2026-06-22 02:34:53.937374 | Job console starting 2026-06-22 02:34:53.969865 | Updating git repos 2026-06-22 02:34:54.025209 | Cloning repos into workspace 2026-06-22 02:34:54.227556 | Restoring repo states 2026-06-22 02:34:54.246197 | Merging changes 2026-06-22 02:34:54.988139 | Checking out repos 2026-06-22 02:34:55.075319 | Preparing playbooks 2026-06-22 02:34:56.065075 | Running Ansible setup 2026-06-22 02:35:03.027613 | PRE-RUN START: [trusted : github.com/osism/zuul-config/playbooks/base/pre.yaml@main] 2026-06-22 02:35:03.866182 | 2026-06-22 02:35:03.866384 | PLAY [Base pre] 2026-06-22 02:35:03.885759 | 2026-06-22 02:35:03.885929 | TASK [Setup log path fact] 2026-06-22 02:35:03.921758 | debian-bookworm | ok 2026-06-22 02:35:03.947359 | 2026-06-22 02:35:03.947717 | TASK [set-zuul-log-path-fact : Set log path for a build] 2026-06-22 02:35:04.012159 | debian-bookworm | ok 2026-06-22 02:35:04.027399 | 2026-06-22 02:35:04.027541 | TASK [emit-job-header : Print job information] 2026-06-22 02:35:04.084846 | # Job Information 2026-06-22 02:35:04.085082 | Ansible Version: 2.16.14 2026-06-22 02:35:04.085146 | Job: ansible-collection-services-molecule-auditd 2026-06-22 02:35:04.085191 | Pipeline: check 2026-06-22 02:35:04.085220 | Executor: 521e9411259a 2026-06-22 02:35:04.085246 | Triggered by: https://github.com/osism/ansible-collection-services/pull/2117 2026-06-22 02:35:04.085275 | Event ID: e81e1c80-6de2-11f1-9927-576c27cae047 2026-06-22 02:35:04.091678 | 2026-06-22 02:35:04.091830 | LOOP [emit-job-header : Print node information] 2026-06-22 02:35:04.231403 | debian-bookworm | ok: 2026-06-22 02:35:04.231724 | debian-bookworm | # Node Information 2026-06-22 02:35:04.231763 | debian-bookworm | Inventory Hostname: debian-bookworm 2026-06-22 02:35:04.231789 | debian-bookworm | Hostname: debian 2026-06-22 02:35:04.231812 | debian-bookworm | Username: zuul 2026-06-22 02:35:04.231833 | debian-bookworm | Distro: Debian 12.14 2026-06-22 02:35:04.231861 | debian-bookworm | Provider: regiocloud-a 2026-06-22 02:35:04.231883 | debian-bookworm | Region: 2026-06-22 02:35:04.231904 | debian-bookworm | Label: debian-bookworm 2026-06-22 02:35:04.231924 | debian-bookworm | Product Name: OpenStack Nova 2026-06-22 02:35:04.231944 | debian-bookworm | Interface IP: 2a13:1a81:8000:3124:f816:3eff:feed:339a 2026-06-22 02:35:04.324415 | debian-bookworm | ok: 2026-06-22 02:35:04.324574 | debian-bookworm | # Node Information 2026-06-22 02:35:04.324607 | debian-bookworm | Inventory Hostname: ubuntu-noble 2026-06-22 02:35:04.324632 | debian-bookworm | Hostname: ubuntu 2026-06-22 02:35:04.324658 | debian-bookworm | Username: zuul 2026-06-22 02:35:04.324680 | debian-bookworm | Distro: Ubuntu 24.04 2026-06-22 02:35:04.324701 | debian-bookworm | Provider: regiocloud-a 2026-06-22 02:35:04.324721 | debian-bookworm | Region: 2026-06-22 02:35:04.324741 | debian-bookworm | Label: ubuntu-noble 2026-06-22 02:35:04.324908 | debian-bookworm | Product Name: OpenStack Nova 2026-06-22 02:35:04.324942 | debian-bookworm | Interface IP: 2a13:1a81:8000:3124:f816:3eff:fe37:4a1a 2026-06-22 02:35:04.340705 | 2026-06-22 02:35:04.340871 | TASK [log-inventory : Ensure Zuul Ansible directory exists] 2026-06-22 02:35:04.962041 | debian-bookworm -> localhost | changed 2026-06-22 02:35:04.971682 | 2026-06-22 02:35:04.971812 | TASK [log-inventory : Copy ansible inventory to logs dir] 2026-06-22 02:35:06.353887 | ubuntu-noble -> localhost | changed 2026-06-22 02:35:06.428566 | debian-bookworm -> localhost | ok 2026-06-22 02:35:06.451285 | 2026-06-22 02:35:06.451487 | TASK [add-build-sshkey : Check to see if ssh key was already created for this build] 2026-06-22 02:35:06.776530 | debian-bookworm -> localhost | ok 2026-06-22 02:35:06.786383 | 2026-06-22 02:35:06.786517 | TASK [add-build-sshkey : Create a new key in workspace based on build UUID] 2026-06-22 02:35:06.859959 | debian-bookworm | ok 2026-06-22 02:35:06.866642 | ubuntu-noble | ok 2026-06-22 02:35:06.899739 | debian-bookworm | included: /var/lib/zuul/builds/d59bce2d6a094e85a2aeeac5a8010bfb/trusted/project_1/github.com/osism/openinfra-zuul-jobs/roles/add-build-sshkey/tasks/create-key-and-replace.yaml 2026-06-22 02:35:06.900032 | ubuntu-noble | included: /var/lib/zuul/builds/d59bce2d6a094e85a2aeeac5a8010bfb/trusted/project_1/github.com/osism/openinfra-zuul-jobs/roles/add-build-sshkey/tasks/create-key-and-replace.yaml 2026-06-22 02:35:06.909593 | 2026-06-22 02:35:06.909717 | TASK [add-build-sshkey : Create Temp SSH key] 2026-06-22 02:35:08.392933 | debian-bookworm -> localhost | Generating public/private rsa key pair. 2026-06-22 02:35:08.393495 | debian-bookworm -> localhost | Your identification has been saved in /var/lib/zuul/builds/d59bce2d6a094e85a2aeeac5a8010bfb/work/d59bce2d6a094e85a2aeeac5a8010bfb_id_rsa 2026-06-22 02:35:08.393584 | debian-bookworm -> localhost | Your public key has been saved in /var/lib/zuul/builds/d59bce2d6a094e85a2aeeac5a8010bfb/work/d59bce2d6a094e85a2aeeac5a8010bfb_id_rsa.pub 2026-06-22 02:35:08.393642 | debian-bookworm -> localhost | The key fingerprint is: 2026-06-22 02:35:08.393696 | debian-bookworm -> localhost | SHA256:G5kxtkXMn7/9nPeqmJGixuIc1iADcvdNZ+4A2l9Z+l0 zuul-build-sshkey 2026-06-22 02:35:08.393742 | debian-bookworm -> localhost | The key's randomart image is: 2026-06-22 02:35:08.393788 | debian-bookworm -> localhost | +---[RSA 3072]----+ 2026-06-22 02:35:08.393829 | debian-bookworm -> localhost | | o. | 2026-06-22 02:35:08.393869 | debian-bookworm -> localhost | | .o | 2026-06-22 02:35:08.393908 | debian-bookworm -> localhost | |o . . . = +... | 2026-06-22 02:35:08.393945 | debian-bookworm -> localhost | |.o . + = @ +o | 2026-06-22 02:35:08.393980 | debian-bookworm -> localhost | | o o o S = . E| 2026-06-22 02:35:08.394261 | debian-bookworm -> localhost | | o o . * o ... | 2026-06-22 02:35:08.394334 | debian-bookworm -> localhost | | o.. + + . .o | 2026-06-22 02:35:08.394378 | debian-bookworm -> localhost | | o..o. . + ..+| 2026-06-22 02:35:08.394416 | debian-bookworm -> localhost | | .oo. o ...oB| 2026-06-22 02:35:08.394452 | debian-bookworm -> localhost | +----[SHA256]-----+ 2026-06-22 02:35:08.394570 | debian-bookworm -> localhost | ok: Runtime: 0:00:00.834232 2026-06-22 02:35:08.412909 | 2026-06-22 02:35:08.413083 | TASK [add-build-sshkey : Remote setup ssh keys (linux)] 2026-06-22 02:35:08.463053 | debian-bookworm | ok 2026-06-22 02:35:08.488364 | ubuntu-noble | ok 2026-06-22 02:35:08.505923 | debian-bookworm | included: /var/lib/zuul/builds/d59bce2d6a094e85a2aeeac5a8010bfb/trusted/project_1/github.com/osism/openinfra-zuul-jobs/roles/add-build-sshkey/tasks/remote-linux.yaml 2026-06-22 02:35:08.506051 | ubuntu-noble | included: /var/lib/zuul/builds/d59bce2d6a094e85a2aeeac5a8010bfb/trusted/project_1/github.com/osism/openinfra-zuul-jobs/roles/add-build-sshkey/tasks/remote-linux.yaml 2026-06-22 02:35:08.519161 | 2026-06-22 02:35:08.519311 | TASK [add-build-sshkey : Remove previously added zuul-build-sshkey] 2026-06-22 02:35:08.564427 | debian-bookworm | skipping: Conditional result was False 2026-06-22 02:35:08.565097 | ubuntu-noble | skipping: Conditional result was False 2026-06-22 02:35:08.572934 | 2026-06-22 02:35:08.573066 | TASK [add-build-sshkey : Enable access via build key on all nodes] 2026-06-22 02:35:09.264498 | debian-bookworm | changed 2026-06-22 02:35:09.311301 | ubuntu-noble | changed 2026-06-22 02:35:09.317020 | 2026-06-22 02:35:09.317155 | TASK [add-build-sshkey : Make sure user has a .ssh] 2026-06-22 02:35:09.590164 | debian-bookworm | ok 2026-06-22 02:35:09.614783 | ubuntu-noble | ok 2026-06-22 02:35:09.636885 | 2026-06-22 02:35:09.637351 | TASK [add-build-sshkey : Install build private key as SSH key on all nodes] 2026-06-22 02:35:10.334775 | debian-bookworm | changed 2026-06-22 02:35:10.410804 | ubuntu-noble | changed 2026-06-22 02:35:10.420794 | 2026-06-22 02:35:10.420975 | TASK [add-build-sshkey : Install build public key as SSH key on all nodes] 2026-06-22 02:35:11.200280 | debian-bookworm | changed 2026-06-22 02:35:11.207390 | ubuntu-noble | changed 2026-06-22 02:35:11.213481 | 2026-06-22 02:35:11.213615 | TASK [add-build-sshkey : Remote setup ssh keys (windows)] 2026-06-22 02:35:11.244865 | debian-bookworm | skipping: Conditional result was False 2026-06-22 02:35:11.256385 | ubuntu-noble | skipping: Conditional result was False 2026-06-22 02:35:11.264006 | 2026-06-22 02:35:11.264168 | TASK [remove-zuul-sshkey : Remove master key from local agent] 2026-06-22 02:35:11.781728 | debian-bookworm -> localhost | changed 2026-06-22 02:35:11.799399 | 2026-06-22 02:35:11.799556 | TASK [add-build-sshkey : Add back temp key] 2026-06-22 02:35:12.213729 | debian-bookworm -> localhost | Identity added: /var/lib/zuul/builds/d59bce2d6a094e85a2aeeac5a8010bfb/work/d59bce2d6a094e85a2aeeac5a8010bfb_id_rsa (zuul-build-sshkey) 2026-06-22 02:35:12.214586 | debian-bookworm -> localhost | ok: Runtime: 0:00:00.015523 2026-06-22 02:35:12.231106 | 2026-06-22 02:35:12.231476 | TASK [add-build-sshkey : Verify we can still SSH to all nodes] 2026-06-22 02:35:12.606961 | debian-bookworm | ok 2026-06-22 02:35:12.652321 | ubuntu-noble | ok 2026-06-22 02:35:12.659514 | 2026-06-22 02:35:12.659683 | TASK [add-build-sshkey : Verify we can still SSH to all nodes (windows)] 2026-06-22 02:35:12.688545 | debian-bookworm | skipping: Conditional result was False 2026-06-22 02:35:12.699807 | ubuntu-noble | skipping: Conditional result was False 2026-06-22 02:35:12.718540 | 2026-06-22 02:35:12.718712 | TASK [start-zuul-console : Start zuul_console daemon.] 2026-06-22 02:35:13.154134 | debian-bookworm | ok 2026-06-22 02:35:13.206964 | ubuntu-noble | ok 2026-06-22 02:35:13.229162 | 2026-06-22 02:35:13.229312 | TASK [validate-host : Define zuul_info_dir fact] 2026-06-22 02:35:13.278471 | debian-bookworm | ok 2026-06-22 02:35:13.285481 | ubuntu-noble | ok 2026-06-22 02:35:13.293078 | 2026-06-22 02:35:13.293290 | TASK [validate-host : Ensure Zuul Ansible directory exists] 2026-06-22 02:35:13.645792 | debian-bookworm -> localhost | ok 2026-06-22 02:35:13.665825 | 2026-06-22 02:35:13.666017 | TASK [validate-host : Collect information about the host] 2026-06-22 02:35:14.880743 | debian-bookworm | ok 2026-06-22 02:35:16.040481 | ubuntu-noble | ok 2026-06-22 02:35:16.053615 | 2026-06-22 02:35:16.053785 | TASK [validate-host : Sanitize hostname] 2026-06-22 02:35:16.116559 | debian-bookworm | ok 2026-06-22 02:35:16.133291 | ubuntu-noble | ok 2026-06-22 02:35:16.139428 | 2026-06-22 02:35:16.139605 | TASK [validate-host : Write out all ansible variables/facts known for each host] 2026-06-22 02:35:16.868211 | debian-bookworm -> localhost | changed 2026-06-22 02:35:16.910329 | ubuntu-noble -> localhost | changed 2026-06-22 02:35:16.917237 | 2026-06-22 02:35:16.917387 | TASK [validate-host : Collect information about zuul worker] 2026-06-22 02:35:17.464260 | debian-bookworm | ok 2026-06-22 02:35:17.505876 | ubuntu-noble | ok 2026-06-22 02:35:17.513887 | 2026-06-22 02:35:17.514062 | TASK [validate-host : Write out all zuul information for each host] 2026-06-22 02:35:18.099859 | debian-bookworm -> localhost | changed 2026-06-22 02:35:18.152513 | ubuntu-noble -> localhost | changed 2026-06-22 02:35:18.175729 | 2026-06-22 02:35:18.175916 | TASK [prepare-workspace-log : Start zuul_console daemon.] 2026-06-22 02:35:18.446731 | debian-bookworm | ok 2026-06-22 02:35:18.521326 | ubuntu-noble | ok 2026-06-22 02:35:18.537779 | 2026-06-22 02:35:18.538054 | TASK [prepare-workspace-log : Synchronize src repos to workspace directory.] 2026-06-22 02:35:19.788613 | debian-bookworm | changed: 2026-06-22 02:35:19.788956 | debian-bookworm | cd+++++++++ src/ 2026-06-22 02:35:19.788992 | debian-bookworm | cd+++++++++ src/github.com/ 2026-06-22 02:35:19.789015 | debian-bookworm | cd+++++++++ src/github.com/osism/ 2026-06-22 02:35:19.789036 | debian-bookworm | cd+++++++++ src/github.com/osism/ansible-collection-services/ 2026-06-22 02:35:19.789056 | debian-bookworm | config] provisioner.env found in /home/zuul/src/github.com/osism/ansible-collection-services/molecule/delegated/molecule.yml, this can be defined in ansible.env 2026-06-22 02:36:59.820447 | debian-bookworm | WARNING Molecule scenarios should migrate to 'extensions/molecule' 2026-06-22 02:36:59.855421 | debian-bookworm | DEBUG [unknown > config] provisioner.env found in /home/zuul/src/github.com/osism/ansible-collection-services/molecule/delegated/molecule.yml, this can be defined in ansible.env 2026-06-22 02:37:00.614412 | ubuntu-noble | DEBUG [unknown > config] provisioner.env found in /home/zuul/src/github.com/osism/ansible-collection-services/molecule/delegated/molecule.yml, this can be defined in ansible.env 2026-06-22 02:37:00.615257 | ubuntu-noble | DEBUG [delegated > validate] Validating schema /home/zuul/src/github.com/osism/ansible-collection-services/molecule/delegated/molecule.yml. 2026-06-22 02:37:00.638101 | ubuntu-noble | DEBUG [default > validate] Validating schema /home/zuul/src/github.com/osism/ansible-collection-services/molecule/default/molecule.yml. 2026-06-22 02:37:00.644041 | ubuntu-noble | INFO [delegated > discovery] scenario test matrix: dependency 2026-06-22 02:37:00.644188 | ubuntu-noble | INFO [delegated > prerun] Performing prerun with role_name_check=0... 2026-06-22 02:37:00.618042 | debian-bookworm | DEBUG [unknown > config] provisioner.env found in /home/zuul/src/github.com/osism/ansible-collection-services/molecule/delegated/molecule.yml, this can be defined in ansible.env 2026-06-22 02:37:00.618649 | debian-bookworm | DEBUG [delegated > validate] Validating schema /home/zuul/src/github.com/osism/ansible-collection-services/molecule/delegated/molecule.yml. 2026-06-22 02:37:00.638590 | debian-bookworm | DEBUG [default > validate] Validating schema /home/zuul/src/github.com/osism/ansible-collection-services/molecule/default/molecule.yml. 2026-06-22 02:37:00.644840 | debian-bookworm | INFO [delegated > discovery] scenario test matrix: dependency 2026-06-22 02:37:00.644948 | debian-bookworm | INFO [delegated > prerun] Performing prerun with role_name_check=0... 2026-06-22 02:37:02.009727 | debian-bookworm | INFO [delegated > dependency] Executing 2026-06-22 02:37:02.010203 | debian-bookworm | WARNING [delegated > dependency] Missing roles requirements file: requirements.yml 2026-06-22 02:37:02.361194 | ubuntu-noble | INFO [delegated > dependency] Executing 2026-06-22 02:37:02.362050 | ubuntu-noble | WARNING [delegated > dependency] Missing roles requirements file: requirements.yml 2026-06-22 02:37:02.465835 | debian-bookworm | ansible-galaxy [core 2.19.11] 2026-06-22 02:37:02.466224 | debian-bookworm | config file = None 2026-06-22 02:37:02.466547 | debian-bookworm | configured module search path = ['/home/zuul/src/github.com/osism/ansible-collection-services/plugins/modules', '/home/zuul/.ansible/plugins/modules', '/usr/share/ansible/plugins/modules'] 2026-06-22 02:37:02.466933 | debian-bookworm | ansible python module location = /home/zuul/venv/lib/python3.11/site-packages/ansible 2026-06-22 02:37:02.467267 | debian-bookworm | ansible collection location = /home/zuul/.ansible/collections:/usr/share/ansible/collections:/home/zuul/venv/lib/python3.11/site-packages:/home/zuul/venv/lib/python3.11/dist-packages:/home/zuul/venv/lib/python3/dist-packages:/home/zuul/venv/local/lib/python3.11/dist-packages 2026-06-22 02:37:02.467533 | debian-bookworm | executable location = /home/zuul/venv/bin/ansible-galaxy 2026-06-22 02:37:02.467877 | debian-bookworm | python version = 3.11.2 (main, Apr 8 2026, 01:58:00) [GCC 12.2.0] (/home/zuul/venv/bin/python3) 2026-06-22 02:37:02.468188 | debian-bookworm | jinja version = 3.1.6 2026-06-22 02:37:02.468432 | debian-bookworm | pyyaml version = 6.0.3 (with libyaml v0.2.5) 2026-06-22 02:37:02.468666 | debian-bookworm | No config file found; using defaults 2026-06-22 02:37:02.469066 | debian-bookworm | Reading requirement file at '/home/zuul/src/github.com/osism/ansible-collection-services/molecule/delegated/collections.yml' 2026-06-22 02:37:02.477491 | debian-bookworm | Loading collection fortinet.fortimanager from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/fortinet/fortimanager 2026-06-22 02:37:02.477972 | debian-bookworm | Found installed collection fortinet.fortimanager:2.11.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/fortinet/fortimanager' 2026-06-22 02:37:02.478293 | debian-bookworm | Loading collection cyberark.pas from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/cyberark/pas 2026-06-22 02:37:02.478729 | debian-bookworm | Found installed collection cyberark.pas:1.0.36 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/cyberark/pas' 2026-06-22 02:37:02.479065 | debian-bookworm | Loading collection kaytus.ksmanage from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/kaytus/ksmanage 2026-06-22 02:37:02.479392 | debian-bookworm | Found installed collection kaytus.ksmanage:2.0.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/kaytus/ksmanage' 2026-06-22 02:37:02.479821 | debian-bookworm | Loading collection community.libvirt from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/libvirt 2026-06-22 02:37:02.480095 | debian-bookworm | Found installed collection community.libvirt:2.0.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/libvirt' 2026-06-22 02:37:02.480506 | debian-bookworm | Loading collection ieisystem.inmanage from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/ieisystem/inmanage 2026-06-22 02:37:02.480854 | debian-bookworm | Found installed collection ieisystem.inmanage:3.0.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/ieisystem/inmanage' 2026-06-22 02:37:02.481497 | debian-bookworm | Loading collection kubernetes.core from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/kubernetes/core 2026-06-22 02:37:02.481819 | debian-bookworm | Found installed collection kubernetes.core:6.2.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/kubernetes/core' 2026-06-22 02:37:02.482349 | debian-bookworm | Loading collection netapp.storagegrid from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/netapp/storagegrid 2026-06-22 02:37:02.482649 | debian-bookworm | Found installed collection netapp.storagegrid:21.15.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/netapp/storagegrid' 2026-06-22 02:37:02.483276 | debian-bookworm | Loading collection ibm.qradar from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/ibm/qradar 2026-06-22 02:37:02.483576 | debian-bookworm | Found installed collection ibm.qradar:4.0.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/ibm/qradar' 2026-06-22 02:37:02.484074 | debian-bookworm | Loading collection community.proxmox from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/proxmox 2026-06-22 02:37:02.484383 | debian-bookworm | Found installed collection community.proxmox:1.4.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/proxmox' 2026-06-22 02:37:02.484899 | debian-bookworm | Loading collection vultr.cloud from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/vultr/cloud 2026-06-22 02:37:02.485208 | debian-bookworm | Found installed collection vultr.cloud:1.13.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/vultr/cloud' 2026-06-22 02:37:02.485491 | debian-bookworm | Loading collection community.sops from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/sops 2026-06-22 02:37:02.485772 | debian-bookworm | Found installed collection community.sops:2.2.7 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/sops' 2026-06-22 02:37:02.486630 | debian-bookworm | Loading collection netapp.ontap from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/netapp/ontap 2026-06-22 02:37:02.486965 | debian-bookworm | Found installed collection netapp.ontap:23.2.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/netapp/ontap' 2026-06-22 02:37:02.487252 | debian-bookworm | Loading collection community.grafana from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/grafana 2026-06-22 02:37:02.487526 | debian-bookworm | Found installed collection community.grafana:2.3.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/grafana' 2026-06-22 02:37:02.487942 | debian-bookworm | Loading collection ansible.windows from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/ansible/windows 2026-06-22 02:37:02.488172 | debian-bookworm | Found installed collection ansible.windows:3.2.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/ansible/windows' 2026-06-22 02:37:02.489728 | debian-bookworm | Loading collection community.windows from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/windows 2026-06-22 02:37:02.490074 | debian-bookworm | Found installed collection community.windows:3.0.1 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/windows' 2026-06-22 02:37:02.490309 | debian-bookworm | Loading collection ansible.netcommon from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/ansible/netcommon 2026-06-22 02:37:02.490652 | debian-bookworm | Found installed collection ansible.netcommon:8.1.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/ansible/netcommon' 2026-06-22 02:37:02.490901 | debian-bookworm | Loading collection community.routeros from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/routeros 2026-06-22 02:37:02.491260 | debian-bookworm | Found installed collection community.routeros:3.13.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/routeros' 2026-06-22 02:37:02.491935 | debian-bookworm | Loading collection openstack.cloud from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/openstack/cloud 2026-06-22 02:37:02.492232 | debian-bookworm | Found installed collection openstack.cloud:2.5.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/openstack/cloud' 2026-06-22 02:37:02.492608 | debian-bookworm | Loading collection f5networks.f5_modules from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/f5networks/f5_modules 2026-06-22 02:37:02.492935 | debian-bookworm | Found installed collection f5networks.f5_modules:1.39.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/f5networks/f5_modules' 2026-06-22 02:37:02.493242 | debian-bookworm | Loading collection community.ciscosmb from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/ciscosmb 2026-06-22 02:37:02.493465 | debian-bookworm | Found installed collection community.ciscosmb:1.0.11 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/ciscosmb' 2026-06-22 02:37:02.494036 | debian-bookworm | Loading collection splunk.es from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/splunk/es 2026-06-22 02:37:02.494344 | debian-bookworm | Found installed collection splunk.es:4.0.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/splunk/es' 2026-06-22 02:37:02.494613 | debian-bookworm | Loading collection cisco.intersight from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/cisco/intersight 2026-06-22 02:37:02.494901 | debian-bookworm | Found installed collection cisco.intersight:2.7.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/cisco/intersight' 2026-06-22 02:37:02.495133 | debian-bookworm | Loading collection cisco.dnac from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/cisco/dnac 2026-06-22 02:37:02.495442 | debian-bookworm | Found installed collection cisco.dnac:6.41.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/cisco/dnac' 2026-06-22 02:37:02.495737 | debian-bookworm | Loading collection grafana.grafana from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/grafana/grafana 2026-06-22 02:37:02.496085 | debian-bookworm | Found installed collection grafana.grafana:6.0.6 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/grafana/grafana' 2026-06-22 02:37:02.496279 | debian-bookworm | Loading collection ansible.posix from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/ansible/posix 2026-06-22 02:37:02.496555 | debian-bookworm | Found installed collection ansible.posix:2.1.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/ansible/posix' 2026-06-22 02:37:02.496852 | debian-bookworm | Loading collection ravendb.ravendb from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/ravendb/ravendb 2026-06-22 02:37:02.497160 | debian-bookworm | Found installed collection ravendb.ravendb:1.0.4 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/ravendb/ravendb' 2026-06-22 02:37:02.497465 | debian-bookworm | Loading collection microsoft.ad from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/microsoft/ad 2026-06-22 02:37:02.497737 | debian-bookworm | Found installed collection microsoft.ad:1.9.2 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/microsoft/ad' 2026-06-22 02:37:02.498033 | debian-bookworm | Loading collection kubevirt.core from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/kubevirt/core 2026-06-22 02:37:02.498309 | debian-bookworm | Found installed collection kubevirt.core:2.2.3 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/kubevirt/core' 2026-06-22 02:37:02.501539 | debian-bookworm | Loading collection community.aws from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/aws 2026-06-22 02:37:02.501796 | debian-bookworm | Found installed collection community.aws:10.0.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/aws' 2026-06-22 02:37:02.502100 | debian-bookworm | Loading collection community.mysql from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/mysql 2026-06-22 02:37:02.502407 | debian-bookworm | Found installed collection community.mysql:3.16.1 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/mysql' 2026-06-22 02:37:02.502961 | debian-bookworm | Loading collection check_point.mgmt from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/check_point/mgmt 2026-06-22 02:37:02.503265 | debian-bookworm | Found installed collection check_point.mgmt:6.6.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/check_point/mgmt' 2026-06-22 02:37:02.503519 | debian-bookworm | Loading collection inspur.ispim from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/inspur/ispim 2026-06-22 02:37:02.503816 | debian-bookworm | Found installed collection inspur.ispim:2.2.3 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/inspur/ispim' 2026-06-22 02:37:02.504444 | debian-bookworm | Loading collection netbox.netbox from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/netbox/netbox 2026-06-22 02:37:02.504728 | debian-bookworm | Found installed collection netbox.netbox:3.21.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/netbox/netbox' 2026-06-22 02:37:02.505059 | debian-bookworm | Loading collection community.sap_libs from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/sap_libs 2026-06-22 02:37:02.505350 | debian-bookworm | Found installed collection community.sap_libs:1.5.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/sap_libs' 2026-06-22 02:37:02.505844 | debian-bookworm | Loading collection community.crypto from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/crypto 2026-06-22 02:37:02.506158 | debian-bookworm | Found installed collection community.crypto:3.0.5 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/crypto' 2026-06-22 02:37:02.508519 | debian-bookworm | Loading collection vmware.vmware_rest from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/vmware/vmware_rest 2026-06-22 02:37:02.508865 | debian-bookworm | Found installed collection vmware.vmware_rest:4.9.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/vmware/vmware_rest' 2026-06-22 02:37:02.509221 | debian-bookworm | Loading collection chocolatey.chocolatey from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/chocolatey/chocolatey 2026-06-22 02:37:02.509532 | debian-bookworm | Found installed collection chocolatey.chocolatey:1.5.3 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/chocolatey/chocolatey' 2026-06-22 02:37:02.510330 | debian-bookworm | Loading collection dellemc.unity from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/dellemc/unity 2026-06-22 02:37:02.510583 | debian-bookworm | Found installed collection dellemc.unity:2.1.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/dellemc/unity' 2026-06-22 02:37:02.510886 | debian-bookworm | Loading collection hitachivantara.vspone_object from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/hitachivantara/vspone_object 2026-06-22 02:37:02.511164 | debian-bookworm | Found installed collection hitachivantara.vspone_object:1.0.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/hitachivantara/vspone_object' 2026-06-22 02:37:02.511983 | debian-bookworm | Loading collection arista.eos from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/arista/eos 2026-06-22 02:37:02.512229 | debian-bookworm | Found installed collection arista.eos:12.0.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/arista/eos' 2026-06-22 02:37:02.512628 | debian-bookworm | Loading collection vmware.vmware from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/vmware/vmware 2026-06-22 02:37:02.512993 | debian-bookworm | Found installed collection vmware.vmware:2.4.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/vmware/vmware' 2026-06-22 02:37:02.514297 | debian-bookworm | Loading collection cisco.mso from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/cisco/mso 2026-06-22 02:37:02.514541 | debian-bookworm | Found installed collection cisco.mso:2.11.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/cisco/mso' 2026-06-22 02:37:02.515444 | debian-bookworm | Loading collection google.cloud from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/google/cloud 2026-06-22 02:37:02.515788 | debian-bookworm | Found installed collection google.cloud:1.9.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/google/cloud' 2026-06-22 02:37:02.516012 | debian-bookworm | Loading collection cyberark.conjur from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/cyberark/conjur 2026-06-22 02:37:02.516291 | debian-bookworm | Found installed collection cyberark.conjur:1.3.8 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/cyberark/conjur' 2026-06-22 02:37:02.518114 | debian-bookworm | Loading collection azure.azcollection from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/azure/azcollection 2026-06-22 02:37:02.518403 | debian-bookworm | Found installed collection azure.azcollection:3.10.1 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/azure/azcollection' 2026-06-22 02:37:02.518714 | debian-bookworm | Loading collection purestorage.flashblade from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/purestorage/flashblade 2026-06-22 02:37:02.519035 | debian-bookworm | Found installed collection purestorage.flashblade:1.22.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/purestorage/flashblade' 2026-06-22 02:37:02.519600 | debian-bookworm | Loading collection ovirt.ovirt from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/ovirt/ovirt 2026-06-22 02:37:02.519922 | debian-bookworm | Found installed collection ovirt.ovirt:3.2.1 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/ovirt/ovirt' 2026-06-22 02:37:02.520268 | debian-bookworm | Loading collection community.dns from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/dns 2026-06-22 02:37:02.520549 | debian-bookworm | Found installed collection community.dns:3.4.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/dns' 2026-06-22 02:37:02.521019 | debian-bookworm | Loading collection telekom_mms.icinga_director from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/telekom_mms/icinga_director 2026-06-22 02:37:02.521316 | debian-bookworm | Found installed collection telekom_mms.icinga_director:2.4.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/telekom_mms/icinga_director' 2026-06-22 02:37:02.521873 | debian-bookworm | Loading collection dellemc.openmanage from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/dellemc/openmanage 2026-06-22 02:37:02.522188 | debian-bookworm | Found installed collection dellemc.openmanage:9.12.3 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/dellemc/openmanage' 2026-06-22 02:37:02.522916 | debian-bookworm | Loading collection vyos.vyos from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/vyos/vyos 2026-06-22 02:37:02.523238 | debian-bookworm | Found installed collection vyos.vyos:6.0.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/vyos/vyos' 2026-06-22 02:37:02.523594 | debian-bookworm | Loading collection netapp.cloudmanager from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/netapp/cloudmanager 2026-06-22 02:37:02.523859 | debian-bookworm | Found installed collection netapp.cloudmanager:21.24.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/netapp/cloudmanager' 2026-06-22 02:37:02.524174 | debian-bookworm | Loading collection community.hashi_vault from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/hashi_vault 2026-06-22 02:37:02.524445 | debian-bookworm | Found installed collection community.hashi_vault:7.1.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/hashi_vault' 2026-06-22 02:37:02.524858 | debian-bookworm | Loading collection community.postgresql from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/postgresql 2026-06-22 02:37:02.525152 | debian-bookworm | Found installed collection community.postgresql:4.1.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/postgresql' 2026-06-22 02:37:02.526086 | debian-bookworm | Loading collection junipernetworks.junos from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/junipernetworks/junos 2026-06-22 02:37:02.526399 | debian-bookworm | Found installed collection junipernetworks.junos:11.0.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/junipernetworks/junos' 2026-06-22 02:37:02.526622 | debian-bookworm | Loading collection ibm.storage_virtualize from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/ibm/storage_virtualize 2026-06-22 02:37:02.526920 | debian-bookworm | Found installed collection ibm.storage_virtualize:2.7.4 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/ibm/storage_virtualize' 2026-06-22 02:37:02.527279 | debian-bookworm | Loading collection infinidat.infinibox from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/infinidat/infinibox 2026-06-22 02:37:02.527608 | debian-bookworm | Found installed collection infinidat.infinibox:1.6.3 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/infinidat/infinibox' 2026-06-22 02:37:02.528091 | debian-bookworm | Loading collection wti.remote from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/wti/remote 2026-06-22 02:37:02.528347 | debian-bookworm | Found installed collection wti.remote:1.0.10 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/wti/remote' 2026-06-22 02:37:02.529032 | debian-bookworm | Loading collection ngine_io.cloudstack from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/ngine_io/cloudstack 2026-06-22 02:37:02.529249 | debian-bookworm | Found installed collection ngine_io.cloudstack:2.5.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/ngine_io/cloudstack' 2026-06-22 02:37:02.529444 | debian-bookworm | Loading collection community.library_inventory_filtering_v1 from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/library_inventory_filtering_v1 2026-06-22 02:37:02.529725 | debian-bookworm | Found installed collection community.library_inventory_filtering_v1:1.1.5 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/library_inventory_filtering_v1' 2026-06-22 02:37:02.531104 | debian-bookworm | Loading collection theforeman.foreman from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/theforeman/foreman 2026-06-22 02:37:02.531443 | debian-bookworm | Found installed collection theforeman.foreman:5.7.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/theforeman/foreman' 2026-06-22 02:37:02.531851 | debian-bookworm | Loading collection community.hrobot from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/hrobot 2026-06-22 02:37:02.532166 | debian-bookworm | Found installed collection community.hrobot:2.7.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/hrobot' 2026-06-22 02:37:02.532658 | debian-bookworm | Loading collection community.mongodb from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/mongodb 2026-06-22 02:37:02.532900 | debian-bookworm | Found installed collection community.mongodb:1.7.10 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/mongodb' 2026-06-22 02:37:02.534357 | debian-bookworm | Loading collection cisco.nxos from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/cisco/nxos 2026-06-22 02:37:02.534506 | debian-bookworm | Found installed collection cisco.nxos:11.0.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/cisco/nxos' 2026-06-22 02:37:02.535424 | debian-bookworm | Loading collection community.digitalocean from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/digitalocean 2026-06-22 02:37:02.535784 | debian-bookworm | Found installed collection community.digitalocean:1.27.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/digitalocean' 2026-06-22 02:37:02.538494 | debian-bookworm | Loading collection fortinet.fortios from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/fortinet/fortios 2026-06-22 02:37:02.538851 | debian-bookworm | Found installed collection fortinet.fortios:2.4.2 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/fortinet/fortios' 2026-06-22 02:37:02.539070 | debian-bookworm | Loading collection community.proxysql from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/proxysql 2026-06-22 02:37:02.539346 | debian-bookworm | Found installed collection community.proxysql:1.7.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/proxysql' 2026-06-22 02:37:02.539702 | debian-bookworm | Loading collection community.zabbix from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/zabbix 2026-06-22 02:37:02.540037 | debian-bookworm | Found installed collection community.zabbix:4.1.1 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/zabbix' 2026-06-22 02:37:02.540311 | debian-bookworm | Loading collection containers.podman from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/containers/podman 2026-06-22 02:37:02.540584 | debian-bookworm | Found installed collection containers.podman:1.18.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/containers/podman' 2026-06-22 02:37:02.541337 | debian-bookworm | Loading collection cisco.ios from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/cisco/ios 2026-06-22 02:37:02.541618 | debian-bookworm | Found installed collection cisco.ios:11.1.1 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/cisco/ios' 2026-06-22 02:37:02.542055 | debian-bookworm | Loading collection dellemc.powerflex from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/dellemc/powerflex 2026-06-22 02:37:02.542340 | debian-bookworm | Found installed collection dellemc.powerflex:2.6.1 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/dellemc/powerflex' 2026-06-22 02:37:02.542561 | debian-bookworm | Loading collection microsoft.iis from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/microsoft/iis 2026-06-22 02:37:02.542855 | debian-bookworm | Found installed collection microsoft.iis:1.0.3 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/microsoft/iis' 2026-06-22 02:37:02.543143 | debian-bookworm | Loading collection purestorage.flasharray from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/purestorage/flasharray 2026-06-22 02:37:02.543429 | debian-bookworm | Found installed collection purestorage.flasharray:1.39.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/purestorage/flasharray' 2026-06-22 02:37:02.545489 | debian-bookworm | Loading collection awx.awx from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/awx/awx 2026-06-22 02:37:02.545851 | debian-bookworm | Found installed collection awx.awx:24.6.1 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/awx/awx' 2026-06-22 02:37:02.546518 | debian-bookworm | Loading collection cisco.iosxr from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/cisco/iosxr 2026-06-22 02:37:02.547053 | debian-bookworm | Found installed collection cisco.iosxr:12.1.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/cisco/iosxr' 2026-06-22 02:37:02.548447 | debian-bookworm | Loading collection dellemc.enterprise_sonic from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/dellemc/enterprise_sonic 2026-06-22 02:37:02.548724 | debian-bookworm | Found installed collection dellemc.enterprise_sonic:3.2.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/dellemc/enterprise_sonic' 2026-06-22 02:37:02.549688 | debian-bookworm | Loading collection hetzner.hcloud from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/hetzner/hcloud 2026-06-22 02:37:02.550022 | debian-bookworm | Found installed collection hetzner.hcloud:5.4.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/hetzner/hcloud' 2026-06-22 02:37:02.550328 | debian-bookworm | Loading collection lowlydba.sqlserver from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/lowlydba/sqlserver 2026-06-22 02:37:02.550606 | debian-bookworm | Found installed collection lowlydba.sqlserver:2.7.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/lowlydba/sqlserver' 2026-06-22 02:37:02.550844 | debian-bookworm | Loading collection ansible.utils from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/ansible/utils 2026-06-22 02:37:02.551152 | debian-bookworm | Found installed collection ansible.utils:6.0.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/ansible/utils' 2026-06-22 02:37:02.552874 | debian-bookworm | Loading collection cisco.aci from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/cisco/aci 2026-06-22 02:37:02.553218 | debian-bookworm | Found installed collection cisco.aci:2.12.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/cisco/aci' 2026-06-22 02:37:02.553542 | debian-bookworm | Loading collection infoblox.nios_modules from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/infoblox/nios_modules 2026-06-22 02:37:02.553838 | debian-bookworm | Found installed collection infoblox.nios_modules:1.8.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/infoblox/nios_modules' 2026-06-22 02:37:02.555171 | debian-bookworm | Loading collection community.vmware from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/vmware 2026-06-22 02:37:02.555488 | debian-bookworm | Found installed collection community.vmware:5.10.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/vmware' 2026-06-22 02:37:02.555910 | debian-bookworm | Loading collection community.okd from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/okd 2026-06-22 02:37:02.556219 | debian-bookworm | Found installed collection community.okd:5.0.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/okd' 2026-06-22 02:37:02.556504 | debian-bookworm | Loading collection community.rabbitmq from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/rabbitmq 2026-06-22 02:37:02.556778 | debian-bookworm | Found installed collection community.rabbitmq:1.6.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/rabbitmq' 2026-06-22 02:37:02.557079 | debian-bookworm | Loading collection netapp_eseries.santricity from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/netapp_eseries/santricity 2026-06-22 02:37:02.557367 | debian-bookworm | Found installed collection netapp_eseries.santricity:1.4.1 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/netapp_eseries/santricity' 2026-06-22 02:37:02.558906 | debian-bookworm | Loading collection cisco.meraki from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/cisco/meraki 2026-06-22 02:37:02.559244 | debian-bookworm | Found installed collection cisco.meraki:2.21.8 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/cisco/meraki' 2026-06-22 02:37:02.559457 | debian-bookworm | Loading collection cisco.ucs from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/cisco/ucs 2026-06-22 02:37:02.559768 | debian-bookworm | Found installed collection cisco.ucs:1.16.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/cisco/ucs' 2026-06-22 02:37:02.560405 | debian-bookworm | Loading collection cloudscale_ch.cloud from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/cloudscale_ch/cloud 2026-06-22 02:37:02.560696 | debian-bookworm | Found installed collection cloudscale_ch.cloud:2.5.2 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/cloudscale_ch/cloud' 2026-06-22 02:37:02.561949 | debian-bookworm | Loading collection amazon.aws from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/amazon/aws 2026-06-22 02:37:02.562214 | debian-bookworm | Found installed collection amazon.aws:10.1.2 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/amazon/aws' 2026-06-22 02:37:02.562516 | debian-bookworm | Loading collection hitachivantara.vspone_block from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/hitachivantara/vspone_block 2026-06-22 02:37:02.562822 | debian-bookworm | Found installed collection hitachivantara.vspone_block:4.4.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/hitachivantara/vspone_block' 2026-06-22 02:37:02.563225 | debian-bookworm | Loading collection community.docker from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/docker 2026-06-22 02:37:02.563523 | debian-bookworm | Found installed collection community.docker:4.8.2 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/docker' 2026-06-22 02:37:02.572573 | debian-bookworm | Loading collection community.general from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/general 2026-06-22 02:37:02.572859 | debian-bookworm | Found installed collection community.general:11.4.1 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/general' 2026-06-22 02:37:02.577727 | debian-bookworm | Loading collection ansible._protomatter from /home/zuul/venv/lib/python3.11/site-packages/ansible/_internal/ansible_collections/ansible/_protomatter 2026-06-22 02:37:02.577885 | debian-bookworm | Found installed collection ansible._protomatter:2.19.11 at '/home/zuul/venv/lib/python3.11/site-packages/ansible/_internal/ansible_collections/ansible/_protomatter' 2026-06-22 02:37:02.582196 | debian-bookworm | Loading collection osism.services from /home/zuul/.ansible/collections/ansible_collections/osism/services 2026-06-22 02:37:02.582403 | debian-bookworm | Found installed collection osism.services:999.0.0 at '/home/zuul/.ansible/collections/ansible_collections/osism/services' 2026-06-22 02:37:02.586204 | debian-bookworm | Initial connection to galaxy_server: https://galaxy.ansible.com 2026-06-22 02:37:02.586495 | debian-bookworm | Created /home/zuul/.ansible/galaxy_token 2026-06-22 02:37:02.586644 | debian-bookworm | Calling Galaxy at https://galaxy.ansible.com/api/ 2026-06-22 02:37:02.888762 | ubuntu-noble | ansible-galaxy [core 2.19.11] 2026-06-22 02:37:02.888811 | ubuntu-noble | config file = None 2026-06-22 02:37:02.888895 | ubuntu-noble | configured module search path = ['/home/zuul/src/github.com/osism/ansible-collection-services/plugins/modules', '/home/zuul/.ansible/plugins/modules', '/usr/share/ansible/plugins/modules'] 2026-06-22 02:37:02.889205 | ubuntu-noble | ansible python module location = /home/zuul/venv/lib/python3.12/site-packages/ansible 2026-06-22 02:37:02.889510 | ubuntu-noble | ansible collection location = /home/zuul/.ansible/collections:/usr/share/ansible/collections:/home/zuul/venv/lib/python3.12/site-packages:/home/zuul/venv/lib/python3.12/dist-packages:/home/zuul/venv/lib/python3/dist-packages:/home/zuul/venv/local/lib/python3.12/dist-packages 2026-06-22 02:37:02.889780 | ubuntu-noble | executable location = /home/zuul/venv/bin/ansible-galaxy 2026-06-22 02:37:02.890088 | ubuntu-noble | python version = 3.12.3 (main, Mar 23 2026, 19:04:32) [GCC 13.3.0] (/home/zuul/venv/bin/python3) 2026-06-22 02:37:02.890318 | ubuntu-noble | jinja version = 3.1.6 2026-06-22 02:37:02.890559 | ubuntu-noble | pyyaml version = 6.0.3 (with libyaml v0.2.5) 2026-06-22 02:37:02.890811 | ubuntu-noble | No config file found; using defaults 2026-06-22 02:37:02.891280 | ubuntu-noble | Reading requirement file at '/home/zuul/src/github.com/osism/ansible-collection-services/molecule/delegated/collections.yml' 2026-06-22 02:37:02.901441 | ubuntu-noble | Loading collection osism.services from /home/zuul/.ansible/collections/ansible_collections/osism/services 2026-06-22 02:37:02.902116 | ubuntu-noble | Found installed collection osism.services:999.0.0 at '/home/zuul/.ansible/collections/ansible_collections/osism/services' 2026-06-22 02:37:02.912416 | ubuntu-noble | Loading collection ansible.windows from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/ansible/windows 2026-06-22 02:37:02.912832 | ubuntu-noble | Found installed collection ansible.windows:3.2.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/ansible/windows' 2026-06-22 02:37:02.913275 | ubuntu-noble | Loading collection infoblox.nios_modules from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/infoblox/nios_modules 2026-06-22 02:37:02.913673 | ubuntu-noble | Found installed collection infoblox.nios_modules:1.8.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/infoblox/nios_modules' 2026-06-22 02:37:02.914205 | ubuntu-noble | Loading collection containers.podman from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/containers/podman 2026-06-22 02:37:02.914532 | ubuntu-noble | Found installed collection containers.podman:1.18.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/containers/podman' 2026-06-22 02:37:02.917231 | ubuntu-noble | Loading collection hetzner.hcloud from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/hetzner/hcloud 2026-06-22 02:37:02.917552 | ubuntu-noble | Found installed collection hetzner.hcloud:5.4.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/hetzner/hcloud' 2026-06-22 02:37:02.919427 | ubuntu-noble | Loading collection cisco.aci from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/cisco/aci 2026-06-22 02:37:02.919776 | ubuntu-noble | Found installed collection cisco.aci:2.12.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/cisco/aci' 2026-06-22 02:37:02.920441 | ubuntu-noble | Loading collection vmware.vmware from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/vmware/vmware 2026-06-22 02:37:02.920771 | ubuntu-noble | Found installed collection vmware.vmware:2.4.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/vmware/vmware' 2026-06-22 02:37:02.921361 | ubuntu-noble | Loading collection dellemc.powerflex from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/dellemc/powerflex 2026-06-22 02:37:02.921688 | ubuntu-noble | Found installed collection dellemc.powerflex:2.6.1 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/dellemc/powerflex' 2026-06-22 02:37:02.922263 | ubuntu-noble | Loading collection community.docker from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/docker 2026-06-22 02:37:02.922574 | ubuntu-noble | Found installed collection community.docker:4.8.2 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/docker' 2026-06-22 02:37:02.923215 | ubuntu-noble | Loading collection dellemc.openmanage from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/dellemc/openmanage 2026-06-22 02:37:02.923519 | ubuntu-noble | Found installed collection dellemc.openmanage:9.12.3 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/dellemc/openmanage' 2026-06-22 02:37:02.925759 | ubuntu-noble | Loading collection community.crypto from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/crypto 2026-06-22 02:37:02.925782 | ubuntu-noble | Found installed collection community.crypto:3.0.5 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/crypto' 2026-06-22 02:37:02.925786 | ubuntu-noble | Loading collection community.postgresql from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/postgresql 2026-06-22 02:37:02.925791 | ubuntu-noble | Found installed collection community.postgresql:4.1.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/postgresql' 2026-06-22 02:37:02.926778 | ubuntu-noble | Loading collection community.vmware from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/vmware 2026-06-22 02:37:02.927117 | ubuntu-noble | Found installed collection community.vmware:5.10.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/vmware' 2026-06-22 02:37:02.927431 | ubuntu-noble | Loading collection cisco.ucs from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/cisco/ucs 2026-06-22 02:37:02.927762 | ubuntu-noble | Found installed collection cisco.ucs:1.16.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/cisco/ucs' 2026-06-22 02:37:02.931169 | ubuntu-noble | Loading collection fortinet.fortios from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/fortinet/fortios 2026-06-22 02:37:02.931482 | ubuntu-noble | Found installed collection fortinet.fortios:2.4.2 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/fortinet/fortios' 2026-06-22 02:37:02.931825 | ubuntu-noble | Loading collection microsoft.ad from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/microsoft/ad 2026-06-22 02:37:02.932157 | ubuntu-noble | Found installed collection microsoft.ad:1.9.2 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/microsoft/ad' 2026-06-22 02:37:02.934218 | ubuntu-noble | Loading collection azure.azcollection from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/azure/azcollection 2026-06-22 02:37:02.934522 | ubuntu-noble | Found installed collection azure.azcollection:3.10.1 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/azure/azcollection' 2026-06-22 02:37:02.935439 | ubuntu-noble | Loading collection ravendb.ravendb from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/ravendb/ravendb 2026-06-22 02:37:02.935894 | ubuntu-noble | Found installed collection ravendb.ravendb:1.0.4 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/ravendb/ravendb' 2026-06-22 02:37:02.936153 | ubuntu-noble | Loading collection hitachivantara.vspone_object from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/hitachivantara/vspone_object 2026-06-22 02:37:02.936461 | ubuntu-noble | Found installed collection hitachivantara.vspone_object:1.0.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/hitachivantara/vspone_object' 2026-06-22 02:37:02.936963 | ubuntu-noble | Loading collection community.hashi_vault from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/hashi_vault 2026-06-22 02:37:02.937213 | ubuntu-noble | Found installed collection community.hashi_vault:7.1.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/hashi_vault' 2026-06-22 02:37:02.937456 | ubuntu-noble | Loading collection ieisystem.inmanage from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/ieisystem/inmanage 2026-06-22 02:37:02.937814 | ubuntu-noble | Found installed collection ieisystem.inmanage:3.0.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/ieisystem/inmanage' 2026-06-22 02:37:02.938104 | ubuntu-noble | Loading collection community.okd from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/okd 2026-06-22 02:37:02.938344 | ubuntu-noble | Found installed collection community.okd:5.0.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/okd' 2026-06-22 02:37:02.939824 | ubuntu-noble | Loading collection cisco.meraki from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/cisco/meraki 2026-06-22 02:37:02.940251 | ubuntu-noble | Found installed collection cisco.meraki:2.21.8 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/cisco/meraki' 2026-06-22 02:37:02.940658 | ubuntu-noble | Loading collection community.mongodb from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/mongodb 2026-06-22 02:37:02.941106 | ubuntu-noble | Found installed collection community.mongodb:1.7.10 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/mongodb' 2026-06-22 02:37:02.941401 | ubuntu-noble | Loading collection community.routeros from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/routeros 2026-06-22 02:37:02.941828 | ubuntu-noble | Found installed collection community.routeros:3.13.