2026-07-20 06:46:33.934968 | Job console starting 2026-07-20 06:46:33.965669 | Updating git repos 2026-07-20 06:46:34.038056 | Cloning repos into workspace 2026-07-20 06:46:34.163026 | Restoring repo states 2026-07-20 06:46:34.254499 | Merging changes 2026-07-20 06:46:35.069861 | Checking out repos 2026-07-20 06:46:35.226216 | Preparing playbooks 2026-07-20 06:46:36.380993 | Running Ansible setup 2026-07-20 06:46:42.332506 | PRE-RUN START: [trusted : github.com/osism/zuul-config/playbooks/base/pre.yaml@main] 2026-07-20 06:46:43.069226 | 2026-07-20 06:46:43.069371 | PLAY [Base pre] 2026-07-20 06:46:43.086525 | 2026-07-20 06:46:43.086673 | TASK [Setup log path fact] 2026-07-20 06:46:43.107076 | debian-bookworm | ok 2026-07-20 06:46:43.122176 | 2026-07-20 06:46:43.122309 | TASK [set-zuul-log-path-fact : Set log path for a build] 2026-07-20 06:46:43.160745 | debian-bookworm | ok 2026-07-20 06:46:43.172123 | 2026-07-20 06:46:43.172246 | TASK [emit-job-header : Print job information] 2026-07-20 06:46:43.212803 | # Job Information 2026-07-20 06:46:43.213011 | Ansible Version: 2.16.14 2026-07-20 06:46:43.213048 | Job: ansible-collection-services-molecule-auditd 2026-07-20 06:46:43.213082 | Pipeline: check 2026-07-20 06:46:43.213107 | Executor: 521e9411259a 2026-07-20 06:46:43.213128 | Triggered by: https://github.com/osism/ansible-collection-services/pull/2117 2026-07-20 06:46:43.213151 | Event ID: 42e77010-8406-11f1-88d8-01df873a0bd3 2026-07-20 06:46:43.218066 | 2026-07-20 06:46:43.218162 | LOOP [emit-job-header : Print node information] 2026-07-20 06:46:43.322119 | debian-bookworm | ok: 2026-07-20 06:46:43.322338 | debian-bookworm | # Node Information 2026-07-20 06:46:43.322371 | debian-bookworm | Inventory Hostname: debian-bookworm 2026-07-20 06:46:43.322396 | debian-bookworm | Hostname: debian 2026-07-20 06:46:43.322417 | debian-bookworm | Username: zuul 2026-07-20 06:46:43.322438 | debian-bookworm | Distro: Debian 12.15 2026-07-20 06:46:43.322462 | debian-bookworm | Provider: regiocloud-a 2026-07-20 06:46:43.322483 | debian-bookworm | Region: 2026-07-20 06:46:43.322504 | debian-bookworm | Label: debian-bookworm 2026-07-20 06:46:43.322523 | debian-bookworm | Product Name: OpenStack Nova 2026-07-20 06:46:43.322542 | debian-bookworm | Interface IP: 2a13:1a81:8000:3124:f816:3eff:fee2:a101 2026-07-20 06:46:43.378663 | debian-bookworm | ok: 2026-07-20 06:46:43.378805 | debian-bookworm | # Node Information 2026-07-20 06:46:43.378853 | debian-bookworm | Inventory Hostname: ubuntu-noble 2026-07-20 06:46:43.378879 | debian-bookworm | Hostname: ubuntu 2026-07-20 06:46:43.378906 | debian-bookworm | Username: zuul 2026-07-20 06:46:43.378928 | debian-bookworm | Distro: Ubuntu 24.04 2026-07-20 06:46:43.378948 | debian-bookworm | Provider: regiocloud-a 2026-07-20 06:46:43.378968 | debian-bookworm | Region: 2026-07-20 06:46:43.378988 | debian-bookworm | Label: ubuntu-noble 2026-07-20 06:46:43.379007 | debian-bookworm | Product Name: OpenStack Nova 2026-07-20 06:46:43.379025 | debian-bookworm | Interface IP: 2a13:1a81:8000:3124:f816:3eff:fecb:e6d5 2026-07-20 06:46:43.403262 | 2026-07-20 06:46:43.403390 | TASK [log-inventory : Ensure Zuul Ansible directory exists] 2026-07-20 06:46:43.885932 | debian-bookworm -> localhost | changed 2026-07-20 06:46:43.896356 | 2026-07-20 06:46:43.896469 | TASK [log-inventory : Copy ansible inventory to logs dir] 2026-07-20 06:46:45.066514 | debian-bookworm -> localhost | changed 2026-07-20 06:46:45.078079 | ubuntu-noble -> localhost | ok 2026-07-20 06:46:45.095883 | 2026-07-20 06:46:45.096003 | TASK [add-build-sshkey : Check to see if ssh key was already created for this build] 2026-07-20 06:46:45.383664 | debian-bookworm -> localhost | ok 2026-07-20 06:46:45.397649 | 2026-07-20 06:46:45.398003 | TASK [add-build-sshkey : Create a new key in workspace based on build UUID] 2026-07-20 06:46:45.443580 | debian-bookworm | ok 2026-07-20 06:46:45.449381 | ubuntu-noble | ok 2026-07-20 06:46:45.470913 | debian-bookworm | included: /var/lib/zuul/builds/4759f23dac544077b439b7e6f9c039ce/trusted/project_1/github.com/osism/openinfra-zuul-jobs/roles/add-build-sshkey/tasks/create-key-and-replace.yaml 2026-07-20 06:46:45.471123 | ubuntu-noble | included: /var/lib/zuul/builds/4759f23dac544077b439b7e6f9c039ce/trusted/project_1/github.com/osism/openinfra-zuul-jobs/roles/add-build-sshkey/tasks/create-key-and-replace.yaml 2026-07-20 06:46:45.480273 | 2026-07-20 06:46:45.480400 | TASK [add-build-sshkey : Create Temp SSH key] 2026-07-20 06:46:47.337762 | debian-bookworm -> localhost | Generating public/private rsa key pair. 2026-07-20 06:46:47.338234 | debian-bookworm -> localhost | Your identification has been saved in /var/lib/zuul/builds/4759f23dac544077b439b7e6f9c039ce/work/4759f23dac544077b439b7e6f9c039ce_id_rsa 2026-07-20 06:46:47.338313 | debian-bookworm -> localhost | Your public key has been saved in /var/lib/zuul/builds/4759f23dac544077b439b7e6f9c039ce/work/4759f23dac544077b439b7e6f9c039ce_id_rsa.pub 2026-07-20 06:46:47.338369 | debian-bookworm -> localhost | The key fingerprint is: 2026-07-20 06:46:47.338425 | debian-bookworm -> localhost | SHA256:5DkoMvM9ipwG2NyEEZMMZAwO0iBa40VRNXznUn11PMg zuul-build-sshkey 2026-07-20 06:46:47.338476 | debian-bookworm -> localhost | The key's randomart image is: 2026-07-20 06:46:47.338529 | debian-bookworm -> localhost | +---[RSA 3072]----+ 2026-07-20 06:46:47.338600 | debian-bookworm -> localhost | |@B=++o.oo ....+| 2026-07-20 06:46:47.338686 | debian-bookworm -> localhost | |B+=+ ... oE..+| 2026-07-20 06:46:47.338732 | debian-bookworm -> localhost | |...o .. + ..| 2026-07-20 06:46:47.338795 | debian-bookworm -> localhost | | . . + .. . | 2026-07-20 06:46:47.339147 | debian-bookworm -> localhost | |.o+o. . S . | 2026-07-20 06:46:47.339199 | debian-bookworm -> localhost | |o o=.o . | 2026-07-20 06:46:47.339244 | debian-bookworm -> localhost | | . . o | 2026-07-20 06:46:47.339290 | debian-bookworm -> localhost | | ..o . . | 2026-07-20 06:46:47.339333 | debian-bookworm -> localhost | | .+ . | 2026-07-20 06:46:47.339538 | debian-bookworm -> localhost | +----[SHA256]-----+ 2026-07-20 06:46:47.339690 | debian-bookworm -> localhost | ok: Runtime: 0:00:01.287796 2026-07-20 06:46:47.356231 | 2026-07-20 06:46:47.356388 | TASK [add-build-sshkey : Remote setup ssh keys (linux)] 2026-07-20 06:46:47.400900 | debian-bookworm | ok 2026-07-20 06:46:47.406431 | ubuntu-noble | ok 2026-07-20 06:46:47.421673 | debian-bookworm | included: /var/lib/zuul/builds/4759f23dac544077b439b7e6f9c039ce/trusted/project_1/github.com/osism/openinfra-zuul-jobs/roles/add-build-sshkey/tasks/remote-linux.yaml 2026-07-20 06:46:47.421800 | ubuntu-noble | included: /var/lib/zuul/builds/4759f23dac544077b439b7e6f9c039ce/trusted/project_1/github.com/osism/openinfra-zuul-jobs/roles/add-build-sshkey/tasks/remote-linux.yaml 2026-07-20 06:46:47.434226 | 2026-07-20 06:46:47.434331 | TASK [add-build-sshkey : Remove previously added zuul-build-sshkey] 2026-07-20 06:46:47.464625 | debian-bookworm | skipping: Conditional result was False 2026-07-20 06:46:47.475778 | ubuntu-noble | skipping: Conditional result was False 2026-07-20 06:46:47.484130 | 2026-07-20 06:46:47.484240 | TASK [add-build-sshkey : Enable access via build key on all nodes] 2026-07-20 06:46:48.186975 | debian-bookworm | changed 2026-07-20 06:46:48.371314 | ubuntu-noble | changed 2026-07-20 06:46:48.380656 | 2026-07-20 06:46:48.380808 | TASK [add-build-sshkey : Make sure user has a .ssh] 2026-07-20 06:46:48.651471 | debian-bookworm | ok 2026-07-20 06:46:48.695754 | ubuntu-noble | ok 2026-07-20 06:46:48.706723 | 2026-07-20 06:46:48.706969 | TASK [add-build-sshkey : Install build private key as SSH key on all nodes] 2026-07-20 06:46:49.388735 | debian-bookworm | changed 2026-07-20 06:46:49.435029 | ubuntu-noble | changed 2026-07-20 06:46:49.441278 | 2026-07-20 06:46:49.441409 | TASK [add-build-sshkey : Install build public key as SSH key on all nodes] 2026-07-20 06:46:50.182530 | debian-bookworm | changed 2026-07-20 06:46:50.187983 | ubuntu-noble | changed 2026-07-20 06:46:50.193653 | 2026-07-20 06:46:50.193776 | TASK [add-build-sshkey : Remote setup ssh keys (windows)] 2026-07-20 06:46:50.222171 | debian-bookworm | skipping: Conditional result was False 2026-07-20 06:46:50.233348 | ubuntu-noble | skipping: Conditional result was False 2026-07-20 06:46:50.240127 | 2026-07-20 06:46:50.240250 | TASK [remove-zuul-sshkey : Remove master key from local agent] 2026-07-20 06:46:50.680796 | debian-bookworm -> localhost | changed 2026-07-20 06:46:50.699738 | 2026-07-20 06:46:50.699881 | TASK [add-build-sshkey : Add back temp key] 2026-07-20 06:46:51.112360 | debian-bookworm -> localhost | Identity added: /var/lib/zuul/builds/4759f23dac544077b439b7e6f9c039ce/work/4759f23dac544077b439b7e6f9c039ce_id_rsa (zuul-build-sshkey) 2026-07-20 06:46:51.112765 | debian-bookworm -> localhost | ok: Runtime: 0:00:00.015103 2026-07-20 06:46:51.124922 | 2026-07-20 06:46:51.125087 | TASK [add-build-sshkey : Verify we can still SSH to all nodes] 2026-07-20 06:46:51.556212 | ubuntu-noble | ok 2026-07-20 06:46:51.560978 | debian-bookworm | ok 2026-07-20 06:46:51.566423 | 2026-07-20 06:46:51.566568 | TASK [add-build-sshkey : Verify we can still SSH to all nodes (windows)] 2026-07-20 06:46:51.589175 | debian-bookworm | skipping: Conditional result was False 2026-07-20 06:46:51.618578 | ubuntu-noble | skipping: Conditional result was False 2026-07-20 06:46:51.639055 | 2026-07-20 06:46:51.639222 | TASK [start-zuul-console : Start zuul_console daemon.] 2026-07-20 06:46:52.088411 | ubuntu-noble | ok 2026-07-20 06:46:52.094476 | debian-bookworm | ok 2026-07-20 06:46:52.111974 | 2026-07-20 06:46:52.112105 | TASK [validate-host : Define zuul_info_dir fact] 2026-07-20 06:46:52.157618 | ubuntu-noble | ok 2026-07-20 06:46:52.184467 | debian-bookworm | ok 2026-07-20 06:46:52.189995 | 2026-07-20 06:46:52.191269 | TASK [validate-host : Ensure Zuul Ansible directory exists] 2026-07-20 06:46:52.581448 | debian-bookworm -> localhost | ok 2026-07-20 06:46:52.588748 | 2026-07-20 06:46:52.588885 | TASK [validate-host : Collect information about the host] 2026-07-20 06:46:53.741570 | debian-bookworm | ok 2026-07-20 06:46:53.893138 | ubuntu-noble | ok 2026-07-20 06:46:53.904661 | 2026-07-20 06:46:53.904794 | TASK [validate-host : Sanitize hostname] 2026-07-20 06:46:53.978380 | debian-bookworm | ok 2026-07-20 06:46:53.984201 | ubuntu-noble | ok 2026-07-20 06:46:53.990218 | 2026-07-20 06:46:53.990327 | TASK [validate-host : Write out all ansible variables/facts known for each host] 2026-07-20 06:46:54.785175 | debian-bookworm -> localhost | changed 2026-07-20 06:46:54.898777 | ubuntu-noble -> localhost | changed 2026-07-20 06:46:54.910952 | 2026-07-20 06:46:54.911170 | TASK [validate-host : Collect information about zuul worker] 2026-07-20 06:46:55.469036 | debian-bookworm | ok 2026-07-20 06:46:55.500037 | ubuntu-noble | ok 2026-07-20 06:46:55.505468 | 2026-07-20 06:46:55.505611 | TASK [validate-host : Write out all zuul information for each host] 2026-07-20 06:46:56.306825 | debian-bookworm -> localhost | changed 2026-07-20 06:46:56.481435 | ubuntu-noble -> localhost | changed 2026-07-20 06:46:56.500117 | 2026-07-20 06:46:56.500283 | TASK [prepare-workspace-log : Start zuul_console daemon.] 2026-07-20 06:46:56.823343 | debian-bookworm | ok 2026-07-20 06:46:56.879089 | ubuntu-noble | ok 2026-07-20 06:46:56.891772 | 2026-07-20 06:46:56.891955 | TASK [prepare-workspace-log : Synchronize src repos to workspace directory.] 2026-07-20 06:46:58.715306 | debian-bookworm | changed: 2026-07-20 06:46:58.715633 | debian-bookworm | cd+++++++++ src/ 2026-07-20 06:46:58.715673 | debian-bookworm | cd+++++++++ src/github.com/ 2026-07-20 06:46:58.715697 | debian-bookworm | cd+++++++++ src/github.com/osism/ 2026-07-20 06:46:58.715721 | debian-bookworm | cd+++++++++ src/github.com/osism/ansible-collection-services/ 2026-07-20 06:46:58.715743 | debian-bookworm | config] provisioner.env found in /home/zuul/src/github.com/osism/ansible-collection-services/molecule/delegated/molecule.yml, this can be defined in ansible.env 2026-07-20 06:48:26.547845 | debian-bookworm | WARNING Molecule scenarios should migrate to 'extensions/molecule' 2026-07-20 06:48:26.579946 | debian-bookworm | DEBUG [unknown > config] provisioner.env found in /home/zuul/src/github.com/osism/ansible-collection-services/molecule/delegated/molecule.yml, this can be defined in ansible.env 2026-07-20 06:48:27.461312 | ubuntu-noble | DEBUG [unknown > config] provisioner.env found in /home/zuul/src/github.com/osism/ansible-collection-services/molecule/delegated/molecule.yml, this can be defined in ansible.env 2026-07-20 06:48:27.462194 | ubuntu-noble | DEBUG [delegated > validate] Validating schema /home/zuul/src/github.com/osism/ansible-collection-services/molecule/delegated/molecule.yml. 2026-07-20 06:48:27.482612 | ubuntu-noble | DEBUG [default > validate] Validating schema /home/zuul/src/github.com/osism/ansible-collection-services/molecule/default/molecule.yml. 2026-07-20 06:48:27.488763 | ubuntu-noble | INFO [delegated > discovery] scenario test matrix: dependency 2026-07-20 06:48:27.488925 | ubuntu-noble | INFO [delegated > prerun] Performing prerun with role_name_check=0... 2026-07-20 06:48:27.262888 | debian-bookworm | DEBUG [unknown > config] provisioner.env found in /home/zuul/src/github.com/osism/ansible-collection-services/molecule/delegated/molecule.yml, this can be defined in ansible.env 2026-07-20 06:48:27.263470 | debian-bookworm | DEBUG [delegated > validate] Validating schema /home/zuul/src/github.com/osism/ansible-collection-services/molecule/delegated/molecule.yml. 2026-07-20 06:48:27.283022 | debian-bookworm | DEBUG [default > validate] Validating schema /home/zuul/src/github.com/osism/ansible-collection-services/molecule/default/molecule.yml. 2026-07-20 06:48:27.288364 | debian-bookworm | INFO [delegated > discovery] scenario test matrix: dependency 2026-07-20 06:48:27.288574 | debian-bookworm | INFO [delegated > prerun] Performing prerun with role_name_check=0... 2026-07-20 06:48:28.502514 | debian-bookworm | INFO [delegated > dependency] Executing 2026-07-20 06:48:28.502927 | debian-bookworm | WARNING [delegated > dependency] Missing roles requirements file: requirements.yml 2026-07-20 06:48:28.918036 | debian-bookworm | ansible-galaxy [core 2.19.11] 2026-07-20 06:48:28.919064 | debian-bookworm | config file = None 2026-07-20 06:48:28.919824 | debian-bookworm | configured module search path = ['/home/zuul/src/github.com/osism/ansible-collection-services/plugins/modules', '/home/zuul/.ansible/plugins/modules', '/usr/share/ansible/plugins/modules'] 2026-07-20 06:48:28.920617 | debian-bookworm | ansible python module location = /home/zuul/venv/lib/python3.11/site-packages/ansible 2026-07-20 06:48:28.921225 | debian-bookworm | ansible collection location = /home/zuul/.ansible/collections:/usr/share/ansible/collections:/home/zuul/venv/lib/python3.11/site-packages:/home/zuul/venv/lib/python3.11/dist-packages:/home/zuul/venv/lib/python3/dist-packages:/home/zuul/venv/local/lib/python3.11/dist-packages 2026-07-20 06:48:28.921765 | debian-bookworm | executable location = /home/zuul/venv/bin/ansible-galaxy 2026-07-20 06:48:28.922250 | debian-bookworm | python version = 3.11.2 (main, May 12 2026, 05:17:27) [GCC 12.2.0] (/home/zuul/venv/bin/python3) 2026-07-20 06:48:28.922796 | debian-bookworm | jinja version = 3.1.6 2026-07-20 06:48:28.923235 | debian-bookworm | pyyaml version = 6.0.3 (with libyaml v0.2.5) 2026-07-20 06:48:28.923590 | debian-bookworm | No config file found; using defaults 2026-07-20 06:48:28.924040 | debian-bookworm | Reading requirement file at '/home/zuul/src/github.com/osism/ansible-collection-services/molecule/delegated/collections.yml' 2026-07-20 06:48:28.924376 | debian-bookworm | Loading collection osism.services from /home/zuul/.ansible/collections/ansible_collections/osism/services 2026-07-20 06:48:28.924774 | debian-bookworm | Found installed collection osism.services:999.0.0 at '/home/zuul/.ansible/collections/ansible_collections/osism/services' 2026-07-20 06:48:28.928716 | debian-bookworm | Loading collection ansible._protomatter from /home/zuul/venv/lib/python3.11/site-packages/ansible/_internal/ansible_collections/ansible/_protomatter 2026-07-20 06:48:28.929097 | debian-bookworm | Found installed collection ansible._protomatter:2.19.11 at '/home/zuul/venv/lib/python3.11/site-packages/ansible/_internal/ansible_collections/ansible/_protomatter' 2026-07-20 06:48:28.933019 | debian-bookworm | Loading collection kubevirt.core from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/kubevirt/core 2026-07-20 06:48:28.933310 | debian-bookworm | Found installed collection kubevirt.core:2.2.3 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/kubevirt/core' 2026-07-20 06:48:28.933616 | debian-bookworm | Loading collection cyberark.pas from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/cyberark/pas 2026-07-20 06:48:28.934074 | debian-bookworm | Found installed collection cyberark.pas:1.0.36 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/cyberark/pas' 2026-07-20 06:48:28.934555 | debian-bookworm | Loading collection community.okd from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/okd 2026-07-20 06:48:28.934864 | debian-bookworm | Found installed collection community.okd:5.0.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/okd' 2026-07-20 06:48:28.935433 | debian-bookworm | Loading collection community.crypto from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/crypto 2026-07-20 06:48:28.935716 | debian-bookworm | Found installed collection community.crypto:3.0.5 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/crypto' 2026-07-20 06:48:28.936650 | debian-bookworm | Loading collection community.zabbix from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/zabbix 2026-07-20 06:48:28.937152 | debian-bookworm | Found installed collection community.zabbix:4.1.1 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/zabbix' 2026-07-20 06:48:28.938430 | debian-bookworm | Loading collection kubernetes.core from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/kubernetes/core 2026-07-20 06:48:28.938849 | debian-bookworm | Found installed collection kubernetes.core:6.2.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/kubernetes/core' 2026-07-20 06:48:28.939270 | debian-bookworm | Loading collection ngine_io.cloudstack from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/ngine_io/cloudstack 2026-07-20 06:48:28.939685 | debian-bookworm | Found installed collection ngine_io.cloudstack:2.5.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/ngine_io/cloudstack' 2026-07-20 06:48:28.941168 | debian-bookworm | Loading collection theforeman.foreman from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/theforeman/foreman 2026-07-20 06:48:28.941591 | debian-bookworm | Found installed collection theforeman.foreman:5.7.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/theforeman/foreman' 2026-07-20 06:48:28.941986 | debian-bookworm | Loading collection containers.podman from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/containers/podman 2026-07-20 06:48:28.942273 | debian-bookworm | Found installed collection containers.podman:1.18.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/containers/podman' 2026-07-20 06:48:28.942902 | debian-bookworm | Loading collection community.digitalocean from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/digitalocean 2026-07-20 06:48:28.943246 | debian-bookworm | Found installed collection community.digitalocean:1.27.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/digitalocean' 2026-07-20 06:48:28.943627 | debian-bookworm | Loading collection microsoft.ad from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/microsoft/ad 2026-07-20 06:48:28.943925 | debian-bookworm | Found installed collection microsoft.ad:1.9.2 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/microsoft/ad' 2026-07-20 06:48:28.944380 | debian-bookworm | Loading collection cisco.iosxr from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/cisco/iosxr 2026-07-20 06:48:28.944787 | debian-bookworm | Found installed collection cisco.iosxr:12.1.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/cisco/iosxr' 2026-07-20 06:48:28.945123 | debian-bookworm | Loading collection community.mysql from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/mysql 2026-07-20 06:48:28.945466 | debian-bookworm | Found installed collection community.mysql:3.16.1 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/mysql' 2026-07-20 06:48:28.945799 | debian-bookworm | Loading collection netapp.storagegrid from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/netapp/storagegrid 2026-07-20 06:48:28.946152 | debian-bookworm | Found installed collection netapp.storagegrid:21.15.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/netapp/storagegrid' 2026-07-20 06:48:28.946406 | debian-bookworm | Loading collection microsoft.iis from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/microsoft/iis 2026-07-20 06:48:28.946761 | debian-bookworm | Found installed collection microsoft.iis:1.0.3 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/microsoft/iis' 2026-07-20 06:48:28.947023 | debian-bookworm | Loading collection community.docker from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/docker 2026-07-20 06:48:28.947356 | debian-bookworm | Found installed collection community.docker:4.8.2 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/docker' 2026-07-20 06:48:28.947640 | debian-bookworm | Loading collection ibm.storage_virtualize from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/ibm/storage_virtualize 2026-07-20 06:48:28.947977 | debian-bookworm | Found installed collection ibm.storage_virtualize:2.7.4 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/ibm/storage_virtualize' 2026-07-20 06:48:28.949616 | debian-bookworm | Loading collection awx.awx from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/awx/awx 2026-07-20 06:48:28.949904 | debian-bookworm | Found installed collection awx.awx:24.6.1 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/awx/awx' 2026-07-20 06:48:28.950168 | debian-bookworm | Loading collection community.proxysql from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/proxysql 2026-07-20 06:48:28.950453 | debian-bookworm | Found installed collection community.proxysql:1.7.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/proxysql' 2026-07-20 06:48:28.950718 | debian-bookworm | Loading collection infoblox.nios_modules from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/infoblox/nios_modules 2026-07-20 06:48:28.950989 | debian-bookworm | Found installed collection infoblox.nios_modules:1.8.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/infoblox/nios_modules' 2026-07-20 06:48:28.951260 | debian-bookworm | Loading collection cyberark.conjur from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/cyberark/conjur 2026-07-20 06:48:28.951478 | debian-bookworm | Found installed collection cyberark.conjur:1.3.8 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/cyberark/conjur' 2026-07-20 06:48:28.951754 | debian-bookworm | Loading collection community.mongodb from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/mongodb 2026-07-20 06:48:28.952024 | debian-bookworm | Found installed collection community.mongodb:1.7.10 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/mongodb' 2026-07-20 06:48:28.952294 | debian-bookworm | Loading collection hitachivantara.vspone_object from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/hitachivantara/vspone_object 2026-07-20 06:48:28.952654 | debian-bookworm | Found installed collection hitachivantara.vspone_object:1.0.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/hitachivantara/vspone_object' 2026-07-20 06:48:28.952939 | debian-bookworm | Loading collection community.sops from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/sops 2026-07-20 06:48:28.953145 | debian-bookworm | Found installed collection community.sops:2.2.7 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/sops' 2026-07-20 06:48:28.953458 | debian-bookworm | Loading collection purestorage.flasharray from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/purestorage/flasharray 2026-07-20 06:48:28.953703 | debian-bookworm | Found installed collection purestorage.flasharray:1.39.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/purestorage/flasharray' 2026-07-20 06:48:28.953965 | debian-bookworm | Loading collection community.rabbitmq from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/rabbitmq 2026-07-20 06:48:28.954172 | debian-bookworm | Found installed collection community.rabbitmq:1.6.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/rabbitmq' 2026-07-20 06:48:28.955239 | debian-bookworm | Loading collection cisco.mso from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/cisco/mso 2026-07-20 06:48:28.955531 | debian-bookworm | Found installed collection cisco.mso:2.11.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/cisco/mso' 2026-07-20 06:48:28.956243 | debian-bookworm | Loading collection arista.eos from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/arista/eos 2026-07-20 06:48:28.956558 | debian-bookworm | Found installed collection arista.eos:12.0.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/arista/eos' 2026-07-20 06:48:28.957252 | debian-bookworm | Loading collection dellemc.unity from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/dellemc/unity 2026-07-20 06:48:28.957577 | debian-bookworm | Found installed collection dellemc.unity:2.1.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/dellemc/unity' 2026-07-20 06:48:28.957849 | debian-bookworm | Loading collection kaytus.ksmanage from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/kaytus/ksmanage 2026-07-20 06:48:28.958125 | debian-bookworm | Found installed collection kaytus.ksmanage:2.0.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/kaytus/ksmanage' 2026-07-20 06:48:28.962952 | debian-bookworm | Loading collection fortinet.fortimanager from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/fortinet/fortimanager 2026-07-20 06:48:28.963229 | debian-bookworm | Found installed collection fortinet.fortimanager:2.11.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/fortinet/fortimanager' 2026-07-20 06:48:28.964232 | debian-bookworm | Loading collection hetzner.hcloud from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/hetzner/hcloud 2026-07-20 06:48:28.964548 | debian-bookworm | Found installed collection hetzner.hcloud:5.4.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/hetzner/hcloud' 2026-07-20 06:48:28.967642 | debian-bookworm | Loading collection community.aws from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/aws 2026-07-20 06:48:28.967941 | debian-bookworm | Found installed collection community.aws:10.0.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/aws' 2026-07-20 06:48:28.970186 | debian-bookworm | Loading collection vmware.vmware_rest from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/vmware/vmware_rest 2026-07-20 06:48:28.970515 | debian-bookworm | Found installed collection vmware.vmware_rest:4.9.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/vmware/vmware_rest' 2026-07-20 06:48:28.971083 | debian-bookworm | Loading collection cisco.ios from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/cisco/ios 2026-07-20 06:48:28.971381 | debian-bookworm | Found installed collection cisco.ios:11.1.1 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/cisco/ios' 2026-07-20 06:48:28.972201 | debian-bookworm | Loading collection google.cloud from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/google/cloud 2026-07-20 06:48:28.972551 | debian-bookworm | Found installed collection google.cloud:1.9.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/google/cloud' 2026-07-20 06:48:28.972857 | debian-bookworm | Loading collection purestorage.flashblade from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/purestorage/flashblade 2026-07-20 06:48:28.973175 | debian-bookworm | Found installed collection purestorage.flashblade:1.22.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/purestorage/flashblade' 2026-07-20 06:48:28.973490 | debian-bookworm | Loading collection inspur.ispim from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/inspur/ispim 2026-07-20 06:48:28.973789 | debian-bookworm | Found installed collection inspur.ispim:2.2.3 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/inspur/ispim' 2026-07-20 06:48:28.974022 | debian-bookworm | Loading collection community.ciscosmb from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/ciscosmb 2026-07-20 06:48:28.974332 | debian-bookworm | Found installed collection community.ciscosmb:1.0.11 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/ciscosmb' 2026-07-20 06:48:28.974575 | debian-bookworm | Loading collection netapp_eseries.santricity from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/netapp_eseries/santricity 2026-07-20 06:48:28.974868 | debian-bookworm | Found installed collection netapp_eseries.santricity:1.4.1 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/netapp_eseries/santricity' 2026-07-20 06:48:28.976265 | debian-bookworm | Loading collection azure.azcollection from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/azure/azcollection 2026-07-20 06:48:28.976623 | debian-bookworm | Found installed collection azure.azcollection:3.10.1 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/azure/azcollection' 2026-07-20 06:48:28.976992 | debian-bookworm | Loading collection telekom_mms.icinga_director from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/telekom_mms/icinga_director 2026-07-20 06:48:28.977296 | debian-bookworm | Found installed collection telekom_mms.icinga_director:2.4.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/telekom_mms/icinga_director' 2026-07-20 06:48:28.977756 | debian-bookworm | Loading collection ibm.qradar from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/ibm/qradar 2026-07-20 06:48:28.978137 | debian-bookworm | Found installed collection ibm.qradar:4.0.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/ibm/qradar' 2026-07-20 06:48:28.978369 | debian-bookworm | Loading collection community.routeros from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/routeros 2026-07-20 06:48:28.978697 | debian-bookworm | Found installed collection community.routeros:3.13.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/routeros' 2026-07-20 06:48:28.978982 | debian-bookworm | Loading collection community.libvirt from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/libvirt 2026-07-20 06:48:28.979217 | debian-bookworm | Found installed collection community.libvirt:2.0.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/libvirt' 2026-07-20 06:48:28.979585 | debian-bookworm | Loading collection cloudscale_ch.cloud from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/cloudscale_ch/cloud 2026-07-20 06:48:28.979884 | debian-bookworm | Found installed collection cloudscale_ch.cloud:2.5.2 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/cloudscale_ch/cloud' 2026-07-20 06:48:28.980184 | debian-bookworm | Loading collection check_point.mgmt from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/check_point/mgmt 2026-07-20 06:48:28.980537 | debian-bookworm | Found installed collection check_point.mgmt:6.6.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/check_point/mgmt' 2026-07-20 06:48:28.981151 | debian-bookworm | Loading collection netapp.ontap from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/netapp/ontap 2026-07-20 06:48:28.981384 | debian-bookworm | Found installed collection netapp.ontap:23.2.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/netapp/ontap' 2026-07-20 06:48:28.981818 | debian-bookworm | Loading collection wti.remote from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/wti/remote 2026-07-20 06:48:28.982049 | debian-bookworm | Found installed collection wti.remote:1.0.10 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/wti/remote' 2026-07-20 06:48:28.982452 | debian-bookworm | Loading collection vultr.cloud from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/vultr/cloud 2026-07-20 06:48:28.982681 | debian-bookworm | Found installed collection vultr.cloud:1.13.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/vultr/cloud' 2026-07-20 06:48:28.982947 | debian-bookworm | Loading collection ansible.netcommon from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/ansible/netcommon 2026-07-20 06:48:28.983188 | debian-bookworm | Found installed collection ansible.netcommon:8.1.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/ansible/netcommon' 2026-07-20 06:48:28.983572 | debian-bookworm | Loading collection community.proxmox from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/proxmox 2026-07-20 06:48:28.983808 | debian-bookworm | Found installed collection community.proxmox:1.4.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/proxmox' 2026-07-20 06:48:28.984301 | debian-bookworm | Loading collection dellemc.openmanage from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/dellemc/openmanage 2026-07-20 06:48:28.984602 | debian-bookworm | Found installed collection dellemc.openmanage:9.12.3 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/dellemc/openmanage' 2026-07-20 06:48:28.984818 | debian-bookworm | Loading collection ansible.posix from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/ansible/posix 2026-07-20 06:48:28.985033 | debian-bookworm | Found installed collection ansible.posix:2.1.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/ansible/posix' 2026-07-20 06:48:28.985335 | debian-bookworm | Loading collection ravendb.ravendb from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/ravendb/ravendb 2026-07-20 06:48:28.985592 | debian-bookworm | Found installed collection ravendb.ravendb:1.0.4 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/ravendb/ravendb' 2026-07-20 06:48:28.985875 | debian-bookworm | Loading collection infinidat.infinibox from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/infinidat/infinibox 2026-07-20 06:48:28.986077 | debian-bookworm | Found installed collection infinidat.infinibox:1.6.3 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/infinidat/infinibox' 2026-07-20 06:48:28.986363 | debian-bookworm | Loading collection chocolatey.chocolatey from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/chocolatey/chocolatey 2026-07-20 06:48:28.986603 | debian-bookworm | Found installed collection chocolatey.chocolatey:1.5.3 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/chocolatey/chocolatey' 2026-07-20 06:48:28.987503 | debian-bookworm | Loading collection junipernetworks.junos from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/junipernetworks/junos 2026-07-20 06:48:28.987774 | debian-bookworm | Found installed collection junipernetworks.junos:11.0.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/junipernetworks/junos' 2026-07-20 06:48:28.988056 | debian-bookworm | Loading collection grafana.grafana from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/grafana/grafana 2026-07-20 06:48:28.988337 | debian-bookworm | Found installed collection grafana.grafana:6.0.6 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/grafana/grafana' 2026-07-20 06:48:28.988558 | debian-bookworm | Loading collection ansible.utils from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/ansible/utils 2026-07-20 06:48:28.988855 | debian-bookworm | Found installed collection ansible.utils:6.0.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/ansible/utils' 2026-07-20 06:48:28.990399 | debian-bookworm | Loading collection cisco.meraki from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/cisco/meraki 2026-07-20 06:48:28.990654 | debian-bookworm | Found installed collection cisco.meraki:2.21.8 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/cisco/meraki' 2026-07-20 06:48:28.990848 | debian-bookworm | Loading collection cisco.ucs from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/cisco/ucs 2026-07-20 06:48:28.991098 | debian-bookworm | Found installed collection cisco.ucs:1.16.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/cisco/ucs' 2026-07-20 06:48:28.991287 | debian-bookworm | Loading collection community.library_inventory_filtering_v1 from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/library_inventory_filtering_v1 2026-07-20 06:48:28.991572 | debian-bookworm | Found installed collection community.library_inventory_filtering_v1:1.1.5 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/library_inventory_filtering_v1' 2026-07-20 06:48:28.991976 | debian-bookworm | Loading collection f5networks.f5_modules from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/f5networks/f5_modules 2026-07-20 06:48:28.992253 | debian-bookworm | Found installed collection f5networks.f5_modules:1.39.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/f5networks/f5_modules' 2026-07-20 06:48:28.993031 | debian-bookworm | Loading collection vyos.vyos from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/vyos/vyos 2026-07-20 06:48:28.993276 | debian-bookworm | Found installed collection vyos.vyos:6.0.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/vyos/vyos' 2026-07-20 06:48:28.993460 | debian-bookworm | Loading collection cisco.intersight from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/cisco/intersight 2026-07-20 06:48:28.993766 | debian-bookworm | Found installed collection cisco.intersight:2.7.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/cisco/intersight' 2026-07-20 06:48:28.994022 | debian-bookworm | Loading collection netapp.cloudmanager from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/netapp/cloudmanager 2026-07-20 06:48:28.994273 | debian-bookworm | Found installed collection netapp.cloudmanager:21.24.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/netapp/cloudmanager' 2026-07-20 06:48:28.994692 | debian-bookworm | Loading collection vmware.vmware from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/vmware/vmware 2026-07-20 06:48:28.994920 | debian-bookworm | Found installed collection vmware.vmware:2.4.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/vmware/vmware' 2026-07-20 06:48:28.995243 | debian-bookworm | Loading collection community.grafana from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/grafana 2026-07-20 06:48:28.995544 | debian-bookworm | Found installed collection community.grafana:2.3.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/grafana' 2026-07-20 06:48:28.995835 | debian-bookworm | Loading collection hitachivantara.vspone_block from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/hitachivantara/vspone_block 2026-07-20 06:48:28.996113 | debian-bookworm | Found installed collection hitachivantara.vspone_block:4.4.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/hitachivantara/vspone_block' 2026-07-20 06:48:28.997784 | debian-bookworm | Loading collection community.windows from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/windows 2026-07-20 06:48:28.998036 | debian-bookworm | Found installed collection community.windows:3.0.1 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/windows' 2026-07-20 06:48:29.001131 | debian-bookworm | Loading collection fortinet.fortios from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/fortinet/fortios 2026-07-20 06:48:29.001442 | debian-bookworm | Found installed collection fortinet.fortios:2.4.2 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/fortinet/fortios' 2026-07-20 06:48:29.002076 | debian-bookworm | Loading collection netbox.netbox from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/netbox/netbox 2026-07-20 06:48:29.002341 | debian-bookworm | Found installed collection netbox.netbox:3.21.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/netbox/netbox' 2026-07-20 06:48:29.002532 | debian-bookworm | Loading collection cisco.dnac from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/cisco/dnac 2026-07-20 06:48:29.002827 | debian-bookworm | Found installed collection cisco.dnac:6.41.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/cisco/dnac' 2026-07-20 06:48:29.004253 | debian-bookworm | Loading collection cisco.aci from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/cisco/aci 2026-07-20 06:48:29.004567 | debian-bookworm | Found installed collection cisco.aci:2.12.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/cisco/aci' 2026-07-20 06:48:29.006072 | debian-bookworm | Loading collection dellemc.enterprise_sonic from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/dellemc/enterprise_sonic 2026-07-20 06:48:29.006360 | debian-bookworm | Found installed collection dellemc.enterprise_sonic:3.2.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/dellemc/enterprise_sonic' 2026-07-20 06:48:29.006726 | debian-bookworm | Loading collection community.hrobot from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/hrobot 2026-07-20 06:48:29.007023 | debian-bookworm | Found installed collection community.hrobot:2.7.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/hrobot' 2026-07-20 06:48:29.007385 | debian-bookworm | Loading collection community.postgresql from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/postgresql 2026-07-20 06:48:29.007654 | debian-bookworm | Found installed collection community.postgresql:4.1.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/postgresql' 2026-07-20 06:48:29.007929 | debian-bookworm | Loading collection ieisystem.inmanage from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/ieisystem/inmanage 2026-07-20 06:48:29.008169 | debian-bookworm | Found installed collection ieisystem.inmanage:3.0.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/ieisystem/inmanage' 2026-07-20 06:48:29.008626 | debian-bookworm | Loading collection dellemc.powerflex from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/dellemc/powerflex 2026-07-20 06:48:29.008928 | debian-bookworm | Found installed collection dellemc.powerflex:2.6.1 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/dellemc/powerflex' 2026-07-20 06:48:29.009231 | debian-bookworm | Loading collection community.dns from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/dns 2026-07-20 06:48:29.009514 | debian-bookworm | Found installed collection community.dns:3.4.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/dns' 2026-07-20 06:48:29.018564 | debian-bookworm | Loading collection community.general from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/general 2026-07-20 06:48:29.018829 | debian-bookworm | Found installed collection community.general:11.4.1 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/general' 2026-07-20 06:48:29.092974 | ubuntu-noble | INFO [delegated > dependency] Executing 2026-07-20 06:48:29.094512 | ubuntu-noble | WARNING [delegated > dependency] Missing roles requirements file: requirements.yml 2026-07-20 06:48:29.020343 | debian-bookworm | Loading collection openstack.cloud from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/openstack/cloud 2026-07-20 06:48:29.020923 | debian-bookworm | Found installed collection openstack.cloud:2.5.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/openstack/cloud' 2026-07-20 06:48:29.021256 | debian-bookworm | Loading collection ansible.windows from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/ansible/windows 2026-07-20 06:48:29.021734 | debian-bookworm | Found installed collection ansible.windows:3.2.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/ansible/windows' 2026-07-20 06:48:29.022112 | debian-bookworm | Loading collection amazon.aws from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/amazon/aws 2026-07-20 06:48:29.022299 | debian-bookworm | Found installed collection amazon.aws:10.1.2 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/amazon/aws' 2026-07-20 06:48:29.022658 | debian-bookworm | Loading collection community.hashi_vault from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/hashi_vault 2026-07-20 06:48:29.022924 | debian-bookworm | Found installed collection community.hashi_vault:7.1.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/hashi_vault' 2026-07-20 06:48:29.023184 | debian-bookworm | Loading collection lowlydba.sqlserver from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/lowlydba/sqlserver 2026-07-20 06:48:29.023447 | debian-bookworm | Found installed collection lowlydba.sqlserver:2.7.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/lowlydba/sqlserver' 2026-07-20 06:48:29.023744 | debian-bookworm | Loading collection community.sap_libs from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/sap_libs 2026-07-20 06:48:29.023998 | debian-bookworm | Found installed collection community.sap_libs:1.5.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/sap_libs' 2026-07-20 06:48:29.025361 | debian-bookworm | Loading collection cisco.nxos from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/cisco/nxos 2026-07-20 06:48:29.025623 | debian-bookworm | Found installed collection cisco.nxos:11.0.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/cisco/nxos' 2026-07-20 06:48:29.026946 | debian-bookworm | Loading collection community.vmware from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/vmware 2026-07-20 06:48:29.027233 | debian-bookworm | Found installed collection community.vmware:5.10.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/vmware' 2026-07-20 06:48:29.027796 | debian-bookworm | Loading collection ovirt.ovirt from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/ovirt/ovirt 2026-07-20 06:48:29.028077 | debian-bookworm | Found installed collection ovirt.ovirt:3.2.1 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/ovirt/ovirt' 2026-07-20 06:48:29.028685 | debian-bookworm | Loading collection splunk.es from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/splunk/es 2026-07-20 06:48:29.028954 | debian-bookworm | Found installed collection splunk.es:4.0.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/splunk/es' 2026-07-20 06:48:29.032456 | debian-bookworm | Initial connection to galaxy_server: https://galaxy.ansible.com 2026-07-20 06:48:29.032809 | debian-bookworm | Created /home/zuul/.ansible/galaxy_token 2026-07-20 06:48:29.032958 | debian-bookworm | Calling Galaxy at https://galaxy.ansible.com/api/ 2026-07-20 06:48:29.242868 | debian-bookworm | Found API version 'v3, pulp-v3, v1' with Galaxy server default (https://galaxy.ansible.com/api/) 2026-07-20 06:48:29.243321 | debian-bookworm | Calling Galaxy at https://galaxy.ansible.com/api/v3/collections/osism/commons/ 2026-07-20 06:48:29.649376 | ubuntu-noble | ansible-galaxy [core 2.19.11] 2026-07-20 06:48:29.649501 | ubuntu-noble | config file = None 2026-07-20 06:48:29.649532 | ubuntu-noble | configured module search path = ['/home/zuul/src/github.com/osism/ansible-collection-services/plugins/modules', '/home/zuul/.ansible/plugins/modules', '/usr/share/ansible/plugins/modules'] 2026-07-20 06:48:29.649554 | ubuntu-noble | ansible python module location = /home/zuul/venv/lib/python3.12/site-packages/ansible 2026-07-20 06:48:29.649590 | ubuntu-noble | ansible collection location = /home/zuul/.ansible/collections:/usr/share/ansible/collections:/home/zuul/venv/lib/python3.12/site-packages:/home/zuul/venv/lib/python3.12/dist-packages:/home/zuul/venv/lib/python3/dist-packages:/home/zuul/venv/local/lib/python3.12/dist-packages 2026-07-20 06:48:29.650256 | ubuntu-noble | executable location = /home/zuul/venv/bin/ansible-galaxy 2026-07-20 06:48:29.650957 | ubuntu-noble | python version = 3.12.3 (main, Jun 19 2026, 12:46:00) [GCC 13.3.0] (/home/zuul/venv/bin/python3) 2026-07-20 06:48:29.651614 | ubuntu-noble | jinja version = 3.1.6 2026-07-20 06:48:29.652686 | ubuntu-noble | pyyaml version = 6.0.3 (with libyaml v0.2.5) 2026-07-20 06:48:29.653188 | ubuntu-noble | No config file found; using defaults 2026-07-20 06:48:29.653872 | ubuntu-noble | Reading requirement file at '/home/zuul/src/github.com/osism/ansible-collection-services/molecule/delegated/collections.yml' 2026-07-20 06:48:29.662239 | ubuntu-noble | Loading collection ansible._protomatter from /home/zuul/venv/lib/python3.12/site-packages/ansible/_internal/ansible_collections/ansible/_protomatter 2026-07-20 06:48:29.663002 | ubuntu-noble | Found installed collection ansible._protomatter:2.19.11 at '/home/zuul/venv/lib/python3.12/site-packages/ansible/_internal/ansible_collections/ansible/_protomatter' 2026-07-20 06:48:29.674668 | ubuntu-noble | Loading collection osism.services from /home/zuul/.ansible/collections/ansible_collections/osism/services 2026-07-20 06:48:29.675210 | ubuntu-noble | Found installed collection osism.services:999.0.0 at '/home/zuul/.ansible/collections/ansible_collections/osism/services' 2026-07-20 06:48:29.685766 | ubuntu-noble | Loading collection ansible.windows from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/ansible/windows 2026-07-20 06:48:29.686252 | ubuntu-noble | Found installed collection ansible.windows:3.2.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/ansible/windows' 2026-07-20 06:48:29.686719 | ubuntu-noble | Loading collection community.mongodb from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/mongodb 2026-07-20 06:48:29.687175 | ubuntu-noble | Found installed collection community.mongodb:1.7.10 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/mongodb' 2026-07-20 06:48:29.687614 | ubuntu-noble | Loading collection grafana.grafana from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/grafana/grafana 2026-07-20 06:48:29.687950 | ubuntu-noble | Found installed collection grafana.grafana:6.0.6 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/grafana/grafana' 2026-07-20 06:48:29.688481 | ubuntu-noble | Loading collection inspur.ispim from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/inspur/ispim 2026-07-20 06:48:29.688820 | ubuntu-noble | Found installed collection inspur.ispim:2.2.3 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/inspur/ispim' 2026-07-20 06:48:29.689310 | ubuntu-noble | Loading collection ibm.qradar from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/ibm/qradar 2026-07-20 06:48:29.689628 | ubuntu-noble | Found installed collection ibm.qradar:4.0.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/ibm/qradar' 2026-07-20 06:48:29.689981 | ubuntu-noble | Loading collection community.zabbix from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/zabbix 2026-07-20 06:48:29.690268 | ubuntu-noble | Found installed collection community.zabbix:4.1.1 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/zabbix' 2026-07-20 06:48:29.692759 | ubuntu-noble | Loading collection hetzner.hcloud from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/hetzner/hcloud 2026-07-20 06:48:29.693086 | ubuntu-noble | Found installed collection hetzner.hcloud:5.4.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/hetzner/hcloud' 2026-07-20 06:48:29.694704 | ubuntu-noble | Loading collection theforeman.foreman from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/theforeman/foreman 2026-07-20 06:48:29.695020 | ubuntu-noble | Found installed collection theforeman.foreman:5.7.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/theforeman/foreman' 2026-07-20 06:48:29.695372 | ubuntu-noble | Loading collection ravendb.ravendb from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/ravendb/ravendb 2026-07-20 06:48:29.695655 | ubuntu-noble | Found installed collection ravendb.ravendb:1.0.4 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/ravendb/ravendb' 2026-07-20 06:48:29.696431 | ubuntu-noble | Loading collection check_point.mgmt from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/check_point/mgmt 2026-07-20 06:48:29.696453 | ubuntu-noble | Found installed collection check_point.mgmt:6.6.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/check_point/mgmt' 2026-07-20 06:48:29.697035 | ubuntu-noble | Loading collection netapp.cloudmanager from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/netapp/cloudmanager 2026-07-20 06:48:29.697051 | ubuntu-noble | Found installed collection netapp.cloudmanager:21.24.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/netapp/cloudmanager' 2026-07-20 06:48:29.698315 | ubuntu-noble | Loading collection google.cloud from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/google/cloud 2026-07-20 06:48:29.698340 | ubuntu-noble | Found installed collection google.cloud:1.9.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/google/cloud' 2026-07-20 06:48:29.701009 | ubuntu-noble | Loading collection awx.awx from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/awx/awx 2026-07-20 06:48:29.701034 | ubuntu-noble | Found installed collection awx.awx:24.6.1 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/awx/awx' 2026-07-20 06:48:29.702783 | ubuntu-noble | Loading collection community.vmware from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/vmware 2026-07-20 06:48:29.702806 | ubuntu-noble | Found installed collection community.vmware:5.10.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/vmware' 2026-07-20 06:48:29.703699 | ubuntu-noble | Loading collection kubernetes.core from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/kubernetes/core 2026-07-20 06:48:29.703722 | ubuntu-noble | Found installed collection kubernetes.core:6.2.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/kubernetes/core' 2026-07-20 06:48:29.704267 | ubuntu-noble | Loading collection microsoft.ad from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/microsoft/ad 2026-07-20 06:48:29.704304 | ubuntu-noble | Found installed collection microsoft.ad:1.9.2 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/microsoft/ad' 2026-07-20 06:48:29.704590 | ubuntu-noble | Loading collection chocolatey.chocolatey from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/chocolatey/chocolatey 2026-07-20 06:48:29.704867 | ubuntu-noble | Found installed collection chocolatey.chocolatey:1.5.3 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/chocolatey/chocolatey' 2026-07-20 06:48:29.705292 | ubuntu-noble | Loading collection telekom_mms.icinga_director from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/telekom_mms/icinga_director 2026-07-20 06:48:29.705589 | ubuntu-noble | Found installed collection telekom_mms.icinga_director:2.4.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/telekom_mms/icinga_director' 2026-07-20 06:48:29.705862 | ubuntu-noble | Loading collection cisco.intersight from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/cisco/intersight 2026-07-20 06:48:29.706156 | ubuntu-noble | Found installed collection cisco.intersight:2.7.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/cisco/intersight' 2026-07-20 06:48:29.706802 | ubuntu-noble | Loading collection community.docker from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/docker 2026-07-20 06:48:29.706831 | ubuntu-noble | Found installed collection community.docker:4.8.2 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/docker' 2026-07-20 06:48:29.707119 | ubuntu-noble | Loading collection community.grafana from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/grafana 2026-07-20 06:48:29.707422 | ubuntu-noble | Found installed collection community.grafana:2.3.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/grafana' 2026-07-20 06:48:29.707858 | ubuntu-noble | Loading collection community.crypto from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/crypto 2026-07-20 06:48:29.708164 | ubuntu-noble | Found installed collection community.crypto:3.0.5 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/crypto' 2026-07-20 06:48:29.708444 | ubuntu-noble | Loading collection ansible.netcommon from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/ansible/netcommon 2026-07-20 06:48:29.708711 | ubuntu-noble | Found installed collection ansible.netcommon:8.1.