements file: requirements.yml (Remove from converge_sequence to suppress) 2026-06-19 15:44:09.823295 | debian-bookworm | INFO [delegated > create] Executing 2026-06-19 15:44:09.825925 | debian-bookworm | WARNING [delegated > create] Executed: Missing playbook (Remove from converge_sequence to suppress) 2026-06-19 15:44:09.835307 | debian-bookworm | INFO [delegated > prepare] Executing 2026-06-19 15:44:09.835449 | debian-bookworm | WARNING [delegated > prepare] Skipping, instances already prepared. 2026-06-19 15:44:09.835560 | debian-bookworm | INFO [delegated > prepare] Executed: Successful 2026-06-19 15:44:09.843352 | debian-bookworm | INFO [delegated > converge] Executing 2026-06-19 15:44:09.818406 | ubuntu-noble | INFO [delegated > dependency] Executing 2026-06-19 15:44:09.819208 | ubuntu-noble | WARNING [delegated > dependency] Missing roles requirements file: requirements.yml 2026-06-19 15:44:10.314745 | debian-bookworm | DEBUG [delegated > converge] ansible-playbook version: ansible-playbook 2026-06-19 15:44:10.314873 | debian-bookworm | config file = None 2026-06-19 15:44:10.314891 | debian-bookworm | configured module search path = 2026-06-19 15:44:10.314905 | debian-bookworm | ansible python module location = /home/zuul/venv/lib/python3.11/site-packages/ansible 2026-06-19 15:44:10.314919 | debian-bookworm | ansible collection location = /home/zuul/.ansible/collections:/usr/share/ansible/collections 2026-06-19 15:44:10.314931 | debian-bookworm | executable location = /home/zuul/venv/bin/ansible-playbook 2026-06-19 15:44:10.314943 | debian-bookworm | python version = 3.11.2 (main, Apr 8 2026, 01:58:00) (/home/zuul/venv/bin/python3) 2026-06-19 15:44:10.314955 | debian-bookworm | jinja version = 3.1.6 2026-06-19 15:44:10.314978 | debian-bookworm | pyyaml version = 6.0.3 (with libyaml v0.2.5) 2026-06-19 15:44:10.314991 | debian-bookworm | DEBUG ANSIBLE ENVIRONMENT: 2026-06-19 15:44:10.315002 | debian-bookworm | ANSIBLE_COLLECTIONS_PATH: /home/zuul/venv/.ansible/collections:/home/zuul/.ansible/collections 2026-06-19 15:44:10.315014 | debian-bookworm | ANSIBLE_CONFIG: /home/zuul/.ansible/tmp/molecule.oWZD.delegated/ansible.cfg 2026-06-19 15:44:10.315025 | debian-bookworm | ANSIBLE_LIBRARY: ../../plugins 2026-06-19 15:44:10.315036 | debian-bookworm | ANSIBLE_PYTHON_INTERPRETER: /home/zuul/venv/bin/python 2026-06-19 15:44:10.315047 | debian-bookworm | ANSIBLE_ROLE: auditd 2026-06-19 15:44:10.315058 | debian-bookworm | ANSIBLE_ROLES_PATH: ../../roles 2026-06-19 15:44:10.315070 | debian-bookworm | ANSIBLE_VERBOSITY: 1 2026-06-19 15:44:10.315081 | debian-bookworm | 2026-06-19 15:44:10.315092 | debian-bookworm | DEBUG MOLECULE ENVIRONMENT: 2026-06-19 15:44:10.315104 | debian-bookworm | MOLECULE_DEBUG: True 2026-06-19 15:44:10.315115 | debian-bookworm | MOLECULE_DEPENDENCY_NAME: galaxy 2026-06-19 15:44:10.315126 | debian-bookworm | MOLECULE_DRIVER_NAME: default 2026-06-19 15:44:10.315137 | debian-bookworm | MOLECULE_ENV_FILE: /home/zuul/src/github.com/osism/ansible-collection-services/.env.yml 2026-06-19 15:44:10.315148 | debian-bookworm | MOLECULE_EPHEMERAL_DIRECTORY: /home/zuul/.ansible/tmp/molecule.oWZD.delegated 2026-06-19 15:44:10.315159 | debian-bookworm | MOLECULE_FILE: /home/zuul/.ansible/tmp/molecule.oWZD.delegated/molecule.yml 2026-06-19 15:44:10.315170 | debian-bookworm | MOLECULE_INSTANCE_CONFIG: /home/zuul/.ansible/tmp/molecule.oWZD.delegated/instance_config.yml 2026-06-19 15:44:10.315218 | debian-bookworm | MOLECULE_INVENTORY_FILE: /home/zuul/.ansible/tmp/molecule.oWZD.delegated/inventory/ansible_inventory.yml 2026-06-19 15:44:10.315248 | debian-bookworm | MOLECULE_PROJECT_DIRECTORY: /home/zuul/src/github.com/osism/ansible-collection-services 2026-06-19 15:44:10.315261 | debian-bookworm | MOLECULE_PROVISIONER_NAME: ansible 2026-06-19 15:44:10.315272 | debian-bookworm | MOLECULE_SCENARIO_DIRECTORY: /home/zuul/src/github.com/osism/ansible-collection-services/molecule/delegated 2026-06-19 15:44:10.315283 | debian-bookworm | MOLECULE_SCENARIO_NAME: delegated 2026-06-19 15:44:10.315294 | debian-bookworm | MOLECULE_STATE_FILE: /home/zuul/.ansible/tmp/molecule.oWZD.delegated/state.yml 2026-06-19 15:44:10.315305 | debian-bookworm | MOLECULE_VERIFIER_NAME: testinfra 2026-06-19 15:44:10.315316 | debian-bookworm | MOLECULE_VERIFIER_TEST_DIRECTORY: /home/zuul/src/github.com/osism/ansible-collection-services/molecule/delegated/tests 2026-06-19 15:44:10.315331 | debian-bookworm | 2026-06-19 15:44:10.315350 | debian-bookworm | DEBUG SHELL REPLAY: ANSIBLE_COLLECTIONS_PATH=/home/zuul/venv/.ansible/collections:/home/zuul/.ansible/collections ANSIBLE_CONFIG=/home/zuul/.ansible/tmp/molecule.oWZD.delegated/ansible.cfg ANSIBLE_LIBRARY=../../plugins ANSIBLE_PYTHON_INTERPRETER=/home/zuul/venv/bin/python ANSIBLE_ROLE=auditd ANSIBLE_ROLES_PATH=../../roles ANSIBLE_VERBOSITY=1 MOLECULE_DEBUG=True MOLECULE_DEPENDENCY_NAME=galaxy MOLECULE_DRIVER_NAME=default MOLECULE_ENV_FILE=/home/zuul/src/github.com/osism/ansible-collection-services/.env.yml MOLECULE_EPHEMERAL_DIRECTORY=/home/zuul/.ansible/tmp/molecule.oWZD.delegated MOLECULE_FILE=/home/zuul/.ansible/tmp/molecule.oWZD.delegated/molecule.yml MOLECULE_INSTANCE_CONFIG=/home/zuul/.ansible/tmp/molecule.oWZD.delegated/instance_config.yml MOLECULE_INVENTORY_FILE=/home/zuul/.ansible/tmp/molecule.oWZD.delegated/inventory/ansible_inventory.yml MOLECULE_PROJECT_DIRECTORY=/home/zuul/src/github.com/osism/ansible-collection-services MOLECULE_PROVISIONER_NAME=ansible MOLECULE_SCENARIO_DIRECTORY=/home/zuul/src/github.com/osism/ansible-collection-services/molecule/delegated MOLECULE_SCENARIO_NAME=delegated MOLECULE_STATE_FILE=/home/zuul/.ansible/tmp/molecule.oWZD.delegated/state.yml MOLECULE_VERIFIER_NAME=testinfra MOLECULE_VERIFIER_TEST_DIRECTORY=/home/zuul/src/github.com/osism/ansible-collection-services/molecule/delegated/tests 2026-06-19 15:44:10.328889 | ubuntu-noble | ansible-galaxy [core 2.19.11] 2026-06-19 15:44:10.329621 | ubuntu-noble | config file = None 2026-06-19 15:44:10.330782 | ubuntu-noble | configured module search path = ['/home/zuul/src/github.com/osism/ansible-collection-services/plugins/modules', '/home/zuul/.ansible/plugins/modules', '/usr/share/ansible/plugins/modules'] 2026-06-19 15:44:10.331318 | ubuntu-noble | ansible python module location = /home/zuul/venv/lib/python3.12/site-packages/ansible 2026-06-19 15:44:10.331837 | ubuntu-noble | ansible collection location = /home/zuul/.ansible/collections:/usr/share/ansible/collections:/home/zuul/venv/lib/python3.12/site-packages:/home/zuul/venv/lib/python3.12/dist-packages:/home/zuul/venv/lib/python3/dist-packages:/home/zuul/venv/local/lib/python3.12/dist-packages 2026-06-19 15:44:10.332295 | ubuntu-noble | executable location = /home/zuul/venv/bin/ansible-galaxy 2026-06-19 15:44:10.332686 | ubuntu-noble | python version = 3.12.3 (main, Mar 23 2026, 19:04:32) [GCC 13.3.0] (/home/zuul/venv/bin/python3) 2026-06-19 15:44:10.333037 | ubuntu-noble | jinja version = 3.1.6 2026-06-19 15:44:10.333487 | ubuntu-noble | pyyaml version = 6.0.3 (with libyaml v0.2.5) 2026-06-19 15:44:10.333833 | ubuntu-noble | No config file found; using defaults 2026-06-19 15:44:10.334438 | ubuntu-noble | Reading requirement file at '/home/zuul/src/github.com/osism/ansible-collection-services/molecule/delegated/collections.yml' 2026-06-19 15:44:10.343508 | ubuntu-noble | Loading collection ansible._protomatter from /home/zuul/venv/lib/python3.12/site-packages/ansible/_internal/ansible_collections/ansible/_protomatter 2026-06-19 15:44:10.344024 | ubuntu-noble | Found installed collection ansible._protomatter:2.19.11 at '/home/zuul/venv/lib/python3.12/site-packages/ansible/_internal/ansible_collections/ansible/_protomatter' 2026-06-19 15:44:10.354865 | ubuntu-noble | Loading collection osism.commons from /home/zuul/.ansible/collections/ansible_collections/osism/commons 2026-06-19 15:44:10.356455 | ubuntu-noble | Found installed collection osism.commons:0.20260601.0 at '/home/zuul/.ansible/collections/ansible_collections/osism/commons' 2026-06-19 15:44:10.358058 | ubuntu-noble | Loading collection osism.services from /home/zuul/.ansible/collections/ansible_collections/osism/services 2026-06-19 15:44:10.358091 | ubuntu-noble | Found installed collection osism.services:999.0.0 at '/home/zuul/.ansible/collections/ansible_collections/osism/services' 2026-06-19 15:44:10.368140 | ubuntu-noble | Loading collection netapp.storagegrid from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/netapp/storagegrid 2026-06-19 15:44:10.368177 | ubuntu-noble | Found installed collection netapp.storagegrid:21.15.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/netapp/storagegrid' 2026-06-19 15:44:10.370398 | ubuntu-noble | Loading collection cloudscale_ch.cloud from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/cloudscale_ch/cloud 2026-06-19 15:44:10.370432 | ubuntu-noble | Found installed collection cloudscale_ch.cloud:2.5.2 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/cloudscale_ch/cloud' 2026-06-19 15:44:10.372648 | ubuntu-noble | Loading collection cisco.mso from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/cisco/mso 2026-06-19 15:44:10.372679 | ubuntu-noble | Found installed collection cisco.mso:2.11.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/cisco/mso' 2026-06-19 15:44:10.372690 | ubuntu-noble | Loading collection community.dns from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/dns 2026-06-19 15:44:10.372699 | ubuntu-noble | Found installed collection community.dns:3.4.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/dns' 2026-06-19 15:44:10.374309 | ubuntu-noble | Loading collection community.windows from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/windows 2026-06-19 15:44:10.374357 | ubuntu-noble | Found installed collection community.windows:3.0.1 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/windows' 2026-06-19 15:44:10.376007 | ubuntu-noble | Loading collection cisco.nxos from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/cisco/nxos 2026-06-19 15:44:10.376033 | ubuntu-noble | Found installed collection cisco.nxos:11.0.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/cisco/nxos' 2026-06-19 15:44:10.378555 | ubuntu-noble | Loading collection cisco.aci from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/cisco/aci 2026-06-19 15:44:10.378583 | ubuntu-noble | Found installed collection cisco.aci:2.12.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/cisco/aci' 2026-06-19 15:44:10.378607 | ubuntu-noble | Loading collection wti.remote from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/wti/remote 2026-06-19 15:44:10.378621 | ubuntu-noble | Found installed collection wti.remote:1.0.10 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/wti/remote' 2026-06-19 15:44:10.381953 | ubuntu-noble | Loading collection fortinet.fortios from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/fortinet/fortios 2026-06-19 15:44:10.381991 | ubuntu-noble | Found installed collection fortinet.fortios:2.4.2 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/fortinet/fortios' 2026-06-19 15:44:10.386361 | ubuntu-noble | Loading collection community.aws from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/aws 2026-06-19 15:44:10.386391 | ubuntu-noble | Found installed collection community.aws:10.0.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/aws' 2026-06-19 15:44:10.386401 | ubuntu-noble | Loading collection dellemc.powerflex from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/dellemc/powerflex 2026-06-19 15:44:10.386409 | ubuntu-noble | Found installed collection dellemc.powerflex:2.6.1 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/dellemc/powerflex' 2026-06-19 15:44:10.386594 | ubuntu-noble | Loading collection f5networks.f5_modules from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/f5networks/f5_modules 2026-06-19 15:44:10.386968 | ubuntu-noble | Found installed collection f5networks.f5_modules:1.39.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/f5networks/f5_modules' 2026-06-19 15:44:10.387276 | ubuntu-noble | Loading collection community.mysql from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/mysql 2026-06-19 15:44:10.387671 | ubuntu-noble | Found installed collection community.mysql:3.16.1 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/mysql' 2026-06-19 15:44:10.387963 | ubuntu-noble | Loading collection kubevirt.core from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/kubevirt/core 2026-06-19 15:44:10.388370 | ubuntu-noble | Found installed collection kubevirt.core:2.2.3 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/kubevirt/core' 2026-06-19 15:44:10.388754 | ubuntu-noble | Loading collection community.docker from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/docker 2026-06-19 15:44:10.389160 | ubuntu-noble | Found installed collection community.docker:4.8.2 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/docker' 2026-06-19 15:44:10.389548 | ubuntu-noble | Loading collection ansible.netcommon from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/ansible/netcommon 2026-06-19 15:44:10.389846 | ubuntu-noble | Found installed collection ansible.netcommon:8.1.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/ansible/netcommon' 2026-06-19 15:44:10.391183 | ubuntu-noble | Loading collection vmware.vmware_rest from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/vmware/vmware_rest 2026-06-19 15:44:10.391691 | ubuntu-noble | Found installed collection vmware.vmware_rest:4.9.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/vmware/vmware_rest' 2026-06-19 15:44:10.392023 | ubuntu-noble | Loading collection community.okd from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/okd 2026-06-19 15:44:10.392409 | ubuntu-noble | Found installed collection community.okd:5.0.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/okd' 2026-06-19 15:44:10.392678 | ubuntu-noble | Loading collection cisco.ucs from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/cisco/ucs 2026-06-19 15:44:10.393038 | ubuntu-noble | Found installed collection cisco.ucs:1.16.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/cisco/ucs' 2026-06-19 15:44:10.393445 | ubuntu-noble | Loading collection microsoft.iis from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/microsoft/iis 2026-06-19 15:44:10.393711 | ubuntu-noble | Found installed collection microsoft.iis:1.0.3 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/microsoft/iis' 2026-06-19 15:44:10.394032 | ubuntu-noble | Loading collection grafana.grafana from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/grafana/grafana 2026-06-19 15:44:10.394309 | ubuntu-noble | Found installed collection grafana.grafana:6.0.6 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/grafana/grafana' 2026-06-19 15:44:10.394652 | ubuntu-noble | Loading collection cyberark.pas from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/cyberark/pas 2026-06-19 15:44:10.394949 | ubuntu-noble | Found installed collection cyberark.pas:1.0.36 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/cyberark/pas' 2026-06-19 15:44:10.395234 | ubuntu-noble | Loading collection ansible.posix from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/ansible/posix 2026-06-19 15:44:10.395516 | ubuntu-noble | Found installed collection ansible.posix:2.1.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/ansible/posix' 2026-06-19 15:44:10.397359 | ubuntu-noble | Loading collection dellemc.enterprise_sonic from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/dellemc/enterprise_sonic 2026-06-19 15:44:10.397385 | ubuntu-noble | Found installed collection dellemc.enterprise_sonic:3.2.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/dellemc/enterprise_sonic' 2026-06-19 15:44:10.397393 | ubuntu-noble | Loading collection community.proxysql from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/proxysql 2026-06-19 15:44:10.397399 | ubuntu-noble | Found installed collection community.proxysql:1.7.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/proxysql' 2026-06-19 15:44:10.397406 | ubuntu-noble | Loading collection ansible.utils from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/ansible/utils 2026-06-19 15:44:10.397413 | ubuntu-noble | Found installed collection ansible.utils:6.0.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/ansible/utils' 2026-06-19 15:44:10.397508 | ubuntu-noble | Loading collection splunk.es from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/splunk/es 2026-06-19 15:44:10.397795 | ubuntu-noble | Found installed collection splunk.es:4.0.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/splunk/es' 2026-06-19 15:44:10.398042 | ubuntu-noble | Loading collection microsoft.ad from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/microsoft/ad 2026-06-19 15:44:10.398353 | ubuntu-noble | Found installed collection microsoft.ad:1.9.2 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/microsoft/ad' 2026-06-19 15:44:10.399758 | ubuntu-noble | Loading collection azure.azcollection from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/azure/azcollection 2026-06-19 15:44:10.400034 | ubuntu-noble | Found installed collection azure.azcollection:3.10.1 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/azure/azcollection' 2026-06-19 15:44:10.400917 | ubuntu-noble | Loading collection arista.eos from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/arista/eos 2026-06-19 15:44:10.401256 | ubuntu-noble | Found installed collection arista.eos:12.0.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/arista/eos' 2026-06-19 15:44:10.401557 | ubuntu-noble | Loading collection cisco.dnac from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/cisco/dnac 2026-06-19 15:44:10.402008 | ubuntu-noble | Found installed collection cisco.dnac:6.41.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/cisco/dnac' 2026-06-19 15:44:10.402435 | ubuntu-noble | Loading collection chocolatey.chocolatey from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/chocolatey/chocolatey 2026-06-19 15:44:10.402789 | ubuntu-noble | Found installed collection chocolatey.chocolatey:1.5.3 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/chocolatey/chocolatey' 2026-06-19 15:44:10.403226 | ubuntu-noble | Loading collection community.libvirt from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/libvirt 2026-06-19 15:44:10.403609 | ubuntu-noble | Found installed collection community.libvirt:2.0.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/libvirt' 2026-06-19 15:44:10.403919 | ubuntu-noble | Loading collection community.ciscosmb from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/ciscosmb 2026-06-19 15:44:10.404138 | ubuntu-noble | Found installed collection community.ciscosmb:1.0.11 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/ciscosmb' 2026-06-19 15:44:10.404445 | ubuntu-noble | Loading collection kaytus.ksmanage from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/kaytus/ksmanage 2026-06-19 15:44:10.404678 | ubuntu-noble | Found installed collection kaytus.ksmanage:2.0.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/kaytus/ksmanage' 2026-06-19 15:44:10.404996 | ubuntu-noble | Loading collection junipernetworks.junos from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/junipernetworks/junos 2026-06-19 15:44:10.405225 | ubuntu-noble | Found installed collection junipernetworks.junos:11.0.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/junipernetworks/junos' 2026-06-19 15:44:10.406151 | ubuntu-noble | Loading collection theforeman.foreman from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/theforeman/foreman 2026-06-19 15:44:10.406873 | ubuntu-noble | Found installed collection theforeman.foreman:5.7.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/theforeman/foreman' 2026-06-19 15:44:10.407370 | ubuntu-noble | Loading collection cisco.intersight from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/cisco/intersight 2026-06-19 15:44:10.407779 | ubuntu-noble | Found installed collection cisco.intersight:2.7.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/cisco/intersight' 2026-06-19 15:44:10.408348 | ubuntu-noble | Loading collection community.digitalocean from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/digitalocean 2026-06-19 15:44:10.408747 | ubuntu-noble | Found installed collection community.digitalocean:1.27.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/digitalocean' 2026-06-19 15:44:10.417669 | ubuntu-noble | Loading collection community.general from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/general 2026-06-19 15:44:10.418226 | ubuntu-noble | Found installed collection community.general:11.4.1 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/general' 2026-06-19 15:44:10.418630 | ubuntu-noble | Loading collection netapp.cloudmanager from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/netapp/cloudmanager 2026-06-19 15:44:10.420366 | ubuntu-noble | Found installed collection netapp.cloudmanager:21.24.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/netapp/cloudmanager' 2026-06-19 15:44:10.420423 | ubuntu-noble | Loading collection hetzner.hcloud from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/hetzner/hcloud 2026-06-19 15:44:10.420436 | ubuntu-noble | Found installed collection hetzner.hcloud:5.4.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/hetzner/hcloud' 2026-06-19 15:44:10.420446 | ubuntu-noble | Loading collection purestorage.flashblade from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/purestorage/flashblade 2026-06-19 15:44:10.420725 | ubuntu-noble | Found installed collection purestorage.flashblade:1.22.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/purestorage/flashblade' 2026-06-19 15:44:10.421176 | ubuntu-noble | Loading collection cisco.iosxr from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/cisco/iosxr 2026-06-19 15:44:10.421577 | ubuntu-noble | Found installed collection cisco.iosxr:12.1.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/cisco/iosxr' 2026-06-19 15:44:10.422033 | ubuntu-noble | Loading collection ngine_io.cloudstack from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/ngine_io/cloudstack 2026-06-19 15:44:10.422455 | ubuntu-noble | Found installed collection ngine_io.cloudstack:2.5.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/ngine_io/cloudstack' 2026-06-19 15:44:10.422812 | ubuntu-noble | Loading collection community.proxmox from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/proxmox 2026-06-19 15:44:10.423276 | ubuntu-noble | Found installed collection community.proxmox:1.4.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/proxmox' 2026-06-19 15:44:10.423670 | ubuntu-noble | Loading collection ansible.windows from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/ansible/windows 2026-06-19 15:44:10.424030 | ubuntu-noble | Found installed collection ansible.windows:3.2.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/ansible/windows' 2026-06-19 15:44:10.424455 | ubuntu-noble | Loading collection ieisystem.inmanage from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/ieisystem/inmanage 2026-06-19 15:44:10.424787 | ubuntu-noble | Found installed collection ieisystem.inmanage:3.0.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/ieisystem/inmanage' 2026-06-19 15:44:10.425184 | ubuntu-noble | Loading collection dellemc.openmanage from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/dellemc/openmanage 2026-06-19 15:44:10.425551 | ubuntu-noble | Found installed collection dellemc.openmanage:9.12.3 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/dellemc/openmanage' 2026-06-19 15:44:10.425864 | ubuntu-noble | Loading collection netapp.ontap from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/netapp/ontap 2026-06-19 15:44:10.426165 | ubuntu-noble | Found installed collection netapp.ontap:23.2.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/netapp/ontap' 2026-06-19 15:44:10.426666 | ubuntu-noble | Loading collection telekom_mms.icinga_director from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/telekom_mms/icinga_director 2026-06-19 15:44:10.426941 | ubuntu-noble | Found installed collection telekom_mms.icinga_director:2.4.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/telekom_mms/icinga_director' 2026-06-19 15:44:10.427222 | ubuntu-noble | Loading collection infinidat.infinibox from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/infinidat/infinibox 2026-06-19 15:44:10.427528 | ubuntu-noble | Found installed collection infinidat.infinibox:1.6.3 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/infinidat/infinibox' 2026-06-19 15:44:10.427874 | ubuntu-noble | Loading collection cisco.ios from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/cisco/ios 2026-06-19 15:44:10.428137 | ubuntu-noble | Found installed collection cisco.ios:11.1.1 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/cisco/ios' 2026-06-19 15:44:10.428449 | ubuntu-noble | Loading collection netapp_eseries.santricity from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/netapp_eseries/santricity 2026-06-19 15:44:10.428736 | ubuntu-noble | Found installed collection netapp_eseries.santricity:1.4.1 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/netapp_eseries/santricity' 2026-06-19 15:44:10.429067 | ubuntu-noble | Loading collection google.cloud from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/google/cloud 2026-06-19 15:44:10.429399 | ubuntu-noble | Found installed collection google.cloud:1.9.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/google/cloud' 2026-06-19 15:44:10.429966 | ubuntu-noble | Loading collection amazon.aws from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/amazon/aws 2026-06-19 15:44:10.430269 | ubuntu-noble | Found installed collection amazon.aws:10.1.2 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/amazon/aws' 2026-06-19 15:44:10.430580 | ubuntu-noble | Loading collection infoblox.nios_modules from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/infoblox/nios_modules 2026-06-19 15:44:10.430870 | ubuntu-noble | Found installed collection infoblox.nios_modules:1.8.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/infoblox/nios_modules' 2026-06-19 15:44:10.432134 | ubuntu-noble | Loading collection community.vmware from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/vmware 2026-06-19 15:44:10.433345 | ubuntu-noble | Found installed collection community.vmware:5.10.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/vmware' 2026-06-19 15:44:10.433368 | ubuntu-noble | Loading collection ibm.storage_virtualize from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/ibm/storage_virtualize 2026-06-19 15:44:10.433375 | ubuntu-noble | Found installed collection ibm.storage_virtualize:2.7.4 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/ibm/storage_virtualize' 2026-06-19 15:44:10.433382 | ubuntu-noble | Loading collection ravendb.ravendb from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/ravendb/ravendb 2026-06-19 15:44:10.433528 | ubuntu-noble | Found installed collection ravendb.ravendb:1.0.4 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/ravendb/ravendb' 2026-06-19 15:44:10.433781 | ubuntu-noble | Loading collection containers.podman from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/containers/podman 2026-06-19 15:44:10.434053 | ubuntu-noble | Found installed collection containers.podman:1.18.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/containers/podman' 2026-06-19 15:44:10.434294 | ubuntu-noble | Loading collection community.library_inventory_filtering_v1 from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/library_inventory_filtering_v1 2026-06-19 15:44:10.434591 | ubuntu-noble | Found installed collection community.library_inventory_filtering_v1:1.1.5 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/library_inventory_filtering_v1' 2026-06-19 15:44:10.434817 | ubuntu-noble | Loading collection vmware.vmware from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/vmware/vmware 2026-06-19 15:44:10.435093 | ubuntu-noble | Found installed collection vmware.vmware:2.4.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/vmware/vmware' 2026-06-19 15:44:10.435373 | ubuntu-noble | Loading collection community.zabbix from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/zabbix 2026-06-19 15:44:10.435647 | ubuntu-noble | Found installed collection community.zabbix:4.1.1 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/zabbix' 2026-06-19 15:44:10.435973 | ubuntu-noble | Loading collection vyos.vyos from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/vyos/vyos 2026-06-19 15:44:10.436246 | ubuntu-noble | Found installed collection vyos.vyos:6.0.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/vyos/vyos' 2026-06-19 15:44:10.436519 | ubuntu-noble | Loading collection lowlydba.sqlserver from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/lowlydba/sqlserver 2026-06-19 15:44:10.436777 | ubuntu-noble | Found installed collection lowlydba.sqlserver:2.7.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/lowlydba/sqlserver' 2026-06-19 15:44:10.437025 | ubuntu-noble | Loading collection hitachivantara.vspone_block from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/hitachivantara/vspone_block 2026-06-19 15:44:10.437333 | ubuntu-noble | Found installed collection hitachivantara.vspone_block:4.4.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/hitachivantara/vspone_block' 2026-06-19 15:44:10.437666 | ubuntu-noble | Loading collection community.routeros from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/routeros 2026-06-19 15:44:10.437903 | ubuntu-noble | Found installed collection community.routeros:3.13.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/routeros' 2026-06-19 15:44:10.438169 | ubuntu-noble | Loading collection community.sap_libs from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/sap_libs 2026-06-19 15:44:10.438415 | ubuntu-noble | Found installed collection community.sap_libs:1.5.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/sap_libs' 2026-06-19 15:44:10.438678 | ubuntu-noble | Loading collection vultr.cloud from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/vultr/cloud 2026-06-19 15:44:10.438878 | ubuntu-noble | Found installed collection vultr.cloud:1.13.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/vultr/cloud' 2026-06-19 15:44:10.439132 | ubuntu-noble | Loading collection purestorage.flasharray from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/purestorage/flasharray 2026-06-19 15:44:10.439399 | ubuntu-noble | Found installed collection purestorage.flasharray:1.39.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/purestorage/flasharray' 2026-06-19 15:44:10.439654 | ubuntu-noble | Loading collection ovirt.ovirt from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/ovirt/ovirt 2026-06-19 15:44:10.439873 | ubuntu-noble | Found installed collection ovirt.ovirt:3.2.1 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/ovirt/ovirt' 2026-06-19 15:44:10.440093 | ubuntu-noble | Loading collection community.rabbitmq from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/rabbitmq 2026-06-19 15:44:10.440338 | ubuntu-noble | Found installed collection community.rabbitmq:1.6.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/rabbitmq' 2026-06-19 15:44:10.440590 | ubuntu-noble | Loading collection community.postgresql from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/postgresql 2026-06-19 15:44:10.440809 | ubuntu-noble | Found installed collection community.postgresql:4.1.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/postgresql' 2026-06-19 15:44:10.441094 | ubuntu-noble | Loading collection community.hashi_vault from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/hashi_vault 2026-06-19 15:44:10.441373 | ubuntu-noble | Found installed collection community.hashi_vault:7.1.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/hashi_vault' 2026-06-19 15:44:10.441950 | ubuntu-noble | Loading collection kubernetes.core from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/kubernetes/core 2026-06-19 15:44:10.442197 | ubuntu-noble | Found installed collection kubernetes.core:6.2.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/kubernetes/core' 2026-06-19 15:44:10.442669 | ubuntu-noble | Loading collection ibm.qradar from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/ibm/qradar 2026-06-19 15:44:10.442888 | ubuntu-noble | Found installed collection ibm.qradar:4.0.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/ibm/qradar' 2026-06-19 15:44:10.443125 | ubuntu-noble | Loading collection inspur.ispim from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/inspur/ispim 2026-06-19 15:44:10.443373 | ubuntu-noble | Found installed collection inspur.ispim:2.2.3 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/inspur/ispim' 2026-06-19 15:44:10.443964 | ubuntu-noble | Loading collection check_point.mgmt from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/check_point/mgmt 2026-06-19 15:44:10.443975 | ubuntu-noble | Found installed collection check_point.mgmt:6.6.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/check_point/mgmt' 2026-06-19 15:44:10.449505 | ubuntu-noble | Loading collection fortinet.fortimanager from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/fortinet/fortimanager 2026-06-19 15:44:10.449718 | ubuntu-noble | Found installed collection fortinet.fortimanager:2.11.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/fortinet/fortimanager' 2026-06-19 15:44:10.450183 | ubuntu-noble | Loading collection community.crypto from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/crypto 2026-06-19 15:44:10.450475 | ubuntu-noble | Found installed collection community.crypto:3.0.5 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/crypto' 2026-06-19 15:44:10.450770 | ubuntu-noble | Loading collection community.grafana from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/grafana 2026-06-19 15:44:10.450989 | ubuntu-noble | Found installed collection community.grafana:2.3.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/grafana' 2026-06-19 15:44:10.451685 | ubuntu-noble | Loading collection community.hrobot from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/hrobot 2026-06-19 15:44:10.451700 | ubuntu-noble | Found installed collection community.hrobot:2.7.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/hrobot' 2026-06-19 15:44:10.451705 | ubuntu-noble | Loading collection hitachivantara.vspone_object from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/hitachivantara/vspone_object 2026-06-19 15:44:10.451931 | ubuntu-noble | Found installed collection hitachivantara.vspone_object:1.0.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/hitachivantara/vspone_object' 2026-06-19 15:44:10.452910 | ubuntu-noble | Loading collection netbox.netbox from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/netbox/netbox 2026-06-19 15:44:10.452929 | ubuntu-noble | Found installed collection netbox.netbox:3.21.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/netbox/netbox' 2026-06-19 15:44:10.454551 | ubuntu-noble | Loading collection cisco.meraki from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/cisco/meraki 2026-06-19 15:44:10.454770 | ubuntu-noble | Found installed collection cisco.meraki:2.21.8 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/cisco/meraki' 2026-06-19 15:44:10.455399 | ubuntu-noble | Loading collection dellemc.unity from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/dellemc/unity 2026-06-19 15:44:10.455845 | ubuntu-noble | Found installed collection dellemc.unity:2.1.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/dellemc/unity' 2026-06-19 15:44:10.455857 | ubuntu-noble | Loading collection community.sops from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/sops 2026-06-19 15:44:10.456071 | ubuntu-noble | Found installed collection community.sops:2.2.7 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/sops' 2026-06-19 15:44:10.456702 | ubuntu-noble | Loading collection openstack.cloud from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/openstack/cloud 2026-06-19 15:44:10.457076 | ubuntu-noble | Found installed collection openstack.cloud:2.5.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/openstack/cloud' 2026-06-19 15:44:10.457087 | ubuntu-noble | Loading collection cyberark.conjur from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/cyberark/conjur 2026-06-19 15:44:10.457339 | ubuntu-noble | Found installed collection cyberark.conjur:1.3.8 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/cyberark/conjur' 2026-06-19 15:44:10.457672 | ubuntu-noble | Loading collection community.mongodb from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/mongodb 2026-06-19 15:44:10.457884 | ubuntu-noble | Found installed collection community.mongodb:1.7.10 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/mongodb' 2026-06-19 15:44:10.460104 | ubuntu-noble | Loading collection awx.awx from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/awx/awx 2026-06-19 15:44:10.460389 | ubuntu-noble | Found installed collection awx.awx:24.6.1 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/awx/awx' 2026-06-19 15:44:10.460998 | ubuntu-noble | Starting galaxy collection install process 2026-06-19 15:44:10.461008 | ubuntu-noble | Nothing to do. All requested collections are already installed. If you want to reinstall them, consider using `--force`. 