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/routeros' 2026-06-22 02:37:02.942246 | ubuntu-noble | Loading collection cisco.iosxr from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/cisco/iosxr 2026-06-22 02:37:02.942662 | ubuntu-noble | Found installed collection cisco.iosxr:12.1.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/cisco/iosxr' 2026-06-22 02:37:02.943161 | ubuntu-noble | Loading collection community.mysql from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/mysql 2026-06-22 02:37:02.943445 | ubuntu-noble | Found installed collection community.mysql:3.16.1 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/mysql' 2026-06-22 02:37:02.943826 | ubuntu-noble | Loading collection ansible.posix from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/ansible/posix 2026-06-22 02:37:02.944115 | ubuntu-noble | Found installed collection ansible.posix:2.1.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/ansible/posix' 2026-06-22 02:37:02.944524 | ubuntu-noble | Loading collection community.zabbix from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/zabbix 2026-06-22 02:37:02.945030 | ubuntu-noble | Found installed collection community.zabbix:4.1.1 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/zabbix' 2026-06-22 02:37:02.945464 | ubuntu-noble | Loading collection kubevirt.core from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/kubevirt/core 2026-06-22 02:37:02.946121 | ubuntu-noble | Found installed collection kubevirt.core:2.2.3 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/kubevirt/core' 2026-06-22 02:37:02.946546 | ubuntu-noble | Loading collection chocolatey.chocolatey from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/chocolatey/chocolatey 2026-06-22 02:37:02.947079 | ubuntu-noble | Found installed collection chocolatey.chocolatey:1.5.3 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/chocolatey/chocolatey' 2026-06-22 02:37:02.947556 | ubuntu-noble | Loading collection ngine_io.cloudstack from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/ngine_io/cloudstack 2026-06-22 02:37:02.947965 | ubuntu-noble | Found installed collection ngine_io.cloudstack:2.5.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/ngine_io/cloudstack' 2026-06-22 02:37:02.948300 | ubuntu-noble | Loading collection openstack.cloud from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/openstack/cloud 2026-06-22 02:37:02.948728 | ubuntu-noble | Found installed collection openstack.cloud:2.5.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/openstack/cloud' 2026-06-22 02:37:02.949501 | ubuntu-noble | Loading collection dellemc.enterprise_sonic from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/dellemc/enterprise_sonic 2026-06-22 02:37:02.949797 | ubuntu-noble | Found installed collection dellemc.enterprise_sonic:3.2.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/dellemc/enterprise_sonic' 2026-06-22 02:37:02.955577 | ubuntu-noble | Loading collection fortinet.fortimanager from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/fortinet/fortimanager 2026-06-22 02:37:02.955949 | ubuntu-noble | Found installed collection fortinet.fortimanager:2.11.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/fortinet/fortimanager' 2026-06-22 02:37:02.956264 | ubuntu-noble | Loading collection wti.remote from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/wti/remote 2026-06-22 02:37:02.956574 | ubuntu-noble | Found installed collection wti.remote:1.0.10 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/wti/remote' 2026-06-22 02:37:02.959742 | ubuntu-noble | Loading collection awx.awx from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/awx/awx 2026-06-22 02:37:02.959764 | ubuntu-noble | Found installed collection awx.awx:24.6.1 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/awx/awx' 2026-06-22 02:37:02.959769 | ubuntu-noble | Loading collection cisco.dnac from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/cisco/dnac 2026-06-22 02:37:02.960004 | ubuntu-noble | Found installed collection cisco.dnac:6.41.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/cisco/dnac' 2026-06-22 02:37:02.960301 | ubuntu-noble | Loading collection inspur.ispim from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/inspur/ispim 2026-06-22 02:37:02.960607 | ubuntu-noble | Found installed collection inspur.ispim:2.2.3 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/inspur/ispim' 2026-06-22 02:37:02.960889 | ubuntu-noble | Loading collection ansible.utils from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/ansible/utils 2026-06-22 02:37:02.961204 | ubuntu-noble | Found installed collection ansible.utils:6.0.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/ansible/utils' 2026-06-22 02:37:02.961435 | ubuntu-noble | Loading collection community.libvirt from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/libvirt 2026-06-22 02:37:02.961768 | ubuntu-noble | Found installed collection community.libvirt:2.0.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/libvirt' 2026-06-22 02:37:02.962302 | ubuntu-noble | Loading collection cisco.ios from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/cisco/ios 2026-06-22 02:37:02.962612 | ubuntu-noble | Found installed collection cisco.ios:11.1.1 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/cisco/ios' 2026-06-22 02:37:02.962979 | ubuntu-noble | Loading collection microsoft.iis from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/microsoft/iis 2026-06-22 02:37:02.963291 | ubuntu-noble | Found installed collection microsoft.iis:1.0.3 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/microsoft/iis' 2026-06-22 02:37:02.964177 | ubuntu-noble | Loading collection community.digitalocean from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/digitalocean 2026-06-22 02:37:02.964480 | ubuntu-noble | Found installed collection community.digitalocean:1.27.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/digitalocean' 2026-06-22 02:37:02.965545 | ubuntu-noble | Loading collection netapp.ontap from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/netapp/ontap 2026-06-22 02:37:02.965902 | ubuntu-noble | Found installed collection netapp.ontap:23.2.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/netapp/ontap' 2026-06-22 02:37:02.966725 | ubuntu-noble | Loading collection vyos.vyos from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/vyos/vyos 2026-06-22 02:37:02.967066 | ubuntu-noble | Found installed collection vyos.vyos:6.0.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/vyos/vyos' 2026-06-22 02:37:02.967678 | ubuntu-noble | Loading collection kubernetes.core from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/kubernetes/core 2026-06-22 02:37:02.968046 | ubuntu-noble | Found installed collection kubernetes.core:6.2.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/kubernetes/core' 2026-06-22 02:37:02.968355 | ubuntu-noble | Loading collection community.hrobot from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/hrobot 2026-06-22 02:37:02.968661 | ubuntu-noble | Found installed collection community.hrobot:2.7.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/hrobot' 2026-06-22 02:37:02.969007 | ubuntu-noble | Loading collection cyberark.pas from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/cyberark/pas 2026-06-22 02:37:02.969329 | ubuntu-noble | Found installed collection cyberark.pas:1.0.36 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/cyberark/pas' 2026-06-22 02:37:02.970059 | ubuntu-noble | Loading collection netapp_eseries.santricity from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/netapp_eseries/santricity 2026-06-22 02:37:02.970115 | ubuntu-noble | Found installed collection netapp_eseries.santricity:1.4.1 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/netapp_eseries/santricity' 2026-06-22 02:37:02.981768 | ubuntu-noble | Loading collection community.general from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/general 2026-06-22 02:37:02.981821 | ubuntu-noble | Found installed collection community.general:11.4.1 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/general' 2026-06-22 02:37:02.981833 | ubuntu-noble | Loading collection f5networks.f5_modules from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/f5networks/f5_modules 2026-06-22 02:37:02.981860 | ubuntu-noble | Found installed collection f5networks.f5_modules:1.39.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/f5networks/f5_modules' 2026-06-22 02:37:02.982041 | ubuntu-noble | Loading collection cyberark.conjur from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/cyberark/conjur 2026-06-22 02:37:02.982475 | ubuntu-noble | Found installed collection cyberark.conjur:1.3.8 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/cyberark/conjur' 2026-06-22 02:37:02.982997 | ubuntu-noble | Loading collection ibm.qradar from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/ibm/qradar 2026-06-22 02:37:02.983375 | ubuntu-noble | Found installed collection ibm.qradar:4.0.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/ibm/qradar' 2026-06-22 02:37:02.984103 | ubuntu-noble | Loading collection cisco.mso from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/cisco/mso 2026-06-22 02:37:02.984833 | ubuntu-noble | Found installed collection cisco.mso:2.11.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/cisco/mso' 2026-06-22 02:37:02.985401 | ubuntu-noble | Loading collection cisco.intersight from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/cisco/intersight 2026-06-22 02:37:02.986079 | ubuntu-noble | Found installed collection cisco.intersight:2.7.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/cisco/intersight' 2026-06-22 02:37:02.986619 | ubuntu-noble | Loading collection community.library_inventory_filtering_v1 from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/library_inventory_filtering_v1 2026-06-22 02:37:02.987107 | ubuntu-noble | Found installed collection community.library_inventory_filtering_v1:1.1.5 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/library_inventory_filtering_v1' 2026-06-22 02:37:02.987499 | ubuntu-noble | Loading collection netapp.cloudmanager from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/netapp/cloudmanager 2026-06-22 02:37:02.987874 | ubuntu-noble | Found installed collection netapp.cloudmanager:21.24.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/netapp/cloudmanager' 2026-06-22 02:37:02.988313 | ubuntu-noble | Loading collection community.windows from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/windows 2026-06-22 02:37:02.988781 | ubuntu-noble | Found installed collection community.windows:3.0.1 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/windows' 2026-06-22 02:37:02.989487 | ubuntu-noble | Loading collection cisco.nxos from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/cisco/nxos 2026-06-22 02:37:02.990295 | ubuntu-noble | Found installed collection cisco.nxos:11.0.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/cisco/nxos' 2026-06-22 02:37:02.990813 | ubuntu-noble | Loading collection community.proxysql from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/proxysql 2026-06-22 02:37:02.992750 | ubuntu-noble | Found installed collection community.proxysql:1.7.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/proxysql' 2026-06-22 02:37:02.992784 | ubuntu-noble | Loading collection dellemc.unity from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/dellemc/unity 2026-06-22 02:37:02.992799 | ubuntu-noble | Found installed collection dellemc.unity:2.1.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/dellemc/unity' 2026-06-22 02:37:02.992813 | ubuntu-noble | Loading collection theforeman.foreman from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/theforeman/foreman 2026-06-22 02:37:02.993136 | ubuntu-noble | Found installed collection theforeman.foreman:5.7.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/theforeman/foreman' 2026-06-22 02:37:02.993593 | ubuntu-noble | Loading collection cloudscale_ch.cloud from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/cloudscale_ch/cloud 2026-06-22 02:37:02.994040 | ubuntu-noble | Found installed collection cloudscale_ch.cloud:2.5.2 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/cloudscale_ch/cloud' 2026-06-22 02:37:02.994330 | ubuntu-noble | Loading collection purestorage.flashblade from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/purestorage/flashblade 2026-06-22 02:37:02.994613 | ubuntu-noble | Found installed collection purestorage.flashblade:1.22.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/purestorage/flashblade' 2026-06-22 02:37:02.995064 | ubuntu-noble | Loading collection netbox.netbox from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/netbox/netbox 2026-06-22 02:37:02.995385 | ubuntu-noble | Found installed collection netbox.netbox:3.21.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/netbox/netbox' 2026-06-22 02:37:02.995606 | ubuntu-noble | Loading collection community.grafana from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/grafana 2026-06-22 02:37:02.995952 | ubuntu-noble | Found installed collection community.grafana:2.3.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/grafana' 2026-06-22 02:37:02.996180 | ubuntu-noble | Loading collection infinidat.infinibox from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/infinidat/infinibox 2026-06-22 02:37:02.996439 | ubuntu-noble | Found installed collection infinidat.infinibox:1.6.3 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/infinidat/infinibox' 2026-06-22 02:37:02.996640 | ubuntu-noble | Loading collection community.sap_libs from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/sap_libs 2026-06-22 02:37:02.996931 | ubuntu-noble | Found installed collection community.sap_libs:1.5.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/sap_libs' 2026-06-22 02:37:02.997140 | ubuntu-noble | Loading collection community.ciscosmb from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/ciscosmb 2026-06-22 02:37:02.997414 | ubuntu-noble | Found installed collection community.ciscosmb:1.0.11 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/ciscosmb' 2026-06-22 02:37:03.000797 | ubuntu-noble | Loading collection community.aws from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/aws 2026-06-22 02:37:03.001104 | ubuntu-noble | Found installed collection community.aws:10.0.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/aws' 2026-06-22 02:37:03.001360 | ubuntu-noble | Loading collection community.rabbitmq from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/rabbitmq 2026-06-22 02:37:03.001624 | ubuntu-noble | Found installed collection community.rabbitmq:1.6.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/rabbitmq' 2026-06-22 02:37:03.001938 | ubuntu-noble | Loading collection ibm.storage_virtualize from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/ibm/storage_virtualize 2026-06-22 02:37:03.002243 | ubuntu-noble | Found installed collection ibm.storage_virtualize:2.7.4 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/ibm/storage_virtualize' 2026-06-22 02:37:03.002502 | ubuntu-noble | Loading collection community.dns from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/dns 2026-06-22 02:37:03.002771 | ubuntu-noble | Found installed collection community.dns:3.4.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/dns' 2026-06-22 02:37:03.003045 | ubuntu-noble | Loading collection netapp.storagegrid from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/netapp/storagegrid 2026-06-22 02:37:03.003297 | ubuntu-noble | Found installed collection netapp.storagegrid:21.15.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/netapp/storagegrid' 2026-06-22 02:37:03.003539 | ubuntu-noble | Loading collection community.sops from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/sops 2026-06-22 02:37:03.003801 | ubuntu-noble | Found installed collection community.sops:2.2.7 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/sops' 2026-06-22 02:37:03.004114 | ubuntu-noble | Loading collection hitachivantara.vspone_block from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/hitachivantara/vspone_block 2026-06-22 02:37:03.004366 | ubuntu-noble | Found installed collection hitachivantara.vspone_block:4.4.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/hitachivantara/vspone_block' 2026-06-22 02:37:03.004569 | ubuntu-noble | Loading collection kaytus.ksmanage from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/kaytus/ksmanage 2026-06-22 02:37:03.004890 | ubuntu-noble | Found installed collection kaytus.ksmanage:2.0.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/kaytus/ksmanage' 2026-06-22 02:37:03.005151 | ubuntu-noble | Loading collection telekom_mms.icinga_director from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/telekom_mms/icinga_director 2026-06-22 02:37:03.005371 | ubuntu-noble | Found installed collection telekom_mms.icinga_director:2.4.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/telekom_mms/icinga_director' 2026-06-22 02:37:03.006343 | ubuntu-noble | Loading collection junipernetworks.junos from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/junipernetworks/junos 2026-06-22 02:37:03.006641 | ubuntu-noble | Found installed collection junipernetworks.junos:11.0.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/junipernetworks/junos' 2026-06-22 02:37:03.007457 | ubuntu-noble | Loading collection arista.eos from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/arista/eos 2026-06-22 02:37:03.007699 | ubuntu-noble | Found installed collection arista.eos:12.0.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/arista/eos' 2026-06-22 02:37:03.007989 | ubuntu-noble | Loading collection purestorage.flasharray from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/purestorage/flasharray 2026-06-22 02:37:03.008340 | ubuntu-noble | Found installed collection purestorage.flasharray:1.39.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/purestorage/flasharray' 2026-06-22 02:37:03.008594 | ubuntu-noble | Loading collection grafana.grafana from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/grafana/grafana 2026-06-22 02:37:03.008863 | ubuntu-noble | Found installed collection grafana.grafana:6.0.6 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/grafana/grafana' 2026-06-22 02:37:03.009469 | ubuntu-noble | Loading collection splunk.es from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/splunk/es 2026-06-22 02:37:03.009724 | ubuntu-noble | Found installed collection splunk.es:4.0.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/splunk/es' 2026-06-22 02:37:03.012210 | ubuntu-noble | Loading collection vmware.vmware_rest from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/vmware/vmware_rest 2026-06-22 02:37:03.012475 | ubuntu-noble | Found installed collection vmware.vmware_rest:4.9.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/vmware/vmware_rest' 2026-06-22 02:37:03.012940 | ubuntu-noble | Loading collection vultr.cloud from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/vultr/cloud 2026-06-22 02:37:03.013180 | ubuntu-noble | Found installed collection vultr.cloud:1.13.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/vultr/cloud' 2026-06-22 02:37:03.013800 | ubuntu-noble | Loading collection ovirt.ovirt from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/ovirt/ovirt 2026-06-22 02:37:03.014071 | ubuntu-noble | Found installed collection ovirt.ovirt:3.2.1 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/ovirt/ovirt' 2026-06-22 02:37:03.015054 | ubuntu-noble | Loading collection google.cloud from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/google/cloud 2026-06-22 02:37:03.015309 | ubuntu-noble | Found installed collection google.cloud:1.9.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/google/cloud' 2026-06-22 02:37:03.016637 | ubuntu-noble | Loading collection amazon.aws from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/amazon/aws 2026-06-22 02:37:03.016933 | ubuntu-noble | Found installed collection amazon.aws:10.1.2 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/amazon/aws' 2026-06-22 02:37:03.017622 | ubuntu-noble | Loading collection check_point.mgmt from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/check_point/mgmt 2026-06-22 02:37:03.017637 | ubuntu-noble | Found installed collection check_point.mgmt:6.6.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/check_point/mgmt' 2026-06-22 02:37:03.018025 | ubuntu-noble | Loading collection community.proxmox from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/proxmox 2026-06-22 02:37:03.018308 | ubuntu-noble | Found installed collection community.proxmox:1.4.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/proxmox' 2026-06-22 02:37:03.018534 | ubuntu-noble | Loading collection ansible.netcommon from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/ansible/netcommon 2026-06-22 02:37:03.018838 | ubuntu-noble | Found installed collection ansible.netcommon:8.1.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/ansible/netcommon' 2026-06-22 02:37:03.019086 | ubuntu-noble | Loading collection lowlydba.sqlserver from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/lowlydba/sqlserver 2026-06-22 02:37:03.019337 | ubuntu-noble | Found installed collection lowlydba.sqlserver:2.7.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/lowlydba/sqlserver' 2026-06-22 02:37:03.033743 | ubuntu-noble | Loading collection ansible._protomatter from /home/zuul/venv/lib/python3.12/site-packages/ansible/_internal/ansible_collections/ansible/_protomatter 2026-06-22 02:37:03.033800 | ubuntu-noble | Found installed collection ansible._protomatter:2.19.11 at '/home/zuul/venv/lib/python3.12/site-packages/ansible/_internal/ansible_collections/ansible/_protomatter' 2026-06-22 02:37:03.038109 | ubuntu-noble | Initial connection to galaxy_server: https://galaxy.ansible.com 2026-06-22 02:37:03.038145 | ubuntu-noble | Created /home/zuul/.ansible/galaxy_token 2026-06-22 02:37:03.038156 | ubuntu-noble | Calling Galaxy at https://galaxy.ansible.com/api/ 2026-06-22 02:37:02.813355 | debian-bookworm | Found API version 'v3, pulp-v3, v1' with Galaxy server default (https://galaxy.ansible.com/api/) 2026-06-22 02:37:02.813836 | debian-bookworm | Calling Galaxy at https://galaxy.ansible.com/api/v3/collections/osism/commons/ 2026-06-22 02:37:03.226748 | ubuntu-noble | Found API version 'v3, pulp-v3, v1' with Galaxy server default (https://galaxy.ansible.com/api/) 2026-06-22 02:37:03.226873 | ubuntu-noble | Calling Galaxy at https://galaxy.ansible.com/api/v3/collections/osism/commons/ 2026-06-22 02:37:03.350414 | debian-bookworm | Calling Galaxy at https://galaxy.ansible.com/api/v3/collections/osism/commons/versions/?limit=100 2026-06-22 02:37:04.673217 | debian-bookworm | Calling Galaxy at https://galaxy.ansible.com/api/v3/collections/osism/commons/versions/0.20260601.0/ 2026-06-22 02:37:05.670031 | ubuntu-noble | Calling Galaxy at https://galaxy.ansible.com/api/v3/collections/osism/commons/versions/?limit=100 2026-06-22 02:37:05.403609 | debian-bookworm | Server https://galaxy.ansible.com/api/ has not signed osism.commons:0.20260601.0 2026-06-22 02:37:05.403966 | debian-bookworm | Fetching a collection tarball for 'osism.commons:0.20260601.0' from Ansible Galaxy 2026-06-22 02:37:06.514873 | ubuntu-noble | Calling Galaxy at https://galaxy.ansible.com/api/v3/collections/osism/commons/versions/0.20260601.0/ 2026-06-22 02:37:07.135108 | ubuntu-noble | Server https://galaxy.ansible.com/api/ has not signed osism.commons:0.20260601.0 2026-06-22 02:37:07.135171 | ubuntu-noble | Fetching a collection tarball for 'osism.commons:0.20260601.0' from Ansible Galaxy 2026-06-22 02:37:07.559963 | debian-bookworm | Validating downloaded file hash 1d41d3b5d145afda8cce7ec8515d5495c0afe9a3787ce4d2ea101956f5f7e2b1 with expected hash 1d41d3b5d145afda8cce7ec8515d5495c0afe9a3787ce4d2ea101956f5f7e2b1 2026-06-22 02:37:07.560297 | debian-bookworm | Collection 'osism.commons:0.20260601.0' obtained from server default https://galaxy.ansible.com/api/ 2026-06-22 02:37:07.727466 | debian-bookworm | Starting galaxy collection install process 2026-06-22 02:37:07.727839 | debian-bookworm | Process install dependency map 2026-06-22 02:37:07.728145 | debian-bookworm | Starting collection install process 2026-06-22 02:37:07.728437 | debian-bookworm | 'ansible.posix:2.1.0' is already installed, skipping. 2026-06-22 02:37:07.728727 | debian-bookworm | 'community.docker:4.8.2' is already installed, skipping. 2026-06-22 02:37:07.729044 | debian-bookworm | 'community.general:11.4.1' is already installed, skipping. 2026-06-22 02:37:07.729340 | debian-bookworm | 'community.library_inventory_filtering_v1:1.1.5' is already installed, skipping. 2026-06-22 02:37:07.729643 | debian-bookworm | Downloading https://galaxy.ansible.com/api/v3/plugin/ansible/content/published/collections/artifacts/osism-commons-0.20260601.0.tar.gz to /home/zuul/.ansible/tmp/ansible-local-20041zgfeymw/tmpdq4cml4l/osism-commons-0.20260601.0-fx473g5z 2026-06-22 02:37:07.729956 | debian-bookworm | Installing 'osism.commons:0.20260601.0' to '/home/zuul/.ansible/collections/ansible_collections/osism/commons' 2026-06-22 02:37:07.730247 | debian-bookworm | osism.commons:0.20260601.0 was installed successfully 2026-06-22 02:37:07.828562 | debian-bookworm | INFO [delegated > dependency] Dependency completed successfully. 2026-06-22 02:37:07.828731 | debian-bookworm | WARNING [delegated > dependency] Executed: Missing roles requirements file: requirements.yml (Remove from dependency_sequence to suppress) 2026-06-22 02:37:07.829311 | debian-bookworm | WARNING Molecule executed 1 scenario (1 missing files) 2026-06-22 02:37:08.259013 | debian-bookworm | ok: Runtime: 0:00:08.405828 2026-06-22 02:37:08.541804 | ubuntu-noble | Validating downloaded file hash 1d41d3b5d145afda8cce7ec8515d5495c0afe9a3787ce4d2ea101956f5f7e2b1 with expected hash 1d41d3b5d145afda8cce7ec8515d5495c0afe9a3787ce4d2ea101956f5f7e2b1 2026-06-22 02:37:08.541899 | ubuntu-noble | Collection 'osism.commons:0.20260601.0' obtained from server default https://galaxy.ansible.com/api/ 2026-06-22 02:37:09.026089 | ubuntu-noble | ok: Runtime: 0:00:09.428796 2026-06-22 02:37:09.037559 | 2026-06-22 02:37:09.037728 | TASK [ansible-molecule : Run molecule create action with scenario delegated] 2026-06-22 02:37:08.713863 | ubuntu-noble | Starting galaxy collection install process 2026-06-22 02:37:08.715836 | ubuntu-noble | Process install dependency map 2026-06-22 02:37:08.715903 | ubuntu-noble | Starting collection install process 2026-06-22 02:37:08.715923 | ubuntu-noble | 'ansible.posix:2.1.0' is already installed, skipping. 2026-06-22 02:37:08.715942 | ubuntu-noble | 'community.docker:4.8.2' is already installed, skipping. 2026-06-22 02:37:08.716388 | ubuntu-noble | 'community.general:11.4.1' is already installed, skipping. 2026-06-22 02:37:08.716848 | ubuntu-noble | 'community.library_inventory_filtering_v1:1.1.5' is already installed, skipping. 2026-06-22 02:37:08.717386 | ubuntu-noble | Downloading https://galaxy.ansible.com/api/v3/plugin/ansible/content/published/collections/artifacts/osism-commons-0.20260601.0.tar.gz to /home/zuul/.ansible/tmp/ansible-local-1796co188pu2/tmphf7rk4nh/osism-commons-0.20260601.0-z7y39xg0 2026-06-22 02:37:08.718068 | ubuntu-noble | Installing 'osism.commons:0.20260601.0' to '/home/zuul/.ansible/collections/ansible_collections/osism/commons' 2026-06-22 02:37:08.718621 | ubuntu-noble | osism.commons:0.20260601.0 was installed successfully 2026-06-22 02:37:08.818042 | ubuntu-noble | INFO [delegated > dependency] Dependency completed successfully. 2026-06-22 02:37:08.818323 | ubuntu-noble | WARNING [delegated > dependency] Executed: Missing roles requirements file: requirements.yml (Remove from dependency_sequence to suppress) 2026-06-22 02:37:08.818950 | ubuntu-noble | WARNING Molecule executed 1 scenario (1 missing files) 2026-06-22 02:37:09.613032 | debian-bookworm | skipping: Conditional result was False 2026-06-22 02:37:09.614101 | ubuntu-noble | skipping: Conditional result was False 2026-06-22 02:37:09.631205 | 2026-06-22 02:37:09.631523 | TASK [ansible-molecule : Run molecule prepare action with scenario delegated] 2026-06-22 02:37:10.343095 | ubuntu-noble | WARNING Molecule scenarios should migrate to 'extensions/molecule' 2026-06-22 02:37:10.354206 | ubuntu-noble | DEBUG [unknown > config] provisioner.env found in /home/zuul/src/github.com/osism/ansible-collection-services/molecule/delegated/molecule.yml, this can be defined in ansible.env 2026-06-22 02:37:10.297075 | debian-bookworm | WARNING Molecule scenarios should migrate to 'extensions/molecule' 2026-06-22 02:37:10.308649 | debian-bookworm | DEBUG [unknown > config] provisioner.env found in /home/zuul/src/github.com/osism/ansible-collection-services/molecule/delegated/molecule.yml, this can be defined in ansible.env 2026-06-22 02:37:11.079148 | ubuntu-noble | DEBUG [unknown > config] provisioner.env found in /home/zuul/src/github.com/osism/ansible-collection-services/molecule/delegated/molecule.yml, this can be defined in ansible.env 2026-06-22 02:37:11.079823 | ubuntu-noble | DEBUG [delegated > validate] Validating schema /home/zuul/src/github.com/osism/ansible-collection-services/molecule/delegated/molecule.yml. 2026-06-22 02:37:11.102843 | ubuntu-noble | DEBUG [default > validate] Validating schema /home/zuul/src/github.com/osism/ansible-collection-services/molecule/default/molecule.yml. 2026-06-22 02:37:11.108672 | ubuntu-noble | INFO [delegated > discovery] scenario test matrix: prepare 2026-06-22 02:37:11.108792 | ubuntu-noble | INFO [delegated > prerun] Performing prerun with role_name_check=0... 2026-06-22 02:37:10.976090 | debian-bookworm | DEBUG [unknown > config] provisioner.env found in /home/zuul/src/github.com/osism/ansible-collection-services/molecule/delegated/molecule.yml, this can be defined in ansible.env 2026-06-22 02:37:10.976705 | debian-bookworm | DEBUG [delegated > validate] Validating schema /home/zuul/src/github.com/osism/ansible-collection-services/molecule/delegated/molecule.yml. 2026-06-22 02:37:10.997150 | debian-bookworm | DEBUG [default > validate] Validating schema /home/zuul/src/github.com/osism/ansible-collection-services/molecule/default/molecule.yml. 2026-06-22 02:37:11.003653 | debian-bookworm | INFO [delegated > discovery] scenario test matrix: prepare 2026-06-22 02:37:11.003845 | debian-bookworm | INFO [delegated > prerun] Performing prerun with role_name_check=0... 2026-06-22 02:37:12.432773 | debian-bookworm | INFO [delegated > prepare] Executing 2026-06-22 02:37:12.718371 | ubuntu-noble | INFO [delegated > prepare] Executing 2026-06-22 02:37:12.907309 | debian-bookworm | DEBUG [delegated > prepare] ansible-playbook version: ansible-playbook 2026-06-22 02:37:12.907419 | debian-bookworm | config file = None 2026-06-22 02:37:12.907455 | debian-bookworm | configured module search path = 2026-06-22 02:37:12.907468 | debian-bookworm | ansible python module location = /home/zuul/venv/lib/python3.11/site-packages/ansible 2026-06-22 02:37:12.907484 | debian-bookworm | ansible collection location = /home/zuul/.ansible/collections:/usr/share/ansible/collections 2026-06-22 02:37:12.907495 | debian-bookworm | executable location = /home/zuul/venv/bin/ansible-playbook 2026-06-22 02:37:12.907505 | debian-bookworm | python version = 3.11.2 (main, Apr 8 2026, 01:58:00) (/home/zuul/venv/bin/python3) 2026-06-22 02:37:12.907515 | debian-bookworm | jinja version = 3.1.6 2026-06-22 02:37:12.907525 | debian-bookworm | pyyaml version = 6.0.3 (with libyaml v0.2.5) 2026-06-22 02:37:12.907550 | debian-bookworm | DEBUG ANSIBLE ENVIRONMENT: 2026-06-22 02:37:12.907561 | debian-bookworm | ANSIBLE_COLLECTIONS_PATH: /home/zuul/venv/.ansible/collections:/home/zuul/.ansible/collections 2026-06-22 02:37:12.907571 | debian-bookworm | ANSIBLE_CONFIG: /home/zuul/.ansible/tmp/molecule.oWZD.delegated/ansible.cfg 2026-06-22 02:37:12.907581 | debian-bookworm | ANSIBLE_LIBRARY: ../../plugins 2026-06-22 02:37:12.907591 | debian-bookworm | ANSIBLE_PYTHON_INTERPRETER: /home/zuul/venv/bin/python 2026-06-22 02:37:12.907600 | debian-bookworm | ANSIBLE_ROLE: auditd 2026-06-22 02:37:12.907610 | debian-bookworm | ANSIBLE_ROLES_PATH: ../../roles 2026-06-22 02:37:12.907620 | debian-bookworm | ANSIBLE_VERBOSITY: 1 2026-06-22 02:37:12.907629 | debian-bookworm | 2026-06-22 02:37:12.907640 | debian-bookworm | DEBUG MOLECULE ENVIRONMENT: 2026-06-22 02:37:12.907650 | debian-bookworm | MOLECULE_DEBUG: True 2026-06-22 02:37:12.907660 | debian-bookworm | MOLECULE_DEPENDENCY_NAME: galaxy 2026-06-22 02:37:12.907669 | debian-bookworm | MOLECULE_DRIVER_NAME: default 2026-06-22 02:37:12.907716 | debian-bookworm | MOLECULE_ENV_FILE: /home/zuul/src/github.com/osism/ansible-collection-services/.env.yml 2026-06-22 02:37:12.907729 | debian-bookworm | MOLECULE_EPHEMERAL_DIRECTORY: /home/zuul/.ansible/tmp/molecule.oWZD.delegated 2026-06-22 02:37:12.907772 | debian-bookworm | MOLECULE_FILE: /home/zuul/.ansible/tmp/molecule.oWZD.delegated/molecule.yml 2026-06-22 02:37:12.907783 | debian-bookworm | MOLECULE_INSTANCE_CONFIG: /home/zuul/.ansible/tmp/molecule.oWZD.delegated/instance_config.yml 2026-06-22 02:37:12.907792 | debian-bookworm | MOLECULE_INVENTORY_FILE: /home/zuul/.ansible/tmp/molecule.oWZD.delegated/inventory/ansible_inventory.yml 2026-06-22 02:37:12.907804 | debian-bookworm | MOLECULE_PROJECT_DIRECTORY: /home/zuul/src/github.com/osism/ansible-collection-services 2026-06-22 02:37:12.907813 | debian-bookworm | MOLECULE_PROVISIONER_NAME: ansible 2026-06-22 02:37:12.907823 | debian-bookworm | MOLECULE_SCENARIO_DIRECTORY: /home/zuul/src/github.com/osism/ansible-collection-services/molecule/delegated 2026-06-22 02:37:12.907833 | debian-bookworm | MOLECULE_SCENARIO_NAME: delegated 2026-06-22 02:37:12.907843 | debian-bookworm | MOLECULE_STATE_FILE: /home/zuul/.ansible/tmp/molecule.oWZD.delegated/state.yml 2026-06-22 02:37:12.907852 | debian-bookworm | MOLECULE_VERIFIER_NAME: testinfra 2026-06-22 02:37:12.907862 | debian-bookworm | MOLECULE_VERIFIER_TEST_DIRECTORY: /home/zuul/src/github.com/osism/ansible-collection-services/molecule/delegated/tests 2026-06-22 02:37:12.907873 | debian-bookworm | 2026-06-22 02:37:12.907892 | debian-bookworm | DEBUG SHELL REPLAY: ANSIBLE_COLLECTIONS_PATH=/home/zuul/venv/.ansible/collections:/home/zuul/.ansible/collections ANSIBLE_CONFIG=/home/zuul/.ansible/tmp/molecule.oWZD.delegated/ansible.cfg ANSIBLE_LIBRARY=../../plugins ANSIBLE_PYTHON_INTERPRETER=/home/zuul/venv/bin/python ANSIBLE_ROLE=auditd ANSIBLE_ROLES_PATH=../../roles ANSIBLE_VERBOSITY=1 MOLECULE_DEBUG=True MOLECULE_DEPENDENCY_NAME=galaxy MOLECULE_DRIVER_NAME=default MOLECULE_ENV_FILE=/home/zuul/src/github.com/osism/ansible-collection-services/.env.yml MOLECULE_EPHEMERAL_DIRECTORY=/home/zuul/.ansible/tmp/molecule.oWZD.delegated MOLECULE_FILE=/home/zuul/.ansible/tmp/molecule.oWZD.delegated/molecule.yml MOLECULE_INSTANCE_CONFIG=/home/zuul/.ansible/tmp/molecule.oWZD.delegated/instance_config.yml MOLECULE_INVENTORY_FILE=/home/zuul/.ansible/tmp/molecule.oWZD.delegated/inventory/ansible_inventory.yml MOLECULE_PROJECT_DIRECTORY=/home/zuul/src/github.com/osism/ansible-collection-services MOLECULE_PROVISIONER_NAME=ansible MOLECULE_SCENARIO_DIRECTORY=/home/zuul/src/github.com/osism/ansible-collection-services/molecule/delegated MOLECULE_SCENARIO_NAME=delegated MOLECULE_STATE_FILE=/home/zuul/.ansible/tmp/molecule.oWZD.delegated/state.yml MOLECULE_VERIFIER_NAME=testinfra MOLECULE_VERIFIER_TEST_DIRECTORY=/home/zuul/src/github.com/osism/ansible-collection-services/molecule/delegated/tests 2026-06-22 02:37:13.232254 | ubuntu-noble | DEBUG [delegated > prepare] ansible-playbook version: ansible-playbook 2026-06-22 02:37:13.232313 | ubuntu-noble | config file = None 2026-06-22 02:37:13.232331 | ubuntu-noble | configured module search path = 2026-06-22 02:37:13.232337 | ubuntu-noble | ansible python module location = /home/zuul/venv/lib/python3.12/site-packages/ansible 2026-06-22 02:37:13.232343 | ubuntu-noble | ansible collection location = /home/zuul/.ansible/collections:/usr/share/ansible/collections 2026-06-22 02:37:13.232346 | ubuntu-noble | executable location = /home/zuul/venv/bin/ansible-playbook 2026-06-22 02:37:13.232350 | ubuntu-noble | python version = 3.12.3 (main, Mar 23 2026, 19:04:32) (/home/zuul/venv/bin/python3) 2026-06-22 02:37:13.232354 | ubuntu-noble | jinja version = 3.1.6 2026-06-22 02:37:13.232358 | ubuntu-noble | pyyaml version = 6.0.3 (with libyaml v0.2.5) 2026-06-22 02:37:13.232615 | ubuntu-noble | DEBUG ANSIBLE ENVIRONMENT: 2026-06-22 02:37:13.232622 | ubuntu-noble | ANSIBLE_COLLECTIONS_PATH: /home/zuul/venv/.ansible/collections:/home/zuul/.ansible/collections 2026-06-22 02:37:13.232626 | ubuntu-noble | ANSIBLE_CONFIG: /home/zuul/.ansible/tmp/molecule.oWZD.delegated/ansible.cfg 2026-06-22 02:37:13.232629 | ubuntu-noble | ANSIBLE_LIBRARY: ../../plugins 2026-06-22 02:37:13.232633 | ubuntu-noble | ANSIBLE_PYTHON_INTERPRETER: /home/zuul/venv/bin/python 2026-06-22 02:37:13.232637 | ubuntu-noble | ANSIBLE_ROLE: auditd 2026-06-22 02:37:13.232640 | ubuntu-noble | ANSIBLE_ROLES_PATH: ../../roles 2026-06-22 02:37:13.232644 | ubuntu-noble | ANSIBLE_VERBOSITY: 1 2026-06-22 02:37:13.232648 | ubuntu-noble | 2026-06-22 02:37:13.232941 | ubuntu-noble | DEBUG MOLECULE ENVIRONMENT: 2026-06-22 02:37:13.232951 | ubuntu-noble | MOLECULE_DEBUG: True 2026-06-22 02:37:13.232955 | ubuntu-noble | MOLECULE_DEPENDENCY_NAME: galaxy 2026-06-22 02:37:13.232958 | ubuntu-noble | MOLECULE_DRIVER_NAME: default 2026-06-22 02:37:13.232962 | ubuntu-noble | MOLECULE_ENV_FILE: /home/zuul/src/github.com/osism/ansible-collection-services/.env.yml 2026-06-22 02:37:13.232966 | ubuntu-noble | MOLECULE_EPHEMERAL_DIRECTORY: /home/zuul/.ansible/tmp/molecule.oWZD.delegated 2026-06-22 02:37:13.232970 | ubuntu-noble | MOLECULE_FILE: /home/zuul/.ansible/tmp/molecule.oWZD.delegated/molecule.yml 2026-06-22 02:37:13.232973 | ubuntu-noble | MOLECULE_INSTANCE_CONFIG: /home/zuul/.ansible/tmp/molecule.oWZD.delegated/instance_config.yml 2026-06-22 02:37:13.232976 | ubuntu-noble | MOLECULE_INVENTORY_FILE: /home/zuul/.ansible/tmp/molecule.oWZD.delegated/inventory/ansible_inventory.yml 2026-06-22 02:37:13.232980 | ubuntu-noble | MOLECULE_PROJECT_DIRECTORY: /home/zuul/src/github.com/osism/ansible-collection-services 2026-06-22 02:37:13.232984 | ubuntu-noble | MOLECULE_PROVISIONER_NAME: ansible 2026-06-22 02:37:13.232987 | ubuntu-noble | MOLECULE_SCENARIO_DIRECTORY: /home/zuul/src/github.com/osism/ansible-collection-services/molecule/delegated 2026-06-22 02:37:13.232991 | ubuntu-noble | MOLECULE_SCENARIO_NAME: delegated 2026-06-22 02:37:13.232994 | ubuntu-noble | MOLECULE_STATE_FILE: /home/zuul/.ansible/tmp/molecule.oWZD.delegated/state.yml 2026-06-22 02:37:13.232997 | ubuntu-noble | MOLECULE_VERIFIER_NAME: testinfra 2026-06-22 02:37:13.233001 | ubuntu-noble | MOLECULE_VERIFIER_TEST_DIRECTORY: /home/zuul/src/github.com/osism/ansible-collection-services/molecule/delegated/tests 2026-06-22 02:37:13.233005 | ubuntu-noble | 2026-06-22 02:37:13.233145 | ubuntu-noble | DEBUG SHELL REPLAY: ANSIBLE_COLLECTIONS_PATH=/home/zuul/venv/.ansible/collections:/home/zuul/.ansible/collections ANSIBLE_CONFIG=/home/zuul/.ansible/tmp/molecule.oWZD.delegated/ansible.cfg ANSIBLE_LIBRARY=../../plugins ANSIBLE_PYTHON_INTERPRETER=/home/zuul/venv/bin/python ANSIBLE_ROLE=auditd ANSIBLE_ROLES_PATH=../../roles ANSIBLE_VERBOSITY=1 MOLECULE_DEBUG=True MOLECULE_DEPENDENCY_NAME=galaxy MOLECULE_DRIVER_NAME=default MOLECULE_ENV_FILE=/home/zuul/src/github.com/osism/ansible-collection-services/.env.yml MOLECULE_EPHEMERAL_DIRECTORY=/home/zuul/.ansible/tmp/molecule.oWZD.delegated MOLECULE_FILE=/home/zuul/.ansible/tmp/molecule.oWZD.delegated/molecule.yml MOLECULE_INSTANCE_CONFIG=/home/zuul/.ansible/tmp/molecule.oWZD.delegated/instance_config.yml MOLECULE_INVENTORY_FILE=/home/zuul/.ansible/tmp/molecule.oWZD.delegated/inventory/ansible_inventory.yml MOLECULE_PROJECT_DIRECTORY=/home/zuul/src/github.com/osism/ansible-collection-services MOLECULE_PROVISIONER_NAME=ansible MOLECULE_SCENARIO_DIRECTORY=/home/zuul/src/github.com/osism/ansible-collection-services/molecule/delegated MOLECULE_SCENARIO_NAME=delegated MOLECULE_STATE_FILE=/home/zuul/.ansible/tmp/molecule.oWZD.delegated/state.yml MOLECULE_VERIFIER_NAME=testinfra MOLECULE_VERIFIER_TEST_DIRECTORY=/home/zuul/src/github.com/osism/ansible-collection-services/molecule/delegated/tests 2026-06-22 02:37:13.349861 | debian-bookworm | Using /home/zuul/.ansible/tmp/molecule.oWZD.delegated/ansible.cfg as config file 2026-06-22 02:37:13.607113 | debian-bookworm | 2026-06-22 02:37:13.607548 | debian-bookworm | PLAY [Prepare] ***************************************************************** 2026-06-22 02:37:13.608021 | debian-bookworm | 2026-06-22 02:37:13.608422 | debian-bookworm | TASK [Gathering Facts] ********************************************************* 2026-06-22 02:37:13.668944 | ubuntu-noble | Using /home/zuul/.ansible/tmp/molecule.oWZD.delegated/ansible.cfg as config file 2026-06-22 02:37:13.960846 | ubuntu-noble | 2026-06-22 02:37:13.962794 | ubuntu-noble | PLAY [Prepare] ***************************************************************** 2026-06-22 02:37:13.963187 | ubuntu-noble | 2026-06-22 02:37:13.963566 | ubuntu-noble | TASK [Gathering Facts] ********************************************************* 2026-06-22 02:37:15.353789 | ubuntu-noble | ok: [molecule-auditd] 2026-06-22 02:37:15.356791 | ubuntu-noble | 2026-06-22 02:37:15.356824 | ubuntu-noble | TASK [Install packages in venv] ************************************************ 2026-06-22 02:37:15.903927 | debian-bookworm | ok: [molecule-auditd] 2026-06-22 02:37:15.904017 | debian-bookworm | 2026-06-22 02:37:15.904158 | debian-bookworm | TASK [Install packages in venv] ************************************************ 2026-06-22 02:37:20.628932 | ubuntu-noble | changed: [molecule-auditd] => (item=docker) => {"ansible_loop_var": "item", "changed": true, "cmd": ["/home/zuul/venv/bin/pip3", "install", "docker"], "item": "docker", "name": ["docker"], "requirements": null, "state": "present", "stderr": "", "stderr_lines": [], "stdout": "Collecting docker\n Downloading docker-7.1.0-py3-none-any.whl.metadata (3.8 kB)\nRequirement already satisfied: requests>=2.26.0 in /home/zuul/venv/lib/python3.12/site-packages (from docker) (2.34.2)\nRequirement already satisfied: urllib3>=1.26.0 in /home/zuul/venv/lib/python3.12/site-packages (from docker) (2.7.0)\nRequirement already satisfied: charset_normalizer<4,>=2 in /home/zuul/venv/lib/python3.12/site-packages (from requests>=2.26.0->docker) (3.4.7)\nRequirement already satisfied: idna<4,>=2.5 in /home/zuul/venv/lib/python3.12/site-packages (from requests>=2.26.0->docker) (3.18)\nRequirement already satisfied: certifi>=2023.5.7 in /home/zuul/venv/lib/python3.12/site-packages (from requests>=2.26.0->docker) (2026.6.17)\nDownloading docker-7.1.0-py3-none-any.whl (147 kB)\n ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ 147.8/147.8 kB 3.7 MB/s eta 0:00:00\nInstalling collected packages: docker\nSuccessfully installed docker-7.1.0\n", "stdout_lines": ["Collecting docker", " Downloading docker-7.1.0-py3-none-any.whl.metadata (3.8 kB)", "Requirement already satisfied: requests>=2.26.0 in /home/zuul/venv/lib/python3.12/site-packages (from docker) (2.34.2)", "Requirement already satisfied: urllib3>=1.26.0 in /home/zuul/venv/lib/python3.12/site-packages (from docker) (2.7.0)", "Requirement already satisfied: charset_normalizer<4,>=2 in /home/zuul/venv/lib/python3.12/site-packages (from requests>=2.26.0->docker) (3.4.7)", "Requirement already satisfied: idna<4,>=2.5 in /home/zuul/venv/lib/python3.12/site-packages (from requests>=2.26.0->docker) (3.18)", "Requirement already satisfied: certifi>=2023.5.7 in /home/zuul/venv/lib/python3.12/site-packages (from requests>=2.26.0->docker) (2026.6.17)", "Downloading docker-7.1.0-py3-none-any.whl (147 kB)", " ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ 147.8/147.8 kB 3.7 MB/s eta 0:00:00", "Installing collected packages: docker", "Successfully installed docker-7.1.0"], "version": null, "virtualenv": "/home/zuul/venv"} 2026-06-22 02:37:20.630253 | ubuntu-noble | changed: [molecule-auditd] => (item=netaddr) => {"ansible_loop_var": "item", "changed": true, "cmd": ["/home/zuul/venv/bin/pip3", "install", "netaddr"], "item": "netaddr", "name": ["netaddr"], "requirements": null, "state": "present", "stderr": "", "stderr_lines": [], "stdout": "Collecting netaddr\n Downloading netaddr-1.3.0-py3-none-any.whl.metadata (5.0 kB)\nDownloading netaddr-1.3.0-py3-none-any.whl (2.3 MB)\n ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ 2.3/2.3 MB 11.2 MB/s eta 0:00:00\nInstalling collected packages: netaddr\nSuccessfully installed netaddr-1.3.0\n", "stdout_lines": ["Collecting netaddr", " Downloading netaddr-1.3.0-py3-none-any.whl.metadata (5.0 kB)", "Downloading netaddr-1.3.0-py3-none-any.whl (2.3 MB)", " ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ 2.3/2.3 MB 11.2 MB/s eta 0:00:00", "Installing collected packages: netaddr", "Successfully installed netaddr-1.3.0"], "version": null, "virtualenv": "/home/zuul/venv"} 2026-06-22 02:37:20.630641 | ubuntu-noble | ok: [molecule-auditd] => (item=requests) => {"ansible_loop_var": "item", "changed": false, "cmd": ["/home/zuul/venv/bin/pip3", "install", "requests"], "item": "requests", "name": ["requests"], "requirements": null, "state": "present", "stderr": "", "stderr_lines": [], "stdout": "Requirement already satisfied: requests in /home/zuul/venv/lib/python3.12/site-packages (2.34.2)\nRequirement already satisfied: charset_normalizer<4,>=2 in /home/zuul/venv/lib/python3.12/site-packages (from requests) (3.4.7)\nRequirement already satisfied: idna<4,>=2.5 in /home/zuul/venv/lib/python3.12/site-packages (from requests) (3.18)\nRequirement already satisfied: urllib3<3,>=1.26 in /home/zuul/venv/lib/python3.12/site-packages (from requests) (2.7.0)\nRequirement already satisfied: certifi>=2023.5.7 in /home/zuul/venv/lib/python3.12/site-packages (from requests) (2026.6.17)\n", "stdout_lines": ["Requirement already satisfied: requests in /home/zuul/venv/lib/python3.12/site-packages (2.34.2)", "Requirement already satisfied: charset_normalizer<4,>=2 in /home/zuul/venv/lib/python3.12/site-packages (from requests) (3.4.7)", "Requirement already satisfied: idna<4,>=2.5 in /home/zuul/venv/lib/python3.12/site-packages (from requests) (3.18)", "Requirement already satisfied: urllib3<3,>=1.26 in /home/zuul/venv/lib/python3.12/site-packages (from requests) (2.7.0)", "Requirement already satisfied: certifi>=2023.5.7 in /home/zuul/venv/lib/python3.12/site-packages (from requests) (2026.6.17)"], "version": null, "virtualenv": "/home/zuul/venv"} 2026-06-22 02:37:20.631008 | ubuntu-noble | 2026-06-22 02:37:20.631335 | ubuntu-noble | TASK [Include required prepare tasks] ****************************************** 2026-06-22 02:37:20.653996 | ubuntu-noble | included: /home/zuul/src/github.com/osism/ansible-collection-services/molecule/delegated/prepare/auditd.yml for molecule-auditd 2026-06-22 02:37:20.654221 | ubuntu-noble | 2026-06-22 02:37:20.654514 | ubuntu-noble | PLAY RECAP ********************************************************************* 2026-06-22 02:37:20.654925 | ubuntu-noble | molecule-auditd : ok=3 changed=1 unreachable=0 failed=0 skipped=0 rescued=0 ignored=0 2026-06-22 02:37:20.655189 | ubuntu-noble | 2026-06-22 02:37:20.770169 | ubuntu-noble | INFO [delegated > prepare] Executed: Successful 2026-06-22 02:37:20.771537 | ubuntu-noble | INFO Molecule executed 1 scenario (1 successful) 2026-06-22 02:37:20.788259 | debian-bookworm | changed: [molecule-auditd] => (item=docker) => {"ansible_loop_var": "item", "changed": true, "cmd": ["/home/zuul/venv/bin/pip3", "install", "docker"], "item": "docker", "name": ["docker"], "requirements": null, "state": "present", "stderr": "", "stderr_lines": [], "stdout": "Collecting docker\n Downloading docker-7.1.0-py3-none-any.whl (147 kB)\n ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ 147.8/147.8 kB 3.1 MB/s eta 0:00:00\nRequirement already satisfied: requests>=2.26.0 in /home/zuul/venv/lib/python3.11/site-packages (from docker) (2.34.2)\nRequirement already satisfied: urllib3>=1.26.0 in /home/zuul/venv/lib/python3.11/site-packages (from docker) (2.7.0)\nRequirement already satisfied: charset_normalizer<4,>=2 in /home/zuul/venv/lib/python3.11/site-packages (from requests>=2.26.0->docker) (3.4.7)\nRequirement already satisfied: idna<4,>=2.5 in /home/zuul/venv/lib/python3.11/site-packages (from requests>=2.26.0->docker) (3.18)\nRequirement already satisfied: certifi>=2023.5.7 in /home/zuul/venv/lib/python3.11/site-packages (from requests>=2.26.0->docker) (2026.6.17)\nInstalling collected packages: docker\nSuccessfully installed docker-7.1.0\n", "stdout_lines": ["Collecting docker", " Downloading docker-7.1.0-py3-none-any.whl (147 kB)", " ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ 147.8/147.8 kB 3.1 MB/s eta 0:00:00", "Requirement already satisfied: requests>=2.26.0 in /home/zuul/venv/lib/python3.11/site-packages (from docker) (2.34.2)", "Requirement already satisfied: urllib3>=1.26.0 in /home/zuul/venv/lib/python3.11/site-packages (from docker) (2.7.0)", "Requirement already satisfied: charset_normalizer<4,>=2 in /home/zuul/venv/lib/python3.11/site-packages (from requests>=2.26.0->docker) (3.4.7)", "Requirement already satisfied: idna<4,>=2.5 in /home/zuul/venv/lib/python3.11/site-packages (from requests>=2.26.0->docker) (3.18)", "Requirement already satisfied: certifi>=2023.5.7 in /home/zuul/venv/lib/python3.11/site-packages (from requests>=2.26.0->docker) (2026.6.17)", "Installing collected packages: docker", "Successfully installed docker-7.1.0"], "version": null, "virtualenv": "/home/zuul/venv"} 2026-06-22 02:37:20.788787 | debian-bookworm | changed: [molecule-auditd] => (item=netaddr) => {"ansible_loop_var": "item", "changed": true, "cmd": ["/home/zuul/venv/bin/pip3", "install", "netaddr"], "item": "netaddr", "name": ["netaddr"], "requirements": null, "state": "present", "stderr": "", "stderr_lines": [], "stdout": "Collecting netaddr\n Downloading netaddr-1.3.0-py3-none-any.whl (2.3 MB)\n ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ 2.3/2.3 MB 14.0 MB/s eta 0:00:00\nInstalling collected packages: netaddr\nSuccessfully installed netaddr-1.3.0\n", "stdout_lines": ["Collecting netaddr", " Downloading netaddr-1.3.0-py3-none-any.whl (2.3 MB)", " ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ 2.3/2.3 MB 14.0 MB/s eta 0:00:00", "Installing collected packages: netaddr", "Successfully installed netaddr-1.3.0"], "version": null, "virtualenv": "/home/zuul/venv"} 2026-06-22 02:37:20.789032 | debian-bookworm | ok: [molecule-auditd] => (item=requests) => {"ansible_loop_var": "item", "changed": false, "cmd": ["/home/zuul/venv/bin/pip3", "install", "requests"], "item": "requests", "name": ["requests"], "requirements": null, "state": "present", "stderr": "", "stderr_lines": [], "stdout": "Requirement already satisfied: requests in /home/zuul/venv/lib/python3.11/site-packages (2.34.2)\nRequirement already satisfied: charset_normalizer<4,>=2 in /home/zuul/venv/lib/python3.11/site-packages (from requests) (3.4.7)\nRequirement already satisfied: idna<4,>=2.5 in /home/zuul/venv/lib/python3.11/site-packages (from requests) (3.18)\nRequirement already satisfied: urllib3<3,>=1.26 in /home/zuul/venv/lib/python3.11/site-packages (from requests) (2.7.0)\nRequirement already satisfied: certifi>=2023.5.7 in /home/zuul/venv/lib/python3.11/site-packages (from requests) (2026.6.17)\n", "stdout_lines": ["Requirement already satisfied: requests in /home/zuul/venv/lib/python3.11/site-packages (2.34.2)", "Requirement already satisfied: charset_normalizer<4,>=2 in /home/zuul/venv/lib/python3.11/site-packages (from requests) (3.4.7)", "Requirement already satisfied: idna<4,>=2.5 in /home/zuul/venv/lib/python3.11/site-packages (from requests) (3.18)", "Requirement already satisfied: urllib3<3,>=1.26 in /home/zuul/venv/lib/python3.11/site-packages (from requests) (2.7.0)", "Requirement already satisfied: certifi>=2023.5.7 in /home/zuul/venv/lib/python3.11/site-packages (from requests) (2026.6.17)"], "version": null, "virtualenv": "/home/zuul/venv"} 2026-06-22 02:37:20.789204 | debian-bookworm | 2026-06-22 02:37:20.789410 | debian-bookworm | TASK [Include required prepare tasks] ****************************************** 2026-06-22 02:37:20.815962 | debian-bookworm | included: /home/zuul/src/github.com/osism/ansible-collection-services/molecule/delegated/prepare/auditd.yml for molecule-auditd 2026-06-22 02:37:20.816230 | debian-bookworm | 2026-06-22 02:37:20.816498 | debian-bookworm | PLAY RECAP ********************************************************************* 2026-06-22 02:37:20.816852 | debian-bookworm | molecule-auditd : ok=3 changed=1 unreachable=0 failed=0 skipped=0 rescued=0 ignored=0 2026-06-22 02:37:20.817094 | debian-bookworm | 2026-06-22 02:37:20.940342 | debian-bookworm | INFO [delegated > prepare] Executed: Successful 2026-06-22 02:37:20.940711 | debian-bookworm | INFO Molecule executed 1 scenario (1 successful) 2026-06-22 02:37:21.210519 | ubuntu-noble | ok: Runtime: 0:00:10.881001 2026-06-22 02:37:21.219934 | debian-bookworm | ok: Runtime: 0:00:11.079060 2026-06-22 02:37:21.230817 | 2026-06-22 02:37:21.231049 | TASK [ansible-molecule : Reset connection] 2026-06-22 02:37:21.283394 | 2026-06-22 02:37:21.283660 | TASK [ansible-molecule : Reset connection] 2026-06-22 02:37:21.320172 | 2026-06-22 02:37:21.320370 | TASK [ansible-molecule : Run molecule converge action with scenario delegated] 2026-06-22 02:37:22.214784 | ubuntu-noble | WARNING Molecule scenarios should migrate to 'extensions/molecule' 2026-06-22 02:37:22.225398 | ubuntu-noble | DEBUG [unknown > config] provisioner.env found in /home/zuul/src/github.com/osism/ansible-collection-services/molecule/delegated/molecule.yml, this can be defined in ansible.env 2026-06-22 02:37:22.157671 | debian-bookworm | WARNING Molecule scenarios should migrate to 'extensions/molecule' 2026-06-22 02:37:22.166402 | debian-bookworm | DEBUG [unknown > config] provisioner.env found in /home/zuul/src/github.com/osism/ansible-collection-services/molecule/delegated/molecule.yml, this can be defined in ansible.env 2026-06-22 02:37:22.819577 | debian-bookworm | DEBUG [unknown > config] provisioner.env found in /home/zuul/src/github.com/osism/ansible-collection-services/molecule/delegated/molecule.yml, this can be defined in ansible.env 2026-06-22 02:37:22.820394 | debian-bookworm | DEBUG [delegated > validate] Validating schema /home/zuul/src/github.com/osism/ansible-collection-services/molecule/delegated/molecule.yml. 2026-06-22 02:37:22.842301 | debian-bookworm | DEBUG [default > validate] Validating schema /home/zuul/src/github.com/osism/ansible-collection-services/molecule/default/molecule.yml. 2026-06-22 02:37:22.848854 | debian-bookworm | INFO [delegated > discovery] scenario test matrix: dependency, create, prepare, converge 2026-06-22 02:37:22.848940 | debian-bookworm | INFO [delegated > prerun] Performing prerun with role_name_check=0... 