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/ansible/netcommon' 2026-07-20 06:48:29.710030 | ubuntu-noble | Loading collection cisco.mso from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/cisco/mso 2026-07-20 06:48:29.710347 | ubuntu-noble | Found installed collection cisco.mso:2.11.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/cisco/mso' 2026-07-20 06:48:29.710852 | ubuntu-noble | Loading collection community.sap_libs from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/sap_libs 2026-07-20 06:48:29.710871 | ubuntu-noble | Found installed collection community.sap_libs:1.5.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/sap_libs' 2026-07-20 06:48:29.711132 | ubuntu-noble | Loading collection kubevirt.core from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/kubevirt/core 2026-07-20 06:48:29.711411 | ubuntu-noble | Found installed collection kubevirt.core:2.2.3 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/kubevirt/core' 2026-07-20 06:48:29.711753 | ubuntu-noble | Loading collection community.okd from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/okd 2026-07-20 06:48:29.712028 | ubuntu-noble | Found installed collection community.okd:5.0.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/okd' 2026-07-20 06:48:29.712740 | ubuntu-noble | Loading collection cisco.ios from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/cisco/ios 2026-07-20 06:48:29.712994 | ubuntu-noble | Found installed collection cisco.ios:11.1.1 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/cisco/ios' 2026-07-20 06:48:29.713596 | ubuntu-noble | Loading collection ngine_io.cloudstack from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/ngine_io/cloudstack 2026-07-20 06:48:29.713850 | ubuntu-noble | Found installed collection ngine_io.cloudstack:2.5.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/ngine_io/cloudstack' 2026-07-20 06:48:29.714149 | ubuntu-noble | Loading collection containers.podman from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/containers/podman 2026-07-20 06:48:29.714392 | ubuntu-noble | Found installed collection containers.podman:1.18.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/containers/podman' 2026-07-20 06:48:29.715230 | ubuntu-noble | Loading collection cisco.iosxr from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/cisco/iosxr 2026-07-20 06:48:29.715530 | ubuntu-noble | Found installed collection cisco.iosxr:12.1.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/cisco/iosxr' 2026-07-20 06:48:29.716471 | ubuntu-noble | Loading collection purestorage.flasharray from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/purestorage/flasharray 2026-07-20 06:48:29.716492 | ubuntu-noble | Found installed collection purestorage.flasharray:1.39.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/purestorage/flasharray' 2026-07-20 06:48:29.716499 | ubuntu-noble | Loading collection community.sops from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/sops 2026-07-20 06:48:29.716504 | ubuntu-noble | Found installed collection community.sops:2.2.7 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/sops' 2026-07-20 06:48:29.717012 | ubuntu-noble | Loading collection dellemc.powerflex from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/dellemc/powerflex 2026-07-20 06:48:29.717676 | ubuntu-noble | Found installed collection dellemc.powerflex:2.6.1 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/dellemc/powerflex' 2026-07-20 06:48:29.717695 | ubuntu-noble | Loading collection ansible.posix from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/ansible/posix 2026-07-20 06:48:29.717702 | ubuntu-noble | Found installed collection ansible.posix:2.1.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/ansible/posix' 2026-07-20 06:48:29.719433 | ubuntu-noble | Loading collection community.windows from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/windows 2026-07-20 06:48:29.719712 | ubuntu-noble | Found installed collection community.windows:3.0.1 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/windows' 2026-07-20 06:48:29.719997 | ubuntu-noble | Loading collection hitachivantara.vspone_object from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/hitachivantara/vspone_object 2026-07-20 06:48:29.720287 | ubuntu-noble | Found installed collection hitachivantara.vspone_object:1.0.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/hitachivantara/vspone_object' 2026-07-20 06:48:29.720554 | ubuntu-noble | Loading collection cyberark.pas from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/cyberark/pas 2026-07-20 06:48:29.721002 | ubuntu-noble | Found installed collection cyberark.pas:1.0.36 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/cyberark/pas' 2026-07-20 06:48:29.753126 | debian-bookworm | Calling Galaxy at https://galaxy.ansible.com/api/v3/collections/osism/commons/versions/?limit=100 2026-07-20 06:48:29.721019 | ubuntu-noble | Loading collection cisco.ucs from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/cisco/ucs 2026-07-20 06:48:29.721225 | ubuntu-noble | Found installed collection cisco.ucs:1.16.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/cisco/ucs' 2026-07-20 06:48:29.722053 | ubuntu-noble | Loading collection arista.eos from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/arista/eos 2026-07-20 06:48:29.722286 | ubuntu-noble | Found installed collection arista.eos:12.0.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/arista/eos' 2026-07-20 06:48:29.722684 | ubuntu-noble | Loading collection community.postgresql from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/postgresql 2026-07-20 06:48:29.722933 | ubuntu-noble | Found installed collection community.postgresql:4.1.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/postgresql' 2026-07-20 06:48:29.725642 | ubuntu-noble | Loading collection vmware.vmware_rest from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/vmware/vmware_rest 2026-07-20 06:48:29.725913 | ubuntu-noble | Found installed collection vmware.vmware_rest:4.9.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/vmware/vmware_rest' 2026-07-20 06:48:29.726244 | ubuntu-noble | Loading collection community.proxmox from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/proxmox 2026-07-20 06:48:29.726481 | ubuntu-noble | Found installed collection community.proxmox:1.4.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/proxmox' 2026-07-20 06:48:29.727065 | ubuntu-noble | Loading collection community.hashi_vault from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/hashi_vault 2026-07-20 06:48:29.727085 | ubuntu-noble | Found installed collection community.hashi_vault:7.1.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/hashi_vault' 2026-07-20 06:48:29.728155 | ubuntu-noble | Loading collection vyos.vyos from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/vyos/vyos 2026-07-20 06:48:29.728180 | ubuntu-noble | Found installed collection vyos.vyos:6.0.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/vyos/vyos' 2026-07-20 06:48:29.728785 | ubuntu-noble | Loading collection vmware.vmware from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/vmware/vmware 2026-07-20 06:48:29.728806 | ubuntu-noble | Found installed collection vmware.vmware:2.4.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/vmware/vmware' 2026-07-20 06:48:29.729083 | ubuntu-noble | Loading collection community.dns from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/dns 2026-07-20 06:48:29.729337 | ubuntu-noble | Found installed collection community.dns:3.4.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/dns' 2026-07-20 06:48:29.733648 | ubuntu-noble | Loading collection community.aws from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/aws 2026-07-20 06:48:29.733678 | ubuntu-noble | Found installed collection community.aws:10.0.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/aws' 2026-07-20 06:48:29.734326 | ubuntu-noble | Loading collection netapp_eseries.santricity from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/netapp_eseries/santricity 2026-07-20 06:48:29.734351 | ubuntu-noble | Found installed collection netapp_eseries.santricity:1.4.1 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/netapp_eseries/santricity' 2026-07-20 06:48:29.734868 | ubuntu-noble | Loading collection openstack.cloud from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/openstack/cloud 2026-07-20 06:48:29.735126 | ubuntu-noble | Found installed collection openstack.cloud:2.5.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/openstack/cloud' 2026-07-20 06:48:29.736011 | ubuntu-noble | Loading collection netapp.ontap from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/netapp/ontap 2026-07-20 06:48:29.736245 | ubuntu-noble | Found installed collection netapp.ontap:23.2.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/netapp/ontap' 2026-07-20 06:48:29.736623 | ubuntu-noble | Loading collection community.hrobot from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/hrobot 2026-07-20 06:48:29.736851 | ubuntu-noble | Found installed collection community.hrobot:2.7.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/hrobot' 2026-07-20 06:48:29.737603 | ubuntu-noble | Loading collection netbox.netbox from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/netbox/netbox 2026-07-20 06:48:29.737850 | ubuntu-noble | Found installed collection netbox.netbox:3.21.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/netbox/netbox' 2026-07-20 06:48:29.741146 | ubuntu-noble | Loading collection fortinet.fortios from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/fortinet/fortios 2026-07-20 06:48:29.741453 | ubuntu-noble | Found installed collection fortinet.fortios:2.4.2 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/fortinet/fortios' 2026-07-20 06:48:29.741669 | ubuntu-noble | Loading collection cyberark.conjur from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/cyberark/conjur 2026-07-20 06:48:29.741953 | ubuntu-noble | Found installed collection cyberark.conjur:1.3.8 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/cyberark/conjur' 2026-07-20 06:48:29.742406 | ubuntu-noble | Loading collection wti.remote from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/wti/remote 2026-07-20 06:48:29.742823 | ubuntu-noble | Found installed collection wti.remote:1.0.10 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/wti/remote' 2026-07-20 06:48:29.742834 | ubuntu-noble | Loading collection community.libvirt from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/libvirt 2026-07-20 06:48:29.743290 | ubuntu-noble | Found installed collection community.libvirt:2.0.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/libvirt' 2026-07-20 06:48:29.743312 | ubuntu-noble | Loading collection ibm.storage_virtualize from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/ibm/storage_virtualize 2026-07-20 06:48:29.743512 | ubuntu-noble | Found installed collection ibm.storage_virtualize:2.7.4 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/ibm/storage_virtualize' 2026-07-20 06:48:29.745158 | ubuntu-noble | Loading collection cisco.aci from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/cisco/aci 2026-07-20 06:48:29.745454 | ubuntu-noble | Found installed collection cisco.aci:2.12.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/cisco/aci' 2026-07-20 06:48:29.755604 | ubuntu-noble | Loading collection community.general from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/general 2026-07-20 06:48:29.755910 | ubuntu-noble | Found installed collection community.general:11.4.1 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/general' 2026-07-20 06:48:29.756139 | ubuntu-noble | Loading collection purestorage.flashblade from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/purestorage/flashblade 2026-07-20 06:48:29.756439 | ubuntu-noble | Found installed collection purestorage.flashblade:1.22.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/purestorage/flashblade' 2026-07-20 06:48:29.756732 | ubuntu-noble | Loading collection infoblox.nios_modules from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/infoblox/nios_modules 2026-07-20 06:48:29.756997 | ubuntu-noble | Found installed collection infoblox.nios_modules:1.8.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/infoblox/nios_modules' 2026-07-20 06:48:29.757338 | ubuntu-noble | Loading collection lowlydba.sqlserver from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/lowlydba/sqlserver 2026-07-20 06:48:29.757578 | ubuntu-noble | Found installed collection lowlydba.sqlserver:2.7.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/lowlydba/sqlserver' 2026-07-20 06:48:29.757850 | ubuntu-noble | Loading collection hitachivantara.vspone_block from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/hitachivantara/vspone_block 2026-07-20 06:48:29.758510 | ubuntu-noble | Found installed collection hitachivantara.vspone_block:4.4.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/hitachivantara/vspone_block' 2026-07-20 06:48:29.758530 | ubuntu-noble | Loading collection community.proxysql from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/proxysql 2026-07-20 06:48:29.758536 | ubuntu-noble | Found installed collection community.proxysql:1.7.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/proxysql' 2026-07-20 06:48:29.760612 | ubuntu-noble | Loading collection azure.azcollection from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/azure/azcollection 2026-07-20 06:48:29.760905 | ubuntu-noble | Found installed collection azure.azcollection:3.10.1 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/azure/azcollection' 2026-07-20 06:48:29.761319 | ubuntu-noble | Loading collection netapp.storagegrid from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/netapp/storagegrid 2026-07-20 06:48:29.761566 | ubuntu-noble | Found installed collection netapp.storagegrid:21.15.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/netapp/storagegrid' 2026-07-20 06:48:29.762253 | ubuntu-noble | Loading collection splunk.es from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/splunk/es 2026-07-20 06:48:29.764345 | ubuntu-noble | Found installed collection splunk.es:4.0.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/splunk/es' 2026-07-20 06:48:29.764411 | ubuntu-noble | Loading collection junipernetworks.junos from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/junipernetworks/junos 2026-07-20 06:48:29.764603 | ubuntu-noble | Found installed collection junipernetworks.junos:11.0.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/junipernetworks/junos' 2026-07-20 06:48:29.765862 | ubuntu-noble | Loading collection cisco.meraki from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/cisco/meraki 2026-07-20 06:48:29.766458 | ubuntu-noble | Found installed collection cisco.meraki:2.21.8 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/cisco/meraki' 2026-07-20 06:48:29.766982 | ubuntu-noble | Loading collection dellemc.openmanage from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/dellemc/openmanage 2026-07-20 06:48:29.767392 | ubuntu-noble | Found installed collection dellemc.openmanage:9.12.3 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/dellemc/openmanage' 2026-07-20 06:48:29.767853 | ubuntu-noble | Loading collection kaytus.ksmanage from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/kaytus/ksmanage 2026-07-20 06:48:29.768326 | ubuntu-noble | Found installed collection kaytus.ksmanage:2.0.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/kaytus/ksmanage' 2026-07-20 06:48:29.768749 | ubuntu-noble | Loading collection community.digitalocean from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/digitalocean 2026-07-20 06:48:29.769126 | ubuntu-noble | Found installed collection community.digitalocean:1.27.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/digitalocean' 2026-07-20 06:48:29.769477 | ubuntu-noble | Loading collection community.routeros from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/routeros 2026-07-20 06:48:29.769894 | ubuntu-noble | Found installed collection community.routeros:3.13.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/routeros' 2026-07-20 06:48:29.770238 | ubuntu-noble | Loading collection community.mysql from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/mysql 2026-07-20 06:48:29.770582 | ubuntu-noble | Found installed collection community.mysql:3.16.1 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/mysql' 2026-07-20 06:48:29.770907 | ubuntu-noble | Loading collection community.library_inventory_filtering_v1 from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/library_inventory_filtering_v1 2026-07-20 06:48:29.771249 | ubuntu-noble | Found installed collection community.library_inventory_filtering_v1:1.1.5 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/library_inventory_filtering_v1' 2026-07-20 06:48:29.771681 | ubuntu-noble | Loading collection ieisystem.inmanage from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/ieisystem/inmanage 2026-07-20 06:48:29.772045 | ubuntu-noble | Found installed collection ieisystem.inmanage:3.0.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/ieisystem/inmanage' 2026-07-20 06:48:29.772397 | ubuntu-noble | Loading collection vultr.cloud from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/vultr/cloud 2026-07-20 06:48:29.772730 | ubuntu-noble | Found installed collection vultr.cloud:1.13.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/vultr/cloud' 2026-07-20 06:48:29.773121 | ubuntu-noble | Loading collection cloudscale_ch.cloud from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/cloudscale_ch/cloud 2026-07-20 06:48:29.774308 | ubuntu-noble | Found installed collection cloudscale_ch.cloud:2.5.2 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/cloudscale_ch/cloud' 2026-07-20 06:48:29.774336 | ubuntu-noble | Loading collection community.rabbitmq from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/rabbitmq 2026-07-20 06:48:29.774345 | ubuntu-noble | Found installed collection community.rabbitmq:1.6.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/rabbitmq' 2026-07-20 06:48:29.774397 | ubuntu-noble | Loading collection f5networks.f5_modules from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/f5networks/f5_modules 2026-07-20 06:48:29.774681 | ubuntu-noble | Found installed collection f5networks.f5_modules:1.39.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/f5networks/f5_modules' 2026-07-20 06:48:29.775094 | ubuntu-noble | Loading collection amazon.aws from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/amazon/aws 2026-07-20 06:48:29.775401 | ubuntu-noble | Found installed collection amazon.aws:10.1.2 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/amazon/aws' 2026-07-20 06:48:29.775638 | ubuntu-noble | Loading collection ansible.utils from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/ansible/utils 2026-07-20 06:48:29.775862 | ubuntu-noble | Found installed collection ansible.utils:6.0.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/ansible/utils' 2026-07-20 06:48:29.780860 | ubuntu-noble | Loading collection fortinet.fortimanager from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/fortinet/fortimanager 2026-07-20 06:48:29.781250 | ubuntu-noble | Found installed collection fortinet.fortimanager:2.11.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/fortinet/fortimanager' 2026-07-20 06:48:29.781585 | ubuntu-noble | Loading collection cisco.dnac from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/cisco/dnac 2026-07-20 06:48:29.781840 | ubuntu-noble | Found installed collection cisco.dnac:6.41.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/cisco/dnac' 2026-07-20 06:48:29.782164 | ubuntu-noble | Loading collection ovirt.ovirt from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/ovirt/ovirt 2026-07-20 06:48:29.782484 | ubuntu-noble | Found installed collection ovirt.ovirt:3.2.1 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/ovirt/ovirt' 2026-07-20 06:48:29.784150 | ubuntu-noble | Loading collection cisco.nxos from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/cisco/nxos 2026-07-20 06:48:29.784525 | ubuntu-noble | Found installed collection cisco.nxos:11.0.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/cisco/nxos' 2026-07-20 06:48:29.785002 | ubuntu-noble | Loading collection dellemc.unity from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/dellemc/unity 2026-07-20 06:48:29.785292 | ubuntu-noble | Found installed collection dellemc.unity:2.1.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/dellemc/unity' 2026-07-20 06:48:29.786301 | ubuntu-noble | Loading collection community.ciscosmb from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/ciscosmb 2026-07-20 06:48:29.786323 | ubuntu-noble | Found installed collection community.ciscosmb:1.0.11 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/ciscosmb' 2026-07-20 06:48:29.786330 | ubuntu-noble | Loading collection infinidat.infinibox from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/infinidat/infinibox 2026-07-20 06:48:29.786337 | ubuntu-noble | Found installed collection infinidat.infinibox:1.6.3 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/infinidat/infinibox' 2026-07-20 06:48:29.786588 | ubuntu-noble | Loading collection microsoft.iis from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/microsoft/iis 2026-07-20 06:48:29.786797 | ubuntu-noble | Found installed collection microsoft.iis:1.0.3 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/microsoft/iis' 2026-07-20 06:48:29.788338 | ubuntu-noble | Loading collection dellemc.enterprise_sonic from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/dellemc/enterprise_sonic 2026-07-20 06:48:29.788614 | ubuntu-noble | Found installed collection dellemc.enterprise_sonic:3.2.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/dellemc/enterprise_sonic' 2026-07-20 06:48:29.792871 | ubuntu-noble | Initial connection to galaxy_server: https://galaxy.ansible.com 2026-07-20 06:48:29.793200 | ubuntu-noble | Created /home/zuul/.ansible/galaxy_token 2026-07-20 06:48:29.793435 | ubuntu-noble | Calling Galaxy at https://galaxy.ansible.com/api/ 2026-07-20 06:48:29.985599 | ubuntu-noble | Found API version 'v3, pulp-v3, v1' with Galaxy server default (https://galaxy.ansible.com/api/) 2026-07-20 06:48:29.988166 | ubuntu-noble | Calling Galaxy at https://galaxy.ansible.com/api/v3/collections/osism/commons/ 2026-07-20 06:48:30.536238 | ubuntu-noble | Calling Galaxy at https://galaxy.ansible.com/api/v3/collections/osism/commons/versions/?limit=100 2026-07-20 06:48:31.743583 | ubuntu-noble | Calling Galaxy at https://galaxy.ansible.com/api/v3/collections/osism/commons/versions/0.20260712.0/ 2026-07-20 06:48:31.920928 | debian-bookworm | Calling Galaxy at https://galaxy.ansible.com/api/v3/collections/osism/commons/versions/0.20260712.0/ 2026-07-20 06:48:32.390569 | ubuntu-noble | Server https://galaxy.ansible.com/api/ has not signed osism.commons:0.20260712.0 2026-07-20 06:48:32.390631 | ubuntu-noble | Fetching a collection tarball for 'osism.commons:0.20260712.0' from Ansible Galaxy 2026-07-20 06:48:32.748533 | debian-bookworm | Server https://galaxy.ansible.com/api/ has not signed osism.commons:0.20260712.0 2026-07-20 06:48:32.748819 | debian-bookworm | Fetching a collection tarball for 'osism.commons:0.20260712.0' from Ansible Galaxy 2026-07-20 06:48:33.691620 | ubuntu-noble | Validating downloaded file hash 35b9909f5629f2c3887ea082fabdacce386e6921aacb19a4617336dec0edfc3c with expected hash 35b9909f5629f2c3887ea082fabdacce386e6921aacb19a4617336dec0edfc3c 2026-07-20 06:48:33.691695 | ubuntu-noble | Collection 'osism.commons:0.20260712.0' obtained from server default https://galaxy.ansible.com/api/ 2026-07-20 06:48:33.877359 | ubuntu-noble | Starting galaxy collection install process 2026-07-20 06:48:33.877455 | ubuntu-noble | Process install dependency map 2026-07-20 06:48:33.877471 | ubuntu-noble | Starting collection install process 2026-07-20 06:48:33.877482 | ubuntu-noble | 'ansible.posix:2.1.0' is already installed, skipping. 2026-07-20 06:48:33.877693 | ubuntu-noble | 'community.docker:4.8.2' is already installed, skipping. 2026-07-20 06:48:33.878064 | ubuntu-noble | 'community.general:11.4.1' is already installed, skipping. 2026-07-20 06:48:33.878551 | ubuntu-noble | 'community.library_inventory_filtering_v1:1.1.5' is already installed, skipping. 2026-07-20 06:48:33.878951 | ubuntu-noble | Downloading https://galaxy.ansible.com/api/v3/plugin/ansible/content/published/collections/artifacts/osism-commons-0.20260712.0.tar.gz to /home/zuul/.ansible/tmp/ansible-local-176571urknu4/tmpmc6c4p0s/osism-commons-0.20260712.0-q7weokcm 2026-07-20 06:48:33.879406 | ubuntu-noble | Installing 'osism.commons:0.20260712.0' to '/home/zuul/.ansible/collections/ansible_collections/osism/commons' 2026-07-20 06:48:33.879777 | ubuntu-noble | osism.commons:0.20260712.0 was installed successfully 2026-07-20 06:48:33.975325 | ubuntu-noble | INFO [delegated > dependency] Dependency completed successfully. 2026-07-20 06:48:33.975852 | ubuntu-noble | WARNING [delegated > dependency] Executed: Missing roles requirements file: requirements.yml (Remove from dependency_sequence to suppress) 2026-07-20 06:48:33.976830 | ubuntu-noble | WARNING Molecule executed 1 scenario (1 missing files) 2026-07-20 06:48:33.976978 | ubuntu-noble | 2026-07-20 06:48:33.977027 | ubuntu-noble | DETAILS 2026-07-20 06:48:33.977150 | ubuntu-noble | delegated > dependency: Executed: Missing roles requirements file: requirements.yml (Remove from dependency_sequence to suppress) 2026-07-20 06:48:33.977190 | ubuntu-noble | 2026-07-20 06:48:33.977488 | ubuntu-noble | SCENARIO RECAP 2026-07-20 06:48:33.977541 | ubuntu-noble | delegated : actions=1 successful=0 disabled=0 skipped=0 missing=1 failed=0 2026-07-20 06:48:33.977555 | ubuntu-noble | 2026-07-20 06:48:35.649040 | debian-bookworm | Validating downloaded file hash 35b9909f5629f2c3887ea082fabdacce386e6921aacb19a4617336dec0edfc3c with expected hash 35b9909f5629f2c3887ea082fabdacce386e6921aacb19a4617336dec0edfc3c 2026-07-20 06:48:35.649212 | debian-bookworm | Collection 'osism.commons:0.20260712.0' obtained from server default https://galaxy.ansible.com/api/ 2026-07-20 06:48:35.800525 | debian-bookworm | Starting galaxy collection install process 2026-07-20 06:48:35.800610 | debian-bookworm | Process install dependency map 2026-07-20 06:48:35.800662 | debian-bookworm | Starting collection install process 2026-07-20 06:48:35.800782 | debian-bookworm | 'ansible.posix:2.1.0' is already installed, skipping. 2026-07-20 06:48:35.800879 | debian-bookworm | 'community.docker:4.8.2' is already installed, skipping. 2026-07-20 06:48:35.800986 | debian-bookworm | 'community.general:11.4.1' is already installed, skipping. 2026-07-20 06:48:35.801071 | debian-bookworm | 'community.library_inventory_filtering_v1:1.1.5' is already installed, skipping. 2026-07-20 06:48:35.801346 | debian-bookworm | Downloading https://galaxy.ansible.com/api/v3/plugin/ansible/content/published/collections/artifacts/osism-commons-0.20260712.0.tar.gz to /home/zuul/.ansible/tmp/ansible-local-1939_8b_wumi/tmpxy4ut6ok/osism-commons-0.20260712.0-2j74_mbm 2026-07-20 06:48:35.801472 | debian-bookworm | Installing 'osism.commons:0.20260712.0' to '/home/zuul/.ansible/collections/ansible_collections/osism/commons' 2026-07-20 06:48:35.801576 | debian-bookworm | osism.commons:0.20260712.0 was installed successfully 2026-07-20 06:48:35.864940 | debian-bookworm | INFO [delegated > dependency] Dependency completed successfully. 2026-07-20 06:48:35.864991 | debian-bookworm | WARNING [delegated > dependency] Executed: Missing roles requirements file: requirements.yml (Remove from dependency_sequence to suppress) 2026-07-20 06:48:35.865160 | debian-bookworm | WARNING Molecule executed 1 scenario (1 missing files) 2026-07-20 06:48:35.865178 | debian-bookworm | 2026-07-20 06:48:35.865195 | debian-bookworm | DETAILS 2026-07-20 06:48:35.865207 | debian-bookworm | delegated > dependency: Executed: Missing roles requirements file: requirements.yml (Remove from dependency_sequence to suppress) 2026-07-20 06:48:35.865219 | debian-bookworm | 2026-07-20 06:48:35.865527 | debian-bookworm | SCENARIO RECAP 2026-07-20 06:48:35.865548 | debian-bookworm | delegated : actions=1 successful=0 disabled=0 skipped=0 missing=1 failed=0 2026-07-20 06:48:35.865560 | debian-bookworm | 2026-07-20 06:48:36.029920 | ubuntu-noble | ok: Runtime: 0:00:07.748224 2026-07-20 06:48:36.038896 | debian-bookworm | ok: Runtime: 0:00:09.655601 2026-07-20 06:48:36.047060 | 2026-07-20 06:48:36.047177 | TASK [ansible-molecule : Run molecule create action with scenario delegated] 2026-07-20 06:48:36.610611 | debian-bookworm | skipping: Conditional result was False 2026-07-20 06:48:36.611774 | ubuntu-noble | skipping: Conditional result was False 2026-07-20 06:48:36.625280 | 2026-07-20 06:48:36.625462 | TASK [ansible-molecule : Run molecule prepare action with scenario delegated] 2026-07-20 06:48:37.348169 | ubuntu-noble | WARNING Molecule scenarios should migrate to 'extensions/molecule' 2026-07-20 06:48:37.358465 | ubuntu-noble | DEBUG [unknown > config] provisioner.env found in /home/zuul/src/github.com/osism/ansible-collection-services/molecule/delegated/molecule.yml, this can be defined in ansible.env 2026-07-20 06:48:37.203093 | debian-bookworm | WARNING Molecule scenarios should migrate to 'extensions/molecule' 2026-07-20 06:48:37.212166 | debian-bookworm | DEBUG [unknown > config] provisioner.env found in /home/zuul/src/github.com/osism/ansible-collection-services/molecule/delegated/molecule.yml, this can be defined in ansible.env 2026-07-20 06:48:38.059795 | ubuntu-noble | DEBUG [unknown > config] provisioner.env found in /home/zuul/src/github.com/osism/ansible-collection-services/molecule/delegated/molecule.yml, this can be defined in ansible.env 2026-07-20 06:48:38.060513 | ubuntu-noble | DEBUG [delegated > validate] Validating schema /home/zuul/src/github.com/osism/ansible-collection-services/molecule/delegated/molecule.yml. 2026-07-20 06:48:38.082865 | ubuntu-noble | DEBUG [default > validate] Validating schema /home/zuul/src/github.com/osism/ansible-collection-services/molecule/default/molecule.yml. 2026-07-20 06:48:38.088638 | ubuntu-noble | INFO [delegated > discovery] scenario test matrix: prepare 2026-07-20 06:48:38.088696 | ubuntu-noble | INFO [delegated > prerun] Performing prerun with role_name_check=0... 2026-07-20 06:48:37.757331 | debian-bookworm | DEBUG [unknown > config] provisioner.env found in /home/zuul/src/github.com/osism/ansible-collection-services/molecule/delegated/molecule.yml, this can be defined in ansible.env 2026-07-20 06:48:37.757906 | debian-bookworm | DEBUG [delegated > validate] Validating schema /home/zuul/src/github.com/osism/ansible-collection-services/molecule/delegated/molecule.yml. 2026-07-20 06:48:37.776865 | debian-bookworm | DEBUG [default > validate] Validating schema /home/zuul/src/github.com/osism/ansible-collection-services/molecule/default/molecule.yml. 2026-07-20 06:48:37.782173 | debian-bookworm | INFO [delegated > discovery] scenario test matrix: prepare 2026-07-20 06:48:37.782274 | debian-bookworm | INFO [delegated > prerun] Performing prerun with role_name_check=0... 2026-07-20 06:48:39.019743 | debian-bookworm | INFO [delegated > prepare] Executing 2026-07-20 06:48:39.404299 | debian-bookworm | DEBUG [delegated > prepare] ansible-playbook version: ansible-playbook 2026-07-20 06:48:39.405769 | debian-bookworm | config file = None 2026-07-20 06:48:39.405793 | debian-bookworm | configured module search path = 2026-07-20 06:48:39.405799 | debian-bookworm | ansible python module location = /home/zuul/venv/lib/python3.11/site-packages/ansible 2026-07-20 06:48:39.405806 | debian-bookworm | ansible collection location = /home/zuul/.ansible/collections:/usr/share/ansible/collections 2026-07-20 06:48:39.405810 | debian-bookworm | executable location = /home/zuul/venv/bin/ansible-playbook 2026-07-20 06:48:39.405814 | debian-bookworm | python version = 3.11.2 (main, May 12 2026, 05:17:27) (/home/zuul/venv/bin/python3) 2026-07-20 06:48:39.405818 | debian-bookworm | jinja version = 3.1.6 2026-07-20 06:48:39.405822 | debian-bookworm | pyyaml version = 6.0.3 (with libyaml v0.2.5) 2026-07-20 06:48:39.405833 | debian-bookworm | DEBUG ANSIBLE ENVIRONMENT: 2026-07-20 06:48:39.405837 | debian-bookworm | ANSIBLE_COLLECTIONS_PATH: /home/zuul/venv/.ansible/collections:/home/zuul/.ansible/collections 2026-07-20 06:48:39.405841 | debian-bookworm | ANSIBLE_CONFIG: /home/zuul/.ansible/tmp/molecule.oWZD.delegated/ansible.cfg 2026-07-20 06:48:39.405845 | debian-bookworm | ANSIBLE_LIBRARY: ../../plugins 2026-07-20 06:48:39.405849 | debian-bookworm | ANSIBLE_PYTHON_INTERPRETER: /home/zuul/venv/bin/python 2026-07-20 06:48:39.405853 | debian-bookworm | ANSIBLE_ROLE: auditd 2026-07-20 06:48:39.405857 | debian-bookworm | ANSIBLE_ROLES_PATH: ../../roles 2026-07-20 06:48:39.405861 | debian-bookworm | ANSIBLE_VERBOSITY: 1 2026-07-20 06:48:39.405865 | debian-bookworm | 2026-07-20 06:48:39.405869 | debian-bookworm | DEBUG MOLECULE ENVIRONMENT: 2026-07-20 06:48:39.405873 | debian-bookworm | MOLECULE_DEBUG: True 2026-07-20 06:48:39.405876 | debian-bookworm | MOLECULE_DEPENDENCY_NAME: galaxy 2026-07-20 06:48:39.405880 | debian-bookworm | MOLECULE_DRIVER_NAME: default 2026-07-20 06:48:39.405884 | debian-bookworm | MOLECULE_ENV_FILE: /home/zuul/src/github.com/osism/ansible-collection-services/.env.yml 2026-07-20 06:48:39.405888 | debian-bookworm | MOLECULE_EPHEMERAL_DIRECTORY: /home/zuul/.ansible/tmp/molecule.oWZD.delegated 2026-07-20 06:48:39.405892 | debian-bookworm | MOLECULE_FILE: /home/zuul/.ansible/tmp/molecule.oWZD.delegated/molecule.yml 2026-07-20 06:48:39.405896 | debian-bookworm | MOLECULE_INSTANCE_CONFIG: /home/zuul/.ansible/tmp/molecule.oWZD.delegated/instance_config.yml 2026-07-20 06:48:39.405900 | debian-bookworm | MOLECULE_INVENTORY_FILE: /home/zuul/.ansible/tmp/molecule.oWZD.delegated/inventory/ansible_inventory.yml 2026-07-20 06:48:39.405904 | debian-bookworm | MOLECULE_PROJECT_DIRECTORY: /home/zuul/src/github.com/osism/ansible-collection-services 2026-07-20 06:48:39.405908 | debian-bookworm | MOLECULE_PROVISIONER_NAME: ansible 2026-07-20 06:48:39.405912 | debian-bookworm | MOLECULE_SCENARIO_DIRECTORY: /home/zuul/src/github.com/osism/ansible-collection-services/molecule/delegated 2026-07-20 06:48:39.405916 | debian-bookworm | MOLECULE_SCENARIO_NAME: delegated 2026-07-20 06:48:39.405919 | debian-bookworm | MOLECULE_STATE_FILE: /home/zuul/.ansible/tmp/molecule.oWZD.delegated/state.yml 2026-07-20 06:48:39.405923 | debian-bookworm | MOLECULE_VERIFIER_NAME: testinfra 2026-07-20 06:48:39.405927 | debian-bookworm | MOLECULE_VERIFIER_TEST_DIRECTORY: /home/zuul/src/github.com/osism/ansible-collection-services/molecule/delegated/tests 2026-07-20 06:48:39.405931 | debian-bookworm | 2026-07-20 06:48:39.405939 | debian-bookworm | DEBUG SHELL REPLAY: ANSIBLE_COLLECTIONS_PATH=/home/zuul/venv/.ansible/collections:/home/zuul/.ansible/collections ANSIBLE_CONFIG=/home/zuul/.ansible/tmp/molecule.oWZD.delegated/ansible.cfg ANSIBLE_LIBRARY=../../plugins ANSIBLE_PYTHON_INTERPRETER=/home/zuul/venv/bin/python ANSIBLE_ROLE=auditd ANSIBLE_ROLES_PATH=../../roles ANSIBLE_VERBOSITY=1 MOLECULE_DEBUG=True MOLECULE_DEPENDENCY_NAME=galaxy MOLECULE_DRIVER_NAME=default MOLECULE_ENV_FILE=/home/zuul/src/github.com/osism/ansible-collection-services/.env.yml MOLECULE_EPHEMERAL_DIRECTORY=/home/zuul/.ansible/tmp/molecule.oWZD.delegated MOLECULE_FILE=/home/zuul/.ansible/tmp/molecule.oWZD.delegated/molecule.yml MOLECULE_INSTANCE_CONFIG=/home/zuul/.ansible/tmp/molecule.oWZD.delegated/instance_config.yml MOLECULE_INVENTORY_FILE=/home/zuul/.ansible/tmp/molecule.oWZD.delegated/inventory/ansible_inventory.yml MOLECULE_PROJECT_DIRECTORY=/home/zuul/src/github.com/osism/ansible-collection-services MOLECULE_PROVISIONER_NAME=ansible MOLECULE_SCENARIO_DIRECTORY=/home/zuul/src/github.com/osism/ansible-collection-services/molecule/delegated MOLECULE_SCENARIO_NAME=delegated MOLECULE_STATE_FILE=/home/zuul/.ansible/tmp/molecule.oWZD.delegated/state.yml MOLECULE_VERIFIER_NAME=testinfra MOLECULE_VERIFIER_TEST_DIRECTORY=/home/zuul/src/github.com/osism/ansible-collection-services/molecule/delegated/tests 2026-07-20 06:48:39.751241 | ubuntu-noble | INFO [delegated > prepare] Executing 2026-07-20 06:48:39.770386 | debian-bookworm | Using /home/zuul/.ansible/tmp/molecule.oWZD.delegated/ansible.cfg as config file 2026-07-20 06:48:39.992049 | debian-bookworm | 2026-07-20 06:48:39.992144 | debian-bookworm | PLAY [Prepare] ***************************************************************** 2026-07-20 06:48:39.992319 | debian-bookworm | 2026-07-20 06:48:39.992453 | debian-bookworm | TASK [Gathering Facts] ********************************************************* 2026-07-20 06:48:40.298011 | ubuntu-noble | DEBUG [delegated > prepare] ansible-playbook version: ansible-playbook 2026-07-20 06:48:40.298073 | ubuntu-noble | config file = None 2026-07-20 06:48:40.298090 | ubuntu-noble | configured module search path = 2026-07-20 06:48:40.298096 | ubuntu-noble | ansible python module location = /home/zuul/venv/lib/python3.12/site-packages/ansible 2026-07-20 06:48:40.298101 | ubuntu-noble | ansible collection location = /home/zuul/.ansible/collections:/usr/share/ansible/collections 2026-07-20 06:48:40.298105 | ubuntu-noble | executable location = /home/zuul/venv/bin/ansible-playbook 2026-07-20 06:48:40.298109 | ubuntu-noble | python version = 3.12.3 (main, Jun 19 2026, 12:46:00) (/home/zuul/venv/bin/python3) 2026-07-20 06:48:40.298113 | ubuntu-noble | jinja version = 3.1.6 2026-07-20 06:48:40.298116 | ubuntu-noble | pyyaml version = 6.0.3 (with libyaml v0.2.5) 2026-07-20 06:48:40.298124 | ubuntu-noble | DEBUG ANSIBLE ENVIRONMENT: 2026-07-20 06:48:40.298128 | ubuntu-noble | ANSIBLE_COLLECTIONS_PATH: /home/zuul/venv/.ansible/collections:/home/zuul/.ansible/collections 2026-07-20 06:48:40.298131 | ubuntu-noble | ANSIBLE_CONFIG: /home/zuul/.ansible/tmp/molecule.oWZD.delegated/ansible.cfg 2026-07-20 06:48:40.298135 | ubuntu-noble | ANSIBLE_LIBRARY: ../../plugins 2026-07-20 06:48:40.298138 | ubuntu-noble | ANSIBLE_PYTHON_INTERPRETER: /home/zuul/venv/bin/python 2026-07-20 06:48:40.298141 | ubuntu-noble | ANSIBLE_ROLE: auditd 2026-07-20 06:48:40.298145 | ubuntu-noble | ANSIBLE_ROLES_PATH: ../../roles 2026-07-20 06:48:40.298148 | ubuntu-noble | ANSIBLE_VERBOSITY: 1 2026-07-20 06:48:40.298152 | ubuntu-noble | 2026-07-20 06:48:40.298232 | ubuntu-noble | DEBUG MOLECULE ENVIRONMENT: 2026-07-20 06:48:40.298237 | ubuntu-noble | MOLECULE_DEBUG: True 2026-07-20 06:48:40.298241 | ubuntu-noble | MOLECULE_DEPENDENCY_NAME: galaxy 2026-07-20 06:48:40.298244 | ubuntu-noble | MOLECULE_DRIVER_NAME: default 2026-07-20 06:48:40.298247 | ubuntu-noble | MOLECULE_ENV_FILE: /home/zuul/src/github.com/osism/ansible-collection-services/.env.yml 2026-07-20 06:48:40.298251 | ubuntu-noble | MOLECULE_EPHEMERAL_DIRECTORY: /home/zuul/.ansible/tmp/molecule.oWZD.delegated 2026-07-20 06:48:40.298254 | ubuntu-noble | MOLECULE_FILE: /home/zuul/.ansible/tmp/molecule.oWZD.delegated/molecule.yml 2026-07-20 06:48:40.298305 | ubuntu-noble | MOLECULE_INSTANCE_CONFIG: /home/zuul/.ansible/tmp/molecule.oWZD.delegated/instance_config.yml 2026-07-20 06:48:40.298313 | ubuntu-noble | MOLECULE_INVENTORY_FILE: /home/zuul/.ansible/tmp/molecule.oWZD.delegated/inventory/ansible_inventory.yml 2026-07-20 06:48:40.298317 | ubuntu-noble | MOLECULE_PROJECT_DIRECTORY: /home/zuul/src/github.com/osism/ansible-collection-services 2026-07-20 06:48:40.298321 | ubuntu-noble | MOLECULE_PROVISIONER_NAME: ansible 2026-07-20 06:48:40.298324 | ubuntu-noble | MOLECULE_SCENARIO_DIRECTORY: /home/zuul/src/github.com/osism/ansible-collection-services/molecule/delegated 2026-07-20 06:48:40.298328 | ubuntu-noble | MOLECULE_SCENARIO_NAME: delegated 2026-07-20 06:48:40.298332 | ubuntu-noble | MOLECULE_STATE_FILE: /home/zuul/.ansible/tmp/molecule.oWZD.delegated/state.yml 2026-07-20 06:48:40.298335 | ubuntu-noble | MOLECULE_VERIFIER_NAME: testinfra 2026-07-20 06:48:40.298339 | ubuntu-noble | MOLECULE_VERIFIER_TEST_DIRECTORY: /home/zuul/src/github.com/osism/ansible-collection-services/molecule/delegated/tests 2026-07-20 06:48:40.298342 | ubuntu-noble | 2026-07-20 06:48:40.298359 | ubuntu-noble | DEBUG SHELL REPLAY: ANSIBLE_COLLECTIONS_PATH=/home/zuul/venv/.ansible/collections:/home/zuul/.ansible/collections ANSIBLE_CONFIG=/home/zuul/.ansible/tmp/molecule.oWZD.delegated/ansible.cfg ANSIBLE_LIBRARY=../../plugins ANSIBLE_PYTHON_INTERPRETER=/home/zuul/venv/bin/python ANSIBLE_ROLE=auditd ANSIBLE_ROLES_PATH=../../roles ANSIBLE_VERBOSITY=1 MOLECULE_DEBUG=True MOLECULE_DEPENDENCY_NAME=galaxy MOLECULE_DRIVER_NAME=default MOLECULE_ENV_FILE=/home/zuul/src/github.com/osism/ansible-collection-services/.env.yml MOLECULE_EPHEMERAL_DIRECTORY=/home/zuul/.ansible/tmp/molecule.oWZD.delegated MOLECULE_FILE=/home/zuul/.ansible/tmp/molecule.oWZD.delegated/molecule.yml MOLECULE_INSTANCE_CONFIG=/home/zuul/.ansible/tmp/molecule.oWZD.delegated/instance_config.yml MOLECULE_INVENTORY_FILE=/home/zuul/.ansible/tmp/molecule.oWZD.delegated/inventory/ansible_inventory.yml MOLECULE_PROJECT_DIRECTORY=/home/zuul/src/github.com/osism/ansible-collection-services MOLECULE_PROVISIONER_NAME=ansible MOLECULE_SCENARIO_DIRECTORY=/home/zuul/src/github.com/osism/ansible-collection-services/molecule/delegated MOLECULE_SCENARIO_NAME=delegated MOLECULE_STATE_FILE=/home/zuul/.ansible/tmp/molecule.oWZD.delegated/state.yml MOLECULE_VERIFIER_NAME=testinfra MOLECULE_VERIFIER_TEST_DIRECTORY=/home/zuul/src/github.com/osism/ansible-collection-services/molecule/delegated/tests 2026-07-20 06:48:40.755985 | ubuntu-noble | Using /home/zuul/.ansible/tmp/molecule.oWZD.delegated/ansible.cfg as config file 2026-07-20 06:48:41.046980 | ubuntu-noble | 2026-07-20 06:48:41.047076 | ubuntu-noble | PLAY [Prepare] ***************************************************************** 2026-07-20 06:48:41.047187 | ubuntu-noble | 2026-07-20 06:48:41.047321 | ubuntu-noble | TASK [Gathering Facts] ********************************************************* 2026-07-20 06:48:41.125030 | debian-bookworm | ok: [molecule-auditd] 2026-07-20 06:48:41.125123 | debian-bookworm | 2026-07-20 06:48:41.125252 | debian-bookworm | TASK [Install packages in venv] ************************************************ 2026-07-20 06:48:42.495897 | ubuntu-noble | ok: [molecule-auditd] 2026-07-20 06:48:42.495978 | ubuntu-noble | 2026-07-20 06:48:42.496481 | ubuntu-noble | TASK [Install packages in venv] ************************************************ 2026-07-20 06:48:45.409383 | debian-bookworm | changed: [molecule-auditd] => (item=docker) => {"ansible_loop_var": "item", "changed": true, "cmd": ["/home/zuul/venv/bin/pip3", "install", "docker"], "item": "docker", "name": ["docker"], "requirements": null, "state": "present", "stderr": "", "stderr_lines": [], "stdout": "Collecting docker\n Downloading docker-7.2.0-py3-none-any.whl (148 kB)\n ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ 148.8/148.8 kB 3.4 MB/s eta 0:00:00\nRequirement already satisfied: requests>=2.26.0 in /home/zuul/venv/lib/python3.11/site-packages (from docker) (2.34.2)\nRequirement already satisfied: urllib3>=1.26.0 in /home/zuul/venv/lib/python3.11/site-packages (from docker) (2.7.0)\nRequirement already satisfied: charset_normalizer<4,>=2 in /home/zuul/venv/lib/python3.11/site-packages (from requests>=2.26.0->docker) (3.4.9)\nRequirement already satisfied: idna<4,>=2.5 in /home/zuul/venv/lib/python3.11/site-packages (from requests>=2.26.0->docker) (3.18)\nRequirement already satisfied: certifi>=2023.5.7 in /home/zuul/venv/lib/python3.11/site-packages (from requests>=2.26.0->docker) (2026.6.17)\nInstalling collected packages: docker\nSuccessfully installed docker-7.2.0\n", "stdout_lines": ["Collecting docker", " Downloading docker-7.2.0-py3-none-any.whl (148 kB)", " ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ 148.8/148.8 kB 3.4 MB/s eta 0:00:00", "Requirement already satisfied: requests>=2.26.0 in /home/zuul/venv/lib/python3.11/site-packages (from docker) (2.34.2)", "Requirement already satisfied: urllib3>=1.26.0 in /home/zuul/venv/lib/python3.11/site-packages (from docker) (2.7.0)", "Requirement already satisfied: charset_normalizer<4,>=2 in /home/zuul/venv/lib/python3.11/site-packages (from requests>=2.26.0->docker) (3.4.9)", "Requirement already satisfied: idna<4,>=2.5 in /home/zuul/venv/lib/python3.11/site-packages (from requests>=2.26.0->docker) (3.18)", "Requirement already satisfied: certifi>=2023.5.7 in /home/zuul/venv/lib/python3.11/site-packages (from requests>=2.26.0->docker) (2026.6.17)", "Installing collected packages: docker", "Successfully installed docker-7.2.0"], "version": null, "virtualenv": "/home/zuul/venv"} 2026-07-20 06:48:45.409621 | debian-bookworm | changed: [molecule-auditd] => (item=netaddr) => {"ansible_loop_var": "item", "changed": true, "cmd": ["/home/zuul/venv/bin/pip3", "install", "netaddr"], "item": "netaddr", "name": ["netaddr"], "requirements": null, "state": "present", "stderr": "", "stderr_lines": [], "stdout": "Collecting netaddr\n Downloading netaddr-1.3.0-py3-none-any.whl (2.3 MB)\n ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ 2.3/2.3 MB 20.3 MB/s eta 0:00:00\nInstalling collected packages: netaddr\nSuccessfully installed netaddr-1.3.0\n", "stdout_lines": ["Collecting netaddr", " Downloading netaddr-1.3.0-py3-none-any.whl (2.3 MB)", " ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ 2.3/2.3 MB 20.3 MB/s eta 0:00:00", "Installing collected packages: netaddr", "Successfully installed netaddr-1.3.0"], "version": null, "virtualenv": "/home/zuul/venv"} 2026-07-20 06:48:45.409740 | debian-bookworm | ok: [molecule-auditd] => (item=requests) => {"ansible_loop_var": "item", "changed": false, "cmd": ["/home/zuul/venv/bin/pip3", "install", "requests"], "item": "requests", "name": ["requests"], "requirements": null, "state": "present", "stderr": "", "stderr_lines": [], "stdout": "Requirement already satisfied: requests in /home/zuul/venv/lib/python3.11/site-packages (2.34.2)\nRequirement already satisfied: charset_normalizer<4,>=2 in /home/zuul/venv/lib/python3.11/site-packages (from requests) (3.4.9)\nRequirement already satisfied: idna<4,>=2.5 in /home/zuul/venv/lib/python3.11/site-packages (from requests) (3.18)\nRequirement already satisfied: urllib3<3,>=1.26 in /home/zuul/venv/lib/python3.11/site-packages (from requests) (2.7.0)\nRequirement already satisfied: certifi>=2023.5.7 in /home/zuul/venv/lib/python3.11/site-packages (from requests) (2026.6.17)\n", "stdout_lines": ["Requirement already satisfied: requests in /home/zuul/venv/lib/python3.11/site-packages (2.34.2)", "Requirement already satisfied: charset_normalizer<4,>=2 in /home/zuul/venv/lib/python3.11/site-packages (from requests) (3.4.9)", "Requirement already satisfied: idna<4,>=2.5 in /home/zuul/venv/lib/python3.11/site-packages (from requests) (3.18)", "Requirement already satisfied: urllib3<3,>=1.26 in /home/zuul/venv/lib/python3.11/site-packages (from requests) (2.7.0)", "Requirement already satisfied: certifi>=2023.5.7 in /home/zuul/venv/lib/python3.11/site-packages (from requests) (2026.6.17)"], "version": null, "virtualenv": "/home/zuul/venv"} 2026-07-20 06:48:45.409837 | debian-bookworm | 2026-07-20 06:48:45.409940 | debian-bookworm | TASK [Include required prepare tasks] ****************************************** 2026-07-20 06:48:45.429899 | debian-bookworm | included: /home/zuul/src/github.com/osism/ansible-collection-services/molecule/delegated/prepare/auditd.yml for molecule-auditd 2026-07-20 06:48:45.429935 | debian-bookworm | 2026-07-20 06:48:45.429972 | debian-bookworm | PLAY RECAP ********************************************************************* 2026-07-20 06:48:45.430087 | debian-bookworm | molecule-auditd : ok=3 changed=1 unreachable=0 failed=0 skipped=0 rescued=0 ignored=0 2026-07-20 06:48:45.430205 | debian-bookworm | 2026-07-20 06:48:45.505221 | debian-bookworm | INFO [delegated > prepare] Executed: Successful 2026-07-20 06:48:45.505519 | debian-bookworm | INFO Molecule executed 1 scenario (1 successful) 2026-07-20 06:48:45.505547 | debian-bookworm | 2026-07-20 06:48:45.505561 | debian-bookworm | DETAILS 2026-07-20 06:48:45.505576 | debian-bookworm | delegated > prepare: Executed: Successful 2026-07-20 06:48:45.505588 | debian-bookworm | 2026-07-20 06:48:45.505655 | debian-bookworm | SCENARIO RECAP 2026-07-20 06:48:45.505670 | debian-bookworm | delegated : actions=1 successful=1 disabled=0 skipped=0 missing=0 failed=0 2026-07-20 06:48:45.505681 | debian-bookworm | 2026-07-20 06:48:45.697831 | debian-bookworm | ok: Runtime: 0:00:08.638132 2026-07-20 06:48:48.078344 | ubuntu-noble | changed: [molecule-auditd] => (item=docker) => {"ansible_loop_var": "item", "changed": true, "cmd": ["/home/zuul/venv/bin/pip3", "install", "docker"], "item": "docker", "name": ["docker"], "requirements": null, "state": "present", "stderr": "", "stderr_lines": [], "stdout": "Collecting docker\n Downloading docker-7.2.0-py3-none-any.whl.metadata (3.8 kB)\nRequirement already satisfied: requests>=2.26.0 in /home/zuul/venv/lib/python3.12/site-packages (from docker) (2.34.2)\nRequirement already satisfied: urllib3>=1.26.0 in /home/zuul/venv/lib/python3.12/site-packages (from docker) (2.7.0)\nRequirement already satisfied: charset_normalizer<4,>=2 in /home/zuul/venv/lib/python3.12/site-packages (from requests>=2.26.0->docker) (3.4.9)\nRequirement already satisfied: idna<4,>=2.5 in /home/zuul/venv/lib/python3.12/site-packages (from requests>=2.26.0->docker) (3.18)\nRequirement already satisfied: certifi>=2023.5.7 in /home/zuul/venv/lib/python3.12/site-packages (from requests>=2.26.0->docker) (2026.6.17)\nDownloading docker-7.2.0-py3-none-any.whl (148 kB)\n ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ 148.8/148.8 kB 3.1 MB/s eta 0:00:00\nInstalling collected packages: docker\nSuccessfully installed docker-7.2.0\n", "stdout_lines": ["Collecting docker", " Downloading docker-7.2.0-py3-none-any.whl.metadata (3.8 kB)", "Requirement already satisfied: requests>=2.26.0 in /home/zuul/venv/lib/python3.12/site-packages (from docker) (2.34.2)", "Requirement already satisfied: urllib3>=1.26.0 in /home/zuul/venv/lib/python3.12/site-packages (from docker) (2.7.0)", "Requirement already satisfied: charset_normalizer<4,>=2 in /home/zuul/venv/lib/python3.12/site-packages (from requests>=2.26.0->docker) (3.4.9)", "Requirement already satisfied: idna<4,>=2.5 in /home/zuul/venv/lib/python3.12/site-packages (from requests>=2.26.0->docker) (3.18)", "Requirement already satisfied: certifi>=2023.5.7 in /home/zuul/venv/lib/python3.12/site-packages (from requests>=2.26.0->docker) (2026.6.17)", "Downloading docker-7.2.0-py3-none-any.whl (148 kB)", " ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ 148.8/148.8 kB 3.1 MB/s eta 0:00:00", "Installing collected packages: docker", "Successfully installed docker-7.2.0"], "version": null, "virtualenv": "/home/zuul/venv"} 2026-07-20 06:48:48.078432 | ubuntu-noble | changed: [molecule-auditd] => (item=netaddr) => {"ansible_loop_var": "item", "changed": true, "cmd": ["/home/zuul/venv/bin/pip3", "install", "netaddr"], "item": "netaddr", "name": ["netaddr"], "requirements": null, "state": "present", "stderr": "", "stderr_lines": [], "stdout": "Collecting netaddr\n Downloading netaddr-1.3.0-py3-none-any.whl.metadata (5.0 kB)\nDownloading netaddr-1.3.0-py3-none-any.whl (2.3 MB)\n ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ 2.3/2.3 MB 11.9 MB/s eta 0:00:00\nInstalling collected packages: netaddr\nSuccessfully installed netaddr-1.3.0\n", "stdout_lines": ["Collecting netaddr", " Downloading netaddr-1.3.0-py3-none-any.whl.metadata (5.0 kB)", "Downloading netaddr-1.3.0-py3-none-any.whl (2.3 MB)", " ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ 2.3/2.3 MB 11.9 MB/s eta 0:00:00", "Installing collected packages: netaddr", "Successfully installed netaddr-1.3.0"], "version": null, "virtualenv": "/home/zuul/venv"} 2026-07-20 06:48:48.078457 | ubuntu-noble | ok: [molecule-auditd] => (item=requests) => {"ansible_loop_var": "item", "changed": false, "cmd": ["/home/zuul/venv/bin/pip3", "install", "requests"], "item": "requests", "name": ["requests"], "requirements": null, "state": "present", "stderr": "", "stderr_lines": [], "stdout": "Requirement already satisfied: requests in /home/zuul/venv/lib/python3.12/site-packages (2.34.2)\nRequirement already satisfied: charset_normalizer<4,>=2 in /home/zuul/venv/lib/python3.12/site-packages (from requests) (3.4.9)\nRequirement already satisfied: idna<4,>=2.5 in /home/zuul/venv/lib/python3.12/site-packages (from requests) (3.18)\nRequirement already satisfied: urllib3<3,>=1.26 in /home/zuul/venv/lib/python3.12/site-packages (from requests) (2.7.0)\nRequirement already satisfied: certifi>=2023.5.7 in /home/zuul/venv/lib/python3.12/site-packages (from requests) (2026.6.17)\n", "stdout_lines": ["Requirement already satisfied: requests in /home/zuul/venv/lib/python3.12/site-packages (2.34.2)", "Requirement already satisfied: charset_normalizer<4,>=2 in /home/zuul/venv/lib/python3.12/site-packages (from requests) (3.4.9)", "Requirement already satisfied: idna<4,>=2.5 in /home/zuul/venv/lib/python3.12/site-packages (from requests) (3.18)", "Requirement already satisfied: urllib3<3,>=1.26 in /home/zuul/venv/lib/python3.12/site-packages (from requests) (2.7.0)", "Requirement already satisfied: certifi>=2023.5.7 in /home/zuul/venv/lib/python3.12/site-packages (from requests) (2026.6.17)"], "version": null, "virtualenv": "/home/zuul/venv"} 2026-07-20 06:48:48.078464 | ubuntu-noble | 2026-07-20 06:48:48.078470 | ubuntu-noble | TASK [Include required prepare tasks] ****************************************** 2026-07-20 06:48:48.103926 | ubuntu-noble | included: /home/zuul/src/github.com/osism/ansible-collection-services/molecule/delegated/prepare/auditd.yml for molecule-auditd 2026-07-20 06:48:48.104022 | ubuntu-noble | 2026-07-20 06:48:48.104194 | ubuntu-noble | PLAY RECAP ********************************************************************* 2026-07-20 06:48:48.104378 | ubuntu-noble | molecule-auditd : ok=3 changed=1 unreachable=0 failed=0 skipped=0 rescued=0 ignored=0 2026-07-20 06:48:48.104511 | ubuntu-noble | 2026-07-20 06:48:48.364611 | ubuntu-noble | ok: Runtime: 0:00:11.303763 2026-07-20 06:48:48.375640 | 2026-07-20 06:48:48.375808 | TASK [ansible-molecule : Reset connection] 2026-07-20 06:48:48.422499 | 2026-07-20 06:48:48.422674 | TASK [ansible-molecule : Reset connection] 2026-07-20 06:48:48.462576 | 2026-07-20 06:48:48.462758 | TASK [ansible-molecule : Run molecule converge action with scenario delegated] 2026-07-20 06:48:48.225051 | ubuntu-noble | INFO [delegated > prepare] Executed: Successful 2026-07-20 06:48:48.225430 | ubuntu-noble | INFO Molecule executed 1 scenario (1 successful) 2026-07-20 06:48:48.225475 | ubuntu-noble | 2026-07-20 06:48:48.225499 | ubuntu-noble | DETAILS 2026-07-20 06:48:48.225511 | ubuntu-noble | delegated > prepare: Executed: Successful 2026-07-20 06:48:48.225521 | ubuntu-noble | 2026-07-20 06:48:48.225562 | ubuntu-noble | SCENARIO RECAP 2026-07-20 06:48:48.225597 | ubuntu-noble | delegated : actions=1 successful=1 disabled=0 skipped=0 missing=0 failed=0 2026-07-20 06:48:48.225608 | ubuntu-noble | 2026-07-20 06:48:49.370477 | ubuntu-noble | WARNING Molecule scenarios should migrate to 'extensions/molecule' 2026-07-20 06:48:49.379979 | ubuntu-noble | DEBUG [unknown > config] provisioner.env found in /home/zuul/src/github.com/osism/ansible-collection-services/molecule/delegated/molecule.yml, this can be defined in ansible.env 2026-07-20 06:48:49.232629 | debian-bookworm | WARNING Molecule scenarios should migrate to 'extensions/molecule' 2026-07-20 06:48:49.239717 | debian-bookworm | DEBUG [unknown > config] provisioner.env found in /home/zuul/src/github.com/osism/ansible-collection-services/molecule/delegated/molecule.yml, this can be defined in ansible.env 2026-07-20 06:48:49.775794 | debian-bookworm | DEBUG [unknown > config] provisioner.env found in /home/zuul/src/github.com/osism/ansible-collection-services/molecule/delegated/molecule.yml, this can be defined in ansible.env 2026-07-20 06:48:49.776409 | debian-bookworm | DEBUG [delegated > validate] Validating schema /home/zuul/src/github.com/osism/ansible-collection-services/molecule/delegated/molecule.yml. 2026-07-20 06:48:49.795660 | debian-bookworm | DEBUG [default > validate] Validating schema /home/zuul/src/github.com/osism/ansible-collection-services/molecule/default/molecule.yml. 2026-07-20 06:48:49.801069 | debian-bookworm | INFO [delegated > discovery] scenario test matrix: dependency, create, prepare, converge 2026-07-20 06:48:49.801218 | debian-bookworm | INFO [delegated > prerun] Performing prerun with role_name_check=0... 