2026-03-26 09:03:00.446614 | Job console starting 2026-03-26 09:03:00.505579 | Updating git repos 2026-03-26 09:03:00.577499 | Cloning repos into workspace 2026-03-26 09:03:00.658456 | Restoring repo states 2026-03-26 09:03:00.686721 | Merging changes 2026-03-26 09:03:01.282403 | Checking out repos 2026-03-26 09:03:01.317620 | Preparing playbooks 2026-03-26 09:03:01.959593 | Running Ansible setup 2026-03-26 09:03:08.069208 | PRE-RUN START: [trusted : github.com/osism/zuul-config/playbooks/base/pre.yaml@main] 2026-03-26 09:03:08.872120 | 2026-03-26 09:03:08.872298 | PLAY [Base pre] 2026-03-26 09:03:08.889240 | 2026-03-26 09:03:08.889382 | TASK [Setup log path fact] 2026-03-26 09:03:08.908788 | debian-bookworm | ok 2026-03-26 09:03:08.925611 | 2026-03-26 09:03:08.925802 | TASK [set-zuul-log-path-fact : Set log path for a build] 2026-03-26 09:03:08.955671 | debian-bookworm | ok 2026-03-26 09:03:08.965614 | 2026-03-26 09:03:08.965736 | TASK [emit-job-header : Print job information] 2026-03-26 09:03:09.017470 | # Job Information 2026-03-26 09:03:09.017847 | Ansible Version: 2.16.14 2026-03-26 09:03:09.017917 | Job: ansible-collection-services-molecule-auditd 2026-03-26 09:03:09.017978 | Pipeline: check 2026-03-26 09:03:09.018020 | Executor: 521e9411259a 2026-03-26 09:03:09.018057 | Triggered by: https://github.com/osism/ansible-collection-services/pull/2073 2026-03-26 09:03:09.018095 | Event ID: 4d490850-28f0-11f1-90c1-65f92e363f59 2026-03-26 09:03:09.026738 | 2026-03-26 09:03:09.027008 | LOOP [emit-job-header : Print node information] 2026-03-26 09:03:09.147303 | debian-bookworm | ok: 2026-03-26 09:03:09.147689 | debian-bookworm | # Node Information 2026-03-26 09:03:09.147871 | debian-bookworm | Inventory Hostname: debian-bookworm 2026-03-26 09:03:09.147908 | debian-bookworm | Hostname: debian 2026-03-26 09:03:09.147945 | debian-bookworm | Username: zuul 2026-03-26 09:03:09.148086 | debian-bookworm | Distro: Debian 12.13 2026-03-26 09:03:09.148128 | debian-bookworm | Provider: regiocloud-a 2026-03-26 09:03:09.148159 | debian-bookworm | Region: 2026-03-26 09:03:09.148182 | debian-bookworm | Label: debian-bookworm 2026-03-26 09:03:09.148202 | debian-bookworm | Product Name: OpenStack Nova 2026-03-26 09:03:09.148284 | debian-bookworm | Interface IP: 2a13:1a81:8000:3124:f816:3eff:feff:8c24 2026-03-26 09:03:09.192921 | debian-bookworm | ok: 2026-03-26 09:03:09.193049 | debian-bookworm | # Node Information 2026-03-26 09:03:09.193112 | debian-bookworm | Inventory Hostname: ubuntu-noble 2026-03-26 09:03:09.193140 | debian-bookworm | Hostname: ubuntu 2026-03-26 09:03:09.193166 | debian-bookworm | Username: zuul 2026-03-26 09:03:09.193188 | debian-bookworm | Distro: Ubuntu 24.04 2026-03-26 09:03:09.193209 | debian-bookworm | Provider: regiocloud-a 2026-03-26 09:03:09.193228 | debian-bookworm | Region: 2026-03-26 09:03:09.193248 | debian-bookworm | Label: ubuntu-noble 2026-03-26 09:03:09.193277 | debian-bookworm | Product Name: OpenStack Nova 2026-03-26 09:03:09.193401 | debian-bookworm | Interface IP: 2a13:1a81:8000:3124:f816:3eff:fe3a:e791 2026-03-26 09:03:09.213609 | 2026-03-26 09:03:09.213741 | TASK [log-inventory : Ensure Zuul Ansible directory exists] 2026-03-26 09:03:09.746032 | debian-bookworm -> localhost | changed 2026-03-26 09:03:09.753529 | 2026-03-26 09:03:09.753654 | TASK [log-inventory : Copy ansible inventory to logs dir] 2026-03-26 09:03:10.993332 | debian-bookworm -> localhost | changed 2026-03-26 09:03:11.096529 | ubuntu-noble -> localhost | ok 2026-03-26 09:03:11.114317 | 2026-03-26 09:03:11.114449 | TASK [add-build-sshkey : Check to see if ssh key was already created for this build] 2026-03-26 09:03:11.409495 | debian-bookworm -> localhost | ok 2026-03-26 09:03:11.420280 | 2026-03-26 09:03:11.420408 | TASK [add-build-sshkey : Create a new key in workspace based on build UUID] 2026-03-26 09:03:11.458743 | debian-bookworm | ok 2026-03-26 09:03:11.464032 | ubuntu-noble | ok 2026-03-26 09:03:11.492276 | debian-bookworm | included: /var/lib/zuul/builds/5650b1a8161f4cea80b86c8756b9b136/trusted/project_1/github.com/osism/openinfra-zuul-jobs/roles/add-build-sshkey/tasks/create-key-and-replace.yaml 2026-03-26 09:03:11.492396 | ubuntu-noble | included: /var/lib/zuul/builds/5650b1a8161f4cea80b86c8756b9b136/trusted/project_1/github.com/osism/openinfra-zuul-jobs/roles/add-build-sshkey/tasks/create-key-and-replace.yaml 2026-03-26 09:03:11.500607 | 2026-03-26 09:03:11.500715 | TASK [add-build-sshkey : Create Temp SSH key] 2026-03-26 09:03:14.453739 | debian-bookworm -> localhost | Generating public/private rsa key pair. 2026-03-26 09:03:14.454124 | debian-bookworm -> localhost | Your identification has been saved in /var/lib/zuul/builds/5650b1a8161f4cea80b86c8756b9b136/work/5650b1a8161f4cea80b86c8756b9b136_id_rsa 2026-03-26 09:03:14.454445 | debian-bookworm -> localhost | Your public key has been saved in /var/lib/zuul/builds/5650b1a8161f4cea80b86c8756b9b136/work/5650b1a8161f4cea80b86c8756b9b136_id_rsa.pub 2026-03-26 09:03:14.454499 | debian-bookworm -> localhost | The key fingerprint is: 2026-03-26 09:03:14.454527 | debian-bookworm -> localhost | SHA256:pJByGIrdtb/JbW16eRN0Wavkp9mjVY6tjKpvb7Bt8a0 zuul-build-sshkey 2026-03-26 09:03:14.454553 | debian-bookworm -> localhost | The key's randomart image is: 2026-03-26 09:03:14.454579 | debian-bookworm -> localhost | +---[RSA 3072]----+ 2026-03-26 09:03:14.454602 | debian-bookworm -> localhost | | . . | 2026-03-26 09:03:14.454625 | debian-bookworm -> localhost | |.o + o . .| 2026-03-26 09:03:14.454645 | debian-bookworm -> localhost | |o + = . . +| 2026-03-26 09:03:14.454665 | debian-bookworm -> localhost | | o . + ..o.| 2026-03-26 09:03:14.454685 | debian-bookworm -> localhost | | . S o....| 2026-03-26 09:03:14.454704 | debian-bookworm -> localhost | | . +...o.=.| 2026-03-26 09:03:14.454723 | debian-bookworm -> localhost | | + o+o+*+o| 2026-03-26 09:03:14.454743 | debian-bookworm -> localhost | | .oo*==+.| 2026-03-26 09:03:14.454803 | debian-bookworm -> localhost | | .++*ooEo.| 2026-03-26 09:03:14.454824 | debian-bookworm -> localhost | +----[SHA256]-----+ 2026-03-26 09:03:14.455039 | debian-bookworm -> localhost | ok: Runtime: 0:00:02.266706 2026-03-26 09:03:14.463642 | 2026-03-26 09:03:14.463799 | TASK [add-build-sshkey : Remote setup ssh keys (linux)] 2026-03-26 09:03:14.508327 | debian-bookworm | ok 2026-03-26 09:03:14.513171 | ubuntu-noble | ok 2026-03-26 09:03:14.527342 | debian-bookworm | included: /var/lib/zuul/builds/5650b1a8161f4cea80b86c8756b9b136/trusted/project_1/github.com/osism/openinfra-zuul-jobs/roles/add-build-sshkey/tasks/remote-linux.yaml 2026-03-26 09:03:14.527446 | ubuntu-noble | included: /var/lib/zuul/builds/5650b1a8161f4cea80b86c8756b9b136/trusted/project_1/github.com/osism/openinfra-zuul-jobs/roles/add-build-sshkey/tasks/remote-linux.yaml 2026-03-26 09:03:14.539813 | 2026-03-26 09:03:14.539950 | TASK [add-build-sshkey : Remove previously added zuul-build-sshkey] 2026-03-26 09:03:14.567745 | debian-bookworm | skipping: Conditional result was False 2026-03-26 09:03:14.599209 | ubuntu-noble | skipping: Conditional result was False 2026-03-26 09:03:14.605375 | 2026-03-26 09:03:14.605509 | TASK [add-build-sshkey : Enable access via build key on all nodes] 2026-03-26 09:03:15.328224 | debian-bookworm | changed 2026-03-26 09:03:15.442192 | ubuntu-noble | changed 2026-03-26 09:03:15.453550 | 2026-03-26 09:03:15.453700 | TASK [add-build-sshkey : Make sure user has a .ssh] 2026-03-26 09:03:15.731641 | debian-bookworm | ok 2026-03-26 09:03:15.778577 | ubuntu-noble | ok 2026-03-26 09:03:15.785648 | 2026-03-26 09:03:15.785807 | TASK [add-build-sshkey : Install build private key as SSH key on all nodes] 2026-03-26 09:03:16.492247 | debian-bookworm | changed 2026-03-26 09:03:16.583894 | ubuntu-noble | changed 2026-03-26 09:03:16.591483 | 2026-03-26 09:03:16.591606 | TASK [add-build-sshkey : Install build public key as SSH key on all nodes] 2026-03-26 09:03:17.313726 | debian-bookworm | changed 2026-03-26 09:03:17.432374 | ubuntu-noble | changed 2026-03-26 09:03:17.438529 | 2026-03-26 09:03:17.438656 | TASK [add-build-sshkey : Remote setup ssh keys (windows)] 2026-03-26 09:03:17.468445 | debian-bookworm | skipping: Conditional result was False 2026-03-26 09:03:17.489783 | ubuntu-noble | skipping: Conditional result was False 2026-03-26 09:03:17.496381 | 2026-03-26 09:03:17.496495 | TASK [remove-zuul-sshkey : Remove master key from local agent] 2026-03-26 09:03:17.930300 | debian-bookworm -> localhost | changed 2026-03-26 09:03:17.950473 | 2026-03-26 09:03:17.950630 | TASK [add-build-sshkey : Add back temp key] 2026-03-26 09:03:18.273836 | debian-bookworm -> localhost | Identity added: /var/lib/zuul/builds/5650b1a8161f4cea80b86c8756b9b136/work/5650b1a8161f4cea80b86c8756b9b136_id_rsa (zuul-build-sshkey) 2026-03-26 09:03:18.274162 | debian-bookworm -> localhost | ok: Runtime: 0:00:00.011383 2026-03-26 09:03:18.281323 | 2026-03-26 09:03:18.281443 | TASK [add-build-sshkey : Verify we can still SSH to all nodes] 2026-03-26 09:03:18.719807 | ubuntu-noble | ok 2026-03-26 09:03:18.747999 | debian-bookworm | ok 2026-03-26 09:03:18.756213 | 2026-03-26 09:03:18.756365 | TASK [add-build-sshkey : Verify we can still SSH to all nodes (windows)] 2026-03-26 09:03:18.785171 | debian-bookworm | skipping: Conditional result was False 2026-03-26 09:03:18.806657 | ubuntu-noble | skipping: Conditional result was False 2026-03-26 09:03:18.830286 | 2026-03-26 09:03:18.830411 | TASK [start-zuul-console : Start zuul_console daemon.] 2026-03-26 09:03:19.275089 | debian-bookworm | ok 2026-03-26 09:03:19.307286 | ubuntu-noble | ok 2026-03-26 09:03:19.327041 | 2026-03-26 09:03:19.327181 | TASK [validate-host : Define zuul_info_dir fact] 2026-03-26 09:03:19.371110 | debian-bookworm | ok 2026-03-26 09:03:19.386773 | ubuntu-noble | ok 2026-03-26 09:03:19.393109 | 2026-03-26 09:03:19.393234 | TASK [validate-host : Ensure Zuul Ansible directory exists] 2026-03-26 09:03:19.923649 | debian-bookworm -> localhost | ok 2026-03-26 09:03:19.930578 | 2026-03-26 09:03:19.930695 | TASK [validate-host : Collect information about the host] 2026-03-26 09:03:21.203354 | debian-bookworm | ok 2026-03-26 09:03:21.328322 | ubuntu-noble | ok 2026-03-26 09:03:21.339800 | 2026-03-26 09:03:21.339928 | TASK [validate-host : Sanitize hostname] 2026-03-26 09:03:21.420699 | debian-bookworm | ok 2026-03-26 09:03:21.465874 | ubuntu-noble | ok 2026-03-26 09:03:21.471471 | 2026-03-26 09:03:21.471600 | TASK [validate-host : Write out all ansible variables/facts known for each host] 2026-03-26 09:03:22.810098 | ubuntu-noble -> localhost | changed 2026-03-26 09:03:22.884053 | debian-bookworm -> localhost | changed 2026-03-26 09:03:22.912986 | 2026-03-26 09:03:22.913133 | TASK [validate-host : Collect information about zuul worker] 2026-03-26 09:03:23.777566 | ubuntu-noble | ok 2026-03-26 09:03:23.784423 | debian-bookworm | ok 2026-03-26 09:03:23.790994 | 2026-03-26 09:03:23.791112 | TASK [validate-host : Write out all zuul information for each host] 2026-03-26 09:03:24.841484 | ubuntu-noble -> localhost | changed 2026-03-26 09:03:24.873709 | debian-bookworm -> localhost | changed 2026-03-26 09:03:24.888575 | 2026-03-26 09:03:24.888715 | TASK [prepare-workspace-log : Start zuul_console daemon.] 2026-03-26 09:03:25.218649 | debian-bookworm | ok 2026-03-26 09:03:25.276912 | ubuntu-noble | ok 2026-03-26 09:03:25.283041 | 2026-03-26 09:03:25.283158 | TASK [prepare-workspace-log : Synchronize src repos to workspace directory.] 2026-03-26 09:03:26.688848 | ubuntu-noble | changed: 2026-03-26 09:03:26.689028 | ubuntu-noble | cd+++++++++ src/ 2026-03-26 09:03:26.689060 | ubuntu-noble | cd+++++++++ src/github.com/ 2026-03-26 09:03:26.689081 | ubuntu-noble | cd+++++++++ src/github.com/osism/ 2026-03-26 09:03:26.689100 | ubuntu-noble | cd+++++++++ src/github.com/osism/ansible-collection-services/ 2026-03-26 09:03:26.689365 | ubuntu-noble | config] provisioner.env found in /home/zuul/src/github.com/osism/ansible-collection-services/molecule/delegated/molecule.yml, this can be defined in ansible.env 2026-03-26 09:04:44.514401 | debian-bookworm | WARNING Molecule scenarios should migrate to 'extensions/molecule' 2026-03-26 09:04:44.543752 | debian-bookworm | DEBUG [unknown > config] provisioner.env found in /home/zuul/src/github.com/osism/ansible-collection-services/molecule/delegated/molecule.yml, this can be defined in ansible.env 2026-03-26 09:04:45.230133 | ubuntu-noble | DEBUG [unknown > config] provisioner.env found in /home/zuul/src/github.com/osism/ansible-collection-services/molecule/delegated/molecule.yml, this can be defined in ansible.env 2026-03-26 09:04:45.230262 | ubuntu-noble | DEBUG [delegated > validate] Validating schema /home/zuul/src/github.com/osism/ansible-collection-services/molecule/delegated/molecule.yml. 2026-03-26 09:04:45.243192 | ubuntu-noble | CRITICAL 'molecule/default/molecule.yml' glob failed. Exiting. 2026-03-26 09:04:45.243411 | ubuntu-noble | INFO default scenario not found, disabling shared state. 2026-03-26 09:04:45.243842 | ubuntu-noble | INFO [delegated > discovery] scenario test matrix: dependency 2026-03-26 09:04:45.244043 | ubuntu-noble | INFO [delegated > prerun] Performing prerun with role_name_check=0... 2026-03-26 09:04:45.185735 | debian-bookworm | DEBUG [unknown > config] provisioner.env found in /home/zuul/src/github.com/osism/ansible-collection-services/molecule/delegated/molecule.yml, this can be defined in ansible.env 2026-03-26 09:04:45.186370 | debian-bookworm | DEBUG [delegated > validate] Validating schema /home/zuul/src/github.com/osism/ansible-collection-services/molecule/delegated/molecule.yml. 2026-03-26 09:04:45.197600 | debian-bookworm | CRITICAL 'molecule/default/molecule.yml' glob failed. Exiting. 2026-03-26 09:04:45.197682 | debian-bookworm | INFO default scenario not found, disabling shared state. 2026-03-26 09:04:45.197888 | debian-bookworm | INFO [delegated > discovery] scenario test matrix: dependency 2026-03-26 09:04:45.198039 | debian-bookworm | INFO [delegated > prerun] Performing prerun with role_name_check=0... 2026-03-26 09:04:46.645228 | ubuntu-noble | INFO [delegated > dependency] Executing 2026-03-26 09:04:46.645948 | ubuntu-noble | WARNING [delegated > dependency] Missing roles requirements file: requirements.yml 2026-03-26 09:04:46.442087 | debian-bookworm | INFO [delegated > dependency] Executing 2026-03-26 09:04:46.442467 | debian-bookworm | WARNING [delegated > dependency] Missing roles requirements file: requirements.yml 2026-03-26 09:04:46.808326 | debian-bookworm | ansible-galaxy [core 2.18.15] 2026-03-26 09:04:46.808833 | debian-bookworm | config file = None 2026-03-26 09:04:46.809248 | debian-bookworm | configured module search path = ['/home/zuul/src/github.com/osism/ansible-collection-services/plugins/modules', '/home/zuul/.ansible/plugins/modules', '/usr/share/ansible/plugins/modules'] 2026-03-26 09:04:46.809737 | debian-bookworm | ansible python module location = /home/zuul/venv/lib/python3.11/site-packages/ansible 2026-03-26 09:04:46.810141 | debian-bookworm | ansible collection location = /home/zuul/.ansible/collections:/usr/share/ansible/collections:/home/zuul/venv/lib/python3.11/site-packages:/home/zuul/venv/lib/python3.11/dist-packages:/home/zuul/venv/lib/python3/dist-packages:/home/zuul/venv/local/lib/python3.11/dist-packages 2026-03-26 09:04:46.810471 | debian-bookworm | executable location = /home/zuul/venv/bin/ansible-galaxy 2026-03-26 09:04:46.810846 | debian-bookworm | python version = 3.11.2 (main, Apr 28 2025, 14:11:48) [GCC 12.2.0] (/home/zuul/venv/bin/python3) 2026-03-26 09:04:46.811195 | debian-bookworm | jinja version = 3.1.6 2026-03-26 09:04:46.811502 | debian-bookworm | libyaml = True 2026-03-26 09:04:46.811792 | debian-bookworm | No config file found; using defaults 2026-03-26 09:04:46.812306 | debian-bookworm | Reading requirement file at '/home/zuul/src/github.com/osism/ansible-collection-services/molecule/delegated/collections.yml' 2026-03-26 09:04:46.813748 | debian-bookworm | Loading collection microsoft.iis from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/microsoft/iis 2026-03-26 09:04:46.814246 | debian-bookworm | Found installed collection microsoft.iis:1.0.3 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/microsoft/iis' 2026-03-26 09:04:46.814647 | debian-bookworm | Loading collection lowlydba.sqlserver from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/lowlydba/sqlserver 2026-03-26 09:04:46.815024 | debian-bookworm | Found installed collection lowlydba.sqlserver:2.7.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/lowlydba/sqlserver' 2026-03-26 09:04:46.815375 | debian-bookworm | Loading collection hitachivantara.vspone_object from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/hitachivantara/vspone_object 2026-03-26 09:04:46.815756 | debian-bookworm | Found installed collection hitachivantara.vspone_object:1.0.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/hitachivantara/vspone_object' 2026-03-26 09:04:46.816156 | debian-bookworm | Loading collection ansible.utils from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/ansible/utils 2026-03-26 09:04:46.816522 | debian-bookworm | Found installed collection ansible.utils:5.1.2 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/ansible/utils' 2026-03-26 09:04:46.816853 | debian-bookworm | Loading collection kubevirt.core from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/kubevirt/core 2026-03-26 09:04:46.817190 | debian-bookworm | Found installed collection kubevirt.core:2.2.3 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/kubevirt/core' 2026-03-26 09:04:46.819146 | debian-bookworm | Loading collection ansible.netcommon from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/ansible/netcommon 2026-03-26 09:04:46.819725 | debian-bookworm | Found installed collection ansible.netcommon:7.2.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/ansible/netcommon' 2026-03-26 09:04:46.820132 | debian-bookworm | Loading collection community.windows from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/windows 2026-03-26 09:04:46.820604 | debian-bookworm | Found installed collection community.windows:2.4.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/windows' 2026-03-26 09:04:46.821006 | debian-bookworm | Loading collection openstack.cloud from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/openstack/cloud 2026-03-26 09:04:46.821391 | debian-bookworm | Found installed collection openstack.cloud:2.5.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/openstack/cloud' 2026-03-26 09:04:46.822398 | debian-bookworm | Loading collection netapp.ontap from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/netapp/ontap 2026-03-26 09:04:46.822844 | debian-bookworm | Found installed collection netapp.ontap:22.14.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/netapp/ontap' 2026-03-26 09:04:46.823852 | debian-bookworm | Loading collection community.digitalocean from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/digitalocean 2026-03-26 09:04:46.824316 | debian-bookworm | Found installed collection community.digitalocean:1.27.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/digitalocean' 2026-03-26 09:04:46.824723 | debian-bookworm | Loading collection netapp.cloudmanager from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/netapp/cloudmanager 2026-03-26 09:04:46.825100 | debian-bookworm | Found installed collection netapp.cloudmanager:21.24.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/netapp/cloudmanager' 2026-03-26 09:04:46.825556 | debian-bookworm | Loading collection dellemc.powerflex from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/dellemc/powerflex 2026-03-26 09:04:46.825951 | debian-bookworm | Found installed collection dellemc.powerflex:2.6.1 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/dellemc/powerflex' 2026-03-26 09:04:46.827466 | debian-bookworm | Loading collection community.vmware from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/vmware 2026-03-26 09:04:46.827983 | debian-bookworm | Found installed collection community.vmware:5.10.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/vmware' 2026-03-26 09:04:46.831218 | debian-bookworm | Loading collection fortinet.fortios from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/fortinet/fortios 2026-03-26 09:04:46.831624 | debian-bookworm | Found installed collection fortinet.fortios:2.4.2 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/fortinet/fortios' 2026-03-26 09:04:46.832048 | debian-bookworm | Loading collection community.mysql from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/mysql 2026-03-26 09:04:46.832408 | debian-bookworm | Found installed collection community.mysql:3.16.1 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/mysql' 2026-03-26 09:04:46.832822 | debian-bookworm | Loading collection dellemc.openmanage from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/dellemc/openmanage 2026-03-26 09:04:46.833204 | debian-bookworm | Found installed collection dellemc.openmanage:9.12.3 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/dellemc/openmanage' 2026-03-26 09:04:46.833636 | debian-bookworm | Loading collection cisco.ise from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/cisco/ise 2026-03-26 09:04:46.834016 | debian-bookworm | Found installed collection cisco.ise:2.10.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/cisco/ise' 2026-03-26 09:04:46.834390 | debian-bookworm | Loading collection check_point.mgmt from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/check_point/mgmt 2026-03-26 09:04:46.834796 | debian-bookworm | Found installed collection check_point.mgmt:6.6.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/check_point/mgmt' 2026-03-26 09:04:46.835173 | debian-bookworm | Loading collection community.docker from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/docker 2026-03-26 09:04:46.835563 | debian-bookworm | Found installed collection community.docker:4.8.2 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/docker' 2026-03-26 09:04:46.837356 | debian-bookworm | Loading collection cisco.meraki from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/cisco/meraki 2026-03-26 09:04:46.837800 | debian-bookworm | Found installed collection cisco.meraki:2.21.8 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/cisco/meraki' 2026-03-26 09:04:46.838432 | debian-bookworm | Loading collection dellemc.enterprise_sonic from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/dellemc/enterprise_sonic 2026-03-26 09:04:46.838794 | debian-bookworm | Found installed collection dellemc.enterprise_sonic:2.5.1 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/dellemc/enterprise_sonic' 2026-03-26 09:04:46.839128 | debian-bookworm | Loading collection community.grafana from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/grafana 2026-03-26 09:04:46.839469 | debian-bookworm | Found installed collection community.grafana:2.3.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/grafana' 2026-03-26 09:04:46.840267 | debian-bookworm | Loading collection ovirt.ovirt from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/ovirt/ovirt 2026-03-26 09:04:46.840654 | debian-bookworm | Found installed collection ovirt.ovirt:3.2.1 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/ovirt/ovirt' 2026-03-26 09:04:46.840985 | debian-bookworm | Loading collection containers.podman from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/containers/podman 2026-03-26 09:04:46.841319 | debian-bookworm | Found installed collection containers.podman:1.18.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/containers/podman' 2026-03-26 09:04:46.841668 | debian-bookworm | Loading collection community.dns from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/dns 2026-03-26 09:04:46.842001 | debian-bookworm | Found installed collection community.dns:3.4.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/dns' 2026-03-26 09:04:46.842972 | debian-bookworm | Loading collection junipernetworks.junos from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/junipernetworks/junos 2026-03-26 09:04:46.843246 | debian-bookworm | Found installed collection junipernetworks.junos:9.1.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/junipernetworks/junos' 2026-03-26 09:04:46.843674 | debian-bookworm | Loading collection cloud.common from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/cloud/common 2026-03-26 09:04:46.844078 | debian-bookworm | Found installed collection cloud.common:4.2.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/cloud/common' 2026-03-26 09:04:46.844414 | debian-bookworm | Loading collection community.hashi_vault from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/hashi_vault 2026-03-26 09:04:46.844742 | debian-bookworm | Found installed collection community.hashi_vault:6.2.1 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/hashi_vault' 2026-03-26 09:04:46.845057 | debian-bookworm | Loading collection community.rabbitmq from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/rabbitmq 2026-03-26 09:04:46.845441 | debian-bookworm | Found installed collection community.rabbitmq:1.6.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/rabbitmq' 2026-03-26 09:04:46.851913 | debian-bookworm | Loading collection fortinet.fortimanager from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/fortinet/fortimanager 2026-03-26 09:04:46.858874 | debian-bookworm | Found installed collection fortinet.fortimanager:2.11.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/fortinet/fortimanager' 2026-03-26 09:04:46.883966 | debian-bookworm | Loading collection google.cloud from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/google/cloud 2026-03-26 09:04:46.884014 | debian-bookworm | Found installed collection google.cloud:1.9.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/google/cloud' 2026-03-26 09:04:46.884020 | debian-bookworm | Loading collection ravendb.ravendb from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/ravendb/ravendb 2026-03-26 09:04:46.884024 | debian-bookworm | Found installed collection ravendb.ravendb:1.0.4 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/ravendb/ravendb' 2026-03-26 09:04:46.884029 | debian-bookworm | Loading collection kaytus.ksmanage from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/kaytus/ksmanage 2026-03-26 09:04:46.884033 | debian-bookworm | Found installed collection kaytus.ksmanage:2.0.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/kaytus/ksmanage' 2026-03-26 09:04:46.884037 | debian-bookworm | Loading collection community.ciscosmb from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/ciscosmb 2026-03-26 09:04:46.884041 | debian-bookworm | Found installed collection community.ciscosmb:1.0.11 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/ciscosmb' 2026-03-26 09:04:46.884045 | debian-bookworm | Loading collection netbox.netbox from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/netbox/netbox 2026-03-26 09:04:46.884049 | debian-bookworm | Found installed collection netbox.netbox:3.21.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/netbox/netbox' 2026-03-26 09:04:46.884054 | debian-bookworm | Loading collection chocolatey.chocolatey from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/chocolatey/chocolatey 2026-03-26 09:04:46.884058 | debian-bookworm | Found installed collection chocolatey.chocolatey:1.5.3 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/chocolatey/chocolatey' 2026-03-26 09:04:46.884062 | debian-bookworm | Loading collection community.zabbix from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/zabbix 2026-03-26 09:04:46.884066 | debian-bookworm | Found installed collection community.zabbix:3.3.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/zabbix' 2026-03-26 09:04:46.884070 | debian-bookworm | Loading collection community.postgresql from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/postgresql 2026-03-26 09:04:46.884074 | debian-bookworm | Found installed collection community.postgresql:3.14.2 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/postgresql' 2026-03-26 09:04:46.884079 | debian-bookworm | Loading collection hetzner.hcloud from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/hetzner/hcloud 2026-03-26 09:04:46.884082 | debian-bookworm | Found installed collection hetzner.hcloud:4.3.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/hetzner/hcloud' 2026-03-26 09:04:46.884086 | debian-bookworm | Loading collection purestorage.flashblade from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/purestorage/flashblade 2026-03-26 09:04:46.884090 | debian-bookworm | Found installed collection purestorage.flashblade:1.22.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/purestorage/flashblade' 2026-03-26 09:04:46.884095 | debian-bookworm | Loading collection amazon.aws from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/amazon/aws 2026-03-26 09:04:46.884104 | debian-bookworm | Found installed collection amazon.aws:9.5.2 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/amazon/aws' 2026-03-26 09:04:46.884108 | debian-bookworm | Loading collection community.proxmox from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/proxmox 2026-03-26 09:04:46.884112 | debian-bookworm | Found installed collection community.proxmox:1.4.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/proxmox' 2026-03-26 09:04:46.884116 | debian-bookworm | Loading collection ngine_io.cloudstack from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/ngine_io/cloudstack 2026-03-26 09:04:46.884120 | debian-bookworm | Found installed collection ngine_io.cloudstack:2.5.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/ngine_io/cloudstack' 2026-03-26 09:04:46.884124 | debian-bookworm | Loading collection cisco.dnac from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/cisco/dnac 2026-03-26 09:04:46.884132 | debian-bookworm | Found installed collection cisco.dnac:6.31.3 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/cisco/dnac' 2026-03-26 09:04:46.884136 | debian-bookworm | Loading collection telekom_mms.icinga_director from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/telekom_mms/icinga_director 2026-03-26 09:04:46.884140 | debian-bookworm | Found installed collection telekom_mms.icinga_director:2.4.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/telekom_mms/icinga_director' 2026-03-26 09:04:46.884144 | debian-bookworm | Loading collection cisco.asa from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/cisco/asa 2026-03-26 09:04:46.884154 | debian-bookworm | Found installed collection cisco.asa:6.1.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/cisco/asa' 2026-03-26 09:04:46.884158 | debian-bookworm | Loading collection ansible.windows from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/ansible/windows 2026-03-26 09:04:46.884162 | debian-bookworm | Found installed collection ansible.windows:2.8.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/ansible/windows' 2026-03-26 09:04:47.051846 | ubuntu-noble | ansible-galaxy [core 2.18.15] 2026-03-26 09:04:47.052716 | ubuntu-noble | config file = None 2026-03-26 09:04:47.053408 | ubuntu-noble | configured module search path = ['/home/zuul/src/github.com/osism/ansible-collection-services/plugins/modules', '/home/zuul/.ansible/plugins/modules', '/usr/share/ansible/plugins/modules'] 2026-03-26 09:04:47.056127 | ubuntu-noble | ansible python module location = /home/zuul/venv/lib/python3.12/site-packages/ansible 2026-03-26 09:04:47.056231 | ubuntu-noble | ansible collection location = /home/zuul/.ansible/collections:/usr/share/ansible/collections:/home/zuul/venv/lib/python3.12/site-packages:/home/zuul/venv/lib/python3.12/dist-packages:/home/zuul/venv/lib/python3/dist-packages:/home/zuul/venv/local/lib/python3.12/dist-packages 2026-03-26 09:04:47.056253 | ubuntu-noble | executable location = /home/zuul/venv/bin/ansible-galaxy 2026-03-26 09:04:47.056264 | ubuntu-noble | python version = 3.12.3 (main, Mar 3 2026, 12:15:18) [GCC 13.3.0] (/home/zuul/venv/bin/python3) 2026-03-26 09:04:47.056530 | ubuntu-noble | jinja version = 3.1.6 2026-03-26 09:04:47.057318 | ubuntu-noble | libyaml = True 2026-03-26 09:04:47.057969 | ubuntu-noble | No config file found; using defaults 2026-03-26 09:04:47.058886 | ubuntu-noble | Reading requirement file at '/home/zuul/src/github.com/osism/ansible-collection-services/molecule/delegated/collections.yml' 2026-03-26 09:04:47.063432 | ubuntu-noble | Loading collection dellemc.unity from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/dellemc/unity 2026-03-26 09:04:47.063975 | ubuntu-noble | Found installed collection dellemc.unity:2.1.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/dellemc/unity' 2026-03-26 09:04:47.064338 | ubuntu-noble | Loading collection purestorage.flasharray from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/purestorage/flasharray 2026-03-26 09:04:47.064786 | ubuntu-noble | Found installed collection purestorage.flasharray:1.39.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/purestorage/flasharray' 2026-03-26 09:04:47.065201 | ubuntu-noble | Loading collection netbox.netbox from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/netbox/netbox 2026-03-26 09:04:47.065580 | ubuntu-noble | Found installed collection netbox.netbox:3.21.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/netbox/netbox' 2026-03-26 09:04:47.065900 | ubuntu-noble | Loading collection infinidat.infinibox from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/infinidat/infinibox 2026-03-26 09:04:47.066310 | ubuntu-noble | Found installed collection infinidat.infinibox:1.6.3 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/infinidat/infinibox' 2026-03-26 09:04:47.066630 | ubuntu-noble | Loading collection sensu.sensu_go from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/sensu/sensu_go 2026-03-26 09:04:47.066993 | ubuntu-noble | Found installed collection sensu.sensu_go:1.14.