2026-06-22 02:37:22.916211 | ubuntu-noble | DEBUG [unknown > config] provisioner.env found in /home/zuul/src/github.com/osism/ansible-collection-services/molecule/delegated/molecule.yml, this can be defined in ansible.env 2026-06-22 02:37:22.917067 | ubuntu-noble | DEBUG [delegated > validate] Validating schema /home/zuul/src/github.com/osism/ansible-collection-services/molecule/delegated/molecule.yml. 2026-06-22 02:37:22.939470 | ubuntu-noble | DEBUG [default > validate] Validating schema /home/zuul/src/github.com/osism/ansible-collection-services/molecule/default/molecule.yml. 2026-06-22 02:37:22.945339 | ubuntu-noble | INFO [delegated > discovery] scenario test matrix: dependency, create, prepare, converge 2026-06-22 02:37:22.945484 | ubuntu-noble | INFO [delegated > prerun] Performing prerun with role_name_check=0... 2026-06-22 02:37:24.274222 | debian-bookworm | INFO [delegated > dependency] Executing 2026-06-22 02:37:24.274431 | debian-bookworm | WARNING [delegated > dependency] Missing roles requirements file: requirements.yml 2026-06-22 02:37:24.638189 | ubuntu-noble | INFO [delegated > dependency] Executing 2026-06-22 02:37:24.638830 | ubuntu-noble | WARNING [delegated > dependency] Missing roles requirements file: requirements.yml 2026-06-22 02:37:24.736524 | debian-bookworm | ansible-galaxy [core 2.19.11] 2026-06-22 02:37:24.737017 | debian-bookworm | config file = None 2026-06-22 02:37:24.737436 | debian-bookworm | configured module search path = ['/home/zuul/src/github.com/osism/ansible-collection-services/plugins/modules', '/home/zuul/.ansible/plugins/modules', '/usr/share/ansible/plugins/modules'] 2026-06-22 02:37:24.737922 | debian-bookworm | ansible python module location = /home/zuul/venv/lib/python3.11/site-packages/ansible 2026-06-22 02:37:24.738320 | debian-bookworm | ansible collection location = /home/zuul/.ansible/collections:/usr/share/ansible/collections:/home/zuul/venv/lib/python3.11/site-packages:/home/zuul/venv/lib/python3.11/dist-packages:/home/zuul/venv/lib/python3/dist-packages:/home/zuul/venv/local/lib/python3.11/dist-packages 2026-06-22 02:37:24.738650 | debian-bookworm | executable location = /home/zuul/venv/bin/ansible-galaxy 2026-06-22 02:37:24.739040 | debian-bookworm | python version = 3.11.2 (main, Apr 8 2026, 01:58:00) [GCC 12.2.0] (/home/zuul/venv/bin/python3) 2026-06-22 02:37:24.739382 | debian-bookworm | jinja version = 3.1.6 2026-06-22 02:37:24.739652 | debian-bookworm | pyyaml version = 6.0.3 (with libyaml v0.2.5) 2026-06-22 02:37:24.739968 | debian-bookworm | No config file found; using defaults 2026-06-22 02:37:24.740384 | debian-bookworm | Reading requirement file at '/home/zuul/src/github.com/osism/ansible-collection-services/molecule/delegated/collections.yml' 2026-06-22 02:37:24.745210 | debian-bookworm | Loading collection community.docker from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/docker 2026-06-22 02:37:24.745564 | debian-bookworm | Found installed collection community.docker:4.8.2 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/docker' 2026-06-22 02:37:24.747333 | debian-bookworm | Loading collection community.windows from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/windows 2026-06-22 02:37:24.747650 | debian-bookworm | Found installed collection community.windows:3.0.1 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/windows' 2026-06-22 02:37:24.748277 | debian-bookworm | Loading collection community.postgresql from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/postgresql 2026-06-22 02:37:24.748638 | debian-bookworm | Found installed collection community.postgresql:4.1.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/postgresql' 2026-06-22 02:37:24.748978 | debian-bookworm | Loading collection grafana.grafana from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/grafana/grafana 2026-06-22 02:37:24.749292 | debian-bookworm | Found installed collection grafana.grafana:6.0.6 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/grafana/grafana' 2026-06-22 02:37:24.749595 | debian-bookworm | Loading collection cisco.dnac from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/cisco/dnac 2026-06-22 02:37:24.750048 | debian-bookworm | Found installed collection cisco.dnac:6.41.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/cisco/dnac' 2026-06-22 02:37:24.750613 | debian-bookworm | Loading collection dellemc.powerflex from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/dellemc/powerflex 2026-06-22 02:37:24.750943 | debian-bookworm | Found installed collection dellemc.powerflex:2.6.1 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/dellemc/powerflex' 2026-06-22 02:37:24.751465 | debian-bookworm | Loading collection community.crypto from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/crypto 2026-06-22 02:37:24.751867 | debian-bookworm | Found installed collection community.crypto:3.0.5 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/crypto' 2026-06-22 02:37:24.752141 | debian-bookworm | Loading collection containers.podman from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/containers/podman 2026-06-22 02:37:24.752540 | debian-bookworm | Found installed collection containers.podman:1.18.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/containers/podman' 2026-06-22 02:37:24.752838 | debian-bookworm | Loading collection cisco.ucs from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/cisco/ucs 2026-06-22 02:37:24.753113 | debian-bookworm | Found installed collection cisco.ucs:1.16.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/cisco/ucs' 2026-06-22 02:37:24.753388 | debian-bookworm | Loading collection cisco.intersight from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/cisco/intersight 2026-06-22 02:37:24.753663 | debian-bookworm | Found installed collection cisco.intersight:2.7.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/cisco/intersight' 2026-06-22 02:37:24.755096 | debian-bookworm | Loading collection cisco.aci from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/cisco/aci 2026-06-22 02:37:24.755435 | debian-bookworm | Found installed collection cisco.aci:2.12.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/cisco/aci' 2026-06-22 02:37:24.756906 | debian-bookworm | Loading collection community.vmware from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/vmware 2026-06-22 02:37:24.757250 | debian-bookworm | Found installed collection community.vmware:5.10.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/vmware' 2026-06-22 02:37:24.757819 | debian-bookworm | Loading collection ibm.qradar from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/ibm/qradar 2026-06-22 02:37:24.758171 | debian-bookworm | Found installed collection ibm.qradar:4.0.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/ibm/qradar' 2026-06-22 02:37:24.758583 | debian-bookworm | Loading collection ansible.windows from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/ansible/windows 2026-06-22 02:37:24.758838 | debian-bookworm | Found installed collection ansible.windows:3.2.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/ansible/windows' 2026-06-22 02:37:24.759597 | debian-bookworm | Loading collection cloudscale_ch.cloud from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/cloudscale_ch/cloud 2026-06-22 02:37:24.759932 | debian-bookworm | Found installed collection cloudscale_ch.cloud:2.5.2 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/cloudscale_ch/cloud' 2026-06-22 02:37:24.760171 | debian-bookworm | Loading collection community.library_inventory_filtering_v1 from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/library_inventory_filtering_v1 2026-06-22 02:37:24.760504 | debian-bookworm | Found installed collection community.library_inventory_filtering_v1:1.1.5 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/library_inventory_filtering_v1' 2026-06-22 02:37:24.760864 | debian-bookworm | Loading collection community.hashi_vault from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/hashi_vault 2026-06-22 02:37:24.761260 | debian-bookworm | Found installed collection community.hashi_vault:7.1.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/hashi_vault' 2026-06-22 02:37:24.761707 | debian-bookworm | Loading collection wti.remote from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/wti/remote 2026-06-22 02:37:24.762033 | debian-bookworm | Found installed collection wti.remote:1.0.10 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/wti/remote' 2026-06-22 02:37:24.762385 | debian-bookworm | Loading collection microsoft.ad from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/microsoft/ad 2026-06-22 02:37:24.762690 | debian-bookworm | Found installed collection microsoft.ad:1.9.2 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/microsoft/ad' 2026-06-22 02:37:24.764458 | debian-bookworm | Loading collection theforeman.foreman from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/theforeman/foreman 2026-06-22 02:37:24.764822 | debian-bookworm | Found installed collection theforeman.foreman:5.7.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/theforeman/foreman' 2026-06-22 02:37:24.765099 | debian-bookworm | Loading collection community.libvirt from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/libvirt 2026-06-22 02:37:24.765353 | debian-bookworm | Found installed collection community.libvirt:2.0.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/libvirt' 2026-06-22 02:37:24.765560 | debian-bookworm | Loading collection ansible.utils from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/ansible/utils 2026-06-22 02:37:24.765806 | debian-bookworm | Found installed collection ansible.utils:6.0.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/ansible/utils' 2026-06-22 02:37:24.766006 | debian-bookworm | Loading collection community.proxysql from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/proxysql 2026-06-22 02:37:24.766257 | debian-bookworm | Found installed collection community.proxysql:1.7.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/proxysql' 2026-06-22 02:37:24.766856 | debian-bookworm | Loading collection dellemc.openmanage from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/dellemc/openmanage 2026-06-22 02:37:24.767052 | debian-bookworm | Found installed collection dellemc.openmanage:9.12.3 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/dellemc/openmanage' 2026-06-22 02:37:24.767644 | debian-bookworm | Loading collection ngine_io.cloudstack from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/ngine_io/cloudstack 2026-06-22 02:37:24.768155 | debian-bookworm | Found installed collection ngine_io.cloudstack:2.5.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/ngine_io/cloudstack' 2026-06-22 02:37:24.768348 | debian-bookworm | Loading collection netapp_eseries.santricity from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/netapp_eseries/santricity 2026-06-22 02:37:24.768611 | debian-bookworm | Found installed collection netapp_eseries.santricity:1.4.1 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/netapp_eseries/santricity' 2026-06-22 02:37:24.769003 | debian-bookworm | Loading collection hitachivantara.vspone_block from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/hitachivantara/vspone_block 2026-06-22 02:37:24.769275 | debian-bookworm | Found installed collection hitachivantara.vspone_block:4.4.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/hitachivantara/vspone_block' 2026-06-22 02:37:24.769788 | debian-bookworm | Loading collection telekom_mms.icinga_director from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/telekom_mms/icinga_director 2026-06-22 02:37:24.770053 | debian-bookworm | Found installed collection telekom_mms.icinga_director:2.4.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/telekom_mms/icinga_director' 2026-06-22 02:37:24.771229 | debian-bookworm | Loading collection hetzner.hcloud from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/hetzner/hcloud 2026-06-22 02:37:24.771480 | debian-bookworm | Found installed collection hetzner.hcloud:5.4.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/hetzner/hcloud' 2026-06-22 02:37:24.773153 | debian-bookworm | Loading collection dellemc.enterprise_sonic from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/dellemc/enterprise_sonic 2026-06-22 02:37:24.773404 | debian-bookworm | Found installed collection dellemc.enterprise_sonic:3.2.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/dellemc/enterprise_sonic' 2026-06-22 02:37:24.774483 | debian-bookworm | Loading collection community.dns from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/dns 2026-06-22 02:37:24.775006 | debian-bookworm | Found installed collection community.dns:3.4.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/dns' 2026-06-22 02:37:24.775434 | debian-bookworm | Loading collection cisco.ios from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/cisco/ios 2026-06-22 02:37:24.775803 | debian-bookworm | Found installed collection cisco.ios:11.1.1 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/cisco/ios' 2026-06-22 02:37:24.776220 | debian-bookworm | Loading collection community.hrobot from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/hrobot 2026-06-22 02:37:24.776527 | debian-bookworm | Found installed collection community.hrobot:2.7.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/hrobot' 2026-06-22 02:37:24.776997 | debian-bookworm | Loading collection community.digitalocean from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/digitalocean 2026-06-22 02:37:24.777387 | debian-bookworm | Found installed collection community.digitalocean:1.27.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/digitalocean' 2026-06-22 02:37:24.777959 | debian-bookworm | Loading collection openstack.cloud from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/openstack/cloud 2026-06-22 02:37:24.778358 | debian-bookworm | Found installed collection openstack.cloud:2.5.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/openstack/cloud' 2026-06-22 02:37:24.780531 | debian-bookworm | Loading collection vmware.vmware_rest from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/vmware/vmware_rest 2026-06-22 02:37:24.780895 | debian-bookworm | Found installed collection vmware.vmware_rest:4.9.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/vmware/vmware_rest' 2026-06-22 02:37:24.781232 | debian-bookworm | Loading collection vmware.vmware from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/vmware/vmware 2026-06-22 02:37:24.781576 | debian-bookworm | Found installed collection vmware.vmware:2.4.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/vmware/vmware' 2026-06-22 02:37:24.781939 | debian-bookworm | Loading collection kaytus.ksmanage from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/kaytus/ksmanage 2026-06-22 02:37:24.782262 | debian-bookworm | Found installed collection kaytus.ksmanage:2.0.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/kaytus/ksmanage' 2026-06-22 02:37:24.782611 | debian-bookworm | Loading collection community.proxmox from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/proxmox 2026-06-22 02:37:24.782977 | debian-bookworm | Found installed collection community.proxmox:1.4.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/proxmox' 2026-06-22 02:37:24.783230 | debian-bookworm | Loading collection community.grafana from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/grafana 2026-06-22 02:37:24.783576 | debian-bookworm | Found installed collection community.grafana:2.3.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/grafana' 2026-06-22 02:37:24.783981 | debian-bookworm | Loading collection infoblox.nios_modules from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/infoblox/nios_modules 2026-06-22 02:37:24.784345 | debian-bookworm | Found installed collection infoblox.nios_modules:1.8.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/infoblox/nios_modules' 2026-06-22 02:37:24.784600 | debian-bookworm | Loading collection community.mongodb from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/mongodb 2026-06-22 02:37:24.784972 | debian-bookworm | Found installed collection community.mongodb:1.7.10 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/mongodb' 2026-06-22 02:37:24.789879 | debian-bookworm | Loading collection fortinet.fortimanager from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/fortinet/fortimanager 2026-06-22 02:37:24.790183 | debian-bookworm | Found installed collection fortinet.fortimanager:2.11.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/fortinet/fortimanager' 2026-06-22 02:37:24.790489 | debian-bookworm | Loading collection hitachivantara.vspone_object from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/hitachivantara/vspone_object 2026-06-22 02:37:24.790817 | debian-bookworm | Found installed collection hitachivantara.vspone_object:1.0.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/hitachivantara/vspone_object' 2026-06-22 02:37:24.791113 | debian-bookworm | Loading collection microsoft.iis from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/microsoft/iis 2026-06-22 02:37:24.791420 | debian-bookworm | Found installed collection microsoft.iis:1.0.3 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/microsoft/iis' 2026-06-22 02:37:24.791763 | debian-bookworm | Loading collection kubevirt.core from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/kubevirt/core 2026-06-22 02:37:24.792074 | debian-bookworm | Found installed collection kubevirt.core:2.2.3 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/kubevirt/core' 2026-06-22 02:37:24.792369 | debian-bookworm | Loading collection inspur.ispim from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/inspur/ispim 2026-06-22 02:37:24.792674 | debian-bookworm | Found installed collection inspur.ispim:2.2.3 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/inspur/ispim' 2026-06-22 02:37:24.793022 | debian-bookworm | Loading collection ravendb.ravendb from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/ravendb/ravendb 2026-06-22 02:37:24.793251 | debian-bookworm | Found installed collection ravendb.ravendb:1.0.4 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/ravendb/ravendb' 2026-06-22 02:37:24.793679 | debian-bookworm | Loading collection kubernetes.core from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/kubernetes/core 2026-06-22 02:37:24.794005 | debian-bookworm | Found installed collection kubernetes.core:6.2.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/kubernetes/core' 2026-06-22 02:37:24.794280 | debian-bookworm | Loading collection ansible.posix from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/ansible/posix 2026-06-22 02:37:24.794558 | debian-bookworm | Found installed collection ansible.posix:2.1.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/ansible/posix' 2026-06-22 02:37:24.795345 | debian-bookworm | Loading collection ovirt.ovirt from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/ovirt/ovirt 2026-06-22 02:37:24.795823 | debian-bookworm | Found installed collection ovirt.ovirt:3.2.1 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/ovirt/ovirt' 2026-06-22 02:37:24.796217 | debian-bookworm | Loading collection netbox.netbox from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/netbox/netbox 2026-06-22 02:37:24.796601 | debian-bookworm | Found installed collection netbox.netbox:3.21.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/netbox/netbox' 2026-06-22 02:37:24.796946 | debian-bookworm | Loading collection community.ciscosmb from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/ciscosmb 2026-06-22 02:37:24.797346 | debian-bookworm | Found installed collection community.ciscosmb:1.0.11 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/ciscosmb' 2026-06-22 02:37:24.797789 | debian-bookworm | Loading collection cisco.iosxr from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/cisco/iosxr 2026-06-22 02:37:24.798176 | debian-bookworm | Found installed collection cisco.iosxr:12.1.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/cisco/iosxr' 2026-06-22 02:37:24.798932 | debian-bookworm | Loading collection junipernetworks.junos from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/junipernetworks/junos 2026-06-22 02:37:24.799274 | debian-bookworm | Found installed collection junipernetworks.junos:11.0.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/junipernetworks/junos' 2026-06-22 02:37:24.799611 | debian-bookworm | Loading collection ansible.netcommon from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/ansible/netcommon 2026-06-22 02:37:24.800029 | debian-bookworm | Found installed collection ansible.netcommon:8.1.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/ansible/netcommon' 2026-06-22 02:37:24.801826 | debian-bookworm | Loading collection awx.awx from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/awx/awx 2026-06-22 02:37:24.802117 | debian-bookworm | Found installed collection awx.awx:24.6.1 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/awx/awx' 2026-06-22 02:37:24.802536 | debian-bookworm | Loading collection vultr.cloud from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/vultr/cloud 2026-06-22 02:37:24.802841 | debian-bookworm | Found installed collection vultr.cloud:1.13.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/vultr/cloud' 2026-06-22 02:37:24.804799 | debian-bookworm | Loading collection azure.azcollection from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/azure/azcollection 2026-06-22 02:37:24.805087 | debian-bookworm | Found installed collection azure.azcollection:3.10.1 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/azure/azcollection' 2026-06-22 02:37:24.805367 | debian-bookworm | Loading collection netapp.cloudmanager from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/netapp/cloudmanager 2026-06-22 02:37:24.805647 | debian-bookworm | Found installed collection netapp.cloudmanager:21.24.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/netapp/cloudmanager' 2026-06-22 02:37:24.805944 | debian-bookworm | Loading collection chocolatey.chocolatey from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/chocolatey/chocolatey 2026-06-22 02:37:24.806216 | debian-bookworm | Found installed collection chocolatey.chocolatey:1.5.3 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/chocolatey/chocolatey' 2026-06-22 02:37:24.806494 | debian-bookworm | Loading collection ieisystem.inmanage from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/ieisystem/inmanage 2026-06-22 02:37:24.806811 | debian-bookworm | Found installed collection ieisystem.inmanage:3.0.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/ieisystem/inmanage' 2026-06-22 02:37:24.808143 | debian-bookworm | Loading collection cisco.nxos from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/cisco/nxos 2026-06-22 02:37:24.808371 | debian-bookworm | Found installed collection cisco.nxos:11.0.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/cisco/nxos' 2026-06-22 02:37:24.810053 | debian-bookworm | Loading collection cisco.meraki from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/cisco/meraki 2026-06-22 02:37:24.810359 | debian-bookworm | Found installed collection cisco.meraki:2.21.8 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/cisco/meraki' 2026-06-22 02:37:24.810860 | debian-bookworm | Loading collection check_point.mgmt from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/check_point/mgmt 2026-06-22 02:37:24.811168 | debian-bookworm | Found installed collection check_point.mgmt:6.6.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/check_point/mgmt' 2026-06-22 02:37:24.811531 | debian-bookworm | Loading collection netapp.storagegrid from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/netapp/storagegrid 2026-06-22 02:37:24.811846 | debian-bookworm | Found installed collection netapp.storagegrid:21.15.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/netapp/storagegrid' 2026-06-22 02:37:24.813540 | debian-bookworm | Loading collection amazon.aws from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/amazon/aws 2026-06-22 02:37:24.814082 | debian-bookworm | Found installed collection amazon.aws:10.1.2 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/amazon/aws' 2026-06-22 02:37:24.814482 | debian-bookworm | Loading collection dellemc.unity from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/dellemc/unity 2026-06-22 02:37:24.814800 | debian-bookworm | Found installed collection dellemc.unity:2.1.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/dellemc/unity' 2026-06-22 02:37:24.815185 | debian-bookworm | Loading collection community.sap_libs from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/sap_libs 2026-06-22 02:37:24.815497 | debian-bookworm | Found installed collection community.sap_libs:1.5.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/sap_libs' 2026-06-22 02:37:24.816426 | debian-bookworm | Loading collection cisco.mso from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/cisco/mso 2026-06-22 02:37:24.816833 | debian-bookworm | Found installed collection cisco.mso:2.11.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/cisco/mso' 2026-06-22 02:37:24.817212 | debian-bookworm | Loading collection community.zabbix from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/zabbix 2026-06-22 02:37:24.817581 | debian-bookworm | Found installed collection community.zabbix:4.1.1 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/zabbix' 2026-06-22 02:37:24.818248 | debian-bookworm | Loading collection google.cloud from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/google/cloud 2026-06-22 02:37:24.818584 | debian-bookworm | Found installed collection google.cloud:1.9.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/google/cloud' 2026-06-22 02:37:24.819261 | debian-bookworm | Loading collection netapp.ontap from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/netapp/ontap 2026-06-22 02:37:24.819595 | debian-bookworm | Found installed collection netapp.ontap:23.2.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/netapp/ontap' 2026-06-22 02:37:24.820005 | debian-bookworm | Loading collection f5networks.f5_modules from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/f5networks/f5_modules 2026-06-22 02:37:24.820356 | debian-bookworm | Found installed collection f5networks.f5_modules:1.39.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/f5networks/f5_modules' 2026-06-22 02:37:24.820696 | debian-bookworm | Loading collection infinidat.infinibox from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/infinidat/infinibox 2026-06-22 02:37:24.821363 | debian-bookworm | Found installed collection infinidat.infinibox:1.6.3 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/infinidat/infinibox' 2026-06-22 02:37:24.821763 | debian-bookworm | Loading collection community.okd from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/okd 2026-06-22 02:37:24.822043 | debian-bookworm | Found installed collection community.okd:5.0.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/okd' 2026-06-22 02:37:24.822411 | debian-bookworm | Loading collection vyos.vyos from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/vyos/vyos 2026-06-22 02:37:24.822712 | debian-bookworm | Found installed collection vyos.vyos:6.0.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/vyos/vyos' 2026-06-22 02:37:24.823499 | debian-bookworm | Loading collection arista.eos from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/arista/eos 2026-06-22 02:37:24.823847 | debian-bookworm | Found installed collection arista.eos:12.0.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/arista/eos' 2026-06-22 02:37:24.824237 | debian-bookworm | Loading collection purestorage.flasharray from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/purestorage/flasharray 2026-06-22 02:37:24.824525 | debian-bookworm | Found installed collection purestorage.flasharray:1.39.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/purestorage/flasharray' 2026-06-22 02:37:24.824828 | debian-bookworm | Loading collection lowlydba.sqlserver from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/lowlydba/sqlserver 2026-06-22 02:37:24.825108 | debian-bookworm | Found installed collection lowlydba.sqlserver:2.7.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/lowlydba/sqlserver' 2026-06-22 02:37:24.825388 | debian-bookworm | Loading collection cyberark.pas from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/cyberark/pas 2026-06-22 02:37:24.825667 | debian-bookworm | Found installed collection cyberark.pas:1.0.36 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/cyberark/pas' 2026-06-22 02:37:24.828587 | debian-bookworm | Loading collection fortinet.fortios from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/fortinet/fortios 2026-06-22 02:37:24.828869 | debian-bookworm | Found installed collection fortinet.fortios:2.4.2 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/fortinet/fortios' 2026-06-22 02:37:24.829578 | debian-bookworm | Loading collection splunk.es from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/splunk/es 2026-06-22 02:37:24.829854 | debian-bookworm | Found installed collection splunk.es:4.0.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/splunk/es' 2026-06-22 02:37:24.830111 | debian-bookworm | Loading collection cyberark.conjur from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/cyberark/conjur 2026-06-22 02:37:24.830451 | debian-bookworm | Found installed collection cyberark.conjur:1.3.8 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/cyberark/conjur' 2026-06-22 02:37:24.830711 | debian-bookworm | Loading collection community.mysql from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/mysql 2026-06-22 02:37:24.831017 | debian-bookworm | Found installed collection community.mysql:3.16.1 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/mysql' 2026-06-22 02:37:24.831278 | debian-bookworm | Loading collection community.rabbitmq from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/rabbitmq 2026-06-22 02:37:24.831536 | debian-bookworm | Found installed collection community.rabbitmq:1.6.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/rabbitmq' 2026-06-22 02:37:24.834695 | debian-bookworm | Loading collection community.aws from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/aws 2026-06-22 02:37:24.834969 | debian-bookworm | Found installed collection community.aws:10.0.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/aws' 2026-06-22 02:37:24.844161 | debian-bookworm | Loading collection community.general from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/general 2026-06-22 02:37:24.844419 | debian-bookworm | Found installed collection community.general:11.4.1 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/general' 2026-06-22 02:37:24.844679 | debian-bookworm | Loading collection purestorage.flashblade from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/purestorage/flashblade 2026-06-22 02:37:24.844969 | debian-bookworm | Found installed collection purestorage.flashblade:1.22.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/purestorage/flashblade' 2026-06-22 02:37:24.845220 | debian-bookworm | Loading collection community.routeros from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/routeros 2026-06-22 02:37:24.845568 | debian-bookworm | Found installed collection community.routeros:3.13.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/routeros' 2026-06-22 02:37:24.845838 | debian-bookworm | Loading collection ibm.storage_virtualize from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/ibm/storage_virtualize 2026-06-22 02:37:24.846098 | debian-bookworm | Found installed collection ibm.storage_virtualize:2.7.4 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/ibm/storage_virtualize' 2026-06-22 02:37:24.846353 | debian-bookworm | Loading collection community.sops from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/sops 2026-06-22 02:37:24.846604 | debian-bookworm | Found installed collection community.sops:2.2.7 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/sops' 2026-06-22 02:37:24.851464 | debian-bookworm | Loading collection ansible._protomatter from /home/zuul/venv/lib/python3.11/site-packages/ansible/_internal/ansible_collections/ansible/_protomatter 2026-06-22 02:37:24.851749 | debian-bookworm | Found installed collection ansible._protomatter:2.19.11 at '/home/zuul/venv/lib/python3.11/site-packages/ansible/_internal/ansible_collections/ansible/_protomatter' 2026-06-22 02:37:24.855980 | debian-bookworm | Loading collection osism.commons from /home/zuul/.ansible/collections/ansible_collections/osism/commons 2026-06-22 02:37:24.857772 | debian-bookworm | Found installed collection osism.commons:0.20260601.0 at '/home/zuul/.ansible/collections/ansible_collections/osism/commons' 2026-06-22 02:37:24.859077 | debian-bookworm | Loading collection osism.services from /home/zuul/.ansible/collections/ansible_collections/osism/services 2026-06-22 02:37:24.859374 | debian-bookworm | Found installed collection osism.services:999.0.0 at '/home/zuul/.ansible/collections/ansible_collections/osism/services' 2026-06-22 02:37:24.860117 | debian-bookworm | Starting galaxy collection install process 2026-06-22 02:37:24.860354 | debian-bookworm | Nothing to do. All requested collections are already installed. If you want to reinstall them, consider using `--force`. 2026-06-22 02:37:25.195770 | ubuntu-noble | ansible-galaxy [core 2.19.11] 2026-06-22 02:37:25.195816 | ubuntu-noble | config file = None 2026-06-22 02:37:25.195825 | ubuntu-noble | configured module search path = ['/home/zuul/src/github.com/osism/ansible-collection-services/plugins/modules', '/home/zuul/.ansible/plugins/modules', '/usr/share/ansible/plugins/modules'] 2026-06-22 02:37:25.195976 | ubuntu-noble | ansible python module location = /home/zuul/venv/lib/python3.12/site-packages/ansible 2026-06-22 02:37:25.196392 | ubuntu-noble | ansible collection location = /home/zuul/.ansible/collections:/usr/share/ansible/collections:/home/zuul/venv/lib/python3.12/site-packages:/home/zuul/venv/lib/python3.12/dist-packages:/home/zuul/venv/lib/python3/dist-packages:/home/zuul/venv/local/lib/python3.12/dist-packages 2026-06-22 02:37:25.196767 | ubuntu-noble | executable location = /home/zuul/venv/bin/ansible-galaxy 2026-06-22 02:37:25.197090 | ubuntu-noble | python version = 3.12.3 (main, Mar 23 2026, 19:04:32) [GCC 13.3.0] (/home/zuul/venv/bin/python3) 2026-06-22 02:37:25.197389 | ubuntu-noble | jinja version = 3.1.6 2026-06-22 02:37:25.198147 | ubuntu-noble | pyyaml version = 6.0.3 (with libyaml v0.2.5) 2026-06-22 02:37:25.198831 | ubuntu-noble | No config file found; using defaults 2026-06-22 02:37:25.199434 | ubuntu-noble | Reading requirement file at '/home/zuul/src/github.com/osism/ansible-collection-services/molecule/delegated/collections.yml' 2026-06-22 02:37:25.207187 | ubuntu-noble | Loading collection kubevirt.core from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/kubevirt/core 2026-06-22 02:37:25.207684 | ubuntu-noble | Found installed collection kubevirt.core:2.2.3 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/kubevirt/core' 2026-06-22 02:37:25.210366 | ubuntu-noble | Loading collection google.cloud from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/google/cloud 2026-06-22 02:37:25.210869 | ubuntu-noble | Found installed collection google.cloud:1.9.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/google/cloud' 2026-06-22 02:37:25.211644 | ubuntu-noble | Loading collection arista.eos from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/arista/eos 2026-06-22 02:37:25.212160 | ubuntu-noble | Found installed collection arista.eos:12.0.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/arista/eos' 2026-06-22 02:37:25.215739 | ubuntu-noble | Loading collection community.aws from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/aws 2026-06-22 02:37:25.216186 | ubuntu-noble | Found installed collection community.aws:10.0.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/aws' 2026-06-22 02:37:25.216570 | ubuntu-noble | Loading collection community.sops from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/sops 2026-06-22 02:37:25.217067 | ubuntu-noble | Found installed collection community.sops:2.2.7 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/sops' 2026-06-22 02:37:25.217442 | ubuntu-noble | Loading collection f5networks.f5_modules from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/f5networks/f5_modules 2026-06-22 02:37:25.217967 | ubuntu-noble | Found installed collection f5networks.f5_modules:1.39.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/f5networks/f5_modules' 2026-06-22 02:37:25.218407 | ubuntu-noble | Loading collection cisco.dnac from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/cisco/dnac 2026-06-22 02:37:25.218820 | ubuntu-noble | Found installed collection cisco.dnac:6.41.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/cisco/dnac' 2026-06-22 02:37:25.219231 | ubuntu-noble | Loading collection community.library_inventory_filtering_v1 from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/library_inventory_filtering_v1 2026-06-22 02:37:25.219580 | ubuntu-noble | Found installed collection community.library_inventory_filtering_v1:1.1.5 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/library_inventory_filtering_v1' 2026-06-22 02:37:25.220062 | ubuntu-noble | Loading collection community.postgresql from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/postgresql 2026-06-22 02:37:25.220615 | ubuntu-noble | Found installed collection community.postgresql:4.1.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/postgresql' 2026-06-22 02:37:25.221131 | ubuntu-noble | Loading collection cisco.aci from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/cisco/aci 2026-06-22 02:37:25.221402 | ubuntu-noble | Found installed collection cisco.aci:2.12.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/cisco/aci' 2026-06-22 02:37:25.221819 | ubuntu-noble | Loading collection community.routeros from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/routeros 2026-06-22 02:37:25.222080 | ubuntu-noble | Found installed collection community.routeros:3.13.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/routeros' 2026-06-22 02:37:25.222434 | ubuntu-noble | Loading collection netbox.netbox from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/netbox/netbox 2026-06-22 02:37:25.223041 | ubuntu-noble | Found installed collection netbox.netbox:3.21.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/netbox/netbox' 2026-06-22 02:37:25.223622 | ubuntu-noble | Loading collection netapp.cloudmanager from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/netapp/cloudmanager 2026-06-22 02:37:25.224146 | ubuntu-noble | Found installed collection netapp.cloudmanager:21.24.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/netapp/cloudmanager' 2026-06-22 02:37:25.224648 | ubuntu-noble | Loading collection telekom_mms.icinga_director from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/telekom_mms/icinga_director 2026-06-22 02:37:25.224958 | ubuntu-noble | Found installed collection telekom_mms.icinga_director:2.4.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/telekom_mms/icinga_director' 2026-06-22 02:37:25.225185 | ubuntu-noble | Loading collection ibm.storage_virtualize from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/ibm/storage_virtualize 2026-06-22 02:37:25.225553 | ubuntu-noble | Found installed collection ibm.storage_virtualize:2.7.4 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/ibm/storage_virtualize' 2026-06-22 02:37:25.225828 | ubuntu-noble | Loading collection ovirt.ovirt from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/ovirt/ovirt 2026-06-22 02:37:25.226117 | ubuntu-noble | Found installed collection ovirt.ovirt:3.2.1 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/ovirt/ovirt' 2026-06-22 02:37:25.226332 | ubuntu-noble | Loading collection grafana.grafana from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/grafana/grafana 2026-06-22 02:37:25.226684 | ubuntu-noble | Found installed collection grafana.grafana:6.0.6 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/grafana/grafana' 2026-06-22 02:37:25.229115 | ubuntu-noble | Loading collection awx.awx from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/awx/awx 2026-06-22 02:37:25.229341 | ubuntu-noble | Found installed collection awx.awx:24.6.1 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/awx/awx' 2026-06-22 02:37:25.229970 | ubuntu-noble | Loading collection check_point.mgmt from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/check_point/mgmt 2026-06-22 02:37:25.230150 | ubuntu-noble | Found installed collection check_point.mgmt:6.6.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/check_point/mgmt' 2026-06-22 02:37:25.232191 | ubuntu-noble | Loading collection azure.azcollection from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/azure/azcollection 2026-06-22 02:37:25.232561 | ubuntu-noble | Found installed collection azure.azcollection:3.10.1 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/azure/azcollection' 2026-06-22 02:37:25.232921 | ubuntu-noble | Loading collection ansible.utils from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/ansible/utils 2026-06-22 02:37:25.233345 | ubuntu-noble | Found installed collection ansible.utils:6.0.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/ansible/utils' 2026-06-22 02:37:25.233797 | ubuntu-noble | Loading collection community.okd from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/okd 2026-06-22 02:37:25.234136 | ubuntu-noble | Found installed collection community.okd:5.0.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/okd' 2026-06-22 02:37:25.234496 | ubuntu-noble | Loading collection community.dns from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/dns 2026-06-22 02:37:25.234827 | ubuntu-noble | Found installed collection community.dns:3.4.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/dns' 2026-06-22 02:37:25.235744 | ubuntu-noble | Loading collection containers.podman from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/containers/podman 2026-06-22 02:37:25.235766 | ubuntu-noble | Found installed collection containers.podman:1.18.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/containers/podman' 2026-06-22 02:37:25.236247 | ubuntu-noble | Loading collection cisco.iosxr from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/cisco/iosxr 2026-06-22 02:37:25.236563 | ubuntu-noble | Found installed collection cisco.iosxr:12.1.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/cisco/iosxr' 2026-06-22 02:37:25.239943 | ubuntu-noble | Loading collection fortinet.fortios from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/fortinet/fortios 2026-06-22 02:37:25.240337 | ubuntu-noble | Found installed collection fortinet.fortios:2.4.2 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/fortinet/fortios' 2026-06-22 02:37:25.242154 | ubuntu-noble | Loading collection cisco.meraki from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/cisco/meraki 2026-06-22 02:37:25.242521 | ubuntu-noble | Found installed collection cisco.meraki:2.21.8 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/cisco/meraki' 2026-06-22 02:37:25.252369 | ubuntu-noble | Loading collection community.general from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/general 2026-06-22 02:37:25.252698 | ubuntu-noble | Found installed collection community.general:11.4.1 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/general' 2026-06-22 02:37:25.253034 | ubuntu-noble | Loading collection ansible.netcommon from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/ansible/netcommon 2026-06-22 02:37:25.253349 | ubuntu-noble | Found installed collection ansible.netcommon:8.1.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/ansible/netcommon' 2026-06-22 02:37:25.254310 | ubuntu-noble | Loading collection vyos.vyos from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/vyos/vyos 2026-06-22 02:37:25.254672 | ubuntu-noble | Found installed collection vyos.vyos:6.0.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/vyos/vyos' 2026-06-22 02:37:25.255017 | ubuntu-noble | Loading collection community.zabbix from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/zabbix 2026-06-22 02:37:25.255334 | ubuntu-noble | Found installed collection community.zabbix:4.1.1 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/zabbix' 2026-06-22 02:37:25.255665 | ubuntu-noble | Loading collection ieisystem.inmanage from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/ieisystem/inmanage 2026-06-22 02:37:25.256741 | ubuntu-noble | Found installed collection ieisystem.inmanage:3.0.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/ieisystem/inmanage' 2026-06-22 02:37:25.256762 | ubuntu-noble | Loading collection community.grafana from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/grafana 2026-06-22 02:37:25.256767 | ubuntu-noble | Found installed collection community.grafana:2.3.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/grafana' 2026-06-22 02:37:25.256952 | ubuntu-noble | Loading collection infinidat.infinibox from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/infinidat/infinibox 2026-06-22 02:37:25.257256 | ubuntu-noble | Found installed collection infinidat.infinibox:1.6.3 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/infinidat/infinibox' 2026-06-22 02:37:25.258484 | ubuntu-noble | Loading collection amazon.aws from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/amazon/aws 2026-06-22 02:37:25.258829 | ubuntu-noble | Found installed collection amazon.aws:10.1.2 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/amazon/aws' 2026-06-22 02:37:25.259112 | ubuntu-noble | Loading collection community.ciscosmb from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/ciscosmb 2026-06-22 02:37:25.259394 | ubuntu-noble | Found installed collection community.ciscosmb:1.0.11 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/ciscosmb' 2026-06-22 02:37:25.259693 | ubuntu-noble | Loading collection kaytus.ksmanage from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/kaytus/ksmanage 2026-06-22 02:37:25.259997 | ubuntu-noble | Found installed collection kaytus.ksmanage:2.0.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/kaytus/ksmanage' 2026-06-22 02:37:25.260681 | ubuntu-noble | Loading collection splunk.es from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/splunk/es 2026-06-22 02:37:25.260983 | ubuntu-noble | Found installed collection splunk.es:4.0.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/splunk/es' 2026-06-22 02:37:25.261265 | ubuntu-noble | Loading collection community.libvirt from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/libvirt 2026-06-22 02:37:25.261560 | ubuntu-noble | Found installed collection community.libvirt:2.0.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/libvirt' 2026-06-22 02:37:25.261891 | ubuntu-noble | Loading collection cisco.intersight from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/cisco/intersight 2026-06-22 02:37:25.262174 | ubuntu-noble | Found installed collection cisco.intersight:2.7.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/cisco/intersight' 2026-06-22 02:37:25.262585 | ubuntu-noble | Loading collection dellemc.powerflex from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/dellemc/powerflex 2026-06-22 02:37:25.262932 | ubuntu-noble | Found installed collection dellemc.powerflex:2.6.1 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/dellemc/powerflex' 2026-06-22 02:37:25.263213 | ubuntu-noble | Loading collection purestorage.flashblade from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/purestorage/flashblade 2026-06-22 02:37:25.263503 | ubuntu-noble | Found installed collection purestorage.flashblade:1.22.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/purestorage/flashblade' 2026-06-22 02:37:25.264534 | ubuntu-noble | Loading collection netapp.ontap from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/netapp/ontap 2026-06-22 02:37:25.264896 | ubuntu-noble | Found installed collection netapp.ontap:23.2.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/netapp/ontap' 2026-06-22 02:37:25.265303 | ubuntu-noble | Loading collection community.hrobot from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/hrobot 2026-06-22 02:37:25.265544 | ubuntu-noble | Found installed collection community.hrobot:2.7.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/hrobot' 2026-06-22 02:37:25.267183 | ubuntu-noble | Loading collection cisco.nxos from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/cisco/nxos 2026-06-22 02:37:25.268742 | ubuntu-noble | Found installed collection cisco.nxos:11.0.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/cisco/nxos' 2026-06-22 02:37:25.268766 | ubuntu-noble | Loading collection community.mysql from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/mysql 2026-06-22 02:37:25.268771 | ubuntu-noble | Found installed collection community.mysql:3.16.1 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/mysql' 2026-06-22 02:37:25.269141 | ubuntu-noble | Loading collection community.digitalocean from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/digitalocean 2026-06-22 02:37:25.269481 | ubuntu-noble | Found installed collection community.digitalocean:1.27.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/digitalocean' 2026-06-22 02:37:25.269840 | ubuntu-noble | Loading collection microsoft.iis from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/microsoft/iis 2026-06-22 02:37:25.270087 | ubuntu-noble | Found installed collection microsoft.iis:1.0.3 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/microsoft/iis' 2026-06-22 02:37:25.270390 | ubuntu-noble | Loading collection ravendb.ravendb from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/ravendb/ravendb 2026-06-22 02:37:25.270792 | ubuntu-noble | Found installed collection ravendb.ravendb:1.0.4 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/ravendb/ravendb' 2026-06-22 02:37:25.271036 | ubuntu-noble | Loading collection inspur.ispim from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/inspur/ispim 2026-06-22 02:37:25.271388 | ubuntu-noble | Found installed collection inspur.ispim:2.2.3 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/inspur/ispim' 2026-06-22 02:37:25.271655 | ubuntu-noble | Loading collection community.proxysql from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/proxysql 2026-06-22 02:37:25.271910 | ubuntu-noble | Found installed collection community.proxysql:1.7.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/proxysql' 2026-06-22 02:37:25.272240 | ubuntu-noble | Loading collection lowlydba.sqlserver from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/lowlydba/sqlserver 2026-06-22 02:37:25.272482 | ubuntu-noble | Found installed collection lowlydba.sqlserver:2.7.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/lowlydba/sqlserver' 2026-06-22 02:37:25.272844 | ubuntu-noble | Loading collection netapp_eseries.santricity from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/netapp_eseries/santricity 2026-06-22 02:37:25.273690 | ubuntu-noble | Found installed collection netapp_eseries.santricity:1.4.1 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/netapp_eseries/santricity' 2026-06-22 02:37:25.274139 | ubuntu-noble | Loading collection ibm.qradar from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/ibm/qradar 2026-06-22 02:37:25.274431 | ubuntu-noble | Found installed collection ibm.qradar:4.0.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/ibm/qradar' 2026-06-22 02:37:25.274812 | ubuntu-noble | Loading collection community.docker from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/docker 2026-06-22 02:37:25.275078 | ubuntu-noble | Found installed collection community.docker:4.8.2 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/docker' 2026-06-22 02:37:25.275968 | ubuntu-noble | Loading collection hetzner.hcloud from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/hetzner/hcloud 2026-06-22 02:37:25.276247 | ubuntu-noble | Found installed collection hetzner.hcloud:5.4.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/hetzner/hcloud' 2026-06-22 02:37:25.276533 | ubuntu-noble | Loading collection microsoft.ad from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/microsoft/ad 2026-06-22 02:37:25.276861 | ubuntu-noble | Found installed collection microsoft.ad:1.9.2 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/microsoft/ad' 2026-06-22 02:37:25.277364 | ubuntu-noble | Loading collection vmware.vmware from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/vmware/vmware 2026-06-22 02:37:25.277698 | ubuntu-noble | Found installed collection vmware.vmware:2.4.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/vmware/vmware' 2026-06-22 02:37:25.277964 | ubuntu-noble | Loading collection infoblox.nios_modules from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/infoblox/nios_modules 2026-06-22 02:37:25.278263 | ubuntu-noble | Found installed collection infoblox.nios_modules:1.8.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/infoblox/nios_modules' 2026-06-22 02:37:25.278743 | ubuntu-noble | Loading collection vultr.cloud from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/vultr/cloud 2026-06-22 02:37:25.278985 | ubuntu-noble | Found installed collection vultr.cloud:1.13.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/vultr/cloud' 2026-06-22 02:37:25.280785 | ubuntu-noble | Loading collection dellemc.enterprise_sonic from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/dellemc/enterprise_sonic 2026-06-22 02:37:25.281165 | ubuntu-noble | Found installed collection dellemc.enterprise_sonic:3.2.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/dellemc/enterprise_sonic' 2026-06-22 02:37:25.281550 | ubuntu-noble | Loading collection ansible.windows from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/ansible/windows 2026-06-22 02:37:25.281889 | ubuntu-noble | Found installed collection ansible.windows:3.2.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/ansible/windows' 2026-06-22 02:37:25.282177 | ubuntu-noble | Loading collection purestorage.flasharray from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/purestorage/flasharray 2026-06-22 02:37:25.282468 | ubuntu-noble | Found installed collection purestorage.flasharray:1.39.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/purestorage/flasharray' 2026-06-22 02:37:25.282845 | ubuntu-noble | Loading collection hitachivantara.vspone_object from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/hitachivantara/vspone_object 2026-06-22 02:37:25.283193 | ubuntu-noble | Found installed collection hitachivantara.vspone_object:1.0.