2026-07-20 06:48:50.096984 | ubuntu-noble | DEBUG [unknown > config] provisioner.env found in /home/zuul/src/github.com/osism/ansible-collection-services/molecule/delegated/molecule.yml, this can be defined in ansible.env 2026-07-20 06:48:50.097878 | ubuntu-noble | DEBUG [delegated > validate] Validating schema /home/zuul/src/github.com/osism/ansible-collection-services/molecule/delegated/molecule.yml. 2026-07-20 06:48:50.122731 | ubuntu-noble | DEBUG [default > validate] Validating schema /home/zuul/src/github.com/osism/ansible-collection-services/molecule/default/molecule.yml. 2026-07-20 06:48:50.128820 | ubuntu-noble | INFO [delegated > discovery] scenario test matrix: dependency, create, prepare, converge 2026-07-20 06:48:50.128978 | ubuntu-noble | INFO [delegated > prerun] Performing prerun with role_name_check=0... 2026-07-20 06:48:51.069368 | debian-bookworm | INFO [delegated > dependency] Executing 2026-07-20 06:48:51.069616 | debian-bookworm | WARNING [delegated > dependency] Missing roles requirements file: requirements.yml 2026-07-20 06:48:51.491421 | debian-bookworm | ansible-galaxy [core 2.19.11] 2026-07-20 06:48:51.491839 | debian-bookworm | config file = None 2026-07-20 06:48:51.492276 | debian-bookworm | configured module search path = ['/home/zuul/src/github.com/osism/ansible-collection-services/plugins/modules', '/home/zuul/.ansible/plugins/modules', '/usr/share/ansible/plugins/modules'] 2026-07-20 06:48:51.492793 | debian-bookworm | ansible python module location = /home/zuul/venv/lib/python3.11/site-packages/ansible 2026-07-20 06:48:51.493230 | debian-bookworm | ansible collection location = /home/zuul/.ansible/collections:/usr/share/ansible/collections:/home/zuul/venv/lib/python3.11/site-packages:/home/zuul/venv/lib/python3.11/dist-packages:/home/zuul/venv/lib/python3/dist-packages:/home/zuul/venv/local/lib/python3.11/dist-packages 2026-07-20 06:48:51.493579 | debian-bookworm | executable location = /home/zuul/venv/bin/ansible-galaxy 2026-07-20 06:48:51.493918 | debian-bookworm | python version = 3.11.2 (main, May 12 2026, 05:17:27) [GCC 12.2.0] (/home/zuul/venv/bin/python3) 2026-07-20 06:48:51.494312 | debian-bookworm | jinja version = 3.1.6 2026-07-20 06:48:51.494622 | debian-bookworm | pyyaml version = 6.0.3 (with libyaml v0.2.5) 2026-07-20 06:48:51.494917 | debian-bookworm | No config file found; using defaults 2026-07-20 06:48:51.495389 | debian-bookworm | Reading requirement file at '/home/zuul/src/github.com/osism/ansible-collection-services/molecule/delegated/collections.yml' 2026-07-20 06:48:51.498611 | debian-bookworm | Loading collection osism.commons from /home/zuul/.ansible/collections/ansible_collections/osism/commons 2026-07-20 06:48:51.500241 | debian-bookworm | Found installed collection osism.commons:0.20260712.0 at '/home/zuul/.ansible/collections/ansible_collections/osism/commons' 2026-07-20 06:48:51.501505 | debian-bookworm | Loading collection osism.services from /home/zuul/.ansible/collections/ansible_collections/osism/services 2026-07-20 06:48:51.501886 | debian-bookworm | Found installed collection osism.services:999.0.0 at '/home/zuul/.ansible/collections/ansible_collections/osism/services' 2026-07-20 06:48:51.875669 | ubuntu-noble | INFO [delegated > dependency] Executing 2026-07-20 06:48:51.877323 | ubuntu-noble | WARNING [delegated > dependency] Missing roles requirements file: requirements.yml 2026-07-20 06:48:51.506563 | debian-bookworm | Loading collection cloudscale_ch.cloud from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/cloudscale_ch/cloud 2026-07-20 06:48:51.506991 | debian-bookworm | Found installed collection cloudscale_ch.cloud:2.5.2 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/cloudscale_ch/cloud' 2026-07-20 06:48:51.507418 | debian-bookworm | Loading collection community.postgresql from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/postgresql 2026-07-20 06:48:51.507803 | debian-bookworm | Found installed collection community.postgresql:4.1.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/postgresql' 2026-07-20 06:48:51.508207 | debian-bookworm | Loading collection community.proxmox from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/proxmox 2026-07-20 06:48:51.508555 | debian-bookworm | Found installed collection community.proxmox:1.4.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/proxmox' 2026-07-20 06:48:51.508942 | debian-bookworm | Loading collection community.libvirt from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/libvirt 2026-07-20 06:48:51.509314 | debian-bookworm | Found installed collection community.libvirt:2.0.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/libvirt' 2026-07-20 06:48:51.509607 | debian-bookworm | Loading collection ibm.storage_virtualize from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/ibm/storage_virtualize 2026-07-20 06:48:51.509998 | debian-bookworm | Found installed collection ibm.storage_virtualize:2.7.4 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/ibm/storage_virtualize' 2026-07-20 06:48:51.510305 | debian-bookworm | Loading collection hitachivantara.vspone_object from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/hitachivantara/vspone_object 2026-07-20 06:48:51.510595 | debian-bookworm | Found installed collection hitachivantara.vspone_object:1.0.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/hitachivantara/vspone_object' 2026-07-20 06:48:51.510986 | debian-bookworm | Loading collection kubernetes.core from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/kubernetes/core 2026-07-20 06:48:51.511292 | debian-bookworm | Found installed collection kubernetes.core:6.2.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/kubernetes/core' 2026-07-20 06:48:51.511579 | debian-bookworm | Loading collection community.sops from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/sops 2026-07-20 06:48:51.511964 | debian-bookworm | Found installed collection community.sops:2.2.7 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/sops' 2026-07-20 06:48:51.512272 | debian-bookworm | Loading collection ansible.netcommon from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/ansible/netcommon 2026-07-20 06:48:51.512578 | debian-bookworm | Found installed collection ansible.netcommon:8.1.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/ansible/netcommon' 2026-07-20 06:48:51.512866 | debian-bookworm | Loading collection grafana.grafana from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/grafana/grafana 2026-07-20 06:48:51.513292 | debian-bookworm | Found installed collection grafana.grafana:6.0.6 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/grafana/grafana' 2026-07-20 06:48:51.513573 | debian-bookworm | Loading collection chocolatey.chocolatey from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/chocolatey/chocolatey 2026-07-20 06:48:51.513854 | debian-bookworm | Found installed collection chocolatey.chocolatey:1.5.3 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/chocolatey/chocolatey' 2026-07-20 06:48:51.514148 | debian-bookworm | Loading collection netapp.storagegrid from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/netapp/storagegrid 2026-07-20 06:48:51.514550 | debian-bookworm | Found installed collection netapp.storagegrid:21.15.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/netapp/storagegrid' 2026-07-20 06:48:51.514832 | debian-bookworm | Loading collection community.ciscosmb from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/ciscosmb 2026-07-20 06:48:51.515145 | debian-bookworm | Found installed collection community.ciscosmb:1.0.11 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/ciscosmb' 2026-07-20 06:48:51.515526 | debian-bookworm | Loading collection cisco.iosxr from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/cisco/iosxr 2026-07-20 06:48:51.515895 | debian-bookworm | Found installed collection cisco.iosxr:12.1.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/cisco/iosxr' 2026-07-20 06:48:51.516288 | debian-bookworm | Loading collection theforeman.foreman from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/theforeman/foreman 2026-07-20 06:48:51.516731 | debian-bookworm | Found installed collection theforeman.foreman:5.7.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/theforeman/foreman' 2026-07-20 06:48:51.518058 | debian-bookworm | Loading collection cisco.meraki from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/cisco/meraki 2026-07-20 06:48:51.518364 | debian-bookworm | Found installed collection cisco.meraki:2.21.8 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/cisco/meraki' 2026-07-20 06:48:51.518806 | debian-bookworm | Loading collection telekom_mms.icinga_director from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/telekom_mms/icinga_director 2026-07-20 06:48:51.519110 | debian-bookworm | Found installed collection telekom_mms.icinga_director:2.4.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/telekom_mms/icinga_director' 2026-07-20 06:48:51.519655 | debian-bookworm | Loading collection ngine_io.cloudstack from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/ngine_io/cloudstack 2026-07-20 06:48:51.519923 | debian-bookworm | Found installed collection ngine_io.cloudstack:2.5.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/ngine_io/cloudstack' 2026-07-20 06:48:51.520291 | debian-bookworm | Loading collection community.mongodb from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/mongodb 2026-07-20 06:48:51.520584 | debian-bookworm | Found installed collection community.mongodb:1.7.10 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/mongodb' 2026-07-20 06:48:51.522739 | debian-bookworm | Loading collection vmware.vmware_rest from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/vmware/vmware_rest 2026-07-20 06:48:51.523011 | debian-bookworm | Found installed collection vmware.vmware_rest:4.9.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/vmware/vmware_rest' 2026-07-20 06:48:51.523328 | debian-bookworm | Loading collection community.grafana from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/grafana 2026-07-20 06:48:51.523643 | debian-bookworm | Found installed collection community.grafana:2.3.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/grafana' 2026-07-20 06:48:51.524222 | debian-bookworm | Loading collection dellemc.openmanage from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/dellemc/openmanage 2026-07-20 06:48:51.524540 | debian-bookworm | Found installed collection dellemc.openmanage:9.12.3 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/dellemc/openmanage' 2026-07-20 06:48:51.525955 | debian-bookworm | Loading collection community.windows from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/windows 2026-07-20 06:48:51.526277 | debian-bookworm | Found installed collection community.windows:3.0.1 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/windows' 2026-07-20 06:48:51.526560 | debian-bookworm | Loading collection lowlydba.sqlserver from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/lowlydba/sqlserver 2026-07-20 06:48:51.526832 | debian-bookworm | Found installed collection lowlydba.sqlserver:2.7.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/lowlydba/sqlserver' 2026-07-20 06:48:51.527128 | debian-bookworm | Loading collection wti.remote from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/wti/remote 2026-07-20 06:48:51.527399 | debian-bookworm | Found installed collection wti.remote:1.0.10 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/wti/remote' 2026-07-20 06:48:51.528784 | debian-bookworm | Loading collection cisco.aci from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/cisco/aci 2026-07-20 06:48:51.529076 | debian-bookworm | Found installed collection cisco.aci:2.12.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/cisco/aci' 2026-07-20 06:48:51.529908 | debian-bookworm | Loading collection community.digitalocean from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/digitalocean 2026-07-20 06:48:51.530251 | debian-bookworm | Found installed collection community.digitalocean:1.27.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/digitalocean' 2026-07-20 06:48:51.530545 | debian-bookworm | Loading collection community.dns from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/dns 2026-07-20 06:48:51.530841 | debian-bookworm | Found installed collection community.dns:3.4.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/dns' 2026-07-20 06:48:51.531500 | debian-bookworm | Loading collection netapp.ontap from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/netapp/ontap 2026-07-20 06:48:51.531789 | debian-bookworm | Found installed collection netapp.ontap:23.2.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/netapp/ontap' 2026-07-20 06:48:51.532132 | debian-bookworm | Loading collection cisco.intersight from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/cisco/intersight 2026-07-20 06:48:51.532412 | debian-bookworm | Found installed collection cisco.intersight:2.7.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/cisco/intersight' 2026-07-20 06:48:51.532750 | debian-bookworm | Loading collection netapp.cloudmanager from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/netapp/cloudmanager 2026-07-20 06:48:51.532984 | debian-bookworm | Found installed collection netapp.cloudmanager:21.24.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/netapp/cloudmanager' 2026-07-20 06:48:51.533416 | debian-bookworm | Loading collection vyos.vyos from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/vyos/vyos 2026-07-20 06:48:51.533690 | debian-bookworm | Found installed collection vyos.vyos:6.0.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/vyos/vyos' 2026-07-20 06:48:51.534667 | debian-bookworm | Loading collection hetzner.hcloud from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/hetzner/hcloud 2026-07-20 06:48:51.534942 | debian-bookworm | Found installed collection hetzner.hcloud:5.4.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/hetzner/hcloud' 2026-07-20 06:48:51.535257 | debian-bookworm | Loading collection ravendb.ravendb from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/ravendb/ravendb 2026-07-20 06:48:51.535548 | debian-bookworm | Found installed collection ravendb.ravendb:1.0.4 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/ravendb/ravendb' 2026-07-20 06:48:51.535797 | debian-bookworm | Loading collection community.routeros from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/routeros 2026-07-20 06:48:51.536055 | debian-bookworm | Found installed collection community.routeros:3.13.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/routeros' 2026-07-20 06:48:51.537050 | debian-bookworm | Loading collection cisco.mso from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/cisco/mso 2026-07-20 06:48:51.537297 | debian-bookworm | Found installed collection cisco.mso:2.11.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/cisco/mso' 2026-07-20 06:48:51.539034 | debian-bookworm | Loading collection azure.azcollection from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/azure/azcollection 2026-07-20 06:48:51.539274 | debian-bookworm | Found installed collection azure.azcollection:3.10.1 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/azure/azcollection' 2026-07-20 06:48:51.539560 | debian-bookworm | Loading collection inspur.ispim from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/inspur/ispim 2026-07-20 06:48:51.539788 | debian-bookworm | Found installed collection inspur.ispim:2.2.3 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/inspur/ispim' 2026-07-20 06:48:51.540932 | debian-bookworm | Loading collection amazon.aws from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/amazon/aws 2026-07-20 06:48:51.541189 | debian-bookworm | Found installed collection amazon.aws:10.1.2 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/amazon/aws' 2026-07-20 06:48:51.541472 | debian-bookworm | Loading collection microsoft.iis from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/microsoft/iis 2026-07-20 06:48:51.541700 | debian-bookworm | Found installed collection microsoft.iis:1.0.3 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/microsoft/iis' 2026-07-20 06:48:51.541935 | debian-bookworm | Loading collection purestorage.flashblade from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/purestorage/flashblade 2026-07-20 06:48:51.542202 | debian-bookworm | Found installed collection purestorage.flashblade:1.22.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/purestorage/flashblade' 2026-07-20 06:48:51.542439 | debian-bookworm | Loading collection cisco.dnac from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/cisco/dnac 2026-07-20 06:48:51.542665 | debian-bookworm | Found installed collection cisco.dnac:6.41.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/cisco/dnac' 2026-07-20 06:48:51.543033 | debian-bookworm | Loading collection dellemc.powerflex from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/dellemc/powerflex 2026-07-20 06:48:51.543278 | debian-bookworm | Found installed collection dellemc.powerflex:2.6.1 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/dellemc/powerflex' 2026-07-20 06:48:51.543542 | debian-bookworm | Loading collection kaytus.ksmanage from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/kaytus/ksmanage 2026-07-20 06:48:51.543766 | debian-bookworm | Found installed collection kaytus.ksmanage:2.0.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/kaytus/ksmanage' 2026-07-20 06:48:51.544031 | debian-bookworm | Loading collection infinidat.infinibox from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/infinidat/infinibox 2026-07-20 06:48:51.544272 | debian-bookworm | Found installed collection infinidat.infinibox:1.6.3 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/infinidat/infinibox' 2026-07-20 06:48:51.547333 | debian-bookworm | Loading collection fortinet.fortios from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/fortinet/fortios 2026-07-20 06:48:51.547595 | debian-bookworm | Found installed collection fortinet.fortios:2.4.2 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/fortinet/fortios' 2026-07-20 06:48:51.548206 | debian-bookworm | Loading collection openstack.cloud from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/openstack/cloud 2026-07-20 06:48:51.548493 | debian-bookworm | Found installed collection openstack.cloud:2.5.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/openstack/cloud' 2026-07-20 06:48:51.551419 | debian-bookworm | Loading collection community.aws from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/aws 2026-07-20 06:48:51.551692 | debian-bookworm | Found installed collection community.aws:10.0.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/aws' 2026-07-20 06:48:51.551937 | debian-bookworm | Loading collection containers.podman from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/containers/podman 2026-07-20 06:48:51.552188 | debian-bookworm | Found installed collection containers.podman:1.18.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/containers/podman' 2026-07-20 06:48:51.552519 | debian-bookworm | Loading collection community.hashi_vault from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/hashi_vault 2026-07-20 06:48:51.552736 | debian-bookworm | Found installed collection community.hashi_vault:7.1.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/hashi_vault' 2026-07-20 06:48:51.553480 | debian-bookworm | Loading collection arista.eos from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/arista/eos 2026-07-20 06:48:51.553748 | debian-bookworm | Found installed collection arista.eos:12.0.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/arista/eos' 2026-07-20 06:48:51.554025 | debian-bookworm | Loading collection hitachivantara.vspone_block from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/hitachivantara/vspone_block 2026-07-20 06:48:51.554286 | debian-bookworm | Found installed collection hitachivantara.vspone_block:4.4.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/hitachivantara/vspone_block' 2026-07-20 06:48:51.554899 | debian-bookworm | Loading collection dellemc.unity from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/dellemc/unity 2026-07-20 06:48:51.555131 | debian-bookworm | Found installed collection dellemc.unity:2.1.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/dellemc/unity' 2026-07-20 06:48:51.555676 | debian-bookworm | Loading collection ovirt.ovirt from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/ovirt/ovirt 2026-07-20 06:48:51.555886 | debian-bookworm | Found installed collection ovirt.ovirt:3.2.1 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/ovirt/ovirt' 2026-07-20 06:48:51.557301 | debian-bookworm | Loading collection community.vmware from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/vmware 2026-07-20 06:48:51.557518 | debian-bookworm | Found installed collection community.vmware:5.10.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/vmware' 2026-07-20 06:48:51.558973 | debian-bookworm | Loading collection dellemc.enterprise_sonic from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/dellemc/enterprise_sonic 2026-07-20 06:48:51.559262 | debian-bookworm | Found installed collection dellemc.enterprise_sonic:3.2.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/dellemc/enterprise_sonic' 2026-07-20 06:48:51.559965 | debian-bookworm | Loading collection cisco.ios from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/cisco/ios 2026-07-20 06:48:51.560245 | debian-bookworm | Found installed collection cisco.ios:11.1.1 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/cisco/ios' 2026-07-20 06:48:51.560508 | debian-bookworm | Loading collection cyberark.pas from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/cyberark/pas 2026-07-20 06:48:51.560785 | debian-bookworm | Found installed collection cyberark.pas:1.0.36 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/cyberark/pas' 2026-07-20 06:48:51.561381 | debian-bookworm | Loading collection splunk.es from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/splunk/es 2026-07-20 06:48:51.561591 | debian-bookworm | Found installed collection splunk.es:4.0.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/splunk/es' 2026-07-20 06:48:51.561806 | debian-bookworm | Loading collection community.library_inventory_filtering_v1 from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/library_inventory_filtering_v1 2026-07-20 06:48:51.562107 | debian-bookworm | Found installed collection community.library_inventory_filtering_v1:1.1.5 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/library_inventory_filtering_v1' 2026-07-20 06:48:51.562324 | debian-bookworm | Loading collection community.mysql from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/mysql 2026-07-20 06:48:51.562607 | debian-bookworm | Found installed collection community.mysql:3.16.1 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/mysql' 2026-07-20 06:48:51.562825 | debian-bookworm | Loading collection purestorage.flasharray from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/purestorage/flasharray 2026-07-20 06:48:51.563076 | debian-bookworm | Found installed collection purestorage.flasharray:1.39.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/purestorage/flasharray' 2026-07-20 06:48:51.563492 | debian-bookworm | Loading collection vultr.cloud from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/vultr/cloud 2026-07-20 06:48:51.563710 | debian-bookworm | Found installed collection vultr.cloud:1.13.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/vultr/cloud' 2026-07-20 06:48:51.563935 | debian-bookworm | Loading collection ansible.utils from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/ansible/utils 2026-07-20 06:48:51.564175 | debian-bookworm | Found installed collection ansible.utils:6.0.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/ansible/utils' 2026-07-20 06:48:51.564688 | debian-bookworm | Loading collection community.crypto from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/crypto 2026-07-20 06:48:51.564904 | debian-bookworm | Found installed collection community.crypto:3.0.5 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/crypto' 2026-07-20 06:48:51.565140 | debian-bookworm | Loading collection community.proxysql from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/proxysql 2026-07-20 06:48:51.565357 | debian-bookworm | Found installed collection community.proxysql:1.7.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/proxysql' 2026-07-20 06:48:51.565574 | debian-bookworm | Loading collection infoblox.nios_modules from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/infoblox/nios_modules 2026-07-20 06:48:51.565859 | debian-bookworm | Found installed collection infoblox.nios_modules:1.8.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/infoblox/nios_modules' 2026-07-20 06:48:51.566089 | debian-bookworm | Loading collection ieisystem.inmanage from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/ieisystem/inmanage 2026-07-20 06:48:51.566334 | debian-bookworm | Found installed collection ieisystem.inmanage:3.0.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/ieisystem/inmanage' 2026-07-20 06:48:51.566567 | debian-bookworm | Loading collection microsoft.ad from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/microsoft/ad 2026-07-20 06:48:51.566819 | debian-bookworm | Found installed collection microsoft.ad:1.9.2 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/microsoft/ad' 2026-07-20 06:48:51.567193 | debian-bookworm | Loading collection f5networks.f5_modules from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/f5networks/f5_modules 2026-07-20 06:48:51.567426 | debian-bookworm | Found installed collection f5networks.f5_modules:1.39.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/f5networks/f5_modules' 2026-07-20 06:48:51.567747 | debian-bookworm | Loading collection community.sap_libs from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/sap_libs 2026-07-20 06:48:51.567989 | debian-bookworm | Found installed collection community.sap_libs:1.5.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/sap_libs' 2026-07-20 06:48:51.569034 | debian-bookworm | Loading collection google.cloud from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/google/cloud 2026-07-20 06:48:51.569353 | debian-bookworm | Found installed collection google.cloud:1.9.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/google/cloud' 2026-07-20 06:48:51.569910 | debian-bookworm | Loading collection community.hrobot from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/hrobot 2026-07-20 06:48:51.570125 | debian-bookworm | Found installed collection community.hrobot:2.7.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/hrobot' 2026-07-20 06:48:51.570367 | debian-bookworm | Loading collection ansible.posix from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/ansible/posix 2026-07-20 06:48:51.570626 | debian-bookworm | Found installed collection ansible.posix:2.1.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/ansible/posix' 2026-07-20 06:48:51.571966 | debian-bookworm | Loading collection cisco.nxos from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/cisco/nxos 2026-07-20 06:48:51.572248 | debian-bookworm | Found installed collection cisco.nxos:11.0.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/cisco/nxos' 2026-07-20 06:48:51.572709 | debian-bookworm | Loading collection ibm.qradar from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/ibm/qradar 2026-07-20 06:48:51.572960 | debian-bookworm | Found installed collection ibm.qradar:4.0.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/ibm/qradar' 2026-07-20 06:48:51.573295 | debian-bookworm | Loading collection community.zabbix from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/zabbix 2026-07-20 06:48:51.573553 | debian-bookworm | Found installed collection community.zabbix:4.1.1 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/zabbix' 2026-07-20 06:48:51.581912 | debian-bookworm | Loading collection community.general from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/general 2026-07-20 06:48:51.582228 | debian-bookworm | Found installed collection community.general:11.4.1 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/general' 2026-07-20 06:48:51.582902 | debian-bookworm | Loading collection netbox.netbox from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/netbox/netbox 2026-07-20 06:48:51.583192 | debian-bookworm | Found installed collection netbox.netbox:3.21.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/netbox/netbox' 2026-07-20 06:48:51.583359 | debian-bookworm | Loading collection cisco.ucs from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/cisco/ucs 2026-07-20 06:48:51.583641 | debian-bookworm | Found installed collection cisco.ucs:1.16.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/cisco/ucs' 2026-07-20 06:48:51.584060 | debian-bookworm | Loading collection check_point.mgmt from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/check_point/mgmt 2026-07-20 06:48:51.584373 | debian-bookworm | Found installed collection check_point.mgmt:6.6.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/check_point/mgmt' 2026-07-20 06:48:51.584671 | debian-bookworm | Loading collection community.rabbitmq from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/rabbitmq 2026-07-20 06:48:51.584934 | debian-bookworm | Found installed collection community.rabbitmq:1.6.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/rabbitmq' 2026-07-20 06:48:51.585115 | debian-bookworm | Loading collection cyberark.conjur from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/cyberark/conjur 2026-07-20 06:48:51.585398 | debian-bookworm | Found installed collection cyberark.conjur:1.3.8 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/cyberark/conjur' 2026-07-20 06:48:51.585760 | debian-bookworm | Loading collection community.docker from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/docker 2026-07-20 06:48:51.585998 | debian-bookworm | Found installed collection community.docker:4.8.2 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/docker' 2026-07-20 06:48:51.588006 | debian-bookworm | Loading collection awx.awx from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/awx/awx 2026-07-20 06:48:51.588297 | debian-bookworm | Found installed collection awx.awx:24.6.1 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/awx/awx' 2026-07-20 06:48:51.588679 | debian-bookworm | Loading collection community.okd from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/okd 2026-07-20 06:48:51.588956 | debian-bookworm | Found installed collection community.okd:5.0.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/okd' 2026-07-20 06:48:51.589239 | debian-bookworm | Loading collection kubevirt.core from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/kubevirt/core 2026-07-20 06:48:51.589478 | debian-bookworm | Found installed collection kubevirt.core:2.2.3 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/kubevirt/core' 2026-07-20 06:48:51.589860 | debian-bookworm | Loading collection vmware.vmware from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/vmware/vmware 2026-07-20 06:48:51.590110 | debian-bookworm | Found installed collection vmware.vmware:2.4.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/vmware/vmware' 2026-07-20 06:48:51.590891 | debian-bookworm | Loading collection junipernetworks.junos from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/junipernetworks/junos 2026-07-20 06:48:51.591167 | debian-bookworm | Found installed collection junipernetworks.junos:11.0.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/junipernetworks/junos' 2026-07-20 06:48:51.595827 | debian-bookworm | Loading collection fortinet.fortimanager from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/fortinet/fortimanager 2026-07-20 06:48:51.596036 | debian-bookworm | Found installed collection fortinet.fortimanager:2.11.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/fortinet/fortimanager' 2026-07-20 06:48:51.596369 | debian-bookworm | Loading collection ansible.windows from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/ansible/windows 2026-07-20 06:48:51.596653 | debian-bookworm | Found installed collection ansible.windows:3.2.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/ansible/windows' 2026-07-20 06:48:51.596903 | debian-bookworm | Loading collection netapp_eseries.santricity from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/netapp_eseries/santricity 2026-07-20 06:48:51.597165 | debian-bookworm | Found installed collection netapp_eseries.santricity:1.4.1 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/netapp_eseries/santricity' 2026-07-20 06:48:51.601754 | debian-bookworm | Loading collection ansible._protomatter from /home/zuul/venv/lib/python3.11/site-packages/ansible/_internal/ansible_collections/ansible/_protomatter 2026-07-20 06:48:51.601919 | debian-bookworm | Found installed collection ansible._protomatter:2.19.11 at '/home/zuul/venv/lib/python3.11/site-packages/ansible/_internal/ansible_collections/ansible/_protomatter' 2026-07-20 06:48:51.602347 | debian-bookworm | Starting galaxy collection install process 2026-07-20 06:48:51.602471 | debian-bookworm | Nothing to do. All requested collections are already installed. If you want to reinstall them, consider using `--force`. 2026-07-20 06:48:51.662036 | debian-bookworm | INFO [delegated > dependency] Dependency completed successfully. 2026-07-20 06:48:51.662319 | debian-bookworm | WARNING [delegated > dependency] Executed: Missing roles requirements file: requirements.yml (Remove from converge_sequence to suppress) 2026-07-20 06:48:51.677592 | debian-bookworm | INFO [delegated > create] Executing 2026-07-20 06:48:51.680024 | debian-bookworm | WARNING [delegated > create] Executed: Missing playbook (Remove from converge_sequence to suppress) 2026-07-20 06:48:51.688918 | debian-bookworm | INFO [delegated > prepare] Executing 2026-07-20 06:48:51.689007 | debian-bookworm | WARNING [delegated > prepare] Skipping, instances already prepared. 2026-07-20 06:48:51.689107 | debian-bookworm | INFO [delegated > prepare] Executed: Successful 2026-07-20 06:48:51.696488 | debian-bookworm | INFO [delegated > converge] Executing 2026-07-20 06:48:52.420618 | ubuntu-noble | ansible-galaxy [core 2.19.11] 2026-07-20 06:48:52.421265 | ubuntu-noble | config file = None 2026-07-20 06:48:52.421762 | ubuntu-noble | configured module search path = ['/home/zuul/src/github.com/osism/ansible-collection-services/plugins/modules', '/home/zuul/.ansible/plugins/modules', '/usr/share/ansible/plugins/modules'] 2026-07-20 06:48:52.422186 | ubuntu-noble | ansible python module location = /home/zuul/venv/lib/python3.12/site-packages/ansible 2026-07-20 06:48:52.422682 | ubuntu-noble | ansible collection location = /home/zuul/.ansible/collections:/usr/share/ansible/collections:/home/zuul/venv/lib/python3.12/site-packages:/home/zuul/venv/lib/python3.12/dist-packages:/home/zuul/venv/lib/python3/dist-packages:/home/zuul/venv/local/lib/python3.12/dist-packages 2026-07-20 06:48:52.423072 | ubuntu-noble | executable location = /home/zuul/venv/bin/ansible-galaxy 2026-07-20 06:48:52.424044 | ubuntu-noble | python version = 3.12.3 (main, Jun 19 2026, 12:46:00) [GCC 13.3.0] (/home/zuul/venv/bin/python3) 2026-07-20 06:48:52.424523 | ubuntu-noble | jinja version = 3.1.6 2026-07-20 06:48:52.424906 | ubuntu-noble | pyyaml version = 6.0.3 (with libyaml v0.2.5) 2026-07-20 06:48:52.425305 | ubuntu-noble | No config file found; using defaults 2026-07-20 06:48:52.425876 | ubuntu-noble | Reading requirement file at '/home/zuul/src/github.com/osism/ansible-collection-services/molecule/delegated/collections.yml' 2026-07-20 06:48:52.436216 | ubuntu-noble | Loading collection ansible._protomatter from /home/zuul/venv/lib/python3.12/site-packages/ansible/_internal/ansible_collections/ansible/_protomatter 2026-07-20 06:48:52.436831 | ubuntu-noble | Found installed collection ansible._protomatter:2.19.11 at '/home/zuul/venv/lib/python3.12/site-packages/ansible/_internal/ansible_collections/ansible/_protomatter' 2026-07-20 06:48:52.450350 | ubuntu-noble | Loading collection vyos.vyos from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/vyos/vyos 2026-07-20 06:48:52.450406 | ubuntu-noble | Found installed collection vyos.vyos:6.0.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/vyos/vyos' 2026-07-20 06:48:52.450419 | ubuntu-noble | Loading collection splunk.es from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/splunk/es 2026-07-20 06:48:52.450541 | ubuntu-noble | Found installed collection splunk.es:4.0.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/splunk/es' 2026-07-20 06:48:52.451032 | ubuntu-noble | Loading collection community.postgresql from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/postgresql 2026-07-20 06:48:52.451462 | ubuntu-noble | Found installed collection community.postgresql:4.1.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/postgresql' 2026-07-20 06:48:52.453615 | ubuntu-noble | Loading collection vmware.vmware_rest from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/vmware/vmware_rest 2026-07-20 06:48:52.454039 | ubuntu-noble | Found installed collection vmware.vmware_rest:4.9.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/vmware/vmware_rest' 2026-07-20 06:48:52.455956 | ubuntu-noble | Loading collection azure.azcollection from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/azure/azcollection 2026-07-20 06:48:52.456460 | ubuntu-noble | Found installed collection azure.azcollection:3.10.1 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/azure/azcollection' 2026-07-20 06:48:52.457144 | ubuntu-noble | Loading collection netapp.ontap from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/netapp/ontap 2026-07-20 06:48:52.457580 | ubuntu-noble | Found installed collection netapp.ontap:23.2.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/netapp/ontap' 2026-07-20 06:48:52.457984 | ubuntu-noble | Loading collection community.proxmox from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/proxmox 2026-07-20 06:48:52.458372 | ubuntu-noble | Found installed collection community.proxmox:1.4.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/proxmox' 2026-07-20 06:48:52.458777 | ubuntu-noble | Loading collection community.rabbitmq from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/rabbitmq 2026-07-20 06:48:52.459127 | ubuntu-noble | Found installed collection community.rabbitmq:1.6.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/rabbitmq' 2026-07-20 06:48:52.459471 | ubuntu-noble | Loading collection netapp.storagegrid from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/netapp/storagegrid 2026-07-20 06:48:52.459966 | ubuntu-noble | Found installed collection netapp.storagegrid:21.15.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/netapp/storagegrid' 2026-07-20 06:48:52.460353 | ubuntu-noble | Loading collection ansible.netcommon from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/ansible/netcommon 2026-07-20 06:48:52.460686 | ubuntu-noble | Found installed collection ansible.netcommon:8.1.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/ansible/netcommon' 2026-07-20 06:48:52.462787 | ubuntu-noble | Loading collection fortinet.fortios from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/fortinet/fortios 2026-07-20 06:48:52.463176 | ubuntu-noble | Found installed collection fortinet.fortios:2.4.2 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/fortinet/fortios' 2026-07-20 06:48:52.463534 | ubuntu-noble | Loading collection vultr.cloud from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/vultr/cloud 2026-07-20 06:48:52.463863 | ubuntu-noble | Found installed collection vultr.cloud:1.13.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/vultr/cloud' 2026-07-20 06:48:52.465620 | ubuntu-noble | Loading collection dellemc.enterprise_sonic from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/dellemc/enterprise_sonic 2026-07-20 06:48:52.465974 | ubuntu-noble | Found installed collection dellemc.enterprise_sonic:3.2.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/dellemc/enterprise_sonic' 2026-07-20 06:48:52.466355 | ubuntu-noble | Loading collection chocolatey.chocolatey from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/chocolatey/chocolatey 2026-07-20 06:48:52.466628 | ubuntu-noble | Found installed collection chocolatey.chocolatey:1.5.3 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/chocolatey/chocolatey' 2026-07-20 06:48:52.466951 | ubuntu-noble | Loading collection community.libvirt from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/libvirt 2026-07-20 06:48:52.467236 | ubuntu-noble | Found installed collection community.libvirt:2.0.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/libvirt' 2026-07-20 06:48:52.468315 | ubuntu-noble | Loading collection inspur.ispim from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/inspur/ispim 2026-07-20 06:48:52.468340 | ubuntu-noble | Found installed collection inspur.ispim:2.2.3 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/inspur/ispim' 2026-07-20 06:48:52.468349 | ubuntu-noble | Loading collection cisco.intersight from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/cisco/intersight 2026-07-20 06:48:52.468382 | ubuntu-noble | Found installed collection cisco.intersight:2.7.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/cisco/intersight' 2026-07-20 06:48:52.470344 | ubuntu-noble | Loading collection hetzner.hcloud from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/hetzner/hcloud 2026-07-20 06:48:52.470415 | ubuntu-noble | Found installed collection hetzner.hcloud:5.4.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/hetzner/hcloud' 2026-07-20 06:48:52.470597 | ubuntu-noble | Loading collection ansible.windows from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/ansible/windows 2026-07-20 06:48:52.471016 | ubuntu-noble | Found installed collection ansible.windows:3.2.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/ansible/windows' 2026-07-20 06:48:52.471670 | ubuntu-noble | Loading collection dellemc.openmanage from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/dellemc/openmanage 2026-07-20 06:48:52.472068 | ubuntu-noble | Found installed collection dellemc.openmanage:9.12.3 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/dellemc/openmanage' 2026-07-20 06:48:52.472497 | ubuntu-noble | Loading collection arista.eos from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/arista/eos 2026-07-20 06:48:52.472990 | ubuntu-noble | Found installed collection arista.eos:12.0.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/arista/eos' 2026-07-20 06:48:52.473415 | ubuntu-noble | Loading collection community.crypto from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/crypto 2026-07-20 06:48:52.473786 | ubuntu-noble | Found installed collection community.crypto:3.0.5 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/crypto' 2026-07-20 06:48:52.475960 | ubuntu-noble | Loading collection community.aws from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/aws 2026-07-20 06:48:52.476463 | ubuntu-noble | Found installed collection community.aws:10.0.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/aws' 2026-07-20 06:48:52.476875 | ubuntu-noble | Loading collection kubernetes.core from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/kubernetes/core 2026-07-20 06:48:52.477552 | ubuntu-noble | Found installed collection kubernetes.core:6.2.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/kubernetes/core' 2026-07-20 06:48:52.477978 | ubuntu-noble | Loading collection ansible.utils from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/ansible/utils 2026-07-20 06:48:52.478760 | ubuntu-noble | Found installed collection ansible.utils:6.0.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/ansible/utils' 2026-07-20 06:48:52.480415 | ubuntu-noble | Loading collection microsoft.iis from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/microsoft/iis 2026-07-20 06:48:52.480446 | ubuntu-noble | Found installed collection microsoft.iis:1.0.3 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/microsoft/iis' 2026-07-20 06:48:52.480454 | ubuntu-noble | Loading collection cyberark.pas from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/cyberark/pas 2026-07-20 06:48:52.480488 | ubuntu-noble | Found installed collection cyberark.pas:1.0.36 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/cyberark/pas' 2026-07-20 06:48:52.481039 | ubuntu-noble | Loading collection netapp_eseries.santricity from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/netapp_eseries/santricity 2026-07-20 06:48:52.481393 | ubuntu-noble | Found installed collection netapp_eseries.santricity:1.4.1 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/netapp_eseries/santricity' 2026-07-20 06:48:52.481672 | ubuntu-noble | Loading collection cisco.dnac from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/cisco/dnac 2026-07-20 06:48:52.481941 | ubuntu-noble | Found installed collection cisco.dnac:6.41.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/cisco/dnac' 2026-07-20 06:48:52.482345 | ubuntu-noble | Loading collection kaytus.ksmanage from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/kaytus/ksmanage 2026-07-20 06:48:52.482579 | ubuntu-noble | Found installed collection kaytus.ksmanage:2.0.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/kaytus/ksmanage' 2026-07-20 06:48:52.482820 | ubuntu-noble | Loading collection community.grafana from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/grafana 2026-07-20 06:48:52.483040 | ubuntu-noble | Found installed collection community.grafana:2.3.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/grafana' 2026-07-20 06:48:52.483294 | ubuntu-noble | Loading collection community.hrobot from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/hrobot 2026-07-20 06:48:52.483576 | ubuntu-noble | Found installed collection community.hrobot:2.7.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/hrobot' 2026-07-20 06:48:52.483848 | ubuntu-noble | Loading collection theforeman.foreman from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/theforeman/foreman 2026-07-20 06:48:52.484068 | ubuntu-noble | Found installed collection theforeman.foreman:5.7.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/theforeman/foreman' 2026-07-20 06:48:52.484330 | ubuntu-noble | Loading collection ansible.posix from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/ansible/posix 2026-07-20 06:48:52.484558 | ubuntu-noble | Found installed collection ansible.posix:2.1.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/ansible/posix' 2026-07-20 06:48:52.484952 | ubuntu-noble | Loading collection cisco.meraki from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/cisco/meraki 2026-07-20 06:48:52.485267 | ubuntu-noble | Found installed collection cisco.meraki:2.21.8 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/cisco/meraki' 2026-07-20 06:48:52.485558 | ubuntu-noble | Loading collection community.ciscosmb from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/ciscosmb 2026-07-20 06:48:52.485822 | ubuntu-noble | Found installed collection community.ciscosmb:1.0.11 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/ciscosmb' 2026-07-20 06:48:52.486423 | ubuntu-noble | Loading collection cisco.iosxr from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/cisco/iosxr 2026-07-20 06:48:52.486697 | ubuntu-noble | Found installed collection cisco.iosxr:12.1.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/cisco/iosxr' 2026-07-20 06:48:52.486951 | ubuntu-noble | Loading collection community.sops from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/sops 2026-07-20 06:48:52.487227 | ubuntu-noble | Found installed collection community.sops:2.2.7 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/sops' 2026-07-20 06:48:52.488301 | ubuntu-noble | Loading collection vmware.vmware from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/vmware/vmware 2026-07-20 06:48:52.488331 | ubuntu-noble | Found installed collection vmware.vmware:2.4.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/vmware/vmware' 2026-07-20 06:48:52.488338 | ubuntu-noble | Loading collection ieisystem.inmanage from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/ieisystem/inmanage 2026-07-20 06:48:52.488344 | ubuntu-noble | Found installed collection ieisystem.inmanage:3.0.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/ieisystem/inmanage' 2026-07-20 06:48:52.488544 | ubuntu-noble | Loading collection ibm.storage_virtualize from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/ibm/storage_virtualize 2026-07-20 06:48:52.488781 | ubuntu-noble | Found installed collection ibm.storage_virtualize:2.7.4 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/ibm/storage_virtualize' 2026-07-20 06:48:52.494024 | ubuntu-noble | Loading collection fortinet.fortimanager from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/fortinet/fortimanager 2026-07-20 06:48:52.494336 | ubuntu-noble | Found installed collection fortinet.fortimanager:2.11.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/fortinet/fortimanager' 2026-07-20 06:48:52.496671 | ubuntu-noble | Loading collection awx.awx from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/awx/awx 2026-07-20 06:48:52.496955 | ubuntu-noble | Found installed collection awx.awx:24.6.1 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/awx/awx' 2026-07-20 06:48:52.497664 | ubuntu-noble | Loading collection dellemc.unity from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/dellemc/unity 2026-07-20 06:48:52.497916 | ubuntu-noble | Found installed collection dellemc.unity:2.1.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/dellemc/unity' 2026-07-20 06:48:52.498176 | ubuntu-noble | Loading collection ravendb.ravendb from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/ravendb/ravendb 2026-07-20 06:48:52.498433 | ubuntu-noble | Found installed collection ravendb.ravendb:1.0.4 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/ravendb/ravendb' 2026-07-20 06:48:52.499332 | ubuntu-noble | Loading collection community.digitalocean from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/digitalocean 2026-07-20 06:48:52.499643 | ubuntu-noble | Found installed collection community.digitalocean:1.27.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/digitalocean' 2026-07-20 06:48:52.499950 | ubuntu-noble | Loading collection community.hashi_vault from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/hashi_vault 2026-07-20 06:48:52.500213 | ubuntu-noble | Found installed collection community.hashi_vault:7.1.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/hashi_vault' 2026-07-20 06:48:52.501847 | ubuntu-noble | Loading collection cisco.aci from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/cisco/aci 2026-07-20 06:48:52.502142 | ubuntu-noble | Found installed collection cisco.aci:2.12.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/cisco/aci' 2026-07-20 06:48:52.502424 | ubuntu-noble | Loading collection infoblox.nios_modules from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/infoblox/nios_modules 2026-07-20 06:48:52.502675 | ubuntu-noble | Found installed collection infoblox.nios_modules:1.8.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/infoblox/nios_modules' 2026-07-20 06:48:52.502911 | ubuntu-noble | Loading collection infinidat.infinibox from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/infinidat/infinibox 2026-07-20 06:48:52.503169 | ubuntu-noble | Found installed collection infinidat.infinibox:1.6.3 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/infinidat/infinibox' 2026-07-20 06:48:52.503430 | ubuntu-noble | Loading collection community.library_inventory_filtering_v1 from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/library_inventory_filtering_v1 2026-07-20 06:48:52.503678 | ubuntu-noble | Found installed collection community.library_inventory_filtering_v1:1.1.5 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/library_inventory_filtering_v1' 2026-07-20 06:48:52.094824 | debian-bookworm | DEBUG [delegated > converge] ansible-playbook version: ansible-playbook 2026-07-20 06:48:52.094870 | debian-bookworm | config file = None 2026-07-20 06:48:52.094875 | debian-bookworm | configured module search path = 2026-07-20 06:48:52.094880 | debian-bookworm | ansible python module location = /home/zuul/venv/lib/python3.11/site-packages/ansible 2026-07-20 06:48:52.094884 | debian-bookworm | ansible collection location = /home/zuul/.ansible/collections:/usr/share/ansible/collections 2026-07-20 06:48:52.094888 | debian-bookworm | executable location = /home/zuul/venv/bin/ansible-playbook 2026-07-20 06:48:52.094892 | debian-bookworm | python version = 3.11.2 (main, May 12 2026, 05:17:27) (/home/zuul/venv/bin/python3) 2026-07-20 06:48:52.094896 | debian-bookworm | jinja version = 3.1.6 2026-07-20 06:48:52.094901 | debian-bookworm | pyyaml version = 6.0.3 (with libyaml v0.2.5) 2026-07-20 06:48:52.095137 | debian-bookworm | DEBUG ANSIBLE ENVIRONMENT: 2026-07-20 06:48:52.095143 | debian-bookworm | ANSIBLE_COLLECTIONS_PATH: /home/zuul/venv/.ansible/collections:/home/zuul/.ansible/collections 2026-07-20 06:48:52.095148 | debian-bookworm | ANSIBLE_CONFIG: /home/zuul/.ansible/tmp/molecule.oWZD.delegated/ansible.cfg 2026-07-20 06:48:52.095151 | debian-bookworm | ANSIBLE_LIBRARY: ../../plugins 2026-07-20 06:48:52.095155 | debian-bookworm | ANSIBLE_PYTHON_INTERPRETER: /home/zuul/venv/bin/python 2026-07-20 06:48:52.095159 | debian-bookworm | ANSIBLE_ROLE: auditd 2026-07-20 06:48:52.095163 | debian-bookworm | ANSIBLE_ROLES_PATH: ../../roles 2026-07-20 06:48:52.095167 | debian-bookworm | ANSIBLE_VERBOSITY: 1 2026-07-20 06:48:52.095171 | debian-bookworm | 2026-07-20 06:48:52.095373 | debian-bookworm | DEBUG MOLECULE ENVIRONMENT: 2026-07-20 06:48:52.095379 | debian-bookworm | MOLECULE_DEBUG: True 2026-07-20 06:48:52.095383 | debian-bookworm | MOLECULE_DEPENDENCY_NAME: galaxy 2026-07-20 06:48:52.095387 | debian-bookworm | MOLECULE_DRIVER_NAME: default 2026-07-20 06:48:52.095391 | debian-bookworm | MOLECULE_ENV_FILE: /home/zuul/src/github.com/osism/ansible-collection-services/.env.yml 2026-07-20 06:48:52.095395 | debian-bookworm | MOLECULE_EPHEMERAL_DIRECTORY: /home/zuul/.ansible/tmp/molecule.oWZD.delegated 2026-07-20 06:48:52.095399 | debian-bookworm | MOLECULE_FILE: /home/zuul/.ansible/tmp/molecule.oWZD.delegated/molecule.yml 2026-07-20 06:48:52.095403 | debian-bookworm | MOLECULE_INSTANCE_CONFIG: /home/zuul/.ansible/tmp/molecule.oWZD.delegated/instance_config.yml 2026-07-20 06:48:52.095407 | debian-bookworm | MOLECULE_INVENTORY_FILE: /home/zuul/.ansible/tmp/molecule.oWZD.delegated/inventory/ansible_inventory.yml 2026-07-20 06:48:52.095411 | debian-bookworm | MOLECULE_PROJECT_DIRECTORY: /home/zuul/src/github.com/osism/ansible-collection-services 2026-07-20 06:48:52.095415 | debian-bookworm | MOLECULE_PROVISIONER_NAME: ansible 2026-07-20 06:48:52.095419 | debian-bookworm | MOLECULE_SCENARIO_DIRECTORY: /home/zuul/src/github.com/osism/ansible-collection-services/molecule/delegated 2026-07-20 06:48:52.095422 | debian-bookworm | MOLECULE_SCENARIO_NAME: delegated 2026-07-20 06:48:52.095426 | debian-bookworm | MOLECULE_STATE_FILE: /home/zuul/.ansible/tmp/molecule.oWZD.delegated/state.yml 2026-07-20 06:48:52.095430 | debian-bookworm | MOLECULE_VERIFIER_NAME: testinfra 2026-07-20 06:48:52.095434 | debian-bookworm | MOLECULE_VERIFIER_TEST_DIRECTORY: /home/zuul/src/github.com/osism/ansible-collection-services/molecule/delegated/tests 2026-07-20 06:48:52.095440 | debian-bookworm | 2026-07-20 06:48:52.095592 | debian-bookworm | DEBUG SHELL REPLAY: ANSIBLE_COLLECTIONS_PATH=/home/zuul/venv/.ansible/collections:/home/zuul/.ansible/collections ANSIBLE_CONFIG=/home/zuul/.ansible/tmp/molecule.oWZD.delegated/ansible.cfg ANSIBLE_LIBRARY=../../plugins ANSIBLE_PYTHON_INTERPRETER=/home/zuul/venv/bin/python ANSIBLE_ROLE=auditd ANSIBLE_ROLES_PATH=../../roles ANSIBLE_VERBOSITY=1 MOLECULE_DEBUG=True MOLECULE_DEPENDENCY_NAME=galaxy MOLECULE_DRIVER_NAME=default MOLECULE_ENV_FILE=/home/zuul/src/github.com/osism/ansible-collection-services/.env.yml MOLECULE_EPHEMERAL_DIRECTORY=/home/zuul/.ansible/tmp/molecule.oWZD.delegated MOLECULE_FILE=/home/zuul/.ansible/tmp/molecule.oWZD.delegated/molecule.yml MOLECULE_INSTANCE_CONFIG=/home/zuul/.ansible/tmp/molecule.oWZD.delegated/instance_config.yml MOLECULE_INVENTORY_FILE=/home/zuul/.ansible/tmp/molecule.oWZD.delegated/inventory/ansible_inventory.yml MOLECULE_PROJECT_DIRECTORY=/home/zuul/src/github.com/osism/ansible-collection-services MOLECULE_PROVISIONER_NAME=ansible MOLECULE_SCENARIO_DIRECTORY=/home/zuul/src/github.com/osism/ansible-collection-services/molecule/delegated MOLECULE_SCENARIO_NAME=delegated MOLECULE_STATE_FILE=/home/zuul/.ansible/tmp/molecule.oWZD.delegated/state.yml MOLECULE_VERIFIER_NAME=testinfra MOLECULE_VERIFIER_TEST_DIRECTORY=/home/zuul/src/github.com/osism/ansible-collection-services/molecule/delegated/tests 2026-07-20 06:48:52.441877 | debian-bookworm | Using /home/zuul/.ansible/tmp/molecule.oWZD.delegated/ansible.cfg as config file 2026-07-20 06:48:52.504476 | ubuntu-noble | Loading collection openstack.cloud from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/openstack/cloud 2026-07-20 06:48:52.504834 | ubuntu-noble | Found installed collection openstack.cloud:2.5.