2026-06-19 15:44:10.523369 | ubuntu-noble | INFO [delegated > dependency] Dependency completed successfully. 2026-06-19 15:44:10.523405 | ubuntu-noble | WARNING [delegated > dependency] Executed: Missing roles requirements file: requirements.yml (Remove from converge_sequence to suppress) 2026-06-19 15:44:10.532358 | ubuntu-noble | INFO [delegated > create] Executing 2026-06-19 15:44:10.534561 | ubuntu-noble | WARNING [delegated > create] Executed: Missing playbook (Remove from converge_sequence to suppress) 2026-06-19 15:44:10.543014 | ubuntu-noble | INFO [delegated > prepare] Executing 2026-06-19 15:44:10.543195 | ubuntu-noble | WARNING [delegated > prepare] Skipping, instances already prepared. 2026-06-19 15:44:10.543394 | ubuntu-noble | INFO [delegated > prepare] Executed: Successful 2026-06-19 15:44:10.551073 | ubuntu-noble | INFO [delegated > converge] Executing 2026-06-19 15:44:10.698901 | debian-bookworm | Using /home/zuul/.ansible/tmp/molecule.oWZD.delegated/ansible.cfg as config file 2026-06-19 15:44:10.923303 | debian-bookworm | 2026-06-19 15:44:10.923388 | debian-bookworm | PLAY [Converge] **************************************************************** 2026-06-19 15:44:10.923405 | debian-bookworm | 2026-06-19 15:44:10.923820 | debian-bookworm | TASK [Gathering Facts] ********************************************************* 2026-06-19 15:44:11.005738 | ubuntu-noble | DEBUG [delegated > converge] ansible-playbook version: ansible-playbook 2026-06-19 15:44:11.005805 | ubuntu-noble | config file = None 2026-06-19 15:44:11.005820 | ubuntu-noble | configured module search path = 2026-06-19 15:44:11.005831 | ubuntu-noble | ansible python module location = /home/zuul/venv/lib/python3.12/site-packages/ansible 2026-06-19 15:44:11.005843 | ubuntu-noble | ansible collection location = /home/zuul/.ansible/collections:/usr/share/ansible/collections 2026-06-19 15:44:11.005853 | ubuntu-noble | executable location = /home/zuul/venv/bin/ansible-playbook 2026-06-19 15:44:11.005863 | ubuntu-noble | python version = 3.12.3 (main, Mar 23 2026, 19:04:32) (/home/zuul/venv/bin/python3) 2026-06-19 15:44:11.005873 | ubuntu-noble | jinja version = 3.1.6 2026-06-19 15:44:11.005883 | ubuntu-noble | pyyaml version = 6.0.3 (with libyaml v0.2.5) 2026-06-19 15:44:11.006475 | ubuntu-noble | DEBUG ANSIBLE ENVIRONMENT: 2026-06-19 15:44:11.006509 | ubuntu-noble | ANSIBLE_COLLECTIONS_PATH: /home/zuul/venv/.ansible/collections:/home/zuul/.ansible/collections 2026-06-19 15:44:11.006521 | ubuntu-noble | ANSIBLE_CONFIG: /home/zuul/.ansible/tmp/molecule.oWZD.delegated/ansible.cfg 2026-06-19 15:44:11.006531 | ubuntu-noble | ANSIBLE_LIBRARY: ../../plugins 2026-06-19 15:44:11.006542 | ubuntu-noble | ANSIBLE_PYTHON_INTERPRETER: /home/zuul/venv/bin/python 2026-06-19 15:44:11.006552 | ubuntu-noble | ANSIBLE_ROLE: auditd 2026-06-19 15:44:11.006562 | ubuntu-noble | ANSIBLE_ROLES_PATH: ../../roles 2026-06-19 15:44:11.006573 | ubuntu-noble | ANSIBLE_VERBOSITY: 1 2026-06-19 15:44:11.006584 | ubuntu-noble | 2026-06-19 15:44:11.006898 | ubuntu-noble | DEBUG MOLECULE ENVIRONMENT: 2026-06-19 15:44:11.006916 | ubuntu-noble | MOLECULE_DEBUG: True 2026-06-19 15:44:11.006936 | ubuntu-noble | MOLECULE_DEPENDENCY_NAME: galaxy 2026-06-19 15:44:11.006954 | ubuntu-noble | MOLECULE_DRIVER_NAME: default 2026-06-19 15:44:11.006971 | ubuntu-noble | MOLECULE_ENV_FILE: /home/zuul/src/github.com/osism/ansible-collection-services/.env.yml 2026-06-19 15:44:11.006989 | ubuntu-noble | MOLECULE_EPHEMERAL_DIRECTORY: /home/zuul/.ansible/tmp/molecule.oWZD.delegated 2026-06-19 15:44:11.007007 | ubuntu-noble | MOLECULE_FILE: /home/zuul/.ansible/tmp/molecule.oWZD.delegated/molecule.yml 2026-06-19 15:44:11.007024 | ubuntu-noble | MOLECULE_INSTANCE_CONFIG: /home/zuul/.ansible/tmp/molecule.oWZD.delegated/instance_config.yml 2026-06-19 15:44:11.007043 | ubuntu-noble | MOLECULE_INVENTORY_FILE: /home/zuul/.ansible/tmp/molecule.oWZD.delegated/inventory/ansible_inventory.yml 2026-06-19 15:44:11.007063 | ubuntu-noble | MOLECULE_PROJECT_DIRECTORY: /home/zuul/src/github.com/osism/ansible-collection-services 2026-06-19 15:44:11.007083 | ubuntu-noble | MOLECULE_PROVISIONER_NAME: ansible 2026-06-19 15:44:11.007102 | ubuntu-noble | MOLECULE_SCENARIO_DIRECTORY: /home/zuul/src/github.com/osism/ansible-collection-services/molecule/delegated 2026-06-19 15:44:11.007121 | ubuntu-noble | MOLECULE_SCENARIO_NAME: delegated 2026-06-19 15:44:11.007132 | ubuntu-noble | MOLECULE_STATE_FILE: /home/zuul/.ansible/tmp/molecule.oWZD.delegated/state.yml 2026-06-19 15:44:11.007142 | ubuntu-noble | MOLECULE_VERIFIER_NAME: testinfra 2026-06-19 15:44:11.007173 | ubuntu-noble | MOLECULE_VERIFIER_TEST_DIRECTORY: /home/zuul/src/github.com/osism/ansible-collection-services/molecule/delegated/tests 2026-06-19 15:44:11.007185 | ubuntu-noble | 2026-06-19 15:44:11.008420 | ubuntu-noble | DEBUG SHELL REPLAY: ANSIBLE_COLLECTIONS_PATH=/home/zuul/venv/.ansible/collections:/home/zuul/.ansible/collections ANSIBLE_CONFIG=/home/zuul/.ansible/tmp/molecule.oWZD.delegated/ansible.cfg ANSIBLE_LIBRARY=../../plugins ANSIBLE_PYTHON_INTERPRETER=/home/zuul/venv/bin/python ANSIBLE_ROLE=auditd ANSIBLE_ROLES_PATH=../../roles ANSIBLE_VERBOSITY=1 MOLECULE_DEBUG=True MOLECULE_DEPENDENCY_NAME=galaxy MOLECULE_DRIVER_NAME=default MOLECULE_ENV_FILE=/home/zuul/src/github.com/osism/ansible-collection-services/.env.yml MOLECULE_EPHEMERAL_DIRECTORY=/home/zuul/.ansible/tmp/molecule.oWZD.delegated MOLECULE_FILE=/home/zuul/.ansible/tmp/molecule.oWZD.delegated/molecule.yml MOLECULE_INSTANCE_CONFIG=/home/zuul/.ansible/tmp/molecule.oWZD.delegated/instance_config.yml MOLECULE_INVENTORY_FILE=/home/zuul/.ansible/tmp/molecule.oWZD.delegated/inventory/ansible_inventory.yml MOLECULE_PROJECT_DIRECTORY=/home/zuul/src/github.com/osism/ansible-collection-services MOLECULE_PROVISIONER_NAME=ansible MOLECULE_SCENARIO_DIRECTORY=/home/zuul/src/github.com/osism/ansible-collection-services/molecule/delegated MOLECULE_SCENARIO_NAME=delegated MOLECULE_STATE_FILE=/home/zuul/.ansible/tmp/molecule.oWZD.delegated/state.yml MOLECULE_VERIFIER_NAME=testinfra MOLECULE_VERIFIER_TEST_DIRECTORY=/home/zuul/src/github.com/osism/ansible-collection-services/molecule/delegated/tests 2026-06-19 15:44:11.397124 | ubuntu-noble | Using /home/zuul/.ansible/tmp/molecule.oWZD.delegated/ansible.cfg as config file 2026-06-19 15:44:11.640165 | ubuntu-noble | 2026-06-19 15:44:11.640751 | ubuntu-noble | PLAY [Converge] **************************************************************** 2026-06-19 15:44:11.641130 | ubuntu-noble | 2026-06-19 15:44:11.642711 | ubuntu-noble | TASK [Gathering Facts] ********************************************************* 2026-06-19 15:44:12.134190 | debian-bookworm | ok: [molecule-auditd] 2026-06-19 15:44:12.134289 | debian-bookworm | 2026-06-19 15:44:12.134299 | debian-bookworm | TASK [Include required variables] ********************************************** 2026-06-19 15:44:12.164274 | debian-bookworm | ok: [molecule-auditd] => {"ansible_facts": {}, "ansible_included_var_files": ["/home/zuul/src/github.com/osism/ansible-collection-services/molecule/delegated/vars/auditd.yml"], "changed": false} 2026-06-19 15:44:12.164360 | debian-bookworm | 2026-06-19 15:44:12.164376 | debian-bookworm | TASK [Include role auditd] ***************************************************** 2026-06-19 15:44:12.212440 | debian-bookworm | included: auditd for molecule-auditd 2026-06-19 15:44:12.212901 | debian-bookworm | 2026-06-19 15:44:12.213270 | debian-bookworm | TASK [auditd : Include distribution specific install tasks] ******************** 2026-06-19 15:44:12.240122 | debian-bookworm | included: /home/zuul/src/github.com/osism/ansible-collection-services/roles/auditd/tasks/install-Debian-family.yml for molecule-auditd 2026-06-19 15:44:12.240522 | debian-bookworm | 2026-06-19 15:44:12.240905 | debian-bookworm | TASK [auditd : Install auditd package] ***************************************** 2026-06-19 15:44:12.917630 | ubuntu-noble | ok: [molecule-auditd] 2026-06-19 15:44:12.917715 | ubuntu-noble | 2026-06-19 15:44:12.917887 | ubuntu-noble | TASK [Include required variables] ********************************************** 2026-06-19 15:44:12.948591 | ubuntu-noble | ok: [molecule-auditd] => {"ansible_facts": {}, "ansible_included_var_files": ["/home/zuul/src/github.com/osism/ansible-collection-services/molecule/delegated/vars/auditd.yml"], "changed": false} 2026-06-19 15:44:12.948628 | ubuntu-noble | 2026-06-19 15:44:12.948634 | ubuntu-noble | TASK [Include role auditd] ***************************************************** 2026-06-19 15:44:12.992607 | ubuntu-noble | included: auditd for molecule-auditd 2026-06-19 15:44:12.992670 | ubuntu-noble | 2026-06-19 15:44:12.992687 | ubuntu-noble | TASK [auditd : Include distribution specific install tasks] ******************** 2026-06-19 15:44:13.017703 | ubuntu-noble | included: /home/zuul/src/github.com/osism/ansible-collection-services/roles/auditd/tasks/install-Debian-family.yml for molecule-auditd 2026-06-19 15:44:13.017761 | ubuntu-noble | 2026-06-19 15:44:13.017776 | ubuntu-noble | TASK [auditd : Install auditd package] ***************************************** 2026-06-19 15:44:16.667352 | debian-bookworm | The following additional packages will be installed: 2026-06-19 15:44:16.667402 | debian-bookworm | libauparse0 2026-06-19 15:44:16.667408 | debian-bookworm | Suggested packages: 2026-06-19 15:44:16.667413 | debian-bookworm | audispd-plugins 2026-06-19 15:44:16.667418 | debian-bookworm | The following NEW packages will be installed: 2026-06-19 15:44:16.667423 | debian-bookworm | auditd libauparse0 2026-06-19 15:44:16.667427 | debian-bookworm | 0 upgraded, 2 newly installed, 0 to remove and 0 not upgraded. 2026-06-19 15:44:16.668233 | debian-bookworm | changed: [molecule-auditd] => {"cache_update_time": 1781883758, "cache_updated": false, "changed": true, "stderr": "debconf: delaying package configuration, since apt-utils is not installed\n", "stderr_lines": ["debconf: delaying package configuration, since apt-utils is not installed"], "stdout": "Reading package lists...\nBuilding dependency tree...\nReading state information...\nThe following additional packages will be installed:\n libauparse0\nSuggested packages:\n audispd-plugins\nThe following NEW packages will be installed:\n auditd libauparse0\n0 upgraded, 2 newly installed, 0 to remove and 0 not upgraded.\nNeed to get 279 kB of archives.\nAfter this operation, 934 kB of additional disk space will be used.\nGet:1 http://deb.debian.org/debian bookworm/main amd64 libauparse0 amd64 1:3.0.9-1 [61.9 kB]\nGet:2 http://deb.debian.org/debian bookworm/main amd64 auditd amd64 1:3.0.9-1 [218 kB]\nFetched 279 kB in 0s (3560 kB/s)\nSelecting previously unselected package libauparse0:amd64.\r\n(Reading database ... \r(Reading database ... 5%\r(Reading database ... 10%\r(Reading database ... 15%\r(Reading database ... 20%\r(Reading database ... 25%\r(Reading database ... 30%\r(Reading database ... 35%\r(Reading database ... 40%\r(Reading database ... 45%\r(Reading database ... 50%\r(Reading database ... 55%\r(Reading database ... 60%\r(Reading database ... 65%\r(Reading database ... 70%\r(Reading database ... 75%\r(Reading database ... 80%\r(Reading database ... 85%\r(Reading database ... 90%\r(Reading database ... 95%\r(Reading database ... 100%\r(Reading database ... 28691 files and directories currently installed.)\r\nPreparing to unpack .../libauparse0_1%3a3.0.9-1_amd64.deb ...\r\nUnpacking libauparse0:amd64 (1:3.0.9-1) ...\r\nSelecting previously unselected package auditd.\r\nPreparing to unpack .../auditd_1%3a3.0.9-1_amd64.deb ...\r\nUnpacking auditd (1:3.0.9-1) ...\r\nSetting up libauparse0:amd64 (1:3.0.9-1) ...\r\nSetting up auditd (1:3.0.9-1) ...\r\nCreated symlink /etc/systemd/system/multi-user.target.wants/auditd.service → /lib/systemd/system/auditd.service.\r\r\nProcessing triggers for libc-bin (2.36-9+deb12u14) ...\r\n", "stdout_lines": ["Reading package lists...", "Building dependency tree...", "Reading state information...", "The following additional packages will be installed:", " libauparse0", "Suggested packages:", " audispd-plugins", "The following NEW packages will be installed:", " auditd libauparse0", "0 upgraded, 2 newly installed, 0 to remove and 0 not upgraded.", "Need to get 279 kB of archives.", "After this operation, 934 kB of additional disk space will be used.", "Get:1 http://deb.debian.org/debian bookworm/main amd64 libauparse0 amd64 1:3.0.9-1 [61.9 kB]", "Get:2 http://deb.debian.org/debian bookworm/main amd64 auditd amd64 1:3.0.9-1 [218 kB]", "Fetched 279 kB in 0s (3560 kB/s)", "Selecting previously unselected package libauparse0:amd64.", "(Reading database ... ", "(Reading database ... 5%", "(Reading database ... 10%", "(Reading database ... 15%", "(Reading database ... 20%", "(Reading database ... 25%", "(Reading database ... 30%", "(Reading database ... 35%", "(Reading database ... 40%", "(Reading database ... 45%", "(Reading database ... 50%", "(Reading database ... 55%", "(Reading database ... 60%", "(Reading database ... 65%", "(Reading database ... 70%", "(Reading database ... 75%", "(Reading database ... 80%", "(Reading database ... 85%", "(Reading database ... 90%", "(Reading database ... 95%", "(Reading database ... 100%", "(Reading database ... 28691 files and directories currently installed.)", "Preparing to unpack .../libauparse0_1%3a3.0.9-1_amd64.deb ...", "Unpacking libauparse0:amd64 (1:3.0.9-1) ...", "Selecting previously unselected package auditd.", "Preparing to unpack .../auditd_1%3a3.0.9-1_amd64.deb ...", "Unpacking auditd (1:3.0.9-1) ...", "Setting up libauparse0:amd64 (1:3.0.9-1) ...", "Setting up auditd (1:3.0.9-1) ...", "Created symlink /etc/systemd/system/multi-user.target.wants/auditd.service → /lib/systemd/system/auditd.service.", "", "Processing triggers for libc-bin (2.36-9+deb12u14) ..."]} 2026-06-19 15:44:16.668270 | debian-bookworm | 2026-06-19 15:44:16.668276 | debian-bookworm | TASK [auditd : Install audispd-plugins package] ******************************** 2026-06-19 15:44:17.456392 | ubuntu-noble | The following additional packages will be installed: 2026-06-19 15:44:17.456446 | ubuntu-noble | libauparse0t64 2026-06-19 15:44:17.456457 | ubuntu-noble | Suggested packages: 2026-06-19 15:44:17.456465 | ubuntu-noble | audispd-plugins 2026-06-19 15:44:17.456474 | ubuntu-noble | The following NEW packages will be installed: 2026-06-19 15:44:17.456482 | ubuntu-noble | auditd libauparse0t64 2026-06-19 15:44:17.456490 | ubuntu-noble | 0 upgraded, 2 newly installed, 0 to remove and 0 not upgraded. 2026-06-19 15:44:17.459772 | ubuntu-noble | changed: [molecule-auditd] => {"cache_update_time": 1781883760, "cache_updated": false, "changed": true, "stderr": "debconf: delaying package configuration, since apt-utils is not installed\n", "stderr_lines": ["debconf: delaying package configuration, since apt-utils is not installed"], "stdout": "Reading package lists...\nBuilding dependency tree...\nReading state information...\nThe following additional packages will be installed:\n libauparse0t64\nSuggested packages:\n audispd-plugins\nThe following NEW packages will be installed:\n auditd libauparse0t64\n0 upgraded, 2 newly installed, 0 to remove and 0 not upgraded.\nNeed to get 274 kB of archives.\nAfter this operation, 893 kB of additional disk space will be used.\nGet:1 http://archive.ubuntu.com/ubuntu noble-updates/main amd64 libauparse0t64 amd64 1:3.1.2-2.1build1.1 [58.9 kB]\nGet:2 http://archive.ubuntu.com/ubuntu noble-updates/main amd64 auditd amd64 1:3.1.2-2.1build1.1 [215 kB]\nFetched 274 kB in 0s (2036 kB/s)\nSelecting previously unselected package libauparse0t64:amd64.\r\n(Reading database ... \r(Reading database ... 5%\r(Reading database ... 10%\r(Reading database ... 15%\r(Reading database ... 20%\r(Reading database ... 25%\r(Reading database ... 30%\r(Reading database ... 35%\r(Reading database ... 40%\r(Reading database ... 45%\r(Reading database ... 50%\r(Reading database ... 55%\r(Reading database ... 60%\r(Reading database ... 65%\r(Reading database ... 70%\r(Reading database ... 75%\r(Reading database ... 80%\r(Reading database ... 85%\r(Reading database ... 90%\r(Reading database ... 95%\r(Reading database ... 100%\r(Reading database ... 36085 files and directories currently installed.)\r\nPreparing to unpack .../libauparse0t64_1%3a3.1.2-2.1build1.1_amd64.deb ...\r\nAdding 'diversion of /lib/x86_64-linux-gnu/libauparse.so.0 to /lib/x86_64-linux-gnu/libauparse.so.0.usr-is-merged by libauparse0t64'\r\nAdding 'diversion of /lib/x86_64-linux-gnu/libauparse.so.0.0.0 to /lib/x86_64-linux-gnu/libauparse.so.0.0.0.usr-is-merged by libauparse0t64'\r\nUnpacking libauparse0t64:amd64 (1:3.1.2-2.1build1.1) ...\r\nSelecting previously unselected package auditd.\r\nPreparing to unpack .../auditd_1%3a3.1.2-2.1build1.1_amd64.deb ...\r\nUnpacking auditd (1:3.1.2-2.1build1.1) ...\r\nSetting up libauparse0t64:amd64 (1:3.1.2-2.1build1.1) ...\r\nSetting up auditd (1:3.1.2-2.1build1.1) ...\r\nCreated symlink /etc/systemd/system/multi-user.target.wants/auditd.service → /usr/lib/systemd/system/auditd.service.\r\r\nProcessing triggers for libc-bin (2.39-0ubuntu8.7) ...\r\n", "stdout_lines": ["Reading package lists...", "Building dependency tree...", "Reading state information...", "The following additional packages will be installed:", " libauparse0t64", "Suggested packages:", " audispd-plugins", "The following NEW packages will be installed:", " auditd libauparse0t64", "0 upgraded, 2 newly installed, 0 to remove and 0 not upgraded.", "Need to get 274 kB of archives.", "After this operation, 893 kB of additional disk space will be used.", "Get:1 http://archive.ubuntu.com/ubuntu noble-updates/main amd64 libauparse0t64 amd64 1:3.1.2-2.1build1.1 [58.9 kB]", "Get:2 http://archive.ubuntu.com/ubuntu noble-updates/main amd64 auditd amd64 1:3.1.2-2.1build1.1 [215 kB]", "Fetched 274 kB in 0s (2036 kB/s)", "Selecting previously unselected package libauparse0t64:amd64.", "(Reading database ... ", "(Reading database ... 5%", "(Reading database ... 10%", "(Reading database ... 15%", "(Reading database ... 20%", "(Reading database ... 25%", "(Reading database ... 30%", "(Reading database ... 35%", "(Reading database ... 40%", "(Reading database ... 45%", "(Reading database ... 50%", "(Reading database ... 55%", "(Reading database ... 60%", "(Reading database ... 65%", "(Reading database ... 70%", "(Reading database ... 75%", "(Reading database ... 80%", "(Reading database ... 85%", "(Reading database ... 90%", "(Reading database ... 95%", "(Reading database ... 100%", "(Reading database ... 36085 files and directories currently installed.)", "Preparing to unpack .../libauparse0t64_1%3a3.1.2-2.1build1.1_amd64.deb ...", "Adding 'diversion of /lib/x86_64-linux-gnu/libauparse.so.0 to /lib/x86_64-linux-gnu/libauparse.so.0.usr-is-merged by libauparse0t64'", "Adding 'diversion of /lib/x86_64-linux-gnu/libauparse.so.0.0.0 to /lib/x86_64-linux-gnu/libauparse.so.0.0.0.usr-is-merged by libauparse0t64'", "Unpacking libauparse0t64:amd64 (1:3.1.2-2.1build1.1) ...", "Selecting previously unselected package auditd.", "Preparing to unpack .../auditd_1%3a3.1.2-2.1build1.1_amd64.deb ...", "Unpacking auditd (1:3.1.2-2.1build1.1) ...", "Setting up libauparse0t64:amd64 (1:3.1.2-2.1build1.1) ...", "Setting up auditd (1:3.1.2-2.1build1.1) ...", "Created symlink /etc/systemd/system/multi-user.target.wants/auditd.service → /usr/lib/systemd/system/auditd.service.", "", "Processing triggers for libc-bin (2.39-0ubuntu8.7) ..."]} 2026-06-19 15:44:17.460035 | ubuntu-noble | 2026-06-19 15:44:17.460253 | ubuntu-noble | TASK [auditd : Install audispd-plugins package] ******************************** 2026-06-19 15:44:19.668982 | debian-bookworm | The following NEW packages will be installed: 2026-06-19 15:44:19.669078 | debian-bookworm | audispd-plugins 2026-06-19 15:44:19.669089 | debian-bookworm | 0 upgraded, 1 newly installed, 0 to remove and 0 not upgraded. 2026-06-19 15:44:19.669102 | debian-bookworm | changed: [molecule-auditd] => {"cache_update_time": 1781883758, "cache_updated": false, "changed": true, "stderr": "debconf: delaying package configuration, since apt-utils is not installed\n", "stderr_lines": ["debconf: delaying package configuration, since apt-utils is not installed"], "stdout": "Reading package lists...\nBuilding dependency tree...\nReading state information...\nThe following NEW packages will be installed:\n audispd-plugins\n0 upgraded, 1 newly installed, 0 to remove and 0 not upgraded.\nNeed to get 45.6 kB of archives.\nAfter this operation, 132 kB of additional disk space will be used.\nGet:1 http://deb.debian.org/debian bookworm/main amd64 audispd-plugins amd64 1:3.0.9-1 [45.6 kB]\nFetched 45.6 kB in 0s (917 kB/s)\nSelecting previously unselected package audispd-plugins.\r\n(Reading database ... \r(Reading database ... 5%\r(Reading database ... 10%\r(Reading database ... 15%\r(Reading database ... 20%\r(Reading database ... 25%\r(Reading database ... 30%\r(Reading database ... 35%\r(Reading database ... 40%\r(Reading database ... 45%\r(Reading database ... 50%\r(Reading database ... 55%\r(Reading database ... 60%\r(Reading database ... 65%\r(Reading database ... 70%\r(Reading database ... 75%\r(Reading database ... 80%\r(Reading database ... 85%\r(Reading database ... 90%\r(Reading database ... 95%\r(Reading database ... 100%\r(Reading database ... 28782 files and directories currently installed.)\r\nPreparing to unpack .../audispd-plugins_1%3a3.0.9-1_amd64.deb ...\r\nUnpacking audispd-plugins (1:3.0.9-1) ...\r\nSetting up audispd-plugins (1:3.0.9-1) ...\r\n", "stdout_lines": ["Reading package lists...", "Building dependency tree...", "Reading state information...", "The following NEW packages will be installed:", " audispd-plugins", "0 upgraded, 1 newly installed, 0 to remove and 0 not upgraded.", "Need to get 45.6 kB of archives.", "After this operation, 132 kB of additional disk space will be used.", "Get:1 http://deb.debian.org/debian bookworm/main amd64 audispd-plugins amd64 1:3.0.9-1 [45.6 kB]", "Fetched 45.6 kB in 0s (917 kB/s)", "Selecting previously unselected package audispd-plugins.", "(Reading database ... ", "(Reading database ... 5%", "(Reading database ... 10%", "(Reading database ... 15%", "(Reading database ... 20%", "(Reading database ... 25%", "(Reading database ... 30%", "(Reading database ... 35%", "(Reading database ... 40%", "(Reading database ... 45%", "(Reading database ... 50%", "(Reading database ... 55%", "(Reading database ... 60%", "(Reading database ... 65%", "(Reading database ... 70%", "(Reading database ... 75%", "(Reading database ... 80%", "(Reading database ... 85%", "(Reading database ... 90%", "(Reading database ... 95%", "(Reading database ... 100%", "(Reading database ... 28782 files and directories currently installed.)", "Preparing to unpack .../audispd-plugins_1%3a3.0.9-1_amd64.deb ...", "Unpacking audispd-plugins (1:3.0.9-1) ...", "Setting up audispd-plugins (1:3.0.9-1) ..."]} 2026-06-19 15:44:19.669134 | debian-bookworm | 2026-06-19 15:44:19.669142 | debian-bookworm | TASK [auditd : Copy auditd.conf configuration files] *************************** 2026-06-19 15:44:20.424183 | ubuntu-noble | The following NEW packages will be installed: 2026-06-19 15:44:20.424573 | ubuntu-noble | audispd-plugins 2026-06-19 15:44:20.424892 | ubuntu-noble | 0 upgraded, 1 newly installed, 0 to remove and 0 not upgraded. 2026-06-19 15:44:20.425305 | ubuntu-noble | changed: [molecule-auditd] => {"cache_update_time": 1781883760, "cache_updated": false, "changed": true, "stderr": "debconf: delaying package configuration, since apt-utils is not installed\n", "stderr_lines": ["debconf: delaying package configuration, since apt-utils is not installed"], "stdout": "Reading package lists...\nBuilding dependency tree...\nReading state information...\nThe following NEW packages will be installed:\n audispd-plugins\n0 upgraded, 1 newly installed, 0 to remove and 0 not upgraded.\nNeed to get 38.8 kB of archives.\nAfter this operation, 131 kB of additional disk space will be used.\nGet:1 http://archive.ubuntu.com/ubuntu noble-updates/universe amd64 audispd-plugins amd64 1:3.1.2-2.1build1.1 [38.8 kB]\nFetched 38.8 kB in 0s (629 kB/s)\nSelecting previously unselected package audispd-plugins.\r\n(Reading database ... \r(Reading database ... 5%\r(Reading database ... 10%\r(Reading database ... 15%\r(Reading database ... 20%\r(Reading database ... 25%\r(Reading database ... 30%\r(Reading database ... 35%\r(Reading database ... 40%\r(Reading database ... 45%\r(Reading database ... 50%\r(Reading database ... 55%\r(Reading database ... 60%\r(Reading database ... 65%\r(Reading database ... 70%\r(Reading database ... 75%\r(Reading database ... 80%\r(Reading database ... 85%\r(Reading database ... 90%\r(Reading database ... 95%\r(Reading database ... 100%\r(Reading database ... 36181 files and directories currently installed.)\r\nPreparing to unpack .../audispd-plugins_1%3a3.1.2-2.1build1.1_amd64.deb ...\r\nUnpacking audispd-plugins (1:3.1.2-2.1build1.1) ...\r\nSetting up audispd-plugins (1:3.1.2-2.1build1.1) ...\r\n", "stdout_lines": ["Reading package lists...", "Building dependency tree...", "Reading state information...", "The following NEW packages will be installed:", " audispd-plugins", "0 upgraded, 1 newly installed, 0 to remove and 0 not upgraded.", "Need to get 38.8 kB of archives.", "After this operation, 131 kB of additional disk space will be used.", "Get:1 http://archive.ubuntu.com/ubuntu noble-updates/universe amd64 audispd-plugins amd64 1:3.1.2-2.1build1.1 [38.8 kB]", "Fetched 38.8 kB in 0s (629 kB/s)", "Selecting previously unselected package audispd-plugins.", "(Reading database ... ", "(Reading database ... 5%", "(Reading database ... 10%", "(Reading database ... 15%", "(Reading database ... 20%", "(Reading database ... 25%", "(Reading database ... 30%", "(Reading database ... 35%", "(Reading database ... 40%", "(Reading database ... 45%", "(Reading database ... 50%", "(Reading database ... 55%", "(Reading database ... 60%", "(Reading database ... 65%", "(Reading database ... 70%", "(Reading database ... 75%", "(Reading database ... 80%", "(Reading database ... 85%", "(Reading database ... 90%", "(Reading database ... 95%", "(Reading database ... 100%", "(Reading database ... 36181 files and directories currently installed.)", "Preparing to unpack .../audispd-plugins_1%3a3.1.2-2.1build1.1_amd64.deb ...", "Unpacking audispd-plugins (1:3.1.2-2.1build1.1) ...", "Setting up audispd-plugins (1:3.1.2-2.1build1.1) ..."]} 2026-06-19 15:44:20.425795 | ubuntu-noble | 2026-06-19 15:44:20.426103 | ubuntu-noble | TASK [auditd : Copy auditd.conf configuration files] *************************** 2026-06-19 15:44:21.283241 | debian-bookworm | --- before 2026-06-19 15:44:21.283282 | debian-bookworm | +++ after: /home/zuul/.ansible/tmp/ansible-local-22049g7y9l2i/tmpx_sahvle/auditd.conf.j2 2026-06-19 15:44:21.287237 | debian-bookworm | @@ -0,0 +1,37 @@ 2026-06-19 15:44:21.287262 | debian-bookworm | +# 2026-06-19 15:44:21.287268 | debian-bookworm | +# This file controls the configuration of the audit daemon 2026-06-19 15:44:21.287273 | debian-bookworm | +# 2026-06-19 15:44:21.287277 | debian-bookworm | + 2026-06-19 15:44:21.287281 | debian-bookworm | +local_events = yes 2026-06-19 15:44:21.287286 | debian-bookworm | +write_logs = yes 2026-06-19 15:44:21.287290 | debian-bookworm | +log_file = /var/log/audit/audit.log 2026-06-19 15:44:21.287295 | debian-bookworm | +log_group = adm 2026-06-19 15:44:21.287299 | debian-bookworm | +log_format = RAW 2026-06-19 15:44:21.287304 | debian-bookworm | +flush = INCREMENTAL_ASYNC 2026-06-19 15:44:21.287308 | debian-bookworm | +freq = 50 2026-06-19 15:44:21.287312 | debian-bookworm | +max_log_file = 8 2026-06-19 15:44:21.287316 | debian-bookworm | +num_logs = 5 2026-06-19 15:44:21.287320 | debian-bookworm | +priority_boost = 4 2026-06-19 15:44:21.287324 | debian-bookworm | +disp_qos = lossy 2026-06-19 15:44:21.287328 | debian-bookworm | +dispatcher = /sbin/audispd 2026-06-19 15:44:21.287332 | debian-bookworm | +name_format = NONE 2026-06-19 15:44:21.287336 | debian-bookworm | +##name = mydomain 2026-06-19 15:44:21.287339 | debian-bookworm | +max_log_file_action = ROTATE 2026-06-19 15:44:21.287344 | debian-bookworm | +space_left = 12361 2026-06-19 15:44:21.287348 | debian-bookworm | +space_left_action = email 2026-06-19 15:44:21.287351 | debian-bookworm | +verify_email = yes 2026-06-19 15:44:21.287355 | debian-bookworm | +action_mail_acct = root 2026-06-19 15:44:21.287359 | debian-bookworm | +admin_space_left = 50 2026-06-19 15:44:21.287374 | debian-bookworm | +admin_space_left_action = SUSPEND 2026-06-19 15:44:21.287378 | debian-bookworm | +disk_full_action = SUSPEND 2026-06-19 15:44:21.287382 | debian-bookworm | +disk_error_action = SUSPEND 2026-06-19 15:44:21.287386 | debian-bookworm | +use_libwrap = yes 2026-06-19 15:44:21.287390 | debian-bookworm | +##tcp_listen_port = 60 2026-06-19 15:44:21.287394 | debian-bookworm | +tcp_listen_queue = 5 2026-06-19 15:44:21.287398 | debian-bookworm | +tcp_max_per_addr = 1 2026-06-19 15:44:21.287402 | debian-bookworm | +##tcp_client_ports = 1024-65535 2026-06-19 15:44:21.287406 | debian-bookworm | +tcp_client_max_idle = 0 2026-06-19 15:44:21.287410 | debian-bookworm | +enable_krb5 = no 2026-06-19 15:44:21.287413 | debian-bookworm | +krb5_principal = auditd 2026-06-19 15:44:21.287417 | debian-bookworm | +##krb5_key_file = /etc/audit/audit.key 2026-06-19 15:44:21.287421 | debian-bookworm | +distribute_network = no 2026-06-19 15:44:21.287425 | debian-bookworm | 2026-06-19 15:44:21.287442 | debian-bookworm | changed: [molecule-auditd] => {"changed": true, "checksum": "e902cc6bebf86c17087d153e359a2cc1231672e0", "dest": "/etc/audit/audit.conf", "gid": 0, "group": "root", "md5sum": "69dfd768317bae876a6a78c8aeb5cce1", "mode": "0640", "owner": "root", "size": 806, "src": "/home/zuul/.ansible/tmp/ansible-tmp-1781883859.686785-2574-92339855042866/.source.conf", "state": "file", "uid": 0} 2026-06-19 15:44:21.287450 | debian-bookworm | 2026-06-19 15:44:21.287504 | debian-bookworm | TASK [auditd : Adjust auditd/audispd configurations] *************************** 2026-06-19 15:44:21.909913 | debian-bookworm | ok: [molecule-auditd] => (item={'parameter': 'active', 'value': 'no', 'config': '/etc/audit/plugins.d/syslog.conf'}) => {"ansible_loop_var": "item", "backup": "", "changed": false, "item": {"config": "/etc/audit/plugins.d/syslog.conf", "parameter": "active", "value": "no"}, "msg": ""} 2026-06-19 15:44:21.909959 | debian-bookworm | 2026-06-19 15:44:21.909966 | debian-bookworm | TASK [auditd : Deploy rules for auditd] **************************************** 2026-06-19 15:44:22.082723 | ubuntu-noble | --- before 2026-06-19 15:44:22.082826 | ubuntu-noble | +++ after: /home/zuul/.ansible/tmp/ansible-local-2047j12v2xwe/tmpe7bhzdc1/auditd.conf.j2 2026-06-19 15:44:22.082930 | ubuntu-noble | @@ -0,0 +1,37 @@ 2026-06-19 15:44:22.083024 | ubuntu-noble | +# 2026-06-19 15:44:22.083128 | ubuntu-noble | +# This file controls the configuration of the audit daemon 2026-06-19 15:44:22.083222 | ubuntu-noble | +# 2026-06-19 15:44:22.083340 | ubuntu-noble | + 2026-06-19 15:44:22.083476 | ubuntu-noble | +local_events = yes 2026-06-19 15:44:22.083585 | ubuntu-noble | +write_logs = yes 2026-06-19 15:44:22.083685 | ubuntu-noble | +log_file = /var/log/audit/audit.log 2026-06-19 15:44:22.083801 | ubuntu-noble | +log_group = adm 2026-06-19 15:44:22.083910 | ubuntu-noble | +log_format = RAW 2026-06-19 15:44:22.084011 | ubuntu-noble | +flush = INCREMENTAL_ASYNC 2026-06-19 15:44:22.084107 | ubuntu-noble | +freq = 50 2026-06-19 15:44:22.084207 | ubuntu-noble | +max_log_file = 8 2026-06-19 15:44:22.084308 | ubuntu-noble | +num_logs = 5 2026-06-19 15:44:22.085148 | ubuntu-noble | +priority_boost = 4 2026-06-19 15:44:22.085251 | ubuntu-noble | +disp_qos = lossy 2026-06-19 15:44:22.085389 | ubuntu-noble | +dispatcher = /sbin/audispd 2026-06-19 15:44:22.085526 | ubuntu-noble | +name_format = NONE 2026-06-19 15:44:22.085624 | ubuntu-noble | +##name = mydomain 2026-06-19 15:44:22.085724 | ubuntu-noble | +max_log_file_action = ROTATE 2026-06-19 15:44:22.085824 | ubuntu-noble | +space_left = 12361 2026-06-19 15:44:22.086873 | ubuntu-noble | +space_left_action = email 2026-06-19 15:44:22.087053 | ubuntu-noble | +verify_email = yes 2026-06-19 15:44:22.087223 | ubuntu-noble | +action_mail_acct = root 2026-06-19 15:44:22.087352 | ubuntu-noble | +admin_space_left = 50 2026-06-19 15:44:22.087475 | ubuntu-noble | +admin_space_left_action = SUSPEND 2026-06-19 15:44:22.088348 | ubuntu-noble | +disk_full_action = SUSPEND 2026-06-19 15:44:22.088366 | ubuntu-noble | +disk_error_action = SUSPEND 2026-06-19 15:44:22.088372 | ubuntu-noble | +use_libwrap = yes 2026-06-19 15:44:22.088377 | ubuntu-noble | +##tcp_listen_port = 60 2026-06-19 15:44:22.088382 | ubuntu-noble | +tcp_listen_queue = 5 2026-06-19 15:44:22.088386 | ubuntu-noble | +tcp_max_per_addr = 1 2026-06-19 15:44:22.088395 | ubuntu-noble | +##tcp_client_ports = 1024-65535 2026-06-19 15:44:22.088579 | ubuntu-noble | +tcp_client_max_idle = 0 2026-06-19 15:44:22.088678 | ubuntu-noble | +enable_krb5 = no 2026-06-19 15:44:22.088779 | ubuntu-noble | +krb5_principal = auditd 2026-06-19 15:44:22.088881 | ubuntu-noble | +##krb5_key_file = /etc/audit/audit.key 2026-06-19 15:44:22.088983 | ubuntu-noble | +distribute_network = no 2026-06-19 15:44:22.089077 | ubuntu-noble | 2026-06-19 15:44:22.089215 | ubuntu-noble | changed: [molecule-auditd] => {"changed": true, "checksum": "e902cc6bebf86c17087d153e359a2cc1231672e0", "dest": "/etc/audit/audit.conf", "gid": 0, "group": "root", "md5sum": "69dfd768317bae876a6a78c8aeb5cce1", "mode": "0640", "owner": "root", "size": 806, "src": "/home/zuul/.ansible/tmp/ansible-tmp-1781883860.4418375-2444-152828342745862/.source.conf", "state": "file", "uid": 0} 2026-06-19 15:44:22.089293 | ubuntu-noble | 2026-06-19 15:44:22.089515 | ubuntu-noble | TASK [auditd : Adjust auditd/audispd configurations] *************************** 2026-06-19 15:44:23.035260 | debian-bookworm | --- before 2026-06-19 15:44:23.035314 | debian-bookworm | +++ after: /home/zuul/.ansible/tmp/ansible-local-22049g7y9l2i/tmp5zf79l9p/20-neo23x0.rules.j2 2026-06-19 15:44:23.035321 | debian-bookworm | @@ -0,0 +1,750 @@ 2026-06-19 15:44:23.035327 | debian-bookworm | +# ___ ___ __ __ 2026-06-19 15:44:23.035333 | debian-bookworm | +# / | __ ______/ (_) /_____/ / 2026-06-19 15:44:23.035337 | debian-bookworm | +# / /| |/ / / / __ / / __/ __ / 2026-06-19 15:44:23.035342 | debian-bookworm | +# / ___ / /_/ / /_/ / / /_/ /_/ / 2026-06-19 15:44:23.035346 | debian-bookworm | +# /_/ |_\__,_/\__,_/_/\__/\__,_/ 2026-06-19 15:44:23.035351 | debian-bookworm | +# 2026-06-19 15:44:23.035355 | debian-bookworm | +# Linux Audit Daemon - Best Practice Configuration 2026-06-19 15:44:23.035360 | debian-bookworm | +# /etc/audit/audit.rules 2026-06-19 15:44:23.035364 | debian-bookworm | +# 2026-06-19 15:44:23.035368 | debian-bookworm | +# Compiled by Florian Roth 2026-06-19 15:44:23.035372 | debian-bookworm | +# 2026-06-19 15:44:23.035376 | debian-bookworm | +# Created : 2017/12/05 2026-06-19 15:44:23.035380 | debian-bookworm | +# Modified : 2023/01/25 2026-06-19 15:44:23.035384 | debian-bookworm | +# 2026-06-19 15:44:23.035388 | debian-bookworm | +# Based on rules published here: 2026-06-19 15:44:23.035392 | debian-bookworm | +# Gov.uk auditd rules 2026-06-19 15:44:23.035396 | debian-bookworm | +# https://github.com/gds-operations/puppet-auditd/pull/1 2026-06-19 15:44:23.035400 | debian-bookworm | +# CentOS 7 hardening 2026-06-19 15:44:23.035404 | debian-bookworm | +# https://highon.coffee/blog/security-harden-centos-7/#auditd---audit-daemon 2026-06-19 15:44:23.035408 | debian-bookworm | +# Linux audit repo 2026-06-19 15:44:23.035413 | debian-bookworm | +# https://github.com/linux-audit/audit-userspace/tree/master/rules 2026-06-19 15:44:23.035418 | debian-bookworm | +# Auditd high performance linux auditing 2026-06-19 15:44:23.035422 | debian-bookworm | +# https://linux-audit.com/tuning-auditd-high-performance-linux-auditing/ 2026-06-19 15:44:23.035426 | debian-bookworm | +# 2026-06-19 15:44:23.035430 | debian-bookworm | +# Further rules 2026-06-19 15:44:23.043656 | debian-bookworm | +# For PCI DSS compliance see: 2026-06-19 15:44:23.043940 | debian-bookworm | +# https://github.com/linux-audit/audit-userspace/blob/master/rules/30-pci-dss-v31.rules 2026-06-19 15:44:23.044115 | debian-bookworm | +# For NISPOM compliance see: 2026-06-19 15:44:23.044281 | debian-bookworm | +# https://github.com/linux-audit/audit-userspace/blob/master/rules/30-nispom.rules 2026-06-19 15:44:23.044400 | debian-bookworm | + 2026-06-19 15:44:23.044515 | debian-bookworm | +# Remove any existing rules 2026-06-19 15:44:23.044629 | debian-bookworm | +-D 2026-06-19 15:44:23.044775 | debian-bookworm | + 2026-06-19 15:44:23.044924 | debian-bookworm | +# Buffer Size 2026-06-19 15:44:23.045041 | debian-bookworm | +## Feel free to increase this if the machine panic's 2026-06-19 15:44:23.045155 | debian-bookworm | +-b 8192 2026-06-19 15:44:23.045266 | debian-bookworm | + 2026-06-19 15:44:23.045379 | debian-bookworm | +# Failure Mode 2026-06-19 15:44:23.045496 | debian-bookworm | +## Possible values: 0 (silent), 1 (printk, print a failure message), 2 (panic, halt the system) 2026-06-19 15:44:23.045607 | debian-bookworm | +-f 1 2026-06-19 15:44:23.045715 | debian-bookworm | + 2026-06-19 15:44:23.045840 | debian-bookworm | +# Ignore errors 2026-06-19 15:44:23.045953 | debian-bookworm | +## e.g. caused by users or files not found in the local environment 2026-06-19 15:44:23.046061 | debian-bookworm | +-i 2026-06-19 15:44:23.046167 | debian-bookworm | + 2026-06-19 15:44:23.046278 | debian-bookworm | +# Self Auditing --------------------------------------------------------------- 2026-06-19 15:44:23.046388 | debian-bookworm | + 2026-06-19 15:44:23.046499 | debian-bookworm | +## Audit the audit logs 2026-06-19 15:44:23.046610 | debian-bookworm | +### Successful and unsuccessful attempts to read information from the audit records 2026-06-19 15:44:23.046723 | debian-bookworm | +-w /var/log/audit/ -p wra -k auditlog 2026-06-19 15:44:23.046851 | debian-bookworm | +-w /var/audit/ -p wra -k auditlog 2026-06-19 15:44:23.046960 | debian-bookworm | + 2026-06-19 15:44:23.047073 | debian-bookworm | +## Auditd configuration 2026-06-19 15:44:23.047221 | debian-bookworm | +### Modifications to audit configuration that occur while the audit collection functions are operating 2026-06-19 15:44:23.047342 | debian-bookworm | +-w /etc/audit/ -p wa -k auditconfig 2026-06-19 15:44:23.047455 | debian-bookworm | +-w /etc/libaudit.conf -p wa -k auditconfig 2026-06-19 15:44:23.047569 | debian-bookworm | +-w /etc/audisp/ -p wa -k audispconfig 2026-06-19 15:44:23.047678 | debian-bookworm | + 2026-06-19 15:44:23.047825 | debian-bookworm | +## Monitor for use of audit management tools 2026-06-19 15:44:23.047942 | debian-bookworm | +-w /sbin/auditctl -p x -k audittools 2026-06-19 15:44:23.048371 | debian-bookworm | +-w /sbin/auditd -p x -k audittools 2026-06-19 15:44:23.048494 | debian-bookworm | +-w /usr/sbin/auditd -p x -k audittools 2026-06-19 15:44:23.048605 | debian-bookworm | +-w /usr/sbin/augenrules -p x -k audittools 2026-06-19 15:44:23.048715 | debian-bookworm | + 2026-06-19 15:44:23.048851 | debian-bookworm | +## Access to all audit trails 2026-06-19 15:44:23.048962 | debian-bookworm | + 2026-06-19 15:44:23.049080 | debian-bookworm | +-a always,exit -F path=/usr/sbin/ausearch -F perm=x -k audittools 2026-06-19 15:44:23.049192 | debian-bookworm | +-a always,exit -F path=/usr/sbin/aureport -F perm=x -k audittools 2026-06-19 15:44:23.049323 | debian-bookworm | +-a always,exit -F path=/usr/sbin/aulast -F perm=x -k audittools 2026-06-19 15:44:22.745037 | ubuntu-noble | ok: [molecule-auditd] => (item={'parameter': 'active', 'value': 'no', 'config': '/etc/audit/plugins.d/syslog.conf'}) => {"ansible_loop_var": "item", "backup": "", "changed": false, "item": {"config": "/etc/audit/plugins.d/syslog.conf", "parameter": "active", "value": "no"}, "msg": ""} 2026-06-19 15:44:22.745169 | ubuntu-noble | 2026-06-19 15:44:22.745358 | ubuntu-noble | TASK [auditd : Deploy rules for auditd] **************************************** 2026-06-19 15:44:23.049501 | debian-bookworm | +-a always,exit -F path=/usr/sbin/aulastlogin -F perm=x -k audittools 2026-06-19 15:44:23.049618 | debian-bookworm | +-a always,exit -F path=/usr/sbin/auvirt -F perm=x -k audittools 2026-06-19 15:44:23.049729 | debian-bookworm | + 2026-06-19 15:44:23.049880 | debian-bookworm | +# Filters --------------------------------------------------------------------- 2026-06-19 15:44:23.049993 | debian-bookworm | + 2026-06-19 15:44:23.050106 | debian-bookworm | +### We put these early because audit is a first match wins system. 