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/hitachivantara/vspone_object' 2026-06-22 02:37:25.283820 | ubuntu-noble | Loading collection ngine_io.cloudstack from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/ngine_io/cloudstack 2026-06-22 02:37:25.284069 | ubuntu-noble | Found installed collection ngine_io.cloudstack:2.5.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/ngine_io/cloudstack' 2026-06-22 02:37:25.284961 | ubuntu-noble | Loading collection cisco.ios from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/cisco/ios 2026-06-22 02:37:25.285248 | ubuntu-noble | Found installed collection cisco.ios:11.1.1 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/cisco/ios' 2026-06-22 02:37:25.286796 | ubuntu-noble | Loading collection ansible.posix from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/ansible/posix 2026-06-22 02:37:25.286840 | ubuntu-noble | Found installed collection ansible.posix:2.1.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/ansible/posix' 2026-06-22 02:37:25.291305 | ubuntu-noble | Loading collection fortinet.fortimanager from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/fortinet/fortimanager 2026-06-22 02:37:25.291328 | ubuntu-noble | Found installed collection fortinet.fortimanager:2.11.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/fortinet/fortimanager' 2026-06-22 02:37:25.291987 | ubuntu-noble | Loading collection community.proxmox from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/proxmox 2026-06-22 02:37:25.292009 | ubuntu-noble | Found installed collection community.proxmox:1.4.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/proxmox' 2026-06-22 02:37:25.293331 | ubuntu-noble | Loading collection kubernetes.core from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/kubernetes/core 2026-06-22 02:37:25.293371 | ubuntu-noble | Found installed collection kubernetes.core:6.2.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/kubernetes/core' 2026-06-22 02:37:25.293379 | ubuntu-noble | Loading collection hitachivantara.vspone_block from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/hitachivantara/vspone_block 2026-06-22 02:37:25.293385 | ubuntu-noble | Found installed collection hitachivantara.vspone_block:4.4.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/hitachivantara/vspone_block' 2026-06-22 02:37:25.294751 | ubuntu-noble | Loading collection cisco.mso from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/cisco/mso 2026-06-22 02:37:25.295021 | ubuntu-noble | Found installed collection cisco.mso:2.11.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/cisco/mso' 2026-06-22 02:37:25.296485 | ubuntu-noble | Loading collection community.vmware from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/vmware 2026-06-22 02:37:25.296829 | ubuntu-noble | Found installed collection community.vmware:5.10.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/vmware' 2026-06-22 02:37:25.297675 | ubuntu-noble | Loading collection openstack.cloud from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/openstack/cloud 2026-06-22 02:37:25.297691 | ubuntu-noble | Found installed collection openstack.cloud:2.5.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/openstack/cloud' 2026-06-22 02:37:25.298324 | ubuntu-noble | Loading collection community.mongodb from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/mongodb 2026-06-22 02:37:25.298343 | ubuntu-noble | Found installed collection community.mongodb:1.7.10 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/mongodb' 2026-06-22 02:37:25.299007 | ubuntu-noble | Loading collection wti.remote from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/wti/remote 2026-06-22 02:37:25.299027 | ubuntu-noble | Found installed collection wti.remote:1.0.10 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/wti/remote' 2026-06-22 02:37:25.299521 | ubuntu-noble | Loading collection community.sap_libs from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/sap_libs 2026-06-22 02:37:25.299534 | ubuntu-noble | Found installed collection community.sap_libs:1.5.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/sap_libs' 2026-06-22 02:37:25.301065 | ubuntu-noble | Loading collection community.hashi_vault from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/hashi_vault 2026-06-22 02:37:25.301128 | ubuntu-noble | Found installed collection community.hashi_vault:7.1.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/hashi_vault' 2026-06-22 02:37:25.303478 | ubuntu-noble | Loading collection vmware.vmware_rest from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/vmware/vmware_rest 2026-06-22 02:37:25.303519 | ubuntu-noble | Found installed collection vmware.vmware_rest:4.9.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/vmware/vmware_rest' 2026-06-22 02:37:25.305755 | ubuntu-noble | Loading collection theforeman.foreman from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/theforeman/foreman 2026-06-22 02:37:25.305796 | ubuntu-noble | Found installed collection theforeman.foreman:5.7.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/theforeman/foreman' 2026-06-22 02:37:25.305808 | ubuntu-noble | Loading collection netapp.storagegrid from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/netapp/storagegrid 2026-06-22 02:37:25.306034 | ubuntu-noble | Found installed collection netapp.storagegrid:21.15.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/netapp/storagegrid' 2026-06-22 02:37:25.306504 | ubuntu-noble | Loading collection cloudscale_ch.cloud from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/cloudscale_ch/cloud 2026-06-22 02:37:25.306970 | ubuntu-noble | Found installed collection cloudscale_ch.cloud:2.5.2 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/cloudscale_ch/cloud' 2026-06-22 02:37:25.307470 | ubuntu-noble | Loading collection dellemc.unity from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/dellemc/unity 2026-06-22 02:37:25.307950 | ubuntu-noble | Found installed collection dellemc.unity:2.1.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/dellemc/unity' 2026-06-22 02:37:25.308370 | ubuntu-noble | Loading collection cyberark.pas from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/cyberark/pas 2026-06-22 02:37:25.308751 | ubuntu-noble | Found installed collection cyberark.pas:1.0.36 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/cyberark/pas' 2026-06-22 02:37:25.309075 | ubuntu-noble | Loading collection chocolatey.chocolatey from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/chocolatey/chocolatey 2026-06-22 02:37:25.309467 | ubuntu-noble | Found installed collection chocolatey.chocolatey:1.5.3 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/chocolatey/chocolatey' 2026-06-22 02:37:25.310125 | ubuntu-noble | Loading collection community.windows from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/windows 2026-06-22 02:37:25.310533 | ubuntu-noble | Found installed collection community.windows:3.0.1 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/windows' 2026-06-22 02:37:25.310975 | ubuntu-noble | Loading collection dellemc.openmanage from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/dellemc/openmanage 2026-06-22 02:37:25.311378 | ubuntu-noble | Found installed collection dellemc.openmanage:9.12.3 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/dellemc/openmanage' 2026-06-22 02:37:25.311806 | ubuntu-noble | Loading collection cisco.ucs from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/cisco/ucs 2026-06-22 02:37:25.312126 | ubuntu-noble | Found installed collection cisco.ucs:1.16.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/cisco/ucs' 2026-06-22 02:37:25.312519 | ubuntu-noble | Loading collection cyberark.conjur from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/cyberark/conjur 2026-06-22 02:37:25.312898 | ubuntu-noble | Found installed collection cyberark.conjur:1.3.8 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/cyberark/conjur' 2026-06-22 02:37:25.313213 | ubuntu-noble | Loading collection community.crypto from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/crypto 2026-06-22 02:37:25.313669 | ubuntu-noble | Found installed collection community.crypto:3.0.5 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/crypto' 2026-06-22 02:37:25.314787 | ubuntu-noble | Loading collection junipernetworks.junos from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/junipernetworks/junos 2026-06-22 02:37:25.314809 | ubuntu-noble | Found installed collection junipernetworks.junos:11.0.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/junipernetworks/junos' 2026-06-22 02:37:25.314817 | ubuntu-noble | Loading collection community.rabbitmq from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/rabbitmq 2026-06-22 02:37:25.314825 | ubuntu-noble | Found installed collection community.rabbitmq:1.6.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/rabbitmq' 2026-06-22 02:37:24.959112 | debian-bookworm | INFO [delegated > dependency] Dependency completed successfully. 2026-06-22 02:37:24.959281 | debian-bookworm | WARNING [delegated > dependency] Executed: Missing roles requirements file: requirements.yml (Remove from converge_sequence to suppress) 2026-06-22 02:37:24.978144 | debian-bookworm | INFO [delegated > create] Executing 2026-06-22 02:37:24.980598 | debian-bookworm | WARNING [delegated > create] Executed: Missing playbook (Remove from converge_sequence to suppress) 2026-06-22 02:37:24.990091 | debian-bookworm | INFO [delegated > prepare] Executing 2026-06-22 02:37:24.990168 | debian-bookworm | WARNING [delegated > prepare] Skipping, instances already prepared. 2026-06-22 02:37:24.990205 | debian-bookworm | INFO [delegated > prepare] Executed: Successful 2026-06-22 02:37:24.998859 | debian-bookworm | INFO [delegated > converge] Executing 2026-06-22 02:37:25.328807 | ubuntu-noble | Loading collection ansible._protomatter from /home/zuul/venv/lib/python3.12/site-packages/ansible/_internal/ansible_collections/ansible/_protomatter 2026-06-22 02:37:25.328848 | ubuntu-noble | Found installed collection ansible._protomatter:2.19.11 at '/home/zuul/venv/lib/python3.12/site-packages/ansible/_internal/ansible_collections/ansible/_protomatter' 2026-06-22 02:37:25.341294 | ubuntu-noble | Loading collection osism.services from /home/zuul/.ansible/collections/ansible_collections/osism/services 2026-06-22 02:37:25.341355 | ubuntu-noble | Found installed collection osism.services:999.0.0 at '/home/zuul/.ansible/collections/ansible_collections/osism/services' 2026-06-22 02:37:25.341366 | ubuntu-noble | Loading collection osism.commons from /home/zuul/.ansible/collections/ansible_collections/osism/commons 2026-06-22 02:37:25.342668 | ubuntu-noble | Found installed collection osism.commons:0.20260601.0 at '/home/zuul/.ansible/collections/ansible_collections/osism/commons' 2026-06-22 02:37:25.344701 | ubuntu-noble | Starting galaxy collection install process 2026-06-22 02:37:25.344779 | ubuntu-noble | Nothing to do. All requested collections are already installed. If you want to reinstall them, consider using `--force`. 2026-06-22 02:37:25.431440 | ubuntu-noble | INFO [delegated > dependency] Dependency completed successfully. 2026-06-22 02:37:25.433749 | ubuntu-noble | WARNING [delegated > dependency] Executed: Missing roles requirements file: requirements.yml (Remove from converge_sequence to suppress) 2026-06-22 02:37:25.448362 | ubuntu-noble | INFO [delegated > create] Executing 2026-06-22 02:37:25.451509 | ubuntu-noble | WARNING [delegated > create] Executed: Missing playbook (Remove from converge_sequence to suppress) 2026-06-22 02:37:25.462042 | ubuntu-noble | INFO [delegated > prepare] Executing 2026-06-22 02:37:25.462193 | ubuntu-noble | WARNING [delegated > prepare] Skipping, instances already prepared. 2026-06-22 02:37:25.462310 | ubuntu-noble | INFO [delegated > prepare] Executed: Successful 2026-06-22 02:37:25.470510 | ubuntu-noble | INFO [delegated > converge] Executing 2026-06-22 02:37:25.478970 | debian-bookworm | DEBUG [delegated > converge] ansible-playbook version: ansible-playbook 2026-06-22 02:37:25.479035 | debian-bookworm | config file = None 2026-06-22 02:37:25.479045 | debian-bookworm | configured module search path = 2026-06-22 02:37:25.479052 | debian-bookworm | ansible python module location = /home/zuul/venv/lib/python3.11/site-packages/ansible 2026-06-22 02:37:25.479057 | debian-bookworm | ansible collection location = /home/zuul/.ansible/collections:/usr/share/ansible/collections 2026-06-22 02:37:25.479061 | debian-bookworm | executable location = /home/zuul/venv/bin/ansible-playbook 2026-06-22 02:37:25.479065 | debian-bookworm | python version = 3.11.2 (main, Apr 8 2026, 01:58:00) (/home/zuul/venv/bin/python3) 2026-06-22 02:37:25.479070 | debian-bookworm | jinja version = 3.1.6 2026-06-22 02:37:25.479074 | debian-bookworm | pyyaml version = 6.0.3 (with libyaml v0.2.5) 2026-06-22 02:37:25.479336 | debian-bookworm | DEBUG ANSIBLE ENVIRONMENT: 2026-06-22 02:37:25.479342 | debian-bookworm | ANSIBLE_COLLECTIONS_PATH: /home/zuul/venv/.ansible/collections:/home/zuul/.ansible/collections 2026-06-22 02:37:25.479346 | debian-bookworm | ANSIBLE_CONFIG: /home/zuul/.ansible/tmp/molecule.oWZD.delegated/ansible.cfg 2026-06-22 02:37:25.479350 | debian-bookworm | ANSIBLE_LIBRARY: ../../plugins 2026-06-22 02:37:25.479354 | debian-bookworm | ANSIBLE_PYTHON_INTERPRETER: /home/zuul/venv/bin/python 2026-06-22 02:37:25.479359 | debian-bookworm | ANSIBLE_ROLE: auditd 2026-06-22 02:37:25.479362 | debian-bookworm | ANSIBLE_ROLES_PATH: ../../roles 2026-06-22 02:37:25.479366 | debian-bookworm | ANSIBLE_VERBOSITY: 1 2026-06-22 02:37:25.479370 | debian-bookworm | 2026-06-22 02:37:25.479648 | debian-bookworm | DEBUG MOLECULE ENVIRONMENT: 2026-06-22 02:37:25.479654 | debian-bookworm | MOLECULE_DEBUG: True 2026-06-22 02:37:25.479658 | debian-bookworm | MOLECULE_DEPENDENCY_NAME: galaxy 2026-06-22 02:37:25.479662 | debian-bookworm | MOLECULE_DRIVER_NAME: default 2026-06-22 02:37:25.479666 | debian-bookworm | MOLECULE_ENV_FILE: /home/zuul/src/github.com/osism/ansible-collection-services/.env.yml 2026-06-22 02:37:25.479670 | debian-bookworm | MOLECULE_EPHEMERAL_DIRECTORY: /home/zuul/.ansible/tmp/molecule.oWZD.delegated 2026-06-22 02:37:25.479692 | debian-bookworm | MOLECULE_FILE: /home/zuul/.ansible/tmp/molecule.oWZD.delegated/molecule.yml 2026-06-22 02:37:25.479698 | debian-bookworm | MOLECULE_INSTANCE_CONFIG: /home/zuul/.ansible/tmp/molecule.oWZD.delegated/instance_config.yml 2026-06-22 02:37:25.479702 | debian-bookworm | MOLECULE_INVENTORY_FILE: /home/zuul/.ansible/tmp/molecule.oWZD.delegated/inventory/ansible_inventory.yml 2026-06-22 02:37:25.479707 | debian-bookworm | MOLECULE_PROJECT_DIRECTORY: /home/zuul/src/github.com/osism/ansible-collection-services 2026-06-22 02:37:25.479710 | debian-bookworm | MOLECULE_PROVISIONER_NAME: ansible 2026-06-22 02:37:25.479714 | debian-bookworm | MOLECULE_SCENARIO_DIRECTORY: /home/zuul/src/github.com/osism/ansible-collection-services/molecule/delegated 2026-06-22 02:37:25.479718 | debian-bookworm | MOLECULE_SCENARIO_NAME: delegated 2026-06-22 02:37:25.479734 | debian-bookworm | MOLECULE_STATE_FILE: /home/zuul/.ansible/tmp/molecule.oWZD.delegated/state.yml 2026-06-22 02:37:25.479738 | debian-bookworm | MOLECULE_VERIFIER_NAME: testinfra 2026-06-22 02:37:25.479742 | debian-bookworm | MOLECULE_VERIFIER_TEST_DIRECTORY: /home/zuul/src/github.com/osism/ansible-collection-services/molecule/delegated/tests 2026-06-22 02:37:25.479750 | debian-bookworm | 2026-06-22 02:37:25.480029 | debian-bookworm | DEBUG SHELL REPLAY: ANSIBLE_COLLECTIONS_PATH=/home/zuul/venv/.ansible/collections:/home/zuul/.ansible/collections ANSIBLE_CONFIG=/home/zuul/.ansible/tmp/molecule.oWZD.delegated/ansible.cfg ANSIBLE_LIBRARY=../../plugins ANSIBLE_PYTHON_INTERPRETER=/home/zuul/venv/bin/python ANSIBLE_ROLE=auditd ANSIBLE_ROLES_PATH=../../roles ANSIBLE_VERBOSITY=1 MOLECULE_DEBUG=True MOLECULE_DEPENDENCY_NAME=galaxy MOLECULE_DRIVER_NAME=default MOLECULE_ENV_FILE=/home/zuul/src/github.com/osism/ansible-collection-services/.env.yml MOLECULE_EPHEMERAL_DIRECTORY=/home/zuul/.ansible/tmp/molecule.oWZD.delegated MOLECULE_FILE=/home/zuul/.ansible/tmp/molecule.oWZD.delegated/molecule.yml MOLECULE_INSTANCE_CONFIG=/home/zuul/.ansible/tmp/molecule.oWZD.delegated/instance_config.yml MOLECULE_INVENTORY_FILE=/home/zuul/.ansible/tmp/molecule.oWZD.delegated/inventory/ansible_inventory.yml MOLECULE_PROJECT_DIRECTORY=/home/zuul/src/github.com/osism/ansible-collection-services MOLECULE_PROVISIONER_NAME=ansible MOLECULE_SCENARIO_DIRECTORY=/home/zuul/src/github.com/osism/ansible-collection-services/molecule/delegated MOLECULE_SCENARIO_NAME=delegated MOLECULE_STATE_FILE=/home/zuul/.ansible/tmp/molecule.oWZD.delegated/state.yml MOLECULE_VERIFIER_NAME=testinfra MOLECULE_VERIFIER_TEST_DIRECTORY=/home/zuul/src/github.com/osism/ansible-collection-services/molecule/delegated/tests 2026-06-22 02:37:25.868242 | debian-bookworm | Using /home/zuul/.ansible/tmp/molecule.oWZD.delegated/ansible.cfg as config file 2026-06-22 02:37:25.976949 | ubuntu-noble | DEBUG [delegated > converge] ansible-playbook version: ansible-playbook 2026-06-22 02:37:25.977001 | ubuntu-noble | config file = None 2026-06-22 02:37:25.977007 | ubuntu-noble | configured module search path = 2026-06-22 02:37:25.977011 | ubuntu-noble | ansible python module location = /home/zuul/venv/lib/python3.12/site-packages/ansible 2026-06-22 02:37:25.977016 | ubuntu-noble | ansible collection location = /home/zuul/.ansible/collections:/usr/share/ansible/collections 2026-06-22 02:37:25.977020 | ubuntu-noble | executable location = /home/zuul/venv/bin/ansible-playbook 2026-06-22 02:37:25.977024 | ubuntu-noble | python version = 3.12.3 (main, Mar 23 2026, 19:04:32) (/home/zuul/venv/bin/python3) 2026-06-22 02:37:25.977027 | ubuntu-noble | jinja version = 3.1.6 2026-06-22 02:37:25.977031 | ubuntu-noble | pyyaml version = 6.0.3 (with libyaml v0.2.5) 2026-06-22 02:37:25.977245 | ubuntu-noble | DEBUG ANSIBLE ENVIRONMENT: 2026-06-22 02:37:25.977253 | ubuntu-noble | ANSIBLE_COLLECTIONS_PATH: /home/zuul/venv/.ansible/collections:/home/zuul/.ansible/collections 2026-06-22 02:37:25.977257 | ubuntu-noble | ANSIBLE_CONFIG: /home/zuul/.ansible/tmp/molecule.oWZD.delegated/ansible.cfg 2026-06-22 02:37:25.977261 | ubuntu-noble | ANSIBLE_LIBRARY: ../../plugins 2026-06-22 02:37:25.977264 | ubuntu-noble | ANSIBLE_PYTHON_INTERPRETER: /home/zuul/venv/bin/python 2026-06-22 02:37:25.977268 | ubuntu-noble | ANSIBLE_ROLE: auditd 2026-06-22 02:37:25.977272 | ubuntu-noble | ANSIBLE_ROLES_PATH: ../../roles 2026-06-22 02:37:25.977275 | ubuntu-noble | ANSIBLE_VERBOSITY: 1 2026-06-22 02:37:25.977279 | ubuntu-noble | 2026-06-22 02:37:25.977390 | ubuntu-noble | DEBUG MOLECULE ENVIRONMENT: 2026-06-22 02:37:25.977397 | ubuntu-noble | MOLECULE_DEBUG: True 2026-06-22 02:37:25.977401 | ubuntu-noble | MOLECULE_DEPENDENCY_NAME: galaxy 2026-06-22 02:37:25.977404 | ubuntu-noble | MOLECULE_DRIVER_NAME: default 2026-06-22 02:37:25.977408 | ubuntu-noble | MOLECULE_ENV_FILE: /home/zuul/src/github.com/osism/ansible-collection-services/.env.yml 2026-06-22 02:37:25.977412 | ubuntu-noble | MOLECULE_EPHEMERAL_DIRECTORY: /home/zuul/.ansible/tmp/molecule.oWZD.delegated 2026-06-22 02:37:25.977416 | ubuntu-noble | MOLECULE_FILE: /home/zuul/.ansible/tmp/molecule.oWZD.delegated/molecule.yml 2026-06-22 02:37:25.977420 | ubuntu-noble | MOLECULE_INSTANCE_CONFIG: /home/zuul/.ansible/tmp/molecule.oWZD.delegated/instance_config.yml 2026-06-22 02:37:25.977424 | ubuntu-noble | MOLECULE_INVENTORY_FILE: /home/zuul/.ansible/tmp/molecule.oWZD.delegated/inventory/ansible_inventory.yml 2026-06-22 02:37:25.977429 | ubuntu-noble | MOLECULE_PROJECT_DIRECTORY: /home/zuul/src/github.com/osism/ansible-collection-services 2026-06-22 02:37:25.977433 | ubuntu-noble | MOLECULE_PROVISIONER_NAME: ansible 2026-06-22 02:37:25.977436 | ubuntu-noble | MOLECULE_SCENARIO_DIRECTORY: /home/zuul/src/github.com/osism/ansible-collection-services/molecule/delegated 2026-06-22 02:37:25.977440 | ubuntu-noble | MOLECULE_SCENARIO_NAME: delegated 2026-06-22 02:37:25.977443 | ubuntu-noble | MOLECULE_STATE_FILE: /home/zuul/.ansible/tmp/molecule.oWZD.delegated/state.yml 2026-06-22 02:37:25.977447 | ubuntu-noble | MOLECULE_VERIFIER_NAME: testinfra 2026-06-22 02:37:25.977450 | ubuntu-noble | MOLECULE_VERIFIER_TEST_DIRECTORY: /home/zuul/src/github.com/osism/ansible-collection-services/molecule/delegated/tests 2026-06-22 02:37:25.977454 | ubuntu-noble | 2026-06-22 02:37:25.977581 | ubuntu-noble | DEBUG SHELL REPLAY: ANSIBLE_COLLECTIONS_PATH=/home/zuul/venv/.ansible/collections:/home/zuul/.ansible/collections ANSIBLE_CONFIG=/home/zuul/.ansible/tmp/molecule.oWZD.delegated/ansible.cfg ANSIBLE_LIBRARY=../../plugins ANSIBLE_PYTHON_INTERPRETER=/home/zuul/venv/bin/python ANSIBLE_ROLE=auditd ANSIBLE_ROLES_PATH=../../roles ANSIBLE_VERBOSITY=1 MOLECULE_DEBUG=True MOLECULE_DEPENDENCY_NAME=galaxy MOLECULE_DRIVER_NAME=default MOLECULE_ENV_FILE=/home/zuul/src/github.com/osism/ansible-collection-services/.env.yml MOLECULE_EPHEMERAL_DIRECTORY=/home/zuul/.ansible/tmp/molecule.oWZD.delegated MOLECULE_FILE=/home/zuul/.ansible/tmp/molecule.oWZD.delegated/molecule.yml MOLECULE_INSTANCE_CONFIG=/home/zuul/.ansible/tmp/molecule.oWZD.delegated/instance_config.yml MOLECULE_INVENTORY_FILE=/home/zuul/.ansible/tmp/molecule.oWZD.delegated/inventory/ansible_inventory.yml MOLECULE_PROJECT_DIRECTORY=/home/zuul/src/github.com/osism/ansible-collection-services MOLECULE_PROVISIONER_NAME=ansible MOLECULE_SCENARIO_DIRECTORY=/home/zuul/src/github.com/osism/ansible-collection-services/molecule/delegated MOLECULE_SCENARIO_NAME=delegated MOLECULE_STATE_FILE=/home/zuul/.ansible/tmp/molecule.oWZD.delegated/state.yml MOLECULE_VERIFIER_NAME=testinfra MOLECULE_VERIFIER_TEST_DIRECTORY=/home/zuul/src/github.com/osism/ansible-collection-services/molecule/delegated/tests 2026-06-22 02:37:26.096082 | debian-bookworm | 2026-06-22 02:37:26.096452 | debian-bookworm | PLAY [Converge] **************************************************************** 2026-06-22 02:37:26.096795 | debian-bookworm | 2026-06-22 02:37:26.097118 | debian-bookworm | TASK [Gathering Facts] ********************************************************* 2026-06-22 02:37:26.423758 | ubuntu-noble | Using /home/zuul/.ansible/tmp/molecule.oWZD.delegated/ansible.cfg as config file 2026-06-22 02:37:26.707443 | ubuntu-noble | 2026-06-22 02:37:26.709882 | ubuntu-noble | PLAY [Converge] **************************************************************** 2026-06-22 02:37:26.710050 | ubuntu-noble | 2026-06-22 02:37:26.710188 | ubuntu-noble | TASK [Gathering Facts] ********************************************************* 2026-06-22 02:37:27.367999 | debian-bookworm | ok: [molecule-auditd] 2026-06-22 02:37:27.368125 | debian-bookworm | 2026-06-22 02:37:27.368280 | debian-bookworm | TASK [Include required variables] ********************************************** 2026-06-22 02:37:27.400016 | debian-bookworm | ok: [molecule-auditd] => {"ansible_facts": {}, "ansible_included_var_files": ["/home/zuul/src/github.com/osism/ansible-collection-services/molecule/delegated/vars/auditd.yml"], "changed": false} 2026-06-22 02:37:27.400081 | debian-bookworm | 2026-06-22 02:37:27.400189 | debian-bookworm | TASK [Include role auditd] ***************************************************** 2026-06-22 02:37:27.456851 | debian-bookworm | included: auditd for molecule-auditd 2026-06-22 02:37:27.456945 | debian-bookworm | 2026-06-22 02:37:27.457067 | debian-bookworm | TASK [auditd : Include distribution specific install tasks] ******************** 2026-06-22 02:37:27.486462 | debian-bookworm | included: /home/zuul/src/github.com/osism/ansible-collection-services/roles/auditd/tasks/install-Debian-family.yml for molecule-auditd 2026-06-22 02:37:27.486533 | debian-bookworm | 2026-06-22 02:37:27.486640 | debian-bookworm | TASK [auditd : Install auditd package] ***************************************** 2026-06-22 02:37:28.121332 | ubuntu-noble | ok: [molecule-auditd] 2026-06-22 02:37:28.123443 | ubuntu-noble | 2026-06-22 02:37:28.123472 | ubuntu-noble | TASK [Include required variables] ********************************************** 2026-06-22 02:37:28.149487 | ubuntu-noble | ok: [molecule-auditd] => {"ansible_facts": {}, "ansible_included_var_files": ["/home/zuul/src/github.com/osism/ansible-collection-services/molecule/delegated/vars/auditd.yml"], "changed": false} 2026-06-22 02:37:28.149819 | ubuntu-noble | 2026-06-22 02:37:28.150122 | ubuntu-noble | TASK [Include role auditd] ***************************************************** 2026-06-22 02:37:28.213784 | ubuntu-noble | included: auditd for molecule-auditd 2026-06-22 02:37:28.213894 | ubuntu-noble | 2026-06-22 02:37:28.213916 | ubuntu-noble | TASK [auditd : Include distribution specific install tasks] ******************** 2026-06-22 02:37:28.262125 | ubuntu-noble | included: /home/zuul/src/github.com/osism/ansible-collection-services/roles/auditd/tasks/install-Debian-family.yml for molecule-auditd 2026-06-22 02:37:28.262185 | ubuntu-noble | 2026-06-22 02:37:28.262201 | ubuntu-noble | TASK [auditd : Install auditd package] ***************************************** 2026-06-22 02:37:32.065160 | debian-bookworm | The following additional packages will be installed: 2026-06-22 02:37:32.065516 | debian-bookworm | libauparse0 2026-06-22 02:37:32.065884 | debian-bookworm | Suggested packages: 2026-06-22 02:37:32.066167 | debian-bookworm | audispd-plugins 2026-06-22 02:37:32.066431 | debian-bookworm | The following NEW packages will be installed: 2026-06-22 02:37:32.066679 | debian-bookworm | auditd libauparse0 2026-06-22 02:37:32.066945 | debian-bookworm | 0 upgraded, 2 newly installed, 0 to remove and 0 not upgraded. 2026-06-22 02:37:32.069122 | debian-bookworm | changed: [molecule-auditd] => {"cache_update_time": 1782095745, "cache_updated": false, "changed": true, "stderr": "debconf: delaying package configuration, since apt-utils is not installed\n", "stderr_lines": ["debconf: delaying package configuration, since apt-utils is not installed"], "stdout": "Reading package lists...\nBuilding dependency tree...\nReading state information...\nThe following additional packages will be installed:\n libauparse0\nSuggested packages:\n audispd-plugins\nThe following NEW packages will be installed:\n auditd libauparse0\n0 upgraded, 2 newly installed, 0 to remove and 0 not upgraded.\nNeed to get 279 kB of archives.\nAfter this operation, 934 kB of additional disk space will be used.\nGet:1 http://deb.debian.org/debian bookworm/main amd64 libauparse0 amd64 1:3.0.9-1 [61.9 kB]\nGet:2 http://deb.debian.org/debian bookworm/main amd64 auditd amd64 1:3.0.9-1 [218 kB]\nFetched 279 kB in 0s (3927 kB/s)\nSelecting previously unselected package libauparse0:amd64.\r\n(Reading database ... \r(Reading database ... 5%\r(Reading database ... 10%\r(Reading database ... 15%\r(Reading database ... 20%\r(Reading database ... 25%\r(Reading database ... 30%\r(Reading database ... 35%\r(Reading database ... 40%\r(Reading database ... 45%\r(Reading database ... 50%\r(Reading database ... 55%\r(Reading database ... 60%\r(Reading database ... 65%\r(Reading database ... 70%\r(Reading database ... 75%\r(Reading database ... 80%\r(Reading database ... 85%\r(Reading database ... 90%\r(Reading database ... 95%\r(Reading database ... 100%\r(Reading database ... 28691 files and directories currently installed.)\r\nPreparing to unpack .../libauparse0_1%3a3.0.9-1_amd64.deb ...\r\nUnpacking libauparse0:amd64 (1:3.0.9-1) ...\r\nSelecting previously unselected package auditd.\r\nPreparing to unpack .../auditd_1%3a3.0.9-1_amd64.deb ...\r\nUnpacking auditd (1:3.0.9-1) ...\r\nSetting up libauparse0:amd64 (1:3.0.9-1) ...\r\nSetting up auditd (1:3.0.9-1) ...\r\nCreated symlink /etc/systemd/system/multi-user.target.wants/auditd.service → /lib/systemd/system/auditd.service.\r\r\nProcessing triggers for libc-bin (2.36-9+deb12u14) ...\r\n", "stdout_lines": ["Reading package lists...", "Building dependency tree...", "Reading state information...", "The following additional packages will be installed:", " libauparse0", "Suggested packages:", " audispd-plugins", "The following NEW packages will be installed:", " auditd libauparse0", "0 upgraded, 2 newly installed, 0 to remove and 0 not upgraded.", "Need to get 279 kB of archives.", "After this operation, 934 kB of additional disk space will be used.", "Get:1 http://deb.debian.org/debian bookworm/main amd64 libauparse0 amd64 1:3.0.9-1 [61.9 kB]", "Get:2 http://deb.debian.org/debian bookworm/main amd64 auditd amd64 1:3.0.9-1 [218 kB]", "Fetched 279 kB in 0s (3927 kB/s)", "Selecting previously unselected package libauparse0:amd64.", "(Reading database ... ", "(Reading database ... 5%", "(Reading database ... 10%", "(Reading database ... 15%", "(Reading database ... 20%", "(Reading database ... 25%", "(Reading database ... 30%", "(Reading database ... 35%", "(Reading database ... 40%", "(Reading database ... 45%", "(Reading database ... 50%", "(Reading database ... 55%", "(Reading database ... 60%", "(Reading database ... 65%", "(Reading database ... 70%", "(Reading database ... 75%", "(Reading database ... 80%", "(Reading database ... 85%", "(Reading database ... 90%", "(Reading database ... 95%", "(Reading database ... 100%", "(Reading database ... 28691 files and directories currently installed.)", "Preparing to unpack .../libauparse0_1%3a3.0.9-1_amd64.deb ...", "Unpacking libauparse0:amd64 (1:3.0.9-1) ...", "Selecting previously unselected package auditd.", "Preparing to unpack .../auditd_1%3a3.0.9-1_amd64.deb ...", "Unpacking auditd (1:3.0.9-1) ...", "Setting up libauparse0:amd64 (1:3.0.9-1) ...", "Setting up auditd (1:3.0.9-1) ...", "Created symlink /etc/systemd/system/multi-user.target.wants/auditd.service → /lib/systemd/system/auditd.service.", "", "Processing triggers for libc-bin (2.36-9+deb12u14) ..."]} 2026-06-22 02:37:32.069360 | debian-bookworm | 2026-06-22 02:37:32.069616 | debian-bookworm | TASK [auditd : Install audispd-plugins package] ******************************** 2026-06-22 02:37:33.388768 | ubuntu-noble | The following additional packages will be installed: 2026-06-22 02:37:33.388817 | ubuntu-noble | libauparse0t64 2026-06-22 02:37:33.388914 | ubuntu-noble | Suggested packages: 2026-06-22 02:37:33.389046 | ubuntu-noble | audispd-plugins 2026-06-22 02:37:33.389175 | ubuntu-noble | The following NEW packages will be installed: 2026-06-22 02:37:33.389296 | ubuntu-noble | auditd libauparse0t64 2026-06-22 02:37:33.389414 | ubuntu-noble | 0 upgraded, 2 newly installed, 0 to remove and 0 not upgraded. 2026-06-22 02:37:33.391281 | ubuntu-noble | changed: [molecule-auditd] => {"cache_update_time": 1782095748, "cache_updated": false, "changed": true, "stderr": "debconf: delaying package configuration, since apt-utils is not installed\n", "stderr_lines": ["debconf: delaying package configuration, since apt-utils is not installed"], "stdout": "Reading package lists...\nBuilding dependency tree...\nReading state information...\nThe following additional packages will be installed:\n libauparse0t64\nSuggested packages:\n audispd-plugins\nThe following NEW packages will be installed:\n auditd libauparse0t64\n0 upgraded, 2 newly installed, 0 to remove and 0 not upgraded.\nNeed to get 274 kB of archives.\nAfter this operation, 893 kB of additional disk space will be used.\nGet:1 http://archive.ubuntu.com/ubuntu noble-updates/main amd64 libauparse0t64 amd64 1:3.1.2-2.1build1.1 [58.9 kB]\nGet:2 http://archive.ubuntu.com/ubuntu noble-updates/main amd64 auditd amd64 1:3.1.2-2.1build1.1 [215 kB]\nFetched 274 kB in 0s (3058 kB/s)\nSelecting previously unselected package libauparse0t64:amd64.\r\n(Reading database ... \r(Reading database ... 5%\r(Reading database ... 10%\r(Reading database ... 15%\r(Reading database ... 20%\r(Reading database ... 25%\r(Reading database ... 30%\r(Reading database ... 35%\r(Reading database ... 40%\r(Reading database ... 45%\r(Reading database ... 50%\r(Reading database ... 55%\r(Reading database ... 60%\r(Reading database ... 65%\r(Reading database ... 70%\r(Reading database ... 75%\r(Reading database ... 80%\r(Reading database ... 85%\r(Reading database ... 90%\r(Reading database ... 95%\r(Reading database ... 100%\r(Reading database ... 36085 files and directories currently installed.)\r\nPreparing to unpack .../libauparse0t64_1%3a3.1.2-2.1build1.1_amd64.deb ...\r\nAdding 'diversion of /lib/x86_64-linux-gnu/libauparse.so.0 to /lib/x86_64-linux-gnu/libauparse.so.0.usr-is-merged by libauparse0t64'\r\nAdding 'diversion of /lib/x86_64-linux-gnu/libauparse.so.0.0.0 to /lib/x86_64-linux-gnu/libauparse.so.0.0.0.usr-is-merged by libauparse0t64'\r\nUnpacking libauparse0t64:amd64 (1:3.1.2-2.1build1.1) ...\r\nSelecting previously unselected package auditd.\r\nPreparing to unpack .../auditd_1%3a3.1.2-2.1build1.1_amd64.deb ...\r\nUnpacking auditd (1:3.1.2-2.1build1.1) ...\r\nSetting up libauparse0t64:amd64 (1:3.1.2-2.1build1.1) ...\r\nSetting up auditd (1:3.1.2-2.1build1.1) ...\r\nCreated symlink /etc/systemd/system/multi-user.target.wants/auditd.service → /usr/lib/systemd/system/auditd.service.\r\r\nProcessing triggers for libc-bin (2.39-0ubuntu8.7) ...\r\n", "stdout_lines": ["Reading package lists...", "Building dependency tree...", "Reading state information...", "The following additional packages will be installed:", " libauparse0t64", "Suggested packages:", " audispd-plugins", "The following NEW packages will be installed:", " auditd libauparse0t64", "0 upgraded, 2 newly installed, 0 to remove and 0 not upgraded.", "Need to get 274 kB of archives.", "After this operation, 893 kB of additional disk space will be used.", "Get:1 http://archive.ubuntu.com/ubuntu noble-updates/main amd64 libauparse0t64 amd64 1:3.1.2-2.1build1.1 [58.9 kB]", "Get:2 http://archive.ubuntu.com/ubuntu noble-updates/main amd64 auditd amd64 1:3.1.2-2.1build1.1 [215 kB]", "Fetched 274 kB in 0s (3058 kB/s)", "Selecting previously unselected package libauparse0t64:amd64.", "(Reading database ... ", "(Reading database ... 5%", "(Reading database ... 10%", "(Reading database ... 15%", "(Reading database ... 20%", "(Reading database ... 25%", "(Reading database ... 30%", "(Reading database ... 35%", "(Reading database ... 40%", "(Reading database ... 45%", "(Reading database ... 50%", "(Reading database ... 55%", "(Reading database ... 60%", "(Reading database ... 65%", "(Reading database ... 70%", "(Reading database ... 75%", "(Reading database ... 80%", "(Reading database ... 85%", "(Reading database ... 90%", "(Reading database ... 95%", "(Reading database ... 100%", "(Reading database ... 36085 files and directories currently installed.)", "Preparing to unpack .../libauparse0t64_1%3a3.1.2-2.1build1.1_amd64.deb ...", "Adding 'diversion of /lib/x86_64-linux-gnu/libauparse.so.0 to /lib/x86_64-linux-gnu/libauparse.so.0.usr-is-merged by libauparse0t64'", "Adding 'diversion of /lib/x86_64-linux-gnu/libauparse.so.0.0.0 to /lib/x86_64-linux-gnu/libauparse.so.0.0.0.usr-is-merged by libauparse0t64'", "Unpacking libauparse0t64:amd64 (1:3.1.2-2.1build1.1) ...", "Selecting previously unselected package auditd.", "Preparing to unpack .../auditd_1%3a3.1.2-2.1build1.1_amd64.deb ...", "Unpacking auditd (1:3.1.2-2.1build1.1) ...", "Setting up libauparse0t64:amd64 (1:3.1.2-2.1build1.1) ...", "Setting up auditd (1:3.1.2-2.1build1.1) ...", "Created symlink /etc/systemd/system/multi-user.target.wants/auditd.service → /usr/lib/systemd/system/auditd.service.", "", "Processing triggers for libc-bin (2.39-0ubuntu8.7) ..."]} 2026-06-22 02:37:33.391624 | ubuntu-noble | 2026-06-22 02:37:33.391637 | ubuntu-noble | TASK [auditd : Install audispd-plugins package] ******************************** 2026-06-22 02:37:35.120860 | debian-bookworm | The following NEW packages will be installed: 2026-06-22 02:37:35.120978 | debian-bookworm | audispd-plugins 2026-06-22 02:37:35.120992 | debian-bookworm | 0 upgraded, 1 newly installed, 0 to remove and 0 not upgraded. 2026-06-22 02:37:35.121016 | debian-bookworm | changed: [molecule-auditd] => {"cache_update_time": 1782095745, "cache_updated": false, "changed": true, "stderr": "debconf: delaying package configuration, since apt-utils is not installed\n", "stderr_lines": ["debconf: delaying package configuration, since apt-utils is not installed"], "stdout": "Reading package lists...\nBuilding dependency tree...\nReading state information...\nThe following NEW packages will be installed:\n audispd-plugins\n0 upgraded, 1 newly installed, 0 to remove and 0 not upgraded.\nNeed to get 45.6 kB of archives.\nAfter this operation, 132 kB of additional disk space will be used.\nGet:1 http://deb.debian.org/debian bookworm/main amd64 audispd-plugins amd64 1:3.0.9-1 [45.6 kB]\nFetched 45.6 kB in 0s (1060 kB/s)\nSelecting previously unselected package audispd-plugins.\r\n(Reading database ... \r(Reading database ... 5%\r(Reading database ... 10%\r(Reading database ... 15%\r(Reading database ... 20%\r(Reading database ... 25%\r(Reading database ... 30%\r(Reading database ... 35%\r(Reading database ... 40%\r(Reading database ... 45%\r(Reading database ... 50%\r(Reading database ... 55%\r(Reading database ... 60%\r(Reading database ... 65%\r(Reading database ... 70%\r(Reading database ... 75%\r(Reading database ... 80%\r(Reading database ... 85%\r(Reading database ... 90%\r(Reading database ... 95%\r(Reading database ... 100%\r(Reading database ... 28782 files and directories currently installed.)\r\nPreparing to unpack .../audispd-plugins_1%3a3.0.9-1_amd64.deb ...\r\nUnpacking audispd-plugins (1:3.0.9-1) ...\r\nSetting up audispd-plugins (1:3.0.9-1) ...\r\n", "stdout_lines": ["Reading package lists...", "Building dependency tree...", "Reading state information...", "The following NEW packages will be installed:", " audispd-plugins", "0 upgraded, 1 newly installed, 0 to remove and 0 not upgraded.", "Need to get 45.6 kB of archives.", "After this operation, 132 kB of additional disk space will be used.", "Get:1 http://deb.debian.org/debian bookworm/main amd64 audispd-plugins amd64 1:3.0.9-1 [45.6 kB]", "Fetched 45.6 kB in 0s (1060 kB/s)", "Selecting previously unselected package audispd-plugins.", "(Reading database ... ", "(Reading database ... 5%", "(Reading database ... 10%", "(Reading database ... 15%", "(Reading database ... 20%", "(Reading database ... 25%", "(Reading database ... 30%", "(Reading database ... 35%", "(Reading database ... 40%", "(Reading database ... 45%", "(Reading database ... 50%", "(Reading database ... 55%", "(Reading database ... 60%", "(Reading database ... 65%", "(Reading database ... 70%", "(Reading database ... 75%", "(Reading database ... 80%", "(Reading database ... 85%", "(Reading database ... 90%", "(Reading database ... 95%", "(Reading database ... 100%", "(Reading database ... 28782 files and directories currently installed.)", "Preparing to unpack .../audispd-plugins_1%3a3.0.9-1_amd64.deb ...", "Unpacking audispd-plugins (1:3.0.9-1) ...", "Setting up audispd-plugins (1:3.0.9-1) ..."]} 2026-06-22 02:37:35.121048 | debian-bookworm | 2026-06-22 02:37:35.121147 | debian-bookworm | TASK [auditd : Copy auditd.conf configuration files] *************************** 2026-06-22 02:37:36.768940 | debian-bookworm | --- before 2026-06-22 02:37:36.769000 | debian-bookworm | +++ after: /home/zuul/.ansible/tmp/ansible-local-2260ct412hyc/tmppunlyfnw/auditd.conf.j2 2026-06-22 02:37:36.769010 | debian-bookworm | @@ -0,0 +1,37 @@ 2026-06-22 02:37:36.769024 | debian-bookworm | +# 2026-06-22 02:37:36.769033 | debian-bookworm | +# This file controls the configuration of the audit daemon 2026-06-22 02:37:36.769121 | debian-bookworm | +# 2026-06-22 02:37:36.769211 | debian-bookworm | + 2026-06-22 02:37:36.769309 | debian-bookworm | +local_events = yes 2026-06-22 02:37:36.769406 | debian-bookworm | +write_logs = yes 2026-06-22 02:37:36.769493 | debian-bookworm | +log_file = /var/log/audit/audit.log 2026-06-22 02:37:36.769586 | debian-bookworm | +log_group = adm 2026-06-22 02:37:36.769681 | debian-bookworm | +log_format = RAW 2026-06-22 02:37:36.769797 | debian-bookworm | +flush = INCREMENTAL_ASYNC 2026-06-22 02:37:36.769882 | debian-bookworm | +freq = 50 2026-06-22 02:37:36.769979 | debian-bookworm | +max_log_file = 8 2026-06-22 02:37:36.770077 | debian-bookworm | +num_logs = 5 2026-06-22 02:37:36.770173 | debian-bookworm | +priority_boost = 4 2026-06-22 02:37:36.770268 | debian-bookworm | +disp_qos = lossy 2026-06-22 02:37:36.770369 | debian-bookworm | +dispatcher = /sbin/audispd 2026-06-22 02:37:36.770468 | debian-bookworm | +name_format = NONE 2026-06-22 02:37:36.770567 | debian-bookworm | +##name = mydomain 2026-06-22 02:37:36.770665 | debian-bookworm | +max_log_file_action = ROTATE 2026-06-22 02:37:36.770775 | debian-bookworm | +space_left = 12361 2026-06-22 02:37:36.770873 | debian-bookworm | +space_left_action = email 2026-06-22 02:37:36.770971 | debian-bookworm | +verify_email = yes 2026-06-22 02:37:36.771068 | debian-bookworm | +action_mail_acct = root 2026-06-22 02:37:36.771163 | debian-bookworm | +admin_space_left = 50 2026-06-22 02:37:36.771259 | debian-bookworm | +admin_space_left_action = SUSPEND 2026-06-22 02:37:36.771355 | debian-bookworm | +disk_full_action = SUSPEND 2026-06-22 02:37:36.771451 | debian-bookworm | +disk_error_action = SUSPEND 2026-06-22 02:37:36.771545 | debian-bookworm | +use_libwrap = yes 2026-06-22 02:37:36.771639 | debian-bookworm | +##tcp_listen_port = 60 2026-06-22 02:37:36.771793 | debian-bookworm | +tcp_listen_queue = 5 2026-06-22 02:37:36.771895 | debian-bookworm | +tcp_max_per_addr = 1 2026-06-22 02:37:36.771990 | debian-bookworm | +##tcp_client_ports = 1024-65535 2026-06-22 02:37:36.772085 | debian-bookworm | +tcp_client_max_idle = 0 2026-06-22 02:37:36.772180 | debian-bookworm | +enable_krb5 = no 2026-06-22 02:37:36.772276 | debian-bookworm | +krb5_principal = auditd 2026-06-22 02:37:36.772375 | debian-bookworm | +##krb5_key_file = /etc/audit/audit.key 2026-06-22 02:37:36.772471 | debian-bookworm | +distribute_network = no 2026-06-22 02:37:36.772560 | debian-bookworm | 2026-06-22 02:37:36.772692 | debian-bookworm | changed: [molecule-auditd] => {"changed": true, "checksum": "e902cc6bebf86c17087d153e359a2cc1231672e0", "dest": "/etc/audit/audit.conf", "gid": 0, "group": "root", "md5sum": "69dfd768317bae876a6a78c8aeb5cce1", "mode": "0640", "owner": "root", "size": 806, "src": "/home/zuul/.ansible/tmp/ansible-tmp-1782095855.146671-2631-123103836678464/.source.conf", "state": "file", "uid": 0} 2026-06-22 02:37:36.772793 | debian-bookworm | 2026-06-22 02:37:36.772897 | debian-bookworm | TASK [auditd : Adjust auditd/audispd configurations] *************************** 2026-06-22 02:37:37.083822 | ubuntu-noble | The following NEW packages will be installed: 2026-06-22 02:37:37.083899 | ubuntu-noble | audispd-plugins 2026-06-22 02:37:37.083914 | ubuntu-noble | 0 upgraded, 1 newly installed, 0 to remove and 0 not upgraded. 2026-06-22 02:37:37.084071 | ubuntu-noble | changed: [molecule-auditd] => {"cache_update_time": 1782095748, "cache_updated": false, "changed": true, "stderr": "debconf: delaying package configuration, since apt-utils is not installed\n", "stderr_lines": ["debconf: delaying package configuration, since apt-utils is not installed"], "stdout": "Reading package lists...\nBuilding dependency tree...\nReading state information...\nThe following NEW packages will be installed:\n audispd-plugins\n0 upgraded, 1 newly installed, 0 to remove and 0 not upgraded.\nNeed to get 38.8 kB of archives.\nAfter this operation, 131 kB of additional disk space will be used.\nGet:1 http://archive.ubuntu.com/ubuntu noble-updates/universe amd64 audispd-plugins amd64 1:3.1.2-2.1build1.1 [38.8 kB]\nFetched 38.8 kB in 0s (602 kB/s)\nSelecting previously unselected package audispd-plugins.\r\n(Reading database ... \r(Reading database ... 5%\r(Reading database ... 10%\r(Reading database ... 15%\r(Reading database ... 20%\r(Reading database ... 25%\r(Reading database ... 30%\r(Reading database ... 35%\r(Reading database ... 40%\r(Reading database ... 45%\r(Reading database ... 50%\r(Reading database ... 55%\r(Reading database ... 60%\r(Reading database ... 65%\r(Reading database ... 70%\r(Reading database ... 75%\r(Reading database ... 80%\r(Reading database ... 85%\r(Reading database ... 90%\r(Reading database ... 95%\r(Reading database ... 100%\r(Reading database ... 36181 files and directories currently installed.)\r\nPreparing to unpack .../audispd-plugins_1%3a3.1.2-2.1build1.1_amd64.deb ...\r\nUnpacking audispd-plugins (1:3.1.2-2.1build1.1) ...\r\nSetting up audispd-plugins (1:3.1.2-2.1build1.1) ...\r\n", "stdout_lines": ["Reading package lists...", "Building dependency tree...", "Reading state information...", "The following NEW packages will be installed:", " audispd-plugins", "0 upgraded, 1 newly installed, 0 to remove and 0 not upgraded.", "Need to get 38.8 kB of archives.", "After this operation, 131 kB of additional disk space will be used.", "Get:1 http://archive.ubuntu.com/ubuntu noble-updates/universe amd64 audispd-plugins amd64 1:3.1.2-2.1build1.1 [38.8 kB]", "Fetched 38.8 kB in 0s (602 kB/s)", "Selecting previously unselected package audispd-plugins.", "(Reading database ... ", "(Reading database ... 5%", "(Reading database ... 10%", "(Reading database ... 15%", "(Reading database ... 20%", "(Reading database ... 25%", "(Reading database ... 30%", "(Reading database ... 35%", "(Reading database ... 40%", "(Reading database ... 45%", "(Reading database ... 50%", "(Reading database ... 55%", "(Reading database ... 60%", "(Reading database ... 65%", "(Reading database ... 70%", "(Reading database ... 75%", "(Reading database ... 80%", "(Reading database ... 85%", "(Reading database ... 90%", "(Reading database ... 95%", "(Reading database ... 100%", "(Reading database ... 36181 files and directories currently installed.)", "Preparing to unpack .../audispd-plugins_1%3a3.1.2-2.1build1.1_amd64.deb ...", "Unpacking audispd-plugins (1:3.1.2-2.1build1.1) ...", "Setting up audispd-plugins (1:3.1.2-2.1build1.1) ..."]} 2026-06-22 02:37:37.084613 | ubuntu-noble | 2026-06-22 02:37:37.085184 | ubuntu-noble | TASK [auditd : Copy auditd.conf configuration files] *************************** 2026-06-22 02:37:37.365485 | debian-bookworm | ok: [molecule-auditd] => (item={'parameter': 'active', 'value': 'no', 'config': '/etc/audit/plugins.d/syslog.conf'}) => {"ansible_loop_var": "item", "backup": "", "changed": false, "item": {"config": "/etc/audit/plugins.d/syslog.conf", "parameter": "active", "value": "no"}, "msg": ""} 2026-06-22 02:37:37.365560 | debian-bookworm | 2026-06-22 02:37:37.365652 | debian-bookworm | TASK [auditd : Deploy rules for auditd] **************************************** 2026-06-22 02:37:38.455234 | debian-bookworm | --- before 2026-06-22 02:37:38.455349 | debian-bookworm | +++ after: /home/zuul/.ansible/tmp/ansible-local-2260ct412hyc/tmpvh31mkpi/20-neo23x0.rules.j2 2026-06-22 02:37:38.455449 | debian-bookworm | @@ -0,0 +1,750 @@ 2026-06-22 02:37:38.455551 | debian-bookworm | +# ___ ___ __ __ 2026-06-22 02:37:38.455650 | debian-bookworm | +# / | __ ______/ (_) /_____/ / 2026-06-22 02:37:38.455862 | debian-bookworm | +# / /| |/ / / / __ / / __/ __ / 2026-06-22 02:37:38.455959 | debian-bookworm | +# / ___ / /_/ / /_/ / / /_/ /_/ / 2026-06-22 02:37:38.456053 | debian-bookworm | +# /_/ |_\__,_/\__,_/_/\__/\__,_/ 2026-06-22 02:37:38.456146 | debian-bookworm | +# 2026-06-22 02:37:38.456245 | debian-bookworm | +# Linux Audit Daemon - Best Practice Configuration 2026-06-22 02:37:38.456341 | debian-bookworm | +# /etc/audit/audit.rules 2026-06-22 02:37:38.456434 | debian-bookworm | +# 2026-06-22 02:37:38.456530 | debian-bookworm | +# Compiled by Florian Roth 2026-06-22 02:37:38.456623 | debian-bookworm | +# 2026-06-22 02:37:38.456729 | debian-bookworm | +# Created : 2017/12/05 2026-06-22 02:37:38.456823 | debian-bookworm | +# Modified : 2023/01/25 2026-06-22 02:37:38.456914 | debian-bookworm | +# 2026-06-22 02:37:38.457010 | debian-bookworm | +# Based on rules published here: 2026-06-22 02:37:38.457103 | debian-bookworm | +# Gov.uk auditd rules 2026-06-22 02:37:38.457365 | debian-bookworm | +# https://github.com/gds-operations/puppet-auditd/pull/1 2026-06-22 02:37:38.457516 | debian-bookworm | +# CentOS 7 hardening 2026-06-22 02:37:38.457673 | debian-bookworm | +# https://highon.coffee/blog/security-harden-centos-7/#auditd---audit-daemon 2026-06-22 02:37:38.457823 | debian-bookworm | +# Linux audit repo 2026-06-22 02:37:38.457971 | debian-bookworm | +# https://github.com/linux-audit/audit-userspace/tree/master/rules 2026-06-22 02:37:38.458103 | debian-bookworm | +# Auditd high performance linux auditing 2026-06-22 02:37:38.458256 | debian-bookworm | +# https://linux-audit.com/tuning-auditd-high-performance-linux-auditing/ 2026-06-22 02:37:38.458342 | debian-bookworm | +# 2026-06-22 02:37:38.458438 | debian-bookworm | +# Further rules 2026-06-22 02:37:38.458577 | debian-bookworm | +# For PCI DSS compliance see: 2026-06-22 02:37:38.458740 | debian-bookworm | +# https://github.com/linux-audit/audit-userspace/blob/master/rules/30-pci-dss-v31.rules 2026-06-22 02:37:38.458883 | debian-bookworm | +# For NISPOM compliance see: 2026-06-22 02:37:38.459023 | debian-bookworm | +# https://github.com/linux-audit/audit-userspace/blob/master/rules/30-nispom.rules 2026-06-22 02:37:38.459124 | debian-bookworm | + 2026-06-22 02:37:38.459215 | debian-bookworm | +# Remove any existing rules 2026-06-22 02:37:38.459307 | debian-bookworm | +-D 2026-06-22 02:37:38.459397 | debian-bookworm | + 2026-06-22 02:37:38.459489 | debian-bookworm | +# Buffer Size 2026-06-22 02:37:38.459585 | debian-bookworm | +## Feel free to increase this if the machine panic's 2026-06-22 02:37:38.459692 | debian-bookworm | +-b 8192 2026-06-22 02:37:38.464189 | debian-bookworm | + 2026-06-22 02:37:38.464444 | debian-bookworm | +# Failure Mode 2026-06-22 02:37:38.464699 | debian-bookworm | +## Possible values: 0 (silent), 1 (printk, print a failure message), 2 (panic, halt the system) 2026-06-22 02:37:38.464957 | debian-bookworm | +-f 1 2026-06-22 02:37:38.467907 | debian-bookworm | + 2026-06-22 02:37:38.468020 | debian-bookworm | +# Ignore errors 2026-06-22 02:37:38.468125 | debian-bookworm | +## e.g. caused by users or files not found in the local environment 2026-06-22 02:37:38.468221 | debian-bookworm | +-i 2026-06-22 02:37:38.468315 | debian-bookworm | + 2026-06-22 02:37:38.468407 | debian-bookworm | +# Self Auditing --------------------------------------------------------------- 2026-06-22 02:37:38.468498 | debian-bookworm | + 2026-06-22 02:37:38.468590 | debian-bookworm | +## Audit the audit logs 2026-06-22 02:37:38.468687 | debian-bookworm | +### Successful and unsuccessful attempts to read information from the audit records 2026-06-22 02:37:38.468817 | debian-bookworm | +-w /var/log/audit/ -p wra -k auditlog 2026-06-22 02:37:38.468913 | debian-bookworm | +-w /var/audit/ -p wra -k auditlog 2026-06-22 02:37:38.469006 | debian-bookworm | + 2026-06-22 02:37:38.469100 | debian-bookworm | +## Auditd configuration 2026-06-22 02:37:38.469196 | debian-bookworm | +### Modifications to audit configuration that occur while the audit collection functions are operating 2026-06-22 02:37:38.469294 | debian-bookworm | +-w /etc/audit/ -p wa -k auditconfig 2026-06-22 02:37:38.469393 | debian-bookworm | +-w /etc/libaudit.conf -p wa -k auditconfig 2026-06-22 02:37:38.469489 | debian-bookworm | +-w /etc/audisp/ -p wa -k audispconfig 2026-06-22 02:37:38.469582 | debian-bookworm | + 2026-06-22 02:37:38.469680 | debian-bookworm | +## Monitor for use of audit management tools 2026-06-22 02:37:38.469793 | debian-bookworm | +-w /sbin/auditctl -p x -k audittools 2026-06-22 02:37:38.469891 | debian-bookworm | +-w /sbin/auditd -p x -k audittools 2026-06-22 02:37:38.469987 | debian-bookworm | +-w /usr/sbin/auditd -p x -k audittools 2026-06-22 02:37:38.470081 | debian-bookworm | +-w /usr/sbin/augenrules -p x -k audittools 2026-06-22 02:37:38.470173 | debian-bookworm | + 2026-06-22 02:37:38.470268 | debian-bookworm | +## Access to all audit trails 2026-06-22 02:37:38.470361 | debian-bookworm | + 2026-06-22 02:37:38.470457 | debian-bookworm | +-a always,exit -F path=/usr/sbin/ausearch -F perm=x -k audittools 2026-06-22 02:37:38.470551 | debian-bookworm | +-a always,exit -F path=/usr/sbin/aureport -F perm=x -k audittools 2026-06-22 02:37:38.470647 | debian-bookworm | +-a always,exit -F path=/usr/sbin/aulast -F perm=x -k audittools 2026-06-22 02:37:38.470758 | debian-bookworm | +-a always,exit -F path=/usr/sbin/aulastlogin -F perm=x -k audittools 2026-06-22 02:37:38.470853 | debian-bookworm | +-a always,exit -F path=/usr/sbin/auvirt -F perm=x -k audittools 2026-06-22 02:37:38.470944 | debian-bookworm | + 2026-06-22 02:37:38.471034 | debian-bookworm | +# Filters --------------------------------------------------------------------- 2026-06-22 02:37:38.471125 | debian-bookworm | + 2026-06-22 02:37:38.471220 | debian-bookworm | +### We put these early because audit is a first match wins system. 2026-06-22 02:37:38.471312 | debian-bookworm | + 2026-06-22 02:37:38.471410 | debian-bookworm | +## Ignore SELinux AVC records 2026-06-22 02:37:38.471505 | debian-bookworm | +-a always,exclude -F msgtype=AVC 2026-06-22 02:37:38.471596 | debian-bookworm | + 2026-06-22 02:37:38.471754 | debian-bookworm | +## Ignore current working directory records 2026-06-22 02:37:38.471834 | debian-bookworm | +-a always,exclude -F msgtype=CWD 2026-06-22 02:37:38.471927 | debian-bookworm | + 2026-06-22 02:37:38.472028 | debian-bookworm | +## Cron jobs fill the logs with stuff we normally don't want (works with SELinux) 2026-06-22 02:37:38.472125 | debian-bookworm | +-a never,user -F subj_type=crond_t 2026-06-22 02:37:38.472222 | debian-bookworm | +-a never,exit -F subj_type=crond_t 2026-06-22 02:37:38.472312 | debian-bookworm | + 2026-06-22 02:37:38.472406 | debian-bookworm | +## This prevents chrony from overwhelming the logs 2026-06-22 02:37:38.472503 | debian-bookworm | +-a never,exit -F arch=b64 -S adjtimex -F auid=-1 -F uid=chrony -F subj_type=chronyd_t 2026-06-22 02:37:38.472591 | debian-bookworm | + 2026-06-22 02:37:38.472690 | debian-bookworm | +## This is not very interesting and wastes a lot of space if the server is public facing 2026-06-22 02:37:38.472798 | debian-bookworm | +-a always,exclude -F msgtype=CRYPTO_KEY_USER 2026-06-22 02:37:38.472892 | debian-bookworm | + 2026-06-22 02:37:38.472989 | debian-bookworm | +## Open VM Tools 2026-06-22 02:37:38.473089 | debian-bookworm | +-a exit,never -F arch=b64 -S all -F exe=/usr/bin/vmtoolsd 2026-06-22 02:37:38.473177 | debian-bookworm | + 2026-06-22 02:37:38.473274 | debian-bookworm | +## High Volume Event Filter (especially on Linux Workstations) 2026-06-22 02:37:38.473370 | debian-bookworm | +-a never,exit -F arch=b64 -F dir=/dev/shm -k sharedmemaccess 2026-06-22 02:37:38.473543 | debian-bookworm | +-a never,exit -F arch=b64 -F dir=/var/lock/lvm -k locklvm 2026-06-22 02:37:38.473634 | debian-bookworm | + 2026-06-22 02:37:38.473750 | debian-bookworm | +## FileBeat 2026-06-22 02:37:38.473853 | debian-bookworm | +-a never,exit -F arch=b64 -F path=/opt/filebeat -k filebeat 2026-06-22 02:37:38.473938 | debian-bookworm | + 2026-06-22 02:37:38.474032 | debian-bookworm | +## More information on how to filter events 2026-06-22 02:37:38.474126 | debian-bookworm | +### https://access.redhat.com/solutions/2482221 2026-06-22 02:37:38.474219 | debian-bookworm | + 2026-06-22 02:37:38.474314 | debian-bookworm | +# Rules ----------------------------------------------------------------------- 2026-06-22 02:37:38.474587 | debian-bookworm | + 2026-06-22 02:37:38.474700 | debian-bookworm | +## Kernel parameters 2026-06-22 02:37:38.474841 | debian-bookworm | +-w /etc/sysctl.conf -p wa -k sysctl 2026-06-22 02:37:38.474950 | debian-bookworm | +-w /etc/sysctl.d -p wa -k sysctl 2026-06-22 02:37:38.475045 | debian-bookworm | + 2026-06-22 02:37:38.475149 | debian-bookworm | +## Kernel module loading and unloading 2026-06-22 02:37:38.475248 | debian-bookworm | +-a always,exit -F perm=x -F auid!