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/openstack/cloud' 2026-07-20 06:48:52.505051 | ubuntu-noble | Loading collection wti.remote from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/wti/remote 2026-07-20 06:48:52.505700 | ubuntu-noble | Found installed collection wti.remote:1.0.10 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/wti/remote' 2026-07-20 06:48:52.505717 | ubuntu-noble | Loading collection lowlydba.sqlserver from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/lowlydba/sqlserver 2026-07-20 06:48:52.505723 | ubuntu-noble | Found installed collection lowlydba.sqlserver:2.7.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/lowlydba/sqlserver' 2026-07-20 06:48:52.506020 | ubuntu-noble | Loading collection community.mongodb from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/mongodb 2026-07-20 06:48:52.506317 | ubuntu-noble | Found installed collection community.mongodb:1.7.10 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/mongodb' 2026-07-20 06:48:52.507333 | ubuntu-noble | Loading collection junipernetworks.junos from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/junipernetworks/junos 2026-07-20 06:48:52.507634 | ubuntu-noble | Found installed collection junipernetworks.junos:11.0.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/junipernetworks/junos' 2026-07-20 06:48:52.509092 | ubuntu-noble | Loading collection community.vmware from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/vmware 2026-07-20 06:48:52.509827 | ubuntu-noble | Found installed collection community.vmware:5.10.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/vmware' 2026-07-20 06:48:52.511321 | ubuntu-noble | Loading collection amazon.aws from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/amazon/aws 2026-07-20 06:48:52.511352 | ubuntu-noble | Found installed collection amazon.aws:10.1.2 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/amazon/aws' 2026-07-20 06:48:52.511675 | ubuntu-noble | Loading collection telekom_mms.icinga_director from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/telekom_mms/icinga_director 2026-07-20 06:48:52.512004 | ubuntu-noble | Found installed collection telekom_mms.icinga_director:2.4.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/telekom_mms/icinga_director' 2026-07-20 06:48:52.512622 | ubuntu-noble | Loading collection cloudscale_ch.cloud from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/cloudscale_ch/cloud 2026-07-20 06:48:52.512913 | ubuntu-noble | Found installed collection cloudscale_ch.cloud:2.5.2 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/cloudscale_ch/cloud' 2026-07-20 06:48:52.513208 | ubuntu-noble | Loading collection kubevirt.core from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/kubevirt/core 2026-07-20 06:48:52.513517 | ubuntu-noble | Found installed collection kubevirt.core:2.2.3 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/kubevirt/core' 2026-07-20 06:48:52.514860 | ubuntu-noble | Loading collection cisco.nxos from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/cisco/nxos 2026-07-20 06:48:52.515180 | ubuntu-noble | Found installed collection cisco.nxos:11.0.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/cisco/nxos' 2026-07-20 06:48:52.515484 | ubuntu-noble | Loading collection cyberark.conjur from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/cyberark/conjur 2026-07-20 06:48:52.515777 | ubuntu-noble | Found installed collection cyberark.conjur:1.3.8 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/cyberark/conjur' 2026-07-20 06:48:52.516054 | ubuntu-noble | Loading collection community.okd from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/okd 2026-07-20 06:48:52.517418 | ubuntu-noble | Found installed collection community.okd:5.0.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/okd' 2026-07-20 06:48:52.517444 | ubuntu-noble | Loading collection cisco.ucs from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/cisco/ucs 2026-07-20 06:48:52.517451 | ubuntu-noble | Found installed collection cisco.ucs:1.16.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/cisco/ucs' 2026-07-20 06:48:52.517458 | ubuntu-noble | Loading collection hitachivantara.vspone_block from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/hitachivantara/vspone_block 2026-07-20 06:48:52.517464 | ubuntu-noble | Found installed collection hitachivantara.vspone_block:4.4.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/hitachivantara/vspone_block' 2026-07-20 06:48:52.518103 | ubuntu-noble | Loading collection ovirt.ovirt from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/ovirt/ovirt 2026-07-20 06:48:52.518125 | ubuntu-noble | Found installed collection ovirt.ovirt:3.2.1 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/ovirt/ovirt' 2026-07-20 06:48:52.518704 | ubuntu-noble | Loading collection netbox.netbox from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/netbox/netbox 2026-07-20 06:48:52.518922 | ubuntu-noble | Found installed collection netbox.netbox:3.21.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/netbox/netbox' 2026-07-20 06:48:52.519308 | ubuntu-noble | Loading collection community.zabbix from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/zabbix 2026-07-20 06:48:52.519539 | ubuntu-noble | Found installed collection community.zabbix:4.1.1 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/zabbix' 2026-07-20 06:48:52.519879 | ubuntu-noble | Loading collection f5networks.f5_modules from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/f5networks/f5_modules 2026-07-20 06:48:52.520091 | ubuntu-noble | Found installed collection f5networks.f5_modules:1.39.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/f5networks/f5_modules' 2026-07-20 06:48:52.520381 | ubuntu-noble | Loading collection community.sap_libs from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/sap_libs 2026-07-20 06:48:52.520615 | ubuntu-noble | Found installed collection community.sap_libs:1.5.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/sap_libs' 2026-07-20 06:48:52.521741 | ubuntu-noble | Loading collection google.cloud from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/google/cloud 2026-07-20 06:48:52.522202 | ubuntu-noble | Found installed collection google.cloud:1.9.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/google/cloud' 2026-07-20 06:48:52.522215 | ubuntu-noble | Loading collection community.proxysql from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/proxysql 2026-07-20 06:48:52.522495 | ubuntu-noble | Found installed collection community.proxysql:1.7.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/proxysql' 2026-07-20 06:48:52.522727 | ubuntu-noble | Loading collection purestorage.flashblade from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/purestorage/flashblade 2026-07-20 06:48:52.522961 | ubuntu-noble | Found installed collection purestorage.flashblade:1.22.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/purestorage/flashblade' 2026-07-20 06:48:52.523455 | ubuntu-noble | Loading collection ibm.qradar from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/ibm/qradar 2026-07-20 06:48:52.523695 | ubuntu-noble | Found installed collection ibm.qradar:4.0.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/ibm/qradar' 2026-07-20 06:48:52.523902 | ubuntu-noble | Loading collection community.mysql from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/mysql 2026-07-20 06:48:52.524184 | ubuntu-noble | Found installed collection community.mysql:3.16.1 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/mysql' 2026-07-20 06:48:52.524417 | ubuntu-noble | Loading collection netapp.cloudmanager from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/netapp/cloudmanager 2026-07-20 06:48:52.524678 | ubuntu-noble | Found installed collection netapp.cloudmanager:21.24.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/netapp/cloudmanager' 2026-07-20 06:48:52.524911 | ubuntu-noble | Loading collection grafana.grafana from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/grafana/grafana 2026-07-20 06:48:52.525211 | ubuntu-noble | Found installed collection grafana.grafana:6.0.6 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/grafana/grafana' 2026-07-20 06:48:52.525592 | ubuntu-noble | Loading collection community.dns from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/dns 2026-07-20 06:48:52.525813 | ubuntu-noble | Found installed collection community.dns:3.4.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/dns' 2026-07-20 06:48:52.526414 | ubuntu-noble | Loading collection ngine_io.cloudstack from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/ngine_io/cloudstack 2026-07-20 06:48:52.526646 | ubuntu-noble | Found installed collection ngine_io.cloudstack:2.5.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/ngine_io/cloudstack' 2026-07-20 06:48:52.527646 | ubuntu-noble | Loading collection cisco.ios from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/cisco/ios 2026-07-20 06:48:52.527848 | ubuntu-noble | Found installed collection cisco.ios:11.1.1 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/cisco/ios' 2026-07-20 06:48:52.528146 | ubuntu-noble | Loading collection containers.podman from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/containers/podman 2026-07-20 06:48:52.528408 | ubuntu-noble | Found installed collection containers.podman:1.18.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/containers/podman' 2026-07-20 06:48:52.529793 | ubuntu-noble | Loading collection cisco.mso from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/cisco/mso 2026-07-20 06:48:52.530030 | ubuntu-noble | Found installed collection cisco.mso:2.11.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/cisco/mso' 2026-07-20 06:48:52.530322 | ubuntu-noble | Loading collection microsoft.ad from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/microsoft/ad 2026-07-20 06:48:52.530580 | ubuntu-noble | Found installed collection microsoft.ad:1.9.2 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/microsoft/ad' 2026-07-20 06:48:52.530750 | ubuntu-noble | Loading collection hitachivantara.vspone_object from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/hitachivantara/vspone_object 2026-07-20 06:48:52.530990 | ubuntu-noble | Found installed collection hitachivantara.vspone_object:1.0.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/hitachivantara/vspone_object' 2026-07-20 06:48:52.541566 | ubuntu-noble | Loading collection community.general from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/general 2026-07-20 06:48:52.541786 | ubuntu-noble | Found installed collection community.general:11.4.1 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/general' 2026-07-20 06:48:52.542318 | ubuntu-noble | Loading collection check_point.mgmt from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/check_point/mgmt 2026-07-20 06:48:52.542876 | ubuntu-noble | Found installed collection check_point.mgmt:6.6.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/check_point/mgmt' 2026-07-20 06:48:52.542890 | ubuntu-noble | Loading collection community.routeros from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/routeros 2026-07-20 06:48:52.543140 | ubuntu-noble | Found installed collection community.routeros:3.13.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/routeros' 2026-07-20 06:48:52.544852 | ubuntu-noble | Loading collection community.windows from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/windows 2026-07-20 06:48:52.545194 | ubuntu-noble | Found installed collection community.windows:3.0.1 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/windows' 2026-07-20 06:48:52.545639 | ubuntu-noble | Loading collection community.docker from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/docker 2026-07-20 06:48:52.545890 | ubuntu-noble | Found installed collection community.docker:4.8.2 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/docker' 2026-07-20 06:48:52.546359 | ubuntu-noble | Loading collection dellemc.powerflex from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/dellemc/powerflex 2026-07-20 06:48:52.546610 | ubuntu-noble | Found installed collection dellemc.powerflex:2.6.1 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/dellemc/powerflex' 2026-07-20 06:48:52.547089 | ubuntu-noble | Loading collection purestorage.flasharray from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/purestorage/flasharray 2026-07-20 06:48:52.547101 | ubuntu-noble | Found installed collection purestorage.flasharray:1.39.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/purestorage/flasharray' 2026-07-20 06:48:52.559962 | ubuntu-noble | Loading collection osism.commons from /home/zuul/.ansible/collections/ansible_collections/osism/commons 2026-07-20 06:48:52.561501 | ubuntu-noble | Found installed collection osism.commons:0.20260712.0 at '/home/zuul/.ansible/collections/ansible_collections/osism/commons' 2026-07-20 06:48:52.563085 | ubuntu-noble | Loading collection osism.services from /home/zuul/.ansible/collections/ansible_collections/osism/services 2026-07-20 06:48:52.563117 | ubuntu-noble | Found installed collection osism.services:999.0.0 at '/home/zuul/.ansible/collections/ansible_collections/osism/services' 2026-07-20 06:48:52.563964 | ubuntu-noble | Starting galaxy collection install process 2026-07-20 06:48:52.563992 | ubuntu-noble | Nothing to do. All requested collections are already installed. If you want to reinstall them, consider using `--force`. 2026-07-20 06:48:52.662349 | ubuntu-noble | INFO [delegated > dependency] Dependency completed successfully. 2026-07-20 06:48:52.664354 | ubuntu-noble | WARNING [delegated > dependency] Executed: Missing roles requirements file: requirements.yml (Remove from converge_sequence to suppress) 2026-07-20 06:48:52.680897 | ubuntu-noble | INFO [delegated > create] Executing 2026-07-20 06:48:52.683799 | ubuntu-noble | WARNING [delegated > create] Executed: Missing playbook (Remove from converge_sequence to suppress) 2026-07-20 06:48:52.694056 | ubuntu-noble | INFO [delegated > prepare] Executing 2026-07-20 06:48:52.694269 | ubuntu-noble | WARNING [delegated > prepare] Skipping, instances already prepared. 2026-07-20 06:48:52.694385 | ubuntu-noble | INFO [delegated > prepare] Executed: Successful 2026-07-20 06:48:52.702629 | ubuntu-noble | INFO [delegated > converge] Executing 2026-07-20 06:48:52.643595 | debian-bookworm | 2026-07-20 06:48:52.643910 | debian-bookworm | PLAY [Converge] **************************************************************** 2026-07-20 06:48:52.644230 | debian-bookworm | 2026-07-20 06:48:52.644592 | debian-bookworm | TASK [Gathering Facts] ********************************************************* 2026-07-20 06:48:53.234350 | ubuntu-noble | DEBUG [delegated > converge] ansible-playbook version: ansible-playbook 2026-07-20 06:48:53.234414 | ubuntu-noble | config file = None 2026-07-20 06:48:53.234420 | ubuntu-noble | configured module search path = 2026-07-20 06:48:53.234424 | ubuntu-noble | ansible python module location = /home/zuul/venv/lib/python3.12/site-packages/ansible 2026-07-20 06:48:53.234429 | ubuntu-noble | ansible collection location = /home/zuul/.ansible/collections:/usr/share/ansible/collections 2026-07-20 06:48:53.234433 | ubuntu-noble | executable location = /home/zuul/venv/bin/ansible-playbook 2026-07-20 06:48:53.234437 | ubuntu-noble | python version = 3.12.3 (main, Jun 19 2026, 12:46:00) (/home/zuul/venv/bin/python3) 2026-07-20 06:48:53.234441 | ubuntu-noble | jinja version = 3.1.6 2026-07-20 06:48:53.234444 | ubuntu-noble | pyyaml version = 6.0.3 (with libyaml v0.2.5) 2026-07-20 06:48:53.234972 | ubuntu-noble | DEBUG ANSIBLE ENVIRONMENT: 2026-07-20 06:48:53.234978 | ubuntu-noble | ANSIBLE_COLLECTIONS_PATH: /home/zuul/venv/.ansible/collections:/home/zuul/.ansible/collections 2026-07-20 06:48:53.234982 | ubuntu-noble | ANSIBLE_CONFIG: /home/zuul/.ansible/tmp/molecule.oWZD.delegated/ansible.cfg 2026-07-20 06:48:53.234985 | ubuntu-noble | ANSIBLE_LIBRARY: ../../plugins 2026-07-20 06:48:53.234989 | ubuntu-noble | ANSIBLE_PYTHON_INTERPRETER: /home/zuul/venv/bin/python 2026-07-20 06:48:53.234992 | ubuntu-noble | ANSIBLE_ROLE: auditd 2026-07-20 06:48:53.234996 | ubuntu-noble | ANSIBLE_ROLES_PATH: ../../roles 2026-07-20 06:48:53.234999 | ubuntu-noble | ANSIBLE_VERBOSITY: 1 2026-07-20 06:48:53.235003 | ubuntu-noble | 2026-07-20 06:48:53.235420 | ubuntu-noble | DEBUG MOLECULE ENVIRONMENT: 2026-07-20 06:48:53.235437 | ubuntu-noble | MOLECULE_DEBUG: True 2026-07-20 06:48:53.235441 | ubuntu-noble | MOLECULE_DEPENDENCY_NAME: galaxy 2026-07-20 06:48:53.235446 | ubuntu-noble | MOLECULE_DRIVER_NAME: default 2026-07-20 06:48:53.235450 | ubuntu-noble | MOLECULE_ENV_FILE: /home/zuul/src/github.com/osism/ansible-collection-services/.env.yml 2026-07-20 06:48:53.235454 | ubuntu-noble | MOLECULE_EPHEMERAL_DIRECTORY: /home/zuul/.ansible/tmp/molecule.oWZD.delegated 2026-07-20 06:48:53.235469 | ubuntu-noble | MOLECULE_FILE: /home/zuul/.ansible/tmp/molecule.oWZD.delegated/molecule.yml 2026-07-20 06:48:53.235473 | ubuntu-noble | MOLECULE_INSTANCE_CONFIG: /home/zuul/.ansible/tmp/molecule.oWZD.delegated/instance_config.yml 2026-07-20 06:48:53.235476 | ubuntu-noble | MOLECULE_INVENTORY_FILE: /home/zuul/.ansible/tmp/molecule.oWZD.delegated/inventory/ansible_inventory.yml 2026-07-20 06:48:53.235482 | ubuntu-noble | MOLECULE_PROJECT_DIRECTORY: /home/zuul/src/github.com/osism/ansible-collection-services 2026-07-20 06:48:53.235487 | ubuntu-noble | MOLECULE_PROVISIONER_NAME: ansible 2026-07-20 06:48:53.235490 | ubuntu-noble | MOLECULE_SCENARIO_DIRECTORY: /home/zuul/src/github.com/osism/ansible-collection-services/molecule/delegated 2026-07-20 06:48:53.235494 | ubuntu-noble | MOLECULE_SCENARIO_NAME: delegated 2026-07-20 06:48:53.235497 | ubuntu-noble | MOLECULE_STATE_FILE: /home/zuul/.ansible/tmp/molecule.oWZD.delegated/state.yml 2026-07-20 06:48:53.235501 | ubuntu-noble | MOLECULE_VERIFIER_NAME: testinfra 2026-07-20 06:48:53.235504 | ubuntu-noble | MOLECULE_VERIFIER_TEST_DIRECTORY: /home/zuul/src/github.com/osism/ansible-collection-services/molecule/delegated/tests 2026-07-20 06:48:53.235508 | ubuntu-noble | 2026-07-20 06:48:53.235767 | ubuntu-noble | DEBUG SHELL REPLAY: ANSIBLE_COLLECTIONS_PATH=/home/zuul/venv/.ansible/collections:/home/zuul/.ansible/collections ANSIBLE_CONFIG=/home/zuul/.ansible/tmp/molecule.oWZD.delegated/ansible.cfg ANSIBLE_LIBRARY=../../plugins ANSIBLE_PYTHON_INTERPRETER=/home/zuul/venv/bin/python ANSIBLE_ROLE=auditd ANSIBLE_ROLES_PATH=../../roles ANSIBLE_VERBOSITY=1 MOLECULE_DEBUG=True MOLECULE_DEPENDENCY_NAME=galaxy MOLECULE_DRIVER_NAME=default MOLECULE_ENV_FILE=/home/zuul/src/github.com/osism/ansible-collection-services/.env.yml MOLECULE_EPHEMERAL_DIRECTORY=/home/zuul/.ansible/tmp/molecule.oWZD.delegated MOLECULE_FILE=/home/zuul/.ansible/tmp/molecule.oWZD.delegated/molecule.yml MOLECULE_INSTANCE_CONFIG=/home/zuul/.ansible/tmp/molecule.oWZD.delegated/instance_config.yml MOLECULE_INVENTORY_FILE=/home/zuul/.ansible/tmp/molecule.oWZD.delegated/inventory/ansible_inventory.yml MOLECULE_PROJECT_DIRECTORY=/home/zuul/src/github.com/osism/ansible-collection-services MOLECULE_PROVISIONER_NAME=ansible MOLECULE_SCENARIO_DIRECTORY=/home/zuul/src/github.com/osism/ansible-collection-services/molecule/delegated MOLECULE_SCENARIO_NAME=delegated MOLECULE_STATE_FILE=/home/zuul/.ansible/tmp/molecule.oWZD.delegated/state.yml MOLECULE_VERIFIER_NAME=testinfra MOLECULE_VERIFIER_TEST_DIRECTORY=/home/zuul/src/github.com/osism/ansible-collection-services/molecule/delegated/tests 2026-07-20 06:48:53.678393 | ubuntu-noble | Using /home/zuul/.ansible/tmp/molecule.oWZD.delegated/ansible.cfg as config file 2026-07-20 06:48:53.948683 | ubuntu-noble | 2026-07-20 06:48:53.948745 | ubuntu-noble | PLAY [Converge] **************************************************************** 2026-07-20 06:48:53.948787 | ubuntu-noble | 2026-07-20 06:48:53.948794 | ubuntu-noble | TASK [Gathering Facts] ********************************************************* 2026-07-20 06:48:53.753382 | debian-bookworm | ok: [molecule-auditd] 2026-07-20 06:48:53.753541 | debian-bookworm | 2026-07-20 06:48:53.753729 | debian-bookworm | TASK [Include required variables] ********************************************** 2026-07-20 06:48:53.776638 | debian-bookworm | ok: [molecule-auditd] => {"ansible_facts": {}, "ansible_included_var_files": ["/home/zuul/src/github.com/osism/ansible-collection-services/molecule/delegated/vars/auditd.yml"], "changed": false} 2026-07-20 06:48:53.776789 | debian-bookworm | 2026-07-20 06:48:53.776957 | debian-bookworm | TASK [Include role auditd] ***************************************************** 2026-07-20 06:48:53.818002 | debian-bookworm | included: auditd for molecule-auditd 2026-07-20 06:48:53.818171 | debian-bookworm | 2026-07-20 06:48:53.818334 | debian-bookworm | TASK [auditd : Include distribution specific install tasks] ******************** 2026-07-20 06:48:53.858221 | debian-bookworm | included: /home/zuul/src/github.com/osism/ansible-collection-services/roles/auditd/tasks/install-Debian-family.yml for molecule-auditd 2026-07-20 06:48:53.858509 | debian-bookworm | 2026-07-20 06:48:53.858821 | debian-bookworm | TASK [auditd : Install auditd package] ***************************************** 2026-07-20 06:48:55.342024 | ubuntu-noble | ok: [molecule-auditd] 2026-07-20 06:48:55.342111 | ubuntu-noble | 2026-07-20 06:48:55.342128 | ubuntu-noble | TASK [Include required variables] ********************************************** 2026-07-20 06:48:55.386876 | ubuntu-noble | ok: [molecule-auditd] => {"ansible_facts": {}, "ansible_included_var_files": ["/home/zuul/src/github.com/osism/ansible-collection-services/molecule/delegated/vars/auditd.yml"], "changed": false} 2026-07-20 06:48:55.386961 | ubuntu-noble | 2026-07-20 06:48:55.386980 | ubuntu-noble | TASK [Include role auditd] ***************************************************** 2026-07-20 06:48:55.464404 | ubuntu-noble | included: auditd for molecule-auditd 2026-07-20 06:48:55.464521 | ubuntu-noble | 2026-07-20 06:48:55.464932 | ubuntu-noble | TASK [auditd : Include distribution specific install tasks] ******************** 2026-07-20 06:48:55.492942 | ubuntu-noble | included: /home/zuul/src/github.com/osism/ansible-collection-services/roles/auditd/tasks/install-Debian-family.yml for molecule-auditd 2026-07-20 06:48:55.493636 | ubuntu-noble | 2026-07-20 06:48:55.494115 | ubuntu-noble | TASK [auditd : Install auditd package] ***************************************** 2026-07-20 06:48:57.860285 | debian-bookworm | The following additional packages will be installed: 2026-07-20 06:48:57.860353 | debian-bookworm | libauparse0 2026-07-20 06:48:57.860465 | debian-bookworm | Suggested packages: 2026-07-20 06:48:57.860587 | debian-bookworm | audispd-plugins 2026-07-20 06:48:57.860692 | debian-bookworm | The following NEW packages will be installed: 2026-07-20 06:48:57.860785 | debian-bookworm | auditd libauparse0 2026-07-20 06:48:57.860884 | debian-bookworm | 0 upgraded, 2 newly installed, 0 to remove and 0 not upgraded. 2026-07-20 06:48:57.861650 | debian-bookworm | changed: [molecule-auditd] => {"cache_update_time": 1784530038, "cache_updated": false, "changed": true, "stderr": "debconf: delaying package configuration, since apt-utils is not installed\n", "stderr_lines": ["debconf: delaying package configuration, since apt-utils is not installed"], "stdout": "Reading package lists...\nBuilding dependency tree...\nReading state information...\nThe following additional packages will be installed:\n libauparse0\nSuggested packages:\n audispd-plugins\nThe following NEW packages will be installed:\n auditd libauparse0\n0 upgraded, 2 newly installed, 0 to remove and 0 not upgraded.\nNeed to get 279 kB of archives.\nAfter this operation, 934 kB of additional disk space will be used.\nGet:1 http://deb.debian.org/debian bookworm/main amd64 libauparse0 amd64 1:3.0.9-1 [61.9 kB]\nGet:2 http://deb.debian.org/debian bookworm/main amd64 auditd amd64 1:3.0.9-1 [218 kB]\nFetched 279 kB in 0s (3125 kB/s)\nSelecting previously unselected package libauparse0:amd64.\r\n(Reading database ... \r(Reading database ... 5%\r(Reading database ... 10%\r(Reading database ... 15%\r(Reading database ... 20%\r(Reading database ... 25%\r(Reading database ... 30%\r(Reading database ... 35%\r(Reading database ... 40%\r(Reading database ... 45%\r(Reading database ... 50%\r(Reading database ... 55%\r(Reading database ... 60%\r(Reading database ... 65%\r(Reading database ... 70%\r(Reading database ... 75%\r(Reading database ... 80%\r(Reading database ... 85%\r(Reading database ... 90%\r(Reading database ... 95%\r(Reading database ... 100%\r(Reading database ... 28692 files and directories currently installed.)\r\nPreparing to unpack .../libauparse0_1%3a3.0.9-1_amd64.deb ...\r\nUnpacking libauparse0:amd64 (1:3.0.9-1) ...\r\nSelecting previously unselected package auditd.\r\nPreparing to unpack .../auditd_1%3a3.0.9-1_amd64.deb ...\r\nUnpacking auditd (1:3.0.9-1) ...\r\nSetting up libauparse0:amd64 (1:3.0.9-1) ...\r\nSetting up auditd (1:3.0.9-1) ...\r\nCreated symlink /etc/systemd/system/multi-user.target.wants/auditd.service → /lib/systemd/system/auditd.service.\r\r\nProcessing triggers for libc-bin (2.36-9+deb12u14) ...\r\n", "stdout_lines": ["Reading package lists...", "Building dependency tree...", "Reading state information...", "The following additional packages will be installed:", " libauparse0", "Suggested packages:", " audispd-plugins", "The following NEW packages will be installed:", " auditd libauparse0", "0 upgraded, 2 newly installed, 0 to remove and 0 not upgraded.", "Need to get 279 kB of archives.", "After this operation, 934 kB of additional disk space will be used.", "Get:1 http://deb.debian.org/debian bookworm/main amd64 libauparse0 amd64 1:3.0.9-1 [61.9 kB]", "Get:2 http://deb.debian.org/debian bookworm/main amd64 auditd amd64 1:3.0.9-1 [218 kB]", "Fetched 279 kB in 0s (3125 kB/s)", "Selecting previously unselected package libauparse0:amd64.", "(Reading database ... ", "(Reading database ... 5%", "(Reading database ... 10%", "(Reading database ... 15%", "(Reading database ... 20%", "(Reading database ... 25%", "(Reading database ... 30%", "(Reading database ... 35%", "(Reading database ... 40%", "(Reading database ... 45%", "(Reading database ... 50%", "(Reading database ... 55%", "(Reading database ... 60%", "(Reading database ... 65%", "(Reading database ... 70%", "(Reading database ... 75%", "(Reading database ... 80%", "(Reading database ... 85%", "(Reading database ... 90%", "(Reading database ... 95%", "(Reading database ... 100%", "(Reading database ... 28692 files and directories currently installed.)", "Preparing to unpack .../libauparse0_1%3a3.0.9-1_amd64.deb ...", "Unpacking libauparse0:amd64 (1:3.0.9-1) ...", "Selecting previously unselected package auditd.", "Preparing to unpack .../auditd_1%3a3.0.9-1_amd64.deb ...", "Unpacking auditd (1:3.0.9-1) ...", "Setting up libauparse0:amd64 (1:3.0.9-1) ...", "Setting up auditd (1:3.0.9-1) ...", "Created symlink /etc/systemd/system/multi-user.target.wants/auditd.service → /lib/systemd/system/auditd.service.", "", "Processing triggers for libc-bin (2.36-9+deb12u14) ..."]} 2026-07-20 06:48:57.861736 | debian-bookworm | 2026-07-20 06:48:57.861838 | debian-bookworm | TASK [auditd : Install audispd-plugins package] ******************************** 2026-07-20 06:49:00.323018 | debian-bookworm | The following NEW packages will be installed: 2026-07-20 06:49:00.323079 | debian-bookworm | audispd-plugins 2026-07-20 06:49:00.323125 | debian-bookworm | 0 upgraded, 1 newly installed, 0 to remove and 0 not upgraded. 2026-07-20 06:49:00.323259 | debian-bookworm | changed: [molecule-auditd] => {"cache_update_time": 1784530038, "cache_updated": false, "changed": true, "stderr": "debconf: delaying package configuration, since apt-utils is not installed\n", "stderr_lines": ["debconf: delaying package configuration, since apt-utils is not installed"], "stdout": "Reading package lists...\nBuilding dependency tree...\nReading state information...\nThe following NEW packages will be installed:\n audispd-plugins\n0 upgraded, 1 newly installed, 0 to remove and 0 not upgraded.\nNeed to get 45.6 kB of archives.\nAfter this operation, 132 kB of additional disk space will be used.\nGet:1 http://deb.debian.org/debian bookworm/main amd64 audispd-plugins amd64 1:3.0.9-1 [45.6 kB]\nFetched 45.6 kB in 0s (992 kB/s)\nSelecting previously unselected package audispd-plugins.\r\n(Reading database ... \r(Reading database ... 5%\r(Reading database ... 10%\r(Reading database ... 15%\r(Reading database ... 20%\r(Reading database ... 25%\r(Reading database ... 30%\r(Reading database ... 35%\r(Reading database ... 40%\r(Reading database ... 45%\r(Reading database ... 50%\r(Reading database ... 55%\r(Reading database ... 60%\r(Reading database ... 65%\r(Reading database ... 70%\r(Reading database ... 75%\r(Reading database ... 80%\r(Reading database ... 85%\r(Reading database ... 90%\r(Reading database ... 95%\r(Reading database ... 100%\r(Reading database ... 28783 files and directories currently installed.)\r\nPreparing to unpack .../audispd-plugins_1%3a3.0.9-1_amd64.deb ...\r\nUnpacking audispd-plugins (1:3.0.9-1) ...\r\nSetting up audispd-plugins (1:3.0.9-1) ...\r\n", "stdout_lines": ["Reading package lists...", "Building dependency tree...", "Reading state information...", "The following NEW packages will be installed:", " audispd-plugins", "0 upgraded, 1 newly installed, 0 to remove and 0 not upgraded.", "Need to get 45.6 kB of archives.", "After this operation, 132 kB of additional disk space will be used.", "Get:1 http://deb.debian.org/debian bookworm/main amd64 audispd-plugins amd64 1:3.0.9-1 [45.6 kB]", "Fetched 45.6 kB in 0s (992 kB/s)", "Selecting previously unselected package audispd-plugins.", "(Reading database ... ", "(Reading database ... 5%", "(Reading database ... 10%", "(Reading database ... 15%", "(Reading database ... 20%", "(Reading database ... 25%", "(Reading database ... 30%", "(Reading database ... 35%", "(Reading database ... 40%", "(Reading database ... 45%", "(Reading database ... 50%", "(Reading database ... 55%", "(Reading database ... 60%", "(Reading database ... 65%", "(Reading database ... 70%", "(Reading database ... 75%", "(Reading database ... 80%", "(Reading database ... 85%", "(Reading database ... 90%", "(Reading database ... 95%", "(Reading database ... 100%", "(Reading database ... 28783 files and directories currently installed.)", "Preparing to unpack .../audispd-plugins_1%3a3.0.9-1_amd64.deb ...", "Unpacking audispd-plugins (1:3.0.9-1) ...", "Setting up audispd-plugins (1:3.0.9-1) ..."]} 2026-07-20 06:49:00.323351 | debian-bookworm | 2026-07-20 06:49:00.323455 | debian-bookworm | TASK [auditd : Copy auditd.conf configuration files] *************************** 2026-07-20 06:49:00.815192 | ubuntu-noble | The following additional packages will be installed: 2026-07-20 06:49:00.818615 | ubuntu-noble | libauparse0t64 2026-07-20 06:49:00.818656 | ubuntu-noble | Suggested packages: 2026-07-20 06:49:00.818664 | ubuntu-noble | audispd-plugins 2026-07-20 06:49:00.818671 | ubuntu-noble | The following NEW packages will be installed: 2026-07-20 06:49:00.818678 | ubuntu-noble | auditd libauparse0t64 2026-07-20 06:49:00.818684 | ubuntu-noble | 0 upgraded, 2 newly installed, 0 to remove and 0 not upgraded. 2026-07-20 06:49:00.822206 | ubuntu-noble | changed: [molecule-auditd] => {"cache_update_time": 1784530040, "cache_updated": false, "changed": true, "stderr": "debconf: delaying package configuration, since apt-utils is not installed\n", "stderr_lines": ["debconf: delaying package configuration, since apt-utils is not installed"], "stdout": "Reading package lists...\nBuilding dependency tree...\nReading state information...\nThe following additional packages will be installed:\n libauparse0t64\nSuggested packages:\n audispd-plugins\nThe following NEW packages will be installed:\n auditd libauparse0t64\n0 upgraded, 2 newly installed, 0 to remove and 0 not upgraded.\nNeed to get 274 kB of archives.\nAfter this operation, 893 kB of additional disk space will be used.\nGet:1 http://archive.ubuntu.com/ubuntu noble-updates/main amd64 libauparse0t64 amd64 1:3.1.2-2.1build1.1 [58.9 kB]\nGet:2 http://archive.ubuntu.com/ubuntu noble-updates/main amd64 auditd amd64 1:3.1.2-2.1build1.1 [215 kB]\nFetched 274 kB in 0s (1069 kB/s)\nSelecting previously unselected package libauparse0t64:amd64.\r\n(Reading database ... \r(Reading database ... 5%\r(Reading database ... 10%\r(Reading database ... 15%\r(Reading database ... 20%\r(Reading database ... 25%\r(Reading database ... 30%\r(Reading database ... 35%\r(Reading database ... 40%\r(Reading database ... 45%\r(Reading database ... 50%\r(Reading database ... 55%\r(Reading database ... 60%\r(Reading database ... 65%\r(Reading database ... 70%\r(Reading database ... 75%\r(Reading database ... 80%\r(Reading database ... 85%\r(Reading database ... 90%\r(Reading database ... 95%\r(Reading database ... 100%\r(Reading database ... 36098 files and directories currently installed.)\r\nPreparing to unpack .../libauparse0t64_1%3a3.1.2-2.1build1.1_amd64.deb ...\r\nAdding 'diversion of /lib/x86_64-linux-gnu/libauparse.so.0 to /lib/x86_64-linux-gnu/libauparse.so.0.usr-is-merged by libauparse0t64'\r\nAdding 'diversion of /lib/x86_64-linux-gnu/libauparse.so.0.0.0 to /lib/x86_64-linux-gnu/libauparse.so.0.0.0.usr-is-merged by libauparse0t64'\r\nUnpacking libauparse0t64:amd64 (1:3.1.2-2.1build1.1) ...\r\nSelecting previously unselected package auditd.\r\nPreparing to unpack .../auditd_1%3a3.1.2-2.1build1.1_amd64.deb ...\r\nUnpacking auditd (1:3.1.2-2.1build1.1) ...\r\nSetting up libauparse0t64:amd64 (1:3.1.2-2.1build1.1) ...\r\nSetting up auditd (1:3.1.2-2.1build1.1) ...\r\nCreated symlink /etc/systemd/system/multi-user.target.wants/auditd.service → /usr/lib/systemd/system/auditd.service.\r\r\nProcessing triggers for libc-bin (2.39-0ubuntu8.7) ...\r\n", "stdout_lines": ["Reading package lists...", "Building dependency tree...", "Reading state information...", "The following additional packages will be installed:", " libauparse0t64", "Suggested packages:", " audispd-plugins", "The following NEW packages will be installed:", " auditd libauparse0t64", "0 upgraded, 2 newly installed, 0 to remove and 0 not upgraded.", "Need to get 274 kB of archives.", "After this operation, 893 kB of additional disk space will be used.", "Get:1 http://archive.ubuntu.com/ubuntu noble-updates/main amd64 libauparse0t64 amd64 1:3.1.2-2.1build1.1 [58.9 kB]", "Get:2 http://archive.ubuntu.com/ubuntu noble-updates/main amd64 auditd amd64 1:3.1.2-2.1build1.1 [215 kB]", "Fetched 274 kB in 0s (1069 kB/s)", "Selecting previously unselected package libauparse0t64:amd64.", "(Reading database ... ", "(Reading database ... 5%", "(Reading database ... 10%", "(Reading database ... 15%", "(Reading database ... 20%", "(Reading database ... 25%", "(Reading database ... 30%", "(Reading database ... 35%", "(Reading database ... 40%", "(Reading database ... 45%", "(Reading database ... 50%", "(Reading database ... 55%", "(Reading database ... 60%", "(Reading database ... 65%", "(Reading database ... 70%", "(Reading database ... 75%", "(Reading database ... 80%", "(Reading database ... 85%", "(Reading database ... 90%", "(Reading database ... 95%", "(Reading database ... 100%", "(Reading database ... 36098 files and directories currently installed.)", "Preparing to unpack .../libauparse0t64_1%3a3.1.2-2.1build1.1_amd64.deb ...", "Adding 'diversion of /lib/x86_64-linux-gnu/libauparse.so.0 to /lib/x86_64-linux-gnu/libauparse.so.0.usr-is-merged by libauparse0t64'", "Adding 'diversion of /lib/x86_64-linux-gnu/libauparse.so.0.0.0 to /lib/x86_64-linux-gnu/libauparse.so.0.0.0.usr-is-merged by libauparse0t64'", "Unpacking libauparse0t64:amd64 (1:3.1.2-2.1build1.1) ...", "Selecting previously unselected package auditd.", "Preparing to unpack .../auditd_1%3a3.1.2-2.1build1.1_amd64.deb ...", "Unpacking auditd (1:3.1.2-2.1build1.1) ...", "Setting up libauparse0t64:amd64 (1:3.1.2-2.1build1.1) ...", "Setting up auditd (1:3.1.2-2.1build1.1) ...", "Created symlink /etc/systemd/system/multi-user.target.wants/auditd.service → /usr/lib/systemd/system/auditd.service.", "", "Processing triggers for libc-bin (2.39-0ubuntu8.7) ..."]} 2026-07-20 06:49:00.822470 | ubuntu-noble | 2026-07-20 06:49:00.822716 | ubuntu-noble | TASK [auditd : Install audispd-plugins package] ******************************** 2026-07-20 06:49:01.744358 | debian-bookworm | --- before 2026-07-20 06:49:01.744778 | debian-bookworm | +++ after: /home/zuul/.ansible/tmp/ansible-local-2195r0njxckq/tmpb9c1vfga/auditd.conf.j2 2026-07-20 06:49:01.745015 | debian-bookworm | @@ -0,0 +1,37 @@ 2026-07-20 06:49:01.745224 | debian-bookworm | +# 2026-07-20 06:49:01.745436 | debian-bookworm | +# This file controls the configuration of the audit daemon 2026-07-20 06:49:01.745636 | debian-bookworm | +# 2026-07-20 06:49:01.745831 | debian-bookworm | + 2026-07-20 06:49:01.746049 | debian-bookworm | +local_events = yes 2026-07-20 06:49:01.746248 | debian-bookworm | +write_logs = yes 2026-07-20 06:49:01.746449 | debian-bookworm | +log_file = /var/log/audit/audit.log 2026-07-20 06:49:01.746645 | debian-bookworm | +log_group = adm 2026-07-20 06:49:01.746847 | debian-bookworm | +log_format = RAW 2026-07-20 06:49:01.747075 | debian-bookworm | +flush = INCREMENTAL_ASYNC 2026-07-20 06:49:01.747284 | debian-bookworm | +freq = 50 2026-07-20 06:49:01.747483 | debian-bookworm | +max_log_file = 8 2026-07-20 06:49:01.747688 | debian-bookworm | +num_logs = 5 2026-07-20 06:49:01.747889 | debian-bookworm | +priority_boost = 4 2026-07-20 06:49:01.748100 | debian-bookworm | +disp_qos = lossy 2026-07-20 06:49:01.748306 | debian-bookworm | +dispatcher = /sbin/audispd 2026-07-20 06:49:01.748549 | debian-bookworm | +name_format = NONE 2026-07-20 06:49:01.748758 | debian-bookworm | +##name = mydomain 2026-07-20 06:49:01.748975 | debian-bookworm | +max_log_file_action = ROTATE 2026-07-20 06:49:01.749178 | debian-bookworm | +space_left = 12361 2026-07-20 06:49:01.749387 | debian-bookworm | +space_left_action = email 2026-07-20 06:49:01.749590 | debian-bookworm | +verify_email = yes 2026-07-20 06:49:01.749791 | debian-bookworm | +action_mail_acct = root 2026-07-20 06:49:01.750008 | debian-bookworm | +admin_space_left = 50 2026-07-20 06:49:01.750213 | debian-bookworm | +admin_space_left_action = SUSPEND 2026-07-20 06:49:01.750414 | debian-bookworm | +disk_full_action = SUSPEND 2026-07-20 06:49:01.750611 | debian-bookworm | +disk_error_action = SUSPEND 2026-07-20 06:49:01.750807 | debian-bookworm | +use_libwrap = yes 2026-07-20 06:49:01.751049 | debian-bookworm | +##tcp_listen_port = 60 2026-07-20 06:49:01.751234 | debian-bookworm | +tcp_listen_queue = 5 2026-07-20 06:49:01.751401 | debian-bookworm | +tcp_max_per_addr = 1 2026-07-20 06:49:01.751579 | debian-bookworm | +##tcp_client_ports = 1024-65535 2026-07-20 06:49:01.751747 | debian-bookworm | +tcp_client_max_idle = 0 2026-07-20 06:49:01.751917 | debian-bookworm | +enable_krb5 = no 2026-07-20 06:49:01.752099 | debian-bookworm | +krb5_principal = auditd 2026-07-20 06:49:01.752276 | debian-bookworm | +##krb5_key_file = /etc/audit/audit.key 2026-07-20 06:49:01.752449 | debian-bookworm | +distribute_network = no 2026-07-20 06:49:01.752765 | debian-bookworm | 2026-07-20 06:49:01.753007 | debian-bookworm | changed: [molecule-auditd] => {"changed": true, "checksum": "e902cc6bebf86c17087d153e359a2cc1231672e0", "dest": "/etc/audit/audit.conf", "gid": 0, "group": "root", "md5sum": "69dfd768317bae876a6a78c8aeb5cce1", "mode": "0640", "owner": "root", "size": 806, "src": "/home/zuul/.ansible/tmp/ansible-tmp-1784530140.3370795-2565-139609239914424/.source.conf", "state": "file", "uid": 0} 2026-07-20 06:49:01.753162 | debian-bookworm | 2026-07-20 06:49:01.753340 | debian-bookworm | TASK [auditd : Adjust auditd/audispd configurations] *************************** 2026-07-20 06:49:02.267005 | debian-bookworm | ok: [molecule-auditd] => (item={'parameter': 'active', 'value': 'no', 'config': '/etc/audit/plugins.d/syslog.conf'}) => {"ansible_loop_var": "item", "backup": "", "changed": false, "item": {"config": "/etc/audit/plugins.d/syslog.conf", "parameter": "active", "value": "no"}, "msg": ""} 2026-07-20 06:49:02.267045 | debian-bookworm | 2026-07-20 06:49:02.267052 | debian-bookworm | TASK [auditd : Deploy rules for auditd] **************************************** 2026-07-20 06:49:03.199719 | debian-bookworm | --- before 2026-07-20 06:49:03.199804 | debian-bookworm | +++ after: /home/zuul/.ansible/tmp/ansible-local-2195r0njxckq/tmpod4tg2w4/20-neo23x0.rules.j2 2026-07-20 06:49:03.199874 | debian-bookworm | @@ -0,0 +1,750 @@ 2026-07-20 06:49:03.200123 | debian-bookworm | +# ___ ___ __ __ 2026-07-20 06:49:03.200300 | debian-bookworm | +# / | __ ______/ (_) /_____/ / 2026-07-20 06:49:03.200498 | debian-bookworm | +# / /| |/ / / / __ / / __/ __ / 2026-07-20 06:49:03.200653 | debian-bookworm | +# / ___ / /_/ / /_/ / / /_/ /_/ / 2026-07-20 06:49:03.200819 | debian-bookworm | +# /_/ |_\__,_/\__,_/_/\__/\__,_/ 2026-07-20 06:49:03.201038 | debian-bookworm | +# 2026-07-20 06:49:03.201208 | debian-bookworm | +# Linux Audit Daemon - Best Practice Configuration 2026-07-20 06:49:03.201376 | debian-bookworm | +# /etc/audit/audit.rules 2026-07-20 06:49:03.201529 | debian-bookworm | +# 2026-07-20 06:49:03.201688 | debian-bookworm | +# Compiled by Florian Roth 2026-07-20 06:49:03.201841 | debian-bookworm | +# 2026-07-20 06:49:03.202027 | debian-bookworm | +# Created : 2017/12/05 2026-07-20 06:49:03.202174 | debian-bookworm | +# Modified : 2023/01/25 2026-07-20 06:49:03.202326 | debian-bookworm | +# 2026-07-20 06:49:03.202486 | debian-bookworm | +# Based on rules published here: 2026-07-20 06:49:03.202642 | debian-bookworm | +# Gov.uk auditd rules 2026-07-20 06:49:03.203048 | debian-bookworm | +# https://github.com/gds-operations/puppet-auditd/pull/1 2026-07-20 06:49:03.203294 | debian-bookworm | +# CentOS 7 hardening 2026-07-20 06:49:03.203549 | debian-bookworm | +# https://highon.coffee/blog/security-harden-centos-7/#auditd---audit-daemon 2026-07-20 06:49:03.203776 | debian-bookworm | +# Linux audit repo 2026-07-20 06:49:03.204056 | debian-bookworm | +# https://github.com/linux-audit/audit-userspace/tree/master/rules 2026-07-20 06:49:03.204288 | debian-bookworm | +# Auditd high performance linux auditing 2026-07-20 06:49:03.204606 | debian-bookworm | +# https://linux-audit.com/tuning-auditd-high-performance-linux-auditing/ 2026-07-20 06:49:03.204772 | debian-bookworm | +# 2026-07-20 06:49:03.204977 | debian-bookworm | +# Further rules 2026-07-20 06:49:03.205215 | debian-bookworm | +# For PCI DSS compliance see: 2026-07-20 06:49:03.205425 | debian-bookworm | +# https://github.com/linux-audit/audit-userspace/blob/master/rules/30-pci-dss-v31.rules 2026-07-20 06:49:03.205647 | debian-bookworm | +# For NISPOM compliance see: 2026-07-20 06:49:03.205852 | debian-bookworm | +# https://github.com/linux-audit/audit-userspace/blob/master/rules/30-nispom.rules 2026-07-20 06:49:03.206003 | debian-bookworm | + 2026-07-20 06:49:03.206150 | debian-bookworm | +# Remove any existing rules 2026-07-20 06:49:03.206283 | debian-bookworm | +-D 2026-07-20 06:49:03.206416 | debian-bookworm | + 2026-07-20 06:49:03.206555 | debian-bookworm | +# Buffer Size 2026-07-20 06:49:03.206694 | debian-bookworm | +## Feel free to increase this if the machine panic's 2026-07-20 06:49:03.206831 | debian-bookworm | +-b 8192 2026-07-20 06:49:03.206981 | debian-bookworm | + 2026-07-20 06:49:03.207117 | debian-bookworm | +# Failure Mode 2026-07-20 06:49:03.207318 | debian-bookworm | +## Possible values: 0 (silent), 1 (printk, print a failure message), 2 (panic, halt the system) 2026-07-20 06:49:03.207452 | debian-bookworm | +-f 1 2026-07-20 06:49:03.207588 | debian-bookworm | + 2026-07-20 06:49:03.207726 | debian-bookworm | +# Ignore errors 2026-07-20 06:49:03.207868 | debian-bookworm | +## e.g. caused by users or files not found in the local environment 2026-07-20 06:49:03.208050 | debian-bookworm | +-i 2026-07-20 06:49:03.208205 | debian-bookworm | + 2026-07-20 06:49:03.212732 | debian-bookworm | +# Self Auditing --------------------------------------------------------------- 2026-07-20 06:49:03.213037 | debian-bookworm | + 2026-07-20 06:49:03.213276 | debian-bookworm | +## Audit the audit logs 2026-07-20 06:49:03.213514 | debian-bookworm | +### Successful and unsuccessful attempts to read information from the audit records 2026-07-20 06:49:03.213745 | debian-bookworm | +-w /var/log/audit/ -p wra -k auditlog 2026-07-20 06:49:03.213982 | debian-bookworm | +-w /var/audit/ -p wra -k auditlog 2026-07-20 06:49:03.214187 | debian-bookworm | + 2026-07-20 06:49:03.214393 | debian-bookworm | +## Auditd configuration 2026-07-20 06:49:03.214612 | debian-bookworm | +### Modifications to audit configuration that occur while the audit collection functions are operating 2026-07-20 06:49:03.214835 | debian-bookworm | +-w /etc/audit/ -p wa -k auditconfig 2026-07-20 06:49:03.215055 | debian-bookworm | +-w /etc/libaudit.conf -p wa -k auditconfig 2026-07-20 06:49:03.215259 | debian-bookworm | +-w /etc/audisp/ -p wa -k audispconfig 2026-07-20 06:49:03.215454 | debian-bookworm | + 2026-07-20 06:49:03.215641 | debian-bookworm | +## Monitor for use of audit management tools 2026-07-20 06:49:03.215820 | debian-bookworm | +-w /sbin/auditctl -p x -k audittools 2026-07-20 06:49:03.216030 | debian-bookworm | +-w /sbin/auditd -p x -k audittools 2026-07-20 06:49:03.216235 | debian-bookworm | +-w /usr/sbin/auditd -p x -k audittools 2026-07-20 06:49:03.216453 | debian-bookworm | +-w /usr/sbin/augenrules -p x -k audittools 2026-07-20 06:49:03.216691 | debian-bookworm | + 2026-07-20 06:49:03.216895 | debian-bookworm | +## Access to all audit trails 2026-07-20 06:49:03.217112 | debian-bookworm | + 2026-07-20 06:49:03.217307 | debian-bookworm | +-a always,exit -F path=/usr/sbin/ausearch -F perm=x -k audittools 2026-07-20 06:49:03.217511 | debian-bookworm | +-a always,exit -F path=/usr/sbin/aureport -F perm=x -k audittools 2026-07-20 06:49:03.217716 | debian-bookworm | +-a always,exit -F path=/usr/sbin/aulast -F perm=x -k audittools 2026-07-20 06:49:03.217924 | debian-bookworm | +-a always,exit -F path=/usr/sbin/aulastlogin -F perm=x -k audittools 2026-07-20 06:49:03.218127 | debian-bookworm | +-a always,exit -F path=/usr/sbin/auvirt -F perm=x -k audittools 2026-07-20 06:49:03.218312 | debian-bookworm | + 2026-07-20 06:49:03.218502 | debian-bookworm | +# Filters --------------------------------------------------------------------- 2026-07-20 06:49:03.218688 | debian-bookworm | + 2026-07-20 06:49:03.218889 | debian-bookworm | +### We put these early because audit is a first match wins system. 2026-07-20 06:49:03.219135 | debian-bookworm | + 2026-07-20 06:49:03.219343 | debian-bookworm | +## Ignore SELinux AVC records 2026-07-20 06:49:03.219549 | debian-bookworm | +-a always,exclude -F msgtype=AVC 2026-07-20 06:49:03.219742 | debian-bookworm | + 2026-07-20 06:49:03.219955 | debian-bookworm | +## Ignore current working directory records 2026-07-20 06:49:03.220162 | debian-bookworm | +-a always,exclude -F msgtype=CWD 2026-07-20 06:49:03.220355 | debian-bookworm | + 2026-07-20 06:49:03.220593 | debian-bookworm | +## Cron jobs fill the logs with stuff we normally don't want (works with SELinux) 2026-07-20 06:49:03.220806 | debian-bookworm | +-a never,user -F subj_type=crond_t 2026-07-20 06:49:03.221056 | debian-bookworm | +-a never,exit -F subj_type=crond_t 2026-07-20 06:49:03.221258 | debian-bookworm | + 2026-07-20 06:49:03.221460 | debian-bookworm | +## This prevents chrony from overwhelming the logs 2026-07-20 06:49:03.221671 | debian-bookworm | +-a never,exit -F arch=b64 -S adjtimex -F auid=-1 -F uid=chrony -F subj_type=chronyd_t 2026-07-20 06:49:03.221858 | debian-bookworm | + 2026-07-20 06:49:03.222074 | debian-bookworm | +## This is not very interesting and wastes a lot of space if the server is public facing 2026-07-20 06:49:03.222286 | debian-bookworm | +-a always,exclude -F msgtype=CRYPTO_KEY_USER 2026-07-20 06:49:03.222477 | debian-bookworm | + 2026-07-20 06:49:03.222673 | debian-bookworm | +## Open VM Tools 2026-07-20 06:49:03.222874 | debian-bookworm | +-a exit,never -F arch=b64 -S all -F exe=/usr/bin/vmtoolsd 2026-07-20 06:49:03.223089 | debian-bookworm | + 2026-07-20 06:49:03.223296 | debian-bookworm | +## High Volume Event Filter (especially on Linux Workstations) 2026-07-20 06:49:03.223507 | debian-bookworm | +-a never,exit -F arch=b64 -F dir=/dev/shm -k sharedmemaccess 2026-07-20 06:49:03.223720 | debian-bookworm | +-a never,exit -F arch=b64 -F dir=/var/lock/lvm -k locklvm 2026-07-20 06:49:03.223937 | debian-bookworm | + 2026-07-20 06:49:03.224157 | debian-bookworm | +## FileBeat 2026-07-20 06:49:03.224370 | debian-bookworm | +-a never,exit -F arch=b64 -F path=/opt/filebeat -k filebeat 2026-07-20 06:49:03.224598 | debian-bookworm | + 2026-07-20 06:49:03.224812 | debian-bookworm | +## More information on how to filter events 2026-07-20 06:49:03.225043 | debian-bookworm | +### https://access.redhat.com/solutions/2482221 2026-07-20 06:49:03.225239 | debian-bookworm | + 2026-07-20 06:49:03.225441 | debian-bookworm | +# Rules ----------------------------------------------------------------------- 2026-07-20 06:49:03.225632 | debian-bookworm | + 2026-07-20 06:49:03.226093 | debian-bookworm | +## Kernel parameters 2026-07-20 06:49:03.226355 | debian-bookworm | +-w /etc/sysctl.conf -p wa -k sysctl 2026-07-20 06:49:03.226577 | debian-bookworm | +-w /etc/sysctl.d -p wa -k sysctl 2026-07-20 06:49:03.226782 | debian-bookworm | + 2026-07-20 06:49:03.227028 | debian-bookworm | +## Kernel module loading and unloading 2026-07-20 06:49:03.227249 | debian-bookworm | +-a always,exit -F perm=x -F auid!=-1 -F path=/sbin/insmod -k modules 2026-07-20 06:49:03.227463 | debian-bookworm | +-a always,exit -F perm=x -F auid!=-1 -F path=/sbin/modprobe -k modules 2026-07-20 06:49:03.227670 | debian-bookworm | +-a always,exit -F perm=x -F auid!=-1 -F path=/sbin/rmmod -k modules 2026-07-20 06:49:03.227867 | debian-bookworm | +-a always,exit -F arch=b64 -S finit_module -S init_module -S delete_module -F auid!=-1 -k modules 2026-07-20 06:49:03.228116 | debian-bookworm | + 2026-07-20 06:49:03.228320 | debian-bookworm | +## Modprobe configuration 2026-07-20 06:49:03.228539 | debian-bookworm | +-w /etc/modprobe.conf -p wa -k modprobe 2026-07-20 06:49:03.228757 | debian-bookworm | +-w /etc/modprobe.d -p wa -k modprobe 2026-07-20 06:49:03.228973 | debian-bookworm | + 2026-07-20 06:49:03.229179 | debian-bookworm | +## KExec usage (all actions) 2026-07-20 06:49:03.229396 | debian-bookworm | +-a always,exit -F arch=b64 -S kexec_load -k KEXEC 2026-07-20 06:49:03.229592 | debian-bookworm | + 2026-07-20 06:49:03.229788 | debian-bookworm | +## Special files 2026-07-20 06:49:03.230049 | debian-bookworm | +-a always,exit -F arch=b64 -S mknod -S mknodat -k specialfiles 2026-07-20 06:49:03.230257 | debian-bookworm | + 2026-07-20 06:49:03.230456 | debian-bookworm | +## Mount operations (only attributable) 2026-07-20 06:49:03.230666 | debian-bookworm | +-a always,exit -F arch=b64 -S mount -S umount2 -F auid!=-1 -k mount 2026-07-20 06:49:03.230862 | debian-bookworm | + 2026-07-20 06:49:03.231091 | debian-bookworm | +### NFS mount 2026-07-20 06:49:03.231321 | debian-bookworm | +-a always,exit -F path=/sbin/mount.nfs -F perm=x -F auid>=500 -F auid!=4294967295 -k T1078_Valid_Accounts 2026-07-20 06:49:03.231536 | debian-bookworm | +-a always,exit -F path=/usr/sbin/mount.nfs -F perm=x -F auid>=500 -F auid!=4294967295 -k T1078_Valid_Accounts 2026-07-20 06:49:03.231738 | debian-bookworm | + 2026-07-20 06:49:03.231953 | debian-bookworm | +## Change swap (only attributable) 2026-07-20 06:49:03.232154 | debian-bookworm | +-a always,exit -F arch=b64 -S swapon -S swapoff -F auid!=-1 -k swap 2026-07-20 06:49:03.232344 | debian-bookworm | + 2026-07-20 06:49:03.232586 | debian-bookworm | +## Time 2026-07-20 06:49:03.232817 | debian-bookworm | +-a always,exit -F arch=b64 -F uid!