2026-06-19 15:44:23.050212 | debian-bookworm | + 2026-06-19 15:44:23.050326 | debian-bookworm | +## Ignore SELinux AVC records 2026-06-19 15:44:23.050454 | debian-bookworm | +-a always,exclude -F msgtype=AVC 2026-06-19 15:44:23.050596 | debian-bookworm | + 2026-06-19 15:44:23.050710 | debian-bookworm | +## Ignore current working directory records 2026-06-19 15:44:23.050842 | debian-bookworm | +-a always,exclude -F msgtype=CWD 2026-06-19 15:44:23.050952 | debian-bookworm | + 2026-06-19 15:44:23.051070 | debian-bookworm | +## Cron jobs fill the logs with stuff we normally don't want (works with SELinux) 2026-06-19 15:44:23.051212 | debian-bookworm | +-a never,user -F subj_type=crond_t 2026-06-19 15:44:23.051334 | debian-bookworm | +-a never,exit -F subj_type=crond_t 2026-06-19 15:44:23.051441 | debian-bookworm | + 2026-06-19 15:44:23.051587 | debian-bookworm | +## This prevents chrony from overwhelming the logs 2026-06-19 15:44:23.051709 | debian-bookworm | +-a never,exit -F arch=b64 -S adjtimex -F auid=-1 -F uid=chrony -F subj_type=chronyd_t 2026-06-19 15:44:23.051836 | debian-bookworm | + 2026-06-19 15:44:23.051951 | debian-bookworm | +## This is not very interesting and wastes a lot of space if the server is public facing 2026-06-19 15:44:23.052076 | debian-bookworm | +-a always,exclude -F msgtype=CRYPTO_KEY_USER 2026-06-19 15:44:23.052185 | debian-bookworm | + 2026-06-19 15:44:23.052299 | debian-bookworm | +## Open VM Tools 2026-06-19 15:44:23.052413 | debian-bookworm | +-a exit,never -F arch=b64 -S all -F exe=/usr/bin/vmtoolsd 2026-06-19 15:44:23.052523 | debian-bookworm | + 2026-06-19 15:44:23.052674 | debian-bookworm | +## High Volume Event Filter (especially on Linux Workstations) 2026-06-19 15:44:23.052850 | debian-bookworm | +-a never,exit -F arch=b64 -F dir=/dev/shm -k sharedmemaccess 2026-06-19 15:44:23.052969 | debian-bookworm | +-a never,exit -F arch=b64 -F dir=/var/lock/lvm -k locklvm 2026-06-19 15:44:23.053079 | debian-bookworm | + 2026-06-19 15:44:23.053194 | debian-bookworm | +## FileBeat 2026-06-19 15:44:23.053307 | debian-bookworm | +-a never,exit -F arch=b64 -F path=/opt/filebeat -k filebeat 2026-06-19 15:44:23.053419 | debian-bookworm | + 2026-06-19 15:44:23.053533 | debian-bookworm | +## More information on how to filter events 2026-06-19 15:44:23.053648 | debian-bookworm | +### https://access.redhat.com/solutions/2482221 2026-06-19 15:44:23.053810 | debian-bookworm | + 2026-06-19 15:44:23.053928 | debian-bookworm | +# Rules ----------------------------------------------------------------------- 2026-06-19 15:44:23.054308 | debian-bookworm | + 2026-06-19 15:44:23.054447 | debian-bookworm | +## Kernel parameters 2026-06-19 15:44:23.054564 | debian-bookworm | +-w /etc/sysctl.conf -p wa -k sysctl 2026-06-19 15:44:23.054680 | debian-bookworm | +-w /etc/sysctl.d -p wa -k sysctl 2026-06-19 15:44:23.054847 | debian-bookworm | + 2026-06-19 15:44:23.054965 | debian-bookworm | +## Kernel module loading and unloading 2026-06-19 15:44:23.055080 | debian-bookworm | +-a always,exit -F perm=x -F auid!=-1 -F path=/sbin/insmod -k modules 2026-06-19 15:44:23.055282 | debian-bookworm | +-a always,exit -F perm=x -F auid!=-1 -F path=/sbin/modprobe -k modules 2026-06-19 15:44:23.055409 | debian-bookworm | +-a always,exit -F perm=x -F auid!=-1 -F path=/sbin/rmmod -k modules 2026-06-19 15:44:23.055527 | debian-bookworm | +-a always,exit -F arch=b64 -S finit_module -S init_module -S delete_module -F auid!=-1 -k modules 2026-06-19 15:44:23.055636 | debian-bookworm | + 2026-06-19 15:44:23.055782 | debian-bookworm | +## Modprobe configuration 2026-06-19 15:44:23.055947 | debian-bookworm | +-w /etc/modprobe.conf -p wa -k modprobe 2026-06-19 15:44:23.056066 | debian-bookworm | +-w /etc/modprobe.d -p wa -k modprobe 2026-06-19 15:44:23.056176 | debian-bookworm | + 2026-06-19 15:44:23.056288 | debian-bookworm | +## KExec usage (all actions) 2026-06-19 15:44:23.056403 | debian-bookworm | +-a always,exit -F arch=b64 -S kexec_load -k KEXEC 2026-06-19 15:44:23.056512 | debian-bookworm | + 2026-06-19 15:44:23.056623 | debian-bookworm | +## Special files 2026-06-19 15:44:23.056760 | debian-bookworm | +-a always,exit -F arch=b64 -S mknod -S mknodat -k specialfiles 2026-06-19 15:44:23.056878 | debian-bookworm | + 2026-06-19 15:44:23.057028 | debian-bookworm | +## Mount operations (only attributable) 2026-06-19 15:44:23.057145 | debian-bookworm | +-a always,exit -F arch=b64 -S mount -S umount2 -F auid!=-1 -k mount 2026-06-19 15:44:23.057253 | debian-bookworm | + 2026-06-19 15:44:23.057369 | debian-bookworm | +### NFS mount 2026-06-19 15:44:23.057495 | debian-bookworm | +-a always,exit -F path=/sbin/mount.nfs -F perm=x -F auid>=500 -F auid!=4294967295 -k T1078_Valid_Accounts 2026-06-19 15:44:23.057618 | debian-bookworm | +-a always,exit -F path=/usr/sbin/mount.nfs -F perm=x -F auid>=500 -F auid!=4294967295 -k T1078_Valid_Accounts 2026-06-19 15:44:23.057730 | debian-bookworm | + 2026-06-19 15:44:23.057859 | debian-bookworm | +## Change swap (only attributable) 2026-06-19 15:44:23.057973 | debian-bookworm | +-a always,exit -F arch=b64 -S swapon -S swapoff -F auid!=-1 -k swap 2026-06-19 15:44:23.058120 | debian-bookworm | + 2026-06-19 15:44:23.058237 | debian-bookworm | +## Time 2026-06-19 15:44:23.058356 | debian-bookworm | +-a always,exit -F arch=b64 -F uid!=ntp -S adjtimex -S settimeofday -S clock_settime -k time 2026-06-19 15:44:23.058469 | debian-bookworm | +### Local time zone 2026-06-19 15:44:23.058585 | debian-bookworm | +-w /etc/localtime -p wa -k localtime 2026-06-19 15:44:23.058695 | debian-bookworm | + 2026-06-19 15:44:23.058821 | debian-bookworm | +## Stunnel 2026-06-19 15:44:23.058936 | debian-bookworm | +-w /usr/sbin/stunnel -p x -k stunnel 2026-06-19 15:44:23.059069 | debian-bookworm | +-w /usr/bin/stunnel -p x -k stunnel 2026-06-19 15:44:23.059217 | debian-bookworm | + 2026-06-19 15:44:23.059339 | debian-bookworm | +## Cron configuration & scheduled jobs 2026-06-19 15:44:23.059452 | debian-bookworm | +-w /etc/cron.allow -p wa -k cron 2026-06-19 15:44:23.059563 | debian-bookworm | +-w /etc/cron.deny -p wa -k cron 2026-06-19 15:44:23.059674 | debian-bookworm | +-w /etc/cron.d/ -p wa -k cron 2026-06-19 15:44:23.059824 | debian-bookworm | +-w /etc/cron.daily/ -p wa -k cron 2026-06-19 15:44:23.059943 | debian-bookworm | +-w /etc/cron.hourly/ -p wa -k cron 2026-06-19 15:44:23.060057 | debian-bookworm | +-w /etc/cron.monthly/ -p wa -k cron 2026-06-19 15:44:23.060204 | debian-bookworm | +-w /etc/cron.weekly/ -p wa -k cron 2026-06-19 15:44:23.060321 | debian-bookworm | +-w /etc/crontab -p wa -k cron 2026-06-19 15:44:23.060432 | debian-bookworm | +-w /var/spool/cron/ -p wa -k cron 2026-06-19 15:44:23.060542 | debian-bookworm | + 2026-06-19 15:44:23.060654 | debian-bookworm | +## User, group, password databases 2026-06-19 15:44:23.060782 | debian-bookworm | +-w /etc/group -p wa -k etcgroup 2026-06-19 15:44:23.060895 | debian-bookworm | +-w /etc/passwd -p wa -k etcpasswd 2026-06-19 15:44:23.061022 | debian-bookworm | +-w /etc/gshadow -k etcgroup 2026-06-19 15:44:23.061134 | debian-bookworm | +-w /etc/shadow -k etcpasswd 2026-06-19 15:44:23.061279 | debian-bookworm | +-w /etc/security/opasswd -k opasswd 2026-06-19 15:44:23.061395 | debian-bookworm | + 2026-06-19 15:44:23.061507 | debian-bookworm | +## Sudoers file changes 2026-06-19 15:44:23.061621 | debian-bookworm | +-w /etc/sudoers -p wa -k actions 2026-06-19 15:44:23.061735 | debian-bookworm | +-w /etc/sudoers.d/ -p wa -k actions 2026-06-19 15:44:23.061864 | debian-bookworm | + 2026-06-19 15:44:23.061976 | debian-bookworm | +## Passwd 2026-06-19 15:44:23.062090 | debian-bookworm | +-w /usr/bin/passwd -p x -k passwd_modification 2026-06-19 15:44:23.062201 | debian-bookworm | + 2026-06-19 15:44:23.062344 | debian-bookworm | +## Tools to change group identifiers 2026-06-19 15:44:23.062465 | debian-bookworm | +-w /usr/sbin/groupadd -p x -k group_modification 2026-06-19 15:44:23.062579 | debian-bookworm | +-w /usr/sbin/groupmod -p x -k group_modification 2026-06-19 15:44:23.062692 | debian-bookworm | +-w /usr/sbin/addgroup -p x -k group_modification 2026-06-19 15:44:23.062840 | debian-bookworm | +-w /usr/sbin/useradd -p x -k user_modification 2026-06-19 15:44:23.062960 | debian-bookworm | +-w /usr/sbin/userdel -p x -k user_modification 2026-06-19 15:44:23.063072 | debian-bookworm | +-w /usr/sbin/usermod -p x -k user_modification 2026-06-19 15:44:23.063209 | debian-bookworm | +-w /usr/sbin/adduser -p x -k user_modification 2026-06-19 15:44:23.063327 | debian-bookworm | + 2026-06-19 15:44:23.063491 | debian-bookworm | +## Login configuration and information 2026-06-19 15:44:23.063608 | debian-bookworm | +-w /etc/login.defs -p wa -k login 2026-06-19 15:44:23.063722 | debian-bookworm | +-w /etc/securetty -p wa -k login 2026-06-19 15:44:23.063851 | debian-bookworm | +-w /var/log/faillog -p wa -k login 2026-06-19 15:44:23.063963 | debian-bookworm | +-w /var/log/lastlog -p wa -k login 2026-06-19 15:44:23.064075 | debian-bookworm | +-w /var/log/tallylog -p wa -k login 2026-06-19 15:44:23.064187 | debian-bookworm | + 2026-06-19 15:44:23.064300 | debian-bookworm | +## Network Environment 2026-06-19 15:44:23.064414 | debian-bookworm | +### Changes to hostname 2026-06-19 15:44:23.064566 | debian-bookworm | +-a always,exit -F arch=b64 -S sethostname -S setdomainname -k network_modifications 2026-06-19 15:44:23.064678 | debian-bookworm | + 2026-06-19 15:44:23.064807 | debian-bookworm | +### Detect Remote Shell Use 2026-06-19 15:44:23.064925 | debian-bookworm | +-a always,exit -F arch=b64 -F exe=/bin/bash -F success=1 -S connect -k "remote_shell" 2026-06-19 15:44:23.065042 | debian-bookworm | +-a always,exit -F arch=b64 -F exe=/usr/bin/bash -F success=1 -S connect -k "remote_shell" 2026-06-19 15:44:23.065153 | debian-bookworm | + 2026-06-19 15:44:23.065266 | debian-bookworm | +### Successful IPv4 Connections 2026-06-19 15:44:23.065389 | debian-bookworm | +-a always,exit -F arch=b64 -S connect -F a2=16 -F success=1 -F key=network_connect_4 2026-06-19 15:44:23.065508 | debian-bookworm | + 2026-06-19 15:44:23.065644 | debian-bookworm | +### Successful IPv6 Connections 2026-06-19 15:44:23.065771 | debian-bookworm | +-a always,exit -F arch=b64 -S connect -F a2=28 -F success=1 -F key=network_connect_6 2026-06-19 15:44:23.065883 | debian-bookworm | + 2026-06-19 15:44:23.065996 | debian-bookworm | +### Changes to other files 2026-06-19 15:44:23.066109 | debian-bookworm | +-w /etc/hosts -p wa -k network_modifications 2026-06-19 15:44:23.066223 | debian-bookworm | +-w /etc/sysconfig/network -p wa -k network_modifications 2026-06-19 15:44:23.066335 | debian-bookworm | +-w /etc/sysconfig/network-scripts -p w -k network_modifications 2026-06-19 15:44:23.066448 | debian-bookworm | +-w /etc/network/ -p wa -k network 2026-06-19 15:44:23.066563 | debian-bookworm | +-a always,exit -F dir=/etc/NetworkManager/ -F perm=wa -k network_modifications 2026-06-19 15:44:23.066783 | debian-bookworm | + 2026-06-19 15:44:23.066920 | debian-bookworm | +### Changes to issue 2026-06-19 15:44:23.067034 | debian-bookworm | +-w /etc/issue -p wa -k etcissue 2026-06-19 15:44:23.067144 | debian-bookworm | +-w /etc/issue.net -p wa -k etcissue 2026-06-19 15:44:23.067312 | debian-bookworm | + 2026-06-19 15:44:23.067436 | debian-bookworm | +## System startup scripts 2026-06-19 15:44:23.067550 | debian-bookworm | +-w /etc/inittab -p wa -k init 2026-06-19 15:44:23.067702 | debian-bookworm | +-w /etc/init.d/ -p wa -k init 2026-06-19 15:44:23.067836 | debian-bookworm | +-w /etc/init/ -p wa -k init 2026-06-19 15:44:23.067948 | debian-bookworm | + 2026-06-19 15:44:23.068061 | debian-bookworm | +## Library search paths 2026-06-19 15:44:23.068173 | debian-bookworm | +-w /etc/ld.so.conf -p wa -k libpath 2026-06-19 15:44:23.068285 | debian-bookworm | +-w /etc/ld.so.conf.d -p wa -k libpath 2026-06-19 15:44:23.068395 | debian-bookworm | + 2026-06-19 15:44:23.068510 | debian-bookworm | +## Systemwide library preloads (LD_PRELOAD) 2026-06-19 15:44:23.068625 | debian-bookworm | +-w /etc/ld.so.preload -p wa -k systemwide_preloads 2026-06-19 15:44:23.068780 | debian-bookworm | + 2026-06-19 15:44:23.068902 | debian-bookworm | +## Pam configuration 2026-06-19 15:44:23.069030 | debian-bookworm | +-w /etc/pam.d/ -p wa -k pam 2026-06-19 15:44:23.069143 | debian-bookworm | +-w /etc/security/limits.conf -p wa -k pam 2026-06-19 15:44:23.069257 | debian-bookworm | +-w /etc/security/limits.d -p wa -k pam 2026-06-19 15:44:23.069371 | debian-bookworm | +-w /etc/security/pam_env.conf -p wa -k pam 2026-06-19 15:44:23.069483 | debian-bookworm | +-w /etc/security/namespace.conf -p wa -k pam 2026-06-19 15:44:23.069597 | debian-bookworm | +-w /etc/security/namespace.d -p wa -k pam 2026-06-19 15:44:23.069710 | debian-bookworm | +-w /etc/security/namespace.init -p wa -k pam 2026-06-19 15:44:23.069868 | debian-bookworm | + 2026-06-19 15:44:23.069985 | debian-bookworm | +## Mail configuration 2026-06-19 15:44:23.070096 | debian-bookworm | +-w /etc/aliases -p wa -k mail 2026-06-19 15:44:23.070207 | debian-bookworm | +-w /etc/postfix/ -p wa -k mail 2026-06-19 15:44:23.070316 | debian-bookworm | +-w /etc/exim4/ -p wa -k mail 2026-06-19 15:44:23.070427 | debian-bookworm | + 2026-06-19 15:44:23.070539 | debian-bookworm | +## SSH configuration 2026-06-19 15:44:23.070652 | debian-bookworm | +-w /etc/ssh/sshd_config -k sshd 2026-06-19 15:44:23.070807 | debian-bookworm | +-w /etc/ssh/sshd_config.d -k sshd 2026-06-19 15:44:23.070954 | debian-bookworm | + 2026-06-19 15:44:23.071067 | debian-bookworm | +## root ssh key tampering 2026-06-19 15:44:23.071179 | debian-bookworm | +-w /root/.ssh -p wa -k rootkey 2026-06-19 15:44:23.071318 | debian-bookworm | + 2026-06-19 15:44:23.071431 | debian-bookworm | +# Systemd 2026-06-19 15:44:23.071543 | debian-bookworm | +-w /bin/systemctl -p x -k systemd 2026-06-19 15:44:23.071655 | debian-bookworm | +-w /etc/systemd/ -p wa -k systemd 2026-06-19 15:44:23.071784 | debian-bookworm | +-w /usr/lib/systemd -p wa -k systemd 2026-06-19 15:44:23.071895 | debian-bookworm | + 2026-06-19 15:44:23.072042 | debian-bookworm | +## https://systemd.network/systemd.generator.html 2026-06-19 15:44:23.072159 | debian-bookworm | +-w /etc/systemd/system-generators/ -p wa -k systemd_generator 2026-06-19 15:44:23.072272 | debian-bookworm | +-w /usr/local/lib/systemd/system-generators/ -p wa -k systemd_generator 2026-06-19 15:44:23.072385 | debian-bookworm | +-w /usr/lib/systemd/system-generators -p wa -k systemd_generator 2026-06-19 15:44:23.072495 | debian-bookworm | + 2026-06-19 15:44:23.072607 | debian-bookworm | +-w /etc/systemd/user-generators/ -p wa -k systemd_generator 2026-06-19 15:44:23.072719 | debian-bookworm | +-w /usr/local/lib/systemd/user-generators/ -p wa -k systemd_generator 2026-06-19 15:44:23.072846 | debian-bookworm | +-w /lib/systemd/system-generators/ -p wa -k systemd_generator 2026-06-19 15:44:23.072955 | debian-bookworm | + 2026-06-19 15:44:23.073105 | debian-bookworm | +## SELinux events that modify the system's Mandatory Access Controls (MAC) 2026-06-19 15:44:23.073228 | debian-bookworm | +-w /etc/selinux/ -p wa -k mac_policy 2026-06-19 15:44:23.073338 | debian-bookworm | + 2026-06-19 15:44:23.073453 | debian-bookworm | +## Critical elements access failures 2026-06-19 15:44:23.073568 | debian-bookworm | +-a always,exit -F arch=b64 -S open -F dir=/etc -F success=0 -k unauthedfileaccess 2026-06-19 15:44:23.073683 | debian-bookworm | +-a always,exit -F arch=b64 -S open -F dir=/bin -F success=0 -k unauthedfileaccess 2026-06-19 15:44:23.073833 | debian-bookworm | +-a always,exit -F arch=b64 -S open -F dir=/sbin -F success=0 -k unauthedfileaccess 2026-06-19 15:44:23.073959 | debian-bookworm | +-a always,exit -F arch=b64 -S open -F dir=/usr/bin -F success=0 -k unauthedfileaccess 2026-06-19 15:44:23.074074 | debian-bookworm | +-a always,exit -F arch=b64 -S open -F dir=/usr/sbin -F success=0 -k unauthedfileaccess 2026-06-19 15:44:23.074226 | debian-bookworm | +-a always,exit -F arch=b64 -S open -F dir=/var -F success=0 -k unauthedfileaccess 2026-06-19 15:44:23.074348 | debian-bookworm | +-a always,exit -F arch=b64 -S open -F dir=/home -F success=0 -k unauthedfileaccess 2026-06-19 15:44:23.074466 | debian-bookworm | +-a always,exit -F arch=b64 -S open -F dir=/srv -F success=0 -k unauthedfileaccess 2026-06-19 15:44:23.074575 | debian-bookworm | + 2026-06-19 15:44:23.074690 | debian-bookworm | +## Process ID change (switching accounts) applications 2026-06-19 15:44:23.074819 | debian-bookworm | +-w /bin/su -p x -k priv_esc 2026-06-19 15:44:23.074937 | debian-bookworm | +-w /usr/bin/sudo -p x -k priv_esc 2026-06-19 15:44:23.075049 | debian-bookworm | + 2026-06-19 15:44:23.075162 | debian-bookworm | +## Power state 2026-06-19 15:44:23.075346 | debian-bookworm | +-w /sbin/shutdown -p x -k power 2026-06-19 15:44:23.075460 | debian-bookworm | +-w /sbin/poweroff -p x -k power 2026-06-19 15:44:23.075569 | debian-bookworm | +-w /sbin/reboot -p x -k power 2026-06-19 15:44:23.075678 | debian-bookworm | +-w /sbin/halt -p x -k power 2026-06-19 15:44:23.075799 | debian-bookworm | + 2026-06-19 15:44:23.075914 | debian-bookworm | +## Session initiation information 2026-06-19 15:44:23.076026 | debian-bookworm | +-w /var/run/utmp -p wa -k session 2026-06-19 15:44:23.076144 | debian-bookworm | +-w /var/log/btmp -p wa -k session 2026-06-19 15:44:23.076300 | debian-bookworm | +-w /var/log/wtmp -p wa -k session 2026-06-19 15:44:23.076415 | debian-bookworm | + 2026-06-19 15:44:23.076534 | debian-bookworm | +## Discretionary Access Control (DAC) modifications 2026-06-19 15:44:23.076652 | debian-bookworm | +-a always,exit -F arch=b64 -S chmod -F auid>=1000 -F auid!=-1 -k perm_mod 2026-06-19 15:44:23.076780 | debian-bookworm | +-a always,exit -F arch=b64 -S chown -F auid>=1000 -F auid!=-1 -k perm_mod 2026-06-19 15:44:23.076898 | debian-bookworm | +-a always,exit -F arch=b64 -S fchmod -F auid>=1000 -F auid!=-1 -k perm_mod 2026-06-19 15:44:23.077014 | debian-bookworm | +-a always,exit -F arch=b64 -S fchmodat -F auid>=1000 -F auid!=-1 -k perm_mod 2026-06-19 15:44:23.077127 | debian-bookworm | +-a always,exit -F arch=b64 -S fchown -F auid>=1000 -F auid!=-1 -k perm_mod 2026-06-19 15:44:23.077241 | debian-bookworm | +-a always,exit -F arch=b64 -S fchownat -F auid>=1000 -F auid!=-1 -k perm_mod 2026-06-19 15:44:23.077388 | debian-bookworm | +-a always,exit -F arch=b64 -S fremovexattr -F auid>=1000 -F auid!=-1 -k perm_mod 2026-06-19 15:44:23.077507 | debian-bookworm | +-a always,exit -F arch=b64 -S fsetxattr -F auid>=1000 -F auid!=-1 -k perm_mod 2026-06-19 15:44:23.077620 | debian-bookworm | +-a always,exit -F arch=b64 -S lchown -F auid>=1000 -F auid!=-1 -k perm_mod 2026-06-19 15:44:23.077735 | debian-bookworm | +-a always,exit -F arch=b64 -S lremovexattr -F auid>=1000 -F auid!=-1 -k perm_mod 2026-06-19 15:44:23.077892 | debian-bookworm | +-a always,exit -F arch=b64 -S lsetxattr -F auid>=1000 -F auid!=-1 -k perm_mod 2026-06-19 15:44:23.078009 | debian-bookworm | +-a always,exit -F arch=b64 -S removexattr -F auid>=1000 -F auid!=-1 -k perm_mod 2026-06-19 15:44:23.078123 | debian-bookworm | +-a always,exit -F arch=b64 -S setxattr -F auid>=1000 -F auid!=-1 -k perm_mod 2026-06-19 15:44:23.078231 | debian-bookworm | + 2026-06-19 15:44:23.078344 | debian-bookworm | +# Special Rules --------------------------------------------------------------- 2026-06-19 15:44:23.078486 | debian-bookworm | + 2026-06-19 15:44:23.078600 | debian-bookworm | +## Reconnaissance 2026-06-19 15:44:23.078713 | debian-bookworm | +-w /usr/bin/whoami -p x -k recon 2026-06-19 15:44:23.078843 | debian-bookworm | +-w /usr/bin/id -p x -k recon 2026-06-19 15:44:23.078956 | debian-bookworm | +-w /bin/hostname -p x -k recon 2026-06-19 15:44:23.079069 | debian-bookworm | +-w /bin/uname -p x -k recon 2026-06-19 15:44:23.079207 | debian-bookworm | +-w /etc/issue -p r -k recon 2026-06-19 15:44:23.079328 | debian-bookworm | +-w /etc/hostname -p r -k recon 2026-06-19 15:44:23.079439 | debian-bookworm | + 2026-06-19 15:44:23.079585 | debian-bookworm | +## Suspicious activity 2026-06-19 15:44:23.079701 | debian-bookworm | +-w /usr/bin/wget -p x -k susp_activity 2026-06-19 15:44:23.079850 | debian-bookworm | +-w /usr/bin/curl -p x -k susp_activity 2026-06-19 15:44:23.079969 | debian-bookworm | +-w /usr/bin/base64 -p x -k susp_activity 2026-06-19 15:44:23.080083 | debian-bookworm | +-w /bin/nc -p x -k susp_activity 2026-06-19 15:44:23.080194 | debian-bookworm | +-w /bin/netcat -p x -k susp_activity 2026-06-19 15:44:23.080309 | debian-bookworm | +-w /usr/bin/ncat -p x -k susp_activity 2026-06-19 15:44:23.080422 | debian-bookworm | +-w /usr/bin/ss -p x -k susp_activity 2026-06-19 15:44:23.080552 | debian-bookworm | +-w /usr/bin/netstat -p x -k susp_activity 2026-06-19 15:44:23.080692 | debian-bookworm | +-w /usr/bin/ssh -p x -k susp_activity 2026-06-19 15:44:23.080822 | debian-bookworm | +-w /usr/bin/scp -p x -k susp_activity 2026-06-19 15:44:23.080937 | debian-bookworm | +-w /usr/bin/sftp -p x -k susp_activity 2026-06-19 15:44:23.081048 | debian-bookworm | +-w /usr/bin/ftp -p x -k susp_activity 2026-06-19 15:44:23.081163 | debian-bookworm | +-w /usr/bin/socat -p x -k susp_activity 2026-06-19 15:44:23.081274 | debian-bookworm | +-w /usr/bin/wireshark -p x -k susp_activity 2026-06-19 15:44:23.081385 | debian-bookworm | +-w /usr/bin/tshark -p x -k susp_activity 2026-06-19 15:44:23.081497 | debian-bookworm | +-w /usr/bin/rawshark -p x -k susp_activity 2026-06-19 15:44:23.081611 | debian-bookworm | +-w /usr/bin/rdesktop -p x -k susp_activity 2026-06-19 15:44:23.081770 | debian-bookworm | +-w /usr/local/bin/rdesktop -p x -k susp_activity 2026-06-19 15:44:23.081888 | debian-bookworm | +-w /usr/bin/wlfreerdp -p x -k susp_activity 2026-06-19 15:44:23.082005 | debian-bookworm | +-w /usr/bin/xfreerdp -p x -k susp_activity 2026-06-19 15:44:23.082119 | debian-bookworm | +-w /usr/local/bin/xfreerdp -p x -k susp_activity 2026-06-19 15:44:23.082233 | debian-bookworm | +-w /usr/bin/nmap -p x -k susp_activity 2026-06-19 15:44:23.082346 | debian-bookworm | + 2026-06-19 15:44:23.082458 | debian-bookworm | +## sssd 2026-06-19 15:44:23.082576 | debian-bookworm | +-a always,exit -F path=/usr/libexec/sssd/p11_child -F perm=x -F auid>=500 -F auid!=4294967295 -k T1078_Valid_Accounts 2026-06-19 15:44:23.082705 | debian-bookworm | +-a always,exit -F path=/usr/libexec/sssd/krb5_child -F perm=x -F auid>=500 -F auid!=4294967295 -k T1078_Valid_Accounts 2026-06-19 15:44:23.082892 | debian-bookworm | +-a always,exit -F path=/usr/libexec/sssd/ldap_child -F perm=x -F auid>=500 -F auid!=4294967295 -k T1078_Valid_Accounts 2026-06-19 15:44:23.083013 | debian-bookworm | +-a always,exit -F path=/usr/libexec/sssd/selinux_child -F perm=x -F auid>=500 -F auid!=4294967295 -k T1078_Valid_Accounts 2026-06-19 15:44:23.083130 | debian-bookworm | +-a always,exit -F path=/usr/libexec/sssd/proxy_child -F perm=x -F auid>=500 -F auid!=4294967295 -k T1078_Valid_Accounts 2026-06-19 15:44:23.083426 | debian-bookworm | + 2026-06-19 15:44:23.083550 | debian-bookworm | +## T1002 Data Compressed 2026-06-19 15:44:23.083662 | debian-bookworm | + 2026-06-19 15:44:23.083844 | debian-bookworm | +-w /usr/bin/zip -p x -k Data_Compressed 2026-06-19 15:44:23.083967 | debian-bookworm | +-w /usr/bin/gzip -p x -k Data_Compressed 2026-06-19 15:44:23.084083 | debian-bookworm | +-w /usr/bin/tar -p x -k Data_Compressed 2026-06-19 15:44:23.084195 | debian-bookworm | +-w /usr/bin/bzip2 -p x -k Data_Compressed 2026-06-19 15:44:23.084305 | debian-bookworm | + 2026-06-19 15:44:23.084419 | debian-bookworm | +-w /usr/bin/lzip -p x -k Data_Compressed 2026-06-19 15:44:23.084533 | debian-bookworm | +-w /usr/local/bin/lzip -p x -k Data_Compressed 2026-06-19 15:44:23.084642 | debian-bookworm | + 2026-06-19 15:44:23.084769 | debian-bookworm | +-w /usr/bin/lz4 -p x -k Data_Compressed 2026-06-19 15:44:23.084919 | debian-bookworm | +-w /usr/local/bin/lz4 -p x -k Data_Compressed 2026-06-19 15:44:23.085033 | debian-bookworm | + 2026-06-19 15:44:23.085152 | debian-bookworm | +-w /usr/bin/lzop -p x -k Data_Compressed 2026-06-19 15:44:23.085271 | debian-bookworm | +-w /usr/local/bin/lzop -p x -k Data_Compressed 2026-06-19 15:44:23.085385 | debian-bookworm | + 2026-06-19 15:44:23.085500 | debian-bookworm | +-w /usr/bin/plzip -p x -k Data_Compressed 2026-06-19 15:44:23.085612 | debian-bookworm | +-w /usr/local/bin/plzip -p x -k Data_Compressed 2026-06-19 15:44:23.085720 | debian-bookworm | + 2026-06-19 15:44:23.085872 | debian-bookworm | +-w /usr/bin/pbzip2 -p x -k Data_Compressed 2026-06-19 15:44:23.086027 | debian-bookworm | +-w /usr/local/bin/pbzip2 -p x -k Data_Compressed 2026-06-19 15:44:23.086142 | debian-bookworm | + 2026-06-19 15:44:23.086257 | debian-bookworm | +-w /usr/bin/lbzip2 -p x -k Data_Compressed 2026-06-19 15:44:23.086372 | debian-bookworm | +-w /usr/local/bin/lbzip2 -p x -k Data_Compressed 2026-06-19 15:44:23.086483 | debian-bookworm | + 2026-06-19 15:44:23.086595 | debian-bookworm | +-w /usr/bin/pixz -p x -k Data_Compressed 2026-06-19 15:44:23.086706 | debian-bookworm | +-w /usr/local/bin/pixz -p x -k Data_Compressed 2026-06-19 15:44:23.086840 | debian-bookworm | + 2026-06-19 15:44:23.086963 | debian-bookworm | +-w /usr/bin/pigz -p x -k Data_Compressed 2026-06-19 15:44:23.087107 | debian-bookworm | +-w /usr/local/bin/pigz -p x -k Data_Compressed 2026-06-19 15:44:23.087248 | debian-bookworm | +-w /usr/bin/unpigz -p x -k Data_Compressed 2026-06-19 15:44:23.087364 | debian-bookworm | +-w /usr/local/bin/unpigz -p x -k Data_Compressed 2026-06-19 15:44:23.087474 | debian-bookworm | + 2026-06-19 15:44:23.087587 | debian-bookworm | +-w /usr/bin/zstd -p x -k Data_Compressed 2026-06-19 15:44:23.087701 | debian-bookworm | +-w /usr/local/bin/zstd -p x -k Data_Compressed 2026-06-19 15:44:23.087825 | debian-bookworm | + 2026-06-19 15:44:23.087937 | debian-bookworm | +## Added to catch netcat on Ubuntu 2026-06-19 15:44:23.088051 | debian-bookworm | +-w /bin/nc.openbsd -p x -k susp_activity 2026-06-19 15:44:23.088196 | debian-bookworm | +-w /bin/nc.traditional -p x -k susp_activity 2026-06-19 15:44:23.088306 | debian-bookworm | + 2026-06-19 15:44:23.088418 | debian-bookworm | +## Sbin suspicious activity 2026-06-19 15:44:23.088530 | debian-bookworm | +-w /sbin/iptables -p x -k sbin_susp 2026-06-19 15:44:23.088642 | debian-bookworm | +-w /sbin/ip6tables -p x -k sbin_susp 2026-06-19 15:44:23.088784 | debian-bookworm | +-w /sbin/ifconfig -p x -k sbin_susp 2026-06-19 15:44:23.088901 | debian-bookworm | +-w /usr/sbin/arptables -p x -k sbin_susp 2026-06-19 15:44:23.089011 | debian-bookworm | +-w /usr/sbin/ebtables -p x -k sbin_susp 2026-06-19 15:44:23.089122 | debian-bookworm | +-w /sbin/xtables-nft-multi -p x -k sbin_susp 2026-06-19 15:44:23.089277 | debian-bookworm | +-w /usr/sbin/nft -p x -k sbin_susp 2026-06-19 15:44:23.089392 | debian-bookworm | +-w /usr/sbin/tcpdump -p x -k sbin_susp 2026-06-19 15:44:23.089506 | debian-bookworm | +-w /usr/sbin/traceroute -p x -k sbin_susp 2026-06-19 15:44:23.089616 | debian-bookworm | +-w /usr/sbin/ufw -p x -k sbin_susp 2026-06-19 15:44:23.089726 | debian-bookworm | + 2026-06-19 15:44:23.089856 | debian-bookworm | +### kde4 2026-06-19 15:44:23.089975 | debian-bookworm | +-a always,exit -F path=/usr/libexec/kde4/kpac_dhcp_helper -F perm=x -F auid>=1000 -F auid!=4294967295 -k T1078_Valid_Accounts 2026-06-19 15:44:23.090094 | debian-bookworm | +-a always,exit -F path=/usr/libexec/kde4/kdesud -F perm=x -F auid>=1000 -F auid!=4294967295 -k T1078_Valid_Accounts 2026-06-19 15:44:23.090204 | debian-bookworm | + 2026-06-19 15:44:23.090359 | debian-bookworm | +## dbus-send invocation 2026-06-19 15:44:23.090477 | debian-bookworm | +### may indicate privilege escalation CVE-2021-3560 2026-06-19 15:44:23.090590 | debian-bookworm | +-w /usr/bin/dbus-send -p x -k dbus_send 2026-06-19 15:44:23.090702 | debian-bookworm | +-w /usr/bin/gdbus -p x -k gdubs_call 2026-06-19 15:44:23.090826 | debian-bookworm | + 2026-06-19 15:44:23.090938 | debian-bookworm | +## pkexec invocation 2026-06-19 15:44:23.091053 | debian-bookworm | +### may indicate privilege escalation CVE-2021-4034 2026-06-19 15:44:23.091167 | debian-bookworm | +-w /usr/bin/pkexec -p x -k pkexec 2026-06-19 15:44:23.091309 | debian-bookworm | + 2026-06-19 15:44:23.091445 | debian-bookworm | +## Suspicious shells 2026-06-19 15:44:23.091565 | debian-bookworm | +-w /bin/ash -p x -k susp_shell 2026-06-19 15:44:23.091678 | debian-bookworm | +-w /bin/csh -p x -k susp_shell 2026-06-19 15:44:23.091806 | debian-bookworm | +-w /bin/fish -p x -k susp_shell 2026-06-19 15:44:23.091922 | debian-bookworm | +-w /bin/tcsh -p x -k susp_shell 2026-06-19 15:44:23.092035 | debian-bookworm | +-w /bin/tclsh -p x -k susp_shell 2026-06-19 15:44:23.092148 | debian-bookworm | +-w /bin/xonsh -p x -k susp_shell 2026-06-19 15:44:23.092260 | debian-bookworm | +-w /usr/local/bin/xonsh -p x -k susp_shell 2026-06-19 15:44:23.092373 | debian-bookworm | +-w /bin/open -p x -k susp_shell 2026-06-19 15:44:23.092515 | debian-bookworm | +-w /bin/rbash -p x -k susp_shell 2026-06-19 15:44:23.092624 | debian-bookworm | + 2026-06-19 15:44:23.092768 | debian-bookworm | +# Web Server Actvity 2026-06-19 15:44:23.092892 | debian-bookworm | +## Change the number "33" to the ID of your WebServer user. Default: www-data:x:33:33 2026-06-19 15:44:23.093006 | debian-bookworm | +-a always,exit -F arch=b64 -S execve -F euid=33 -k detect_execve_www 2026-06-19 15:44:23.093115 | debian-bookworm | + 2026-06-19 15:44:23.093225 | debian-bookworm | +### https://clustershell.readthedocs.io/ 2026-06-19 15:44:23.093334 | debian-bookworm | +-w /bin/clush -p x -k susp_shell 2026-06-19 15:44:23.093442 | debian-bookworm | +-w /usr/local/bin/clush -p x -k susp_shell 2026-06-19 15:44:23.093588 | debian-bookworm | +-w /etc/clustershell/clush.conf -p x -k susp_shell 2026-06-19 15:44:23.093700 | debian-bookworm | + 2026-06-19 15:44:23.093828 | debian-bookworm | +### https://github.com/tmux/tmux 2026-06-19 15:44:23.093942 | debian-bookworm | +-w /bin/tmux -p x -k susp_shell 2026-06-19 15:44:23.094054 | debian-bookworm | +-w /usr/local/bin/tmux -p x -k susp_shell 2026-06-19 15:44:23.094166 | debian-bookworm | + 2026-06-19 15:44:23.094278 | debian-bookworm | +## Shell/profile configurations 2026-06-19 15:44:23.094389 | debian-bookworm | +-w /etc/profile.d/ -p wa -k shell_profiles 2026-06-19 15:44:23.094507 | debian-bookworm | +-w /etc/profile -p wa -k shell_profiles 2026-06-19 15:44:23.094649 | debian-bookworm | +-w /etc/shells -p wa -k shell_profiles 2026-06-19 15:44:23.094794 | debian-bookworm | +-w /etc/bashrc -p wa -k shell_profiles 2026-06-19 15:44:23.094911 | debian-bookworm | +-w /etc/csh.cshrc -p wa -k shell_profiles 2026-06-19 15:44:23.095026 | debian-bookworm | +-w /etc/csh.login -p wa -k shell_profiles 2026-06-19 15:44:23.095248 | debian-bookworm | +-w /etc/fish/ -p wa -k shell_profiles 2026-06-19 15:44:23.095369 | debian-bookworm | +-w /etc/zsh/ -p wa -k shell_profiles 2026-06-19 15:44:23.095479 | debian-bookworm | + 2026-06-19 15:44:23.095590 | debian-bookworm | +### https://github.com/xxh/xxh 2026-06-19 15:44:23.095753 | debian-bookworm | +-w /usr/local/bin/xxh.bash -p x -k susp_shell 2026-06-19 15:44:23.095871 | debian-bookworm | +-w /usr/local/bin/xxh.xsh -p x -k susp_shell 2026-06-19 15:44:23.095985 | debian-bookworm | +-w /usr/local/bin/xxh.zsh -p x -k susp_shell 2026-06-19 15:44:23.096092 | debian-bookworm | + 2026-06-19 15:44:23.096204 | debian-bookworm | +## Injection 2026-06-19 15:44:23.096328 | debian-bookworm | +### These rules watch for code injection by the ptrace facility. 2026-06-19 15:44:23.096444 | debian-bookworm | +### This could indicate someone trying to do something bad or just debugging 2026-06-19 15:44:23.096559 | debian-bookworm | +-a always,exit -F arch=b64 -S ptrace -F a0=0x4 -k code_injection 2026-06-19 15:44:23.096685 | debian-bookworm | +-a always,exit -F arch=b64 -S ptrace -F a0=0x5 -k data_injection 2026-06-19 15:44:23.096842 | debian-bookworm | +-a always,exit -F arch=b64 -S ptrace -F a0=0x6 -k register_injection 2026-06-19 15:44:23.096959 | debian-bookworm | +-a always,exit -F arch=b64 -S ptrace -k tracing 2026-06-19 15:44:23.097067 | debian-bookworm | + 2026-06-19 15:44:23.097178 | debian-bookworm | +## Anonymous File Creation 2026-06-19 15:44:23.097290 | debian-bookworm | +### These rules watch the use of memfd_create 2026-06-19 15:44:23.097403 | debian-bookworm | +### "memfd_create" creates anonymous file and returns a file descriptor to access it 2026-06-19 15:44:23.097518 | debian-bookworm | +### When combined with "fexecve" can be used to stealthily run binaries in memory without touching disk 2026-06-19 15:44:23.097632 | debian-bookworm | +-a always,exit -F arch=b64 -S memfd_create -F key=anon_file_create 2026-06-19 15:44:23.097826 | debian-bookworm | + 2026-06-19 15:44:23.097950 | debian-bookworm | +## Privilege Abuse 2026-06-19 15:44:23.098066 | debian-bookworm | +### The purpose of this rule is to detect when an admin may be abusing power by looking in user's home dir. 2026-06-19 15:44:23.098183 | debian-bookworm | +-a always,exit -F dir=/home -F uid=0 -F auid>=1000 -F auid!=-1 -C auid!