=-1 -F path=/sbin/insmod -k modules 2026-06-22 02:37:38.475344 | debian-bookworm | +-a always,exit -F perm=x -F auid!=-1 -F path=/sbin/modprobe -k modules 2026-06-22 02:37:38.475439 | debian-bookworm | +-a always,exit -F perm=x -F auid!=-1 -F path=/sbin/rmmod -k modules 2026-06-22 02:37:38.475538 | debian-bookworm | +-a always,exit -F arch=b64 -S finit_module -S init_module -S delete_module -F auid!=-1 -k modules 2026-06-22 02:37:38.475628 | debian-bookworm | + 2026-06-22 02:37:38.475761 | debian-bookworm | +## Modprobe configuration 2026-06-22 02:37:38.475859 | debian-bookworm | +-w /etc/modprobe.conf -p wa -k modprobe 2026-06-22 02:37:38.475955 | debian-bookworm | +-w /etc/modprobe.d -p wa -k modprobe 2026-06-22 02:37:38.476048 | debian-bookworm | + 2026-06-22 02:37:38.476143 | debian-bookworm | +## KExec usage (all actions) 2026-06-22 02:37:38.476241 | debian-bookworm | +-a always,exit -F arch=b64 -S kexec_load -k KEXEC 2026-06-22 02:37:38.476334 | debian-bookworm | + 2026-06-22 02:37:38.476428 | debian-bookworm | +## Special files 2026-06-22 02:37:38.476530 | debian-bookworm | +-a always,exit -F arch=b64 -S mknod -S mknodat -k specialfiles 2026-06-22 02:37:38.476619 | debian-bookworm | + 2026-06-22 02:37:38.476730 | debian-bookworm | +## Mount operations (only attributable) 2026-06-22 02:37:38.476821 | debian-bookworm | +-a always,exit -F arch=b64 -S mount -S umount2 -F auid!=-1 -k mount 2026-06-22 02:37:38.476913 | debian-bookworm | + 2026-06-22 02:37:38.477009 | debian-bookworm | +### NFS mount 2026-06-22 02:37:38.477109 | debian-bookworm | +-a always,exit -F path=/sbin/mount.nfs -F perm=x -F auid>=500 -F auid!=4294967295 -k T1078_Valid_Accounts 2026-06-22 02:37:38.477210 | debian-bookworm | +-a always,exit -F path=/usr/sbin/mount.nfs -F perm=x -F auid>=500 -F auid!=4294967295 -k T1078_Valid_Accounts 2026-06-22 02:37:38.477301 | debian-bookworm | + 2026-06-22 02:37:38.477400 | debian-bookworm | +## Change swap (only attributable) 2026-06-22 02:37:38.477497 | debian-bookworm | +-a always,exit -F arch=b64 -S swapon -S swapoff -F auid!=-1 -k swap 2026-06-22 02:37:38.477587 | debian-bookworm | + 2026-06-22 02:37:38.477684 | debian-bookworm | +## Time 2026-06-22 02:37:38.477813 | debian-bookworm | +-a always,exit -F arch=b64 -F uid!=ntp -S adjtimex -S settimeofday -S clock_settime -k time 2026-06-22 02:37:38.477911 | debian-bookworm | +### Local time zone 2026-06-22 02:37:38.478015 | debian-bookworm | +-w /etc/localtime -p wa -k localtime 2026-06-22 02:37:38.478110 | debian-bookworm | + 2026-06-22 02:37:38.478205 | debian-bookworm | +## Stunnel 2026-06-22 02:37:38.478300 | debian-bookworm | +-w /usr/sbin/stunnel -p x -k stunnel 2026-06-22 02:37:38.478394 | debian-bookworm | +-w /usr/bin/stunnel -p x -k stunnel 2026-06-22 02:37:38.478486 | debian-bookworm | + 2026-06-22 02:37:38.478583 | debian-bookworm | +## Cron configuration & scheduled jobs 2026-06-22 02:37:38.478678 | debian-bookworm | +-w /etc/cron.allow -p wa -k cron 2026-06-22 02:37:38.478784 | debian-bookworm | +-w /etc/cron.deny -p wa -k cron 2026-06-22 02:37:38.478879 | debian-bookworm | +-w /etc/cron.d/ -p wa -k cron 2026-06-22 02:37:38.478976 | debian-bookworm | +-w /etc/cron.daily/ -p wa -k cron 2026-06-22 02:37:38.479072 | debian-bookworm | +-w /etc/cron.hourly/ -p wa -k cron 2026-06-22 02:37:38.479168 | debian-bookworm | +-w /etc/cron.monthly/ -p wa -k cron 2026-06-22 02:37:38.479262 | debian-bookworm | +-w /etc/cron.weekly/ -p wa -k cron 2026-06-22 02:37:38.479357 | debian-bookworm | +-w /etc/crontab -p wa -k cron 2026-06-22 02:37:38.479453 | debian-bookworm | +-w /var/spool/cron/ -p wa -k cron 2026-06-22 02:37:38.479545 | debian-bookworm | + 2026-06-22 02:37:38.479637 | debian-bookworm | +## User, group, password databases 2026-06-22 02:37:38.479779 | debian-bookworm | +-w /etc/group -p wa -k etcgroup 2026-06-22 02:37:38.479873 | debian-bookworm | +-w /etc/passwd -p wa -k etcpasswd 2026-06-22 02:37:38.479971 | debian-bookworm | +-w /etc/gshadow -k etcgroup 2026-06-22 02:37:38.480063 | debian-bookworm | +-w /etc/shadow -k etcpasswd 2026-06-22 02:37:38.480160 | debian-bookworm | +-w /etc/security/opasswd -k opasswd 2026-06-22 02:37:38.480251 | debian-bookworm | + 2026-06-22 02:37:38.480348 | debian-bookworm | +## Sudoers file changes 2026-06-22 02:37:38.480444 | debian-bookworm | +-w /etc/sudoers -p wa -k actions 2026-06-22 02:37:38.480535 | debian-bookworm | +-w /etc/sudoers.d/ -p wa -k actions 2026-06-22 02:37:38.480626 | debian-bookworm | + 2026-06-22 02:37:38.480736 | debian-bookworm | +## Passwd 2026-06-22 02:37:38.480825 | debian-bookworm | +-w /usr/bin/passwd -p x -k passwd_modification 2026-06-22 02:37:38.480916 | debian-bookworm | + 2026-06-22 02:37:38.481009 | debian-bookworm | +## Tools to change group identifiers 2026-06-22 02:37:38.481104 | debian-bookworm | +-w /usr/sbin/groupadd -p x -k group_modification 2026-06-22 02:37:38.481199 | debian-bookworm | +-w /usr/sbin/groupmod -p x -k group_modification 2026-06-22 02:37:38.481294 | debian-bookworm | +-w /usr/sbin/addgroup -p x -k group_modification 2026-06-22 02:37:38.481391 | debian-bookworm | +-w /usr/sbin/useradd -p x -k user_modification 2026-06-22 02:37:38.481488 | debian-bookworm | +-w /usr/sbin/userdel -p x -k user_modification 2026-06-22 02:37:38.481584 | debian-bookworm | +-w /usr/sbin/usermod -p x -k user_modification 2026-06-22 02:37:38.481677 | debian-bookworm | +-w /usr/sbin/adduser -p x -k user_modification 2026-06-22 02:37:38.481806 | debian-bookworm | + 2026-06-22 02:37:38.481876 | debian-bookworm | +## Login configuration and information 2026-06-22 02:37:38.481970 | debian-bookworm | +-w /etc/login.defs -p wa -k login 2026-06-22 02:37:38.482064 | debian-bookworm | +-w /etc/securetty -p wa -k login 2026-06-22 02:37:38.482158 | debian-bookworm | +-w /var/log/faillog -p wa -k login 2026-06-22 02:37:38.482250 | debian-bookworm | +-w /var/log/lastlog -p wa -k login 2026-06-22 02:37:38.482345 | debian-bookworm | +-w /var/log/tallylog -p wa -k login 2026-06-22 02:37:38.482435 | debian-bookworm | + 2026-06-22 02:37:38.482529 | debian-bookworm | +## Network Environment 2026-06-22 02:37:38.482623 | debian-bookworm | +### Changes to hostname 2026-06-22 02:37:38.482743 | debian-bookworm | +-a always,exit -F arch=b64 -S sethostname -S setdomainname -k network_modifications 2026-06-22 02:37:38.482836 | debian-bookworm | + 2026-06-22 02:37:38.482928 | debian-bookworm | +### Detect Remote Shell Use 2026-06-22 02:37:38.483023 | debian-bookworm | +-a always,exit -F arch=b64 -F exe=/bin/bash -F success=1 -S connect -k "remote_shell" 2026-06-22 02:37:38.483120 | debian-bookworm | +-a always,exit -F arch=b64 -F exe=/usr/bin/bash -F success=1 -S connect -k "remote_shell" 2026-06-22 02:37:38.483210 | debian-bookworm | + 2026-06-22 02:37:38.483302 | debian-bookworm | +### Successful IPv4 Connections 2026-06-22 02:37:38.483398 | debian-bookworm | +-a always,exit -F arch=b64 -S connect -F a2=16 -F success=1 -F key=network_connect_4 2026-06-22 02:37:38.483487 | debian-bookworm | + 2026-06-22 02:37:38.483584 | debian-bookworm | +### Successful IPv6 Connections 2026-06-22 02:37:38.483707 | debian-bookworm | +-a always,exit -F arch=b64 -S connect -F a2=28 -F success=1 -F key=network_connect_6 2026-06-22 02:37:38.483802 | debian-bookworm | + 2026-06-22 02:37:38.483898 | debian-bookworm | +### Changes to other files 2026-06-22 02:37:38.483993 | debian-bookworm | +-w /etc/hosts -p wa -k network_modifications 2026-06-22 02:37:38.484090 | debian-bookworm | +-w /etc/sysconfig/network -p wa -k network_modifications 2026-06-22 02:37:38.484183 | debian-bookworm | +-w /etc/sysconfig/network-scripts -p w -k network_modifications 2026-06-22 02:37:38.484275 | debian-bookworm | +-w /etc/network/ -p wa -k network 2026-06-22 02:37:38.484371 | debian-bookworm | +-a always,exit -F dir=/etc/NetworkManager/ -F perm=wa -k network_modifications 2026-06-22 02:37:38.484462 | debian-bookworm | + 2026-06-22 02:37:38.484556 | debian-bookworm | +### Changes to issue 2026-06-22 02:37:38.484649 | debian-bookworm | +-w /etc/issue -p wa -k etcissue 2026-06-22 02:37:38.484760 | debian-bookworm | +-w /etc/issue.net -p wa -k etcissue 2026-06-22 02:37:38.484845 | debian-bookworm | + 2026-06-22 02:37:38.484938 | debian-bookworm | +## System startup scripts 2026-06-22 02:37:38.485047 | debian-bookworm | +-w /etc/inittab -p wa -k init 2026-06-22 02:37:38.485124 | debian-bookworm | +-w /etc/init.d/ -p wa -k init 2026-06-22 02:37:38.485218 | debian-bookworm | +-w /etc/init/ -p wa -k init 2026-06-22 02:37:38.485310 | debian-bookworm | + 2026-06-22 02:37:38.485406 | debian-bookworm | +## Library search paths 2026-06-22 02:37:38.485503 | debian-bookworm | +-w /etc/ld.so.conf -p wa -k libpath 2026-06-22 02:37:38.485599 | debian-bookworm | +-w /etc/ld.so.conf.d -p wa -k libpath 2026-06-22 02:37:38.485695 | debian-bookworm | + 2026-06-22 02:37:38.485816 | debian-bookworm | +## Systemwide library preloads (LD_PRELOAD) 2026-06-22 02:37:38.485917 | debian-bookworm | +-w /etc/ld.so.preload -p wa -k systemwide_preloads 2026-06-22 02:37:38.486009 | debian-bookworm | + 2026-06-22 02:37:38.486127 | debian-bookworm | +## Pam configuration 2026-06-22 02:37:38.486199 | debian-bookworm | +-w /etc/pam.d/ -p wa -k pam 2026-06-22 02:37:38.486297 | debian-bookworm | +-w /etc/security/limits.conf -p wa -k pam 2026-06-22 02:37:38.486393 | debian-bookworm | +-w /etc/security/limits.d -p wa -k pam 2026-06-22 02:37:38.486489 | debian-bookworm | +-w /etc/security/pam_env.conf -p wa -k pam 2026-06-22 02:37:38.486587 | debian-bookworm | +-w /etc/security/namespace.conf -p wa -k pam 2026-06-22 02:37:38.486683 | debian-bookworm | +-w /etc/security/namespace.d -p wa -k pam 2026-06-22 02:37:38.486788 | debian-bookworm | +-w /etc/security/namespace.init -p wa -k pam 2026-06-22 02:37:38.486881 | debian-bookworm | + 2026-06-22 02:37:38.486979 | debian-bookworm | +## Mail configuration 2026-06-22 02:37:38.487072 | debian-bookworm | +-w /etc/aliases -p wa -k mail 2026-06-22 02:37:38.487179 | debian-bookworm | +-w /etc/postfix/ -p wa -k mail 2026-06-22 02:37:38.487259 | debian-bookworm | +-w /etc/exim4/ -p wa -k mail 2026-06-22 02:37:38.487348 | debian-bookworm | + 2026-06-22 02:37:38.487440 | debian-bookworm | +## SSH configuration 2026-06-22 02:37:38.487532 | debian-bookworm | +-w /etc/ssh/sshd_config -k sshd 2026-06-22 02:37:38.487624 | debian-bookworm | +-w /etc/ssh/sshd_config.d -k sshd 2026-06-22 02:37:38.487758 | debian-bookworm | + 2026-06-22 02:37:38.487838 | debian-bookworm | +## root ssh key tampering 2026-06-22 02:37:38.487930 | debian-bookworm | +-w /root/.ssh -p wa -k rootkey 2026-06-22 02:37:38.488023 | debian-bookworm | + 2026-06-22 02:37:38.488119 | debian-bookworm | +# Systemd 2026-06-22 02:37:38.488213 | debian-bookworm | +-w /bin/systemctl -p x -k systemd 2026-06-22 02:37:38.488309 | debian-bookworm | +-w /etc/systemd/ -p wa -k systemd 2026-06-22 02:37:38.488405 | debian-bookworm | +-w /usr/lib/systemd -p wa -k systemd 2026-06-22 02:37:38.488494 | debian-bookworm | + 2026-06-22 02:37:38.488591 | debian-bookworm | +## https://systemd.network/systemd.generator.html 2026-06-22 02:37:38.488686 | debian-bookworm | +-w /etc/systemd/system-generators/ -p wa -k systemd_generator 2026-06-22 02:37:38.488804 | debian-bookworm | +-w /usr/local/lib/systemd/system-generators/ -p wa -k systemd_generator 2026-06-22 02:37:38.488900 | debian-bookworm | +-w /usr/lib/systemd/system-generators -p wa -k systemd_generator 2026-06-22 02:37:38.488992 | debian-bookworm | + 2026-06-22 02:37:38.489087 | debian-bookworm | +-w /etc/systemd/user-generators/ -p wa -k systemd_generator 2026-06-22 02:37:38.489183 | debian-bookworm | +-w /usr/local/lib/systemd/user-generators/ -p wa -k systemd_generator 2026-06-22 02:37:38.489277 | debian-bookworm | +-w /lib/systemd/system-generators/ -p wa -k systemd_generator 2026-06-22 02:37:38.489376 | debian-bookworm | + 2026-06-22 02:37:38.489466 | debian-bookworm | +## SELinux events that modify the system's Mandatory Access Controls (MAC) 2026-06-22 02:37:38.489561 | debian-bookworm | +-w /etc/selinux/ -p wa -k mac_policy 2026-06-22 02:37:38.489652 | debian-bookworm | + 2026-06-22 02:37:38.489757 | debian-bookworm | +## Critical elements access failures 2026-06-22 02:37:38.489854 | debian-bookworm | +-a always,exit -F arch=b64 -S open -F dir=/etc -F success=0 -k unauthedfileaccess 2026-06-22 02:37:38.489950 | debian-bookworm | +-a always,exit -F arch=b64 -S open -F dir=/bin -F success=0 -k unauthedfileaccess 2026-06-22 02:37:38.490043 | debian-bookworm | +-a always,exit -F arch=b64 -S open -F dir=/sbin -F success=0 -k unauthedfileaccess 2026-06-22 02:37:38.490139 | debian-bookworm | +-a always,exit -F arch=b64 -S open -F dir=/usr/bin -F success=0 -k unauthedfileaccess 2026-06-22 02:37:38.490234 | debian-bookworm | +-a always,exit -F arch=b64 -S open -F dir=/usr/sbin -F success=0 -k unauthedfileaccess 2026-06-22 02:37:38.490331 | debian-bookworm | +-a always,exit -F arch=b64 -S open -F dir=/var -F success=0 -k unauthedfileaccess 2026-06-22 02:37:38.490458 | debian-bookworm | +-a always,exit -F arch=b64 -S open -F dir=/home -F success=0 -k unauthedfileaccess 2026-06-22 02:37:38.490520 | debian-bookworm | +-a always,exit -F arch=b64 -S open -F dir=/srv -F success=0 -k unauthedfileaccess 2026-06-22 02:37:38.490615 | debian-bookworm | + 2026-06-22 02:37:38.490727 | debian-bookworm | +## Process ID change (switching accounts) applications 2026-06-22 02:37:38.490829 | debian-bookworm | +-w /bin/su -p x -k priv_esc 2026-06-22 02:37:38.490925 | debian-bookworm | +-w /usr/bin/sudo -p x -k priv_esc 2026-06-22 02:37:38.491015 | debian-bookworm | + 2026-06-22 02:37:38.491109 | debian-bookworm | +## Power state 2026-06-22 02:37:38.491206 | debian-bookworm | +-w /sbin/shutdown -p x -k power 2026-06-22 02:37:38.491301 | debian-bookworm | +-w /sbin/poweroff -p x -k power 2026-06-22 02:37:38.491397 | debian-bookworm | +-w /sbin/reboot -p x -k power 2026-06-22 02:37:38.491490 | debian-bookworm | +-w /sbin/halt -p x -k power 2026-06-22 02:37:38.491581 | debian-bookworm | + 2026-06-22 02:37:38.491676 | debian-bookworm | +## Session initiation information 2026-06-22 02:37:38.491803 | debian-bookworm | +-w /var/run/utmp -p wa -k session 2026-06-22 02:37:38.491898 | debian-bookworm | +-w /var/log/btmp -p wa -k session 2026-06-22 02:37:38.491993 | debian-bookworm | +-w /var/log/wtmp -p wa -k session 2026-06-22 02:37:38.492085 | debian-bookworm | + 2026-06-22 02:37:38.492187 | debian-bookworm | +## Discretionary Access Control (DAC) modifications 2026-06-22 02:37:38.492277 | debian-bookworm | +-a always,exit -F arch=b64 -S chmod -F auid>=1000 -F auid!=-1 -k perm_mod 2026-06-22 02:37:38.492372 | debian-bookworm | +-a always,exit -F arch=b64 -S chown -F auid>=1000 -F auid!=-1 -k perm_mod 2026-06-22 02:37:38.492469 | debian-bookworm | +-a always,exit -F arch=b64 -S fchmod -F auid>=1000 -F auid!=-1 -k perm_mod 2026-06-22 02:37:38.492572 | debian-bookworm | +-a always,exit -F arch=b64 -S fchmodat -F auid>=1000 -F auid!=-1 -k perm_mod 2026-06-22 02:37:38.492664 | debian-bookworm | +-a always,exit -F arch=b64 -S fchown -F auid>=1000 -F auid!=-1 -k perm_mod 2026-06-22 02:37:38.492772 | debian-bookworm | +-a always,exit -F arch=b64 -S fchownat -F auid>=1000 -F auid!=-1 -k perm_mod 2026-06-22 02:37:38.492869 | debian-bookworm | +-a always,exit -F arch=b64 -S fremovexattr -F auid>=1000 -F auid!=-1 -k perm_mod 2026-06-22 02:37:38.492964 | debian-bookworm | +-a always,exit -F arch=b64 -S fsetxattr -F auid>=1000 -F auid!=-1 -k perm_mod 2026-06-22 02:37:38.493060 | debian-bookworm | +-a always,exit -F arch=b64 -S lchown -F auid>=1000 -F auid!=-1 -k perm_mod 2026-06-22 02:37:38.493155 | debian-bookworm | +-a always,exit -F arch=b64 -S lremovexattr -F auid>=1000 -F auid!=-1 -k perm_mod 2026-06-22 02:37:38.493254 | debian-bookworm | +-a always,exit -F arch=b64 -S lsetxattr -F auid>=1000 -F auid!=-1 -k perm_mod 2026-06-22 02:37:38.493352 | debian-bookworm | +-a always,exit -F arch=b64 -S removexattr -F auid>=1000 -F auid!=-1 -k perm_mod 2026-06-22 02:37:38.493448 | debian-bookworm | +-a always,exit -F arch=b64 -S setxattr -F auid>=1000 -F auid!=-1 -k perm_mod 2026-06-22 02:37:38.493539 | debian-bookworm | + 2026-06-22 02:37:38.493636 | debian-bookworm | +# Special Rules --------------------------------------------------------------- 2026-06-22 02:37:38.493749 | debian-bookworm | + 2026-06-22 02:37:38.493848 | debian-bookworm | +## Reconnaissance 2026-06-22 02:37:38.493944 | debian-bookworm | +-w /usr/bin/whoami -p x -k recon 2026-06-22 02:37:38.494040 | debian-bookworm | +-w /usr/bin/id -p x -k recon 2026-06-22 02:37:38.494136 | debian-bookworm | +-w /bin/hostname -p x -k recon 2026-06-22 02:37:38.494230 | debian-bookworm | +-w /bin/uname -p x -k recon 2026-06-22 02:37:38.494325 | debian-bookworm | +-w /etc/issue -p r -k recon 2026-06-22 02:37:38.494420 | debian-bookworm | +-w /etc/hostname -p r -k recon 2026-06-22 02:37:38.494511 | debian-bookworm | + 2026-06-22 02:37:38.494607 | debian-bookworm | +## Suspicious activity 2026-06-22 02:37:38.494704 | debian-bookworm | +-w /usr/bin/wget -p x -k susp_activity 2026-06-22 02:37:38.494812 | debian-bookworm | +-w /usr/bin/curl -p x -k susp_activity 2026-06-22 02:37:38.494910 | debian-bookworm | +-w /usr/bin/base64 -p x -k susp_activity 2026-06-22 02:37:38.495007 | debian-bookworm | +-w /bin/nc -p x -k susp_activity 2026-06-22 02:37:38.495102 | debian-bookworm | +-w /bin/netcat -p x -k susp_activity 2026-06-22 02:37:38.495196 | debian-bookworm | +-w /usr/bin/ncat -p x -k susp_activity 2026-06-22 02:37:38.495291 | debian-bookworm | +-w /usr/bin/ss -p x -k susp_activity 2026-06-22 02:37:38.495386 | debian-bookworm | +-w /usr/bin/netstat -p x -k susp_activity 2026-06-22 02:37:38.495480 | debian-bookworm | +-w /usr/bin/ssh -p x -k susp_activity 2026-06-22 02:37:38.495575 | debian-bookworm | +-w /usr/bin/scp -p x -k susp_activity 2026-06-22 02:37:38.495668 | debian-bookworm | +-w /usr/bin/sftp -p x -k susp_activity 2026-06-22 02:37:38.495799 | debian-bookworm | +-w /usr/bin/ftp -p x -k susp_activity 2026-06-22 02:37:38.495896 | debian-bookworm | +-w /usr/bin/socat -p x -k susp_activity 2026-06-22 02:37:38.495993 | debian-bookworm | +-w /usr/bin/wireshark -p x -k susp_activity 2026-06-22 02:37:38.496089 | debian-bookworm | +-w /usr/bin/tshark -p x -k susp_activity 2026-06-22 02:37:38.496183 | debian-bookworm | +-w /usr/bin/rawshark -p x -k susp_activity 2026-06-22 02:37:38.496278 | debian-bookworm | +-w /usr/bin/rdesktop -p x -k susp_activity 2026-06-22 02:37:38.496373 | debian-bookworm | +-w /usr/local/bin/rdesktop -p x -k susp_activity 2026-06-22 02:37:38.496468 | debian-bookworm | +-w /usr/bin/wlfreerdp -p x -k susp_activity 2026-06-22 02:37:38.496564 | debian-bookworm | +-w /usr/bin/xfreerdp -p x -k susp_activity 2026-06-22 02:37:38.496658 | debian-bookworm | +-w /usr/local/bin/xfreerdp -p x -k susp_activity 2026-06-22 02:37:38.496778 | debian-bookworm | +-w /usr/bin/nmap -p x -k susp_activity 2026-06-22 02:37:38.496871 | debian-bookworm | + 2026-06-22 02:37:38.496965 | debian-bookworm | +## sssd 2026-06-22 02:37:38.497066 | debian-bookworm | +-a always,exit -F path=/usr/libexec/sssd/p11_child -F perm=x -F auid>=500 -F auid!=4294967295 -k T1078_Valid_Accounts 2026-06-22 02:37:38.497167 | debian-bookworm | +-a always,exit -F path=/usr/libexec/sssd/krb5_child -F perm=x -F auid>=500 -F auid!=4294967295 -k T1078_Valid_Accounts 2026-06-22 02:37:38.497265 | debian-bookworm | +-a always,exit -F path=/usr/libexec/sssd/ldap_child -F perm=x -F auid>=500 -F auid!=4294967295 -k T1078_Valid_Accounts 2026-06-22 02:37:38.497361 | debian-bookworm | +-a always,exit -F path=/usr/libexec/sssd/selinux_child -F perm=x -F auid>=500 -F auid!=4294967295 -k T1078_Valid_Accounts 2026-06-22 02:37:38.497459 | debian-bookworm | +-a always,exit -F path=/usr/libexec/sssd/proxy_child -F perm=x -F auid>=500 -F auid!=4294967295 -k T1078_Valid_Accounts 2026-06-22 02:37:38.497549 | debian-bookworm | + 2026-06-22 02:37:38.497645 | debian-bookworm | +## T1002 Data Compressed 2026-06-22 02:37:38.497747 | debian-bookworm | + 2026-06-22 02:37:38.497844 | debian-bookworm | +-w /usr/bin/zip -p x -k Data_Compressed 2026-06-22 02:37:38.497939 | debian-bookworm | +-w /usr/bin/gzip -p x -k Data_Compressed 2026-06-22 02:37:38.498041 | debian-bookworm | +-w /usr/bin/tar -p x -k Data_Compressed 2026-06-22 02:37:38.498134 | debian-bookworm | +-w /usr/bin/bzip2 -p x -k Data_Compressed 2026-06-22 02:37:38.498227 | debian-bookworm | + 2026-06-22 02:37:38.498329 | debian-bookworm | +-w /usr/bin/lzip -p x -k Data_Compressed 2026-06-22 02:37:38.498422 | debian-bookworm | +-w /usr/local/bin/lzip -p x -k Data_Compressed 2026-06-22 02:37:38.498517 | debian-bookworm | + 2026-06-22 02:37:38.498609 | debian-bookworm | +-w /usr/bin/lz4 -p x -k Data_Compressed 2026-06-22 02:37:38.498705 | debian-bookworm | +-w /usr/local/bin/lz4 -p x -k Data_Compressed 2026-06-22 02:37:38.498809 | debian-bookworm | + 2026-06-22 02:37:38.498905 | debian-bookworm | +-w /usr/bin/lzop -p x -k Data_Compressed 2026-06-22 02:37:38.499001 | debian-bookworm | +-w /usr/local/bin/lzop -p x -k Data_Compressed 2026-06-22 02:37:38.499121 | debian-bookworm | + 2026-06-22 02:37:38.499187 | debian-bookworm | +-w /usr/bin/plzip -p x -k Data_Compressed 2026-06-22 02:37:38.499280 | debian-bookworm | +-w /usr/local/bin/plzip -p x -k Data_Compressed 2026-06-22 02:37:38.499374 | debian-bookworm | + 2026-06-22 02:37:38.499469 | debian-bookworm | +-w /usr/bin/pbzip2 -p x -k Data_Compressed 2026-06-22 02:37:38.499564 | debian-bookworm | +-w /usr/local/bin/pbzip2 -p x -k Data_Compressed 2026-06-22 02:37:38.499656 | debian-bookworm | + 2026-06-22 02:37:38.499779 | debian-bookworm | +-w /usr/bin/lbzip2 -p x -k Data_Compressed 2026-06-22 02:37:38.499875 | debian-bookworm | +-w /usr/local/bin/lbzip2 -p x -k Data_Compressed 2026-06-22 02:37:38.499966 | debian-bookworm | + 2026-06-22 02:37:38.500058 | debian-bookworm | +-w /usr/bin/pixz -p x -k Data_Compressed 2026-06-22 02:37:38.500155 | debian-bookworm | +-w /usr/local/bin/pixz -p x -k Data_Compressed 2026-06-22 02:37:38.500246 | debian-bookworm | + 2026-06-22 02:37:38.500345 | debian-bookworm | +-w /usr/bin/pigz -p x -k Data_Compressed 2026-06-22 02:37:38.500439 | debian-bookworm | +-w /usr/local/bin/pigz -p x -k Data_Compressed 2026-06-22 02:37:38.500533 | debian-bookworm | +-w /usr/bin/unpigz -p x -k Data_Compressed 2026-06-22 02:37:38.500629 | debian-bookworm | +-w /usr/local/bin/unpigz -p x -k Data_Compressed 2026-06-22 02:37:38.500734 | debian-bookworm | + 2026-06-22 02:37:38.500834 | debian-bookworm | +-w /usr/bin/zstd -p x -k Data_Compressed 2026-06-22 02:37:38.500930 | debian-bookworm | +-w /usr/local/bin/zstd -p x -k Data_Compressed 2026-06-22 02:37:38.501020 | debian-bookworm | + 2026-06-22 02:37:38.501118 | debian-bookworm | +## Added to catch netcat on Ubuntu 2026-06-22 02:37:38.501214 | debian-bookworm | +-w /bin/nc.openbsd -p x -k susp_activity 2026-06-22 02:37:38.501308 | debian-bookworm | +-w /bin/nc.traditional -p x -k susp_activity 2026-06-22 02:37:38.501401 | debian-bookworm | + 2026-06-22 02:37:38.501494 | debian-bookworm | +## Sbin suspicious activity 2026-06-22 02:37:38.501590 | debian-bookworm | +-w /sbin/iptables -p x -k sbin_susp 2026-06-22 02:37:38.501684 | debian-bookworm | +-w /sbin/ip6tables -p x -k sbin_susp 2026-06-22 02:37:38.501792 | debian-bookworm | +-w /sbin/ifconfig -p x -k sbin_susp 2026-06-22 02:37:38.501887 | debian-bookworm | +-w /usr/sbin/arptables -p x -k sbin_susp 2026-06-22 02:37:38.501982 | debian-bookworm | +-w /usr/sbin/ebtables -p x -k sbin_susp 2026-06-22 02:37:38.502079 | debian-bookworm | +-w /sbin/xtables-nft-multi -p x -k sbin_susp 2026-06-22 02:37:38.502175 | debian-bookworm | +-w /usr/sbin/nft -p x -k sbin_susp 2026-06-22 02:37:38.502271 | debian-bookworm | +-w /usr/sbin/tcpdump -p x -k sbin_susp 2026-06-22 02:37:38.502385 | debian-bookworm | +-w /usr/sbin/traceroute -p x -k sbin_susp 2026-06-22 02:37:38.502458 | debian-bookworm | +-w /usr/sbin/ufw -p x -k sbin_susp 2026-06-22 02:37:38.502550 | debian-bookworm | + 2026-06-22 02:37:38.502644 | debian-bookworm | +### kde4 2026-06-22 02:37:38.502756 | debian-bookworm | +-a always,exit -F path=/usr/libexec/kde4/kpac_dhcp_helper -F perm=x -F auid>=1000 -F auid!=4294967295 -k T1078_Valid_Accounts 2026-06-22 02:37:38.502852 | debian-bookworm | +-a always,exit -F path=/usr/libexec/kde4/kdesud -F perm=x -F auid>=1000 -F auid!=4294967295 -k T1078_Valid_Accounts 2026-06-22 02:37:38.502945 | debian-bookworm | + 2026-06-22 02:37:38.503037 | debian-bookworm | +## dbus-send invocation 2026-06-22 02:37:38.503134 | debian-bookworm | +### may indicate privilege escalation CVE-2021-3560 2026-06-22 02:37:38.503228 | debian-bookworm | +-w /usr/bin/dbus-send -p x -k dbus_send 2026-06-22 02:37:38.503324 | debian-bookworm | +-w /usr/bin/gdbus -p x -k gdubs_call 2026-06-22 02:37:38.503414 | debian-bookworm | + 2026-06-22 02:37:38.503506 | debian-bookworm | +## pkexec invocation 2026-06-22 02:37:38.503604 | debian-bookworm | +### may indicate privilege escalation CVE-2021-4034 2026-06-22 02:37:38.503733 | debian-bookworm | +-w /usr/bin/pkexec -p x -k pkexec 2026-06-22 02:37:38.503832 | debian-bookworm | + 2026-06-22 02:37:38.503930 | debian-bookworm | +## Suspicious shells 2026-06-22 02:37:38.504023 | debian-bookworm | +-w /bin/ash -p x -k susp_shell 2026-06-22 02:37:38.504120 | debian-bookworm | +-w /bin/csh -p x -k susp_shell 2026-06-22 02:37:38.504213 | debian-bookworm | +-w /bin/fish -p x -k susp_shell 2026-06-22 02:37:38.504311 | debian-bookworm | +-w /bin/tcsh -p x -k susp_shell 2026-06-22 02:37:38.504405 | debian-bookworm | +-w /bin/tclsh -p x -k susp_shell 2026-06-22 02:37:38.504498 | debian-bookworm | +-w /bin/xonsh -p x -k susp_shell 2026-06-22 02:37:38.504656 | debian-bookworm | +-w /usr/local/bin/xonsh -p x -k susp_shell 2026-06-22 02:37:38.504680 | debian-bookworm | +-w /bin/open -p x -k susp_shell 2026-06-22 02:37:38.504787 | debian-bookworm | +-w /bin/rbash -p x -k susp_shell 2026-06-22 02:37:38.505048 | debian-bookworm | + 2026-06-22 02:37:38.505057 | debian-bookworm | +# Web Server Actvity 2026-06-22 02:37:38.505063 | debian-bookworm | +## Change the number "33" to the ID of your WebServer user. Default: www-data:x:33:33 2026-06-22 02:37:38.505150 | debian-bookworm | +-a always,exit -F arch=b64 -S execve -F euid=33 -k detect_execve_www 2026-06-22 02:37:38.505241 | debian-bookworm | + 2026-06-22 02:37:38.505335 | debian-bookworm | +### https://clustershell.readthedocs.io/ 2026-06-22 02:37:38.505429 | debian-bookworm | +-w /bin/clush -p x -k susp_shell 2026-06-22 02:37:38.505523 | debian-bookworm | +-w /usr/local/bin/clush -p x -k susp_shell 2026-06-22 02:37:38.505639 | debian-bookworm | +-w /etc/clustershell/clush.conf -p x -k susp_shell 2026-06-22 02:37:38.505706 | debian-bookworm | + 2026-06-22 02:37:38.505833 | debian-bookworm | +### https://github.com/tmux/tmux 2026-06-22 02:37:38.505934 | debian-bookworm | +-w /bin/tmux -p x -k susp_shell 2026-06-22 02:37:38.506022 | debian-bookworm | +-w /usr/local/bin/tmux -p x -k susp_shell 2026-06-22 02:37:38.506113 | debian-bookworm | + 2026-06-22 02:37:38.506208 | debian-bookworm | +## Shell/profile configurations 2026-06-22 02:37:38.506297 | debian-bookworm | +-w /etc/profile.d/ -p wa -k shell_profiles 2026-06-22 02:37:38.506395 | debian-bookworm | +-w /etc/profile -p wa -k shell_profiles 2026-06-22 02:37:38.506491 | debian-bookworm | +-w /etc/shells -p wa -k shell_profiles 2026-06-22 02:37:38.506586 | debian-bookworm | +-w /etc/bashrc -p wa -k shell_profiles 2026-06-22 02:37:38.506735 | debian-bookworm | +-w /etc/csh.cshrc -p wa -k shell_profiles 2026-06-22 02:37:38.506787 | debian-bookworm | +-w /etc/csh.login -p wa -k shell_profiles 2026-06-22 02:37:38.506946 | debian-bookworm | +-w /etc/fish/ -p wa -k shell_profiles 2026-06-22 02:37:38.507037 | debian-bookworm | +-w /etc/zsh/ -p wa -k shell_profiles 2026-06-22 02:37:38.507128 | debian-bookworm | + 2026-06-22 02:37:38.507222 | debian-bookworm | +### https://github.com/xxh/xxh 2026-06-22 02:37:38.507316 | debian-bookworm | +-w /usr/local/bin/xxh.bash -p x -k susp_shell 2026-06-22 02:37:38.507410 | debian-bookworm | +-w /usr/local/bin/xxh.xsh -p x -k susp_shell 2026-06-22 02:37:38.507504 | debian-bookworm | +-w /usr/local/bin/xxh.zsh -p x -k susp_shell 2026-06-22 02:37:38.507594 | debian-bookworm | + 2026-06-22 02:37:38.507697 | debian-bookworm | +## Injection 2026-06-22 02:37:38.507834 | debian-bookworm | +### These rules watch for code injection by the ptrace facility. 2026-06-22 02:37:38.507925 | debian-bookworm | +### This could indicate someone trying to do something bad or just debugging 2026-06-22 02:37:38.508024 | debian-bookworm | +-a always,exit -F arch=b64 -S ptrace -F a0=0x4 -k code_injection 2026-06-22 02:37:38.508121 | debian-bookworm | +-a always,exit -F arch=b64 -S ptrace -F a0=0x5 -k data_injection 2026-06-22 02:37:38.508216 | debian-bookworm | +-a always,exit -F arch=b64 -S ptrace -F a0=0x6 -k register_injection 2026-06-22 02:37:38.508313 | debian-bookworm | +-a always,exit -F arch=b64 -S ptrace -k tracing 2026-06-22 02:37:38.508404 | debian-bookworm | + 2026-06-22 02:37:38.508498 | debian-bookworm | +## Anonymous File Creation 2026-06-22 02:37:38.508590 | debian-bookworm | +### These rules watch the use of memfd_create 2026-06-22 02:37:38.508682 | debian-bookworm | +### "memfd_create" creates anonymous file and returns a file descriptor to access it 2026-06-22 02:37:38.508792 | debian-bookworm | +### When combined with "fexecve" can be used to stealthily run binaries in memory without touching disk 2026-06-22 02:37:38.508889 | debian-bookworm | +-a always,exit -F arch=b64 -S memfd_create -F key=anon_file_create 2026-06-22 02:37:38.508980 | debian-bookworm | + 2026-06-22 02:37:38.509073 | debian-bookworm | +## Privilege Abuse 2026-06-22 02:37:38.509172 | debian-bookworm | +### The purpose of this rule is to detect when an admin may be abusing power by looking in user's home dir. 2026-06-22 02:37:38.509269 | debian-bookworm | +-a always,exit -F dir=/home -F uid=0 -F auid>=1000 -F auid!=-1 -C auid!=obj_uid -k power_abuse 2026-06-22 02:37:38.509360 | debian-bookworm | + 2026-06-22 02:37:38.509456 | debian-bookworm | +# Socket Creations 2026-06-22 02:37:38.509551 | debian-bookworm | +# will catch both IPv4 and IPv6 2026-06-22 02:37:38.509641 | debian-bookworm | + 2026-06-22 02:37:38.509931 | debian-bookworm | +-a always,exit -F arch=b32 -S socket -F a0=2 -k network_socket_created 2026-06-22 02:37:38.510010 | debian-bookworm | +-a always,exit -F arch=b64 -S socket -F a0=2 -k network_socket_created 2026-06-22 02:37:38.510036 | debian-bookworm | + 2026-06-22 02:37:38.510048 | debian-bookworm | +-a always,exit -F arch=b32 -S socket -F a0=10 -k network_socket_created 2026-06-22 02:37:38.510162 | debian-bookworm | +-a always,exit -F arch=b64 -S socket -F a0=10 -k network_socket_created 2026-06-22 02:37:38.510231 | debian-bookworm | + 2026-06-22 02:37:38.510324 | debian-bookworm | +# Software Management --------------------------------------------------------- 2026-06-22 02:37:38.510417 | debian-bookworm | + 2026-06-22 02:37:38.510514 | debian-bookworm | +# RPM (Redhat/CentOS) 2026-06-22 02:37:38.510615 | debian-bookworm | +-w /usr/bin/rpm -p x -k software_mgmt 2026-06-22 02:37:38.510704 | debian-bookworm | +-w /usr/bin/yum -p x -k software_mgmt 2026-06-22 02:37:38.510809 | debian-bookworm | + 2026-06-22 02:37:38.510904 | debian-bookworm | +# DNF (Fedora/RedHat 8/CentOS 8) 2026-06-22 02:37:38.510998 | debian-bookworm | +-w /usr/bin/dnf -p x -k software_mgmt 2026-06-22 02:37:38.511088 | debian-bookworm | + 2026-06-22 02:37:38.511183 | debian-bookworm | +# YAST/Zypper/RPM (SuSE) 2026-06-22 02:37:38.511283 | debian-bookworm | +-w /sbin/yast -p x -k software_mgmt 2026-06-22 02:37:38.511384 | debian-bookworm | +-w /sbin/yast2 -p x -k software_mgmt 2026-06-22 02:37:38.511483 | debian-bookworm | +-w /bin/rpm -p x -k software_mgmt 2026-06-22 02:37:38.511577 | debian-bookworm | +-w /usr/bin/zypper -k software_mgmt 2026-06-22 02:37:38.511667 | debian-bookworm | + 2026-06-22 02:37:38.511815 | debian-bookworm | +# DPKG / APT-GET (Debian/Ubuntu) 2026-06-22 02:37:38.511895 | debian-bookworm | +-w /usr/bin/dpkg -p x -k software_mgmt 2026-06-22 02:37:38.511985 | debian-bookworm | +-w /usr/bin/apt -p x -k software_mgmt 2026-06-22 02:37:38.512080 | debian-bookworm | +-w /usr/bin/apt-add-repository -p x -k software_mgmt 2026-06-22 02:37:38.512178 | debian-bookworm | +-w /usr/bin/apt-get -p x -k software_mgmt 2026-06-22 02:37:38.512279 | debian-bookworm | +-w /usr/bin/aptitude -p x -k software_mgmt 2026-06-22 02:37:38.512385 | debian-bookworm | +-w /usr/bin/wajig -p x -k software_mgmt 2026-06-22 02:37:38.512477 | debian-bookworm | +-w /usr/bin/snap -p x -k software_mgmt 2026-06-22 02:37:38.512553 | debian-bookworm | + 2026-06-22 02:37:38.512655 | debian-bookworm | +# PIP(3) (Python installs) 2026-06-22 02:37:38.512847 | debian-bookworm | +-w /usr/bin/pip -p x -k third_party_software_mgmt 2026-06-22 02:37:38.512871 | debian-bookworm | +-w /usr/local/bin/pip -p x -k third_party_software_mgmt 2026-06-22 02:37:38.512956 | debian-bookworm | +-w /usr/bin/pip3 -p x -k third_party_software_mgmt 2026-06-22 02:37:38.513051 | debian-bookworm | +-w /usr/local/bin/pip3 -p x -k third_party_software_mgmt 2026-06-22 02:37:38.513148 | debian-bookworm | +-w /usr/bin/pipx -p x -k third_party_software_mgmt 2026-06-22 02:37:38.513240 | debian-bookworm | +-w /usr/local/bin/pipx -p x -k third_party_software_mgmt 2026-06-22 02:37:38.513330 | debian-bookworm | + 2026-06-22 02:37:38.513467 | debian-bookworm | +# npm 2026-06-22 02:37:38.513519 | debian-bookworm | +## T1072 third party software 2026-06-22 02:37:38.513612 | debian-bookworm | +## https://www.npmjs.com 2026-06-22 02:37:38.513706 | debian-bookworm | +## https://docs.npmjs.com/cli/v6/commands/npm-audit 2026-06-22 02:37:38.513816 | debian-bookworm | +-w /usr/bin/npm -p x -k third_party_software_mgmt 2026-06-22 02:37:38.513907 | debian-bookworm | + 2026-06-22 02:37:38.514003 | debian-bookworm | +# Comprehensive Perl Archive Network (CPAN) (CPAN installs) 2026-06-22 02:37:38.514099 | debian-bookworm | +## T1072 third party software 2026-06-22 02:37:38.514193 | debian-bookworm | +## https://www.cpan.org 2026-06-22 02:37:38.514287 | debian-bookworm | +-w /usr/bin/cpan -p x -k third_party_software_mgmt 2026-06-22 02:37:38.514377 | debian-bookworm | + 2026-06-22 02:37:38.514472 | debian-bookworm | +# Ruby (RubyGems installs) 2026-06-22 02:37:38.514567 | debian-bookworm | +## T1072 third party software 2026-06-22 02:37:38.514663 | debian-bookworm | +## https://rubygems.org 2026-06-22 02:37:38.514787 | debian-bookworm | +-w /usr/bin/gem -p x -k third_party_software_mgmt 2026-06-22 02:37:38.514879 | debian-bookworm | + 2026-06-22 02:37:38.514973 | debian-bookworm | +# LuaRocks (Lua installs) 2026-06-22 02:37:38.515066 | debian-bookworm | +## T1072 third party software 2026-06-22 02:37:38.515161 | debian-bookworm | +## https://luarocks.org 2026-06-22 02:37:38.515258 | debian-bookworm | +-w /usr/bin/luarocks -p x -k third_party_software_mgmt 2026-06-22 02:37:38.515351 | debian-bookworm | + 2026-06-22 02:37:38.515449 | debian-bookworm | +# Pacman (Arch Linux) 2026-06-22 02:37:38.515542 | debian-bookworm | +## https://wiki.archlinux.org/title/Pacman 2026-06-22 02:37:38.515634 | debian-bookworm | +## T1072 third party software 2026-06-22 02:37:38.515761 | debian-bookworm | +-w /etc/pacman.conf -p x -k third_party_software_mgmt 2026-06-22 02:37:38.515858 | debian-bookworm | +-w /etc/pacman.d -p x -k third_party_software_mgmt 2026-06-22 02:37:38.515947 | debian-bookworm | + 2026-06-22 02:37:38.516042 | debian-bookworm | +# Special Software ------------------------------------------------------------ 2026-06-22 02:37:38.516130 | debian-bookworm | + 2026-06-22 02:37:38.516221 | debian-bookworm | +## GDS specific secrets 2026-06-22 02:37:38.516317 | debian-bookworm | +-w /etc/puppet/ssl -p wa -k puppet_ssl 2026-06-22 02:37:38.516534 | debian-bookworm | + 2026-06-22 02:37:38.516595 | debian-bookworm | +## IBM Bigfix BESClient 2026-06-22 02:37:38.516622 | debian-bookworm | +-a always,exit -F arch=b64 -S open -F dir=/opt/BESClient -F success=0 -k soft_besclient 2026-06-22 02:37:38.516826 | debian-bookworm | +-w /var/opt/BESClient/ -p wa -k soft_besclient 2026-06-22 02:37:38.516853 | debian-bookworm | + 2026-06-22 02:37:38.516877 | debian-bookworm | +## CHEF https://www.chef.io/chef/ 2026-06-22 02:37:38.516992 | debian-bookworm | +-w /etc/chef -p wa -k soft_chef 2026-06-22 02:37:38.517084 | debian-bookworm | + 2026-06-22 02:37:38.517179 | debian-bookworm | +## Salt 2026-06-22 02:37:38.517272 | debian-bookworm | +## https://saltproject.io/ 2026-06-22 02:37:38.517368 | debian-bookworm | +## https://docs.saltproject.io/en/latest/ref/configuration/master.html 2026-06-22 02:37:38.517467 | debian-bookworm | +-w /etc/salt -p wa -k soft_salt 2026-06-22 02:37:38.517561 | debian-bookworm | +-w /usr/local/etc/salt -p wa -k soft_salt 2026-06-22 02:37:38.517651 | debian-bookworm | + 2026-06-22 02:37:38.517764 | debian-bookworm | +## Otter 2026-06-22 02:37:38.517941 | debian-bookworm | +## https://inedo.com/otter 2026-06-22 02:37:38.517963 | debian-bookworm | +-w /etc/otter -p wa -k soft_otter 2026-06-22 02:37:38.518029 | debian-bookworm | + 2026-06-22 02:37:38.518130 | debian-bookworm | +## T1081 Credentials In Files 2026-06-22 02:37:38.518229 | debian-bookworm | +-w /usr/bin/grep -p x -k string_search 2026-06-22 02:37:38.518320 | debian-bookworm | +-w /usr/bin/egrep -p x -k string_search 2026-06-22 02:37:38.518417 | debian-bookworm | +-w /usr/bin/ugrep -p x -k string_search 2026-06-22 02:37:38.518526 | debian-bookworm | +### macOS 2026-06-22 02:37:38.518601 | debian-bookworm | +-w /usr/local/bin/grep -p x -k string_search 2026-06-22 02:37:38.518693 | debian-bookworm | +-w /usr/local/bin/egrep -p x -k string_search 2026-06-22 02:37:38.518825 | debian-bookworm | +-w /usr/local/bin/ugrep -p x -k string_search 2026-06-22 02:37:38.518909 | debian-bookworm | + 2026-06-22 02:37:38.519047 | debian-bookworm | +### https://github.com/tmbinc/bgrep 2026-06-22 02:37:38.519102 | debian-bookworm | +-w /usr/bin/bgrep -p x -k string_search 2026-06-22 02:37:38.519192 | debian-bookworm | +### macOS 2026-06-22 02:37:38.519294 | debian-bookworm | +-w /usr/local/bin/bgrep -p x -k string_search 2026-06-22 02:37:38.519389 | debian-bookworm | + 2026-06-22 02:37:38.519486 | debian-bookworm | +### https://github.com/BurntSushi/ripgrep 2026-06-22 02:37:38.519585 | debian-bookworm | +-w /usr/bin/rg -p x -k string_search 2026-06-22 02:37:38.519672 | debian-bookworm | +### macOS 2026-06-22 02:37:38.519812 | debian-bookworm | +-w /usr/local/bin/rg -p x -k string_search 2026-06-22 02:37:38.519890 | debian-bookworm | + 2026-06-22 02:37:38.519983 | debian-bookworm | +### https://github.com/awgn/cgrep 2026-06-22 02:37:38.520115 | debian-bookworm | + 2026-06-22 02:37:38.520151 | debian-bookworm | +-w /usr/bin/cgrep -p x -k string_search 2026-06-22 02:37:38.520268 | debian-bookworm | +### macOS 2026-06-22 02:37:38.520358 | debian-bookworm | +-w /usr/local/bin/cgrep -p x -k string_search 2026-06-22 02:37:38.520441 | debian-bookworm | + 2026-06-22 02:37:38.520537 | debian-bookworm | +### https://github.com/jpr5/ngrep 2026-06-22 02:37:38.520646 | debian-bookworm | +-w /usr/bin/ngrep -p x -k string_search 2026-06-22 02:37:38.520764 | debian-bookworm | +### macOS 2026-06-22 02:37:38.520954 | debian-bookworm | +-w /usr/local/bin/ngrep -p x -k string_search 2026-06-22 02:37:38.520987 | debian-bookworm | + 2026-06-22 02:37:38.521050 | debian-bookworm | +### https://github.com/vrothberg/vgrep 2026-06-22 02:37:38.521133 | debian-bookworm | +-w /usr/bin/vgrep -p x -k string_search 2026-06-22 02:37:38.521235 | debian-bookworm | +### macOS 2026-06-22 02:37:38.521384 | debian-bookworm | +-w /usr/local/bin/vgrep -p x -k string_search 2026-06-22 02:37:38.521406 | debian-bookworm | + 2026-06-22 02:37:38.521519 | debian-bookworm | +### https://github.com/monochromegane/the_platinum_searcher 2026-06-22 02:37:38.521618 | debian-bookworm | +-w /usr/bin/pt -p x -k string_search 2026-06-22 02:37:38.521758 | debian-bookworm | +### macOS 2026-06-22 02:37:38.521814 | debian-bookworm | +-w /usr/local/bin/pt -p x -k string_search 2026-06-22 02:37:38.521909 | debian-bookworm | + 2026-06-22 02:37:38.521994 | debian-bookworm | +### https://github.com/gvansickle/ucg 2026-06-22 02:37:38.522086 | debian-bookworm | +-w /usr/bin/ucg -p x -k string_search 2026-06-22 02:37:38.522180 | debian-bookworm | +### macOS 2026-06-22 02:37:38.522270 | debian-bookworm | +-w /usr/local/bin/ucg -p x -k string_search 2026-06-22 02:37:38.522363 | debian-bookworm | + 2026-06-22 02:37:38.522509 | debian-bookworm | +### https://github.com/ggreer/the_silver_searcher 2026-06-22 02:37:38.522552 | debian-bookworm | +-w /usr/bin/ag -p x -k string_search 2026-06-22 02:37:38.522655 | debian-bookworm | +### macOS 2026-06-22 02:37:38.522797 | debian-bookworm | +-w /usr/local/bin/ag -p x -k string_search 2026-06-22 02:37:38.522847 | debian-bookworm | + 2026-06-22 02:37:38.522943 | debian-bookworm | +### https://github.com/beyondgrep/ack3 2026-06-22 02:37:38.523035 | debian-bookworm | +### https://beyondgrep.com 2026-06-22 02:37:38.523128 | debian-bookworm | +-w /usr/bin/ack -p x -k string_search 2026-06-22 02:37:38.523223 | debian-bookworm | +-w /usr/local/bin/ack -p x -k string_search 2026-06-22 02:37:38.523321 | debian-bookworm | +-w /usr/bin/semgrep -p x -k string_search 2026-06-22 02:37:38.523440 | debian-bookworm | +### macOS 2026-06-22 02:37:38.523508 | debian-bookworm | +-w /usr/local/bin/semgrep -p x -k string_search 2026-06-22 02:37:38.523603 | debian-bookworm | + 2026-06-22 02:37:38.523813 | debian-bookworm | +## Docker 2026-06-22 02:37:38.524084 | debian-bookworm | +-w /usr/bin/dockerd -k docker 2026-06-22 02:37:38.524100 | debian-bookworm | +-w /usr/bin/docker -k docker 2026-06-22 02:37:38.525646 | debian-bookworm | +-w /usr/bin/docker-containerd -k docker 2026-06-22 02:37:38.525693 | debian-bookworm | +-w /usr/bin/docker-runc -k docker 2026-06-22 02:37:38.525704 | debian-bookworm | +-w /var/lib/docker -p wa -k docker 2026-06-22 02:37:38.525788 | debian-bookworm | +-w /etc/docker -k docker 2026-06-22 02:37:38.525800 | debian-bookworm | +-w /etc/sysconfig/docker -k docker 2026-06-22 02:37:38.525809 | debian-bookworm | +-w /etc/sysconfig/docker-storage -k docker 2026-06-22 02:37:38.525819 | debian-bookworm | +-w /usr/lib/systemd/system/docker.service -k docker 2026-06-22 02:37:38.525829 | debian-bookworm | +-w /usr/lib/systemd/system/docker.socket -k docker 2026-06-22 02:37:38.525839 | debian-bookworm | + 2026-06-22 02:37:38.525849 | debian-bookworm | +## Virtualization stuff 2026-06-22 02:37:38.525858 | debian-bookworm | +-w /usr/bin/qemu-system-x86_64 -p x -k qemu-system-x86_64 2026-06-22 02:37:38.525868 | debian-bookworm | +-w /usr/bin/qemu-img -p x -k qemu-img 2026-06-22 02:37:38.525878 | debian-bookworm | +-w /usr/bin/qemu-kvm -p x -k qemu-kvm 2026-06-22 02:37:38.525887 | debian-bookworm | +-w /usr/bin/qemu -p x -k qemu 2026-06-22 02:37:38.525897 | debian-bookworm | +-w /usr/bin/virtualbox -p x -k virtualbox 2026-06-22 02:37:38.525907 | debian-bookworm | +-w /usr/bin/virt-manager -p x -k virt-manager 2026-06-22 02:37:38.525916 | debian-bookworm | +-w /usr/bin/VBoxManage -p x -k VBoxManage 2026-06-22 02:37:38.525933 | debian-bookworm | + 2026-06-22 02:37:38.525944 | debian-bookworm | +#### VirtualBox on macOS 2026-06-22 02:37:38.525953 | debian-bookworm | + 2026-06-22 02:37:38.525966 | debian-bookworm | +-w /usr/local/bin/VirtualBox -p x -k virt_tool 2026-06-22 02:37:38.526098 | debian-bookworm | +-w /usr/local/bin/VirtualBoxVM -p x -k virt_tool 2026-06-22 02:37:38.526275 | debian-bookworm | +-w /usr/local/bin/VBoxManage -p x -k virt_tool 2026-06-22 02:37:38.526291 | debian-bookworm | +-w /usr/local/bin/VBoxVRDP -p x -k virt_tool 2026-06-22 02:37:38.526395 | debian-bookworm | +-w /usr/local/bin/VBoxHeadless -p x -k virt_tool 2026-06-22 02:37:38.526594 | debian-bookworm | +-w /usr/local/bin/vboxwebsrv -p x -k virt_tool 2026-06-22 02:37:38.526647 | debian-bookworm | +-w /usr/local/bin/VBoxBugReport -p x -k virt_tool 2026-06-22 02:37:38.526792 | debian-bookworm | +-w /usr/local/bin/VBoxBalloonCtrl -p x -k virt_tool 2026-06-22 02:37:38.526941 | debian-bookworm | +-w /usr/local/bin/VBoxAutostart -p x -k virt_tool 2026-06-22 02:37:38.527095 | debian-bookworm | +-w /usr/local/bin/VBoxDTrace -p x -k virt_tool 2026-06-22 02:37:38.527187 | debian-bookworm | +-w /usr/local/bin/vbox-img -p x -k virt_tool 2026-06-22 02:37:38.527288 | debian-bookworm | +-w /Library/LaunchDaemons/org.virtualbox.startup.plist -p x -k virt_tool 2026-06-22 02:37:38.527386 | debian-bookworm | +-w /Library/Application Support/VirtualBox/LaunchDaemons/ -p x -k virt_tool 2026-06-22 02:37:38.527484 | debian-bookworm | +-w /Library/Application Support/VirtualBox/VBoxDrv.kext/ -p x -k virt_tool 2026-06-22 02:37:38.527581 | debian-bookworm | +-w /Library/Application Support/VirtualBox/VBoxUSB.kext/ -p x -k virt_tool 2026-06-22 02:37:38.527678 | debian-bookworm | +-w /Library/Application Support/VirtualBox/VBoxNetFlt.kext/ -p x -k virt_tool 2026-06-22 02:37:38.527873 | debian-bookworm | +-w /Library/Application Support/VirtualBox/VBoxNetAdp.kext/ -p x -k virt_tool 2026-06-22 02:37:38.527897 | debian-bookworm | + 2026-06-22 02:37:38.528003 | debian-bookworm | +### Parallels Desktop on macOS 2026-06-22 02:37:38.528093 | debian-bookworm | + 2026-06-22 02:37:38.528190 | debian-bookworm | +-w /usr/local/bin/prl_convert -p x -k virt_tool 2026-06-22 02:37:38.528283 | debian-bookworm | +-w /usr/local/bin/prl_disk_tool -p x -k virt_tool 2026-06-22 02:37:38.528372 | debian-bookworm | +-w /usr/local/bin/prl_perf_ctl -p x -k virt_tool 2026-06-22 02:37:38.528478 | debian-bookworm | +-w /usr/local/bin/prlcore2dmp -p x -k virt_tool 2026-06-22 02:37:38.528560 | debian-bookworm | +-w /usr/local/bin/prlctl -p x -k virt_tool 2026-06-22 02:37:38.528654 | debian-bookworm | +-w /usr/local/bin/prlexec -p x -k virt_tool 2026-06-22 02:37:38.528785 | debian-bookworm | +-w /usr/local/bin/prlsrvctl -p x -k virt_tool 2026-06-22 02:37:38.528883 | debian-bookworm | +-w /Library/Preferences/Parallels -p x -k virt_tool 2026-06-22 02:37:38.528982 | debian-bookworm | + 2026-06-22 02:37:38.529073 | debian-bookworm | +### qemu on macOS 2026-06-22 02:37:38.529162 | debian-bookworm | + 2026-06-22 02:37:38.529261 | debian-bookworm | +-w /usr/local/bin/qemu-edid -p x -k virt_tool 2026-06-22 02:37:38.529356 | debian-bookworm | +-w /usr/local/bin/qemu-img -p x -k virt_tool 2026-06-22 02:37:38.529452 | debian-bookworm | +-w /usr/local/bin/qemu-io -p x -k virt_tool 2026-06-22 02:37:38.529547 | debian-bookworm | +-w /usr/local/bin/qemu-nbd -p x -k virt_tool 2026-06-22 02:37:38.529643 | debian-bookworm | +-w /usr/local/bin/qemu-system-x86_64 -p x -k virt_tool 2026-06-22 02:37:38.529746 | debian-bookworm | + 2026-06-22 02:37:38.529840 | debian-bookworm | +## Kubelet 2026-06-22 02:37:38.529937 | debian-bookworm | +-w /usr/bin/kubelet -k kubelet 2026-06-22 02:37:38.530069 | debian-bookworm | + 2026-06-22 02:37:38.530122 | debian-bookworm | +# ipc system call 2026-06-22 02:37:38.530216 | debian-bookworm | +# /usr/include/linux/ipc.h 2026-06-22 02:37:38.530306 | debian-bookworm | + 2026-06-22 02:37:38.530399 | debian-bookworm | +## msgctl 2026-06-22 02:37:38.530501 | debian-bookworm | +#-a always,exit -S ipc -F a0=14 -k Inter-Process_Communication 2026-06-22 02:37:38.530595 | debian-bookworm | +## msgget 2026-06-22 02:37:38.530692 | debian-bookworm | +#-a always,exit -S ipc -F a0=13 -k Inter-Process_Communication 2026-06-22 02:37:38.530841 | debian-bookworm | +## Use these lines on x86_64, ia64 instead 2026-06-22 02:37:38.530942 | debian-bookworm | +-a always,exit -F arch=b64 -S msgctl -k Inter-Process_Communication 2026-06-22 02:37:38.531103 | debian-bookworm | +-a always,exit -F arch=b64 -S msgget -k Inter-Process_Communication 2026-06-22 02:37:38.531302 | debian-bookworm | + 2026-06-22 02:37:38.531535 | debian-bookworm | +## semctl 2026-06-22 02:37:38.531671 | debian-bookworm | +#-a always,exit -S ipc -F a0=3 -k Inter-Process_Communication 2026-06-22 02:37:38.531880 | debian-bookworm | +## semget 2026-06-22 02:37:38.531926 | debian-bookworm | +#-a always,exit -S ipc -F a0=2 -k Inter-Process_Communication 2026-06-22 02:37:38.532038 | debian-bookworm | +## semop 2026-06-22 02:37:38.532250 | debian-bookworm | +#-a always,exit -S ipc -F a0=1 -k Inter-Process_Communication 2026-06-22 02:37:38.532336 | debian-bookworm | +## semtimedop 2026-06-22 02:37:38.532451 | debian-bookworm | +#-a always,exit -S ipc -F a0=4 -k Inter-Process_Communication 2026-06-22 02:37:38.532515 | debian-bookworm | +## Use these lines on x86_64, ia64 instead 2026-06-22 02:37:38.532667 | debian-bookworm | +-a always,exit -F arch=b64 -S semctl -k Inter-Process_Communication 2026-06-22 02:37:38.532873 | debian-bookworm | +-a always,exit -F arch=b64 -S semget -k Inter-Process_Communication 2026-06-22 02:37:38.532920 | debian-bookworm | +-a always,exit -F arch=b64 -S semop -k Inter-Process_Communication 2026-06-22 02:37:38.533160 | debian-bookworm | +-a always,exit -F arch=b64 -S semtimedop -k Inter-Process_Communication 2026-06-22 02:37:38.533340 | debian-bookworm | + 2026-06-22 02:37:38.533522 | debian-bookworm | +## shmctl 2026-06-22 02:37:38.533599 | debian-bookworm | +#-a always,exit -S ipc -F a0=24 -k Inter-Process_Communication 2026-06-22 02:37:38.533855 | debian-bookworm | +## shmget 2026-06-22 02:37:38.534014 | debian-bookworm | +#-a always,exit -S ipc -F a0=23 -k Inter-Process_Communication 2026-06-22 02:37:38.534074 | debian-bookworm | +## Use these lines on x86_64, ia64 instead 2026-06-22 02:37:38.534223 | debian-bookworm | +-a always,exit -F arch=b64 -S shmctl -k Inter-Process_Communication 2026-06-22 02:37:38.534348 | debian-bookworm | +-a always,exit -F arch=b64 -S shmget -k Inter-Process_Communication 2026-06-22 02:37:38.534479 | debian-bookworm | + 2026-06-22 02:37:38.534658 | debian-bookworm | +# High Volume Events ---------------------------------------------------------- 2026-06-22 02:37:38.534910 | debian-bookworm | + 2026-06-22 02:37:38.534928 | debian-bookworm | +## Disable these rules if they create too many events in your environment 2026-06-22 02:37:38.535103 | debian-bookworm | + 2026-06-22 02:37:38.535402 | debian-bookworm | +## Common Shells 2026-06-22 02:37:38.535457 | debian-bookworm | +-w /bin/bash -p x -k susp_shell 2026-06-22 02:37:38.535626 | debian-bookworm | +-w /bin/dash -p x -k susp_shell 2026-06-22 02:37:38.535856 | debian-bookworm | +-w /bin/busybox -p x -k susp_shell 2026-06-22 02:37:38.535901 | debian-bookworm | +-w /bin/zsh -p x -k susp_shell 2026-06-22 02:37:38.535938 | debian-bookworm | +-w /bin/sh -p x -k susp_shell 2026-06-22 02:37:38.536062 | debian-bookworm | +-w /bin/ksh -p x -k susp_shell 2026-06-22 02:37:38.536222 | debian-bookworm | + 2026-06-22 02:37:38.536278 | debian-bookworm | +## Root command executions 2026-06-22 02:37:38.536304 | debian-bookworm | +-a always,exit -F arch=b64 -F euid=0 -F auid>=1000 -F auid!=-1 -S execve -k rootcmd 2026-06-22 02:37:38.536482 | debian-bookworm | + 2026-06-22 02:37:38.536745 | debian-bookworm | +## File Deletion Events by User 2026-06-22 02:37:38.536931 | debian-bookworm | +-a always,exit -F arch=b64 -S rmdir -S unlink -S unlinkat -S rename -S renameat -F auid>=1000 -F auid!=-1 -k delete 2026-06-22 02:37:38.537213 | debian-bookworm | + 2026-06-22 02:37:38.537230 | debian-bookworm | +## File Access 2026-06-22 02:37:38.537289 | debian-bookworm | +### Unauthorized Access (unsuccessful) 2026-06-22 02:37:38.537500 | debian-bookworm | +-a always,exit -F arch=b64 -S creat -S open -S openat -S open_by_handle_at -S truncate -S ftruncate -F exit=-EACCES -F auid>=1000 -F auid!=-1 -k file_access 2026-06-22 02:37:38.537929 | debian-bookworm | +-a always,exit -F arch=b64 -S creat -S open -S openat -S open_by_handle_at -S truncate -S ftruncate -F exit=-EPERM -F auid>=1000 -F auid!