=ntp -S adjtimex -S settimeofday -S clock_settime -k time 2026-07-20 06:49:03.233075 | debian-bookworm | +### Local time zone 2026-07-20 06:49:03.233271 | debian-bookworm | +-w /etc/localtime -p wa -k localtime 2026-07-20 06:49:03.233470 | debian-bookworm | + 2026-07-20 06:49:03.233656 | debian-bookworm | +## Stunnel 2026-07-20 06:49:03.233852 | debian-bookworm | +-w /usr/sbin/stunnel -p x -k stunnel 2026-07-20 06:49:03.234074 | debian-bookworm | +-w /usr/bin/stunnel -p x -k stunnel 2026-07-20 06:49:03.234275 | debian-bookworm | + 2026-07-20 06:49:03.234481 | debian-bookworm | +## Cron configuration & scheduled jobs 2026-07-20 06:49:03.234689 | debian-bookworm | +-w /etc/cron.allow -p wa -k cron 2026-07-20 06:49:03.234891 | debian-bookworm | +-w /etc/cron.deny -p wa -k cron 2026-07-20 06:49:03.235108 | debian-bookworm | +-w /etc/cron.d/ -p wa -k cron 2026-07-20 06:49:03.235312 | debian-bookworm | +-w /etc/cron.daily/ -p wa -k cron 2026-07-20 06:49:03.235500 | debian-bookworm | +-w /etc/cron.hourly/ -p wa -k cron 2026-07-20 06:49:03.235700 | debian-bookworm | +-w /etc/cron.monthly/ -p wa -k cron 2026-07-20 06:49:03.235942 | debian-bookworm | +-w /etc/cron.weekly/ -p wa -k cron 2026-07-20 06:49:03.236166 | debian-bookworm | +-w /etc/crontab -p wa -k cron 2026-07-20 06:49:03.236361 | debian-bookworm | +-w /var/spool/cron/ -p wa -k cron 2026-07-20 06:49:03.236568 | debian-bookworm | + 2026-07-20 06:49:03.236769 | debian-bookworm | +## User, group, password databases 2026-07-20 06:49:03.236991 | debian-bookworm | +-w /etc/group -p wa -k etcgroup 2026-07-20 06:49:03.237191 | debian-bookworm | +-w /etc/passwd -p wa -k etcpasswd 2026-07-20 06:49:03.237420 | debian-bookworm | +-w /etc/gshadow -k etcgroup 2026-07-20 06:49:03.237613 | debian-bookworm | +-w /etc/shadow -k etcpasswd 2026-07-20 06:49:03.237827 | debian-bookworm | +-w /etc/security/opasswd -k opasswd 2026-07-20 06:49:03.238055 | debian-bookworm | + 2026-07-20 06:49:03.238265 | debian-bookworm | +## Sudoers file changes 2026-07-20 06:49:03.238460 | debian-bookworm | +-w /etc/sudoers -p wa -k actions 2026-07-20 06:49:03.238662 | debian-bookworm | +-w /etc/sudoers.d/ -p wa -k actions 2026-07-20 06:49:03.238854 | debian-bookworm | + 2026-07-20 06:49:03.239064 | debian-bookworm | +## Passwd 2026-07-20 06:49:03.239255 | debian-bookworm | +-w /usr/bin/passwd -p x -k passwd_modification 2026-07-20 06:49:03.239449 | debian-bookworm | + 2026-07-20 06:49:03.239648 | debian-bookworm | +## Tools to change group identifiers 2026-07-20 06:49:03.239845 | debian-bookworm | +-w /usr/sbin/groupadd -p x -k group_modification 2026-07-20 06:49:03.240094 | debian-bookworm | +-w /usr/sbin/groupmod -p x -k group_modification 2026-07-20 06:49:03.240297 | debian-bookworm | +-w /usr/sbin/addgroup -p x -k group_modification 2026-07-20 06:49:03.240676 | debian-bookworm | +-w /usr/sbin/useradd -p x -k user_modification 2026-07-20 06:49:03.240917 | debian-bookworm | +-w /usr/sbin/userdel -p x -k user_modification 2026-07-20 06:49:03.241145 | debian-bookworm | +-w /usr/sbin/usermod -p x -k user_modification 2026-07-20 06:49:03.241348 | debian-bookworm | +-w /usr/sbin/adduser -p x -k user_modification 2026-07-20 06:49:03.241743 | debian-bookworm | + 2026-07-20 06:49:03.241959 | debian-bookworm | +## Login configuration and information 2026-07-20 06:49:03.242171 | debian-bookworm | +-w /etc/login.defs -p wa -k login 2026-07-20 06:49:03.242373 | debian-bookworm | +-w /etc/securetty -p wa -k login 2026-07-20 06:49:03.242577 | debian-bookworm | +-w /var/log/faillog -p wa -k login 2026-07-20 06:49:03.242778 | debian-bookworm | +-w /var/log/lastlog -p wa -k login 2026-07-20 06:49:03.243025 | debian-bookworm | +-w /var/log/tallylog -p wa -k login 2026-07-20 06:49:03.243227 | debian-bookworm | + 2026-07-20 06:49:03.243429 | debian-bookworm | +## Network Environment 2026-07-20 06:49:03.243628 | debian-bookworm | +### Changes to hostname 2026-07-20 06:49:03.243827 | debian-bookworm | +-a always,exit -F arch=b64 -S sethostname -S setdomainname -k network_modifications 2026-07-20 06:49:03.244069 | debian-bookworm | + 2026-07-20 06:49:03.244268 | debian-bookworm | +### Detect Remote Shell Use 2026-07-20 06:49:03.244486 | debian-bookworm | +-a always,exit -F arch=b64 -F exe=/bin/bash -F success=1 -S connect -k "remote_shell" 2026-07-20 06:49:03.244688 | debian-bookworm | +-a always,exit -F arch=b64 -F exe=/usr/bin/bash -F success=1 -S connect -k "remote_shell" 2026-07-20 06:49:03.244872 | debian-bookworm | + 2026-07-20 06:49:03.245122 | debian-bookworm | +### Successful IPv4 Connections 2026-07-20 06:49:03.245319 | debian-bookworm | +-a always,exit -F arch=b64 -S connect -F a2=16 -F success=1 -F key=network_connect_4 2026-07-20 06:49:03.245489 | debian-bookworm | + 2026-07-20 06:49:03.245653 | debian-bookworm | +### Successful IPv6 Connections 2026-07-20 06:49:03.245820 | debian-bookworm | +-a always,exit -F arch=b64 -S connect -F a2=28 -F success=1 -F key=network_connect_6 2026-07-20 06:49:03.245996 | debian-bookworm | + 2026-07-20 06:49:03.246169 | debian-bookworm | +### Changes to other files 2026-07-20 06:49:03.246355 | debian-bookworm | +-w /etc/hosts -p wa -k network_modifications 2026-07-20 06:49:03.246565 | debian-bookworm | +-w /etc/sysconfig/network -p wa -k network_modifications 2026-07-20 06:49:03.246765 | debian-bookworm | +-w /etc/sysconfig/network-scripts -p w -k network_modifications 2026-07-20 06:49:03.246989 | debian-bookworm | +-w /etc/network/ -p wa -k network 2026-07-20 06:49:03.247196 | debian-bookworm | +-a always,exit -F dir=/etc/NetworkManager/ -F perm=wa -k network_modifications 2026-07-20 06:49:03.247388 | debian-bookworm | + 2026-07-20 06:49:03.247581 | debian-bookworm | +### Changes to issue 2026-07-20 06:49:03.247770 | debian-bookworm | +-w /etc/issue -p wa -k etcissue 2026-07-20 06:49:03.247995 | debian-bookworm | +-w /etc/issue.net -p wa -k etcissue 2026-07-20 06:49:03.248184 | debian-bookworm | + 2026-07-20 06:49:03.248387 | debian-bookworm | +## System startup scripts 2026-07-20 06:49:03.248605 | debian-bookworm | +-w /etc/inittab -p wa -k init 2026-07-20 06:49:03.248801 | debian-bookworm | +-w /etc/init.d/ -p wa -k init 2026-07-20 06:49:03.249004 | debian-bookworm | +-w /etc/init/ -p wa -k init 2026-07-20 06:49:03.249200 | debian-bookworm | + 2026-07-20 06:49:03.249390 | debian-bookworm | +## Library search paths 2026-07-20 06:49:03.249571 | debian-bookworm | +-w /etc/ld.so.conf -p wa -k libpath 2026-07-20 06:49:03.249759 | debian-bookworm | +-w /etc/ld.so.conf.d -p wa -k libpath 2026-07-20 06:49:03.249952 | debian-bookworm | + 2026-07-20 06:49:03.250149 | debian-bookworm | +## Systemwide library preloads (LD_PRELOAD) 2026-07-20 06:49:03.250334 | debian-bookworm | +-w /etc/ld.so.preload -p wa -k systemwide_preloads 2026-07-20 06:49:03.250515 | debian-bookworm | + 2026-07-20 06:49:03.250696 | debian-bookworm | +## Pam configuration 2026-07-20 06:49:03.250900 | debian-bookworm | +-w /etc/pam.d/ -p wa -k pam 2026-07-20 06:49:03.251125 | debian-bookworm | +-w /etc/security/limits.conf -p wa -k pam 2026-07-20 06:49:03.251319 | debian-bookworm | +-w /etc/security/limits.d -p wa -k pam 2026-07-20 06:49:03.251527 | debian-bookworm | +-w /etc/security/pam_env.conf -p wa -k pam 2026-07-20 06:49:03.251740 | debian-bookworm | +-w /etc/security/namespace.conf -p wa -k pam 2026-07-20 06:49:03.252284 | debian-bookworm | +-w /etc/security/namespace.d -p wa -k pam 2026-07-20 06:49:03.252536 | debian-bookworm | +-w /etc/security/namespace.init -p wa -k pam 2026-07-20 06:49:03.252734 | debian-bookworm | + 2026-07-20 06:49:03.252943 | debian-bookworm | +## Mail configuration 2026-07-20 06:49:03.253141 | debian-bookworm | +-w /etc/aliases -p wa -k mail 2026-07-20 06:49:03.253328 | debian-bookworm | +-w /etc/postfix/ -p wa -k mail 2026-07-20 06:49:03.253511 | debian-bookworm | +-w /etc/exim4/ -p wa -k mail 2026-07-20 06:49:03.253693 | debian-bookworm | + 2026-07-20 06:49:03.253886 | debian-bookworm | +## SSH configuration 2026-07-20 06:49:03.254151 | debian-bookworm | +-w /etc/ssh/sshd_config -k sshd 2026-07-20 06:49:03.254361 | debian-bookworm | +-w /etc/ssh/sshd_config.d -k sshd 2026-07-20 06:49:03.254554 | debian-bookworm | + 2026-07-20 06:49:03.254755 | debian-bookworm | +## root ssh key tampering 2026-07-20 06:49:03.254981 | debian-bookworm | +-w /root/.ssh -p wa -k rootkey 2026-07-20 06:49:03.255173 | debian-bookworm | + 2026-07-20 06:49:03.255357 | debian-bookworm | +# Systemd 2026-07-20 06:49:03.255546 | debian-bookworm | +-w /bin/systemctl -p x -k systemd 2026-07-20 06:49:03.255742 | debian-bookworm | +-w /etc/systemd/ -p wa -k systemd 2026-07-20 06:49:03.255981 | debian-bookworm | +-w /usr/lib/systemd -p wa -k systemd 2026-07-20 06:49:03.256185 | debian-bookworm | + 2026-07-20 06:49:03.256391 | debian-bookworm | +## https://systemd.network/systemd.generator.html 2026-07-20 06:49:03.256603 | debian-bookworm | +-w /etc/systemd/system-generators/ -p wa -k systemd_generator 2026-07-20 06:49:03.256811 | debian-bookworm | +-w /usr/local/lib/systemd/system-generators/ -p wa -k systemd_generator 2026-07-20 06:49:03.257036 | debian-bookworm | +-w /usr/lib/systemd/system-generators -p wa -k systemd_generator 2026-07-20 06:49:03.257226 | debian-bookworm | + 2026-07-20 06:49:03.257415 | debian-bookworm | +-w /etc/systemd/user-generators/ -p wa -k systemd_generator 2026-07-20 06:49:03.257610 | debian-bookworm | +-w /usr/local/lib/systemd/user-generators/ -p wa -k systemd_generator 2026-07-20 06:49:03.257804 | debian-bookworm | +-w /lib/systemd/system-generators/ -p wa -k systemd_generator 2026-07-20 06:49:03.258017 | debian-bookworm | + 2026-07-20 06:49:03.258231 | debian-bookworm | +## SELinux events that modify the system's Mandatory Access Controls (MAC) 2026-07-20 06:49:03.258433 | debian-bookworm | +-w /etc/selinux/ -p wa -k mac_policy 2026-07-20 06:49:03.258628 | debian-bookworm | + 2026-07-20 06:49:03.258828 | debian-bookworm | +## Critical elements access failures 2026-07-20 06:49:03.259076 | debian-bookworm | +-a always,exit -F arch=b64 -S open -F dir=/etc -F success=0 -k unauthedfileaccess 2026-07-20 06:49:03.259294 | debian-bookworm | +-a always,exit -F arch=b64 -S open -F dir=/bin -F success=0 -k unauthedfileaccess 2026-07-20 06:49:03.259523 | debian-bookworm | +-a always,exit -F arch=b64 -S open -F dir=/sbin -F success=0 -k unauthedfileaccess 2026-07-20 06:49:03.259747 | debian-bookworm | +-a always,exit -F arch=b64 -S open -F dir=/usr/bin -F success=0 -k unauthedfileaccess 2026-07-20 06:49:03.259979 | debian-bookworm | +-a always,exit -F arch=b64 -S open -F dir=/usr/sbin -F success=0 -k unauthedfileaccess 2026-07-20 06:49:03.260193 | debian-bookworm | +-a always,exit -F arch=b64 -S open -F dir=/var -F success=0 -k unauthedfileaccess 2026-07-20 06:49:03.260396 | debian-bookworm | +-a always,exit -F arch=b64 -S open -F dir=/home -F success=0 -k unauthedfileaccess 2026-07-20 06:49:03.260658 | debian-bookworm | +-a always,exit -F arch=b64 -S open -F dir=/srv -F success=0 -k unauthedfileaccess 2026-07-20 06:49:03.260870 | debian-bookworm | + 2026-07-20 06:49:03.261097 | debian-bookworm | +## Process ID change (switching accounts) applications 2026-07-20 06:49:03.261302 | debian-bookworm | +-w /bin/su -p x -k priv_esc 2026-07-20 06:49:03.261516 | debian-bookworm | +-w /usr/bin/sudo -p x -k priv_esc 2026-07-20 06:49:03.261721 | debian-bookworm | + 2026-07-20 06:49:03.261957 | debian-bookworm | +## Power state 2026-07-20 06:49:03.262160 | debian-bookworm | +-w /sbin/shutdown -p x -k power 2026-07-20 06:49:03.262351 | debian-bookworm | +-w /sbin/poweroff -p x -k power 2026-07-20 06:49:03.262551 | debian-bookworm | +-w /sbin/reboot -p x -k power 2026-07-20 06:49:03.262755 | debian-bookworm | +-w /sbin/halt -p x -k power 2026-07-20 06:49:03.262979 | debian-bookworm | + 2026-07-20 06:49:03.263180 | debian-bookworm | +## Session initiation information 2026-07-20 06:49:03.263373 | debian-bookworm | +-w /var/run/utmp -p wa -k session 2026-07-20 06:49:03.263566 | debian-bookworm | +-w /var/log/btmp -p wa -k session 2026-07-20 06:49:03.263784 | debian-bookworm | +-w /var/log/wtmp -p wa -k session 2026-07-20 06:49:03.264015 | debian-bookworm | + 2026-07-20 06:49:03.264237 | debian-bookworm | +## Discretionary Access Control (DAC) modifications 2026-07-20 06:49:03.264452 | debian-bookworm | +-a always,exit -F arch=b64 -S chmod -F auid>=1000 -F auid!=-1 -k perm_mod 2026-07-20 06:49:03.264703 | debian-bookworm | +-a always,exit -F arch=b64 -S chown -F auid>=1000 -F auid!=-1 -k perm_mod 2026-07-20 06:49:03.264930 | debian-bookworm | +-a always,exit -F arch=b64 -S fchmod -F auid>=1000 -F auid!=-1 -k perm_mod 2026-07-20 06:49:03.265147 | debian-bookworm | +-a always,exit -F arch=b64 -S fchmodat -F auid>=1000 -F auid!=-1 -k perm_mod 2026-07-20 06:49:03.265351 | debian-bookworm | +-a always,exit -F arch=b64 -S fchown -F auid>=1000 -F auid!=-1 -k perm_mod 2026-07-20 06:49:03.265554 | debian-bookworm | +-a always,exit -F arch=b64 -S fchownat -F auid>=1000 -F auid!=-1 -k perm_mod 2026-07-20 06:49:03.265758 | debian-bookworm | +-a always,exit -F arch=b64 -S fremovexattr -F auid>=1000 -F auid!=-1 -k perm_mod 2026-07-20 06:49:03.266002 | debian-bookworm | +-a always,exit -F arch=b64 -S fsetxattr -F auid>=1000 -F auid!=-1 -k perm_mod 2026-07-20 06:49:03.266217 | debian-bookworm | +-a always,exit -F arch=b64 -S lchown -F auid>=1000 -F auid!=-1 -k perm_mod 2026-07-20 06:49:03.266421 | debian-bookworm | +-a always,exit -F arch=b64 -S lremovexattr -F auid>=1000 -F auid!=-1 -k perm_mod 2026-07-20 06:49:03.266620 | debian-bookworm | +-a always,exit -F arch=b64 -S lsetxattr -F auid>=1000 -F auid!=-1 -k perm_mod 2026-07-20 06:49:03.266834 | debian-bookworm | +-a always,exit -F arch=b64 -S removexattr -F auid>=1000 -F auid!=-1 -k perm_mod 2026-07-20 06:49:03.267079 | debian-bookworm | +-a always,exit -F arch=b64 -S setxattr -F auid>=1000 -F auid!=-1 -k perm_mod 2026-07-20 06:49:03.267267 | debian-bookworm | + 2026-07-20 06:49:03.267440 | debian-bookworm | +# Special Rules --------------------------------------------------------------- 2026-07-20 06:49:03.267600 | debian-bookworm | + 2026-07-20 06:49:03.267777 | debian-bookworm | +## Reconnaissance 2026-07-20 06:49:03.267976 | debian-bookworm | +-w /usr/bin/whoami -p x -k recon 2026-07-20 06:49:03.268149 | debian-bookworm | +-w /usr/bin/id -p x -k recon 2026-07-20 06:49:03.268347 | debian-bookworm | +-w /bin/hostname -p x -k recon 2026-07-20 06:49:03.268587 | debian-bookworm | +-w /bin/uname -p x -k recon 2026-07-20 06:49:03.268787 | debian-bookworm | +-w /etc/issue -p r -k recon 2026-07-20 06:49:03.269011 | debian-bookworm | +-w /etc/hostname -p r -k recon 2026-07-20 06:49:03.269195 | debian-bookworm | + 2026-07-20 06:49:03.269382 | debian-bookworm | +## Suspicious activity 2026-07-20 06:49:03.269571 | debian-bookworm | +-w /usr/bin/wget -p x -k susp_activity 2026-07-20 06:49:03.269756 | debian-bookworm | +-w /usr/bin/curl -p x -k susp_activity 2026-07-20 06:49:03.269961 | debian-bookworm | +-w /usr/bin/base64 -p x -k susp_activity 2026-07-20 06:49:03.270441 | debian-bookworm | +-w /bin/nc -p x -k susp_activity 2026-07-20 06:49:03.270774 | debian-bookworm | +-w /bin/netcat -p x -k susp_activity 2026-07-20 06:49:03.271119 | debian-bookworm | +-w /usr/bin/ncat -p x -k susp_activity 2026-07-20 06:49:03.271374 | debian-bookworm | +-w /usr/bin/ss -p x -k susp_activity 2026-07-20 06:49:03.271618 | debian-bookworm | +-w /usr/bin/netstat -p x -k susp_activity 2026-07-20 06:49:03.271854 | debian-bookworm | +-w /usr/bin/ssh -p x -k susp_activity 2026-07-20 06:49:03.272114 | debian-bookworm | +-w /usr/bin/scp -p x -k susp_activity 2026-07-20 06:49:03.272345 | debian-bookworm | +-w /usr/bin/sftp -p x -k susp_activity 2026-07-20 06:49:03.272601 | debian-bookworm | +-w /usr/bin/ftp -p x -k susp_activity 2026-07-20 06:49:03.272832 | debian-bookworm | +-w /usr/bin/socat -p x -k susp_activity 2026-07-20 06:49:03.273075 | debian-bookworm | +-w /usr/bin/wireshark -p x -k susp_activity 2026-07-20 06:49:03.273298 | debian-bookworm | +-w /usr/bin/tshark -p x -k susp_activity 2026-07-20 06:49:03.273524 | debian-bookworm | +-w /usr/bin/rawshark -p x -k susp_activity 2026-07-20 06:49:03.273744 | debian-bookworm | +-w /usr/bin/rdesktop -p x -k susp_activity 2026-07-20 06:49:03.274010 | debian-bookworm | +-w /usr/local/bin/rdesktop -p x -k susp_activity 2026-07-20 06:49:03.274238 | debian-bookworm | +-w /usr/bin/wlfreerdp -p x -k susp_activity 2026-07-20 06:49:03.274467 | debian-bookworm | +-w /usr/bin/xfreerdp -p x -k susp_activity 2026-07-20 06:49:03.274691 | debian-bookworm | +-w /usr/local/bin/xfreerdp -p x -k susp_activity 2026-07-20 06:49:03.274949 | debian-bookworm | +-w /usr/bin/nmap -p x -k susp_activity 2026-07-20 06:49:03.275176 | debian-bookworm | + 2026-07-20 06:49:03.275383 | debian-bookworm | +## sssd 2026-07-20 06:49:03.275599 | debian-bookworm | +-a always,exit -F path=/usr/libexec/sssd/p11_child -F perm=x -F auid>=500 -F auid!=4294967295 -k T1078_Valid_Accounts 2026-07-20 06:49:03.275812 | debian-bookworm | +-a always,exit -F path=/usr/libexec/sssd/krb5_child -F perm=x -F auid>=500 -F auid!=4294967295 -k T1078_Valid_Accounts 2026-07-20 06:49:03.276064 | debian-bookworm | +-a always,exit -F path=/usr/libexec/sssd/ldap_child -F perm=x -F auid>=500 -F auid!=4294967295 -k T1078_Valid_Accounts 2026-07-20 06:49:03.276277 | debian-bookworm | +-a always,exit -F path=/usr/libexec/sssd/selinux_child -F perm=x -F auid>=500 -F auid!=4294967295 -k T1078_Valid_Accounts 2026-07-20 06:49:03.276511 | debian-bookworm | +-a always,exit -F path=/usr/libexec/sssd/proxy_child -F perm=x -F auid>=500 -F auid!=4294967295 -k T1078_Valid_Accounts 2026-07-20 06:49:03.276716 | debian-bookworm | + 2026-07-20 06:49:03.276960 | debian-bookworm | +## T1002 Data Compressed 2026-07-20 06:49:03.277173 | debian-bookworm | + 2026-07-20 06:49:03.277358 | debian-bookworm | +-w /usr/bin/zip -p x -k Data_Compressed 2026-07-20 06:49:03.277552 | debian-bookworm | +-w /usr/bin/gzip -p x -k Data_Compressed 2026-07-20 06:49:03.277732 | debian-bookworm | +-w /usr/bin/tar -p x -k Data_Compressed 2026-07-20 06:49:03.277921 | debian-bookworm | +-w /usr/bin/bzip2 -p x -k Data_Compressed 2026-07-20 06:49:03.278100 | debian-bookworm | + 2026-07-20 06:49:03.278277 | debian-bookworm | +-w /usr/bin/lzip -p x -k Data_Compressed 2026-07-20 06:49:03.278452 | debian-bookworm | +-w /usr/local/bin/lzip -p x -k Data_Compressed 2026-07-20 06:49:03.278621 | debian-bookworm | + 2026-07-20 06:49:03.278794 | debian-bookworm | +-w /usr/bin/lz4 -p x -k Data_Compressed 2026-07-20 06:49:03.278984 | debian-bookworm | +-w /usr/local/bin/lz4 -p x -k Data_Compressed 2026-07-20 06:49:03.279159 | debian-bookworm | + 2026-07-20 06:49:03.279391 | debian-bookworm | +-w /usr/bin/lzop -p x -k Data_Compressed 2026-07-20 06:49:03.279577 | debian-bookworm | +-w /usr/local/bin/lzop -p x -k Data_Compressed 2026-07-20 06:49:03.279751 | debian-bookworm | + 2026-07-20 06:49:03.279945 | debian-bookworm | +-w /usr/bin/plzip -p x -k Data_Compressed 2026-07-20 06:49:03.280125 | debian-bookworm | +-w /usr/local/bin/plzip -p x -k Data_Compressed 2026-07-20 06:49:03.280297 | debian-bookworm | + 2026-07-20 06:49:03.280506 | debian-bookworm | +-w /usr/bin/pbzip2 -p x -k Data_Compressed 2026-07-20 06:49:03.280691 | debian-bookworm | +-w /usr/local/bin/pbzip2 -p x -k Data_Compressed 2026-07-20 06:49:03.280859 | debian-bookworm | + 2026-07-20 06:49:03.281052 | debian-bookworm | +-w /usr/bin/lbzip2 -p x -k Data_Compressed 2026-07-20 06:49:03.281231 | debian-bookworm | +-w /usr/local/bin/lbzip2 -p x -k Data_Compressed 2026-07-20 06:49:03.281402 | debian-bookworm | + 2026-07-20 06:49:03.281578 | debian-bookworm | +-w /usr/bin/pixz -p x -k Data_Compressed 2026-07-20 06:49:03.281752 | debian-bookworm | +-w /usr/local/bin/pixz -p x -k Data_Compressed 2026-07-20 06:49:03.281959 | debian-bookworm | + 2026-07-20 06:49:03.282140 | debian-bookworm | +-w /usr/bin/pigz -p x -k Data_Compressed 2026-07-20 06:49:03.282293 | debian-bookworm | +-w /usr/local/bin/pigz -p x -k Data_Compressed 2026-07-20 06:49:03.282447 | debian-bookworm | +-w /usr/bin/unpigz -p x -k Data_Compressed 2026-07-20 06:49:03.282604 | debian-bookworm | +-w /usr/local/bin/unpigz -p x -k Data_Compressed 2026-07-20 06:49:03.282755 | debian-bookworm | + 2026-07-20 06:49:03.282920 | debian-bookworm | +-w /usr/bin/zstd -p x -k Data_Compressed 2026-07-20 06:49:03.283077 | debian-bookworm | +-w /usr/local/bin/zstd -p x -k Data_Compressed 2026-07-20 06:49:03.283223 | debian-bookworm | + 2026-07-20 06:49:03.283378 | debian-bookworm | +## Added to catch netcat on Ubuntu 2026-07-20 06:49:03.283531 | debian-bookworm | +-w /bin/nc.openbsd -p x -k susp_activity 2026-07-20 06:49:03.283693 | debian-bookworm | +-w /bin/nc.traditional -p x -k susp_activity 2026-07-20 06:49:03.283843 | debian-bookworm | + 2026-07-20 06:49:03.284011 | debian-bookworm | +## Sbin suspicious activity 2026-07-20 06:49:03.284165 | debian-bookworm | +-w /sbin/iptables -p x -k sbin_susp 2026-07-20 06:49:03.284317 | debian-bookworm | +-w /sbin/ip6tables -p x -k sbin_susp 2026-07-20 06:49:03.284483 | debian-bookworm | +-w /sbin/ifconfig -p x -k sbin_susp 2026-07-20 06:49:03.284643 | debian-bookworm | +-w /usr/sbin/arptables -p x -k sbin_susp 2026-07-20 06:49:03.284796 | debian-bookworm | +-w /usr/sbin/ebtables -p x -k sbin_susp 2026-07-20 06:49:03.284989 | debian-bookworm | +-w /sbin/xtables-nft-multi -p x -k sbin_susp 2026-07-20 06:49:03.285149 | debian-bookworm | +-w /usr/sbin/nft -p x -k sbin_susp 2026-07-20 06:49:03.285302 | debian-bookworm | +-w /usr/sbin/tcpdump -p x -k sbin_susp 2026-07-20 06:49:03.285455 | debian-bookworm | +-w /usr/sbin/traceroute -p x -k sbin_susp 2026-07-20 06:49:03.285601 | debian-bookworm | +-w /usr/sbin/ufw -p x -k sbin_susp 2026-07-20 06:49:03.285742 | debian-bookworm | + 2026-07-20 06:49:03.285886 | debian-bookworm | +### kde4 2026-07-20 06:49:03.286090 | debian-bookworm | +-a always,exit -F path=/usr/libexec/kde4/kpac_dhcp_helper -F perm=x -F auid>=1000 -F auid!=4294967295 -k T1078_Valid_Accounts 2026-07-20 06:49:03.286243 | debian-bookworm | +-a always,exit -F path=/usr/libexec/kde4/kdesud -F perm=x -F auid>=1000 -F auid!=4294967295 -k T1078_Valid_Accounts 2026-07-20 06:49:03.286383 | debian-bookworm | + 2026-07-20 06:49:03.286541 | debian-bookworm | +## dbus-send invocation 2026-07-20 06:49:03.286689 | debian-bookworm | +### may indicate privilege escalation CVE-2021-3560 2026-07-20 06:49:03.286835 | debian-bookworm | +-w /usr/bin/dbus-send -p x -k dbus_send 2026-07-20 06:49:03.286991 | debian-bookworm | +-w /usr/bin/gdbus -p x -k gdubs_call 2026-07-20 06:49:03.287133 | debian-bookworm | + 2026-07-20 06:49:03.287277 | debian-bookworm | +## pkexec invocation 2026-07-20 06:49:03.287426 | debian-bookworm | +### may indicate privilege escalation CVE-2021-4034 2026-07-20 06:49:03.287570 | debian-bookworm | +-w /usr/bin/pkexec -p x -k pkexec 2026-07-20 06:49:03.287710 | debian-bookworm | + 2026-07-20 06:49:03.287852 | debian-bookworm | +## Suspicious shells 2026-07-20 06:49:03.288005 | debian-bookworm | +-w /bin/ash -p x -k susp_shell 2026-07-20 06:49:03.288152 | debian-bookworm | +-w /bin/csh -p x -k susp_shell 2026-07-20 06:49:03.288297 | debian-bookworm | +-w /bin/fish -p x -k susp_shell 2026-07-20 06:49:03.288441 | debian-bookworm | +-w /bin/tcsh -p x -k susp_shell 2026-07-20 06:49:03.288609 | debian-bookworm | +-w /bin/tclsh -p x -k susp_shell 2026-07-20 06:49:03.288755 | debian-bookworm | +-w /bin/xonsh -p x -k susp_shell 2026-07-20 06:49:03.288895 | debian-bookworm | +-w /usr/local/bin/xonsh -p x -k susp_shell 2026-07-20 06:49:03.289073 | debian-bookworm | +-w /bin/open -p x -k susp_shell 2026-07-20 06:49:03.289204 | debian-bookworm | +-w /bin/rbash -p x -k susp_shell 2026-07-20 06:49:03.289333 | debian-bookworm | + 2026-07-20 06:49:03.289462 | debian-bookworm | +# Web Server Actvity 2026-07-20 06:49:03.289598 | debian-bookworm | +## Change the number "33" to the ID of your WebServer user. Default: www-data:x:33:33 2026-07-20 06:49:03.289731 | debian-bookworm | +-a always,exit -F arch=b64 -S execve -F euid=33 -k detect_execve_www 2026-07-20 06:49:03.289859 | debian-bookworm | + 2026-07-20 06:49:03.290007 | debian-bookworm | +### https://clustershell.readthedocs.io/ 2026-07-20 06:49:03.290138 | debian-bookworm | +-w /bin/clush -p x -k susp_shell 2026-07-20 06:49:03.290268 | debian-bookworm | +-w /usr/local/bin/clush -p x -k susp_shell 2026-07-20 06:49:03.290399 | debian-bookworm | +-w /etc/clustershell/clush.conf -p x -k susp_shell 2026-07-20 06:49:03.290527 | debian-bookworm | + 2026-07-20 06:49:03.290657 | debian-bookworm | +### https://github.com/tmux/tmux 2026-07-20 06:49:03.290789 | debian-bookworm | +-w /bin/tmux -p x -k susp_shell 2026-07-20 06:49:03.290949 | debian-bookworm | +-w /usr/local/bin/tmux -p x -k susp_shell 2026-07-20 06:49:03.291083 | debian-bookworm | + 2026-07-20 06:49:03.291214 | debian-bookworm | +## Shell/profile configurations 2026-07-20 06:49:03.291345 | debian-bookworm | +-w /etc/profile.d/ -p wa -k shell_profiles 2026-07-20 06:49:03.291473 | debian-bookworm | +-w /etc/profile -p wa -k shell_profiles 2026-07-20 06:49:03.291590 | debian-bookworm | +-w /etc/shells -p wa -k shell_profiles 2026-07-20 06:49:03.291706 | debian-bookworm | +-w /etc/bashrc -p wa -k shell_profiles 2026-07-20 06:49:03.291823 | debian-bookworm | +-w /etc/csh.cshrc -p wa -k shell_profiles 2026-07-20 06:49:03.291953 | debian-bookworm | +-w /etc/csh.login -p wa -k shell_profiles 2026-07-20 06:49:03.292069 | debian-bookworm | +-w /etc/fish/ -p wa -k shell_profiles 2026-07-20 06:49:03.292247 | debian-bookworm | +-w /etc/zsh/ -p wa -k shell_profiles 2026-07-20 06:49:03.292366 | debian-bookworm | + 2026-07-20 06:49:03.292498 | debian-bookworm | +### https://github.com/xxh/xxh 2026-07-20 06:49:03.292618 | debian-bookworm | +-w /usr/local/bin/xxh.bash -p x -k susp_shell 2026-07-20 06:49:03.292734 | debian-bookworm | +-w /usr/local/bin/xxh.xsh -p x -k susp_shell 2026-07-20 06:49:03.292850 | debian-bookworm | +-w /usr/local/bin/xxh.zsh -p x -k susp_shell 2026-07-20 06:49:03.292977 | debian-bookworm | + 2026-07-20 06:49:03.293095 | debian-bookworm | +## Injection 2026-07-20 06:49:03.293221 | debian-bookworm | +### These rules watch for code injection by the ptrace facility. 2026-07-20 06:49:03.293344 | debian-bookworm | +### This could indicate someone trying to do something bad or just debugging 2026-07-20 06:49:03.293467 | debian-bookworm | +-a always,exit -F arch=b64 -S ptrace -F a0=0x4 -k code_injection 2026-07-20 06:49:03.293585 | debian-bookworm | +-a always,exit -F arch=b64 -S ptrace -F a0=0x5 -k data_injection 2026-07-20 06:49:03.293706 | debian-bookworm | +-a always,exit -F arch=b64 -S ptrace -F a0=0x6 -k register_injection 2026-07-20 06:49:03.293826 | debian-bookworm | +-a always,exit -F arch=b64 -S ptrace -k tracing 2026-07-20 06:49:03.293971 | debian-bookworm | + 2026-07-20 06:49:03.294092 | debian-bookworm | +## Anonymous File Creation 2026-07-20 06:49:03.294207 | debian-bookworm | +### These rules watch the use of memfd_create 2026-07-20 06:49:03.294321 | debian-bookworm | +### "memfd_create" creates anonymous file and returns a file descriptor to access it 2026-07-20 06:49:03.294436 | debian-bookworm | +### When combined with "fexecve" can be used to stealthily run binaries in memory without touching disk 2026-07-20 06:49:03.294548 | debian-bookworm | +-a always,exit -F arch=b64 -S memfd_create -F key=anon_file_create 2026-07-20 06:49:03.294667 | debian-bookworm | + 2026-07-20 06:49:03.294804 | debian-bookworm | +## Privilege Abuse 2026-07-20 06:49:03.294941 | debian-bookworm | +### The purpose of this rule is to detect when an admin may be abusing power by looking in user's home dir. 2026-07-20 06:49:03.295060 | debian-bookworm | +-a always,exit -F dir=/home -F uid=0 -F auid>=1000 -F auid!=-1 -C auid!=obj_uid -k power_abuse 2026-07-20 06:49:03.295170 | debian-bookworm | + 2026-07-20 06:49:03.295282 | debian-bookworm | +# Socket Creations 2026-07-20 06:49:03.295394 | debian-bookworm | +# will catch both IPv4 and IPv6 2026-07-20 06:49:03.295502 | debian-bookworm | + 2026-07-20 06:49:03.295640 | debian-bookworm | +-a always,exit -F arch=b32 -S socket -F a0=2 -k network_socket_created 2026-07-20 06:49:03.295764 | debian-bookworm | +-a always,exit -F arch=b64 -S socket -F a0=2 -k network_socket_created 2026-07-20 06:49:03.295873 | debian-bookworm | + 2026-07-20 06:49:03.296003 | debian-bookworm | +-a always,exit -F arch=b32 -S socket -F a0=10 -k network_socket_created 2026-07-20 06:49:03.296118 | debian-bookworm | +-a always,exit -F arch=b64 -S socket -F a0=10 -k network_socket_created 2026-07-20 06:49:03.296230 | debian-bookworm | + 2026-07-20 06:49:03.296343 | debian-bookworm | +# Software Management --------------------------------------------------------- 2026-07-20 06:49:03.296454 | debian-bookworm | + 2026-07-20 06:49:03.296586 | debian-bookworm | +# RPM (Redhat/CentOS) 2026-07-20 06:49:03.296702 | debian-bookworm | +-w /usr/bin/rpm -p x -k software_mgmt 2026-07-20 06:49:03.296821 | debian-bookworm | +-w /usr/bin/yum -p x -k software_mgmt 2026-07-20 06:49:03.296947 | debian-bookworm | + 2026-07-20 06:49:03.297063 | debian-bookworm | +# DNF (Fedora/RedHat 8/CentOS 8) 2026-07-20 06:49:03.297177 | debian-bookworm | +-w /usr/bin/dnf -p x -k software_mgmt 2026-07-20 06:49:03.297289 | debian-bookworm | + 2026-07-20 06:49:03.297402 | debian-bookworm | +# YAST/Zypper/RPM (SuSE) 2026-07-20 06:49:03.297514 | debian-bookworm | +-w /sbin/yast -p x -k software_mgmt 2026-07-20 06:49:03.297626 | debian-bookworm | +-w /sbin/yast2 -p x -k software_mgmt 2026-07-20 06:49:03.297737 | debian-bookworm | +-w /bin/rpm -p x -k software_mgmt 2026-07-20 06:49:03.297850 | debian-bookworm | +-w /usr/bin/zypper -k software_mgmt 2026-07-20 06:49:03.297989 | debian-bookworm | + 2026-07-20 06:49:03.298103 | debian-bookworm | +# DPKG / APT-GET (Debian/Ubuntu) 2026-07-20 06:49:03.298216 | debian-bookworm | +-w /usr/bin/dpkg -p x -k software_mgmt 2026-07-20 06:49:03.298326 | debian-bookworm | +-w /usr/bin/apt -p x -k software_mgmt 2026-07-20 06:49:03.298438 | debian-bookworm | +-w /usr/bin/apt-add-repository -p x -k software_mgmt 2026-07-20 06:49:03.298552 | debian-bookworm | +-w /usr/bin/apt-get -p x -k software_mgmt 2026-07-20 06:49:03.298665 | debian-bookworm | +-w /usr/bin/aptitude -p x -k software_mgmt 2026-07-20 06:49:03.298779 | debian-bookworm | +-w /usr/bin/wajig -p x -k software_mgmt 2026-07-20 06:49:03.298890 | debian-bookworm | +-w /usr/bin/snap -p x -k software_mgmt 2026-07-20 06:49:03.299013 | debian-bookworm | + 2026-07-20 06:49:03.299127 | debian-bookworm | +# PIP(3) (Python installs) 2026-07-20 06:49:03.299243 | debian-bookworm | +-w /usr/bin/pip -p x -k third_party_software_mgmt 2026-07-20 06:49:03.299356 | debian-bookworm | +-w /usr/local/bin/pip -p x -k third_party_software_mgmt 2026-07-20 06:49:03.299469 | debian-bookworm | +-w /usr/bin/pip3 -p x -k third_party_software_mgmt 2026-07-20 06:49:03.299582 | debian-bookworm | +-w /usr/local/bin/pip3 -p x -k third_party_software_mgmt 2026-07-20 06:49:03.299693 | debian-bookworm | +-w /usr/bin/pipx -p x -k third_party_software_mgmt 2026-07-20 06:49:03.299804 | debian-bookworm | +-w /usr/local/bin/pipx -p x -k third_party_software_mgmt 2026-07-20 06:49:03.299927 | debian-bookworm | + 2026-07-20 06:49:03.300045 | debian-bookworm | +# npm 2026-07-20 06:49:03.300161 | debian-bookworm | +## T1072 third party software 2026-07-20 06:49:03.300275 | debian-bookworm | +## https://www.npmjs.com 2026-07-20 06:49:03.300388 | debian-bookworm | +## https://docs.npmjs.com/cli/v6/commands/npm-audit 2026-07-20 06:49:03.300517 | debian-bookworm | +-w /usr/bin/npm -p x -k third_party_software_mgmt 2026-07-20 06:49:03.300629 | debian-bookworm | + 2026-07-20 06:49:03.300745 | debian-bookworm | +# Comprehensive Perl Archive Network (CPAN) (CPAN installs) 2026-07-20 06:49:03.300859 | debian-bookworm | +## T1072 third party software 2026-07-20 06:49:03.300997 | debian-bookworm | +## https://www.cpan.org 2026-07-20 06:49:03.301116 | debian-bookworm | +-w /usr/bin/cpan -p x -k third_party_software_mgmt 2026-07-20 06:49:03.301225 | debian-bookworm | + 2026-07-20 06:49:03.301339 | debian-bookworm | +# Ruby (RubyGems installs) 2026-07-20 06:49:03.301454 | debian-bookworm | +## T1072 third party software 2026-07-20 06:49:03.301566 | debian-bookworm | +## https://rubygems.org 2026-07-20 06:49:03.301679 | debian-bookworm | +-w /usr/bin/gem -p x -k third_party_software_mgmt 2026-07-20 06:49:03.301789 | debian-bookworm | + 2026-07-20 06:49:03.301931 | debian-bookworm | +# LuaRocks (Lua installs) 2026-07-20 06:49:03.302051 | debian-bookworm | +## T1072 third party software 2026-07-20 06:49:03.302172 | debian-bookworm | +## https://luarocks.org 2026-07-20 06:49:03.302291 | debian-bookworm | +-w /usr/bin/luarocks -p x -k third_party_software_mgmt 2026-07-20 06:49:03.302400 | debian-bookworm | + 2026-07-20 06:49:03.302512 | debian-bookworm | +# Pacman (Arch Linux) 2026-07-20 06:49:03.302625 | debian-bookworm | +## https://wiki.archlinux.org/title/Pacman 2026-07-20 06:49:03.302739 | debian-bookworm | +## T1072 third party software 2026-07-20 06:49:03.302854 | debian-bookworm | +-w /etc/pacman.conf -p x -k third_party_software_mgmt 2026-07-20 06:49:03.302991 | debian-bookworm | +-w /etc/pacman.d -p x -k third_party_software_mgmt 2026-07-20 06:49:03.303103 | debian-bookworm | + 2026-07-20 06:49:03.303223 | debian-bookworm | +# Special Software ------------------------------------------------------------ 2026-07-20 06:49:03.303333 | debian-bookworm | + 2026-07-20 06:49:03.303444 | debian-bookworm | +## GDS specific secrets 2026-07-20 06:49:03.303557 | debian-bookworm | +-w /etc/puppet/ssl -p wa -k puppet_ssl 2026-07-20 06:49:03.303667 | debian-bookworm | + 2026-07-20 06:49:03.303779 | debian-bookworm | +## IBM Bigfix BESClient 2026-07-20 06:49:03.303895 | debian-bookworm | +-a always,exit -F arch=b64 -S open -F dir=/opt/BESClient -F success=0 -k soft_besclient 2026-07-20 06:49:03.304019 | debian-bookworm | +-w /var/opt/BESClient/ -p wa -k soft_besclient 2026-07-20 06:49:03.304128 | debian-bookworm | + 2026-07-20 06:49:03.304243 | debian-bookworm | +## CHEF https://www.chef.io/chef/ 2026-07-20 06:49:03.304356 | debian-bookworm | +-w /etc/chef -p wa -k soft_chef 2026-07-20 06:49:03.304464 | debian-bookworm | + 2026-07-20 06:49:03.304598 | debian-bookworm | +## Salt 2026-07-20 06:49:03.304709 | debian-bookworm | +## https://saltproject.io/ 2026-07-20 06:49:03.304826 | debian-bookworm | +## https://docs.saltproject.io/en/latest/ref/configuration/master.html 2026-07-20 06:49:03.304965 | debian-bookworm | +-w /etc/salt -p wa -k soft_salt 2026-07-20 06:49:03.305080 | debian-bookworm | +-w /usr/local/etc/salt -p wa -k soft_salt 2026-07-20 06:49:03.305189 | debian-bookworm | + 2026-07-20 06:49:03.305300 | debian-bookworm | +## Otter 2026-07-20 06:49:03.305411 | debian-bookworm | +## https://inedo.com/otter 2026-07-20 06:49:03.305526 | debian-bookworm | +-w /etc/otter -p wa -k soft_otter 2026-07-20 06:49:03.305634 | debian-bookworm | + 2026-07-20 06:49:03.305746 | debian-bookworm | +## T1081 Credentials In Files 2026-07-20 06:49:03.305864 | debian-bookworm | +-w /usr/bin/grep -p x -k string_search 2026-07-20 06:49:03.305990 | debian-bookworm | +-w /usr/bin/egrep -p x -k string_search 2026-07-20 06:49:03.306106 | debian-bookworm | +-w /usr/bin/ugrep -p x -k string_search 2026-07-20 06:49:03.306218 | debian-bookworm | +### macOS 2026-07-20 06:49:03.306332 | debian-bookworm | +-w /usr/local/bin/grep -p x -k string_search 2026-07-20 06:49:03.306446 | debian-bookworm | +-w /usr/local/bin/egrep -p x -k string_search 2026-07-20 06:49:03.306558 | debian-bookworm | +-w /usr/local/bin/ugrep -p x -k string_search 2026-07-20 06:49:03.306669 | debian-bookworm | + 2026-07-20 06:49:03.306784 | debian-bookworm | +### https://github.com/tmbinc/bgrep 2026-07-20 06:49:03.306896 | debian-bookworm | +-w /usr/bin/bgrep -p x -k string_search 2026-07-20 06:49:03.307017 | debian-bookworm | +### macOS 2026-07-20 06:49:03.307130 | debian-bookworm | +-w /usr/local/bin/bgrep -p x -k string_search 2026-07-20 06:49:03.307239 | debian-bookworm | + 2026-07-20 06:49:03.307353 | debian-bookworm | +### https://github.com/BurntSushi/ripgrep 2026-07-20 06:49:03.307469 | debian-bookworm | +-w /usr/bin/rg -p x -k string_search 2026-07-20 06:49:03.307581 | debian-bookworm | +### macOS 2026-07-20 06:49:03.307697 | debian-bookworm | +-w /usr/local/bin/rg -p x -k string_search 2026-07-20 06:49:03.307808 | debian-bookworm | + 2026-07-20 06:49:03.307928 | debian-bookworm | +### https://github.com/awgn/cgrep 2026-07-20 06:49:03.308042 | debian-bookworm | + 2026-07-20 06:49:03.308155 | debian-bookworm | +-w /usr/bin/cgrep -p x -k string_search 2026-07-20 06:49:03.308268 | debian-bookworm | +### macOS 2026-07-20 06:49:03.308382 | debian-bookworm | +-w /usr/local/bin/cgrep -p x -k string_search 2026-07-20 06:49:03.308506 | debian-bookworm | + 2026-07-20 06:49:03.308624 | debian-bookworm | +### https://github.com/jpr5/ngrep 2026-07-20 06:49:03.308736 | debian-bookworm | +-w /usr/bin/ngrep -p x -k string_search 2026-07-20 06:49:03.308851 | debian-bookworm | +### macOS 2026-07-20 06:49:03.309014 | debian-bookworm | +-w /usr/local/bin/ngrep -p x -k string_search 2026-07-20 06:49:03.309129 | debian-bookworm | + 2026-07-20 06:49:03.309243 | debian-bookworm | +### https://github.com/vrothberg/vgrep 2026-07-20 06:49:03.309358 | debian-bookworm | +-w /usr/bin/vgrep -p x -k string_search 2026-07-20 06:49:03.309469 | debian-bookworm | +### macOS 2026-07-20 06:49:03.309581 | debian-bookworm | +-w /usr/local/bin/vgrep -p x -k string_search 2026-07-20 06:49:03.309691 | debian-bookworm | + 2026-07-20 06:49:03.309804 | debian-bookworm | +### https://github.com/monochromegane/the_platinum_searcher 2026-07-20 06:49:03.309929 | debian-bookworm | +-w /usr/bin/pt -p x -k string_search 2026-07-20 06:49:03.310043 | debian-bookworm | +### macOS 2026-07-20 06:49:03.310165 | debian-bookworm | +-w /usr/local/bin/pt -p x -k string_search 2026-07-20 06:49:03.310275 | debian-bookworm | + 2026-07-20 06:49:03.310388 | debian-bookworm | +### https://github.com/gvansickle/ucg 2026-07-20 06:49:03.310500 | debian-bookworm | +-w /usr/bin/ucg -p x -k string_search 2026-07-20 06:49:03.310611 | debian-bookworm | +### macOS 2026-07-20 06:49:03.310723 | debian-bookworm | +-w /usr/local/bin/ucg -p x -k string_search 2026-07-20 06:49:03.310832 | debian-bookworm | + 2026-07-20 06:49:03.310972 | debian-bookworm | +### https://github.com/ggreer/the_silver_searcher 2026-07-20 06:49:03.311088 | debian-bookworm | +-w /usr/bin/ag -p x -k string_search 2026-07-20 06:49:03.311200 | debian-bookworm | +### macOS 2026-07-20 06:49:03.311315 | debian-bookworm | +-w /usr/local/bin/ag -p x -k string_search 2026-07-20 06:49:03.311426 | debian-bookworm | + 2026-07-20 06:49:03.311539 | debian-bookworm | +### https://github.com/beyondgrep/ack3 2026-07-20 06:49:03.311653 | debian-bookworm | +### https://beyondgrep.com 2026-07-20 06:49:03.311767 | debian-bookworm | +-w /usr/bin/ack -p x -k string_search 2026-07-20 06:49:03.311880 | debian-bookworm | +-w /usr/local/bin/ack -p x -k string_search 2026-07-20 06:49:03.312005 | debian-bookworm | +-w /usr/bin/semgrep -p x -k string_search 2026-07-20 06:49:03.312118 | debian-bookworm | +### macOS 2026-07-20 06:49:03.312232 | debian-bookworm | +-w /usr/local/bin/semgrep -p x -k string_search 2026-07-20 06:49:03.312343 | debian-bookworm | + 2026-07-20 06:49:03.312453 | debian-bookworm | +## Docker 2026-07-20 06:49:03.312588 | debian-bookworm | +-w /usr/bin/dockerd -k docker 2026-07-20 06:49:03.312702 | debian-bookworm | +-w /usr/bin/docker -k docker 2026-07-20 06:49:03.312818 | debian-bookworm | +-w /usr/bin/docker-containerd -k docker 2026-07-20 06:49:03.312941 | debian-bookworm | +-w /usr/bin/docker-runc -k docker 2026-07-20 06:49:03.313055 | debian-bookworm | +-w /var/lib/docker -p wa -k docker 2026-07-20 06:49:03.313167 | debian-bookworm | +-w /etc/docker -k docker 2026-07-20 06:49:03.313279 | debian-bookworm | +-w /etc/sysconfig/docker -k docker 2026-07-20 06:49:03.313391 | debian-bookworm | +-w /etc/sysconfig/docker-storage -k docker 2026-07-20 06:49:03.313508 | debian-bookworm | +-w /usr/lib/systemd/system/docker.service -k docker 2026-07-20 06:49:03.313622 | debian-bookworm | +-w /usr/lib/systemd/system/docker.socket -k docker 2026-07-20 06:49:03.313732 | debian-bookworm | + 2026-07-20 06:49:03.313845 | debian-bookworm | +## Virtualization stuff 2026-07-20 06:49:03.313987 | debian-bookworm | +-w /usr/bin/qemu-system-x86_64 -p x -k qemu-system-x86_64 2026-07-20 06:49:03.314102 | debian-bookworm | +-w /usr/bin/qemu-img -p x -k qemu-img 2026-07-20 06:49:03.314214 | debian-bookworm | +-w /usr/bin/qemu-kvm -p x -k qemu-kvm 2026-07-20 06:49:03.314328 | debian-bookworm | +-w /usr/bin/qemu -p x -k qemu 2026-07-20 06:49:03.314441 | debian-bookworm | +-w /usr/bin/virtualbox -p x -k virtualbox 2026-07-20 06:49:03.314553 | debian-bookworm | +-w /usr/bin/virt-manager -p x -k virt-manager 2026-07-20 06:49:03.314667 | debian-bookworm | +-w /usr/bin/VBoxManage -p x -k VBoxManage 2026-07-20 06:49:03.314777 | debian-bookworm | + 2026-07-20 06:49:03.314891 | debian-bookworm | +#### VirtualBox on macOS 2026-07-20 06:49:03.315013 | debian-bookworm | + 2026-07-20 06:49:03.315132 | debian-bookworm | +-w /usr/local/bin/VirtualBox -p x -k virt_tool 2026-07-20 06:49:03.315245 | debian-bookworm | +-w /usr/local/bin/VirtualBoxVM -p x -k virt_tool 2026-07-20 06:49:03.315358 | debian-bookworm | +-w /usr/local/bin/VBoxManage -p x -k virt_tool 2026-07-20 06:49:03.315473 | debian-bookworm | +-w /usr/local/bin/VBoxVRDP -p x -k virt_tool 2026-07-20 06:49:03.315588 | debian-bookworm | +-w /usr/local/bin/VBoxHeadless -p x -k virt_tool 2026-07-20 06:49:03.315703 | debian-bookworm | +-w /usr/local/bin/vboxwebsrv -p x -k virt_tool 2026-07-20 06:49:03.315817 | debian-bookworm | +-w /usr/local/bin/VBoxBugReport -p x -k virt_tool 2026-07-20 06:49:03.315940 | debian-bookworm | +-w /usr/local/bin/VBoxBalloonCtrl -p x -k virt_tool 2026-07-20 06:49:03.316055 | debian-bookworm | +-w /usr/local/bin/VBoxAutostart -p x -k virt_tool 2026-07-20 06:49:03.316167 | debian-bookworm | +-w /usr/local/bin/VBoxDTrace -p x -k virt_tool 2026-07-20 06:49:03.316279 | debian-bookworm | +-w /usr/local/bin/vbox-img -p x -k virt_tool 2026-07-20 06:49:03.316394 | debian-bookworm | +-w /Library/LaunchDaemons/org.virtualbox.startup.plist -p x -k virt_tool 2026-07-20 06:49:03.316524 | debian-bookworm | +-w /Library/Application Support/VirtualBox/LaunchDaemons/ -p x -k virt_tool 2026-07-20 06:49:03.316645 | debian-bookworm | +-w /Library/Application Support/VirtualBox/VBoxDrv.kext/ -p x -k virt_tool 2026-07-20 06:49:03.316761 | debian-bookworm | +-w /Library/Application Support/VirtualBox/VBoxUSB.kext/ -p x -k virt_tool 2026-07-20 06:49:03.316874 | debian-bookworm | +-w /Library/Application Support/VirtualBox/VBoxNetFlt.kext/ -p x -k virt_tool 2026-07-20 06:49:03.317018 | debian-bookworm | +-w /Library/Application Support/VirtualBox/VBoxNetAdp.kext/ -p x -k virt_tool 2026-07-20 06:49:03.317134 | debian-bookworm | + 2026-07-20 06:49:03.317260 | debian-bookworm | +### Parallels Desktop on macOS 2026-07-20 06:49:03.317371 | debian-bookworm | + 2026-07-20 06:49:03.317486 | debian-bookworm | +-w /usr/local/bin/prl_convert -p x -k virt_tool 2026-07-20 06:49:03.317600 | debian-bookworm | +-w /usr/local/bin/prl_disk_tool -p x -k virt_tool 2026-07-20 06:49:03.317711 | debian-bookworm | +-w /usr/local/bin/prl_perf_ctl -p x -k virt_tool 2026-07-20 06:49:03.317823 | debian-bookworm | +-w /usr/local/bin/prlcore2dmp -p x -k virt_tool 2026-07-20 06:49:03.317944 | debian-bookworm | +-w /usr/local/bin/prlctl -p x -k virt_tool 2026-07-20 06:49:03.318059 | debian-bookworm | +-w /usr/local/bin/prlexec -p x -k virt_tool 2026-07-20 06:49:03.318172 | debian-bookworm | +-w /usr/local/bin/prlsrvctl -p x -k virt_tool 2026-07-20 06:49:03.318286 | debian-bookworm | +-w /Library/Preferences/Parallels -p x -k virt_tool 2026-07-20 06:49:03.318395 | debian-bookworm | + 2026-07-20 06:49:03.318533 | debian-bookworm | +### qemu on macOS 2026-07-20 06:49:03.318653 | debian-bookworm | + 2026-07-20 06:49:03.318767 | debian-bookworm | +-w /usr/local/bin/qemu-edid -p x -k virt_tool 2026-07-20 06:49:03.318881 | debian-bookworm | +-w /usr/local/bin/qemu-img -p x -k virt_tool 2026-07-20 06:49:03.319024 | debian-bookworm | +-w /usr/local/bin/qemu-io -p x -k virt_tool 2026-07-20 06:49:03.319139 | debian-bookworm | +-w /usr/local/bin/qemu-nbd -p x -k virt_tool 2026-07-20 06:49:03.319254 | debian-bookworm | +-w /usr/local/bin/qemu-system-x86_64 -p x -k virt_tool 2026-07-20 06:49:03.319366 | debian-bookworm | + 2026-07-20 06:49:03.319478 | debian-bookworm | +## Kubelet 2026-07-20 06:49:03.319590 | debian-bookworm | +-w /usr/bin/kubelet -k kubelet 2026-07-20 06:49:03.319699 | debian-bookworm | + 2026-07-20 06:49:03.319812 | debian-bookworm | +# ipc system call 2026-07-20 06:49:03.319976 | debian-bookworm | +# /usr/include/linux/ipc.h 2026-07-20 06:49:03.320092 | debian-bookworm | + 2026-07-20 06:49:03.320205 | debian-bookworm | +## msgctl 2026-07-20 06:49:03.320327 | debian-bookworm | +#-a always,exit -S ipc -F a0=14 -k Inter-Process_Communication 2026-07-20 06:49:03.320439 | debian-bookworm | +## msgget 2026-07-20 06:49:03.320567 | debian-bookworm | +#-a always,exit -S ipc -F a0=13 -k Inter-Process_Communication 2026-07-20 06:49:03.320682 | debian-bookworm | +## Use these lines on x86_64, ia64 instead 2026-07-20 06:49:03.320797 | debian-bookworm | +-a always,exit -F arch=b64 -S msgctl -k Inter-Process_Communication 2026-07-20 06:49:03.320920 | debian-bookworm | +-a always,exit -F arch=b64 -S msgget -k Inter-Process_Communication 2026-07-20 06:49:03.321030 | debian-bookworm | + 2026-07-20 06:49:03.321141 | debian-bookworm | +## semctl 2026-07-20 06:49:03.321256 | debian-bookworm | +#-a always,exit -S ipc -F a0=3 -k Inter-Process_Communication 2026-07-20 06:49:03.321365 | debian-bookworm | +## semget 2026-07-20 06:49:03.321478 | debian-bookworm | +#-a always,exit -S ipc -F a0=2 -k Inter-Process_Communication 2026-07-20 06:49:03.321587 | debian-bookworm | +## semop 2026-07-20 06:49:03.321702 | debian-bookworm | +#-a always,exit -S ipc -F a0=1 -k Inter-Process_Communication 2026-07-20 06:49:03.321814 | debian-bookworm | +## semtimedop 2026-07-20 06:49:03.321939 | debian-bookworm | +#-a always,exit -S ipc -F a0=4 -k Inter-Process_Communication 2026-07-20 06:49:03.322054 | debian-bookworm | +## Use these lines on x86_64, ia64 instead 2026-07-20 06:49:03.322171 | debian-bookworm | +-a always,exit -F arch=b64 -S semctl -k Inter-Process_Communication 2026-07-20 06:49:03.322286 | debian-bookworm | +-a always,exit -F arch=b64 -S semget -k Inter-Process_Communication 2026-07-20 06:49:03.322400 | debian-bookworm | +-a always,exit -F arch=b64 -S semop -k Inter-Process_Communication 2026-07-20 06:49:03.322514 | debian-bookworm | +-a always,exit -F arch=b64 -S semtimedop -k Inter-Process_Communication 2026-07-20 06:49:03.322622 | debian-bookworm | + 2026-07-20 06:49:03.322733 | debian-bookworm | +## shmctl 2026-07-20 06:49:03.322846 | debian-bookworm | +#-a always,exit -S ipc -F a0=24 -k Inter-Process_Communication 2026-07-20 06:49:03.322966 | debian-bookworm | +## shmget 2026-07-20 06:49:03.323081 | debian-bookworm | +#-a always,exit -S ipc -F a0=23 -k Inter-Process_Communication 2026-07-20 06:49:03.323196 | debian-bookworm | +## Use these lines on x86_64, ia64 instead 2026-07-20 06:49:03.323314 | debian-bookworm | +-a always,exit -F arch=b64 -S shmctl -k Inter-Process_Communication 2026-07-20 06:49:03.323429 | debian-bookworm | +-a always,exit -F arch=b64 -S shmget -k Inter-Process_Communication 2026-07-20 06:49:03.323538 | debian-bookworm | + 2026-07-20 06:49:03.323650 | debian-bookworm | +# High Volume Events ---------------------------------------------------------- 2026-07-20 06:49:03.323759 | debian-bookworm | + 2026-07-20 06:49:03.323872 | debian-bookworm | +## Disable these rules if they create too many events in your environment 2026-07-20 06:49:03.324029 | debian-bookworm | + 2026-07-20 06:49:03.324145 | debian-bookworm | +## Common Shells 2026-07-20 06:49:03.324258 | debian-bookworm | +-w /bin/bash -p x -k susp_shell 2026-07-20 06:49:03.324370 | debian-bookworm | +-w /bin/dash -p x -k susp_shell 2026-07-20 06:49:03.324504 | debian-bookworm | +-w /bin/busybox -p x -k susp_shell 2026-07-20 06:49:03.324618 | debian-bookworm | +-w /bin/zsh -p x -k susp_shell 2026-07-20 06:49:03.324731 | debian-bookworm | +-w /bin/sh -p x -k susp_shell 2026-07-20 06:49:03.324843 | debian-bookworm | +-w /bin/ksh -p x -k susp_shell 2026-07-20 06:49:03.324963 | debian-bookworm | + 2026-07-20 06:49:03.325077 | debian-bookworm | +## Root command executions 2026-07-20 06:49:03.325191 | debian-bookworm | +-a always,exit -F arch=b64 -F euid=0 -F auid>=1000 -F auid!=-1 -S execve -k rootcmd 2026-07-20 06:49:03.325302 | debian-bookworm | + 2026-07-20 06:49:03.325415 | debian-bookworm | +## File Deletion Events by User 2026-07-20 06:49:03.325530 | debian-bookworm | +-a always,exit -F arch=b64 -S rmdir -S unlink -S unlinkat -S rename -S renameat -F auid>=1000 -F auid!=-1 -k delete 2026-07-20 06:49:03.325640 | debian-bookworm | + 2026-07-20 06:49:03.325750 | debian-bookworm | +## File Access 2026-07-20 06:49:03.325864 | debian-bookworm | +### Unauthorized Access (unsuccessful) 2026-07-20 06:49:03.326007 | debian-bookworm | +-a always,exit -F arch=b64 -S creat -S open -S openat -S open_by_handle_at -S truncate -S ftruncate -F exit=-EACCES -F auid>=1000 -F auid!=-1 -k file_access 2026-07-20 06:49:03.326128 | debian-bookworm | +-a always,exit -F arch=b64 -S creat -S open -S openat -S open_by_handle_at -S truncate -S ftruncate -F exit=-EPERM -F auid>=1000 -F auid!=-1 -k file_access 2026-07-20 06:49:03.326241 | debian-bookworm | + 2026-07-20 06:49:03.326354 | debian-bookworm | +### Unsuccessful Creation 2026-07-20 06:49:03.326468 | debian-bookworm | +-a always,exit -F arch=b64 -S mkdir,creat,link,symlink,mknod,mknodat,linkat,symlinkat -F exit=-EACCES -k file_creation 2026-07-20 06:49:03.326584 | debian-bookworm | +-a always,exit -F arch=b64 -S mkdir,link,symlink,mkdirat -F exit=-EPERM -k file_creation 2026-07-20 06:49:03.326695 | debian-bookworm | + 2026-07-20 06:49:03.326807 | debian-bookworm | +### Unsuccessful Modification 2026-07-20 06:49:03.326932 | debian-bookworm | +-a always,exit -F arch=b64 -S rename -S renameat -S truncate -S chmod -S setxattr -S lsetxattr -S removexattr -S lremovexattr -F exit=-EACCES -k file_modification 2026-07-20 06:49:03.327052 | debian-bookworm | +-a always,exit -F arch=b64 -S rename -S renameat -S truncate -S chmod -S setxattr -S lsetxattr -S removexattr -S lremovexattr -F exit=-EPERM -k file_modification 2026-07-20 06:49:03.327161 | debian-bookworm | + 2026-07-20 06:49:03.327273 | debian-bookworm | +## 32bit API Exploitation 2026-07-20 06:49:03.327388 | debian-bookworm | +### If you are on a 64 bit platform, everything _should_ be running 2026-07-20 06:49:03.327501 | debian-bookworm | +### in 64 bit mode. This rule will detect any use of the 32 bit syscalls 2026-07-20 06:49:03.327614 | debian-bookworm | +### because this might be a sign of someone exploiting a hole in the 32 2026-07-20 06:49:03.327727 | debian-bookworm | +### bit API. 2026-07-20 06:49:03.327845 | debian-bookworm | +-a always,exit -F arch=b32 -S all -k 32bit_api 2026-07-20 06:49:03.327966 | debian-bookworm | + 2026-07-20 06:49:03.328081 | debian-bookworm | +# Make The Configuration Immutable -------------------------------------------- 2026-07-20 06:49:03.328190 | debian-bookworm | + 2026-07-20 06:49:03.328303 | debian-bookworm | +##-e 2 2026-07-20 06:49:03.328410 | debian-bookworm | 2026-07-20 06:49:03.328637 | debian-bookworm | changed: [molecule-auditd] => (item=20-neo23x0.rules) => {"ansible_loop_var": "item", "changed": true, "checksum": "9f99ce5c4f891fbf3e2bce06ed4cb97fb9e01f41", "dest": "/etc/audit/rules.d/20-neo23x0.rules", "gid": 0, "group": "root", "item": "20-neo23x0.rules", "md5sum": "6ac57206fd77de34805c3f4d50ef8b1d", "mode": "0644", "owner": "root", "size": 27367, "src": "/home/zuul/.ansible/tmp/ansible-tmp-1784530142.2872589-2643-30864866286116/.source.rules", "state": "file", "uid": 0} 2026-07-20 06:49:03.328752 | debian-bookworm | 2026-07-20 06:49:03.328868 | debian-bookworm | TASK [auditd : Manage auditd service] ****************************************** 2026-07-20 06:49:04.038835 | debian-bookworm | ok: [molecule-auditd] => {"changed": false, "enabled": true, "name": "auditd", "state": "started", "status": {"ActiveEnterTimestamp": "Mon 2026-07-20 06:48:57 UTC", "ActiveEnterTimestampMonotonic": "184725278", "ActiveExitTimestampMonotonic": "0", "ActiveState": "active", "After": "systemd-journald.socket local-fs.target system.slice systemd-tmpfiles-setup.service", "AllowIsolate": "no", "AssertResult": "yes", "AssertTimestamp": "Mon 2026-07-20 06:48:57 UTC", "AssertTimestampMonotonic": "184668704", "Before": "shutdown.target ssh.service sysinit.target systemd-update-utmp.service", "BlockIOAccounting": "no", "BlockIOWeight": "[not set]", "CPUAccounting": "yes", "CPUAffinityFromNUMA": "no", "CPUQuotaPerSecUSec": "infinity", "CPUQuotaPeriodUSec": "infinity", "CPUSchedulingPolicy": "0", "CPUSchedulingPriority": "0", "CPUSchedulingResetOnFork": "no", "CPUShares": "[not set]", "CPUUsageNSec": "40629000", "CPUWeight": "[not set]", "CacheDirectoryMode": "0755", "CanFreeze": "yes", "CanIsolate": "no", "CanReload": "no", "CanStart": "yes", "CanStop": "yes", "CapabilityBoundingSet": "cap_chown cap_dac_override cap_dac_read_search cap_fowner cap_fsetid cap_kill cap_setgid cap_setuid cap_setpcap cap_linux_immutable cap_net_bind_service cap_net_broadcast cap_net_admin cap_net_raw cap_ipc_lock cap_ipc_owner cap_sys_rawio cap_sys_chroot cap_sys_ptrace cap_sys_pacct cap_sys_admin cap_sys_boot cap_sys_nice cap_sys_resource cap_sys_time cap_sys_tty_config cap_mknod cap_lease cap_audit_write cap_audit_control cap_setfcap cap_mac_override cap_mac_admin cap_syslog cap_wake_alarm cap_block_suspend cap_audit_read cap_perfmon cap_bpf cap_checkpoint_restore", "CleanResult": "success", "CollectMode": "inactive", "ConditionResult": "yes", "ConditionTimestamp": "Mon 2026-07-20 06:48:57 UTC", "ConditionTimestampMonotonic": "184668673", "ConfigurationDirectoryMode": "0755", "Conflicts": "shutdown.target", "ControlGroup": "/system.slice/auditd.service", "ControlGroupId": "3328", "ControlPID": "0", "CoredumpFilter": "0x33", "DefaultDependencies": "no", "DefaultMemoryLow": "0", "DefaultMemoryMin": "0", "Delegate": "no", "Description": "Security Auditing Service", "DevicePolicy": "auto", "Documentation": "\"man:auditd(8)\" https://github.com/linux-audit/audit-documentation", "DynamicUser": "no", "ExecMainCode": "0", "ExecMainExitTimestampMonotonic": "0", "ExecMainPID": "2415", "ExecMainStartTimestamp": "Mon 2026-07-20 06:48:57 UTC", "ExecMainStartTimestampMonotonic": "184703758", "ExecMainStatus": "0", "ExecStart": "{ path=/sbin/auditd ; argv[]=/sbin/auditd ; ignore_errors=no ; start_time=[Mon 2026-07-20 06:48:57 UTC] ; stop_time=[Mon 2026-07-20 06:48:57 UTC] ; pid=2414 ; code=exited ; status=0 }", "ExecStartEx": "{ path=/sbin/auditd ; argv[]=/sbin/auditd ; flags= ; start_time=[Mon 2026-07-20 06:48:57 UTC] ; stop_time=[Mon 2026-07-20 06:48:57 UTC] ; pid=2414 ; code=exited ; status=0 }", "ExecStartPost": "{ path=/sbin/augenrules ; argv[]=/sbin/augenrules --load ; ignore_errors=yes ; start_time=[Mon 2026-07-20 06:48:57 UTC] ; stop_time=[Mon 2026-07-20 06:48:57 UTC] ; pid=2418 ; code=exited ; status=0 }", "ExecStartPostEx": "{ path=/sbin/augenrules ; argv[]=/sbin/augenrules --load ; flags=ignore-failure ; start_time=[Mon 2026-07-20 06:48:57 UTC] ; stop_time=[Mon 2026-07-20 06:48:57 UTC] ; pid=2418 ; code=exited ; status=0 }", "ExitType": "main", "FailureAction": "none", "FileDescriptorStoreMax": "0", "FinalKillSignal": "9", "FragmentPath": "/lib/systemd/system/auditd.service", "FreezerState": "running", "GID": "[not set]", "GuessMainPID": "yes", "IOAccounting": "no", "IOReadBytes": "18446744073709551615", "IOReadOperations": "18446744073709551615", "IOSchedulingClass": "2", "IOSchedulingPriority": "4", "IOWeight": "[not set]", "IOWriteBytes": "18446744073709551615", "IOWriteOperations": "18446744073709551615", "IPAccounting": "no", "IPEgressBytes": "[no data]", "IPEgressPackets": "[no data]", "IPIngressBytes": "[no data]", "IPIngressPackets": "[no data]", "Id": "auditd.service", "IgnoreOnIsolate": "no", "IgnoreSIGPIPE": "yes", "InactiveEnterTimestampMonotonic": "0", "InactiveExitTimestamp": "Mon 2026-07-20 06:48:57 UTC", "InactiveExitTimestampMonotonic": "184684523", "InvocationID": "740b123c2bd64b54bc4490ee72d824e8", "JobRunningTimeoutUSec": "infinity", "JobTimeoutAction": "none", "JobTimeoutUSec": "infinity", "KeyringMode": "private", "KillMode": "control-group", "KillSignal": "15", "LimitAS": "infinity", "LimitASSoft": "infinity", "LimitCORE": "infinity", "LimitCORESoft": "0", "LimitCPU": "infinity", "LimitCPUSoft": "infinity", "LimitDATA": "infinity", "LimitDATASoft": "infinity", "LimitFSIZE": "infinity", "LimitFSIZESoft": "infinity", "LimitLOCKS": "infinity", "LimitLOCKSSoft": "infinity", "LimitMEMLOCK": "8388608", "LimitMEMLOCKSoft": "8388608", "LimitMSGQUEUE": "819200", "LimitMSGQUEUESoft": "819200", "LimitNICE": "0", "LimitNICESoft": "0", "LimitNOFILE": "524288", "LimitNOFILESoft": "1024", "LimitNPROC": "15480", "LimitNPROCSoft": "15480", "LimitRSS": "infinity", "LimitRSSSoft": "infinity", "LimitRTPRIO": "0", "LimitRTPRIOSoft": "0", "LimitRTTIME": "infinity", "LimitRTTIMESoft": "infinity", "LimitSIGPENDING": "15480", "LimitSIGPENDINGSoft": "15480", "LimitSTACK": "infinity", "LimitSTACKSoft": "8388608", "LoadState": "loaded", "LockPersonality": "yes", "LogLevelMax": "-1", "LogRateLimitBurst": "0", "LogRateLimitIntervalUSec": "0", "LogsDirectoryMode": "0755", "MainPID": "2415", "ManagedOOMMemoryPressure": "auto", "ManagedOOMMemoryPressureLimit": "0", "ManagedOOMPreference": "none", "ManagedOOMSwap": "auto", "MemoryAccounting": "yes", "MemoryAvailable": "infinity", "MemoryCurrent": "712704", "MemoryDenyWriteExecute": "yes", "MemoryHigh": "infinity", "MemoryLimit": "infinity", "MemoryLow": "0", "MemoryMax": "infinity", "MemoryMin": "0", "MemorySwapMax": "infinity", "MountAPIVFS": "no", "NFileDescriptorStore": "0", "NRestarts": "0", "NUMAPolicy": "n/a", "Names": "auditd.service", "NeedDaemonReload": "no", "Nice": "0", "NoNewPrivileges": "no", "NonBlocking": "no", "NotifyAccess": "none", "OOMPolicy": "stop", "OOMScoreAdjust": "0", "OnFailureJobMode": "replace", "OnSuccessJobMode": "fail", "PIDFile": "/run/auditd.pid", "Perpetual": "no", "PrivateDevices": "no", "PrivateIPC": "no", "PrivateMounts": "no", "PrivateNetwork": "no", "PrivateTmp": "no", "PrivateUsers": "no", "ProcSubset": "all", "ProtectClock": "no", "ProtectControlGroups": "yes", "ProtectHome": "no", "ProtectHostname": "no", "ProtectKernelLogs": "no", "ProtectKernelModules": "yes", "ProtectKernelTunables": "no", "ProtectProc": "default", "ProtectSystem": "no", "RefuseManualStart": "no", "RefuseManualStop": "no", "ReloadResult": "success", "RemainAfterExit": "no", "RemoveIPC": "no", "Requires": "system.slice", "Restart": "on-failure", "RestartKillSignal": "15", "RestartPreventExitStatus": "2 4 6", "RestartUSec": "100ms", "RestrictNamespaces": "no", "RestrictRealtime": "yes", "RestrictSUIDSGID": "no", "Result": "success", "RootDirectoryStartOnly": "no", "RuntimeDirectoryMode": "0755", "RuntimeDirectoryPreserve": "no", "RuntimeMaxUSec": "infinity", "RuntimeRandomizedExtraUSec": "0", "SameProcessGroup": "no", "SecureBits": "0", "SendSIGHUP": "no", "SendSIGKILL": "yes", "Slice": "system.slice", "StandardError": "inherit", "StandardInput": "null", "StandardOutput": "journal", "StartLimitAction": "none", "StartLimitBurst": "5", "StartLimitIntervalUSec": "10s", "StartupBlockIOWeight": "[not set]", "StartupCPUShares": "[not set]", "StartupCPUWeight": "[not set]", "StartupIOWeight": "[not set]", "StateChangeTimestamp": "Mon 2026-07-20 06:48:57 UTC", "StateChangeTimestampMonotonic": "184725278", "StateDirectoryMode": "0755", "StatusErrno": "0", "StopWhenUnneeded": "no", "SubState": "running", "SuccessAction": "none", "SyslogFacility": "3", "SyslogLevel": "6", "SyslogLevelPrefix": "yes", "SyslogPriority": "30", "SystemCallErrorNumber": "2147483646", "TTYReset": "no", "TTYVHangup": "no", "TTYVTDisallocate": "no", "TasksAccounting": "yes", "TasksCurrent": "2", "TasksMax": "4644", "TimeoutAbortUSec": "1min 30s", "TimeoutCleanUSec": "infinity", "TimeoutStartFailureMode": "terminate", "TimeoutStartUSec": "1min 30s", "TimeoutStopFailureMode": "terminate", "TimeoutStopUSec": "1min 30s", "TimerSlackNSec": "50000", "Transient": "no", "Type": "forking", "UID": "[not set]", "UMask": "0022", "UnitFilePreset": "enabled", "UnitFileState": "enabled", "UtmpMode": "init", "WantedBy": "multi-user.target", "WatchdogSignal": "6", "WatchdogTimestampMonotonic": "0", "WatchdogUSec": "0"}} 2026-07-20 06:49:04.044757 | debian-bookworm | 2026-07-20 06:49:04.044789 | debian-bookworm | TASK [auditd : List existing rules files] ************************************** 2026-07-20 06:49:04.580219 | debian-bookworm | ok: [molecule-auditd] => {"changed": false, "cmd": ["find", "/etc/audit/rules.d", "-type", "f", "-printf", "%f\n"], "delta": "0:00:00.007061", "end": "2026-07-20 06:49:04.535691", "msg": "", "rc": 0, "start": "2026-07-20 06:49:04.528630", "stderr": "", "stderr_lines": [], "stdout": "audit.rules\n20-neo23x0.rules", "stdout_lines": ["audit.rules", "20-neo23x0.rules"]} 2026-07-20 06:49:04.580278 | debian-bookworm | 2026-07-20 06:49:04.580285 | debian-bookworm | TASK [auditd : Remove unmanaged rules files] *********************************** 2026-07-20 06:49:04.938819 | debian-bookworm | --- before 2026-07-20 06:49:04.938858 | debian-bookworm | +++ after 2026-07-20 06:49:04.938864 | debian-bookworm | @@ -1,4 +1,4 @@ 2026-07-20 06:49:04.938869 | debian-bookworm | { 2026-07-20 06:49:04.938873 | debian-bookworm | "path": "/etc/audit/rules.d/audit.rules", 2026-07-20 06:49:04.938888 | debian-bookworm | - "state": "file" 2026-07-20 06:49:04.938893 | debian-bookworm | + "state": "absent" 2026-07-20 06:49:04.938897 | debian-bookworm | } 2026-07-20 06:49:04.938901 | debian-bookworm | 2026-07-20 06:49:04.938906 | debian-bookworm | changed: [molecule-auditd] => (item=audit.rules) => {"ansible_loop_var": "item", "changed": true, "item": "audit.rules", "path": "/etc/audit/rules.d/audit.rules", "state": "absent"} 2026-07-20 06:49:04.938918 | debian-bookworm | skipping: [molecule-auditd] => (item=20-neo23x0.rules) => {"ansible_loop_var": "item", "changed": false, "false_condition": "item not in auditd_rules_files", "item": "20-neo23x0.rules", "skip_reason": "Conditional result was False"} 2026-07-20 06:49:04.938926 | debian-bookworm | 2026-07-20 06:49:04.938931 | debian-bookworm | RUNNING HANDLER [auditd : Restart auditd service] ****************************** 2026-07-20 06:49:04.749647 | ubuntu-noble | The following NEW packages will be installed: 2026-07-20 06:49:04.750010 | ubuntu-noble | audispd-plugins 2026-07-20 06:49:04.750399 | ubuntu-noble | 0 upgraded, 1 newly installed, 0 to remove and 0 not upgraded. 