=obj_uid -k power_abuse 2026-06-19 15:44:23.098294 | debian-bookworm | + 2026-06-19 15:44:23.098405 | debian-bookworm | +# Socket Creations 2026-06-19 15:44:23.098518 | debian-bookworm | +# will catch both IPv4 and IPv6 2026-06-19 15:44:23.099052 | debian-bookworm | + 2026-06-19 15:44:23.099209 | debian-bookworm | +-a always,exit -F arch=b32 -S socket -F a0=2 -k network_socket_created 2026-06-19 15:44:23.099329 | debian-bookworm | +-a always,exit -F arch=b64 -S socket -F a0=2 -k network_socket_created 2026-06-19 15:44:23.099438 | debian-bookworm | + 2026-06-19 15:44:23.099551 | debian-bookworm | +-a always,exit -F arch=b32 -S socket -F a0=10 -k network_socket_created 2026-06-19 15:44:23.099666 | debian-bookworm | +-a always,exit -F arch=b64 -S socket -F a0=10 -k network_socket_created 2026-06-19 15:44:23.099953 | debian-bookworm | + 2026-06-19 15:44:23.100121 | debian-bookworm | +# Software Management --------------------------------------------------------- 2026-06-19 15:44:23.100234 | debian-bookworm | + 2026-06-19 15:44:23.100347 | debian-bookworm | +# RPM (Redhat/CentOS) 2026-06-19 15:44:23.100463 | debian-bookworm | +-w /usr/bin/rpm -p x -k software_mgmt 2026-06-19 15:44:23.100576 | debian-bookworm | +-w /usr/bin/yum -p x -k software_mgmt 2026-06-19 15:44:23.100686 | debian-bookworm | + 2026-06-19 15:44:23.100842 | debian-bookworm | +# DNF (Fedora/RedHat 8/CentOS 8) 2026-06-19 15:44:23.100961 | debian-bookworm | +-w /usr/bin/dnf -p x -k software_mgmt 2026-06-19 15:44:23.101107 | debian-bookworm | + 2026-06-19 15:44:23.101223 | debian-bookworm | +# YAST/Zypper/RPM (SuSE) 2026-06-19 15:44:23.101335 | debian-bookworm | +-w /sbin/yast -p x -k software_mgmt 2026-06-19 15:44:23.101447 | debian-bookworm | +-w /sbin/yast2 -p x -k software_mgmt 2026-06-19 15:44:23.101558 | debian-bookworm | +-w /bin/rpm -p x -k software_mgmt 2026-06-19 15:44:23.101672 | debian-bookworm | +-w /usr/bin/zypper -k software_mgmt 2026-06-19 15:44:23.101797 | debian-bookworm | + 2026-06-19 15:44:23.101911 | debian-bookworm | +# DPKG / APT-GET (Debian/Ubuntu) 2026-06-19 15:44:23.102031 | debian-bookworm | +-w /usr/bin/dpkg -p x -k software_mgmt 2026-06-19 15:44:23.102173 | debian-bookworm | +-w /usr/bin/apt -p x -k software_mgmt 2026-06-19 15:44:23.102291 | debian-bookworm | +-w /usr/bin/apt-add-repository -p x -k software_mgmt 2026-06-19 15:44:23.102402 | debian-bookworm | +-w /usr/bin/apt-get -p x -k software_mgmt 2026-06-19 15:44:23.102514 | debian-bookworm | +-w /usr/bin/aptitude -p x -k software_mgmt 2026-06-19 15:44:23.102626 | debian-bookworm | +-w /usr/bin/wajig -p x -k software_mgmt 2026-06-19 15:44:23.102748 | debian-bookworm | +-w /usr/bin/snap -p x -k software_mgmt 2026-06-19 15:44:23.102860 | debian-bookworm | + 2026-06-19 15:44:23.102972 | debian-bookworm | +# PIP(3) (Python installs) 2026-06-19 15:44:23.103086 | debian-bookworm | +-w /usr/bin/pip -p x -k third_party_software_mgmt 2026-06-19 15:44:23.103316 | debian-bookworm | +-w /usr/local/bin/pip -p x -k third_party_software_mgmt 2026-06-19 15:44:23.103443 | debian-bookworm | +-w /usr/bin/pip3 -p x -k third_party_software_mgmt 2026-06-19 15:44:23.103559 | debian-bookworm | +-w /usr/local/bin/pip3 -p x -k third_party_software_mgmt 2026-06-19 15:44:23.103677 | debian-bookworm | +-w /usr/bin/pipx -p x -k third_party_software_mgmt 2026-06-19 15:44:23.103827 | debian-bookworm | +-w /usr/local/bin/pipx -p x -k third_party_software_mgmt 2026-06-19 15:44:23.103940 | debian-bookworm | + 2026-06-19 15:44:23.104052 | debian-bookworm | +# npm 2026-06-19 15:44:23.104166 | debian-bookworm | +## T1072 third party software 2026-06-19 15:44:23.104277 | debian-bookworm | +## https://www.npmjs.com 2026-06-19 15:44:23.104391 | debian-bookworm | +## https://docs.npmjs.com/cli/v6/commands/npm-audit 2026-06-19 15:44:23.104508 | debian-bookworm | +-w /usr/bin/npm -p x -k third_party_software_mgmt 2026-06-19 15:44:23.104616 | debian-bookworm | + 2026-06-19 15:44:23.104729 | debian-bookworm | +# Comprehensive Perl Archive Network (CPAN) (CPAN installs) 2026-06-19 15:44:23.104859 | debian-bookworm | +## T1072 third party software 2026-06-19 15:44:23.104974 | debian-bookworm | +## https://www.cpan.org 2026-06-19 15:44:23.105095 | debian-bookworm | +-w /usr/bin/cpan -p x -k third_party_software_mgmt 2026-06-19 15:44:23.105208 | debian-bookworm | + 2026-06-19 15:44:23.105322 | debian-bookworm | +# Ruby (RubyGems installs) 2026-06-19 15:44:23.105435 | debian-bookworm | +## T1072 third party software 2026-06-19 15:44:23.105549 | debian-bookworm | +## https://rubygems.org 2026-06-19 15:44:23.105661 | debian-bookworm | +-w /usr/bin/gem -p x -k third_party_software_mgmt 2026-06-19 15:44:23.105784 | debian-bookworm | + 2026-06-19 15:44:23.105900 | debian-bookworm | +# LuaRocks (Lua installs) 2026-06-19 15:44:23.106012 | debian-bookworm | +## T1072 third party software 2026-06-19 15:44:23.106135 | debian-bookworm | +## https://luarocks.org 2026-06-19 15:44:23.106249 | debian-bookworm | +-w /usr/bin/luarocks -p x -k third_party_software_mgmt 2026-06-19 15:44:23.106360 | debian-bookworm | + 2026-06-19 15:44:23.106470 | debian-bookworm | +# Pacman (Arch Linux) 2026-06-19 15:44:23.106584 | debian-bookworm | +## https://wiki.archlinux.org/title/Pacman 2026-06-19 15:44:23.106699 | debian-bookworm | +## T1072 third party software 2026-06-19 15:44:23.106825 | debian-bookworm | +-w /etc/pacman.conf -p x -k third_party_software_mgmt 2026-06-19 15:44:23.106940 | debian-bookworm | +-w /etc/pacman.d -p x -k third_party_software_mgmt 2026-06-19 15:44:23.107051 | debian-bookworm | + 2026-06-19 15:44:23.107164 | debian-bookworm | +# Special Software ------------------------------------------------------------ 2026-06-19 15:44:23.107308 | debian-bookworm | + 2026-06-19 15:44:23.107424 | debian-bookworm | +## GDS specific secrets 2026-06-19 15:44:23.107537 | debian-bookworm | +-w /etc/puppet/ssl -p wa -k puppet_ssl 2026-06-19 15:44:23.107646 | debian-bookworm | + 2026-06-19 15:44:23.107794 | debian-bookworm | +## IBM Bigfix BESClient 2026-06-19 15:44:23.107920 | debian-bookworm | +-a always,exit -F arch=b64 -S open -F dir=/opt/BESClient -F success=0 -k soft_besclient 2026-06-19 15:44:23.108035 | debian-bookworm | +-w /var/opt/BESClient/ -p wa -k soft_besclient 2026-06-19 15:44:23.108145 | debian-bookworm | + 2026-06-19 15:44:23.108257 | debian-bookworm | +## CHEF https://www.chef.io/chef/ 2026-06-19 15:44:23.108368 | debian-bookworm | +-w /etc/chef -p wa -k soft_chef 2026-06-19 15:44:23.108477 | debian-bookworm | + 2026-06-19 15:44:23.108585 | debian-bookworm | +## Salt 2026-06-19 15:44:23.108697 | debian-bookworm | +## https://saltproject.io/ 2026-06-19 15:44:23.108827 | debian-bookworm | +## https://docs.saltproject.io/en/latest/ref/configuration/master.html 2026-06-19 15:44:23.108941 | debian-bookworm | +-w /etc/salt -p wa -k soft_salt 2026-06-19 15:44:23.109056 | debian-bookworm | +-w /usr/local/etc/salt -p wa -k soft_salt 2026-06-19 15:44:23.109166 | debian-bookworm | + 2026-06-19 15:44:23.109277 | debian-bookworm | +## Otter 2026-06-19 15:44:23.109389 | debian-bookworm | +## https://inedo.com/otter 2026-06-19 15:44:23.109501 | debian-bookworm | +-w /etc/otter -p wa -k soft_otter 2026-06-19 15:44:23.109610 | debian-bookworm | + 2026-06-19 15:44:23.109723 | debian-bookworm | +## T1081 Credentials In Files 2026-06-19 15:44:23.109848 | debian-bookworm | +-w /usr/bin/grep -p x -k string_search 2026-06-19 15:44:23.109964 | debian-bookworm | +-w /usr/bin/egrep -p x -k string_search 2026-06-19 15:44:23.110076 | debian-bookworm | +-w /usr/bin/ugrep -p x -k string_search 2026-06-19 15:44:23.110187 | debian-bookworm | +### macOS 2026-06-19 15:44:23.110299 | debian-bookworm | +-w /usr/local/bin/grep -p x -k string_search 2026-06-19 15:44:23.110413 | debian-bookworm | +-w /usr/local/bin/egrep -p x -k string_search 2026-06-19 15:44:23.110525 | debian-bookworm | +-w /usr/local/bin/ugrep -p x -k string_search 2026-06-19 15:44:23.110633 | debian-bookworm | + 2026-06-19 15:44:23.110756 | debian-bookworm | +### https://github.com/tmbinc/bgrep 2026-06-19 15:44:23.110874 | debian-bookworm | +-w /usr/bin/bgrep -p x -k string_search 2026-06-19 15:44:23.110984 | debian-bookworm | +### macOS 2026-06-19 15:44:23.111097 | debian-bookworm | +-w /usr/local/bin/bgrep -p x -k string_search 2026-06-19 15:44:23.111232 | debian-bookworm | + 2026-06-19 15:44:23.111354 | debian-bookworm | +### https://github.com/BurntSushi/ripgrep 2026-06-19 15:44:23.111468 | debian-bookworm | +-w /usr/bin/rg -p x -k string_search 2026-06-19 15:44:23.111582 | debian-bookworm | +### macOS 2026-06-19 15:44:23.111696 | debian-bookworm | +-w /usr/local/bin/rg -p x -k string_search 2026-06-19 15:44:23.111840 | debian-bookworm | + 2026-06-19 15:44:23.111956 | debian-bookworm | +### https://github.com/awgn/cgrep 2026-06-19 15:44:23.112065 | debian-bookworm | + 2026-06-19 15:44:23.112178 | debian-bookworm | +-w /usr/bin/cgrep -p x -k string_search 2026-06-19 15:44:23.112288 | debian-bookworm | +### macOS 2026-06-19 15:44:23.112401 | debian-bookworm | +-w /usr/local/bin/cgrep -p x -k string_search 2026-06-19 15:44:23.112511 | debian-bookworm | + 2026-06-19 15:44:23.112633 | debian-bookworm | +### https://github.com/jpr5/ngrep 2026-06-19 15:44:23.112759 | debian-bookworm | +-w /usr/bin/ngrep -p x -k string_search 2026-06-19 15:44:23.112873 | debian-bookworm | +### macOS 2026-06-19 15:44:23.112984 | debian-bookworm | +-w /usr/local/bin/ngrep -p x -k string_search 2026-06-19 15:44:23.113093 | debian-bookworm | + 2026-06-19 15:44:23.113206 | debian-bookworm | +### https://github.com/vrothberg/vgrep 2026-06-19 15:44:23.113317 | debian-bookworm | +-w /usr/bin/vgrep -p x -k string_search 2026-06-19 15:44:23.113426 | debian-bookworm | +### macOS 2026-06-19 15:44:23.113536 | debian-bookworm | +-w /usr/local/bin/vgrep -p x -k string_search 2026-06-19 15:44:23.113646 | debian-bookworm | + 2026-06-19 15:44:23.113777 | debian-bookworm | +### https://github.com/monochromegane/the_platinum_searcher 2026-06-19 15:44:23.113890 | debian-bookworm | +-w /usr/bin/pt -p x -k string_search 2026-06-19 15:44:23.114002 | debian-bookworm | +### macOS 2026-06-19 15:44:23.114125 | debian-bookworm | +-w /usr/local/bin/pt -p x -k string_search 2026-06-19 15:44:23.114233 | debian-bookworm | + 2026-06-19 15:44:23.114347 | debian-bookworm | +### https://github.com/gvansickle/ucg 2026-06-19 15:44:23.114458 | debian-bookworm | +-w /usr/bin/ucg -p x -k string_search 2026-06-19 15:44:23.114568 | debian-bookworm | +### macOS 2026-06-19 15:44:23.114682 | debian-bookworm | +-w /usr/local/bin/ucg -p x -k string_search 2026-06-19 15:44:23.114824 | debian-bookworm | + 2026-06-19 15:44:23.114943 | debian-bookworm | +### https://github.com/ggreer/the_silver_searcher 2026-06-19 15:44:23.115057 | debian-bookworm | +-w /usr/bin/ag -p x -k string_search 2026-06-19 15:44:23.115171 | debian-bookworm | +### macOS 2026-06-19 15:44:23.115326 | debian-bookworm | +-w /usr/local/bin/ag -p x -k string_search 2026-06-19 15:44:23.115441 | debian-bookworm | + 2026-06-19 15:44:23.115563 | debian-bookworm | +### https://github.com/beyondgrep/ack3 2026-06-19 15:44:23.115677 | debian-bookworm | +### https://beyondgrep.com 2026-06-19 15:44:23.115805 | debian-bookworm | +-w /usr/bin/ack -p x -k string_search 2026-06-19 15:44:23.115920 | debian-bookworm | +-w /usr/local/bin/ack -p x -k string_search 2026-06-19 15:44:23.116033 | debian-bookworm | +-w /usr/bin/semgrep -p x -k string_search 2026-06-19 15:44:23.116143 | debian-bookworm | +### macOS 2026-06-19 15:44:23.116255 | debian-bookworm | +-w /usr/local/bin/semgrep -p x -k string_search 2026-06-19 15:44:23.116366 | debian-bookworm | + 2026-06-19 15:44:23.116477 | debian-bookworm | +## Docker 2026-06-19 15:44:23.116589 | debian-bookworm | +-w /usr/bin/dockerd -k docker 2026-06-19 15:44:23.116701 | debian-bookworm | +-w /usr/bin/docker -k docker 2026-06-19 15:44:23.116827 | debian-bookworm | +-w /usr/bin/docker-containerd -k docker 2026-06-19 15:44:23.116940 | debian-bookworm | +-w /usr/bin/docker-runc -k docker 2026-06-19 15:44:23.117053 | debian-bookworm | +-w /var/lib/docker -p wa -k docker 2026-06-19 15:44:23.117163 | debian-bookworm | +-w /etc/docker -k docker 2026-06-19 15:44:23.117275 | debian-bookworm | +-w /etc/sysconfig/docker -k docker 2026-06-19 15:44:23.117389 | debian-bookworm | +-w /etc/sysconfig/docker-storage -k docker 2026-06-19 15:44:23.117503 | debian-bookworm | +-w /usr/lib/systemd/system/docker.service -k docker 2026-06-19 15:44:23.117616 | debian-bookworm | +-w /usr/lib/systemd/system/docker.socket -k docker 2026-06-19 15:44:23.117727 | debian-bookworm | + 2026-06-19 15:44:23.117855 | debian-bookworm | +## Virtualization stuff 2026-06-19 15:44:23.117970 | debian-bookworm | +-w /usr/bin/qemu-system-x86_64 -p x -k qemu-system-x86_64 2026-06-19 15:44:23.118082 | debian-bookworm | +-w /usr/bin/qemu-img -p x -k qemu-img 2026-06-19 15:44:23.118193 | debian-bookworm | +-w /usr/bin/qemu-kvm -p x -k qemu-kvm 2026-06-19 15:44:23.118304 | debian-bookworm | +-w /usr/bin/qemu -p x -k qemu 2026-06-19 15:44:23.118417 | debian-bookworm | +-w /usr/bin/virtualbox -p x -k virtualbox 2026-06-19 15:44:23.118530 | debian-bookworm | +-w /usr/bin/virt-manager -p x -k virt-manager 2026-06-19 15:44:23.118640 | debian-bookworm | +-w /usr/bin/VBoxManage -p x -k VBoxManage 2026-06-19 15:44:23.118778 | debian-bookworm | + 2026-06-19 15:44:23.118900 | debian-bookworm | +#### VirtualBox on macOS 2026-06-19 15:44:23.119011 | debian-bookworm | + 2026-06-19 15:44:23.119125 | debian-bookworm | +-w /usr/local/bin/VirtualBox -p x -k virt_tool 2026-06-19 15:44:23.119261 | debian-bookworm | +-w /usr/local/bin/VirtualBoxVM -p x -k virt_tool 2026-06-19 15:44:23.119376 | debian-bookworm | +-w /usr/local/bin/VBoxManage -p x -k virt_tool 2026-06-19 15:44:23.119490 | debian-bookworm | +-w /usr/local/bin/VBoxVRDP -p x -k virt_tool 2026-06-19 15:44:23.119603 | debian-bookworm | +-w /usr/local/bin/VBoxHeadless -p x -k virt_tool 2026-06-19 15:44:23.119714 | debian-bookworm | +-w /usr/local/bin/vboxwebsrv -p x -k virt_tool 2026-06-19 15:44:23.119840 | debian-bookworm | +-w /usr/local/bin/VBoxBugReport -p x -k virt_tool 2026-06-19 15:44:23.119953 | debian-bookworm | +-w /usr/local/bin/VBoxBalloonCtrl -p x -k virt_tool 2026-06-19 15:44:23.120064 | debian-bookworm | +-w /usr/local/bin/VBoxAutostart -p x -k virt_tool 2026-06-19 15:44:23.120179 | debian-bookworm | +-w /usr/local/bin/VBoxDTrace -p x -k virt_tool 2026-06-19 15:44:23.120293 | debian-bookworm | +-w /usr/local/bin/vbox-img -p x -k virt_tool 2026-06-19 15:44:23.120410 | debian-bookworm | +-w /Library/LaunchDaemons/org.virtualbox.startup.plist -p x -k virt_tool 2026-06-19 15:44:23.120525 | debian-bookworm | +-w /Library/Application Support/VirtualBox/LaunchDaemons/ -p x -k virt_tool 2026-06-19 15:44:23.120638 | debian-bookworm | +-w /Library/Application Support/VirtualBox/VBoxDrv.kext/ -p x -k virt_tool 2026-06-19 15:44:23.120778 | debian-bookworm | +-w /Library/Application Support/VirtualBox/VBoxUSB.kext/ -p x -k virt_tool 2026-06-19 15:44:23.120896 | debian-bookworm | +-w /Library/Application Support/VirtualBox/VBoxNetFlt.kext/ -p x -k virt_tool 2026-06-19 15:44:23.121017 | debian-bookworm | +-w /Library/Application Support/VirtualBox/VBoxNetAdp.kext/ -p x -k virt_tool 2026-06-19 15:44:23.121129 | debian-bookworm | + 2026-06-19 15:44:23.121252 | debian-bookworm | +### Parallels Desktop on macOS 2026-06-19 15:44:23.121362 | debian-bookworm | + 2026-06-19 15:44:23.121476 | debian-bookworm | +-w /usr/local/bin/prl_convert -p x -k virt_tool 2026-06-19 15:44:23.121589 | debian-bookworm | +-w /usr/local/bin/prl_disk_tool -p x -k virt_tool 2026-06-19 15:44:23.121705 | debian-bookworm | +-w /usr/local/bin/prl_perf_ctl -p x -k virt_tool 2026-06-19 15:44:23.121835 | debian-bookworm | +-w /usr/local/bin/prlcore2dmp -p x -k virt_tool 2026-06-19 15:44:23.121949 | debian-bookworm | +-w /usr/local/bin/prlctl -p x -k virt_tool 2026-06-19 15:44:23.122060 | debian-bookworm | +-w /usr/local/bin/prlexec -p x -k virt_tool 2026-06-19 15:44:23.122177 | debian-bookworm | +-w /usr/local/bin/prlsrvctl -p x -k virt_tool 2026-06-19 15:44:23.122292 | debian-bookworm | +-w /Library/Preferences/Parallels -p x -k virt_tool 2026-06-19 15:44:23.122401 | debian-bookworm | + 2026-06-19 15:44:23.122511 | debian-bookworm | +### qemu on macOS 2026-06-19 15:44:23.122620 | debian-bookworm | + 2026-06-19 15:44:23.122731 | debian-bookworm | +-w /usr/local/bin/qemu-edid -p x -k virt_tool 2026-06-19 15:44:23.122857 | debian-bookworm | +-w /usr/local/bin/qemu-img -p x -k virt_tool 2026-06-19 15:44:23.122973 | debian-bookworm | +-w /usr/local/bin/qemu-io -p x -k virt_tool 2026-06-19 15:44:23.123086 | debian-bookworm | +-w /usr/local/bin/qemu-nbd -p x -k virt_tool 2026-06-19 15:44:23.123224 | debian-bookworm | +-w /usr/local/bin/qemu-system-x86_64 -p x -k virt_tool 2026-06-19 15:44:23.123336 | debian-bookworm | + 2026-06-19 15:44:23.123448 | debian-bookworm | +## Kubelet 2026-06-19 15:44:23.123561 | debian-bookworm | +-w /usr/bin/kubelet -k kubelet 2026-06-19 15:44:23.123670 | debian-bookworm | + 2026-06-19 15:44:23.123813 | debian-bookworm | +# ipc system call 2026-06-19 15:44:23.123929 | debian-bookworm | +# /usr/include/linux/ipc.h 2026-06-19 15:44:23.124040 | debian-bookworm | + 2026-06-19 15:44:23.124151 | debian-bookworm | +## msgctl 2026-06-19 15:44:23.124267 | debian-bookworm | +#-a always,exit -S ipc -F a0=14 -k Inter-Process_Communication 2026-06-19 15:44:23.124379 | debian-bookworm | +## msgget 2026-06-19 15:44:23.124493 | debian-bookworm | +#-a always,exit -S ipc -F a0=13 -k Inter-Process_Communication 2026-06-19 15:44:23.124606 | debian-bookworm | +## Use these lines on x86_64, ia64 instead 2026-06-19 15:44:23.124722 | debian-bookworm | +-a always,exit -F arch=b64 -S msgctl -k Inter-Process_Communication 2026-06-19 15:44:23.124852 | debian-bookworm | +-a always,exit -F arch=b64 -S msgget -k Inter-Process_Communication 2026-06-19 15:44:23.124960 | debian-bookworm | + 2026-06-19 15:44:23.125072 | debian-bookworm | +## semctl 2026-06-19 15:44:23.125191 | debian-bookworm | +#-a always,exit -S ipc -F a0=3 -k Inter-Process_Communication 2026-06-19 15:44:23.125304 | debian-bookworm | +## semget 2026-06-19 15:44:23.125417 | debian-bookworm | +#-a always,exit -S ipc -F a0=2 -k Inter-Process_Communication 2026-06-19 15:44:23.125527 | debian-bookworm | +## semop 2026-06-19 15:44:23.125639 | debian-bookworm | +#-a always,exit -S ipc -F a0=1 -k Inter-Process_Communication 2026-06-19 15:44:23.125761 | debian-bookworm | +## semtimedop 2026-06-19 15:44:23.125873 | debian-bookworm | +#-a always,exit -S ipc -F a0=4 -k Inter-Process_Communication 2026-06-19 15:44:23.125984 | debian-bookworm | +## Use these lines on x86_64, ia64 instead 2026-06-19 15:44:23.126096 | debian-bookworm | +-a always,exit -F arch=b64 -S semctl -k Inter-Process_Communication 2026-06-19 15:44:23.126210 | debian-bookworm | +-a always,exit -F arch=b64 -S semget -k Inter-Process_Communication 2026-06-19 15:44:23.126323 | debian-bookworm | +-a always,exit -F arch=b64 -S semop -k Inter-Process_Communication 2026-06-19 15:44:23.126435 | debian-bookworm | +-a always,exit -F arch=b64 -S semtimedop -k Inter-Process_Communication 2026-06-19 15:44:23.126543 | debian-bookworm | + 2026-06-19 15:44:23.126653 | debian-bookworm | +## shmctl 2026-06-19 15:44:23.126797 | debian-bookworm | +#-a always,exit -S ipc -F a0=24 -k Inter-Process_Communication 2026-06-19 15:44:23.126912 | debian-bookworm | +## shmget 2026-06-19 15:44:23.127024 | debian-bookworm | +#-a always,exit -S ipc -F a0=23 -k Inter-Process_Communication 2026-06-19 15:44:23.127137 | debian-bookworm | +## Use these lines on x86_64, ia64 instead 2026-06-19 15:44:23.127269 | debian-bookworm | +-a always,exit -F arch=b64 -S shmctl -k Inter-Process_Communication 2026-06-19 15:44:23.127384 | debian-bookworm | +-a always,exit -F arch=b64 -S shmget -k Inter-Process_Communication 2026-06-19 15:44:23.127492 | debian-bookworm | + 2026-06-19 15:44:23.127603 | debian-bookworm | +# High Volume Events ---------------------------------------------------------- 2026-06-19 15:44:23.127711 | debian-bookworm | + 2026-06-19 15:44:23.127836 | debian-bookworm | +## Disable these rules if they create too many events in your environment 2026-06-19 15:44:23.127945 | debian-bookworm | + 2026-06-19 15:44:23.128093 | debian-bookworm | +## Common Shells 2026-06-19 15:44:23.128212 | debian-bookworm | +-w /bin/bash -p x -k susp_shell 2026-06-19 15:44:23.128326 | debian-bookworm | +-w /bin/dash -p x -k susp_shell 2026-06-19 15:44:23.128452 | debian-bookworm | +-w /bin/busybox -p x -k susp_shell 2026-06-19 15:44:23.128564 | debian-bookworm | +-w /bin/zsh -p x -k susp_shell 2026-06-19 15:44:23.128679 | debian-bookworm | +-w /bin/sh -p x -k susp_shell 2026-06-19 15:44:23.128810 | debian-bookworm | +-w /bin/ksh -p x -k susp_shell 2026-06-19 15:44:23.128921 | debian-bookworm | + 2026-06-19 15:44:23.129032 | debian-bookworm | +## Root command executions 2026-06-19 15:44:23.129147 | debian-bookworm | +-a always,exit -F arch=b64 -F euid=0 -F auid>=1000 -F auid!=-1 -S execve -k rootcmd 2026-06-19 15:44:23.129256 | debian-bookworm | + 2026-06-19 15:44:23.129371 | debian-bookworm | +## File Deletion Events by User 2026-06-19 15:44:23.129487 | debian-bookworm | +-a always,exit -F arch=b64 -S rmdir -S unlink -S unlinkat -S rename -S renameat -F auid>=1000 -F auid!=-1 -k delete 2026-06-19 15:44:23.129598 | debian-bookworm | + 2026-06-19 15:44:23.129712 | debian-bookworm | +## File Access 2026-06-19 15:44:23.129859 | debian-bookworm | +### Unauthorized Access (unsuccessful) 2026-06-19 15:44:23.129983 | debian-bookworm | +-a always,exit -F arch=b64 -S creat -S open -S openat -S open_by_handle_at -S truncate -S ftruncate -F exit=-EACCES -F auid>=1000 -F auid!=-1 -k file_access 2026-06-19 15:44:23.130103 | debian-bookworm | +-a always,exit -F arch=b64 -S creat -S open -S openat -S open_by_handle_at -S truncate -S ftruncate -F exit=-EPERM -F auid>=1000 -F auid!=-1 -k file_access 2026-06-19 15:44:23.130216 | debian-bookworm | + 2026-06-19 15:44:23.130327 | debian-bookworm | +### Unsuccessful Creation 2026-06-19 15:44:23.130442 | debian-bookworm | +-a always,exit -F arch=b64 -S mkdir,creat,link,symlink,mknod,mknodat,linkat,symlinkat -F exit=-EACCES -k file_creation 2026-06-19 15:44:23.130561 | debian-bookworm | +-a always,exit -F arch=b64 -S mkdir,link,symlink,mkdirat -F exit=-EPERM -k file_creation 2026-06-19 15:44:23.130672 | debian-bookworm | + 2026-06-19 15:44:23.130800 | debian-bookworm | +### Unsuccessful Modification 2026-06-19 15:44:23.130919 | debian-bookworm | +-a always,exit -F arch=b64 -S rename -S renameat -S truncate -S chmod -S setxattr -S lsetxattr -S removexattr -S lremovexattr -F exit=-EACCES -k file_modification 2026-06-19 15:44:23.131037 | debian-bookworm | +-a always,exit -F arch=b64 -S rename -S renameat -S truncate -S chmod -S setxattr -S lsetxattr -S removexattr -S lremovexattr -F exit=-EPERM -k file_modification 2026-06-19 15:44:23.131147 | debian-bookworm | + 2026-06-19 15:44:23.131289 | debian-bookworm | +## 32bit API Exploitation 2026-06-19 15:44:23.131406 | debian-bookworm | +### If you are on a 64 bit platform, everything _should_ be running 2026-06-19 15:44:23.131523 | debian-bookworm | +### in 64 bit mode. This rule will detect any use of the 32 bit syscalls 2026-06-19 15:44:23.131638 | debian-bookworm | +### because this might be a sign of someone exploiting a hole in the 32 2026-06-19 15:44:23.131763 | debian-bookworm | +### bit API. 2026-06-19 15:44:23.131881 | debian-bookworm | +-a always,exit -F arch=b32 -S all -k 32bit_api 2026-06-19 15:44:23.131990 | debian-bookworm | + 2026-06-19 15:44:23.132103 | debian-bookworm | +# Make The Configuration Immutable -------------------------------------------- 2026-06-19 15:44:23.132212 | debian-bookworm | + 2026-06-19 15:44:23.132324 | debian-bookworm | +##-e 2 2026-06-19 15:44:23.132432 | debian-bookworm | 2026-06-19 15:44:23.132696 | debian-bookworm | changed: [molecule-auditd] => (item=20-neo23x0.rules) => {"ansible_loop_var": "item", "changed": true, "checksum": "9f99ce5c4f891fbf3e2bce06ed4cb97fb9e01f41", "dest": "/etc/audit/rules.d/20-neo23x0.rules", "gid": 0, "group": "root", "item": "20-neo23x0.rules", "md5sum": "6ac57206fd77de34805c3f4d50ef8b1d", "mode": "0644", "owner": "root", "size": 27367, "src": "/home/zuul/.ansible/tmp/ansible-tmp-1781883861.9406307-2652-174896913532230/.source.rules", "state": "file", "uid": 0} 2026-06-19 15:44:23.132826 | debian-bookworm | 2026-06-19 15:44:23.132945 | debian-bookworm | TASK [auditd : Manage auditd service] ****************************************** 2026-06-19 15:44:23.876917 | ubuntu-noble | --- before 2026-06-19 15:44:23.877237 | ubuntu-noble | +++ after: /home/zuul/.ansible/tmp/ansible-local-2047j12v2xwe/tmpbhmz0e6q/20-neo23x0.rules.j2 2026-06-19 15:44:23.877518 | ubuntu-noble | @@ -0,0 +1,750 @@ 2026-06-19 15:44:23.877742 | ubuntu-noble | +# ___ ___ __ __ 2026-06-19 15:44:23.877956 | ubuntu-noble | +# / | __ ______/ (_) /_____/ / 2026-06-19 15:44:23.878157 | ubuntu-noble | +# / /| |/ / / / __ / / __/ __ / 2026-06-19 15:44:23.878377 | ubuntu-noble | +# / ___ / /_/ / /_/ / / /_/ /_/ / 2026-06-19 15:44:23.878603 | ubuntu-noble | +# /_/ |_\__,_/\__,_/_/\__/\__,_/ 2026-06-19 15:44:23.878802 | ubuntu-noble | +# 2026-06-19 15:44:23.879017 | ubuntu-noble | +# Linux Audit Daemon - Best Practice Configuration 2026-06-19 15:44:23.879221 | ubuntu-noble | +# /etc/audit/audit.rules 2026-06-19 15:44:23.879451 | ubuntu-noble | +# 2026-06-19 15:44:23.880343 | ubuntu-noble | +# Compiled by Florian Roth 2026-06-19 15:44:23.880362 | ubuntu-noble | +# 2026-06-19 15:44:23.880368 | ubuntu-noble | +# Created : 2017/12/05 2026-06-19 15:44:23.880374 | ubuntu-noble | +# Modified : 2023/01/25 2026-06-19 15:44:23.880380 | ubuntu-noble | +# 2026-06-19 15:44:23.880579 | ubuntu-noble | +# Based on rules published here: 2026-06-19 15:44:23.880767 | ubuntu-noble | +# Gov.uk auditd rules 2026-06-19 15:44:23.881194 | ubuntu-noble | +# https://github.com/gds-operations/puppet-auditd/pull/1 2026-06-19 15:44:23.881547 | ubuntu-noble | +# CentOS 7 hardening 2026-06-19 15:44:23.881854 | ubuntu-noble | +# https://highon.coffee/blog/security-harden-centos-7/#auditd---audit-daemon 2026-06-19 15:44:23.882112 | ubuntu-noble | +# Linux audit repo 2026-06-19 15:44:23.882434 | ubuntu-noble | +# https://github.com/linux-audit/audit-userspace/tree/master/rules 2026-06-19 15:44:23.882725 | ubuntu-noble | +# Auditd high performance linux auditing 2026-06-19 15:44:23.883002 | ubuntu-noble | +# https://linux-audit.com/tuning-auditd-high-performance-linux-auditing/ 2026-06-19 15:44:23.883189 | ubuntu-noble | +# 2026-06-19 15:44:23.883441 | ubuntu-noble | +# Further rules 2026-06-19 15:44:23.883851 | ubuntu-noble | +# For PCI DSS compliance see: 2026-06-19 15:44:23.884116 | ubuntu-noble | +# https://github.com/linux-audit/audit-userspace/blob/master/rules/30-pci-dss-v31.rules 2026-06-19 15:44:23.884368 | ubuntu-noble | +# For NISPOM compliance see: 2026-06-19 15:44:23.884646 | ubuntu-noble | +# https://github.com/linux-audit/audit-userspace/blob/master/rules/30-nispom.rules 2026-06-19 15:44:23.884814 | ubuntu-noble | + 2026-06-19 15:44:23.884987 | ubuntu-noble | +# Remove any existing rules 2026-06-19 15:44:23.885149 | ubuntu-noble | +-D 2026-06-19 15:44:23.885312 | ubuntu-noble | + 2026-06-19 15:44:23.885554 | ubuntu-noble | +# Buffer Size 2026-06-19 15:44:23.885730 | ubuntu-noble | +## Feel free to increase this if the machine panic's 2026-06-19 15:44:23.885895 | ubuntu-noble | +-b 8192 2026-06-19 15:44:23.887340 | ubuntu-noble | + 2026-06-19 15:44:23.887357 | ubuntu-noble | +# Failure Mode 2026-06-19 15:44:23.887363 | ubuntu-noble | +## Possible values: 0 (silent), 1 (printk, print a failure message), 2 (panic, halt the system) 2026-06-19 15:44:23.887368 | ubuntu-noble | +-f 1 2026-06-19 15:44:23.887373 | ubuntu-noble | + 2026-06-19 15:44:23.887379 | ubuntu-noble | +# Ignore errors 2026-06-19 15:44:23.887384 | ubuntu-noble | +## e.g. caused by users or files not found in the local environment 2026-06-19 15:44:23.887389 | ubuntu-noble | +-i 2026-06-19 15:44:23.887394 | ubuntu-noble | + 2026-06-19 15:44:23.887399 | ubuntu-noble | +# Self Auditing --------------------------------------------------------------- 2026-06-19 15:44:23.887561 | ubuntu-noble | + 2026-06-19 15:44:23.887730 | ubuntu-noble | +## Audit the audit logs 2026-06-19 15:44:23.887900 | ubuntu-noble | +### Successful and unsuccessful attempts to read information from the audit records 2026-06-19 15:44:23.888065 | ubuntu-noble | +-w /var/log/audit/ -p wra -k auditlog 2026-06-19 15:44:23.888230 | ubuntu-noble | +-w /var/audit/ -p wra -k auditlog 2026-06-19 15:44:23.888416 | ubuntu-noble | + 2026-06-19 15:44:23.888602 | ubuntu-noble | +## Auditd configuration 2026-06-19 15:44:23.888772 | ubuntu-noble | +### Modifications to audit configuration that occur while the audit collection functions are operating 2026-06-19 15:44:23.888940 | ubuntu-noble | +-w /etc/audit/ -p wa -k auditconfig 2026-06-19 15:44:23.889110 | ubuntu-noble | +-w /etc/libaudit.conf -p wa -k auditconfig 2026-06-19 15:44:23.889275 | ubuntu-noble | +-w /etc/audisp/ -p wa -k audispconfig 2026-06-19 15:44:23.889451 | ubuntu-noble | + 2026-06-19 15:44:23.889643 | ubuntu-noble | +## Monitor for use of audit management tools 2026-06-19 15:44:23.889813 | ubuntu-noble | +-w /sbin/auditctl -p x -k audittools 2026-06-19 15:44:23.889976 | ubuntu-noble | +-w /sbin/auditd -p x -k audittools 2026-06-19 15:44:23.890143 | ubuntu-noble | +-w /usr/sbin/auditd -p x -k audittools 2026-06-19 15:44:23.890307 | ubuntu-noble | +-w /usr/sbin/augenrules -p x -k audittools 2026-06-19 15:44:23.890520 | ubuntu-noble | + 2026-06-19 15:44:23.890696 | ubuntu-noble | +## Access to all audit trails 2026-06-19 15:44:23.890851 | ubuntu-noble | + 2026-06-19 15:44:23.891023 | ubuntu-noble | +-a always,exit -F path=/usr/sbin/ausearch -F perm=x -k audittools 2026-06-19 15:44:23.891193 | ubuntu-noble | +-a always,exit -F path=/usr/sbin/aureport -F perm=x -k audittools 2026-06-19 15:44:23.891389 | ubuntu-noble | +-a always,exit -F path=/usr/sbin/aulast -F perm=x -k audittools 2026-06-19 15:44:23.891603 | ubuntu-noble | +-a always,exit -F path=/usr/sbin/aulastlogin -F perm=x -k audittools 2026-06-19 15:44:23.891777 | ubuntu-noble | +-a always,exit -F path=/usr/sbin/auvirt -F perm=x -k audittools 2026-06-19 15:44:23.891931 | ubuntu-noble | + 2026-06-19 15:44:23.892091 | ubuntu-noble | +# Filters --------------------------------------------------------------------- 2026-06-19 15:44:23.892247 | ubuntu-noble | + 2026-06-19 15:44:23.892432 | ubuntu-noble | +### We put these early because audit is a first match wins system. 2026-06-19 15:44:23.892603 | ubuntu-noble | + 2026-06-19 15:44:23.892768 | ubuntu-noble | +## Ignore SELinux AVC records 2026-06-19 15:44:23.892931 | ubuntu-noble | +-a always,exclude -F msgtype=AVC 2026-06-19 15:44:23.893083 | ubuntu-noble | + 2026-06-19 15:44:23.893250 | ubuntu-noble | +## Ignore current working directory records 2026-06-19 15:44:23.893433 | ubuntu-noble | +-a always,exclude -F msgtype=CWD 2026-06-19 15:44:23.893650 | ubuntu-noble | + 2026-06-19 15:44:23.893826 | ubuntu-noble | +## Cron jobs fill the logs with stuff we normally don't want (works with SELinux) 2026-06-19 15:44:23.894010 | ubuntu-noble | +-a never,user -F subj_type=crond_t 2026-06-19 15:44:23.894177 | ubuntu-noble | +-a never,exit -F subj_type=crond_t 2026-06-19 15:44:23.894351 | ubuntu-noble | + 2026-06-19 15:44:23.894537 | ubuntu-noble | +## This prevents chrony from overwhelming the logs 2026-06-19 15:44:23.894715 | ubuntu-noble | +-a never,exit -F arch=b64 -S adjtimex -F auid=-1 -F uid=chrony -F subj_type=chronyd_t 2026-06-19 15:44:23.894871 | ubuntu-noble | + 2026-06-19 15:44:23.895039 | ubuntu-noble | +## This is not very interesting and wastes a lot of space if the server is public facing 2026-06-19 15:44:23.895213 | ubuntu-noble | +-a always,exclude -F msgtype=CRYPTO_KEY_USER 2026-06-19 15:44:23.895384 | ubuntu-noble | + 2026-06-19 15:44:23.895568 | ubuntu-noble | +## Open VM Tools 2026-06-19 15:44:23.895740 | ubuntu-noble | +-a exit,never -F arch=b64 -S all -F exe=/usr/bin/vmtoolsd 2026-06-19 15:44:23.895894 | ubuntu-noble | + 2026-06-19 15:44:23.896062 | ubuntu-noble | +## High Volume Event Filter (especially on Linux Workstations) 2026-06-19 15:44:23.896227 | ubuntu-noble | +-a never,exit -F arch=b64 -F dir=/dev/shm -k sharedmemaccess 2026-06-19 15:44:23.896410 | ubuntu-noble | +-a never,exit -F arch=b64 -F dir=/var/lock/lvm -k locklvm 2026-06-19 15:44:23.896581 | ubuntu-noble | + 2026-06-19 15:44:23.896742 | ubuntu-noble | +## FileBeat 2026-06-19 15:44:23.896909 | ubuntu-noble | +-a never,exit -F arch=b64 -F path=/opt/filebeat -k filebeat 2026-06-19 15:44:23.897064 | ubuntu-noble | + 2026-06-19 15:44:23.897225 | ubuntu-noble | +## More information on how to filter events 2026-06-19 15:44:23.898340 | ubuntu-noble | +### https://access.redhat.com/solutions/2482221 2026-06-19 15:44:23.898357 | ubuntu-noble | + 2026-06-19 15:44:23.898363 | ubuntu-noble | +# Rules ----------------------------------------------------------------------- 2026-06-19 15:44:23.898368 | ubuntu-noble | + 2026-06-19 15:44:23.898373 | ubuntu-noble | +## Kernel parameters 2026-06-19 15:44:23.898379 | ubuntu-noble | +-w /etc/sysctl.conf -p wa -k sysctl 2026-06-19 15:44:23.898384 | ubuntu-noble | +-w /etc/sysctl.d -p wa -k sysctl 2026-06-19 15:44:23.898467 | ubuntu-noble | + 2026-06-19 15:44:23.898650 | ubuntu-noble | +## Kernel module loading and unloading 2026-06-19 15:44:23.898826 | ubuntu-noble | +-a always,exit -F perm=x -F auid!=-1 -F path=/sbin/insmod -k modules 2026-06-19 15:44:23.898998 | ubuntu-noble | +-a always,exit -F perm=x -F auid!=-1 -F path=/sbin/modprobe -k modules 2026-06-19 15:44:23.899167 | ubuntu-noble | +-a always,exit -F perm=x -F auid!=-1 -F path=/sbin/rmmod -k modules 2026-06-19 15:44:23.899366 | ubuntu-noble | +-a always,exit -F arch=b64 -S finit_module -S init_module -S delete_module -F auid!=-1 -k modules 2026-06-19 15:44:23.899565 | ubuntu-noble | + 2026-06-19 15:44:23.899736 | ubuntu-noble | +## Modprobe configuration 2026-06-19 15:44:23.899903 | ubuntu-noble | +-w /etc/modprobe.conf -p wa -k modprobe 2026-06-19 15:44:23.900064 | ubuntu-noble | +-w /etc/modprobe.d -p wa -k modprobe 2026-06-19 15:44:23.900203 | ubuntu-noble | + 2026-06-19 15:44:23.900363 | ubuntu-noble | +## KExec usage (all actions) 2026-06-19 15:44:23.900534 | ubuntu-noble | +-a always,exit -F arch=b64 -S kexec_load -k KEXEC 2026-06-19 15:44:23.900675 | ubuntu-noble | + 2026-06-19 15:44:23.900819 | ubuntu-noble | +## Special files 2026-06-19 15:44:23.900969 | ubuntu-noble | +-a always,exit -F arch=b64 -S mknod -S mknodat -k specialfiles 2026-06-19 15:44:23.901104 | ubuntu-noble | + 2026-06-19 15:44:23.901253 | ubuntu-noble | +## Mount operations (only attributable) 2026-06-19 15:44:23.901422 | ubuntu-noble | +-a always,exit -F arch=b64 -S mount -S umount2 -F auid!=-1 -k mount 2026-06-19 15:44:23.901608 | ubuntu-noble | + 2026-06-19 15:44:23.901757 | ubuntu-noble | +### NFS mount 2026-06-19 15:44:23.901919 | ubuntu-noble | +-a always,exit -F path=/sbin/mount.nfs -F perm=x -F auid>=500 -F auid!=4294967295 -k T1078_Valid_Accounts 2026-06-19 15:44:23.902076 | ubuntu-noble | +-a always,exit -F path=/usr/sbin/mount.nfs -F perm=x -F auid>=500 -F auid!=4294967295 -k T1078_Valid_Accounts 2026-06-19 15:44:23.902206 | ubuntu-noble | + 2026-06-19 15:44:23.902366 | ubuntu-noble | +## Change swap (only attributable) 2026-06-19 15:44:23.902532 | ubuntu-noble | +-a always,exit -F arch=b64 -S swapon -S swapoff -F auid!=-1 -k swap 2026-06-19 15:44:23.902666 | ubuntu-noble | + 2026-06-19 15:44:23.902801 | ubuntu-noble | +## Time 2026-06-19 15:44:23.902946 | ubuntu-noble | +-a always,exit -F arch=b64 -F uid!