=-1 -k file_access 2026-06-22 02:37:38.538153 | debian-bookworm | + 2026-06-22 02:37:38.538250 | debian-bookworm | +### Unsuccessful Creation 2026-06-22 02:37:38.538486 | debian-bookworm | +-a always,exit -F arch=b64 -S mkdir,creat,link,symlink,mknod,mknodat,linkat,symlinkat -F exit=-EACCES -k file_creation 2026-06-22 02:37:38.538634 | debian-bookworm | +-a always,exit -F arch=b64 -S mkdir,link,symlink,mkdirat -F exit=-EPERM -k file_creation 2026-06-22 02:37:38.538819 | debian-bookworm | + 2026-06-22 02:37:38.538915 | debian-bookworm | +### Unsuccessful Modification 2026-06-22 02:37:38.539014 | debian-bookworm | +-a always,exit -F arch=b64 -S rename -S renameat -S truncate -S chmod -S setxattr -S lsetxattr -S removexattr -S lremovexattr -F exit=-EACCES -k file_modification 2026-06-22 02:37:38.539118 | debian-bookworm | +-a always,exit -F arch=b64 -S rename -S renameat -S truncate -S chmod -S setxattr -S lsetxattr -S removexattr -S lremovexattr -F exit=-EPERM -k file_modification 2026-06-22 02:37:38.539202 | debian-bookworm | + 2026-06-22 02:37:38.539344 | debian-bookworm | +## 32bit API Exploitation 2026-06-22 02:37:38.539487 | debian-bookworm | +### If you are on a 64 bit platform, everything _should_ be running 2026-06-22 02:37:38.539614 | debian-bookworm | +### in 64 bit mode. This rule will detect any use of the 32 bit syscalls 2026-06-22 02:37:38.539882 | debian-bookworm | +### because this might be a sign of someone exploiting a hole in the 32 2026-06-22 02:37:38.539917 | debian-bookworm | +### bit API. 2026-06-22 02:37:38.539945 | debian-bookworm | +-a always,exit -F arch=b32 -S all -k 32bit_api 2026-06-22 02:37:38.540079 | debian-bookworm | + 2026-06-22 02:37:38.540132 | debian-bookworm | +# Make The Configuration Immutable -------------------------------------------- 2026-06-22 02:37:38.540225 | debian-bookworm | + 2026-06-22 02:37:38.540326 | debian-bookworm | +##-e 2 2026-06-22 02:37:38.540411 | debian-bookworm | 2026-06-22 02:37:38.540964 | debian-bookworm | changed: [molecule-auditd] => (item=20-neo23x0.rules) => {"ansible_loop_var": "item", "changed": true, "checksum": "9f99ce5c4f891fbf3e2bce06ed4cb97fb9e01f41", "dest": "/etc/audit/rules.d/20-neo23x0.rules", "gid": 0, "group": "root", "item": "20-neo23x0.rules", "md5sum": "6ac57206fd77de34805c3f4d50ef8b1d", "mode": "0644", "owner": "root", "size": 27367, "src": "/home/zuul/.ansible/tmp/ansible-tmp-1782095857.3944333-2709-54111904482544/.source.rules", "state": "file", "uid": 0} 2026-06-22 02:37:38.541178 | debian-bookworm | 2026-06-22 02:37:38.541261 | debian-bookworm | TASK [auditd : Manage auditd service] ****************************************** 2026-06-22 02:37:38.859698 | ubuntu-noble | --- before 2026-06-22 02:37:38.860014 | ubuntu-noble | +++ after: /home/zuul/.ansible/tmp/ansible-local-20637iu9h0dg/tmp5tdpxnht/auditd.conf.j2 2026-06-22 02:37:38.860304 | ubuntu-noble | @@ -0,0 +1,37 @@ 2026-06-22 02:37:38.860670 | ubuntu-noble | +# 2026-06-22 02:37:38.860980 | ubuntu-noble | +# This file controls the configuration of the audit daemon 2026-06-22 02:37:38.861197 | ubuntu-noble | +# 2026-06-22 02:37:38.861740 | ubuntu-noble | + 2026-06-22 02:37:38.861893 | ubuntu-noble | +local_events = yes 2026-06-22 02:37:38.862241 | ubuntu-noble | +write_logs = yes 2026-06-22 02:37:38.862611 | ubuntu-noble | +log_file = /var/log/audit/audit.log 2026-06-22 02:37:38.863829 | ubuntu-noble | +log_group = adm 2026-06-22 02:37:38.863856 | ubuntu-noble | +log_format = RAW 2026-06-22 02:37:38.863861 | ubuntu-noble | +flush = INCREMENTAL_ASYNC 2026-06-22 02:37:38.863865 | ubuntu-noble | +freq = 50 2026-06-22 02:37:38.864015 | ubuntu-noble | +max_log_file = 8 2026-06-22 02:37:38.864247 | ubuntu-noble | +num_logs = 5 2026-06-22 02:37:38.864510 | ubuntu-noble | +priority_boost = 4 2026-06-22 02:37:38.864835 | ubuntu-noble | +disp_qos = lossy 2026-06-22 02:37:38.865103 | ubuntu-noble | +dispatcher = /sbin/audispd 2026-06-22 02:37:38.865479 | ubuntu-noble | +name_format = NONE 2026-06-22 02:37:38.867310 | ubuntu-noble | +##name = mydomain 2026-06-22 02:37:38.867630 | ubuntu-noble | +max_log_file_action = ROTATE 2026-06-22 02:37:38.867861 | ubuntu-noble | +space_left = 12361 2026-06-22 02:37:38.868044 | ubuntu-noble | +space_left_action = email 2026-06-22 02:37:38.868223 | ubuntu-noble | +verify_email = yes 2026-06-22 02:37:38.868396 | ubuntu-noble | +action_mail_acct = root 2026-06-22 02:37:38.868591 | ubuntu-noble | +admin_space_left = 50 2026-06-22 02:37:38.868814 | ubuntu-noble | +admin_space_left_action = SUSPEND 2026-06-22 02:37:38.868999 | ubuntu-noble | +disk_full_action = SUSPEND 2026-06-22 02:37:38.869182 | ubuntu-noble | +disk_error_action = SUSPEND 2026-06-22 02:37:38.869411 | ubuntu-noble | +use_libwrap = yes 2026-06-22 02:37:38.869590 | ubuntu-noble | +##tcp_listen_port = 60 2026-06-22 02:37:38.870752 | ubuntu-noble | +tcp_listen_queue = 5 2026-06-22 02:37:38.870783 | ubuntu-noble | +tcp_max_per_addr = 1 2026-06-22 02:37:38.870791 | ubuntu-noble | +##tcp_client_ports = 1024-65535 2026-06-22 02:37:38.870798 | ubuntu-noble | +tcp_client_max_idle = 0 2026-06-22 02:37:38.870804 | ubuntu-noble | +enable_krb5 = no 2026-06-22 02:37:38.870810 | ubuntu-noble | +krb5_principal = auditd 2026-06-22 02:37:38.870821 | ubuntu-noble | +##krb5_key_file = /etc/audit/audit.key 2026-06-22 02:37:38.870909 | ubuntu-noble | +distribute_network = no 2026-06-22 02:37:38.871061 | ubuntu-noble | 2026-06-22 02:37:38.871272 | ubuntu-noble | changed: [molecule-auditd] => {"changed": true, "checksum": "e902cc6bebf86c17087d153e359a2cc1231672e0", "dest": "/etc/audit/audit.conf", "gid": 0, "group": "root", "md5sum": "69dfd768317bae876a6a78c8aeb5cce1", "mode": "0640", "owner": "root", "size": 806, "src": "/home/zuul/.ansible/tmp/ansible-tmp-1782095857.1014-2460-251145532853678/.source.conf", "state": "file", "uid": 0} 2026-06-22 02:37:38.871400 | ubuntu-noble | 2026-06-22 02:37:38.871594 | ubuntu-noble | TASK [auditd : Adjust auditd/audispd configurations] *************************** 2026-06-22 02:37:39.510256 | ubuntu-noble | ok: [molecule-auditd] => (item={'parameter': 'active', 'value': 'no', 'config': '/etc/audit/plugins.d/syslog.conf'}) => {"ansible_loop_var": "item", "backup": "", "changed": false, "item": {"config": "/etc/audit/plugins.d/syslog.conf", "parameter": "active", "value": "no"}, "msg": ""} 2026-06-22 02:37:39.510513 | ubuntu-noble | 2026-06-22 02:37:39.510696 | ubuntu-noble | TASK [auditd : Deploy rules for auditd] **************************************** 2026-06-22 02:37:39.460107 | debian-bookworm | ok: [molecule-auditd] => {"changed": false, "enabled": true, "name": "auditd", "state": "started", "status": {"ActiveEnterTimestamp": "Mon 2026-06-22 02:37:31 UTC", "ActiveEnterTimestampMonotonic": "4062976118", "ActiveExitTimestampMonotonic": "0", "ActiveState": "active", "After": "systemd-tmpfiles-setup.service system.slice local-fs.target systemd-journald.socket", "AllowIsolate": "no", "AssertResult": "yes", "AssertTimestamp": "Mon 2026-06-22 02:37:31 UTC", "AssertTimestampMonotonic": "4062895599", "Before": "shutdown.target ssh.service systemd-update-utmp.service sysinit.target", "BlockIOAccounting": "no", "BlockIOWeight": "[not set]", "CPUAccounting": "yes", "CPUAffinityFromNUMA": "no", "CPUQuotaPerSecUSec": "infinity", "CPUQuotaPeriodUSec": "infinity", "CPUSchedulingPolicy": "0", "CPUSchedulingPriority": "0", "CPUSchedulingResetOnFork": "no", "CPUShares": "[not set]", "CPUUsageNSec": "51504000", "CPUWeight": "[not set]", "CacheDirectoryMode": "0755", "CanFreeze": "yes", "CanIsolate": "no", "CanReload": "no", "CanStart": "yes", "CanStop": "yes", "CapabilityBoundingSet": "cap_chown cap_dac_override cap_dac_read_search cap_fowner cap_fsetid cap_kill cap_setgid cap_setuid cap_setpcap cap_linux_immutable cap_net_bind_service cap_net_broadcast cap_net_admin cap_net_raw cap_ipc_lock cap_ipc_owner cap_sys_rawio cap_sys_chroot cap_sys_ptrace cap_sys_pacct cap_sys_admin cap_sys_boot cap_sys_nice cap_sys_resource cap_sys_time cap_sys_tty_config cap_mknod cap_lease cap_audit_write cap_audit_control cap_setfcap cap_mac_override cap_mac_admin cap_syslog cap_wake_alarm cap_block_suspend cap_audit_read cap_perfmon cap_bpf cap_checkpoint_restore", "CleanResult": "success", "CollectMode": "inactive", "ConditionResult": "yes", "ConditionTimestamp": "Mon 2026-06-22 02:37:31 UTC", "ConditionTimestampMonotonic": "4062895552", "ConfigurationDirectoryMode": "0755", "Conflicts": "shutdown.target", "ControlGroup": "/system.slice/auditd.service", "ControlGroupId": "3328", "ControlPID": "0", "CoredumpFilter": "0x33", "DefaultDependencies": "no", "DefaultMemoryLow": "0", "DefaultMemoryMin": "0", "Delegate": "no", "Description": "Security Auditing Service", "DevicePolicy": "auto", "Documentation": "\"man:auditd(8)\" https://github.com/linux-audit/audit-documentation", "DynamicUser": "no", "ExecMainCode": "0", "ExecMainExitTimestampMonotonic": "0", "ExecMainPID": "2480", "ExecMainStartTimestamp": "Mon 2026-06-22 02:37:31 UTC", "ExecMainStartTimestampMonotonic": "4062945660", "ExecMainStatus": "0", "ExecStart": "{ path=/sbin/auditd ; argv[]=/sbin/auditd ; ignore_errors=no ; start_time=[Mon 2026-06-22 02:37:31 UTC] ; stop_time=[Mon 2026-06-22 02:37:31 UTC] ; pid=2479 ; code=exited ; status=0 }", "ExecStartEx": "{ path=/sbin/auditd ; argv[]=/sbin/auditd ; flags= ; start_time=[Mon 2026-06-22 02:37:31 UTC] ; stop_time=[Mon 2026-06-22 02:37:31 UTC] ; pid=2479 ; code=exited ; status=0 }", "ExecStartPost": "{ path=/sbin/augenrules ; argv[]=/sbin/augenrules --load ; ignore_errors=yes ; start_time=[Mon 2026-06-22 02:37:31 UTC] ; stop_time=[Mon 2026-06-22 02:37:31 UTC] ; pid=2483 ; code=exited ; status=0 }", "ExecStartPostEx": "{ path=/sbin/augenrules ; argv[]=/sbin/augenrules --load ; flags=ignore-failure ; start_time=[Mon 2026-06-22 02:37:31 UTC] ; stop_time=[Mon 2026-06-22 02:37:31 UTC] ; pid=2483 ; code=exited ; status=0 }", "ExitType": "main", "FailureAction": "none", "FileDescriptorStoreMax": "0", "FinalKillSignal": "9", "FragmentPath": "/lib/systemd/system/auditd.service", "FreezerState": "running", "GID": "[not set]", "GuessMainPID": "yes", "IOAccounting": "no", "IOReadBytes": "18446744073709551615", "IOReadOperations": "18446744073709551615", "IOSchedulingClass": "2", "IOSchedulingPriority": "4", "IOWeight": "[not set]", "IOWriteBytes": "18446744073709551615", "IOWriteOperations": "18446744073709551615", "IPAccounting": "no", "IPEgressBytes": "[no data]", "IPEgressPackets": "[no data]", "IPIngressBytes": "[no data]", "IPIngressPackets": "[no data]", "Id": "auditd.service", "IgnoreOnIsolate": "no", "IgnoreSIGPIPE": "yes", "InactiveEnterTimestampMonotonic": "0", "InactiveExitTimestamp": "Mon 2026-06-22 02:37:31 UTC", "InactiveExitTimestampMonotonic": "4062925591", "InvocationID": "7d5b4cf90c1c4b7db31d6d1a676de32d", "JobRunningTimeoutUSec": "infinity", "JobTimeoutAction": "none", "JobTimeoutUSec": "infinity", "KeyringMode": "private", "KillMode": "control-group", "KillSignal": "15", "LimitAS": "infinity", "LimitASSoft": "infinity", "LimitCORE": "infinity", "LimitCORESoft": "0", "LimitCPU": "infinity", "LimitCPUSoft": "infinity", "LimitDATA": "infinity", "LimitDATASoft": "infinity", "LimitFSIZE": "infinity", "LimitFSIZESoft": "infinity", "LimitLOCKS": "infinity", "LimitLOCKSSoft": "infinity", "LimitMEMLOCK": "8388608", "LimitMEMLOCKSoft": "8388608", "LimitMSGQUEUE": "819200", "LimitMSGQUEUESoft": "819200", "LimitNICE": "0", "LimitNICESoft": "0", "LimitNOFILE": "524288", "LimitNOFILESoft": "1024", "LimitNPROC": "15480", "LimitNPROCSoft": "15480", "LimitRSS": "infinity", "LimitRSSSoft": "infinity", "LimitRTPRIO": "0", "LimitRTPRIOSoft": "0", "LimitRTTIME": "infinity", "LimitRTTIMESoft": "infinity", "LimitSIGPENDING": "15480", "LimitSIGPENDINGSoft": "15480", "LimitSTACK": "infinity", "LimitSTACKSoft": "8388608", "LoadState": "loaded", "LockPersonality": "yes", "LogLevelMax": "-1", "LogRateLimitBurst": "0", "LogRateLimitIntervalUSec": "0", "LogsDirectoryMode": "0755", "MainPID": "2480", "ManagedOOMMemoryPressure": "auto", "ManagedOOMMemoryPressureLimit": "0", "ManagedOOMPreference": "none", "ManagedOOMSwap": "auto", "MemoryAccounting": "yes", "MemoryAvailable": "infinity", "MemoryCurrent": "712704", "MemoryDenyWriteExecute": "yes", "MemoryHigh": "infinity", "MemoryLimit": "infinity", "MemoryLow": "0", "MemoryMax": "infinity", "MemoryMin": "0", "MemorySwapMax": "infinity", "MountAPIVFS": "no", "NFileDescriptorStore": "0", "NRestarts": "0", "NUMAPolicy": "n/a", "Names": "auditd.service", "NeedDaemonReload": "no", "Nice": "0", "NoNewPrivileges": "no", "NonBlocking": "no", "NotifyAccess": "none", "OOMPolicy": "stop", "OOMScoreAdjust": "0", "OnFailureJobMode": "replace", "OnSuccessJobMode": "fail", "PIDFile": "/run/auditd.pid", "Perpetual": "no", "PrivateDevices": "no", "PrivateIPC": "no", "PrivateMounts": "no", "PrivateNetwork": "no", "PrivateTmp": "no", "PrivateUsers": "no", "ProcSubset": "all", "ProtectClock": "no", "ProtectControlGroups": "yes", "ProtectHome": "no", "ProtectHostname": "no", "ProtectKernelLogs": "no", "ProtectKernelModules": "yes", "ProtectKernelTunables": "no", "ProtectProc": "default", "ProtectSystem": "no", "RefuseManualStart": "no", "RefuseManualStop": "no", "ReloadResult": "success", "RemainAfterExit": "no", "RemoveIPC": "no", "Requires": "system.slice", "Restart": "on-failure", "RestartKillSignal": "15", "RestartPreventExitStatus": "2 4 6", "RestartUSec": "100ms", "RestrictNamespaces": "no", "RestrictRealtime": "yes", "RestrictSUIDSGID": "no", "Result": "success", "RootDirectoryStartOnly": "no", "RuntimeDirectoryMode": "0755", "RuntimeDirectoryPreserve": "no", "RuntimeMaxUSec": "infinity", "RuntimeRandomizedExtraUSec": "0", "SameProcessGroup": "no", "SecureBits": "0", "SendSIGHUP": "no", "SendSIGKILL": "yes", "Slice": "system.slice", "StandardError": "inherit", "StandardInput": "null", "StandardOutput": "journal", "StartLimitAction": "none", "StartLimitBurst": "5", "StartLimitIntervalUSec": "10s", "StartupBlockIOWeight": "[not set]", "StartupCPUShares": "[not set]", "StartupCPUWeight": "[not set]", "StartupIOWeight": "[not set]", "StateChangeTimestamp": "Mon 2026-06-22 02:37:31 UTC", "StateChangeTimestampMonotonic": "4062976118", "StateDirectoryMode": "0755", "StatusErrno": "0", "StopWhenUnneeded": "no", "SubState": "running", "SuccessAction": "none", "SyslogFacility": "3", "SyslogLevel": "6", "SyslogLevelPrefix": "yes", "SyslogPriority": "30", "SystemCallErrorNumber": "2147483646", "TTYReset": "no", "TTYVHangup": "no", "TTYVTDisallocate": "no", "TasksAccounting": "yes", "TasksCurrent": "2", "TasksMax": "4644", "TimeoutAbortUSec": "1min 30s", "TimeoutCleanUSec": "infinity", "TimeoutStartFailureMode": "terminate", "TimeoutStartUSec": "1min 30s", "TimeoutStopFailureMode": "terminate", "TimeoutStopUSec": "1min 30s", "TimerSlackNSec": "50000", "Transient": "no", "Type": "forking", "UID": "[not set]", "UMask": "0022", "UnitFilePreset": "enabled", "UnitFileState": "enabled", "UtmpMode": "init", "WantedBy": "multi-user.target", "WatchdogSignal": "6", "WatchdogTimestampMonotonic": "0", "WatchdogUSec": "0"}} 2026-06-22 02:37:39.468496 | debian-bookworm | 2026-06-22 02:37:39.468582 | debian-bookworm | TASK [auditd : List existing rules files] ************************************** 2026-06-22 02:37:40.061318 | debian-bookworm | ok: [molecule-auditd] => {"changed": false, "cmd": ["find", "/etc/audit/rules.d", "-type", "f", "-printf", "%f\n"], "delta": "0:00:00.008974", "end": "2026-06-22 02:37:40.012518", "msg": "", "rc": 0, "start": "2026-06-22 02:37:40.003544", "stderr": "", "stderr_lines": [], "stdout": "audit.rules\n20-neo23x0.rules", "stdout_lines": ["audit.rules", "20-neo23x0.rules"]} 2026-06-22 02:37:40.061421 | debian-bookworm | 2026-06-22 02:37:40.061442 | debian-bookworm | TASK [auditd : Remove unmanaged rules files] *********************************** 2026-06-22 02:37:40.708864 | ubuntu-noble | --- before 2026-06-22 02:37:40.711298 | ubuntu-noble | +++ after: /home/zuul/.ansible/tmp/ansible-local-20637iu9h0dg/tmp6rncaavq/20-neo23x0.rules.j2 2026-06-22 02:37:40.711653 | ubuntu-noble | @@ -0,0 +1,750 @@ 2026-06-22 02:37:40.712003 | ubuntu-noble | +# ___ ___ __ __ 2026-06-22 02:37:40.712273 | ubuntu-noble | +# / | __ ______/ (_) /_____/ / 2026-06-22 02:37:40.713743 | ubuntu-noble | +# / /| |/ / / / __ / / __/ __ / 2026-06-22 02:37:40.713767 | ubuntu-noble | +# / ___ / /_/ / /_/ / / /_/ /_/ / 2026-06-22 02:37:40.713772 | ubuntu-noble | +# /_/ |_\__,_/\__,_/_/\__/\__,_/ 2026-06-22 02:37:40.713775 | ubuntu-noble | +# 2026-06-22 02:37:40.714068 | ubuntu-noble | +# Linux Audit Daemon - Best Practice Configuration 2026-06-22 02:37:40.714361 | ubuntu-noble | +# /etc/audit/audit.rules 2026-06-22 02:37:40.714676 | ubuntu-noble | +# 2026-06-22 02:37:40.715016 | ubuntu-noble | +# Compiled by Florian Roth 2026-06-22 02:37:40.715289 | ubuntu-noble | +# 2026-06-22 02:37:40.715557 | ubuntu-noble | +# Created : 2017/12/05 2026-06-22 02:37:40.715902 | ubuntu-noble | +# Modified : 2023/01/25 2026-06-22 02:37:40.716202 | ubuntu-noble | +# 2026-06-22 02:37:40.716583 | ubuntu-noble | +# Based on rules published here: 2026-06-22 02:37:40.716910 | ubuntu-noble | +# Gov.uk auditd rules 2026-06-22 02:37:40.717581 | ubuntu-noble | +# https://github.com/gds-operations/puppet-auditd/pull/1 2026-06-22 02:37:40.718090 | ubuntu-noble | +# CentOS 7 hardening 2026-06-22 02:37:40.718565 | ubuntu-noble | +# https://highon.coffee/blog/security-harden-centos-7/#auditd---audit-daemon 2026-06-22 02:37:40.718959 | ubuntu-noble | +# Linux audit repo 2026-06-22 02:37:40.719240 | ubuntu-noble | +# https://github.com/linux-audit/audit-userspace/tree/master/rules 2026-06-22 02:37:40.719498 | ubuntu-noble | +# Auditd high performance linux auditing 2026-06-22 02:37:40.719804 | ubuntu-noble | +# https://linux-audit.com/tuning-auditd-high-performance-linux-auditing/ 2026-06-22 02:37:40.719976 | ubuntu-noble | +# 2026-06-22 02:37:40.720139 | ubuntu-noble | +# Further rules 2026-06-22 02:37:40.720378 | ubuntu-noble | +# For PCI DSS compliance see: 2026-06-22 02:37:40.720690 | ubuntu-noble | +# https://github.com/linux-audit/audit-userspace/blob/master/rules/30-pci-dss-v31.rules 2026-06-22 02:37:40.720950 | ubuntu-noble | +# For NISPOM compliance see: 2026-06-22 02:37:40.721173 | ubuntu-noble | +# https://github.com/linux-audit/audit-userspace/blob/master/rules/30-nispom.rules 2026-06-22 02:37:40.721317 | ubuntu-noble | + 2026-06-22 02:37:40.721480 | ubuntu-noble | +# Remove any existing rules 2026-06-22 02:37:40.721614 | ubuntu-noble | +-D 2026-06-22 02:37:40.721787 | ubuntu-noble | + 2026-06-22 02:37:40.721935 | ubuntu-noble | +# Buffer Size 2026-06-22 02:37:40.722080 | ubuntu-noble | +## Feel free to increase this if the machine panic's 2026-06-22 02:37:40.722279 | ubuntu-noble | +-b 8192 2026-06-22 02:37:40.722422 | ubuntu-noble | + 2026-06-22 02:37:40.722597 | ubuntu-noble | +# Failure Mode 2026-06-22 02:37:40.722772 | ubuntu-noble | +## Possible values: 0 (silent), 1 (printk, print a failure message), 2 (panic, halt the system) 2026-06-22 02:37:40.722910 | ubuntu-noble | +-f 1 2026-06-22 02:37:40.723047 | ubuntu-noble | + 2026-06-22 02:37:40.723187 | ubuntu-noble | +# Ignore errors 2026-06-22 02:37:40.723338 | ubuntu-noble | +## e.g. caused by users or files not found in the local environment 2026-06-22 02:37:40.723513 | ubuntu-noble | +-i 2026-06-22 02:37:40.723647 | ubuntu-noble | + 2026-06-22 02:37:40.723811 | ubuntu-noble | +# Self Auditing --------------------------------------------------------------- 2026-06-22 02:37:40.723942 | ubuntu-noble | + 2026-06-22 02:37:40.724070 | ubuntu-noble | +## Audit the audit logs 2026-06-22 02:37:40.724254 | ubuntu-noble | +### Successful and unsuccessful attempts to read information from the audit records 2026-06-22 02:37:40.724463 | ubuntu-noble | +-w /var/log/audit/ -p wra -k auditlog 2026-06-22 02:37:40.724600 | ubuntu-noble | +-w /var/audit/ -p wra -k auditlog 2026-06-22 02:37:40.724744 | ubuntu-noble | + 2026-06-22 02:37:40.724873 | ubuntu-noble | +## Auditd configuration 2026-06-22 02:37:40.725005 | ubuntu-noble | +### Modifications to audit configuration that occur while the audit collection functions are operating 2026-06-22 02:37:40.725131 | ubuntu-noble | +-w /etc/audit/ -p wa -k auditconfig 2026-06-22 02:37:40.725259 | ubuntu-noble | +-w /etc/libaudit.conf -p wa -k auditconfig 2026-06-22 02:37:40.726736 | ubuntu-noble | +-w /etc/audisp/ -p wa -k audispconfig 2026-06-22 02:37:40.726759 | ubuntu-noble | + 2026-06-22 02:37:40.726764 | ubuntu-noble | +## Monitor for use of audit management tools 2026-06-22 02:37:40.726767 | ubuntu-noble | +-w /sbin/auditctl -p x -k audittools 2026-06-22 02:37:40.726771 | ubuntu-noble | +-w /sbin/auditd -p x -k audittools 2026-06-22 02:37:40.726774 | ubuntu-noble | +-w /usr/sbin/auditd -p x -k audittools 2026-06-22 02:37:40.726778 | ubuntu-noble | +-w /usr/sbin/augenrules -p x -k audittools 2026-06-22 02:37:40.726781 | ubuntu-noble | + 2026-06-22 02:37:40.726785 | ubuntu-noble | +## Access to all audit trails 2026-06-22 02:37:40.726789 | ubuntu-noble | + 2026-06-22 02:37:40.726795 | ubuntu-noble | +-a always,exit -F path=/usr/sbin/ausearch -F perm=x -k audittools 2026-06-22 02:37:40.726893 | ubuntu-noble | +-a always,exit -F path=/usr/sbin/aureport -F perm=x -k audittools 2026-06-22 02:37:40.727029 | ubuntu-noble | +-a always,exit -F path=/usr/sbin/aulast -F perm=x -k audittools 2026-06-22 02:37:40.727154 | ubuntu-noble | +-a always,exit -F path=/usr/sbin/aulastlogin -F perm=x -k audittools 2026-06-22 02:37:40.727276 | ubuntu-noble | +-a always,exit -F path=/usr/sbin/auvirt -F perm=x -k audittools 2026-06-22 02:37:40.727391 | ubuntu-noble | + 2026-06-22 02:37:40.727525 | ubuntu-noble | +# Filters --------------------------------------------------------------------- 2026-06-22 02:37:40.727641 | ubuntu-noble | + 2026-06-22 02:37:40.727782 | ubuntu-noble | +### We put these early because audit is a first match wins system. 2026-06-22 02:37:40.727931 | ubuntu-noble | + 2026-06-22 02:37:40.728066 | ubuntu-noble | +## Ignore SELinux AVC records 2026-06-22 02:37:40.728191 | ubuntu-noble | +-a always,exclude -F msgtype=AVC 2026-06-22 02:37:40.728299 | ubuntu-noble | + 2026-06-22 02:37:40.728420 | ubuntu-noble | +## Ignore current working directory records 2026-06-22 02:37:40.728558 | ubuntu-noble | +-a always,exclude -F msgtype=CWD 2026-06-22 02:37:40.728675 | ubuntu-noble | + 2026-06-22 02:37:40.728821 | ubuntu-noble | +## Cron jobs fill the logs with stuff we normally don't want (works with SELinux) 2026-06-22 02:37:40.728940 | ubuntu-noble | +-a never,user -F subj_type=crond_t 2026-06-22 02:37:40.729065 | ubuntu-noble | +-a never,exit -F subj_type=crond_t 2026-06-22 02:37:40.729178 | ubuntu-noble | + 2026-06-22 02:37:40.729300 | ubuntu-noble | +## This prevents chrony from overwhelming the logs 2026-06-22 02:37:40.729424 | ubuntu-noble | +-a never,exit -F arch=b64 -S adjtimex -F auid=-1 -F uid=chrony -F subj_type=chronyd_t 2026-06-22 02:37:40.729573 | ubuntu-noble | + 2026-06-22 02:37:40.729686 | ubuntu-noble | +## This is not very interesting and wastes a lot of space if the server is public facing 2026-06-22 02:37:40.729816 | ubuntu-noble | +-a always,exclude -F msgtype=CRYPTO_KEY_USER 2026-06-22 02:37:40.729917 | ubuntu-noble | + 2026-06-22 02:37:40.730025 | ubuntu-noble | +## Open VM Tools 2026-06-22 02:37:40.730166 | ubuntu-noble | +-a exit,never -F arch=b64 -S all -F exe=/usr/bin/vmtoolsd 2026-06-22 02:37:40.730280 | ubuntu-noble | + 2026-06-22 02:37:40.730396 | ubuntu-noble | +## High Volume Event Filter (especially on Linux Workstations) 2026-06-22 02:37:40.730537 | ubuntu-noble | +-a never,exit -F arch=b64 -F dir=/dev/shm -k sharedmemaccess 2026-06-22 02:37:40.730650 | ubuntu-noble | +-a never,exit -F arch=b64 -F dir=/var/lock/lvm -k locklvm 2026-06-22 02:37:40.730771 | ubuntu-noble | + 2026-06-22 02:37:40.730916 | ubuntu-noble | +## FileBeat 2026-06-22 02:37:40.731032 | ubuntu-noble | +-a never,exit -F arch=b64 -F path=/opt/filebeat -k filebeat 2026-06-22 02:37:40.731163 | ubuntu-noble | + 2026-06-22 02:37:40.731249 | ubuntu-noble | +## More information on how to filter events 2026-06-22 02:37:40.731364 | ubuntu-noble | +### https://access.redhat.com/solutions/2482221 2026-06-22 02:37:40.731504 | ubuntu-noble | + 2026-06-22 02:37:40.731614 | ubuntu-noble | +# Rules ----------------------------------------------------------------------- 2026-06-22 02:37:40.731734 | ubuntu-noble | + 2026-06-22 02:37:40.731849 | ubuntu-noble | +## Kernel parameters 2026-06-22 02:37:40.731971 | ubuntu-noble | +-w /etc/sysctl.conf -p wa -k sysctl 2026-06-22 02:37:40.732071 | ubuntu-noble | +-w /etc/sysctl.d -p wa -k sysctl 2026-06-22 02:37:40.732165 | ubuntu-noble | + 2026-06-22 02:37:40.732266 | ubuntu-noble | +## Kernel module loading and unloading 2026-06-22 02:37:40.732369 | ubuntu-noble | +-a always,exit -F perm=x -F auid!=-1 -F path=/sbin/insmod -k modules 2026-06-22 02:37:40.732491 | ubuntu-noble | +-a always,exit -F perm=x -F auid!=-1 -F path=/sbin/modprobe -k modules 2026-06-22 02:37:40.732595 | ubuntu-noble | +-a always,exit -F perm=x -F auid!=-1 -F path=/sbin/rmmod -k modules 2026-06-22 02:37:40.732724 | ubuntu-noble | +-a always,exit -F arch=b64 -S finit_module -S init_module -S delete_module -F auid!=-1 -k modules 2026-06-22 02:37:40.732818 | ubuntu-noble | + 2026-06-22 02:37:40.732943 | ubuntu-noble | +## Modprobe configuration 2026-06-22 02:37:40.733046 | ubuntu-noble | +-w /etc/modprobe.conf -p wa -k modprobe 2026-06-22 02:37:40.733143 | ubuntu-noble | +-w /etc/modprobe.d -p wa -k modprobe 2026-06-22 02:37:40.733237 | ubuntu-noble | + 2026-06-22 02:37:40.733339 | ubuntu-noble | +## KExec usage (all actions) 2026-06-22 02:37:40.733460 | ubuntu-noble | +-a always,exit -F arch=b64 -S kexec_load -k KEXEC 2026-06-22 02:37:40.733555 | ubuntu-noble | + 2026-06-22 02:37:40.733656 | ubuntu-noble | +## Special files 2026-06-22 02:37:40.733774 | ubuntu-noble | +-a always,exit -F arch=b64 -S mknod -S mknodat -k specialfiles 2026-06-22 02:37:40.733869 | ubuntu-noble | + 2026-06-22 02:37:40.733969 | ubuntu-noble | +## Mount operations (only attributable) 2026-06-22 02:37:40.734083 | ubuntu-noble | +-a always,exit -F arch=b64 -S mount -S umount2 -F auid!=-1 -k mount 2026-06-22 02:37:40.734213 | ubuntu-noble | + 2026-06-22 02:37:40.734319 | ubuntu-noble | +### NFS mount 2026-06-22 02:37:40.734446 | ubuntu-noble | +-a always,exit -F path=/sbin/mount.nfs -F perm=x -F auid>=500 -F auid!=4294967295 -k T1078_Valid_Accounts 2026-06-22 02:37:40.734571 | ubuntu-noble | +-a always,exit -F path=/usr/sbin/mount.nfs -F perm=x -F auid>=500 -F auid!=4294967295 -k T1078_Valid_Accounts 2026-06-22 02:37:40.734667 | ubuntu-noble | + 2026-06-22 02:37:40.734790 | ubuntu-noble | +## Change swap (only attributable) 2026-06-22 02:37:40.734894 | ubuntu-noble | +-a always,exit -F arch=b64 -S swapon -S swapoff -F auid!=-1 -k swap 2026-06-22 02:37:40.734989 | ubuntu-noble | + 2026-06-22 02:37:40.735089 | ubuntu-noble | +## Time 2026-06-22 02:37:40.735195 | ubuntu-noble | +-a always,exit -F arch=b64 -F uid!=ntp -S adjtimex -S settimeofday -S clock_settime -k time 2026-06-22 02:37:40.735294 | ubuntu-noble | +### Local time zone 2026-06-22 02:37:40.735396 | ubuntu-noble | +-w /etc/localtime -p wa -k localtime 2026-06-22 02:37:40.735512 | ubuntu-noble | + 2026-06-22 02:37:40.735602 | ubuntu-noble | +## Stunnel 2026-06-22 02:37:40.735718 | ubuntu-noble | +-w /usr/sbin/stunnel -p x -k stunnel 2026-06-22 02:37:40.735817 | ubuntu-noble | +-w /usr/bin/stunnel -p x -k stunnel 2026-06-22 02:37:40.735945 | ubuntu-noble | + 2026-06-22 02:37:40.736072 | ubuntu-noble | +## Cron configuration & scheduled jobs 2026-06-22 02:37:40.736174 | ubuntu-noble | +-w /etc/cron.allow -p wa -k cron 2026-06-22 02:37:40.736276 | ubuntu-noble | +-w /etc/cron.deny -p wa -k cron 2026-06-22 02:37:40.736371 | ubuntu-noble | +-w /etc/cron.d/ -p wa -k cron 2026-06-22 02:37:40.736487 | ubuntu-noble | +-w /etc/cron.daily/ -p wa -k cron 2026-06-22 02:37:40.736597 | ubuntu-noble | +-w /etc/cron.hourly/ -p wa -k cron 2026-06-22 02:37:40.736685 | ubuntu-noble | +-w /etc/cron.monthly/ -p wa -k cron 2026-06-22 02:37:40.736803 | ubuntu-noble | +-w /etc/cron.weekly/ -p wa -k cron 2026-06-22 02:37:40.736899 | ubuntu-noble | +-w /etc/crontab -p wa -k cron 2026-06-22 02:37:40.736997 | ubuntu-noble | +-w /var/spool/cron/ -p wa -k cron 2026-06-22 02:37:40.737092 | ubuntu-noble | + 2026-06-22 02:37:40.737194 | ubuntu-noble | +## User, group, password databases 2026-06-22 02:37:40.737291 | ubuntu-noble | +-w /etc/group -p wa -k etcgroup 2026-06-22 02:37:40.737389 | ubuntu-noble | +-w /etc/passwd -p wa -k etcpasswd 2026-06-22 02:37:40.737521 | ubuntu-noble | +-w /etc/gshadow -k etcgroup 2026-06-22 02:37:40.737621 | ubuntu-noble | +-w /etc/shadow -k etcpasswd 2026-06-22 02:37:40.737734 | ubuntu-noble | +-w /etc/security/opasswd -k opasswd 2026-06-22 02:37:40.737828 | ubuntu-noble | + 2026-06-22 02:37:40.737930 | ubuntu-noble | +## Sudoers file changes 2026-06-22 02:37:40.738031 | ubuntu-noble | +-w /etc/sudoers -p wa -k actions 2026-06-22 02:37:40.738155 | ubuntu-noble | +-w /etc/sudoers.d/ -p wa -k actions 2026-06-22 02:37:40.738279 | ubuntu-noble | + 2026-06-22 02:37:40.738378 | ubuntu-noble | +## Passwd 2026-06-22 02:37:40.738500 | ubuntu-noble | +-w /usr/bin/passwd -p x -k passwd_modification 2026-06-22 02:37:40.738596 | ubuntu-noble | + 2026-06-22 02:37:40.738698 | ubuntu-noble | +## Tools to change group identifiers 2026-06-22 02:37:40.738820 | ubuntu-noble | +-w /usr/sbin/groupadd -p x -k group_modification 2026-06-22 02:37:40.738925 | ubuntu-noble | +-w /usr/sbin/groupmod -p x -k group_modification 2026-06-22 02:37:40.739028 | ubuntu-noble | +-w /usr/sbin/addgroup -p x -k group_modification 2026-06-22 02:37:40.739133 | ubuntu-noble | +-w /usr/sbin/useradd -p x -k user_modification 2026-06-22 02:37:40.739270 | ubuntu-noble | +-w /usr/sbin/userdel -p x -k user_modification 2026-06-22 02:37:40.739400 | ubuntu-noble | +-w /usr/sbin/usermod -p x -k user_modification 2026-06-22 02:37:40.739543 | ubuntu-noble | +-w /usr/sbin/adduser -p x -k user_modification 2026-06-22 02:37:40.739642 | ubuntu-noble | + 2026-06-22 02:37:40.739772 | ubuntu-noble | +## Login configuration and information 2026-06-22 02:37:40.739922 | ubuntu-noble | +-w /etc/login.defs -p wa -k login 2026-06-22 02:37:40.740053 | ubuntu-noble | +-w /etc/securetty -p wa -k login 2026-06-22 02:37:40.740205 | ubuntu-noble | +-w /var/log/faillog -p wa -k login 2026-06-22 02:37:40.740358 | ubuntu-noble | +-w /var/log/lastlog -p wa -k login 2026-06-22 02:37:40.740730 | ubuntu-noble | +-w /var/log/tallylog -p wa -k login 2026-06-22 02:37:40.740747 | ubuntu-noble | + 2026-06-22 02:37:40.740784 | ubuntu-noble | +## Network Environment 2026-06-22 02:37:40.740927 | ubuntu-noble | +### Changes to hostname 2026-06-22 02:37:40.741017 | ubuntu-noble | +-a always,exit -F arch=b64 -S sethostname -S setdomainname -k network_modifications 2026-06-22 02:37:40.741111 | ubuntu-noble | + 2026-06-22 02:37:40.741216 | ubuntu-noble | +### Detect Remote Shell Use 2026-06-22 02:37:40.741325 | ubuntu-noble | +-a always,exit -F arch=b64 -F exe=/bin/bash -F success=1 -S connect -k "remote_shell" 2026-06-22 02:37:40.741447 | ubuntu-noble | +-a always,exit -F arch=b64 -F exe=/usr/bin/bash -F success=1 -S connect -k "remote_shell" 2026-06-22 02:37:40.741562 | ubuntu-noble | + 2026-06-22 02:37:40.741663 | ubuntu-noble | +### Successful IPv4 Connections 2026-06-22 02:37:40.741798 | ubuntu-noble | +-a always,exit -F arch=b64 -S connect -F a2=16 -F success=1 -F key=network_connect_4 2026-06-22 02:37:40.741894 | ubuntu-noble | + 2026-06-22 02:37:40.742004 | ubuntu-noble | +### Successful IPv6 Connections 2026-06-22 02:37:40.742100 | ubuntu-noble | +-a always,exit -F arch=b64 -S connect -F a2=28 -F success=1 -F key=network_connect_6 2026-06-22 02:37:40.742195 | ubuntu-noble | + 2026-06-22 02:37:40.742298 | ubuntu-noble | +### Changes to other files 2026-06-22 02:37:40.742401 | ubuntu-noble | +-w /etc/hosts -p wa -k network_modifications 2026-06-22 02:37:40.742518 | ubuntu-noble | +-w /etc/sysconfig/network -p wa -k network_modifications 2026-06-22 02:37:40.742618 | ubuntu-noble | +-w /etc/sysconfig/network-scripts -p w -k network_modifications 2026-06-22 02:37:40.742732 | ubuntu-noble | +-w /etc/network/ -p wa -k network 2026-06-22 02:37:40.742836 | ubuntu-noble | +-a always,exit -F dir=/etc/NetworkManager/ -F perm=wa -k network_modifications 2026-06-22 02:37:40.742933 | ubuntu-noble | + 2026-06-22 02:37:40.743033 | ubuntu-noble | +### Changes to issue 2026-06-22 02:37:40.743134 | ubuntu-noble | +-w /etc/issue -p wa -k etcissue 2026-06-22 02:37:40.743235 | ubuntu-noble | +-w /etc/issue.net -p wa -k etcissue 2026-06-22 02:37:40.743332 | ubuntu-noble | + 2026-06-22 02:37:40.743472 | ubuntu-noble | +## System startup scripts 2026-06-22 02:37:40.743541 | ubuntu-noble | +-w /etc/inittab -p wa -k init 2026-06-22 02:37:40.743646 | ubuntu-noble | +-w /etc/init.d/ -p wa -k init 2026-06-22 02:37:40.743754 | ubuntu-noble | +-w /etc/init/ -p wa -k init 2026-06-22 02:37:40.743856 | ubuntu-noble | + 2026-06-22 02:37:40.744880 | ubuntu-noble | +## Library search paths 2026-06-22 02:37:40.744902 | ubuntu-noble | +-w /etc/ld.so.conf -p wa -k libpath 2026-06-22 02:37:40.744906 | ubuntu-noble | +-w /etc/ld.so.conf.d -p wa -k libpath 2026-06-22 02:37:40.744910 | ubuntu-noble | + 2026-06-22 02:37:40.744914 | ubuntu-noble | +## Systemwide library preloads (LD_PRELOAD) 2026-06-22 02:37:40.744918 | ubuntu-noble | +-w /etc/ld.so.preload -p wa -k systemwide_preloads 2026-06-22 02:37:40.744921 | ubuntu-noble | + 2026-06-22 02:37:40.744925 | ubuntu-noble | +## Pam configuration 2026-06-22 02:37:40.745763 | ubuntu-noble | +-w /etc/pam.d/ -p wa -k pam 2026-06-22 02:37:40.745949 | ubuntu-noble | +-w /etc/security/limits.conf -p wa -k pam 2026-06-22 02:37:40.746065 | ubuntu-noble | +-w /etc/security/limits.d -p wa -k pam 2026-06-22 02:37:40.746171 | ubuntu-noble | +-w /etc/security/pam_env.conf -p wa -k pam 2026-06-22 02:37:40.746288 | ubuntu-noble | +-w /etc/security/namespace.conf -p wa -k pam 2026-06-22 02:37:40.746385 | ubuntu-noble | +-w /etc/security/namespace.d -p wa -k pam 2026-06-22 02:37:40.746501 | ubuntu-noble | +-w /etc/security/namespace.init -p wa -k pam 2026-06-22 02:37:40.746601 | ubuntu-noble | + 2026-06-22 02:37:40.746739 | ubuntu-noble | +## Mail configuration 2026-06-22 02:37:40.747624 | ubuntu-noble | +-w /etc/aliases -p wa -k mail 2026-06-22 02:37:40.747639 | ubuntu-noble | +-w /etc/postfix/ -p wa -k mail 2026-06-22 02:37:40.747643 | ubuntu-noble | +-w /etc/exim4/ -p wa -k mail 2026-06-22 02:37:40.747647 | ubuntu-noble | + 2026-06-22 02:37:40.747663 | ubuntu-noble | +## SSH configuration 2026-06-22 02:37:40.747667 | ubuntu-noble | +-w /etc/ssh/sshd_config -k sshd 2026-06-22 02:37:40.747671 | ubuntu-noble | +-w /etc/ssh/sshd_config.d -k sshd 2026-06-22 02:37:40.747674 | ubuntu-noble | + 2026-06-22 02:37:40.747755 | ubuntu-noble | +## root ssh key tampering 2026-06-22 02:37:40.747848 | ubuntu-noble | +-w /root/.ssh -p wa -k rootkey 2026-06-22 02:37:40.748105 | ubuntu-noble | + 2026-06-22 02:37:40.748225 | ubuntu-noble | +# Systemd 2026-06-22 02:37:40.748318 | ubuntu-noble | +-w /bin/systemctl -p x -k systemd 2026-06-22 02:37:40.748417 | ubuntu-noble | +-w /etc/systemd/ -p wa -k systemd 2026-06-22 02:37:40.748528 | ubuntu-noble | +-w /usr/lib/systemd -p wa -k systemd 2026-06-22 02:37:40.748623 | ubuntu-noble | + 2026-06-22 02:37:40.748779 | ubuntu-noble | +## https://systemd.network/systemd.generator.html 2026-06-22 02:37:40.748886 | ubuntu-noble | +-w /etc/systemd/system-generators/ -p wa -k systemd_generator 2026-06-22 02:37:40.748988 | ubuntu-noble | +-w /usr/local/lib/systemd/system-generators/ -p wa -k systemd_generator 2026-06-22 02:37:40.749122 | ubuntu-noble | +-w /usr/lib/systemd/system-generators -p wa -k systemd_generator 2026-06-22 02:37:40.749218 | ubuntu-noble | + 2026-06-22 02:37:40.749321 | ubuntu-noble | +-w /etc/systemd/user-generators/ -p wa -k systemd_generator 2026-06-22 02:37:40.749424 | ubuntu-noble | +-w /usr/local/lib/systemd/user-generators/ -p wa -k systemd_generator 2026-06-22 02:37:40.749561 | ubuntu-noble | +-w /lib/systemd/system-generators/ -p wa -k systemd_generator 2026-06-22 02:37:40.749658 | ubuntu-noble | + 2026-06-22 02:37:40.749782 | ubuntu-noble | +## SELinux events that modify the system's Mandatory Access Controls (MAC) 2026-06-22 02:37:40.749885 | ubuntu-noble | +-w /etc/selinux/ -p wa -k mac_policy 2026-06-22 02:37:40.749985 | ubuntu-noble | + 2026-06-22 02:37:40.750081 | ubuntu-noble | +## Critical elements access failures 2026-06-22 02:37:40.750185 | ubuntu-noble | +-a always,exit -F arch=b64 -S open -F dir=/etc -F success=0 -k unauthedfileaccess 2026-06-22 02:37:40.750327 | ubuntu-noble | +-a always,exit -F arch=b64 -S open -F dir=/bin -F success=0 -k unauthedfileaccess 2026-06-22 02:37:40.750461 | ubuntu-noble | +-a always,exit -F arch=b64 -S open -F dir=/sbin -F success=0 -k unauthedfileaccess 2026-06-22 02:37:40.750567 | ubuntu-noble | +-a always,exit -F arch=b64 -S open -F dir=/usr/bin -F success=0 -k unauthedfileaccess 2026-06-22 02:37:40.750667 | ubuntu-noble | +-a always,exit -F arch=b64 -S open -F dir=/usr/sbin -F success=0 -k unauthedfileaccess 2026-06-22 02:37:40.751475 | ubuntu-noble | +-a always,exit -F arch=b64 -S open -F dir=/var -F success=0 -k unauthedfileaccess 2026-06-22 02:37:40.751497 | ubuntu-noble | +-a always,exit -F arch=b64 -S open -F dir=/home -F success=0 -k unauthedfileaccess 2026-06-22 02:37:40.751509 | ubuntu-noble | +-a always,exit -F arch=b64 -S open -F dir=/srv -F success=0 -k unauthedfileaccess 2026-06-22 02:37:40.751513 | ubuntu-noble | + 2026-06-22 02:37:40.751517 | ubuntu-noble | +## Process ID change (switching accounts) applications 2026-06-22 02:37:40.751521 | ubuntu-noble | +-w /bin/su -p x -k priv_esc 2026-06-22 02:37:40.751525 | ubuntu-noble | +-w /usr/bin/sudo -p x -k priv_esc 2026-06-22 02:37:40.751572 | ubuntu-noble | + 2026-06-22 02:37:40.751666 | ubuntu-noble | +## Power state 2026-06-22 02:37:40.751794 | ubuntu-noble | +-w /sbin/shutdown -p x -k power 2026-06-22 02:37:40.751894 | ubuntu-noble | +-w /sbin/poweroff -p x -k power 2026-06-22 02:37:40.752123 | ubuntu-noble | +-w /sbin/reboot -p x -k power 2026-06-22 02:37:40.752131 | ubuntu-noble | +-w /sbin/halt -p x -k power 2026-06-22 02:37:40.752183 | ubuntu-noble | + 2026-06-22 02:37:40.752284 | ubuntu-noble | +## Session initiation information 2026-06-22 02:37:40.752490 | ubuntu-noble | +-w /var/run/utmp -p wa -k session 2026-06-22 02:37:40.752526 | ubuntu-noble | +-w /var/log/btmp -p wa -k session 2026-06-22 02:37:40.752632 | ubuntu-noble | +-w /var/log/wtmp -p wa -k session 2026-06-22 02:37:40.752754 | ubuntu-noble | + 2026-06-22 02:37:40.754006 | ubuntu-noble | +## Discretionary Access Control (DAC) modifications 2026-06-22 02:37:40.754024 | ubuntu-noble | +-a always,exit -F arch=b64 -S chmod -F auid>=1000 -F auid!=-1 -k perm_mod 2026-06-22 02:37:40.754028 | ubuntu-noble | +-a always,exit -F arch=b64 -S chown -F auid>=1000 -F auid!=-1 -k perm_mod 2026-06-22 02:37:40.754036 | ubuntu-noble | +-a always,exit -F arch=b64 -S fchmod -F auid>=1000 -F auid!=-1 -k perm_mod 2026-06-22 02:37:40.754040 | ubuntu-noble | +-a always,exit -F arch=b64 -S fchmodat -F auid>=1000 -F auid!=-1 -k perm_mod 2026-06-22 02:37:40.754044 | ubuntu-noble | +-a always,exit -F arch=b64 -S fchown -F auid>=1000 -F auid!=-1 -k perm_mod 2026-06-22 02:37:40.754047 | ubuntu-noble | +-a always,exit -F arch=b64 -S fchownat -F auid>=1000 -F auid!=-1 -k perm_mod 2026-06-22 02:37:40.754051 | ubuntu-noble | +-a always,exit -F arch=b64 -S fremovexattr -F auid>=1000 -F auid!=-1 -k perm_mod 2026-06-22 02:37:40.754054 | ubuntu-noble | +-a always,exit -F arch=b64 -S fsetxattr -F auid>=1000 -F auid!=-1 -k perm_mod 2026-06-22 02:37:40.754058 | ubuntu-noble | +-a always,exit -F arch=b64 -S lchown -F auid>=1000 -F auid!=-1 -k perm_mod 2026-06-22 02:37:40.754061 | ubuntu-noble | +-a always,exit -F arch=b64 -S lremovexattr -F auid>=1000 -F auid!=-1 -k perm_mod 2026-06-22 02:37:40.754064 | ubuntu-noble | +-a always,exit -F arch=b64 -S lsetxattr -F auid>=1000 -F auid!=-1 -k perm_mod 2026-06-22 02:37:40.754070 | ubuntu-noble | +-a always,exit -F arch=b64 -S removexattr -F auid>=1000 -F auid!=-1 -k perm_mod 2026-06-22 02:37:40.754164 | ubuntu-noble | +-a always,exit -F arch=b64 -S setxattr -F auid>=1000 -F auid!=-1 -k perm_mod 2026-06-22 02:37:40.754252 | ubuntu-noble | + 2026-06-22 02:37:40.754350 | ubuntu-noble | +# Special Rules --------------------------------------------------------------- 2026-06-22 02:37:40.754555 | ubuntu-noble | + 2026-06-22 02:37:40.754639 | ubuntu-noble | +## Reconnaissance 2026-06-22 02:37:40.754841 | ubuntu-noble | +-w /usr/bin/whoami -p x -k recon 2026-06-22 02:37:40.754926 | ubuntu-noble | +-w /usr/bin/id -p x -k recon 2026-06-22 02:37:40.755033 | ubuntu-noble | +-w /bin/hostname -p x -k recon 2026-06-22 02:37:40.755126 | ubuntu-noble | +-w /bin/uname -p x -k recon 2026-06-22 02:37:40.755224 | ubuntu-noble | +-w /etc/issue -p r -k recon 2026-06-22 02:37:40.755320 | ubuntu-noble | +-w /etc/hostname -p r -k recon 2026-06-22 02:37:40.755413 | ubuntu-noble | + 2026-06-22 02:37:40.755556 | ubuntu-noble | +## Suspicious activity 2026-06-22 02:37:40.756825 | ubuntu-noble | +-w /usr/bin/wget -p x -k susp_activity 2026-06-22 02:37:40.756846 | ubuntu-noble | +-w /usr/bin/curl -p x -k susp_activity 2026-06-22 02:37:40.756850 | ubuntu-noble | +-w /usr/bin/base64 -p x -k susp_activity 2026-06-22 02:37:40.756853 | ubuntu-noble | +-w /bin/nc -p x -k susp_activity 2026-06-22 02:37:40.756857 | ubuntu-noble | +-w /bin/netcat -p x -k susp_activity 2026-06-22 02:37:40.756861 | ubuntu-noble | +-w /usr/bin/ncat -p x -k susp_activity 2026-06-22 02:37:40.756864 | ubuntu-noble | +-w /usr/bin/ss -p x -k susp_activity 2026-06-22 02:37:40.756867 | ubuntu-noble | +-w /usr/bin/netstat -p x -k susp_activity 2026-06-22 02:37:40.756871 | ubuntu-noble | +-w /usr/bin/ssh -p x -k susp_activity 2026-06-22 02:37:40.756874 | ubuntu-noble | +-w /usr/bin/scp -p x -k susp_activity 2026-06-22 02:37:40.756878 | ubuntu-noble | +-w /usr/bin/sftp -p x -k susp_activity 2026-06-22 02:37:40.756881 | ubuntu-noble | +-w /usr/bin/ftp -p x -k susp_activity 2026-06-22 02:37:40.756887 | ubuntu-noble | +-w /usr/bin/socat -p x -k susp_activity 2026-06-22 02:37:40.756981 | ubuntu-noble | +-w /usr/bin/wireshark -p x -k susp_activity 2026-06-22 02:37:40.757079 | ubuntu-noble | +-w /usr/bin/tshark -p x -k susp_activity 2026-06-22 02:37:40.757180 | ubuntu-noble | +-w /usr/bin/rawshark -p x -k susp_activity 2026-06-22 02:37:40.757282 | ubuntu-noble | +-w /usr/bin/rdesktop -p x -k susp_activity 2026-06-22 02:37:40.757383 | ubuntu-noble | +-w /usr/local/bin/rdesktop -p x -k susp_activity 2026-06-22 02:37:40.757497 | ubuntu-noble | +-w /usr/bin/wlfreerdp -p x -k susp_activity 2026-06-22 02:37:40.757600 | ubuntu-noble | +-w /usr/bin/xfreerdp -p x -k susp_activity 2026-06-22 02:37:40.757700 | ubuntu-noble | +-w /usr/local/bin/xfreerdp -p x -k susp_activity 2026-06-22 02:37:40.758176 | ubuntu-noble | +-w /usr/bin/nmap -p x -k susp_activity 2026-06-22 02:37:40.758211 | ubuntu-noble | + 2026-06-22 02:37:40.758306 | ubuntu-noble | +## sssd 2026-06-22 02:37:40.758418 | ubuntu-noble | +-a always,exit -F path=/usr/libexec/sssd/p11_child -F perm=x -F auid>=500 -F auid!=4294967295 -k T1078_Valid_Accounts 2026-06-22 02:37:40.758576 | ubuntu-noble | +-a always,exit -F path=/usr/libexec/sssd/krb5_child -F perm=x -F auid>=500 -F auid!=4294967295 -k T1078_Valid_Accounts 2026-06-22 02:37:40.758674 | ubuntu-noble | +-a always,exit -F path=/usr/libexec/sssd/ldap_child -F perm=x -F auid>=500 -F auid!=4294967295 -k T1078_Valid_Accounts 2026-06-22 02:37:40.759472 | ubuntu-noble | +-a always,exit -F path=/usr/libexec/sssd/selinux_child -F perm=x -F auid>=500 -F auid!=4294967295 -k T1078_Valid_Accounts 2026-06-22 02:37:40.759493 | ubuntu-noble | +-a always,exit -F path=/usr/libexec/sssd/proxy_child -F perm=x -F auid>=500 -F auid!=4294967295 -k T1078_Valid_Accounts 2026-06-22 02:37:40.759508 | ubuntu-noble | + 2026-06-22 02:37:40.759512 | ubuntu-noble | +## T1002 Data Compressed 2026-06-22 02:37:40.759516 | ubuntu-noble | + 2026-06-22 02:37:40.759519 | ubuntu-noble | +-w /usr/bin/zip -p x -k Data_Compressed 2026-06-22 02:37:40.759523 | ubuntu-noble | +-w /usr/bin/gzip -p x -k Data_Compressed 2026-06-22 02:37:40.759530 | ubuntu-noble | +-w /usr/bin/tar -p x -k Data_Compressed 2026-06-22 02:37:40.759676 | ubuntu-noble | +-w /usr/bin/bzip2 -p x -k Data_Compressed 2026-06-22 02:37:40.759788 | ubuntu-noble | + 2026-06-22 02:37:40.759891 | ubuntu-noble | +-w /usr/bin/lzip -p x -k Data_Compressed 2026-06-22 02:37:40.759998 | ubuntu-noble | +-w /usr/local/bin/lzip -p x -k Data_Compressed 2026-06-22 02:37:40.760129 | ubuntu-noble | + 2026-06-22 02:37:40.760285 | ubuntu-noble | +-w /usr/bin/lz4 -p x -k Data_Compressed 2026-06-22 02:37:40.760464 | ubuntu-noble | +-w /usr/local/bin/lz4 -p x -k Data_Compressed 2026-06-22 02:37:40.760605 | ubuntu-noble | + 2026-06-22 02:37:40.760811 | ubuntu-noble | +-w /usr/bin/lzop -p x -k Data_Compressed 2026-06-22 02:37:40.760983 | ubuntu-noble | +-w /usr/local/bin/lzop -p x -k Data_Compressed 2026-06-22 02:37:40.761134 | ubuntu-noble | + 2026-06-22 02:37:40.761299 | ubuntu-noble | +-w /usr/bin/plzip -p x -k Data_Compressed 2026-06-22 02:37:40.761411 | ubuntu-noble | +-w /usr/local/bin/plzip -p x -k Data_Compressed 2026-06-22 02:37:40.761544 | ubuntu-noble | + 2026-06-22 02:37:40.761648 | ubuntu-noble | +-w /usr/bin/pbzip2 -p x -k Data_Compressed 2026-06-22 02:37:40.761807 | ubuntu-noble | +-w /usr/local/bin/pbzip2 -p x -k Data_Compressed 2026-06-22 02:37:40.763746 | ubuntu-noble | + 2026-06-22 02:37:40.763770 | ubuntu-noble | +-w /usr/bin/lbzip2 -p x -k Data_Compressed 2026-06-22 02:37:40.763775 | ubuntu-noble | +-w /usr/local/bin/lbzip2 -p x -k Data_Compressed 2026-06-22 02:37:40.763779 | ubuntu-noble | + 2026-06-22 02:37:40.763783 | ubuntu-noble | +-w /usr/bin/pixz -p x -k Data_Compressed 2026-06-22 02:37:40.763787 | ubuntu-noble | +-w /usr/local/bin/pixz -p x -k Data_Compressed 2026-06-22 02:37:40.763791 | ubuntu-noble | + 2026-06-22 02:37:40.763795 | ubuntu-noble | +-w /usr/bin/pigz -p x -k Data_Compressed 2026-06-22 02:37:40.763798 | ubuntu-noble | +-w /usr/local/bin/pigz -p x -k Data_Compressed 2026-06-22 02:37:40.763802 | ubuntu-noble | +-w /usr/bin/unpigz -p x -k Data_Compressed 2026-06-22 02:37:40.763806 | ubuntu-noble | +-w /usr/local/bin/unpigz -p x -k Data_Compressed 2026-06-22 02:37:40.763810 | ubuntu-noble | + 2026-06-22 02:37:40.763813 | ubuntu-noble | +-w /usr/bin/zstd -p x -k Data_Compressed 2026-06-22 02:37:40.763817 | ubuntu-noble | +-w /usr/local/bin/zstd -p x -k Data_Compressed 2026-06-22 02:37:40.763821 | ubuntu-noble | + 2026-06-22 02:37:40.763825 | ubuntu-noble | +## Added to catch netcat on Ubuntu 2026-06-22 02:37:40.763828 | ubuntu-noble | +-w /bin/nc.openbsd -p x -k susp_activity 2026-06-22 02:37:40.763832 | ubuntu-noble | +-w /bin/nc.traditional -p x -k susp_activity 2026-06-22 02:37:40.763836 | ubuntu-noble | + 2026-06-22 02:37:40.763843 | ubuntu-noble | +## Sbin suspicious activity 2026-06-22 02:37:40.763896 | ubuntu-noble | +-w /sbin/iptables -p x -k sbin_susp 2026-06-22 02:37:40.763995 | ubuntu-noble | +-w /sbin/ip6tables -p x -k sbin_susp 2026-06-22 02:37:40.764093 | ubuntu-noble | +-w /sbin/ifconfig -p x -k sbin_susp 2026-06-22 02:37:40.764194 | ubuntu-noble | +-w /usr/sbin/arptables -p x -k sbin_susp 2026-06-22 02:37:40.764294 | ubuntu-noble | +-w /usr/sbin/ebtables -p x -k sbin_susp 2026-06-22 02:37:40.764395 | ubuntu-noble | +-w /sbin/xtables-nft-multi -p x -k sbin_susp 2026-06-22 02:37:40.764525 | ubuntu-noble | +-w /usr/sbin/nft -p x -k sbin_susp 2026-06-22 02:37:40.764622 | ubuntu-noble | +-w /usr/sbin/tcpdump -p x -k sbin_susp 2026-06-22 02:37:40.764772 | ubuntu-noble | +-w /usr/sbin/traceroute -p x -k sbin_susp 2026-06-22 02:37:40.764850 | ubuntu-noble | +-w /usr/sbin/ufw -p x -k sbin_susp 2026-06-22 02:37:40.764963 | ubuntu-noble | + 2026-06-22 02:37:40.765043 | ubuntu-noble | +### kde4 2026-06-22 02:37:40.765153 | ubuntu-noble | +-a always,exit -F path=/usr/libexec/kde4/kpac_dhcp_helper -F perm=x -F auid>=1000 -F auid!=4294967295 -k T1078_Valid_Accounts 2026-06-22 02:37:40.765261 | ubuntu-noble | +-a always,exit -F path=/usr/libexec/kde4/kdesud -F perm=x -F auid>=1000 -F auid!=4294967295 -k T1078_Valid_Accounts 2026-06-22 02:37:40.765351 | ubuntu-noble | + 2026-06-22 02:37:40.765463 | ubuntu-noble | +## dbus-send invocation 2026-06-22 02:37:40.765579 | ubuntu-noble | +### may indicate privilege escalation CVE-2021-3560 2026-06-22 02:37:40.765682 | ubuntu-noble | +-w /usr/bin/dbus-send -p x -k dbus_send 2026-06-22 02:37:40.765801 | ubuntu-noble | +-w /usr/bin/gdbus -p x -k gdubs_call 2026-06-22 02:37:40.765896 | ubuntu-noble | + 2026-06-22 02:37:40.765996 | ubuntu-noble | +## pkexec invocation 2026-06-22 02:37:40.766107 | ubuntu-noble | +### may indicate privilege escalation CVE-2021-4034 2026-06-22 02:37:40.766230 | ubuntu-noble | +-w /usr/bin/pkexec -p x -k pkexec 2026-06-22 02:37:40.766326 | ubuntu-noble | + 2026-06-22 02:37:40.766423 | ubuntu-noble | +## Suspicious shells 2026-06-22 02:37:40.766568 | ubuntu-noble | +-w /bin/ash -p x -k susp_shell 2026-06-22 02:37:40.766669 | ubuntu-noble | +-w /bin/csh -p x -k susp_shell 2026-06-22 02:37:40.766799 | ubuntu-noble | +-w /bin/fish -p x -k susp_shell 2026-06-22 02:37:40.766949 | ubuntu-noble | +-w /bin/tcsh -p x -k susp_shell 2026-06-22 02:37:40.767098 | ubuntu-noble | +-w /bin/tclsh -p x -k susp_shell 2026-06-22 02:37:40.767229 | ubuntu-noble | +-w /bin/xonsh -p x -k susp_shell 2026-06-22 02:37:40.767334 | ubuntu-noble | +-w /usr/local/bin/xonsh -p x -k susp_shell 2026-06-22 02:37:40.767452 | ubuntu-noble | +-w /bin/open -p x -k susp_shell 2026-06-22 02:37:40.767547 | ubuntu-noble | +-w /bin/rbash -p x -k susp_shell 2026-06-22 02:37:40.767644 | ubuntu-noble | + 2026-06-22 02:37:40.767772 | ubuntu-noble | +# Web Server Actvity 2026-06-22 02:37:40.767883 | ubuntu-noble | +## Change the number "33" to the ID of your WebServer user. Default: www-data:x:33:33 2026-06-22 02:37:40.767988 | ubuntu-noble | +-a always,exit -F arch=b64 -S execve -F euid=33 -k detect_execve_www 2026-06-22 02:37:40.768137 | ubuntu-noble | + 2026-06-22 02:37:40.768270 | ubuntu-noble | +### https://clustershell.readthedocs.io/ 2026-06-22 02:37:40.768372 | ubuntu-noble | +-w /bin/clush -p x -k susp_shell 2026-06-22 02:37:40.768489 | ubuntu-noble | +-w /usr/local/bin/clush -p x -k susp_shell 2026-06-22 02:37:40.768595 | ubuntu-noble | +-w /etc/clustershell/clush.conf -p x -k susp_shell 2026-06-22 02:37:40.768692 | ubuntu-noble | + 2026-06-22 02:37:40.768828 | ubuntu-noble | +### https://github.com/tmux/tmux 2026-06-22 02:37:40.768929 | ubuntu-noble | +-w /bin/tmux -p x -k susp_shell 2026-06-22 02:37:40.769030 | ubuntu-noble | +-w /usr/local/bin/tmux -p x -k susp_shell 2026-06-22 02:37:40.769123 | ubuntu-noble | + 2026-06-22 02:37:40.769225 | ubuntu-noble | +## Shell/profile configurations 2026-06-22 02:37:40.769327 | ubuntu-noble | +-w /etc/profile.d/ -p wa -k shell_profiles 2026-06-22 02:37:40.769467 | ubuntu-noble | +-w /etc/profile -p wa -k shell_profiles 2026-06-22 02:37:40.769561 | ubuntu-noble | +-w /etc/shells -p wa -k shell_profiles 2026-06-22 02:37:40.769659 | ubuntu-noble | +-w /etc/bashrc -p wa -k shell_profiles 2026-06-22 02:37:40.769769 | ubuntu-noble | +-w /etc/csh.cshrc -p wa -k shell_profiles 2026-06-22 02:37:40.769871 | ubuntu-noble | +-w /etc/csh.login -p wa -k shell_profiles 2026-06-22 02:37:40.769969 | ubuntu-noble | +-w /etc/fish/ -p wa -k shell_profiles 2026-06-22 02:37:40.770070 | ubuntu-noble | +-w /etc/zsh/ -p wa -k shell_profiles 2026-06-22 02:37:40.770198 | ubuntu-noble | + 2026-06-22 02:37:40.770305 | ubuntu-noble | +### https://github.com/xxh/xxh 2026-06-22 02:37:40.770406 | ubuntu-noble | +-w /usr/local/bin/xxh.bash -p x -k susp_shell 2026-06-22 02:37:40.770520 | ubuntu-noble | +-w /usr/local/bin/xxh.xsh -p x -k susp_shell 2026-06-22 02:37:40.770618 | ubuntu-noble | +-w /usr/local/bin/xxh.zsh -p x -k susp_shell 2026-06-22 02:37:40.770730 | ubuntu-noble | + 2026-06-22 02:37:40.770829 | ubuntu-noble | +## Injection 2026-06-22 02:37:40.770933 | ubuntu-noble | +### These rules watch for code injection by the ptrace facility. 2026-06-22 02:37:40.771033 | ubuntu-noble | +### This could indicate someone trying to do something bad or just debugging 2026-06-22 02:37:40.771137 | ubuntu-noble | +-a always,exit -F arch=b64 -S ptrace -F a0=0x4 -k code_injection 2026-06-22 02:37:40.771243 | ubuntu-noble | +-a always,exit -F arch=b64 -S ptrace -F a0=0x5 -k data_injection 2026-06-22 02:37:40.771345 | ubuntu-noble | +-a always,exit -F arch=b64 -S ptrace -F a0=0x6 -k register_injection 2026-06-22 02:37:40.771509 | ubuntu-noble | +-a always,exit -F arch=b64 -S ptrace -k tracing 2026-06-22 02:37:40.771554 | ubuntu-noble | + 2026-06-22 02:37:40.771663 | ubuntu-noble | +## Anonymous File Creation 2026-06-22 02:37:40.771774 | ubuntu-noble | +### These rules watch the use of memfd_create 2026-06-22 02:37:40.771875 | ubuntu-noble | +### "memfd_create" creates anonymous file and returns a file descriptor to access it 2026-06-22 02:37:40.771979 | ubuntu-noble | +### When combined with "fexecve" can be used to stealthily run binaries in memory without touching disk 2026-06-22 02:37:40.772081 | ubuntu-noble | +-a always,exit -F arch=b64 -S memfd_create -F key=anon_file_create 2026-06-22 02:37:40.772172 | ubuntu-noble | + 2026-06-22 02:37:40.772272 | ubuntu-noble | +## Privilege Abuse 2026-06-22 02:37:40.772376 | ubuntu-noble | +### The purpose of this rule is to detect when an admin may be abusing power by looking in user's home dir. 2026-06-22 02:37:40.772510 | ubuntu-noble | +-a always,exit -F dir=/home -F uid=0 -F auid>=1000 -F auid!=-1 -C auid!