2026-07-20 06:49:04.750843 | ubuntu-noble | changed: [molecule-auditd] => {"cache_update_time": 1784530040, "cache_updated": false, "changed": true, "stderr": "debconf: delaying package configuration, since apt-utils is not installed\n", "stderr_lines": ["debconf: delaying package configuration, since apt-utils is not installed"], "stdout": "Reading package lists...\nBuilding dependency tree...\nReading state information...\nThe following NEW packages will be installed:\n audispd-plugins\n0 upgraded, 1 newly installed, 0 to remove and 0 not upgraded.\nNeed to get 38.8 kB of archives.\nAfter this operation, 131 kB of additional disk space will be used.\nGet:1 http://archive.ubuntu.com/ubuntu noble-updates/universe amd64 audispd-plugins amd64 1:3.1.2-2.1build1.1 [38.8 kB]\nFetched 38.8 kB in 0s (166 kB/s)\nSelecting previously unselected package audispd-plugins.\r\n(Reading database ... \r(Reading database ... 5%\r(Reading database ... 10%\r(Reading database ... 15%\r(Reading database ... 20%\r(Reading database ... 25%\r(Reading database ... 30%\r(Reading database ... 35%\r(Reading database ... 40%\r(Reading database ... 45%\r(Reading database ... 50%\r(Reading database ... 55%\r(Reading database ... 60%\r(Reading database ... 65%\r(Reading database ... 70%\r(Reading database ... 75%\r(Reading database ... 80%\r(Reading database ... 85%\r(Reading database ... 90%\r(Reading database ... 95%\r(Reading database ... 100%\r(Reading database ... 36194 files and directories currently installed.)\r\nPreparing to unpack .../audispd-plugins_1%3a3.1.2-2.1build1.1_amd64.deb ...\r\nUnpacking audispd-plugins (1:3.1.2-2.1build1.1) ...\r\nSetting up audispd-plugins (1:3.1.2-2.1build1.1) ...\r\n", "stdout_lines": ["Reading package lists...", "Building dependency tree...", "Reading state information...", "The following NEW packages will be installed:", " audispd-plugins", "0 upgraded, 1 newly installed, 0 to remove and 0 not upgraded.", "Need to get 38.8 kB of archives.", "After this operation, 131 kB of additional disk space will be used.", "Get:1 http://archive.ubuntu.com/ubuntu noble-updates/universe amd64 audispd-plugins amd64 1:3.1.2-2.1build1.1 [38.8 kB]", "Fetched 38.8 kB in 0s (166 kB/s)", "Selecting previously unselected package audispd-plugins.", "(Reading database ... ", "(Reading database ... 5%", "(Reading database ... 10%", "(Reading database ... 15%", "(Reading database ... 20%", "(Reading database ... 25%", "(Reading database ... 30%", "(Reading database ... 35%", "(Reading database ... 40%", "(Reading database ... 45%", "(Reading database ... 50%", "(Reading database ... 55%", "(Reading database ... 60%", "(Reading database ... 65%", "(Reading database ... 70%", "(Reading database ... 75%", "(Reading database ... 80%", "(Reading database ... 85%", "(Reading database ... 90%", "(Reading database ... 95%", "(Reading database ... 100%", "(Reading database ... 36194 files and directories currently installed.)", "Preparing to unpack .../audispd-plugins_1%3a3.1.2-2.1build1.1_amd64.deb ...", "Unpacking audispd-plugins (1:3.1.2-2.1build1.1) ...", "Setting up audispd-plugins (1:3.1.2-2.1build1.1) ..."]} 2026-07-20 06:49:04.751108 | ubuntu-noble | 2026-07-20 06:49:04.751462 | ubuntu-noble | TASK [auditd : Copy auditd.conf configuration files] *************************** 2026-07-20 06:49:05.674629 | debian-bookworm | changed: [molecule-auditd] => {"changed": true, "name": "auditd", "state": "started", "status": {"ActiveEnterTimestamp": "Mon 2026-07-20 06:48:57 UTC", "ActiveEnterTimestampMonotonic": "184725278", "ActiveExitTimestampMonotonic": "0", "ActiveState": "active", "After": "systemd-journald.socket local-fs.target system.slice systemd-tmpfiles-setup.service", "AllowIsolate": "no", "AssertResult": "yes", "AssertTimestamp": "Mon 2026-07-20 06:48:57 UTC", "AssertTimestampMonotonic": "184668704", "Before": "shutdown.target ssh.service sysinit.target systemd-update-utmp.service", "BlockIOAccounting": "no", "BlockIOWeight": "[not set]", "CPUAccounting": "yes", "CPUAffinityFromNUMA": "no", "CPUQuotaPerSecUSec": "infinity", "CPUQuotaPeriodUSec": "infinity", "CPUSchedulingPolicy": "0", "CPUSchedulingPriority": "0", "CPUSchedulingResetOnFork": "no", "CPUShares": "[not set]", "CPUUsageNSec": "41954000", "CPUWeight": "[not set]", "CacheDirectoryMode": "0755", "CanFreeze": "yes", "CanIsolate": "no", "CanReload": "no", "CanStart": "yes", "CanStop": "yes", "CapabilityBoundingSet": "cap_chown cap_dac_override cap_dac_read_search cap_fowner cap_fsetid cap_kill cap_setgid cap_setuid cap_setpcap cap_linux_immutable cap_net_bind_service cap_net_broadcast cap_net_admin cap_net_raw cap_ipc_lock cap_ipc_owner cap_sys_rawio cap_sys_chroot cap_sys_ptrace cap_sys_pacct cap_sys_admin cap_sys_boot cap_sys_nice cap_sys_resource cap_sys_time cap_sys_tty_config cap_mknod cap_lease cap_audit_write cap_audit_control cap_setfcap cap_mac_override cap_mac_admin cap_syslog cap_wake_alarm cap_block_suspend cap_audit_read cap_perfmon cap_bpf cap_checkpoint_restore", "CleanResult": "success", "CollectMode": "inactive", "ConditionResult": "yes", "ConditionTimestamp": "Mon 2026-07-20 06:48:57 UTC", "ConditionTimestampMonotonic": "184668673", "ConfigurationDirectoryMode": "0755", "Conflicts": "shutdown.target", "ControlGroup": "/system.slice/auditd.service", "ControlGroupId": "3328", "ControlPID": "0", "CoredumpFilter": "0x33", "DefaultDependencies": "no", "DefaultMemoryLow": "0", "DefaultMemoryMin": "0", "Delegate": "no", "Description": "Security Auditing Service", "DevicePolicy": "auto", "Documentation": "\"man:auditd(8)\" https://github.com/linux-audit/audit-documentation", "DynamicUser": "no", "ExecMainCode": "0", "ExecMainExitTimestampMonotonic": "0", "ExecMainPID": "2415", "ExecMainStartTimestamp": "Mon 2026-07-20 06:48:57 UTC", "ExecMainStartTimestampMonotonic": "184703758", "ExecMainStatus": "0", "ExecStart": "{ path=/sbin/auditd ; argv[]=/sbin/auditd ; ignore_errors=no ; start_time=[Mon 2026-07-20 06:48:57 UTC] ; stop_time=[Mon 2026-07-20 06:48:57 UTC] ; pid=2414 ; code=exited ; status=0 }", "ExecStartEx": "{ path=/sbin/auditd ; argv[]=/sbin/auditd ; flags= ; start_time=[Mon 2026-07-20 06:48:57 UTC] ; stop_time=[Mon 2026-07-20 06:48:57 UTC] ; pid=2414 ; code=exited ; status=0 }", "ExecStartPost": "{ path=/sbin/augenrules ; argv[]=/sbin/augenrules --load ; ignore_errors=yes ; start_time=[Mon 2026-07-20 06:48:57 UTC] ; stop_time=[Mon 2026-07-20 06:48:57 UTC] ; pid=2418 ; code=exited ; status=0 }", "ExecStartPostEx": "{ path=/sbin/augenrules ; argv[]=/sbin/augenrules --load ; flags=ignore-failure ; start_time=[Mon 2026-07-20 06:48:57 UTC] ; stop_time=[Mon 2026-07-20 06:48:57 UTC] ; pid=2418 ; code=exited ; status=0 }", "ExitType": "main", "FailureAction": "none", "FileDescriptorStoreMax": "0", "FinalKillSignal": "9", "FragmentPath": "/lib/systemd/system/auditd.service", "FreezerState": "running", "GID": "[not set]", "GuessMainPID": "yes", "IOAccounting": "no", "IOReadBytes": "18446744073709551615", "IOReadOperations": "18446744073709551615", "IOSchedulingClass": "2", "IOSchedulingPriority": "4", "IOWeight": "[not set]", "IOWriteBytes": "18446744073709551615", "IOWriteOperations": "18446744073709551615", "IPAccounting": "no", "IPEgressBytes": "[no data]", "IPEgressPackets": "[no data]", "IPIngressBytes": "[no data]", "IPIngressPackets": "[no data]", "Id": "auditd.service", "IgnoreOnIsolate": "no", "IgnoreSIGPIPE": "yes", "InactiveEnterTimestampMonotonic": "0", "InactiveExitTimestamp": "Mon 2026-07-20 06:48:57 UTC", "InactiveExitTimestampMonotonic": "184684523", "InvocationID": "740b123c2bd64b54bc4490ee72d824e8", "JobRunningTimeoutUSec": "infinity", "JobTimeoutAction": "none", "JobTimeoutUSec": "infinity", "KeyringMode": "private", "KillMode": "control-group", "KillSignal": "15", "LimitAS": "infinity", "LimitASSoft": "infinity", "LimitCORE": "infinity", "LimitCORESoft": "0", "LimitCPU": "infinity", "LimitCPUSoft": "infinity", "LimitDATA": "infinity", "LimitDATASoft": "infinity", "LimitFSIZE": "infinity", "LimitFSIZESoft": "infinity", "LimitLOCKS": "infinity", "LimitLOCKSSoft": "infinity", "LimitMEMLOCK": "8388608", "LimitMEMLOCKSoft": "8388608", "LimitMSGQUEUE": "819200", "LimitMSGQUEUESoft": "819200", "LimitNICE": "0", "LimitNICESoft": "0", "LimitNOFILE": "524288", "LimitNOFILESoft": "1024", "LimitNPROC": "15480", "LimitNPROCSoft": "15480", "LimitRSS": "infinity", "LimitRSSSoft": "infinity", "LimitRTPRIO": "0", "LimitRTPRIOSoft": "0", "LimitRTTIME": "infinity", "LimitRTTIMESoft": "infinity", "LimitSIGPENDING": "15480", "LimitSIGPENDINGSoft": "15480", "LimitSTACK": "infinity", "LimitSTACKSoft": "8388608", "LoadState": "loaded", "LockPersonality": "yes", "LogLevelMax": "-1", "LogRateLimitBurst": "0", "LogRateLimitIntervalUSec": "0", "LogsDirectoryMode": "0755", "MainPID": "2415", "ManagedOOMMemoryPressure": "auto", "ManagedOOMMemoryPressureLimit": "0", "ManagedOOMPreference": "none", "ManagedOOMSwap": "auto", "MemoryAccounting": "yes", "MemoryAvailable": "infinity", "MemoryCurrent": "720896", "MemoryDenyWriteExecute": "yes", "MemoryHigh": "infinity", "MemoryLimit": "infinity", "MemoryLow": "0", "MemoryMax": "infinity", "MemoryMin": "0", "MemorySwapMax": "infinity", "MountAPIVFS": "no", "NFileDescriptorStore": "0", "NRestarts": "0", "NUMAPolicy": "n/a", "Names": "auditd.service", "NeedDaemonReload": "no", "Nice": "0", "NoNewPrivileges": "no", "NonBlocking": "no", "NotifyAccess": "none", "OOMPolicy": "stop", "OOMScoreAdjust": "0", "OnFailureJobMode": "replace", "OnSuccessJobMode": "fail", "PIDFile": "/run/auditd.pid", "Perpetual": "no", "PrivateDevices": "no", "PrivateIPC": "no", "PrivateMounts": "no", "PrivateNetwork": "no", "PrivateTmp": "no", "PrivateUsers": "no", "ProcSubset": "all", "ProtectClock": "no", "ProtectControlGroups": "yes", "ProtectHome": "no", "ProtectHostname": "no", "ProtectKernelLogs": "no", "ProtectKernelModules": "yes", "ProtectKernelTunables": "no", "ProtectProc": "default", "ProtectSystem": "no", "RefuseManualStart": "no", "RefuseManualStop": "no", "ReloadResult": "success", "RemainAfterExit": "no", "RemoveIPC": "no", "Requires": "system.slice", "Restart": "on-failure", "RestartKillSignal": "15", "RestartPreventExitStatus": "2 4 6", "RestartUSec": "100ms", "RestrictNamespaces": "no", "RestrictRealtime": "yes", "RestrictSUIDSGID": "no", "Result": "success", "RootDirectoryStartOnly": "no", "RuntimeDirectoryMode": "0755", "RuntimeDirectoryPreserve": "no", "RuntimeMaxUSec": "infinity", "RuntimeRandomizedExtraUSec": "0", "SameProcessGroup": "no", "SecureBits": "0", "SendSIGHUP": "no", "SendSIGKILL": "yes", "Slice": "system.slice", "StandardError": "inherit", "StandardInput": "null", "StandardOutput": "journal", "StartLimitAction": "none", "StartLimitBurst": "5", "StartLimitIntervalUSec": "10s", "StartupBlockIOWeight": "[not set]", "StartupCPUShares": "[not set]", "StartupCPUWeight": "[not set]", "StartupIOWeight": "[not set]", "StateChangeTimestamp": "Mon 2026-07-20 06:48:57 UTC", "StateChangeTimestampMonotonic": "184725278", "StateDirectoryMode": "0755", "StatusErrno": "0", "StopWhenUnneeded": "no", "SubState": "running", "SuccessAction": "none", "SyslogFacility": "3", "SyslogLevel": "6", "SyslogLevelPrefix": "yes", "SyslogPriority": "30", "SystemCallErrorNumber": "2147483646", "TTYReset": "no", "TTYVHangup": "no", "TTYVTDisallocate": "no", "TasksAccounting": "yes", "TasksCurrent": "2", "TasksMax": "4644", "TimeoutAbortUSec": "1min 30s", "TimeoutCleanUSec": "infinity", "TimeoutStartFailureMode": "terminate", "TimeoutStartUSec": "1min 30s", "TimeoutStopFailureMode": "terminate", "TimeoutStopUSec": "1min 30s", "TimerSlackNSec": "50000", "Transient": "no", "Type": "forking", "UID": "[not set]", "UMask": "0022", "UnitFilePreset": "enabled", "UnitFileState": "enabled", "UtmpMode": "init", "WantedBy": "multi-user.target", "WatchdogSignal": "6", "WatchdogTimestampMonotonic": "0", "WatchdogUSec": "0"}} 2026-07-20 06:49:05.677979 | debian-bookworm | 2026-07-20 06:49:05.678013 | debian-bookworm | RUNNING HANDLER [auditd : Generate auditd rules] ******************************* 2026-07-20 06:49:06.135605 | debian-bookworm | changed: [molecule-auditd] => {"changed": true, "cmd": ["augenrules", "--load"], "delta": "0:00:00.086820", "end": "2026-07-20 06:49:06.083214", "msg": "", "rc": 0, "start": "2026-07-20 06:49:05.996394", "stderr": "Unknown user: chrony\nThere was an error in line 24 of /etc/audit/audit.rules\nError sending add rule data request (No such file or directory)\nThere was an error in line 28 of /etc/audit/audit.rules\nUnknown user: ntp\nThere was an error in line 44 of /etc/audit/audit.rules\nError sending add rule data request (No such file or directory)\nThere was an error in line 83 of /etc/audit/audit.rules\nError sending add rule data request (No such file or directory)\nThere was an error in line 84 of /etc/audit/audit.rules\nError sending add rule data request (No such file or directory)\nThere was an error in line 112 of /etc/audit/audit.rules\nError sending add rule data request (No such file or directory)\nThere was an error in line 115 of /etc/audit/audit.rules\nError sending add rule data request (No such file or directory)\nThere was an error in line 176 of /etc/audit/audit.rules\nError sending add rule data request (No such file or directory)\nThere was an error in line 177 of /etc/audit/audit.rules\nError sending add rule data request (No such file or directory)\nThere was an error in line 178 of /etc/audit/audit.rules\nError sending add rule data request (No such file or directory)\nThere was an error in line 179 of /etc/audit/audit.rules\nError sending add rule data request (No such file or directory)\nThere was an error in line 180 of /etc/audit/audit.rules\nError sending add rule data request (No such file or directory)\nThere was an error in line 217 of /etc/audit/audit.rules\nError sending add rule data request (No such file or directory)\nThere was an error in line 218 of /etc/audit/audit.rules\nError sending add rule data request (No such file or directory)\nThere was an error in line 234 of /etc/audit/audit.rules\nError sending add rule data request (No such file or directory)\nThere was an error in line 285 of /etc/audit/audit.rules\nError sending add rule data request (No such file or directory)\nThere was an error in line 286 of /etc/audit/audit.rules\nError sending add rule data request (No such file or directory)\nThere was an error in line 324 of /etc/audit/audit.rules\nError sending add rule data request (No such file or directory)\nThere was an error in line 325 of /etc/audit/audit.rules\nError sending add rule data request (No such file or directory)\nThere was an error in line 346 of /etc/audit/audit.rules\nparameter passed without an option given\nThere was an error in line 347 of /etc/audit/audit.rules\nparameter passed without an option given\nThere was an error in line 348 of /etc/audit/audit.rules\nparameter passed without an option given\nThere was an error in line 349 of /etc/audit/audit.rules\nparameter passed without an option given\nThere was an error in line 350 of /etc/audit/audit.rules\nparameter passed without an option given\nThere was an error in line 351 of /etc/audit/audit.rules\nError sending add rule data request (No such file or directory)\nThere was an error in line 359 of /etc/audit/audit.rules", "stderr_lines": ["Unknown user: chrony", "There was an error in line 24 of /etc/audit/audit.rules", "Error sending add rule data request (No such file or directory)", "There was an error in line 28 of /etc/audit/audit.rules", "Unknown user: ntp", "There was an error in line 44 of /etc/audit/audit.rules", "Error sending add rule data request (No such file or directory)", "There was an error in line 83 of /etc/audit/audit.rules", "Error sending add rule data request (No such file or directory)", "There was an error in line 84 of /etc/audit/audit.rules", "Error sending add rule data request (No such file or directory)", "There was an error in line 112 of /etc/audit/audit.rules", "Error sending add rule data request (No such file or directory)", "There was an error in line 115 of /etc/audit/audit.rules", "Error sending add rule data request (No such file or directory)", "There was an error in line 176 of /etc/audit/audit.rules", "Error sending add rule data request (No such file or directory)", "There was an error in line 177 of /etc/audit/audit.rules", "Error sending add rule data request (No such file or directory)", "There was an error in line 178 of /etc/audit/audit.rules", "Error sending add rule data request (No such file or directory)", "There was an error in line 179 of /etc/audit/audit.rules", "Error sending add rule data request (No such file or directory)", "There was an error in line 180 of /etc/audit/audit.rules", "Error sending add rule data request (No such file or directory)", "There was an error in line 217 of /etc/audit/audit.rules", "Error sending add rule data request (No such file or directory)", "There was an error in line 218 of /etc/audit/audit.rules", "Error sending add rule data request (No such file or directory)", "There was an error in line 234 of /etc/audit/audit.rules", "Error sending add rule data request (No such file or directory)", "There was an error in line 285 of /etc/audit/audit.rules", "Error sending add rule data request (No such file or directory)", "There was an error in line 286 of /etc/audit/audit.rules", "Error sending add rule data request (No such file or directory)", "There was an error in line 324 of /etc/audit/audit.rules", "Error sending add rule data request (No such file or directory)", "There was an error in line 325 of /etc/audit/audit.rules", "Error sending add rule data request (No such file or directory)", "There was an error in line 346 of /etc/audit/audit.rules", "parameter passed without an option given", "There was an error in line 347 of /etc/audit/audit.rules", "parameter passed without an option given", "There was an error in line 348 of /etc/audit/audit.rules", "parameter passed without an option given", "There was an error in line 349 of /etc/audit/audit.rules", "parameter passed without an option given", "There was an error in line 350 of /etc/audit/audit.rules", "parameter passed without an option given", "There was an error in line 351 of /etc/audit/audit.rules", "Error sending add rule data request (No such file or directory)", "There was an error in line 359 of /etc/audit/audit.rules"], "stdout": "/usr/sbin/augenrules: No change\nNo rules\nenabled 1\nfailure 1\npid 2804\nrate_limit 0\nbacklog_limit 8192\nlost 0\nbacklog 1218\nbacklog_wait_time 60000\nbacklog_wait_time_actual 0\nenabled 1\nfailure 1\npid 2804\nrate_limit 0\nbacklog_limit 8192\nlost 0\nbacklog 958\nbacklog_wait_time 60000\nbacklog_wait_time_actual 0", "stdout_lines": ["/usr/sbin/augenrules: No change", "No rules", "enabled 1", "failure 1", "pid 2804", "rate_limit 0", "backlog_limit 8192", "lost 0", "backlog 1218", "backlog_wait_time 60000", "backlog_wait_time_actual 0", "enabled 1", "failure 1", "pid 2804", "rate_limit 0", "backlog_limit 8192", "lost 0", "backlog 958", "backlog_wait_time 60000", "backlog_wait_time_actual 0"]} 2026-07-20 06:49:06.135652 | debian-bookworm | 2026-07-20 06:49:06.135657 | debian-bookworm | RUNNING HANDLER [auditd : Restart auditd service] ****************************** 2026-07-20 06:49:06.419665 | ubuntu-noble | --- before 2026-07-20 06:49:06.420022 | ubuntu-noble | +++ after: /home/zuul/.ansible/tmp/ansible-local-20328_81hf_b/tmpfhejm9sg/auditd.conf.j2 2026-07-20 06:49:06.420416 | ubuntu-noble | @@ -0,0 +1,37 @@ 2026-07-20 06:49:06.420711 | ubuntu-noble | +# 2026-07-20 06:49:06.421013 | ubuntu-noble | +# This file controls the configuration of the audit daemon 2026-07-20 06:49:06.421310 | ubuntu-noble | +# 2026-07-20 06:49:06.421614 | ubuntu-noble | + 2026-07-20 06:49:06.421909 | ubuntu-noble | +local_events = yes 2026-07-20 06:49:06.422194 | ubuntu-noble | +write_logs = yes 2026-07-20 06:49:06.422548 | ubuntu-noble | +log_file = /var/log/audit/audit.log 2026-07-20 06:49:06.422819 | ubuntu-noble | +log_group = adm 2026-07-20 06:49:06.423123 | ubuntu-noble | +log_format = RAW 2026-07-20 06:49:06.423510 | ubuntu-noble | +flush = INCREMENTAL_ASYNC 2026-07-20 06:49:06.423807 | ubuntu-noble | +freq = 50 2026-07-20 06:49:06.424079 | ubuntu-noble | +max_log_file = 8 2026-07-20 06:49:06.424413 | ubuntu-noble | +num_logs = 5 2026-07-20 06:49:06.424646 | ubuntu-noble | +priority_boost = 4 2026-07-20 06:49:06.424897 | ubuntu-noble | +disp_qos = lossy 2026-07-20 06:49:06.425156 | ubuntu-noble | +dispatcher = /sbin/audispd 2026-07-20 06:49:06.425454 | ubuntu-noble | +name_format = NONE 2026-07-20 06:49:06.425713 | ubuntu-noble | +##name = mydomain 2026-07-20 06:49:06.425983 | ubuntu-noble | +max_log_file_action = ROTATE 2026-07-20 06:49:06.426236 | ubuntu-noble | +space_left = 12361 2026-07-20 06:49:06.426568 | ubuntu-noble | +space_left_action = email 2026-07-20 06:49:06.426824 | ubuntu-noble | +verify_email = yes 2026-07-20 06:49:06.427075 | ubuntu-noble | +action_mail_acct = root 2026-07-20 06:49:06.427358 | ubuntu-noble | +admin_space_left = 50 2026-07-20 06:49:06.427638 | ubuntu-noble | +admin_space_left_action = SUSPEND 2026-07-20 06:49:06.427896 | ubuntu-noble | +disk_full_action = SUSPEND 2026-07-20 06:49:06.428150 | ubuntu-noble | +disk_error_action = SUSPEND 2026-07-20 06:49:06.428462 | ubuntu-noble | +use_libwrap = yes 2026-07-20 06:49:06.430131 | ubuntu-noble | +##tcp_listen_port = 60 2026-07-20 06:49:06.430735 | ubuntu-noble | +tcp_listen_queue = 5 2026-07-20 06:49:06.430979 | ubuntu-noble | +tcp_max_per_addr = 1 2026-07-20 06:49:06.431205 | ubuntu-noble | +##tcp_client_ports = 1024-65535 2026-07-20 06:49:06.431463 | ubuntu-noble | +tcp_client_max_idle = 0 2026-07-20 06:49:06.431681 | ubuntu-noble | +enable_krb5 = no 2026-07-20 06:49:06.431887 | ubuntu-noble | +krb5_principal = auditd 2026-07-20 06:49:06.432103 | ubuntu-noble | +##krb5_key_file = /etc/audit/audit.key 2026-07-20 06:49:06.432334 | ubuntu-noble | +distribute_network = no 2026-07-20 06:49:06.432552 | ubuntu-noble | 2026-07-20 06:49:06.432836 | ubuntu-noble | changed: [molecule-auditd] => {"changed": true, "checksum": "e902cc6bebf86c17087d153e359a2cc1231672e0", "dest": "/etc/audit/audit.conf", "gid": 0, "group": "root", "md5sum": "69dfd768317bae876a6a78c8aeb5cce1", "mode": "0640", "owner": "root", "size": 806, "src": "/home/zuul/.ansible/tmp/ansible-tmp-1784530144.7696867-2429-34356831965132/.source.conf", "state": "file", "uid": 0} 2026-07-20 06:49:06.433017 | ubuntu-noble | 2026-07-20 06:49:06.433239 | ubuntu-noble | TASK [auditd : Adjust auditd/audispd configurations] *************************** 2026-07-20 06:49:06.913520 | debian-bookworm | changed: [molecule-auditd] => {"changed": true, "name": "auditd", "state": "started", "status": {"ActiveEnterTimestamp": "Mon 2026-07-20 06:49:05 UTC", "ActiveEnterTimestampMonotonic": "193135791", "ActiveExitTimestamp": "Mon 2026-07-20 06:49:05 UTC", "ActiveExitTimestampMonotonic": "192928930", "ActiveState": "active", "After": "systemd-journald.socket local-fs.target system.slice systemd-tmpfiles-setup.service", "AllowIsolate": "no", "AssertResult": "yes", "AssertTimestamp": "Mon 2026-07-20 06:49:05 UTC", "AssertTimestampMonotonic": "192965304", "Before": "shutdown.target ssh.service sysinit.target systemd-update-utmp.service", "BlockIOAccounting": "no", "BlockIOWeight": "[not set]", "CPUAccounting": "yes", "CPUAffinityFromNUMA": "no", "CPUQuotaPerSecUSec": "infinity", "CPUQuotaPeriodUSec": "infinity", "CPUSchedulingPolicy": "0", "CPUSchedulingPriority": "0", "CPUSchedulingResetOnFork": "no", "CPUShares": "[not set]", "CPUUsageNSec": "161210000", "CPUWeight": "[not set]", "CacheDirectoryMode": "0755", "CanFreeze": "yes", "CanIsolate": "no", "CanReload": "no", "CanStart": "yes", "CanStop": "yes", "CapabilityBoundingSet": "cap_chown cap_dac_override cap_dac_read_search cap_fowner cap_fsetid cap_kill cap_setgid cap_setuid cap_setpcap cap_linux_immutable cap_net_bind_service cap_net_broadcast cap_net_admin cap_net_raw cap_ipc_lock cap_ipc_owner cap_sys_rawio cap_sys_chroot cap_sys_ptrace cap_sys_pacct cap_sys_admin cap_sys_boot cap_sys_nice cap_sys_resource cap_sys_time cap_sys_tty_config cap_mknod cap_lease cap_audit_write cap_audit_control cap_setfcap cap_mac_override cap_mac_admin cap_syslog cap_wake_alarm cap_block_suspend cap_audit_read cap_perfmon cap_bpf cap_checkpoint_restore", "CleanResult": "success", "CollectMode": "inactive", "ConditionResult": "yes", "ConditionTimestamp": "Mon 2026-07-20 06:49:05 UTC", "ConditionTimestampMonotonic": "192965253", "ConfigurationDirectoryMode": "0755", "Conflicts": "shutdown.target", "ControlGroup": "/system.slice/auditd.service", "ControlGroupId": "3367", "ControlPID": "0", "CoredumpFilter": "0x33", "DefaultDependencies": "no", "DefaultMemoryLow": "0", "DefaultMemoryMin": "0", "Delegate": "no", "Description": "Security Auditing Service", "DevicePolicy": "auto", "Documentation": "\"man:auditd(8)\" https://github.com/linux-audit/audit-documentation", "DynamicUser": "no", "ExecMainCode": "0", "ExecMainExitTimestampMonotonic": "0", "ExecMainPID": "2804", "ExecMainStartTimestamp": "Mon 2026-07-20 06:49:05 UTC", "ExecMainStartTimestampMonotonic": "193018512", "ExecMainStatus": "0", "ExecStart": "{ path=/sbin/auditd ; argv[]=/sbin/auditd ; ignore_errors=no ; start_time=[Mon 2026-07-20 06:49:05 UTC] ; stop_time=[Mon 2026-07-20 06:49:05 UTC] ; pid=2803 ; code=exited ; status=0 }", "ExecStartEx": "{ path=/sbin/auditd ; argv[]=/sbin/auditd ; flags= ; start_time=[Mon 2026-07-20 06:49:05 UTC] ; stop_time=[Mon 2026-07-20 06:49:05 UTC] ; pid=2803 ; code=exited ; status=0 }", "ExecStartPost": "{ path=/sbin/augenrules ; argv[]=/sbin/augenrules --load ; ignore_errors=yes ; start_time=[Mon 2026-07-20 06:49:05 UTC] ; stop_time=[Mon 2026-07-20 06:49:05 UTC] ; pid=2807 ; code=exited ; status=0 }", "ExecStartPostEx": "{ path=/sbin/augenrules ; argv[]=/sbin/augenrules --load ; flags=ignore-failure ; start_time=[Mon 2026-07-20 06:49:05 UTC] ; stop_time=[Mon 2026-07-20 06:49:05 UTC] ; pid=2807 ; code=exited ; status=0 }", "ExitType": "main", "FailureAction": "none", "FileDescriptorStoreMax": "0", "FinalKillSignal": "9", "FragmentPath": "/lib/systemd/system/auditd.service", "FreezerState": "running", "GID": "[not set]", "GuessMainPID": "yes", "IOAccounting": "no", "IOReadBytes": "18446744073709551615", "IOReadOperations": "18446744073709551615", "IOSchedulingClass": "2", "IOSchedulingPriority": "4", "IOWeight": "[not set]", "IOWriteBytes": "18446744073709551615", "IOWriteOperations": "18446744073709551615", "IPAccounting": "no", "IPEgressBytes": "[no data]", "IPEgressPackets": "[no data]", "IPIngressBytes": "[no data]", "IPIngressPackets": "[no data]", "Id": "auditd.service", "IgnoreOnIsolate": "no", "IgnoreSIGPIPE": "yes", "InactiveEnterTimestamp": "Mon 2026-07-20 06:49:05 UTC", "InactiveEnterTimestampMonotonic": "192964559", "InactiveExitTimestamp": "Mon 2026-07-20 06:49:05 UTC", "InactiveExitTimestampMonotonic": "192983844", "InvocationID": "402e197f8ab74d7ab02fd140dc2758e2", "JobRunningTimeoutUSec": "infinity", "JobTimeoutAction": "none", "JobTimeoutUSec": "infinity", "KeyringMode": "private", "KillMode": "control-group", "KillSignal": "15", "LimitAS": "infinity", "LimitASSoft": "infinity", "LimitCORE": "infinity", "LimitCORESoft": "0", "LimitCPU": "infinity", "LimitCPUSoft": "infinity", "LimitDATA": "infinity", "LimitDATASoft": "infinity", "LimitFSIZE": "infinity", "LimitFSIZESoft": "infinity", "LimitLOCKS": "infinity", "LimitLOCKSSoft": "infinity", "LimitMEMLOCK": "8388608", "LimitMEMLOCKSoft": "8388608", "LimitMSGQUEUE": "819200", "LimitMSGQUEUESoft": "819200", "LimitNICE": "0", "LimitNICESoft": "0", "LimitNOFILE": "524288", "LimitNOFILESoft": "1024", "LimitNPROC": "15480", "LimitNPROCSoft": "15480", "LimitRSS": "infinity", "LimitRSSSoft": "infinity", "LimitRTPRIO": "0", "LimitRTPRIOSoft": "0", "LimitRTTIME": "infinity", "LimitRTTIMESoft": "infinity", "LimitSIGPENDING": "15480", "LimitSIGPENDINGSoft": "15480", "LimitSTACK": "infinity", "LimitSTACKSoft": "8388608", "LoadState": "loaded", "LockPersonality": "yes", "LogLevelMax": "-1", "LogRateLimitBurst": "0", "LogRateLimitIntervalUSec": "0", "LogsDirectoryMode": "0755", "MainPID": "2804", "ManagedOOMMemoryPressure": "auto", "ManagedOOMMemoryPressureLimit": "0", "ManagedOOMPreference": "none", "ManagedOOMSwap": "auto", "MemoryAccounting": "yes", "MemoryAvailable": "infinity", "MemoryCurrent": "2076672", "MemoryDenyWriteExecute": "yes", "MemoryHigh": "infinity", "MemoryLimit": "infinity", "MemoryLow": "0", "MemoryMax": "infinity", "MemoryMin": "0", "MemorySwapMax": "infinity", "MountAPIVFS": "no", "NFileDescriptorStore": "0", "NRestarts": "0", "NUMAPolicy": "n/a", "Names": "auditd.service", "NeedDaemonReload": "no", "Nice": "0", "NoNewPrivileges": "no", "NonBlocking": "no", "NotifyAccess": "none", "OOMPolicy": "stop", "OOMScoreAdjust": "0", "OnFailureJobMode": "replace", "OnSuccessJobMode": "fail", "PIDFile": "/run/auditd.pid", "Perpetual": "no", "PrivateDevices": "no", "PrivateIPC": "no", "PrivateMounts": "no", "PrivateNetwork": "no", "PrivateTmp": "no", "PrivateUsers": "no", "ProcSubset": "all", "ProtectClock": "no", "ProtectControlGroups": "yes", "ProtectHome": "no", "ProtectHostname": "no", "ProtectKernelLogs": "no", "ProtectKernelModules": "yes", "ProtectKernelTunables": "no", "ProtectProc": "default", "ProtectSystem": "no", "RefuseManualStart": "no", "RefuseManualStop": "no", "ReloadResult": "success", "RemainAfterExit": "no", "RemoveIPC": "no", "Requires": "system.slice", "Restart": "on-failure", "RestartKillSignal": "15", "RestartPreventExitStatus": "2 4 6", "RestartUSec": "100ms", "RestrictNamespaces": "no", "RestrictRealtime": "yes", "RestrictSUIDSGID": "no", "Result": "success", "RootDirectoryStartOnly": "no", "RuntimeDirectoryMode": "0755", "RuntimeDirectoryPreserve": "no", "RuntimeMaxUSec": "infinity", "RuntimeRandomizedExtraUSec": "0", "SameProcessGroup": "no", "SecureBits": "0", "SendSIGHUP": "no", "SendSIGKILL": "yes", "Slice": "system.slice", "StandardError": "inherit", "StandardInput": "null", "StandardOutput": "journal", "StartLimitAction": "none", "StartLimitBurst": "5", "StartLimitIntervalUSec": "10s", "StartupBlockIOWeight": "[not set]", "StartupCPUShares": "[not set]", "StartupCPUWeight": "[not set]", "StartupIOWeight": "[not set]", "StateChangeTimestamp": "Mon 2026-07-20 06:49:05 UTC", "StateChangeTimestampMonotonic": "193135791", "StateDirectoryMode": "0755", "StatusErrno": "0", "StopWhenUnneeded": "no", "SubState": "running", "SuccessAction": "none", "SyslogFacility": "3", "SyslogLevel": "6", "SyslogLevelPrefix": "yes", "SyslogPriority": "30", "SystemCallErrorNumber": "2147483646", "TTYReset": "no", "TTYVHangup": "no", "TTYVTDisallocate": "no", "TasksAccounting": "yes", "TasksCurrent": "2", "TasksMax": "4644", "TimeoutAbortUSec": "1min 30s", "TimeoutCleanUSec": "infinity", "TimeoutStartFailureMode": "terminate", "TimeoutStartUSec": "1min 30s", "TimeoutStopFailureMode": "terminate", "TimeoutStopUSec": "1min 30s", "TimerSlackNSec": "50000", "Transient": "no", "Type": "forking", "UID": "[not set]", "UMask": "0022", "UnitFilePreset": "enabled", "UnitFileState": "enabled", "UtmpMode": "init", "WantedBy": "multi-user.target", "WatchdogSignal": "6", "WatchdogTimestampMonotonic": "0", "WatchdogUSec": "0"}} 2026-07-20 06:49:06.914398 | debian-bookworm | 2026-07-20 06:49:06.914418 | debian-bookworm | PLAY RECAP ********************************************************************* 2026-07-20 06:49:06.914425 | debian-bookworm | molecule-auditd : ok=15 changed=8 unreachable=0 failed=0 skipped=0 rescued=0 ignored=0 2026-07-20 06:49:06.914431 | debian-bookworm | 2026-07-20 06:49:07.002225 | debian-bookworm | INFO [delegated > converge] Executed: Successful 2026-07-20 06:49:07.002980 | debian-bookworm | WARNING Molecule executed 1 scenario (1 missing files) 2026-07-20 06:49:07.003079 | debian-bookworm | 2026-07-20 06:49:07.003112 | debian-bookworm | DETAILS 2026-07-20 06:49:07.003199 | debian-bookworm | delegated > dependency: Executed: Missing roles requirements file: requirements.yml (Remove from converge_sequence to suppress) 2026-07-20 06:49:07.003275 | debian-bookworm | delegated > create: Executed: Missing playbook (Remove from converge_sequence to suppress) 2026-07-20 06:49:07.003352 | debian-bookworm | delegated > prepare: Executed: Successful 2026-07-20 06:49:07.003427 | debian-bookworm | delegated > converge: Executed: Successful 2026-07-20 06:49:07.003453 | debian-bookworm | 2026-07-20 06:49:07.003669 | debian-bookworm | SCENARIO RECAP 2026-07-20 06:49:07.003702 | debian-bookworm | delegated : actions=4 successful=1 disabled=0 skipped=0 missing=2 failed=0 2026-07-20 06:49:07.003712 | debian-bookworm | 2026-07-20 06:49:07.521995 | debian-bookworm | ok: Runtime: 0:00:18.099966 2026-07-20 06:49:07.056735 | ubuntu-noble | ok: [molecule-auditd] => (item={'parameter': 'active', 'value': 'no', 'config': '/etc/audit/plugins.d/syslog.conf'}) => {"ansible_loop_var": "item", "backup": "", "changed": false, "item": {"config": "/etc/audit/plugins.d/syslog.conf", "parameter": "active", "value": "no"}, "msg": ""} 2026-07-20 06:49:07.056805 | ubuntu-noble | 2026-07-20 06:49:07.057338 | ubuntu-noble | TASK [auditd : Deploy rules for auditd] **************************************** 2026-07-20 06:49:08.156687 | ubuntu-noble | --- before 2026-07-20 06:49:08.157111 | ubuntu-noble | +++ after: /home/zuul/.ansible/tmp/ansible-local-20328_81hf_b/tmp46tbsnbk/20-neo23x0.rules.j2 2026-07-20 06:49:08.158452 | ubuntu-noble | @@ -0,0 +1,750 @@ 2026-07-20 06:49:08.158641 | ubuntu-noble | +# ___ ___ __ __ 2026-07-20 06:49:08.158775 | ubuntu-noble | +# / | __ ______/ (_) /_____/ / 2026-07-20 06:49:08.158895 | ubuntu-noble | +# / /| |/ / / / __ / / __/ __ / 2026-07-20 06:49:08.159010 | ubuntu-noble | +# / ___ / /_/ / /_/ / / /_/ /_/ / 2026-07-20 06:49:08.159140 | ubuntu-noble | +# /_/ |_\__,_/\__,_/_/\__/\__,_/ 2026-07-20 06:49:08.159257 | ubuntu-noble | +# 2026-07-20 06:49:08.159396 | ubuntu-noble | +# Linux Audit Daemon - Best Practice Configuration 2026-07-20 06:49:08.159518 | ubuntu-noble | +# /etc/audit/audit.rules 2026-07-20 06:49:08.159633 | ubuntu-noble | +# 2026-07-20 06:49:08.159753 | ubuntu-noble | +# Compiled by Florian Roth 2026-07-20 06:49:08.159868 | ubuntu-noble | +# 2026-07-20 06:49:08.159986 | ubuntu-noble | +# Created : 2017/12/05 2026-07-20 06:49:08.160128 | ubuntu-noble | +# Modified : 2023/01/25 2026-07-20 06:49:08.160245 | ubuntu-noble | +# 2026-07-20 06:49:08.160377 | ubuntu-noble | +# Based on rules published here: 2026-07-20 06:49:08.160498 | ubuntu-noble | +# Gov.uk auditd rules 2026-07-20 06:49:08.162291 | ubuntu-noble | +# https://github.com/gds-operations/puppet-auditd/pull/1 2026-07-20 06:49:08.162307 | ubuntu-noble | +# CentOS 7 hardening 2026-07-20 06:49:08.162312 | ubuntu-noble | +# https://highon.coffee/blog/security-harden-centos-7/#auditd---audit-daemon 2026-07-20 06:49:08.162316 | ubuntu-noble | +# Linux audit repo 2026-07-20 06:49:08.162329 | ubuntu-noble | +# https://github.com/linux-audit/audit-userspace/tree/master/rules 2026-07-20 06:49:08.162334 | ubuntu-noble | +# Auditd high performance linux auditing 2026-07-20 06:49:08.162337 | ubuntu-noble | +# https://linux-audit.com/tuning-auditd-high-performance-linux-auditing/ 2026-07-20 06:49:08.162341 | ubuntu-noble | +# 2026-07-20 06:49:08.162345 | ubuntu-noble | +# Further rules 2026-07-20 06:49:08.162348 | ubuntu-noble | +# For PCI DSS compliance see: 2026-07-20 06:49:08.162352 | ubuntu-noble | +# https://github.com/linux-audit/audit-userspace/blob/master/rules/30-pci-dss-v31.rules 2026-07-20 06:49:08.162497 | ubuntu-noble | +# For NISPOM compliance see: 2026-07-20 06:49:08.162672 | ubuntu-noble | +# https://github.com/linux-audit/audit-userspace/blob/master/rules/30-nispom.rules 2026-07-20 06:49:08.162792 | ubuntu-noble | + 2026-07-20 06:49:08.162912 | ubuntu-noble | +# Remove any existing rules 2026-07-20 06:49:08.163025 | ubuntu-noble | +-D 2026-07-20 06:49:08.163152 | ubuntu-noble | + 2026-07-20 06:49:08.163268 | ubuntu-noble | +# Buffer Size 2026-07-20 06:49:08.163408 | ubuntu-noble | +## Feel free to increase this if the machine panic's 2026-07-20 06:49:08.163523 | ubuntu-noble | +-b 8192 2026-07-20 06:49:08.163633 | ubuntu-noble | + 2026-07-20 06:49:08.163747 | ubuntu-noble | +# Failure Mode 2026-07-20 06:49:08.163870 | ubuntu-noble | +## Possible values: 0 (silent), 1 (printk, print a failure message), 2 (panic, halt the system) 2026-07-20 06:49:08.163985 | ubuntu-noble | +-f 1 2026-07-20 06:49:08.164106 | ubuntu-noble | + 2026-07-20 06:49:08.164221 | ubuntu-noble | +# Ignore errors 2026-07-20 06:49:08.164353 | ubuntu-noble | +## e.g. caused by users or files not found in the local environment 2026-07-20 06:49:08.164470 | ubuntu-noble | +-i 2026-07-20 06:49:08.164581 | ubuntu-noble | + 2026-07-20 06:49:08.164700 | ubuntu-noble | +# Self Auditing --------------------------------------------------------------- 2026-07-20 06:49:08.164815 | ubuntu-noble | + 2026-07-20 06:49:08.164932 | ubuntu-noble | +## Audit the audit logs 2026-07-20 06:49:08.165052 | ubuntu-noble | +### Successful and unsuccessful attempts to read information from the audit records 2026-07-20 06:49:08.165184 | ubuntu-noble | +-w /var/log/audit/ -p wra -k auditlog 2026-07-20 06:49:08.165315 | ubuntu-noble | +-w /var/audit/ -p wra -k auditlog 2026-07-20 06:49:08.165431 | ubuntu-noble | + 2026-07-20 06:49:08.165548 | ubuntu-noble | +## Auditd configuration 2026-07-20 06:49:08.165665 | ubuntu-noble | +### Modifications to audit configuration that occur while the audit collection functions are operating 2026-07-20 06:49:08.165781 | ubuntu-noble | +-w /etc/audit/ -p wa -k auditconfig 2026-07-20 06:49:08.165901 | ubuntu-noble | +-w /etc/libaudit.conf -p wa -k auditconfig 2026-07-20 06:49:08.166018 | ubuntu-noble | +-w /etc/audisp/ -p wa -k audispconfig 2026-07-20 06:49:08.166157 | ubuntu-noble | + 2026-07-20 06:49:08.166289 | ubuntu-noble | +## Monitor for use of audit management tools 2026-07-20 06:49:08.166411 | ubuntu-noble | +-w /sbin/auditctl -p x -k audittools 2026-07-20 06:49:08.166528 | ubuntu-noble | +-w /sbin/auditd -p x -k audittools 2026-07-20 06:49:08.166647 | ubuntu-noble | +-w /usr/sbin/auditd -p x -k audittools 2026-07-20 06:49:08.166765 | ubuntu-noble | +-w /usr/sbin/augenrules -p x -k audittools 2026-07-20 06:49:08.166878 | ubuntu-noble | + 2026-07-20 06:49:08.166995 | ubuntu-noble | +## Access to all audit trails 2026-07-20 06:49:08.167130 | ubuntu-noble | + 2026-07-20 06:49:08.167257 | ubuntu-noble | +-a always,exit -F path=/usr/sbin/ausearch -F perm=x -k audittools 2026-07-20 06:49:08.167390 | ubuntu-noble | +-a always,exit -F path=/usr/sbin/aureport -F perm=x -k audittools 2026-07-20 06:49:08.167515 | ubuntu-noble | +-a always,exit -F path=/usr/sbin/aulast -F perm=x -k audittools 2026-07-20 06:49:08.167642 | ubuntu-noble | +-a always,exit -F path=/usr/sbin/aulastlogin -F perm=x -k audittools 2026-07-20 06:49:08.167763 | ubuntu-noble | +-a always,exit -F path=/usr/sbin/auvirt -F perm=x -k audittools 2026-07-20 06:49:08.167875 | ubuntu-noble | + 2026-07-20 06:49:08.167990 | ubuntu-noble | +# Filters --------------------------------------------------------------------- 2026-07-20 06:49:08.168110 | ubuntu-noble | + 2026-07-20 06:49:08.168231 | ubuntu-noble | +### We put these early because audit is a first match wins system. 2026-07-20 06:49:08.168353 | ubuntu-noble | + 2026-07-20 06:49:08.168478 | ubuntu-noble | +## Ignore SELinux AVC records 2026-07-20 06:49:08.168596 | ubuntu-noble | +-a always,exclude -F msgtype=AVC 2026-07-20 06:49:08.168706 | ubuntu-noble | + 2026-07-20 06:49:08.168824 | ubuntu-noble | +## Ignore current working directory records 2026-07-20 06:49:08.168944 | ubuntu-noble | +-a always,exclude -F msgtype=CWD 2026-07-20 06:49:08.169055 | ubuntu-noble | + 2026-07-20 06:49:08.169186 | ubuntu-noble | +## Cron jobs fill the logs with stuff we normally don't want (works with SELinux) 2026-07-20 06:49:08.169326 | ubuntu-noble | +-a never,user -F subj_type=crond_t 2026-07-20 06:49:08.169449 | ubuntu-noble | +-a never,exit -F subj_type=crond_t 2026-07-20 06:49:08.169560 | ubuntu-noble | + 2026-07-20 06:49:08.169680 | ubuntu-noble | +## This prevents chrony from overwhelming the logs 2026-07-20 06:49:08.169801 | ubuntu-noble | +-a never,exit -F arch=b64 -S adjtimex -F auid=-1 -F uid=chrony -F subj_type=chronyd_t 2026-07-20 06:49:08.169912 | ubuntu-noble | + 2026-07-20 06:49:08.170031 | ubuntu-noble | +## This is not very interesting and wastes a lot of space if the server is public facing 2026-07-20 06:49:08.170163 | ubuntu-noble | +-a always,exclude -F msgtype=CRYPTO_KEY_USER 2026-07-20 06:49:08.170284 | ubuntu-noble | + 2026-07-20 06:49:08.170405 | ubuntu-noble | +## Open VM Tools 2026-07-20 06:49:08.170524 | ubuntu-noble | +-a exit,never -F arch=b64 -S all -F exe=/usr/bin/vmtoolsd 2026-07-20 06:49:08.170633 | ubuntu-noble | + 2026-07-20 06:49:08.170757 | ubuntu-noble | +## High Volume Event Filter (especially on Linux Workstations) 2026-07-20 06:49:08.170877 | ubuntu-noble | +-a never,exit -F arch=b64 -F dir=/dev/shm -k sharedmemaccess 2026-07-20 06:49:08.170994 | ubuntu-noble | +-a never,exit -F arch=b64 -F dir=/var/lock/lvm -k locklvm 2026-07-20 06:49:08.171128 | ubuntu-noble | + 2026-07-20 06:49:08.171247 | ubuntu-noble | +## FileBeat 2026-07-20 06:49:08.171381 | ubuntu-noble | +-a never,exit -F arch=b64 -F path=/opt/filebeat -k filebeat 2026-07-20 06:49:08.171497 | ubuntu-noble | + 2026-07-20 06:49:08.171615 | ubuntu-noble | +## More information on how to filter events 2026-07-20 06:49:08.171734 | ubuntu-noble | +### https://access.redhat.com/solutions/2482221 2026-07-20 06:49:08.171845 | ubuntu-noble | + 2026-07-20 06:49:08.171961 | ubuntu-noble | +# Rules ----------------------------------------------------------------------- 2026-07-20 06:49:08.172071 | ubuntu-noble | + 2026-07-20 06:49:08.172197 | ubuntu-noble | +## Kernel parameters 2026-07-20 06:49:08.172339 | ubuntu-noble | +-w /etc/sysctl.conf -p wa -k sysctl 2026-07-20 06:49:08.172460 | ubuntu-noble | +-w /etc/sysctl.d -p wa -k sysctl 2026-07-20 06:49:08.172572 | ubuntu-noble | + 2026-07-20 06:49:08.172688 | ubuntu-noble | +## Kernel module loading and unloading 2026-07-20 06:49:08.172810 | ubuntu-noble | +-a always,exit -F perm=x -F auid!=-1 -F path=/sbin/insmod -k modules 2026-07-20 06:49:08.172930 | ubuntu-noble | +-a always,exit -F perm=x -F auid!=-1 -F path=/sbin/modprobe -k modules 2026-07-20 06:49:08.173050 | ubuntu-noble | +-a always,exit -F perm=x -F auid!=-1 -F path=/sbin/rmmod -k modules 2026-07-20 06:49:08.173183 | ubuntu-noble | +-a always,exit -F arch=b64 -S finit_module -S init_module -S delete_module -F auid!=-1 -k modules 2026-07-20 06:49:08.173307 | ubuntu-noble | + 2026-07-20 06:49:08.173428 | ubuntu-noble | +## Modprobe configuration 2026-07-20 06:49:08.173547 | ubuntu-noble | +-w /etc/modprobe.conf -p wa -k modprobe 2026-07-20 06:49:08.173662 | ubuntu-noble | +-w /etc/modprobe.d -p wa -k modprobe 2026-07-20 06:49:08.173772 | ubuntu-noble | + 2026-07-20 06:49:08.173890 | ubuntu-noble | +## KExec usage (all actions) 2026-07-20 06:49:08.174011 | ubuntu-noble | +-a always,exit -F arch=b64 -S kexec_load -k KEXEC 2026-07-20 06:49:08.174147 | ubuntu-noble | + 2026-07-20 06:49:08.174267 | ubuntu-noble | +## Special files 2026-07-20 06:49:08.174407 | ubuntu-noble | +-a always,exit -F arch=b64 -S mknod -S mknodat -k specialfiles 2026-07-20 06:49:08.175317 | ubuntu-noble | + 2026-07-20 06:49:08.175329 | ubuntu-noble | +## Mount operations (only attributable) 2026-07-20 06:49:08.175333 | ubuntu-noble | +-a always,exit -F arch=b64 -S mount -S umount2 -F auid!=-1 -k mount 2026-07-20 06:49:08.175343 | ubuntu-noble | + 2026-07-20 06:49:08.175347 | ubuntu-noble | +### NFS mount 2026-07-20 06:49:08.175351 | ubuntu-noble | +-a always,exit -F path=/sbin/mount.nfs -F perm=x -F auid>=500 -F auid!=4294967295 -k T1078_Valid_Accounts 2026-07-20 06:49:08.175355 | ubuntu-noble | +-a always,exit -F path=/usr/sbin/mount.nfs -F perm=x -F auid>=500 -F auid!=4294967295 -k T1078_Valid_Accounts 2026-07-20 06:49:08.175358 | ubuntu-noble | + 2026-07-20 06:49:08.175382 | ubuntu-noble | +## Change swap (only attributable) 2026-07-20 06:49:08.175507 | ubuntu-noble | +-a always,exit -F arch=b64 -S swapon -S swapoff -F auid!=-1 -k swap 2026-07-20 06:49:08.175618 | ubuntu-noble | + 2026-07-20 06:49:08.175732 | ubuntu-noble | +## Time 2026-07-20 06:49:08.175856 | ubuntu-noble | +-a always,exit -F arch=b64 -F uid!