=ntp -S adjtimex -S settimeofday -S clock_settime -k time 2026-06-19 15:44:23.903082 | ubuntu-noble | +### Local time zone 2026-06-19 15:44:23.903222 | ubuntu-noble | +-w /etc/localtime -p wa -k localtime 2026-06-19 15:44:23.903367 | ubuntu-noble | + 2026-06-19 15:44:23.903517 | ubuntu-noble | +## Stunnel 2026-06-19 15:44:23.903659 | ubuntu-noble | +-w /usr/sbin/stunnel -p x -k stunnel 2026-06-19 15:44:23.903808 | ubuntu-noble | +-w /usr/bin/stunnel -p x -k stunnel 2026-06-19 15:44:23.903938 | ubuntu-noble | + 2026-06-19 15:44:23.904080 | ubuntu-noble | +## Cron configuration & scheduled jobs 2026-06-19 15:44:23.904218 | ubuntu-noble | +-w /etc/cron.allow -p wa -k cron 2026-06-19 15:44:23.904371 | ubuntu-noble | +-w /etc/cron.deny -p wa -k cron 2026-06-19 15:44:23.904544 | ubuntu-noble | +-w /etc/cron.d/ -p wa -k cron 2026-06-19 15:44:23.904687 | ubuntu-noble | +-w /etc/cron.daily/ -p wa -k cron 2026-06-19 15:44:23.904815 | ubuntu-noble | +-w /etc/cron.hourly/ -p wa -k cron 2026-06-19 15:44:23.904939 | ubuntu-noble | +-w /etc/cron.monthly/ -p wa -k cron 2026-06-19 15:44:23.905064 | ubuntu-noble | +-w /etc/cron.weekly/ -p wa -k cron 2026-06-19 15:44:23.905188 | ubuntu-noble | +-w /etc/crontab -p wa -k cron 2026-06-19 15:44:23.905311 | ubuntu-noble | +-w /var/spool/cron/ -p wa -k cron 2026-06-19 15:44:23.905448 | ubuntu-noble | + 2026-06-19 15:44:23.907340 | ubuntu-noble | +## User, group, password databases 2026-06-19 15:44:23.907352 | ubuntu-noble | +-w /etc/group -p wa -k etcgroup 2026-06-19 15:44:23.907356 | ubuntu-noble | +-w /etc/passwd -p wa -k etcpasswd 2026-06-19 15:44:23.907361 | ubuntu-noble | +-w /etc/gshadow -k etcgroup 2026-06-19 15:44:23.907365 | ubuntu-noble | +-w /etc/shadow -k etcpasswd 2026-06-19 15:44:23.907374 | ubuntu-noble | +-w /etc/security/opasswd -k opasswd 2026-06-19 15:44:23.907379 | ubuntu-noble | + 2026-06-19 15:44:23.907384 | ubuntu-noble | +## Sudoers file changes 2026-06-19 15:44:23.907388 | ubuntu-noble | +-w /etc/sudoers -p wa -k actions 2026-06-19 15:44:23.907391 | ubuntu-noble | +-w /etc/sudoers.d/ -p wa -k actions 2026-06-19 15:44:23.907395 | ubuntu-noble | + 2026-06-19 15:44:23.907399 | ubuntu-noble | +## Passwd 2026-06-19 15:44:23.907403 | ubuntu-noble | +-w /usr/bin/passwd -p x -k passwd_modification 2026-06-19 15:44:23.907407 | ubuntu-noble | + 2026-06-19 15:44:23.907411 | ubuntu-noble | +## Tools to change group identifiers 2026-06-19 15:44:23.907415 | ubuntu-noble | +-w /usr/sbin/groupadd -p x -k group_modification 2026-06-19 15:44:23.907419 | ubuntu-noble | +-w /usr/sbin/groupmod -p x -k group_modification 2026-06-19 15:44:23.907499 | ubuntu-noble | +-w /usr/sbin/addgroup -p x -k group_modification 2026-06-19 15:44:23.907639 | ubuntu-noble | +-w /usr/sbin/useradd -p x -k user_modification 2026-06-19 15:44:23.907758 | ubuntu-noble | +-w /usr/sbin/userdel -p x -k user_modification 2026-06-19 15:44:23.907875 | ubuntu-noble | +-w /usr/sbin/usermod -p x -k user_modification 2026-06-19 15:44:23.907991 | ubuntu-noble | +-w /usr/sbin/adduser -p x -k user_modification 2026-06-19 15:44:23.908098 | ubuntu-noble | + 2026-06-19 15:44:23.908213 | ubuntu-noble | +## Login configuration and information 2026-06-19 15:44:23.908341 | ubuntu-noble | +-w /etc/login.defs -p wa -k login 2026-06-19 15:44:23.908460 | ubuntu-noble | +-w /etc/securetty -p wa -k login 2026-06-19 15:44:23.908586 | ubuntu-noble | +-w /var/log/faillog -p wa -k login 2026-06-19 15:44:23.908701 | ubuntu-noble | +-w /var/log/lastlog -p wa -k login 2026-06-19 15:44:23.908816 | ubuntu-noble | +-w /var/log/tallylog -p wa -k login 2026-06-19 15:44:23.908927 | ubuntu-noble | + 2026-06-19 15:44:23.909042 | ubuntu-noble | +## Network Environment 2026-06-19 15:44:23.909156 | ubuntu-noble | +### Changes to hostname 2026-06-19 15:44:23.909275 | ubuntu-noble | +-a always,exit -F arch=b64 -S sethostname -S setdomainname -k network_modifications 2026-06-19 15:44:23.909396 | ubuntu-noble | + 2026-06-19 15:44:23.909525 | ubuntu-noble | +### Detect Remote Shell Use 2026-06-19 15:44:23.909645 | ubuntu-noble | +-a always,exit -F arch=b64 -F exe=/bin/bash -F success=1 -S connect -k "remote_shell" 2026-06-19 15:44:23.909761 | ubuntu-noble | +-a always,exit -F arch=b64 -F exe=/usr/bin/bash -F success=1 -S connect -k "remote_shell" 2026-06-19 15:44:23.909871 | ubuntu-noble | + 2026-06-19 15:44:23.909985 | ubuntu-noble | +### Successful IPv4 Connections 2026-06-19 15:44:23.910105 | ubuntu-noble | +-a always,exit -F arch=b64 -S connect -F a2=16 -F success=1 -F key=network_connect_4 2026-06-19 15:44:23.910212 | ubuntu-noble | + 2026-06-19 15:44:23.910337 | ubuntu-noble | +### Successful IPv6 Connections 2026-06-19 15:44:23.910461 | ubuntu-noble | +-a always,exit -F arch=b64 -S connect -F a2=28 -F success=1 -F key=network_connect_6 2026-06-19 15:44:23.910599 | ubuntu-noble | + 2026-06-19 15:44:23.910715 | ubuntu-noble | +### Changes to other files 2026-06-19 15:44:23.910833 | ubuntu-noble | +-w /etc/hosts -p wa -k network_modifications 2026-06-19 15:44:23.910949 | ubuntu-noble | +-w /etc/sysconfig/network -p wa -k network_modifications 2026-06-19 15:44:23.911064 | ubuntu-noble | +-w /etc/sysconfig/network-scripts -p w -k network_modifications 2026-06-19 15:44:23.911176 | ubuntu-noble | +-w /etc/network/ -p wa -k network 2026-06-19 15:44:23.911294 | ubuntu-noble | +-a always,exit -F dir=/etc/NetworkManager/ -F perm=wa -k network_modifications 2026-06-19 15:44:23.911415 | ubuntu-noble | + 2026-06-19 15:44:23.911561 | ubuntu-noble | +### Changes to issue 2026-06-19 15:44:23.911676 | ubuntu-noble | +-w /etc/issue -p wa -k etcissue 2026-06-19 15:44:23.911790 | ubuntu-noble | +-w /etc/issue.net -p wa -k etcissue 2026-06-19 15:44:23.911897 | ubuntu-noble | + 2026-06-19 15:44:23.912010 | ubuntu-noble | +## System startup scripts 2026-06-19 15:44:23.912123 | ubuntu-noble | +-w /etc/inittab -p wa -k init 2026-06-19 15:44:23.912236 | ubuntu-noble | +-w /etc/init.d/ -p wa -k init 2026-06-19 15:44:23.912373 | ubuntu-noble | +-w /etc/init/ -p wa -k init 2026-06-19 15:44:23.912507 | ubuntu-noble | + 2026-06-19 15:44:23.912624 | ubuntu-noble | +## Library search paths 2026-06-19 15:44:23.912740 | ubuntu-noble | +-w /etc/ld.so.conf -p wa -k libpath 2026-06-19 15:44:23.912855 | ubuntu-noble | +-w /etc/ld.so.conf.d -p wa -k libpath 2026-06-19 15:44:23.912964 | ubuntu-noble | + 2026-06-19 15:44:23.913084 | ubuntu-noble | +## Systemwide library preloads (LD_PRELOAD) 2026-06-19 15:44:23.913200 | ubuntu-noble | +-w /etc/ld.so.preload -p wa -k systemwide_preloads 2026-06-19 15:44:23.913422 | ubuntu-noble | + 2026-06-19 15:44:23.913577 | ubuntu-noble | +## Pam configuration 2026-06-19 15:44:23.913694 | ubuntu-noble | +-w /etc/pam.d/ -p wa -k pam 2026-06-19 15:44:23.913814 | ubuntu-noble | +-w /etc/security/limits.conf -p wa -k pam 2026-06-19 15:44:23.913928 | ubuntu-noble | +-w /etc/security/limits.d -p wa -k pam 2026-06-19 15:44:23.914043 | ubuntu-noble | +-w /etc/security/pam_env.conf -p wa -k pam 2026-06-19 15:44:23.914158 | ubuntu-noble | +-w /etc/security/namespace.conf -p wa -k pam 2026-06-19 15:44:23.914273 | ubuntu-noble | +-w /etc/security/namespace.d -p wa -k pam 2026-06-19 15:44:23.914410 | ubuntu-noble | +-w /etc/security/namespace.init -p wa -k pam 2026-06-19 15:44:23.914533 | ubuntu-noble | + 2026-06-19 15:44:23.914649 | ubuntu-noble | +## Mail configuration 2026-06-19 15:44:23.914761 | ubuntu-noble | +-w /etc/aliases -p wa -k mail 2026-06-19 15:44:23.914876 | ubuntu-noble | +-w /etc/postfix/ -p wa -k mail 2026-06-19 15:44:23.914988 | ubuntu-noble | +-w /etc/exim4/ -p wa -k mail 2026-06-19 15:44:23.915097 | ubuntu-noble | + 2026-06-19 15:44:23.915209 | ubuntu-noble | +## SSH configuration 2026-06-19 15:44:23.915334 | ubuntu-noble | +-w /etc/ssh/sshd_config -k sshd 2026-06-19 15:44:23.915453 | ubuntu-noble | +-w /etc/ssh/sshd_config.d -k sshd 2026-06-19 15:44:23.915571 | ubuntu-noble | + 2026-06-19 15:44:23.915767 | ubuntu-noble | +## root ssh key tampering 2026-06-19 15:44:23.915887 | ubuntu-noble | +-w /root/.ssh -p wa -k rootkey 2026-06-19 15:44:23.915997 | ubuntu-noble | + 2026-06-19 15:44:23.916110 | ubuntu-noble | +# Systemd 2026-06-19 15:44:23.916226 | ubuntu-noble | +-w /bin/systemctl -p x -k systemd 2026-06-19 15:44:23.916471 | ubuntu-noble | +-w /etc/systemd/ -p wa -k systemd 2026-06-19 15:44:23.916736 | ubuntu-noble | +-w /usr/lib/systemd -p wa -k systemd 2026-06-19 15:44:23.916850 | ubuntu-noble | + 2026-06-19 15:44:23.917066 | ubuntu-noble | +## https://systemd.network/systemd.generator.html 2026-06-19 15:44:23.917188 | ubuntu-noble | +-w /etc/systemd/system-generators/ -p wa -k systemd_generator 2026-06-19 15:44:23.917306 | ubuntu-noble | +-w /usr/local/lib/systemd/system-generators/ -p wa -k systemd_generator 2026-06-19 15:44:23.917445 | ubuntu-noble | +-w /usr/lib/systemd/system-generators -p wa -k systemd_generator 2026-06-19 15:44:23.917592 | ubuntu-noble | + 2026-06-19 15:44:23.917710 | ubuntu-noble | +-w /etc/systemd/user-generators/ -p wa -k systemd_generator 2026-06-19 15:44:23.917827 | ubuntu-noble | +-w /usr/local/lib/systemd/user-generators/ -p wa -k systemd_generator 2026-06-19 15:44:23.917943 | ubuntu-noble | +-w /lib/systemd/system-generators/ -p wa -k systemd_generator 2026-06-19 15:44:23.918193 | ubuntu-noble | + 2026-06-19 15:44:23.918415 | ubuntu-noble | +## SELinux events that modify the system's Mandatory Access Controls (MAC) 2026-06-19 15:44:23.918555 | ubuntu-noble | +-w /etc/selinux/ -p wa -k mac_policy 2026-06-19 15:44:23.918667 | ubuntu-noble | + 2026-06-19 15:44:23.918782 | ubuntu-noble | +## Critical elements access failures 2026-06-19 15:44:23.918901 | ubuntu-noble | +-a always,exit -F arch=b64 -S open -F dir=/etc -F success=0 -k unauthedfileaccess 2026-06-19 15:44:23.919027 | ubuntu-noble | +-a always,exit -F arch=b64 -S open -F dir=/bin -F success=0 -k unauthedfileaccess 2026-06-19 15:44:23.919204 | ubuntu-noble | +-a always,exit -F arch=b64 -S open -F dir=/sbin -F success=0 -k unauthedfileaccess 2026-06-19 15:44:23.919410 | ubuntu-noble | +-a always,exit -F arch=b64 -S open -F dir=/usr/bin -F success=0 -k unauthedfileaccess 2026-06-19 15:44:23.919670 | ubuntu-noble | +-a always,exit -F arch=b64 -S open -F dir=/usr/sbin -F success=0 -k unauthedfileaccess 2026-06-19 15:44:23.919797 | ubuntu-noble | +-a always,exit -F arch=b64 -S open -F dir=/var -F success=0 -k unauthedfileaccess 2026-06-19 15:44:23.920068 | ubuntu-noble | +-a always,exit -F arch=b64 -S open -F dir=/home -F success=0 -k unauthedfileaccess 2026-06-19 15:44:23.920368 | ubuntu-noble | +-a always,exit -F arch=b64 -S open -F dir=/srv -F success=0 -k unauthedfileaccess 2026-06-19 15:44:23.920517 | ubuntu-noble | + 2026-06-19 15:44:23.920646 | ubuntu-noble | +## Process ID change (switching accounts) applications 2026-06-19 15:44:23.920762 | ubuntu-noble | +-w /bin/su -p x -k priv_esc 2026-06-19 15:44:23.920883 | ubuntu-noble | +-w /usr/bin/sudo -p x -k priv_esc 2026-06-19 15:44:23.920994 | ubuntu-noble | + 2026-06-19 15:44:23.921107 | ubuntu-noble | +## Power state 2026-06-19 15:44:23.921224 | ubuntu-noble | +-w /sbin/shutdown -p x -k power 2026-06-19 15:44:23.922338 | ubuntu-noble | +-w /sbin/poweroff -p x -k power 2026-06-19 15:44:23.922367 | ubuntu-noble | +-w /sbin/reboot -p x -k power 2026-06-19 15:44:23.922371 | ubuntu-noble | +-w /sbin/halt -p x -k power 2026-06-19 15:44:23.922376 | ubuntu-noble | + 2026-06-19 15:44:23.922382 | ubuntu-noble | +## Session initiation information 2026-06-19 15:44:23.922388 | ubuntu-noble | +-w /var/run/utmp -p wa -k session 2026-06-19 15:44:23.922394 | ubuntu-noble | +-w /var/log/btmp -p wa -k session 2026-06-19 15:44:23.922400 | ubuntu-noble | +-w /var/log/wtmp -p wa -k session 2026-06-19 15:44:23.922406 | ubuntu-noble | + 2026-06-19 15:44:23.922412 | ubuntu-noble | +## Discretionary Access Control (DAC) modifications 2026-06-19 15:44:23.922447 | ubuntu-noble | +-a always,exit -F arch=b64 -S chmod -F auid>=1000 -F auid!=-1 -k perm_mod 2026-06-19 15:44:23.922613 | ubuntu-noble | +-a always,exit -F arch=b64 -S chown -F auid>=1000 -F auid!=-1 -k perm_mod 2026-06-19 15:44:23.922741 | ubuntu-noble | +-a always,exit -F arch=b64 -S fchmod -F auid>=1000 -F auid!=-1 -k perm_mod 2026-06-19 15:44:23.922861 | ubuntu-noble | +-a always,exit -F arch=b64 -S fchmodat -F auid>=1000 -F auid!=-1 -k perm_mod 2026-06-19 15:44:23.922982 | ubuntu-noble | +-a always,exit -F arch=b64 -S fchown -F auid>=1000 -F auid!=-1 -k perm_mod 2026-06-19 15:44:23.923100 | ubuntu-noble | +-a always,exit -F arch=b64 -S fchownat -F auid>=1000 -F auid!=-1 -k perm_mod 2026-06-19 15:44:23.923218 | ubuntu-noble | +-a always,exit -F arch=b64 -S fremovexattr -F auid>=1000 -F auid!=-1 -k perm_mod 2026-06-19 15:44:23.923357 | ubuntu-noble | +-a always,exit -F arch=b64 -S fsetxattr -F auid>=1000 -F auid!=-1 -k perm_mod 2026-06-19 15:44:23.923507 | ubuntu-noble | +-a always,exit -F arch=b64 -S lchown -F auid>=1000 -F auid!=-1 -k perm_mod 2026-06-19 15:44:23.923670 | ubuntu-noble | +-a always,exit -F arch=b64 -S lremovexattr -F auid>=1000 -F auid!=-1 -k perm_mod 2026-06-19 15:44:23.923792 | ubuntu-noble | +-a always,exit -F arch=b64 -S lsetxattr -F auid>=1000 -F auid!=-1 -k perm_mod 2026-06-19 15:44:23.923912 | ubuntu-noble | +-a always,exit -F arch=b64 -S removexattr -F auid>=1000 -F auid!=-1 -k perm_mod 2026-06-19 15:44:23.924031 | ubuntu-noble | +-a always,exit -F arch=b64 -S setxattr -F auid>=1000 -F auid!=-1 -k perm_mod 2026-06-19 15:44:23.924142 | ubuntu-noble | + 2026-06-19 15:44:23.924255 | ubuntu-noble | +# Special Rules --------------------------------------------------------------- 2026-06-19 15:44:23.924410 | ubuntu-noble | + 2026-06-19 15:44:23.924544 | ubuntu-noble | +## Reconnaissance 2026-06-19 15:44:23.924661 | ubuntu-noble | +-w /usr/bin/whoami -p x -k recon 2026-06-19 15:44:23.924850 | ubuntu-noble | +-w /usr/bin/id -p x -k recon 2026-06-19 15:44:23.924981 | ubuntu-noble | +-w /bin/hostname -p x -k recon 2026-06-19 15:44:23.925101 | ubuntu-noble | +-w /bin/uname -p x -k recon 2026-06-19 15:44:23.925215 | ubuntu-noble | +-w /etc/issue -p r -k recon 2026-06-19 15:44:23.925342 | ubuntu-noble | +-w /etc/hostname -p r -k recon 2026-06-19 15:44:23.925465 | ubuntu-noble | + 2026-06-19 15:44:23.925613 | ubuntu-noble | +## Suspicious activity 2026-06-19 15:44:23.925732 | ubuntu-noble | +-w /usr/bin/wget -p x -k susp_activity 2026-06-19 15:44:23.925848 | ubuntu-noble | +-w /usr/bin/curl -p x -k susp_activity 2026-06-19 15:44:23.925966 | ubuntu-noble | +-w /usr/bin/base64 -p x -k susp_activity 2026-06-19 15:44:23.926082 | ubuntu-noble | +-w /bin/nc -p x -k susp_activity 2026-06-19 15:44:23.926196 | ubuntu-noble | +-w /bin/netcat -p x -k susp_activity 2026-06-19 15:44:23.926313 | ubuntu-noble | +-w /usr/bin/ncat -p x -k susp_activity 2026-06-19 15:44:23.926455 | ubuntu-noble | +-w /usr/bin/ss -p x -k susp_activity 2026-06-19 15:44:23.926583 | ubuntu-noble | +-w /usr/bin/netstat -p x -k susp_activity 2026-06-19 15:44:23.926699 | ubuntu-noble | +-w /usr/bin/ssh -p x -k susp_activity 2026-06-19 15:44:23.926813 | ubuntu-noble | +-w /usr/bin/scp -p x -k susp_activity 2026-06-19 15:44:23.926927 | ubuntu-noble | +-w /usr/bin/sftp -p x -k susp_activity 2026-06-19 15:44:23.927041 | ubuntu-noble | +-w /usr/bin/ftp -p x -k susp_activity 2026-06-19 15:44:23.927156 | ubuntu-noble | +-w /usr/bin/socat -p x -k susp_activity 2026-06-19 15:44:23.927271 | ubuntu-noble | +-w /usr/bin/wireshark -p x -k susp_activity 2026-06-19 15:44:23.927414 | ubuntu-noble | +-w /usr/bin/tshark -p x -k susp_activity 2026-06-19 15:44:23.927566 | ubuntu-noble | +-w /usr/bin/rawshark -p x -k susp_activity 2026-06-19 15:44:23.927686 | ubuntu-noble | +-w /usr/bin/rdesktop -p x -k susp_activity 2026-06-19 15:44:23.927802 | ubuntu-noble | +-w /usr/local/bin/rdesktop -p x -k susp_activity 2026-06-19 15:44:23.927917 | ubuntu-noble | +-w /usr/bin/wlfreerdp -p x -k susp_activity 2026-06-19 15:44:23.928037 | ubuntu-noble | +-w /usr/bin/xfreerdp -p x -k susp_activity 2026-06-19 15:44:23.928154 | ubuntu-noble | +-w /usr/local/bin/xfreerdp -p x -k susp_activity 2026-06-19 15:44:23.928270 | ubuntu-noble | +-w /usr/bin/nmap -p x -k susp_activity 2026-06-19 15:44:23.928395 | ubuntu-noble | + 2026-06-19 15:44:23.928541 | ubuntu-noble | +## sssd 2026-06-19 15:44:23.928671 | ubuntu-noble | +-a always,exit -F path=/usr/libexec/sssd/p11_child -F perm=x -F auid>=500 -F auid!=4294967295 -k T1078_Valid_Accounts 2026-06-19 15:44:23.928797 | ubuntu-noble | +-a always,exit -F path=/usr/libexec/sssd/krb5_child -F perm=x -F auid>=500 -F auid!=4294967295 -k T1078_Valid_Accounts 2026-06-19 15:44:23.928921 | ubuntu-noble | +-a always,exit -F path=/usr/libexec/sssd/ldap_child -F perm=x -F auid>=500 -F auid!=4294967295 -k T1078_Valid_Accounts 2026-06-19 15:44:23.929043 | ubuntu-noble | +-a always,exit -F path=/usr/libexec/sssd/selinux_child -F perm=x -F auid>=500 -F auid!=4294967295 -k T1078_Valid_Accounts 2026-06-19 15:44:23.929163 | ubuntu-noble | +-a always,exit -F path=/usr/libexec/sssd/proxy_child -F perm=x -F auid>=500 -F auid!=4294967295 -k T1078_Valid_Accounts 2026-06-19 15:44:23.929273 | ubuntu-noble | + 2026-06-19 15:44:23.929410 | ubuntu-noble | +## T1002 Data Compressed 2026-06-19 15:44:23.929533 | ubuntu-noble | + 2026-06-19 15:44:23.929653 | ubuntu-noble | +-w /usr/bin/zip -p x -k Data_Compressed 2026-06-19 15:44:23.929770 | ubuntu-noble | +-w /usr/bin/gzip -p x -k Data_Compressed 2026-06-19 15:44:23.929884 | ubuntu-noble | +-w /usr/bin/tar -p x -k Data_Compressed 2026-06-19 15:44:23.931333 | ubuntu-noble | +-w /usr/bin/bzip2 -p x -k Data_Compressed 2026-06-19 15:44:23.931346 | ubuntu-noble | + 2026-06-19 15:44:23.931349 | ubuntu-noble | +-w /usr/bin/lzip -p x -k Data_Compressed 2026-06-19 15:44:23.931353 | ubuntu-noble | +-w /usr/local/bin/lzip -p x -k Data_Compressed 2026-06-19 15:44:23.931357 | ubuntu-noble | + 2026-06-19 15:44:23.931360 | ubuntu-noble | +-w /usr/bin/lz4 -p x -k Data_Compressed 2026-06-19 15:44:23.931364 | ubuntu-noble | +-w /usr/local/bin/lz4 -p x -k Data_Compressed 2026-06-19 15:44:23.931367 | ubuntu-noble | + 2026-06-19 15:44:23.931371 | ubuntu-noble | +-w /usr/bin/lzop -p x -k Data_Compressed 2026-06-19 15:44:23.931375 | ubuntu-noble | +-w /usr/local/bin/lzop -p x -k Data_Compressed 2026-06-19 15:44:23.931378 | ubuntu-noble | + 2026-06-19 15:44:23.931382 | ubuntu-noble | +-w /usr/bin/plzip -p x -k Data_Compressed 2026-06-19 15:44:23.931385 | ubuntu-noble | +-w /usr/local/bin/plzip -p x -k Data_Compressed 2026-06-19 15:44:23.931389 | ubuntu-noble | + 2026-06-19 15:44:23.931420 | ubuntu-noble | +-w /usr/bin/pbzip2 -p x -k Data_Compressed 2026-06-19 15:44:23.931597 | ubuntu-noble | +-w /usr/local/bin/pbzip2 -p x -k Data_Compressed 2026-06-19 15:44:23.931711 | ubuntu-noble | + 2026-06-19 15:44:23.931830 | ubuntu-noble | +-w /usr/bin/lbzip2 -p x -k Data_Compressed 2026-06-19 15:44:23.931948 | ubuntu-noble | +-w /usr/local/bin/lbzip2 -p x -k Data_Compressed 2026-06-19 15:44:23.932057 | ubuntu-noble | + 2026-06-19 15:44:23.932174 | ubuntu-noble | +-w /usr/bin/pixz -p x -k Data_Compressed 2026-06-19 15:44:23.932290 | ubuntu-noble | +-w /usr/local/bin/pixz -p x -k Data_Compressed 2026-06-19 15:44:23.932413 | ubuntu-noble | + 2026-06-19 15:44:23.932564 | ubuntu-noble | +-w /usr/bin/pigz -p x -k Data_Compressed 2026-06-19 15:44:23.932685 | ubuntu-noble | +-w /usr/local/bin/pigz -p x -k Data_Compressed 2026-06-19 15:44:23.932801 | ubuntu-noble | +-w /usr/bin/unpigz -p x -k Data_Compressed 2026-06-19 15:44:23.932917 | ubuntu-noble | +-w /usr/local/bin/unpigz -p x -k Data_Compressed 2026-06-19 15:44:23.933027 | ubuntu-noble | + 2026-06-19 15:44:23.933144 | ubuntu-noble | +-w /usr/bin/zstd -p x -k Data_Compressed 2026-06-19 15:44:23.933260 | ubuntu-noble | +-w /usr/local/bin/zstd -p x -k Data_Compressed 2026-06-19 15:44:23.933384 | ubuntu-noble | + 2026-06-19 15:44:23.933513 | ubuntu-noble | +## Added to catch netcat on Ubuntu 2026-06-19 15:44:23.933632 | ubuntu-noble | +-w /bin/nc.openbsd -p x -k susp_activity 2026-06-19 15:44:23.933749 | ubuntu-noble | +-w /bin/nc.traditional -p x -k susp_activity 2026-06-19 15:44:23.933857 | ubuntu-noble | + 2026-06-19 15:44:23.933974 | ubuntu-noble | +## Sbin suspicious activity 2026-06-19 15:44:23.934091 | ubuntu-noble | +-w /sbin/iptables -p x -k sbin_susp 2026-06-19 15:44:23.934203 | ubuntu-noble | +-w /sbin/ip6tables -p x -k sbin_susp 2026-06-19 15:44:23.934329 | ubuntu-noble | +-w /sbin/ifconfig -p x -k sbin_susp 2026-06-19 15:44:23.934461 | ubuntu-noble | +-w /usr/sbin/arptables -p x -k sbin_susp 2026-06-19 15:44:23.934593 | ubuntu-noble | +-w /usr/sbin/ebtables -p x -k sbin_susp 2026-06-19 15:44:23.934712 | ubuntu-noble | +-w /sbin/xtables-nft-multi -p x -k sbin_susp 2026-06-19 15:44:23.934827 | ubuntu-noble | +-w /usr/sbin/nft -p x -k sbin_susp 2026-06-19 15:44:23.934943 | ubuntu-noble | +-w /usr/sbin/tcpdump -p x -k sbin_susp 2026-06-19 15:44:23.935061 | ubuntu-noble | +-w /usr/sbin/traceroute -p x -k sbin_susp 2026-06-19 15:44:23.935172 | ubuntu-noble | +-w /usr/sbin/ufw -p x -k sbin_susp 2026-06-19 15:44:23.935280 | ubuntu-noble | + 2026-06-19 15:44:23.935407 | ubuntu-noble | +### kde4 2026-06-19 15:44:23.935545 | ubuntu-noble | +-a always,exit -F path=/usr/libexec/kde4/kpac_dhcp_helper -F perm=x -F auid>=1000 -F auid!=4294967295 -k T1078_Valid_Accounts 2026-06-19 15:44:23.935669 | ubuntu-noble | +-a always,exit -F path=/usr/libexec/kde4/kdesud -F perm=x -F auid>=1000 -F auid!=4294967295 -k T1078_Valid_Accounts 2026-06-19 15:44:23.935777 | ubuntu-noble | + 2026-06-19 15:44:23.935890 | ubuntu-noble | +## dbus-send invocation 2026-06-19 15:44:23.936017 | ubuntu-noble | +### may indicate privilege escalation CVE-2021-3560 2026-06-19 15:44:23.936133 | ubuntu-noble | +-w /usr/bin/dbus-send -p x -k dbus_send 2026-06-19 15:44:23.936249 | ubuntu-noble | +-w /usr/bin/gdbus -p x -k gdubs_call 2026-06-19 15:44:23.936372 | ubuntu-noble | + 2026-06-19 15:44:23.936513 | ubuntu-noble | +## pkexec invocation 2026-06-19 15:44:23.936638 | ubuntu-noble | +### may indicate privilege escalation CVE-2021-4034 2026-06-19 15:44:23.936755 | ubuntu-noble | +-w /usr/bin/pkexec -p x -k pkexec 2026-06-19 15:44:23.936864 | ubuntu-noble | + 2026-06-19 15:44:23.936979 | ubuntu-noble | +## Suspicious shells 2026-06-19 15:44:23.937096 | ubuntu-noble | +-w /bin/ash -p x -k susp_shell 2026-06-19 15:44:23.937210 | ubuntu-noble | +-w /bin/csh -p x -k susp_shell 2026-06-19 15:44:23.937338 | ubuntu-noble | +-w /bin/fish -p x -k susp_shell 2026-06-19 15:44:23.937458 | ubuntu-noble | +-w /bin/tcsh -p x -k susp_shell 2026-06-19 15:44:23.937584 | ubuntu-noble | +-w /bin/tclsh -p x -k susp_shell 2026-06-19 15:44:23.937702 | ubuntu-noble | +-w /bin/xonsh -p x -k susp_shell 2026-06-19 15:44:23.937818 | ubuntu-noble | +-w /usr/local/bin/xonsh -p x -k susp_shell 2026-06-19 15:44:23.937933 | ubuntu-noble | +-w /bin/open -p x -k susp_shell 2026-06-19 15:44:23.938047 | ubuntu-noble | +-w /bin/rbash -p x -k susp_shell 2026-06-19 15:44:23.938155 | ubuntu-noble | + 2026-06-19 15:44:23.938268 | ubuntu-noble | +# Web Server Actvity 2026-06-19 15:44:23.938403 | ubuntu-noble | +## Change the number "33" to the ID of your WebServer user. Default: www-data:x:33:33 2026-06-19 15:44:23.938533 | ubuntu-noble | +-a always,exit -F arch=b64 -S execve -F euid=33 -k detect_execve_www 2026-06-19 15:44:23.938643 | ubuntu-noble | + 2026-06-19 15:44:23.938759 | ubuntu-noble | +### https://clustershell.readthedocs.io/ 2026-06-19 15:44:23.938877 | ubuntu-noble | +-w /bin/clush -p x -k susp_shell 2026-06-19 15:44:23.938992 | ubuntu-noble | +-w /usr/local/bin/clush -p x -k susp_shell 2026-06-19 15:44:23.939107 | ubuntu-noble | +-w /etc/clustershell/clush.conf -p x -k susp_shell 2026-06-19 15:44:23.939214 | ubuntu-noble | + 2026-06-19 15:44:23.939340 | ubuntu-noble | +### https://github.com/tmux/tmux 2026-06-19 15:44:23.939459 | ubuntu-noble | +-w /bin/tmux -p x -k susp_shell 2026-06-19 15:44:23.939601 | ubuntu-noble | +-w /usr/local/bin/tmux -p x -k susp_shell 2026-06-19 15:44:23.939710 | ubuntu-noble | + 2026-06-19 15:44:23.939825 | ubuntu-noble | +## Shell/profile configurations 2026-06-19 15:44:23.939940 | ubuntu-noble | +-w /etc/profile.d/ -p wa -k shell_profiles 2026-06-19 15:44:23.940054 | ubuntu-noble | +-w /etc/profile -p wa -k shell_profiles 2026-06-19 15:44:23.940170 | ubuntu-noble | +-w /etc/shells -p wa -k shell_profiles 2026-06-19 15:44:23.940284 | ubuntu-noble | +-w /etc/bashrc -p wa -k shell_profiles 2026-06-19 15:44:23.940411 | ubuntu-noble | +-w /etc/csh.cshrc -p wa -k shell_profiles 2026-06-19 15:44:23.940542 | ubuntu-noble | +-w /etc/csh.login -p wa -k shell_profiles 2026-06-19 15:44:23.940657 | ubuntu-noble | +-w /etc/fish/ -p wa -k shell_profiles 2026-06-19 15:44:23.940772 | ubuntu-noble | +-w /etc/zsh/ -p wa -k shell_profiles 2026-06-19 15:44:23.940878 | ubuntu-noble | + 2026-06-19 15:44:23.940991 | ubuntu-noble | +### https://github.com/xxh/xxh 2026-06-19 15:44:23.941107 | ubuntu-noble | +-w /usr/local/bin/xxh.bash -p x -k susp_shell 2026-06-19 15:44:23.941221 | ubuntu-noble | +-w /usr/local/bin/xxh.xsh -p x -k susp_shell 2026-06-19 15:44:23.941347 | ubuntu-noble | +-w /usr/local/bin/xxh.zsh -p x -k susp_shell 2026-06-19 15:44:23.941459 | ubuntu-noble | + 2026-06-19 15:44:23.941597 | ubuntu-noble | +## Injection 2026-06-19 15:44:23.941715 | ubuntu-noble | +### These rules watch for code injection by the ptrace facility. 2026-06-19 15:44:23.941832 | ubuntu-noble | +### This could indicate someone trying to do something bad or just debugging 2026-06-19 15:44:23.943332 | ubuntu-noble | +-a always,exit -F arch=b64 -S ptrace -F a0=0x4 -k code_injection 2026-06-19 15:44:23.943343 | ubuntu-noble | +-a always,exit -F arch=b64 -S ptrace -F a0=0x5 -k data_injection 2026-06-19 15:44:23.943347 | ubuntu-noble | +-a always,exit -F arch=b64 -S ptrace -F a0=0x6 -k register_injection 2026-06-19 15:44:23.943351 | ubuntu-noble | +-a always,exit -F arch=b64 -S ptrace -k tracing 2026-06-19 15:44:23.943355 | ubuntu-noble | + 2026-06-19 15:44:23.943365 | ubuntu-noble | +## Anonymous File Creation 2026-06-19 15:44:23.943369 | ubuntu-noble | +### These rules watch the use of memfd_create 2026-06-19 15:44:23.943372 | ubuntu-noble | +### "memfd_create" creates anonymous file and returns a file descriptor to access it 2026-06-19 15:44:23.943376 | ubuntu-noble | +### When combined with "fexecve" can be used to stealthily run binaries in memory without touching disk 2026-06-19 15:44:23.943380 | ubuntu-noble | +-a always,exit -F arch=b64 -S memfd_create -F key=anon_file_create 2026-06-19 15:44:23.943383 | ubuntu-noble | + 2026-06-19 15:44:23.943387 | ubuntu-noble | +## Privilege Abuse 2026-06-19 15:44:23.943390 | ubuntu-noble | +### The purpose of this rule is to detect when an admin may be abusing power by looking in user's home dir. 2026-06-19 15:44:23.943394 | ubuntu-noble | +-a always,exit -F dir=/home -F uid=0 -F auid>=1000 -F auid!=-1 -C auid!=obj_uid -k power_abuse 2026-06-19 15:44:23.943397 | ubuntu-noble | + 2026-06-19 15:44:23.943521 | ubuntu-noble | +# Socket Creations 2026-06-19 15:44:23.943640 | ubuntu-noble | +# will catch both IPv4 and IPv6 2026-06-19 15:44:23.943748 | ubuntu-noble | + 2026-06-19 15:44:23.943866 | ubuntu-noble | +-a always,exit -F arch=b32 -S socket -F a0=2 -k network_socket_created 2026-06-19 15:44:23.943984 | ubuntu-noble | +-a always,exit -F arch=b64 -S socket -F a0=2 -k network_socket_created 2026-06-19 15:44:23.944090 | ubuntu-noble | + 2026-06-19 15:44:23.944207 | ubuntu-noble | +-a always,exit -F arch=b32 -S socket -F a0=10 -k network_socket_created 2026-06-19 15:44:23.944340 | ubuntu-noble | +-a always,exit -F arch=b64 -S socket -F a0=10 -k network_socket_created 2026-06-19 15:44:23.944454 | ubuntu-noble | + 2026-06-19 15:44:23.944581 | ubuntu-noble | +# Software Management --------------------------------------------------------- 2026-06-19 15:44:23.944689 | ubuntu-noble | + 2026-06-19 15:44:23.944803 | ubuntu-noble | +# RPM (Redhat/CentOS) 2026-06-19 15:44:23.944921 | ubuntu-noble | +-w /usr/bin/rpm -p x -k software_mgmt 2026-06-19 15:44:23.945037 | ubuntu-noble | +-w /usr/bin/yum -p x -k software_mgmt 2026-06-19 15:44:23.945147 | ubuntu-noble | + 2026-06-19 15:44:23.945262 | ubuntu-noble | +# DNF (Fedora/RedHat 8/CentOS 8) 2026-06-19 15:44:23.945392 | ubuntu-noble | +-w /usr/bin/dnf -p x -k software_mgmt 2026-06-19 15:44:23.945522 | ubuntu-noble | + 2026-06-19 15:44:23.945640 | ubuntu-noble | +# YAST/Zypper/RPM (SuSE) 2026-06-19 15:44:23.945756 | ubuntu-noble | +-w /sbin/yast -p x -k software_mgmt 2026-06-19 15:44:23.945868 | ubuntu-noble | +-w /sbin/yast2 -p x -k software_mgmt 2026-06-19 15:44:23.945981 | ubuntu-noble | +-w /bin/rpm -p x -k software_mgmt 2026-06-19 15:44:23.946093 | ubuntu-noble | +-w /usr/bin/zypper -k software_mgmt 2026-06-19 15:44:23.946199 | ubuntu-noble | + 2026-06-19 15:44:23.946312 | ubuntu-noble | +# DPKG / APT-GET (Debian/Ubuntu) 2026-06-19 15:44:23.946442 | ubuntu-noble | +-w /usr/bin/dpkg -p x -k software_mgmt 2026-06-19 15:44:23.946568 | ubuntu-noble | +-w /usr/bin/apt -p x -k software_mgmt 2026-06-19 15:44:23.946686 | ubuntu-noble | +-w /usr/bin/apt-add-repository -p x -k software_mgmt 2026-06-19 15:44:23.946802 | ubuntu-noble | +-w /usr/bin/apt-get -p x -k software_mgmt 2026-06-19 15:44:23.946915 | ubuntu-noble | +-w /usr/bin/aptitude -p x -k software_mgmt 2026-06-19 15:44:23.947029 | ubuntu-noble | +-w /usr/bin/wajig -p x -k software_mgmt 2026-06-19 15:44:23.947145 | ubuntu-noble | +-w /usr/bin/snap -p x -k software_mgmt 2026-06-19 15:44:23.947252 | ubuntu-noble | + 2026-06-19 15:44:23.947378 | ubuntu-noble | +# PIP(3) (Python installs) 2026-06-19 15:44:23.947513 | ubuntu-noble | +-w /usr/bin/pip -p x -k third_party_software_mgmt 2026-06-19 15:44:23.947633 | ubuntu-noble | +-w /usr/local/bin/pip -p x -k third_party_software_mgmt 2026-06-19 15:44:23.947751 | ubuntu-noble | +-w /usr/bin/pip3 -p x -k third_party_software_mgmt 2026-06-19 15:44:23.947871 | ubuntu-noble | +-w /usr/local/bin/pip3 -p x -k third_party_software_mgmt 2026-06-19 15:44:23.947985 | ubuntu-noble | +-w /usr/bin/pipx -p x -k third_party_software_mgmt 2026-06-19 15:44:23.948104 | ubuntu-noble | +-w /usr/local/bin/pipx -p x -k third_party_software_mgmt 2026-06-19 15:44:23.948213 | ubuntu-noble | + 2026-06-19 15:44:23.948336 | ubuntu-noble | +# npm 2026-06-19 15:44:23.948456 | ubuntu-noble | +## T1072 third party software 2026-06-19 15:44:23.948604 | ubuntu-noble | +## https://www.npmjs.com 2026-06-19 15:44:23.948723 | ubuntu-noble | +## https://docs.npmjs.com/cli/v6/commands/npm-audit 2026-06-19 15:44:23.948840 | ubuntu-noble | +-w /usr/bin/npm -p x -k third_party_software_mgmt 2026-06-19 15:44:23.948950 | ubuntu-noble | + 2026-06-19 15:44:23.949068 | ubuntu-noble | +# Comprehensive Perl Archive Network (CPAN) (CPAN installs) 2026-06-19 15:44:23.949184 | ubuntu-noble | +## T1072 third party software 2026-06-19 15:44:23.949299 | ubuntu-noble | +## https://www.cpan.org 2026-06-19 15:44:23.949429 | ubuntu-noble | +-w /usr/bin/cpan -p x -k third_party_software_mgmt 2026-06-19 15:44:23.949551 | ubuntu-noble | + 2026-06-19 15:44:23.949666 | ubuntu-noble | +# Ruby (RubyGems installs) 2026-06-19 15:44:23.949781 | ubuntu-noble | +## T1072 third party software 2026-06-19 15:44:23.949894 | ubuntu-noble | +## https://rubygems.org 2026-06-19 15:44:23.950008 | ubuntu-noble | +-w /usr/bin/gem -p x -k third_party_software_mgmt 2026-06-19 15:44:23.950114 | ubuntu-noble | + 2026-06-19 15:44:23.950228 | ubuntu-noble | +# LuaRocks (Lua installs) 2026-06-19 15:44:23.950356 | ubuntu-noble | +## T1072 third party software 2026-06-19 15:44:23.950483 | ubuntu-noble | +## https://luarocks.org 2026-06-19 15:44:23.950607 | ubuntu-noble | +-w /usr/bin/luarocks -p x -k third_party_software_mgmt 2026-06-19 15:44:23.950718 | ubuntu-noble | + 2026-06-19 15:44:23.950834 | ubuntu-noble | +# Pacman (Arch Linux) 2026-06-19 15:44:23.950952 | ubuntu-noble | +## https://wiki.archlinux.org/title/Pacman 2026-06-19 15:44:23.951065 | ubuntu-noble | +## T1072 third party software 2026-06-19 15:44:23.951181 | ubuntu-noble | +-w /etc/pacman.conf -p x -k third_party_software_mgmt 2026-06-19 15:44:23.951296 | ubuntu-noble | +-w /etc/pacman.d -p x -k third_party_software_mgmt 2026-06-19 15:44:23.951418 | ubuntu-noble | + 2026-06-19 15:44:23.951559 | ubuntu-noble | +# Special Software ------------------------------------------------------------ 2026-06-19 15:44:23.951672 | ubuntu-noble | + 2026-06-19 15:44:23.951786 | ubuntu-noble | +## GDS specific secrets 2026-06-19 15:44:23.951900 | ubuntu-noble | +-w /etc/puppet/ssl -p wa -k puppet_ssl 2026-06-19 15:44:23.952008 | ubuntu-noble | + 2026-06-19 15:44:23.952120 | ubuntu-noble | +## IBM Bigfix BESClient 2026-06-19 15:44:23.952242 | ubuntu-noble | +-a always,exit -F arch=b64 -S open -F dir=/opt/BESClient -F success=0 -k soft_besclient 2026-06-19 15:44:23.952372 | ubuntu-noble | +-w /var/opt/BESClient/ -p wa -k soft_besclient 2026-06-19 15:44:23.952495 | ubuntu-noble | + 2026-06-19 15:44:23.952611 | ubuntu-noble | +## CHEF https://www.chef.io/chef/ 2026-06-19 15:44:23.952723 | ubuntu-noble | +-w /etc/chef -p wa -k soft_chef 2026-06-19 15:44:23.952828 | ubuntu-noble | + 2026-06-19 15:44:23.952939 | ubuntu-noble | +## Salt 2026-06-19 15:44:23.953055 | ubuntu-noble | +## https://saltproject.io/ 2026-06-19 15:44:23.953175 | ubuntu-noble | +## https://docs.saltproject.io/en/latest/ref/configuration/master.html 2026-06-19 15:44:23.953289 | ubuntu-noble | +-w /etc/salt -p wa -k soft_salt 2026-06-19 15:44:23.953417 | ubuntu-noble | +-w /usr/local/etc/salt -p wa -k soft_salt 2026-06-19 15:44:23.953539 | ubuntu-noble | + 2026-06-19 15:44:23.953651 | ubuntu-noble | +## Otter 2026-06-19 15:44:23.953767 | ubuntu-noble | +## https://inedo.com/otter 2026-06-19 15:44:23.953880 | ubuntu-noble | +-w /etc/otter -p wa -k soft_otter 2026-06-19 15:44:23.953986 | ubuntu-noble | + 2026-06-19 15:44:23.954098 | ubuntu-noble | +## T1081 Credentials In Files 2026-06-19 15:44:23.954212 | ubuntu-noble | +-w /usr/bin/grep -p x -k string_search 2026-06-19 15:44:23.955333 | ubuntu-noble | +-w /usr/bin/egrep -p x -k string_search 2026-06-19 15:44:23.955344 | ubuntu-noble | +-w /usr/bin/ugrep -p x -k string_search 2026-06-19 15:44:23.955348 | ubuntu-noble | +### macOS 2026-06-19 15:44:23.955352 | ubuntu-noble | +-w /usr/local/bin/grep -p x -k string_search 2026-06-19 15:44:23.955355 | ubuntu-noble | +-w /usr/local/bin/egrep -p x -k string_search 2026-06-19 15:44:23.955359 | ubuntu-noble | +-w /usr/local/bin/ugrep -p x -k string_search 2026-06-19 15:44:23.955362 | ubuntu-noble | + 2026-06-19 15:44:23.955366 | ubuntu-noble | +### https://github.com/tmbinc/bgrep 2026-06-19 15:44:23.955369 | ubuntu-noble | +-w /usr/bin/bgrep -p x -k string_search 2026-06-19 15:44:23.955373 | ubuntu-noble | +### macOS 2026-06-19 15:44:23.955376 | ubuntu-noble | +-w /usr/local/bin/bgrep -p x -k string_search 2026-06-19 15:44:23.955486 | ubuntu-noble | + 2026-06-19 15:44:23.955609 | ubuntu-noble | +### https://github.com/BurntSushi/ripgrep 2026-06-19 15:44:23.955727 | ubuntu-noble | +-w /usr/bin/rg -p x -k string_search 2026-06-19 15:44:23.955839 | ubuntu-noble | +### macOS 2026-06-19 15:44:23.955954 | ubuntu-noble | +-w /usr/local/bin/rg -p x -k string_search 2026-06-19 15:44:23.956065 | ubuntu-noble | + 2026-06-19 15:44:23.956180 | ubuntu-noble | +### https://github.com/awgn/cgrep 2026-06-19 15:44:23.956288 | ubuntu-noble | + 2026-06-19 15:44:23.956422 | ubuntu-noble | +-w /usr/bin/cgrep -p x -k string_search 2026-06-19 15:44:23.956592 | ubuntu-noble | +### macOS 2026-06-19 15:44:23.956710 | ubuntu-noble | +-w /usr/local/bin/cgrep -p x -k string_search 2026-06-19 15:44:23.956819 | ubuntu-noble | + 2026-06-19 15:44:23.956936 | ubuntu-noble | +### https://github.com/jpr5/ngrep 2026-06-19 15:44:23.957054 | ubuntu-noble | +-w /usr/bin/ngrep -p x -k string_search 2026-06-19 15:44:23.957165 | ubuntu-noble | +### macOS 2026-06-19 15:44:23.957281 | ubuntu-noble | +-w /usr/local/bin/ngrep -p x -k string_search 2026-06-19 15:44:23.957405 | ubuntu-noble | + 2026-06-19 15:44:23.957536 | ubuntu-noble | +### https://github.com/vrothberg/vgrep 2026-06-19 15:44:23.957656 | ubuntu-noble | +-w /usr/bin/vgrep -p x -k string_search 2026-06-19 15:44:23.957767 | ubuntu-noble | +### macOS 2026-06-19 15:44:23.957883 | ubuntu-noble | +-w /usr/local/bin/vgrep -p x -k string_search 2026-06-19 15:44:23.957991 | ubuntu-noble | + 2026-06-19 15:44:23.958107 | ubuntu-noble | +### https://github.com/monochromegane/the_platinum_searcher 2026-06-19 15:44:23.958222 | ubuntu-noble | +-w /usr/bin/pt -p x -k string_search 2026-06-19 15:44:23.958344 | ubuntu-noble | +### macOS 2026-06-19 15:44:23.958466 | ubuntu-noble | +-w /usr/local/bin/pt -p x -k string_search 2026-06-19 15:44:23.958587 | ubuntu-noble | + 2026-06-19 15:44:23.958703 | ubuntu-noble | +### https://github.com/gvansickle/ucg 2026-06-19 15:44:23.958821 | ubuntu-noble | +-w /usr/bin/ucg -p x -k string_search 2026-06-19 15:44:23.958931 | ubuntu-noble | +### macOS 2026-06-19 15:44:23.959045 | ubuntu-noble | +-w /usr/local/bin/ucg -p x -k string_search 2026-06-19 15:44:23.959154 | ubuntu-noble | + 2026-06-19 15:44:23.959269 | ubuntu-noble | +### https://github.com/ggreer/the_silver_searcher 2026-06-19 15:44:23.959397 | ubuntu-noble | +-w /usr/bin/ag -p x -k string_search 2026-06-19 15:44:23.959536 | ubuntu-noble | +### macOS 2026-06-19 15:44:23.959655 | ubuntu-noble | +-w /usr/local/bin/ag -p x -k string_search 2026-06-19 15:44:23.959764 | ubuntu-noble | + 2026-06-19 15:44:23.959879 | ubuntu-noble | +### https://github.com/beyondgrep/ack3 2026-06-19 15:44:23.959991 | ubuntu-noble | +### https://beyondgrep.com 2026-06-19 15:44:23.960108 | ubuntu-noble | +-w /usr/bin/ack -p x -k string_search 2026-06-19 15:44:23.960224 | ubuntu-noble | +-w /usr/local/bin/ack -p x -k string_search 2026-06-19 15:44:23.960352 | ubuntu-noble | +-w /usr/bin/semgrep -p x -k string_search 2026-06-19 15:44:23.960468 | ubuntu-noble | +### macOS 2026-06-19 15:44:23.960595 | ubuntu-noble | +-w /usr/local/bin/semgrep -p x -k string_search 2026-06-19 15:44:23.960702 | ubuntu-noble | + 2026-06-19 15:44:23.960814 | ubuntu-noble | +## Docker 2026-06-19 15:44:23.960928 | ubuntu-noble | +-w /usr/bin/dockerd -k docker 2026-06-19 15:44:23.961042 | ubuntu-noble | +-w /usr/bin/docker -k docker 2026-06-19 15:44:23.961155 | ubuntu-noble | +-w /usr/bin/docker-containerd -k docker 2026-06-19 15:44:23.961268 | ubuntu-noble | +-w /usr/bin/docker-runc -k docker 2026-06-19 15:44:23.961394 | ubuntu-noble | +-w /var/lib/docker -p wa -k docker 2026-06-19 15:44:23.961517 | ubuntu-noble | +-w /etc/docker -k docker 2026-06-19 15:44:23.961633 | ubuntu-noble | +-w /etc/sysconfig/docker -k docker 2026-06-19 15:44:23.961749 | ubuntu-noble | +-w /etc/sysconfig/docker-storage -k docker 2026-06-19 15:44:23.961864 | ubuntu-noble | +-w /usr/lib/systemd/system/docker.service -k docker 2026-06-19 15:44:23.961979 | ubuntu-noble | +-w /usr/lib/systemd/system/docker.socket -k docker 