=obj_uid -k power_abuse 2026-06-22 02:37:40.772601 | ubuntu-noble | + 2026-06-22 02:37:40.772719 | ubuntu-noble | +# Socket Creations 2026-06-22 02:37:40.772817 | ubuntu-noble | +# will catch both IPv4 and IPv6 2026-06-22 02:37:40.772912 | ubuntu-noble | + 2026-06-22 02:37:40.773016 | ubuntu-noble | +-a always,exit -F arch=b32 -S socket -F a0=2 -k network_socket_created 2026-06-22 02:37:40.773118 | ubuntu-noble | +-a always,exit -F arch=b64 -S socket -F a0=2 -k network_socket_created 2026-06-22 02:37:40.773215 | ubuntu-noble | + 2026-06-22 02:37:40.773318 | ubuntu-noble | +-a always,exit -F arch=b32 -S socket -F a0=10 -k network_socket_created 2026-06-22 02:37:40.773419 | ubuntu-noble | +-a always,exit -F arch=b64 -S socket -F a0=10 -k network_socket_created 2026-06-22 02:37:40.773528 | ubuntu-noble | + 2026-06-22 02:37:40.773629 | ubuntu-noble | +# Software Management --------------------------------------------------------- 2026-06-22 02:37:40.773737 | ubuntu-noble | + 2026-06-22 02:37:40.773838 | ubuntu-noble | +# RPM (Redhat/CentOS) 2026-06-22 02:37:40.773941 | ubuntu-noble | +-w /usr/bin/rpm -p x -k software_mgmt 2026-06-22 02:37:40.774043 | ubuntu-noble | +-w /usr/bin/yum -p x -k software_mgmt 2026-06-22 02:37:40.774159 | ubuntu-noble | + 2026-06-22 02:37:40.774267 | ubuntu-noble | +# DNF (Fedora/RedHat 8/CentOS 8) 2026-06-22 02:37:40.774366 | ubuntu-noble | +-w /usr/bin/dnf -p x -k software_mgmt 2026-06-22 02:37:40.774473 | ubuntu-noble | + 2026-06-22 02:37:40.774573 | ubuntu-noble | +# YAST/Zypper/RPM (SuSE) 2026-06-22 02:37:40.774672 | ubuntu-noble | +-w /sbin/yast -p x -k software_mgmt 2026-06-22 02:37:40.774789 | ubuntu-noble | +-w /sbin/yast2 -p x -k software_mgmt 2026-06-22 02:37:40.774888 | ubuntu-noble | +-w /bin/rpm -p x -k software_mgmt 2026-06-22 02:37:40.774990 | ubuntu-noble | +-w /usr/bin/zypper -k software_mgmt 2026-06-22 02:37:40.775085 | ubuntu-noble | + 2026-06-22 02:37:40.775186 | ubuntu-noble | +# DPKG / APT-GET (Debian/Ubuntu) 2026-06-22 02:37:40.775291 | ubuntu-noble | +-w /usr/bin/dpkg -p x -k software_mgmt 2026-06-22 02:37:40.775392 | ubuntu-noble | +-w /usr/bin/apt -p x -k software_mgmt 2026-06-22 02:37:40.775520 | ubuntu-noble | +-w /usr/bin/apt-add-repository -p x -k software_mgmt 2026-06-22 02:37:40.775621 | ubuntu-noble | +-w /usr/bin/apt-get -p x -k software_mgmt 2026-06-22 02:37:40.775734 | ubuntu-noble | +-w /usr/bin/aptitude -p x -k software_mgmt 2026-06-22 02:37:40.775842 | ubuntu-noble | +-w /usr/bin/wajig -p x -k software_mgmt 2026-06-22 02:37:40.775937 | ubuntu-noble | +-w /usr/bin/snap -p x -k software_mgmt 2026-06-22 02:37:40.776030 | ubuntu-noble | + 2026-06-22 02:37:40.776129 | ubuntu-noble | +# PIP(3) (Python installs) 2026-06-22 02:37:40.776243 | ubuntu-noble | +-w /usr/bin/pip -p x -k third_party_software_mgmt 2026-06-22 02:37:40.776346 | ubuntu-noble | +-w /usr/local/bin/pip -p x -k third_party_software_mgmt 2026-06-22 02:37:40.776472 | ubuntu-noble | +-w /usr/bin/pip3 -p x -k third_party_software_mgmt 2026-06-22 02:37:40.776564 | ubuntu-noble | +-w /usr/local/bin/pip3 -p x -k third_party_software_mgmt 2026-06-22 02:37:40.776670 | ubuntu-noble | +-w /usr/bin/pipx -p x -k third_party_software_mgmt 2026-06-22 02:37:40.776784 | ubuntu-noble | +-w /usr/local/bin/pipx -p x -k third_party_software_mgmt 2026-06-22 02:37:40.776875 | ubuntu-noble | + 2026-06-22 02:37:40.776972 | ubuntu-noble | +# npm 2026-06-22 02:37:40.777072 | ubuntu-noble | +## T1072 third party software 2026-06-22 02:37:40.777169 | ubuntu-noble | +## https://www.npmjs.com 2026-06-22 02:37:40.777270 | ubuntu-noble | +## https://docs.npmjs.com/cli/v6/commands/npm-audit 2026-06-22 02:37:40.777371 | ubuntu-noble | +-w /usr/bin/npm -p x -k third_party_software_mgmt 2026-06-22 02:37:40.777476 | ubuntu-noble | + 2026-06-22 02:37:40.777577 | ubuntu-noble | +# Comprehensive Perl Archive Network (CPAN) (CPAN installs) 2026-06-22 02:37:40.777677 | ubuntu-noble | +## T1072 third party software 2026-06-22 02:37:40.777790 | ubuntu-noble | +## https://www.cpan.org 2026-06-22 02:37:40.777904 | ubuntu-noble | +-w /usr/bin/cpan -p x -k third_party_software_mgmt 2026-06-22 02:37:40.778032 | ubuntu-noble | + 2026-06-22 02:37:40.778156 | ubuntu-noble | +# Ruby (RubyGems installs) 2026-06-22 02:37:40.778279 | ubuntu-noble | +## T1072 third party software 2026-06-22 02:37:40.778381 | ubuntu-noble | +## https://rubygems.org 2026-06-22 02:37:40.778517 | ubuntu-noble | +-w /usr/bin/gem -p x -k third_party_software_mgmt 2026-06-22 02:37:40.778612 | ubuntu-noble | + 2026-06-22 02:37:40.778730 | ubuntu-noble | +# LuaRocks (Lua installs) 2026-06-22 02:37:40.778843 | ubuntu-noble | +## T1072 third party software 2026-06-22 02:37:40.778990 | ubuntu-noble | +## https://luarocks.org 2026-06-22 02:37:40.779144 | ubuntu-noble | +-w /usr/bin/luarocks -p x -k third_party_software_mgmt 2026-06-22 02:37:40.779248 | ubuntu-noble | + 2026-06-22 02:37:40.779350 | ubuntu-noble | +# Pacman (Arch Linux) 2026-06-22 02:37:40.779602 | ubuntu-noble | +## https://wiki.archlinux.org/title/Pacman 2026-06-22 02:37:40.779609 | ubuntu-noble | +## T1072 third party software 2026-06-22 02:37:40.779677 | ubuntu-noble | +-w /etc/pacman.conf -p x -k third_party_software_mgmt 2026-06-22 02:37:40.779800 | ubuntu-noble | +-w /etc/pacman.d -p x -k third_party_software_mgmt 2026-06-22 02:37:40.779894 | ubuntu-noble | + 2026-06-22 02:37:40.779997 | ubuntu-noble | +# Special Software ------------------------------------------------------------ 2026-06-22 02:37:40.780094 | ubuntu-noble | + 2026-06-22 02:37:40.780195 | ubuntu-noble | +## GDS specific secrets 2026-06-22 02:37:40.780293 | ubuntu-noble | +-w /etc/puppet/ssl -p wa -k puppet_ssl 2026-06-22 02:37:40.780386 | ubuntu-noble | + 2026-06-22 02:37:40.780501 | ubuntu-noble | +## IBM Bigfix BESClient 2026-06-22 02:37:40.780605 | ubuntu-noble | +-a always,exit -F arch=b64 -S open -F dir=/opt/BESClient -F success=0 -k soft_besclient 2026-06-22 02:37:40.780723 | ubuntu-noble | +-w /var/opt/BESClient/ -p wa -k soft_besclient 2026-06-22 02:37:40.780816 | ubuntu-noble | + 2026-06-22 02:37:40.780919 | ubuntu-noble | +## CHEF https://www.chef.io/chef/ 2026-06-22 02:37:40.781019 | ubuntu-noble | +-w /etc/chef -p wa -k soft_chef 2026-06-22 02:37:40.781111 | ubuntu-noble | + 2026-06-22 02:37:40.781250 | ubuntu-noble | +## Salt 2026-06-22 02:37:40.781308 | ubuntu-noble | +## https://saltproject.io/ 2026-06-22 02:37:40.781413 | ubuntu-noble | +## https://docs.saltproject.io/en/latest/ref/configuration/master.html 2026-06-22 02:37:40.781529 | ubuntu-noble | +-w /etc/salt -p wa -k soft_salt 2026-06-22 02:37:40.781631 | ubuntu-noble | +-w /usr/local/etc/salt -p wa -k soft_salt 2026-06-22 02:37:40.781737 | ubuntu-noble | + 2026-06-22 02:37:40.781834 | ubuntu-noble | +## Otter 2026-06-22 02:37:40.781937 | ubuntu-noble | +## https://inedo.com/otter 2026-06-22 02:37:40.782040 | ubuntu-noble | +-w /etc/otter -p wa -k soft_otter 2026-06-22 02:37:40.782138 | ubuntu-noble | + 2026-06-22 02:37:40.782269 | ubuntu-noble | +## T1081 Credentials In Files 2026-06-22 02:37:40.782375 | ubuntu-noble | +-w /usr/bin/grep -p x -k string_search 2026-06-22 02:37:40.782507 | ubuntu-noble | +-w /usr/bin/egrep -p x -k string_search 2026-06-22 02:37:40.782609 | ubuntu-noble | +-w /usr/bin/ugrep -p x -k string_search 2026-06-22 02:37:40.783447 | ubuntu-noble | +### macOS 2026-06-22 02:37:40.783468 | ubuntu-noble | +-w /usr/local/bin/grep -p x -k string_search 2026-06-22 02:37:40.783472 | ubuntu-noble | +-w /usr/local/bin/egrep -p x -k string_search 2026-06-22 02:37:40.783476 | ubuntu-noble | +-w /usr/local/bin/ugrep -p x -k string_search 2026-06-22 02:37:40.783480 | ubuntu-noble | + 2026-06-22 02:37:40.783485 | ubuntu-noble | +### https://github.com/tmbinc/bgrep 2026-06-22 02:37:40.783489 | ubuntu-noble | +-w /usr/bin/bgrep -p x -k string_search 2026-06-22 02:37:40.783493 | ubuntu-noble | +### macOS 2026-06-22 02:37:40.783529 | ubuntu-noble | +-w /usr/local/bin/bgrep -p x -k string_search 2026-06-22 02:37:40.783627 | ubuntu-noble | + 2026-06-22 02:37:40.783751 | ubuntu-noble | +### https://github.com/BurntSushi/ripgrep 2026-06-22 02:37:40.783854 | ubuntu-noble | +-w /usr/bin/rg -p x -k string_search 2026-06-22 02:37:40.783952 | ubuntu-noble | +### macOS 2026-06-22 02:37:40.784055 | ubuntu-noble | +-w /usr/local/bin/rg -p x -k string_search 2026-06-22 02:37:40.784151 | ubuntu-noble | + 2026-06-22 02:37:40.784276 | ubuntu-noble | +### https://github.com/awgn/cgrep 2026-06-22 02:37:40.784412 | ubuntu-noble | + 2026-06-22 02:37:40.784542 | ubuntu-noble | +-w /usr/bin/cgrep -p x -k string_search 2026-06-22 02:37:40.784642 | ubuntu-noble | +### macOS 2026-06-22 02:37:40.784764 | ubuntu-noble | +-w /usr/local/bin/cgrep -p x -k string_search 2026-06-22 02:37:40.784873 | ubuntu-noble | + 2026-06-22 02:37:40.785001 | ubuntu-noble | +### https://github.com/jpr5/ngrep 2026-06-22 02:37:40.785104 | ubuntu-noble | +-w /usr/bin/ngrep -p x -k string_search 2026-06-22 02:37:40.785202 | ubuntu-noble | +### macOS 2026-06-22 02:37:40.785305 | ubuntu-noble | +-w /usr/local/bin/ngrep -p x -k string_search 2026-06-22 02:37:40.785399 | ubuntu-noble | + 2026-06-22 02:37:40.785516 | ubuntu-noble | +### https://github.com/vrothberg/vgrep 2026-06-22 02:37:40.785616 | ubuntu-noble | +-w /usr/bin/vgrep -p x -k string_search 2026-06-22 02:37:40.785723 | ubuntu-noble | +### macOS 2026-06-22 02:37:40.785826 | ubuntu-noble | +-w /usr/local/bin/vgrep -p x -k string_search 2026-06-22 02:37:40.785920 | ubuntu-noble | + 2026-06-22 02:37:40.786027 | ubuntu-noble | +### https://github.com/monochromegane/the_platinum_searcher 2026-06-22 02:37:40.786133 | ubuntu-noble | +-w /usr/bin/pt -p x -k string_search 2026-06-22 02:37:40.786249 | ubuntu-noble | +### macOS 2026-06-22 02:37:40.786352 | ubuntu-noble | +-w /usr/local/bin/pt -p x -k string_search 2026-06-22 02:37:40.786477 | ubuntu-noble | + 2026-06-22 02:37:40.786582 | ubuntu-noble | +### https://github.com/gvansickle/ucg 2026-06-22 02:37:40.786684 | ubuntu-noble | +-w /usr/bin/ucg -p x -k string_search 2026-06-22 02:37:40.786799 | ubuntu-noble | +### macOS 2026-06-22 02:37:40.786903 | ubuntu-noble | +-w /usr/local/bin/ucg -p x -k string_search 2026-06-22 02:37:40.786998 | ubuntu-noble | + 2026-06-22 02:37:40.787101 | ubuntu-noble | +### https://github.com/ggreer/the_silver_searcher 2026-06-22 02:37:40.787202 | ubuntu-noble | +-w /usr/bin/ag -p x -k string_search 2026-06-22 02:37:40.787297 | ubuntu-noble | +### macOS 2026-06-22 02:37:40.787399 | ubuntu-noble | +-w /usr/local/bin/ag -p x -k string_search 2026-06-22 02:37:40.787503 | ubuntu-noble | + 2026-06-22 02:37:40.787606 | ubuntu-noble | +### https://github.com/beyondgrep/ack3 2026-06-22 02:37:40.787747 | ubuntu-noble | +### https://beyondgrep.com 2026-06-22 02:37:40.787824 | ubuntu-noble | +-w /usr/bin/ack -p x -k string_search 2026-06-22 02:37:40.787927 | ubuntu-noble | +-w /usr/local/bin/ack -p x -k string_search 2026-06-22 02:37:40.788028 | ubuntu-noble | +-w /usr/bin/semgrep -p x -k string_search 2026-06-22 02:37:40.788125 | ubuntu-noble | +### macOS 2026-06-22 02:37:40.788227 | ubuntu-noble | +-w /usr/local/bin/semgrep -p x -k string_search 2026-06-22 02:37:40.788322 | ubuntu-noble | + 2026-06-22 02:37:40.788421 | ubuntu-noble | +## Docker 2026-06-22 02:37:40.788829 | ubuntu-noble | +-w /usr/bin/dockerd -k docker 2026-06-22 02:37:40.788843 | ubuntu-noble | +-w /usr/bin/docker -k docker 2026-06-22 02:37:40.788847 | ubuntu-noble | +-w /usr/bin/docker-containerd -k docker 2026-06-22 02:37:40.788853 | ubuntu-noble | +-w /usr/bin/docker-runc -k docker 2026-06-22 02:37:40.788930 | ubuntu-noble | +-w /var/lib/docker -p wa -k docker 2026-06-22 02:37:40.789028 | ubuntu-noble | +-w /etc/docker -k docker 2026-06-22 02:37:40.789130 | ubuntu-noble | +-w /etc/sysconfig/docker -k docker 2026-06-22 02:37:40.789230 | ubuntu-noble | +-w /etc/sysconfig/docker-storage -k docker 2026-06-22 02:37:40.789333 | ubuntu-noble | +-w /usr/lib/systemd/system/docker.service -k docker 2026-06-22 02:37:40.789459 | ubuntu-noble | +-w /usr/lib/systemd/system/docker.socket -k docker 2026-06-22 02:37:40.789556 | ubuntu-noble | + 2026-06-22 02:37:40.789659 | ubuntu-noble | +## Virtualization stuff 2026-06-22 02:37:40.789775 | ubuntu-noble | +-w /usr/bin/qemu-system-x86_64 -p x -k qemu-system-x86_64 2026-06-22 02:37:40.789908 | ubuntu-noble | +-w /usr/bin/qemu-img -p x -k qemu-img 2026-06-22 02:37:40.789976 | ubuntu-noble | +-w /usr/bin/qemu-kvm -p x -k qemu-kvm 2026-06-22 02:37:40.790078 | ubuntu-noble | +-w /usr/bin/qemu -p x -k qemu 2026-06-22 02:37:40.790177 | ubuntu-noble | +-w /usr/bin/virtualbox -p x -k virtualbox 2026-06-22 02:37:40.790278 | ubuntu-noble | +-w /usr/bin/virt-manager -p x -k virt-manager 2026-06-22 02:37:40.790378 | ubuntu-noble | +-w /usr/bin/VBoxManage -p x -k VBoxManage 2026-06-22 02:37:40.790486 | ubuntu-noble | + 2026-06-22 02:37:40.790588 | ubuntu-noble | +#### VirtualBox on macOS 2026-06-22 02:37:40.790684 | ubuntu-noble | + 2026-06-22 02:37:40.790882 | ubuntu-noble | +-w /usr/local/bin/VirtualBox -p x -k virt_tool 2026-06-22 02:37:40.790990 | ubuntu-noble | +-w /usr/local/bin/VirtualBoxVM -p x -k virt_tool 2026-06-22 02:37:40.791091 | ubuntu-noble | +-w /usr/local/bin/VBoxManage -p x -k virt_tool 2026-06-22 02:37:40.791191 | ubuntu-noble | +-w /usr/local/bin/VBoxVRDP -p x -k virt_tool 2026-06-22 02:37:40.791292 | ubuntu-noble | +-w /usr/local/bin/VBoxHeadless -p x -k virt_tool 2026-06-22 02:37:40.791393 | ubuntu-noble | +-w /usr/local/bin/vboxwebsrv -p x -k virt_tool 2026-06-22 02:37:40.791520 | ubuntu-noble | +-w /usr/local/bin/VBoxBugReport -p x -k virt_tool 2026-06-22 02:37:40.791622 | ubuntu-noble | +-w /usr/local/bin/VBoxBalloonCtrl -p x -k virt_tool 2026-06-22 02:37:40.791739 | ubuntu-noble | +-w /usr/local/bin/VBoxAutostart -p x -k virt_tool 2026-06-22 02:37:40.791840 | ubuntu-noble | +-w /usr/local/bin/VBoxDTrace -p x -k virt_tool 2026-06-22 02:37:40.791940 | ubuntu-noble | +-w /usr/local/bin/vbox-img -p x -k virt_tool 2026-06-22 02:37:40.792069 | ubuntu-noble | +-w /Library/LaunchDaemons/org.virtualbox.startup.plist -p x -k virt_tool 2026-06-22 02:37:40.792150 | ubuntu-noble | +-w /Library/Application Support/VirtualBox/LaunchDaemons/ -p x -k virt_tool 2026-06-22 02:37:40.792254 | ubuntu-noble | +-w /Library/Application Support/VirtualBox/VBoxDrv.kext/ -p x -k virt_tool 2026-06-22 02:37:40.792359 | ubuntu-noble | +-w /Library/Application Support/VirtualBox/VBoxUSB.kext/ -p x -k virt_tool 2026-06-22 02:37:40.792471 | ubuntu-noble | +-w /Library/Application Support/VirtualBox/VBoxNetFlt.kext/ -p x -k virt_tool 2026-06-22 02:37:40.792573 | ubuntu-noble | +-w /Library/Application Support/VirtualBox/VBoxNetAdp.kext/ -p x -k virt_tool 2026-06-22 02:37:40.792667 | ubuntu-noble | + 2026-06-22 02:37:40.792782 | ubuntu-noble | +### Parallels Desktop on macOS 2026-06-22 02:37:40.792877 | ubuntu-noble | + 2026-06-22 02:37:40.792978 | ubuntu-noble | +-w /usr/local/bin/prl_convert -p x -k virt_tool 2026-06-22 02:37:40.793077 | ubuntu-noble | +-w /usr/local/bin/prl_disk_tool -p x -k virt_tool 2026-06-22 02:37:40.793178 | ubuntu-noble | +-w /usr/local/bin/prl_perf_ctl -p x -k virt_tool 2026-06-22 02:37:40.793278 | ubuntu-noble | +-w /usr/local/bin/prlcore2dmp -p x -k virt_tool 2026-06-22 02:37:40.793378 | ubuntu-noble | +-w /usr/local/bin/prlctl -p x -k virt_tool 2026-06-22 02:37:40.793492 | ubuntu-noble | +-w /usr/local/bin/prlexec -p x -k virt_tool 2026-06-22 02:37:40.793592 | ubuntu-noble | +-w /usr/local/bin/prlsrvctl -p x -k virt_tool 2026-06-22 02:37:40.793691 | ubuntu-noble | +-w /Library/Preferences/Parallels -p x -k virt_tool 2026-06-22 02:37:40.793798 | ubuntu-noble | + 2026-06-22 02:37:40.793898 | ubuntu-noble | +### qemu on macOS 2026-06-22 02:37:40.793994 | ubuntu-noble | + 2026-06-22 02:37:40.794095 | ubuntu-noble | +-w /usr/local/bin/qemu-edid -p x -k virt_tool 2026-06-22 02:37:40.794236 | ubuntu-noble | +-w /usr/local/bin/qemu-img -p x -k virt_tool 2026-06-22 02:37:40.794298 | ubuntu-noble | +-w /usr/local/bin/qemu-io -p x -k virt_tool 2026-06-22 02:37:40.794409 | ubuntu-noble | +-w /usr/local/bin/qemu-nbd -p x -k virt_tool 2026-06-22 02:37:40.794565 | ubuntu-noble | +-w /usr/local/bin/qemu-system-x86_64 -p x -k virt_tool 2026-06-22 02:37:40.794630 | ubuntu-noble | + 2026-06-22 02:37:40.794762 | ubuntu-noble | +## Kubelet 2026-06-22 02:37:40.794865 | ubuntu-noble | +-w /usr/bin/kubelet -k kubelet 2026-06-22 02:37:40.794957 | ubuntu-noble | + 2026-06-22 02:37:40.795324 | ubuntu-noble | +# ipc system call 2026-06-22 02:37:40.795334 | ubuntu-noble | +# /usr/include/linux/ipc.h 2026-06-22 02:37:40.795338 | ubuntu-noble | + 2026-06-22 02:37:40.795344 | ubuntu-noble | +## msgctl 2026-06-22 02:37:40.795449 | ubuntu-noble | +#-a always,exit -S ipc -F a0=14 -k Inter-Process_Communication 2026-06-22 02:37:40.795548 | ubuntu-noble | +## msgget 2026-06-22 02:37:40.795660 | ubuntu-noble | +#-a always,exit -S ipc -F a0=13 -k Inter-Process_Communication 2026-06-22 02:37:40.795777 | ubuntu-noble | +## Use these lines on x86_64, ia64 instead 2026-06-22 02:37:40.795881 | ubuntu-noble | +-a always,exit -F arch=b64 -S msgctl -k Inter-Process_Communication 2026-06-22 02:37:40.795985 | ubuntu-noble | +-a always,exit -F arch=b64 -S msgget -k Inter-Process_Communication 2026-06-22 02:37:40.796079 | ubuntu-noble | + 2026-06-22 02:37:40.796177 | ubuntu-noble | +## semctl 2026-06-22 02:37:40.796284 | ubuntu-noble | +#-a always,exit -S ipc -F a0=3 -k Inter-Process_Communication 2026-06-22 02:37:40.796406 | ubuntu-noble | +## semget 2026-06-22 02:37:40.796503 | ubuntu-noble | +#-a always,exit -S ipc -F a0=2 -k Inter-Process_Communication 2026-06-22 02:37:40.796599 | ubuntu-noble | +## semop 2026-06-22 02:37:40.796724 | ubuntu-noble | +#-a always,exit -S ipc -F a0=1 -k Inter-Process_Communication 2026-06-22 02:37:40.796827 | ubuntu-noble | +## semtimedop 2026-06-22 02:37:40.796932 | ubuntu-noble | +#-a always,exit -S ipc -F a0=4 -k Inter-Process_Communication 2026-06-22 02:37:40.797034 | ubuntu-noble | +## Use these lines on x86_64, ia64 instead 2026-06-22 02:37:40.797137 | ubuntu-noble | +-a always,exit -F arch=b64 -S semctl -k Inter-Process_Communication 2026-06-22 02:37:40.797244 | ubuntu-noble | +-a always,exit -F arch=b64 -S semget -k Inter-Process_Communication 2026-06-22 02:37:40.797346 | ubuntu-noble | +-a always,exit -F arch=b64 -S semop -k Inter-Process_Communication 2026-06-22 02:37:40.797499 | ubuntu-noble | +-a always,exit -F arch=b64 -S semtimedop -k Inter-Process_Communication 2026-06-22 02:37:40.797567 | ubuntu-noble | + 2026-06-22 02:37:40.797663 | ubuntu-noble | +## shmctl 2026-06-22 02:37:40.797781 | ubuntu-noble | +#-a always,exit -S ipc -F a0=24 -k Inter-Process_Communication 2026-06-22 02:37:40.797877 | ubuntu-noble | +## shmget 2026-06-22 02:37:40.797979 | ubuntu-noble | +#-a always,exit -S ipc -F a0=23 -k Inter-Process_Communication 2026-06-22 02:37:40.798078 | ubuntu-noble | +## Use these lines on x86_64, ia64 instead 2026-06-22 02:37:40.798196 | ubuntu-noble | +-a always,exit -F arch=b64 -S shmctl -k Inter-Process_Communication 2026-06-22 02:37:40.798310 | ubuntu-noble | +-a always,exit -F arch=b64 -S shmget -k Inter-Process_Communication 2026-06-22 02:37:40.798403 | ubuntu-noble | + 2026-06-22 02:37:40.798524 | ubuntu-noble | +# High Volume Events ---------------------------------------------------------- 2026-06-22 02:37:40.798621 | ubuntu-noble | + 2026-06-22 02:37:40.798741 | ubuntu-noble | +## Disable these rules if they create too many events in your environment 2026-06-22 02:37:40.799647 | ubuntu-noble | + 2026-06-22 02:37:40.799663 | ubuntu-noble | +## Common Shells 2026-06-22 02:37:40.799667 | ubuntu-noble | +-w /bin/bash -p x -k susp_shell 2026-06-22 02:37:40.799671 | ubuntu-noble | +-w /bin/dash -p x -k susp_shell 2026-06-22 02:37:40.799675 | ubuntu-noble | +-w /bin/busybox -p x -k susp_shell 2026-06-22 02:37:40.799679 | ubuntu-noble | +-w /bin/zsh -p x -k susp_shell 2026-06-22 02:37:40.799683 | ubuntu-noble | +-w /bin/sh -p x -k susp_shell 2026-06-22 02:37:40.799687 | ubuntu-noble | +-w /bin/ksh -p x -k susp_shell 2026-06-22 02:37:40.799738 | ubuntu-noble | + 2026-06-22 02:37:40.799837 | ubuntu-noble | +## Root command executions 2026-06-22 02:37:40.799945 | ubuntu-noble | +-a always,exit -F arch=b64 -F euid=0 -F auid>=1000 -F auid!=-1 -S execve -k rootcmd 2026-06-22 02:37:40.800038 | ubuntu-noble | + 2026-06-22 02:37:40.800140 | ubuntu-noble | +## File Deletion Events by User 2026-06-22 02:37:40.800246 | ubuntu-noble | +-a always,exit -F arch=b64 -S rmdir -S unlink -S unlinkat -S rename -S renameat -F auid>=1000 -F auid!=-1 -k delete 2026-06-22 02:37:40.800339 | ubuntu-noble | + 2026-06-22 02:37:40.800458 | ubuntu-noble | +## File Access 2026-06-22 02:37:40.800559 | ubuntu-noble | +### Unauthorized Access (unsuccessful) 2026-06-22 02:37:40.800669 | ubuntu-noble | +-a always,exit -F arch=b64 -S creat -S open -S openat -S open_by_handle_at -S truncate -S ftruncate -F exit=-EACCES -F auid>=1000 -F auid!=-1 -k file_access 2026-06-22 02:37:40.800797 | ubuntu-noble | +-a always,exit -F arch=b64 -S creat -S open -S openat -S open_by_handle_at -S truncate -S ftruncate -F exit=-EPERM -F auid>=1000 -F auid!=-1 -k file_access 2026-06-22 02:37:40.800883 | ubuntu-noble | + 2026-06-22 02:37:40.800985 | ubuntu-noble | +### Unsuccessful Creation 2026-06-22 02:37:40.801099 | ubuntu-noble | +-a always,exit -F arch=b64 -S mkdir,creat,link,symlink,mknod,mknodat,linkat,symlinkat -F exit=-EACCES -k file_creation 2026-06-22 02:37:40.801202 | ubuntu-noble | +-a always,exit -F arch=b64 -S mkdir,link,symlink,mkdirat -F exit=-EPERM -k file_creation 2026-06-22 02:37:40.801294 | ubuntu-noble | + 2026-06-22 02:37:40.801399 | ubuntu-noble | +### Unsuccessful Modification 2026-06-22 02:37:40.801523 | ubuntu-noble | +-a always,exit -F arch=b64 -S rename -S renameat -S truncate -S chmod -S setxattr -S lsetxattr -S removexattr -S lremovexattr -F exit=-EACCES -k file_modification 2026-06-22 02:37:40.801628 | ubuntu-noble | +-a always,exit -F arch=b64 -S rename -S renameat -S truncate -S chmod -S setxattr -S lsetxattr -S removexattr -S lremovexattr -F exit=-EPERM -k file_modification 2026-06-22 02:37:40.801737 | ubuntu-noble | + 2026-06-22 02:37:40.801838 | ubuntu-noble | +## 32bit API Exploitation 2026-06-22 02:37:40.801943 | ubuntu-noble | +### If you are on a 64 bit platform, everything _should_ be running 2026-06-22 02:37:40.802048 | ubuntu-noble | +### in 64 bit mode. This rule will detect any use of the 32 bit syscalls 2026-06-22 02:37:40.802154 | ubuntu-noble | +### because this might be a sign of someone exploiting a hole in the 32 2026-06-22 02:37:40.802270 | ubuntu-noble | +### bit API. 2026-06-22 02:37:40.802372 | ubuntu-noble | +-a always,exit -F arch=b32 -S all -k 32bit_api 2026-06-22 02:37:40.802495 | ubuntu-noble | + 2026-06-22 02:37:40.802599 | ubuntu-noble | +# Make The Configuration Immutable -------------------------------------------- 2026-06-22 02:37:40.802692 | ubuntu-noble | + 2026-06-22 02:37:40.802805 | ubuntu-noble | +##-e 2 2026-06-22 02:37:40.802900 | ubuntu-noble | 2026-06-22 02:37:40.803132 | ubuntu-noble | changed: [molecule-auditd] => (item=20-neo23x0.rules) => {"ansible_loop_var": "item", "changed": true, "checksum": "9f99ce5c4f891fbf3e2bce06ed4cb97fb9e01f41", "dest": "/etc/audit/rules.d/20-neo23x0.rules", "gid": 0, "group": "root", "item": "20-neo23x0.rules", "md5sum": "6ac57206fd77de34805c3f4d50ef8b1d", "mode": "0644", "owner": "root", "size": 27367, "src": "/home/zuul/.ansible/tmp/ansible-tmp-1782095859.5412538-2538-136947373494690/.source.rules", "state": "file", "uid": 0} 2026-06-22 02:37:40.803225 | ubuntu-noble | 2026-06-22 02:37:40.803331 | ubuntu-noble | TASK [auditd : Manage auditd service] ****************************************** 2026-06-22 02:37:40.502950 | debian-bookworm | --- before 2026-06-22 02:37:40.503101 | debian-bookworm | +++ after 2026-06-22 02:37:40.503155 | debian-bookworm | @@ -1,4 +1,4 @@ 2026-06-22 02:37:40.503269 | debian-bookworm | { 2026-06-22 02:37:40.503397 | debian-bookworm | "path": "/etc/audit/rules.d/audit.rules", 2026-06-22 02:37:40.503517 | debian-bookworm | - "state": "file" 2026-06-22 02:37:40.503637 | debian-bookworm | + "state": "absent" 2026-06-22 02:37:40.503804 | debian-bookworm | } 2026-06-22 02:37:40.503919 | debian-bookworm | 2026-06-22 02:37:40.504053 | debian-bookworm | changed: [molecule-auditd] => (item=audit.rules) => {"ansible_loop_var": "item", "changed": true, "item": "audit.rules", "path": "/etc/audit/rules.d/audit.rules", "state": "absent"} 2026-06-22 02:37:40.504182 | debian-bookworm | skipping: [molecule-auditd] => (item=20-neo23x0.rules) => {"ansible_loop_var": "item", "changed": false, "false_condition": "item not in auditd_rules_files", "item": "20-neo23x0.rules", "skip_reason": "Conditional result was False"} 2026-06-22 02:37:40.504295 | debian-bookworm | 2026-06-22 02:37:40.504505 | debian-bookworm | RUNNING HANDLER [auditd : Restart auditd service] ****************************** 2026-06-22 02:37:41.282114 | debian-bookworm | changed: [molecule-auditd] => {"changed": true, "name": "auditd", "state": "started", "status": {"ActiveEnterTimestamp": "Mon 2026-06-22 02:37:31 UTC", "ActiveEnterTimestampMonotonic": "4062976118", "ActiveExitTimestampMonotonic": "0", "ActiveState": "active", "After": "systemd-tmpfiles-setup.service system.slice local-fs.target systemd-journald.socket", "AllowIsolate": "no", "AssertResult": "yes", "AssertTimestamp": "Mon 2026-06-22 02:37:31 UTC", "AssertTimestampMonotonic": "4062895599", "Before": "shutdown.target ssh.service systemd-update-utmp.service sysinit.target", "BlockIOAccounting": "no", "BlockIOWeight": "[not set]", "CPUAccounting": "yes", "CPUAffinityFromNUMA": "no", "CPUQuotaPerSecUSec": "infinity", "CPUQuotaPeriodUSec": "infinity", "CPUSchedulingPolicy": "0", "CPUSchedulingPriority": "0", "CPUSchedulingResetOnFork": "no", "CPUShares": "[not set]", "CPUUsageNSec": "52592000", "CPUWeight": "[not set]", "CacheDirectoryMode": "0755", "CanFreeze": "yes", "CanIsolate": "no", "CanReload": "no", "CanStart": "yes", "CanStop": "yes", "CapabilityBoundingSet": "cap_chown cap_dac_override cap_dac_read_search cap_fowner cap_fsetid cap_kill cap_setgid cap_setuid cap_setpcap cap_linux_immutable cap_net_bind_service cap_net_broadcast cap_net_admin cap_net_raw cap_ipc_lock cap_ipc_owner cap_sys_rawio cap_sys_chroot cap_sys_ptrace cap_sys_pacct cap_sys_admin cap_sys_boot cap_sys_nice cap_sys_resource cap_sys_time cap_sys_tty_config cap_mknod cap_lease cap_audit_write cap_audit_control cap_setfcap cap_mac_override cap_mac_admin cap_syslog cap_wake_alarm cap_block_suspend cap_audit_read cap_perfmon cap_bpf cap_checkpoint_restore", "CleanResult": "success", "CollectMode": "inactive", "ConditionResult": "yes", "ConditionTimestamp": "Mon 2026-06-22 02:37:31 UTC", "ConditionTimestampMonotonic": "4062895552", "ConfigurationDirectoryMode": "0755", "Conflicts": "shutdown.target", "ControlGroup": "/system.slice/auditd.service", "ControlGroupId": "3328", "ControlPID": "0", "CoredumpFilter": "0x33", "DefaultDependencies": "no", "DefaultMemoryLow": "0", "DefaultMemoryMin": "0", "Delegate": "no", "Description": "Security Auditing Service", "DevicePolicy": "auto", "Documentation": "\"man:auditd(8)\" https://github.com/linux-audit/audit-documentation", "DynamicUser": "no", "ExecMainCode": "0", "ExecMainExitTimestampMonotonic": "0", "ExecMainPID": "2480", "ExecMainStartTimestamp": "Mon 2026-06-22 02:37:31 UTC", "ExecMainStartTimestampMonotonic": "4062945660", "ExecMainStatus": "0", "ExecStart": "{ path=/sbin/auditd ; argv[]=/sbin/auditd ; ignore_errors=no ; start_time=[Mon 2026-06-22 02:37:31 UTC] ; stop_time=[Mon 2026-06-22 02:37:31 UTC] ; pid=2479 ; code=exited ; status=0 }", "ExecStartEx": "{ path=/sbin/auditd ; argv[]=/sbin/auditd ; flags= ; start_time=[Mon 2026-06-22 02:37:31 UTC] ; stop_time=[Mon 2026-06-22 02:37:31 UTC] ; pid=2479 ; code=exited ; status=0 }", "ExecStartPost": "{ path=/sbin/augenrules ; argv[]=/sbin/augenrules --load ; ignore_errors=yes ; start_time=[Mon 2026-06-22 02:37:31 UTC] ; stop_time=[Mon 2026-06-22 02:37:31 UTC] ; pid=2483 ; code=exited ; status=0 }", "ExecStartPostEx": "{ path=/sbin/augenrules ; argv[]=/sbin/augenrules --load ; flags=ignore-failure ; start_time=[Mon 2026-06-22 02:37:31 UTC] ; stop_time=[Mon 2026-06-22 02:37:31 UTC] ; pid=2483 ; code=exited ; status=0 }", "ExitType": "main", "FailureAction": "none", "FileDescriptorStoreMax": "0", "FinalKillSignal": "9", "FragmentPath": "/lib/systemd/system/auditd.service", "FreezerState": "running", "GID": "[not set]", "GuessMainPID": "yes", "IOAccounting": "no", "IOReadBytes": "18446744073709551615", "IOReadOperations": "18446744073709551615", "IOSchedulingClass": "2", "IOSchedulingPriority": "4", "IOWeight": "[not set]", "IOWriteBytes": "18446744073709551615", "IOWriteOperations": "18446744073709551615", "IPAccounting": "no", "IPEgressBytes": "[no data]", "IPEgressPackets": "[no data]", "IPIngressBytes": "[no data]", "IPIngressPackets": "[no data]", "Id": "auditd.service", "IgnoreOnIsolate": "no", "IgnoreSIGPIPE": "yes", "InactiveEnterTimestampMonotonic": "0", "InactiveExitTimestamp": "Mon 2026-06-22 02:37:31 UTC", "InactiveExitTimestampMonotonic": "4062925591", "InvocationID": "7d5b4cf90c1c4b7db31d6d1a676de32d", "JobRunningTimeoutUSec": "infinity", "JobTimeoutAction": "none", "JobTimeoutUSec": "infinity", "KeyringMode": "private", "KillMode": "control-group", "KillSignal": "15", "LimitAS": "infinity", "LimitASSoft": "infinity", "LimitCORE": "infinity", "LimitCORESoft": "0", "LimitCPU": "infinity", "LimitCPUSoft": "infinity", "LimitDATA": "infinity", "LimitDATASoft": "infinity", "LimitFSIZE": "infinity", "LimitFSIZESoft": "infinity", "LimitLOCKS": "infinity", "LimitLOCKSSoft": "infinity", "LimitMEMLOCK": "8388608", "LimitMEMLOCKSoft": "8388608", "LimitMSGQUEUE": "819200", "LimitMSGQUEUESoft": "819200", "LimitNICE": "0", "LimitNICESoft": "0", "LimitNOFILE": "524288", "LimitNOFILESoft": "1024", "LimitNPROC": "15480", "LimitNPROCSoft": "15480", "LimitRSS": "infinity", "LimitRSSSoft": "infinity", "LimitRTPRIO": "0", "LimitRTPRIOSoft": "0", "LimitRTTIME": "infinity", "LimitRTTIMESoft": "infinity", "LimitSIGPENDING": "15480", "LimitSIGPENDINGSoft": "15480", "LimitSTACK": "infinity", "LimitSTACKSoft": "8388608", "LoadState": "loaded", "LockPersonality": "yes", "LogLevelMax": "-1", "LogRateLimitBurst": "0", "LogRateLimitIntervalUSec": "0", "LogsDirectoryMode": "0755", "MainPID": "2480", "ManagedOOMMemoryPressure": "auto", "ManagedOOMMemoryPressureLimit": "0", "ManagedOOMPreference": "none", "ManagedOOMSwap": "auto", "MemoryAccounting": "yes", "MemoryAvailable": "infinity", "MemoryCurrent": "720896", "MemoryDenyWriteExecute": "yes", "MemoryHigh": "infinity", "MemoryLimit": "infinity", "MemoryLow": "0", "MemoryMax": "infinity", "MemoryMin": "0", "MemorySwapMax": "infinity", "MountAPIVFS": "no", "NFileDescriptorStore": "0", "NRestarts": "0", "NUMAPolicy": "n/a", "Names": "auditd.service", "NeedDaemonReload": "no", "Nice": "0", "NoNewPrivileges": "no", "NonBlocking": "no", "NotifyAccess": "none", "OOMPolicy": "stop", "OOMScoreAdjust": "0", "OnFailureJobMode": "replace", "OnSuccessJobMode": "fail", "PIDFile": "/run/auditd.pid", "Perpetual": "no", "PrivateDevices": "no", "PrivateIPC": "no", "PrivateMounts": "no", "PrivateNetwork": "no", "PrivateTmp": "no", "PrivateUsers": "no", "ProcSubset": "all", "ProtectClock": "no", "ProtectControlGroups": "yes", "ProtectHome": "no", "ProtectHostname": "no", "ProtectKernelLogs": "no", "ProtectKernelModules": "yes", "ProtectKernelTunables": "no", "ProtectProc": "default", "ProtectSystem": "no", "RefuseManualStart": "no", "RefuseManualStop": "no", "ReloadResult": "success", "RemainAfterExit": "no", "RemoveIPC": "no", "Requires": "system.slice", "Restart": "on-failure", "RestartKillSignal": "15", "RestartPreventExitStatus": "2 4 6", "RestartUSec": "100ms", "RestrictNamespaces": "no", "RestrictRealtime": "yes", "RestrictSUIDSGID": "no", "Result": "success", "RootDirectoryStartOnly": "no", "RuntimeDirectoryMode": "0755", "RuntimeDirectoryPreserve": "no", "RuntimeMaxUSec": "infinity", "RuntimeRandomizedExtraUSec": "0", "SameProcessGroup": "no", "SecureBits": "0", "SendSIGHUP": "no", "SendSIGKILL": "yes", "Slice": "system.slice", "StandardError": "inherit", "StandardInput": "null", "StandardOutput": "journal", "StartLimitAction": "none", "StartLimitBurst": "5", "StartLimitIntervalUSec": "10s", "StartupBlockIOWeight": "[not set]", "StartupCPUShares": "[not set]", "StartupCPUWeight": "[not set]", "StartupIOWeight": "[not set]", "StateChangeTimestamp": "Mon 2026-06-22 02:37:31 UTC", "StateChangeTimestampMonotonic": "4062976118", "StateDirectoryMode": "0755", "StatusErrno": "0", "StopWhenUnneeded": "no", "SubState": "running", "SuccessAction": "none", "SyslogFacility": "3", "SyslogLevel": "6", "SyslogLevelPrefix": "yes", "SyslogPriority": "30", "SystemCallErrorNumber": "2147483646", "TTYReset": "no", "TTYVHangup": "no", "TTYVTDisallocate": "no", "TasksAccounting": "yes", "TasksCurrent": "2", "TasksMax": "4644", "TimeoutAbortUSec": "1min 30s", "TimeoutCleanUSec": "infinity", "TimeoutStartFailureMode": "terminate", "TimeoutStartUSec": "1min 30s", "TimeoutStopFailureMode": "terminate", "TimeoutStopUSec": "1min 30s", "TimerSlackNSec": "50000", "Transient": "no", "Type": "forking", "UID": "[not set]", "UMask": "0022", "UnitFilePreset": "enabled", "UnitFileState": "enabled", "UtmpMode": "init", "WantedBy": "multi-user.target", "WatchdogSignal": "6", "WatchdogTimestampMonotonic": "0", "WatchdogUSec": "0"}} 2026-06-22 02:37:41.288069 | debian-bookworm | 2026-06-22 02:37:41.288163 | debian-bookworm | RUNNING HANDLER [auditd : Generate auditd rules] ******************************* 2026-06-22 02:37:41.770573 | ubuntu-noble | ok: [molecule-auditd] => {"changed": false, "enabled": true, "name": "auditd", "state": "started", "status": {"ActiveEnterTimestamp": "Mon 2026-06-22 02:37:32 UTC", "ActiveEnterTimestampMonotonic": "3930296653", "ActiveExitTimestampMonotonic": "0", "ActiveState": "active", "After": "systemd-journald.socket local-fs.target system.slice systemd-tmpfiles-setup.service", "AllowIsolate": "no", "AssertResult": "yes", "AssertTimestamp": "Mon 2026-06-22 02:37:32 UTC", "AssertTimestampMonotonic": "3930243509", "Before": "systemd-update-utmp.service shutdown.target sysinit.target ssh.service", "BlockIOAccounting": "no", "BlockIOWeight": "[not set]", "CPUAccounting": "yes", "CPUAffinityFromNUMA": "no", "CPUQuotaPerSecUSec": "infinity", "CPUQuotaPeriodUSec": "infinity", "CPUSchedulingPolicy": "0", "CPUSchedulingPriority": "0", "CPUSchedulingResetOnFork": "no", "CPUShares": "[not set]", "CPUUsageNSec": "41753000", "CPUWeight": "[not set]", "CacheDirectoryMode": "0755", "CanFreeze": "yes", "CanIsolate": "no", "CanReload": "no", "CanStart": "yes", "CanStop": "yes", "CapabilityBoundingSet": "cap_chown cap_dac_override cap_dac_read_search cap_fowner cap_fsetid cap_kill cap_setgid cap_setuid cap_setpcap cap_linux_immutable cap_net_bind_service cap_net_broadcast cap_net_admin cap_net_raw cap_ipc_lock cap_ipc_owner cap_sys_rawio cap_sys_chroot cap_sys_ptrace cap_sys_pacct cap_sys_admin cap_sys_boot cap_sys_nice cap_sys_resource cap_sys_time cap_sys_tty_config cap_mknod cap_lease cap_audit_write cap_audit_control cap_setfcap cap_mac_override cap_mac_admin cap_syslog cap_wake_alarm cap_block_suspend cap_audit_read cap_perfmon cap_bpf cap_checkpoint_restore", "CleanResult": "success", "CollectMode": "inactive", "ConditionResult": "yes", "ConditionTimestamp": "Mon 2026-06-22 02:37:32 UTC", "ConditionTimestampMonotonic": "3930243462", "ConfigurationDirectoryMode": "0755", "Conflicts": "shutdown.target", "ControlGroup": "/system.slice/auditd.service", "ControlGroupId": "3868", "ControlPID": "0", "CoredumpFilter": "0x33", "CoredumpReceive": "no", "DefaultDependencies": "no", "DefaultMemoryLow": "0", "DefaultMemoryMin": "0", "DefaultStartupMemoryLow": "0", "Delegate": "no", "Description": "Security Auditing Service", "DevicePolicy": "auto", "Documentation": "\"man:auditd(8)\" https://github.com/linux-audit/audit-documentation", "DynamicUser": "no", "ExecMainCode": "0", "ExecMainExitTimestampMonotonic": "0", "ExecMainPID": "2307", "ExecMainStartTimestamp": "Mon 2026-06-22 02:37:32 UTC", "ExecMainStartTimestampMonotonic": "3930264443", "ExecMainStatus": "0", "ExecStart": "{ path=/sbin/auditd ; argv[]=/sbin/auditd ; ignore_errors=no ; start_time=[Mon 2026-06-22 02:37:32 UTC] ; stop_time=[Mon 2026-06-22 02:37:32 UTC] ; pid=2306 ; code=exited ; status=0 }", "ExecStartEx": "{ path=/sbin/auditd ; argv[]=/sbin/auditd ; flags= ; start_time=[Mon 2026-06-22 02:37:32 UTC] ; stop_time=[Mon 2026-06-22 02:37:32 UTC] ; pid=2306 ; code=exited ; status=0 }", "ExecStartPost": "{ path=/sbin/augenrules ; argv[]=/sbin/augenrules --load ; ignore_errors=yes ; start_time=[Mon 2026-06-22 02:37:32 UTC] ; stop_time=[Mon 2026-06-22 02:37:32 UTC] ; pid=2310 ; code=exited ; status=0 }", "ExecStartPostEx": "{ path=/sbin/augenrules ; argv[]=/sbin/augenrules --load ; flags=ignore-failure ; start_time=[Mon 2026-06-22 02:37:32 UTC] ; stop_time=[Mon 2026-06-22 02:37:32 UTC] ; pid=2310 ; code=exited ; status=0 }", "ExitType": "main", "ExtensionImagePolicy": "root=verity+signed+encrypted+unprotected+absent:usr=verity+signed+encrypted+unprotected+absent:home=encrypted+unprotected+absent:srv=encrypted+unprotected+absent:tmp=encrypted+unprotected+absent:var=encrypted+unprotected+absent", "FailureAction": "none", "FileDescriptorStoreMax": "0", "FileDescriptorStorePreserve": "restart", "FinalKillSignal": "9", "FragmentPath": "/usr/lib/systemd/system/auditd.service", "FreezerState": "running", "GID": "[not set]", "GuessMainPID": "yes", "IOAccounting": "no", "IOReadBytes": "[not set]", "IOReadOperations": "[not set]", "IOSchedulingClass": "2", "IOSchedulingPriority": "4", "IOWeight": "[not set]", "IOWriteBytes": "[not set]", "IOWriteOperations": "[not set]", "IPAccounting": "no", "IPEgressBytes": "[no data]", "IPEgressPackets": "[no data]", "IPIngressBytes": "[no data]", "IPIngressPackets": "[no data]", "Id": "auditd.service", "IgnoreOnIsolate": "no", "IgnoreSIGPIPE": "yes", "InactiveEnterTimestampMonotonic": "0", "InactiveExitTimestamp": "Mon 2026-06-22 02:37:32 UTC", "InactiveExitTimestampMonotonic": "3930252274", "InvocationID": "3f2497fbf6644ed1ac24363f5dab8ed6", "JobRunningTimeoutUSec": "infinity", "JobTimeoutAction": "none", "JobTimeoutUSec": "infinity", "KeyringMode": "private", "KillMode": "control-group", "KillSignal": "15", "LimitAS": "infinity", "LimitASSoft": "infinity", "LimitCORE": "infinity", "LimitCORESoft": "0", "LimitCPU": "infinity", "LimitCPUSoft": "infinity", "LimitDATA": "infinity", "LimitDATASoft": "infinity", "LimitFSIZE": "infinity", "LimitFSIZESoft": "infinity", "LimitLOCKS": "infinity", "LimitLOCKSSoft": "infinity", "LimitMEMLOCK": "8388608", "LimitMEMLOCKSoft": "8388608", "LimitMSGQUEUE": "819200", "LimitMSGQUEUESoft": "819200", "LimitNICE": "0", "LimitNICESoft": "0", "LimitNOFILE": "524288", "LimitNOFILESoft": "1024", "LimitNPROC": "15372", "LimitNPROCSoft": "15372", "LimitRSS": "infinity", "LimitRSSSoft": "infinity", "LimitRTPRIO": "0", "LimitRTPRIOSoft": "0", "LimitRTTIME": "infinity", "LimitRTTIMESoft": "infinity", "LimitSIGPENDING": "15372", "LimitSIGPENDINGSoft": "15372", "LimitSTACK": "infinity", "LimitSTACKSoft": "8388608", "LoadState": "loaded", "LockPersonality": "yes", "LogLevelMax": "-1", "LogRateLimitBurst": "0", "LogRateLimitIntervalUSec": "0", "LogsDirectoryMode": "0755", "MainPID": "2307", "ManagedOOMMemoryPressure": "auto", "ManagedOOMMemoryPressureLimit": "0", "ManagedOOMPreference": "none", "ManagedOOMSwap": "auto", "MemoryAccounting": "yes", "MemoryAvailable": "3534327808", "MemoryCurrent": "499712", "MemoryDenyWriteExecute": "yes", "MemoryHigh": "infinity", "MemoryKSM": "no", "MemoryLimit": "infinity", "MemoryLow": "0", "MemoryMax": "infinity", "MemoryMin": "0", "MemoryPeak": "2330624", "MemoryPressureThresholdUSec": "200ms", "MemoryPressureWatch": "auto", "MemorySwapCurrent": "0", "MemorySwapMax": "infinity", "MemorySwapPeak": "0", "MemoryZSwapCurrent": "0", "MemoryZSwapMax": "infinity", "MountAPIVFS": "no", "MountImagePolicy": "root=verity+signed+encrypted+unprotected+absent:usr=verity+signed+encrypted+unprotected+absent:home=encrypted+unprotected+absent:srv=encrypted+unprotected+absent:tmp=encrypted+unprotected+absent:var=encrypted+unprotected+absent", "NFileDescriptorStore": "0", "NRestarts": "0", "NUMAPolicy": "n/a", "Names": "auditd.service", "NeedDaemonReload": "no", "Nice": "0", "NoNewPrivileges": "no", "NonBlocking": "no", "NotifyAccess": "none", "OOMPolicy": "stop", "OOMScoreAdjust": "0", "OnFailureJobMode": "replace", "OnSuccessJobMode": "fail", "PIDFile": "/run/auditd.pid", "Perpetual": "no", "PrivateDevices": "no", "PrivateIPC": "no", "PrivateMounts": "no", "PrivateNetwork": "no", "PrivateTmp": "no", "PrivateUsers": "no", "ProcSubset": "all", "ProtectClock": "no", "ProtectControlGroups": "no", "ProtectHome": "no", "ProtectHostname": "no", "ProtectKernelLogs": "no", "ProtectKernelModules": "yes", "ProtectKernelTunables": "no", "ProtectProc": "default", "ProtectSystem": "no", "RefuseManualStart": "no", "RefuseManualStop": "no", "ReloadResult": "success", "ReloadSignal": "1", "RemainAfterExit": "no", "RemoveIPC": "no", "Requires": "system.slice", "Restart": "on-failure", "RestartKillSignal": "15", "RestartMaxDelayUSec": "infinity", "RestartMode": "normal", "RestartPreventExitStatus": "2 4 6", "RestartSteps": "0", "RestartUSec": "100ms", "RestartUSecNext": "100ms", "RestrictNamespaces": "no", "RestrictRealtime": "yes", "RestrictSUIDSGID": "no", "Result": "success", "RootDirectoryStartOnly": "no", "RootEphemeral": "no", "RootImagePolicy": "root=verity+signed+encrypted+unprotected+absent:usr=verity+signed+encrypted+unprotected+absent:home=encrypted+unprotected+absent:srv=encrypted+unprotected+absent:tmp=encrypted+unprotected+absent:var=encrypted+unprotected+absent", "RuntimeDirectoryMode": "0755", "RuntimeDirectoryPreserve": "no", "RuntimeMaxUSec": "infinity", "RuntimeRandomizedExtraUSec": "0", "SameProcessGroup": "no", "SecureBits": "0", "SendSIGHUP": "no", "SendSIGKILL": "yes", "SetLoginEnvironment": "no", "Slice": "system.slice", "StandardError": "inherit", "StandardInput": "null", "StandardOutput": "journal", "StartLimitAction": "none", "StartLimitBurst": "5", "StartLimitIntervalUSec": "10s", "StartupBlockIOWeight": "[not set]", "StartupCPUShares": "[not set]", "StartupCPUWeight": "[not set]", "StartupIOWeight": "[not set]", "StartupMemoryHigh": "infinity", "StartupMemoryLow": "0", "StartupMemoryMax": "infinity", "StartupMemorySwapMax": "infinity", "StartupMemoryZSwapMax": "infinity", "StateChangeTimestamp": "Mon 2026-06-22 02:37:32 UTC", "StateChangeTimestampMonotonic": "3930296653", "StateDirectoryMode": "0755", "StatusErrno": "0", "StopWhenUnneeded": "no", "SubState": "running", "SuccessAction": "none", "SurviveFinalKillSignal": "no", "SyslogFacility": "3", "SyslogLevel": "6", "SyslogLevelPrefix": "yes", "SyslogPriority": "30", "SystemCallErrorNumber": "2147483646", "TTYReset": "no", "TTYVHangup": "no", "TTYVTDisallocate": "no", "TasksAccounting": "yes", "TasksCurrent": "2", "TasksMax": "4611", "TimeoutAbortUSec": "1min 30s", "TimeoutCleanUSec": "infinity", "TimeoutStartFailureMode": "terminate", "TimeoutStartUSec": "1min 30s", "TimeoutStopFailureMode": "terminate", "TimeoutStopUSec": "1min 30s", "TimerSlackNSec": "50000", "Transient": "no", "Type": "forking", "UID": "[not set]", "UMask": "0022", "UnitFilePreset": "enabled", "UnitFileState": "enabled", "UtmpMode": "init", "WantedBy": "multi-user.target", "WatchdogSignal": "6", "WatchdogTimestampMonotonic": "0", "WatchdogUSec": "0"}} 2026-06-22 02:37:41.776504 | ubuntu-noble | 2026-06-22 02:37:41.777310 | ubuntu-noble | TASK [auditd : List existing rules files] ************************************** 2026-06-22 02:37:41.805756 | debian-bookworm | changed: [molecule-auditd] => {"changed": true, "cmd": ["augenrules", "--load"], "delta": "0:00:00.105057", "end": "2026-06-22 02:37:41.748400", "msg": "", "rc": 0, "start": "2026-06-22 02:37:41.643343", "stderr": "Unknown user: chrony\nThere was an error in line 24 of /etc/audit/audit.rules\nError sending add rule data request (No such file or directory)\nThere was an error in line 28 of /etc/audit/audit.rules\nUnknown user: ntp\nThere was an error in line 44 of /etc/audit/audit.rules\nError sending add rule data request (No such file or directory)\nThere was an error in line 83 of /etc/audit/audit.rules\nError sending add rule data request (No such file or directory)\nThere was an error in line 84 of /etc/audit/audit.rules\nError sending add rule data request (No such file or directory)\nThere was an error in line 112 of /etc/audit/audit.rules\nError sending add rule data request (No such file or directory)\nThere was an error in line 115 of /etc/audit/audit.rules\nError sending add rule data request (No such file or directory)\nThere was an error in line 176 of /etc/audit/audit.rules\nError sending add rule data request (No such file or directory)\nThere was an error in line 177 of /etc/audit/audit.rules\nError sending add rule data request (No such file or directory)\nThere was an error in line 178 of /etc/audit/audit.rules\nError sending add rule data request (No such file or directory)\nThere was an error in line 179 of /etc/audit/audit.rules\nError sending add rule data request (No such file or directory)\nThere was an error in line 180 of /etc/audit/audit.rules\nError sending add rule data request (No such file or directory)\nThere was an error in line 217 of /etc/audit/audit.rules\nError sending add rule data request (No such file or directory)\nThere was an error in line 218 of /etc/audit/audit.rules\nError sending add rule data request (No such file or directory)\nThere was an error in line 234 of /etc/audit/audit.rules\nError sending add rule data request (No such file or directory)\nThere was an error in line 285 of /etc/audit/audit.rules\nError sending add rule data request (No such file or directory)\nThere was an error in line 286 of /etc/audit/audit.rules\nError sending add rule data request (No such file or directory)\nThere was an error in line 324 of /etc/audit/audit.rules\nError sending add rule data request (No such file or directory)\nThere was an error in line 325 of /etc/audit/audit.rules\nError sending add rule data request (No such file or directory)\nThere was an error in line 346 of /etc/audit/audit.rules\nparameter passed without an option given\nThere was an error in line 347 of /etc/audit/audit.rules\nparameter passed without an option given\nThere was an error in line 348 of /etc/audit/audit.rules\nparameter passed without an option given\nThere was an error in line 349 of /etc/audit/audit.rules\nparameter passed without an option given\nThere was an error in line 350 of /etc/audit/audit.rules\nparameter passed without an option given\nThere was an error in line 351 of /etc/audit/audit.rules\nError sending add rule data request (No such file or directory)\nThere was an error in line 359 of /etc/audit/audit.rules", "stderr_lines": ["Unknown user: chrony", "There was an error in line 24 of /etc/audit/audit.rules", "Error sending add rule data request (No such file or directory)", "There was an error in line 28 of /etc/audit/audit.rules", "Unknown user: ntp", "There was an error in line 44 of /etc/audit/audit.rules", "Error sending add rule data request (No such file or directory)", "There was an error in line 83 of /etc/audit/audit.rules", "Error sending add rule data request (No such file or directory)", "There was an error in line 84 of /etc/audit/audit.rules", "Error sending add rule data request (No such file or directory)", "There was an error in line 112 of /etc/audit/audit.rules", "Error sending add rule data request (No such file or directory)", "There was an error in line 115 of /etc/audit/audit.rules", "Error sending add rule data request (No such file or directory)", "There was an error in line 176 of /etc/audit/audit.rules", "Error sending add rule data request (No such file or directory)", "There was an error in line 177 of /etc/audit/audit.rules", "Error sending add rule data request (No such file or directory)", "There was an error in line 178 of /etc/audit/audit.rules", "Error sending add rule data request (No such file or directory)", "There was an error in line 179 of /etc/audit/audit.rules", "Error sending add rule data request (No such file or directory)", "There was an error in line 180 of /etc/audit/audit.rules", "Error sending add rule data request (No such file or directory)", "There was an error in line 217 of /etc/audit/audit.rules", "Error sending add rule data request (No such file or directory)", "There was an error in line 218 of /etc/audit/audit.rules", "Error sending add rule data request (No such file or directory)", "There was an error in line 234 of /etc/audit/audit.rules", "Error sending add rule data request (No such file or directory)", "There was an error in line 285 of /etc/audit/audit.rules", "Error sending add rule data request (No such file or directory)", "There was an error in line 286 of /etc/audit/audit.rules", "Error sending add rule data request (No such file or directory)", "There was an error in line 324 of /etc/audit/audit.rules", "Error sending add rule data request (No such file or directory)", "There was an error in line 325 of /etc/audit/audit.rules", "Error sending add rule data request (No such file or directory)", "There was an error in line 346 of /etc/audit/audit.rules", "parameter passed without an option given", "There was an error in line 347 of /etc/audit/audit.rules", "parameter passed without an option given", "There was an error in line 348 of /etc/audit/audit.rules", "parameter passed without an option given", "There was an error in line 349 of /etc/audit/audit.rules", "parameter passed without an option given", "There was an error in line 350 of /etc/audit/audit.rules", "parameter passed without an option given", "There was an error in line 351 of /etc/audit/audit.rules", "Error sending add rule data request (No such file or directory)", "There was an error in line 359 of /etc/audit/audit.rules"], "stdout": "/usr/sbin/augenrules: No change\nNo rules\nenabled 1\nfailure 1\npid 2871\nrate_limit 0\nbacklog_limit 8192\nlost 0\nbacklog 164\nbacklog_wait_time 60000\nbacklog_wait_time_actual 0\nenabled 1\nfailure 1\npid 2871\nrate_limit 0\nbacklog_limit 8192\nlost 0\nbacklog 0\nbacklog_wait_time 60000\nbacklog_wait_time_actual 0", "stdout_lines": ["/usr/sbin/augenrules: No change", "No rules", "enabled 1", "failure 1", "pid 2871", "rate_limit 0", "backlog_limit 8192", "lost 0", "backlog 164", "backlog_wait_time 60000", "backlog_wait_time_actual 0", "enabled 1", "failure 1", "pid 2871", "rate_limit 0", "backlog_limit 8192", "lost 0", "backlog 0", "backlog_wait_time 60000", "backlog_wait_time_actual 0"]} 2026-06-22 02:37:41.805832 | debian-bookworm | 2026-06-22 02:37:41.805976 | debian-bookworm | RUNNING HANDLER [auditd : Restart auditd service] ****************************** 2026-06-22 02:37:42.408694 | ubuntu-noble | ok: [molecule-auditd] => {"changed": false, "cmd": ["find", "/etc/audit/rules.d", "-type", "f", "-printf", "%f\n"], "delta": "0:00:00.007822", "end": "2026-06-22 02:37:42.355210", "msg": "", "rc": 0, "start": "2026-06-22 02:37:42.347388", "stderr": "", "stderr_lines": [], "stdout": "audit.rules\n20-neo23x0.rules", "stdout_lines": ["audit.rules", "20-neo23x0.rules"]} 2026-06-22 02:37:42.408840 | ubuntu-noble | 2026-06-22 02:37:42.409008 | ubuntu-noble | TASK [auditd : Remove unmanaged rules files] *********************************** 2026-06-22 02:37:42.623111 | debian-bookworm | changed: [molecule-auditd] => {"changed": true, "name": "auditd", "state": "started", "status": {"ActiveEnterTimestamp": "Mon 2026-06-22 02:37:41 UTC", "ActiveEnterTimestampMonotonic": "4072964209", "ActiveExitTimestamp": "Mon 2026-06-22 02:37:41 UTC", "ActiveExitTimestampMonotonic": "4072788641", "ActiveState": "active", "After": "systemd-tmpfiles-setup.service system.slice local-fs.target systemd-journald.socket", "AllowIsolate": "no", "AssertResult": "yes", "AssertTimestamp": "Mon 2026-06-22 02:37:41 UTC", "AssertTimestampMonotonic": "4072832091", "Before": "shutdown.target ssh.service systemd-update-utmp.service sysinit.target", "BlockIOAccounting": "no", "BlockIOWeight": "[not set]", "CPUAccounting": "yes", "CPUAffinityFromNUMA": "no", "CPUQuotaPerSecUSec": "infinity", "CPUQuotaPeriodUSec": "infinity", "CPUSchedulingPolicy": "0", "CPUSchedulingPriority": "0", "CPUSchedulingResetOnFork": "no", "CPUShares": "[not set]", "CPUUsageNSec": "159931000", "CPUWeight": "[not set]", "CacheDirectoryMode": "0755", "CanFreeze": "yes", "CanIsolate": "no", "CanReload": "no", "CanStart": "yes", "CanStop": "yes", "CapabilityBoundingSet": "cap_chown cap_dac_override cap_dac_read_search cap_fowner cap_fsetid cap_kill cap_setgid cap_setuid cap_setpcap cap_linux_immutable cap_net_bind_service cap_net_broadcast cap_net_admin cap_net_raw cap_ipc_lock cap_ipc_owner cap_sys_rawio cap_sys_chroot cap_sys_ptrace cap_sys_pacct cap_sys_admin cap_sys_boot cap_sys_nice cap_sys_resource cap_sys_time cap_sys_tty_config cap_mknod cap_lease cap_audit_write cap_audit_control cap_setfcap cap_mac_override cap_mac_admin cap_syslog cap_wake_alarm cap_block_suspend cap_audit_read cap_perfmon cap_bpf cap_checkpoint_restore", "CleanResult": "success", "CollectMode": "inactive", "ConditionResult": "yes", "ConditionTimestamp": "Mon 2026-06-22 02:37:41 UTC", "ConditionTimestampMonotonic": "4072831954", "ConfigurationDirectoryMode": "0755", "Conflicts": "shutdown.target", "ControlGroup": "/system.slice/auditd.service", "ControlGroupId": "3367", "ControlPID": "0", "CoredumpFilter": "0x33", "DefaultDependencies": "no", "DefaultMemoryLow": "0", "DefaultMemoryMin": "0", "Delegate": "no", "Description": "Security Auditing Service", "DevicePolicy": "auto", "Documentation": "\"man:auditd(8)\" https://github.com/linux-audit/audit-documentation", "DynamicUser": "no", "ExecMainCode": "0", "ExecMainExitTimestampMonotonic": "0", "ExecMainPID": "2871", "ExecMainStartTimestamp": "Mon 2026-06-22 02:37:41 UTC", "ExecMainStartTimestampMonotonic": "4072861121", "ExecMainStatus": "0", "ExecStart": "{ path=/sbin/auditd ; argv[]=/sbin/auditd ; ignore_errors=no ; start_time=[Mon 2026-06-22 02:37:41 UTC] ; stop_time=[Mon 2026-06-22 02:37:41 UTC] ; pid=2869 ; code=exited ; status=0 }", "ExecStartEx": "{ path=/sbin/auditd ; argv[]=/sbin/auditd ; flags= ; start_time=[Mon 2026-06-22 02:37:41 UTC] ; stop_time=[Mon 2026-06-22 02:37:41 UTC] ; pid=2869 ; code=exited ; status=0 }", "ExecStartPost": "{ path=/sbin/augenrules ; argv[]=/sbin/augenrules --load ; ignore_errors=yes ; start_time=[Mon 2026-06-22 02:37:41 UTC] ; stop_time=[Mon 2026-06-22 02:37:41 UTC] ; pid=2874 ; code=exited ; status=0 }", "ExecStartPostEx": "{ path=/sbin/augenrules ; argv[]=/sbin/augenrules --load ; flags=ignore-failure ; start_time=[Mon 2026-06-22 02:37:41 UTC] ; stop_time=[Mon 2026-06-22 02:37:41 UTC] ; pid=2874 ; code=exited ; status=0 }", "ExitType": "main", "FailureAction": "none", "FileDescriptorStoreMax": "0", "FinalKillSignal": "9", "FragmentPath": "/lib/systemd/system/auditd.service", "FreezerState": "running", "GID": "[not set]", "GuessMainPID": "yes", "IOAccounting": "no", "IOReadBytes": "18446744073709551615", "IOReadOperations": "18446744073709551615", "IOSchedulingClass": "2", "IOSchedulingPriority": "4", "IOWeight": "[not set]", "IOWriteBytes": "18446744073709551615", "IOWriteOperations": "18446744073709551615", "IPAccounting": "no", "IPEgressBytes": "[no data]", "IPEgressPackets": "[no data]", "IPIngressBytes": "[no data]", "IPIngressPackets": "[no data]", "Id": "auditd.service", "IgnoreOnIsolate": "no", "IgnoreSIGPIPE": "yes", "InactiveEnterTimestamp": "Mon 2026-06-22 02:37:41 UTC", "InactiveEnterTimestampMonotonic": "4072830740", "InactiveExitTimestamp": "Mon 2026-06-22 02:37:41 UTC", "InactiveExitTimestampMonotonic": "4072841669", "InvocationID": "dd8d3dc05dee44158db852a534fba1fd", "JobRunningTimeoutUSec": "infinity", "JobTimeoutAction": "none", "JobTimeoutUSec": "infinity", "KeyringMode": "private", "KillMode": "control-group", "KillSignal": "15", "LimitAS": "infinity", "LimitASSoft": "infinity", "LimitCORE": "infinity", "LimitCORESoft": "0", "LimitCPU": "infinity", "LimitCPUSoft": "infinity", "LimitDATA": "infinity", "LimitDATASoft": "infinity", "LimitFSIZE": "infinity", "LimitFSIZESoft": "infinity", "LimitLOCKS": "infinity", "LimitLOCKSSoft": "infinity", "LimitMEMLOCK": "8388608", "LimitMEMLOCKSoft": "8388608", "LimitMSGQUEUE": "819200", "LimitMSGQUEUESoft": "819200", "LimitNICE": "0", "LimitNICESoft": "0", "LimitNOFILE": "524288", "LimitNOFILESoft": "1024", "LimitNPROC": "15480", "LimitNPROCSoft": "15480", "LimitRSS": "infinity", "LimitRSSSoft": "infinity", "LimitRTPRIO": "0", "LimitRTPRIOSoft": "0", "LimitRTTIME": "infinity", "LimitRTTIMESoft": "infinity", "LimitSIGPENDING": "15480", "LimitSIGPENDINGSoft": "15480", "LimitSTACK": "infinity", "LimitSTACKSoft": "8388608", "LoadState": "loaded", "LockPersonality": "yes", "LogLevelMax": "-1", "LogRateLimitBurst": "0", "LogRateLimitIntervalUSec": "0", "LogsDirectoryMode": "0755", "MainPID": "2871", "ManagedOOMMemoryPressure": "auto", "ManagedOOMMemoryPressureLimit": "0", "ManagedOOMPreference": "none", "ManagedOOMSwap": "auto", "MemoryAccounting": "yes", "MemoryAvailable": "infinity", "MemoryCurrent": "2072576", "MemoryDenyWriteExecute": "yes", "MemoryHigh": "infinity", "MemoryLimit": "infinity", "MemoryLow": "0", "MemoryMax": "infinity", "MemoryMin": "0", "MemorySwapMax": "infinity", "MountAPIVFS": "no", "NFileDescriptorStore": "0", "NRestarts": "0", "NUMAPolicy": "n/a", "Names": "auditd.service", "NeedDaemonReload": "no", "Nice": "0", "NoNewPrivileges": "no", "NonBlocking": "no", "NotifyAccess": "none", "OOMPolicy": "stop", "OOMScoreAdjust": "0", "OnFailureJobMode": "replace", "OnSuccessJobMode": "fail", "PIDFile": "/run/auditd.pid", "Perpetual": "no", "PrivateDevices": "no", "PrivateIPC": "no", "PrivateMounts": "no", "PrivateNetwork": "no", "PrivateTmp": "no", "PrivateUsers": "no", "ProcSubset": "all", "ProtectClock": "no", "ProtectControlGroups": "yes", "ProtectHome": "no", "ProtectHostname": "no", "ProtectKernelLogs": "no", "ProtectKernelModules": "yes", "ProtectKernelTunables": "no", "ProtectProc": "default", "ProtectSystem": "no", "RefuseManualStart": "no", "RefuseManualStop": "no", "ReloadResult": "success", "RemainAfterExit": "no", "RemoveIPC": "no", "Requires": "system.slice", "Restart": "on-failure", "RestartKillSignal": "15", "RestartPreventExitStatus": "2 4 6", "RestartUSec": "100ms", "RestrictNamespaces": "no", "RestrictRealtime": "yes", "RestrictSUIDSGID": "no", "Result": "success", "RootDirectoryStartOnly": "no", "RuntimeDirectoryMode": "0755", "RuntimeDirectoryPreserve": "no", "RuntimeMaxUSec": "infinity", "RuntimeRandomizedExtraUSec": "0", "SameProcessGroup": "no", "SecureBits": "0", "SendSIGHUP": "no", "SendSIGKILL": "yes", "Slice": "system.slice", "StandardError": "inherit", "StandardInput": "null", "StandardOutput": "journal", "StartLimitAction": "none", "StartLimitBurst": "5", "StartLimitIntervalUSec": "10s", "StartupBlockIOWeight": "[not