=ntp -S adjtimex -S settimeofday -S clock_settime -k time 2026-07-20 06:49:08.175975 | ubuntu-noble | +### Local time zone 2026-07-20 06:49:08.176117 | ubuntu-noble | +-w /etc/localtime -p wa -k localtime 2026-07-20 06:49:08.176234 | ubuntu-noble | + 2026-07-20 06:49:08.176365 | ubuntu-noble | +## Stunnel 2026-07-20 06:49:08.176487 | ubuntu-noble | +-w /usr/sbin/stunnel -p x -k stunnel 2026-07-20 06:49:08.176618 | ubuntu-noble | +-w /usr/bin/stunnel -p x -k stunnel 2026-07-20 06:49:08.176730 | ubuntu-noble | + 2026-07-20 06:49:08.176850 | ubuntu-noble | +## Cron configuration & scheduled jobs 2026-07-20 06:49:08.176968 | ubuntu-noble | +-w /etc/cron.allow -p wa -k cron 2026-07-20 06:49:08.177095 | ubuntu-noble | +-w /etc/cron.deny -p wa -k cron 2026-07-20 06:49:08.177214 | ubuntu-noble | +-w /etc/cron.d/ -p wa -k cron 2026-07-20 06:49:08.177354 | ubuntu-noble | +-w /etc/cron.daily/ -p wa -k cron 2026-07-20 06:49:08.177477 | ubuntu-noble | +-w /etc/cron.hourly/ -p wa -k cron 2026-07-20 06:49:08.177594 | ubuntu-noble | +-w /etc/cron.monthly/ -p wa -k cron 2026-07-20 06:49:08.177710 | ubuntu-noble | +-w /etc/cron.weekly/ -p wa -k cron 2026-07-20 06:49:08.177826 | ubuntu-noble | +-w /etc/crontab -p wa -k cron 2026-07-20 06:49:08.177943 | ubuntu-noble | +-w /var/spool/cron/ -p wa -k cron 2026-07-20 06:49:08.178054 | ubuntu-noble | + 2026-07-20 06:49:08.178196 | ubuntu-noble | +## User, group, password databases 2026-07-20 06:49:08.178325 | ubuntu-noble | +-w /etc/group -p wa -k etcgroup 2026-07-20 06:49:08.178456 | ubuntu-noble | +-w /etc/passwd -p wa -k etcpasswd 2026-07-20 06:49:08.178575 | ubuntu-noble | +-w /etc/gshadow -k etcgroup 2026-07-20 06:49:08.178692 | ubuntu-noble | +-w /etc/shadow -k etcpasswd 2026-07-20 06:49:08.178809 | ubuntu-noble | +-w /etc/security/opasswd -k opasswd 2026-07-20 06:49:08.178923 | ubuntu-noble | + 2026-07-20 06:49:08.179042 | ubuntu-noble | +## Sudoers file changes 2026-07-20 06:49:08.179171 | ubuntu-noble | +-w /etc/sudoers -p wa -k actions 2026-07-20 06:49:08.179299 | ubuntu-noble | +-w /etc/sudoers.d/ -p wa -k actions 2026-07-20 06:49:08.179425 | ubuntu-noble | + 2026-07-20 06:49:08.179539 | ubuntu-noble | +## Passwd 2026-07-20 06:49:08.179657 | ubuntu-noble | +-w /usr/bin/passwd -p x -k passwd_modification 2026-07-20 06:49:08.179769 | ubuntu-noble | + 2026-07-20 06:49:08.179886 | ubuntu-noble | +## Tools to change group identifiers 2026-07-20 06:49:08.180009 | ubuntu-noble | +-w /usr/sbin/groupadd -p x -k group_modification 2026-07-20 06:49:08.180162 | ubuntu-noble | +-w /usr/sbin/groupmod -p x -k group_modification 2026-07-20 06:49:08.180298 | ubuntu-noble | +-w /usr/sbin/addgroup -p x -k group_modification 2026-07-20 06:49:08.180426 | ubuntu-noble | +-w /usr/sbin/useradd -p x -k user_modification 2026-07-20 06:49:08.180546 | ubuntu-noble | +-w /usr/sbin/userdel -p x -k user_modification 2026-07-20 06:49:08.180666 | ubuntu-noble | +-w /usr/sbin/usermod -p x -k user_modification 2026-07-20 06:49:08.180786 | ubuntu-noble | +-w /usr/sbin/adduser -p x -k user_modification 2026-07-20 06:49:08.180897 | ubuntu-noble | + 2026-07-20 06:49:08.181016 | ubuntu-noble | +## Login configuration and information 2026-07-20 06:49:08.181144 | ubuntu-noble | +-w /etc/login.defs -p wa -k login 2026-07-20 06:49:08.181262 | ubuntu-noble | +-w /etc/securetty -p wa -k login 2026-07-20 06:49:08.182286 | ubuntu-noble | +-w /var/log/faillog -p wa -k login 2026-07-20 06:49:08.182297 | ubuntu-noble | +-w /var/log/lastlog -p wa -k login 2026-07-20 06:49:08.182301 | ubuntu-noble | +-w /var/log/tallylog -p wa -k login 2026-07-20 06:49:08.182305 | ubuntu-noble | + 2026-07-20 06:49:08.182308 | ubuntu-noble | +## Network Environment 2026-07-20 06:49:08.182312 | ubuntu-noble | +### Changes to hostname 2026-07-20 06:49:08.182315 | ubuntu-noble | +-a always,exit -F arch=b64 -S sethostname -S setdomainname -k network_modifications 2026-07-20 06:49:08.182319 | ubuntu-noble | + 2026-07-20 06:49:08.182322 | ubuntu-noble | +### Detect Remote Shell Use 2026-07-20 06:49:08.182326 | ubuntu-noble | +-a always,exit -F arch=b64 -F exe=/bin/bash -F success=1 -S connect -k "remote_shell" 2026-07-20 06:49:08.182451 | ubuntu-noble | +-a always,exit -F arch=b64 -F exe=/usr/bin/bash -F success=1 -S connect -k "remote_shell" 2026-07-20 06:49:08.182561 | ubuntu-noble | + 2026-07-20 06:49:08.182681 | ubuntu-noble | +### Successful IPv4 Connections 2026-07-20 06:49:08.182802 | ubuntu-noble | +-a always,exit -F arch=b64 -S connect -F a2=16 -F success=1 -F key=network_connect_4 2026-07-20 06:49:08.182912 | ubuntu-noble | + 2026-07-20 06:49:08.183028 | ubuntu-noble | +### Successful IPv6 Connections 2026-07-20 06:49:08.183174 | ubuntu-noble | +-a always,exit -F arch=b64 -S connect -F a2=28 -F success=1 -F key=network_connect_6 2026-07-20 06:49:08.183297 | ubuntu-noble | + 2026-07-20 06:49:08.183419 | ubuntu-noble | +### Changes to other files 2026-07-20 06:49:08.183537 | ubuntu-noble | +-w /etc/hosts -p wa -k network_modifications 2026-07-20 06:49:08.183655 | ubuntu-noble | +-w /etc/sysconfig/network -p wa -k network_modifications 2026-07-20 06:49:08.183774 | ubuntu-noble | +-w /etc/sysconfig/network-scripts -p w -k network_modifications 2026-07-20 06:49:08.183891 | ubuntu-noble | +-w /etc/network/ -p wa -k network 2026-07-20 06:49:08.184013 | ubuntu-noble | +-a always,exit -F dir=/etc/NetworkManager/ -F perm=wa -k network_modifications 2026-07-20 06:49:08.184133 | ubuntu-noble | + 2026-07-20 06:49:08.184260 | ubuntu-noble | +### Changes to issue 2026-07-20 06:49:08.184387 | ubuntu-noble | +-w /etc/issue -p wa -k etcissue 2026-07-20 06:49:08.184506 | ubuntu-noble | +-w /etc/issue.net -p wa -k etcissue 2026-07-20 06:49:08.184615 | ubuntu-noble | + 2026-07-20 06:49:08.184731 | ubuntu-noble | +## System startup scripts 2026-07-20 06:49:08.184846 | ubuntu-noble | +-w /etc/inittab -p wa -k init 2026-07-20 06:49:08.184964 | ubuntu-noble | +-w /etc/init.d/ -p wa -k init 2026-07-20 06:49:08.185172 | ubuntu-noble | +-w /etc/init/ -p wa -k init 2026-07-20 06:49:08.185315 | ubuntu-noble | + 2026-07-20 06:49:08.185437 | ubuntu-noble | +## Library search paths 2026-07-20 06:49:08.185554 | ubuntu-noble | +-w /etc/ld.so.conf -p wa -k libpath 2026-07-20 06:49:08.185671 | ubuntu-noble | +-w /etc/ld.so.conf.d -p wa -k libpath 2026-07-20 06:49:08.185783 | ubuntu-noble | + 2026-07-20 06:49:08.185903 | ubuntu-noble | +## Systemwide library preloads (LD_PRELOAD) 2026-07-20 06:49:08.186020 | ubuntu-noble | +-w /etc/ld.so.preload -p wa -k systemwide_preloads 2026-07-20 06:49:08.186157 | ubuntu-noble | + 2026-07-20 06:49:08.186286 | ubuntu-noble | +## Pam configuration 2026-07-20 06:49:08.186406 | ubuntu-noble | +-w /etc/pam.d/ -p wa -k pam 2026-07-20 06:49:08.186525 | ubuntu-noble | +-w /etc/security/limits.conf -p wa -k pam 2026-07-20 06:49:08.186643 | ubuntu-noble | +-w /etc/security/limits.d -p wa -k pam 2026-07-20 06:49:08.186761 | ubuntu-noble | +-w /etc/security/pam_env.conf -p wa -k pam 2026-07-20 06:49:08.186877 | ubuntu-noble | +-w /etc/security/namespace.conf -p wa -k pam 2026-07-20 06:49:08.186993 | ubuntu-noble | +-w /etc/security/namespace.d -p wa -k pam 2026-07-20 06:49:08.187119 | ubuntu-noble | +-w /etc/security/namespace.init -p wa -k pam 2026-07-20 06:49:08.187231 | ubuntu-noble | + 2026-07-20 06:49:08.187359 | ubuntu-noble | +## Mail configuration 2026-07-20 06:49:08.187479 | ubuntu-noble | +-w /etc/aliases -p wa -k mail 2026-07-20 06:49:08.187596 | ubuntu-noble | +-w /etc/postfix/ -p wa -k mail 2026-07-20 06:49:08.187712 | ubuntu-noble | +-w /etc/exim4/ -p wa -k mail 2026-07-20 06:49:08.187824 | ubuntu-noble | + 2026-07-20 06:49:08.187940 | ubuntu-noble | +## SSH configuration 2026-07-20 06:49:08.188057 | ubuntu-noble | +-w /etc/ssh/sshd_config -k sshd 2026-07-20 06:49:08.188183 | ubuntu-noble | +-w /etc/ssh/sshd_config.d -k sshd 2026-07-20 06:49:08.188305 | ubuntu-noble | + 2026-07-20 06:49:08.188427 | ubuntu-noble | +## root ssh key tampering 2026-07-20 06:49:08.188542 | ubuntu-noble | +-w /root/.ssh -p wa -k rootkey 2026-07-20 06:49:08.188652 | ubuntu-noble | + 2026-07-20 06:49:08.189291 | ubuntu-noble | +# Systemd 2026-07-20 06:49:08.189302 | ubuntu-noble | +-w /bin/systemctl -p x -k systemd 2026-07-20 06:49:08.189306 | ubuntu-noble | +-w /etc/systemd/ -p wa -k systemd 2026-07-20 06:49:08.189309 | ubuntu-noble | +-w /usr/lib/systemd -p wa -k systemd 2026-07-20 06:49:08.189313 | ubuntu-noble | + 2026-07-20 06:49:08.189317 | ubuntu-noble | +## https://systemd.network/systemd.generator.html 2026-07-20 06:49:08.189427 | ubuntu-noble | +-w /etc/systemd/system-generators/ -p wa -k systemd_generator 2026-07-20 06:49:08.189547 | ubuntu-noble | +-w /usr/local/lib/systemd/system-generators/ -p wa -k systemd_generator 2026-07-20 06:49:08.189666 | ubuntu-noble | +-w /usr/lib/systemd/system-generators -p wa -k systemd_generator 2026-07-20 06:49:08.189778 | ubuntu-noble | + 2026-07-20 06:49:08.189896 | ubuntu-noble | +-w /etc/systemd/user-generators/ -p wa -k systemd_generator 2026-07-20 06:49:08.190021 | ubuntu-noble | +-w /usr/local/lib/systemd/user-generators/ -p wa -k systemd_generator 2026-07-20 06:49:08.190150 | ubuntu-noble | +-w /lib/systemd/system-generators/ -p wa -k systemd_generator 2026-07-20 06:49:08.190263 | ubuntu-noble | + 2026-07-20 06:49:08.190397 | ubuntu-noble | +## SELinux events that modify the system's Mandatory Access Controls (MAC) 2026-07-20 06:49:08.190518 | ubuntu-noble | +-w /etc/selinux/ -p wa -k mac_policy 2026-07-20 06:49:08.190627 | ubuntu-noble | + 2026-07-20 06:49:08.190744 | ubuntu-noble | +## Critical elements access failures 2026-07-20 06:49:08.190866 | ubuntu-noble | +-a always,exit -F arch=b64 -S open -F dir=/etc -F success=0 -k unauthedfileaccess 2026-07-20 06:49:08.190988 | ubuntu-noble | +-a always,exit -F arch=b64 -S open -F dir=/bin -F success=0 -k unauthedfileaccess 2026-07-20 06:49:08.191119 | ubuntu-noble | +-a always,exit -F arch=b64 -S open -F dir=/sbin -F success=0 -k unauthedfileaccess 2026-07-20 06:49:08.191240 | ubuntu-noble | +-a always,exit -F arch=b64 -S open -F dir=/usr/bin -F success=0 -k unauthedfileaccess 2026-07-20 06:49:08.191373 | ubuntu-noble | +-a always,exit -F arch=b64 -S open -F dir=/usr/sbin -F success=0 -k unauthedfileaccess 2026-07-20 06:49:08.191498 | ubuntu-noble | +-a always,exit -F arch=b64 -S open -F dir=/var -F success=0 -k unauthedfileaccess 2026-07-20 06:49:08.191620 | ubuntu-noble | +-a always,exit -F arch=b64 -S open -F dir=/home -F success=0 -k unauthedfileaccess 2026-07-20 06:49:08.191751 | ubuntu-noble | +-a always,exit -F arch=b64 -S open -F dir=/srv -F success=0 -k unauthedfileaccess 2026-07-20 06:49:08.191860 | ubuntu-noble | + 2026-07-20 06:49:08.191980 | ubuntu-noble | +## Process ID change (switching accounts) applications 2026-07-20 06:49:08.192106 | ubuntu-noble | +-w /bin/su -p x -k priv_esc 2026-07-20 06:49:08.192226 | ubuntu-noble | +-w /usr/bin/sudo -p x -k priv_esc 2026-07-20 06:49:08.192347 | ubuntu-noble | + 2026-07-20 06:49:08.192465 | ubuntu-noble | +## Power state 2026-07-20 06:49:08.192584 | ubuntu-noble | +-w /sbin/shutdown -p x -k power 2026-07-20 06:49:08.192700 | ubuntu-noble | +-w /sbin/poweroff -p x -k power 2026-07-20 06:49:08.192815 | ubuntu-noble | +-w /sbin/reboot -p x -k power 2026-07-20 06:49:08.192931 | ubuntu-noble | +-w /sbin/halt -p x -k power 2026-07-20 06:49:08.193040 | ubuntu-noble | + 2026-07-20 06:49:08.193181 | ubuntu-noble | +## Session initiation information 2026-07-20 06:49:08.193310 | ubuntu-noble | +-w /var/run/utmp -p wa -k session 2026-07-20 06:49:08.193431 | ubuntu-noble | +-w /var/log/btmp -p wa -k session 2026-07-20 06:49:08.194285 | ubuntu-noble | +-w /var/log/wtmp -p wa -k session 2026-07-20 06:49:08.194295 | ubuntu-noble | + 2026-07-20 06:49:08.194299 | ubuntu-noble | +## Discretionary Access Control (DAC) modifications 2026-07-20 06:49:08.194303 | ubuntu-noble | +-a always,exit -F arch=b64 -S chmod -F auid>=1000 -F auid!=-1 -k perm_mod 2026-07-20 06:49:08.194306 | ubuntu-noble | +-a always,exit -F arch=b64 -S chown -F auid>=1000 -F auid!=-1 -k perm_mod 2026-07-20 06:49:08.194316 | ubuntu-noble | +-a always,exit -F arch=b64 -S fchmod -F auid>=1000 -F auid!=-1 -k perm_mod 2026-07-20 06:49:08.194319 | ubuntu-noble | +-a always,exit -F arch=b64 -S fchmodat -F auid>=1000 -F auid!=-1 -k perm_mod 2026-07-20 06:49:08.194325 | ubuntu-noble | +-a always,exit -F arch=b64 -S fchown -F auid>=1000 -F auid!=-1 -k perm_mod 2026-07-20 06:49:08.194427 | ubuntu-noble | +-a always,exit -F arch=b64 -S fchownat -F auid>=1000 -F auid!=-1 -k perm_mod 2026-07-20 06:49:08.194550 | ubuntu-noble | +-a always,exit -F arch=b64 -S fremovexattr -F auid>=1000 -F auid!=-1 -k perm_mod 2026-07-20 06:49:08.194673 | ubuntu-noble | +-a always,exit -F arch=b64 -S fsetxattr -F auid>=1000 -F auid!=-1 -k perm_mod 2026-07-20 06:49:08.194794 | ubuntu-noble | +-a always,exit -F arch=b64 -S lchown -F auid>=1000 -F auid!=-1 -k perm_mod 2026-07-20 06:49:08.194916 | ubuntu-noble | +-a always,exit -F arch=b64 -S lremovexattr -F auid>=1000 -F auid!=-1 -k perm_mod 2026-07-20 06:49:08.195038 | ubuntu-noble | +-a always,exit -F arch=b64 -S lsetxattr -F auid>=1000 -F auid!=-1 -k perm_mod 2026-07-20 06:49:08.195180 | ubuntu-noble | +-a always,exit -F arch=b64 -S removexattr -F auid>=1000 -F auid!=-1 -k perm_mod 2026-07-20 06:49:08.195316 | ubuntu-noble | +-a always,exit -F arch=b64 -S setxattr -F auid>=1000 -F auid!=-1 -k perm_mod 2026-07-20 06:49:08.195433 | ubuntu-noble | + 2026-07-20 06:49:08.195550 | ubuntu-noble | +# Special Rules --------------------------------------------------------------- 2026-07-20 06:49:08.195663 | ubuntu-noble | + 2026-07-20 06:49:08.195776 | ubuntu-noble | +## Reconnaissance 2026-07-20 06:49:08.195894 | ubuntu-noble | +-w /usr/bin/whoami -p x -k recon 2026-07-20 06:49:08.196013 | ubuntu-noble | +-w /usr/bin/id -p x -k recon 2026-07-20 06:49:08.196138 | ubuntu-noble | +-w /bin/hostname -p x -k recon 2026-07-20 06:49:08.196253 | ubuntu-noble | +-w /bin/uname -p x -k recon 2026-07-20 06:49:08.196378 | ubuntu-noble | +-w /etc/issue -p r -k recon 2026-07-20 06:49:08.196497 | ubuntu-noble | +-w /etc/hostname -p r -k recon 2026-07-20 06:49:08.196607 | ubuntu-noble | + 2026-07-20 06:49:08.196723 | ubuntu-noble | +## Suspicious activity 2026-07-20 06:49:08.196841 | ubuntu-noble | +-w /usr/bin/wget -p x -k susp_activity 2026-07-20 06:49:08.197030 | ubuntu-noble | +-w /usr/bin/curl -p x -k susp_activity 2026-07-20 06:49:08.197172 | ubuntu-noble | +-w /usr/bin/base64 -p x -k susp_activity 2026-07-20 06:49:08.197303 | ubuntu-noble | +-w /bin/nc -p x -k susp_activity 2026-07-20 06:49:08.197425 | ubuntu-noble | +-w /bin/netcat -p x -k susp_activity 2026-07-20 06:49:08.197544 | ubuntu-noble | +-w /usr/bin/ncat -p x -k susp_activity 2026-07-20 06:49:08.197660 | ubuntu-noble | +-w /usr/bin/ss -p x -k susp_activity 2026-07-20 06:49:08.197778 | ubuntu-noble | +-w /usr/bin/netstat -p x -k susp_activity 2026-07-20 06:49:08.197894 | ubuntu-noble | +-w /usr/bin/ssh -p x -k susp_activity 2026-07-20 06:49:08.198009 | ubuntu-noble | +-w /usr/bin/scp -p x -k susp_activity 2026-07-20 06:49:08.198151 | ubuntu-noble | +-w /usr/bin/sftp -p x -k susp_activity 2026-07-20 06:49:08.198281 | ubuntu-noble | +-w /usr/bin/ftp -p x -k susp_activity 2026-07-20 06:49:08.198408 | ubuntu-noble | +-w /usr/bin/socat -p x -k susp_activity 2026-07-20 06:49:08.198529 | ubuntu-noble | +-w /usr/bin/wireshark -p x -k susp_activity 2026-07-20 06:49:08.198662 | ubuntu-noble | +-w /usr/bin/tshark -p x -k susp_activity 2026-07-20 06:49:08.198782 | ubuntu-noble | +-w /usr/bin/rawshark -p x -k susp_activity 2026-07-20 06:49:08.198901 | ubuntu-noble | +-w /usr/bin/rdesktop -p x -k susp_activity 2026-07-20 06:49:08.199018 | ubuntu-noble | +-w /usr/local/bin/rdesktop -p x -k susp_activity 2026-07-20 06:49:08.199147 | ubuntu-noble | +-w /usr/bin/wlfreerdp -p x -k susp_activity 2026-07-20 06:49:08.199264 | ubuntu-noble | +-w /usr/bin/xfreerdp -p x -k susp_activity 2026-07-20 06:49:08.199396 | ubuntu-noble | +-w /usr/local/bin/xfreerdp -p x -k susp_activity 2026-07-20 06:49:08.199657 | ubuntu-noble | +-w /usr/bin/nmap -p x -k susp_activity 2026-07-20 06:49:08.199779 | ubuntu-noble | + 2026-07-20 06:49:08.199896 | ubuntu-noble | +## sssd 2026-07-20 06:49:08.200027 | ubuntu-noble | +-a always,exit -F path=/usr/libexec/sssd/p11_child -F perm=x -F auid>=500 -F auid!=4294967295 -k T1078_Valid_Accounts 2026-07-20 06:49:08.200182 | ubuntu-noble | +-a always,exit -F path=/usr/libexec/sssd/krb5_child -F perm=x -F auid>=500 -F auid!=4294967295 -k T1078_Valid_Accounts 2026-07-20 06:49:08.201286 | ubuntu-noble | +-a always,exit -F path=/usr/libexec/sssd/ldap_child -F perm=x -F auid>=500 -F auid!=4294967295 -k T1078_Valid_Accounts 2026-07-20 06:49:08.201297 | ubuntu-noble | +-a always,exit -F path=/usr/libexec/sssd/selinux_child -F perm=x -F auid>=500 -F auid!=4294967295 -k T1078_Valid_Accounts 2026-07-20 06:49:08.201301 | ubuntu-noble | +-a always,exit -F path=/usr/libexec/sssd/proxy_child -F perm=x -F auid>=500 -F auid!=4294967295 -k T1078_Valid_Accounts 2026-07-20 06:49:08.201305 | ubuntu-noble | + 2026-07-20 06:49:08.201308 | ubuntu-noble | +## T1002 Data Compressed 2026-07-20 06:49:08.201312 | ubuntu-noble | + 2026-07-20 06:49:08.201315 | ubuntu-noble | +-w /usr/bin/zip -p x -k Data_Compressed 2026-07-20 06:49:08.201319 | ubuntu-noble | +-w /usr/bin/gzip -p x -k Data_Compressed 2026-07-20 06:49:08.201322 | ubuntu-noble | +-w /usr/bin/tar -p x -k Data_Compressed 2026-07-20 06:49:08.201326 | ubuntu-noble | +-w /usr/bin/bzip2 -p x -k Data_Compressed 2026-07-20 06:49:08.201371 | ubuntu-noble | + 2026-07-20 06:49:08.201492 | ubuntu-noble | +-w /usr/bin/lzip -p x -k Data_Compressed 2026-07-20 06:49:08.201613 | ubuntu-noble | +-w /usr/local/bin/lzip -p x -k Data_Compressed 2026-07-20 06:49:08.201723 | ubuntu-noble | + 2026-07-20 06:49:08.201844 | ubuntu-noble | +-w /usr/bin/lz4 -p x -k Data_Compressed 2026-07-20 06:49:08.201963 | ubuntu-noble | +-w /usr/local/bin/lz4 -p x -k Data_Compressed 2026-07-20 06:49:08.202074 | ubuntu-noble | + 2026-07-20 06:49:08.202206 | ubuntu-noble | +-w /usr/bin/lzop -p x -k Data_Compressed 2026-07-20 06:49:08.202339 | ubuntu-noble | +-w /usr/local/bin/lzop -p x -k Data_Compressed 2026-07-20 06:49:08.202452 | ubuntu-noble | + 2026-07-20 06:49:08.202571 | ubuntu-noble | +-w /usr/bin/plzip -p x -k Data_Compressed 2026-07-20 06:49:08.202694 | ubuntu-noble | +-w /usr/local/bin/plzip -p x -k Data_Compressed 2026-07-20 06:49:08.202806 | ubuntu-noble | + 2026-07-20 06:49:08.202923 | ubuntu-noble | +-w /usr/bin/pbzip2 -p x -k Data_Compressed 2026-07-20 06:49:08.203050 | ubuntu-noble | +-w /usr/local/bin/pbzip2 -p x -k Data_Compressed 2026-07-20 06:49:08.203172 | ubuntu-noble | + 2026-07-20 06:49:08.203302 | ubuntu-noble | +-w /usr/bin/lbzip2 -p x -k Data_Compressed 2026-07-20 06:49:08.203424 | ubuntu-noble | +-w /usr/local/bin/lbzip2 -p x -k Data_Compressed 2026-07-20 06:49:08.203534 | ubuntu-noble | + 2026-07-20 06:49:08.203652 | ubuntu-noble | +-w /usr/bin/pixz -p x -k Data_Compressed 2026-07-20 06:49:08.203771 | ubuntu-noble | +-w /usr/local/bin/pixz -p x -k Data_Compressed 2026-07-20 06:49:08.203881 | ubuntu-noble | + 2026-07-20 06:49:08.204003 | ubuntu-noble | +-w /usr/bin/pigz -p x -k Data_Compressed 2026-07-20 06:49:08.204147 | ubuntu-noble | +-w /usr/local/bin/pigz -p x -k Data_Compressed 2026-07-20 06:49:08.204268 | ubuntu-noble | +-w /usr/bin/unpigz -p x -k Data_Compressed 2026-07-20 06:49:08.204402 | ubuntu-noble | +-w /usr/local/bin/unpigz -p x -k Data_Compressed 2026-07-20 06:49:08.204511 | ubuntu-noble | + 2026-07-20 06:49:08.204629 | ubuntu-noble | +-w /usr/bin/zstd -p x -k Data_Compressed 2026-07-20 06:49:08.204746 | ubuntu-noble | +-w /usr/local/bin/zstd -p x -k Data_Compressed 2026-07-20 06:49:08.204855 | ubuntu-noble | + 2026-07-20 06:49:08.204972 | ubuntu-noble | +## Added to catch netcat on Ubuntu 2026-07-20 06:49:08.205102 | ubuntu-noble | +-w /bin/nc.openbsd -p x -k susp_activity 2026-07-20 06:49:08.205222 | ubuntu-noble | +-w /bin/nc.traditional -p x -k susp_activity 2026-07-20 06:49:08.205343 | ubuntu-noble | + 2026-07-20 06:49:08.205463 | ubuntu-noble | +## Sbin suspicious activity 2026-07-20 06:49:08.205579 | ubuntu-noble | +-w /sbin/iptables -p x -k sbin_susp 2026-07-20 06:49:08.205695 | ubuntu-noble | +-w /sbin/ip6tables -p x -k sbin_susp 2026-07-20 06:49:08.205812 | ubuntu-noble | +-w /sbin/ifconfig -p x -k sbin_susp 2026-07-20 06:49:08.205942 | ubuntu-noble | +-w /usr/sbin/arptables -p x -k sbin_susp 2026-07-20 06:49:08.206059 | ubuntu-noble | +-w /usr/sbin/ebtables -p x -k sbin_susp 2026-07-20 06:49:08.206202 | ubuntu-noble | +-w /sbin/xtables-nft-multi -p x -k sbin_susp 2026-07-20 06:49:08.206333 | ubuntu-noble | +-w /usr/sbin/nft -p x -k sbin_susp 2026-07-20 06:49:08.206479 | ubuntu-noble | +-w /usr/sbin/tcpdump -p x -k sbin_susp 2026-07-20 06:49:08.206599 | ubuntu-noble | +-w /usr/sbin/traceroute -p x -k sbin_susp 2026-07-20 06:49:08.206716 | ubuntu-noble | +-w /usr/sbin/ufw -p x -k sbin_susp 2026-07-20 06:49:08.206827 | ubuntu-noble | + 2026-07-20 06:49:08.206943 | ubuntu-noble | +### kde4 2026-07-20 06:49:08.207071 | ubuntu-noble | +-a always,exit -F path=/usr/libexec/kde4/kpac_dhcp_helper -F perm=x -F auid>=1000 -F auid!=4294967295 -k T1078_Valid_Accounts 2026-07-20 06:49:08.207208 | ubuntu-noble | +-a always,exit -F path=/usr/libexec/kde4/kdesud -F perm=x -F auid>=1000 -F auid!=4294967295 -k T1078_Valid_Accounts 2026-07-20 06:49:08.207331 | ubuntu-noble | + 2026-07-20 06:49:08.207452 | ubuntu-noble | +## dbus-send invocation 2026-07-20 06:49:08.207574 | ubuntu-noble | +### may indicate privilege escalation CVE-2021-3560 2026-07-20 06:49:08.207690 | ubuntu-noble | +-w /usr/bin/dbus-send -p x -k dbus_send 2026-07-20 06:49:08.207808 | ubuntu-noble | +-w /usr/bin/gdbus -p x -k gdubs_call 2026-07-20 06:49:08.207919 | ubuntu-noble | + 2026-07-20 06:49:08.208036 | ubuntu-noble | +## pkexec invocation 2026-07-20 06:49:08.208166 | ubuntu-noble | +### may indicate privilege escalation CVE-2021-4034 2026-07-20 06:49:08.208303 | ubuntu-noble | +-w /usr/bin/pkexec -p x -k pkexec 2026-07-20 06:49:08.208419 | ubuntu-noble | + 2026-07-20 06:49:08.208535 | ubuntu-noble | +## Suspicious shells 2026-07-20 06:49:08.208651 | ubuntu-noble | +-w /bin/ash -p x -k susp_shell 2026-07-20 06:49:08.209323 | ubuntu-noble | +-w /bin/csh -p x -k susp_shell 2026-07-20 06:49:08.209355 | ubuntu-noble | +-w /bin/fish -p x -k susp_shell 2026-07-20 06:49:08.209361 | ubuntu-noble | +-w /bin/tcsh -p x -k susp_shell 2026-07-20 06:49:08.209365 | ubuntu-noble | +-w /bin/tclsh -p x -k susp_shell 2026-07-20 06:49:08.209369 | ubuntu-noble | +-w /bin/xonsh -p x -k susp_shell 2026-07-20 06:49:08.209373 | ubuntu-noble | +-w /usr/local/bin/xonsh -p x -k susp_shell 2026-07-20 06:49:08.209401 | ubuntu-noble | +-w /bin/open -p x -k susp_shell 2026-07-20 06:49:08.209510 | ubuntu-noble | +-w /bin/rbash -p x -k susp_shell 2026-07-20 06:49:08.209603 | ubuntu-noble | + 2026-07-20 06:49:08.210458 | ubuntu-noble | +# Web Server Actvity 2026-07-20 06:49:08.210477 | ubuntu-noble | +## Change the number "33" to the ID of your WebServer user. Default: www-data:x:33:33 2026-07-20 06:49:08.210482 | ubuntu-noble | +-a always,exit -F arch=b64 -S execve -F euid=33 -k detect_execve_www 2026-07-20 06:49:08.210487 | ubuntu-noble | + 2026-07-20 06:49:08.210491 | ubuntu-noble | +### https://clustershell.readthedocs.io/ 2026-07-20 06:49:08.210496 | ubuntu-noble | +-w /bin/clush -p x -k susp_shell 2026-07-20 06:49:08.210500 | ubuntu-noble | +-w /usr/local/bin/clush -p x -k susp_shell 2026-07-20 06:49:08.210504 | ubuntu-noble | +-w /etc/clustershell/clush.conf -p x -k susp_shell 2026-07-20 06:49:08.210530 | ubuntu-noble | + 2026-07-20 06:49:08.210631 | ubuntu-noble | +### https://github.com/tmux/tmux 2026-07-20 06:49:08.211471 | ubuntu-noble | +-w /bin/tmux -p x -k susp_shell 2026-07-20 06:49:08.211487 | ubuntu-noble | +-w /usr/local/bin/tmux -p x -k susp_shell 2026-07-20 06:49:08.211492 | ubuntu-noble | + 2026-07-20 06:49:08.211496 | ubuntu-noble | +## Shell/profile configurations 2026-07-20 06:49:08.211501 | ubuntu-noble | +-w /etc/profile.d/ -p wa -k shell_profiles 2026-07-20 06:49:08.211516 | ubuntu-noble | +-w /etc/profile -p wa -k shell_profiles 2026-07-20 06:49:08.211520 | ubuntu-noble | +-w /etc/shells -p wa -k shell_profiles 2026-07-20 06:49:08.211524 | ubuntu-noble | +-w /etc/bashrc -p wa -k shell_profiles 2026-07-20 06:49:08.211531 | ubuntu-noble | +-w /etc/csh.cshrc -p wa -k shell_profiles 2026-07-20 06:49:08.211636 | ubuntu-noble | +-w /etc/csh.login -p wa -k shell_profiles 2026-07-20 06:49:08.211721 | ubuntu-noble | +-w /etc/fish/ -p wa -k shell_profiles 2026-07-20 06:49:08.211820 | ubuntu-noble | +-w /etc/zsh/ -p wa -k shell_profiles 2026-07-20 06:49:08.211917 | ubuntu-noble | + 2026-07-20 06:49:08.212018 | ubuntu-noble | +### https://github.com/xxh/xxh 2026-07-20 06:49:08.212141 | ubuntu-noble | +-w /usr/local/bin/xxh.bash -p x -k susp_shell 2026-07-20 06:49:08.212243 | ubuntu-noble | +-w /usr/local/bin/xxh.xsh -p x -k susp_shell 2026-07-20 06:49:08.212368 | ubuntu-noble | +-w /usr/local/bin/xxh.zsh -p x -k susp_shell 2026-07-20 06:49:08.212464 | ubuntu-noble | + 2026-07-20 06:49:08.212564 | ubuntu-noble | +## Injection 2026-07-20 06:49:08.212672 | ubuntu-noble | +### These rules watch for code injection by the ptrace facility. 2026-07-20 06:49:08.212798 | ubuntu-noble | +### This could indicate someone trying to do something bad or just debugging 2026-07-20 06:49:08.212879 | ubuntu-noble | +-a always,exit -F arch=b64 -S ptrace -F a0=0x4 -k code_injection 2026-07-20 06:49:08.213012 | ubuntu-noble | +-a always,exit -F arch=b64 -S ptrace -F a0=0x5 -k data_injection 2026-07-20 06:49:08.213702 | ubuntu-noble | +-a always,exit -F arch=b64 -S ptrace -F a0=0x6 -k register_injection 2026-07-20 06:49:08.213725 | ubuntu-noble | +-a always,exit -F arch=b64 -S ptrace -k tracing 2026-07-20 06:49:08.213733 | ubuntu-noble | + 2026-07-20 06:49:08.213745 | ubuntu-noble | +## Anonymous File Creation 2026-07-20 06:49:08.213752 | ubuntu-noble | +### These rules watch the use of memfd_create 2026-07-20 06:49:08.213759 | ubuntu-noble | +### "memfd_create" creates anonymous file and returns a file descriptor to access it 2026-07-20 06:49:08.213766 | ubuntu-noble | +### When combined with "fexecve" can be used to stealthily run binaries in memory without touching disk 2026-07-20 06:49:08.213887 | ubuntu-noble | +-a always,exit -F arch=b64 -S memfd_create -F key=anon_file_create 2026-07-20 06:49:08.213895 | ubuntu-noble | + 2026-07-20 06:49:08.213987 | ubuntu-noble | +## Privilege Abuse 2026-07-20 06:49:08.214098 | ubuntu-noble | +### The purpose of this rule is to detect when an admin may be abusing power by looking in user's home dir. 2026-07-20 06:49:08.214761 | ubuntu-noble | +-a always,exit -F dir=/home -F uid=0 -F auid>=1000 -F auid!=-1 -C auid!=obj_uid -k power_abuse 2026-07-20 06:49:08.214777 | ubuntu-noble | + 2026-07-20 06:49:08.214781 | ubuntu-noble | +# Socket Creations 2026-07-20 06:49:08.214785 | ubuntu-noble | +# will catch both IPv4 and IPv6 2026-07-20 06:49:08.214789 | ubuntu-noble | + 2026-07-20 06:49:08.214795 | ubuntu-noble | +-a always,exit -F arch=b32 -S socket -F a0=2 -k network_socket_created 2026-07-20 06:49:08.215045 | ubuntu-noble | +-a always,exit -F arch=b64 -S socket -F a0=2 -k network_socket_created 2026-07-20 06:49:08.215172 | ubuntu-noble | + 2026-07-20 06:49:08.215295 | ubuntu-noble | +-a always,exit -F arch=b32 -S socket -F a0=10 -k network_socket_created 2026-07-20 06:49:08.215405 | ubuntu-noble | +-a always,exit -F arch=b64 -S socket -F a0=10 -k network_socket_created 2026-07-20 06:49:08.215500 | ubuntu-noble | + 2026-07-20 06:49:08.215604 | ubuntu-noble | +# Software Management --------------------------------------------------------- 2026-07-20 06:49:08.215696 | ubuntu-noble | + 2026-07-20 06:49:08.215799 | ubuntu-noble | +# RPM (Redhat/CentOS) 2026-07-20 06:49:08.215899 | ubuntu-noble | +-w /usr/bin/rpm -p x -k software_mgmt 2026-07-20 06:49:08.216000 | ubuntu-noble | +-w /usr/bin/yum -p x -k software_mgmt 2026-07-20 06:49:08.216101 | ubuntu-noble | + 2026-07-20 06:49:08.216204 | ubuntu-noble | +# DNF (Fedora/RedHat 8/CentOS 8) 2026-07-20 06:49:08.217249 | ubuntu-noble | +-w /usr/bin/dnf -p x -k software_mgmt 2026-07-20 06:49:08.217266 | ubuntu-noble | + 2026-07-20 06:49:08.217292 | ubuntu-noble | +# YAST/Zypper/RPM (SuSE) 2026-07-20 06:49:08.217297 | ubuntu-noble | +-w /sbin/yast -p x -k software_mgmt 2026-07-20 06:49:08.217301 | ubuntu-noble | +-w /sbin/yast2 -p x -k software_mgmt 2026-07-20 06:49:08.217304 | ubuntu-noble | +-w /bin/rpm -p x -k software_mgmt 2026-07-20 06:49:08.217308 | ubuntu-noble | +-w /usr/bin/zypper -k software_mgmt 2026-07-20 06:49:08.217311 | ubuntu-noble | + 2026-07-20 06:49:08.217315 | ubuntu-noble | +# DPKG / APT-GET (Debian/Ubuntu) 2026-07-20 06:49:08.217318 | ubuntu-noble | +-w /usr/bin/dpkg -p x -k software_mgmt 2026-07-20 06:49:08.217324 | ubuntu-noble | +-w /usr/bin/apt -p x -k software_mgmt 2026-07-20 06:49:08.217443 | ubuntu-noble | +-w /usr/bin/apt-add-repository -p x -k software_mgmt 2026-07-20 06:49:08.217522 | ubuntu-noble | +-w /usr/bin/apt-get -p x -k software_mgmt 2026-07-20 06:49:08.217623 | ubuntu-noble | +-w /usr/bin/aptitude -p x -k software_mgmt 2026-07-20 06:49:08.217724 | ubuntu-noble | +-w /usr/bin/wajig -p x -k software_mgmt 2026-07-20 06:49:08.217825 | ubuntu-noble | +-w /usr/bin/snap -p x -k software_mgmt 2026-07-20 06:49:08.217919 | ubuntu-noble | + 2026-07-20 06:49:08.218022 | ubuntu-noble | +# PIP(3) (Python installs) 2026-07-20 06:49:08.218141 | ubuntu-noble | +-w /usr/bin/pip -p x -k third_party_software_mgmt 2026-07-20 06:49:08.218235 | ubuntu-noble | +-w /usr/local/bin/pip -p x -k third_party_software_mgmt 2026-07-20 06:49:08.218439 | ubuntu-noble | +-w /usr/bin/pip3 -p x -k third_party_software_mgmt 2026-07-20 06:49:08.218468 | ubuntu-noble | +-w /usr/local/bin/pip3 -p x -k third_party_software_mgmt 2026-07-20 06:49:08.218574 | ubuntu-noble | +-w /usr/bin/pipx -p x -k third_party_software_mgmt 2026-07-20 06:49:08.218673 | ubuntu-noble | +-w /usr/local/bin/pipx -p x -k third_party_software_mgmt 2026-07-20 06:49:08.218769 | ubuntu-noble | + 2026-07-20 06:49:08.218866 | ubuntu-noble | +# npm 2026-07-20 06:49:08.218968 | ubuntu-noble | +## T1072 third party software 2026-07-20 06:49:08.220059 | ubuntu-noble | +## https://www.npmjs.com 2026-07-20 06:49:08.220089 | ubuntu-noble | +## https://docs.npmjs.com/cli/v6/commands/npm-audit 2026-07-20 06:49:08.220094 | ubuntu-noble | +-w /usr/bin/npm -p x -k third_party_software_mgmt 2026-07-20 06:49:08.220098 | ubuntu-noble | + 2026-07-20 06:49:08.220101 | ubuntu-noble | +# Comprehensive Perl Archive Network (CPAN) (CPAN installs) 2026-07-20 06:49:08.220105 | ubuntu-noble | +## T1072 third party software 2026-07-20 06:49:08.220108 | ubuntu-noble | +## https://www.cpan.org 2026-07-20 06:49:08.220111 | ubuntu-noble | +-w /usr/bin/cpan -p x -k third_party_software_mgmt 2026-07-20 06:49:08.220115 | ubuntu-noble | + 2026-07-20 06:49:08.220118 | ubuntu-noble | +# Ruby (RubyGems installs) 2026-07-20 06:49:08.220124 | ubuntu-noble | +## T1072 third party software 2026-07-20 06:49:08.220195 | ubuntu-noble | +## https://rubygems.org 2026-07-20 06:49:08.220433 | ubuntu-noble | +-w /usr/bin/gem -p x -k third_party_software_mgmt 2026-07-20 06:49:08.220443 | ubuntu-noble | + 2026-07-20 06:49:08.220507 | ubuntu-noble | +# LuaRocks (Lua installs) 2026-07-20 06:49:08.220622 | ubuntu-noble | +## T1072 third party software 2026-07-20 06:49:08.221292 | ubuntu-noble | +## https://luarocks.org 2026-07-20 06:49:08.221306 | ubuntu-noble | +-w /usr/bin/luarocks -p x -k third_party_software_mgmt 2026-07-20 06:49:08.221310 | ubuntu-noble | + 2026-07-20 06:49:08.221313 | ubuntu-noble | +# Pacman (Arch Linux) 2026-07-20 06:49:08.221317 | ubuntu-noble | +## https://wiki.archlinux.org/title/Pacman 2026-07-20 06:49:08.221322 | ubuntu-noble | +## T1072 third party software 2026-07-20 06:49:08.221414 | ubuntu-noble | +-w /etc/pacman.conf -p x -k third_party_software_mgmt 2026-07-20 06:49:08.221519 | ubuntu-noble | +-w /etc/pacman.d -p x -k third_party_software_mgmt 2026-07-20 06:49:08.221619 | ubuntu-noble | + 2026-07-20 06:49:08.221716 | ubuntu-noble | +# Special Software ------------------------------------------------------------ 2026-07-20 06:49:08.221811 | ubuntu-noble | + 2026-07-20 06:49:08.221909 | ubuntu-noble | +## GDS specific secrets 2026-07-20 06:49:08.222009 | ubuntu-noble | +-w /etc/puppet/ssl -p wa -k puppet_ssl 2026-07-20 06:49:08.222113 | ubuntu-noble | + 2026-07-20 06:49:08.222211 | ubuntu-noble | +## IBM Bigfix BESClient 2026-07-20 06:49:08.222332 | ubuntu-noble | +-a always,exit -F arch=b64 -S open -F dir=/opt/BESClient -F success=0 -k soft_besclient 2026-07-20 06:49:08.222436 | ubuntu-noble | +-w /var/opt/BESClient/ -p wa -k soft_besclient 2026-07-20 06:49:08.222530 | ubuntu-noble | + 2026-07-20 06:49:08.222629 | ubuntu-noble | +## CHEF https://www.chef.io/chef/ 2026-07-20 06:49:08.222731 | ubuntu-noble | +-w /etc/chef -p wa -k soft_chef 2026-07-20 06:49:08.222825 | ubuntu-noble | + 2026-07-20 06:49:08.222923 | ubuntu-noble | +## Salt 2026-07-20 06:49:08.223026 | ubuntu-noble | +## https://saltproject.io/ 2026-07-20 06:49:08.223139 | ubuntu-noble | +## https://docs.saltproject.io/en/latest/ref/configuration/master.html 2026-07-20 06:49:08.223237 | ubuntu-noble | +-w /etc/salt -p wa -k soft_salt 2026-07-20 06:49:08.223360 | ubuntu-noble | +-w /usr/local/etc/salt -p wa -k soft_salt 2026-07-20 06:49:08.223454 | ubuntu-noble | + 2026-07-20 06:49:08.223549 | ubuntu-noble | +## Otter 2026-07-20 06:49:08.225305 | ubuntu-noble | +## https://inedo.com/otter 2026-07-20 06:49:08.225329 | ubuntu-noble | +-w /etc/otter -p wa -k soft_otter 2026-07-20 06:49:08.225335 | ubuntu-noble | + 2026-07-20 06:49:08.225341 | ubuntu-noble | +## T1081 Credentials In Files 2026-07-20 06:49:08.225347 | ubuntu-noble | +-w /usr/bin/grep -p x -k string_search 2026-07-20 06:49:08.225353 | ubuntu-noble | +-w /usr/bin/egrep -p x -k string_search 2026-07-20 06:49:08.225359 | ubuntu-noble | +-w /usr/bin/ugrep -p x -k string_search 2026-07-20 06:49:08.225365 | ubuntu-noble | +### macOS 2026-07-20 06:49:08.225371 | ubuntu-noble | +-w /usr/local/bin/grep -p x -k string_search 2026-07-20 06:49:08.225377 | ubuntu-noble | +-w /usr/local/bin/egrep -p x -k string_search 2026-07-20 06:49:08.225382 | ubuntu-noble | +-w /usr/local/bin/ugrep -p x -k string_search 2026-07-20 06:49:08.225388 | ubuntu-noble | + 2026-07-20 06:49:08.225394 | ubuntu-noble | +### https://github.com/tmbinc/bgrep 2026-07-20 06:49:08.225400 | ubuntu-noble | +-w /usr/bin/bgrep -p x -k string_search 2026-07-20 06:49:08.225406 | ubuntu-noble | +### macOS 2026-07-20 06:49:08.225411 | ubuntu-noble | +-w /usr/local/bin/bgrep -p x -k string_search 2026-07-20 06:49:08.225416 | ubuntu-noble | + 2026-07-20 06:49:08.225426 | ubuntu-noble | +### https://github.com/BurntSushi/ripgrep 2026-07-20 06:49:08.225431 | ubuntu-noble | +-w /usr/bin/rg -p x -k string_search 2026-07-20 06:49:08.225525 | ubuntu-noble | +### macOS 2026-07-20 06:49:08.225626 | ubuntu-noble | +-w /usr/local/bin/rg -p x -k string_search 2026-07-20 06:49:08.225722 | ubuntu-noble | + 2026-07-20 06:49:08.225822 | ubuntu-noble | +### https://github.com/awgn/cgrep 2026-07-20 06:49:08.225917 | ubuntu-noble | + 2026-07-20 06:49:08.226018 | ubuntu-noble | +-w /usr/bin/cgrep -p x -k string_search 2026-07-20 06:49:08.226133 | ubuntu-noble | +### macOS 2026-07-20 06:49:08.226237 | ubuntu-noble | +-w /usr/local/bin/cgrep -p x -k string_search 2026-07-20 06:49:08.226358 | ubuntu-noble | + 2026-07-20 06:49:08.226459 | ubuntu-noble | +### https://github.com/jpr5/ngrep 2026-07-20 06:49:08.226562 | ubuntu-noble | +-w /usr/bin/ngrep -p x -k string_search 2026-07-20 06:49:08.226660 | ubuntu-noble | +### macOS 2026-07-20 06:49:08.226763 | ubuntu-noble | +-w /usr/local/bin/ngrep -p x -k string_search 2026-07-20 06:49:08.226855 | ubuntu-noble | + 2026-07-20 06:49:08.226957 | ubuntu-noble | +### https://github.com/vrothberg/vgrep 2026-07-20 06:49:08.227059 | ubuntu-noble | +-w /usr/bin/vgrep -p x -k string_search 2026-07-20 06:49:08.227166 | ubuntu-noble | +### macOS 2026-07-20 06:49:08.227285 | ubuntu-noble | +-w /usr/local/bin/vgrep -p x -k string_search 2026-07-20 06:49:08.227388 | ubuntu-noble | + 2026-07-20 06:49:08.227494 | ubuntu-noble | +### https://github.com/monochromegane/the_platinum_searcher 2026-07-20 06:49:08.227607 | ubuntu-noble | +-w /usr/bin/pt -p x -k string_search 2026-07-20 06:49:08.227696 | ubuntu-noble | +### macOS 2026-07-20 06:49:08.227798 | ubuntu-noble | +-w /usr/local/bin/pt -p x -k string_search 2026-07-20 06:49:08.227894 | ubuntu-noble | + 2026-07-20 06:49:08.227997 | ubuntu-noble | +### https://github.com/gvansickle/ucg 2026-07-20 06:49:08.228111 | ubuntu-noble | +-w /usr/bin/ucg -p x -k string_search 2026-07-20 06:49:08.228204 | ubuntu-noble | +### macOS 2026-07-20 06:49:08.228326 | ubuntu-noble | +-w /usr/local/bin/ucg -p x -k string_search 2026-07-20 06:49:08.228421 | ubuntu-noble | + 2026-07-20 06:49:08.228524 | ubuntu-noble | +### https://github.com/ggreer/the_silver_searcher 2026-07-20 06:49:08.228626 | ubuntu-noble | +-w /usr/bin/ag -p x -k string_search 2026-07-20 06:49:08.228726 | ubuntu-noble | +### macOS 2026-07-20 06:49:08.228830 | ubuntu-noble | +-w /usr/local/bin/ag -p x -k string_search 2026-07-20 06:49:08.228925 | ubuntu-noble | + 2026-07-20 06:49:08.229026 | ubuntu-noble | +### https://github.com/beyondgrep/ack3 2026-07-20 06:49:08.229137 | ubuntu-noble | +### https://beyondgrep.com 2026-07-20 06:49:08.229236 | ubuntu-noble | +-w /usr/bin/ack -p x -k string_search 2026-07-20 06:49:08.229347 | ubuntu-noble | +-w /usr/local/bin/ack -p x -k string_search 2026-07-20 06:49:08.229450 | ubuntu-noble | +-w /usr/bin/semgrep -p x -k string_search 2026-07-20 06:49:08.229546 | ubuntu-noble | +### macOS 2026-07-20 06:49:08.229647 | ubuntu-noble | +-w /usr/local/bin/semgrep -p x -k string_search 2026-07-20 06:49:08.229757 | ubuntu-noble | + 2026-07-20 06:49:08.229839 | ubuntu-noble | +## Docker 2026-07-20 06:49:08.229936 | ubuntu-noble | +-w /usr/bin/dockerd -k docker 2026-07-20 06:49:08.230034 | ubuntu-noble | +-w /usr/bin/docker -k docker 2026-07-20 06:49:08.230158 | ubuntu-noble | +-w /usr/bin/docker-containerd -k docker 2026-07-20 06:49:08.230259 | ubuntu-noble | +-w /usr/bin/docker-runc -k docker 2026-07-20 06:49:08.230378 | ubuntu-noble | +-w /var/lib/docker -p wa -k docker 2026-07-20 06:49:08.230476 | ubuntu-noble | +-w /etc/docker -k docker 2026-07-20 06:49:08.230574 | ubuntu-noble | +-w /etc/sysconfig/docker -k docker 2026-07-20 06:49:08.230674 | ubuntu-noble | +-w /etc/sysconfig/docker-storage -k docker 2026-07-20 06:49:08.230776 | ubuntu-noble | +-w /usr/lib/systemd/system/docker.service -k docker 2026-07-20 06:49:08.230878 | ubuntu-noble | +-w /usr/lib/systemd/system/docker.socket -k docker 2026-07-20 06:49:08.230971 | ubuntu-noble | + 2026-07-20 06:49:08.231082 | ubuntu-noble | +## Virtualization stuff 2026-07-20 06:49:08.231181 | ubuntu-noble | +-w /usr/bin/qemu-system-x86_64 -p x -k qemu-system-x86_64 2026-07-20 06:49:08.231292 | ubuntu-noble | +-w /usr/bin/qemu-img -p x -k qemu-img 2026-07-20 06:49:08.231392 | ubuntu-noble | +-w /usr/bin/qemu-kvm -p x -k qemu-kvm 2026-07-20 06:49:08.231493 | ubuntu-noble | +-w /usr/bin/qemu -p x -k qemu 2026-07-20 06:49:08.231592 | ubuntu-noble | +-w /usr/bin/virtualbox -p x -k virtualbox 2026-07-20 06:49:08.231693 | ubuntu-noble | +-w /usr/bin/virt-manager -p x -k virt-manager 2026-07-20 06:49:08.231791 | ubuntu-noble | +-w /usr/bin/VBoxManage -p x -k VBoxManage 2026-07-20 06:49:08.231889 | ubuntu-noble | + 2026-07-20 06:49:08.231982 | ubuntu-noble | +#### VirtualBox on macOS 2026-07-20 06:49:08.232108 | ubuntu-noble | + 2026-07-20 06:49:08.232199 | ubuntu-noble | +-w /usr/local/bin/VirtualBox -p x -k virt_tool 2026-07-20 06:49:08.232311 | ubuntu-noble | +-w /usr/local/bin/VirtualBoxVM -p x -k virt_tool 2026-07-20 06:49:08.232413 | ubuntu-noble | +-w /usr/local/bin/VBoxManage -p x -k virt_tool 2026-07-20 06:49:08.232515 | ubuntu-noble | +-w /usr/local/bin/VBoxVRDP -p x -k virt_tool 2026-07-20 06:49:08.232620 | ubuntu-noble | +-w /usr/local/bin/VBoxHeadless -p x -k virt_tool 2026-07-20 06:49:08.232733 | ubuntu-noble | +-w /usr/local/bin/vboxwebsrv -p x -k virt_tool 2026-07-20 06:49:08.232836 | ubuntu-noble | +-w /usr/local/bin/VBoxBugReport -p x -k virt_tool 2026-07-20 06:49:08.232938 | ubuntu-noble | +-w /usr/local/bin/VBoxBalloonCtrl -p x -k virt_tool 2026-07-20 06:49:08.233039 | ubuntu-noble | +-w /usr/local/bin/VBoxAutostart -p x -k virt_tool 2026-07-20 06:49:08.233146 | ubuntu-noble | +-w /usr/local/bin/VBoxDTrace -p x -k virt_tool 2026-07-20 06:49:08.233247 | ubuntu-noble | +-w /usr/local/bin/vbox-img -p x -k virt_tool 2026-07-20 06:49:08.233424 | ubuntu-noble | +-w /Library/LaunchDaemons/org.virtualbox.startup.plist -p x -k virt_tool 2026-07-20 06:49:08.233531 | ubuntu-noble | +-w /Library/Application Support/VirtualBox/LaunchDaemons/ -p x -k virt_tool 2026-07-20 06:49:08.233636 | ubuntu-noble | +-w /Library/Application Support/VirtualBox/VBoxDrv.kext/ -p x -k virt_tool 2026-07-20 06:49:08.233740 | ubuntu-noble | +-w /Library/Application Support/VirtualBox/VBoxUSB.kext/ -p x -k virt_tool 2026-07-20 06:49:08.233842 | ubuntu-noble | +-w /Library/Application Support/VirtualBox/VBoxNetFlt.kext/ -p x -k virt_tool 2026-07-20 06:49:08.233947 | ubuntu-noble | +-w /Library/Application Support/VirtualBox/VBoxNetAdp.kext/ -p x -k virt_tool 2026-07-20 06:49:08.234052 | ubuntu-noble | + 2026-07-20 06:49:08.234156 | ubuntu-noble | +### Parallels Desktop on macOS 2026-07-20 06:49:08.234249 | ubuntu-noble | + 2026-07-20 06:49:08.234366 | ubuntu-noble | +-w /usr/local/bin/prl_convert -p x -k virt_tool 2026-07-20 06:49:08.234462 | ubuntu-noble | +-w /usr/local/bin/prl_disk_tool -p x -k virt_tool 2026-07-20 06:49:08.234562 | ubuntu-noble | +-w /usr/local/bin/prl_perf_ctl -p x -k virt_tool 2026-07-20 06:49:08.234666 | ubuntu-noble | +-w /usr/local/bin/prlcore2dmp -p x -k virt_tool 2026-07-20 06:49:08.234766 | ubuntu-noble | +-w /usr/local/bin/prlctl -p x -k virt_tool 2026-07-20 06:49:08.234868 | ubuntu-noble | +-w /usr/local/bin/prlexec -p x -k virt_tool 2026-07-20 06:49:08.234969 | ubuntu-noble | +-w /usr/local/bin/prlsrvctl -p x -k virt_tool 2026-07-20 06:49:08.235083 | ubuntu-noble | +-w /Library/Preferences/Parallels -p x -k virt_tool 2026-07-20 06:49:08.235189 | ubuntu-noble | + 2026-07-20 06:49:08.235299 | ubuntu-noble | +### qemu on macOS 2026-07-20 06:49:08.235394 | ubuntu-noble | + 2026-07-20 06:49:08.235493 | ubuntu-noble | +-w /usr/local/bin/qemu-edid -p x -k virt_tool 2026-07-20 06:49:08.235598 | ubuntu-noble | +-w /usr/local/bin/qemu-img -p x -k virt_tool 2026-07-20 06:49:08.235699 | ubuntu-noble | +-w /usr/local/bin/qemu-io -p x -k virt_tool 2026-07-20 06:49:08.235802 | ubuntu-noble | +-w /usr/local/bin/qemu-nbd -p x -k virt_tool 2026-07-20 06:49:08.235905 | ubuntu-noble | +-w /usr/local/bin/qemu-system-x86_64 -p x -k virt_tool 2026-07-20 06:49:08.235998 | ubuntu-noble | + 2026-07-20 06:49:08.236105 | ubuntu-noble | +## Kubelet 2026-07-20 06:49:08.236206 | ubuntu-noble | +-w /usr/bin/kubelet -k kubelet 2026-07-20 06:49:08.236311 | ubuntu-noble | + 2026-07-20 06:49:08.236411 | ubuntu-noble | +# ipc system call 2026-07-20 06:49:08.236509 | ubuntu-noble | +# /usr/include/linux/ipc.h 2026-07-20 06:49:08.236604 | ubuntu-noble | + 2026-07-20 06:49:08.236703 | ubuntu-noble | +## msgctl 2026-07-20 06:49:08.236810 | ubuntu-noble | +#-a always,exit -S ipc -F a0=14 -k Inter-Process_Communication 2026-07-20 06:49:08.236906 | ubuntu-noble | +## msgget 2026-07-20 06:49:08.237011 | ubuntu-noble | +#-a always,exit -S ipc -F a0=13 -k Inter-Process_Communication 2026-07-20 06:49:08.237133 | ubuntu-noble | +## Use these lines on x86_64, ia64 instead 2026-07-20 06:49:08.237240 | ubuntu-noble | +-a always,exit -F arch=b64 -S msgctl -k Inter-Process_Communication 2026-07-20 06:49:08.237364 | ubuntu-noble | +-a always,exit -F arch=b64 -S msgget -k Inter-Process_Communication 2026-07-20 06:49:08.237460 | ubuntu-noble | + 2026-07-20 06:49:08.237557 | ubuntu-noble | +## semctl 2026-07-20 06:49:08.237662 | ubuntu-noble | +#-a always,exit -S ipc -F a0=3 -k Inter-Process_Communication 2026-07-20 06:49:08.237760 | ubuntu-noble | +## semget 2026-07-20 06:49:08.237865 | ubuntu-noble | +#-a always,exit -S ipc -F a0=2 -k Inter-Process_Communication 2026-07-20 06:49:08.237963 | ubuntu-noble | +## semop 2026-07-20 06:49:08.238067 | ubuntu-noble | +#-a always,exit -S ipc -F a0=1 -k Inter-Process_Communication 2026-07-20 06:49:08.238175 | ubuntu-noble | +## semtimedop 2026-07-20 06:49:08.238289 | ubuntu-noble | +#-a always,exit -S ipc -F a0=4 -k Inter-Process_Communication 2026-07-20 06:49:08.238392 | ubuntu-noble | +## Use these lines on x86_64, ia64 instead 2026-07-20 06:49:08.238497 | ubuntu-noble | +-a always,exit -F arch=b64 -S semctl -k Inter-Process_Communication 2026-07-20 06:49:08.238604 | ubuntu-noble | +-a always,exit -F arch=b64 -S semget -k Inter-Process_Communication 2026-07-20 06:49:08.238710 | ubuntu-noble | +-a always,exit -F arch=b64 -S semop -k Inter-Process_Communication 2026-07-20 06:49:08.238814 | ubuntu-noble | +-a always,exit -F arch=b64 -S semtimedop -k Inter-Process_Communication 2026-07-20 06:49:08.238908 | ubuntu-noble | + 2026-07-20 06:49:08.239449 | ubuntu-noble | +## shmctl 2026-07-20 06:49:08.239462 | ubuntu-noble | +#-a always,exit -S ipc -F a0=24 -k Inter-Process_Communication 2026-07-20 06:49:08.239472 | ubuntu-noble | +## shmget 2026-07-20 06:49:08.239476 | ubuntu-noble | +#-a always,exit -S ipc -F a0=23 -k Inter-Process_Communication 2026-07-20 06:49:08.239479 | ubuntu-noble | +## Use these lines on x86_64, ia64 instead 2026-07-20 06:49:08.239515 | ubuntu-noble | +-a always,exit -F arch=b64 -S shmctl -k Inter-Process_Communication 2026-07-20 06:49:08.239620 | ubuntu-noble | +-a always,exit -F arch=b64 -S shmget -k Inter-Process_Communication 2026-07-20 06:49:08.239714 | ubuntu-noble | + 2026-07-20 06:49:08.239815 | ubuntu-noble | +# High Volume Events ---------------------------------------------------------- 2026-07-20 06:49:08.239908 | ubuntu-noble | + 2026-07-20 06:49:08.240012 | ubuntu-noble | +## Disable these rules if they create too many events in your environment 2026-07-20 06:49:08.240114 | ubuntu-noble | + 2026-07-20 06:49:08.240212 | ubuntu-noble | +## Common Shells 2026-07-20 06:49:08.240322 | ubuntu-noble | +-w /bin/bash -p x -k susp_shell 2026-07-20 06:49:08.240424 | ubuntu-noble | +-w /bin/dash -p x -k susp_shell 2026-07-20 06:49:08.240528 | ubuntu-noble | +-w /bin/busybox -p x -k susp_shell 2026-07-20 06:49:08.240628 | ubuntu-noble | +-w /bin/zsh -p x -k susp_shell 2026-07-20 06:49:08.240726 | ubuntu-noble | +-w /bin/sh -p x -k susp_shell 2026-07-20 06:49:08.240825 | ubuntu-noble | +-w /bin/ksh -p x -k susp_shell 2026-07-20 06:49:08.240919 | ubuntu-noble | + 2026-07-20 06:49:08.241018 | ubuntu-noble | +## Root command executions 2026-07-20 06:49:08.241142 | ubuntu-noble | +-a always,exit -F arch=b64 -F euid=0 -F auid>=1000 -F auid!=-1 -S execve -k rootcmd 2026-07-20 06:49:08.241238 | ubuntu-noble | + 2026-07-20 06:49:08.241350 | ubuntu-noble | +## File Deletion Events by User 2026-07-20 06:49:08.241456 | ubuntu-noble | +-a always,exit -F arch=b64 -S rmdir -S unlink -S unlinkat -S rename -S renameat -F auid>=1000 -F auid!=-1 -k delete 2026-07-20 06:49:08.241548 | ubuntu-noble | + 2026-07-20 06:49:08.241654 | ubuntu-noble | +## File Access 2026-07-20 06:49:08.241757 | ubuntu-noble | +### Unauthorized Access (unsuccessful) 2026-07-20 06:49:08.241870 | ubuntu-noble | +-a always,exit -F arch=b64 -S creat -S open -S openat -S open_by_handle_at -S truncate -S ftruncate -F exit=-EACCES -F auid>=1000 -F auid!=-1 -k file_access 2026-07-20 06:49:08.241974 | ubuntu-noble | +-a always,exit -F arch=b64 -S creat -S open -S openat -S open_by_handle_at -S truncate -S ftruncate -F exit=-EPERM -F auid>=1000 -F auid!=-1 -k file_access 2026-07-20 06:49:08.242067 | ubuntu-noble | + 2026-07-20 06:49:08.242181 | ubuntu-noble | +### Unsuccessful Creation 2026-07-20 06:49:08.242301 | ubuntu-noble | +-a always,exit -F arch=b64 -S mkdir,creat,link,symlink,mknod,mknodat,linkat,symlinkat -F exit=-EACCES -k file_creation 2026-07-20 06:49:08.242409 | ubuntu-noble | +-a always,exit -F arch=b64 -S mkdir,link,symlink,mkdirat -F exit=-EPERM -k file_creation 2026-07-20 06:49:08.242508 | ubuntu-noble | + 2026-07-20 06:49:08.242600 | ubuntu-noble | +### Unsuccessful Modification 2026-07-20 06:49:08.242708 | ubuntu-noble | +-a always,exit -F arch=b64 -S rename -S renameat -S truncate -S chmod -S setxattr -S lsetxattr -S removexattr -S lremovexattr -F exit=-EACCES -k file_modification 2026-07-20 06:49:08.242814 | ubuntu-noble | +-a always,exit -F arch=b64 -S rename -S renameat -S truncate -S chmod -S setxattr -S lsetxattr -S removexattr -S lremovexattr -F exit=-EPERM -k file_modification 2026-07-20 06:49:08.242908 | ubuntu-noble | + 2026-07-20 06:49:08.243008 | ubuntu-noble | +## 32bit API Exploitation 2026-07-20 06:49:08.244295 | ubuntu-noble | +### If you are on a 64 bit platform, everything _should_ be running 2026-07-20 06:49:08.244312 | ubuntu-noble | +### in 64 bit mode. This rule will detect any use of the 32 bit syscalls 2026-07-20 06:49:08.244316 | ubuntu-noble | +### because this might be a sign of someone exploiting a hole in the 32 2026-07-20 06:49:08.244319 | ubuntu-noble | +### bit API. 2026-07-20 06:49:08.244323 | ubuntu-noble | +-a always,exit -F arch=b32 -S all -k 32bit_api 2026-07-20 06:49:08.244327 | ubuntu-noble | + 2026-07-20 06:49:08.244330 | ubuntu-noble | +# Make The Configuration Immutable -------------------------------------------- 2026-07-20 06:49:08.244333 | ubuntu-noble | + 2026-07-20 06:49:08.244337 | ubuntu-noble | +##-e 2 2026-07-20 06:49:08.244341 | ubuntu-noble | 2026-07-20 06:49:08.244348 | ubuntu-noble | changed: [molecule-auditd] => (item=20-neo23x0.rules) => {"ansible_loop_var": "item", "changed": true, "checksum": "9f99ce5c4f891fbf3e2bce06ed4cb97fb9e01f41", "dest": "/etc/audit/rules.d/20-neo23x0.rules", "gid": 0, "group": "root", "item": "20-neo23x0.rules", "md5sum": "6ac57206fd77de34805c3f4d50ef8b1d", "mode": "0644", "owner": "root", "size": 27367, "src": "/home/zuul/.ansible/tmp/ansible-tmp-1784530147.08111-2507-72282171837425/.source.rules", "state": "file", "uid": 0} 2026-07-20 06:49:08.244362 | ubuntu-noble | 2026-07-20 06:49:08.244399 | ubuntu-noble | TASK [auditd : Manage auditd service] ****************************************** 2026-07-20 06:49:09.136665 | ubuntu-noble | ok: [molecule-auditd] => {"changed": false, "enabled": true, "name": "auditd", "state": "started", "status": {"ActiveEnterTimestamp": "Mon 2026-07-20 06:49:00 UTC", "ActiveEnterTimestampMonotonic": "162770196", "ActiveExitTimestampMonotonic": "0", "ActiveState": "active", "After": "local-fs.target systemd-journald.socket systemd-tmpfiles-setup.service system.slice", "AllowIsolate": "no", "AssertResult": "yes", "AssertTimestamp": "Mon 2026-07-20 06:48:59 UTC", "AssertTimestampMonotonic": "162720875", "Before": "shutdown.target ssh.service systemd-update-utmp.service sysinit.target", "BlockIOAccounting": "no", "BlockIOWeight": "[not set]", "CPUAccounting": "yes", "CPUAffinityFromNUMA": "no", "CPUQuotaPerSecUSec": "infinity", "CPUQuotaPeriodUSec": "infinity", "CPUSchedulingPolicy": "0", "CPUSchedulingPriority": "0", "CPUSchedulingResetOnFork": "no", "CPUShares": "[not set]", "CPUUsageNSec": "36569000", "CPUWeight": "[not set]", "CacheDirectoryMode": "0755", "CanFreeze": "yes", "CanIsolate": "no", "CanReload": "no", "CanStart": "yes", "CanStop": "yes", "CapabilityBoundingSet": "cap_chown cap_dac_override cap_dac_read_search cap_fowner cap_fsetid cap_kill cap_setgid cap_setuid cap_setpcap cap_linux_immutable cap_net_bind_service cap_net_broadcast cap_net_admin cap_net_raw cap_ipc_lock cap_ipc_owner cap_sys_rawio cap_sys_chroot cap_sys_ptrace cap_sys_pacct cap_sys_admin cap_sys_boot cap_sys_nice cap_sys_resource cap_sys_time cap_sys_tty_config cap_mknod cap_lease cap_audit_write cap_audit_control cap_setfcap cap_mac_override cap_mac_admin cap_syslog cap_wake_alarm cap_block_suspend cap_audit_read cap_perfmon cap_bpf cap_checkpoint_restore", "CleanResult": "success", "CollectMode": "inactive", "ConditionResult": "yes", "ConditionTimestamp": "Mon 2026-07-20 06:48:59 UTC", "ConditionTimestampMonotonic": "162720806", "ConfigurationDirectoryMode": "0755", "Conflicts": "shutdown.target", "ControlGroup": "/system.slice/auditd.service", "ControlGroupId": "3826", "ControlPID": "0", "CoredumpFilter": "0x33", "CoredumpReceive": "no", "DefaultDependencies": "no", "DefaultMemoryLow": "0", "DefaultMemoryMin": "0", "DefaultStartupMemoryLow": "0", "Delegate": "no", "Description": "Security Auditing Service", "DevicePolicy": "auto", "Documentation": "\"man:auditd(8)\" https://github.com/linux-audit/audit-documentation", "DynamicUser": "no", "ExecMainCode": "0", "ExecMainExitTimestampMonotonic": "0", "ExecMainPID": "2276", "ExecMainStartTimestamp": "Mon 2026-07-20 06:48:59 UTC", "ExecMainStartTimestampMonotonic": "162736281", "ExecMainStatus": "0", "ExecStart": "{ path=/sbin/auditd ; argv[]=/sbin/auditd ; ignore_errors=no ; start_time=[Mon 2026-07-20 06:48:59 UTC] ; stop_time=[Mon 2026-07-20 06:48:59 UTC] ; pid=2275 ; code=exited ; status=0 }", "ExecStartEx": "{ path=/sbin/auditd ; argv[]=/sbin/auditd ; flags= ; start_time=[Mon 2026-07-20 06:48:59 UTC] ; stop_time=[Mon 2026-07-20 06:48:59 UTC] ; pid=2275 ; code=exited ; status=0 }", "ExecStartPost": "{ path=/sbin/augenrules ; argv[]=/sbin/augenrules --load ; ignore_errors=yes ; start_time=[Mon 2026-07-20 06:48:59 UTC] ; stop_time=[Mon 2026-07-20 06:49:00 UTC] ; pid=2279 ; code=exited ; status=0 }", "ExecStartPostEx": "{ path=/sbin/augenrules ; argv[]=/sbin/augenrules --load ; flags=ignore-failure ; start_time=[Mon 2026-07-20 06:48:59 UTC] ; stop_time=[Mon 2026-07-20 06:49:00 UTC] ; pid=2279 ; code=exited ; status=0 }", "ExitType": "main", "ExtensionImagePolicy": "root=verity+signed+encrypted+unprotected+absent:usr=verity+signed+encrypted+unprotected+absent:home=encrypted+unprotected+absent:srv=encrypted+unprotected+absent:tmp=encrypted+unprotected+absent:var=encrypted+unprotected+absent", "FailureAction": "none", "FileDescriptorStoreMax": "0", "FileDescriptorStorePreserve": "restart", "FinalKillSignal": "9", "FragmentPath": "/usr/lib/systemd/system/auditd.service", "FreezerState": "running", "GID": "[not set]", "GuessMainPID": "yes", "IOAccounting": "no", "IOReadBytes": "[not set]", "IOReadOperations": "[not set]", "IOSchedulingClass": "2", "IOSchedulingPriority": "4", "IOWeight": "[not set]", "IOWriteBytes": "[not set]", "IOWriteOperations": "[not set]", "IPAccounting": "no", "IPEgressBytes": "[no data]", "IPEgressPackets": "[no data]", "IPIngressBytes": "[no data]", "IPIngressPackets": "[no data]", "Id": "auditd.service", "IgnoreOnIsolate": "no", "IgnoreSIGPIPE": "yes", "InactiveEnterTimestampMonotonic": "0", "InactiveExitTimestamp": "Mon 2026-07-20 06:48:59 UTC", "InactiveExitTimestampMonotonic": "162727385", "InvocationID": "92146d2f0dc44c2481448911f79a01cc", "JobRunningTimeoutUSec": "infinity", "JobTimeoutAction": "none", "JobTimeoutUSec": "infinity", "KeyringMode": "private", "KillMode": "control-group", "KillSignal": "15", "LimitAS": "infinity", "LimitASSoft": "infinity", "LimitCORE": "infinity", "LimitCORESoft": "0", "LimitCPU": "infinity", "LimitCPUSoft": "infinity", "LimitDATA": "infinity", "LimitDATASoft": "infinity", "LimitFSIZE": "infinity", "LimitFSIZESoft": "infinity", "LimitLOCKS": "infinity", "LimitLOCKSSoft": "infinity", "LimitMEMLOCK": "8388608", "LimitMEMLOCKSoft": "8388608", "LimitMSGQUEUE": "819200", "LimitMSGQUEUESoft": "819200", "LimitNICE": "0", "LimitNICESoft": "0", "LimitNOFILE": "524288", "LimitNOFILESoft": "1024", "LimitNPROC": "15372", "LimitNPROCSoft": "15372", "LimitRSS": "infinity", "LimitRSSSoft": "infinity", "LimitRTPRIO": "0", "LimitRTPRIOSoft": "0", "LimitRTTIME": "infinity", "LimitRTTIMESoft": "infinity", "LimitSIGPENDING": "15372", "LimitSIGPENDINGSoft": "15372", "LimitSTACK": "infinity", "LimitSTACKSoft": "8388608", "LoadState": "loaded", "LockPersonality": "yes", "LogLevelMax": "-1", "LogRateLimitBurst": "0", "LogRateLimitIntervalUSec": "0", "LogsDirectoryMode": "0755", "MainPID": "2276", "ManagedOOMMemoryPressure": "auto", "ManagedOOMMemoryPressureLimit": "0", "ManagedOOMPreference": "none", "ManagedOOMSwap": "auto", "MemoryAccounting": "yes", "MemoryAvailable": "3536691200", "MemoryCurrent": "507904", "MemoryDenyWriteExecute": "yes", "MemoryHigh": "infinity", "MemoryKSM": "no", "MemoryLimit": "infinity", "MemoryLow": "0", "MemoryMax": "infinity", "MemoryMin": "0", "MemoryPeak": "2351104", "MemoryPressureThresholdUSec": "200ms", "MemoryPressureWatch": "auto", "MemorySwapCurrent": "0", "MemorySwapMax": "infinity", "MemorySwapPeak": "0", "MemoryZSwapCurrent": "0", "MemoryZSwapMax": "infinity", "MountAPIVFS": "no", "MountImagePolicy": "root=verity+signed+encrypted+unprotected+absent:usr=verity+signed+encrypted+unprotected+absent:home=encrypted+unprotected+absent:srv=encrypted+unprotected+absent:tmp=encrypted+unprotected+absent:var=encrypted+unprotected+absent", "NFileDescriptorStore": "0", "NRestarts": "0", "NUMAPolicy": "n/a", "Names": "auditd.service", "NeedDaemonReload": "no", "Nice": "0", "NoNewPrivileges": "no", "NonBlocking": "no", "NotifyAccess": "none", "OOMPolicy": "stop", "OOMScoreAdjust": "0", "OnFailureJobMode": "replace", "OnSuccessJobMode": "fail", "PIDFile": "/run/auditd.pid", "Perpetual": "no", "PrivateDevices": "no", "PrivateIPC": "no", "PrivateMounts": "no", "PrivateNetwork": "no", "PrivateTmp": "no", "PrivateUsers": "no", "ProcSubset": "all", "ProtectClock": "no", "ProtectControlGroups": "no", "ProtectHome": "no", "ProtectHostname": "no", "ProtectKernelLogs": "no", "ProtectKernelModules": "yes", "ProtectKernelTunables": "no", "ProtectProc": "default", "ProtectSystem": "no", "RefuseManualStart": "no", "RefuseManualStop": "no", "ReloadResult": "success", "ReloadSignal": "1", "RemainAfterExit": "no", "RemoveIPC": "no", "Requires": "system.slice", "Restart": "on-failure", "RestartKillSignal": "15", "RestartMaxDelayUSec": "infinity", "RestartMode": "normal", "RestartPreventExitStatus": "2 4 6", "RestartSteps": "0", "RestartUSec": "100ms", "RestartUSecNext": "100ms", "RestrictNamespaces": "no", "RestrictRealtime": "yes", "RestrictSUIDSGID": "no", "Result": "success", "RootDirectoryStartOnly": "no", "RootEphemeral": "no", "RootImagePolicy": "root=verity+signed+encrypted+unprotected+absent:usr=verity+signed+encrypted+unprotected+absent:home=encrypted+unprotected+absent:srv=encrypted+unprotected+absent:tmp=encrypted+unprotected+absent:var=encrypted+unprotected+absent", "RuntimeDirectoryMode": "0755", "RuntimeDirectoryPreserve": "no", "RuntimeMaxUSec": "infinity", "RuntimeRandomizedExtraUSec": "0", "SameProcessGroup": "no", "SecureBits": "0", "SendSIGHUP": "no", "SendSIGKILL": "yes", "SetLoginEnvironment": "no", "Slice": "system.slice", "StandardError": "inherit", "StandardInput": "null", "StandardOutput": "journal", "StartLimitAction": "none", "StartLimitBurst": "5", "StartLimitIntervalUSec": "10s", "StartupBlockIOWeight": "[not set]", "StartupCPUShares": "[not set]", "StartupCPUWeight": "[not set]", "StartupIOWeight": "[not set]", "StartupMemoryHigh": "infinity", "StartupMemoryLow": "0", "StartupMemoryMax": "infinity", "StartupMemorySwapMax": "infinity", "StartupMemoryZSwapMax": "infinity", "StateChangeTimestamp": "Mon 2026-07-20 06:49:00 UTC", "StateChangeTimestampMonotonic": "162770196", "StateDirectoryMode": "0755", "StatusErrno": "0", "StopWhenUnneeded": "no", "SubState": "running", "SuccessAction": "none", "SurviveFinalKillSignal": "no", "SyslogFacility": "3", "SyslogLevel": "6", "SyslogLevelPrefix": "yes", "SyslogPriority": "30", "SystemCallErrorNumber": "2147483646", "TTYReset": "no", "TTYVHangup": "no", "TTYVTDisallocate": "no", "TasksAccounting": "yes", "TasksCurrent": "2", "TasksMax": "4611", "TimeoutAbortUSec": "1min 30s", "TimeoutCleanUSec": "infinity", "TimeoutStartFailureMode": "terminate", "TimeoutStartUSec": "1min 30s", "TimeoutStopFailureMode": "terminate", "TimeoutStopUSec": "1min 30s", "TimerSlackNSec": "50000", "Transient": "no", "Type": "forking", "UID": "[not set]", "UMask": "0022", "UnitFilePreset": "enabled", "UnitFileState": "enabled", "UtmpMode": "init", "WantedBy": "multi-user.target", "WatchdogSignal": "6", "WatchdogTimestampMonotonic": "0", "WatchdogUSec": "0"}} 2026-07-20 06:49:09.143436 | ubuntu-noble | 2026-07-20 06:49:09.143547 | ubuntu-noble | TASK [auditd : List existing rules files] ************************************** 