2026-06-19 15:44:23.962086 | ubuntu-noble | + 2026-06-19 15:44:23.962200 | ubuntu-noble | +## Virtualization stuff 2026-06-19 15:44:23.962325 | ubuntu-noble | +-w /usr/bin/qemu-system-x86_64 -p x -k qemu-system-x86_64 2026-06-19 15:44:23.962445 | ubuntu-noble | +-w /usr/bin/qemu-img -p x -k qemu-img 2026-06-19 15:44:23.962585 | ubuntu-noble | +-w /usr/bin/qemu-kvm -p x -k qemu-kvm 2026-06-19 15:44:23.962701 | ubuntu-noble | +-w /usr/bin/qemu -p x -k qemu 2026-06-19 15:44:23.962819 | ubuntu-noble | +-w /usr/bin/virtualbox -p x -k virtualbox 2026-06-19 15:44:23.962934 | ubuntu-noble | +-w /usr/bin/virt-manager -p x -k virt-manager 2026-06-19 15:44:23.963049 | ubuntu-noble | +-w /usr/bin/VBoxManage -p x -k VBoxManage 2026-06-19 15:44:23.964334 | ubuntu-noble | + 2026-06-19 15:44:23.964346 | ubuntu-noble | +#### VirtualBox on macOS 2026-06-19 15:44:23.964350 | ubuntu-noble | + 2026-06-19 15:44:23.964354 | ubuntu-noble | +-w /usr/local/bin/VirtualBox -p x -k virt_tool 2026-06-19 15:44:23.964358 | ubuntu-noble | +-w /usr/local/bin/VirtualBoxVM -p x -k virt_tool 2026-06-19 15:44:23.964361 | ubuntu-noble | +-w /usr/local/bin/VBoxManage -p x -k virt_tool 2026-06-19 15:44:23.964365 | ubuntu-noble | +-w /usr/local/bin/VBoxVRDP -p x -k virt_tool 2026-06-19 15:44:23.964368 | ubuntu-noble | +-w /usr/local/bin/VBoxHeadless -p x -k virt_tool 2026-06-19 15:44:23.964372 | ubuntu-noble | +-w /usr/local/bin/vboxwebsrv -p x -k virt_tool 2026-06-19 15:44:23.964375 | ubuntu-noble | +-w /usr/local/bin/VBoxBugReport -p x -k virt_tool 2026-06-19 15:44:23.964379 | ubuntu-noble | +-w /usr/local/bin/VBoxBalloonCtrl -p x -k virt_tool 2026-06-19 15:44:23.964390 | ubuntu-noble | +-w /usr/local/bin/VBoxAutostart -p x -k virt_tool 2026-06-19 15:44:23.964493 | ubuntu-noble | +-w /usr/local/bin/VBoxDTrace -p x -k virt_tool 2026-06-19 15:44:23.964611 | ubuntu-noble | +-w /usr/local/bin/vbox-img -p x -k virt_tool 2026-06-19 15:44:23.964732 | ubuntu-noble | +-w /Library/LaunchDaemons/org.virtualbox.startup.plist -p x -k virt_tool 2026-06-19 15:44:23.964853 | ubuntu-noble | +-w /Library/Application Support/VirtualBox/LaunchDaemons/ -p x -k virt_tool 2026-06-19 15:44:23.964972 | ubuntu-noble | +-w /Library/Application Support/VirtualBox/VBoxDrv.kext/ -p x -k virt_tool 2026-06-19 15:44:23.965092 | ubuntu-noble | +-w /Library/Application Support/VirtualBox/VBoxUSB.kext/ -p x -k virt_tool 2026-06-19 15:44:23.965211 | ubuntu-noble | +-w /Library/Application Support/VirtualBox/VBoxNetFlt.kext/ -p x -k virt_tool 2026-06-19 15:44:23.965341 | ubuntu-noble | +-w /Library/Application Support/VirtualBox/VBoxNetAdp.kext/ -p x -k virt_tool 2026-06-19 15:44:23.965456 | ubuntu-noble | + 2026-06-19 15:44:23.965596 | ubuntu-noble | +### Parallels Desktop on macOS 2026-06-19 15:44:23.965706 | ubuntu-noble | + 2026-06-19 15:44:23.965823 | ubuntu-noble | +-w /usr/local/bin/prl_convert -p x -k virt_tool 2026-06-19 15:44:23.965938 | ubuntu-noble | +-w /usr/local/bin/prl_disk_tool -p x -k virt_tool 2026-06-19 15:44:23.966053 | ubuntu-noble | +-w /usr/local/bin/prl_perf_ctl -p x -k virt_tool 2026-06-19 15:44:23.966167 | ubuntu-noble | +-w /usr/local/bin/prlcore2dmp -p x -k virt_tool 2026-06-19 15:44:23.966283 | ubuntu-noble | +-w /usr/local/bin/prlctl -p x -k virt_tool 2026-06-19 15:44:23.966412 | ubuntu-noble | +-w /usr/local/bin/prlexec -p x -k virt_tool 2026-06-19 15:44:23.966541 | ubuntu-noble | +-w /usr/local/bin/prlsrvctl -p x -k virt_tool 2026-06-19 15:44:23.966693 | ubuntu-noble | +-w /Library/Preferences/Parallels -p x -k virt_tool 2026-06-19 15:44:23.966815 | ubuntu-noble | + 2026-06-19 15:44:23.966931 | ubuntu-noble | +### qemu on macOS 2026-06-19 15:44:23.967042 | ubuntu-noble | + 2026-06-19 15:44:23.967159 | ubuntu-noble | +-w /usr/local/bin/qemu-edid -p x -k virt_tool 2026-06-19 15:44:23.967281 | ubuntu-noble | +-w /usr/local/bin/qemu-img -p x -k virt_tool 2026-06-19 15:44:23.967415 | ubuntu-noble | +-w /usr/local/bin/qemu-io -p x -k virt_tool 2026-06-19 15:44:23.967567 | ubuntu-noble | +-w /usr/local/bin/qemu-nbd -p x -k virt_tool 2026-06-19 15:44:23.967688 | ubuntu-noble | +-w /usr/local/bin/qemu-system-x86_64 -p x -k virt_tool 2026-06-19 15:44:23.967796 | ubuntu-noble | + 2026-06-19 15:44:23.967910 | ubuntu-noble | +## Kubelet 2026-06-19 15:44:23.968027 | ubuntu-noble | +-w /usr/bin/kubelet -k kubelet 2026-06-19 15:44:23.968136 | ubuntu-noble | + 2026-06-19 15:44:23.968249 | ubuntu-noble | +# ipc system call 2026-06-19 15:44:23.968387 | ubuntu-noble | +# /usr/include/linux/ipc.h 2026-06-19 15:44:23.968515 | ubuntu-noble | + 2026-06-19 15:44:23.968628 | ubuntu-noble | +## msgctl 2026-06-19 15:44:23.968746 | ubuntu-noble | +#-a always,exit -S ipc -F a0=14 -k Inter-Process_Communication 2026-06-19 15:44:23.968857 | ubuntu-noble | +## msgget 2026-06-19 15:44:23.968980 | ubuntu-noble | +#-a always,exit -S ipc -F a0=13 -k Inter-Process_Communication 2026-06-19 15:44:23.969096 | ubuntu-noble | +## Use these lines on x86_64, ia64 instead 2026-06-19 15:44:23.969214 | ubuntu-noble | +-a always,exit -F arch=b64 -S msgctl -k Inter-Process_Communication 2026-06-19 15:44:23.969344 | ubuntu-noble | +-a always,exit -F arch=b64 -S msgget -k Inter-Process_Communication 2026-06-19 15:44:23.969456 | ubuntu-noble | + 2026-06-19 15:44:23.969593 | ubuntu-noble | +## semctl 2026-06-19 15:44:23.969716 | ubuntu-noble | +#-a always,exit -S ipc -F a0=3 -k Inter-Process_Communication 2026-06-19 15:44:23.969827 | ubuntu-noble | +## semget 2026-06-19 15:44:23.969945 | ubuntu-noble | +#-a always,exit -S ipc -F a0=2 -k Inter-Process_Communication 2026-06-19 15:44:23.970056 | ubuntu-noble | +## semop 2026-06-19 15:44:23.970175 | ubuntu-noble | +#-a always,exit -S ipc -F a0=1 -k Inter-Process_Communication 2026-06-19 15:44:23.970287 | ubuntu-noble | +## semtimedop 2026-06-19 15:44:23.970434 | ubuntu-noble | +#-a always,exit -S ipc -F a0=4 -k Inter-Process_Communication 2026-06-19 15:44:23.970566 | ubuntu-noble | +## Use these lines on x86_64, ia64 instead 2026-06-19 15:44:23.970685 | ubuntu-noble | +-a always,exit -F arch=b64 -S semctl -k Inter-Process_Communication 2026-06-19 15:44:23.970804 | ubuntu-noble | +-a always,exit -F arch=b64 -S semget -k Inter-Process_Communication 2026-06-19 15:44:23.970921 | ubuntu-noble | +-a always,exit -F arch=b64 -S semop -k Inter-Process_Communication 2026-06-19 15:44:23.971041 | ubuntu-noble | +-a always,exit -F arch=b64 -S semtimedop -k Inter-Process_Communication 2026-06-19 15:44:23.971148 | ubuntu-noble | + 2026-06-19 15:44:23.971261 | ubuntu-noble | +## shmctl 2026-06-19 15:44:23.971393 | ubuntu-noble | +#-a always,exit -S ipc -F a0=24 -k Inter-Process_Communication 2026-06-19 15:44:23.971531 | ubuntu-noble | +## shmget 2026-06-19 15:44:23.971651 | ubuntu-noble | +#-a always,exit -S ipc -F a0=23 -k Inter-Process_Communication 2026-06-19 15:44:23.971766 | ubuntu-noble | +## Use these lines on x86_64, ia64 instead 2026-06-19 15:44:23.971883 | ubuntu-noble | +-a always,exit -F arch=b64 -S shmctl -k Inter-Process_Communication 2026-06-19 15:44:23.972000 | ubuntu-noble | +-a always,exit -F arch=b64 -S shmget -k Inter-Process_Communication 2026-06-19 15:44:23.972107 | ubuntu-noble | + 2026-06-19 15:44:23.972226 | ubuntu-noble | +# High Volume Events ---------------------------------------------------------- 2026-06-19 15:44:23.972347 | ubuntu-noble | + 2026-06-19 15:44:23.972469 | ubuntu-noble | +## Disable these rules if they create too many events in your environment 2026-06-19 15:44:23.972587 | ubuntu-noble | + 2026-06-19 15:44:23.972699 | ubuntu-noble | +## Common Shells 2026-06-19 15:44:23.972814 | ubuntu-noble | +-w /bin/bash -p x -k susp_shell 2026-06-19 15:44:23.972930 | ubuntu-noble | +-w /bin/dash -p x -k susp_shell 2026-06-19 15:44:23.973045 | ubuntu-noble | +-w /bin/busybox -p x -k susp_shell 2026-06-19 15:44:23.973158 | ubuntu-noble | +-w /bin/zsh -p x -k susp_shell 2026-06-19 15:44:23.973272 | ubuntu-noble | +-w /bin/sh -p x -k susp_shell 2026-06-19 15:44:23.973397 | ubuntu-noble | +-w /bin/ksh -p x -k susp_shell 2026-06-19 15:44:23.973529 | ubuntu-noble | + 2026-06-19 15:44:23.973645 | ubuntu-noble | +## Root command executions 2026-06-19 15:44:23.974333 | ubuntu-noble | +-a always,exit -F arch=b64 -F euid=0 -F auid>=1000 -F auid!=-1 -S execve -k rootcmd 2026-06-19 15:44:23.974343 | ubuntu-noble | + 2026-06-19 15:44:23.974348 | ubuntu-noble | +## File Deletion Events by User 2026-06-19 15:44:23.974352 | ubuntu-noble | +-a always,exit -F arch=b64 -S rmdir -S unlink -S unlinkat -S rename -S renameat -F auid>=1000 -F auid!=-1 -k delete 2026-06-19 15:44:23.974356 | ubuntu-noble | + 2026-06-19 15:44:23.974359 | ubuntu-noble | +## File Access 2026-06-19 15:44:23.974385 | ubuntu-noble | +### Unauthorized Access (unsuccessful) 2026-06-19 15:44:23.974521 | ubuntu-noble | +-a always,exit -F arch=b64 -S creat -S open -S openat -S open_by_handle_at -S truncate -S ftruncate -F exit=-EACCES -F auid>=1000 -F auid!=-1 -k file_access 2026-06-19 15:44:23.974644 | ubuntu-noble | +-a always,exit -F arch=b64 -S creat -S open -S openat -S open_by_handle_at -S truncate -S ftruncate -F exit=-EPERM -F auid>=1000 -F auid!=-1 -k file_access 2026-06-19 15:44:23.974754 | ubuntu-noble | + 2026-06-19 15:44:23.974868 | ubuntu-noble | +### Unsuccessful Creation 2026-06-19 15:44:23.974986 | ubuntu-noble | +-a always,exit -F arch=b64 -S mkdir,creat,link,symlink,mknod,mknodat,linkat,symlinkat -F exit=-EACCES -k file_creation 2026-06-19 15:44:23.975105 | ubuntu-noble | +-a always,exit -F arch=b64 -S mkdir,link,symlink,mkdirat -F exit=-EPERM -k file_creation 2026-06-19 15:44:23.975213 | ubuntu-noble | + 2026-06-19 15:44:23.975338 | ubuntu-noble | +### Unsuccessful Modification 2026-06-19 15:44:23.975463 | ubuntu-noble | +-a always,exit -F arch=b64 -S rename -S renameat -S truncate -S chmod -S setxattr -S lsetxattr -S removexattr -S lremovexattr -F exit=-EACCES -k file_modification 2026-06-19 15:44:23.975594 | ubuntu-noble | +-a always,exit -F arch=b64 -S rename -S renameat -S truncate -S chmod -S setxattr -S lsetxattr -S removexattr -S lremovexattr -F exit=-EPERM -k file_modification 2026-06-19 15:44:23.975701 | ubuntu-noble | + 2026-06-19 15:44:23.975813 | ubuntu-noble | +## 32bit API Exploitation 2026-06-19 15:44:23.975930 | ubuntu-noble | +### If you are on a 64 bit platform, everything _should_ be running 2026-06-19 15:44:23.976046 | ubuntu-noble | +### in 64 bit mode. This rule will detect any use of the 32 bit syscalls 2026-06-19 15:44:23.976162 | ubuntu-noble | +### because this might be a sign of someone exploiting a hole in the 32 2026-06-19 15:44:23.976273 | ubuntu-noble | +### bit API. 2026-06-19 15:44:23.976404 | ubuntu-noble | +-a always,exit -F arch=b32 -S all -k 32bit_api 2026-06-19 15:44:23.976525 | ubuntu-noble | + 2026-06-19 15:44:23.976642 | ubuntu-noble | +# Make The Configuration Immutable -------------------------------------------- 2026-06-19 15:44:23.976749 | ubuntu-noble | + 2026-06-19 15:44:23.976859 | ubuntu-noble | +##-e 2 2026-06-19 15:44:23.976967 | ubuntu-noble | 2026-06-19 15:44:23.977183 | ubuntu-noble | changed: [molecule-auditd] => (item=20-neo23x0.rules) => {"ansible_loop_var": "item", "changed": true, "checksum": "9f99ce5c4f891fbf3e2bce06ed4cb97fb9e01f41", "dest": "/etc/audit/rules.d/20-neo23x0.rules", "gid": 0, "group": "root", "item": "20-neo23x0.rules", "md5sum": "6ac57206fd77de34805c3f4d50ef8b1d", "mode": "0644", "owner": "root", "size": 27367, "src": "/home/zuul/.ansible/tmp/ansible-tmp-1781883862.7739275-2522-182340324505306/.source.rules", "state": "file", "uid": 0} 2026-06-19 15:44:23.977303 | ubuntu-noble | 2026-06-19 15:44:23.977438 | ubuntu-noble | TASK [auditd : Manage auditd service] ****************************************** 2026-06-19 15:44:24.050725 | debian-bookworm | ok: [molecule-auditd] => {"changed": false, "enabled": true, "name": "auditd", "state": "started", "status": {"ActiveEnterTimestamp": "Fri 2026-06-19 15:44:15 UTC", "ActiveEnterTimestampMonotonic": "260296723", "ActiveExitTimestampMonotonic": "0", "ActiveState": "active", "After": "systemd-tmpfiles-setup.service system.slice local-fs.target systemd-journald.socket", "AllowIsolate": "no", "AssertResult": "yes", "AssertTimestamp": "Fri 2026-06-19 15:44:15 UTC", "AssertTimestampMonotonic": "260231325", "Before": "sysinit.target ssh.service shutdown.target systemd-update-utmp.service", "BlockIOAccounting": "no", "BlockIOWeight": "[not set]", "CPUAccounting": "yes", "CPUAffinityFromNUMA": "no", "CPUQuotaPerSecUSec": "infinity", "CPUQuotaPeriodUSec": "infinity", "CPUSchedulingPolicy": "0", "CPUSchedulingPriority": "0", "CPUSchedulingResetOnFork": "no", "CPUShares": "[not set]", "CPUUsageNSec": "48325000", "CPUWeight": "[not set]", "CacheDirectoryMode": "0755", "CanFreeze": "yes", "CanIsolate": "no", "CanReload": "no", "CanStart": "yes", "CanStop": "yes", "CapabilityBoundingSet": "cap_chown cap_dac_override cap_dac_read_search cap_fowner cap_fsetid cap_kill cap_setgid cap_setuid cap_setpcap cap_linux_immutable cap_net_bind_service cap_net_broadcast cap_net_admin cap_net_raw cap_ipc_lock cap_ipc_owner cap_sys_rawio cap_sys_chroot cap_sys_ptrace cap_sys_pacct cap_sys_admin cap_sys_boot cap_sys_nice cap_sys_resource cap_sys_time cap_sys_tty_config cap_mknod cap_lease cap_audit_write cap_audit_control cap_setfcap cap_mac_override cap_mac_admin cap_syslog cap_wake_alarm cap_block_suspend cap_audit_read cap_perfmon cap_bpf cap_checkpoint_restore", "CleanResult": "success", "CollectMode": "inactive", "ConditionResult": "yes", "ConditionTimestamp": "Fri 2026-06-19 15:44:15 UTC", "ConditionTimestampMonotonic": "260231246", "ConfigurationDirectoryMode": "0755", "Conflicts": "shutdown.target", "ControlGroup": "/system.slice/auditd.service", "ControlGroupId": "3211", "ControlPID": "0", "CoredumpFilter": "0x33", "DefaultDependencies": "no", "DefaultMemoryLow": "0", "DefaultMemoryMin": "0", "Delegate": "no", "Description": "Security Auditing Service", "DevicePolicy": "auto", "Documentation": "\"man:auditd(8)\" https://github.com/linux-audit/audit-documentation", "DynamicUser": "no", "ExecMainCode": "0", "ExecMainExitTimestampMonotonic": "0", "ExecMainPID": "2424", "ExecMainStartTimestamp": "Fri 2026-06-19 15:44:15 UTC", "ExecMainStartTimestampMonotonic": "260264914", "ExecMainStatus": "0", "ExecStart": "{ path=/sbin/auditd ; argv[]=/sbin/auditd ; ignore_errors=no ; start_time=[Fri 2026-06-19 15:44:15 UTC] ; stop_time=[Fri 2026-06-19 15:44:15 UTC] ; pid=2423 ; code=exited ; status=0 }", "ExecStartEx": "{ path=/sbin/auditd ; argv[]=/sbin/auditd ; flags= ; start_time=[Fri 2026-06-19 15:44:15 UTC] ; stop_time=[Fri 2026-06-19 15:44:15 UTC] ; pid=2423 ; code=exited ; status=0 }", "ExecStartPost": "{ path=/sbin/augenrules ; argv[]=/sbin/augenrules --load ; ignore_errors=yes ; start_time=[Fri 2026-06-19 15:44:15 UTC] ; stop_time=[Fri 2026-06-19 15:44:15 UTC] ; pid=2427 ; code=exited ; status=0 }", "ExecStartPostEx": "{ path=/sbin/augenrules ; argv[]=/sbin/augenrules --load ; flags=ignore-failure ; start_time=[Fri 2026-06-19 15:44:15 UTC] ; stop_time=[Fri 2026-06-19 15:44:15 UTC] ; pid=2427 ; code=exited ; status=0 }", "ExitType": "main", "FailureAction": "none", "FileDescriptorStoreMax": "0", "FinalKillSignal": "9", "FragmentPath": "/lib/systemd/system/auditd.service", "FreezerState": "running", "GID": "[not set]", "GuessMainPID": "yes", "IOAccounting": "no", "IOReadBytes": "18446744073709551615", "IOReadOperations": "18446744073709551615", "IOSchedulingClass": "2", "IOSchedulingPriority": "4", "IOWeight": "[not set]", "IOWriteBytes": "18446744073709551615", "IOWriteOperations": "18446744073709551615", "IPAccounting": "no", "IPEgressBytes": "[no data]", "IPEgressPackets": "[no data]", "IPIngressBytes": "[no data]", "IPIngressPackets": "[no data]", "Id": "auditd.service", "IgnoreOnIsolate": "no", "IgnoreSIGPIPE": "yes", "InactiveEnterTimestampMonotonic": "0", "InactiveExitTimestamp": "Fri 2026-06-19 15:44:15 UTC", "InactiveExitTimestampMonotonic": "260249446", "InvocationID": "7dee96f3766d4c61b1f86d5e134fb199", "JobRunningTimeoutUSec": "infinity", "JobTimeoutAction": "none", "JobTimeoutUSec": "infinity", "KeyringMode": "private", "KillMode": "control-group", "KillSignal": "15", "LimitAS": "infinity", "LimitASSoft": "infinity", "LimitCORE": "infinity", "LimitCORESoft": "0", "LimitCPU": "infinity", "LimitCPUSoft": "infinity", "LimitDATA": "infinity", "LimitDATASoft": "infinity", "LimitFSIZE": "infinity", "LimitFSIZESoft": "infinity", "LimitLOCKS": "infinity", "LimitLOCKSSoft": "infinity", "LimitMEMLOCK": "8388608", "LimitMEMLOCKSoft": "8388608", "LimitMSGQUEUE": "819200", "LimitMSGQUEUESoft": "819200", "LimitNICE": "0", "LimitNICESoft": "0", "LimitNOFILE": "524288", "LimitNOFILESoft": "1024", "LimitNPROC": "15480", "LimitNPROCSoft": "15480", "LimitRSS": "infinity", "LimitRSSSoft": "infinity", "LimitRTPRIO": "0", "LimitRTPRIOSoft": "0", "LimitRTTIME": "infinity", "LimitRTTIMESoft": "infinity", "LimitSIGPENDING": "15480", "LimitSIGPENDINGSoft": "15480", "LimitSTACK": "infinity", "LimitSTACKSoft": "8388608", "LoadState": "loaded", "LockPersonality": "yes", "LogLevelMax": "-1", "LogRateLimitBurst": "0", "LogRateLimitIntervalUSec": "0", "LogsDirectoryMode": "0755", "MainPID": "2424", "ManagedOOMMemoryPressure": "auto", "ManagedOOMMemoryPressureLimit": "0", "ManagedOOMPreference": "none", "ManagedOOMSwap": "auto", "MemoryAccounting": "yes", "MemoryAvailable": "infinity", "MemoryCurrent": "708608", "MemoryDenyWriteExecute": "yes", "MemoryHigh": "infinity", "MemoryLimit": "infinity", "MemoryLow": "0", "MemoryMax": "infinity", "MemoryMin": "0", "MemorySwapMax": "infinity", "MountAPIVFS": "no", "NFileDescriptorStore": "0", "NRestarts": "0", "NUMAPolicy": "n/a", "Names": "auditd.service", "NeedDaemonReload": "no", "Nice": "0", "NoNewPrivileges": "no", "NonBlocking": "no", "NotifyAccess": "none", "OOMPolicy": "stop", "OOMScoreAdjust": "0", "OnFailureJobMode": "replace", "OnSuccessJobMode": "fail", "PIDFile": "/run/auditd.pid", "Perpetual": "no", "PrivateDevices": "no", "PrivateIPC": "no", "PrivateMounts": "no", "PrivateNetwork": "no", "PrivateTmp": "no", "PrivateUsers": "no", "ProcSubset": "all", "ProtectClock": "no", "ProtectControlGroups": "yes", "ProtectHome": "no", "ProtectHostname": "no", "ProtectKernelLogs": "no", "ProtectKernelModules": "yes", "ProtectKernelTunables": "no", "ProtectProc": "default", "ProtectSystem": "no", "RefuseManualStart": "no", "RefuseManualStop": "no", "ReloadResult": "success", "RemainAfterExit": "no", "RemoveIPC": "no", "Requires": "system.slice", "Restart": "on-failure", "RestartKillSignal": "15", "RestartPreventExitStatus": "2 4 6", "RestartUSec": "100ms", "RestrictNamespaces": "no", "RestrictRealtime": "yes", "RestrictSUIDSGID": "no", "Result": "success", "RootDirectoryStartOnly": "no", "RuntimeDirectoryMode": "0755", "RuntimeDirectoryPreserve": "no", "RuntimeMaxUSec": "infinity", "RuntimeRandomizedExtraUSec": "0", "SameProcessGroup": "no", "SecureBits": "0", "SendSIGHUP": "no", "SendSIGKILL": "yes", "Slice": "system.slice", "StandardError": "inherit", "StandardInput": "null", "StandardOutput": "journal", "StartLimitAction": "none", "StartLimitBurst": "5", "StartLimitIntervalUSec": "10s", "StartupBlockIOWeight": "[not set]", "StartupCPUShares": "[not set]", "StartupCPUWeight": "[not set]", "StartupIOWeight": "[not set]", "StateChangeTimestamp": "Fri 2026-06-19 15:44:15 UTC", "StateChangeTimestampMonotonic": "260296723", "StateDirectoryMode": "0755", "StatusErrno": "0", "StopWhenUnneeded": "no", "SubState": "running", "SuccessAction": "none", "SyslogFacility": "3", "SyslogLevel": "6", "SyslogLevelPrefix": "yes", "SyslogPriority": "30", "SystemCallErrorNumber": "2147483646", "TTYReset": "no", "TTYVHangup": "no", "TTYVTDisallocate": "no", "TasksAccounting": "yes", "TasksCurrent": "2", "TasksMax": "4644", "TimeoutAbortUSec": "1min 30s", "TimeoutCleanUSec": "infinity", "TimeoutStartFailureMode": "terminate", "TimeoutStartUSec": "1min 30s", "TimeoutStopFailureMode": "terminate", "TimeoutStopUSec": "1min 30s", "TimerSlackNSec": "50000", "Transient": "no", "Type": "forking", "UID": "[not set]", "UMask": "0022", "UnitFilePreset": "enabled", "UnitFileState": "enabled", "UtmpMode": "init", "WantedBy": "multi-user.target", "WatchdogSignal": "6", "WatchdogTimestampMonotonic": "0", "WatchdogUSec": "0"}} 2026-06-19 15:44:24.056492 | debian-bookworm | 2026-06-19 15:44:24.056526 | debian-bookworm | TASK [auditd : List existing rules files] ************************************** 2026-06-19 15:44:24.688399 | debian-bookworm | ok: [molecule-auditd] => {"changed": false, "cmd": ["find", "/etc/audit/rules.d", "-type", "f", "-printf", "%f\n"], "delta": "0:00:00.008541", "end": "2026-06-19 15:44:24.631414", "msg": "", "rc": 0, "start": "2026-06-19 15:44:24.622873", "stderr": "", "stderr_lines": [], "stdout": "20-neo23x0.rules\naudit.rules", "stdout_lines": ["20-neo23x0.rules", "audit.rules"]} 2026-06-19 15:44:24.688470 | debian-bookworm | 2026-06-19 15:44:24.688478 | debian-bookworm | TASK [auditd : Remove unmanaged rules files] *********************************** 2026-06-19 15:44:24.875248 | ubuntu-noble | ok: [molecule-auditd] => {"changed": false, "enabled": true, "name": "auditd", "state": "started", "status": {"ActiveEnterTimestamp": "Fri 2026-06-19 15:44:16 UTC", "ActiveEnterTimestampMonotonic": "233443315", "ActiveExitTimestampMonotonic": "0", "ActiveState": "active", "After": "local-fs.target systemd-journald.socket systemd-tmpfiles-setup.service system.slice", "AllowIsolate": "no", "AssertResult": "yes", "AssertTimestamp": "Fri 2026-06-19 15:44:16 UTC", "AssertTimestampMonotonic": "233382839", "Before": "sysinit.target ssh.service shutdown.target systemd-update-utmp.service", "BlockIOAccounting": "no", "BlockIOWeight": "[not set]", "CPUAccounting": "yes", "CPUAffinityFromNUMA": "no", "CPUQuotaPerSecUSec": "infinity", "CPUQuotaPeriodUSec": "infinity", "CPUSchedulingPolicy": "0", "CPUSchedulingPriority": "0", "CPUSchedulingResetOnFork": "no", "CPUShares": "[not set]", "CPUUsageNSec": "36787000", "CPUWeight": "[not set]", "CacheDirectoryMode": "0755", "CanFreeze": "yes", "CanIsolate": "no", "CanReload": "no", "CanStart": "yes", "CanStop": "yes", "CapabilityBoundingSet": "cap_chown cap_dac_override cap_dac_read_search cap_fowner cap_fsetid cap_kill cap_setgid cap_setuid cap_setpcap cap_linux_immutable cap_net_bind_service cap_net_broadcast cap_net_admin cap_net_raw cap_ipc_lock cap_ipc_owner cap_sys_rawio cap_sys_chroot cap_sys_ptrace cap_sys_pacct cap_sys_admin cap_sys_boot cap_sys_nice cap_sys_resource cap_sys_time cap_sys_tty_config cap_mknod cap_lease cap_audit_write cap_audit_control cap_setfcap cap_mac_override cap_mac_admin cap_syslog cap_wake_alarm cap_block_suspend cap_audit_read cap_perfmon cap_bpf cap_checkpoint_restore", "CleanResult": "success", "CollectMode": "inactive", "ConditionResult": "yes", "ConditionTimestamp": "Fri 2026-06-19 15:44:16 UTC", "ConditionTimestampMonotonic": "233382803", "ConfigurationDirectoryMode": "0755", "Conflicts": "shutdown.target", "ControlGroup": "/system.slice/auditd.service", "ControlGroupId": "3826", "ControlPID": "0", "CoredumpFilter": "0x33", "CoredumpReceive": "no", "DefaultDependencies": "no", "DefaultMemoryLow": "0", "DefaultMemoryMin": "0", "DefaultStartupMemoryLow": "0", "Delegate": "no", "Description": "Security Auditing Service", "DevicePolicy": "auto", "Documentation": "\"man:auditd(8)\" https://github.com/linux-audit/audit-documentation", "DynamicUser": "no", "ExecMainCode": "0", "ExecMainExitTimestampMonotonic": "0", "ExecMainPID": "2291", "ExecMainStartTimestamp": "Fri 2026-06-19 15:44:16 UTC", "ExecMainStartTimestampMonotonic": "233411624", "ExecMainStatus": "0", "ExecStart": "{ path=/sbin/auditd ; argv[]=/sbin/auditd ; ignore_errors=no ; start_time=[Fri 2026-06-19 15:44:16 UTC] ; stop_time=[Fri 2026-06-19 15:44:16 UTC] ; pid=2290 ; code=exited ; status=0 }", "ExecStartEx": "{ path=/sbin/auditd ; argv[]=/sbin/auditd ; flags= ; start_time=[Fri 2026-06-19 15:44:16 UTC] ; stop_time=[Fri 2026-06-19 15:44:16 UTC] ; pid=2290 ; code=exited ; status=0 }", "ExecStartPost": "{ path=/sbin/augenrules ; argv[]=/sbin/augenrules --load ; ignore_errors=yes ; start_time=[Fri 2026-06-19 15:44:16 UTC] ; stop_time=[Fri 2026-06-19 15:44:16 UTC] ; pid=2294 ; code=exited ; status=0 }", "ExecStartPostEx": "{ path=/sbin/augenrules ; argv[]=/sbin/augenrules --load ; flags=ignore-failure ; start_time=[Fri 2026-06-19 15:44:16 UTC] ; stop_time=[Fri 2026-06-19 15:44:16 UTC] ; pid=2294 ; code=exited ; status=0 }", "ExitType": "main", "ExtensionImagePolicy": "root=verity+signed+encrypted+unprotected+absent:usr=verity+signed+encrypted+unprotected+absent:home=encrypted+unprotected+absent:srv=encrypted+unprotected+absent:tmp=encrypted+unprotected+absent:var=encrypted+unprotected+absent", "FailureAction": "none", "FileDescriptorStoreMax": "0", "FileDescriptorStorePreserve": "restart", "FinalKillSignal": "9", "FragmentPath": "/usr/lib/systemd/system/auditd.service", "FreezerState": "running", "GID": "[not set]", "GuessMainPID": "yes", "IOAccounting": "no", "IOReadBytes": "[not set]", "IOReadOperations": "[not set]", "IOSchedulingClass": "2", "IOSchedulingPriority": "4", "IOWeight": "[not set]", "IOWriteBytes": "[not set]", "IOWriteOperations": "[not set]", "IPAccounting": "no", "IPEgressBytes": "[no data]", "IPEgressPackets": "[no data]", "IPIngressBytes": "[no data]", "IPIngressPackets": "[no data]", "Id": "auditd.service", "IgnoreOnIsolate": "no", "IgnoreSIGPIPE": "yes", "InactiveEnterTimestampMonotonic": "0", "InactiveExitTimestamp": "Fri 2026-06-19 15:44:16 UTC", "InactiveExitTimestampMonotonic": "233397295", "InvocationID": "a279b006052345c6b718e0b3a674403f", "JobRunningTimeoutUSec": "infinity", "JobTimeoutAction": "none", "JobTimeoutUSec": "infinity", "KeyringMode": "private", "KillMode": "control-group", "KillSignal": "15", "LimitAS": "infinity", "LimitASSoft": "infinity", "LimitCORE": "infinity", "LimitCORESoft": "0", "LimitCPU": "infinity", "LimitCPUSoft": "infinity", "LimitDATA": "infinity", "LimitDATASoft": "infinity", "LimitFSIZE": "infinity", "LimitFSIZESoft": "infinity", "LimitLOCKS": "infinity", "LimitLOCKSSoft": "infinity", "LimitMEMLOCK": "8388608", "LimitMEMLOCKSoft": "8388608", "LimitMSGQUEUE": "819200", "LimitMSGQUEUESoft": "819200", "LimitNICE": "0", "LimitNICESoft": "0", "LimitNOFILE": "524288", "LimitNOFILESoft": "1024", "LimitNPROC": "15372", "LimitNPROCSoft": "15372", "LimitRSS": "infinity", "LimitRSSSoft": "infinity", "LimitRTPRIO": "0", "LimitRTPRIOSoft": "0", "LimitRTTIME": "infinity", "LimitRTTIMESoft": "infinity", "LimitSIGPENDING": "15372", "LimitSIGPENDINGSoft": "15372", "LimitSTACK": "infinity", "LimitSTACKSoft": "8388608", "LoadState": "loaded", "LockPersonality": "yes", "LogLevelMax": "-1", "LogRateLimitBurst": "0", "LogRateLimitIntervalUSec": "0", "LogsDirectoryMode": "0755", "MainPID": "2291", "ManagedOOMMemoryPressure": "auto", "ManagedOOMMemoryPressureLimit": "0", "ManagedOOMPreference": "none", "ManagedOOMSwap": "auto", "MemoryAccounting": "yes", "MemoryAvailable": "3510984704", "MemoryCurrent": "503808", "MemoryDenyWriteExecute": "yes", "MemoryHigh": "infinity", "MemoryKSM": "no", "MemoryLimit": "infinity", "MemoryLow": "0", "MemoryMax": "infinity", "MemoryMin": "0", "MemoryPeak": "2002944", "MemoryPressureThresholdUSec": "200ms", "MemoryPressureWatch": "auto", "MemorySwapCurrent": "0", "MemorySwapMax": "infinity", "MemorySwapPeak": "0", "MemoryZSwapCurrent": "0", "MemoryZSwapMax": "infinity", "MountAPIVFS": "no", "MountImagePolicy": "root=verity+signed+encrypted+unprotected+absent:usr=verity+signed+encrypted+unprotected+absent:home=encrypted+unprotected+absent:srv=encrypted+unprotected+absent:tmp=encrypted+unprotected+absent:var=encrypted+unprotected+absent", "NFileDescriptorStore": "0", "NRestarts": "0", "NUMAPolicy": "n/a", "Names": "auditd.service", "NeedDaemonReload": "no", "Nice": "0", "NoNewPrivileges": "no", "NonBlocking": "no", "NotifyAccess": "none", "OOMPolicy": "stop", "OOMScoreAdjust": "0", "OnFailureJobMode": "replace", "OnSuccessJobMode": "fail", "PIDFile": "/run/auditd.pid", "Perpetual": "no", "PrivateDevices": "no", "PrivateIPC": "no", "PrivateMounts": "no", "PrivateNetwork": "no", "PrivateTmp": "no", "PrivateUsers": "no", "ProcSubset": "all", "ProtectClock": "no", "ProtectControlGroups": "no", "ProtectHome": "no", "ProtectHostname": "no", "ProtectKernelLogs": "no", "ProtectKernelModules": "yes", "ProtectKernelTunables": "no", "ProtectProc": "default", "ProtectSystem": "no", "RefuseManualStart": "no", "RefuseManualStop": "no", "ReloadResult": "success", "ReloadSignal": "1", "RemainAfterExit": "no", "RemoveIPC": "no", "Requires": "system.slice", "Restart": "on-failure", "RestartKillSignal": "15", "RestartMaxDelayUSec": "infinity", "RestartMode": "normal", "RestartPreventExitStatus": "2 4 6", "RestartSteps": "0", "RestartUSec": "100ms", "RestartUSecNext": "100ms", "RestrictNamespaces": "no", "RestrictRealtime": "yes", "RestrictSUIDSGID": "no", "Result": "success", "RootDirectoryStartOnly": "no", "RootEphemeral": "no", "RootImagePolicy": "root=verity+signed+encrypted+unprotected+absent:usr=verity+signed+encrypted+unprotected+absent:home=encrypted+unprotected+absent:srv=encrypted+unprotected+absent:tmp=encrypted+unprotected+absent:var=encrypted+unprotected+absent", "RuntimeDirectoryMode": "0755", "RuntimeDirectoryPreserve": "no", "RuntimeMaxUSec": "infinity", "RuntimeRandomizedExtraUSec": "0", "SameProcessGroup": "no", "SecureBits": "0", "SendSIGHUP": "no", "SendSIGKILL": "yes", "SetLoginEnvironment": "no", "Slice": "system.slice", "StandardError": "inherit", "StandardInput": "null", "StandardOutput": "journal", "StartLimitAction": "none", "StartLimitBurst": "5", "StartLimitIntervalUSec": "10s", "StartupBlockIOWeight": "[not set]", "StartupCPUShares": "[not set]", "StartupCPUWeight": "[not set]", "StartupIOWeight": "[not set]", "StartupMemoryHigh": "infinity", "StartupMemoryLow": "0", "StartupMemoryMax": "infinity", "StartupMemorySwapMax": "infinity", "StartupMemoryZSwapMax": "infinity", "StateChangeTimestamp": "Fri 2026-06-19 15:44:16 UTC", "StateChangeTimestampMonotonic": "233443315", "StateDirectoryMode": "0755", "StatusErrno": "0", "StopWhenUnneeded": "no", "SubState": "running", "SuccessAction": "none", "SurviveFinalKillSignal": "no", "SyslogFacility": "3", "SyslogLevel": "6", "SyslogLevelPrefix": "yes", "SyslogPriority": "30", "SystemCallErrorNumber": "2147483646", "TTYReset": "no", "TTYVHangup": "no", "TTYVTDisallocate": "no", "TasksAccounting": "yes", "TasksCurrent": "2", "TasksMax": "4611", "TimeoutAbortUSec": "1min 30s", "TimeoutCleanUSec": "infinity", "TimeoutStartFailureMode": "terminate", "TimeoutStartUSec": "1min 30s", "TimeoutStopFailureMode": "terminate", "TimeoutStopUSec": "1min 30s", "TimerSlackNSec": "50000", "Transient": "no", "Type": "forking", "UID": "[not set]", "UMask": "0022", "UnitFilePreset": "enabled", "UnitFileState": "enabled", "UtmpMode": "init", "WantedBy": "multi-user.target", "WatchdogSignal": "6", "WatchdogTimestampMonotonic": "0", "WatchdogUSec": "0"}} 2026-06-19 15:44:24.882861 | ubuntu-noble | 2026-06-19 15:44:24.883043 | ubuntu-noble | TASK [auditd : List existing rules files] ************************************** 2026-06-19 15:44:25.123537 | debian-bookworm | skipping: [molecule-auditd] => (item=20-neo23x0.rules) => {"ansible_loop_var": "item", "changed": false, "false_condition": "item not in auditd_rules_files", "item": "20-neo23x0.rules", "skip_reason": "Conditional result was False"} 2026-06-19 15:44:25.123661 | debian-bookworm | --- before 2026-06-19 15:44:25.123671 | debian-bookworm | +++ after 2026-06-19 15:44:25.123677 | debian-bookworm | @@ -1,4 +1,4 @@ 2026-06-19 15:44:25.123684 | debian-bookworm | { 2026-06-19 15:44:25.123689 | debian-bookworm | "path": "/etc/audit/rules.d/audit.rules", 2026-06-19 15:44:25.123697 | debian-bookworm | - "state": "file" 2026-06-19 15:44:25.123703 | debian-bookworm | + "state": "absent" 2026-06-19 15:44:25.123708 | debian-bookworm | } 2026-06-19 15:44:25.123713 | debian-bookworm | 2026-06-19 15:44:25.123720 | debian-bookworm | changed: [molecule-auditd] => (item=audit.rules) => {"ansible_loop_var": "item", "changed": true, "item": "audit.rules", "path": "/etc/audit/rules.d/audit.rules", "state": "absent"} 2026-06-19 15:44:25.123756 | debian-bookworm | 2026-06-19 15:44:25.123802 | debian-bookworm | RUNNING HANDLER [auditd : Restart auditd service] ****************************** 2026-06-19 15:44:25.440157 | ubuntu-noble | ok: [molecule-auditd] => {"changed": false, "cmd": ["find", "/etc/audit/rules.d", "-type", "f", "-printf", "%f\n"], "delta": "0:00:00.007782", "end": "2026-06-19 15:44:25.389364", "msg": "", "rc": 0, "start": "2026-06-19 15:44:25.381582", "stderr": "", "stderr_lines": [], "stdout": "20-neo23x0.rules\naudit.rules", "stdout_lines": ["20-neo23x0.rules", "audit.rules"]} 2026-06-19 15:44:25.440206 | ubuntu-noble | 2026-06-19 15:44:25.440215 | ubuntu-noble | TASK [auditd : Remove unmanaged rules files] *********************************** 2026-06-19 15:44:26.020682 | debian-bookworm | changed: [molecule-auditd] => {"changed": true, "name": "auditd", "state": "started", "status": {"ActiveEnterTimestamp": "Fri 2026-06-19 15:44:15 UTC", "ActiveEnterTimestampMonotonic": "260296723", "ActiveExitTimestampMonotonic": "0", "ActiveState": "active", "After": "systemd-tmpfiles-setup.service system.slice local-fs.target systemd-journald.socket", "AllowIsolate": "no", "AssertResult": "yes", "AssertTimestamp": "Fri 2026-06-19 15:44:15 UTC", "AssertTimestampMonotonic": "260231325", "Before": "sysinit.target ssh.service shutdown.target systemd-update-utmp.service", "BlockIOAccounting": "no", "BlockIOWeight": "[not set]", "CPUAccounting": "yes", "CPUAffinityFromNUMA": "no", "CPUQuotaPerSecUSec": "infinity", "CPUQuotaPeriodUSec": "infinity", "CPUSchedulingPolicy": "0", "CPUSchedulingPriority": "0", "CPUSchedulingResetOnFork": "no", "CPUShares": "[not set]", "CPUUsageNSec": "49736000", "CPUWeight": "[not set]", "CacheDirectoryMode": "0755", "CanFreeze": "yes", "CanIsolate": "no", "CanReload": "no", "CanStart": "yes", "CanStop": "yes", "CapabilityBoundingSet": "cap_chown cap_dac_override cap_dac_read_search cap_fowner cap_fsetid cap_kill cap_setgid cap_setuid cap_setpcap cap_linux_immutable cap_net_bind_service cap_net_broadcast cap_net_admin cap_net_raw cap_ipc_lock cap_ipc_owner cap_sys_rawio cap_sys_chroot cap_sys_ptrace cap_sys_pacct cap_sys_admin cap_sys_boot cap_sys_nice cap_sys_resource cap_sys_time cap_sys_tty_config cap_mknod cap_lease cap_audit_write cap_audit_control cap_setfcap cap_mac_override cap_mac_admin cap_syslog cap_wake_alarm cap_block_suspend cap_audit_read cap_perfmon cap_bpf cap_checkpoint_restore", "CleanResult": "success", "CollectMode": "inactive", "ConditionResult": "yes", "ConditionTimestamp": "Fri 2026-06-19 15:44:15 UTC", "ConditionTimestampMonotonic": "260231246", "ConfigurationDirectoryMode": "0755", "Conflicts": "shutdown.target", "ControlGroup": "/system.slice/auditd.service", "ControlGroupId": "3211", "ControlPID": "0", "CoredumpFilter": "0x33", "DefaultDependencies": "no", "DefaultMemoryLow": "0", "DefaultMemoryMin": "0", "Delegate": "no", "Description": "Security Auditing Service", "DevicePolicy": "auto", "Documentation": "\"man:auditd(8)\" https://github.com/linux-audit/audit-documentation", "DynamicUser": "no", "ExecMainCode": "0", "ExecMainExitTimestampMonotonic": "0", "ExecMainPID": "2424", "ExecMainStartTimestamp": "Fri 2026-06-19 15:44:15 UTC", "ExecMainStartTimestampMonotonic": "260264914", "ExecMainStatus": "0", "ExecStart": "{ path=/sbin/auditd ; argv[]=/sbin/auditd ; ignore_errors=no ; start_time=[Fri 2026-06-19 15:44:15 UTC] ; stop_time=[Fri 2026-06-19 15:44:15 UTC] ; pid=2423 ; code=exited ; status=0 }", "ExecStartEx": "{ path=/sbin/auditd ; argv[]=/sbin/auditd ; flags= ; start_time=[Fri 2026-06-19 15:44:15 UTC] ; stop_time=[Fri 2026-06-19 15:44:15 UTC] ; pid=2423 ; code=exited ; status=0 }", "ExecStartPost": "{ path=/sbin/augenrules ; argv[]=/sbin/augenrules --load ; ignore_errors=yes ; start_time=[Fri 2026-06-19 15:44:15 UTC] ; stop_time=[Fri 2026-06-19 15:44:15 UTC] ; pid=2427 ; code=exited ; status=0 }", "ExecStartPostEx": "{ path=/sbin/augenrules ; argv[]=/sbin/augenrules --load ; flags=ignore-failure ; start_time=[Fri 2026-06-19 15:44:15 UTC] ; stop_time=[Fri 2026-06-19 15:44:15 UTC] ; pid=2427 ; code=exited ; status=0 }", "ExitType": "main", "FailureAction": "none", "FileDescriptorStoreMax": "0", "FinalKillSignal": "9", "FragmentPath": "/lib/systemd/system/auditd.service", "FreezerState": "running", "GID": "[not set]", "GuessMainPID": "yes", "IOAccounting": "no", "IOReadBytes": "18446744073709551615", "IOReadOperations": "18446744073709551615", "IOSchedulingClass": "2", "IOSchedulingPriority": "4", "IOWeight": "[not set]", "IOWriteBytes": "18446744073709551615", "IOWriteOperations": "18446744073709551615", "IPAccounting": "no", "IPEgressBytes": "[no data]", "IPEgressPackets": "[no data]", "IPIngressBytes": "[no data]", "IPIngressPackets": "[no data]", "Id": "auditd.service", "IgnoreOnIsolate": "no", "IgnoreSIGPIPE": "yes", "InactiveEnterTimestampMonotonic": "0", "InactiveExitTimestamp": "Fri 2026-06-19 15:44:15 