set]", "StartupCPUShares": "[not set]", "StartupCPUWeight": "[not set]", "StartupIOWeight": "[not set]", "StateChangeTimestamp": "Mon 2026-06-22 02:37:41 UTC", "StateChangeTimestampMonotonic": "4072964209", "StateDirectoryMode": "0755", "StatusErrno": "0", "StopWhenUnneeded": "no", "SubState": "running", "SuccessAction": "none", "SyslogFacility": "3", "SyslogLevel": "6", "SyslogLevelPrefix": "yes", "SyslogPriority": "30", "SystemCallErrorNumber": "2147483646", "TTYReset": "no", "TTYVHangup": "no", "TTYVTDisallocate": "no", "TasksAccounting": "yes", "TasksCurrent": "2", "TasksMax": "4644", "TimeoutAbortUSec": "1min 30s", "TimeoutCleanUSec": "infinity", "TimeoutStartFailureMode": "terminate", "TimeoutStartUSec": "1min 30s", "TimeoutStopFailureMode": "terminate", "TimeoutStopUSec": "1min 30s", "TimerSlackNSec": "50000", "Transient": "no", "Type": "forking", "UID": "[not set]", "UMask": "0022", "UnitFilePreset": "enabled", "UnitFileState": "enabled", "UtmpMode": "init", "WantedBy": "multi-user.target", "WatchdogSignal": "6", "WatchdogTimestampMonotonic": "0", "WatchdogUSec": "0"}} 2026-06-22 02:37:42.623843 | debian-bookworm | 2026-06-22 02:37:42.623889 | debian-bookworm | PLAY RECAP ********************************************************************* 2026-06-22 02:37:42.623998 | debian-bookworm | molecule-auditd : ok=15 changed=8 unreachable=0 failed=0 skipped=0 rescued=0 ignored=0 2026-06-22 02:37:42.624095 | debian-bookworm | 2026-06-22 02:37:42.751509 | debian-bookworm | INFO [delegated > converge] Executed: Successful 2026-06-22 02:37:42.752385 | debian-bookworm | WARNING Molecule executed 1 scenario (1 missing files) 2026-06-22 02:37:42.916451 | debian-bookworm | ok: Runtime: 0:00:20.980238 2026-06-22 02:37:42.898646 | ubuntu-noble | --- before 2026-06-22 02:37:42.901778 | ubuntu-noble | +++ after 2026-06-22 02:37:42.901810 | ubuntu-noble | @@ -1,4 +1,4 @@ 2026-06-22 02:37:42.901817 | ubuntu-noble | { 2026-06-22 02:37:42.901824 | ubuntu-noble | "path": "/etc/audit/rules.d/audit.rules", 2026-06-22 02:37:42.901830 | ubuntu-noble | - "state": "file" 2026-06-22 02:37:42.901837 | ubuntu-noble | + "state": "absent" 2026-06-22 02:37:42.901843 | ubuntu-noble | } 2026-06-22 02:37:42.901942 | ubuntu-noble | 2026-06-22 02:37:42.902194 | ubuntu-noble | changed: [molecule-auditd] => (item=audit.rules) => {"ansible_loop_var": "item", "changed": true, "item": "audit.rules", "path": "/etc/audit/rules.d/audit.rules", "state": "absent"} 2026-06-22 02:37:42.902515 | ubuntu-noble | skipping: [molecule-auditd] => (item=20-neo23x0.rules) => {"ansible_loop_var": "item", "changed": false, "false_condition": "item not in auditd_rules_files", "item": "20-neo23x0.rules", "skip_reason": "Conditional result was False"} 2026-06-22 02:37:42.902812 | ubuntu-noble | 2026-06-22 02:37:42.903103 | ubuntu-noble | RUNNING HANDLER [auditd : Restart auditd service] ****************************** 2026-06-22 02:37:43.736635 | ubuntu-noble | changed: [molecule-auditd] => {"changed": true, "name": "auditd", "state": "started", "status": {"ActiveEnterTimestamp": "Mon 2026-06-22 02:37:32 UTC", "ActiveEnterTimestampMonotonic": "3930296653", "ActiveExitTimestampMonotonic": "0", "ActiveState": "active", "After": "systemd-journald.socket local-fs.target system.slice systemd-tmpfiles-setup.service", "AllowIsolate": "no", "AssertResult": "yes", "AssertTimestamp": "Mon 2026-06-22 02:37:32 UTC", "AssertTimestampMonotonic": "3930243509", "Before": "systemd-update-utmp.service shutdown.target sysinit.target ssh.service", "BlockIOAccounting": "no", "BlockIOWeight": "[not set]", "CPUAccounting": "yes", "CPUAffinityFromNUMA": "no", "CPUQuotaPerSecUSec": "infinity", "CPUQuotaPeriodUSec": "infinity", "CPUSchedulingPolicy": "0", "CPUSchedulingPriority": "0", "CPUSchedulingResetOnFork": "no", "CPUShares": "[not set]", "CPUUsageNSec": "43306000", "CPUWeight": "[not set]", "CacheDirectoryMode": "0755", "CanFreeze": "yes", "CanIsolate": "no", "CanReload": "no", "CanStart": "yes", "CanStop": "yes", "CapabilityBoundingSet": "cap_chown cap_dac_override cap_dac_read_search cap_fowner cap_fsetid cap_kill cap_setgid cap_setuid cap_setpcap cap_linux_immutable cap_net_bind_service cap_net_broadcast cap_net_admin cap_net_raw cap_ipc_lock cap_ipc_owner cap_sys_rawio cap_sys_chroot cap_sys_ptrace cap_sys_pacct cap_sys_admin cap_sys_boot cap_sys_nice cap_sys_resource cap_sys_time cap_sys_tty_config cap_mknod cap_lease cap_audit_write cap_audit_control cap_setfcap cap_mac_override cap_mac_admin cap_syslog cap_wake_alarm cap_block_suspend cap_audit_read cap_perfmon cap_bpf cap_checkpoint_restore", "CleanResult": "success", "CollectMode": "inactive", "ConditionResult": "yes", "ConditionTimestamp": "Mon 2026-06-22 02:37:32 UTC", "ConditionTimestampMonotonic": "3930243462", "ConfigurationDirectoryMode": "0755", "Conflicts": "shutdown.target", "ControlGroup": "/system.slice/auditd.service", "ControlGroupId": "3868", "ControlPID": "0", "CoredumpFilter": "0x33", "CoredumpReceive": "no", "DefaultDependencies": "no", "DefaultMemoryLow": "0", "DefaultMemoryMin": "0", "DefaultStartupMemoryLow": "0", "Delegate": "no", "Description": "Security Auditing Service", "DevicePolicy": "auto", "Documentation": "\"man:auditd(8)\" https://github.com/linux-audit/audit-documentation", "DynamicUser": "no", "ExecMainCode": "0", "ExecMainExitTimestampMonotonic": "0", "ExecMainPID": "2307", "ExecMainStartTimestamp": "Mon 2026-06-22 02:37:32 UTC", "ExecMainStartTimestampMonotonic": "3930264443", "ExecMainStatus": "0", "ExecStart": "{ path=/sbin/auditd ; argv[]=/sbin/auditd ; ignore_errors=no ; start_time=[Mon 2026-06-22 02:37:32 UTC] ; stop_time=[Mon 2026-06-22 02:37:32 UTC] ; pid=2306 ; code=exited ; status=0 }", "ExecStartEx": "{ path=/sbin/auditd ; argv[]=/sbin/auditd ; flags= ; start_time=[Mon 2026-06-22 02:37:32 UTC] ; stop_time=[Mon 2026-06-22 02:37:32 UTC] ; pid=2306 ; code=exited ; status=0 }", "ExecStartPost": "{ path=/sbin/augenrules ; argv[]=/sbin/augenrules --load ; ignore_errors=yes ; start_time=[Mon 2026-06-22 02:37:32 UTC] ; stop_time=[Mon 2026-06-22 02:37:32 UTC] ; pid=2310 ; code=exited ; status=0 }", "ExecStartPostEx": "{ path=/sbin/augenrules ; argv[]=/sbin/augenrules --load ; flags=ignore-failure ; start_time=[Mon 2026-06-22 02:37:32 UTC] ; stop_time=[Mon 2026-06-22 02:37:32 UTC] ; pid=2310 ; code=exited ; status=0 }", "ExitType": "main", "ExtensionImagePolicy": "root=verity+signed+encrypted+unprotected+absent:usr=verity+signed+encrypted+unprotected+absent:home=encrypted+unprotected+absent:srv=encrypted+unprotected+absent:tmp=encrypted+unprotected+absent:var=encrypted+unprotected+absent", "FailureAction": "none", "FileDescriptorStoreMax": "0", "FileDescriptorStorePreserve": "restart", "FinalKillSignal": "9", "FragmentPath": "/usr/lib/systemd/system/auditd.service", "FreezerState": "running", "GID": "[not set]", "GuessMainPID": "yes", "IOAccounting": "no", "IOReadBytes": "[not set]", "IOReadOperations": "[not set]", "IOSchedulingClass": "2", "IOSchedulingPriority": "4", "IOWeight": "[not set]", "IOWriteBytes": "[not set]", "IOWriteOperations": "[not set]", "IPAccounting": "no", "IPEgressBytes": "[no data]", "IPEgressPackets": "[no data]", "IPIngressBytes": "[no data]", "IPIngressPackets": "[no data]", "Id": "auditd.service", "IgnoreOnIsolate": "no", "IgnoreSIGPIPE": "yes", "InactiveEnterTimestampMonotonic": "0", "InactiveExitTimestamp": "Mon 2026-06-22 02:37:32 UTC", "InactiveExitTimestampMonotonic": "3930252274", "InvocationID": "3f2497fbf6644ed1ac24363f5dab8ed6", "JobRunningTimeoutUSec": "infinity", "JobTimeoutAction": "none", "JobTimeoutUSec": "infinity", "KeyringMode": "private", "KillMode": "control-group", "KillSignal": "15", "LimitAS": "infinity", "LimitASSoft": "infinity", "LimitCORE": "infinity", "LimitCORESoft": "0", "LimitCPU": "infinity", "LimitCPUSoft": "infinity", "LimitDATA": "infinity", "LimitDATASoft": "infinity", "LimitFSIZE": "infinity", "LimitFSIZESoft": "infinity", "LimitLOCKS": "infinity", "LimitLOCKSSoft": "infinity", "LimitMEMLOCK": "8388608", "LimitMEMLOCKSoft": "8388608", "LimitMSGQUEUE": "819200", "LimitMSGQUEUESoft": "819200", "LimitNICE": "0", "LimitNICESoft": "0", "LimitNOFILE": "524288", "LimitNOFILESoft": "1024", "LimitNPROC": "15372", "LimitNPROCSoft": "15372", "LimitRSS": "infinity", "LimitRSSSoft": "infinity", "LimitRTPRIO": "0", "LimitRTPRIOSoft": "0", "LimitRTTIME": "infinity", "LimitRTTIMESoft": "infinity", "LimitSIGPENDING": "15372", "LimitSIGPENDINGSoft": "15372", "LimitSTACK": "infinity", "LimitSTACKSoft": "8388608", "LoadState": "loaded", "LockPersonality": "yes", "LogLevelMax": "-1", "LogRateLimitBurst": "0", "LogRateLimitIntervalUSec": "0", "LogsDirectoryMode": "0755", "MainPID": "2307", "ManagedOOMMemoryPressure": "auto", "ManagedOOMMemoryPressureLimit": "0", "ManagedOOMPreference": "none", "ManagedOOMSwap": "auto", "MemoryAccounting": "yes", "MemoryAvailable": "3558854656", "MemoryCurrent": "507904", "MemoryDenyWriteExecute": "yes", "MemoryHigh": "infinity", "MemoryKSM": "no", "MemoryLimit": "infinity", "MemoryLow": "0", "MemoryMax": "infinity", "MemoryMin": "0", "MemoryPeak": "2330624", "MemoryPressureThresholdUSec": "200ms", "MemoryPressureWatch": "auto", "MemorySwapCurrent": "0", "MemorySwapMax": "infinity", "MemorySwapPeak": "0", "MemoryZSwapCurrent": "0", "MemoryZSwapMax": "infinity", "MountAPIVFS": "no", "MountImagePolicy": "root=verity+signed+encrypted+unprotected+absent:usr=verity+signed+encrypted+unprotected+absent:home=encrypted+unprotected+absent:srv=encrypted+unprotected+absent:tmp=encrypted+unprotected+absent:var=encrypted+unprotected+absent", "NFileDescriptorStore": "0", "NRestarts": "0", "NUMAPolicy": "n/a", "Names": "auditd.service", "NeedDaemonReload": "no", "Nice": "0", "NoNewPrivileges": "no", "NonBlocking": "no", "NotifyAccess": "none", "OOMPolicy": "stop", "OOMScoreAdjust": "0", "OnFailureJobMode": "replace", "OnSuccessJobMode": "fail", "PIDFile": "/run/auditd.pid", "Perpetual": "no", "PrivateDevices": "no", "PrivateIPC": "no", "PrivateMounts": "no", "PrivateNetwork": "no", "PrivateTmp": "no", "PrivateUsers": "no", "ProcSubset": "all", "ProtectClock": "no", "ProtectControlGroups": "no", "ProtectHome": "no", "ProtectHostname": "no", "ProtectKernelLogs": "no", "ProtectKernelModules": "yes", "ProtectKernelTunables": "no", "ProtectProc": "default", "ProtectSystem": "no", "RefuseManualStart": "no", "RefuseManualStop": "no", "ReloadResult": "success", "ReloadSignal": "1", "RemainAfterExit": "no", "RemoveIPC": "no", "Requires": "system.slice", "Restart": "on-failure", "RestartKillSignal": "15", "RestartMaxDelayUSec": "infinity", "RestartMode": "normal", "RestartPreventExitStatus": "2 4 6", "RestartSteps": "0", "RestartUSec": "100ms", "RestartUSecNext": "100ms", "RestrictNamespaces": "no", "RestrictRealtime": "yes", "RestrictSUIDSGID": "no", "Result": "success", "RootDirectoryStartOnly": "no", "RootEphemeral": "no", "RootImagePolicy": "root=verity+signed+encrypted+unprotected+absent:usr=verity+signed+encrypted+unprotected+absent:home=encrypted+unprotected+absent:srv=encrypted+unprotected+absent:tmp=encrypted+unprotected+absent:var=encrypted+unprotected+absent", "RuntimeDirectoryMode": "0755", "RuntimeDirectoryPreserve": "no", "RuntimeMaxUSec": "infinity", "RuntimeRandomizedExtraUSec": "0", "SameProcessGroup": "no", "SecureBits": "0", "SendSIGHUP": "no", "SendSIGKILL": "yes", "SetLoginEnvironment": "no", "Slice": "system.slice", "StandardError": "inherit", "StandardInput": "null", "StandardOutput": "journal", "StartLimitAction": "none", "StartLimitBurst": "5", "StartLimitIntervalUSec": "10s", "StartupBlockIOWeight": "[not set]", "StartupCPUShares": "[not set]", "StartupCPUWeight": "[not set]", "StartupIOWeight": "[not set]", "StartupMemoryHigh": "infinity", "StartupMemoryLow": "0", "StartupMemoryMax": "infinity", "StartupMemorySwapMax": "infinity", "StartupMemoryZSwapMax": "infinity", "StateChangeTimestamp": "Mon 2026-06-22 02:37:32 UTC", "StateChangeTimestampMonotonic": "3930296653", "StateDirectoryMode": "0755", "StatusErrno": "0", "StopWhenUnneeded": "no", "SubState": "running", "SuccessAction": "none", "SurviveFinalKillSignal": "no", "SyslogFacility": "3", "SyslogLevel": "6", "SyslogLevelPrefix": "yes", "SyslogPriority": "30", "SystemCallErrorNumber": "2147483646", "TTYReset": "no", "TTYVHangup": "no", "TTYVTDisallocate": "no", "TasksAccounting": "yes", "TasksCurrent": "2", "TasksMax": "4611", "TimeoutAbortUSec": "1min 30s", "TimeoutCleanUSec": "infinity", "TimeoutStartFailureMode": "terminate", "TimeoutStartUSec": "1min 30s", "TimeoutStopFailureMode": "terminate", "TimeoutStopUSec": "1min 30s", "TimerSlackNSec": "50000", "Transient": "no", "Type": "forking", "UID": "[not set]", "UMask": "0022", "UnitFilePreset": "enabled", "UnitFileState": "enabled", "UtmpMode": "init", "WantedBy": "multi-user.target", "WatchdogSignal": "6", "WatchdogTimestampMonotonic": "0", "WatchdogUSec": "0"}} 2026-06-22 02:37:43.741588 | ubuntu-noble | 2026-06-22 02:37:43.741769 | ubuntu-noble | RUNNING HANDLER [auditd : Generate auditd rules] ******************************* 2026-06-22 02:37:44.271281 | ubuntu-noble | changed: [molecule-auditd] => {"changed": true, "cmd": ["augenrules", "--load"], "delta": "0:00:00.057013", "end": "2026-06-22 02:37:44.205571", "msg": "", "rc": 0, "start": "2026-06-22 02:37:44.148558", "stderr": "Unknown user: chrony\nThere was an error in line 24 of /etc/audit/audit.rules\nError sending add rule data request (No such file or directory)\nThere was an error in line 28 of /etc/audit/audit.rules\nUnknown user: ntp\nThere was an error in line 44 of /etc/audit/audit.rules\nError sending add rule data request (No such file or directory)\nThere was an error in line 83 of /etc/audit/audit.rules\nError sending add rule data request (No such file or directory)\nThere was an error in line 84 of /etc/audit/audit.rules\nError sending add rule data request (No such file or directory)\nThere was an error in line 86 of /etc/audit/audit.rules\nError sending add rule data request (No such file or directory)\nThere was an error in line 112 of /etc/audit/audit.rules\nError sending add rule data request (No such file or directory)\nThere was an error in line 115 of /etc/audit/audit.rules\nError sending add rule data request (No such file or directory)\nThere was an error in line 176 of /etc/audit/audit.rules\nError sending add rule data request (No such file or directory)\nThere was an error in line 177 of /etc/audit/audit.rules\nError sending add rule data request (No such file or directory)\nThere was an error in line 178 of /etc/audit/audit.rules\nError sending add rule data request (No such file or directory)\nThere was an error in line 179 of /etc/audit/audit.rules\nError sending add rule data request (No such file or directory)\nThere was an error in line 180 of /etc/audit/audit.rules\nError sending add rule data request (No such file or directory)\nThere was an error in line 217 of /etc/audit/audit.rules\nError sending add rule data request (No such file or directory)\nThere was an error in line 218 of /etc/audit/audit.rules\nError sending add rule data request (No such file or directory)\nThere was an error in line 234 of /etc/audit/audit.rules\nError sending add rule data request (No such file or directory)\nThere was an error in line 285 of /etc/audit/audit.rules\nError sending add rule data request (No such file or directory)\nThere was an error in line 286 of /etc/audit/audit.rules\nError sending add rule data request (No such file or directory)\nThere was an error in line 324 of /etc/audit/audit.rules\nError sending add rule data request (No such file or directory)\nThere was an error in line 325 of /etc/audit/audit.rules\nError sending add rule data request (No such file or directory)\nThere was an error in line 346 of /etc/audit/audit.rules\nparameter passed without an option given\nThere was an error in line 347 of /etc/audit/audit.rules\nparameter passed without an option given\nThere was an error in line 348 of /etc/audit/audit.rules\nparameter passed without an option given\nThere was an error in line 349 of /etc/audit/audit.rules\nparameter passed without an option given\nThere was an error in line 350 of /etc/audit/audit.rules\nparameter passed without an option given\nThere was an error in line 351 of /etc/audit/audit.rules\nError sending add rule data request (No such file or directory)\nThere was an error in line 359 of /etc/audit/audit.rules", "stderr_lines": ["Unknown user: chrony", "There was an error in line 24 of /etc/audit/audit.rules", "Error sending add rule data request (No such file or directory)", "There was an error in line 28 of /etc/audit/audit.rules", "Unknown user: ntp", "There was an error in line 44 of /etc/audit/audit.rules", "Error sending add rule data request (No such file or directory)", "There was an error in line 83 of /etc/audit/audit.rules", "Error sending add rule data request (No such file or directory)", "There was an error in line 84 of /etc/audit/audit.rules", "Error sending add rule data request (No such file or directory)", "There was an error in line 86 of /etc/audit/audit.rules", "Error sending add rule data request (No such file or directory)", "There was an error in line 112 of /etc/audit/audit.rules", "Error sending add rule data request (No such file or directory)", "There was an error in line 115 of /etc/audit/audit.rules", "Error sending add rule data request (No such file or directory)", "There was an error in line 176 of /etc/audit/audit.rules", "Error sending add rule data request (No such file or directory)", "There was an error in line 177 of /etc/audit/audit.rules", "Error sending add rule data request (No such file or directory)", "There was an error in line 178 of /etc/audit/audit.rules", "Error sending add rule data request (No such file or directory)", "There was an error in line 179 of /etc/audit/audit.rules", "Error sending add rule data request (No such file or directory)", "There was an error in line 180 of /etc/audit/audit.rules", "Error sending add rule data request (No such file or directory)", "There was an error in line 217 of /etc/audit/audit.rules", "Error sending add rule data request (No such file or directory)", "There was an error in line 218 of /etc/audit/audit.rules", "Error sending add rule data request (No such file or directory)", "There was an error in line 234 of /etc/audit/audit.rules", "Error sending add rule data request (No such file or directory)", "There was an error in line 285 of /etc/audit/audit.rules", "Error sending add rule data request (No such file or directory)", "There was an error in line 286 of /etc/audit/audit.rules", "Error sending add rule data request (No such file or directory)", "There was an error in line 324 of /etc/audit/audit.rules", "Error sending add rule data request (No such file or directory)", "There was an error in line 325 of /etc/audit/audit.rules", "Error sending add rule data request (No such file or directory)", "There was an error in line 346 of /etc/audit/audit.rules", "parameter passed without an option given", "There was an error in line 347 of /etc/audit/audit.rules", "parameter passed without an option given", "There was an error in line 348 of /etc/audit/audit.rules", "parameter passed without an option given", "There was an error in line 349 of /etc/audit/audit.rules", "parameter passed without an option given", "There was an error in line 350 of /etc/audit/audit.rules", "parameter passed without an option given", "There was an error in line 351 of /etc/audit/audit.rules", "Error sending add rule data request (No such file or directory)", "There was an error in line 359 of /etc/audit/audit.rules"], "stdout": "/usr/sbin/augenrules: No change\nNo rules\nenabled 1\nfailure 1\npid 2700\nrate_limit 0\nbacklog_limit 8192\nlost 0\nbacklog 1018\nbacklog_wait_time 60000\nbacklog_wait_time_actual 0\nenabled 1\nfailure 1\npid 2700\nrate_limit 0\nbacklog_limit 8192\nlost 0\nbacklog 1017\nbacklog_wait_time 60000\nbacklog_wait_time_actual 0", "stdout_lines": ["/usr/sbin/augenrules: No change", "No rules", "enabled 1", "failure 1", "pid 2700", "rate_limit 0", "backlog_limit 8192", "lost 0", "backlog 1018", "backlog_wait_time 60000", "backlog_wait_time_actual 0", "enabled 1", "failure 1", "pid 2700", "rate_limit 0", "backlog_limit 8192", "lost 0", "backlog 1017", "backlog_wait_time 60000", "backlog_wait_time_actual 0"]} 2026-06-22 02:37:44.271343 | ubuntu-noble | 2026-06-22 02:37:44.271762 | ubuntu-noble | RUNNING HANDLER [auditd : Restart auditd service] ****************************** 2026-06-22 02:37:45.163315 | ubuntu-noble | changed: [molecule-auditd] => {"changed": true, "name": "auditd", "state": "started", "status": {"ActiveEnterTimestamp": "Mon 2026-06-22 02:37:43 UTC", "ActiveEnterTimestampMonotonic": "3941326370", "ActiveExitTimestamp": "Mon 2026-06-22 02:37:43 UTC", "ActiveExitTimestampMonotonic": "3941170185", "ActiveState": "active", "After": "systemd-journald.socket local-fs.target system.slice systemd-tmpfiles-setup.service", "AllowIsolate": "no", "AssertResult": "yes", "AssertTimestamp": "Mon 2026-06-22 02:37:43 UTC", "AssertTimestampMonotonic": "3941210808", "Before": "systemd-update-utmp.service shutdown.target sysinit.target ssh.service", "BlockIOAccounting": "no", "BlockIOWeight": "[not set]", "CPUAccounting": "yes", "CPUAffinityFromNUMA": "no", "CPUQuotaPerSecUSec": "infinity", "CPUQuotaPeriodUSec": "infinity", "CPUSchedulingPolicy": "0", "CPUSchedulingPriority": "0", "CPUSchedulingResetOnFork": "no", "CPUShares": "[not set]", "CPUUsageNSec": "161253000", "CPUWeight": "[not set]", "CacheDirectoryMode": "0755", "CanFreeze": "yes", "CanIsolate": "no", "CanReload": "no", "CanStart": "yes", "CanStop": "yes", "CapabilityBoundingSet": "cap_chown cap_dac_override cap_dac_read_search cap_fowner cap_fsetid cap_kill cap_setgid cap_setuid cap_setpcap cap_linux_immutable cap_net_bind_service cap_net_broadcast cap_net_admin cap_net_raw cap_ipc_lock cap_ipc_owner cap_sys_rawio cap_sys_chroot cap_sys_ptrace cap_sys_pacct cap_sys_admin cap_sys_boot cap_sys_nice cap_sys_resource cap_sys_time cap_sys_tty_config cap_mknod cap_lease cap_audit_write cap_audit_control cap_setfcap cap_mac_override cap_mac_admin cap_syslog cap_wake_alarm cap_block_suspend cap_audit_read cap_perfmon cap_bpf cap_checkpoint_restore", "CleanResult": "success", "CollectMode": "inactive", "ConditionResult": "yes", "ConditionTimestamp": "Mon 2026-06-22 02:37:43 UTC", "ConditionTimestampMonotonic": "3941210732", "ConfigurationDirectoryMode": "0755", "Conflicts": "shutdown.target", "ControlGroup": "/system.slice/auditd.service", "ControlGroupId": "3910", "ControlPID": "0", "CoredumpFilter": "0x33", "CoredumpReceive": "no", "DefaultDependencies": "no", "DefaultMemoryLow": "0", "DefaultMemoryMin": "0", "DefaultStartupMemoryLow": "0", "Delegate": "no", "Description": "Security Auditing Service", "DevicePolicy": "auto", "Documentation": "\"man:auditd(8)\" https://github.com/linux-audit/audit-documentation", "DynamicUser": "no", "ExecMainCode": "0", "ExecMainExitTimestampMonotonic": "0", "ExecMainPID": "2700", "ExecMainStartTimestamp": "Mon 2026-06-22 02:37:43 UTC", "ExecMainStartTimestampMonotonic": "3941238491", "ExecMainStatus": "0", "ExecStart": "{ path=/sbin/auditd ; argv[]=/sbin/auditd ; ignore_errors=no ; start_time=[Mon 2026-06-22 02:37:43 UTC] ; stop_time=[Mon 2026-06-22 02:37:43 UTC] ; pid=2698 ; code=exited ; status=0 }", "ExecStartEx": "{ path=/sbin/auditd ; argv[]=/sbin/auditd ; flags= ; start_time=[Mon 2026-06-22 02:37:43 UTC] ; stop_time=[Mon 2026-06-22 02:37:43 UTC] ; pid=2698 ; code=exited ; status=0 }", "ExecStartPost": "{ path=/sbin/augenrules ; argv[]=/sbin/augenrules --load ; ignore_errors=yes ; start_time=[Mon 2026-06-22 02:37:43 UTC] ; stop_time=[Mon 2026-06-22 02:37:43 UTC] ; pid=2703 ; code=exited ; status=0 }", "ExecStartPostEx": "{ path=/sbin/augenrules ; argv[]=/sbin/augenrules --load ; flags=ignore-failure ; start_time=[Mon 2026-06-22 02:37:43 UTC] ; stop_time=[Mon 2026-06-22 02:37:43 UTC] ; pid=2703 ; code=exited ; status=0 }", "ExitType": "main", "ExtensionImagePolicy": "root=verity+signed+encrypted+unprotected+absent:usr=verity+signed+encrypted+unprotected+absent:home=encrypted+unprotected+absent:srv=encrypted+unprotected+absent:tmp=encrypted+unprotected+absent:var=encrypted+unprotected+absent", "FailureAction": "none", "FileDescriptorStoreMax": "0", "FileDescriptorStorePreserve": "restart", "FinalKillSignal": "9", "FragmentPath": "/usr/lib/systemd/system/auditd.service", "FreezerState": "running", "GID": "[not set]", "GuessMainPID": "yes", "IOAccounting": "no", "IOReadBytes": "[not set]", "IOReadOperations": "[not set]", "IOSchedulingClass": "2", "IOSchedulingPriority": "4", "IOWeight": "[not set]", "IOWriteBytes": "[not set]", "IOWriteOperations": "[not set]", "IPAccounting": "no", "IPEgressBytes": "[no data]", "IPEgressPackets": "[no data]", "IPIngressBytes": "[no data]", "IPIngressPackets": "[no data]", "Id": "auditd.service", "IgnoreOnIsolate": "no", "IgnoreSIGPIPE": "yes", "InactiveEnterTimestamp": "Mon 2026-06-22 02:37:43 UTC", "InactiveEnterTimestampMonotonic": "3941209637", "InactiveExitTimestamp": "Mon 2026-06-22 02:37:43 UTC", "InactiveExitTimestampMonotonic": "3941216480", "InvocationID": "acb170c19bea427e95bde0b0f4fcd960", "JobRunningTimeoutUSec": "infinity", "JobTimeoutAction": "none", "JobTimeoutUSec": "infinity", "KeyringMode": "private", "KillMode": "control-group", "KillSignal": "15", "LimitAS": "infinity", "LimitASSoft": "infinity", "LimitCORE": "infinity", "LimitCORESoft": "0", "LimitCPU": "infinity", "LimitCPUSoft": "infinity", "LimitDATA": "infinity", "LimitDATASoft": "infinity", "LimitFSIZE": "infinity", "LimitFSIZESoft": "infinity", "LimitLOCKS": "infinity", "LimitLOCKSSoft": "infinity", "LimitMEMLOCK": "8388608", "LimitMEMLOCKSoft": "8388608", "LimitMSGQUEUE": "819200", "LimitMSGQUEUESoft": "819200", "LimitNICE": "0", "LimitNICESoft": "0", "LimitNOFILE": "524288", "LimitNOFILESoft": "1024", "LimitNPROC": "15372", "LimitNPROCSoft": "15372", "LimitRSS": "infinity", "LimitRSSSoft": "infinity", "LimitRTPRIO": "0", "LimitRTPRIOSoft": "0", "LimitRTTIME": "infinity", "LimitRTTIMESoft": "infinity", "LimitSIGPENDING": "15372", "LimitSIGPENDINGSoft": "15372", "LimitSTACK": "infinity", "LimitSTACKSoft": "8388608", "LoadState": "loaded", "LockPersonality": "yes", "LogLevelMax": "-1", "LogRateLimitBurst": "0", "LogRateLimitIntervalUSec": "0", "LogsDirectoryMode": "0755", "MainPID": "2700", "ManagedOOMMemoryPressure": "auto", "ManagedOOMMemoryPressureLimit": "0", "ManagedOOMPreference": "none", "ManagedOOMSwap": "auto", "MemoryAccounting": "yes", "MemoryAvailable": "3545022464", "MemoryCurrent": "1859584", "MemoryDenyWriteExecute": "yes", "MemoryHigh": "infinity", "MemoryKSM": "no", "MemoryLimit": "infinity", "MemoryLow": "0", "MemoryMax": "infinity", "MemoryMin": "0", "MemoryPeak": "2129920", "MemoryPressureThresholdUSec": "200ms", "MemoryPressureWatch": "auto", "MemorySwapCurrent": "0", "MemorySwapMax": "infinity", "MemorySwapPeak": "0", "MemoryZSwapCurrent": "0", "MemoryZSwapMax": "infinity", "MountAPIVFS": "no", "MountImagePolicy": "root=verity+signed+encrypted+unprotected+absent:usr=verity+signed+encrypted+unprotected+absent:home=encrypted+unprotected+absent:srv=encrypted+unprotected+absent:tmp=encrypted+unprotected+absent:var=encrypted+unprotected+absent", "NFileDescriptorStore": "0", "NRestarts": "0", "NUMAPolicy": "n/a", "Names": "auditd.service", "NeedDaemonReload": "no", "Nice": "0", "NoNewPrivileges": "no", "NonBlocking": "no", "NotifyAccess": "none", "OOMPolicy": "stop", "OOMScoreAdjust": "0", "OnFailureJobMode": "replace", "OnSuccessJobMode": "fail", "PIDFile": "/run/auditd.pid", "Perpetual": "no", "PrivateDevices": "no", "PrivateIPC": "no", "PrivateMounts": "no", "PrivateNetwork": "no", "PrivateTmp": "no", "PrivateUsers": "no", "ProcSubset": "all", "ProtectClock": "no", "ProtectControlGroups": "no", "ProtectHome": "no", "ProtectHostname": "no", "ProtectKernelLogs": "no", "ProtectKernelModules": "yes", "ProtectKernelTunables": "no", "ProtectProc": "default", "ProtectSystem": "no", "RefuseManualStart": "no", "RefuseManualStop": "no", "ReloadResult": "success", "ReloadSignal": "1", "RemainAfterExit": "no", "RemoveIPC": "no", "Requires": "system.slice", "Restart": "on-failure", "RestartKillSignal": "15", "RestartMaxDelayUSec": "infinity", "RestartMode": "normal", "RestartPreventExitStatus": "2 4 6", "RestartSteps": "0", "RestartUSec": "100ms", "RestartUSecNext": "100ms", "RestrictNamespaces": "no", "RestrictRealtime": "yes", "RestrictSUIDSGID": "no", "Result": "success", "RootDirectoryStartOnly": "no", "RootEphemeral": "no", "RootImagePolicy": "root=verity+signed+encrypted+unprotected+absent:usr=verity+signed+encrypted+unprotected+absent:home=encrypted+unprotected+absent:srv=encrypted+unprotected+absent:tmp=encrypted+unprotected+absent:var=encrypted+unprotected+absent", "RuntimeDirectoryMode": "0755", "RuntimeDirectoryPreserve": "no", "RuntimeMaxUSec": "infinity", "RuntimeRandomizedExtraUSec": "0", "SameProcessGroup": "no", "SecureBits": "0", "SendSIGHUP": "no", "SendSIGKILL": "yes", "SetLoginEnvironment": "no", "Slice": "system.slice", "StandardError": "inherit", "StandardInput": "null", "StandardOutput": "journal", "StartLimitAction": "none", "StartLimitBurst": "5", "StartLimitIntervalUSec": "10s", "StartupBlockIOWeight": "[not set]", "StartupCPUShares": "[not set]", "StartupCPUWeight": "[not set]", "StartupIOWeight": "[not set]", "StartupMemoryHigh": "infinity", "StartupMemoryLow": "0", "StartupMemoryMax": "infinity", "StartupMemorySwapMax": "infinity", "StartupMemoryZSwapMax": "infinity", "StateChangeTimestamp": "Mon 2026-06-22 02:37:43 UTC", "StateChangeTimestampMonotonic": "3941326370", "StateDirectoryMode": "0755", "StatusErrno": "0", "StopWhenUnneeded": "no", "SubState": "running", "SuccessAction": "none", "SurviveFinalKillSignal": "no", "SyslogFacility": "3", "SyslogLevel": "6", "SyslogLevelPrefix": "yes", "SyslogPriority": "30", "SystemCallErrorNumber": "2147483646", "TTYReset": "no", "TTYVHangup": "no", "TTYVTDisallocate": "no", "TasksAccounting": "yes", "TasksCurrent": "2", "TasksMax": "4611", "TimeoutAbortUSec": "1min 30s", "TimeoutCleanUSec": "infinity", "TimeoutStartFailureMode": "terminate", "TimeoutStartUSec": "1min 30s", "TimeoutStopFailureMode": "terminate", "TimeoutStopUSec": "1min 30s", "TimerSlackNSec": "50000", "Transient": "no", "Type": "forking", "UID": "[not set]", "UMask": "0022", "UnitFilePreset": "enabled", "UnitFileState": "enabled", "UtmpMode": "init", "WantedBy": "multi-user.target", "WatchdogSignal": "6", "WatchdogTimestampMonotonic": "0", "WatchdogUSec": "0"}} 2026-06-22 02:37:45.164834 | ubuntu-noble | 2026-06-22 02:37:45.164867 | ubuntu-noble | PLAY RECAP ********************************************************************* 2026-06-22 02:37:45.164875 | ubuntu-noble | molecule-auditd : ok=15 changed=8 unreachable=0 failed=0 skipped=0 rescued=0 ignored=0 2026-06-22 02:37:45.164881 | ubuntu-noble | 2026-06-22 02:37:45.286937 | ubuntu-noble | INFO [delegated > converge] Executed: Successful 2026-06-22 02:37:45.287000 | ubuntu-noble | WARNING Molecule executed 1 scenario (1 missing files) 2026-06-22 02:37:45.493562 | ubuntu-noble | ok: Runtime: 0:00:23.507166 2026-06-22 02:37:45.517804 | 2026-06-22 02:37:45.517959 | TASK [ansible-molecule : Run molecule verify action with scenario delegated] 2026-06-22 02:37:46.267038 | ubuntu-noble | WARNING Molecule scenarios should migrate to 'extensions/molecule' 2026-06-22 02:37:46.284979 | ubuntu-noble | DEBUG [unknown > config] provisioner.env found in /home/zuul/src/github.com/osism/ansible-collection-services/molecule/delegated/molecule.yml, this can be defined in ansible.env 2026-06-22 02:37:46.263992 | debian-bookworm | WARNING Molecule scenarios should migrate to 'extensions/molecule' 2026-06-22 02:37:46.275382 | debian-bookworm | DEBUG [unknown > config] provisioner.env found in /home/zuul/src/github.com/osism/ansible-collection-services/molecule/delegated/molecule.yml, this can be defined in ansible.env 2026-06-22 02:37:47.002415 | ubuntu-noble | DEBUG [unknown > config] provisioner.env found in /home/zuul/src/github.com/osism/ansible-collection-services/molecule/delegated/molecule.yml, this can be defined in ansible.env 2026-06-22 02:37:47.003082 | ubuntu-noble | DEBUG [delegated > validate] Validating schema /home/zuul/src/github.com/osism/ansible-collection-services/molecule/delegated/molecule.yml. 2026-06-22 02:37:46.934781 | debian-bookworm | DEBUG [unknown > config] provisioner.env found in /home/zuul/src/github.com/osism/ansible-collection-services/molecule/delegated/molecule.yml, this can be defined in ansible.env 2026-06-22 02:37:46.935468 | debian-bookworm | DEBUG [delegated > validate] Validating schema /home/zuul/src/github.com/osism/ansible-collection-services/molecule/delegated/molecule.yml. 2026-06-22 02:37:46.958895 | debian-bookworm | DEBUG [default > validate] Validating schema /home/zuul/src/github.com/osism/ansible-collection-services/molecule/default/molecule.yml. 2026-06-22 02:37:46.965245 | debian-bookworm | INFO [delegated > discovery] scenario test matrix: verify 2026-06-22 02:37:46.965341 | debian-bookworm | INFO [delegated > prerun] Performing prerun with role_name_check=0... 2026-06-22 02:37:47.027949 | ubuntu-noble | DEBUG [default > validate] Validating schema /home/zuul/src/github.com/osism/ansible-collection-services/molecule/default/molecule.yml. 2026-06-22 02:37:47.033803 | ubuntu-noble | INFO [delegated > discovery] scenario test matrix: verify 2026-06-22 02:37:47.033889 | ubuntu-noble | INFO [delegated > prerun] Performing prerun with role_name_check=0... 2026-06-22 02:37:48.964389 | ubuntu-noble | INFO [delegated > verify] Executing 2026-06-22 02:37:48.966425 | ubuntu-noble | INFO [delegated > verify] Executing Testinfra tests found in /home/zuul/src/github.com/osism/ansible-collection-services/molecule/delegated/tests/... 2026-06-22 02:37:48.967596 | ubuntu-noble | DEBUG ANSIBLE ENVIRONMENT: 2026-06-22 02:37:48.967611 | ubuntu-noble | ANSIBLE_COLLECTIONS_PATH: /home/zuul/venv/.ansible/collections:/home/zuul/.ansible/collections 2026-06-22 02:37:48.967622 | ubuntu-noble | ANSIBLE_CONFIG: /home/zuul/.ansible/tmp/molecule.oWZD.delegated/ansible.cfg 2026-06-22 02:37:48.967630 | ubuntu-noble | ANSIBLE_LIBRARY: ../../plugins 2026-06-22 02:37:48.967636 | ubuntu-noble | ANSIBLE_PYTHON_INTERPRETER: /home/zuul/venv/bin/python 2026-06-22 02:37:48.967643 | ubuntu-noble | ANSIBLE_ROLE: auditd 2026-06-22 02:37:48.967649 | ubuntu-noble | ANSIBLE_ROLES_PATH: ../../roles 2026-06-22 02:37:48.967654 | ubuntu-noble | ANSIBLE_VERBOSITY: 1 2026-06-22 02:37:48.967661 | ubuntu-noble | 2026-06-22 02:37:48.967924 | ubuntu-noble | DEBUG MOLECULE ENVIRONMENT: 2026-06-22 02:37:48.968000 | ubuntu-noble | MOLECULE_DEBUG: True 2026-06-22 02:37:48.968017 | ubuntu-noble | MOLECULE_DEPENDENCY_NAME: galaxy 2026-06-22 02:37:48.968030 | ubuntu-noble | MOLECULE_DRIVER_NAME: default 2026-06-22 02:37:48.968042 | ubuntu-noble | MOLECULE_ENV_FILE: /home/zuul/src/github.com/osism/ansible-collection-services/.env.yml 2026-06-22 02:37:48.968055 | ubuntu-noble | MOLECULE_EPHEMERAL_DIRECTORY: /home/zuul/.ansible/tmp/molecule.oWZD.delegated 2026-06-22 02:37:48.968069 | ubuntu-noble | MOLECULE_FILE: /home/zuul/.ansible/tmp/molecule.oWZD.delegated/molecule.yml 2026-06-22 02:37:48.968080 | ubuntu-noble | MOLECULE_INSTANCE_CONFIG: /home/zuul/.ansible/tmp/molecule.oWZD.delegated/instance_config.yml 2026-06-22 02:37:48.968095 | ubuntu-noble | MOLECULE_INVENTORY_FILE: /home/zuul/.ansible/tmp/molecule.oWZD.delegated/inventory/ansible_inventory.yml 2026-06-22 02:37:48.968109 | ubuntu-noble | MOLECULE_PROJECT_DIRECTORY: /home/zuul/src/github.com/osism/ansible-collection-services 2026-06-22 02:37:48.968120 | ubuntu-noble | MOLECULE_PROVISIONER_NAME: ansible 2026-06-22 02:37:48.968132 | ubuntu-noble | MOLECULE_SCENARIO_DIRECTORY: /home/zuul/src/github.com/osism/ansible-collection-services/molecule/delegated 2026-06-22 02:37:48.968145 | ubuntu-noble | MOLECULE_SCENARIO_NAME: delegated 2026-06-22 02:37:48.968156 | ubuntu-noble | MOLECULE_STATE_FILE: /home/zuul/.ansible/tmp/molecule.oWZD.delegated/state.yml 2026-06-22 02:37:48.968168 | ubuntu-noble | MOLECULE_VERIFIER_NAME: testinfra 2026-06-22 02:37:48.968180 | ubuntu-noble | MOLECULE_VERIFIER_TEST_DIRECTORY: /home/zuul/src/github.com/osism/ansible-collection-services/molecule/delegated/tests 2026-06-22 02:37:48.968193 | ubuntu-noble | 2026-06-22 02:37:48.968240 | ubuntu-noble | DEBUG SHELL REPLAY: ANSIBLE_COLLECTIONS_PATH=/home/zuul/venv/.ansible/collections:/home/zuul/.ansible/collections ANSIBLE_CONFIG=/home/zuul/.ansible/tmp/molecule.oWZD.delegated/ansible.cfg ANSIBLE_LIBRARY=../../plugins ANSIBLE_PYTHON_INTERPRETER=/home/zuul/venv/bin/python ANSIBLE_ROLE=auditd ANSIBLE_ROLES_PATH=../../roles ANSIBLE_VERBOSITY=1 MOLECULE_DEBUG=True MOLECULE_DEPENDENCY_NAME=galaxy MOLECULE_DRIVER_NAME=default MOLECULE_ENV_FILE=/home/zuul/src/github.com/osism/ansible-collection-services/.env.yml MOLECULE_EPHEMERAL_DIRECTORY=/home/zuul/.ansible/tmp/molecule.oWZD.delegated MOLECULE_FILE=/home/zuul/.ansible/tmp/molecule.oWZD.delegated/molecule.yml MOLECULE_INSTANCE_CONFIG=/home/zuul/.ansible/tmp/molecule.oWZD.delegated/instance_config.yml MOLECULE_INVENTORY_FILE=/home/zuul/.ansible/tmp/molecule.oWZD.delegated/inventory/ansible_inventory.yml MOLECULE_PROJECT_DIRECTORY=/home/zuul/src/github.com/osism/ansible-collection-services MOLECULE_PROVISIONER_NAME=ansible MOLECULE_SCENARIO_DIRECTORY=/home/zuul/src/github.com/osism/ansible-collection-services/molecule/delegated MOLECULE_SCENARIO_NAME=delegated MOLECULE_STATE_FILE=/home/zuul/.ansible/tmp/molecule.oWZD.delegated/state.yml MOLECULE_VERIFIER_NAME=testinfra MOLECULE_VERIFIER_TEST_DIRECTORY=/home/zuul/src/github.com/osism/ansible-collection-services/molecule/delegated/tests 2026-06-22 02:37:48.605075 | debian-bookworm | INFO [delegated > verify] Executing 2026-06-22 02:37:48.606463 | debian-bookworm | INFO [delegated > verify] Executing Testinfra tests found in /home/zuul/src/github.com/osism/ansible-collection-services/molecule/delegated/tests/... 2026-06-22 02:37:48.607567 | debian-bookworm | DEBUG ANSIBLE ENVIRONMENT: 2026-06-22 02:37:48.607582 | debian-bookworm | ANSIBLE_COLLECTIONS_PATH: /home/zuul/venv/.ansible/collections:/home/zuul/.ansible/collections 2026-06-22 02:37:48.607590 | debian-bookworm | ANSIBLE_CONFIG: /home/zuul/.ansible/tmp/molecule.oWZD.delegated/ansible.cfg 2026-06-22 02:37:48.607597 | debian-bookworm | ANSIBLE_LIBRARY: ../../plugins 2026-06-22 02:37:48.607603 | debian-bookworm | ANSIBLE_PYTHON_INTERPRETER: /home/zuul/venv/bin/python 2026-06-22 02:37:48.607608 | debian-bookworm | ANSIBLE_ROLE: auditd 2026-06-22 02:37:48.607613 | debian-bookworm | ANSIBLE_ROLES_PATH: ../../roles 2026-06-22 02:37:48.607618 | debian-bookworm | ANSIBLE_VERBOSITY: 1 2026-06-22 02:37:48.607622 | debian-bookworm | 2026-06-22 02:37:48.607853 | debian-bookworm | DEBUG MOLECULE ENVIRONMENT: 2026-06-22 02:37:48.607900 | debian-bookworm | MOLECULE_DEBUG: True 2026-06-22 02:37:48.607909 | debian-bookworm | MOLECULE_DEPENDENCY_NAME: galaxy 2026-06-22 02:37:48.607915 | debian-bookworm | MOLECULE_DRIVER_NAME: default 2026-06-22 02:37:48.607922 | debian-bookworm | MOLECULE_ENV_FILE: /home/zuul/src/github.com/osism/ansible-collection-services/.env.yml 2026-06-22 02:37:48.607929 | debian-bookworm | MOLECULE_EPHEMERAL_DIRECTORY: /home/zuul/.ansible/tmp/molecule.oWZD.delegated 2026-06-22 02:37:48.607936 | debian-bookworm | MOLECULE_FILE: /home/zuul/.ansible/tmp/molecule.oWZD.delegated/molecule.yml 2026-06-22 02:37:48.607942 | debian-bookworm | MOLECULE_INSTANCE_CONFIG: /home/zuul/.ansible/tmp/molecule.oWZD.delegated/instance_config.yml 2026-06-22 02:37:48.607948 | debian-bookworm | MOLECULE_INVENTORY_FILE: /home/zuul/.ansible/tmp/molecule.oWZD.delegated/inventory/ansible_inventory.yml 2026-06-22 02:37:48.607955 | debian-bookworm | MOLECULE_PROJECT_DIRECTORY: /home/zuul/src/github.com/osism/ansible-collection-services 2026-06-22 02:37:48.607962 | debian-bookworm | MOLECULE_PROVISIONER_NAME: ansible 2026-06-22 02:37:48.607968 | debian-bookworm | MOLECULE_SCENARIO_DIRECTORY: /home/zuul/src/github.com/osism/ansible-collection-services/molecule/delegated 2026-06-22 02:37:48.607974 | debian-bookworm | MOLECULE_SCENARIO_NAME: delegated 2026-06-22 02:37:48.607980 | debian-bookworm | MOLECULE_STATE_FILE: /home/zuul/.ansible/tmp/molecule.oWZD.delegated/state.yml 2026-06-22 02:37:48.607986 | debian-bookworm | MOLECULE_VERIFIER_NAME: testinfra 2026-06-22 02:37:48.608002 | debian-bookworm | MOLECULE_VERIFIER_TEST_DIRECTORY: /home/zuul/src/github.com/osism/ansible-collection-services/molecule/delegated/tests 2026-06-22 02:37:48.608009 | debian-bookworm | 2026-06-22 02:37:48.608035 | debian-bookworm | DEBUG SHELL REPLAY: ANSIBLE_COLLECTIONS_PATH=/home/zuul/venv/.ansible/collections:/home/zuul/.ansible/collections ANSIBLE_CONFIG=/home/zuul/.ansible/tmp/molecule.oWZD.delegated/ansible.cfg ANSIBLE_LIBRARY=../../plugins ANSIBLE_PYTHON_INTERPRETER=/home/zuul/venv/bin/python ANSIBLE_ROLE=auditd ANSIBLE_ROLES_PATH=../../roles ANSIBLE_VERBOSITY=1 MOLECULE_DEBUG=True MOLECULE_DEPENDENCY_NAME=galaxy MOLECULE_DRIVER_NAME=default MOLECULE_ENV_FILE=/home/zuul/src/github.com/osism/ansible-collection-services/.env.yml MOLECULE_EPHEMERAL_DIRECTORY=/home/zuul/.ansible/tmp/molecule.oWZD.delegated MOLECULE_FILE=/home/zuul/.ansible/tmp/molecule.oWZD.delegated/molecule.yml MOLECULE_INSTANCE_CONFIG=/home/zuul/.ansible/tmp/molecule.oWZD.delegated/instance_config.yml MOLECULE_INVENTORY_FILE=/home/zuul/.ansible/tmp/molecule.oWZD.delegated/inventory/ansible_inventory.yml MOLECULE_PROJECT_DIRECTORY=/home/zuul/src/github.com/osism/ansible-collection-services MOLECULE_PROVISIONER_NAME=ansible MOLECULE_SCENARIO_DIRECTORY=/home/zuul/src/github.com/osism/ansible-collection-services/molecule/delegated MOLECULE_SCENARIO_NAME=delegated MOLECULE_STATE_FILE=/home/zuul/.ansible/tmp/molecule.oWZD.delegated/state.yml MOLECULE_VERIFIER_NAME=testinfra MOLECULE_VERIFIER_TEST_DIRECTORY=/home/zuul/src/github.com/osism/ansible-collection-services/molecule/delegated/tests 2026-06-22 02:37:48.847230 | debian-bookworm | writing pytest debug information to pytestdebug.log 2026-06-22 02:37:48.863021 | debian-bookworm | ============================= test session starts ============================== 2026-06-22 02:37:48.863523 | debian-bookworm | platform linux -- Python 3.11.2, pytest-9.1.0, pluggy-1.6.0 -- /home/zuul/venv/bin/python3 2026-06-22 02:37:48.864118 | debian-bookworm | using: pytest-9.1.0 2026-06-22 02:37:48.864514 | debian-bookworm | registered third-party plugins: 2026-06-22 02:37:48.864889 | debian-bookworm | pytest-testinfra-10.2.2 at /home/zuul/venv/lib/python3.11/site-packages/testinfra/plugin.py 2026-06-22 02:37:48.865262 | debian-bookworm | rootdir: /home/zuul 2026-06-22 02:37:48.865643 | debian-bookworm | plugins: testinfra-10.2.2 2026-06-22 02:37:49.253635 | ubuntu-noble | writing pytest debug information to pytestdebug.log 2026-06-22 02:37:49.269638 | ubuntu-noble | ============================= test session starts ============================== 2026-06-22 02:37:49.271749 | ubuntu-noble | platform linux -- Python 3.12.3, pytest-9.1.0, pluggy-1.6.0 -- /home/zuul/venv/bin/python3 2026-06-22 02:37:49.271777 | ubuntu-noble | using: pytest-9.1.0 2026-06-22 02:37:49.271783 | ubuntu-noble | registered third-party plugins: 2026-06-22 02:37:49.271789 | ubuntu-noble | pytest-testinfra-10.2.2 at /home/zuul/venv/lib/python3.12/site-packages/testinfra/plugin.py 2026-06-22 02:37:49.271794 | ubuntu-noble | rootdir: /home/zuul 2026-06-22 02:37:49.271804 | ubuntu-noble | plugins: testinfra-10.2.2 2026-06-22 02:37:50.092470 | debian-bookworm | collecting ... collected 6 items 2026-06-22 02:37:50.092840 | debian-bookworm | 2026-06-22 02:37:50.658515 | ubuntu-noble | collecting ... collected 6 items 2026-06-22 02:37:50.658598 | ubuntu-noble | 2026-06-22 02:37:55.276108 | debian-bookworm | tests/auditd.py::test_pkg[ansible://molecule-auditd] PASSED [ 16%] 2026-06-22 02:37:55.319860 | debian-bookworm | tests/auditd.py::test_conffile[ansible://molecule-auditd] PASSED [ 33%] 2026-06-22 02:37:56.255305 | ubuntu-noble | tests/auditd.py::test_pkg[ansible://molecule-auditd] PASSED [ 16%] 2026-06-22 02:37:56.290394 | ubuntu-noble | tests/auditd.py::test_conffile[ansible://molecule-auditd] PASSED [ 33%] 2026-06-22 02:37:58.177727 | debian-bookworm | tests/auditd.py::test_adjustment[ansible://molecule-auditd] PASSED [ 50%] 2026-06-22 02:37:59.556397 | ubuntu-noble | tests/auditd.py::test_adjustment[ansible://molecule-auditd] PASSED [ 50%] 2026-06-22 02:38:03.203272 | debian-bookworm | tests/auditd.py::test_rulefiles[ansible://molecule-auditd] PASSED [ 66%] 2026-06-22 02:38:04.544628 | debian-bookworm | tests/auditd.py::test_srv[ansible://molecule-auditd] PASSED [ 83%] 2026-06-22 02:38:04.584957 | debian-bookworm | wrote pytest debug information to pytestdebug.log 2026-06-22 02:38:04.585434 | debian-bookworm | tests/auditd.py::test_function[ansible://molecule-auditd] PASSED [100%] 2026-06-22 02:38:04.585740 | debian-bookworm | 2026-06-22 02:38:04.586049 | debian-bookworm | ============================== 6 passed in 15.71s ============================== 2026-06-22 02:38:04.612656 | debian-bookworm | INFO [delegated > verify] Verifier completed successfully. 2026-06-22 02:38:04.612793 | debian-bookworm | INFO [delegated > verify] Executed: Successful 2026-06-22 02:38:04.613506 | debian-bookworm | INFO Molecule executed 1 scenario (1 successful) 2026-06-22 02:38:05.082830 | debian-bookworm | ok: Runtime: 0:00:18.754344 2026-06-22 02:38:06.011411 | ubuntu-noble | tests/auditd.py::test_rulefiles[ansible://molecule-auditd] PASSED [ 66%] 2026-06-22 02:38:07.916098 | ubuntu-noble | ok: Runtime: 0:00:21.914925 2026-06-22 02:38:07.923172 | 2026-06-22 02:38:07.923294 | TASK [ansible-molecule : Run molecule destroy action with scenario delegated] 2026-06-22 02:38:07.657577 | ubuntu-noble | tests/auditd.py::test_srv[ansible://molecule-auditd] PASSED [ 83%] 2026-06-22 02:38:07.708213 | ubuntu-noble | wrote pytest debug information to pytestdebug.log 2026-06-22 02:38:07.710187 | ubuntu-noble | tests/auditd.py::test_function[ansible://molecule-auditd] PASSED [100%] 2026-06-22 02:38:07.710307 | ubuntu-noble | 2026-06-22 02:38:07.710416 | ubuntu-noble | ============================== 6 passed in 18.42s ============================== 2026-06-22 02:38:07.759790 | ubuntu-noble | INFO [delegated > verify] Verifier completed successfully. 2026-06-22 02:38:07.759849 | ubuntu-noble | INFO [delegated > verify] Executed: Successful 2026-06-22 02:38:07.759857 | ubuntu-noble | INFO Molecule executed 1 scenario (1 successful) 2026-06-22 02:38:08.472988 | debian-bookworm | skipping: Conditional result was False 2026-06-22 02:38:08.474231 | ubuntu-noble | skipping: Conditional result was False 2026-06-22 02:38:08.500455 | 2026-06-22 02:38:08.500601 | PLAY RECAP 2026-06-22 02:38:08.500861 | debian-bookworm | ok: 17 changed: 12 unreachable: 0 failed: 0 skipped: 16 rescued: 0 ignored: 0 2026-06-22 02:38:08.500907 | ubuntu-noble | ok: 17 changed: 12 unreachable: 0 failed: 0 skipped: 16 rescued: 0 ignored: 0 2026-06-22 02:38:08.500936 | 2026-06-22 02:38:08.690411 | RUN END RESULT_NORMAL: [untrusted : github.com/osism/zuul-jobs/playbooks/ansible-molecule/run.yaml@main] 2026-06-22 02:38:08.691991 | POST-RUN START: [trusted : github.com/osism/zuul-config/playbooks/base/post-fetch.yaml@main] 2026-06-22 02:38:09.539749 | 2026-06-22 02:38:09.539973 | PLAY [Base post-fetch] 2026-06-22 02:38:09.559188 | 2026-06-22 02:38:09.559370 | TASK [diagnose-network : Ensure log directory exists] 2026-06-22 02:38:10.304943 | debian-bookworm | ok 2026-06-22 02:38:10.311373 | ubuntu-noble | ok 2026-06-22 02:38:10.320017 | 2026-06-22 02:38:10.320231 | TASK [diagnose-network : Snapshot dual-stack network state (post)] 2026-06-22 02:38:27.550037 | debian-bookworm | ok: Runtime: 0:00:15.595428 2026-06-22 02:38:27.594190 | ubuntu-noble | ok: Runtime: 0:00:15.564683 2026-06-22 02:38:27.604555 | 2026-06-22 02:38:27.604727 | TASK [diagnose-network : Snapshot Docker/BuildKit IPv6 config (teardown)] 2026-06-22 02:38:33.675815 | debian-bookworm | ok: Runtime: 0:00:00.006365 2026-06-22 02:38:33.829647 | ubuntu-noble | ok: Runtime: 0:00:00.010559 2026-06-22 02:38:33.837695 | 2026-06-22 02:38:33.837862 | TASK [diagnose-network : Probe container network namespace (teardown)] 2026-06-22 02:38:39.955205 | debian-bookworm | ok: Runtime: 0:00:00.005930 2026-06-22 02:38:40.069813 | ubuntu-noble | ok: Runtime: 0:00:00.007449 2026-06-22 02:38:40.089837 | 2026-06-22 02:38:40.089994 | TASK [fetch-output : Set log path for multiple nodes] 2026-06-22 02:38:40.159024 | debian-bookworm | ok 2026-06-22 02:38:40.198962 | ubuntu-noble | ok 2026-06-22 02:38:40.209375 | 2026-06-22 02:38:40.209535 | TASK [fetch-output : Set log path for single node] 2026-06-22 02:38:40.247742 | debian-bookworm | skipping: Conditional result was False 2026-06-22 02:38:40.270591 | ubuntu-noble | skipping: Conditional result was False 2026-06-22 02:38:40.284178 | 2026-06-22 02:38:40.284351 | LOOP [fetch-output : Ensure local output dirs] 2026-06-22 02:38:40.621203 | debian-bookworm -> localhost | changed: "/var/lib/zuul/builds/d59bce2d6a094e85a2aeeac5a8010bfb/work/logs/debian-bookworm" 2026-06-22 02:38:40.631024 | ubuntu-noble -> localhost | changed: "/var/lib/zuul/builds/d59bce2d6a094e85a2aeeac5a8010bfb/work/logs/ubuntu-noble" 2026-06-22 02:38:40.922428 | debian-bookworm -> localhost | changed: "/var/lib/zuul/builds/d59bce2d6a094e85a2aeeac5a8010bfb/work/artifacts" 2026-06-22 02:38:40.923579 | ubuntu-noble -> localhost | ok: "/var/lib/zuul/builds/d59bce2d6a094e85a2aeeac5a8010bfb/work/artifacts" 2026-06-22 02:38:41.198788 | ubuntu-noble -> localhost | changed: "/var/lib/zuul/builds/d59bce2d6a094e85a2aeeac5a8010bfb/work/docs" 2026-06-22 02:38:41.222984 | debian-bookworm -> localhost | ok: "/var/lib/zuul/builds/d59bce2d6a094e85a2aeeac5a8010bfb/work/docs" 2026-06-22 02:38:41.223164 | debian-bookworm -> localhost | changed: All items complete 2026-06-22 02:38:41.223204 | 2026-06-22 02:38:41.235152 | 2026-06-22 02:38:41.235303 | LOOP [fetch-output : Collect logs, artifacts and docs] 2026-06-22 02:38:42.104962 | debian-bookworm | changed: 2026-06-22 02:38:42.105341 | debian-bookworm | .d..t...... ./ 2026-06-22 02:38:42.105385 | debian-bookworm | >f+++++++++ net-debug.post.txt 2026-06-22 02:38:42.105410 | debian-bookworm | >f+++++++++ net-debug.pre.txt 2026-06-22 02:38:42.105431 | debian-bookworm | >f+++++++++ sudo-debug.txt 2026-06-22 02:38:42.105452 | debian-bookworm | >f+++++++++ sudo-strace.log 2026-06-22 02:38:42.105472 | debian-bookworm | >f+++++++++ sudo-strace.log.time 2026-06-22 02:38:42.110478 | ubuntu-noble | changed: 2026-06-22 02:38:42.110564 | ubuntu-noble | .d..t...... ./ 2026-06-22 02:38:42.110610 | ubuntu-noble | >f+++++++++ net-debug.post.txt 2026-06-22 02:38:42.110635 | ubuntu-noble | >f+++++++++ net-debug.pre.txt 2026-06-22 02:38:42.110656 | ubuntu-noble | >f+++++++++ sudo-debug.txt 2026-06-22 02:38:42.110676 | ubuntu-noble | >f+++++++++ sudo-strace.log 2026-06-22 02:38:42.110697 | ubuntu-noble | >f+++++++++ sudo-strace.log.time 2026-06-22 02:38:42.703374 | ubuntu-noble | changed: .d..t...... ./ 2026-06-22 02:38:42.727285 | debian-bookworm | ok 2026-06-22 02:38:43.293094 | ubuntu-noble | changed: .d..t...... ./ 2026-06-22 02:38:43.323132 | debian-bookworm | ok 2026-06-22 02:38:43.323349 | debian-bookworm | changed: All items complete 2026-06-22 02:38:43.323411 | 2026-06-22 02:38:43.358930 | 2026-06-22 02:38:43.359126 | LOOP [merge-output-to-logs : Move artifacts and docs to logs dir] 2026-06-22 02:38:43.731067 | debian-bookworm -> localhost | ok: Item: artifacts Runtime: 0:00:00.012623 2026-06-22 02:38:44.101817 | debian-bookworm -> localhost | ok: Item: docs Runtime: 0:00:00.012472 2026-06-22 02:38:44.135787 | 2026-06-22 02:38:44.135951 | PLAY RECAP 2026-06-22 02:38:44.136033 | debian-bookworm | ok: 8 changed: 3 unreachable: 0 failed: 0 skipped: 1 rescued: 0 ignored: 0 2026-06-22 02:38:44.136081 | ubuntu-noble | ok: 7 changed: 2 unreachable: 0 failed: 0 skipped: 1 rescued: 0 ignored: 0 2026-06-22 02:38:44.136127 | 2026-06-22 02:38:44.313456 | POST-RUN END RESULT_NORMAL: [trusted : github.com/osism/zuul-config/playbooks/base/post-fetch.yaml@main] 2026-06-22 02:38:44.316181 | POST-RUN START: [trusted : github.com/osism/zuul-config/playbooks/base/post.yaml@main] 2026-06-22 02:38:45.154996 | 2026-06-22 02:38:45.155237 | PLAY [Base post] 2026-06-22 02:38:45.180767 | 2026-06-22 02:38:45.180950 | TASK [remove-build-sshkey : Remove the build SSH key from all nodes] 2026-06-22 02:38:46.058188 | debian-bookworm | changed 2026-06-22 02:38:46.092518 | ubuntu-noble | changed 2026-06-22 02:38:46.103903 | 2026-06-22 02:38:46.104055 | PLAY RECAP 2026-06-22 02:38:46.104175 | debian-bookworm | ok: 1 changed: 1 unreachable: 0 failed: 0 skipped: 0 rescued: 0 ignored: 0 2026-06-22 02:38:46.104214 | ubuntu-noble | ok: 1 changed: 1 unreachable: 0 failed: 0 skipped: 0 rescued: 0 ignored: 0 2026-06-22 02:38:46.104239 | 2026-06-22 02:38:46.275876 | POST-RUN END RESULT_NORMAL: [trusted : github.com/osism/zuul-config/playbooks/base/post.yaml@main] 2026-06-22 02:38:46.280079 | POST-RUN START: [trusted : github.com/osism/zuul-config/playbooks/base/post-logs.yaml@main] 2026-06-22 02:38:47.139298 | 2026-06-22 02:38:47.139505 | PLAY [Base post-logs] 2026-06-22 02:38:47.151283 | 2026-06-22 02:38:47.151421 | TASK [generate-zuul-manifest : Generate Zuul manifest] 2026-06-22 02:38:47.672152 | localhost | changed 2026-06-22 02:38:47.695652 | 2026-06-22 02:38:47.695995 | TASK [generate-zuul-manifest : Return Zuul manifest URL to Zuul] 2026-06-22 02:38:47.735054 | localhost | ok 2026-06-22 02:38:47.743385 | 2026-06-22 02:38:47.743695 | TASK [Set zuul-log-path fact] 2026-06-22 02:38:47.763421 | localhost | ok 2026-06-22 02:38:47.778312 | 2026-06-22 02:38:47.778506 | TASK [set-zuul-log-path-fact : Set log path for a build] 2026-06-22 02:38:47.818637 | localhost | ok 2026-06-22 02:38:47.827176 | 2026-06-22 02:38:47.827426 | TASK [upload-logs : Create log directories] 2026-06-22 02:38:48.393828 | localhost | changed 2026-06-22 02:38:48.398223 | 2026-06-22 02:38:48.398366 | TASK [upload-logs : Ensure logs are readable before uploading] 2026-06-22 02:38:48.973887 | localhost -> localhost | ok: Runtime: 0:00:00.006615 2026-06-22 02:38:48.984230 | 2026-06-22 02:38:48.984421 | TASK [upload-logs : Upload logs to log server] 2026-06-22 02:38:49.631774 | localhost | Output suppressed because no_log was given 2026-06-22 02:38:49.634812 | 2026-06-22 02:38:49.635036 | LOOP [upload-logs : Compress console log and json output] 2026-06-22 02:38:49.703696 | localhost | skipping: Conditional result was False 2026-06-22 02:38:49.709062 | localhost | skipping: Conditional result was False 2026-06-22 02:38:49.722343 | 2026-06-22 02:38:49.722577 | LOOP [upload-logs : Upload compressed console log and json output] 2026-06-22 02:38:49.776904 | localhost | skipping: Conditional result was False 2026-06-22 02:38:49.777662 | 2026-06-22 02:38:49.781546 | localhost | skipping: Conditional result was False 2026-06-22 02:38:49.796391 | 2026-06-22 02:38:49.796668 | LOOP [upload-logs : Upload console log and json output]