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/sensu/sensu_go' 2026-03-26 09:04:47.067322 | ubuntu-noble | Loading collection community.libvirt from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/libvirt 2026-03-26 09:04:47.067747 | ubuntu-noble | Found installed collection community.libvirt:1.4.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/libvirt' 2026-03-26 09:04:47.068210 | ubuntu-noble | Loading collection community.hashi_vault from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/hashi_vault 2026-03-26 09:04:47.068550 | ubuntu-noble | Found installed collection community.hashi_vault:6.2.1 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/hashi_vault' 2026-03-26 09:04:47.068852 | ubuntu-noble | Loading collection infoblox.nios_modules from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/infoblox/nios_modules 2026-03-26 09:04:47.069173 | ubuntu-noble | Found installed collection infoblox.nios_modules:1.8.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/infoblox/nios_modules' 2026-03-26 09:04:47.069588 | ubuntu-noble | Loading collection ansible.utils from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/ansible/utils 2026-03-26 09:04:47.069907 | ubuntu-noble | Found installed collection ansible.utils:5.1.2 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/ansible/utils' 2026-03-26 09:04:47.070208 | ubuntu-noble | Loading collection community.okd from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/okd 2026-03-26 09:04:47.070495 | ubuntu-noble | Found installed collection community.okd:4.0.2 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/okd' 2026-03-26 09:04:47.070790 | ubuntu-noble | Loading collection cisco.intersight from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/cisco/intersight 2026-03-26 09:04:47.071175 | ubuntu-noble | Found installed collection cisco.intersight:2.7.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/cisco/intersight' 2026-03-26 09:04:47.071500 | ubuntu-noble | Loading collection kaytus.ksmanage from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/kaytus/ksmanage 2026-03-26 09:04:47.071865 | ubuntu-noble | Found installed collection kaytus.ksmanage:2.0.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/kaytus/ksmanage' 2026-03-26 09:04:47.072172 | ubuntu-noble | Loading collection cisco.ucs from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/cisco/ucs 2026-03-26 09:04:47.072458 | ubuntu-noble | Found installed collection cisco.ucs:1.16.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/cisco/ucs' 2026-03-26 09:04:47.072759 | ubuntu-noble | Loading collection community.docker from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/docker 2026-03-26 09:04:47.073205 | ubuntu-noble | Found installed collection community.docker:4.8.2 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/docker' 2026-03-26 09:04:47.073491 | ubuntu-noble | Loading collection google.cloud from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/google/cloud 2026-03-26 09:04:47.073783 | ubuntu-noble | Found installed collection google.cloud:1.9.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/google/cloud' 2026-03-26 09:04:47.074135 | ubuntu-noble | Loading collection community.mysql from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/mysql 2026-03-26 09:04:47.074672 | ubuntu-noble | Found installed collection community.mysql:3.16.1 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/mysql' 2026-03-26 09:04:47.077122 | ubuntu-noble | Loading collection cisco.ios from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/cisco/ios 2026-03-26 09:04:47.077159 | ubuntu-noble | Found installed collection cisco.ios:9.2.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/cisco/ios' 2026-03-26 09:04:47.077168 | ubuntu-noble | Loading collection community.grafana from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/grafana 2026-03-26 09:04:47.077176 | ubuntu-noble | Found installed collection community.grafana:2.3.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/grafana' 2026-03-26 09:04:47.077202 | ubuntu-noble | Loading collection cisco.ise from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/cisco/ise 2026-03-26 09:04:47.077212 | ubuntu-noble | Found installed collection cisco.ise:2.10.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/cisco/ise' 2026-03-26 09:04:47.077220 | ubuntu-noble | Loading collection microsoft.iis from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/microsoft/iis 2026-03-26 09:04:47.077525 | ubuntu-noble | Found installed collection microsoft.iis:1.0.3 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/microsoft/iis' 2026-03-26 09:04:47.077866 | ubuntu-noble | Loading collection dellemc.powerflex from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/dellemc/powerflex 2026-03-26 09:04:47.078203 | ubuntu-noble | Found installed collection dellemc.powerflex:2.6.1 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/dellemc/powerflex' 2026-03-26 09:04:47.078581 | ubuntu-noble | Loading collection netapp.ontap from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/netapp/ontap 2026-03-26 09:04:47.078930 | ubuntu-noble | Found installed collection netapp.ontap:22.14.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/netapp/ontap' 2026-03-26 09:04:47.079239 | ubuntu-noble | Loading collection chocolatey.chocolatey from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/chocolatey/chocolatey 2026-03-26 09:04:47.079523 | ubuntu-noble | Found installed collection chocolatey.chocolatey:1.5.3 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/chocolatey/chocolatey' 2026-03-26 09:04:47.079958 | ubuntu-noble | Loading collection splunk.es from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/splunk/es 2026-03-26 09:04:47.080270 | ubuntu-noble | Found installed collection splunk.es:4.0.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/splunk/es' 2026-03-26 09:04:47.080693 | ubuntu-noble | Loading collection amazon.aws from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/amazon/aws 2026-03-26 09:04:47.081083 | ubuntu-noble | Found installed collection amazon.aws:9.5.2 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/amazon/aws' 2026-03-26 09:04:47.084105 | ubuntu-noble | Loading collection vmware.vmware_rest from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/vmware/vmware_rest 2026-03-26 09:04:47.084793 | ubuntu-noble | Found installed collection vmware.vmware_rest:4.9.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/vmware/vmware_rest' 2026-03-26 09:04:47.086164 | ubuntu-noble | Loading collection azure.azcollection from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/azure/azcollection 2026-03-26 09:04:47.086774 | ubuntu-noble | Found installed collection azure.azcollection:3.10.1 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/azure/azcollection' 2026-03-26 09:04:47.107106 | ubuntu-noble | Loading collection fortinet.fortimanager from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/fortinet/fortimanager 2026-03-26 09:04:47.107760 | ubuntu-noble | Found installed collection fortinet.fortimanager:2.11.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/fortinet/fortimanager' 2026-03-26 09:04:47.108200 | ubuntu-noble | Loading collection netapp_eseries.santricity from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/netapp_eseries/santricity 2026-03-26 09:04:47.108741 | ubuntu-noble | Found installed collection netapp_eseries.santricity:1.4.1 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/netapp_eseries/santricity' 2026-03-26 09:04:47.109148 | ubuntu-noble | Loading collection community.mongodb from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/mongodb 2026-03-26 09:04:47.109535 | ubuntu-noble | Found installed collection community.mongodb:1.7.10 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/mongodb' 2026-03-26 09:04:47.110029 | ubuntu-noble | Loading collection ravendb.ravendb from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/ravendb/ravendb 2026-03-26 09:04:47.110530 | ubuntu-noble | Found installed collection ravendb.ravendb:1.0.4 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/ravendb/ravendb' 2026-03-26 09:04:47.110960 | ubuntu-noble | Loading collection netapp.storagegrid from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/netapp/storagegrid 2026-03-26 09:04:47.111354 | ubuntu-noble | Found installed collection netapp.storagegrid:21.14.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/netapp/storagegrid' 2026-03-26 09:04:47.111740 | ubuntu-noble | Loading collection microsoft.ad from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/microsoft/ad 2026-03-26 09:04:47.112168 | ubuntu-noble | Found installed collection microsoft.ad:1.9.2 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/microsoft/ad' 2026-03-26 09:04:47.112531 | ubuntu-noble | Loading collection f5networks.f5_modules from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/f5networks/f5_modules 2026-03-26 09:04:47.114097 | ubuntu-noble | Found installed collection f5networks.f5_modules:1.39.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/f5networks/f5_modules' 2026-03-26 09:04:47.114126 | ubuntu-noble | Loading collection hetzner.hcloud from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/hetzner/hcloud 2026-03-26 09:04:47.114136 | ubuntu-noble | Found installed collection hetzner.hcloud:4.3.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/hetzner/hcloud' 2026-03-26 09:04:47.114145 | ubuntu-noble | Loading collection cisco.iosxr from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/cisco/iosxr 2026-03-26 09:04:47.114347 | ubuntu-noble | Found installed collection cisco.iosxr:10.3.1 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/cisco/iosxr' 2026-03-26 09:04:47.114713 | ubuntu-noble | Loading collection cloud.common from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/cloud/common 2026-03-26 09:04:47.115028 | ubuntu-noble | Found installed collection cloud.common:4.2.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/cloud/common' 2026-03-26 09:04:47.115312 | ubuntu-noble | Loading collection cyberark.conjur from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/cyberark/conjur 2026-03-26 09:04:47.115658 | ubuntu-noble | Found installed collection cyberark.conjur:1.3.8 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/cyberark/conjur' 2026-03-26 09:04:47.115914 | ubuntu-noble | Loading collection junipernetworks.junos from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/junipernetworks/junos 2026-03-26 09:04:47.116187 | ubuntu-noble | Found installed collection junipernetworks.junos:9.1.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/junipernetworks/junos' 2026-03-26 09:04:47.116517 | ubuntu-noble | Loading collection community.proxysql from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/proxysql 2026-03-26 09:04:47.116793 | ubuntu-noble | Found installed collection community.proxysql:1.7.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/proxysql' 2026-03-26 09:04:47.117040 | ubuntu-noble | Loading collection community.routeros from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/routeros 2026-03-26 09:04:47.117368 | ubuntu-noble | Found installed collection community.routeros:3.13.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/routeros' 2026-03-26 09:04:47.117671 | ubuntu-noble | Loading collection telekom_mms.icinga_director from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/telekom_mms/icinga_director 2026-03-26 09:04:47.117929 | ubuntu-noble | Found installed collection telekom_mms.icinga_director:2.4.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/telekom_mms/icinga_director' 2026-03-26 09:04:47.118246 | ubuntu-noble | Loading collection netapp.cloudmanager from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/netapp/cloudmanager 2026-03-26 09:04:47.118469 | ubuntu-noble | Found installed collection netapp.cloudmanager:21.24.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/netapp/cloudmanager' 2026-03-26 09:04:47.119292 | ubuntu-noble | Loading collection community.vmware from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/vmware 2026-03-26 09:04:47.119581 | ubuntu-noble | Found installed collection community.vmware:5.10.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/vmware' 2026-03-26 09:04:47.123192 | ubuntu-noble | Loading collection community.aws from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/aws 2026-03-26 09:04:47.123503 | ubuntu-noble | Found installed collection community.aws:9.3.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/aws' 2026-03-26 09:04:47.124167 | ubuntu-noble | Loading collection ngine_io.cloudstack from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/ngine_io/cloudstack 2026-03-26 09:04:47.124473 | ubuntu-noble | Found installed collection ngine_io.cloudstack:2.5.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/ngine_io/cloudstack' 2026-03-26 09:04:47.125090 | ubuntu-noble | Loading collection ovirt.ovirt from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/ovirt/ovirt 2026-03-26 09:04:47.125450 | ubuntu-noble | Found installed collection ovirt.ovirt:3.2.1 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/ovirt/ovirt' 2026-03-26 09:04:47.125829 | ubuntu-noble | Loading collection ansible.windows from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/ansible/windows 2026-03-26 09:04:47.126138 | ubuntu-noble | Found installed collection ansible.windows:2.8.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/ansible/windows' 2026-03-26 09:04:47.126358 | ubuntu-noble | Loading collection ibm.storage_virtualize from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/ibm/storage_virtualize 2026-03-26 09:04:47.126668 | ubuntu-noble | Found installed collection ibm.storage_virtualize:2.7.4 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/ibm/storage_virtualize' 2026-03-26 09:04:47.127015 | ubuntu-noble | Loading collection community.sap_libs from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/sap_libs 2026-03-26 09:04:47.127354 | ubuntu-noble | Found installed collection community.sap_libs:1.5.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/sap_libs' 2026-03-26 09:04:47.128086 | ubuntu-noble | Loading collection ibm.qradar from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/ibm/qradar 2026-03-26 09:04:47.128106 | ubuntu-noble | Found installed collection ibm.qradar:4.0.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/ibm/qradar' 2026-03-26 09:04:47.128114 | ubuntu-noble | Loading collection ibm.spectrum_virtualize from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/ibm/spectrum_virtualize 2026-03-26 09:04:47.128375 | ubuntu-noble | Found installed collection ibm.spectrum_virtualize:2.0.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/ibm/spectrum_virtualize' 2026-03-26 09:04:47.128701 | ubuntu-noble | Loading collection community.rabbitmq from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/rabbitmq 2026-03-26 09:04:47.128949 | ubuntu-noble | Found installed collection community.rabbitmq:1.6.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/rabbitmq' 2026-03-26 09:04:47.130148 | ubuntu-noble | Loading collection cisco.mso from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/cisco/mso 2026-03-26 09:04:47.130486 | ubuntu-noble | Found installed collection cisco.mso:2.11.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/cisco/mso' 2026-03-26 09:04:47.131261 | ubuntu-noble | Loading collection kubernetes.core from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/kubernetes/core 2026-03-26 09:04:47.131568 | ubuntu-noble | Found installed collection kubernetes.core:5.4.1 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/kubernetes/core' 2026-03-26 09:04:47.132743 | ubuntu-noble | Loading collection ansible.netcommon from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/ansible/netcommon 2026-03-26 09:04:47.133013 | ubuntu-noble | Found installed collection ansible.netcommon:7.2.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/ansible/netcommon' 2026-03-26 09:04:47.134884 | ubuntu-noble | Loading collection cisco.meraki from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/cisco/meraki 2026-03-26 09:04:47.135208 | ubuntu-noble | Found installed collection cisco.meraki:2.21.8 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/cisco/meraki' 2026-03-26 09:04:47.135719 | ubuntu-noble | Loading collection community.ciscosmb from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/ciscosmb 2026-03-26 09:04:47.135732 | ubuntu-noble | Found installed collection community.ciscosmb:1.0.11 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/ciscosmb' 2026-03-26 09:04:47.137134 | ubuntu-noble | Loading collection community.postgresql from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/postgresql 2026-03-26 09:04:47.137158 | ubuntu-noble | Found installed collection community.postgresql:3.14.2 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/postgresql' 2026-03-26 09:04:47.137164 | ubuntu-noble | Loading collection community.proxmox from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/proxmox 2026-03-26 09:04:47.137169 | ubuntu-noble | Found installed collection community.proxmox:1.4.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/proxmox' 2026-03-26 09:04:47.137652 | ubuntu-noble | Loading collection dellemc.enterprise_sonic from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/dellemc/enterprise_sonic 2026-03-26 09:04:47.137886 | ubuntu-noble | Found installed collection dellemc.enterprise_sonic:2.5.1 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/dellemc/enterprise_sonic' 2026-03-26 09:04:47.138559 | ubuntu-noble | Loading collection community.hrobot from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/hrobot 2026-03-26 09:04:47.138588 | ubuntu-noble | Found installed collection community.hrobot:2.7.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/hrobot' 2026-03-26 09:04:47.139338 | ubuntu-noble | Loading collection vultr.cloud from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/vultr/cloud 2026-03-26 09:04:47.139369 | ubuntu-noble | Found installed collection vultr.cloud:1.13.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/vultr/cloud' 2026-03-26 09:04:47.140461 | ubuntu-noble | Loading collection vyos.vyos from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/vyos/vyos 2026-03-26 09:04:47.140483 | ubuntu-noble | Found installed collection vyos.vyos:5.0.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/vyos/vyos' 2026-03-26 09:04:47.140708 | ubuntu-noble | Loading collection community.zabbix from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/zabbix 2026-03-26 09:04:47.140989 | ubuntu-noble | Found installed collection community.zabbix:3.3.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/zabbix' 2026-03-26 09:04:47.141657 | ubuntu-noble | Loading collection openstack.cloud from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/openstack/cloud 2026-03-26 09:04:47.141954 | ubuntu-noble | Found installed collection openstack.cloud:2.5.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/openstack/cloud' 2026-03-26 09:04:47.142712 | ubuntu-noble | Loading collection cloudscale_ch.cloud from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/cloudscale_ch/cloud 2026-03-26 09:04:47.143018 | ubuntu-noble | Found installed collection cloudscale_ch.cloud:2.5.2 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/cloudscale_ch/cloud' 2026-03-26 09:04:47.143242 | ubuntu-noble | Loading collection cisco.dnac from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/cisco/dnac 2026-03-26 09:04:47.143444 | ubuntu-noble | Found installed collection cisco.dnac:6.31.3 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/cisco/dnac' 2026-03-26 09:04:47.143784 | ubuntu-noble | Loading collection ieisystem.inmanage from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/ieisystem/inmanage 2026-03-26 09:04:47.144037 | ubuntu-noble | Found installed collection ieisystem.inmanage:3.0.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/ieisystem/inmanage' 2026-03-26 09:04:47.144846 | ubuntu-noble | Loading collection dellemc.openmanage from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/dellemc/openmanage 2026-03-26 09:04:47.145162 | ubuntu-noble | Found installed collection dellemc.openmanage:9.12.3 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/dellemc/openmanage' 2026-03-26 09:04:47.145434 | ubuntu-noble | Loading collection inspur.ispim from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/inspur/ispim 2026-03-26 09:04:47.145827 | ubuntu-noble | Found installed collection inspur.ispim:2.2.3 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/inspur/ispim' 2026-03-26 09:04:47.146100 | ubuntu-noble | Loading collection lowlydba.sqlserver from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/lowlydba/sqlserver 2026-03-26 09:04:47.146349 | ubuntu-noble | Found installed collection lowlydba.sqlserver:2.7.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/lowlydba/sqlserver' 2026-03-26 09:04:47.146952 | ubuntu-noble | Loading collection hitachivantara.vspone_block from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/hitachivantara/vspone_block 2026-03-26 09:04:47.147182 | ubuntu-noble | Found installed collection hitachivantara.vspone_block:3.5.1 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/hitachivantara/vspone_block' 2026-03-26 09:04:47.149120 | ubuntu-noble | Loading collection community.windows from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/windows 2026-03-26 09:04:47.149243 | ubuntu-noble | Found installed collection community.windows:2.4.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/windows' 2026-03-26 09:04:47.149755 | ubuntu-noble | Loading collection community.dns from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/dns 2026-03-26 09:04:47.150290 | ubuntu-noble | Found installed collection community.dns:3.4.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/dns' 2026-03-26 09:04:47.150805 | ubuntu-noble | Loading collection arista.eos from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/arista/eos 2026-03-26 09:04:47.151211 | ubuntu-noble | Found installed collection arista.eos:10.1.1 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/arista/eos' 2026-03-26 09:04:47.151576 | ubuntu-noble | Loading collection community.library_inventory_filtering_v1 from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/library_inventory_filtering_v1 2026-03-26 09:04:47.152015 | ubuntu-noble | Found installed collection community.library_inventory_filtering_v1:1.1.5 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/library_inventory_filtering_v1' 2026-03-26 09:04:47.153307 | ubuntu-noble | Loading collection awx.awx from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/awx/awx 2026-03-26 09:04:47.153770 | ubuntu-noble | Found installed collection awx.awx:24.6.1 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/awx/awx' 2026-03-26 09:04:47.154141 | ubuntu-noble | Loading collection ansible.posix from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/ansible/posix 2026-03-26 09:04:47.154560 | ubuntu-noble | Found installed collection ansible.posix:1.6.2 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/ansible/posix' 2026-03-26 09:04:47.156697 | ubuntu-noble | Loading collection cisco.nxos from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/cisco/nxos 2026-03-26 09:04:47.156733 | ubuntu-noble | Found installed collection cisco.nxos:9.4.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/cisco/nxos' 2026-03-26 09:04:47.160099 | ubuntu-noble | Loading collection theforeman.foreman from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/theforeman/foreman 2026-03-26 09:04:47.160131 | ubuntu-noble | Found installed collection theforeman.foreman:4.2.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/theforeman/foreman' 2026-03-26 09:04:47.160140 | ubuntu-noble | Loading collection grafana.grafana from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/grafana/grafana 2026-03-26 09:04:47.160149 | ubuntu-noble | Found installed collection grafana.grafana:5.7.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/grafana/grafana' 2026-03-26 09:04:47.160157 | ubuntu-noble | Loading collection purestorage.flashblade from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/purestorage/flashblade 2026-03-26 09:04:47.160180 | ubuntu-noble | Found installed collection purestorage.flashblade:1.22.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/purestorage/flashblade' 2026-03-26 09:04:47.160189 | ubuntu-noble | Loading collection containers.podman from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/containers/podman 2026-03-26 09:04:47.160441 | ubuntu-noble | Found installed collection containers.podman:1.18.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/containers/podman' 2026-03-26 09:04:47.160714 | ubuntu-noble | Loading collection community.sops from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/sops 2026-03-26 09:04:47.161032 | ubuntu-noble | Found installed collection community.sops:2.2.7 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/sops' 2026-03-26 09:04:47.200039 | ubuntu-noble | Loading collection community.network from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/network 2026-03-26 09:04:47.201026 | ubuntu-noble | Found installed collection community.network:5.1.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/network' 2026-03-26 09:04:47.204387 | ubuntu-noble | Loading collection fortinet.fortios from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/fortinet/fortios 2026-03-26 09:04:47.205318 | ubuntu-noble | Found installed collection fortinet.fortios:2.4.2 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/fortinet/fortios' 2026-03-26 09:04:47.205964 | ubuntu-noble | Loading collection vmware.vmware from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/vmware/vmware 2026-03-26 09:04:47.206790 | ubuntu-noble | Found installed collection vmware.vmware:1.11.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/vmware/vmware' 2026-03-26 09:04:47.207337 | ubuntu-noble | Loading collection check_point.mgmt from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/check_point/mgmt 2026-03-26 09:04:47.207775 | ubuntu-noble | Found installed collection check_point.mgmt:6.6.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/check_point/mgmt' 2026-03-26 09:04:47.208244 | ubuntu-noble | Loading collection wti.remote from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/wti/remote 2026-03-26 09:04:47.208821 | ubuntu-noble | Found installed collection wti.remote:1.0.10 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/wti/remote' 2026-03-26 09:04:47.209193 | ubuntu-noble | Loading collection cyberark.pas from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/cyberark/pas 2026-03-26 09:04:47.209522 | ubuntu-noble | Found installed collection cyberark.pas:1.0.36 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/cyberark/pas' 2026-03-26 09:04:47.209984 | ubuntu-noble | Loading collection community.digitalocean from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/digitalocean 2026-03-26 09:04:47.210342 | ubuntu-noble | Found installed collection community.digitalocean:1.27.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/digitalocean' 2026-03-26 09:04:47.218179 | ubuntu-noble | Loading collection community.general from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/general 2026-03-26 09:04:47.218729 | ubuntu-noble | Found installed collection community.general:10.7.6 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/general' 2026-03-26 09:04:47.219126 | ubuntu-noble | Loading collection hitachivantara.vspone_object from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/hitachivantara/vspone_object 2026-03-26 09:04:47.219684 | ubuntu-noble | Found installed collection hitachivantara.vspone_object:1.0.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/hitachivantara/vspone_object' 2026-03-26 09:04:47.220086 | ubuntu-noble | Loading collection community.crypto from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/crypto 2026-03-26 09:04:47.220550 | ubuntu-noble | Found installed collection community.crypto:2.26.6 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/crypto' 2026-03-26 09:04:47.221448 | ubuntu-noble | Loading collection cisco.aci from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/cisco/aci 2026-03-26 09:04:47.221928 | ubuntu-noble | Found installed collection cisco.aci:2.12.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/cisco/aci' 2026-03-26 09:04:47.223097 | ubuntu-noble | Loading collection kubevirt.core from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/kubevirt/core 2026-03-26 09:04:47.223128 | ubuntu-noble | Found installed collection kubevirt.core:2.2.3 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/kubevirt/core' 2026-03-26 09:04:47.223139 | ubuntu-noble | Loading collection cisco.asa from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/cisco/asa 2026-03-26 09:04:47.223378 | ubuntu-noble | Found installed collection cisco.asa:6.1.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/cisco/asa' 2026-03-26 09:04:47.235944 | ubuntu-noble | Loading collection osism.services from /home/zuul/.ansible/collections/ansible_collections/osism/services 2026-03-26 09:04:47.236377 | ubuntu-noble | Found installed collection osism.services:999.0.0 at '/home/zuul/.ansible/collections/ansible_collections/osism/services' 2026-03-26 09:04:47.240556 | ubuntu-noble | Initial connection to galaxy_server: https://galaxy.ansible.com 2026-03-26 09:04:47.241051 | ubuntu-noble | Created /home/zuul/.ansible/galaxy_token 2026-03-26 09:04:47.241398 | ubuntu-noble | Calling Galaxy at https://galaxy.ansible.com/api/ 2026-03-26 09:04:46.901093 | debian-bookworm | Loading collection community.network from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/network 2026-03-26 09:04:46.901267 | debian-bookworm | Found installed collection community.network:5.1.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/network' 2026-03-26 09:04:46.901722 | debian-bookworm | Loading collection community.routeros from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/routeros 2026-03-26 09:04:46.902091 | debian-bookworm | Found installed collection community.routeros:3.13.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/routeros' 2026-03-26 09:04:46.902395 | debian-bookworm | Loading collection ansible.posix from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/ansible/posix 2026-03-26 09:04:46.902754 | debian-bookworm | Found installed collection ansible.posix:1.6.2 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/ansible/posix' 2026-03-26 09:04:46.903065 | debian-bookworm | Loading collection sensu.sensu_go from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/sensu/sensu_go 2026-03-26 09:04:46.903392 | debian-bookworm | Found installed collection sensu.sensu_go:1.14.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/sensu/sensu_go' 2026-03-26 09:04:46.907376 | debian-bookworm | Loading collection community.aws from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/aws 2026-03-26 09:04:46.907797 | debian-bookworm | Found installed collection community.aws:9.3.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/aws' 2026-03-26 09:04:46.908121 | debian-bookworm | Loading collection vultr.cloud from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/vultr/cloud 2026-03-26 09:04:46.908465 | debian-bookworm | Found installed collection vultr.cloud:1.13.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/vultr/cloud' 2026-03-26 09:04:46.908739 | debian-bookworm | Loading collection inspur.ispim from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/inspur/ispim 2026-03-26 09:04:46.909076 | debian-bookworm | Found installed collection inspur.ispim:2.2.3 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/inspur/ispim' 2026-03-26 09:04:46.909325 | debian-bookworm | Loading collection ieisystem.inmanage from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/ieisystem/inmanage 2026-03-26 09:04:46.909758 | debian-bookworm | Found installed collection ieisystem.inmanage:3.0.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/ieisystem/inmanage' 2026-03-26 09:04:46.910095 | debian-bookworm | Loading collection community.mongodb from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/mongodb 2026-03-26 09:04:46.910378 | debian-bookworm | Found installed collection community.mongodb:1.7.10 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/mongodb' 2026-03-26 09:04:46.912132 | debian-bookworm | Loading collection azure.azcollection from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/azure/azcollection 2026-03-26 09:04:46.912447 | debian-bookworm | Found installed collection azure.azcollection:3.10.1 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/azure/azcollection' 2026-03-26 09:04:46.912860 | debian-bookworm | Loading collection infinidat.infinibox from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/infinidat/infinibox 2026-03-26 09:04:46.913147 | debian-bookworm | Found installed collection infinidat.infinibox:1.6.3 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/infinidat/infinibox' 2026-03-26 09:04:46.913427 | debian-bookworm | Loading collection ibm.spectrum_virtualize from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/ibm/spectrum_virtualize 2026-03-26 09:04:46.913802 | debian-bookworm | Found installed collection ibm.spectrum_virtualize:2.0.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/ibm/spectrum_virtualize' 2026-03-26 09:04:46.914439 | debian-bookworm | Loading collection cisco.iosxr from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/cisco/iosxr 2026-03-26 09:04:46.914740 | debian-bookworm | Found installed collection cisco.iosxr:10.3.1 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/cisco/iosxr' 2026-03-26 09:04:46.915458 | debian-bookworm | Loading collection splunk.es from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/splunk/es 2026-03-26 09:04:46.915768 | debian-bookworm | Found installed collection splunk.es:4.0.