2026-07-20 06:49:09.701569 | ubuntu-noble | ok: [molecule-auditd] => {"changed": false, "cmd": ["find", "/etc/audit/rules.d", "-type", "f", "-printf", "%f\n"], "delta": "0:00:00.006300", "end": "2026-07-20 06:49:09.658524", "msg": "", "rc": 0, "start": "2026-07-20 06:49:09.652224", "stderr": "", "stderr_lines": [], "stdout": "audit.rules\n20-neo23x0.rules", "stdout_lines": ["audit.rules", "20-neo23x0.rules"]} 2026-07-20 06:49:09.701707 | ubuntu-noble | 2026-07-20 06:49:09.701888 | ubuntu-noble | TASK [auditd : Remove unmanaged rules files] *********************************** 2026-07-20 06:49:10.135931 | ubuntu-noble | --- before 2026-07-20 06:49:10.136110 | ubuntu-noble | +++ after 2026-07-20 06:49:10.136291 | ubuntu-noble | @@ -1,4 +1,4 @@ 2026-07-20 06:49:10.136484 | ubuntu-noble | { 2026-07-20 06:49:10.136680 | ubuntu-noble | "path": "/etc/audit/rules.d/audit.rules", 2026-07-20 06:49:10.136861 | ubuntu-noble | - "state": "file" 2026-07-20 06:49:10.137306 | ubuntu-noble | + "state": "absent" 2026-07-20 06:49:10.137319 | ubuntu-noble | } 2026-07-20 06:49:10.137699 | ubuntu-noble | 2026-07-20 06:49:10.137708 | ubuntu-noble | changed: [molecule-auditd] => (item=audit.rules) => {"ansible_loop_var": "item", "changed": true, "item": "audit.rules", "path": "/etc/audit/rules.d/audit.rules", "state": "absent"} 2026-07-20 06:49:10.137923 | ubuntu-noble | skipping: [molecule-auditd] => (item=20-neo23x0.rules) => {"ansible_loop_var": "item", "changed": false, "false_condition": "item not in auditd_rules_files", "item": "20-neo23x0.rules", "skip_reason": "Conditional result was False"} 2026-07-20 06:49:10.138148 | ubuntu-noble | 2026-07-20 06:49:10.138396 | ubuntu-noble | RUNNING HANDLER [auditd : Restart auditd service] ****************************** 2026-07-20 06:49:10.940022 | ubuntu-noble | changed: [molecule-auditd] => {"changed": true, "name": "auditd", "state": "started", "status": {"ActiveEnterTimestamp": "Mon 2026-07-20 06:49:00 UTC", "ActiveEnterTimestampMonotonic": "162770196", "ActiveExitTimestampMonotonic": "0", "ActiveState": "active", "After": "local-fs.target systemd-journald.socket systemd-tmpfiles-setup.service system.slice", "AllowIsolate": "no", "AssertResult": "yes", "AssertTimestamp": "Mon 2026-07-20 06:48:59 UTC", "AssertTimestampMonotonic": "162720875", "Before": "shutdown.target ssh.service systemd-update-utmp.service sysinit.target", "BlockIOAccounting": "no", "BlockIOWeight": "[not set]", "CPUAccounting": "yes", "CPUAffinityFromNUMA": "no", "CPUQuotaPerSecUSec": "infinity", "CPUQuotaPeriodUSec": "infinity", "CPUSchedulingPolicy": "0", "CPUSchedulingPriority": "0", "CPUSchedulingResetOnFork": "no", "CPUShares": "[not set]", "CPUUsageNSec": "37656000", "CPUWeight": "[not set]", "CacheDirectoryMode": "0755", "CanFreeze": "yes", "CanIsolate": "no", "CanReload": "no", "CanStart": "yes", "CanStop": "yes", "CapabilityBoundingSet": "cap_chown cap_dac_override cap_dac_read_search cap_fowner cap_fsetid cap_kill cap_setgid cap_setuid cap_setpcap cap_linux_immutable cap_net_bind_service cap_net_broadcast cap_net_admin cap_net_raw cap_ipc_lock cap_ipc_owner cap_sys_rawio cap_sys_chroot cap_sys_ptrace cap_sys_pacct cap_sys_admin cap_sys_boot cap_sys_nice cap_sys_resource cap_sys_time cap_sys_tty_config cap_mknod cap_lease cap_audit_write cap_audit_control cap_setfcap cap_mac_override cap_mac_admin cap_syslog cap_wake_alarm cap_block_suspend cap_audit_read cap_perfmon cap_bpf cap_checkpoint_restore", "CleanResult": "success", "CollectMode": "inactive", "ConditionResult": "yes", "ConditionTimestamp": "Mon 2026-07-20 06:48:59 UTC", "ConditionTimestampMonotonic": "162720806", "ConfigurationDirectoryMode": "0755", "Conflicts": "shutdown.target", "ControlGroup": "/system.slice/auditd.service", "ControlGroupId": "3826", "ControlPID": "0", "CoredumpFilter": "0x33", "CoredumpReceive": "no", "DefaultDependencies": "no", "DefaultMemoryLow": "0", "DefaultMemoryMin": "0", "DefaultStartupMemoryLow": "0", "Delegate": "no", "Description": "Security Auditing Service", "DevicePolicy": "auto", "Documentation": "\"man:auditd(8)\" https://github.com/linux-audit/audit-documentation", "DynamicUser": "no", "ExecMainCode": "0", "ExecMainExitTimestampMonotonic": "0", "ExecMainPID": "2276", "ExecMainStartTimestamp": "Mon 2026-07-20 06:48:59 UTC", "ExecMainStartTimestampMonotonic": "162736281", "ExecMainStatus": "0", "ExecStart": "{ path=/sbin/auditd ; argv[]=/sbin/auditd ; ignore_errors=no ; start_time=[Mon 2026-07-20 06:48:59 UTC] ; stop_time=[Mon 2026-07-20 06:48:59 UTC] ; pid=2275 ; code=exited ; status=0 }", "ExecStartEx": "{ path=/sbin/auditd ; argv[]=/sbin/auditd ; flags= ; start_time=[Mon 2026-07-20 06:48:59 UTC] ; stop_time=[Mon 2026-07-20 06:48:59 UTC] ; pid=2275 ; code=exited ; status=0 }", "ExecStartPost": "{ path=/sbin/augenrules ; argv[]=/sbin/augenrules --load ; ignore_errors=yes ; start_time=[Mon 2026-07-20 06:48:59 UTC] ; stop_time=[Mon 2026-07-20 06:49:00 UTC] ; pid=2279 ; code=exited ; status=0 }", "ExecStartPostEx": "{ path=/sbin/augenrules ; argv[]=/sbin/augenrules --load ; flags=ignore-failure ; start_time=[Mon 2026-07-20 06:48:59 UTC] ; stop_time=[Mon 2026-07-20 06:49:00 UTC] ; pid=2279 ; code=exited ; status=0 }", "ExitType": "main", "ExtensionImagePolicy": "root=verity+signed+encrypted+unprotected+absent:usr=verity+signed+encrypted+unprotected+absent:home=encrypted+unprotected+absent:srv=encrypted+unprotected+absent:tmp=encrypted+unprotected+absent:var=encrypted+unprotected+absent", "FailureAction": "none", "FileDescriptorStoreMax": "0", "FileDescriptorStorePreserve": "restart", "FinalKillSignal": "9", "FragmentPath": "/usr/lib/systemd/system/auditd.service", "FreezerState": "running", "GID": "[not set]", "GuessMainPID": "yes", "IOAccounting": "no", "IOReadBytes": "[not set]", "IOReadOperations": "[not set]", "IOSchedulingClass": "2", "IOSchedulingPriority": "4", "IOWeight": "[not set]", "IOWriteBytes": "[not set]", "IOWriteOperations": "[not set]", "IPAccounting": "no", "IPEgressBytes": "[no data]", "IPEgressPackets": "[no data]", "IPIngressBytes": "[no data]", "IPIngressPackets": "[no data]", "Id": "auditd.service", "IgnoreOnIsolate": "no", "IgnoreSIGPIPE": "yes", "InactiveEnterTimestampMonotonic": "0", "InactiveExitTimestamp": "Mon 2026-07-20 06:48:59 UTC", "InactiveExitTimestampMonotonic": "162727385", "InvocationID": "92146d2f0dc44c2481448911f79a01cc", "JobRunningTimeoutUSec": "infinity", "JobTimeoutAction": "none", "JobTimeoutUSec": "infinity", "KeyringMode": "private", "KillMode": "control-group", "KillSignal": "15", "LimitAS": "infinity", "LimitASSoft": "infinity", "LimitCORE": "infinity", "LimitCORESoft": "0", "LimitCPU": "infinity", "LimitCPUSoft": "infinity", "LimitDATA": "infinity", "LimitDATASoft": "infinity", "LimitFSIZE": "infinity", "LimitFSIZESoft": "infinity", "LimitLOCKS": "infinity", "LimitLOCKSSoft": "infinity", "LimitMEMLOCK": "8388608", "LimitMEMLOCKSoft": "8388608", "LimitMSGQUEUE": "819200", "LimitMSGQUEUESoft": "819200", "LimitNICE": "0", "LimitNICESoft": "0", "LimitNOFILE": "524288", "LimitNOFILESoft": "1024", "LimitNPROC": "15372", "LimitNPROCSoft": "15372", "LimitRSS": "infinity", "LimitRSSSoft": "infinity", "LimitRTPRIO": "0", "LimitRTPRIOSoft": "0", "LimitRTTIME": "infinity", "LimitRTTIMESoft": "infinity", "LimitSIGPENDING": "15372", "LimitSIGPENDINGSoft": "15372", "LimitSTACK": "infinity", "LimitSTACKSoft": "8388608", "LoadState": "loaded", "LockPersonality": "yes", "LogLevelMax": "-1", "LogRateLimitBurst": "0", "LogRateLimitIntervalUSec": "0", "LogsDirectoryMode": "0755", "MainPID": "2276", "ManagedOOMMemoryPressure": "auto", "ManagedOOMMemoryPressureLimit": "0", "ManagedOOMPreference": "none", "ManagedOOMSwap": "auto", "MemoryAccounting": "yes", "MemoryAvailable": "3542839296", "MemoryCurrent": "516096", "MemoryDenyWriteExecute": "yes", "MemoryHigh": "infinity", "MemoryKSM": "no", "MemoryLimit": "infinity", "MemoryLow": "0", "MemoryMax": "infinity", "MemoryMin": "0", "MemoryPeak": "2351104", "MemoryPressureThresholdUSec": "200ms", "MemoryPressureWatch": "auto", "MemorySwapCurrent": "0", "MemorySwapMax": "infinity", "MemorySwapPeak": "0", "MemoryZSwapCurrent": "0", "MemoryZSwapMax": "infinity", "MountAPIVFS": "no", "MountImagePolicy": "root=verity+signed+encrypted+unprotected+absent:usr=verity+signed+encrypted+unprotected+absent:home=encrypted+unprotected+absent:srv=encrypted+unprotected+absent:tmp=encrypted+unprotected+absent:var=encrypted+unprotected+absent", "NFileDescriptorStore": "0", "NRestarts": "0", "NUMAPolicy": "n/a", "Names": "auditd.service", "NeedDaemonReload": "no", "Nice": "0", "NoNewPrivileges": "no", "NonBlocking": "no", "NotifyAccess": "none", "OOMPolicy": "stop", "OOMScoreAdjust": "0", "OnFailureJobMode": "replace", "OnSuccessJobMode": "fail", "PIDFile": "/run/auditd.pid", "Perpetual": "no", "PrivateDevices": "no", "PrivateIPC": "no", "PrivateMounts": "no", "PrivateNetwork": "no", "PrivateTmp": "no", "PrivateUsers": "no", "ProcSubset": "all", "ProtectClock": "no", "ProtectControlGroups": "no", "ProtectHome": "no", "ProtectHostname": "no", "ProtectKernelLogs": "no", "ProtectKernelModules": "yes", "ProtectKernelTunables": "no", "ProtectProc": "default", "ProtectSystem": "no", "RefuseManualStart": "no", "RefuseManualStop": "no", "ReloadResult": "success", "ReloadSignal": "1", "RemainAfterExit": "no", "RemoveIPC": "no", "Requires": "system.slice", "Restart": "on-failure", "RestartKillSignal": "15", "RestartMaxDelayUSec": "infinity", "RestartMode": "normal", "RestartPreventExitStatus": "2 4 6", "RestartSteps": "0", "RestartUSec": "100ms", "RestartUSecNext": "100ms", "RestrictNamespaces": "no", "RestrictRealtime": "yes", "RestrictSUIDSGID": "no", "Result": "success", "RootDirectoryStartOnly": "no", "RootEphemeral": "no", "RootImagePolicy": "root=verity+signed+encrypted+unprotected+absent:usr=verity+signed+encrypted+unprotected+absent:home=encrypted+unprotected+absent:srv=encrypted+unprotected+absent:tmp=encrypted+unprotected+absent:var=encrypted+unprotected+absent", "RuntimeDirectoryMode": "0755", "RuntimeDirectoryPreserve": "no", "RuntimeMaxUSec": "infinity", "RuntimeRandomizedExtraUSec": "0", "SameProcessGroup": "no", "SecureBits": "0", "SendSIGHUP": "no", "SendSIGKILL": "yes", "SetLoginEnvironment": "no", "Slice": "system.slice", "StandardError": "inherit", "StandardInput": "null", "StandardOutput": "journal", "StartLimitAction": "none", "StartLimitBurst": "5", "StartLimitIntervalUSec": "10s", "StartupBlockIOWeight": "[not set]", "StartupCPUShares": "[not set]", "StartupCPUWeight": "[not set]", "StartupIOWeight": "[not set]", "StartupMemoryHigh": "infinity", "StartupMemoryLow": "0", "StartupMemoryMax": "infinity", "StartupMemorySwapMax": "infinity", "StartupMemoryZSwapMax": "infinity", "StateChangeTimestamp": "Mon 2026-07-20 06:49:00 UTC", "StateChangeTimestampMonotonic": "162770196", "StateDirectoryMode": "0755", "StatusErrno": "0", "StopWhenUnneeded": "no", "SubState": "running", "SuccessAction": "none", "SurviveFinalKillSignal": "no", "SyslogFacility": "3", "SyslogLevel": "6", "SyslogLevelPrefix": "yes", "SyslogPriority": "30", "SystemCallErrorNumber": "2147483646", "TTYReset": "no", "TTYVHangup": "no", "TTYVTDisallocate": "no", "TasksAccounting": "yes", "TasksCurrent": "2", "TasksMax": "4611", "TimeoutAbortUSec": "1min 30s", "TimeoutCleanUSec": "infinity", "TimeoutStartFailureMode": "terminate", "TimeoutStartUSec": "1min 30s", "TimeoutStopFailureMode": "terminate", "TimeoutStopUSec": "1min 30s", "TimerSlackNSec": "50000", "Transient": "no", "Type": "forking", "UID": "[not set]", "UMask": "0022", "UnitFilePreset": "enabled", "UnitFileState": "enabled", "UtmpMode": "init", "WantedBy": "multi-user.target", "WatchdogSignal": "6", "WatchdogTimestampMonotonic": "0", "WatchdogUSec": "0"}} 2026-07-20 06:49:10.943895 | ubuntu-noble | 2026-07-20 06:49:10.944054 | ubuntu-noble | RUNNING HANDLER [auditd : Generate auditd rules] ******************************* 2026-07-20 06:49:11.403887 | ubuntu-noble | changed: [molecule-auditd] => {"changed": true, "cmd": ["augenrules", "--load"], "delta": "0:00:00.050440", "end": "2026-07-20 06:49:11.356379", "msg": "", "rc": 0, "start": "2026-07-20 06:49:11.305939", "stderr": "Unknown user: chrony\nThere was an error in line 24 of /etc/audit/audit.rules\nError sending add rule data request (No such file or directory)\nThere was an error in line 28 of /etc/audit/audit.rules\nUnknown user: ntp\nThere was an error in line 44 of /etc/audit/audit.rules\nError sending add rule data request (No such file or directory)\nThere was an error in line 83 of /etc/audit/audit.rules\nError sending add rule data request (No such file or directory)\nThere was an error in line 84 of /etc/audit/audit.rules\nError sending add rule data request (No such file or directory)\nThere was an error in line 86 of /etc/audit/audit.rules\nError sending add rule data request (No such file or directory)\nThere was an error in line 112 of /etc/audit/audit.rules\nError sending add rule data request (No such file or directory)\nThere was an error in line 115 of /etc/audit/audit.rules\nError sending add rule data request (No such file or directory)\nThere was an error in line 176 of /etc/audit/audit.rules\nError sending add rule data request (No such file or directory)\nThere was an error in line 177 of /etc/audit/audit.rules\nError sending add rule data request (No such file or directory)\nThere was an error in line 178 of /etc/audit/audit.rules\nError sending add rule data request (No such file or directory)\nThere was an error in line 179 of /etc/audit/audit.rules\nError sending add rule data request (No such file or directory)\nThere was an error in line 180 of /etc/audit/audit.rules\nError sending add rule data request (No such file or directory)\nThere was an error in line 217 of /etc/audit/audit.rules\nError sending add rule data request (No such file or directory)\nThere was an error in line 218 of /etc/audit/audit.rules\nError sending add rule data request (No such file or directory)\nThere was an error in line 234 of /etc/audit/audit.rules\nError sending add rule data request (No such file or directory)\nThere was an error in line 285 of /etc/audit/audit.rules\nError sending add rule data request (No such file or directory)\nThere was an error in line 286 of /etc/audit/audit.rules\nError sending add rule data request (No such file or directory)\nThere was an error in line 324 of /etc/audit/audit.rules\nError sending add rule data request (No such file or directory)\nThere was an error in line 325 of /etc/audit/audit.rules\nError sending add rule data request (No such file or directory)\nThere was an error in line 346 of /etc/audit/audit.rules\nparameter passed without an option given\nThere was an error in line 347 of /etc/audit/audit.rules\nparameter passed without an option given\nThere was an error in line 348 of /etc/audit/audit.rules\nparameter passed without an option given\nThere was an error in line 349 of /etc/audit/audit.rules\nparameter passed without an option given\nThere was an error in line 350 of /etc/audit/audit.rules\nparameter passed without an option given\nThere was an error in line 351 of /etc/audit/audit.rules\nError sending add rule data request (No such file or directory)\nThere was an error in line 359 of /etc/audit/audit.rules", "stderr_lines": ["Unknown user: chrony", "There was an error in line 24 of /etc/audit/audit.rules", "Error sending add rule data request (No such file or directory)", "There was an error in line 28 of /etc/audit/audit.rules", "Unknown user: ntp", "There was an error in line 44 of /etc/audit/audit.rules", "Error sending add rule data request (No such file or directory)", "There was an error in line 83 of /etc/audit/audit.rules", "Error sending add rule data request (No such file or directory)", "There was an error in line 84 of /etc/audit/audit.rules", "Error sending add rule data request (No such file or directory)", "There was an error in line 86 of /etc/audit/audit.rules", "Error sending add rule data request (No such file or directory)", "There was an error in line 112 of /etc/audit/audit.rules", "Error sending add rule data request (No such file or directory)", "There was an error in line 115 of /etc/audit/audit.rules", "Error sending add rule data request (No such file or directory)", "There was an error in line 176 of /etc/audit/audit.rules", "Error sending add rule data request (No such file or directory)", "There was an error in line 177 of /etc/audit/audit.rules", "Error sending add rule data request (No such file or directory)", "There was an error in line 178 of /etc/audit/audit.rules", "Error sending add rule data request (No such file or directory)", "There was an error in line 179 of /etc/audit/audit.rules", "Error sending add rule data request (No such file or directory)", "There was an error in line 180 of /etc/audit/audit.rules", "Error sending add rule data request (No such file or directory)", "There was an error in line 217 of /etc/audit/audit.rules", "Error sending add rule data request (No such file or directory)", "There was an error in line 218 of /etc/audit/audit.rules", "Error sending add rule data request (No such file or directory)", "There was an error in line 234 of /etc/audit/audit.rules", "Error sending add rule data request (No such file or directory)", "There was an error in line 285 of /etc/audit/audit.rules", "Error sending add rule data request (No such file or directory)", "There was an error in line 286 of /etc/audit/audit.rules", "Error sending add rule data request (No such file or directory)", "There was an error in line 324 of /etc/audit/audit.rules", "Error sending add rule data request (No such file or directory)", "There was an error in line 325 of /etc/audit/audit.rules", "Error sending add rule data request (No such file or directory)", "There was an error in line 346 of /etc/audit/audit.rules", "parameter passed without an option given", "There was an error in line 347 of /etc/audit/audit.rules", "parameter passed without an option given", "There was an error in line 348 of /etc/audit/audit.rules", "parameter passed without an option given", "There was an error in line 349 of /etc/audit/audit.rules", "parameter passed without an option given", "There was an error in line 350 of /etc/audit/audit.rules", "parameter passed without an option given", "There was an error in line 351 of /etc/audit/audit.rules", "Error sending add rule data request (No such file or directory)", "There was an error in line 359 of /etc/audit/audit.rules"], "stdout": "/usr/sbin/augenrules: No change\nNo rules\nenabled 1\nfailure 1\npid 2670\nrate_limit 0\nbacklog_limit 8192\nlost 0\nbacklog 1249\nbacklog_wait_time 60000\nbacklog_wait_time_actual 0\nenabled 1\nfailure 1\npid 2670\nrate_limit 0\nbacklog_limit 8192\nlost 0\nbacklog 1241\nbacklog_wait_time 60000\nbacklog_wait_time_actual 0", "stdout_lines": ["/usr/sbin/augenrules: No change", "No rules", "enabled 1", "failure 1", "pid 2670", "rate_limit 0", "backlog_limit 8192", "lost 0", "backlog 1249", "backlog_wait_time 60000", "backlog_wait_time_actual 0", "enabled 1", "failure 1", "pid 2670", "rate_limit 0", "backlog_limit 8192", "lost 0", "backlog 1241", "backlog_wait_time 60000", "backlog_wait_time_actual 0"]} 2026-07-20 06:49:11.403931 | ubuntu-noble | 2026-07-20 06:49:11.403937 | ubuntu-noble | RUNNING HANDLER [auditd : Restart auditd service] ****************************** 2026-07-20 06:49:12.396622 | ubuntu-noble | ok: Runtime: 0:00:23.325799 2026-07-20 06:49:12.427267 | 2026-07-20 06:49:12.427693 | TASK [ansible-molecule : Run molecule verify action with scenario delegated] 2026-07-20 06:49:12.181998 | ubuntu-noble | changed: [molecule-auditd] => {"changed": true, "name": "auditd", "state": "started", "status": {"ActiveEnterTimestamp": "Mon 2026-07-20 06:49:10 UTC", "ActiveEnterTimestampMonotonic": "173609525", "ActiveExitTimestamp": "Mon 2026-07-20 06:49:10 UTC", "ActiveExitTimestampMonotonic": "173451154", "ActiveState": "active", "After": "local-fs.target systemd-journald.socket systemd-tmpfiles-setup.service system.slice", "AllowIsolate": "no", "AssertResult": "yes", "AssertTimestamp": "Mon 2026-07-20 06:49:10 UTC", "AssertTimestampMonotonic": "173492551", "Before": "shutdown.target ssh.service systemd-update-utmp.service sysinit.target", "BlockIOAccounting": "no", "BlockIOWeight": "[not set]", "CPUAccounting": "yes", "CPUAffinityFromNUMA": "no", "CPUQuotaPerSecUSec": "infinity", "CPUQuotaPeriodUSec": "infinity", "CPUSchedulingPolicy": "0", "CPUSchedulingPriority": "0", "CPUSchedulingResetOnFork": "no", "CPUShares": "[not set]", "CPUUsageNSec": "158246000", "CPUWeight": "[not set]", "CacheDirectoryMode": "0755", "CanFreeze": "yes", "CanIsolate": "no", "CanReload": "no", "CanStart": "yes", "CanStop": "yes", "CapabilityBoundingSet": "cap_chown cap_dac_override cap_dac_read_search cap_fowner cap_fsetid cap_kill cap_setgid cap_setuid cap_setpcap cap_linux_immutable cap_net_bind_service cap_net_broadcast cap_net_admin cap_net_raw cap_ipc_lock cap_ipc_owner cap_sys_rawio cap_sys_chroot cap_sys_ptrace cap_sys_pacct cap_sys_admin cap_sys_boot cap_sys_nice cap_sys_resource cap_sys_time cap_sys_tty_config cap_mknod cap_lease cap_audit_write cap_audit_control cap_setfcap cap_mac_override cap_mac_admin cap_syslog cap_wake_alarm cap_block_suspend cap_audit_read cap_perfmon cap_bpf cap_checkpoint_restore", "CleanResult": "success", "CollectMode": "inactive", "ConditionResult": "yes", "ConditionTimestamp": "Mon 2026-07-20 06:49:10 UTC", "ConditionTimestampMonotonic": "173492433", "ConfigurationDirectoryMode": "0755", "Conflicts": "shutdown.target", "ControlGroup": "/system.slice/auditd.service", "ControlGroupId": "3868", "ControlPID": "0", "CoredumpFilter": "0x33", "CoredumpReceive": "no", "DefaultDependencies": "no", "DefaultMemoryLow": "0", "DefaultMemoryMin": "0", "DefaultStartupMemoryLow": "0", "Delegate": "no", "Description": "Security Auditing Service", "DevicePolicy": "auto", "Documentation": "\"man:auditd(8)\" https://github.com/linux-audit/audit-documentation", "DynamicUser": "no", "ExecMainCode": "0", "ExecMainExitTimestampMonotonic": "0", "ExecMainPID": "2670", "ExecMainStartTimestamp": "Mon 2026-07-20 06:49:10 UTC", "ExecMainStartTimestampMonotonic": "173521508", "ExecMainStatus": "0", "ExecStart": "{ path=/sbin/auditd ; argv[]=/sbin/auditd ; ignore_errors=no ; start_time=[Mon 2026-07-20 06:49:10 UTC] ; stop_time=[Mon 2026-07-20 06:49:10 UTC] ; pid=2669 ; code=exited ; status=0 }", "ExecStartEx": "{ path=/sbin/auditd ; argv[]=/sbin/auditd ; flags= ; start_time=[Mon 2026-07-20 06:49:10 UTC] ; stop_time=[Mon 2026-07-20 06:49:10 UTC] ; pid=2669 ; code=exited ; status=0 }", "ExecStartPost": "{ path=/sbin/augenrules ; argv[]=/sbin/augenrules --load ; ignore_errors=yes ; start_time=[Mon 2026-07-20 06:49:10 UTC] ; stop_time=[Mon 2026-07-20 06:49:10 UTC] ; pid=2673 ; code=exited ; status=0 }", "ExecStartPostEx": "{ path=/sbin/augenrules ; argv[]=/sbin/augenrules --load ; flags=ignore-failure ; start_time=[Mon 2026-07-20 06:49:10 UTC] ; stop_time=[Mon 2026-07-20 06:49:10 UTC] ; pid=2673 ; code=exited ; status=0 }", "ExitType": "main", "ExtensionImagePolicy": "root=verity+signed+encrypted+unprotected+absent:usr=verity+signed+encrypted+unprotected+absent:home=encrypted+unprotected+absent:srv=encrypted+unprotected+absent:tmp=encrypted+unprotected+absent:var=encrypted+unprotected+absent", "FailureAction": "none", "FileDescriptorStoreMax": "0", "FileDescriptorStorePreserve": "restart", "FinalKillSignal": "9", "FragmentPath": "/usr/lib/systemd/system/auditd.service", "FreezerState": "running", "GID": "[not set]", "GuessMainPID": "yes", "IOAccounting": "no", "IOReadBytes": "[not set]", "IOReadOperations": "[not set]", "IOSchedulingClass": "2", "IOSchedulingPriority": "4", "IOWeight": "[not set]", "IOWriteBytes": "[not set]", "IOWriteOperations": "[not set]", "IPAccounting": "no", "IPEgressBytes": "[no data]", "IPEgressPackets": "[no data]", "IPIngressBytes": "[no data]", "IPIngressPackets": "[no data]", "Id": "auditd.service", "IgnoreOnIsolate": "no", "IgnoreSIGPIPE": "yes", "InactiveEnterTimestamp": "Mon 2026-07-20 06:49:10 UTC", "InactiveEnterTimestampMonotonic": "173490493", "InactiveExitTimestamp": "Mon 2026-07-20 06:49:10 UTC", "InactiveExitTimestampMonotonic": "173500537", "InvocationID": "8c136d3293e545c2855e50cb4aec9e4e", "JobRunningTimeoutUSec": "infinity", "JobTimeoutAction": "none", "JobTimeoutUSec": "infinity", "KeyringMode": "private", "KillMode": "control-group", "KillSignal": "15", "LimitAS": "infinity", "LimitASSoft": "infinity", "LimitCORE": "infinity", "LimitCORESoft": "0", "LimitCPU": "infinity", "LimitCPUSoft": "infinity", "LimitDATA": "infinity", "LimitDATASoft": "infinity", "LimitFSIZE": "infinity", "LimitFSIZESoft": "infinity", "LimitLOCKS": "infinity", "LimitLOCKSSoft": "infinity", "LimitMEMLOCK": "8388608", "LimitMEMLOCKSoft": "8388608", "LimitMSGQUEUE": "819200", "LimitMSGQUEUESoft": "819200", "LimitNICE": "0", "LimitNICESoft": "0", "LimitNOFILE": "524288", "LimitNOFILESoft": "1024", "LimitNPROC": "15372", "LimitNPROCSoft": "15372", "LimitRSS": "infinity", "LimitRSSSoft": "infinity", "LimitRTPRIO": "0", "LimitRTPRIOSoft": "0", "LimitRTTIME": "infinity", "LimitRTTIMESoft": "infinity", "LimitSIGPENDING": "15372", "LimitSIGPENDINGSoft": "15372", "LimitSTACK": "infinity", "LimitSTACKSoft": "8388608", "LoadState": "loaded", "LockPersonality": "yes", "LogLevelMax": "-1", "LogRateLimitBurst": "0", "LogRateLimitIntervalUSec": "0", "LogsDirectoryMode": "0755", "MainPID": "2670", "ManagedOOMMemoryPressure": "auto", "ManagedOOMMemoryPressureLimit": "0", "ManagedOOMPreference": "none", "ManagedOOMSwap": "auto", "MemoryAccounting": "yes", "MemoryAvailable": "3555835904", "MemoryCurrent": "1855488", "MemoryDenyWriteExecute": "yes", "MemoryHigh": "infinity", "MemoryKSM": "no", "MemoryLimit": "infinity", "MemoryLow": "0", "MemoryMax": "infinity", "MemoryMin": "0", "MemoryPeak": "2334720", "MemoryPressureThresholdUSec": "200ms", "MemoryPressureWatch": "auto", "MemorySwapCurrent": "0", "MemorySwapMax": "infinity", "MemorySwapPeak": "0", "MemoryZSwapCurrent": "0", "MemoryZSwapMax": "infinity", "MountAPIVFS": "no", "MountImagePolicy": "root=verity+signed+encrypted+unprotected+absent:usr=verity+signed+encrypted+unprotected+absent:home=encrypted+unprotected+absent:srv=encrypted+unprotected+absent:tmp=encrypted+unprotected+absent:var=encrypted+unprotected+absent", "NFileDescriptorStore": "0", "NRestarts": "0", "NUMAPolicy": "n/a", "Names": "auditd.service", "NeedDaemonReload": "no", "Nice": "0", "NoNewPrivileges": "no", "NonBlocking": "no", "NotifyAccess": "none", "OOMPolicy": "stop", "OOMScoreAdjust": "0", "OnFailureJobMode": "replace", "OnSuccessJobMode": "fail", "PIDFile": "/run/auditd.pid", "Perpetual": "no", "PrivateDevices": "no", "PrivateIPC": "no", "PrivateMounts": "no", "PrivateNetwork": "no", "PrivateTmp": "no", "PrivateUsers": "no", "ProcSubset": "all", "ProtectClock": "no", "ProtectControlGroups": "no", "ProtectHome": "no", "ProtectHostname": "no", "ProtectKernelLogs": "no", "ProtectKernelModules": "yes", "ProtectKernelTunables": "no", "ProtectProc": "default", "ProtectSystem": "no", "RefuseManualStart": "no", "RefuseManualStop": "no", "ReloadResult": "success", "ReloadSignal": "1", "RemainAfterExit": "no", "RemoveIPC": "no", "Requires": "system.slice", "Restart": "on-failure", "RestartKillSignal": "15", "RestartMaxDelayUSec": "infinity", "RestartMode": "normal", "RestartPreventExitStatus": "2 4 6", "RestartSteps": "0", "RestartUSec": "100ms", "RestartUSecNext": "100ms", "RestrictNamespaces": "no", "RestrictRealtime": "yes", "RestrictSUIDSGID": "no", "Result": "success", "RootDirectoryStartOnly": "no", "RootEphemeral": "no", "RootImagePolicy": "root=verity+signed+encrypted+unprotected+absent:usr=verity+signed+encrypted+unprotected+absent:home=encrypted+unprotected+absent:srv=encrypted+unprotected+absent:tmp=encrypted+unprotected+absent:var=encrypted+unprotected+absent", "RuntimeDirectoryMode": "0755", "RuntimeDirectoryPreserve": "no", "RuntimeMaxUSec": "infinity", "RuntimeRandomizedExtraUSec": "0", "SameProcessGroup": "no", "SecureBits": "0", "SendSIGHUP": "no", "SendSIGKILL": "yes", "SetLoginEnvironment": "no", "Slice": "system.slice", "StandardError": "inherit", "StandardInput": "null", "StandardOutput": "journal", "StartLimitAction": "none", "StartLimitBurst": "5", "StartLimitIntervalUSec": "10s", "StartupBlockIOWeight": "[not set]", "StartupCPUShares": "[not set]", "StartupCPUWeight": "[not set]", "StartupIOWeight": "[not set]", "StartupMemoryHigh": "infinity", "StartupMemoryLow": "0", "StartupMemoryMax": "infinity", "StartupMemorySwapMax": "infinity", "StartupMemoryZSwapMax": "infinity", "StateChangeTimestamp": "Mon 2026-07-20 06:49:10 UTC", "StateChangeTimestampMonotonic": "173609525", "StateDirectoryMode": "0755", "StatusErrno": "0", "StopWhenUnneeded": "no", "SubState": "running", "SuccessAction": "none", "SurviveFinalKillSignal": "no", "SyslogFacility": "3", "SyslogLevel": "6", "SyslogLevelPrefix": "yes", "SyslogPriority": "30", "SystemCallErrorNumber": "2147483646", "TTYReset": "no", "TTYVHangup": "no", "TTYVTDisallocate": "no", "TasksAccounting": "yes", "TasksCurrent": "2", "TasksMax": "4611", "TimeoutAbortUSec": "1min 30s", "TimeoutCleanUSec": "infinity", "TimeoutStartFailureMode": "terminate", "TimeoutStartUSec": "1min 30s", "TimeoutStopFailureMode": "terminate", "TimeoutStopUSec": "1min 30s", "TimerSlackNSec": "50000", "Transient": "no", "Type": "forking", "UID": "[not set]", "UMask": "0022", "UnitFilePreset": "enabled", "UnitFileState": "enabled", "UtmpMode": "init", "WantedBy": "multi-user.target", "WatchdogSignal": "6", "WatchdogTimestampMonotonic": "0", "WatchdogUSec": "0"}} 2026-07-20 06:49:12.182773 | ubuntu-noble | 2026-07-20 06:49:12.182959 | ubuntu-noble | PLAY RECAP ********************************************************************* 2026-07-20 06:49:12.183148 | ubuntu-noble | molecule-auditd : ok=15 changed=8 unreachable=0 failed=0 skipped=0 rescued=0 ignored=0 2026-07-20 06:49:12.184319 | ubuntu-noble | 2026-07-20 06:49:12.274356 | ubuntu-noble | INFO [delegated > converge] Executed: Successful 2026-07-20 06:49:12.274865 | ubuntu-noble | WARNING Molecule executed 1 scenario (1 missing files) 2026-07-20 06:49:12.274911 | ubuntu-noble | 2026-07-20 06:49:12.274917 | ubuntu-noble | DETAILS 2026-07-20 06:49:12.274972 | ubuntu-noble | delegated > dependency: Executed: Missing roles requirements file: requirements.yml (Remove from converge_sequence to suppress) 2026-07-20 06:49:12.275023 | ubuntu-noble | delegated > create: Executed: Missing playbook (Remove from converge_sequence to suppress) 2026-07-20 06:49:12.275070 | ubuntu-noble | delegated > prepare: Executed: Successful 2026-07-20 06:49:12.275108 | ubuntu-noble | delegated > converge: Executed: Successful 2026-07-20 06:49:12.275114 | ubuntu-noble | 2026-07-20 06:49:12.275264 | ubuntu-noble | SCENARIO RECAP 2026-07-20 06:49:12.275269 | ubuntu-noble | delegated : actions=4 successful=1 disabled=0 skipped=0 missing=2 failed=0 2026-07-20 06:49:12.275286 | ubuntu-noble | 2026-07-20 06:49:13.161447 | ubuntu-noble | WARNING Molecule scenarios should migrate to 'extensions/molecule' 2026-07-20 06:49:13.170905 | ubuntu-noble | DEBUG [unknown > config] provisioner.env found in /home/zuul/src/github.com/osism/ansible-collection-services/molecule/delegated/molecule.yml, this can be defined in ansible.env 2026-07-20 06:49:13.074050 | debian-bookworm | WARNING Molecule scenarios should migrate to 'extensions/molecule' 2026-07-20 06:49:13.084468 | debian-bookworm | DEBUG [unknown > config] provisioner.env found in /home/zuul/src/github.com/osism/ansible-collection-services/molecule/delegated/molecule.yml, this can be defined in ansible.env 2026-07-20 06:49:13.779355 | ubuntu-noble | DEBUG [unknown > config] provisioner.env found in /home/zuul/src/github.com/osism/ansible-collection-services/molecule/delegated/molecule.yml, this can be defined in ansible.env 2026-07-20 06:49:13.780109 | ubuntu-noble | DEBUG [delegated > validate] Validating schema /home/zuul/src/github.com/osism/ansible-collection-services/molecule/delegated/molecule.yml. 2026-07-20 06:49:13.803090 | ubuntu-noble | DEBUG [default > validate] Validating schema /home/zuul/src/github.com/osism/ansible-collection-services/molecule/default/molecule.yml. 2026-07-20 06:49:13.808806 | ubuntu-noble | INFO [delegated > discovery] scenario test matrix: verify 2026-07-20 06:49:13.808949 | ubuntu-noble | INFO [delegated > prerun] Performing prerun with role_name_check=0... 2026-07-20 06:49:13.655929 | debian-bookworm | DEBUG [unknown > config] provisioner.env found in /home/zuul/src/github.com/osism/ansible-collection-services/molecule/delegated/molecule.yml, this can be defined in ansible.env 2026-07-20 06:49:13.656585 | debian-bookworm | DEBUG [delegated > validate] Validating schema /home/zuul/src/github.com/osism/ansible-collection-services/molecule/delegated/molecule.yml. 2026-07-20 06:49:13.678643 | debian-bookworm | DEBUG [default > validate] Validating schema /home/zuul/src/github.com/osism/ansible-collection-services/molecule/default/molecule.yml. 2026-07-20 06:49:13.684353 | debian-bookworm | INFO [delegated > discovery] scenario test matrix: verify 2026-07-20 06:49:13.684410 | debian-bookworm | INFO [delegated > prerun] Performing prerun with role_name_check=0... 2026-07-20 06:49:15.415137 | ubuntu-noble | INFO [delegated > verify] Executing 2026-07-20 06:49:15.417376 | ubuntu-noble | INFO [delegated > verify] Executing Testinfra tests found in /home/zuul/src/github.com/osism/ansible-collection-services/molecule/delegated/tests/... 2026-07-20 06:49:15.418098 | ubuntu-noble | DEBUG ANSIBLE ENVIRONMENT: 2026-07-20 06:49:15.418113 | ubuntu-noble | ANSIBLE_COLLECTIONS_PATH: /home/zuul/venv/.ansible/collections:/home/zuul/.ansible/collections 2026-07-20 06:49:15.418123 | ubuntu-noble | ANSIBLE_CONFIG: /home/zuul/.ansible/tmp/molecule.oWZD.delegated/ansible.cfg 2026-07-20 06:49:15.418132 | ubuntu-noble | ANSIBLE_LIBRARY: ../../plugins 2026-07-20 06:49:15.418140 | ubuntu-noble | ANSIBLE_PYTHON_INTERPRETER: /home/zuul/venv/bin/python 2026-07-20 06:49:15.418147 | ubuntu-noble | ANSIBLE_ROLE: auditd 2026-07-20 06:49:15.418154 | ubuntu-noble | ANSIBLE_ROLES_PATH: ../../roles 2026-07-20 06:49:15.418162 | ubuntu-noble | ANSIBLE_VERBOSITY: 1 2026-07-20 06:49:15.418170 | ubuntu-noble | 2026-07-20 06:49:15.418242 | ubuntu-noble | DEBUG MOLECULE ENVIRONMENT: 2026-07-20 06:49:15.418251 | ubuntu-noble | MOLECULE_DEBUG: True 2026-07-20 06:49:15.418258 | ubuntu-noble | MOLECULE_DEPENDENCY_NAME: galaxy 2026-07-20 06:49:15.418265 | ubuntu-noble | MOLECULE_DRIVER_NAME: default 2026-07-20 06:49:15.418295 | ubuntu-noble | MOLECULE_ENV_FILE: /home/zuul/src/github.com/osism/ansible-collection-services/.env.yml 2026-07-20 06:49:15.418303 | ubuntu-noble | MOLECULE_EPHEMERAL_DIRECTORY: /home/zuul/.ansible/tmp/molecule.oWZD.delegated 2026-07-20 06:49:15.418310 | ubuntu-noble | MOLECULE_FILE: /home/zuul/.ansible/tmp/molecule.oWZD.delegated/molecule.yml 2026-07-20 06:49:15.418318 | ubuntu-noble | MOLECULE_INSTANCE_CONFIG: /home/zuul/.ansible/tmp/molecule.oWZD.delegated/instance_config.yml 2026-07-20 06:49:15.418325 | ubuntu-noble | MOLECULE_INVENTORY_FILE: /home/zuul/.ansible/tmp/molecule.oWZD.delegated/inventory/ansible_inventory.yml 2026-07-20 06:49:15.418333 | ubuntu-noble | MOLECULE_PROJECT_DIRECTORY: /home/zuul/src/github.com/osism/ansible-collection-services 2026-07-20 06:49:15.418341 | ubuntu-noble | MOLECULE_PROVISIONER_NAME: ansible 2026-07-20 06:49:15.418348 | ubuntu-noble | MOLECULE_SCENARIO_DIRECTORY: /home/zuul/src/github.com/osism/ansible-collection-services/molecule/delegated 2026-07-20 06:49:15.418356 | ubuntu-noble | MOLECULE_SCENARIO_NAME: delegated 2026-07-20 06:49:15.418363 | ubuntu-noble | MOLECULE_STATE_FILE: /home/zuul/.ansible/tmp/molecule.oWZD.delegated/state.yml 2026-07-20 06:49:15.418370 | ubuntu-noble | MOLECULE_VERIFIER_NAME: testinfra 2026-07-20 06:49:15.418378 | ubuntu-noble | MOLECULE_VERIFIER_TEST_DIRECTORY: /home/zuul/src/github.com/osism/ansible-collection-services/molecule/delegated/tests 2026-07-20 06:49:15.418386 | ubuntu-noble | 2026-07-20 06:49:15.418410 | ubuntu-noble | DEBUG SHELL REPLAY: ANSIBLE_COLLECTIONS_PATH=/home/zuul/venv/.ansible/collections:/home/zuul/.ansible/collections ANSIBLE_CONFIG=/home/zuul/.ansible/tmp/molecule.oWZD.delegated/ansible.cfg ANSIBLE_LIBRARY=../../plugins ANSIBLE_PYTHON_INTERPRETER=/home/zuul/venv/bin/python ANSIBLE_ROLE=auditd ANSIBLE_ROLES_PATH=../../roles ANSIBLE_VERBOSITY=1 MOLECULE_DEBUG=True MOLECULE_DEPENDENCY_NAME=galaxy MOLECULE_DRIVER_NAME=default MOLECULE_ENV_FILE=/home/zuul/src/github.com/osism/ansible-collection-services/.env.yml MOLECULE_EPHEMERAL_DIRECTORY=/home/zuul/.ansible/tmp/molecule.oWZD.delegated MOLECULE_FILE=/home/zuul/.ansible/tmp/molecule.oWZD.delegated/molecule.yml MOLECULE_INSTANCE_CONFIG=/home/zuul/.ansible/tmp/molecule.oWZD.delegated/instance_config.yml MOLECULE_INVENTORY_FILE=/home/zuul/.ansible/tmp/molecule.oWZD.delegated/inventory/ansible_inventory.yml MOLECULE_PROJECT_DIRECTORY=/home/zuul/src/github.com/osism/ansible-collection-services MOLECULE_PROVISIONER_NAME=ansible MOLECULE_SCENARIO_DIRECTORY=/home/zuul/src/github.com/osism/ansible-collection-services/molecule/delegated MOLECULE_SCENARIO_NAME=delegated MOLECULE_STATE_FILE=/home/zuul/.ansible/tmp/molecule.oWZD.delegated/state.yml MOLECULE_VERIFIER_NAME=testinfra MOLECULE_VERIFIER_TEST_DIRECTORY=/home/zuul/src/github.com/osism/ansible-collection-services/molecule/delegated/tests 2026-07-20 06:49:15.176644 | debian-bookworm | INFO [delegated > verify] Executing 2026-07-20 06:49:15.178381 | debian-bookworm | INFO [delegated > verify] Executing Testinfra tests found in /home/zuul/src/github.com/osism/ansible-collection-services/molecule/delegated/tests/... 2026-07-20 06:49:15.179526 | debian-bookworm | DEBUG ANSIBLE ENVIRONMENT: 2026-07-20 06:49:15.179546 | debian-bookworm | ANSIBLE_COLLECTIONS_PATH: /home/zuul/venv/.ansible/collections:/home/zuul/.ansible/collections 2026-07-20 06:49:15.179553 | debian-bookworm | ANSIBLE_CONFIG: /home/zuul/.ansible/tmp/molecule.oWZD.delegated/ansible.cfg 2026-07-20 06:49:15.179559 | debian-bookworm | ANSIBLE_LIBRARY: ../../plugins 2026-07-20 06:49:15.179565 | debian-bookworm | ANSIBLE_PYTHON_INTERPRETER: /home/zuul/venv/bin/python 2026-07-20 06:49:15.179574 | debian-bookworm | ANSIBLE_ROLE: auditd 2026-07-20 06:49:15.179582 | debian-bookworm | ANSIBLE_ROLES_PATH: ../../roles 2026-07-20 06:49:15.179589 | debian-bookworm | ANSIBLE_VERBOSITY: 1 2026-07-20 06:49:15.179598 | debian-bookworm | 2026-07-20 06:49:15.179702 | debian-bookworm | DEBUG MOLECULE ENVIRONMENT: 2026-07-20 06:49:15.179716 | debian-bookworm | MOLECULE_DEBUG: True 2026-07-20 06:49:15.179737 | debian-bookworm | MOLECULE_DEPENDENCY_NAME: galaxy 2026-07-20 06:49:15.179747 | debian-bookworm | MOLECULE_DRIVER_NAME: default 2026-07-20 06:49:15.179756 | debian-bookworm | MOLECULE_ENV_FILE: /home/zuul/src/github.com/osism/ansible-collection-services/.env.yml 2026-07-20 06:49:15.179765 | debian-bookworm | MOLECULE_EPHEMERAL_DIRECTORY: /home/zuul/.ansible/tmp/molecule.oWZD.delegated 2026-07-20 06:49:15.179774 | debian-bookworm | MOLECULE_FILE: /home/zuul/.ansible/tmp/molecule.oWZD.delegated/molecule.yml 2026-07-20 06:49:15.179783 | debian-bookworm | MOLECULE_INSTANCE_CONFIG: /home/zuul/.ansible/tmp/molecule.oWZD.delegated/instance_config.yml 2026-07-20 06:49:15.179791 | debian-bookworm | MOLECULE_INVENTORY_FILE: /home/zuul/.ansible/tmp/molecule.oWZD.delegated/inventory/ansible_inventory.yml 2026-07-20 06:49:15.179800 | debian-bookworm | MOLECULE_PROJECT_DIRECTORY: /home/zuul/src/github.com/osism/ansible-collection-services 2026-07-20 06:49:15.179808 | debian-bookworm | MOLECULE_PROVISIONER_NAME: ansible 2026-07-20 06:49:15.179816 | debian-bookworm | MOLECULE_SCENARIO_DIRECTORY: /home/zuul/src/github.com/osism/ansible-collection-services/molecule/delegated 2026-07-20 06:49:15.179825 | debian-bookworm | MOLECULE_SCENARIO_NAME: delegated 2026-07-20 06:49:15.179833 | debian-bookworm | MOLECULE_STATE_FILE: /home/zuul/.ansible/tmp/molecule.oWZD.delegated/state.yml 2026-07-20 06:49:15.179839 | debian-bookworm | MOLECULE_VERIFIER_NAME: testinfra 2026-07-20 06:49:15.179845 | debian-bookworm | MOLECULE_VERIFIER_TEST_DIRECTORY: /home/zuul/src/github.com/osism/ansible-collection-services/molecule/delegated/tests 2026-07-20 06:49:15.179850 | debian-bookworm | 2026-07-20 06:49:15.179869 | debian-bookworm | DEBUG SHELL REPLAY: ANSIBLE_COLLECTIONS_PATH=/home/zuul/venv/.ansible/collections:/home/zuul/.ansible/collections ANSIBLE_CONFIG=/home/zuul/.ansible/tmp/molecule.oWZD.delegated/ansible.cfg ANSIBLE_LIBRARY=../../plugins ANSIBLE_PYTHON_INTERPRETER=/home/zuul/venv/bin/python ANSIBLE_ROLE=auditd ANSIBLE_ROLES_PATH=../../roles ANSIBLE_VERBOSITY=1 MOLECULE_DEBUG=True MOLECULE_DEPENDENCY_NAME=galaxy MOLECULE_DRIVER_NAME=default MOLECULE_ENV_FILE=/home/zuul/src/github.com/osism/ansible-collection-services/.env.yml MOLECULE_EPHEMERAL_DIRECTORY=/home/zuul/.ansible/tmp/molecule.oWZD.delegated MOLECULE_FILE=/home/zuul/.ansible/tmp/molecule.oWZD.delegated/molecule.yml MOLECULE_INSTANCE_CONFIG=/home/zuul/.ansible/tmp/molecule.oWZD.delegated/instance_config.yml MOLECULE_INVENTORY_FILE=/home/zuul/.ansible/tmp/molecule.oWZD.delegated/inventory/ansible_inventory.yml MOLECULE_PROJECT_DIRECTORY=/home/zuul/src/github.com/osism/ansible-collection-services MOLECULE_PROVISIONER_NAME=ansible MOLECULE_SCENARIO_DIRECTORY=/home/zuul/src/github.com/osism/ansible-collection-services/molecule/delegated MOLECULE_SCENARIO_NAME=delegated MOLECULE_STATE_FILE=/home/zuul/.ansible/tmp/molecule.oWZD.delegated/state.yml MOLECULE_VERIFIER_NAME=testinfra MOLECULE_VERIFIER_TEST_DIRECTORY=/home/zuul/src/github.com/osism/ansible-collection-services/molecule/delegated/tests 2026-07-20 06:49:15.404996 | debian-bookworm | writing pytest debug information to pytestdebug.log 2026-07-20 06:49:15.417847 | debian-bookworm | ============================= test session starts ============================== 2026-07-20 06:49:15.418337 | debian-bookworm | platform linux -- Python 3.11.2, pytest-9.1.1, pluggy-1.6.0 -- /home/zuul/venv/bin/python3 2026-07-20 06:49:15.419014 | debian-bookworm | using: pytest-9.1.1 2026-07-20 06:49:15.419632 | debian-bookworm | registered third-party plugins: 2026-07-20 06:49:15.420212 | debian-bookworm | pytest-testinfra-10.2.2 at /home/zuul/venv/lib/python3.11/site-packages/testinfra/plugin.py 2026-07-20 06:49:15.420704 | debian-bookworm | rootdir: /home/zuul 2026-07-20 06:49:15.421273 | debian-bookworm | plugins: testinfra-10.2.2 2026-07-20 06:49:15.678327 | ubuntu-noble | writing pytest debug information to pytestdebug.log 2026-07-20 06:49:15.694312 | ubuntu-noble | ============================= test session starts ============================== 2026-07-20 06:49:15.694339 | ubuntu-noble | platform linux -- Python 3.12.3, pytest-9.1.1, pluggy-1.6.0 -- /home/zuul/venv/bin/python3 2026-07-20 06:49:15.694660 | ubuntu-noble | using: pytest-9.1.1 2026-07-20 06:49:15.695132 | ubuntu-noble | registered third-party plugins: 2026-07-20 06:49:15.695780 | ubuntu-noble | pytest-testinfra-10.2.2 at /home/zuul/venv/lib/python3.12/site-packages/testinfra/plugin.py 2026-07-20 06:49:15.696503 | ubuntu-noble | rootdir: /home/zuul 2026-07-20 06:49:15.696908 | ubuntu-noble | plugins: testinfra-10.2.2 2026-07-20 06:49:16.487357 | debian-bookworm | collecting ... collected 6 items 2026-07-20 06:49:16.487654 | debian-bookworm | 2026-07-20 06:49:16.929574 | ubuntu-noble | collecting ... collected 6 items 2026-07-20 06:49:16.929938 | ubuntu-noble | 2026-07-20 06:49:20.954585 | debian-bookworm | tests/auditd.py::test_pkg[ansible://molecule-auditd] PASSED [ 16%] 2026-07-20 06:49:20.998148 | debian-bookworm | tests/auditd.py::test_conffile[ansible://molecule-auditd] PASSED [ 33%] 2026-07-20 06:49:21.891475 | ubuntu-noble | tests/auditd.py::test_pkg[ansible://molecule-auditd] PASSED [ 16%] 2026-07-20 06:49:21.934098 | ubuntu-noble | tests/auditd.py::test_conffile[ansible://molecule-auditd] PASSED [ 33%] 2026-07-20 06:49:23.640432 | debian-bookworm | tests/auditd.py::test_adjustment[ansible://molecule-auditd] PASSED [ 50%] 2026-07-20 06:49:24.758024 | ubuntu-noble | tests/auditd.py::test_adjustment[ansible://molecule-auditd] PASSED [ 50%] 2026-07-20 06:49:29.200831 | debian-bookworm | tests/auditd.py::test_rulefiles[ansible://molecule-auditd] PASSED [ 66%] 2026-07-20 06:49:30.499003 | debian-bookworm | tests/auditd.py::test_srv[ansible://molecule-auditd] PASSED [ 83%] 2026-07-20 06:49:30.539615 | debian-bookworm | wrote pytest debug information to pytestdebug.log 2026-07-20 06:49:30.540034 | debian-bookworm | tests/auditd.py::test_function[ansible://molecule-auditd] PASSED [100%] 2026-07-20 06:49:30.540144 | debian-bookworm | 2026-07-20 06:49:30.540259 | debian-bookworm | ============================== 6 passed in 15.11s ============================== 2026-07-20 06:49:30.602841 | ubuntu-noble | tests/auditd.py::test_rulefiles[ansible://molecule-auditd] PASSED [ 66%] 2026-07-20 06:49:30.572528 | debian-bookworm | INFO [delegated > verify] Verifier completed successfully. 2026-07-20 06:49:30.572567 | debian-bookworm | INFO [delegated > verify] Executed: Successful 2026-07-20 06:49:30.572573 | debian-bookworm | INFO Molecule executed 1 scenario (1 successful) 2026-07-20 06:49:30.572578 | debian-bookworm | 2026-07-20 06:49:30.572584 | debian-bookworm | DETAILS 2026-07-20 06:49:30.572590 | debian-bookworm | delegated > verify: Executed: Successful 2026-07-20 06:49:30.572595 | debian-bookworm | 2026-07-20 06:49:30.572600 | debian-bookworm | SCENARIO RECAP 2026-07-20 06:49:30.572605 | debian-bookworm | delegated : actions=1 successful=0 disabled=0 skipped=0 missing=0 failed=0 2026-07-20 06:49:30.572612 | debian-bookworm | 2026-07-20 06:49:31.057635 | debian-bookworm | ok: Runtime: 0:00:17.833039 2026-07-20 06:49:32.384393 | ubuntu-noble | tests/auditd.py::test_srv[ansible://molecule-auditd] PASSED [ 83%] 2026-07-20 06:49:32.447723 | ubuntu-noble | wrote pytest debug information to pytestdebug.log 2026-07-20 06:49:32.448249 | ubuntu-noble | tests/auditd.py::test_function[ansible://molecule-auditd] PASSED [100%] 2026-07-20 06:49:32.450494 | ubuntu-noble | 2026-07-20 06:49:32.450562 | ubuntu-noble | ============================== 6 passed in 16.73s ============================== 2026-07-20 06:49:32.652576 | ubuntu-noble | ok: Runtime: 0:00:19.765038 2026-07-20 06:49:32.663632 | 2026-07-20 06:49:32.663799 | TASK [ansible-molecule : Run molecule destroy action with scenario delegated] 2026-07-20 06:49:32.508446 | ubuntu-noble | INFO [delegated > verify] Verifier completed successfully. 2026-07-20 06:49:32.508564 | ubuntu-noble | INFO [delegated > verify] Executed: Successful 2026-07-20 06:49:32.508586 | ubuntu-noble | INFO Molecule executed 1 scenario (1 successful) 2026-07-20 06:49:32.508603 | ubuntu-noble | 2026-07-20 06:49:32.508620 | ubuntu-noble | DETAILS 2026-07-20 06:49:32.508634 | ubuntu-noble | delegated > verify: Executed: Successful 2026-07-20 06:49:32.508661 | ubuntu-noble | 2026-07-20 06:49:32.508675 | ubuntu-noble | SCENARIO RECAP 2026-07-20 06:49:32.508689 | ubuntu-noble | delegated : actions=1 successful=0 disabled=0 skipped=0 missing=0 failed=0 2026-07-20 06:49:32.508702 | ubuntu-noble | 2026-07-20 06:49:33.231775 | debian-bookworm | skipping: Conditional result was False 2026-07-20 06:49:33.233065 | ubuntu-noble | skipping: Conditional result was False 2026-07-20 06:49:33.263191 | 2026-07-20 06:49:33.263358 | PLAY RECAP 2026-07-20 06:49:33.263428 | debian-bookworm | ok: 17 changed: 12 unreachable: 0 failed: 0 skipped: 16 rescued: 0 ignored: 0 2026-07-20 06:49:33.263463 | ubuntu-noble | ok: 17 changed: 12 unreachable: 0 failed: 0 skipped: 16 rescued: 0 ignored: 0 2026-07-20 06:49:33.263486 | 2026-07-20 06:49:33.458629 | RUN END RESULT_NORMAL: [untrusted : github.com/osism/zuul-jobs/playbooks/ansible-molecule/run.yaml@main] 2026-07-20 06:49:33.461964 | POST-RUN START: [trusted : github.com/osism/zuul-config/playbooks/base/post-fetch.yaml@main] 2026-07-20 06:49:34.292800 | 2026-07-20 06:49:34.292998 | PLAY [Base post-fetch] 2026-07-20 06:49:34.309262 | 2026-07-20 06:49:34.309447 | TASK [diagnose-network : Ensure log directory exists] 2026-07-20 06:49:35.032962 | debian-bookworm | ok 2026-07-20 06:49:35.070040 | ubuntu-noble | ok 2026-07-20 06:49:35.083119 | 2026-07-20 06:49:35.083335 | TASK [diagnose-network : Snapshot dual-stack network state (post)] 2026-07-20 06:49:46.778982 | debian-bookworm | ok: Runtime: 0:00:05.826090 2026-07-20 06:49:46.999405 | ubuntu-noble | ok: Runtime: 0:00:05.738824 2026-07-20 06:49:47.009493 | 2026-07-20 06:49:47.009657 | TASK [diagnose-network : Snapshot Docker/BuildKit IPv6 config (teardown)] 2026-07-20 06:49:53.067481 | debian-bookworm | ok: Runtime: 0:00:00.010051 2026-07-20 06:49:53.244332 | ubuntu-noble | ok: Runtime: 0:00:00.007336 2026-07-20 06:49:53.252518 | 2026-07-20 06:49:53.252680 | TASK [diagnose-network : Probe container network namespace (teardown)] 2026-07-20 06:49:59.233465 | debian-bookworm | ok: Runtime: 0:00:00.009535 2026-07-20 06:49:59.500375 | ubuntu-noble | ok: Runtime: 0:00:00.012252 2026-07-20 06:49:59.518225 | 2026-07-20 06:49:59.518394 | TASK [fetch-output : Set log path for multiple nodes] 2026-07-20 06:49:59.603881 | debian-bookworm | ok 2026-07-20 06:49:59.611061 | ubuntu-noble | ok 2026-07-20 06:49:59.618890 | 2026-07-20 06:49:59.619013 | TASK [fetch-output : Set log path for single node] 2026-07-20 06:49:59.648552 | debian-bookworm | skipping: Conditional result was False 2026-07-20 06:49:59.669714 | ubuntu-noble | skipping: Conditional result was False 2026-07-20 06:49:59.680396 | 2026-07-20 06:49:59.680562 | LOOP [fetch-output : Ensure local output dirs] 2026-07-20 06:49:59.979703 | debian-bookworm -> localhost | changed: "/var/lib/zuul/builds/4759f23dac544077b439b7e6f9c039ce/work/logs/debian-bookworm" 2026-07-20 06:50:00.025206 | ubuntu-noble -> localhost | changed: "/var/lib/zuul/builds/4759f23dac544077b439b7e6f9c039ce/work/logs/ubuntu-noble" 2026-07-20 06:50:00.285136 | debian-bookworm -> localhost | changed: "/var/lib/zuul/builds/4759f23dac544077b439b7e6f9c039ce/work/artifacts" 2026-07-20 06:50:00.299766 | ubuntu-noble -> localhost | ok: "/var/lib/zuul/builds/4759f23dac544077b439b7e6f9c039ce/work/artifacts" 2026-07-20 06:50:00.569462 | debian-bookworm -> localhost | changed: "/var/lib/zuul/builds/4759f23dac544077b439b7e6f9c039ce/work/docs" 2026-07-20 06:50:00.618821 | ubuntu-noble -> localhost | ok: "/var/lib/zuul/builds/4759f23dac544077b439b7e6f9c039ce/work/docs" 2026-07-20 06:50:00.619086 | ubuntu-noble -> localhost | changed: All items complete 2026-07-20 06:50:00.619120 | 2026-07-20 06:50:00.632849 | 2026-07-20 06:50:00.633036 | LOOP [fetch-output : Collect logs, artifacts and docs] 2026-07-20 06:50:01.443937 | ubuntu-noble | changed: 2026-07-20 06:50:01.444295 | ubuntu-noble | .d..t...... ./ 2026-07-20 06:50:01.444337 | ubuntu-noble | >f+++++++++ net-debug.post.txt 2026-07-20 06:50:01.444363 | ubuntu-noble | >f+++++++++ net-debug.pre.txt 2026-07-20 06:50:01.444385 | ubuntu-noble | >f+++++++++ sudo-debug.txt 2026-07-20 06:50:01.444407 | ubuntu-noble | >f+++++++++ sudo-strace.log 2026-07-20 06:50:01.444428 | ubuntu-noble | >f+++++++++ sudo-strace.log.time 2026-07-20 06:50:01.449789 | debian-bookworm | changed: 2026-07-20 06:50:01.449912 | debian-bookworm | .d..t...... ./ 2026-07-20 06:50:01.450094 | debian-bookworm | >f+++++++++ net-debug.post.txt 2026-07-20 06:50:01.450129 | debian-bookworm | >f+++++++++ net-debug.pre.txt 2026-07-20 06:50:01.450152 | debian-bookworm | >f+++++++++ sudo-debug.txt 2026-07-20 06:50:01.450172 | debian-bookworm | >f+++++++++ sudo-strace.log 2026-07-20 06:50:01.450191 | debian-bookworm | >f+++++++++ sudo-strace.log.time 2026-07-20 06:50:02.022849 | ubuntu-noble | changed: .d..t...... ./ 2026-07-20 06:50:02.047359 | debian-bookworm | ok 2026-07-20 06:50:02.586061 | ubuntu-noble | changed: .d..t...... ./ 2026-07-20 06:50:02.673860 | debian-bookworm | ok 2026-07-20 06:50:02.674066 | debian-bookworm | changed: All items complete 2026-07-20 06:50:02.674139 | 2026-07-20 06:50:02.692627 | 2026-07-20 06:50:02.692763 | LOOP [merge-output-to-logs : Move artifacts and docs to logs dir] 2026-07-20 06:50:03.055548 | debian-bookworm -> localhost | ok: Item: artifacts Runtime: 0:00:00.011901 2026-07-20 06:50:03.391305 | debian-bookworm -> localhost | ok: Item: docs Runtime: 0:00:00.007890 2026-07-20 06:50:03.408946 | 2026-07-20 06:50:03.409160 | PLAY RECAP 2026-07-20 06:50:03.409223 | debian-bookworm | ok: 8 changed: 3 unreachable: 0 failed: 0 skipped: 1 rescued: 0 ignored: 0 2026-07-20 06:50:03.409280 | ubuntu-noble | ok: 7 changed: 2 unreachable: 0 failed: 0 skipped: 1 rescued: 0 ignored: 0 2026-07-20 06:50:03.409303 | 2026-07-20 06:50:03.580459 | POST-RUN END RESULT_NORMAL: [trusted : github.com/osism/zuul-config/playbooks/base/post-fetch.yaml@main] 2026-07-20 06:50:03.582056 | POST-RUN START: [trusted : github.com/osism/zuul-config/playbooks/base/post.yaml@main] 2026-07-20 06:50:04.371707 | 2026-07-20 06:50:04.371891 | PLAY [Base post] 2026-07-20 06:50:04.385708 | 2026-07-20 06:50:04.385846 | TASK [remove-build-sshkey : Remove the build SSH key from all nodes] 2026-07-20 06:50:05.195022 | debian-bookworm | changed 2026-07-20 06:50:05.345835 | ubuntu-noble | changed 2026-07-20 06:50:05.357164 | 2026-07-20 06:50:05.357335 | PLAY RECAP 2026-07-20 06:50:05.357436 | debian-bookworm | ok: 1 changed: 1 unreachable: 0 failed: 0 skipped: 0 rescued: 0 ignored: 0 2026-07-20 06:50:05.357474 | ubuntu-noble | ok: 1 changed: 1 unreachable: 0 failed: 0 skipped: 0 rescued: 0 ignored: 0 2026-07-20 06:50:05.357498 | 2026-07-20 06:50:05.514605 | POST-RUN END RESULT_NORMAL: [trusted : github.com/osism/zuul-config/playbooks/base/post.yaml@main] 2026-07-20 06:50:05.518365 | POST-RUN START: [trusted : github.com/osism/zuul-config/playbooks/base/post-logs.yaml@main] 2026-07-20 06:50:06.417545 | 2026-07-20 06:50:06.417768 | PLAY [Base post-logs] 2026-07-20 06:50:06.432375 | 2026-07-20 06:50:06.432631 | TASK [generate-zuul-manifest : Generate Zuul manifest] 2026-07-20 06:50:06.968458 | localhost | changed 2026-07-20 06:50:06.987841 | 2026-07-20 06:50:06.988057 | TASK [generate-zuul-manifest : Return Zuul manifest URL to Zuul] 2026-07-20 06:50:07.026511 | localhost | ok 2026-07-20 06:50:07.032471 | 2026-07-20 06:50:07.032664 | TASK [Set zuul-log-path fact] 2026-07-20 06:50:07.050138 | localhost | ok 2026-07-20 06:50:07.060043 | 2026-07-20 06:50:07.060207 | TASK [set-zuul-log-path-fact : Set log path for a build] 2026-07-20 06:50:07.087323 | localhost | ok 2026-07-20 06:50:07.090771 | 2026-07-20 06:50:07.090912 | TASK [upload-logs : Create log directories] 2026-07-20 06:50:07.652179 | localhost | changed 2026-07-20 06:50:07.656059 | 2026-07-20 06:50:07.656190 | TASK [upload-logs : Ensure logs are readable before uploading] 2026-07-20 06:50:08.227988 | localhost -> localhost | ok: Runtime: 0:00:00.006891 2026-07-20 06:50:08.233502 | 2026-07-20 06:50:08.233653 | TASK [upload-logs : Upload logs to log server] 2026-07-20 06:50:08.864328 | localhost | Output suppressed because no_log was given 2026-07-20 06:50:08.867235 | 2026-07-20 06:50:08.867388 | LOOP [upload-logs : Compress console log and json output] 2026-07-20 06:50:08.951209 | localhost | skipping: Conditional result was False 2026-07-20 06:50:08.960374 | localhost | skipping: Conditional result was False 2026-07-20 06:50:08.974581 | 2026-07-20 06:50:08.974760 | LOOP [upload-logs : Upload compressed console log and json output] 2026-07-20 06:50:09.033328 | localhost | skipping: Conditional result was False 2026-07-20 06:50:09.033622 | 2026-07-20 06:50:09.041779 | localhost | skipping: Conditional result was False 2026-07-20 06:50:09.047811 | 2026-07-20 06:50:09.047972 | LOOP [upload-logs : Upload console log and json output]