UTC", "InactiveExitTimestampMonotonic": "260249446", "InvocationID": "7dee96f3766d4c61b1f86d5e134fb199", "JobRunningTimeoutUSec": "infinity", "JobTimeoutAction": "none", "JobTimeoutUSec": "infinity", "KeyringMode": "private", "KillMode": "control-group", "KillSignal": "15", "LimitAS": "infinity", "LimitASSoft": "infinity", "LimitCORE": "infinity", "LimitCORESoft": "0", "LimitCPU": "infinity", "LimitCPUSoft": "infinity", "LimitDATA": "infinity", "LimitDATASoft": "infinity", "LimitFSIZE": "infinity", "LimitFSIZESoft": "infinity", "LimitLOCKS": "infinity", "LimitLOCKSSoft": "infinity", "LimitMEMLOCK": "8388608", "LimitMEMLOCKSoft": "8388608", "LimitMSGQUEUE": "819200", "LimitMSGQUEUESoft": "819200", "LimitNICE": "0", "LimitNICESoft": "0", "LimitNOFILE": "524288", "LimitNOFILESoft": "1024", "LimitNPROC": "15480", "LimitNPROCSoft": "15480", "LimitRSS": "infinity", "LimitRSSSoft": "infinity", "LimitRTPRIO": "0", "LimitRTPRIOSoft": "0", "LimitRTTIME": "infinity", "LimitRTTIMESoft": "infinity", "LimitSIGPENDING": "15480", "LimitSIGPENDINGSoft": "15480", "LimitSTACK": "infinity", "LimitSTACKSoft": "8388608", "LoadState": "loaded", "LockPersonality": "yes", "LogLevelMax": "-1", "LogRateLimitBurst": "0", "LogRateLimitIntervalUSec": "0", "LogsDirectoryMode": "0755", "MainPID": "2424", "ManagedOOMMemoryPressure": "auto", "ManagedOOMMemoryPressureLimit": "0", "ManagedOOMPreference": "none", "ManagedOOMSwap": "auto", "MemoryAccounting": "yes", "MemoryAvailable": "infinity", "MemoryCurrent": "716800", "MemoryDenyWriteExecute": "yes", "MemoryHigh": "infinity", "MemoryLimit": "infinity", "MemoryLow": "0", "MemoryMax": "infinity", "MemoryMin": "0", "MemorySwapMax": "infinity", "MountAPIVFS": "no", "NFileDescriptorStore": "0", "NRestarts": "0", "NUMAPolicy": "n/a", "Names": "auditd.service", "NeedDaemonReload": "no", "Nice": "0", "NoNewPrivileges": "no", "NonBlocking": "no", "NotifyAccess": "none", "OOMPolicy": "stop", "OOMScoreAdjust": "0", "OnFailureJobMode": "replace", "OnSuccessJobMode": "fail", "PIDFile": "/run/auditd.pid", "Perpetual": "no", "PrivateDevices": "no", "PrivateIPC": "no", "PrivateMounts": "no", "PrivateNetwork": "no", "PrivateTmp": "no", "PrivateUsers": "no", "ProcSubset": "all", "ProtectClock": "no", "ProtectControlGroups": "yes", "ProtectHome": "no", "ProtectHostname": "no", "ProtectKernelLogs": "no", "ProtectKernelModules": "yes", "ProtectKernelTunables": "no", "ProtectProc": "default", "ProtectSystem": "no", "RefuseManualStart": "no", "RefuseManualStop": "no", "ReloadResult": "success", "RemainAfterExit": "no", "RemoveIPC": "no", "Requires": "system.slice", "Restart": "on-failure", "RestartKillSignal": "15", "RestartPreventExitStatus": "2 4 6", "RestartUSec": "100ms", "RestrictNamespaces": "no", "RestrictRealtime": "yes", "RestrictSUIDSGID": "no", "Result": "success", "RootDirectoryStartOnly": "no", "RuntimeDirectoryMode": "0755", "RuntimeDirectoryPreserve": "no", "RuntimeMaxUSec": "infinity", "RuntimeRandomizedExtraUSec": "0", "SameProcessGroup": "no", "SecureBits": "0", "SendSIGHUP": "no", "SendSIGKILL": "yes", "Slice": "system.slice", "StandardError": "inherit", "StandardInput": "null", "StandardOutput": "journal", "StartLimitAction": "none", "StartLimitBurst": "5", "StartLimitIntervalUSec": "10s", "StartupBlockIOWeight": "[not set]", "StartupCPUShares": "[not set]", "StartupCPUWeight": "[not set]", "StartupIOWeight": "[not set]", "StateChangeTimestamp": "Fri 2026-06-19 15:44:15 UTC", "StateChangeTimestampMonotonic": "260296723", "StateDirectoryMode": "0755", "StatusErrno": "0", "StopWhenUnneeded": "no", "SubState": "running", "SuccessAction": "none", "SyslogFacility": "3", "SyslogLevel": "6", "SyslogLevelPrefix": "yes", "SyslogPriority": "30", "SystemCallErrorNumber": "2147483646", "TTYReset": "no", "TTYVHangup": "no", "TTYVTDisallocate": "no", "TasksAccounting": "yes", "TasksCurrent": "2", "TasksMax": "4644", "TimeoutAbortUSec": "1min 30s", "TimeoutCleanUSec": "infinity", "TimeoutStartFailureMode": "terminate", "TimeoutStartUSec": "1min 30s", "TimeoutStopFailureMode": "terminate", "TimeoutStopUSec": "1min 30s", "TimerSlackNSec": "50000", "Transient": "no", "Type": "forking", "UID": "[not set]", "UMask": "0022", "UnitFilePreset": "enabled", "UnitFileState": "enabled", "UtmpMode": "init", "WantedBy": "multi-user.target", "WatchdogSignal": "6", "WatchdogTimestampMonotonic": "0", "WatchdogUSec": "0"}} 2026-06-19 15:44:26.029404 | debian-bookworm | 2026-06-19 15:44:26.029698 | debian-bookworm | RUNNING HANDLER [auditd : Generate auditd rules] ******************************* 2026-06-19 15:44:25.864778 | ubuntu-noble | skipping: [molecule-auditd] => (item=20-neo23x0.rules) => {"ansible_loop_var": "item", "changed": false, "false_condition": "item not in auditd_rules_files", "item": "20-neo23x0.rules", "skip_reason": "Conditional result was False"} 2026-06-19 15:44:25.866055 | ubuntu-noble | --- before 2026-06-19 15:44:25.866071 | ubuntu-noble | +++ after 2026-06-19 15:44:25.866076 | ubuntu-noble | @@ -1,4 +1,4 @@ 2026-06-19 15:44:25.866080 | ubuntu-noble | { 2026-06-19 15:44:25.866084 | ubuntu-noble | "path": "/etc/audit/rules.d/audit.rules", 2026-06-19 15:44:25.866088 | ubuntu-noble | - "state": "file" 2026-06-19 15:44:25.866092 | ubuntu-noble | + "state": "absent" 2026-06-19 15:44:25.866096 | ubuntu-noble | } 2026-06-19 15:44:25.866100 | ubuntu-noble | 2026-06-19 15:44:25.866105 | ubuntu-noble | changed: [molecule-auditd] => (item=audit.rules) => {"ansible_loop_var": "item", "changed": true, "item": "audit.rules", "path": "/etc/audit/rules.d/audit.rules", "state": "absent"} 2026-06-19 15:44:25.866110 | ubuntu-noble | 2026-06-19 15:44:25.866114 | ubuntu-noble | RUNNING HANDLER [auditd : Restart auditd service] ****************************** 2026-06-19 15:44:26.582787 | ubuntu-noble | changed: [molecule-auditd] => {"changed": true, "name": "auditd", "state": "started", "status": {"ActiveEnterTimestamp": "Fri 2026-06-19 15:44:16 UTC", "ActiveEnterTimestampMonotonic": "233443315", "ActiveExitTimestampMonotonic": "0", "ActiveState": "active", "After": "local-fs.target systemd-journald.socket systemd-tmpfiles-setup.service system.slice", "AllowIsolate": "no", "AssertResult": "yes", "AssertTimestamp": "Fri 2026-06-19 15:44:16 UTC", "AssertTimestampMonotonic": "233382839", "Before": "sysinit.target ssh.service shutdown.target systemd-update-utmp.service", "BlockIOAccounting": "no", "BlockIOWeight": "[not set]", "CPUAccounting": "yes", "CPUAffinityFromNUMA": "no", "CPUQuotaPerSecUSec": "infinity", "CPUQuotaPeriodUSec": "infinity", "CPUSchedulingPolicy": "0", "CPUSchedulingPriority": "0", "CPUSchedulingResetOnFork": "no", "CPUShares": "[not set]", "CPUUsageNSec": "37706000", "CPUWeight": "[not set]", "CacheDirectoryMode": "0755", "CanFreeze": "yes", "CanIsolate": "no", "CanReload": "no", "CanStart": "yes", "CanStop": "yes", "CapabilityBoundingSet": "cap_chown cap_dac_override cap_dac_read_search cap_fowner cap_fsetid cap_kill cap_setgid cap_setuid cap_setpcap cap_linux_immutable cap_net_bind_service cap_net_broadcast cap_net_admin cap_net_raw cap_ipc_lock cap_ipc_owner cap_sys_rawio cap_sys_chroot cap_sys_ptrace cap_sys_pacct cap_sys_admin cap_sys_boot cap_sys_nice cap_sys_resource cap_sys_time cap_sys_tty_config cap_mknod cap_lease cap_audit_write cap_audit_control cap_setfcap cap_mac_override cap_mac_admin cap_syslog cap_wake_alarm cap_block_suspend cap_audit_read cap_perfmon cap_bpf cap_checkpoint_restore", "CleanResult": "success", "CollectMode": "inactive", "ConditionResult": "yes", "ConditionTimestamp": "Fri 2026-06-19 15:44:16 UTC", "ConditionTimestampMonotonic": "233382803", "ConfigurationDirectoryMode": "0755", "Conflicts": "shutdown.target", "ControlGroup": "/system.slice/auditd.service", "ControlGroupId": "3826", "ControlPID": "0", "CoredumpFilter": "0x33", "CoredumpReceive": "no", "DefaultDependencies": "no", "DefaultMemoryLow": "0", "DefaultMemoryMin": "0", "DefaultStartupMemoryLow": "0", "Delegate": "no", "Description": "Security Auditing Service", "DevicePolicy": "auto", "Documentation": "\"man:auditd(8)\" https://github.com/linux-audit/audit-documentation", "DynamicUser": "no", "ExecMainCode": "0", "ExecMainExitTimestampMonotonic": "0", "ExecMainPID": "2291", "ExecMainStartTimestamp": "Fri 2026-06-19 15:44:16 UTC", "ExecMainStartTimestampMonotonic": "233411624", "ExecMainStatus": "0", "ExecStart": "{ path=/sbin/auditd ; argv[]=/sbin/auditd ; ignore_errors=no ; start_time=[Fri 2026-06-19 15:44:16 UTC] ; stop_time=[Fri 2026-06-19 15:44:16 UTC] ; pid=2290 ; code=exited ; status=0 }", "ExecStartEx": "{ path=/sbin/auditd ; argv[]=/sbin/auditd ; flags= ; start_time=[Fri 2026-06-19 15:44:16 UTC] ; stop_time=[Fri 2026-06-19 15:44:16 UTC] ; pid=2290 ; code=exited ; status=0 }", "ExecStartPost": "{ path=/sbin/augenrules ; argv[]=/sbin/augenrules --load ; ignore_errors=yes ; start_time=[Fri 2026-06-19 15:44:16 UTC] ; stop_time=[Fri 2026-06-19 15:44:16 UTC] ; pid=2294 ; code=exited ; status=0 }", "ExecStartPostEx": "{ path=/sbin/augenrules ; argv[]=/sbin/augenrules --load ; flags=ignore-failure ; start_time=[Fri 2026-06-19 15:44:16 UTC] ; stop_time=[Fri 2026-06-19 15:44:16 UTC] ; pid=2294 ; code=exited ; status=0 }", "ExitType": "main", "ExtensionImagePolicy": "root=verity+signed+encrypted+unprotected+absent:usr=verity+signed+encrypted+unprotected+absent:home=encrypted+unprotected+absent:srv=encrypted+unprotected+absent:tmp=encrypted+unprotected+absent:var=encrypted+unprotected+absent", "FailureAction": "none", "FileDescriptorStoreMax": "0", "FileDescriptorStorePreserve": "restart", "FinalKillSignal": "9", "FragmentPath": "/usr/lib/systemd/system/auditd.service", "FreezerState": "running", "GID": "[not set]", "GuessMainPID": "yes", "IOAccounting": "no", "IOReadBytes": "[not set]", "IOReadOperations": "[not set]", "IOSchedulingClass": "2", "IOSchedulingPriority": "4", "IOWeight": "[not set]", "IOWriteBytes": "[not set]", "IOWriteOperations": "[not set]", "IPAccounting": "no", "IPEgressBytes": "[no data]", "IPEgressPackets": "[no data]", "IPIngressBytes": "[no data]", "IPIngressPackets": "[no data]", "Id": "auditd.service", "IgnoreOnIsolate": "no", "IgnoreSIGPIPE": "yes", "InactiveEnterTimestampMonotonic": "0", "InactiveExitTimestamp": "Fri 2026-06-19 15:44:16 UTC", "InactiveExitTimestampMonotonic": "233397295", "InvocationID": "a279b006052345c6b718e0b3a674403f", "JobRunningTimeoutUSec": "infinity", "JobTimeoutAction": "none", "JobTimeoutUSec": "infinity", "KeyringMode": "private", "KillMode": "control-group", "KillSignal": "15", "LimitAS": "infinity", "LimitASSoft": "infinity", "LimitCORE": "infinity", "LimitCORESoft": "0", "LimitCPU": "infinity", "LimitCPUSoft": "infinity", "LimitDATA": "infinity", "LimitDATASoft": "infinity", "LimitFSIZE": "infinity", "LimitFSIZESoft": "infinity", "LimitLOCKS": "infinity", "LimitLOCKSSoft": "infinity", "LimitMEMLOCK": "8388608", "LimitMEMLOCKSoft": "8388608", "LimitMSGQUEUE": "819200", "LimitMSGQUEUESoft": "819200", "LimitNICE": "0", "LimitNICESoft": "0", "LimitNOFILE": "524288", "LimitNOFILESoft": "1024", "LimitNPROC": "15372", "LimitNPROCSoft": "15372", "LimitRSS": "infinity", "LimitRSSSoft": "infinity", "LimitRTPRIO": "0", "LimitRTPRIOSoft": "0", "LimitRTTIME": "infinity", "LimitRTTIMESoft": "infinity", "LimitSIGPENDING": "15372", "LimitSIGPENDINGSoft": "15372", "LimitSTACK": "infinity", "LimitSTACKSoft": "8388608", "LoadState": "loaded", "LockPersonality": "yes", "LogLevelMax": "-1", "LogRateLimitBurst": "0", "LogRateLimitIntervalUSec": "0", "LogsDirectoryMode": "0755", "MainPID": "2291", "ManagedOOMMemoryPressure": "auto", "ManagedOOMMemoryPressureLimit": "0", "ManagedOOMPreference": "none", "ManagedOOMSwap": "auto", "MemoryAccounting": "yes", "MemoryAvailable": "3528925184", "MemoryCurrent": "512000", "MemoryDenyWriteExecute": "yes", "MemoryHigh": "infinity", "MemoryKSM": "no", "MemoryLimit": "infinity", "MemoryLow": "0", "MemoryMax": "infinity", "MemoryMin": "0", "MemoryPeak": "2002944", "MemoryPressureThresholdUSec": "200ms", "MemoryPressureWatch": "auto", "MemorySwapCurrent": "0", "MemorySwapMax": "infinity", "MemorySwapPeak": "0", "MemoryZSwapCurrent": "0", "MemoryZSwapMax": "infinity", "MountAPIVFS": "no", "MountImagePolicy": "root=verity+signed+encrypted+unprotected+absent:usr=verity+signed+encrypted+unprotected+absent:home=encrypted+unprotected+absent:srv=encrypted+unprotected+absent:tmp=encrypted+unprotected+absent:var=encrypted+unprotected+absent", "NFileDescriptorStore": "0", "NRestarts": "0", "NUMAPolicy": "n/a", "Names": "auditd.service", "NeedDaemonReload": "no", "Nice": "0", "NoNewPrivileges": "no", "NonBlocking": "no", "NotifyAccess": "none", "OOMPolicy": "stop", "OOMScoreAdjust": "0", "OnFailureJobMode": "replace", "OnSuccessJobMode": "fail", "PIDFile": "/run/auditd.pid", "Perpetual": "no", "PrivateDevices": "no", "PrivateIPC": "no", "PrivateMounts": "no", "PrivateNetwork": "no", "PrivateTmp": "no", "PrivateUsers": "no", "ProcSubset": "all", "ProtectClock": "no", "ProtectControlGroups": "no", "ProtectHome": "no", "ProtectHostname": "no", "ProtectKernelLogs": "no", "ProtectKernelModules": "yes", "ProtectKernelTunables": "no", "ProtectProc": "default", "ProtectSystem": "no", "RefuseManualStart": "no", "RefuseManualStop": "no", "ReloadResult": "success", "ReloadSignal": "1", "RemainAfterExit": "no", "RemoveIPC": "no", "Requires": "system.slice", "Restart": "on-failure", "RestartKillSignal": "15", "RestartMaxDelayUSec": "infinity", "RestartMode": "normal", "RestartPreventExitStatus": "2 4 6", "RestartSteps": "0", "RestartUSec": "100ms", "RestartUSecNext": "100ms", "RestrictNamespaces": "no", "RestrictRealtime": "yes", "RestrictSUIDSGID": "no", "Result": "success", "RootDirectoryStartOnly": "no", "RootEphemeral": "no", "RootImagePolicy": "root=verity+signed+encrypted+unprotected+absent:usr=verity+signed+encrypted+unprotected+absent:home=encrypted+unprotected+absent:srv=encrypted+unprotected+absent:tmp=encrypted+unprotected+absent:var=encrypted+unprotected+absent", "RuntimeDirectoryMode": "0755", "RuntimeDirectoryPreserve": "no", "RuntimeMaxUSec": "infinity", "RuntimeRandomizedExtraUSec": "0", "SameProcessGroup": "no", "SecureBits": "0", "SendSIGHUP": "no", "SendSIGKILL": "yes", "SetLoginEnvironment": "no", "Slice": "system.slice", "StandardError": "inherit", "StandardInput": "null", "StandardOutput": "journal", "StartLimitAction": "none", "StartLimitBurst": "5", "StartLimitIntervalUSec": "10s", "StartupBlockIOWeight": "[not set]", "StartupCPUShares": "[not set]", "StartupCPUWeight": "[not set]", "StartupIOWeight": "[not set]", "StartupMemoryHigh": "infinity", "StartupMemoryLow": "0", "StartupMemoryMax": "infinity", "StartupMemorySwapMax": "infinity", "StartupMemoryZSwapMax": "infinity", "StateChangeTimestamp": "Fri 2026-06-19 15:44:16 UTC", "StateChangeTimestampMonotonic": "233443315", "StateDirectoryMode": "0755", "StatusErrno": "0", "StopWhenUnneeded": "no", "SubState": "running", "SuccessAction": "none", "SurviveFinalKillSignal": "no", "SyslogFacility": "3", "SyslogLevel": "6", "SyslogLevelPrefix": "yes", "SyslogPriority": "30", "SystemCallErrorNumber": "2147483646", "TTYReset": "no", "TTYVHangup": "no", "TTYVTDisallocate": "no", "TasksAccounting": "yes", "TasksCurrent": "2", "TasksMax": "4611", "TimeoutAbortUSec": "1min 30s", "TimeoutCleanUSec": "infinity", "TimeoutStartFailureMode": "terminate", "TimeoutStartUSec": "1min 30s", "TimeoutStopFailureMode": "terminate", "TimeoutStopUSec": "1min 30s", "TimerSlackNSec": "50000", "Transient": "no", "Type": "forking", "UID": "[not set]", "UMask": "0022", "UnitFilePreset": "enabled", "UnitFileState": "enabled", "UtmpMode": "init", "WantedBy": "multi-user.target", "WatchdogSignal": "6", "WatchdogTimestampMonotonic": "0", "WatchdogUSec": "0"}} 2026-06-19 15:44:26.586345 | ubuntu-noble | 2026-06-19 15:44:26.586369 | ubuntu-noble | RUNNING HANDLER [auditd : Generate auditd rules] ******************************* 2026-06-19 15:44:26.684703 | debian-bookworm | changed: [molecule-auditd] => {"changed": true, "cmd": ["augenrules", "--load"], "delta": "0:00:00.128714", "end": "2026-06-19 15:44:26.608931", "msg": "", "rc": 0, "start": "2026-06-19 15:44:26.480217", "stderr": "Unknown user: chrony\nThere was an error in line 24 of /etc/audit/audit.rules\nError sending add rule data request (No such file or directory)\nThere was an error in line 28 of /etc/audit/audit.rules\nUnknown user: ntp\nThere was an error in line 44 of /etc/audit/audit.rules\nError sending add rule data request (No such file or directory)\nThere was an error in line 83 of /etc/audit/audit.rules\nError sending add rule data request (No such file or directory)\nThere was an error in line 84 of /etc/audit/audit.rules\nError sending add rule data request (No such file or directory)\nThere was an error in line 112 of /etc/audit/audit.rules\nError sending add rule data request (No such file or directory)\nThere was an error in line 115 of /etc/audit/audit.rules\nError sending add rule data request (No such file or directory)\nThere was an error in line 176 of /etc/audit/audit.rules\nError sending add rule data request (No such file or directory)\nThere was an error in line 177 of /etc/audit/audit.rules\nError sending add rule data request (No such file or directory)\nThere was an error in line 178 of /etc/audit/audit.rules\nError sending add rule data request (No such file or directory)\nThere was an error in line 179 of /etc/audit/audit.rules\nError sending add rule data request (No such file or directory)\nThere was an error in line 180 of /etc/audit/audit.rules\nError sending add rule data request (No such file or directory)\nThere was an error in line 217 of /etc/audit/audit.rules\nError sending add rule data request (No such file or directory)\nThere was an error in line 218 of /etc/audit/audit.rules\nError sending add rule data request (No such file or directory)\nThere was an error in line 234 of /etc/audit/audit.rules\nError sending add rule data request (No such file or directory)\nThere was an error in line 285 of /etc/audit/audit.rules\nError sending add rule data request (No such file or directory)\nThere was an error in line 286 of /etc/audit/audit.rules\nError sending add rule data request (No such file or directory)\nThere was an error in line 324 of /etc/audit/audit.rules\nError sending add rule data request (No such file or directory)\nThere was an error in line 325 of /etc/audit/audit.rules\nError sending add rule data request (No such file or directory)\nThere was an error in line 346 of /etc/audit/audit.rules\nparameter passed without an option given\nThere was an error in line 347 of /etc/audit/audit.rules\nparameter passed without an option given\nThere was an error in line 348 of /etc/audit/audit.rules\nparameter passed without an option given\nThere was an error in line 349 of /etc/audit/audit.rules\nparameter passed without an option given\nThere was an error in line 350 of /etc/audit/audit.rules\nparameter passed without an option given\nThere was an error in line 351 of /etc/audit/audit.rules\nError sending add rule data request (No such file or directory)\nThere was an error in line 359 of /etc/audit/audit.rules", "stderr_lines": ["Unknown user: chrony", "There was an error in line 24 of /etc/audit/audit.rules", "Error sending add rule data request (No such file or directory)", "There was an error in line 28 of /etc/audit/audit.rules", "Unknown user: ntp", "There was an error in line 44 of /etc/audit/audit.rules", "Error sending add rule data request (No such file or directory)", "There was an error in line 83 of /etc/audit/audit.rules", "Error sending add rule data request (No such file or directory)", "There was an error in line 84 of /etc/audit/audit.rules", "Error sending add rule data request (No such file or directory)", "There was an error in line 112 of /etc/audit/audit.rules", "Error sending add rule data request (No such file or directory)", "There was an error in line 115 of /etc/audit/audit.rules", "Error sending add rule data request (No such file or directory)", "There was an error in line 176 of /etc/audit/audit.rules", "Error sending add rule data request (No such file or directory)", "There was an error in line 177 of /etc/audit/audit.rules", "Error sending add rule data request (No such file or directory)", "There was an error in line 178 of /etc/audit/audit.rules", "Error sending add rule data request (No such file or directory)", "There was an error in line 179 of /etc/audit/audit.rules", "Error sending add rule data request (No such file or directory)", "There was an error in line 180 of /etc/audit/audit.rules", "Error sending add rule data request (No such file or directory)", "There was an error in line 217 of /etc/audit/audit.rules", "Error sending add rule data request (No such file or directory)", "There was an error in line 218 of /etc/audit/audit.rules", "Error sending add rule data request (No such file or directory)", "There was an error in line 234 of /etc/audit/audit.rules", "Error sending add rule data request (No such file or directory)", "There was an error in line 285 of /etc/audit/audit.rules", "Error sending add rule data request (No such file or directory)", "There was an error in line 286 of /etc/audit/audit.rules", "Error sending add rule data request (No such file or directory)", "There was an error in line 324 of /etc/audit/audit.rules", "Error sending add rule data request (No such file or directory)", "There was an error in line 325 of /etc/audit/audit.rules", "Error sending add rule data request (No such file or directory)", "There was an error in line 346 of /etc/audit/audit.rules", "parameter passed without an option given", "There was an error in line 347 of /etc/audit/audit.rules", "parameter passed without an option given", "There was an error in line 348 of /etc/audit/audit.rules", "parameter passed without an option given", "There was an error in line 349 of /etc/audit/audit.rules", "parameter passed without an option given", "There was an error in line 350 of /etc/audit/audit.rules", "parameter passed without an option given", "There was an error in line 351 of /etc/audit/audit.rules", "Error sending add rule data request (No such file or directory)", "There was an error in line 359 of /etc/audit/audit.rules"], "stdout": "/usr/sbin/augenrules: No change\nNo rules\nenabled 1\nfailure 1\npid 2813\nrate_limit 0\nbacklog_limit 8192\nlost 0\nbacklog 18\nbacklog_wait_time 60000\nbacklog_wait_time_actual 0\nenabled 1\nfailure 1\npid 2813\nrate_limit 0\nbacklog_limit 8192\nlost 0\nbacklog 0\nbacklog_wait_time 60000\nbacklog_wait_time_actual 0", "stdout_lines": ["/usr/sbin/augenrules: No change", "No rules", "enabled 1", "failure 1", "pid 2813", "rate_limit 0", "backlog_limit 8192", "lost 0", "backlog 18", "backlog_wait_time 60000", "backlog_wait_time_actual 0", "enabled 1", "failure 1", "pid 2813", "rate_limit 0", "backlog_limit 8192", "lost 0", "backlog 0", "backlog_wait_time 60000", "backlog_wait_time_actual 0"]} 2026-06-19 15:44:26.685179 | debian-bookworm | 2026-06-19 15:44:26.685698 | debian-bookworm | RUNNING HANDLER [auditd : Restart auditd service] ****************************** 2026-06-19 15:44:27.087932 | ubuntu-noble | changed: [molecule-auditd] => {"changed": true, "cmd": ["augenrules", "--load"], "delta": "0:00:00.101564", "end": "2026-06-19 15:44:27.040633", "msg": "", "rc": 0, "start": "2026-06-19 15:44:26.939069", "stderr": "Unknown user: chrony\nThere was an error in line 24 of /etc/audit/audit.rules\nError sending add rule data request (No such file or directory)\nThere was an error in line 28 of /etc/audit/audit.rules\nUnknown user: ntp\nThere was an error in line 44 of /etc/audit/audit.rules\nError sending add rule data request (No such file or directory)\nThere was an error in line 83 of /etc/audit/audit.rules\nError sending add rule data request (No such file or directory)\nThere was an error in line 84 of /etc/audit/audit.rules\nError sending add rule data request (No such file or directory)\nThere was an error in line 86 of /etc/audit/audit.rules\nError sending add rule data request (No such file or directory)\nThere was an error in line 112 of /etc/audit/audit.rules\nError sending add rule data request (No such file or directory)\nThere was an error in line 115 of /etc/audit/audit.rules\nError sending add rule data request (No such file or directory)\nThere was an error in line 176 of /etc/audit/audit.rules\nError sending add rule data request (No such file or directory)\nThere was an error in line 177 of /etc/audit/audit.rules\nError sending add rule data request (No such file or directory)\nThere was an error in line 178 of /etc/audit/audit.rules\nError sending add rule data request (No such file or directory)\nThere was an error in line 179 of /etc/audit/audit.rules\nError sending add rule data request (No such file or directory)\nThere was an error in line 180 of /etc/audit/audit.rules\nError sending add rule data request (No such file or directory)\nThere was an error in line 217 of /etc/audit/audit.rules\nError sending add rule data request (No such file or directory)\nThere was an error in line 218 of /etc/audit/audit.rules\nError sending add rule data request (No such file or directory)\nThere was an error in line 234 of /etc/audit/audit.rules\nError sending add rule data request (No such file or directory)\nThere was an error in line 285 of /etc/audit/audit.rules\nError sending add rule data request (No such file or directory)\nThere was an error in line 286 of /etc/audit/audit.rules\nError sending add rule data request (No such file or directory)\nThere was an error in line 324 of /etc/audit/audit.rules\nError sending add rule data request (No such file or directory)\nThere was an error in line 325 of /etc/audit/audit.rules\nError sending add rule data request (No such file or directory)\nThere was an error in line 346 of /etc/audit/audit.rules\nparameter passed without an option given\nThere was an error in line 347 of /etc/audit/audit.rules\nparameter passed without an option given\nThere was an error in line 348 of /etc/audit/audit.rules\nparameter passed without an option given\nThere was an error in line 349 of /etc/audit/audit.rules\nparameter passed without an option given\nThere was an error in line 350 of /etc/audit/audit.rules\nparameter passed without an option given\nThere was an error in line 351 of /etc/audit/audit.rules\nError sending add rule data request (No such file or directory)\nThere was an error in line 359 of /etc/audit/audit.rules", "stderr_lines": ["Unknown user: chrony", "There was an error in line 24 of /etc/audit/audit.rules", "Error sending add rule data request (No such file or directory)", "There was an error in line 28 of /etc/audit/audit.rules", "Unknown user: ntp", "There was an error in line 44 of /etc/audit/audit.rules", "Error sending add rule data request (No such file or directory)", "There was an error in line 83 of /etc/audit/audit.rules", "Error sending add rule data request (No such file or directory)", "There was an error in line 84 of /etc/audit/audit.rules", "Error sending add rule data request (No such file or directory)", "There was an error in line 86 of /etc/audit/audit.rules", "Error sending add rule data request (No such file or directory)", "There was an error in line 112 of /etc/audit/audit.rules", "Error sending add rule data request (No such file or directory)", "There was an error in line 115 of /etc/audit/audit.rules", "Error sending add rule data request (No such file or directory)", "There was an error in line 176 of /etc/audit/audit.rules", "Error sending add rule data request (No such file or directory)", "There was an error in line 177 of /etc/audit/audit.rules", "Error sending add rule data request (No such file or directory)", "There was an error in line 178 of /etc/audit/audit.rules", "Error sending add rule data request (No such file or directory)", "There was an error in line 179 of /etc/audit/audit.rules", "Error sending add rule data request (No such file or directory)", "There was an error in line 180 of /etc/audit/audit.rules", "Error sending add rule data request (No such file or directory)", "There was an error in line 217 of /etc/audit/audit.rules", "Error sending add rule data request (No such file or directory)", "There was an error in line 218 of /etc/audit/audit.rules", "Error sending add rule data request (No such file or directory)", "There was an error in line 234 of /etc/audit/audit.rules", "Error sending add rule data request (No such file or directory)", "There was an error in line 285 of /etc/audit/audit.rules", "Error sending add rule data request (No such file or directory)", "There was an error in line 286 of /etc/audit/audit.rules", "Error sending add rule data request (No such file or directory)", "There was an error in line 324 of /etc/audit/audit.rules", "Error sending add rule data request (No such file or directory)", "There was an error in line 325 of /etc/audit/audit.rules", "Error sending add rule data request (No such file or directory)", "There was an error in line 346 of /etc/audit/audit.rules", "parameter passed without an option given", "There was an error in line 347 of /etc/audit/audit.rules", "parameter passed without an option given", "There was an error in line 348 of /etc/audit/audit.rules", "parameter passed without an option given", "There was an error in line 349 of /etc/audit/audit.rules", "parameter passed without an option given", "There was an error in line 350 of /etc/audit/audit.rules", "parameter passed without an option given", "There was an error in line 351 of /etc/audit/audit.rules", "Error sending add rule data request (No such file or directory)", "There was an error in line 359 of /etc/audit/audit.rules"], "stdout": "/usr/sbin/augenrules: No change\nNo rules\nenabled 1\nfailure 1\npid 2683\nrate_limit 0\nbacklog_limit 8192\nlost 0\nbacklog 92\nbacklog_wait_time 60000\nbacklog_wait_time_actual 0\nenabled 1\nfailure 1\npid 2683\nrate_limit 0\nbacklog_limit 8192\nlost 0\nbacklog 96\nbacklog_wait_time 60000\nbacklog_wait_time_actual 0", "stdout_lines": ["/usr/sbin/augenrules: No change", "No rules", "enabled 1", "failure 1", "pid 2683", "rate_limit 0", "backlog_limit 8192", "lost 0", "backlog 92", "backlog_wait_time 60000", "backlog_wait_time_actual 0", "enabled 1", "failure 1", "pid 2683", "rate_limit 0", "backlog_limit 8192", "lost 0", "backlog 96", "backlog_wait_time 60000", "backlog_wait_time_actual 0"]} 2026-06-19 15:44:27.088115 | ubuntu-noble | 2026-06-19 15:44:27.088256 | ubuntu-noble | RUNNING HANDLER [auditd : Restart auditd service] ****************************** 2026-06-19 15:44:27.647290 | debian-bookworm | changed: [molecule-auditd] => {"changed": true, "name": "auditd", "state": "started", "status": {"ActiveEnterTimestamp": "Fri 2026-06-19 15:44:25 UTC", "ActiveEnterTimestampMonotonic": "270340384", "ActiveExitTimestamp": "Fri 2026-06-19 15:44:25 UTC", "ActiveExitTimestampMonotonic": "270140029", "ActiveState": "active", "After": "systemd-tmpfiles-setup.service system.slice local-fs.target systemd-journald.socket", "AllowIsolate": "no", "AssertResult": "yes", "AssertTimestamp": "Fri 2026-06-19 15:44:25 UTC", "AssertTimestampMonotonic": "270182422", "Before": "sysinit.target ssh.service shutdown.target systemd-update-utmp.service", "BlockIOAccounting": "no", "BlockIOWeight": "[not set]", "CPUAccounting": "yes", "CPUAffinityFromNUMA": "no", "CPUQuotaPerSecUSec": "infinity", "CPUQuotaPeriodUSec": "infinity", "CPUSchedulingPolicy": "0", "CPUSchedulingPriority": "0", "CPUSchedulingResetOnFork": "no", "CPUShares": "[not set]", "CPUUsageNSec": "183032000", "CPUWeight": "[not set]", "CacheDirectoryMode": "0755", "CanFreeze": "yes", "CanIsolate": "no", "CanReload": "no", "CanStart": "yes", "CanStop": "yes", "CapabilityBoundingSet": "cap_chown cap_dac_override cap_dac_read_search cap_fowner cap_fsetid cap_kill cap_setgid cap_setuid cap_setpcap cap_linux_immutable cap_net_bind_service cap_net_broadcast cap_net_admin cap_net_raw cap_ipc_lock cap_ipc_owner cap_sys_rawio cap_sys_chroot cap_sys_ptrace cap_sys_pacct cap_sys_admin cap_sys_boot cap_sys_nice cap_sys_resource cap_sys_time cap_sys_tty_config cap_mknod cap_lease cap_audit_write cap_audit_control cap_setfcap cap_mac_override cap_mac_admin cap_syslog cap_wake_alarm cap_block_suspend cap_audit_read cap_perfmon cap_bpf cap_checkpoint_restore", "CleanResult": "success", "CollectMode": "inactive", "ConditionResult": "yes", "ConditionTimestamp": "Fri 2026-06-19 15:44:25 UTC", "ConditionTimestampMonotonic": "270182377", "ConfigurationDirectoryMode": "0755", "Conflicts": "shutdown.target", "ControlGroup": "/system.slice/auditd.service", "ControlGroupId": "3250", "ControlPID": "0", "CoredumpFilter": "0x33", "DefaultDependencies": "no", "DefaultMemoryLow": "0", "DefaultMemoryMin": "0", "Delegate": "no", "Description": "Security Auditing Service", "DevicePolicy": "auto", "Documentation": "\"man:auditd(8)\" https://github.com/linux-audit/audit-documentation", "DynamicUser": "no", "ExecMainCode": "0", "ExecMainExitTimestampMonotonic": "0", "ExecMainPID": "2813", "ExecMainStartTimestamp": "Fri 2026-06-19 15:44:25 UTC", "ExecMainStartTimestampMonotonic": "270227855", "ExecMainStatus": "0", "ExecStart": "{ path=/sbin/auditd ; argv[]=/sbin/auditd ; ignore_errors=no ; start_time=[Fri 2026-06-19 15:44:25 UTC] ; stop_time=[Fri 2026-06-19 15:44:25 UTC] ; pid=2812 ; code=exited ; status=0 }", "ExecStartEx": "{ path=/sbin/auditd ; argv[]=/sbin/auditd ; flags= ; start_time=[Fri 2026-06-19 15:44:25 UTC] ; stop_time=[Fri 2026-06-19 15:44:25 UTC] ; pid=2812 ; code=exited ; status=0 }", "ExecStartPost": "{ path=/sbin/augenrules ; argv[]=/sbin/augenrules --load ; ignore_errors=yes ; start_time=[Fri 2026-06-19 15:44:25 UTC] ; stop_time=[Fri 2026-06-19 15:44:25 UTC] ; pid=2816 ; code=exited ; status=0 }", "ExecStartPostEx": "{ path=/sbin/augenrules ; argv[]=/sbin/augenrules --load ; flags=ignore-failure ; start_time=[Fri 2026-06-19 15:44:25 UTC] ; stop_time=[Fri 2026-06-19 15:44:25 UTC] ; pid=2816 ; code=exited ; status=0 }", "ExitType": "main", "FailureAction": "none", "FileDescriptorStoreMax": "0", "FinalKillSignal": "9", "FragmentPath": "/lib/systemd/system/auditd.service", "FreezerState": "running", "GID": "[not set]", "GuessMainPID": "yes", "IOAccounting": "no", "IOReadBytes": "18446744073709551615", "IOReadOperations": "18446744073709551615", "IOSchedulingClass": "2", "IOSchedulingPriority": "4", "IOWeight": "[not set]", "IOWriteBytes": "18446744073709551615", "IOWriteOperations": "18446744073709551615", "IPAccounting": "no", "IPEgressBytes": "[no data]", "IPEgressPackets": "[no data]", "IPIngressBytes": "[no data]", "IPIngressPackets": "[no data]", "Id": "auditd.service", "IgnoreOnIsolate": "no", "IgnoreSIGPIPE": "yes", "InactiveEnterTimestamp": "Fri 2026-06-19 15:44:25 UTC", "InactiveEnterTimestampMonotonic": "270181186", "InactiveExitTimestamp": "Fri 2026-06-19 15:44:25 UTC", "InactiveExitTimestampMonotonic": "270208376", "InvocationID": "130164bc9c8c4cce91f7799096a512b7", "JobRunningTimeoutUSec": "infinity", "JobTimeoutAction": "none", "JobTimeoutUSec": "infinity", "KeyringMode": "private", "KillMode": "control-group", "KillSignal": "15", "LimitAS": "infinity", "LimitASSoft": "infinity", "LimitCORE": "infinity", "LimitCORESoft": "0", "LimitCPU": "infinity", "LimitCPUSoft": "infinity", "LimitDATA": "infinity", "LimitDATASoft": "infinity", "LimitFSIZE": "infinity", "LimitFSIZESoft": "infinity", "LimitLOCKS": "infinity", "LimitLOCKSSoft": "infinity", "LimitMEMLOCK": "8388608", "LimitMEMLOCKSoft": "8388608", "LimitMSGQUEUE": "819200", "LimitMSGQUEUESoft": "819200", "LimitNICE": "0", "LimitNICESoft": "0", "LimitNOFILE": "524288", "LimitNOFILESoft": "1024", "LimitNPROC": "15480", "LimitNPROCSoft": "15480", "LimitRSS": "infinity", "LimitRSSSoft": "infinity", "LimitRTPRIO": "0", "LimitRTPRIOSoft": "0", "LimitRTTIME": "infinity", "LimitRTTIMESoft": "infinity", "LimitSIGPENDING": "15480", "LimitSIGPENDINGSoft": "15480", "LimitSTACK": "infinity", "LimitSTACKSoft": "8388608", "LoadState": "loaded", "LockPersonality": "yes", "LogLevelMax": "-1", "LogRateLimitBurst": "0", "LogRateLimitIntervalUSec": "0", "LogsDirectoryMode": "0755", "MainPID": "2813", "ManagedOOMMemoryPressure": "auto", "ManagedOOMMemoryPressureLimit": "0", "ManagedOOMPreference": "none", "ManagedOOMSwap": "auto", "MemoryAccounting": "yes", "MemoryAvailable": "infinity", "MemoryCurrent": "2080768", "MemoryDenyWriteExecute": "yes", "MemoryHigh": "infinity", "MemoryLimit": "infinity", "MemoryLow": "0", "MemoryMax": "infinity", "MemoryMin": "0", "MemorySwapMax": "infinity", "MountAPIVFS": "no", "NFileDescriptorStore": "0", "NRestarts": "0", "NUMAPolicy": "n/a", "Names": "auditd.service", "NeedDaemonReload": "no", "Nice": "0", "NoNewPrivileges": "no", "NonBlocking": "no", "NotifyAccess": "none", "OOMPolicy": "stop", "OOMScoreAdjust": "0", "OnFailureJobMode": "replace", "OnSuccessJobMode": "fail", "PIDFile": "/run/auditd.pid", "Perpetual": "no", "PrivateDevices": "no", "PrivateIPC": "no", "PrivateMounts": "no", "PrivateNetwork": "no", "PrivateTmp": "no", "PrivateUsers": "no", "ProcSubset": "all", "ProtectClock": "no", "ProtectControlGroups": "yes", "ProtectHome": "no", "ProtectHostname": "no", "ProtectKernelLogs": "no", "ProtectKernelModules": "yes", "ProtectKernelTunables": "no", "ProtectProc": "default", "ProtectSystem": "no", "RefuseManualStart": "no", "RefuseManualStop": "no", "ReloadResult": "success", "RemainAfterExit": "no", "RemoveIPC": "no", "Requires": "system.slice", "Restart": "on-failure", "RestartKillSignal": "15", "RestartPreventExitStatus": "2 