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/splunk/es' 2026-03-26 09:04:46.916292 | debian-bookworm | Loading collection community.crypto from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/crypto 2026-03-26 09:04:46.916612 | debian-bookworm | Found installed collection community.crypto:2.26.6 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/crypto' 2026-03-26 09:04:46.919062 | debian-bookworm | Loading collection awx.awx from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/awx/awx 2026-03-26 09:04:46.919364 | debian-bookworm | Found installed collection awx.awx:24.6.1 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/awx/awx' 2026-03-26 09:04:46.920092 | debian-bookworm | Loading collection kubernetes.core from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/kubernetes/core 2026-03-26 09:04:46.920368 | debian-bookworm | Found installed collection kubernetes.core:5.4.1 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/kubernetes/core' 2026-03-26 09:04:46.921192 | debian-bookworm | Loading collection dellemc.unity from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/dellemc/unity 2026-03-26 09:04:46.921463 | debian-bookworm | Found installed collection dellemc.unity:2.1.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/dellemc/unity' 2026-03-26 09:04:46.922027 | debian-bookworm | Loading collection vmware.vmware from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/vmware/vmware 2026-03-26 09:04:46.922295 | debian-bookworm | Found installed collection vmware.vmware:1.11.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/vmware/vmware' 2026-03-26 09:04:46.923149 | debian-bookworm | Loading collection cloudscale_ch.cloud from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/cloudscale_ch/cloud 2026-03-26 09:04:46.923415 | debian-bookworm | Found installed collection cloudscale_ch.cloud:2.5.2 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/cloudscale_ch/cloud' 2026-03-26 09:04:46.924370 | debian-bookworm | Loading collection arista.eos from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/arista/eos 2026-03-26 09:04:46.924672 | debian-bookworm | Found installed collection arista.eos:10.1.1 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/arista/eos' 2026-03-26 09:04:46.924944 | debian-bookworm | Loading collection grafana.grafana from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/grafana/grafana 2026-03-26 09:04:46.925323 | debian-bookworm | Found installed collection grafana.grafana:5.7.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/grafana/grafana' 2026-03-26 09:04:46.925617 | debian-bookworm | Loading collection cisco.intersight from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/cisco/intersight 2026-03-26 09:04:46.925892 | debian-bookworm | Found installed collection cisco.intersight:2.7.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/cisco/intersight' 2026-03-26 09:04:46.926181 | debian-bookworm | Loading collection ibm.storage_virtualize from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/ibm/storage_virtualize 2026-03-26 09:04:46.926452 | debian-bookworm | Found installed collection ibm.storage_virtualize:2.7.4 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/ibm/storage_virtualize' 2026-03-26 09:04:46.927956 | debian-bookworm | Loading collection theforeman.foreman from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/theforeman/foreman 2026-03-26 09:04:46.928320 | debian-bookworm | Found installed collection theforeman.foreman:4.2.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/theforeman/foreman' 2026-03-26 09:04:46.937362 | debian-bookworm | Loading collection community.general from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/general 2026-03-26 09:04:46.937775 | debian-bookworm | Found installed collection community.general:10.7.6 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/general' 2026-03-26 09:04:46.938146 | debian-bookworm | Loading collection community.okd from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/okd 2026-03-26 09:04:46.938577 | debian-bookworm | Found installed collection community.okd:4.0.2 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/okd' 2026-03-26 09:04:46.938958 | debian-bookworm | Loading collection community.proxysql from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/proxysql 2026-03-26 09:04:46.939245 | debian-bookworm | Found installed collection community.proxysql:1.7.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/proxysql' 2026-03-26 09:04:46.939634 | debian-bookworm | Loading collection community.sap_libs from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/sap_libs 2026-03-26 09:04:46.939976 | debian-bookworm | Found installed collection community.sap_libs:1.5.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/sap_libs' 2026-03-26 09:04:46.940387 | debian-bookworm | Loading collection hitachivantara.vspone_block from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/hitachivantara/vspone_block 2026-03-26 09:04:46.940810 | debian-bookworm | Found installed collection hitachivantara.vspone_block:3.5.1 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/hitachivantara/vspone_block' 2026-03-26 09:04:46.942096 | debian-bookworm | Loading collection cisco.mso from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/cisco/mso 2026-03-26 09:04:46.942423 | debian-bookworm | Found installed collection cisco.mso:2.11.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/cisco/mso' 2026-03-26 09:04:46.943240 | debian-bookworm | Loading collection vyos.vyos from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/vyos/vyos 2026-03-26 09:04:46.943607 | debian-bookworm | Found installed collection vyos.vyos:5.0.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/vyos/vyos' 2026-03-26 09:04:46.943967 | debian-bookworm | Loading collection community.hrobot from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/hrobot 2026-03-26 09:04:46.944307 | debian-bookworm | Found installed collection community.hrobot:2.7.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/hrobot' 2026-03-26 09:04:46.944662 | debian-bookworm | Loading collection netapp_eseries.santricity from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/netapp_eseries/santricity 2026-03-26 09:04:46.944997 | debian-bookworm | Found installed collection netapp_eseries.santricity:1.4.1 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/netapp_eseries/santricity' 2026-03-26 09:04:46.945330 | debian-bookworm | Loading collection purestorage.flasharray from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/purestorage/flasharray 2026-03-26 09:04:46.945707 | debian-bookworm | Found installed collection purestorage.flasharray:1.39.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/purestorage/flasharray' 2026-03-26 09:04:46.946029 | debian-bookworm | Loading collection wti.remote from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/wti/remote 2026-03-26 09:04:46.946377 | debian-bookworm | Found installed collection wti.remote:1.0.10 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/wti/remote' 2026-03-26 09:04:46.946717 | debian-bookworm | Loading collection microsoft.ad from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/microsoft/ad 2026-03-26 09:04:46.947016 | debian-bookworm | Found installed collection microsoft.ad:1.9.2 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/microsoft/ad' 2026-03-26 09:04:46.948415 | debian-bookworm | Loading collection cisco.aci from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/cisco/aci 2026-03-26 09:04:46.948696 | debian-bookworm | Found installed collection cisco.aci:2.12.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/cisco/aci' 2026-03-26 09:04:46.948959 | debian-bookworm | Loading collection community.sops from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/sops 2026-03-26 09:04:46.949296 | debian-bookworm | Found installed collection community.sops:2.2.7 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/sops' 2026-03-26 09:04:46.949581 | debian-bookworm | Loading collection cyberark.pas from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/cyberark/pas 2026-03-26 09:04:46.949971 | debian-bookworm | Found installed collection cyberark.pas:1.0.36 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/cyberark/pas' 2026-03-26 09:04:46.950241 | debian-bookworm | Loading collection netapp.storagegrid from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/netapp/storagegrid 2026-03-26 09:04:46.950587 | debian-bookworm | Found installed collection netapp.storagegrid:21.14.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/netapp/storagegrid' 2026-03-26 09:04:46.953093 | debian-bookworm | Loading collection vmware.vmware_rest from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/vmware/vmware_rest 2026-03-26 09:04:46.953446 | debian-bookworm | Found installed collection vmware.vmware_rest:4.9.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/vmware/vmware_rest' 2026-03-26 09:04:46.954291 | debian-bookworm | Loading collection cisco.ios from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/cisco/ios 2026-03-26 09:04:46.954581 | debian-bookworm | Found installed collection cisco.ios:9.2.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/cisco/ios' 2026-03-26 09:04:46.954844 | debian-bookworm | Loading collection cisco.ucs from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/cisco/ucs 2026-03-26 09:04:46.955191 | debian-bookworm | Found installed collection cisco.ucs:1.16.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/cisco/ucs' 2026-03-26 09:04:46.955457 | debian-bookworm | Loading collection infoblox.nios_modules from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/infoblox/nios_modules 2026-03-26 09:04:46.955755 | debian-bookworm | Found installed collection infoblox.nios_modules:1.8.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/infoblox/nios_modules' 2026-03-26 09:04:46.956090 | debian-bookworm | Loading collection community.libvirt from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/libvirt 2026-03-26 09:04:46.956366 | debian-bookworm | Found installed collection community.libvirt:1.4.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/libvirt' 2026-03-26 09:04:46.956664 | debian-bookworm | Loading collection cyberark.conjur from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/cyberark/conjur 2026-03-26 09:04:46.956932 | debian-bookworm | Found installed collection cyberark.conjur:1.3.8 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/cyberark/conjur' 2026-03-26 09:04:46.958740 | debian-bookworm | Loading collection cisco.nxos from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/cisco/nxos 2026-03-26 09:04:46.959138 | debian-bookworm | Found installed collection cisco.nxos:9.4.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/cisco/nxos' 2026-03-26 09:04:46.959668 | debian-bookworm | Loading collection ibm.qradar from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/ibm/qradar 2026-03-26 09:04:46.960054 | debian-bookworm | Found installed collection ibm.qradar:4.0.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/ibm/qradar' 2026-03-26 09:04:46.960529 | debian-bookworm | Loading collection f5networks.f5_modules from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/f5networks/f5_modules 2026-03-26 09:04:46.960866 | debian-bookworm | Found installed collection f5networks.f5_modules:1.39.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/f5networks/f5_modules' 2026-03-26 09:04:46.961102 | debian-bookworm | Loading collection community.library_inventory_filtering_v1 from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/library_inventory_filtering_v1 2026-03-26 09:04:46.961396 | debian-bookworm | Found installed collection community.library_inventory_filtering_v1:1.1.5 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/library_inventory_filtering_v1' 2026-03-26 09:04:46.966150 | debian-bookworm | Loading collection osism.services from /home/zuul/.ansible/collections/ansible_collections/osism/services 2026-03-26 09:04:46.966463 | debian-bookworm | Found installed collection osism.services:999.0.0 at '/home/zuul/.ansible/collections/ansible_collections/osism/services' 2026-03-26 09:04:46.970498 | debian-bookworm | Initial connection to galaxy_server: https://galaxy.ansible.com 2026-03-26 09:04:46.970899 | debian-bookworm | Created /home/zuul/.ansible/galaxy_token 2026-03-26 09:04:46.971119 | debian-bookworm | Calling Galaxy at https://galaxy.ansible.com/api/ 2026-03-26 09:04:47.490758 | ubuntu-noble | Found API version 'v3, pulp-v3, v1' with Galaxy server default (https://galaxy.ansible.com/api/) 2026-03-26 09:04:47.491497 | ubuntu-noble | Calling Galaxy at https://galaxy.ansible.com/api/v3/collections/osism/commons/ 2026-03-26 09:04:47.537929 | debian-bookworm | Found API version 'v3, pulp-v3, v1' with Galaxy server default (https://galaxy.ansible.com/api/) 2026-03-26 09:04:47.538386 | debian-bookworm | Calling Galaxy at https://galaxy.ansible.com/api/v3/collections/osism/commons/ 2026-03-26 09:04:48.310892 | ubuntu-noble | Calling Galaxy at https://galaxy.ansible.com/api/v3/collections/osism/commons/versions/?limit=100 2026-03-26 09:04:48.484450 | debian-bookworm | Calling Galaxy at https://galaxy.ansible.com/api/v3/collections/osism/commons/versions/?limit=100 2026-03-26 09:04:48.966016 | ubuntu-noble | Calling Galaxy at https://galaxy.ansible.com/api/v3/collections/osism/commons/versions/0.20260318.0/ 2026-03-26 09:04:49.522415 | ubuntu-noble | Server https://galaxy.ansible.com/api/ has not signed osism.commons:0.20260318.0 2026-03-26 09:04:49.522479 | ubuntu-noble | Fetching a collection tarball for 'osism.commons:0.20260318.0' from Ansible Galaxy 2026-03-26 09:04:49.592330 | debian-bookworm | Calling Galaxy at https://galaxy.ansible.com/api/v3/collections/osism/commons/versions/0.20260318.0/ 2026-03-26 09:04:50.548081 | debian-bookworm | Server https://galaxy.ansible.com/api/ has not signed osism.commons:0.20260318.0 2026-03-26 09:04:50.548438 | debian-bookworm | Fetching a collection tarball for 'osism.commons:0.20260318.0' from Ansible Galaxy 2026-03-26 09:04:51.438142 | ubuntu-noble | Validating downloaded file hash a8b0daa997f8a6a43297328a901f89a21e28c6a6ab16356fcbec4c59b6328e15 with expected hash a8b0daa997f8a6a43297328a901f89a21e28c6a6ab16356fcbec4c59b6328e15 2026-03-26 09:04:51.438205 | ubuntu-noble | Collection 'osism.commons:0.20260318.0' obtained from server default https://galaxy.ansible.com/api/ 2026-03-26 09:04:51.614160 | ubuntu-noble | Starting galaxy collection install process 2026-03-26 09:04:51.616132 | ubuntu-noble | Process install dependency map 2026-03-26 09:04:51.616186 | ubuntu-noble | Starting collection install process 2026-03-26 09:04:51.616199 | ubuntu-noble | 'ansible.posix:1.6.2' is already installed, skipping. 2026-03-26 09:04:51.616298 | ubuntu-noble | 'community.docker:4.8.2' is already installed, skipping. 2026-03-26 09:04:51.616869 | ubuntu-noble | 'community.general:10.7.6' is already installed, skipping. 2026-03-26 09:04:51.617452 | ubuntu-noble | 'community.library_inventory_filtering_v1:1.1.5' is already installed, skipping. 2026-03-26 09:04:51.617995 | ubuntu-noble | Downloading https://galaxy.ansible.com/api/v3/plugin/ansible/content/published/collections/artifacts/osism-commons-0.20260318.0.tar.gz to /home/zuul/.ansible/tmp/ansible-local-16375g6u1800/tmpg254awzo/osism-commons-0.20260318.0-yptfxl6t 2026-03-26 09:04:51.618538 | ubuntu-noble | Installing 'osism.commons:0.20260318.0' to '/home/zuul/.ansible/collections/ansible_collections/osism/commons' 2026-03-26 09:04:51.618921 | ubuntu-noble | osism.commons:0.20260318.0 was installed successfully 2026-03-26 09:04:51.708389 | ubuntu-noble | INFO [delegated > dependency] Dependency completed successfully. 2026-03-26 09:04:51.708829 | ubuntu-noble | WARNING [delegated > dependency] Executed: Missing roles requirements file: requirements.yml (Remove from dependency_sequence to suppress) 2026-03-26 09:04:51.709665 | ubuntu-noble | WARNING Molecule executed 1 scenario (1 missing files) 2026-03-26 09:04:51.971880 | debian-bookworm | Validating downloaded file hash a8b0daa997f8a6a43297328a901f89a21e28c6a6ab16356fcbec4c59b6328e15 with expected hash a8b0daa997f8a6a43297328a901f89a21e28c6a6ab16356fcbec4c59b6328e15 2026-03-26 09:04:51.972270 | debian-bookworm | Collection 'osism.commons:0.20260318.0' obtained from server default https://galaxy.ansible.com/api/ 2026-03-26 09:04:52.145294 | debian-bookworm | Starting galaxy collection install process 2026-03-26 09:04:52.145724 | debian-bookworm | Process install dependency map 2026-03-26 09:04:52.146027 | debian-bookworm | Starting collection install process 2026-03-26 09:04:52.146318 | debian-bookworm | 'ansible.posix:1.6.2' is already installed, skipping. 2026-03-26 09:04:52.146651 | debian-bookworm | 'community.docker:4.8.2' is already installed, skipping. 2026-03-26 09:04:52.146933 | debian-bookworm | 'community.general:10.7.6' is already installed, skipping. 2026-03-26 09:04:52.147243 | debian-bookworm | 'community.library_inventory_filtering_v1:1.1.5' is already installed, skipping. 2026-03-26 09:04:52.147624 | debian-bookworm | Downloading https://galaxy.ansible.com/api/v3/plugin/ansible/content/published/collections/artifacts/osism-commons-0.20260318.0.tar.gz to /home/zuul/.ansible/tmp/ansible-local-1784j8u3zpxi/tmp7427uk55/osism-commons-0.20260318.0-8s284ofr 2026-03-26 09:04:52.148043 | debian-bookworm | Installing 'osism.commons:0.20260318.0' to '/home/zuul/.ansible/collections/ansible_collections/osism/commons' 2026-03-26 09:04:52.148313 | debian-bookworm | osism.commons:0.20260318.0 was installed successfully 2026-03-26 09:04:52.226673 | debian-bookworm | INFO [delegated > dependency] Dependency completed successfully. 2026-03-26 09:04:52.227004 | debian-bookworm | WARNING [delegated > dependency] Executed: Missing roles requirements file: requirements.yml (Remove from dependency_sequence to suppress) 2026-03-26 09:04:52.227862 | debian-bookworm | WARNING Molecule executed 1 scenario (1 missing files) 2026-03-26 09:04:52.400213 | ubuntu-noble | ok: Runtime: 0:00:07.585541 2026-03-26 09:04:52.415519 | debian-bookworm | ok: Runtime: 0:00:08.157668 2026-03-26 09:04:52.426172 | 2026-03-26 09:04:52.426313 | TASK [ansible-molecule : Run molecule create action with scenario delegated] 2026-03-26 09:04:52.996595 | debian-bookworm | skipping: Conditional result was False 2026-03-26 09:04:52.998002 | ubuntu-noble | skipping: Conditional result was False 2026-03-26 09:04:53.011558 | 2026-03-26 09:04:53.011734 | TASK [ansible-molecule : Run molecule prepare action with scenario delegated] 2026-03-26 09:04:53.831543 | ubuntu-noble | WARNING Molecule scenarios should migrate to 'extensions/molecule' 2026-03-26 09:04:53.841014 | ubuntu-noble | DEBUG [unknown > config] provisioner.env found in /home/zuul/src/github.com/osism/ansible-collection-services/molecule/delegated/molecule.yml, this can be defined in ansible.env 2026-03-26 09:04:53.763243 | debian-bookworm | WARNING Molecule scenarios should migrate to 'extensions/molecule' 2026-03-26 09:04:53.772172 | debian-bookworm | DEBUG [unknown > config] provisioner.env found in /home/zuul/src/github.com/osism/ansible-collection-services/molecule/delegated/molecule.yml, this can be defined in ansible.env 2026-03-26 09:04:54.412139 | ubuntu-noble | DEBUG [unknown > config] provisioner.env found in /home/zuul/src/github.com/osism/ansible-collection-services/molecule/delegated/molecule.yml, this can be defined in ansible.env 2026-03-26 09:04:54.412762 | ubuntu-noble | DEBUG [delegated > validate] Validating schema /home/zuul/src/github.com/osism/ansible-collection-services/molecule/delegated/molecule.yml. 2026-03-26 09:04:54.425192 | ubuntu-noble | CRITICAL 'molecule/default/molecule.yml' glob failed. Exiting. 2026-03-26 09:04:54.425308 | ubuntu-noble | INFO default scenario not found, disabling shared state. 2026-03-26 09:04:54.425323 | ubuntu-noble | INFO [delegated > discovery] scenario test matrix: prepare 2026-03-26 09:04:54.425359 | ubuntu-noble | INFO [delegated > prerun] Performing prerun with role_name_check=0... 2026-03-26 09:04:54.286769 | debian-bookworm | DEBUG [unknown > config] provisioner.env found in /home/zuul/src/github.com/osism/ansible-collection-services/molecule/delegated/molecule.yml, this can be defined in ansible.env 2026-03-26 09:04:54.287398 | debian-bookworm | DEBUG [delegated > validate] Validating schema /home/zuul/src/github.com/osism/ansible-collection-services/molecule/delegated/molecule.yml. 2026-03-26 09:04:54.298048 | debian-bookworm | CRITICAL 'molecule/default/molecule.yml' glob failed. Exiting. 2026-03-26 09:04:54.298135 | debian-bookworm | INFO default scenario not found, disabling shared state. 2026-03-26 09:04:54.298323 | debian-bookworm | INFO [delegated > discovery] scenario test matrix: prepare 2026-03-26 09:04:54.298516 | debian-bookworm | INFO [delegated > prerun] Performing prerun with role_name_check=0... 2026-03-26 09:04:55.808118 | ubuntu-noble | INFO [delegated > prepare] Executing 2026-03-26 09:04:55.578002 | debian-bookworm | INFO [delegated > prepare] Executing 2026-03-26 09:04:55.913543 | debian-bookworm | DEBUG [delegated > prepare] ansible-playbook version: ansible-playbook 2026-03-26 09:04:55.913611 | debian-bookworm | config file = None 2026-03-26 09:04:55.913631 | debian-bookworm | configured module search path = 2026-03-26 09:04:55.913637 | debian-bookworm | ansible python module location = /home/zuul/venv/lib/python3.11/site-packages/ansible 2026-03-26 09:04:55.913645 | debian-bookworm | ansible collection location = /home/zuul/.ansible/collections:/usr/share/ansible/collections 2026-03-26 09:04:55.913649 | debian-bookworm | executable location = /home/zuul/venv/bin/ansible-playbook 2026-03-26 09:04:55.913654 | debian-bookworm | python version = 3.11.2 (main, Apr 28 2025, 14:11:48) (/home/zuul/venv/bin/python3) 2026-03-26 09:04:55.913658 | debian-bookworm | jinja version = 3.1.6 2026-03-26 09:04:55.913663 | debian-bookworm | libyaml = True 2026-03-26 09:04:55.913830 | debian-bookworm | DEBUG ANSIBLE ENVIRONMENT: 2026-03-26 09:04:55.913837 | debian-bookworm | ANSIBLE_COLLECTIONS_PATH: /home/zuul/venv/.ansible/collections:/home/zuul/.ansible/collections 2026-03-26 09:04:55.913841 | debian-bookworm | ANSIBLE_CONFIG: /home/zuul/.ansible/tmp/molecule.oWZD.delegated/ansible.cfg 2026-03-26 09:04:55.913845 | debian-bookworm | ANSIBLE_LIBRARY: ../../plugins 2026-03-26 09:04:55.913850 | debian-bookworm | ANSIBLE_PYTHON_INTERPRETER: /home/zuul/venv/bin/python 2026-03-26 09:04:55.913854 | debian-bookworm | ANSIBLE_ROLE: auditd 2026-03-26 09:04:55.913858 | debian-bookworm | ANSIBLE_ROLES_PATH: ../../roles 2026-03-26 09:04:55.913862 | debian-bookworm | ANSIBLE_VERBOSITY: 1 2026-03-26 09:04:55.913866 | debian-bookworm | 2026-03-26 09:04:55.914069 | debian-bookworm | DEBUG MOLECULE ENVIRONMENT: 2026-03-26 09:04:55.914075 | debian-bookworm | MOLECULE_DEBUG: True 2026-03-26 09:04:55.914079 | debian-bookworm | MOLECULE_DEPENDENCY_NAME: galaxy 2026-03-26 09:04:55.914083 | debian-bookworm | MOLECULE_DRIVER_NAME: default 2026-03-26 09:04:55.914087 | debian-bookworm | MOLECULE_ENV_FILE: /home/zuul/src/github.com/osism/ansible-collection-services/.env.yml 2026-03-26 09:04:55.914091 | debian-bookworm | MOLECULE_EPHEMERAL_DIRECTORY: /home/zuul/.ansible/tmp/molecule.oWZD.delegated 2026-03-26 09:04:55.914095 | debian-bookworm | MOLECULE_FILE: /home/zuul/.ansible/tmp/molecule.oWZD.delegated/molecule.yml 2026-03-26 09:04:55.914099 | debian-bookworm | MOLECULE_INSTANCE_CONFIG: /home/zuul/.ansible/tmp/molecule.oWZD.delegated/instance_config.yml 2026-03-26 09:04:55.914103 | debian-bookworm | MOLECULE_INVENTORY_FILE: /home/zuul/.ansible/tmp/molecule.oWZD.delegated/inventory/ansible_inventory.yml 2026-03-26 09:04:55.914108 | debian-bookworm | MOLECULE_PROJECT_DIRECTORY: /home/zuul/src/github.com/osism/ansible-collection-services 2026-03-26 09:04:55.914112 | debian-bookworm | MOLECULE_PROVISIONER_NAME: ansible 2026-03-26 09:04:55.914115 | debian-bookworm | MOLECULE_SCENARIO_DIRECTORY: /home/zuul/src/github.com/osism/ansible-collection-services/molecule/delegated 2026-03-26 09:04:55.914119 | debian-bookworm | MOLECULE_SCENARIO_NAME: delegated 2026-03-26 09:04:55.914123 | debian-bookworm | MOLECULE_STATE_FILE: /home/zuul/.ansible/tmp/molecule.oWZD.delegated/state.yml 2026-03-26 09:04:55.914127 | debian-bookworm | MOLECULE_VERIFIER_NAME: testinfra 2026-03-26 09:04:55.914131 | debian-bookworm | MOLECULE_VERIFIER_TEST_DIRECTORY: /home/zuul/src/github.com/osism/ansible-collection-services/molecule/delegated/tests 2026-03-26 09:04:55.914135 | debian-bookworm | 2026-03-26 09:04:55.914286 | debian-bookworm | DEBUG SHELL REPLAY: ANSIBLE_COLLECTIONS_PATH=/home/zuul/venv/.ansible/collections:/home/zuul/.ansible/collections ANSIBLE_CONFIG=/home/zuul/.ansible/tmp/molecule.oWZD.delegated/ansible.cfg ANSIBLE_LIBRARY=../../plugins ANSIBLE_PYTHON_INTERPRETER=/home/zuul/venv/bin/python ANSIBLE_ROLE=auditd ANSIBLE_ROLES_PATH=../../roles ANSIBLE_VERBOSITY=1 MOLECULE_DEBUG=True MOLECULE_DEPENDENCY_NAME=galaxy MOLECULE_DRIVER_NAME=default MOLECULE_ENV_FILE=/home/zuul/src/github.com/osism/ansible-collection-services/.env.yml MOLECULE_EPHEMERAL_DIRECTORY=/home/zuul/.ansible/tmp/molecule.oWZD.delegated MOLECULE_FILE=/home/zuul/.ansible/tmp/molecule.oWZD.delegated/molecule.yml MOLECULE_INSTANCE_CONFIG=/home/zuul/.ansible/tmp/molecule.oWZD.delegated/instance_config.yml MOLECULE_INVENTORY_FILE=/home/zuul/.ansible/tmp/molecule.oWZD.delegated/inventory/ansible_inventory.yml MOLECULE_PROJECT_DIRECTORY=/home/zuul/src/github.com/osism/ansible-collection-services MOLECULE_PROVISIONER_NAME=ansible MOLECULE_SCENARIO_DIRECTORY=/home/zuul/src/github.com/osism/ansible-collection-services/molecule/delegated MOLECULE_SCENARIO_NAME=delegated MOLECULE_STATE_FILE=/home/zuul/.ansible/tmp/molecule.oWZD.delegated/state.yml MOLECULE_VERIFIER_NAME=testinfra MOLECULE_VERIFIER_TEST_DIRECTORY=/home/zuul/src/github.com/osism/ansible-collection-services/molecule/delegated/tests 2026-03-26 09:04:56.176820 | ubuntu-noble | DEBUG [delegated > prepare] ansible-playbook version: ansible-playbook 2026-03-26 09:04:56.176948 | ubuntu-noble | config file = None 2026-03-26 09:04:56.176990 | ubuntu-noble | configured module search path = 2026-03-26 09:04:56.177004 | ubuntu-noble | ansible python module location = /home/zuul/venv/lib/python3.12/site-packages/ansible 2026-03-26 09:04:56.177015 | ubuntu-noble | ansible collection location = /home/zuul/.ansible/collections:/usr/share/ansible/collections 2026-03-26 09:04:56.177026 | ubuntu-noble | executable location = /home/zuul/venv/bin/ansible-playbook 2026-03-26 09:04:56.177036 | ubuntu-noble | python version = 3.12.3 (main, Mar 3 2026, 12:15:18) (/home/zuul/venv/bin/python3) 2026-03-26 09:04:56.177046 | ubuntu-noble | jinja version = 3.1.6 2026-03-26 09:04:56.177110 | ubuntu-noble | libyaml = True 2026-03-26 09:04:56.177824 | ubuntu-noble | DEBUG ANSIBLE ENVIRONMENT: 2026-03-26 09:04:56.177863 | ubuntu-noble | ANSIBLE_COLLECTIONS_PATH: /home/zuul/venv/.ansible/collections:/home/zuul/.ansible/collections 2026-03-26 09:04:56.177883 | ubuntu-noble | ANSIBLE_CONFIG: /home/zuul/.ansible/tmp/molecule.oWZD.delegated/ansible.cfg 2026-03-26 09:04:56.177925 | ubuntu-noble | ANSIBLE_LIBRARY: ../../plugins 2026-03-26 09:04:56.177945 | ubuntu-noble | ANSIBLE_PYTHON_INTERPRETER: /home/zuul/venv/bin/python 2026-03-26 09:04:56.177962 | ubuntu-noble | ANSIBLE_ROLE: auditd 2026-03-26 09:04:56.177981 | ubuntu-noble | ANSIBLE_ROLES_PATH: ../../roles 2026-03-26 09:04:56.177996 | ubuntu-noble | ANSIBLE_VERBOSITY: 1 2026-03-26 09:04:56.178008 | ubuntu-noble | 2026-03-26 09:04:56.178417 | ubuntu-noble | DEBUG MOLECULE ENVIRONMENT: 2026-03-26 09:04:56.178448 | ubuntu-noble | MOLECULE_DEBUG: True 2026-03-26 09:04:56.178459 | ubuntu-noble | MOLECULE_DEPENDENCY_NAME: galaxy 2026-03-26 09:04:56.178469 | ubuntu-noble | MOLECULE_DRIVER_NAME: default 2026-03-26 09:04:56.178479 | ubuntu-noble | MOLECULE_ENV_FILE: /home/zuul/src/github.com/osism/ansible-collection-services/.env.yml 2026-03-26 09:04:56.178490 | ubuntu-noble | MOLECULE_EPHEMERAL_DIRECTORY: /home/zuul/.ansible/tmp/molecule.oWZD.delegated 2026-03-26 09:04:56.178500 | ubuntu-noble | MOLECULE_FILE: /home/zuul/.ansible/tmp/molecule.oWZD.delegated/molecule.yml 2026-03-26 09:04:56.178510 | ubuntu-noble | MOLECULE_INSTANCE_CONFIG: /home/zuul/.ansible/tmp/molecule.oWZD.delegated/instance_config.yml 2026-03-26 09:04:56.178519 | ubuntu-noble | MOLECULE_INVENTORY_FILE: /home/zuul/.ansible/tmp/molecule.oWZD.delegated/inventory/ansible_inventory.yml 2026-03-26 09:04:56.178529 | ubuntu-noble | MOLECULE_PROJECT_DIRECTORY: /home/zuul/src/github.com/osism/ansible-collection-services 2026-03-26 09:04:56.178539 | ubuntu-noble | MOLECULE_PROVISIONER_NAME: ansible 2026-03-26 09:04:56.178549 | ubuntu-noble | MOLECULE_SCENARIO_DIRECTORY: /home/zuul/src/github.com/osism/ansible-collection-services/molecule/delegated 2026-03-26 09:04:56.178559 | ubuntu-noble | MOLECULE_SCENARIO_NAME: delegated 2026-03-26 09:04:56.178569 | ubuntu-noble | MOLECULE_STATE_FILE: /home/zuul/.ansible/tmp/molecule.oWZD.delegated/state.yml 2026-03-26 09:04:56.178578 | ubuntu-noble | MOLECULE_VERIFIER_NAME: testinfra 2026-03-26 09:04:56.178588 | ubuntu-noble | MOLECULE_VERIFIER_TEST_DIRECTORY: /home/zuul/src/github.com/osism/ansible-collection-services/molecule/delegated/tests 2026-03-26 09:04:56.178600 | ubuntu-noble | 2026-03-26 09:04:56.180147 | ubuntu-noble | DEBUG SHELL REPLAY: ANSIBLE_COLLECTIONS_PATH=/home/zuul/venv/.ansible/collections:/home/zuul/.ansible/collections ANSIBLE_CONFIG=/home/zuul/.ansible/tmp/molecule.oWZD.delegated/ansible.cfg ANSIBLE_LIBRARY=../../plugins ANSIBLE_PYTHON_INTERPRETER=/home/zuul/venv/bin/python ANSIBLE_ROLE=auditd ANSIBLE_ROLES_PATH=../../roles ANSIBLE_VERBOSITY=1 MOLECULE_DEBUG=True MOLECULE_DEPENDENCY_NAME=galaxy MOLECULE_DRIVER_NAME=default MOLECULE_ENV_FILE=/home/zuul/src/github.com/osism/ansible-collection-services/.env.yml MOLECULE_EPHEMERAL_DIRECTORY=/home/zuul/.ansible/tmp/molecule.oWZD.delegated MOLECULE_FILE=/home/zuul/.ansible/tmp/molecule.oWZD.delegated/molecule.yml MOLECULE_INSTANCE_CONFIG=/home/zuul/.ansible/tmp/molecule.oWZD.delegated/instance_config.yml MOLECULE_INVENTORY_FILE=/home/zuul/.ansible/tmp/molecule.oWZD.delegated/inventory/ansible_inventory.yml MOLECULE_PROJECT_DIRECTORY=/home/zuul/src/github.com/osism/ansible-collection-services MOLECULE_PROVISIONER_NAME=ansible MOLECULE_SCENARIO_DIRECTORY=/home/zuul/src/github.com/osism/ansible-collection-services/molecule/delegated MOLECULE_SCENARIO_NAME=delegated MOLECULE_STATE_FILE=/home/zuul/.ansible/tmp/molecule.oWZD.delegated/state.yml MOLECULE_VERIFIER_NAME=testinfra MOLECULE_VERIFIER_TEST_DIRECTORY=/home/zuul/src/github.com/osism/ansible-collection-services/molecule/delegated/tests 2026-03-26 09:04:56.514663 | ubuntu-noble | Using /home/zuul/.ansible/tmp/molecule.oWZD.delegated/ansible.cfg as config file 2026-03-26 09:04:56.196693 | debian-bookworm | Using /home/zuul/.ansible/tmp/molecule.oWZD.delegated/ansible.cfg as config file 2026-03-26 09:04:56.457223 | debian-bookworm | 2026-03-26 09:04:56.457655 | debian-bookworm | PLAY [Prepare] ***************************************************************** 2026-03-26 09:04:56.458030 | debian-bookworm | 2026-03-26 09:04:56.458387 | debian-bookworm | TASK [Gathering Facts] ********************************************************* 2026-03-26 09:04:56.818213 | ubuntu-noble | 2026-03-26 09:04:56.818375 | ubuntu-noble | PLAY [Prepare] ***************************************************************** 2026-03-26 09:04:56.818760 | ubuntu-noble | 2026-03-26 09:04:56.819905 | ubuntu-noble | TASK [Gathering Facts] ********************************************************* 2026-03-26 09:04:57.718929 | debian-bookworm | ok: [molecule-auditd] 2026-03-26 09:04:57.719013 | debian-bookworm | 2026-03-26 09:04:57.719187 | debian-bookworm | TASK [Install packages in venv] ************************************************ 2026-03-26 09:04:58.131443 | ubuntu-noble | ok: [molecule-auditd] 2026-03-26 09:04:58.131494 | ubuntu-noble | 2026-03-26 09:04:58.131501 | ubuntu-noble | TASK [Install packages in venv] ************************************************ 2026-03-26 09:05:02.758386 | debian-bookworm | changed: [molecule-auditd] => (item=docker) => {"ansible_loop_var": "item", "changed": true, "cmd": ["/home/zuul/venv/bin/pip3", "install", "docker"], "item": "docker", "name": ["docker"], "requirements": null, "state": "present", "stderr": "", "stderr_lines": [], "stdout": "Collecting docker\n Downloading docker-7.1.0-py3-none-any.whl (147 kB)\n ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ 147.8/147.8 kB 3.4 MB/s eta 0:00:00\nRequirement already satisfied: requests>=2.26.0 in /home/zuul/venv/lib/python3.11/site-packages (from docker) (2.33.0)\nRequirement already satisfied: urllib3>=1.26.0 in /home/zuul/venv/lib/python3.11/site-packages (from docker) (2.6.3)\nRequirement already satisfied: charset_normalizer<4,>=2 in /home/zuul/venv/lib/python3.11/site-packages (from requests>=2.26.0->docker) (3.4.6)\nRequirement already satisfied: idna<4,>=2.5 in /home/zuul/venv/lib/python3.11/site-packages (from requests>=2.26.0->docker) (3.11)\nRequirement already satisfied: certifi>=2023.5.7 in /home/zuul/venv/lib/python3.11/site-packages (from requests>=2.26.0->docker) (2026.2.25)\nInstalling collected packages: docker\nSuccessfully installed docker-7.1.0\n", "stdout_lines": ["Collecting docker", " Downloading docker-7.1.0-py3-none-any.whl (147 kB)", " ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ 147.8/147.8 kB 3.4 MB/s eta 0:00:00", "Requirement already satisfied: requests>=2.26.0 in /home/zuul/venv/lib/python3.11/site-packages (from docker) (2.33.0)", "Requirement already satisfied: urllib3>=1.26.0 in /home/zuul/venv/lib/python3.11/site-packages (from docker) (2.6.3)", "Requirement already satisfied: charset_normalizer<4,>=2 in /home/zuul/venv/lib/python3.11/site-packages (from requests>=2.26.0->docker) (3.4.6)", "Requirement already satisfied: idna<4,>=2.5 in /home/zuul/venv/lib/python3.11/site-packages (from requests>=2.26.0->docker) (3.11)", "Requirement already satisfied: certifi>=2023.5.7 in /home/zuul/venv/lib/python3.11/site-packages (from requests>=2.26.0->docker) (2026.2.25)", "Installing collected packages: docker", "Successfully installed docker-7.1.0"], "version": null, "virtualenv": "/home/zuul/venv"} 2026-03-26 09:05:02.758578 | debian-bookworm | changed: [molecule-auditd] => (item=netaddr) => {"ansible_loop_var": "item", "changed": true, "cmd": ["/home/zuul/venv/bin/pip3", "install", "netaddr"], "item": "netaddr", "name": ["netaddr"], "requirements": null, "state": "present", "stderr": "", "stderr_lines": [], "stdout": "Collecting netaddr\n Downloading netaddr-1.3.0-py3-none-any.whl (2.3 MB)\n ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ 2.3/2.3 MB 13.8 MB/s eta 0:00:00\nInstalling collected packages: netaddr\nSuccessfully installed netaddr-1.3.0\n", "stdout_lines": ["Collecting netaddr", " Downloading netaddr-1.3.0-py3-none-any.whl (2.3 MB)", " ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ 2.3/2.3 MB 13.8 MB/s eta 0:00:00", "Installing collected packages: netaddr", "Successfully installed netaddr-1.3.0"], "version": null, "virtualenv": "/home/zuul/venv"} 2026-03-26 09:05:02.758609 | debian-bookworm | ok: [molecule-auditd] => (item=requests) => {"ansible_loop_var": "item", "changed": false, "cmd": ["/home/zuul/venv/bin/pip3", "install", "requests"], "item": "requests", "name": ["requests"], "requirements": null, "state": "present", "stderr": "", "stderr_lines": [], "stdout": "Requirement already satisfied: requests in /home/zuul/venv/lib/python3.11/site-packages (2.33.0)\nRequirement already satisfied: charset_normalizer<4,>=2 in /home/zuul/venv/lib/python3.11/site-packages (from requests) (3.4.6)\nRequirement already satisfied: idna<4,>=2.5 in /home/zuul/venv/lib/python3.11/site-packages (from requests) (3.11)\nRequirement already satisfied: urllib3<3,>=1.26 in /home/zuul/venv/lib/python3.11/site-packages (from requests) (2.6.3)\nRequirement already satisfied: certifi>=2023.5.7 in /home/zuul/venv/lib/python3.11/site-packages (from requests) (2026.2.25)\n", "stdout_lines": ["Requirement already satisfied: requests in /home/zuul/venv/lib/python3.11/site-packages (2.33.0)", "Requirement already satisfied: charset_normalizer<4,>=2 in /home/zuul/venv/lib/python3.11/site-packages (from requests) (3.4.6)", "Requirement already satisfied: idna<4,>=2.5 in /home/zuul/venv/lib/python3.11/site-packages (from requests) (3.11)", "Requirement already satisfied: urllib3<3,>=1.26 in /home/zuul/venv/lib/python3.11/site-packages (from requests) (2.6.3)", "Requirement already satisfied: certifi>=2023.5.7 in /home/zuul/venv/lib/python3.11/site-packages (from requests) (2026.2.25)"], "version": null, "virtualenv": "/home/zuul/venv"} 2026-03-26 09:05:02.758619 | debian-bookworm | 2026-03-26 09:05:02.758629 | debian-bookworm | TASK [Include required prepare tasks] ****************************************** 2026-03-26 09:05:02.781501 | debian-bookworm | included: /home/zuul/src/github.com/osism/ansible-collection-services/molecule/delegated/prepare/auditd.yml for molecule-auditd 2026-03-26 09:05:02.781576 | debian-bookworm | 2026-03-26 09:05:02.781672 | debian-bookworm | PLAY RECAP ********************************************************************* 2026-03-26 09:05:02.781781 | debian-bookworm | molecule-auditd : ok=3 changed=1 unreachable=0 failed=0 skipped=0 rescued=0 ignored=0 2026-03-26 09:05:02.781883 | debian-bookworm | 2026-03-26 09:05:02.890618 | debian-bookworm | INFO [delegated > prepare] Executed: Successful 2026-03-26 09:05:02.891127 | debian-bookworm | INFO Molecule executed 1 scenario (1 successful) 2026-03-26 09:05:03.075905 | debian-bookworm | ok: Runtime: 0:00:09.550179 2026-03-26 09:05:03.427102 | ubuntu-noble | changed: [molecule-auditd] => (item=docker) => {"ansible_loop_var": "item", "changed": true, "cmd": ["/home/zuul/venv/bin/pip3", "install", "docker"], "item": "docker", "name": ["docker"], "requirements": null, "state": "present", "stderr": "", "stderr_lines": [], "stdout": "Collecting docker\n Downloading docker-7.1.0-py3-none-any.whl.metadata (3.8 kB)\nRequirement already satisfied: requests>=2.26.0 in /home/zuul/venv/lib/python3.12/site-packages (from docker) (2.33.0)\nRequirement already satisfied: urllib3>=1.26.0 in /home/zuul/venv/lib/python3.12/site-packages (from docker) (2.6.3)\nRequirement already satisfied: charset_normalizer<4,>=2 in /home/zuul/venv/lib/python3.12/site-packages (from requests>=2.26.0->docker) (3.4.6)\nRequirement already satisfied: idna<4,>=2.5 in /home/zuul/venv/lib/python3.12/site-packages (from requests>=2.26.0->docker) (3.11)\nRequirement already satisfied: certifi>=2023.5.7 in /home/zuul/venv/lib/python3.12/site-packages (from requests>=2.26.0->docker) (2026.2.25)\nDownloading docker-7.1.0-py3-none-any.whl (147 kB)\n ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ 147.8/147.8 kB 4.1 MB/s eta 0:00:00\nInstalling collected packages: docker\nSuccessfully installed docker-7.1.0\n", "stdout_lines": ["Collecting docker", " Downloading docker-7.1.0-py3-none-any.whl.metadata (3.8 kB)", "Requirement already satisfied: requests>=2.26.0 in /home/zuul/venv/lib/python3.12/site-packages (from docker) (2.33.0)", "Requirement already satisfied: urllib3>=1.26.0 in /home/zuul/venv/lib/python3.12/site-packages (from docker) (2.6.3)", "Requirement already satisfied: charset_normalizer<4,>=2 in /home/zuul/venv/lib/python3.12/site-packages (from requests>=2.26.0->docker) (3.4.6)", "Requirement already satisfied: idna<4,>=2.5 in /home/zuul/venv/lib/python3.12/site-packages (from requests>=2.26.0->docker) (3.11)", "Requirement already satisfied: certifi>=2023.5.7 in /home/zuul/venv/lib/python3.12/site-packages (from requests>=2.26.0->docker) (2026.2.25)", "Downloading docker-7.1.0-py3-none-any.whl (147 kB)", " ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ 147.8/147.8 kB 4.1 MB/s eta 0:00:00", "Installing collected packages: docker", "Successfully installed docker-7.1.0"], "version": null, "virtualenv": "/home/zuul/venv"} 2026-03-26 09:05:03.428589 | ubuntu-noble | changed: [molecule-auditd] => (item=netaddr) => {"ansible_loop_var": "item", "changed": true, "cmd": ["/home/zuul/venv/bin/pip3", "install", "netaddr"], "item": "netaddr", "name": ["netaddr"], "requirements": null, "state": "present", "stderr": "", "stderr_lines": [], "stdout": "Collecting netaddr\n Downloading netaddr-1.3.0-py3-none-any.whl.metadata (5.0 kB)\nDownloading netaddr-1.3.0-py3-none-any.whl (2.3 MB)\n ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ 2.3/2.3 MB 19.7 MB/s eta 0:00:00\nInstalling collected packages: netaddr\nSuccessfully installed netaddr-1.3.0\n", "stdout_lines": ["Collecting netaddr", " Downloading netaddr-1.3.0-py3-none-any.whl.metadata (5.0 kB)", "Downloading netaddr-1.3.0-py3-none-any.whl (2.3 MB)", " ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ 2.3/2.3 MB 19.7 MB/s eta 0:00:00", "Installing collected packages: netaddr", "Successfully installed netaddr-1.3.0"], "version": null, "virtualenv": "/home/zuul/venv"} 2026-03-26 09:05:03.428618 | ubuntu-noble | ok: [molecule-auditd] => (item=requests) => {"ansible_loop_var": "item", "changed": false, "cmd": ["/home/zuul/venv/bin/pip3", "install", "requests"], "item": "requests", "name": ["requests"], "requirements": null, "state": "present", "stderr": "", "stderr_lines": [], "stdout": "Requirement already satisfied: requests in /home/zuul/venv/lib/python3.12/site-packages (2.33.0)\nRequirement already satisfied: charset_normalizer<4,>=2 in /home/zuul/venv/lib/python3.12/site-packages (from requests) (3.4.6)\nRequirement already satisfied: idna<4,>=2.5 in /home/zuul/venv/lib/python3.12/site-packages (from requests) (3.11)\nRequirement already satisfied: urllib3<3,>=1.26 in /home/zuul/venv/lib/python3.12/site-packages (from requests) (2.6.3)\nRequirement already satisfied: certifi>=2023.5.7 in /home/zuul/venv/lib/python3.12/site-packages (from requests) (2026.2.25)\n", "stdout_lines": ["Requirement already satisfied: requests in /home/zuul/venv/lib/python3.12/site-packages (2.33.0)", "Requirement already satisfied: charset_normalizer<4,>=2 in /home/zuul/venv/lib/python3.12/site-packages (from requests) (3.4.6)", "Requirement already satisfied: idna<4,>=2.5 in /home/zuul/venv/lib/python3.12/site-packages (from requests) (3.11)", "Requirement already satisfied: urllib3<3,>=1.26 in /home/zuul/venv/lib/python3.12/site-packages (from requests) (2.6.3)", "Requirement already satisfied: certifi>=2023.5.7 in /home/zuul/venv/lib/python3.12/site-packages (from requests) (2026.2.25)"], "version": null, "virtualenv": "/home/zuul/venv"} 2026-03-26 09:05:03.428626 | ubuntu-noble | 2026-03-26 09:05:03.428634 | ubuntu-noble | TASK [Include required prepare tasks] ****************************************** 2026-03-26 09:05:03.453569 | ubuntu-noble | included: /home/zuul/src/github.com/osism/ansible-collection-services/molecule/delegated/prepare/auditd.yml for molecule-auditd 2026-03-26 09:05:03.453615 | ubuntu-noble | 2026-03-26 09:05:03.453624 | ubuntu-noble | PLAY RECAP ********************************************************************* 2026-03-26 09:05:03.453631 | ubuntu-noble | molecule-auditd : ok=3 changed=1 unreachable=0 failed=0 skipped=0 rescued=0 ignored=0 2026-03-26 09:05:03.453636 | ubuntu-noble | 2026-03-26 09:05:03.693508 | ubuntu-noble | ok: Runtime: 0:00:10.190646 2026-03-26 09:05:03.700089 | 2026-03-26 09:05:03.700204 | TASK [ansible-molecule : Reset connection] 2026-03-26 09:05:03.736475 | 2026-03-26 09:05:03.736605 | TASK [ansible-molecule : Reset connection] 2026-03-26 09:05:03.771466 | 2026-03-26 09:05:03.771669 | TASK [ansible-molecule : Run molecule converge action with scenario delegated] 2026-03-26 09:05:03.563842 | ubuntu-noble | INFO [delegated > prepare] Executed: Successful 2026-03-26 09:05:03.564229 | ubuntu-noble | INFO Molecule executed 1 scenario (1 successful) 2026-03-26 09:05:04.703012 | debian-bookworm | WARNING Molecule scenarios should migrate to 'extensions/molecule' 2026-03-26 09:05:04.711462 | debian-bookworm | DEBUG [unknown > config] provisioner.env found in /home/zuul/src/github.com/osism/ansible-collection-services/molecule/delegated/molecule.yml, this can be defined in ansible.env 2026-03-26 09:05:04.866542 | ubuntu-noble | WARNING Molecule scenarios should migrate to 'extensions/molecule' 2026-03-26 09:05:04.876529 | ubuntu-noble | DEBUG [unknown > config] provisioner.env found in /home/zuul/src/github.com/osism/ansible-collection-services/molecule/delegated/molecule.yml, this can be defined in ansible.env 2026-03-26 09:05:05.234495 | debian-bookworm | DEBUG [unknown > config] provisioner.env found in /home/zuul/src/github.com/osism/ansible-collection-services/molecule/delegated/molecule.yml, this can be defined in ansible.env 2026-03-26 09:05:05.235191 | debian-bookworm | DEBUG [delegated > validate] Validating schema /home/zuul/src/github.com/osism/ansible-collection-services/molecule/delegated/molecule.yml. 2026-03-26 09:05:05.246551 | debian-bookworm | CRITICAL 'molecule/default/molecule.yml' glob failed. Exiting. 2026-03-26 09:05:05.246642 | debian-bookworm | INFO default scenario not found, disabling shared state. 2026-03-26 09:05:05.246863 | debian-bookworm | INFO [delegated > discovery] scenario test matrix: dependency, create, prepare, converge 2026-03-26 09:05:05.247045 | debian-bookworm | INFO [delegated > prerun] Performing prerun with role_name_check=0... 2026-03-26 09:05:05.437190 | ubuntu-noble | DEBUG [unknown > config] provisioner.env found in /home/zuul/src/github.com/osism/ansible-collection-services/molecule/delegated/molecule.yml, this can be defined in ansible.env 2026-03-26 09:05:05.437923 | ubuntu-noble | DEBUG [delegated > validate] Validating schema /home/zuul/src/github.com/osism/ansible-collection-services/molecule/delegated/molecule.yml. 2026-03-26 09:05:05.450141 | ubuntu-noble | CRITICAL 'molecule/default/molecule.yml' glob failed. Exiting. 2026-03-26 09:05:05.450252 | ubuntu-noble | INFO default scenario not found, disabling shared state. 2026-03-26 09:05:05.450416 | ubuntu-noble | INFO [delegated > discovery] scenario test matrix: dependency, create, prepare, converge 2026-03-26 09:05:05.450532 | ubuntu-noble | INFO [delegated > prerun] Performing prerun with role_name_check=0... 2026-03-26 09:05:06.564604 | debian-bookworm | INFO [delegated > dependency] Executing 2026-03-26 09:05:06.564822 | debian-bookworm | WARNING [delegated > dependency] Missing roles requirements file: requirements.yml 2026-03-26 09:05:06.951741 | ubuntu-noble | INFO [delegated > dependency] Executing 2026-03-26 09:05:06.952277 | ubuntu-noble | WARNING [delegated > dependency] Missing roles requirements file: requirements.yml 2026-03-26 09:05:06.958558 | debian-bookworm | ansible-galaxy [core 2.18.15] 2026-03-26 09:05:06.959003 | debian-bookworm | config file = None 2026-03-26 09:05:06.959476 | debian-bookworm | configured module search path = ['/home/zuul/src/github.com/osism/ansible-collection-services/plugins/modules', '/home/zuul/.ansible/plugins/modules', '/usr/share/ansible/plugins/modules'] 2026-03-26 09:05:06.959968 | debian-bookworm | ansible python module location = /home/zuul/venv/lib/python3.11/site-packages/ansible 2026-03-26 09:05:06.960479 | debian-bookworm | ansible collection location = /home/zuul/.ansible/collections:/usr/share/ansible/collections:/home/zuul/venv/lib/python3.11/site-packages:/home/zuul/venv/lib/python3.11/dist-packages:/home/zuul/venv/lib/python3/dist-packages:/home/zuul/venv/local/lib/python3.11/dist-packages 2026-03-26 09:05:06.960818 | debian-bookworm | executable location = /home/zuul/venv/bin/ansible-galaxy 2026-03-26 09:05:06.961143 | debian-bookworm | python version = 3.11.2 (main, Apr 28 2025, 14:11:48) [GCC 12.2.0] (/home/zuul/venv/bin/python3) 2026-03-26 09:05:06.961557 | debian-bookworm | jinja version = 3.1.6 2026-03-26 09:05:06.961860 | debian-bookworm | libyaml = True 2026-03-26 09:05:06.962141 | debian-bookworm | No config file found; using defaults 2026-03-26 09:05:06.962677 | debian-bookworm | Reading requirement file at '/home/zuul/src/github.com/osism/ansible-collection-services/molecule/delegated/collections.yml' 2026-03-26 09:05:06.965718 | debian-bookworm | Loading collection osism.commons from /home/zuul/.ansible/collections/ansible_collections/osism/commons 2026-03-26 09:05:06.967701 | debian-bookworm | Found installed collection osism.commons:0.20260318.0 at '/home/zuul/.ansible/collections/ansible_collections/osism/commons' 2026-03-26 09:05:06.969083 | debian-bookworm | Loading collection osism.services from /home/zuul/.ansible/collections/ansible_collections/osism/services 2026-03-26 09:05:06.969513 | debian-bookworm | Found installed collection osism.services:999.0.0 at '/home/zuul/.ansible/collections/ansible_collections/osism/services' 2026-03-26 09:05:06.975581 | debian-bookworm | Loading collection cisco.aci from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/cisco/aci 2026-03-26 09:05:06.976068 | debian-bookworm | Found installed collection cisco.aci:2.12.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/cisco/aci' 2026-03-26 09:05:06.976607 | debian-bookworm | Loading collection vmware.vmware from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/vmware/vmware 2026-03-26 09:05:06.977026 | debian-bookworm | Found installed collection vmware.vmware:1.11.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/vmware/vmware' 2026-03-26 09:05:06.983050 | debian-bookworm | Loading collection fortinet.fortimanager from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/fortinet/fortimanager 2026-03-26 09:05:06.983517 | debian-bookworm | Found installed collection fortinet.fortimanager:2.11.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/fortinet/fortimanager' 2026-03-26 09:05:06.984143 | debian-bookworm | Loading collection ansible.windows from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/ansible/windows 2026-03-26 09:05:06.984608 | debian-bookworm | Found installed collection ansible.windows:2.8.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/ansible/windows' 2026-03-26 09:05:06.984896 | debian-bookworm | Loading collection community.library_inventory_filtering_v1 from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/library_inventory_filtering_v1 2026-03-26 09:05:06.985288 | debian-bookworm | Found installed collection community.library_inventory_filtering_v1:1.1.5 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/library_inventory_filtering_v1' 2026-03-26 09:05:06.985647 | debian-bookworm | Loading collection check_point.mgmt from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/check_point/mgmt 2026-03-26 09:05:06.986044 | debian-bookworm | Found installed collection check_point.mgmt:6.6.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/check_point/mgmt' 2026-03-26 09:05:06.986446 | debian-bookworm | Loading collection community.grafana from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/grafana 2026-03-26 09:05:06.986726 | debian-bookworm | Found installed collection community.grafana:2.3.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/grafana' 2026-03-26 09:05:06.987219 | debian-bookworm | Loading collection lowlydba.sqlserver from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/lowlydba/sqlserver 2026-03-26 09:05:06.987634 | debian-bookworm | Found installed collection lowlydba.sqlserver:2.7.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/lowlydba/sqlserver' 2026-03-26 09:05:06.988194 | debian-bookworm | Loading collection kubernetes.core from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/kubernetes/core 2026-03-26 09:05:06.988632 | debian-bookworm | Found installed collection kubernetes.core:5.4.1 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/kubernetes/core' 2026-03-26 09:05:06.989010 | debian-bookworm | Loading collection kubevirt.core from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/kubevirt/core 2026-03-26 09:05:06.989340 | debian-bookworm | Found installed collection kubevirt.core:2.2.3 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/kubevirt/core' 2026-03-26 09:05:06.989773 | debian-bookworm | Loading collection splunk.es from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/splunk/es 2026-03-26 09:05:06.990080 | debian-bookworm | Found installed collection splunk.es:4.0.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/splunk/es' 2026-03-26 09:05:06.990414 | debian-bookworm | Loading collection kaytus.ksmanage from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/kaytus/ksmanage 2026-03-26 09:05:06.990729 | debian-bookworm | Found installed collection kaytus.ksmanage:2.0.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/kaytus/ksmanage' 2026-03-26 09:05:06.991460 | debian-bookworm | Loading collection netapp.ontap from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/netapp/ontap 2026-03-26 09:05:06.991849 | debian-bookworm | Found installed collection netapp.ontap:22.14.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/netapp/ontap' 2026-03-26 09:05:06.992180 | debian-bookworm | Loading collection ibm.storage_virtualize from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/ibm/storage_virtualize 2026-03-26 09:05:06.992530 | debian-bookworm | Found installed collection ibm.storage_virtualize:2.7.4 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/ibm/storage_virtualize' 2026-03-26 09:05:06.992783 | debian-bookworm | Loading collection cloud.common from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/cloud/common 2026-03-26 09:05:06.993105 | debian-bookworm | Found installed collection cloud.common:4.2.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/cloud/common' 2026-03-26 09:05:06.994663 | debian-bookworm | Loading collection theforeman.foreman from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/theforeman/foreman 2026-03-26 09:05:06.995071 | debian-bookworm | Found installed collection theforeman.foreman:4.2.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/theforeman/foreman' 2026-03-26 09:05:06.995676 | debian-bookworm | Loading collection hitachivantara.vspone_block from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/hitachivantara/vspone_block 2026-03-26 09:05:06.996063 | debian-bookworm | Found installed collection hitachivantara.vspone_block:3.5.1 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/hitachivantara/vspone_block' 2026-03-26 09:05:06.996294 | debian-bookworm | Loading collection ansible.posix from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/ansible/posix 2026-03-26 09:05:06.996727 | debian-bookworm | Found installed collection ansible.posix:1.6.2 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/ansible/posix' 2026-03-26 09:05:06.997046 | debian-bookworm | Loading collection purestorage.flashblade from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/purestorage/flashblade 2026-03-26 09:05:06.997384 | debian-bookworm | Found installed collection purestorage.flashblade:1.22.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/purestorage/flashblade' 2026-03-26 09:05:06.997700 | debian-bookworm | Loading collection infoblox.nios_modules from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/infoblox/nios_modules 2026-03-26 09:05:06.997947 | debian-bookworm | Found installed collection infoblox.nios_modules:1.8.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/infoblox/nios_modules' 2026-03-26 09:05:06.998425 | debian-bookworm | Loading collection community.okd from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/okd 2026-03-26 09:05:06.998729 | debian-bookworm | Found installed collection community.okd:4.0.2 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/okd' 2026-03-26 09:05:06.999008 | debian-bookworm | Loading collection cyberark.conjur from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/cyberark/conjur 2026-03-26 09:05:06.999312 | debian-bookworm | Found installed collection cyberark.conjur:1.3.8 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/cyberark/conjur' 2026-03-26 09:05:06.999682 | debian-bookworm | Loading collection sensu.sensu_go from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/sensu/sensu_go 2026-03-26 09:05:07.000022 | debian-bookworm | Found installed collection sensu.sensu_go:1.14.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/sensu/sensu_go' 2026-03-26 09:05:07.001746 | debian-bookworm | Loading collection dellemc.openmanage from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/dellemc/openmanage 2026-03-26 09:05:07.002324 | debian-bookworm | Found installed collection dellemc.openmanage:9.12.3 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/dellemc/openmanage' 2026-03-26 09:05:07.002845 | debian-bookworm | Loading collection infinidat.infinibox from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/infinidat/infinibox 2026-03-26 09:05:07.003213 | debian-bookworm | Found installed collection infinidat.infinibox:1.6.3 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/infinidat/infinibox' 2026-03-26 09:05:07.004143 | debian-bookworm | Loading collection community.vmware from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/vmware 2026-03-26 09:05:07.004605 | debian-bookworm | Found installed collection community.vmware:5.10.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/vmware' 2026-03-26 09:05:07.006967 | debian-bookworm | Loading collection vmware.vmware_rest from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/vmware/vmware_rest 2026-03-26 09:05:07.007445 | debian-bookworm | Found installed collection vmware.vmware_rest:4.9.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/vmware/vmware_rest' 2026-03-26 09:05:07.008254 | debian-bookworm | Loading collection netbox.netbox from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/netbox/netbox 2026-03-26 09:05:07.008690 | debian-bookworm | Found installed collection netbox.netbox:3.21.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/netbox/netbox' 2026-03-26 09:05:07.012236 | debian-bookworm | Loading collection fortinet.fortios from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/fortinet/fortios 2026-03-26 09:05:07.012608 | debian-bookworm | Found installed collection fortinet.fortios:2.4.2 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/fortinet/fortios' 2026-03-26 09:05:07.012911 | debian-bookworm | Loading collection community.hashi_vault from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/hashi_vault 2026-03-26 09:05:07.013209 | debian-bookworm | Found installed collection community.hashi_vault:6.2.1 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/hashi_vault' 2026-03-26 09:05:07.013549 | debian-bookworm | Loading collection grafana.grafana from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/grafana/grafana 2026-03-26 09:05:07.013804 | debian-bookworm | Found installed collection grafana.grafana:5.7.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/grafana/grafana' 2026-03-26 09:05:07.014147 | debian-bookworm | Loading collection community.hrobot from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/hrobot 2026-03-26 09:05:07.014497 | debian-bookworm | Found installed collection community.hrobot:2.7.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/hrobot' 2026-03-26 09:05:07.015861 | debian-bookworm | Loading collection amazon.aws from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/amazon/aws 2026-03-26 09:05:07.016265 | debian-bookworm | Found installed collection amazon.aws:9.5.2 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/amazon/aws' 2026-03-26 09:05:07.017026 | debian-bookworm | Loading collection dellemc.enterprise_sonic from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/dellemc/enterprise_sonic 2026-03-26 09:05:07.017362 | debian-bookworm | Found installed collection dellemc.enterprise_sonic:2.5.1 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/dellemc/enterprise_sonic' 2026-03-26 09:05:07.054141 | debian-bookworm | Loading collection community.network from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/network 2026-03-26 09:05:07.054757 | debian-bookworm | Found installed collection community.network:5.1.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/network' 2026-03-26 09:05:07.055996 | debian-bookworm | Loading collection ansible.netcommon from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/ansible/netcommon 2026-03-26 09:05:07.056477 | debian-bookworm | Found installed collection ansible.netcommon:7.2.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/ansible/netcommon' 2026-03-26 09:05:07.056812 | debian-bookworm | Loading collection cisco.ise from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/cisco/ise 2026-03-26 09:05:07.057113 | debian-bookworm | Found installed collection cisco.ise:2.10.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/cisco/ise' 2026-03-26 09:05:07.057763 | debian-bookworm | Loading collection ngine_io.cloudstack from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/ngine_io/cloudstack 2026-03-26 09:05:07.058055 | debian-bookworm | Found installed collection ngine_io.cloudstack:2.5.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/ngine_io/cloudstack' 2026-03-26 09:05:07.060671 | debian-bookworm | Loading collection awx.awx from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/awx/awx 2026-03-26 09:05:07.060978 | debian-bookworm | Found installed collection awx.awx:24.6.1 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/awx/awx' 2026-03-26 09:05:07.061276 | debian-bookworm | Loading collection chocolatey.chocolatey from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/chocolatey/chocolatey 2026-03-26 09:05:07.061673 | debian-bookworm | Found installed collection chocolatey.chocolatey:1.5.3 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/chocolatey/chocolatey' 2026-03-26 09:05:07.062573 | debian-bookworm | Loading collection arista.eos from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/arista/eos 2026-03-26 09:05:07.062871 | debian-bookworm | Found installed collection arista.eos:10.1.1 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/arista/eos' 2026-03-26 09:05:07.064060 | debian-bookworm | Loading collection junipernetworks.junos from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/junipernetworks/junos 2026-03-26 09:05:07.064376 | debian-bookworm | Found installed collection junipernetworks.junos:9.1.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/junipernetworks/junos' 2026-03-26 09:05:07.064703 | debian-bookworm | Loading collection community.ciscosmb from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/ciscosmb 2026-03-26 09:05:07.065326 | debian-bookworm | Found installed collection community.ciscosmb:1.0.11 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/ciscosmb' 2026-03-26 09:05:07.066100 | debian-bookworm | Loading collection google.cloud from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/google/cloud 2026-03-26 09:05:07.066422 | debian-bookworm | Found installed collection google.cloud:1.9.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/google/cloud' 2026-03-26 09:05:07.066815 | debian-bookworm | Loading collection community.dns from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/dns 2026-03-26 09:05:07.067116 | debian-bookworm | Found installed collection community.dns:3.4.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/dns' 2026-03-26 09:05:07.067432 | debian-bookworm | Loading collection microsoft.ad from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/microsoft/ad 2026-03-26 09:05:07.067730 | debian-bookworm | Found installed collection microsoft.ad:1.9.2 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/microsoft/ad' 2026-03-26 09:05:07.068134 | debian-bookworm | Loading collection netapp.cloudmanager from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/netapp/cloudmanager 2026-03-26 09:05:07.068500 | debian-bookworm | Found installed collection netapp.cloudmanager:21.24.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/netapp/cloudmanager' 2026-03-26 09:05:07.068901 | debian-bookworm | Loading collection community.mongodb from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/mongodb 2026-03-26 09:05:07.069190 | debian-bookworm | Found installed collection community.mongodb:1.7.10 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/mongodb' 2026-03-26 09:05:07.069483 | debian-bookworm | Loading collection community.rabbitmq from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/rabbitmq 2026-03-26 09:05:07.069757 | debian-bookworm | Found installed collection community.rabbitmq:1.6.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/rabbitmq' 2026-03-26 09:05:07.070026 | debian-bookworm | Loading collection cisco.intersight from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/cisco/intersight 2026-03-26 09:05:07.070298 | debian-bookworm | Found installed collection cisco.intersight:2.7.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/cisco/intersight' 2026-03-26 09:05:07.070898 | debian-bookworm | Loading collection f5networks.f5_modules from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/f5networks/f5_modules 2026-03-26 09:05:07.071186 | debian-bookworm | Found installed collection f5networks.f5_modules:1.39.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/f5networks/f5_modules' 2026-03-26 09:05:07.072297 | debian-bookworm | Loading collection community.digitalocean from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/digitalocean 2026-03-26 09:05:07.072578 | debian-bookworm | Found installed collection community.digitalocean:1.27.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/digitalocean' 2026-03-26 09:05:07.072810 | debian-bookworm | Loading collection cisco.dnac from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/cisco/dnac 2026-03-26 09:05:07.073158 | debian-bookworm | Found installed collection cisco.dnac:6.31.3 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/cisco/dnac' 2026-03-26 09:05:07.073513 | debian-bookworm | Loading collection community.sap_libs from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/sap_libs 2026-03-26 09:05:07.073851 | debian-bookworm | Found installed collection community.sap_libs:1.5.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/sap_libs' 2026-03-26 09:05:07.074097 | debian-bookworm | Loading collection community.libvirt from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/libvirt 2026-03-26 09:05:07.074440 | debian-bookworm | Found installed collection community.libvirt:1.4.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/libvirt' 2026-03-26 09:05:07.074675 | debian-bookworm | Loading collection cisco.ucs from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/cisco/ucs 2026-03-26 09:05:07.074973 | debian-bookworm | Found installed collection cisco.ucs:1.16.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/cisco/ucs' 2026-03-26 09:05:07.075302 | debian-bookworm | Loading collection community.routeros from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/routeros 2026-03-26 09:05:07.075650 | debian-bookworm | Found installed collection community.routeros:3.13.