4 6", "RestartUSec": "100ms", "RestrictNamespaces": "no", "RestrictRealtime": "yes", "RestrictSUIDSGID": "no", "Result": "success", "RootDirectoryStartOnly": "no", "RuntimeDirectoryMode": "0755", "RuntimeDirectoryPreserve": "no", "RuntimeMaxUSec": "infinity", "RuntimeRandomizedExtraUSec": "0", "SameProcessGroup": "no", "SecureBits": "0", "SendSIGHUP": "no", "SendSIGKILL": "yes", "Slice": "system.slice", "StandardError": "inherit", "StandardInput": "null", "StandardOutput": "journal", "StartLimitAction": "none", "StartLimitBurst": "5", "StartLimitIntervalUSec": "10s", "StartupBlockIOWeight": "[not set]", "StartupCPUShares": "[not set]", "StartupCPUWeight": "[not set]", "StartupIOWeight": "[not set]", "StateChangeTimestamp": "Fri 2026-06-19 15:44:25 UTC", "StateChangeTimestampMonotonic": "270340384", "StateDirectoryMode": "0755", "StatusErrno": "0", "StopWhenUnneeded": "no", "SubState": "running", "SuccessAction": "none", "SyslogFacility": "3", "SyslogLevel": "6", "SyslogLevelPrefix": "yes", "SyslogPriority": "30", "SystemCallErrorNumber": "2147483646", "TTYReset": "no", "TTYVHangup": "no", "TTYVTDisallocate": "no", "TasksAccounting": "yes", "TasksCurrent": "2", "TasksMax": "4644", "TimeoutAbortUSec": "1min 30s", "TimeoutCleanUSec": "infinity", "TimeoutStartFailureMode": "terminate", "TimeoutStartUSec": "1min 30s", "TimeoutStopFailureMode": "terminate", "TimeoutStopUSec": "1min 30s", "TimerSlackNSec": "50000", "Transient": "no", "Type": "forking", "UID": "[not set]", "UMask": "0022", "UnitFilePreset": "enabled", "UnitFileState": "enabled", "UtmpMode": "init", "WantedBy": "multi-user.target", "WatchdogSignal": "6", "WatchdogTimestampMonotonic": "0", "WatchdogUSec": "0"}} 2026-06-19 15:44:27.649156 | debian-bookworm | 2026-06-19 15:44:27.649261 | debian-bookworm | PLAY RECAP ********************************************************************* 2026-06-19 15:44:27.649376 | debian-bookworm | molecule-auditd : ok=15 changed=8 unreachable=0 failed=0 skipped=0 rescued=0 ignored=0 2026-06-19 15:44:27.649471 | debian-bookworm | 2026-06-19 15:44:27.800509 | debian-bookworm | INFO [delegated > converge] Executed: Successful 2026-06-19 15:44:27.801007 | debian-bookworm | WARNING Molecule executed 1 scenario (1 missing files) 2026-06-19 15:44:27.891163 | ubuntu-noble | changed: [molecule-auditd] => {"changed": true, "name": "auditd", "state": "started", "status": {"ActiveEnterTimestamp": "Fri 2026-06-19 15:44:26 UTC", "ActiveEnterTimestampMonotonic": "243109640", "ActiveExitTimestamp": "Fri 2026-06-19 15:44:26 UTC", "ActiveExitTimestampMonotonic": "242981305", "ActiveState": "active", "After": "local-fs.target systemd-journald.socket systemd-tmpfiles-setup.service system.slice", "AllowIsolate": "no", "AssertResult": "yes", "AssertTimestamp": "Fri 2026-06-19 15:44:26 UTC", "AssertTimestampMonotonic": "243021766", "Before": "sysinit.target ssh.service shutdown.target systemd-update-utmp.service", "BlockIOAccounting": "no", "BlockIOWeight": "[not set]", "CPUAccounting": "yes", "CPUAffinityFromNUMA": "no", "CPUQuotaPerSecUSec": "infinity", "CPUQuotaPeriodUSec": "infinity", "CPUSchedulingPolicy": "0", "CPUSchedulingPriority": "0", "CPUSchedulingResetOnFork": "no", "CPUShares": "[not set]", "CPUUsageNSec": "143084000", "CPUWeight": "[not set]", "CacheDirectoryMode": "0755", "CanFreeze": "yes", "CanIsolate": "no", "CanReload": "no", "CanStart": "yes", "CanStop": "yes", "CapabilityBoundingSet": "cap_chown cap_dac_override cap_dac_read_search cap_fowner cap_fsetid cap_kill cap_setgid cap_setuid cap_setpcap cap_linux_immutable cap_net_bind_service cap_net_broadcast cap_net_admin cap_net_raw cap_ipc_lock cap_ipc_owner cap_sys_rawio cap_sys_chroot cap_sys_ptrace cap_sys_pacct cap_sys_admin cap_sys_boot cap_sys_nice cap_sys_resource cap_sys_time cap_sys_tty_config cap_mknod cap_lease cap_audit_write cap_audit_control cap_setfcap cap_mac_override cap_mac_admin cap_syslog cap_wake_alarm cap_block_suspend cap_audit_read cap_perfmon cap_bpf cap_checkpoint_restore", "CleanResult": "success", "CollectMode": "inactive", "ConditionResult": "yes", "ConditionTimestamp": "Fri 2026-06-19 15:44:26 UTC", "ConditionTimestampMonotonic": "243020968", "ConfigurationDirectoryMode": "0755", "Conflicts": "shutdown.target", "ControlGroup": "/system.slice/auditd.service", "ControlGroupId": "3868", "ControlPID": "0", "CoredumpFilter": "0x33", "CoredumpReceive": "no", "DefaultDependencies": "no", "DefaultMemoryLow": "0", "DefaultMemoryMin": "0", "DefaultStartupMemoryLow": "0", "Delegate": "no", "Description": "Security Auditing Service", "DevicePolicy": "auto", "Documentation": "\"man:auditd(8)\" https://github.com/linux-audit/audit-documentation", "DynamicUser": "no", "ExecMainCode": "0", "ExecMainExitTimestampMonotonic": "0", "ExecMainPID": "2683", "ExecMainStartTimestamp": "Fri 2026-06-19 15:44:26 UTC", "ExecMainStartTimestampMonotonic": "243052684", "ExecMainStatus": "0", "ExecStart": "{ path=/sbin/auditd ; argv[]=/sbin/auditd ; ignore_errors=no ; start_time=[Fri 2026-06-19 15:44:26 UTC] ; stop_time=[Fri 2026-06-19 15:44:26 UTC] ; pid=2682 ; code=exited ; status=0 }", "ExecStartEx": "{ path=/sbin/auditd ; argv[]=/sbin/auditd ; flags= ; start_time=[Fri 2026-06-19 15:44:26 UTC] ; stop_time=[Fri 2026-06-19 15:44:26 UTC] ; pid=2682 ; code=exited ; status=0 }", "ExecStartPost": "{ path=/sbin/augenrules ; argv[]=/sbin/augenrules --load ; ignore_errors=yes ; start_time=[Fri 2026-06-19 15:44:26 UTC] ; stop_time=[Fri 2026-06-19 15:44:26 UTC] ; pid=2687 ; code=exited ; status=0 }", "ExecStartPostEx": "{ path=/sbin/augenrules ; argv[]=/sbin/augenrules --load ; flags=ignore-failure ; start_time=[Fri 2026-06-19 15:44:26 UTC] ; stop_time=[Fri 2026-06-19 15:44:26 UTC] ; pid=2687 ; code=exited ; status=0 }", "ExitType": "main", "ExtensionImagePolicy": "root=verity+signed+encrypted+unprotected+absent:usr=verity+signed+encrypted+unprotected+absent:home=encrypted+unprotected+absent:srv=encrypted+unprotected+absent:tmp=encrypted+unprotected+absent:var=encrypted+unprotected+absent", "FailureAction": "none", "FileDescriptorStoreMax": "0", "FileDescriptorStorePreserve": "restart", "FinalKillSignal": "9", "FragmentPath": "/usr/lib/systemd/system/auditd.service", "FreezerState": "running", "GID": "[not set]", "GuessMainPID": "yes", "IOAccounting": "no", "IOReadBytes": "[not set]", "IOReadOperations": "[not set]", "IOSchedulingClass": "2", "IOSchedulingPriority": "4", "IOWeight": "[not set]", "IOWriteBytes": "[not set]", "IOWriteOperations": "[not set]", "IPAccounting": "no", "IPEgressBytes": "[no data]", "IPEgressPackets": "[no data]", "IPIngressBytes": "[no data]", "IPIngressPackets": "[no data]", "Id": "auditd.service", "IgnoreOnIsolate": "no", "IgnoreSIGPIPE": "yes", "InactiveEnterTimestamp": "Fri 2026-06-19 15:44:26 UTC", "InactiveEnterTimestampMonotonic": "243020078", "InactiveExitTimestamp": "Fri 2026-06-19 15:44:26 UTC", "InactiveExitTimestampMonotonic": "243028319", "InvocationID": "47fe259e01c545fdb6902b6478c97985", "JobRunningTimeoutUSec": "infinity", "JobTimeoutAction": "none", "JobTimeoutUSec": "infinity", "KeyringMode": "private", "KillMode": "control-group", "KillSignal": "15", "LimitAS": "infinity", "LimitASSoft": "infinity", "LimitCORE": "infinity", "LimitCORESoft": "0", "LimitCPU": "infinity", "LimitCPUSoft": "infinity", "LimitDATA": "infinity", "LimitDATASoft": "infinity", "LimitFSIZE": "infinity", "LimitFSIZESoft": "infinity", "LimitLOCKS": "infinity", "LimitLOCKSSoft": "infinity", "LimitMEMLOCK": "8388608", "LimitMEMLOCKSoft": "8388608", "LimitMSGQUEUE": "819200", "LimitMSGQUEUESoft": "819200", "LimitNICE": "0", "LimitNICESoft": "0", "LimitNOFILE": "524288", "LimitNOFILESoft": "1024", "LimitNPROC": "15372", "LimitNPROCSoft": "15372", "LimitRSS": "infinity", "LimitRSSSoft": "infinity", "LimitRTPRIO": "0", "LimitRTPRIOSoft": "0", "LimitRTTIME": "infinity", "LimitRTTIMESoft": "infinity", "LimitSIGPENDING": "15372", "LimitSIGPENDINGSoft": "15372", "LimitSTACK": "infinity", "LimitSTACKSoft": "8388608", "LoadState": "loaded", "LockPersonality": "yes", "LogLevelMax": "-1", "LogRateLimitBurst": "0", "LogRateLimitIntervalUSec": "0", "LogsDirectoryMode": "0755", "MainPID": "2683", "ManagedOOMMemoryPressure": "auto", "ManagedOOMMemoryPressureLimit": "0", "ManagedOOMPreference": "none", "ManagedOOMSwap": "auto", "MemoryAccounting": "yes", "MemoryAvailable": "3519078400", "MemoryCurrent": "1863680", "MemoryDenyWriteExecute": "yes", "MemoryHigh": "infinity", "MemoryKSM": "no", "MemoryLimit": "infinity", "MemoryLow": "0", "MemoryMax": "infinity", "MemoryMin": "0", "MemoryPeak": "2224128", "MemoryPressureThresholdUSec": "200ms", "MemoryPressureWatch": "auto", "MemorySwapCurrent": "0", "MemorySwapMax": "infinity", "MemorySwapPeak": "0", "MemoryZSwapCurrent": "0", "MemoryZSwapMax": "infinity", "MountAPIVFS": "no", "MountImagePolicy": "root=verity+signed+encrypted+unprotected+absent:usr=verity+signed+encrypted+unprotected+absent:home=encrypted+unprotected+absent:srv=encrypted+unprotected+absent:tmp=encrypted+unprotected+absent:var=encrypted+unprotected+absent", "NFileDescriptorStore": "0", "NRestarts": "0", "NUMAPolicy": "n/a", "Names": "auditd.service", "NeedDaemonReload": "no", "Nice": "0", "NoNewPrivileges": "no", "NonBlocking": "no", "NotifyAccess": "none", "OOMPolicy": "stop", "OOMScoreAdjust": "0", "OnFailureJobMode": "replace", "OnSuccessJobMode": "fail", "PIDFile": "/run/auditd.pid", "Perpetual": "no", "PrivateDevices": "no", "PrivateIPC": "no", "PrivateMounts": "no", "PrivateNetwork": "no", "PrivateTmp": "no", "PrivateUsers": "no", "ProcSubset": "all", "ProtectClock": "no", "ProtectControlGroups": "no", "ProtectHome": "no", "ProtectHostname": "no", "ProtectKernelLogs": "no", "ProtectKernelModules": "yes", "ProtectKernelTunables": "no", "ProtectProc": "default", "ProtectSystem": "no", "RefuseManualStart": "no", "RefuseManualStop": "no", "ReloadResult": "success", "ReloadSignal": "1", "RemainAfterExit": "no", "RemoveIPC": "no", "Requires": "system.slice", "Restart": "on-failure", "RestartKillSignal": "15", "RestartMaxDelayUSec": "infinity", "RestartMode": "normal", "RestartPreventExitStatus": "2 4 6", "RestartSteps": "0", "RestartUSec": "100ms", "RestartUSecNext": "100ms", "RestrictNamespaces": "no", "RestrictRealtime": "yes", "RestrictSUIDSGID": "no", "Result": "success", "RootDirectoryStartOnly": "no", "RootEphemeral": "no", "RootImagePolicy": "root=verity+signed+encrypted+unprotected+absent:usr=verity+signed+encrypted+unprotected+absent:home=encrypted+unprotected+absent:srv=encrypted+unprotected+absent:tmp=encrypted+unprotected+absent:var=encrypted+unprotected+absent", "RuntimeDirectoryMode": "0755", "RuntimeDirectoryPreserve": "no", "RuntimeMaxUSec": "infinity", "RuntimeRandomizedExtraUSec": "0", "SameProcessGroup": "no", "SecureBits": "0", "SendSIGHUP": "no", "SendSIGKILL": "yes", "SetLoginEnvironment": "no", "Slice": "system.slice", "StandardError": "inherit", "StandardInput": "null", "StandardOutput": "journal", "StartLimitAction": "none", "StartLimitBurst": "5", "StartLimitIntervalUSec": "10s", "StartupBlockIOWeight": "[not set]", "StartupCPUShares": "[not set]", "StartupCPUWeight": "[not set]", "StartupIOWeight": "[not set]", "StartupMemoryHigh": "infinity", "StartupMemoryLow": "0", "StartupMemoryMax": "infinity", "StartupMemorySwapMax": "infinity", "StartupMemoryZSwapMax": "infinity", "StateChangeTimestamp": "Fri 2026-06-19 15:44:26 UTC", "StateChangeTimestampMonotonic": "243109640", "StateDirectoryMode": "0755", "StatusErrno": "0", "StopWhenUnneeded": "no", "SubState": "running", "SuccessAction": "none", "SurviveFinalKillSignal": "no", "SyslogFacility": "3", "SyslogLevel": "6", "SyslogLevelPrefix": "yes", "SyslogPriority": "30", "SystemCallErrorNumber": "2147483646", "TTYReset": "no", "TTYVHangup": "no", "TTYVTDisallocate": "no", "TasksAccounting": "yes", "TasksCurrent": "2", "TasksMax": "4611", "TimeoutAbortUSec": "1min 30s", "TimeoutCleanUSec": "infinity", "TimeoutStartFailureMode": "terminate", "TimeoutStartUSec": "1min 30s", "TimeoutStopFailureMode": "terminate", "TimeoutStopUSec": "1min 30s", "TimerSlackNSec": "50000", "Transient": "no", "Type": "forking", "UID": "[not set]", "UMask": "0022", "UnitFilePreset": "enabled", "UnitFileState": "enabled", "UtmpMode": "init", "WantedBy": "multi-user.target", "WatchdogSignal": "6", "WatchdogTimestampMonotonic": "0", "WatchdogUSec": "0"}} 2026-06-19 15:44:27.891388 | ubuntu-noble | 2026-06-19 15:44:27.891562 | ubuntu-noble | PLAY RECAP ********************************************************************* 2026-06-19 15:44:27.891777 | ubuntu-noble | molecule-auditd : ok=15 changed=8 unreachable=0 failed=0 skipped=0 rescued=0 ignored=0 2026-06-19 15:44:27.891905 | ubuntu-noble | 2026-06-19 15:44:27.975096 | ubuntu-noble | INFO [delegated > converge] Executed: Successful 2026-06-19 15:44:27.975927 | ubuntu-noble | WARNING Molecule executed 1 scenario (1 missing files) 2026-06-19 15:44:28.092016 | debian-bookworm | ok: Runtime: 0:00:20.881057 2026-06-19 15:44:28.117672 | ubuntu-noble | ok: Runtime: 0:00:20.953474 2026-06-19 15:44:28.143648 | 2026-06-19 15:44:28.143835 | TASK [ansible-molecule : Run molecule verify action with scenario delegated] 2026-06-19 15:44:28.874906 | debian-bookworm | WARNING Molecule scenarios should migrate to 'extensions/molecule' 2026-06-19 15:44:28.885224 | debian-bookworm | DEBUG [unknown > config] provisioner.env found in /home/zuul/src/github.com/osism/ansible-collection-services/molecule/delegated/molecule.yml, this can be defined in ansible.env 2026-06-19 15:44:28.878363 | ubuntu-noble | WARNING Molecule scenarios should migrate to 'extensions/molecule' 2026-06-19 15:44:28.888668 | ubuntu-noble | DEBUG [unknown > config] provisioner.env found in /home/zuul/src/github.com/osism/ansible-collection-services/molecule/delegated/molecule.yml, this can be defined in ansible.env 2026-06-19 15:44:29.578916 | debian-bookworm | DEBUG [unknown > config] provisioner.env found in /home/zuul/src/github.com/osism/ansible-collection-services/molecule/delegated/molecule.yml, this can be defined in ansible.env 2026-06-19 15:44:29.580172 | debian-bookworm | DEBUG [delegated > validate] Validating schema /home/zuul/src/github.com/osism/ansible-collection-services/molecule/delegated/molecule.yml. 2026-06-19 15:44:29.605178 | debian-bookworm | DEBUG [default > validate] Validating schema /home/zuul/src/github.com/osism/ansible-collection-services/molecule/default/molecule.yml. 2026-06-19 15:44:29.611948 | debian-bookworm | INFO [delegated > discovery] scenario test matrix: verify 2026-06-19 15:44:29.612140 | debian-bookworm | INFO [delegated > prerun] Performing prerun with role_name_check=0... 2026-06-19 15:44:29.532686 | ubuntu-noble | DEBUG [unknown > config] provisioner.env found in /home/zuul/src/github.com/osism/ansible-collection-services/molecule/delegated/molecule.yml, this can be defined in ansible.env 2026-06-19 15:44:29.533553 | ubuntu-noble | DEBUG [delegated > validate] Validating schema /home/zuul/src/github.com/osism/ansible-collection-services/molecule/delegated/molecule.yml. 2026-06-19 15:44:29.559417 | ubuntu-noble | DEBUG [default > validate] Validating schema /home/zuul/src/github.com/osism/ansible-collection-services/molecule/default/molecule.yml. 2026-06-19 15:44:29.565368 | ubuntu-noble | INFO [delegated > discovery] scenario test matrix: verify 2026-06-19 15:44:29.565540 | ubuntu-noble | INFO [delegated > prerun] Performing prerun with role_name_check=0... 2026-06-19 15:44:31.502281 | debian-bookworm | INFO [delegated > verify] Executing 2026-06-19 15:44:31.504308 | debian-bookworm | INFO [delegated > verify] Executing Testinfra tests found in /home/zuul/src/github.com/osism/ansible-collection-services/molecule/delegated/tests/... 2026-06-19 15:44:31.505660 | debian-bookworm | DEBUG ANSIBLE ENVIRONMENT: 2026-06-19 15:44:31.505704 | debian-bookworm | ANSIBLE_COLLECTIONS_PATH: /home/zuul/venv/.ansible/collections:/home/zuul/.ansible/collections 2026-06-19 15:44:31.505715 | debian-bookworm | ANSIBLE_CONFIG: /home/zuul/.ansible/tmp/molecule.oWZD.delegated/ansible.cfg 2026-06-19 15:44:31.505724 | debian-bookworm | ANSIBLE_LIBRARY: ../../plugins 2026-06-19 15:44:31.505731 | debian-bookworm | ANSIBLE_PYTHON_INTERPRETER: /home/zuul/venv/bin/python 2026-06-19 15:44:31.505737 | debian-bookworm | ANSIBLE_ROLE: auditd 2026-06-19 15:44:31.505744 | debian-bookworm | ANSIBLE_ROLES_PATH: ../../roles 2026-06-19 15:44:31.505751 | debian-bookworm | ANSIBLE_VERBOSITY: 1 2026-06-19 15:44:31.505757 | debian-bookworm | 2026-06-19 15:44:31.505962 | debian-bookworm | DEBUG MOLECULE ENVIRONMENT: 2026-06-19 15:44:31.505973 | debian-bookworm | MOLECULE_DEBUG: True 2026-06-19 15:44:31.505980 | debian-bookworm | MOLECULE_DEPENDENCY_NAME: galaxy 2026-06-19 15:44:31.505986 | debian-bookworm | MOLECULE_DRIVER_NAME: default 2026-06-19 15:44:31.505993 | debian-bookworm | MOLECULE_ENV_FILE: /home/zuul/src/github.com/osism/ansible-collection-services/.env.yml 2026-06-19 15:44:31.506000 | debian-bookworm | MOLECULE_EPHEMERAL_DIRECTORY: /home/zuul/.ansible/tmp/molecule.oWZD.delegated 2026-06-19 15:44:31.506006 | debian-bookworm | MOLECULE_FILE: /home/zuul/.ansible/tmp/molecule.oWZD.delegated/molecule.yml 2026-06-19 15:44:31.506013 | debian-bookworm | MOLECULE_INSTANCE_CONFIG: /home/zuul/.ansible/tmp/molecule.oWZD.delegated/instance_config.yml 2026-06-19 15:44:31.506019 | debian-bookworm | MOLECULE_INVENTORY_FILE: /home/zuul/.ansible/tmp/molecule.oWZD.delegated/inventory/ansible_inventory.yml 2026-06-19 15:44:31.506026 | debian-bookworm | MOLECULE_PROJECT_DIRECTORY: /home/zuul/src/github.com/osism/ansible-collection-services 2026-06-19 15:44:31.506033 | debian-bookworm | MOLECULE_PROVISIONER_NAME: ansible 2026-06-19 15:44:31.506039 | debian-bookworm | MOLECULE_SCENARIO_DIRECTORY: /home/zuul/src/github.com/osism/ansible-collection-services/molecule/delegated 2026-06-19 15:44:31.506045 | debian-bookworm | MOLECULE_SCENARIO_NAME: delegated 2026-06-19 15:44:31.506051 | debian-bookworm | MOLECULE_STATE_FILE: /home/zuul/.ansible/tmp/molecule.oWZD.delegated/state.yml 2026-06-19 15:44:31.506058 | debian-bookworm | MOLECULE_VERIFIER_NAME: testinfra 2026-06-19 15:44:31.506064 | debian-bookworm | MOLECULE_VERIFIER_TEST_DIRECTORY: /home/zuul/src/github.com/osism/ansible-collection-services/molecule/delegated/tests 2026-06-19 15:44:31.506071 | debian-bookworm | 2026-06-19 15:44:31.506204 | debian-bookworm | DEBUG SHELL REPLAY: ANSIBLE_COLLECTIONS_PATH=/home/zuul/venv/.ansible/collections:/home/zuul/.ansible/collections ANSIBLE_CONFIG=/home/zuul/.ansible/tmp/molecule.oWZD.delegated/ansible.cfg ANSIBLE_LIBRARY=../../plugins ANSIBLE_PYTHON_INTERPRETER=/home/zuul/venv/bin/python ANSIBLE_ROLE=auditd ANSIBLE_ROLES_PATH=../../roles ANSIBLE_VERBOSITY=1 MOLECULE_DEBUG=True MOLECULE_DEPENDENCY_NAME=galaxy MOLECULE_DRIVER_NAME=default MOLECULE_ENV_FILE=/home/zuul/src/github.com/osism/ansible-collection-services/.env.yml MOLECULE_EPHEMERAL_DIRECTORY=/home/zuul/.ansible/tmp/molecule.oWZD.delegated MOLECULE_FILE=/home/zuul/.ansible/tmp/molecule.oWZD.delegated/molecule.yml MOLECULE_INSTANCE_CONFIG=/home/zuul/.ansible/tmp/molecule.oWZD.delegated/instance_config.yml MOLECULE_INVENTORY_FILE=/home/zuul/.ansible/tmp/molecule.oWZD.delegated/inventory/ansible_inventory.yml MOLECULE_PROJECT_DIRECTORY=/home/zuul/src/github.com/osism/ansible-collection-services MOLECULE_PROVISIONER_NAME=ansible MOLECULE_SCENARIO_DIRECTORY=/home/zuul/src/github.com/osism/ansible-collection-services/molecule/delegated MOLECULE_SCENARIO_NAME=delegated MOLECULE_STATE_FILE=/home/zuul/.ansible/tmp/molecule.oWZD.delegated/state.yml MOLECULE_VERIFIER_NAME=testinfra MOLECULE_VERIFIER_TEST_DIRECTORY=/home/zuul/src/github.com/osism/ansible-collection-services/molecule/delegated/tests 2026-06-19 15:44:31.350678 | ubuntu-noble | INFO [delegated > verify] Executing 2026-06-19 15:44:31.352659 | ubuntu-noble | INFO [delegated > verify] Executing Testinfra tests found in /home/zuul/src/github.com/osism/ansible-collection-services/molecule/delegated/tests/... 2026-06-19 15:44:31.353745 | ubuntu-noble | DEBUG ANSIBLE ENVIRONMENT: 2026-06-19 15:44:31.353764 | ubuntu-noble | ANSIBLE_COLLECTIONS_PATH: /home/zuul/venv/.ansible/collections:/home/zuul/.ansible/collections 2026-06-19 15:44:31.353772 | ubuntu-noble | ANSIBLE_CONFIG: /home/zuul/.ansible/tmp/molecule.oWZD.delegated/ansible.cfg 2026-06-19 15:44:31.353779 | ubuntu-noble | ANSIBLE_LIBRARY: ../../plugins 2026-06-19 15:44:31.353784 | ubuntu-noble | ANSIBLE_PYTHON_INTERPRETER: /home/zuul/venv/bin/python 2026-06-19 15:44:31.353789 | ubuntu-noble | ANSIBLE_ROLE: auditd 2026-06-19 15:44:31.353794 | ubuntu-noble | ANSIBLE_ROLES_PATH: ../../roles 2026-06-19 15:44:31.353799 | ubuntu-noble | ANSIBLE_VERBOSITY: 1 2026-06-19 15:44:31.353804 | ubuntu-noble | 2026-06-19 15:44:31.354032 | ubuntu-noble | DEBUG MOLECULE ENVIRONMENT: 2026-06-19 15:44:31.354043 | ubuntu-noble | MOLECULE_DEBUG: True 2026-06-19 15:44:31.354048 | ubuntu-noble | MOLECULE_DEPENDENCY_NAME: galaxy 2026-06-19 15:44:31.354053 | ubuntu-noble | MOLECULE_DRIVER_NAME: default 2026-06-19 15:44:31.354058 | ubuntu-noble | MOLECULE_ENV_FILE: /home/zuul/src/github.com/osism/ansible-collection-services/.env.yml 2026-06-19 15:44:31.354063 | ubuntu-noble | MOLECULE_EPHEMERAL_DIRECTORY: /home/zuul/.ansible/tmp/molecule.oWZD.delegated 2026-06-19 15:44:31.354069 | ubuntu-noble | MOLECULE_FILE: /home/zuul/.ansible/tmp/molecule.oWZD.delegated/molecule.yml 2026-06-19 15:44:31.354074 | ubuntu-noble | MOLECULE_INSTANCE_CONFIG: /home/zuul/.ansible/tmp/molecule.oWZD.delegated/instance_config.yml 2026-06-19 15:44:31.354079 | ubuntu-noble | MOLECULE_INVENTORY_FILE: /home/zuul/.ansible/tmp/molecule.oWZD.delegated/inventory/ansible_inventory.yml 2026-06-19 15:44:31.354085 | ubuntu-noble | MOLECULE_PROJECT_DIRECTORY: /home/zuul/src/github.com/osism/ansible-collection-services 2026-06-19 15:44:31.354090 | ubuntu-noble | MOLECULE_PROVISIONER_NAME: ansible 2026-06-19 15:44:31.354095 | ubuntu-noble | MOLECULE_SCENARIO_DIRECTORY: /home/zuul/src/github.com/osism/ansible-collection-services/molecule/delegated 2026-06-19 15:44:31.354100 | ubuntu-noble | MOLECULE_SCENARIO_NAME: delegated 2026-06-19 15:44:31.354105 | ubuntu-noble | MOLECULE_STATE_FILE: /home/zuul/.ansible/tmp/molecule.oWZD.delegated/state.yml 2026-06-19 15:44:31.354110 | ubuntu-noble | MOLECULE_VERIFIER_NAME: testinfra 2026-06-19 15:44:31.354115 | ubuntu-noble | MOLECULE_VERIFIER_TEST_DIRECTORY: /home/zuul/src/github.com/osism/ansible-collection-services/molecule/delegated/tests 2026-06-19 15:44:31.354120 | ubuntu-noble | 2026-06-19 15:44:31.354242 | ubuntu-noble | DEBUG SHELL REPLAY: ANSIBLE_COLLECTIONS_PATH=/home/zuul/venv/.ansible/collections:/home/zuul/.ansible/collections ANSIBLE_CONFIG=/home/zuul/.ansible/tmp/molecule.oWZD.delegated/ansible.cfg ANSIBLE_LIBRARY=../../plugins ANSIBLE_PYTHON_INTERPRETER=/home/zuul/venv/bin/python ANSIBLE_ROLE=auditd ANSIBLE_ROLES_PATH=../../roles ANSIBLE_VERBOSITY=1 MOLECULE_DEBUG=True MOLECULE_DEPENDENCY_NAME=galaxy MOLECULE_DRIVER_NAME=default MOLECULE_ENV_FILE=/home/zuul/src/github.com/osism/ansible-collection-services/.env.yml MOLECULE_EPHEMERAL_DIRECTORY=/home/zuul/.ansible/tmp/molecule.oWZD.delegated MOLECULE_FILE=/home/zuul/.ansible/tmp/molecule.oWZD.delegated/molecule.yml MOLECULE_INSTANCE_CONFIG=/home/zuul/.ansible/tmp/molecule.oWZD.delegated/instance_config.yml MOLECULE_INVENTORY_FILE=/home/zuul/.ansible/tmp/molecule.oWZD.delegated/inventory/ansible_inventory.yml MOLECULE_PROJECT_DIRECTORY=/home/zuul/src/github.com/osism/ansible-collection-services MOLECULE_PROVISIONER_NAME=ansible MOLECULE_SCENARIO_DIRECTORY=/home/zuul/src/github.com/osism/ansible-collection-services/molecule/delegated MOLECULE_SCENARIO_NAME=delegated MOLECULE_STATE_FILE=/home/zuul/.ansible/tmp/molecule.oWZD.delegated/state.yml MOLECULE_VERIFIER_NAME=testinfra MOLECULE_VERIFIER_TEST_DIRECTORY=/home/zuul/src/github.com/osism/ansible-collection-services/molecule/delegated/tests 2026-06-19 15:44:31.602609 | ubuntu-noble | writing pytest debug information to pytestdebug.log 2026-06-19 15:44:31.623636 | ubuntu-noble | ============================= test session starts ============================== 2026-06-19 15:44:31.624367 | ubuntu-noble | platform linux -- Python 3.12.3, pytest-8.4.2, pluggy-1.6.0 -- /home/zuul/venv/bin/python3 2026-06-19 15:44:31.624608 | ubuntu-noble | using: pytest-8.4.2 2026-06-19 15:44:31.626071 | ubuntu-noble | registered third-party plugins: 2026-06-19 15:44:31.626107 | ubuntu-noble | pytest-testinfra-10.2.2 at /home/zuul/venv/lib/python3.12/site-packages/testinfra/plugin.py 2026-06-19 15:44:31.626121 | ubuntu-noble | rootdir: /home/zuul 2026-06-19 15:44:31.626135 | ubuntu-noble | plugins: testinfra-10.2.2 2026-06-19 15:44:31.758856 | debian-bookworm | writing pytest debug information to pytestdebug.log 2026-06-19 15:44:31.774668 | debian-bookworm | ============================= test session starts ============================== 2026-06-19 15:44:31.775415 | debian-bookworm | platform linux -- Python 3.11.2, pytest-8.4.2, pluggy-1.6.0 -- /home/zuul/venv/bin/python3 2026-06-19 15:44:31.776024 | debian-bookworm | using: pytest-8.4.2 2026-06-19 15:44:31.776482 | debian-bookworm | registered third-party plugins: 2026-06-19 15:44:31.776922 | debian-bookworm | pytest-testinfra-10.2.2 at /home/zuul/venv/lib/python3.11/site-packages/testinfra/plugin.py 2026-06-19 15:44:31.777306 | debian-bookworm | rootdir: /home/zuul 2026-06-19 15:44:31.777760 | debian-bookworm | plugins: testinfra-10.2.2 2026-06-19 15:44:33.117862 | debian-bookworm | collecting ... collected 6 items 2026-06-19 15:44:33.117960 | debian-bookworm | 2026-06-19 15:44:32.830882 | ubuntu-noble | collecting ... collected 6 items 2026-06-19 15:44:32.830949 | ubuntu-noble | 2026-06-19 15:44:37.843519 | ubuntu-noble | tests/auditd.py::test_pkg[ansible://molecule-auditd] PASSED [ 16%] 2026-06-19 15:44:37.880816 | ubuntu-noble | tests/auditd.py::test_conffile[ansible://molecule-auditd] PASSED [ 33%] 2026-06-19 15:44:38.518515 | debian-bookworm | tests/auditd.py::test_pkg[ansible://molecule-auditd] PASSED [ 16%] 2026-06-19 15:44:38.561148 | debian-bookworm | tests/auditd.py::test_conffile[ansible://molecule-auditd] PASSED [ 33%] 2026-06-19 15:44:40.769977 | ubuntu-noble | tests/auditd.py::test_adjustment[ansible://molecule-auditd] PASSED [ 50%] 2026-06-19 15:44:41.684927 | debian-bookworm | tests/auditd.py::test_adjustment[ansible://molecule-auditd] PASSED [ 50%] 2026-06-19 15:44:46.804388 | ubuntu-noble | tests/auditd.py::test_rulefiles[ansible://molecule-auditd] PASSED [ 66%] 2026-06-19 15:44:47.792548 | debian-bookworm | tests/auditd.py::test_rulefiles[ansible://molecule-auditd] PASSED [ 66%] 2026-06-19 15:44:48.539636 | ubuntu-noble | tests/auditd.py::test_srv[ansible://molecule-auditd] PASSED [ 83%] 2026-06-19 15:44:48.632033 | ubuntu-noble | wrote pytest debug information to pytestdebug.log 2026-06-19 15:44:48.633394 | ubuntu-noble | tests/auditd.py::test_function[ansible://molecule-auditd] PASSED [100%] 2026-06-19 15:44:48.633444 | ubuntu-noble | 2026-06-19 15:44:48.633673 | ubuntu-noble | ============================== 6 passed in 16.95s ============================== 2026-06-19 15:44:48.687908 | ubuntu-noble | INFO [delegated > verify] Verifier completed successfully. 2026-06-19 15:44:48.688478 | ubuntu-noble | INFO [delegated > verify] Executed: Successful 2026-06-19 15:44:48.689511 | ubuntu-noble | INFO Molecule executed 1 scenario (1 successful) 2026-06-19 15:44:48.826920 | ubuntu-noble | ok: Runtime: 0:00:20.219492 2026-06-19 15:44:49.572661 | debian-bookworm | ok: Runtime: 0:00:21.010519 2026-06-19 15:44:49.582037 | 2026-06-19 15:44:49.582200 | TASK [ansible-molecule : Run molecule destroy action with scenario delegated] 2026-06-19 15:44:49.306987 | debian-bookworm | tests/auditd.py::test_srv[ansible://molecule-auditd] PASSED [ 83%] 2026-06-19 15:44:49.390370 | debian-bookworm | wrote pytest debug information to pytestdebug.log 2026-06-19 15:44:49.390898 | debian-bookworm | tests/auditd.py::test_function[ansible://molecule-auditd] PASSED [100%] 2026-06-19 15:44:49.391003 | debian-bookworm | 2026-06-19 15:44:49.391128 | debian-bookworm | ============================== 6 passed in 17.57s ============================== 2026-06-19 15:44:49.443445 | debian-bookworm | INFO [delegated > verify] Verifier completed successfully. 2026-06-19 15:44:49.443940 | debian-bookworm | INFO [delegated > verify] Executed: Successful 2026-06-19 15:44:49.444935 | debian-bookworm | INFO Molecule executed 1 scenario (1 successful) 2026-06-19 15:44:50.137362 | debian-bookworm | skipping: Conditional result was False 2026-06-19 15:44:50.137992 | ubuntu-noble | skipping: Conditional result was False 2026-06-19 15:44:50.150091 | 2026-06-19 15:44:50.150216 | PLAY RECAP 2026-06-19 15:44:50.150302 | debian-bookworm | ok: 17 changed: 12 unreachable: 0 failed: 0 skipped: 16 rescued: 0 ignored: 0 2026-06-19 15:44:50.150337 | ubuntu-noble | ok: 17 changed: 12 unreachable: 0 failed: 0 skipped: 16 rescued: 0 ignored: 0 2026-06-19 15:44:50.150359 | 2026-06-19 15:44:50.322132 | RUN END RESULT_NORMAL: [untrusted : github.com/osism/zuul-jobs/playbooks/ansible-molecule/run.yaml@main] 2026-06-19 15:44:50.324710 | POST-RUN START: [trusted : github.com/osism/zuul-config/playbooks/base/post-fetch.yaml@main] 2026-06-19 15:44:51.146761 | 2026-06-19 15:44:51.146975 | PLAY [Base post-fetch] 2026-06-19 15:44:51.162453 | 2026-06-19 15:44:51.162619 | TASK [diagnose-network : Ensure log directory exists] 2026-06-19 15:44:51.903227 | debian-bookworm | ok 2026-06-19 15:44:51.935990 | ubuntu-noble | ok 2026-06-19 15:44:51.946537 | 2026-06-19 15:44:51.946766 | TASK [diagnose-network : Snapshot dual-stack network state (post)] 2026-06-19 15:45:19.619973 | debian-bookworm | ok: Runtime: 0:00:25.232436 2026-06-19 15:45:30.561777 | ubuntu-noble | ok: Runtime: 0:00:34.685305 2026-06-19 15:45:30.575489 | 2026-06-19 15:45:30.575688 | TASK [diagnose-network : Snapshot Docker/BuildKit IPv6 config (teardown)] 2026-06-19 15:45:36.678803 | debian-bookworm | ok: Runtime: 0:00:00.009305 2026-06-19 15:45:36.743899 | ubuntu-noble | ok: Runtime: 0:00:00.011787 2026-06-19 15:45:36.752952 | 2026-06-19 15:45:36.753132 | TASK [diagnose-network : Probe container network namespace (teardown)] 2026-06-19 15:45:42.808219 | debian-bookworm | ok: Runtime: 0:00:00.010356 2026-06-19 15:45:42.973685 | ubuntu-noble | ok: Runtime: 0:00:00.012181 2026-06-19 15:45:42.992006 | 2026-06-19 15:45:42.992152 | TASK [fetch-output : Set log path for multiple nodes] 2026-06-19 15:45:43.068658 | debian-bookworm | ok 2026-06-19 15:45:43.085529 | ubuntu-noble | ok 2026-06-19 15:45:43.093202 | 2026-06-19 15:45:43.093326 | TASK [fetch-output : Set log path for single node] 2026-06-19 15:45:43.131485 | debian-bookworm | skipping: Conditional result was False 2026-06-19 15:45:43.143696 | ubuntu-noble | skipping: Conditional result was False 2026-06-19 15:45:43.153850 | 2026-06-19 15:45:43.154050 | LOOP [fetch-output : Ensure local output dirs] 2026-06-19 15:45:43.502779 | ubuntu-noble -> localhost | changed: "/var/lib/zuul/builds/bff939a964774a62ba18a41d490c3f3f/work/logs/ubuntu-noble" 2026-06-19 15:45:43.506423 | debian-bookworm -> localhost | changed: "/var/lib/zuul/builds/bff939a964774a62ba18a41d490c3f3f/work/logs/debian-bookworm" 2026-06-19 15:45:43.792311 | ubuntu-noble -> localhost | changed: "/var/lib/zuul/builds/bff939a964774a62ba18a41d490c3f3f/work/artifacts" 2026-06-19 15:45:43.832155 | debian-bookworm -> localhost | ok: "/var/lib/zuul/builds/bff939a964774a62ba18a41d490c3f3f/work/artifacts" 2026-06-19 15:45:44.072506 | ubuntu-noble -> localhost | changed: "/var/lib/zuul/builds/bff939a964774a62ba18a41d490c3f3f/work/docs" 2026-06-19 15:45:44.123385 | debian-bookworm -> localhost | ok: "/var/lib/zuul/builds/bff939a964774a62ba18a41d490c3f3f/work/docs" 2026-06-19 15:45:44.123550 | debian-bookworm -> localhost | changed: All items complete 2026-06-19 15:45:44.123588 | 2026-06-19 15:45:44.138411 | 2026-06-19 15:45:44.138569 | LOOP [fetch-output : Collect logs, artifacts and docs] 2026-06-19 15:45:44.954171 | debian-bookworm | changed: 2026-06-19 15:45:44.954588 | debian-bookworm | .d..t...... ./ 2026-06-19 15:45:44.954643 | debian-bookworm | >f+++++++++ net-debug.post.txt 2026-06-19 15:45:44.954673 | debian-bookworm | >f+++++++++ net-debug.pre.txt 2026-06-19 15:45:44.954698 | debian-bookworm | >f+++++++++ sudo-debug.txt 2026-06-19 15:45:44.954725 | debian-bookworm | >f+++++++++ sudo-strace.log 2026-06-19 15:45:44.954749 | debian-bookworm | >f+++++++++ sudo-strace.log.time 2026-06-19 15:45:44.960565 | ubuntu-noble | changed: 2026-06-19 15:45:44.960658 | ubuntu-noble | .d..t...... ./ 2026-06-19 15:45:44.960688 | ubuntu-noble | >f+++++++++ net-debug.post.txt 2026-06-19 15:45:44.960711 | ubuntu-noble | >f+++++++++ net-debug.pre.txt 2026-06-19 15:45:44.960731 | ubuntu-noble | >f+++++++++ sudo-debug.txt 2026-06-19 15:45:44.960750 | ubuntu-noble | >f+++++++++ sudo-strace.log 2026-06-19 15:45:44.960769 | ubuntu-noble | >f+++++++++ sudo-strace.log.time 2026-06-19 15:45:45.535135 | ubuntu-noble | changed: .d..t...... ./ 2026-06-19 15:45:45.540915 | debian-bookworm | changed: .d..t...... ./ 2026-06-19 15:45:46.139448 | debian-bookworm | changed: .d..t...... ./ 2026-06-19 15:45:46.156866 | ubuntu-noble | ok 2026-06-19 15:45:46.157056 | ubuntu-noble | changed: All items complete 2026-06-19 15:45:46.157099 | 2026-06-19 15:45:46.182145 | 2026-06-19 15:45:46.182325 | LOOP [merge-output-to-logs : Move artifacts and docs to logs dir] 2026-06-19 15:45:46.558489 | debian-bookworm -> localhost | ok: Item: artifacts Runtime: 0:00:00.012554 2026-06-19 15:45:46.880495 | debian-bookworm -> localhost | ok: Item: docs Runtime: 0:00:00.013629 2026-06-19 15:45:46.896991 | 2026-06-19 15:45:46.897099 | PLAY RECAP 2026-06-19 15:45:46.897154 | debian-bookworm | ok: 8 changed: 3 unreachable: 0 failed: 0 skipped: 1 rescued: 0 ignored: 0 2026-06-19 15:45:46.897189 | ubuntu-noble | ok: 7 changed: 2 unreachable: 0 failed: 0 skipped: 1 rescued: 0 ignored: 0 2026-06-19 15:45:46.897211 | 2026-06-19 15:45:47.054937 | POST-RUN END RESULT_NORMAL: [trusted : github.com/osism/zuul-config/playbooks/base/post-fetch.yaml@main] 2026-06-19 15:45:47.056664 | POST-RUN START: [trusted : github.com/osism/zuul-config/playbooks/base/post.yaml@main] 2026-06-19 15:45:47.936630 | 2026-06-19 15:45:47.936807 | PLAY [Base post] 2026-06-19 15:45:47.950334 | 2026-06-19 15:45:47.950492 | TASK [remove-build-sshkey : Remove the build SSH key from all nodes] 2026-06-19 15:45:48.764897 | debian-bookworm | changed 2026-06-19 15:45:48.823893 | ubuntu-noble | changed 2026-06-19 15:45:48.838220 | 2026-06-19 15:45:48.838419 | PLAY RECAP 2026-06-19 15:45:48.838516 | debian-bookworm | ok: 1 changed: 1 unreachable: 0 failed: 0 skipped: 0 rescued: 0 ignored: 0 2026-06-19 15:45:48.838555 | ubuntu-noble | ok: 1 changed: 1 unreachable: 0 failed: 0 skipped: 0 rescued: 0 ignored: 0 2026-06-19 15:45:48.838580 | 2026-06-19 15:45:49.029870 | POST-RUN END RESULT_NORMAL: [trusted : github.com/osism/zuul-config/playbooks/base/post.yaml@main] 2026-06-19 15:45:49.032957 | POST-RUN START: [trusted : github.com/osism/zuul-config/playbooks/base/post-logs.yaml@main] 2026-06-19 15:45:49.948321 | 2026-06-19 15:45:49.948518 | PLAY [Base post-logs] 2026-06-19 15:45:49.960528 | 2026-06-19 15:45:49.960700 | TASK [generate-zuul-manifest : Generate Zuul manifest] 2026-06-19 15:45:50.445987 | localhost | changed 2026-06-19 15:45:50.469306 | 2026-06-19 15:45:50.469628 | TASK [generate-zuul-manifest : Return Zuul manifest URL to Zuul] 2026-06-19 15:45:50.507330 | localhost | ok 2026-06-19 15:45:50.514648 | 2026-06-19 15:45:50.514820 | TASK [Set zuul-log-path fact] 2026-06-19 15:45:50.532720 | localhost | ok 2026-06-19 15:45:50.547376 | 2026-06-19 15:45:50.547516 | TASK [set-zuul-log-path-fact : Set log path for a build] 2026-06-19 15:45:50.575916 | localhost | ok 2026-06-19 15:45:50.582270 | 2026-06-19 15:45:50.582473 | TASK [upload-logs : Create log directories] 2026-06-19 15:45:51.213682 | localhost | changed 2026-06-19 15:45:51.220830 | 2026-06-19 15:45:51.221024 | TASK [upload-logs : Ensure logs are readable before uploading] 2026-06-19 15:45:51.828215 | localhost -> localhost | ok: Runtime: 0:00:00.007912 2026-06-19 15:45:51.833545 | 2026-06-19 15:45:51.833685 | TASK [upload-logs : Upload logs to log server] 2026-06-19 15:45:52.452686 | localhost | Output suppressed because no_log was given 2026-06-19 15:45:52.457157 | 2026-06-19 15:45:52.457392 | LOOP [upload-logs : Compress console log and json output] 2026-06-19 15:45:52.521899 | localhost | skipping: Conditional result was False 2026-06-19 15:45:52.527111 | localhost | skipping: Conditional result was False 2026-06-19 15:45:52.541005 | 2026-06-19 15:45:52.541257 | LOOP [upload-logs : Upload compressed console log and json output] 2026-06-19 15:45:52.594015 | localhost | skipping: Conditional result was False 2026-06-19 15:45:52.594724 | 2026-06-19 15:45:52.597914 | localhost | skipping: Conditional result was False 2026-06-19 15:45:52.606286 | 2026-06-19 15:45:52.606646 | LOOP [upload-logs : Upload console log and json output]