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/routeros' 2026-03-26 09:05:07.075948 | debian-bookworm | Loading collection cyberark.pas from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/cyberark/pas 2026-03-26 09:05:07.076191 | debian-bookworm | Found installed collection cyberark.pas:1.0.36 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/cyberark/pas' 2026-03-26 09:05:07.076443 | debian-bookworm | Loading collection ravendb.ravendb from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/ravendb/ravendb 2026-03-26 09:05:07.076679 | debian-bookworm | Found installed collection ravendb.ravendb:1.0.4 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/ravendb/ravendb' 2026-03-26 09:05:07.077787 | debian-bookworm | Loading collection hetzner.hcloud from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/hetzner/hcloud 2026-03-26 09:05:07.078167 | debian-bookworm | Found installed collection hetzner.hcloud:4.3.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/hetzner/hcloud' 2026-03-26 09:05:07.080195 | debian-bookworm | Loading collection cisco.nxos from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/cisco/nxos 2026-03-26 09:05:07.080604 | debian-bookworm | Found installed collection cisco.nxos:9.4.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/cisco/nxos' 2026-03-26 09:05:07.081043 | debian-bookworm | Loading collection wti.remote from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/wti/remote 2026-03-26 09:05:07.081375 | debian-bookworm | Found installed collection wti.remote:1.0.10 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/wti/remote' 2026-03-26 09:05:07.082195 | debian-bookworm | Loading collection cisco.ios from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/cisco/ios 2026-03-26 09:05:07.082570 | debian-bookworm | Found installed collection cisco.ios:9.2.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/cisco/ios' 2026-03-26 09:05:07.082855 | debian-bookworm | Loading collection community.mysql from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/mysql 2026-03-26 09:05:07.083170 | debian-bookworm | Found installed collection community.mysql:3.16.1 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/mysql' 2026-03-26 09:05:07.083383 | debian-bookworm | Loading collection community.proxysql from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/proxysql 2026-03-26 09:05:07.083756 | debian-bookworm | Found installed collection community.proxysql:1.7.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/proxysql' 2026-03-26 09:05:07.084480 | debian-bookworm | Loading collection ovirt.ovirt from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/ovirt/ovirt 2026-03-26 09:05:07.084801 | debian-bookworm | Found installed collection ovirt.ovirt:3.2.1 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/ovirt/ovirt' 2026-03-26 09:05:07.085012 | debian-bookworm | Loading collection microsoft.iis from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/microsoft/iis 2026-03-26 09:05:07.085295 | debian-bookworm | Found installed collection microsoft.iis:1.0.3 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/microsoft/iis' 2026-03-26 09:05:07.085769 | debian-bookworm | Loading collection community.docker from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/docker 2026-03-26 09:05:07.086097 | debian-bookworm | Found installed collection community.docker:4.8.2 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/docker' 2026-03-26 09:05:07.088045 | debian-bookworm | Loading collection azure.azcollection from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/azure/azcollection 2026-03-26 09:05:07.088417 | debian-bookworm | Found installed collection azure.azcollection:3.10.1 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/azure/azcollection' 2026-03-26 09:05:07.091782 | debian-bookworm | Loading collection community.aws from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/aws 2026-03-26 09:05:07.092054 | debian-bookworm | Found installed collection community.aws:9.3.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/aws' 2026-03-26 09:05:07.092525 | debian-bookworm | Loading collection netapp.storagegrid from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/netapp/storagegrid 2026-03-26 09:05:07.092899 | debian-bookworm | Found installed collection netapp.storagegrid:21.14.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/netapp/storagegrid' 2026-03-26 09:05:07.093533 | debian-bookworm | Loading collection dellemc.powerflex from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/dellemc/powerflex 2026-03-26 09:05:07.093836 | debian-bookworm | Found installed collection dellemc.powerflex:2.6.1 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/dellemc/powerflex' 2026-03-26 09:05:07.094659 | debian-bookworm | Loading collection cloudscale_ch.cloud from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/cloudscale_ch/cloud 2026-03-26 09:05:07.094998 | debian-bookworm | Found installed collection cloudscale_ch.cloud:2.5.2 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/cloudscale_ch/cloud' 2026-03-26 09:05:07.095764 | debian-bookworm | Loading collection openstack.cloud from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/openstack/cloud 2026-03-26 09:05:07.096164 | debian-bookworm | Found installed collection openstack.cloud:2.5.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/openstack/cloud' 2026-03-26 09:05:07.096493 | debian-bookworm | Loading collection hitachivantara.vspone_object from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/hitachivantara/vspone_object 2026-03-26 09:05:07.096843 | debian-bookworm | Found installed collection hitachivantara.vspone_object:1.0.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/hitachivantara/vspone_object' 2026-03-26 09:05:07.097252 | debian-bookworm | Loading collection community.postgresql from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/postgresql 2026-03-26 09:05:07.097632 | debian-bookworm | Found installed collection community.postgresql:3.14.2 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/postgresql' 2026-03-26 09:05:07.097926 | debian-bookworm | Loading collection containers.podman from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/containers/podman 2026-03-26 09:05:07.098249 | debian-bookworm | Found installed collection containers.podman:1.18.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/containers/podman' 2026-03-26 09:05:07.099876 | debian-bookworm | Loading collection cisco.mso from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/cisco/mso 2026-03-26 09:05:07.100177 | debian-bookworm | Found installed collection cisco.mso:2.11.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/cisco/mso' 2026-03-26 09:05:07.100562 | debian-bookworm | Loading collection ieisystem.inmanage from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/ieisystem/inmanage 2026-03-26 09:05:07.100782 | debian-bookworm | Found installed collection ieisystem.inmanage:3.0.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/ieisystem/inmanage' 2026-03-26 09:05:07.101376 | debian-bookworm | Loading collection ibm.qradar from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/ibm/qradar 2026-03-26 09:05:07.101687 | debian-bookworm | Found installed collection ibm.qradar:4.0.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/ibm/qradar' 2026-03-26 09:05:07.102477 | debian-bookworm | Loading collection vyos.vyos from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/vyos/vyos 2026-03-26 09:05:07.102876 | debian-bookworm | Found installed collection vyos.vyos:5.0.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/vyos/vyos' 2026-03-26 09:05:07.103313 | debian-bookworm | Loading collection community.windows from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/windows 2026-03-26 09:05:07.103646 | debian-bookworm | Found installed collection community.windows:2.4.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/windows' 2026-03-26 09:05:07.104452 | debian-bookworm | Loading collection cisco.iosxr from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/cisco/iosxr 2026-03-26 09:05:07.104787 | debian-bookworm | Found installed collection cisco.iosxr:10.3.1 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/cisco/iosxr' 2026-03-26 09:05:07.104974 | debian-bookworm | Loading collection community.sops from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/sops 2026-03-26 09:05:07.105326 | debian-bookworm | Found installed collection community.sops:2.2.7 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/sops' 2026-03-26 09:05:07.105655 | debian-bookworm | Loading collection inspur.ispim from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/inspur/ispim 2026-03-26 09:05:07.105972 | debian-bookworm | Found installed collection inspur.ispim:2.2.3 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/inspur/ispim' 2026-03-26 09:05:07.108131 | debian-bookworm | Loading collection cisco.meraki from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/cisco/meraki 2026-03-26 09:05:07.108574 | debian-bookworm | Found installed collection cisco.meraki:2.21.8 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/cisco/meraki' 2026-03-26 09:05:07.108966 | debian-bookworm | Loading collection community.zabbix from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/zabbix 2026-03-26 09:05:07.109309 | debian-bookworm | Found installed collection community.zabbix:3.3.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/zabbix' 2026-03-26 09:05:07.117903 | debian-bookworm | Loading collection community.general from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/general 2026-03-26 09:05:07.118188 | debian-bookworm | Found installed collection community.general:10.7.6 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/general' 2026-03-26 09:05:07.118663 | debian-bookworm | Loading collection vultr.cloud from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/vultr/cloud 2026-03-26 09:05:07.119030 | debian-bookworm | Found installed collection vultr.cloud:1.13.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/vultr/cloud' 2026-03-26 09:05:07.119337 | debian-bookworm | Loading collection netapp_eseries.santricity from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/netapp_eseries/santricity 2026-03-26 09:05:07.119683 | debian-bookworm | Found installed collection netapp_eseries.santricity:1.4.1 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/netapp_eseries/santricity' 2026-03-26 09:05:07.120186 | debian-bookworm | Loading collection telekom_mms.icinga_director from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/telekom_mms/icinga_director 2026-03-26 09:05:07.120547 | debian-bookworm | Found installed collection telekom_mms.icinga_director:2.4.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/telekom_mms/icinga_director' 2026-03-26 09:05:07.120914 | debian-bookworm | Loading collection cisco.asa from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/cisco/asa 2026-03-26 09:05:07.121241 | debian-bookworm | Found installed collection cisco.asa:6.1.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/cisco/asa' 2026-03-26 09:05:07.121446 | debian-bookworm | Loading collection ansible.utils from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/ansible/utils 2026-03-26 09:05:07.121830 | debian-bookworm | Found installed collection ansible.utils:5.1.2 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/ansible/utils' 2026-03-26 09:05:07.122112 | debian-bookworm | Loading collection purestorage.flasharray from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/purestorage/flasharray 2026-03-26 09:05:07.122520 | debian-bookworm | Found installed collection purestorage.flasharray:1.39.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/purestorage/flasharray' 2026-03-26 09:05:07.122873 | debian-bookworm | Loading collection community.proxmox from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/proxmox 2026-03-26 09:05:07.123172 | debian-bookworm | Found installed collection community.proxmox:1.4.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/proxmox' 2026-03-26 09:05:07.123679 | debian-bookworm | Loading collection community.crypto from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/crypto 2026-03-26 09:05:07.124002 | debian-bookworm | Found installed collection community.crypto:2.26.6 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/crypto' 2026-03-26 09:05:07.124790 | debian-bookworm | Loading collection dellemc.unity from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/dellemc/unity 2026-03-26 09:05:07.125146 | debian-bookworm | Found installed collection dellemc.unity:2.1.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/dellemc/unity' 2026-03-26 09:05:07.125447 | debian-bookworm | Loading collection ibm.spectrum_virtualize from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/ibm/spectrum_virtualize 2026-03-26 09:05:07.125965 | debian-bookworm | Found installed collection ibm.spectrum_virtualize:2.0.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/ibm/spectrum_virtualize' 2026-03-26 09:05:07.126917 | debian-bookworm | Starting galaxy collection install process 2026-03-26 09:05:07.127145 | debian-bookworm | Nothing to do. All requested collections are already installed. If you want to reinstall them, consider using `--force`. 2026-03-26 09:05:07.216286 | debian-bookworm | INFO [delegated > dependency] Dependency completed successfully. 2026-03-26 09:05:07.216403 | debian-bookworm | WARNING [delegated > dependency] Executed: Missing roles requirements file: requirements.yml (Remove from converge_sequence to suppress) 2026-03-26 09:05:07.236366 | debian-bookworm | INFO [delegated > create] Executing 2026-03-26 09:05:07.241183 | debian-bookworm | WARNING [delegated > create] Executed: Missing playbook (Remove from converge_sequence to suppress) 2026-03-26 09:05:07.260348 | debian-bookworm | INFO [delegated > prepare] Executing 2026-03-26 09:05:07.260522 | debian-bookworm | WARNING [delegated > prepare] Skipping, instances already prepared. 2026-03-26 09:05:07.260725 | debian-bookworm | INFO [delegated > prepare] Executed: Successful 2026-03-26 09:05:07.272375 | debian-bookworm | INFO [delegated > converge] Executing 2026-03-26 09:05:07.380712 | ubuntu-noble | ansible-galaxy [core 2.18.15] 2026-03-26 09:05:07.383101 | ubuntu-noble | config file = None 2026-03-26 09:05:07.383130 | ubuntu-noble | configured module search path = ['/home/zuul/src/github.com/osism/ansible-collection-services/plugins/modules', '/home/zuul/.ansible/plugins/modules', '/usr/share/ansible/plugins/modules'] 2026-03-26 09:05:07.383136 | ubuntu-noble | ansible python module location = /home/zuul/venv/lib/python3.12/site-packages/ansible 2026-03-26 09:05:07.383146 | ubuntu-noble | ansible collection location = /home/zuul/.ansible/collections:/usr/share/ansible/collections:/home/zuul/venv/lib/python3.12/site-packages:/home/zuul/venv/lib/python3.12/dist-packages:/home/zuul/venv/lib/python3/dist-packages:/home/zuul/venv/local/lib/python3.12/dist-packages 2026-03-26 09:05:07.383153 | ubuntu-noble | executable location = /home/zuul/venv/bin/ansible-galaxy 2026-03-26 09:05:07.383161 | ubuntu-noble | python version = 3.12.3 (main, Mar 3 2026, 12:15:18) [GCC 13.3.0] (/home/zuul/venv/bin/python3) 2026-03-26 09:05:07.383397 | ubuntu-noble | jinja version = 3.1.6 2026-03-26 09:05:07.383681 | ubuntu-noble | libyaml = True 2026-03-26 09:05:07.383970 | ubuntu-noble | No config file found; using defaults 2026-03-26 09:05:07.384542 | ubuntu-noble | Reading requirement file at '/home/zuul/src/github.com/osism/ansible-collection-services/molecule/delegated/collections.yml' 2026-03-26 09:05:07.393893 | ubuntu-noble | Loading collection community.library_inventory_filtering_v1 from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/library_inventory_filtering_v1 2026-03-26 09:05:07.394519 | ubuntu-noble | Found installed collection community.library_inventory_filtering_v1:1.1.5 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/library_inventory_filtering_v1' 2026-03-26 09:05:07.395075 | ubuntu-noble | Loading collection openstack.cloud from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/openstack/cloud 2026-03-26 09:05:07.395534 | ubuntu-noble | Found installed collection openstack.cloud:2.5.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/openstack/cloud' 2026-03-26 09:05:07.395871 | ubuntu-noble | Loading collection hitachivantara.vspone_object from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/hitachivantara/vspone_object 2026-03-26 09:05:07.396429 | ubuntu-noble | Found installed collection hitachivantara.vspone_object:1.0.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/hitachivantara/vspone_object' 2026-03-26 09:05:07.396868 | ubuntu-noble | Loading collection community.hashi_vault from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/hashi_vault 2026-03-26 09:05:07.397372 | ubuntu-noble | Found installed collection community.hashi_vault:6.2.1 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/hashi_vault' 2026-03-26 09:05:07.397708 | ubuntu-noble | Loading collection cyberark.pas from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/cyberark/pas 2026-03-26 09:05:07.398012 | ubuntu-noble | Found installed collection cyberark.pas:1.0.36 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/cyberark/pas' 2026-03-26 09:05:07.398483 | ubuntu-noble | Loading collection cisco.ucs from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/cisco/ucs 2026-03-26 09:05:07.398781 | ubuntu-noble | Found installed collection cisco.ucs:1.16.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/cisco/ucs' 2026-03-26 09:05:07.399767 | ubuntu-noble | Loading collection community.vmware from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/vmware 2026-03-26 09:05:07.400173 | ubuntu-noble | Found installed collection community.vmware:5.10.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/vmware' 2026-03-26 09:05:07.400541 | ubuntu-noble | Loading collection inspur.ispim from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/inspur/ispim 2026-03-26 09:05:07.400898 | ubuntu-noble | Found installed collection inspur.ispim:2.2.3 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/inspur/ispim' 2026-03-26 09:05:07.401311 | ubuntu-noble | Loading collection community.zabbix from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/zabbix 2026-03-26 09:05:07.401754 | ubuntu-noble | Found installed collection community.zabbix:3.3.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/zabbix' 2026-03-26 09:05:07.402166 | ubuntu-noble | Loading collection community.windows from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/windows 2026-03-26 09:05:07.402664 | ubuntu-noble | Found installed collection community.windows:2.4.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/windows' 2026-03-26 09:05:07.403130 | ubuntu-noble | Loading collection community.docker from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/docker 2026-03-26 09:05:07.403506 | ubuntu-noble | Found installed collection community.docker:4.8.2 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/docker' 2026-03-26 09:05:07.403768 | ubuntu-noble | Loading collection cyberark.conjur from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/cyberark/conjur 2026-03-26 09:05:07.404091 | ubuntu-noble | Found installed collection cyberark.conjur:1.3.8 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/cyberark/conjur' 2026-03-26 09:05:07.404324 | ubuntu-noble | Loading collection community.ciscosmb from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/ciscosmb 2026-03-26 09:05:07.404645 | ubuntu-noble | Found installed collection community.ciscosmb:1.0.11 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/ciscosmb' 2026-03-26 09:05:07.408519 | ubuntu-noble | Loading collection community.aws from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/aws 2026-03-26 09:05:07.408809 | ubuntu-noble | Found installed collection community.aws:9.3.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/aws' 2026-03-26 09:05:07.409851 | ubuntu-noble | Loading collection google.cloud from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/google/cloud 2026-03-26 09:05:07.410168 | ubuntu-noble | Found installed collection google.cloud:1.9.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/google/cloud' 2026-03-26 09:05:07.411074 | ubuntu-noble | Loading collection splunk.es from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/splunk/es 2026-03-26 09:05:07.411353 | ubuntu-noble | Found installed collection splunk.es:4.0.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/splunk/es' 2026-03-26 09:05:07.411708 | ubuntu-noble | Loading collection netapp.cloudmanager from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/netapp/cloudmanager 2026-03-26 09:05:07.412010 | ubuntu-noble | Found installed collection netapp.cloudmanager:21.24.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/netapp/cloudmanager' 2026-03-26 09:05:07.412339 | ubuntu-noble | Loading collection community.libvirt from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/libvirt 2026-03-26 09:05:07.412641 | ubuntu-noble | Found installed collection community.libvirt:1.4.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/libvirt' 2026-03-26 09:05:07.414937 | ubuntu-noble | Loading collection junipernetworks.junos from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/junipernetworks/junos 2026-03-26 09:05:07.415221 | ubuntu-noble | Found installed collection junipernetworks.junos:9.1.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/junipernetworks/junos' 2026-03-26 09:05:07.415622 | ubuntu-noble | Loading collection ansible.utils from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/ansible/utils 2026-03-26 09:05:07.415898 | ubuntu-noble | Found installed collection ansible.utils:5.1.2 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/ansible/utils' 2026-03-26 09:05:07.416537 | ubuntu-noble | Loading collection dellemc.powerflex from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/dellemc/powerflex 2026-03-26 09:05:07.416892 | ubuntu-noble | Found installed collection dellemc.powerflex:2.6.1 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/dellemc/powerflex' 2026-03-26 09:05:07.437376 | ubuntu-noble | Loading collection azure.azcollection from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/azure/azcollection 2026-03-26 09:05:07.437735 | ubuntu-noble | Found installed collection azure.azcollection:3.10.1 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/azure/azcollection' 2026-03-26 09:05:07.438955 | ubuntu-noble | Loading collection hetzner.hcloud from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/hetzner/hcloud 2026-03-26 09:05:07.439362 | ubuntu-noble | Found installed collection hetzner.hcloud:4.3.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/hetzner/hcloud' 2026-03-26 09:05:07.440384 | ubuntu-noble | Loading collection cloudscale_ch.cloud from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/cloudscale_ch/cloud 2026-03-26 09:05:07.441087 | ubuntu-noble | Found installed collection cloudscale_ch.cloud:2.5.2 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/cloudscale_ch/cloud' 2026-03-26 09:05:07.441108 | ubuntu-noble | Loading collection ravendb.ravendb from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/ravendb/ravendb 2026-03-26 09:05:07.441435 | ubuntu-noble | Found installed collection ravendb.ravendb:1.0.4 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/ravendb/ravendb' 2026-03-26 09:05:07.442235 | ubuntu-noble | Loading collection ovirt.ovirt from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/ovirt/ovirt 2026-03-26 09:05:07.442610 | ubuntu-noble | Found installed collection ovirt.ovirt:3.2.1 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/ovirt/ovirt' 2026-03-26 09:05:07.443050 | ubuntu-noble | Loading collection lowlydba.sqlserver from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/lowlydba/sqlserver 2026-03-26 09:05:07.443433 | ubuntu-noble | Found installed collection lowlydba.sqlserver:2.7.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/lowlydba/sqlserver' 2026-03-26 09:05:07.443680 | ubuntu-noble | Loading collection microsoft.ad from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/microsoft/ad 2026-03-26 09:05:07.444081 | ubuntu-noble | Found installed collection microsoft.ad:1.9.2 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/microsoft/ad' 2026-03-26 09:05:07.444411 | ubuntu-noble | Loading collection community.sap_libs from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/sap_libs 2026-03-26 09:05:07.444765 | ubuntu-noble | Found installed collection community.sap_libs:1.5.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/sap_libs' 2026-03-26 09:05:07.445172 | ubuntu-noble | Loading collection kaytus.ksmanage from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/kaytus/ksmanage 2026-03-26 09:05:07.445509 | ubuntu-noble | Found installed collection kaytus.ksmanage:2.0.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/kaytus/ksmanage' 2026-03-26 09:05:07.445802 | ubuntu-noble | Loading collection wti.remote from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/wti/remote 2026-03-26 09:05:07.447918 | ubuntu-noble | Found installed collection wti.remote:1.0.10 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/wti/remote' 2026-03-26 09:05:07.447961 | ubuntu-noble | Loading collection arista.eos from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/arista/eos 2026-03-26 09:05:07.447969 | ubuntu-noble | Found installed collection arista.eos:10.1.1 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/arista/eos' 2026-03-26 09:05:07.447976 | ubuntu-noble | Loading collection sensu.sensu_go from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/sensu/sensu_go 2026-03-26 09:05:07.447982 | ubuntu-noble | Found installed collection sensu.sensu_go:1.14.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/sensu/sensu_go' 2026-03-26 09:05:07.489050 | ubuntu-noble | Loading collection community.network from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/network 2026-03-26 09:05:07.489155 | ubuntu-noble | Found installed collection community.network:5.1.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/network' 2026-03-26 09:05:07.491112 | ubuntu-noble | Loading collection community.digitalocean from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/digitalocean 2026-03-26 09:05:07.491159 | ubuntu-noble | Found installed collection community.digitalocean:1.27.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/digitalocean' 2026-03-26 09:05:07.491172 | ubuntu-noble | Loading collection telekom_mms.icinga_director from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/telekom_mms/icinga_director 2026-03-26 09:05:07.491594 | ubuntu-noble | Found installed collection telekom_mms.icinga_director:2.4.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/telekom_mms/icinga_director' 2026-03-26 09:05:07.491968 | ubuntu-noble | Loading collection cloud.common from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/cloud/common 2026-03-26 09:05:07.492524 | ubuntu-noble | Found installed collection cloud.common:4.2.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/cloud/common' 2026-03-26 09:05:07.493858 | ubuntu-noble | Loading collection cisco.nxos from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/cisco/nxos 2026-03-26 09:05:07.494339 | ubuntu-noble | Found installed collection cisco.nxos:9.4.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/cisco/nxos' 2026-03-26 09:05:07.494723 | ubuntu-noble | Loading collection cisco.ise from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/cisco/ise 2026-03-26 09:05:07.495048 | ubuntu-noble | Found installed collection cisco.ise:2.10.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/cisco/ise' 2026-03-26 09:05:07.495471 | ubuntu-noble | Loading collection community.okd from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/okd 2026-03-26 09:05:07.495778 | ubuntu-noble | Found installed collection community.okd:4.0.2 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/okd' 2026-03-26 09:05:07.496206 | ubuntu-noble | Loading collection vyos.vyos from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/vyos/vyos 2026-03-26 09:05:07.496601 | ubuntu-noble | Found installed collection vyos.vyos:5.0.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/vyos/vyos' 2026-03-26 09:05:07.496981 | ubuntu-noble | Loading collection chocolatey.chocolatey from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/chocolatey/chocolatey 2026-03-26 09:05:07.497423 | ubuntu-noble | Found installed collection chocolatey.chocolatey:1.5.3 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/chocolatey/chocolatey' 2026-03-26 09:05:07.497768 | ubuntu-noble | Loading collection cisco.dnac from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/cisco/dnac 2026-03-26 09:05:07.498045 | ubuntu-noble | Found installed collection cisco.dnac:6.31.3 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/cisco/dnac' 2026-03-26 09:05:07.498326 | ubuntu-noble | Loading collection community.proxmox from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/proxmox 2026-03-26 09:05:07.498655 | ubuntu-noble | Found installed collection community.proxmox:1.4.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/proxmox' 2026-03-26 09:05:07.498930 | ubuntu-noble | Loading collection community.sops from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/sops 2026-03-26 09:05:07.499224 | ubuntu-noble | Found installed collection community.sops:2.2.7 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/sops' 2026-03-26 09:05:07.499567 | ubuntu-noble | Loading collection infinidat.infinibox from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/infinidat/infinibox 2026-03-26 09:05:07.499822 | ubuntu-noble | Found installed collection infinidat.infinibox:1.6.3 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/infinidat/infinibox' 2026-03-26 09:05:07.500152 | ubuntu-noble | Loading collection containers.podman from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/containers/podman 2026-03-26 09:05:07.500381 | ubuntu-noble | Found installed collection containers.podman:1.18.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/containers/podman' 2026-03-26 09:05:07.500856 | ubuntu-noble | Loading collection ibm.storage_virtualize from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/ibm/storage_virtualize 2026-03-26 09:05:07.500869 | ubuntu-noble | Found installed collection ibm.storage_virtualize:2.7.4 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/ibm/storage_virtualize' 2026-03-26 09:05:07.501737 | ubuntu-noble | Loading collection cisco.aci from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/cisco/aci 2026-03-26 09:05:07.502098 | ubuntu-noble | Found installed collection cisco.aci:2.12.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/cisco/aci' 2026-03-26 09:05:07.503088 | ubuntu-noble | Loading collection ibm.qradar from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/ibm/qradar 2026-03-26 09:05:07.503112 | ubuntu-noble | Found installed collection ibm.qradar:4.0.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/ibm/qradar' 2026-03-26 09:05:07.503120 | ubuntu-noble | Loading collection grafana.grafana from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/grafana/grafana 2026-03-26 09:05:07.503479 | ubuntu-noble | Found installed collection grafana.grafana:5.7.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/grafana/grafana' 2026-03-26 09:05:07.504129 | ubuntu-noble | Loading collection dellemc.openmanage from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/dellemc/openmanage 2026-03-26 09:05:07.504413 | ubuntu-noble | Found installed collection dellemc.openmanage:9.12.3 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/dellemc/openmanage' 2026-03-26 09:05:07.504961 | ubuntu-noble | Loading collection community.rabbitmq from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/rabbitmq 2026-03-26 09:05:07.504975 | ubuntu-noble | Found installed collection community.rabbitmq:1.6.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/rabbitmq' 2026-03-26 09:05:07.505683 | ubuntu-noble | Loading collection check_point.mgmt from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/check_point/mgmt 2026-03-26 09:05:07.505704 | ubuntu-noble | Found installed collection check_point.mgmt:6.6.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/check_point/mgmt' 2026-03-26 09:05:07.506405 | ubuntu-noble | Loading collection dellemc.enterprise_sonic from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/dellemc/enterprise_sonic 2026-03-26 09:05:07.506761 | ubuntu-noble | Found installed collection dellemc.enterprise_sonic:2.5.1 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/dellemc/enterprise_sonic' 2026-03-26 09:05:07.508651 | ubuntu-noble | Loading collection theforeman.foreman from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/theforeman/foreman 2026-03-26 09:05:07.508912 | ubuntu-noble | Found installed collection theforeman.foreman:4.2.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/theforeman/foreman' 2026-03-26 09:05:07.509630 | ubuntu-noble | Loading collection vultr.cloud from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/vultr/cloud 2026-03-26 09:05:07.509664 | ubuntu-noble | Found installed collection vultr.cloud:1.13.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/vultr/cloud' 2026-03-26 09:05:07.510412 | ubuntu-noble | Loading collection hitachivantara.vspone_block from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/hitachivantara/vspone_block 2026-03-26 09:05:07.510433 | ubuntu-noble | Found installed collection hitachivantara.vspone_block:3.5.1 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/hitachivantara/vspone_block' 2026-03-26 09:05:07.511383 | ubuntu-noble | Loading collection kubevirt.core from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/kubevirt/core 2026-03-26 09:05:07.511409 | ubuntu-noble | Found installed collection kubevirt.core:2.2.3 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/kubevirt/core' 2026-03-26 09:05:07.511932 | ubuntu-noble | Loading collection netbox.netbox from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/netbox/netbox 2026-03-26 09:05:07.512193 | ubuntu-noble | Found installed collection netbox.netbox:3.21.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/netbox/netbox' 2026-03-26 09:05:07.512602 | ubuntu-noble | Loading collection community.postgresql from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/postgresql 2026-03-26 09:05:07.512830 | ubuntu-noble | Found installed collection community.postgresql:3.14.2 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/postgresql' 2026-03-26 09:05:07.513950 | ubuntu-noble | Loading collection ansible.netcommon from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/ansible/netcommon 2026-03-26 09:05:07.514279 | ubuntu-noble | Found installed collection ansible.netcommon:7.2.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/ansible/netcommon' 2026-03-26 09:05:07.517863 | ubuntu-noble | Loading collection fortinet.fortios from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/fortinet/fortios 2026-03-26 09:05:07.518225 | ubuntu-noble | Found installed collection fortinet.fortios:2.4.2 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/fortinet/fortios' 2026-03-26 09:05:07.527892 | ubuntu-noble | Loading collection community.general from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/general 2026-03-26 09:05:07.528371 | ubuntu-noble | Found installed collection community.general:10.7.6 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/general' 2026-03-26 09:05:07.528792 | ubuntu-noble | Loading collection vmware.vmware from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/vmware/vmware 2026-03-26 09:05:07.529241 | ubuntu-noble | Found installed collection vmware.vmware:1.11.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/vmware/vmware' 2026-03-26 09:05:07.533141 | ubuntu-noble | Loading collection vmware.vmware_rest from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/vmware/vmware_rest 2026-03-26 09:05:07.533211 | ubuntu-noble | Found installed collection vmware.vmware_rest:4.9.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/vmware/vmware_rest' 2026-03-26 09:05:07.533611 | ubuntu-noble | Loading collection ansible.windows from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/ansible/windows 2026-03-26 09:05:07.534079 | ubuntu-noble | Found installed collection ansible.windows:2.8.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/ansible/windows' 2026-03-26 09:05:07.534824 | ubuntu-noble | Loading collection cisco.meraki from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/cisco/meraki 2026-03-26 09:05:07.535359 | ubuntu-noble | Found installed collection cisco.meraki:2.21.8 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/cisco/meraki' 2026-03-26 09:05:07.541049 | ubuntu-noble | Loading collection fortinet.fortimanager from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/fortinet/fortimanager 2026-03-26 09:05:07.541619 | ubuntu-noble | Found installed collection fortinet.fortimanager:2.11.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/fortinet/fortimanager' 2026-03-26 09:05:07.541998 | ubuntu-noble | Loading collection community.mysql from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/mysql 2026-03-26 09:05:07.542590 | ubuntu-noble | Found installed collection community.mysql:3.16.1 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/mysql' 2026-03-26 09:05:07.544106 | ubuntu-noble | Loading collection community.dns from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/dns 2026-03-26 09:05:07.544141 | ubuntu-noble | Found installed collection community.dns:3.4.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/dns' 2026-03-26 09:05:07.544152 | ubuntu-noble | Loading collection amazon.aws from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/amazon/aws 2026-03-26 09:05:07.544264 | ubuntu-noble | Found installed collection amazon.aws:9.5.2 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/amazon/aws' 2026-03-26 09:05:07.544656 | ubuntu-noble | Loading collection ieisystem.inmanage from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/ieisystem/inmanage 2026-03-26 09:05:07.544978 | ubuntu-noble | Found installed collection ieisystem.inmanage:3.0.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/ieisystem/inmanage' 2026-03-26 09:05:07.545420 | ubuntu-noble | Loading collection purestorage.flashblade from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/purestorage/flashblade 2026-03-26 09:05:07.545736 | ubuntu-noble | Found installed collection purestorage.flashblade:1.22.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/purestorage/flashblade' 2026-03-26 09:05:07.546154 | ubuntu-noble | Loading collection ibm.spectrum_virtualize from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/ibm/spectrum_virtualize 2026-03-26 09:05:07.546697 | ubuntu-noble | Found installed collection ibm.spectrum_virtualize:2.0.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/ibm/spectrum_virtualize' 2026-03-26 09:05:07.547001 | ubuntu-noble | Loading collection ansible.posix from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/ansible/posix 2026-03-26 09:05:07.547310 | ubuntu-noble | Found installed collection ansible.posix:1.6.2 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/ansible/posix' 2026-03-26 09:05:07.547678 | ubuntu-noble | Loading collection cisco.mso from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/cisco/mso 2026-03-26 09:05:07.547998 | ubuntu-noble | Found installed collection cisco.mso:2.11.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/cisco/mso' 2026-03-26 09:05:07.548549 | ubuntu-noble | Loading collection ngine_io.cloudstack from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/ngine_io/cloudstack 2026-03-26 09:05:07.548866 | ubuntu-noble | Found installed collection ngine_io.cloudstack:2.5.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/ngine_io/cloudstack' 2026-03-26 09:05:07.549186 | ubuntu-noble | Loading collection f5networks.f5_modules from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/f5networks/f5_modules 2026-03-26 09:05:07.549489 | ubuntu-noble | Found installed collection f5networks.f5_modules:1.39.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/f5networks/f5_modules' 2026-03-26 09:05:07.549755 | ubuntu-noble | Loading collection community.routeros from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/routeros 2026-03-26 09:05:07.550053 | ubuntu-noble | Found installed collection community.routeros:3.13.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/routeros' 2026-03-26 09:05:07.550671 | ubuntu-noble | Loading collection cisco.iosxr from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/cisco/iosxr 2026-03-26 09:05:07.550960 | ubuntu-noble | Found installed collection cisco.iosxr:10.3.1 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/cisco/iosxr' 2026-03-26 09:05:07.551269 | ubuntu-noble | Loading collection purestorage.flasharray from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/purestorage/flasharray 2026-03-26 09:05:07.551559 | ubuntu-noble | Found installed collection purestorage.flasharray:1.39.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/purestorage/flasharray' 2026-03-26 09:05:07.551870 | ubuntu-noble | Loading collection netapp.storagegrid from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/netapp/storagegrid 2026-03-26 09:05:07.552213 | ubuntu-noble | Found installed collection netapp.storagegrid:21.14.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/netapp/storagegrid' 2026-03-26 09:05:07.553414 | ubuntu-noble | Loading collection dellemc.unity from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/dellemc/unity 2026-03-26 09:05:07.553436 | ubuntu-noble | Found installed collection dellemc.unity:2.1.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/dellemc/unity' 2026-03-26 09:05:07.554123 | ubuntu-noble | Loading collection community.hrobot from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/hrobot 2026-03-26 09:05:07.554145 | ubuntu-noble | Found installed collection community.hrobot:2.7.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/hrobot' 2026-03-26 09:05:07.554920 | ubuntu-noble | Loading collection cisco.ios from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/cisco/ios 2026-03-26 09:05:07.555230 | ubuntu-noble | Found installed collection cisco.ios:9.2.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/cisco/ios' 2026-03-26 09:05:07.555733 | ubuntu-noble | Loading collection cisco.intersight from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/cisco/intersight 2026-03-26 09:05:07.555751 | ubuntu-noble | Found installed collection cisco.intersight:2.7.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/cisco/intersight' 2026-03-26 09:05:07.555979 | ubuntu-noble | Loading collection cisco.asa from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/cisco/asa 2026-03-26 09:05:07.556272 | ubuntu-noble | Found installed collection cisco.asa:6.1.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/cisco/asa' 2026-03-26 09:05:07.556528 | ubuntu-noble | Loading collection microsoft.iis from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/microsoft/iis 2026-03-26 09:05:07.556778 | ubuntu-noble | Found installed collection microsoft.iis:1.0.3 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/microsoft/iis' 2026-03-26 09:05:07.557464 | ubuntu-noble | Loading collection kubernetes.core from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/kubernetes/core 2026-03-26 09:05:07.557712 | ubuntu-noble | Found installed collection kubernetes.core:5.4.1 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/kubernetes/core' 2026-03-26 09:05:07.560101 | ubuntu-noble | Loading collection awx.awx from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/awx/awx 2026-03-26 09:05:07.560396 | ubuntu-noble | Found installed collection awx.awx:24.6.1 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/awx/awx' 2026-03-26 09:05:07.560630 | ubuntu-noble | Loading collection community.proxysql from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/proxysql 2026-03-26 09:05:07.561176 | ubuntu-noble | Found installed collection community.proxysql:1.7.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/proxysql' 2026-03-26 09:05:07.561195 | ubuntu-noble | Loading collection netapp_eseries.santricity from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/netapp_eseries/santricity 2026-03-26 09:05:07.561519 | ubuntu-noble | Found installed collection netapp_eseries.santricity:1.4.1 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/netapp_eseries/santricity' 2026-03-26 09:05:07.562508 | ubuntu-noble | Loading collection netapp.ontap from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/netapp/ontap 2026-03-26 09:05:07.562755 | ubuntu-noble | Found installed collection netapp.ontap:22.14.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/netapp/ontap' 2026-03-26 09:05:07.563298 | ubuntu-noble | Loading collection community.crypto from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/crypto 2026-03-26 09:05:07.563623 | ubuntu-noble | Found installed collection community.crypto:2.26.6 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/crypto' 2026-03-26 09:05:07.563868 | ubuntu-noble | Loading collection infoblox.nios_modules from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/infoblox/nios_modules 2026-03-26 09:05:07.564152 | ubuntu-noble | Found installed collection infoblox.nios_modules:1.8.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/infoblox/nios_modules' 2026-03-26 09:05:07.564615 | ubuntu-noble | Loading collection community.mongodb from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/mongodb 2026-03-26 09:05:07.564837 | ubuntu-noble | Found installed collection community.mongodb:1.7.10 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/mongodb' 2026-03-26 09:05:07.565224 | ubuntu-noble | Loading collection community.grafana from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/grafana 2026-03-26 09:05:07.565665 | ubuntu-noble | Found installed collection community.grafana:2.3.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/grafana' 2026-03-26 09:05:07.578178 | ubuntu-noble | Loading collection osism.commons from /home/zuul/.ansible/collections/ansible_collections/osism/commons 2026-03-26 09:05:07.579785 | ubuntu-noble | Found installed collection osism.commons:0.20260318.0 at '/home/zuul/.ansible/collections/ansible_collections/osism/commons' 2026-03-26 09:05:07.581144 | ubuntu-noble | Loading collection osism.services from /home/zuul/.ansible/collections/ansible_collections/osism/services 2026-03-26 09:05:07.581408 | ubuntu-noble | Found installed collection osism.services:999.0.0 at '/home/zuul/.ansible/collections/ansible_collections/osism/services' 2026-03-26 09:05:07.582447 | ubuntu-noble | Starting galaxy collection install process 2026-03-26 09:05:07.582476 | ubuntu-noble | Nothing to do. All requested collections are already installed. If you want to reinstall them, consider using `--force`. 2026-03-26 09:05:07.659151 | ubuntu-noble | INFO [delegated > dependency] Dependency completed successfully. 2026-03-26 09:05:07.659215 | ubuntu-noble | WARNING [delegated > dependency] Executed: Missing roles requirements file: requirements.yml (Remove from converge_sequence to suppress) 2026-03-26 09:05:07.674292 | ubuntu-noble | INFO [delegated > create] Executing 2026-03-26 09:05:07.677206 | ubuntu-noble | WARNING [delegated > create] Executed: Missing playbook (Remove from converge_sequence to suppress) 2026-03-26 09:05:07.686590 | ubuntu-noble | INFO [delegated > prepare] Executing 2026-03-26 09:05:07.686698 | ubuntu-noble | WARNING [delegated > prepare] Skipping, instances already prepared. 2026-03-26 09:05:07.686788 | ubuntu-noble | INFO [delegated > prepare] Executed: Successful 2026-03-26 09:05:07.695429 | ubuntu-noble | INFO [delegated > converge] Executing 2026-03-26 09:05:07.645026 | debian-bookworm | DEBUG [delegated > converge] ansible-playbook version: ansible-playbook 2026-03-26 09:05:07.645123 | debian-bookworm | config file = None 2026-03-26 09:05:07.645130 | debian-bookworm | configured module search path = 2026-03-26 09:05:07.645136 | debian-bookworm | ansible python module location = /home/zuul/venv/lib/python3.11/site-packages/ansible 2026-03-26 09:05:07.645142 | debian-bookworm | ansible collection location = /home/zuul/.ansible/collections:/usr/share/ansible/collections 2026-03-26 09:05:07.645146 | debian-bookworm | executable location = /home/zuul/venv/bin/ansible-playbook 2026-03-26 09:05:07.645151 | debian-bookworm | python version = 3.11.2 (main, Apr 28 2025, 14:11:48) (/home/zuul/venv/bin/python3) 2026-03-26 09:05:07.645155 | debian-bookworm | jinja version = 3.1.6 2026-03-26 09:05:07.645160 | debian-bookworm | libyaml = True 2026-03-26 09:05:07.645175 | debian-bookworm | DEBUG ANSIBLE ENVIRONMENT: 2026-03-26 09:05:07.645179 | debian-bookworm | ANSIBLE_COLLECTIONS_PATH: /home/zuul/venv/.ansible/collections:/home/zuul/.ansible/collections 2026-03-26 09:05:07.645183 | debian-bookworm | ANSIBLE_CONFIG: /home/zuul/.ansible/tmp/molecule.oWZD.delegated/ansible.cfg 2026-03-26 09:05:07.645187 | debian-bookworm | ANSIBLE_LIBRARY: ../../plugins 2026-03-26 09:05:07.645191 | debian-bookworm | ANSIBLE_PYTHON_INTERPRETER: /home/zuul/venv/bin/python 2026-03-26 09:05:07.645195 | debian-bookworm | ANSIBLE_ROLE: auditd 2026-03-26 09:05:07.645199 | debian-bookworm | ANSIBLE_ROLES_PATH: ../../roles 2026-03-26 09:05:07.645203 | debian-bookworm | ANSIBLE_VERBOSITY: 1 2026-03-26 09:05:07.645207 | debian-bookworm | 2026-03-26 09:05:07.645321 | debian-bookworm | DEBUG MOLECULE ENVIRONMENT: 2026-03-26 09:05:07.645328 | debian-bookworm | MOLECULE_DEBUG: True 2026-03-26 09:05:07.645332 | debian-bookworm | MOLECULE_DEPENDENCY_NAME: galaxy 2026-03-26 09:05:07.645355 | debian-bookworm | MOLECULE_DRIVER_NAME: default 2026-03-26 09:05:07.645359 | debian-bookworm | MOLECULE_ENV_FILE: /home/zuul/src/github.com/osism/ansible-collection-services/.env.yml 2026-03-26 09:05:07.645367 | debian-bookworm | MOLECULE_EPHEMERAL_DIRECTORY: /home/zuul/.ansible/tmp/molecule.oWZD.delegated 2026-03-26 09:05:07.645372 | debian-bookworm | MOLECULE_FILE: /home/zuul/.ansible/tmp/molecule.oWZD.delegated/molecule.yml 2026-03-26 09:05:07.645376 | debian-bookworm | MOLECULE_INSTANCE_CONFIG: /home/zuul/.ansible/tmp/molecule.oWZD.delegated/instance_config.yml 2026-03-26 09:05:07.645380 | debian-bookworm | MOLECULE_INVENTORY_FILE: /home/zuul/.ansible/tmp/molecule.oWZD.delegated/inventory/ansible_inventory.yml 2026-03-26 09:05:07.645397 | debian-bookworm | MOLECULE_PROJECT_DIRECTORY: /home/zuul/src/github.com/osism/ansible-collection-services 2026-03-26 09:05:07.645402 | debian-bookworm | MOLECULE_PROVISIONER_NAME: ansible 2026-03-26 09:05:07.645406 | debian-bookworm | MOLECULE_SCENARIO_DIRECTORY: /home/zuul/src/github.com/osism/ansible-collection-services/molecule/delegated 2026-03-26 09:05:07.645410 | debian-bookworm | MOLECULE_SCENARIO_NAME: delegated 2026-03-26 09:05:07.645414 | debian-bookworm | MOLECULE_STATE_FILE: /home/zuul/.ansible/tmp/molecule.oWZD.delegated/state.yml 2026-03-26 09:05:07.645418 | debian-bookworm | MOLECULE_VERIFIER_NAME: testinfra 2026-03-26 09:05:07.645421 | debian-bookworm | MOLECULE_VERIFIER_TEST_DIRECTORY: /home/zuul/src/github.com/osism/ansible-collection-services/molecule/delegated/tests 2026-03-26 09:05:07.645426 | debian-bookworm | 2026-03-26 09:05:07.645534 | debian-bookworm | DEBUG SHELL REPLAY: ANSIBLE_COLLECTIONS_PATH=/home/zuul/venv/.ansible/collections:/home/zuul/.ansible/collections ANSIBLE_CONFIG=/home/zuul/.ansible/tmp/molecule.oWZD.delegated/ansible.cfg ANSIBLE_LIBRARY=../../plugins ANSIBLE_PYTHON_INTERPRETER=/home/zuul/venv/bin/python ANSIBLE_ROLE=auditd ANSIBLE_ROLES_PATH=../../roles ANSIBLE_VERBOSITY=1 MOLECULE_DEBUG=True MOLECULE_DEPENDENCY_NAME=galaxy MOLECULE_DRIVER_NAME=default MOLECULE_ENV_FILE=/home/zuul/src/github.com/osism/ansible-collection-services/.env.yml MOLECULE_EPHEMERAL_DIRECTORY=/home/zuul/.ansible/tmp/molecule.oWZD.delegated MOLECULE_FILE=/home/zuul/.ansible/tmp/molecule.oWZD.delegated/molecule.yml MOLECULE_INSTANCE_CONFIG=/home/zuul/.ansible/tmp/molecule.oWZD.delegated/instance_config.yml MOLECULE_INVENTORY_FILE=/home/zuul/.ansible/tmp/molecule.oWZD.delegated/inventory/ansible_inventory.yml MOLECULE_PROJECT_DIRECTORY=/home/zuul/src/github.com/osism/ansible-collection-services MOLECULE_PROVISIONER_NAME=ansible MOLECULE_SCENARIO_DIRECTORY=/home/zuul/src/github.com/osism/ansible-collection-services/molecule/delegated MOLECULE_SCENARIO_NAME=delegated MOLECULE_STATE_FILE=/home/zuul/.ansible/tmp/molecule.oWZD.delegated/state.yml MOLECULE_VERIFIER_NAME=testinfra MOLECULE_VERIFIER_TEST_DIRECTORY=/home/zuul/src/github.com/osism/ansible-collection-services/molecule/delegated/tests 2026-03-26 09:05:08.122151 | ubuntu-noble | DEBUG [delegated > converge] ansible-playbook version: ansible-playbook 2026-03-26 09:05:08.122204 | ubuntu-noble | config file = None 2026-03-26 09:05:08.122211 | ubuntu-noble | configured module search path = 2026-03-26 09:05:08.122215 | ubuntu-noble | ansible python module location = /home/zuul/venv/lib/python3.12/site-packages/ansible 2026-03-26 09:05:08.122220 | ubuntu-noble | ansible collection location = /home/zuul/.ansible/collections:/usr/share/ansible/collections 2026-03-26 09:05:08.122224 | ubuntu-noble | executable location = /home/zuul/venv/bin/ansible-playbook 2026-03-26 09:05:08.122227 | ubuntu-noble | python version = 3.12.3 (main, Mar 3 2026, 12:15:18) (/home/zuul/venv/bin/python3) 2026-03-26 09:05:08.122231 | ubuntu-noble | jinja version = 3.1.6 2026-03-26 09:05:08.122234 | ubuntu-noble | libyaml = True 2026-03-26 09:05:08.122238 | ubuntu-noble | DEBUG ANSIBLE ENVIRONMENT: 2026-03-26 09:05:08.122241 | ubuntu-noble | ANSIBLE_COLLECTIONS_PATH: /home/zuul/venv/.ansible/collections:/home/zuul/.ansible/collections 2026-03-26 09:05:08.122245 | ubuntu-noble | ANSIBLE_CONFIG: /home/zuul/.ansible/tmp/molecule.oWZD.delegated/ansible.cfg 2026-03-26 09:05:08.122248 | ubuntu-noble | ANSIBLE_LIBRARY: ../../plugins 2026-03-26 09:05:08.122251 | ubuntu-noble | ANSIBLE_PYTHON_INTERPRETER: /home/zuul/venv/bin/python 2026-03-26 09:05:08.122254 | ubuntu-noble | ANSIBLE_ROLE: auditd 2026-03-26 09:05:08.122258 | ubuntu-noble | ANSIBLE_ROLES_PATH: ../../roles 2026-03-26 09:05:08.122262 | ubuntu-noble | ANSIBLE_VERBOSITY: 1 2026-03-26 09:05:08.122267 | ubuntu-noble | 2026-03-26 09:05:08.122270 | ubuntu-noble | DEBUG MOLECULE ENVIRONMENT: 2026-03-26 09:05:08.122274 | ubuntu-noble | MOLECULE_DEBUG: True 2026-03-26 09:05:08.122277 | ubuntu-noble | MOLECULE_DEPENDENCY_NAME: galaxy 2026-03-26 09:05:08.122296 | ubuntu-noble | MOLECULE_DRIVER_NAME: default 2026-03-26 09:05:08.122299 | ubuntu-noble | MOLECULE_ENV_FILE: /home/zuul/src/github.com/osism/ansible-collection-services/.env.yml 2026-03-26 09:05:08.122303 | ubuntu-noble | MOLECULE_EPHEMERAL_DIRECTORY: /home/zuul/.ansible/tmp/molecule.oWZD.delegated 2026-03-26 09:05:08.122307 | ubuntu-noble | MOLECULE_FILE: /home/zuul/.ansible/tmp/molecule.oWZD.delegated/molecule.yml 2026-03-26 09:05:08.122311 | ubuntu-noble | MOLECULE_INSTANCE_CONFIG: /home/zuul/.ansible/tmp/molecule.oWZD.delegated/instance_config.yml 2026-03-26 09:05:08.122317 | ubuntu-noble | MOLECULE_INVENTORY_FILE: /home/zuul/.ansible/tmp/molecule.oWZD.delegated/inventory/ansible_inventory.yml 2026-03-26 09:05:08.122323 | ubuntu-noble | MOLECULE_PROJECT_DIRECTORY: /home/zuul/src/github.com/osism/ansible-collection-services 2026-03-26 09:05:08.122328 | ubuntu-noble | MOLECULE_PROVISIONER_NAME: ansible 2026-03-26 09:05:08.122334 | ubuntu-noble | MOLECULE_SCENARIO_DIRECTORY: /home/zuul/src/github.com/osism/ansible-collection-services/molecule/delegated 2026-03-26 09:05:08.122340 | ubuntu-noble | MOLECULE_SCENARIO_NAME: delegated 2026-03-26 09:05:08.122347 | ubuntu-noble | MOLECULE_STATE_FILE: /home/zuul/.ansible/tmp/molecule.oWZD.delegated/state.yml 2026-03-26 09:05:08.122353 | ubuntu-noble | MOLECULE_VERIFIER_NAME: testinfra 2026-03-26 09:05:08.122360 | ubuntu-noble | MOLECULE_VERIFIER_TEST_DIRECTORY: /home/zuul/src/github.com/osism/ansible-collection-services/molecule/delegated/tests 2026-03-26 09:05:08.122369 | ubuntu-noble | 2026-03-26 09:05:08.122387 | ubuntu-noble | DEBUG SHELL REPLAY: ANSIBLE_COLLECTIONS_PATH=/home/zuul/venv/.ansible/collections:/home/zuul/.ansible/collections ANSIBLE_CONFIG=/home/zuul/.ansible/tmp/molecule.oWZD.delegated/ansible.cfg ANSIBLE_LIBRARY=../../plugins ANSIBLE_PYTHON_INTERPRETER=/home/zuul/venv/bin/python ANSIBLE_ROLE=auditd ANSIBLE_ROLES_PATH=../../roles ANSIBLE_VERBOSITY=1 MOLECULE_DEBUG=True MOLECULE_DEPENDENCY_NAME=galaxy MOLECULE_DRIVER_NAME=default MOLECULE_ENV_FILE=/home/zuul/src/github.com/osism/ansible-collection-services/.env.yml MOLECULE_EPHEMERAL_DIRECTORY=/home/zuul/.ansible/tmp/molecule.oWZD.delegated MOLECULE_FILE=/home/zuul/.ansible/tmp/molecule.oWZD.delegated/molecule.yml MOLECULE_INSTANCE_CONFIG=/home/zuul/.ansible/tmp/molecule.oWZD.delegated/instance_config.yml MOLECULE_INVENTORY_FILE=/home/zuul/.ansible/tmp/molecule.oWZD.delegated/inventory/ansible_inventory.yml MOLECULE_PROJECT_DIRECTORY=/home/zuul/src/github.com/osism/ansible-collection-services MOLECULE_PROVISIONER_NAME=ansible MOLECULE_SCENARIO_DIRECTORY=/home/zuul/src/github.com/osism/ansible-collection-services/molecule/delegated MOLECULE_SCENARIO_NAME=delegated MOLECULE_STATE_FILE=/home/zuul/.ansible/tmp/molecule.oWZD.delegated/state.yml MOLECULE_VERIFIER_NAME=testinfra MOLECULE_VERIFIER_TEST_DIRECTORY=/home/zuul/src/github.com/osism/ansible-collection-services/molecule/delegated/tests 2026-03-26 09:05:07.946472 | debian-bookworm | Using /home/zuul/.ansible/tmp/molecule.oWZD.delegated/ansible.cfg as config file 2026-03-26 09:05:08.212080 | debian-bookworm | 2026-03-26 09:05:08.212405 | debian-bookworm | PLAY [Converge] **************************************************************** 2026-03-26 09:05:08.212689 | debian-bookworm | 2026-03-26 09:05:08.212984 | debian-bookworm | TASK [Gathering Facts] ********************************************************* 2026-03-26 09:05:08.489215 | ubuntu-noble | Using /home/zuul/.ansible/tmp/molecule.oWZD.delegated/ansible.cfg as config file 2026-03-26 09:05:08.747213 | ubuntu-noble | 2026-03-26 09:05:08.747295 | ubuntu-noble | PLAY [Converge] **************************************************************** 2026-03-26 09:05:08.747468 | ubuntu-noble | 2026-03-26 09:05:08.747854 | ubuntu-noble | TASK [Gathering Facts] ********************************************************* 2026-03-26 09:05:09.410293 | debian-bookworm | ok: [molecule-auditd] 2026-03-26 09:05:09.410372 | debian-bookworm | 2026-03-26 09:05:09.410467 | debian-bookworm | TASK [Include required variables] ********************************************** 2026-03-26 09:05:09.441930 | debian-bookworm | ok: [molecule-auditd] => {"ansible_facts": {}, "ansible_included_var_files": ["/home/zuul/src/github.com/osism/ansible-collection-services/molecule/delegated/vars/auditd.yml"], "changed": false} 2026-03-26 09:05:09.442050 | debian-bookworm | 2026-03-26 09:05:09.442111 | debian-bookworm | TASK [Include role auditd] ***************************************************** 2026-03-26 09:05:09.486813 | debian-bookworm | included: auditd for molecule-auditd 2026-03-26 09:05:09.486941 | debian-bookworm | 2026-03-26 09:05:09.486958 | debian-bookworm | TASK [auditd : Include distribution specific install tasks] ******************** 2026-03-26 09:05:09.535508 | debian-bookworm | included: /home/zuul/src/github.com/osism/ansible-collection-services/roles/auditd/tasks/install-Debian-family.yml for molecule-auditd 2026-03-26 09:05:09.535679 | debian-bookworm | 2026-03-26 09:05:09.535716 | debian-bookworm | TASK [auditd : Install auditd package] ***************************************** 2026-03-26 09:05:10.109618 | ubuntu-noble | ok: [molecule-auditd] 2026-03-26 09:05:10.109701 | ubuntu-noble | 2026-03-26 09:05:10.109820 | ubuntu-noble | TASK [Include required variables] ********************************************** 2026-03-26 09:05:10.141310 | ubuntu-noble | ok: [molecule-auditd] => {"ansible_facts": {}, "ansible_included_var_files": ["/home/zuul/src/github.com/osism/ansible-collection-services/molecule/delegated/vars/auditd.yml"], "changed": false} 2026-03-26 09:05:10.141388 | ubuntu-noble | 2026-03-26 09:05:10.141502 | ubuntu-noble | TASK [Include role auditd] ***************************************************** 2026-03-26 09:05:10.209751 | ubuntu-noble | included: auditd for molecule-auditd 2026-03-26 09:05:10.210024 | ubuntu-noble | 2026-03-26 09:05:10.210299 | ubuntu-noble | TASK [auditd : Include distribution specific install tasks] ******************** 2026-03-26 09:05:10.253813 | ubuntu-noble | included: /home/zuul/src/github.com/osism/ansible-collection-services/roles/auditd/tasks/install-Debian-family.yml for molecule-auditd 2026-03-26 09:05:10.254084 | ubuntu-noble | 2026-03-26 09:05:10.254350 | ubuntu-noble | TASK [auditd : Install auditd package] ***************************************** 2026-03-26 09:05:14.534881 | debian-bookworm | The following additional packages will be installed: 2026-03-26 09:05:14.534971 | debian-bookworm | libauparse0 2026-03-26 09:05:14.534982 | debian-bookworm | Suggested packages: 2026-03-26 09:05:14.535004 | debian-bookworm | audispd-plugins 2026-03-26 09:05:14.535133 | debian-bookworm | The following NEW packages will be installed: 2026-03-26 09:05:14.535292 | debian-bookworm | auditd libauparse0 2026-03-26 09:05:14.535471 | debian-bookworm | 0 upgraded, 2 newly installed, 0 to remove and 0 not upgraded. 2026-03-26 09:05:14.536759 | debian-bookworm | changed: [molecule-auditd] => {"cache_update_time": 1774515810, "cache_updated": false, "changed": true, "stderr": "debconf: delaying package configuration, since apt-utils is not installed\n", "stderr_lines": ["debconf: delaying package configuration, since apt-utils is not installed"], "stdout": "Reading package lists...\nBuilding dependency tree...\nReading state information...\nThe following additional packages will be installed:\n libauparse0\nSuggested packages:\n audispd-plugins\nThe following NEW packages will be installed:\n auditd libauparse0\n0 upgraded, 2 newly installed, 0 to remove and 0 not upgraded.\nNeed to get 279 kB of archives.\nAfter this operation, 934 kB of additional disk space will be used.\nGet:1 http://deb.debian.org/debian bookworm/main amd64 libauparse0 amd64 1:3.0.9-1 [61.9 kB]\nGet:2 http://deb.debian.org/debian bookworm/main amd64 auditd amd64 1:3.0.9-1 [218 kB]\nFetched 279 kB in 0s (3721 kB/s)\nSelecting previously unselected package libauparse0:amd64.\r\n(Reading database ... \r(Reading database ... 5%\r(Reading database ... 10%\r(Reading database ... 15%\r(Reading database ... 20%\r(Reading database ... 25%\r(Reading database ... 30%\r(Reading database ... 35%\r(Reading database ... 40%\r(Reading database ... 45%\r(Reading database ... 50%\r(Reading database ... 55%\r(Reading database ... 60%\r(Reading database ... 65%\r(Reading database ... 70%\r(Reading database ... 75%\r(Reading database ... 80%\r(Reading database ... 85%\r(Reading database ... 90%\r(Reading database ... 95%\r(Reading database ... 100%\r(Reading database ... 28690 files and directories currently installed.)\r\nPreparing to unpack .../libauparse0_1%3a3.0.9-1_amd64.deb ...\r\nUnpacking libauparse0:amd64 (1:3.0.9-1) ...\r\nSelecting previously unselected package auditd.\r\nPreparing to unpack .../auditd_1%3a3.0.9-1_amd64.deb ...\r\nUnpacking auditd (1:3.0.9-1) ...\r\nSetting up libauparse0:amd64 (1:3.0.9-1) ...\r\nSetting up auditd (1:3.0.9-1) ...\r\nCreated symlink /etc/systemd/system/multi-user.target.wants/auditd.service → /lib/systemd/system/auditd.service.\r\r\nProcessing triggers for libc-bin (2.36-9+deb12u13) ...\r\n", "stdout_lines": ["Reading package lists...", "Building dependency tree...", "Reading state information...", "The following additional packages will be installed:", " libauparse0", "Suggested packages:", " audispd-plugins", "The following NEW packages will be installed:", " auditd libauparse0", "0 upgraded, 2 newly installed, 0 to remove and 0 not upgraded.", "Need to get 279 kB of archives.", "After this operation, 934 kB of additional disk space will be used.", "Get:1 http://deb.debian.org/debian bookworm/main amd64 libauparse0 amd64 1:3.0.9-1 [61.9 kB]", "Get:2 http://deb.debian.org/debian bookworm/main amd64 auditd amd64 1:3.0.9-1 [218 kB]", "Fetched 279 kB in 0s (3721 kB/s)", "Selecting previously unselected package libauparse0:amd64.", "(Reading database ... ", "(Reading database ... 5%", "(Reading database ... 10%", "(Reading database ... 15%", "(Reading database ... 20%", "(Reading database ... 25%", "(Reading database ... 30%", "(Reading database ... 35%", "(Reading database ... 40%", "(Reading database ... 45%", "(Reading database ... 50%", "(Reading database ... 55%", "(Reading database ... 60%", "(Reading database ... 65%", "(Reading database ... 70%", "(Reading database ... 75%", "(Reading database ... 80%", "(Reading database ... 85%", "(Reading database ... 90%", "(Reading database ... 95%", "(Reading database ... 100%", "(Reading database ... 28690 files and directories currently installed.)", "Preparing to unpack .../libauparse0_1%3a3.0.9-1_amd64.deb ...", "Unpacking libauparse0:amd64 (1:3.0.9-1) ...", "Selecting previously unselected package auditd.", "Preparing to unpack .../auditd_1%3a3.0.9-1_amd64.deb ...", "Unpacking auditd (1:3.0.9-1) ...", "Setting up libauparse0:amd64 (1:3.0.9-1) ...", "Setting up auditd (1:3.0.9-1) ...", "Created symlink /etc/systemd/system/multi-user.target.wants/auditd.service → /lib/systemd/system/auditd.service.", "", "Processing triggers for libc-bin (2.36-9+deb12u13) ..."]} 2026-03-26 09:05:14.536808 | debian-bookworm | 2026-03-26 09:05:14.536966 | debian-bookworm | TASK [auditd : Install audispd-plugins package] ******************************** 2026-03-26 09:05:16.192738 | ubuntu-noble | The following additional packages will be installed: 2026-03-26 09:05:16.192812 | ubuntu-noble | libauparse0t64 2026-03-26 09:05:16.194704 | ubuntu-noble | Suggested packages: 2026-03-26 09:05:16.194739 | ubuntu-noble | audispd-plugins 2026-03-26 09:05:16.194746 | ubuntu-noble | The following NEW packages will be installed: 2026-03-26 09:05:16.194753 | ubuntu-noble | auditd libauparse0t64 2026-03-26 09:05:16.194759 | ubuntu-noble | 0 upgraded, 2 newly installed, 0 to remove and 0 not upgraded. 2026-03-26 09:05:16.195100 | ubuntu-noble | changed: [molecule-auditd] => {"cache_update_time": 1774515813, "cache_updated": false, "changed": true, "stderr": "debconf: delaying package configuration, since apt-utils is not installed\n", "stderr_lines": ["debconf: delaying package configuration, since apt-utils is not installed"], "stdout": "Reading package lists...\nBuilding dependency tree...\nReading state information...\nThe following additional packages will be installed:\n libauparse0t64\nSuggested packages:\n audispd-plugins\nThe following NEW packages will be installed:\n auditd libauparse0t64\n0 upgraded, 2 newly installed, 0 to remove and 0 not upgraded.\nNeed to get 274 kB of archives.\nAfter this operation, 893 kB of additional disk space will be used.\nGet:1 http://archive.ubuntu.com/ubuntu noble-updates/main amd64 libauparse0t64 amd64 1:3.1.2-2.1build1.1 [58.9 kB]\nGet:2 http://archive.ubuntu.com/ubuntu noble-updates/main amd64 auditd amd64 1:3.1.2-2.1build1.1 [215 kB]\nFetched 274 kB in 0s (1024 kB/s)\nSelecting previously unselected package libauparse0t64:amd64.\r\n(Reading database ... \r(Reading database ... 5%\r(Reading database ... 10%\r(Reading database ... 15%\r(Reading database ... 20%\r(Reading database ... 25%\r(Reading database ... 30%\r(Reading database ... 35%\r(Reading database ... 40%\r(Reading database ... 45%\r(Reading database ... 50%\r(Reading database ... 55%\r(Reading database ... 60%\r(Reading database ... 65%\r(Reading database ... 70%\r(Reading database ... 75%\r(Reading database ... 80%\r(Reading database ... 85%\r(Reading database ... 90%\r(Reading database ... 95%\r(Reading database ... 100%\r(Reading database ... 35437 files and directories currently installed.)\r\nPreparing to unpack .../libauparse0t64_1%3a3.1.2-2.1build1.1_amd64.deb ...\r\nAdding 'diversion of /lib/x86_64-linux-gnu/libauparse.so.0 to /lib/x86_64-linux-gnu/libauparse.so.0.usr-is-merged by libauparse0t64'\r\nAdding 'diversion of /lib/x86_64-linux-gnu/libauparse.so.0.0.0 to /lib/x86_64-linux-gnu/libauparse.so.0.0.0.usr-is-merged by libauparse0t64'\r\nUnpacking libauparse0t64:amd64 (1:3.1.2-2.1build1.1) ...\r\nSelecting previously unselected package auditd.\r\nPreparing to unpack .../auditd_1%3a3.1.2-2.1build1.1_amd64.deb ...\r\nUnpacking auditd (1:3.1.2-2.1build1.1) ...\r\nSetting up libauparse0t64:amd64 (1:3.1.2-2.1build1.1) ...\r\nSetting up auditd (1:3.1.2-2.1build1.1) ...\r\nCreated symlink /etc/systemd/system/multi-user.target.wants/auditd.service → /usr/lib/systemd/system/auditd.service.\r\r\nProcessing triggers for libc-bin (2.39-0ubuntu8.7) ...\r\n", "stdout_lines": ["Reading package lists...", "Building dependency tree...", "Reading state information...", "The following additional packages will be installed:", " libauparse0t64", "Suggested packages:", " audispd-plugins", "The following NEW packages will be installed:", " auditd libauparse0t64", "0 upgraded, 2 newly installed, 0 to remove and 0 not upgraded.", "Need to get 274 kB of archives.", "After this operation, 893 kB of additional disk space will be used.", "Get:1 http://archive.ubuntu.com/ubuntu noble-updates/main amd64 libauparse0t64 amd64 1:3.1.2-2.1build1.1 [58.9 kB]", "Get:2 http://archive.ubuntu.com/ubuntu noble-updates/main amd64 auditd amd64 1:3.1.2-2.1build1.1 [215 kB]", "Fetched 274 kB in 0s (1024 kB/s)", "Selecting previously unselected package libauparse0t64:amd64.", "(Reading database ... ", "(Reading database ... 5%", "(Reading database ... 10%", "(Reading database ... 15%", "(Reading database ... 20%", "(Reading database ... 25%", "(Reading database ... 30%", "(Reading database ... 35%", "(Reading database ... 40%", "(Reading database ... 45%", "(Reading database ... 50%", "(Reading database ... 55%", "(Reading database ... 60%", "(Reading database ... 65%", "(Reading database ... 70%", "(Reading database ... 75%", "(Reading database ... 80%", "(Reading database ... 85%", "(Reading database ... 90%", "(Reading database ... 95%", "(Reading database ... 100%", "(Reading database ... 35437 files and directories currently installed.)", "Preparing to unpack .../libauparse0t64_1%3a3.1.2-2.1build1.1_amd64.deb ...", "Adding 'diversion of /lib/x86_64-linux-gnu/libauparse.so.0 to /lib/x86_64-linux-gnu/libauparse.so.0.usr-is-merged by libauparse0t64'", "Adding 'diversion of /lib/x86_64-linux-gnu/libauparse.so.0.0.0 to /lib/x86_64-linux-gnu/libauparse.so.0.0.0.usr-is-merged by libauparse0t64'", "Unpacking libauparse0t64:amd64 (1:3.1.2-2.1build1.1) ...", "Selecting previously unselected package auditd.", "Preparing to unpack .../auditd_1%3a3.1.2-2.1build1.1_amd64.deb ...", "Unpacking auditd (1:3.1.2-2.1build1.1) ...", "Setting up libauparse0t64:amd64 (1:3.1.2-2.1build1.1) ...", "Setting up auditd (1:3.1.2-2.1build1.1) ...", "Created symlink /etc/systemd/system/multi-user.target.wants/auditd.service → /usr/lib/systemd/system/auditd.service.", "", "Processing triggers for libc-bin (2.39-0ubuntu8.7) ..."]} 2026-03-26 09:05:16.195135 | ubuntu-noble | 2026-03-26 09:05:16.196184 | ubuntu-noble | TASK [auditd : Install audispd-plugins package] ******************************** 2026-03-26 09:05:17.905687 | debian-bookworm | The following NEW packages will be installed: 2026-03-26 09:05:17.905946 | debian-bookworm | audispd-plugins 2026-03-26 09:05:17.906212 | debian-bookworm | 0 upgraded, 1 newly installed, 0 to remove and 0 not upgraded. 2026-03-26 09:05:17.906592 | debian-bookworm | changed: [molecule-auditd] => {"cache_update_time": 1774515810, "cache_updated": false, "changed": true, "stderr": "debconf: delaying package configuration, since apt-utils is not installed\n", "stderr_lines": ["debconf: delaying package configuration, since apt-utils is not installed"], "stdout": "Reading package lists...\nBuilding dependency tree...\nReading state information...\nThe following NEW packages will be installed:\n audispd-plugins\n0 upgraded, 1 newly installed, 0 to remove and 0 not upgraded.\nNeed to get 45.6 kB of archives.\nAfter this operation, 132 kB of additional disk space will be used.\nGet:1 http://deb.debian.org/debian bookworm/main amd64 audispd-plugins amd64 1:3.0.9-1 [45.6 kB]\nFetched 45.6 kB in 0s (920 kB/s)\nSelecting previously unselected package audispd-plugins.\r\n(Reading database ... \r(Reading database ... 5%\r(Reading database ... 10%\r(Reading database ... 15%\r(Reading database ... 20%\r(Reading database ... 25%\r(Reading database ... 30%\r(Reading database ... 35%\r(Reading database ... 40%\r(Reading database ... 45%\r(Reading database ... 50%\r(Reading database ... 55%\r(Reading database ... 60%\r(Reading database ... 65%\r(Reading database ... 70%\r(Reading database ... 75%\r(Reading database ... 80%\r(Reading database ... 85%\r(Reading database ... 90%\r(Reading database ... 95%\r(Reading database ... 100%\r(Reading database ... 28781 files and directories currently installed.)\r\nPreparing to unpack .../audispd-plugins_1%3a3.0.9-1_amd64.deb ...\r\nUnpacking audispd-plugins (1:3.0.9-1) ...\r\nSetting up audispd-plugins (1:3.0.9-1) ...\r\n", "stdout_lines": ["Reading package lists...", "Building dependency tree...", "Reading state information...", "The following NEW packages will be installed:", " audispd-plugins", "0 upgraded, 1 newly installed, 0 to remove and 0 not upgraded.", "Need to get 45.6 kB of archives.", "After this operation, 132 kB of additional disk space will be used.", "Get:1 http://deb.debian.org/debian bookworm/main amd64 audispd-plugins amd64 1:3.0.9-1 [45.6 kB]", "Fetched 45.6 kB in 0s (920 kB/s)", "Selecting previously unselected package audispd-plugins.", "(Reading database ... ", "(Reading database ... 5%", "(Reading database ... 10%", "(Reading database ... 15%", "(Reading database ... 20%", "(Reading database ... 25%", "(Reading database ... 30%", "(Reading database ... 35%", "(Reading database ... 40%", "(Reading database ... 45%", "(Reading database ... 50%", "(Reading database ... 55%", "(Reading database ... 60%", "(Reading database ... 65%", "(Reading database ... 70%", "(Reading database ... 75%", "(Reading database ... 80%", "(Reading database ... 85%", "(Reading database ... 90%", "(Reading database ... 95%", "(Reading database ... 100%", "(Reading database ... 28781 files and directories currently installed.)", "Preparing to unpack .../audispd-plugins_1%3a3.0.9-1_amd64.deb ...", "Unpacking audispd-plugins (1:3.0.9-1) ...", "Setting up audispd-plugins (1:3.0.9-1) ..."]} 2026-03-26 09:05:17.906819 | debian-bookworm | 2026-03-26 09:05:17.907066 | debian-bookworm | TASK [auditd : Copy auditd.conf configuration files] *************************** 2026-03-26 09:05:19.192865 | debian-bookworm | --- before 2026-03-26 09:05:19.193013 | debian-bookworm | +++ after: /home/zuul/.ansible/tmp/ansible-local-20401eaevp39/tmpz9rrvb8i/auditd.conf.j2 2026-03-26 09:05:19.193026 | debian-bookworm | @@ -0,0 +1,37 @@ 2026-03-26 09:05:19.193046 | debian-bookworm | +# 2026-03-26 09:05:19.193055 | debian-bookworm | +# This file controls the configuration of the audit daemon 2026-03-26 09:05:19.193157 | debian-bookworm | +# 2026-03-26 09:05:19.193296 | debian-bookworm | + 2026-03-26 09:05:19.193529 | debian-bookworm | +local_events = yes 2026-03-26 09:05:19.193708 | debian-bookworm | +write_logs = yes 2026-03-26 09:05:19.193882 | debian-bookworm | +log_file = /var/log/audit/audit.log 2026-03-26 09:05:19.194047 | debian-bookworm | +log_group = adm 2026-03-26 09:05:19.194196 | debian-bookworm | +log_format = RAW 2026-03-26 09:05:19.194385 | debian-bookworm | +flush = INCREMENTAL_ASYNC 2026-03-26 09:05:19.194473 | debian-bookworm | +freq = 50 2026-03-26 09:05:19.194579 | debian-bookworm | +max_log_file = 8 2026-03-26 09:05:19.194687 | debian-bookworm | +num_logs = 5 2026-03-26 09:05:19.194819 | debian-bookworm | +priority_boost = 4 2026-03-26 09:05:19.194970 | debian-bookworm | +disp_qos = lossy 2026-03-26 09:05:19.195129 | debian-bookworm | +dispatcher = /sbin/audispd 2026-03-26 09:05:19.195280 | debian-bookworm | +name_format = NONE 2026-03-26 09:05:19.195455 | debian-bookworm | +##name = mydomain 2026-03-26 09:05:19.195608 | debian-bookworm | +max_log_file_action = ROTATE 2026-03-26 09:05:19.195764 | debian-bookworm | +space_left = 12361 2026-03-26 09:05:19.195942 | debian-bookworm | +space_left_action = email 2026-03-26 09:05:19.196131 | debian-bookworm | +verify_email = yes 2026-03-26 09:05:19.196286 | debian-bookworm | +action_mail_acct = root 2026-03-26 09:05:19.196523 | debian-bookworm | +admin_space_left = 50 2026-03-26 09:05:19.196695 | debian-bookworm | +admin_space_left_action = SUSPEND 2026-03-26 09:05:19.196857 | debian-bookworm | +disk_full_action = SUSPEND 2026-03-26 09:05:19.196965 | debian-bookworm | +disk_error_action = SUSPEND 2026-03-26 09:05:19.197047 | debian-bookworm | +use_libwrap = yes 2026-03-26 09:05:19.197177 | debian-bookworm | +##tcp_listen_port = 60 2026-03-26 09:05:19.197259 | debian-bookworm | +tcp_listen_queue = 5 2026-03-26 09:05:19.197434 | debian-bookworm | +tcp_max_per_addr = 1 2026-03-26 09:05:19.197577 | debian-bookworm | +##tcp_client_ports = 1024-65535 2026-03-26 09:05:19.197723 | debian-bookworm | +tcp_client_max_idle = 0 2026-03-26 09:05:19.197868 | debian-bookworm | +enable_krb5 = no 2026-03-26 09:05:19.198012 | debian-bookworm | +krb5_principal = auditd 2026-03-26 09:05:19.198161 | debian-bookworm | +##krb5_key_file = /etc/audit/audit.key 2026-03-26 09:05:19.198303 | debian-bookworm | +distribute_network = no 2026-03-26 09:05:19.198437 | debian-bookworm | 2026-03-26 09:05:19.198624 | debian-bookworm | changed: [molecule-auditd] => {"changed": true, "checksum": "e902cc6bebf86c17087d153e359a2cc1231672e0", "dest": "/etc/audit/audit.conf", "gid": 0, "group": "root", "md5sum": "69dfd768317bae876a6a78c8aeb5cce1", "mode": "0640", "owner": "root", "size": 806, "src": "/home/zuul/.ansible/tmp/ansible-tmp-1774515917.9254909-2410-180731342198570/.source.conf", "state": "file", "uid": 0} 2026-03-26 09:05:19.198742 | debian-bookworm | 2026-03-26 09:05:19.198890 | debian-bookworm | TASK [auditd : Adjust auditd/audispd configurations] *************************** 2026-03-26 09:05:19.631024 | debian-bookworm | ok: [molecule-auditd] => (item={'parameter': 'active', 'value': 'no', 'config': '/etc/audit/plugins.d/syslog.conf'}) => {"ansible_loop_var": "item", "backup": "", "changed": false, "item": {"config": "/etc/audit/plugins.d/syslog.conf", "parameter": "active", "value": "no"}, "msg": ""} 2026-03-26 09:05:19.631152 | debian-bookworm | 2026-03-26 09:05:19.631350 | debian-bookworm | TASK [auditd : Deploy rules for auditd] **************************************** 2026-03-26 09:05:20.572740 | debian-bookworm | --- before 2026-03-26 09:05:20.573041 | debian-bookworm | +++ after: /home/zuul/.ansible/tmp/ansible-local-20401eaevp39/tmp531cwifj/20-neo23x0.rules.j2 2026-03-26 09:05:20.573308 | debian-bookworm | @@ -0,0 +1,750 @@ 2026-03-26 09:05:20.573598 | debian-bookworm | +# ___ ___ __ __ 2026-03-26 09:05:20.573853 | debian-bookworm | +# / | __ ______/ (_) /_____/ / 2026-03-26 09:05:20.574118 | debian-bookworm | +# / /| |/ / / / __ / / __/ __ / 2026-03-26 09:05:20.574361 | debian-bookworm | +# / ___ / /_/ / /_/ / / /_/ /_/ / 2026-03-26 09:05:20.574611 | debian-bookworm | +# /_/ |_\__,_/\__,_/_/\__/\__,_/ 2026-03-26 09:05:20.574857 | debian-bookworm | +# 2026-03-26 09:05:20.575109 | debian-bookworm | +# Linux Audit Daemon - Best Practice Configuration 2026-03-26 09:05:20.575389 | debian-bookworm | +# /etc/audit/audit.rules 2026-03-26 09:05:20.575626 | debian-bookworm | +# 2026-03-26 09:05:20.575831 | debian-bookworm | +# Compiled by Florian Roth 2026-03-26 09:05:20.584651 | debian-bookworm | +# 2026-03-26 09:05:20.585051 | debian-bookworm | +# Created : 2017/12/05 2026-03-26 09:05:20.585267 | debian-bookworm | +# Modified : 2023/01/25 2026-03-26 09:05:20.585496 | debian-bookworm | +# 2026-03-26 09:05:20.585671 | debian-bookworm | +# Based on rules published here: 2026-03-26 09:05:20.585845 | debian-bookworm | +# Gov.uk auditd rules 2026-03-26 09:05:20.586284 | debian-bookworm | +# https://github.com/gds-operations/puppet-auditd/pull/1 2026-03-26 09:05:20.586628 | debian-bookworm | +# CentOS 7 hardening 2026-03-26 09:05:20.586924 | debian-bookworm | +# https://highon.coffee/blog/security-harden-centos-7/#auditd---audit-daemon 2026-03-26 09:05:20.587185 | debian-bookworm | +# Linux audit repo 2026-03-26 09:05:20.587511 | debian-bookworm | +# https://github.com/linux-audit/audit-userspace/tree/master/rules 2026-03-26 09:05:20.587782 | debian-bookworm | +# Auditd high performance linux auditing 2026-03-26 09:05:20.588111 | debian-bookworm | +# https://linux-audit.com/tuning-auditd-high-performance-linux-auditing/ 2026-03-26 09:05:20.588306 | debian-bookworm | +# 2026-03-26 09:05:20.588512 | debian-bookworm | +# Further rules 2026-03-26 09:05:20.588772 | debian-bookworm | +# For PCI DSS compliance see: 2026-03-26 09:05:20.589042 | debian-bookworm | +# https://github.com/linux-audit/audit-userspace/blob/master/rules/30-pci-dss-v31.rules 2026-03-26 09:05:20.589416 | debian-bookworm | +# For NISPOM compliance see: 2026-03-26 09:05:20.589703 | debian-bookworm | +# https://github.com/linux-audit/audit-userspace/blob/master/rules/30-nispom.rules 2026-03-26 09:05:20.589889 | debian-bookworm | + 2026-03-26 09:05:20.590073 | debian-bookworm | +# Remove any existing rules 2026-03-26 09:05:20.590252 | debian-bookworm | +-D 2026-03-26 09:05:20.590480 | debian-bookworm | + 2026-03-26 09:05:20.590665 | debian-bookworm | +# Buffer Size 2026-03-26 09:05:20.590839 | debian-bookworm | +## Feel free to increase this if the machine panic's 2026-03-26 09:05:20.590997 | debian-bookworm | +-b 8192 2026-03-26 09:05:20.591149 | debian-bookworm | + 2026-03-26 09:05:20.591307 | debian-bookworm | +# Failure Mode 2026-03-26 09:05:20.591514 | debian-bookworm | +## Possible values: 0 (silent), 1 (printk, print a failure message), 2 (panic, halt the system) 2026-03-26 09:05:20.591661 | debian-bookworm | +-f 1 2026-03-26 09:05:20.591799 | debian-bookworm | + 2026-03-26 09:05:20.591983 | debian-bookworm | +# Ignore errors 2026-03-26 09:05:20.592135 | debian-bookworm | +## e.g. caused by users or files not found in the local environment 2026-03-26 09:05:20.592277 | debian-bookworm | +-i 2026-03-26 09:05:20.592433 | debian-bookworm | + 2026-03-26 09:05:20.592576 | debian-bookworm | +# Self Auditing --------------------------------------------------------------- 2026-03-26 09:05:20.592714 | debian-bookworm | + 2026-03-26 09:05:20.592859 | debian-bookworm | +## Audit the audit logs 2026-03-26 09:05:20.593016 | debian-bookworm | +### Successful and unsuccessful attempts to read information from the audit records 2026-03-26 09:05:20.593163 | debian-bookworm | +-w /var/log/audit/ -p wra -k auditlog 2026-03-26 09:05:20.593306 | debian-bookworm | +-w /var/audit/ -p wra -k auditlog 2026-03-26 09:05:20.593461 | debian-bookworm | + 2026-03-26 09:05:20.593606 | debian-bookworm | +## Auditd configuration 2026-03-26 09:05:20.593750 | debian-bookworm | +### Modifications to audit configuration that occur while the audit collection functions are operating 2026-03-26 09:05:20.593892 | debian-bookworm | +-w /etc/audit/ -p wa -k auditconfig 2026-03-26 09:05:20.594032 | debian-bookworm | +-w /etc/libaudit.conf -p wa -k auditconfig 2026-03-26 09:05:20.594173 | debian-bookworm | +-w /etc/audisp/ -p wa -k audispconfig 2026-03-26 09:05:20.594310 | debian-bookworm | + 2026-03-26 09:05:20.594469 | debian-bookworm | +## Monitor for use of audit management tools 2026-03-26 09:05:20.594610 | debian-bookworm | +-w /sbin/auditctl -p x -k audittools 2026-03-26 09:05:20.594752 | debian-bookworm | +-w /sbin/auditd -p x -k audittools 2026-03-26 09:05:20.594896 | debian-bookworm | +-w /usr/sbin/auditd -p x -k audittools 2026-03-26 09:05:20.595040 | debian-bookworm | +-w /usr/sbin/augenrules -p x -k audittools 2026-03-26 09:05:20.595479 | debian-bookworm | + 2026-03-26 09:05:20.595690 | debian-bookworm | +## Access to all audit trails 2026-03-26 09:05:20.595852 | debian-bookworm | + 2026-03-26 09:05:20.596040 | debian-bookworm | +-a always,exit -F path=/usr/sbin/ausearch -F perm=x -k audittools 2026-03-26 09:05:20.596186 | debian-bookworm | +-a always,exit -F path=/usr/sbin/aureport -F perm=x -k audittools 2026-03-26 09:05:20.596323 | debian-bookworm | +-a always,exit -F path=/usr/sbin/aulast -F perm=x -k audittools 2026-03-26 09:05:20.596482 | debian-bookworm | +-a always,exit -F path=/usr/sbin/aulastlogin -F perm=x -k audittools 2026-03-26 09:05:20.596619 | debian-bookworm | +-a always,exit -F path=/usr/sbin/auvirt -F perm=x -k audittools 2026-03-26 09:05:20.596783 | debian-bookworm | + 2026-03-26 09:05:20.596926 | debian-bookworm | +# Filters --------------------------------------------------------------------- 2026-03-26 09:05:20.597079 | debian-bookworm | + 2026-03-26 09:05:20.597215 | debian-bookworm | +### We put these early because audit is a first match wins system. 2026-03-26 09:05:20.597387 | debian-bookworm | + 2026-03-26 09:05:20.597533 | debian-bookworm | +## Ignore SELinux AVC records 2026-03-26 09:05:20.597667 | debian-bookworm | +-a always,exclude -F msgtype=AVC 2026-03-26 09:05:20.597788 | debian-bookworm | + 2026-03-26 09:05:20.597913 | debian-bookworm | +## Ignore current working directory records 2026-03-26 09:05:20.598039 | debian-bookworm | +-a always,exclude -F msgtype=CWD 2026-03-26 09:05:20.598159 | debian-bookworm | + 2026-03-26 09:05:20.598285 | debian-bookworm | +## Cron jobs fill the logs with stuff we normally don't want (works with SELinux) 2026-03-26 09:05:20.598424 | debian-bookworm | +-a never,user -F subj_type=crond_t 2026-03-26 09:05:20.598549 | debian-bookworm | +-a never,exit -F subj_type=crond_t 2026-03-26 09:05:20.598671 | debian-bookworm | + 2026-03-26 09:05:20.598796 | debian-bookworm | +## This prevents chrony from overwhelming the logs 2026-03-26 09:05:20.598920 | debian-bookworm | +-a never,exit -F arch=b64 -S adjtimex -F auid=-1 -F uid=chrony -F subj_type=chronyd_t 2026-03-26 09:05:20.599040 | debian-bookworm | + 2026-03-26 09:05:20.599164 | debian-bookworm | +## This is not very interesting and wastes a lot of space if the server is public facing 2026-03-26 09:05:20.599292 | debian-bookworm | +-a always,exclude -F msgtype=CRYPTO_KEY_USER 2026-03-26 09:05:20.599429 | debian-bookworm | + 2026-03-26 09:05:20.599555 | debian-bookworm | +## Open VM Tools 2026-03-26 09:05:20.599679 | debian-bookworm | +-a exit,never -F arch=b64 -S all -F exe=/usr/bin/vmtoolsd 2026-03-26 09:05:20.599800 | debian-bookworm | + 2026-03-26 09:05:20.599945 | debian-bookworm | +## High Volume Event Filter (especially on Linux Workstations) 2026-03-26 09:05:20.600096 | debian-bookworm | +-a never,exit -F arch=b64 -F dir=/dev/shm -k sharedmemaccess 2026-03-26 09:05:20.600223 | debian-bookworm | +-a never,exit -F arch=b64 -F dir=/var/lock/lvm -k locklvm 2026-03-26 09:05:20.600382 | debian-bookworm | + 2026-03-26 09:05:20.600513 | debian-bookworm | +## FileBeat 2026-03-26 09:05:20.600638 | debian-bookworm | +-a never,exit -F arch=b64 -F path=/opt/filebeat -k filebeat 2026-03-26 09:05:20.600755 | debian-bookworm | + 2026-03-26 09:05:20.600886 | debian-bookworm | +## More information on how to filter events 2026-03-26 09:05:20.601001 | debian-bookworm | +### https://access.redhat.com/solutions/2482221 2026-03-26 09:05:20.601111 | debian-bookworm | + 2026-03-26 09:05:20.601224 | debian-bookworm | +# Rules ----------------------------------------------------------------------- 2026-03-26 09:05:20.601348 | debian-bookworm | + 2026-03-26 09:05:20.601463 | debian-bookworm | +## Kernel parameters 2026-03-26 09:05:20.601576 | debian-bookworm | +-w /etc/sysctl.conf -p wa -k sysctl 2026-03-26 09:05:20.601689 | debian-bookworm | +-w /etc/sysctl.d -p wa -k sysctl 2026-03-26 09:05:20.601801 | debian-bookworm | + 2026-03-26 09:05:20.601914 | debian-bookworm | +## Kernel module loading and unloading 2026-03-26 09:05:20.602028 | debian-bookworm | +-a always,exit -F perm=x -F auid!=-1 -F path=/sbin/insmod -k modules 2026-03-26 09:05:20.602142 | debian-bookworm | +-a always,exit -F perm=x -F auid!=-1 -F path=/sbin/modprobe -k modules 2026-03-26 09:05:20.602254 | debian-bookworm | +-a always,exit -F perm=x -F auid!=-1 -F path=/sbin/rmmod -k modules 2026-03-26 09:05:20.602388 | debian-bookworm | +-a always,exit -F arch=b64 -S finit_module -S init_module -S delete_module -F auid!=-1 -k modules 2026-03-26 09:05:20.602499 | debian-bookworm | + 2026-03-26 09:05:20.602611 | debian-bookworm | +## Modprobe configuration 2026-03-26 09:05:20.602725 | debian-bookworm | +-w /etc/modprobe.conf -p wa -k modprobe 2026-03-26 09:05:20.602837 | debian-bookworm | +-w /etc/modprobe.d -p wa -k modprobe 2026-03-26 09:05:20.602942 | debian-bookworm | + 2026-03-26 09:05:20.603053 | debian-bookworm | +## KExec usage (all actions) 2026-03-26 09:05:20.603166 | debian-bookworm | +-a always,exit -F arch=b64 -S kexec_load -k KEXEC 2026-03-26 09:05:20.603273 | debian-bookworm | + 2026-03-26 09:05:20.603425 | debian-bookworm | +## Special files 2026-03-26 09:05:20.603541 | debian-bookworm | +-a always,exit -F arch=b64 -S mknod -S mknodat -k specialfiles 2026-03-26 09:05:20.603649 | debian-bookworm | + 2026-03-26 09:05:20.603762 | debian-bookworm | +## Mount operations (only attributable) 2026-03-26 09:05:20.603875 | debian-bookworm | +-a always,exit -F arch=b64 -S mount -S umount2 -F auid!=-1 -k mount 2026-03-26 09:05:20.604017 | debian-bookworm | + 2026-03-26 09:05:20.604132 | debian-bookworm | +### NFS mount 2026-03-26 09:05:20.604259 | debian-bookworm | +-a always,exit -F path=/sbin/mount.nfs -F perm=x -F auid>=500 -F auid!=4294967295 -k T1078_Valid_Accounts 2026-03-26 09:05:20.604416 | debian-bookworm | +-a always,exit -F path=/usr/sbin/mount.nfs -F perm=x -F auid>=500 -F auid!=4294967295 -k T1078_Valid_Accounts 2026-03-26 09:05:20.604559 | debian-bookworm | + 2026-03-26 09:05:20.604680 | debian-bookworm | +## Change swap (only attributable) 2026-03-26 09:05:20.604797 | debian-bookworm | +-a always,exit -F arch=b64 -S swapon -S swapoff -F auid!=-1 -k swap 2026-03-26 09:05:20.604921 | debian-bookworm | + 2026-03-26 09:05:20.605035 | debian-bookworm | +## Time 2026-03-26 09:05:20.605201 | debian-bookworm | +-a always,exit -F arch=b64 -F uid!=ntp -S adjtimex -S settimeofday -S clock_settime -k time 2026-03-26 09:05:20.605373 | debian-bookworm | +### Local time zone 2026-03-26 09:05:20.605503 | debian-bookworm | +-w /etc/localtime -p wa -k localtime 2026-03-26 09:05:20.605614 | debian-bookworm | + 2026-03-26 09:05:20.605725 | debian-bookworm | +## Stunnel 2026-03-26 09:05:20.605869 | debian-bookworm | +-w /usr/sbin/stunnel -p x -k stunnel 2026-03-26 09:05:20.605986 | debian-bookworm | +-w /usr/bin/stunnel -p x -k stunnel 2026-03-26 09:05:20.606094 | debian-bookworm | + 2026-03-26 09:05:20.606208 | debian-bookworm | +## Cron configuration & scheduled jobs 2026-03-26 09:05:20.606389 | debian-bookworm | +-w /etc/cron.allow -p wa -k cron 2026-03-26 09:05:20.606525 | debian-bookworm | +-w /etc/cron.deny -p wa -k cron 2026-03-26 09:05:20.606640 | debian-bookworm | +-w /etc/cron.d/ -p wa -k cron 2026-03-26 09:05:20.606754 | debian-bookworm | +-w /etc/cron.daily/ -p wa -k cron 2026-03-26 09:05:20.606867 | debian-bookworm | +-w /etc/cron.hourly/ -p wa -k cron 2026-03-26 09:05:20.606978 | debian-bookworm | +-w /etc/cron.monthly/ -p wa -k cron 2026-03-26 09:05:20.607088 | debian-bookworm | +-w /etc/cron.weekly/ -p wa -k cron 2026-03-26 09:05:20.607198 | debian-bookworm | +-w /etc/crontab -p wa -k cron 2026-03-26 09:05:20.607306 | debian-bookworm | +-w /var/spool/cron/ -p wa -k cron 2026-03-26 09:05:20.607439 | debian-bookworm | + 2026-03-26 09:05:20.607552 | debian-bookworm | +## User, group, password databases 2026-03-26 09:05:20.607664 | debian-bookworm | +-w /etc/group -p wa -k etcgroup 2026-03-26 09:05:20.607783 | debian-bookworm | +-w /etc/passwd -p wa -k etcpasswd 2026-03-26 09:05:20.607895 | debian-bookworm | +-w /etc/gshadow -k etcgroup 2026-03-26 09:05:20.608027 | debian-bookworm | +-w /etc/shadow -k etcpasswd 2026-03-26 09:05:20.608140 | debian-bookworm | +-w /etc/security/opasswd -k opasswd 2026-03-26 09:05:20.608250 | debian-bookworm | + 2026-03-26 09:05:20.608402 | debian-bookworm | +## Sudoers file changes 2026-03-26 09:05:20.608531 | debian-bookworm | +-w /etc/sudoers -p wa -k actions 2026-03-26 09:05:20.608663 | debian-bookworm | +-w /etc/sudoers.d/ -p wa -k actions 2026-03-26 09:05:20.608791 | debian-bookworm | + 2026-03-26 09:05:20.608922 | debian-bookworm | +## Passwd 2026-03-26 09:05:20.609037 | debian-bookworm | +-w /usr/bin/passwd -p x -k passwd_modification 2026-03-26 09:05:20.609146 | debian-bookworm | + 2026-03-26 09:05:20.609257 | debian-bookworm | +## Tools to change group identifiers 2026-03-26 09:05:20.609389 | debian-bookworm | +-w /usr/sbin/groupadd -p x -k group_modification 2026-03-26 09:05:20.609504 | debian-bookworm | +-w /usr/sbin/groupmod -p x -k group_modification 2026-03-26 09:05:20.609617 | debian-bookworm | +-w /usr/sbin/addgroup -p x -k group_modification 2026-03-26 09:05:20.609730 | debian-bookworm | +-w /usr/sbin/useradd -p x -k user_modification 2026-03-26 09:05:20.609842 | debian-bookworm | +-w /usr/sbin/userdel -p x -k user_modification 2026-03-26 09:05:20.609953 | debian-bookworm | +-w /usr/sbin/usermod -p x -k user_modification 2026-03-26 09:05:20.610065 | debian-bookworm | +-w /usr/sbin/adduser -p x -k user_modification 2026-03-26 09:05:20.610172 | debian-bookworm | + 2026-03-26 09:05:20.610283 | debian-bookworm | +## Login configuration and information 2026-03-26 09:05:20.610412 | debian-bookworm | +-w /etc/login.defs -p wa -k login 2026-03-26 09:05:20.610521 | debian-bookworm | +-w /etc/securetty -p wa -k login 2026-03-26 09:05:20.610631 | debian-bookworm | +-w /var/log/faillog -p wa -k login 2026-03-26 09:05:20.610744 | debian-bookworm | +-w /var/log/lastlog -p wa -k login 2026-03-26 09:05:20.610856 | debian-bookworm | +-w /var/log/tallylog -p wa -k login 2026-03-26 09:05:20.610971 | debian-bookworm | + 2026-03-26 09:05:20.611085 | debian-bookworm | +## Network Environment 2026-03-26 09:05:20.611199 | debian-bookworm | +### Changes to hostname 2026-03-26 09:05:20.611313 | debian-bookworm | +-a always,exit -F arch=b64 -S sethostname -S setdomainname -k network_modifications 2026-03-26 09:05:20.611473 | debian-bookworm | + 2026-03-26 09:05:20.611588 | debian-bookworm | +### Detect Remote Shell Use 2026-03-26 09:05:20.611702 | debian-bookworm | +-a always,exit -F arch=b64 -F exe=/bin/bash -F success=1 -S connect -k "remote_shell" 2026-03-26 09:05:20.611815 | debian-bookworm | +-a always,exit -F arch=b64 -F exe=/usr/bin/bash -F success=1 -S connect -k "remote_shell" 2026-03-26 09:05:20.611977 | debian-bookworm | + 2026-03-26 09:05:20.612098 | debian-bookworm | +### Successful IPv4 Connections 2026-03-26 09:05:20.612212 | debian-bookworm | +-a always,exit -F arch=b64 -S connect -F a2=16 -F success=1 -F key=network_connect_4 2026-03-26 09:05:20.612339 | debian-bookworm | + 2026-03-26 09:05:20.612454 | debian-bookworm | +### Successful IPv6 Connections 2026-03-26 09:05:20.612566 | debian-bookworm | +-a always,exit -F arch=b64 -S connect -F a2=28 -F success=1 -F key=network_connect_6 2026-03-26 09:05:20.612689 | debian-bookworm | + 2026-03-26 09:05:20.612800 | debian-bookworm | +### Changes to other files 2026-03-26 09:05:20.612912 | debian-bookworm | +-w /etc/hosts -p wa -k network_modifications 2026-03-26 09:05:20.613024 | debian-bookworm | +-w /etc/sysconfig/network -p wa -k network_modifications 2026-03-26 09:05:20.613135 | debian-bookworm | +-w /etc/sysconfig/network-scripts -p w -k network_modifications 2026-03-26 09:05:20.613244 | debian-bookworm | +-w /etc/network/ -p wa -k network 2026-03-26 09:05:20.613372 | debian-bookworm | +-a always,exit -F dir=/etc/NetworkManager/ -F perm=wa -k network_modifications 2026-03-26 09:05:20.613484 | debian-bookworm | + 2026-03-26 09:05:20.613594 | debian-bookworm | +### Changes to issue 2026-03-26 09:05:20.613706 | debian-bookworm | +-w /etc/issue -p wa -k etcissue 2026-03-26 09:05:20.613822 | debian-bookworm | +-w /etc/issue.net -p wa -k etcissue 2026-03-26 09:05:20.613934 | debian-bookworm | + 2026-03-26 09:05:20.614046 | debian-bookworm | +## System startup scripts 2026-03-26 09:05:20.614156 | debian-bookworm | +-w /etc/inittab -p wa -k init 2026-03-26 09:05:20.614269 | debian-bookworm | +-w /etc/init.d/ -p wa -k init 2026-03-26 09:05:20.614423 | debian-bookworm | +-w /etc/init/ -p wa -k init 2026-03-26 09:05:20.614535 | debian-bookworm | + 2026-03-26 09:05:20.614647 | debian-bookworm | +## Library search paths 2026-03-26 09:05:20.614767 | debian-bookworm | +-w /etc/ld.so.conf -p wa -k libpath 2026-03-26 09:05:20.614877 | debian-bookworm | +-w /etc/ld.so.conf.d -p wa -k libpath 2026-03-26 09:05:20.614985 | debian-bookworm | + 2026-03-26 09:05:20.615098 | debian-bookworm | +## Systemwide library preloads (LD_PRELOAD) 2026-03-26 09:05:20.615208 | debian-bookworm | +-w /etc/ld.so.preload -p wa -k systemwide_preloads 2026-03-26 09:05:20.615314 | debian-bookworm | + 2026-03-26 09:05:20.615442 | debian-bookworm | +## Pam configuration 2026-03-26 09:05:20.615553 | debian-bookworm | +-w /etc/pam.d/ -p wa -k pam 2026-03-26 09:05:20.615668 | debian-bookworm | +-w /etc/security/limits.conf -p wa -k pam 2026-03-26 09:05:20.615779 | debian-bookworm | +-w /etc/security/limits.d -p wa -k pam 2026-03-26 09:05:20.615890 | debian-bookworm | +-w /etc/security/pam_env.conf -p wa -k pam 2026-03-26 09:05:20.616027 | debian-bookworm | +-w /etc/security/namespace.conf -p wa -k pam 2026-03-26 09:05:20.616141 | debian-bookworm | +-w /etc/security/namespace.d -p wa -k pam 2026-03-26 09:05:20.616249 | debian-bookworm | +-w /etc/security/namespace.init -p wa -k pam 2026-03-26 09:05:20.616371 | debian-bookworm | + 2026-03-26 09:05:20.616484 | debian-bookworm | +## Mail configuration 2026-03-26 09:05:20.616595 | debian-bookworm | +-w /etc/aliases -p wa -k mail 2026-03-26 09:05:20.616706 | debian-bookworm | +-w /etc/postfix/ -p wa -k mail 2026-03-26 09:05:20.616818 | debian-bookworm | +-w /etc/exim4/ -p wa -k mail 2026-03-26 09:05:20.616925 | debian-bookworm | + 2026-03-26 09:05:20.617037 | debian-bookworm | +## SSH configuration 2026-03-26 09:05:20.617155 | debian-bookworm | +-w /etc/ssh/sshd_config -k sshd 2026-03-26 09:05:20.617267 | debian-bookworm | +-w /etc/ssh/sshd_config.d -k sshd 2026-03-26 09:05:20.617386 | debian-bookworm | + 2026-03-26 09:05:20.617500 | debian-bookworm | +## root ssh key tampering 2026-03-26 09:05:20.617610 | debian-bookworm | +-w /root/.ssh -p wa -k rootkey 2026-03-26 09:05:20.617717 | debian-bookworm | + 2026-03-26 09:05:20.617827 | debian-bookworm | +# Systemd 2026-03-26 09:05:20.617937 | debian-bookworm | +-w /bin/systemctl -p x -k systemd 2026-03-26 09:05:20.618047 | debian-bookworm | +-w /etc/systemd/ -p wa -k systemd 2026-03-26 09:05:20.618157 | debian-bookworm | +-w /usr/lib/systemd -p wa -k systemd 2026-03-26 09:05:20.618263 | debian-bookworm | + 2026-03-26 09:05:20.618413 | debian-bookworm | +## https://systemd.network/systemd.generator.html 2026-03-26 09:05:20.618530 | debian-bookworm | +-w /etc/systemd/system-generators/ -p wa -k systemd_generator 2026-03-26 09:05:20.618645 | debian-bookworm | +-w /usr/local/lib/systemd/system-generators/ -p wa -k systemd_generator 2026-03-26 09:05:20.618758 | debian-bookworm | +-w /usr/lib/systemd/system-generators -p wa -k systemd_generator 2026-03-26 09:05:20.618867 | debian-bookworm | + 2026-03-26 09:05:20.618978 | debian-bookworm | +-w /etc/systemd/user-generators/ -p wa -k systemd_generator 2026-03-26 09:05:20.619090 | debian-bookworm | +-w /usr/local/lib/systemd/user-generators/ -p wa -k systemd_generator 2026-03-26 09:05:20.619202 | debian-bookworm | +-w /lib/systemd/system-generators/ -p wa -k systemd_generator 2026-03-26 09:05:20.619311 | debian-bookworm | + 2026-03-26 09:05:20.619447 | debian-bookworm | +## SELinux events that modify the system's Mandatory Access Controls (MAC) 2026-03-26 09:05:20.619560 | debian-bookworm | +-w /etc/selinux/ -p wa -k mac_policy 2026-03-26 09:05:20.619668 | debian-bookworm | + 2026-03-26 09:05:20.619779 | debian-bookworm | +## Critical elements access failures 2026-03-26 09:05:20.619894 | debian-bookworm | +-a always,exit -F arch=b64 -S open -F dir=/etc -F success=0 -k unauthedfileaccess 2026-03-26 09:05:20.620040 | debian-bookworm | +-a always,exit -F arch=b64 -S open -F dir=/bin -F success=0 -k unauthedfileaccess 2026-03-26 09:05:20.620181 | debian-bookworm | +-a always,exit -F arch=b64 -S open -F dir=/sbin -F success=0 -k unauthedfileaccess 2026-03-26 09:05:20.620296 | debian-bookworm | +-a always,exit -F arch=b64 -S open -F dir=/usr/bin -F success=0 -k unauthedfileaccess 2026-03-26 09:05:20.620455 | debian-bookworm | +-a always,exit -F arch=b64 -S open -F dir=/usr/sbin -F success=0 -k unauthedfileaccess 2026-03-26 09:05:20.620572 | debian-bookworm | +-a always,exit -F arch=b64 -S open -F dir=/var -F success=0 -k unauthedfileaccess 2026-03-26 09:05:20.620685 | debian-bookworm | +-a always,exit -F arch=b64 -S open -F dir=/home -F success=0 -k unauthedfileaccess 2026-03-26 09:05:20.620799 | debian-bookworm | +-a always,exit -F arch=b64 -S open -F dir=/srv -F success=0 -k unauthedfileaccess 2026-03-26 09:05:20.620907 | debian-bookworm | + 2026-03-26 09:05:20.621019 | debian-bookworm | +## Process ID change (switching accounts) applications 2026-03-26 09:05:20.621129 | debian-bookworm | +-w /bin/su -p x -k priv_esc 2026-03-26 09:05:20.621242 | debian-bookworm | +-w /usr/bin/sudo -p x -k priv_esc 2026-03-26 09:05:20.621364 | debian-bookworm | + 2026-03-26 09:05:20.621477 | debian-bookworm | +## Power state 2026-03-26 09:05:20.621587 | debian-bookworm | +-w /sbin/shutdown -p x -k power 2026-03-26 09:05:20.621696 | debian-bookworm | +-w /sbin/poweroff -p x -k power 2026-03-26 09:05:20.621806 | debian-bookworm | +-w /sbin/reboot -p x -k power 2026-03-26 09:05:20.621916 | debian-bookworm | +-w /sbin/halt -p x -k power 2026-03-26 09:05:20.622025 | debian-bookworm | + 2026-03-26 09:05:20.622136 | debian-bookworm | +## Session initiation information 2026-03-26 09:05:20.622248 | debian-bookworm | +-w /var/run/utmp -p wa -k session 2026-03-26 09:05:20.622378 | debian-bookworm | +-w /var/log/btmp -p wa -k session 2026-03-26 09:05:20.622492 | debian-bookworm | +-w /var/log/wtmp -p wa -k session 2026-03-26 09:05:20.622599 | debian-bookworm | + 2026-03-26 09:05:20.622719 | debian-bookworm | +## Discretionary Access Control (DAC) modifications 2026-03-26 09:05:20.622835 | debian-bookworm | +-a always,exit -F arch=b64 -S chmod -F auid>=1000 -F auid!=-1 -k perm_mod 2026-03-26 09:05:20.622951 | debian-bookworm | +-a always,exit -F arch=b64 -S chown -F auid>=1000 -F auid!=-1 -k perm_mod 2026-03-26 09:05:20.623065 | debian-bookworm | +-a always,exit -F arch=b64 -S fchmod -F auid>=1000 -F auid!=-1 -k perm_mod 2026-03-26 09:05:20.623176 | debian-bookworm | +-a always,exit -F arch=b64 -S fchmodat -F auid>=1000 -F auid!=-1 -k perm_mod 2026-03-26 09:05:20.623302 | debian-bookworm | +-a always,exit -F arch=b64 -S fchown -F auid>=1000 -F auid!=-1 -k perm_mod 2026-03-26 09:05:20.623460 | debian-bookworm | +-a always,exit -F arch=b64 -S fchownat -F auid>=1000 -F auid!=-1 -k perm_mod 2026-03-26 09:05:20.623575 | debian-bookworm | +-a always,exit -F arch=b64 -S fremovexattr -F auid>=1000 -F auid!=-1 -k perm_mod 2026-03-26 09:05:20.623687 | debian-bookworm | +-a always,exit -F arch=b64 -S fsetxattr -F auid>=1000 -F auid!=-1 -k perm_mod 2026-03-26 09:05:20.623797 | debian-bookworm | +-a always,exit -F arch=b64 -S lchown -F auid>=1000 -F auid!=-1 -k perm_mod 2026-03-26 09:05:20.623907 | debian-bookworm | +-a always,exit -F arch=b64 -S lremovexattr -F auid>=1000 -F auid!=-1 -k perm_mod 2026-03-26 09:05:20.624059 | debian-bookworm | +-a always,exit -F arch=b64 -S lsetxattr -F auid>=1000 -F auid!=-1 -k perm_mod 2026-03-26 09:05:20.624178 | debian-bookworm | +-a always,exit -F arch=b64 -S removexattr -F auid>=1000 -F auid!=-1 -k perm_mod 2026-03-26 09:05:20.624294 | debian-bookworm | +-a always,exit -F arch=b64 -S setxattr -F auid>=1000 -F auid!=-1 -k perm_mod 2026-03-26 09:05:20.624443 | debian-bookworm | + 2026-03-26 09:05:20.624615 | debian-bookworm | +# Special Rules --------------------------------------------------------------- 2026-03-26 09:05:20.624739 | debian-bookworm | + 2026-03-26 09:05:20.624853 | debian-bookworm | +## Reconnaissance 2026-03-26 09:05:20.624967 | debian-bookworm | +-w /usr/bin/whoami -p x -k recon 2026-03-26 09:05:20.625081 | debian-bookworm | +-w /usr/bin/id -p x -k recon 2026-03-26 09:05:20.625194 | debian-bookworm | +-w /bin/hostname -p x -k recon 2026-03-26 09:05:20.625309 | debian-bookworm | +-w /bin/uname -p x -k recon 2026-03-26 09:05:20.625465 | debian-bookworm | +-w /etc/issue -p r -k recon 2026-03-26 09:05:20.625584 | debian-bookworm | +-w /etc/hostname -p r -k recon 2026-03-26 09:05:20.625697 | debian-bookworm | + 2026-03-26 09:05:20.625809 | debian-bookworm | +## Suspicious activity 2026-03-26 09:05:20.625921 | debian-bookworm | +-w /usr/bin/wget -p x -k susp_activity 2026-03-26 09:05:20.626034 | debian-bookworm | +-w /usr/bin/curl -p x -k susp_activity 2026-03-26 09:05:20.626146 | debian-bookworm | +-w /usr/bin/base64 -p x -k susp_activity 2026-03-26 09:05:20.626261 | debian-bookworm | +-w /bin/nc -p x -k susp_activity 2026-03-26 09:05:20.626391 | debian-bookworm | +-w /bin/netcat -p x -k susp_activity 2026-03-26 09:05:20.626512 | debian-bookworm | +-w /usr/bin/ncat -p x -k susp_activity 2026-03-26 09:05:20.626645 | debian-bookworm | +-w /usr/bin/ss -p x -k susp_activity 2026-03-26 09:05:20.626763 | debian-bookworm | +-w /usr/bin/netstat -p x -k susp_activity 2026-03-26 09:05:20.626881 | debian-bookworm | +-w /usr/bin/ssh -p x -k susp_activity 2026-03-26 09:05:20.626998 | debian-bookworm | +-w /usr/bin/scp -p x -k susp_activity 2026-03-26 09:05:20.627113 | debian-bookworm | +-w /usr/bin/sftp -p x -k susp_activity 2026-03-26 09:05:20.627222 | debian-bookworm | +-w /usr/bin/ftp -p x -k susp_activity 2026-03-26 09:05:20.627356 | debian-bookworm | +-w /usr/bin/socat -p x -k susp_activity 2026-03-26 09:05:20.627476 | debian-bookworm | +-w /usr/bin/wireshark -p x -k susp_activity 2026-03-26 09:05:20.627593 | debian-bookworm | +-w /usr/bin/tshark -p x -k susp_activity 2026-03-26 09:05:20.627706 | debian-bookworm | +-w /usr/bin/rawshark -p x -k susp_activity 2026-03-26 09:05:20.627819 | debian-bookworm | +-w /usr/bin/rdesktop -p x -k susp_activity 2026-03-26 09:05:20.627970 | debian-bookworm | +-w /usr/local/bin/rdesktop -p x -k susp_activity 2026-03-26 09:05:20.628089 | debian-bookworm | +-w /usr/bin/wlfreerdp -p x -k susp_activity 2026-03-26 09:05:20.628205 | debian-bookworm | +-w /usr/bin/xfreerdp -p x -k susp_activity 2026-03-26 09:05:20.628322 | debian-bookworm | +-w /usr/local/bin/xfreerdp -p x -k susp_activity 2026-03-26 09:05:20.628457 | debian-bookworm | +-w /usr/bin/nmap -p x -k susp_activity 2026-03-26 09:05:20.628569 | debian-bookworm | + 2026-03-26 09:05:20.628682 | debian-bookworm | +## sssd 2026-03-26 09:05:20.628804 | debian-bookworm | +-a always,exit -F path=/usr/libexec/sssd/p11_child -F perm=x -F auid>=500 -F auid!=4294967295 -k T1078_Valid_Accounts 2026-03-26 09:05:20.628923 | debian-bookworm | +-a always,exit -F path=/usr/libexec/sssd/krb5_child -F perm=x -F auid>=500 -F auid!=4294967295 -k T1078_Valid_Accounts 2026-03-26 09:05:20.629039 | debian-bookworm | +-a always,exit -F path=/usr/libexec/sssd/ldap_child -F perm=x -F auid>=500 -F auid!=4294967295 -k T1078_Valid_Accounts 2026-03-26 09:05:20.629155 | debian-bookworm | +-a always,exit -F path=/usr/libexec/sssd/selinux_child -F perm=x -F auid>=500 -F auid!=4294967295 -k T1078_Valid_Accounts 2026-03-26 09:05:20.629268 | debian-bookworm | +-a always,exit -F path=/usr/libexec/sssd/proxy_child -F perm=x -F auid>=500 -F auid!=4294967295 -k T1078_Valid_Accounts 2026-03-26 09:05:20.629415 | debian-bookworm | + 2026-03-26 09:05:20.629534 | debian-bookworm | +## T1002 Data Compressed 2026-03-26 09:05:20.629646 | debian-bookworm | + 2026-03-26 09:05:20.629760 | debian-bookworm | +-w /usr/bin/zip -p x -k Data_Compressed 2026-03-26 09:05:20.629877 | debian-bookworm | +-w /usr/bin/gzip -p x -k Data_Compressed 2026-03-26 09:05:20.629991 | debian-bookworm | +-w /usr/bin/tar -p x -k Data_Compressed 2026-03-26 09:05:20.630106 | debian-bookworm | +-w /usr/bin/bzip2 -p x -k Data_Compressed 2026-03-26 09:05:20.630218 | debian-bookworm | + 2026-03-26 09:05:20.630346 | debian-bookworm | +-w /usr/bin/lzip -p x -k Data_Compressed 2026-03-26 09:05:20.630465 | debian-bookworm | +-w /usr/local/bin/lzip -p x -k Data_Compressed 2026-03-26 09:05:20.630575 | debian-bookworm | + 2026-03-26 09:05:20.630694 | debian-bookworm | +-w /usr/bin/lz4 -p x -k Data_Compressed 2026-03-26 09:05:20.630811 | debian-bookworm | +-w /usr/local/bin/lz4 -p x -k Data_Compressed 2026-03-26 09:05:20.630922 | debian-bookworm | + 2026-03-26 09:05:20.631033 | debian-bookworm | +-w /usr/bin/lzop -p x -k Data_Compressed 2026-03-26 09:05:20.631147 | debian-bookworm | +-w /usr/local/bin/lzop -p x -k Data_Compressed 2026-03-26 09:05:20.631257 | debian-bookworm | + 2026-03-26 09:05:20.631389 | debian-bookworm | +-w /usr/bin/plzip -p x -k Data_Compressed 2026-03-26 09:05:20.631503 | debian-bookworm | +-w /usr/local/bin/plzip -p x -k Data_Compressed 2026-03-26 09:05:20.631612 | debian-bookworm | + 2026-03-26 09:05:20.631727 | debian-bookworm | +-w /usr/bin/pbzip2 -p x -k Data_Compressed 2026-03-26 09:05:20.631842 | debian-bookworm | +-w /usr/local/bin/pbzip2 -p x -k Data_Compressed 2026-03-26 09:05:20.631976 | debian-bookworm | + 2026-03-26 09:05:20.632094 | debian-bookworm | +-w /usr/bin/lbzip2 -p x -k Data_Compressed 2026-03-26 09:05:20.632207 | debian-bookworm | +-w /usr/local/bin/lbzip2 -p x -k Data_Compressed 2026-03-26 09:05:20.632319 | debian-bookworm | + 2026-03-26 09:05:20.632496 | debian-bookworm | +-w /usr/bin/pixz -p x -k Data_Compressed 2026-03-26 09:05:20.632618 | debian-bookworm | +-w /usr/local/bin/pixz -p x -k Data_Compressed 2026-03-26 09:05:20.632728 | debian-bookworm | + 2026-03-26 09:05:20.632848 | debian-bookworm | +-w /usr/bin/pigz -p x -k Data_Compressed 2026-03-26 09:05:20.632962 | debian-bookworm | +-w /usr/local/bin/pigz -p x -k Data_Compressed 2026-03-26 09:05:20.633076 | debian-bookworm | +-w /usr/bin/unpigz -p x -k Data_Compressed 2026-03-26 09:05:20.633191 | debian-bookworm | +-w /usr/local/bin/unpigz -p x -k Data_Compressed 2026-03-26 09:05:20.633300 | debian-bookworm | + 2026-03-26 09:05:20.633454 | debian-bookworm | +-w /usr/bin/zstd -p x -k Data_Compressed 2026-03-26 09:05:20.633581 | debian-bookworm | +-w /usr/local/bin/zstd -p x -k Data_Compressed 2026-03-26 09:05:20.633702 | debian-bookworm | + 2026-03-26 09:05:20.633819 | debian-bookworm | +## Added to catch netcat on Ubuntu 2026-03-26 09:05:20.633934 | debian-bookworm | +-w /bin/nc.openbsd -p x -k susp_activity 2026-03-26 09:05:20.634048 | debian-bookworm | +-w /bin/nc.traditional -p x -k susp_activity 2026-03-26 09:05:20.634155 | debian-bookworm | + 2026-03-26 09:05:20.634268 | debian-bookworm | +## Sbin suspicious activity 2026-03-26 09:05:20.634403 | debian-bookworm | +-w /sbin/iptables -p x -k sbin_susp 2026-03-26 09:05:20.634516 | debian-bookworm | +-w /sbin/ip6tables -p x -k sbin_susp 2026-03-26 09:05:20.634627 | debian-bookworm | +-w /sbin/ifconfig -p x -k sbin_susp 2026-03-26 09:05:20.634740 | debian-bookworm | +-w /usr/sbin/arptables -p x -k sbin_susp 2026-03-26 09:05:20.634852 | debian-bookworm | +-w /usr/sbin/ebtables -p x -k sbin_susp 2026-03-26 09:05:20.634964 | debian-bookworm | +-w /sbin/xtables-nft-multi -p x -k sbin_susp 2026-03-26 09:05:20.635075 | debian-bookworm | +-w /usr/sbin/nft -p x -k sbin_susp 2026-03-26 09:05:20.635184 | debian-bookworm | +-w /usr/sbin/tcpdump -p x -k sbin_susp 2026-03-26 09:05:20.635293 | debian-bookworm | +-w /usr/sbin/traceroute -p x -k sbin_susp 2026-03-26 09:05:20.635417 | debian-bookworm | +-w /usr/sbin/ufw -p x -k sbin_susp 2026-03-26 09:05:20.635526 | debian-bookworm | + 2026-03-26 09:05:20.635635 | debian-bookworm | +### kde4 2026-03-26 09:05:20.635820 | debian-bookworm | +-a always,exit -F path=/usr/libexec/kde4/kpac_dhcp_helper -F perm=x -F auid>=1000 -F auid!=4294967295 -k T1078_Valid_Accounts 2026-03-26 09:05:20.635976 | debian-bookworm | +-a always,exit -F path=/usr/libexec/kde4/kdesud -F perm=x -F auid>=1000 -F auid!=4294967295 -k T1078_Valid_Accounts 2026-03-26 09:05:20.636109 | debian-bookworm | + 2026-03-26 09:05:20.636221 | debian-bookworm | +## dbus-send invocation 2026-03-26 09:05:20.636349 | debian-bookworm | +### may indicate privilege escalation CVE-2021-3560 2026-03-26 09:05:20.636469 | debian-bookworm | +-w /usr/bin/dbus-send -p x -k dbus_send 2026-03-26 09:05:20.636587 | debian-bookworm | +-w /usr/bin/gdbus -p x -k gdubs_call 2026-03-26 09:05:20.636695 | debian-bookworm | + 2026-03-26 09:05:20.636805 | debian-bookworm | +## pkexec invocation 2026-03-26 09:05:20.636918 | debian-bookworm | +### may indicate privilege escalation CVE-2021-4034 2026-03-26 09:05:20.637029 | debian-bookworm | +-w /usr/bin/pkexec -p x -k pkexec 2026-03-26 09:05:20.637138 | debian-bookworm | + 2026-03-26 09:05:20.637248 | debian-bookworm | +## Suspicious shells 2026-03-26 09:05:20.637397 | debian-bookworm | +-w /bin/ash -p x -k susp_shell 2026-03-26 09:05:20.637515 | debian-bookworm | +-w /bin/csh -p x -k susp_shell 2026-03-26 09:05:20.637628 | debian-bookworm | +-w /bin/fish -p x -k susp_shell 2026-03-26 09:05:20.637738 | debian-bookworm | +-w /bin/tcsh -p x -k susp_shell 2026-03-26 09:05:20.637847 | debian-bookworm | +-w /bin/tclsh -p x -k susp_shell 2026-03-26 09:05:20.637956 | debian-bookworm | +-w /bin/xonsh -p x -k susp_shell 2026-03-26 09:05:20.638065 | debian-bookworm | +-w /usr/local/bin/xonsh -p x -k susp_shell 2026-03-26 09:05:20.638183 | debian-bookworm | +-w /bin/open -p x -k susp_shell 2026-03-26 09:05:20.638291 | debian-bookworm | +-w /bin/rbash -p x -k susp_shell 2026-03-26 09:05:20.638414 | debian-bookworm | + 2026-03-26 09:05:20.638527 | debian-bookworm | +# Web Server Actvity 2026-03-26 09:05:20.638642 | debian-bookworm | +## Change the number "33" to the ID of your WebServer user. Default: www-data:x:33:33 2026-03-26 09:05:20.638756 | debian-bookworm | +-a always,exit -F arch=b64 -S execve -F euid=33 -k detect_execve_www 2026-03-26 09:05:20.638866 | debian-bookworm | + 2026-03-26 09:05:20.638980 | debian-bookworm | +### https://clustershell.readthedocs.io/ 2026-03-26 09:05:20.639090 | debian-bookworm | +-w /bin/clush -p x -k susp_shell 2026-03-26 09:05:20.639200 | debian-bookworm | +-w /usr/local/bin/clush -p x -k susp_shell 2026-03-26 09:05:20.639312 | debian-bookworm | +-w /etc/clustershell/clush.conf -p x -k susp_shell 2026-03-26 09:05:20.639433 | debian-bookworm | + 2026-03-26 09:05:20.639544 | debian-bookworm | +### https://github.com/tmux/tmux 2026-03-26 09:05:20.639665 | debian-bookworm | +-w /bin/tmux -p x -k susp_shell 2026-03-26 09:05:20.639777 | debian-bookworm | +-w /usr/local/bin/tmux -p x -k susp_shell 2026-03-26 09:05:20.639886 | debian-bookworm | + 2026-03-26 09:05:20.640023 | debian-bookworm | +## Shell/profile configurations 2026-03-26 09:05:20.640137 | debian-bookworm | +-w /etc/profile.d/ -p wa -k shell_profiles 2026-03-26 09:05:20.640247 | debian-bookworm | +-w /etc/profile -p wa -k shell_profiles 2026-03-26 09:05:20.640395 | debian-bookworm | +-w /etc/shells -p wa -k shell_profiles 2026-03-26 09:05:20.640510 | debian-bookworm | +-w /etc/bashrc -p wa -k shell_profiles 2026-03-26 09:05:20.640621 | debian-bookworm | +-w /etc/csh.cshrc -p wa -k shell_profiles 2026-03-26 09:05:20.640734 | debian-bookworm | +-w /etc/csh.login -p wa -k shell_profiles 2026-03-26 09:05:20.640847 | debian-bookworm | +-w /etc/fish/ -p wa -k shell_profiles 2026-03-26 09:05:20.640958 | debian-bookworm | +-w /etc/zsh/ -p wa -k shell_profiles 2026-03-26 09:05:20.641081 | debian-bookworm | + 2026-03-26 09:05:20.641192 | debian-bookworm | +### https://github.com/xxh/xxh 2026-03-26 09:05:20.641307 | debian-bookworm | +-w /usr/local/bin/xxh.bash -p x -k susp_shell 2026-03-26 09:05:20.641437 | debian-bookworm | +-w /usr/local/bin/xxh.xsh -p x -k susp_shell 2026-03-26 09:05:20.641549 | debian-bookworm | +-w /usr/local/bin/xxh.zsh -p x -k susp_shell 2026-03-26 09:05:20.641661 | debian-bookworm | + 2026-03-26 09:05:20.641773 | debian-bookworm | +## Injection 2026-03-26 09:05:20.641886 | debian-bookworm | +### These rules watch for code injection by the ptrace facility. 2026-03-26 09:05:20.641998 | debian-bookworm | +### This could indicate someone trying to do something bad or just debugging 2026-03-26 09:05:20.642115 | debian-bookworm | +-a always,exit -F arch=b64 -S ptrace -F a0=0x4 -k code_injection 2026-03-26 09:05:20.642228 | debian-bookworm | +-a always,exit -F arch=b64 -S ptrace -F a0=0x5 -k data_injection 2026-03-26 09:05:20.642357 | debian-bookworm | +-a always,exit -F arch=b64 -S ptrace -F a0=0x6 -k register_injection 2026-03-26 09:05:20.642471 | debian-bookworm | +-a always,exit -F arch=b64 -S ptrace -k tracing 2026-03-26 09:05:20.642578 | debian-bookworm | + 2026-03-26 09:05:20.642705 | debian-bookworm | +## Anonymous File Creation 2026-03-26 09:05:20.642838 | debian-bookworm | +### These rules watch the use of memfd_create 2026-03-26 09:05:20.642953 | debian-bookworm | +### "memfd_create" creates anonymous file and returns a file descriptor to access it 2026-03-26 09:05:20.643078 | debian-bookworm | +### When combined with "fexecve" can be used to stealthily run binaries in memory without touching disk 2026-03-26 09:05:20.643195 | debian-bookworm | +-a always,exit -F arch=b64 -S memfd_create -F key=anon_file_create 2026-03-26 09:05:20.643320 | debian-bookworm | + 2026-03-26 09:05:20.643870 | debian-bookworm | +## Privilege Abuse 2026-03-26 09:05:20.644047 | debian-bookworm | +### The purpose of this rule is to detect when an admin may be abusing power by looking in user's home dir. 2026-03-26 09:05:20.644171 | debian-bookworm | +-a always,exit -F dir=/home -F uid=0 -F auid>=1000 -F auid!=-1 -C auid!=obj_uid -k power_abuse 2026-03-26 09:05:20.644283 | debian-bookworm | + 2026-03-26 09:05:20.644448 | debian-bookworm | +# Socket Creations 2026-03-26 09:05:20.644576 | debian-bookworm | +# will catch both IPv4 and IPv6 2026-03-26 09:05:20.644688 | debian-bookworm | + 2026-03-26 09:05:20.644803 | debian-bookworm | +-a always,exit -F arch=b32 -S socket -F a0=2 -k network_socket_created 2026-03-26 09:05:20.644916 | debian-bookworm | +-a always,exit -F arch=b64 -S socket -F a0=2 -k network_socket_created 2026-03-26 09:05:20.645026 | debian-bookworm | + 2026-03-26 09:05:20.645139 | debian-bookworm | +-a always,exit -F arch=b32 -S socket -F a0=10 -k network_socket_created 2026-03-26 09:05:20.645250 | debian-bookworm | +-a always,exit -F arch=b64 -S socket -F a0=10 -k network_socket_created 2026-03-26 09:05:20.645383 | debian-bookworm | + 2026-03-26 09:05:20.645499 | debian-bookworm | +# Software Management --------------------------------------------------------- 2026-03-26 09:05:20.645608 | debian-bookworm | + 2026-03-26 09:05:20.645720 | debian-bookworm | +# RPM (Redhat/CentOS) 2026-03-26 09:05:20.645832 | debian-bookworm | +-w /usr/bin/rpm -p x -k software_mgmt 2026-03-26 09:05:20.645944 | debian-bookworm | +-w /usr/bin/yum -p x -k software_mgmt 2026-03-26 09:05:20.646052 | debian-bookworm | + 2026-03-26 09:05:20.646162 | debian-bookworm | +# DNF (Fedora/RedHat 8/CentOS 8) 2026-03-26 09:05:20.646273 | debian-bookworm | +-w /usr/bin/dnf -p x -k software_mgmt 2026-03-26 09:05:20.646440 | debian-bookworm | + 2026-03-26 09:05:20.646558 | debian-bookworm | +# YAST/Zypper/RPM (SuSE) 2026-03-26 09:05:20.646672 | debian-bookworm | +-w /sbin/yast -p x -k software_mgmt 2026-03-26 09:05:20.646784 | debian-bookworm | +-w /sbin/yast2 -p x -k software_mgmt 2026-03-26 09:05:20.646895 | debian-bookworm | +-w /bin/rpm -p x -k software_mgmt 2026-03-26 09:05:20.647006 | debian-bookworm | +-w /usr/bin/zypper -k software_mgmt 2026-03-26 09:05:20.647113 | debian-bookworm | + 2026-03-26 09:05:20.647226 | debian-bookworm | +# DPKG / APT-GET (Debian/Ubuntu) 2026-03-26 09:05:20.647360 | debian-bookworm | +-w /usr/bin/dpkg -p x -k software_mgmt 2026-03-26 09:05:20.647474 | debian-bookworm | +-w /usr/bin/apt -p x -k software_mgmt 2026-03-26 09:05:20.647591 | debian-bookworm | +-w /usr/bin/apt-add-repository -p x -k software_mgmt 2026-03-26 09:05:20.647702 | debian-bookworm | +-w /usr/bin/apt-get -p x -k software_mgmt 2026-03-26 09:05:20.647820 | debian-bookworm | +-w /usr/bin/aptitude -p x -k software_mgmt 2026-03-26 09:05:20.647952 | debian-bookworm | +-w /usr/bin/wajig -p x -k software_mgmt 2026-03-26 09:05:20.648085 | debian-bookworm | +-w /usr/bin/snap -p x -k software_mgmt 2026-03-26 09:05:20.648195 | debian-bookworm | + 2026-03-26 09:05:20.648308 | debian-bookworm | +# PIP(3) (Python installs) 2026-03-26 09:05:20.648443 | debian-bookworm | +-w /usr/bin/pip -p x -k third_party_software_mgmt 2026-03-26 09:05:20.648560 | debian-bookworm | +-w /usr/local/bin/pip -p x -k third_party_software_mgmt 2026-03-26 09:05:20.648691 | debian-bookworm | +-w /usr/bin/pip3 -p x -k third_party_software_mgmt 2026-03-26 09:05:20.648804 | debian-bookworm | +-w /usr/local/bin/pip3 -p x -k third_party_software_mgmt 2026-03-26 09:05:20.648917 | debian-bookworm | +-w /usr/bin/pipx -p x -k third_party_software_mgmt 2026-03-26 09:05:20.649030 | debian-bookworm | +-w /usr/local/bin/pipx -p x -k third_party_software_mgmt 2026-03-26 09:05:20.649138 | debian-bookworm | + 2026-03-26 09:05:20.649248 | debian-bookworm | +# npm 2026-03-26 09:05:20.649394 | debian-bookworm | +## T1072 third party software 2026-03-26 09:05:20.649512 | debian-bookworm | +## https://www.npmjs.com 2026-03-26 09:05:20.649702 | debian-bookworm | +## https://docs.npmjs.com/cli/v6/commands/npm-audit 2026-03-26 09:05:20.649830 | debian-bookworm | +-w /usr/bin/npm -p x -k third_party_software_mgmt 2026-03-26 09:05:20.649940 | debian-bookworm | + 2026-03-26 09:05:20.650054 | debian-bookworm | +# Comprehensive Perl Archive Network (CPAN) (CPAN installs) 2026-03-26 09:05:20.650166 | debian-bookworm | +## T1072 third party software 2026-03-26 09:05:20.650278 | debian-bookworm | +## https://www.cpan.org 2026-03-26 09:05:20.650434 | debian-bookworm | +-w /usr/bin/cpan -p x -k third_party_software_mgmt 2026-03-26 09:05:20.650551 | debian-bookworm | + 2026-03-26 09:05:20.650665 | debian-bookworm | +# Ruby (RubyGems installs) 2026-03-26 09:05:20.650776 | debian-bookworm | +## T1072 third party software 2026-03-26 09:05:20.650887 | debian-bookworm | +## https://rubygems.org 2026-03-26 09:05:20.650998 | debian-bookworm | +-w /usr/bin/gem -p x -k third_party_software_mgmt 2026-03-26 09:05:20.651105 | debian-bookworm | + 2026-03-26 09:05:20.651215 | debian-bookworm | +# LuaRocks (Lua installs) 2026-03-26 09:05:20.651356 | debian-bookworm | +## T1072 third party software 2026-03-26 09:05:20.651481 | debian-bookworm | +## https://luarocks.org 2026-03-26 09:05:20.651595 | debian-bookworm | +-w /usr/bin/luarocks -p x -k third_party_software_mgmt 2026-03-26 09:05:20.651702 | debian-bookworm | + 2026-03-26 09:05:20.651812 | debian-bookworm | +# Pacman (Arch Linux) 2026-03-26 09:05:20.651997 | debian-bookworm | +## https://wiki.archlinux.org/title/Pacman 2026-03-26 09:05:20.652129 | debian-bookworm | +## T1072 third party software 2026-03-26 09:05:20.652246 | debian-bookworm | +-w /etc/pacman.conf -p x -k third_party_software_mgmt 2026-03-26 09:05:20.652375 | debian-bookworm | +-w /etc/pacman.d -p x -k third_party_software_mgmt 2026-03-26 09:05:20.652483 | debian-bookworm | + 2026-03-26 09:05:20.652602 | debian-bookworm | +# Special Software ------------------------------------------------------------ 2026-03-26 09:05:20.652711 | debian-bookworm | + 2026-03-26 09:05:20.652821 | debian-bookworm | +## GDS specific secrets 2026-03-26 09:05:20.652932 | debian-bookworm | +-w /etc/puppet/ssl -p wa -k puppet_ssl 2026-03-26 09:05:20.653040 | debian-bookworm | + 2026-03-26 09:05:20.653149 | debian-bookworm | +## IBM Bigfix BESClient 2026-03-26 09:05:20.653262 | debian-bookworm | +-a always,exit -F arch=b64 -S open -F dir=/opt/BESClient -F success=0 -k soft_besclient 2026-03-26 09:05:20.653395 | debian-bookworm | +-w /var/opt/BESClient/ -p wa -k soft_besclient 2026-03-26 09:05:20.653506 | debian-bookworm | + 2026-03-26 09:05:20.653616 | debian-bookworm | +## CHEF https://www.chef.io/chef/ 2026-03-26 09:05:20.653727 | debian-bookworm | +-w /etc/chef -p wa -k soft_chef 2026-03-26 09:05:20.653835 | debian-bookworm | + 2026-03-26 09:05:20.653944 | debian-bookworm | +## Salt 2026-03-26 09:05:20.654057 | debian-bookworm | +## https://saltproject.io/ 2026-03-26 09:05:20.654170 | debian-bookworm | +## https://docs.saltproject.io/en/latest/ref/configuration/master.html 2026-03-26 09:05:20.654285 | debian-bookworm | +-w /etc/salt -p wa -k soft_salt 2026-03-26 09:05:20.654439 | debian-bookworm | +-w /usr/local/etc/salt -p wa -k soft_salt 2026-03-26 09:05:20.654555 | debian-bookworm | + 2026-03-26 09:05:20.654666 | debian-bookworm | +## Otter 2026-03-26 09:05:20.654777 | debian-bookworm | +## https://inedo.com/otter 2026-03-26 09:05:20.654891 | debian-bookworm | +-w /etc/otter -p wa -k soft_otter 2026-03-26 09:05:20.655001 | debian-bookworm | + 2026-03-26 09:05:20.655112 | debian-bookworm | +## T1081 Credentials In Files 2026-03-26 09:05:20.655225 | debian-bookworm | +-w /usr/bin/grep -p x -k string_search 2026-03-26 09:05:20.655374 | debian-bookworm | +-w /usr/bin/egrep -p x -k string_search 2026-03-26 09:05:20.655496 | debian-bookworm | +-w /usr/bin/ugrep -p x -k string_search 2026-03-26 09:05:20.655607 | debian-bookworm | +### macOS 2026-03-26 09:05:20.655718 | debian-bookworm | +-w /usr/local/bin/grep -p x -k string_search 2026-03-26 09:05:20.655831 | debian-bookworm | +-w /usr/local/bin/egrep -p x -k string_search 2026-03-26 09:05:20.655969 | debian-bookworm | +-w /usr/local/bin/ugrep -p x -k string_search 2026-03-26 09:05:20.656079 | debian-bookworm | + 2026-03-26 09:05:20.656192 | debian-bookworm | +### https://github.com/tmbinc/bgrep 2026-03-26 09:05:20.656307 | debian-bookworm | +-w /usr/bin/bgrep -p x -k string_search 2026-03-26 09:05:20.656443 | debian-bookworm | +### macOS 2026-03-26 09:05:20.656563 | debian-bookworm | +-w /usr/local/bin/bgrep -p x -k string_search 2026-03-26 09:05:20.656685 | debian-bookworm | + 2026-03-26 09:05:20.656806 | debian-bookworm | +### https://github.com/BurntSushi/ripgrep 2026-03-26 09:05:20.656919 | debian-bookworm | +-w /usr/bin/rg -p x -k string_search 2026-03-26 09:05:20.657031 | debian-bookworm | +### macOS 2026-03-26 09:05:20.657142 | debian-bookworm | +-w /usr/local/bin/rg -p x -k string_search 2026-03-26 09:05:20.657250 | debian-bookworm | + 2026-03-26 09:05:20.657396 | debian-bookworm | +### https://github.com/awgn/cgrep 2026-03-26 09:05:20.657512 | debian-bookworm | + 2026-03-26 09:05:20.657624 | debian-bookworm | +-w /usr/bin/cgrep -p x -k string_search 2026-03-26 09:05:20.657734 | debian-bookworm | +### macOS 2026-03-26 09:05:20.657846 | debian-bookworm | +-w /usr/local/bin/cgrep -p x -k string_search 2026-03-26 09:05:20.657956 | debian-bookworm | + 2026-03-26 09:05:20.658066 | debian-bookworm | +### https://github.com/jpr5/ngrep 2026-03-26 09:05:20.658177 | debian-bookworm | +-w /usr/bin/ngrep -p x -k string_search 2026-03-26 09:05:20.658287 | debian-bookworm | +### macOS 2026-03-26 09:05:20.658453 | debian-bookworm | +-w /usr/local/bin/ngrep -p x -k string_search 2026-03-26 09:05:20.658569 | debian-bookworm | + 2026-03-26 09:05:20.658688 | debian-bookworm | +### https://github.com/vrothberg/vgrep 2026-03-26 09:05:20.658799 | debian-bookworm | +-w /usr/bin/vgrep -p x -k string_search 2026-03-26 09:05:20.658910 | debian-bookworm | +### macOS 2026-03-26 09:05:20.659025 | debian-bookworm | +-w /usr/local/bin/vgrep -p x -k string_search 2026-03-26 09:05:20.659139 | debian-bookworm | + 2026-03-26 09:05:20.659261 | debian-bookworm | +### https://github.com/monochromegane/the_platinum_searcher 2026-03-26 09:05:20.659395 | debian-bookworm | +-w /usr/bin/pt -p x -k string_search 2026-03-26 09:05:20.659511 | debian-bookworm | +### macOS 2026-03-26 09:05:20.659625 | debian-bookworm | +-w /usr/local/bin/pt -p x -k string_search 2026-03-26 09:05:20.659735 | debian-bookworm | + 2026-03-26 09:05:20.659848 | debian-bookworm | +### https://github.com/gvansickle/ucg 2026-03-26 09:05:20.659996 | debian-bookworm | +-w /usr/bin/ucg -p x -k string_search 2026-03-26 09:05:20.660114 | debian-bookworm | +### macOS 2026-03-26 09:05:20.660227 | debian-bookworm | +-w /usr/local/bin/ucg -p x -k string_search 2026-03-26 09:05:20.660373 | debian-bookworm | + 2026-03-26 09:05:20.660500 | debian-bookworm | +### https://github.com/ggreer/the_silver_searcher 2026-03-26 09:05:20.660617 | debian-bookworm | +-w /usr/bin/ag -p x -k string_search 2026-03-26 09:05:20.660727 | debian-bookworm | +### macOS 2026-03-26 09:05:20.660840 | debian-bookworm | +-w /usr/local/bin/ag -p x -k string_search 2026-03-26 09:05:20.660952 | debian-bookworm | + 2026-03-26 09:05:20.661066 | debian-bookworm | +### https://github.com/beyondgrep/ack3 2026-03-26 09:05:20.661179 | debian-bookworm | +### https://beyondgrep.com 2026-03-26 09:05:20.661294 | debian-bookworm | +-w /usr/bin/ack -p x -k string_search 2026-03-26 09:05:20.661425 | debian-bookworm | +-w /usr/local/bin/ack -p x -k string_search 2026-03-26 09:05:20.661539 | debian-bookworm | +-w /usr/bin/semgrep -p x -k string_search 2026-03-26 09:05:20.661650 | debian-bookworm | +### macOS 2026-03-26 09:05:20.661761 | debian-bookworm | +-w /usr/local/bin/semgrep -p x -k string_search 2026-03-26 09:05:20.661868 | debian-bookworm | + 2026-03-26 09:05:20.661976 | debian-bookworm | +## Docker 2026-03-26 09:05:20.662089 | debian-bookworm | +-w /usr/bin/dockerd -k docker 2026-03-26 09:05:20.662197 | debian-bookworm | +-w /usr/bin/docker -k docker 2026-03-26 09:05:20.662308 | debian-bookworm | +-w /usr/bin/docker-containerd -k docker 2026-03-26 09:05:20.662437 | debian-bookworm | +-w /usr/bin/docker-runc -k docker 2026-03-26 09:05:20.662549 | debian-bookworm | +-w /var/lib/docker -p wa -k docker 2026-03-26 09:05:20.662660 | debian-bookworm | +-w /etc/docker -k docker 2026-03-26 09:05:20.662769 | debian-bookworm | +-w /etc/sysconfig/docker -k docker 2026-03-26 09:05:20.662880 | debian-bookworm | +-w /etc/sysconfig/docker-storage -k docker 2026-03-26 09:05:20.662989 | debian-bookworm | +-w /usr/lib/systemd/system/docker.service -k docker 2026-03-26 09:05:20.663101 | debian-bookworm | +-w /usr/lib/systemd/system/docker.socket -k docker 2026-03-26 09:05:20.663209 | debian-bookworm | + 2026-03-26 09:05:20.663317 | debian-bookworm | +## Virtualization stuff 2026-03-26 09:05:20.663482 | debian-bookworm | +-w /usr/bin/qemu-system-x86_64 -p x -k qemu-system-x86_64 2026-03-26 09:05:20.663598 | debian-bookworm | +-w /usr/bin/qemu-img -p x -k qemu-img 2026-03-26 09:05:20.663707 | debian-bookworm | +-w /usr/bin/qemu-kvm -p x -k qemu-kvm 2026-03-26 09:05:20.663817 | debian-bookworm | +-w /usr/bin/qemu -p x -k qemu 2026-03-26 09:05:20.663948 | debian-bookworm | +-w /usr/bin/virtualbox -p x -k virtualbox 2026-03-26 09:05:20.664068 | debian-bookworm | +-w /usr/bin/virt-manager -p x -k virt-manager 2026-03-26 09:05:20.664181 | debian-bookworm | +-w /usr/bin/VBoxManage -p x -k VBoxManage 2026-03-26 09:05:20.664289 | debian-bookworm | + 2026-03-26 09:05:20.664419 | debian-bookworm | +#### VirtualBox on macOS 2026-03-26 09:05:20.664530 | debian-bookworm | + 2026-03-26 09:05:20.664644 | debian-bookworm | +-w /usr/local/bin/VirtualBox -p x -k virt_tool 2026-03-26 09:05:20.664766 | debian-bookworm | +-w /usr/local/bin/VirtualBoxVM -p x -k virt_tool 2026-03-26 09:05:20.664876 | debian-bookworm | +-w /usr/local/bin/VBoxManage -p x -k virt_tool 2026-03-26 09:05:20.664986 | debian-bookworm | +-w /usr/local/bin/VBoxVRDP -p x -k virt_tool 2026-03-26 09:05:20.665097 | debian-bookworm | +-w /usr/local/bin/VBoxHeadless -p x -k virt_tool 2026-03-26 09:05:20.665206 | debian-bookworm | +-w /usr/local/bin/vboxwebsrv -p x -k virt_tool 2026-03-26 09:05:20.665318 | debian-bookworm | +-w /usr/local/bin/VBoxBugReport -p x -k virt_tool 2026-03-26 09:05:20.665453 | debian-bookworm | +-w /usr/local/bin/VBoxBalloonCtrl -p x -k virt_tool 2026-03-26 09:05:20.665567 | debian-bookworm | +-w /usr/local/bin/VBoxAutostart -p x -k virt_tool 2026-03-26 09:05:20.665677 | debian-bookworm | +-w /usr/local/bin/VBoxDTrace -p x -k virt_tool 2026-03-26 09:05:20.665785 | debian-bookworm | +-w /usr/local/bin/vbox-img -p x -k virt_tool 2026-03-26 09:05:20.665899 | debian-bookworm | +-w /Library/LaunchDaemons/org.virtualbox.startup.plist -p x -k virt_tool 2026-03-26 09:05:20.666012 | debian-bookworm | +-w /Library/Application Support/VirtualBox/LaunchDaemons/ -p x -k virt_tool 2026-03-26 09:05:20.666122 | debian-bookworm | +-w /Library/Application Support/VirtualBox/VBoxDrv.kext/ -p x -k virt_tool 2026-03-26 09:05:20.666234 | debian-bookworm | +-w /Library/Application Support/VirtualBox/VBoxUSB.kext/ -p x -k virt_tool 2026-03-26 09:05:20.666382 | debian-bookworm | +-w /Library/Application Support/VirtualBox/VBoxNetFlt.kext/ -p x -k virt_tool 2026-03-26 09:05:20.666503 | debian-bookworm | +-w /Library/Application Support/VirtualBox/VBoxNetAdp.kext/ -p x -k virt_tool 2026-03-26 09:05:20.666612 | debian-bookworm | + 2026-03-26 09:05:20.666778 | debian-bookworm | +### Parallels Desktop on macOS 2026-03-26 09:05:20.666917 | debian-bookworm | + 2026-03-26 09:05:20.667031 | debian-bookworm | +-w /usr/local/bin/prl_convert -p x -k virt_tool 2026-03-26 09:05:20.667143 | debian-bookworm | +-w /usr/local/bin/prl_disk_tool -p x -k virt_tool 2026-03-26 09:05:20.667261 | debian-bookworm | +-w /usr/local/bin/prl_perf_ctl -p x -k virt_tool 2026-03-26 09:05:20.667390 | debian-bookworm | +-w /usr/local/bin/prlcore2dmp -p x -k virt_tool 2026-03-26 09:05:20.667503 | debian-bookworm | +-w /usr/local/bin/prlctl -p x -k virt_tool 2026-03-26 09:05:20.667611 | debian-bookworm | +-w /usr/local/bin/prlexec -p x -k virt_tool 2026-03-26 09:05:20.667720 | debian-bookworm | +-w /usr/local/bin/prlsrvctl -p x -k virt_tool 2026-03-26 09:05:20.667830 | debian-bookworm | +-w /Library/Preferences/Parallels -p x -k virt_tool 2026-03-26 09:05:20.667968 | debian-bookworm | + 2026-03-26 09:05:20.668086 | debian-bookworm | +### qemu on macOS 2026-03-26 09:05:20.668194 | debian-bookworm | + 2026-03-26 09:05:20.668307 | debian-bookworm | +-w /usr/local/bin/qemu-edid -p x -k virt_tool 2026-03-26 09:05:20.668460 | debian-bookworm | +-w /usr/local/bin/qemu-img -p x -k virt_tool 2026-03-26 09:05:20.668579 | debian-bookworm | +-w /usr/local/bin/qemu-io -p x -k virt_tool 2026-03-26 09:05:20.668695 | debian-bookworm | +-w /usr/local/bin/qemu-nbd -p x -k virt_tool 2026-03-26 09:05:20.668810 | debian-bookworm | +-w /usr/local/bin/qemu-system-x86_64 -p x -k virt_tool 2026-03-26 09:05:20.668916 | debian-bookworm | + 2026-03-26 09:05:20.669027 | debian-bookworm | +## Kubelet 2026-03-26 09:05:20.669139 | debian-bookworm | +-w /usr/bin/kubelet -k kubelet 2026-03-26 09:05:20.669247 | debian-bookworm | + 2026-03-26 09:05:20.669376 | debian-bookworm | +# ipc system call 2026-03-26 09:05:20.669489 | debian-bookworm | +# /usr/include/linux/ipc.h 2026-03-26 09:05:20.669597 | debian-bookworm | + 2026-03-26 09:05:20.669713 | debian-bookworm | +## msgctl 2026-03-26 09:05:20.669830 | debian-bookworm | +#-a always,exit -S ipc -F a0=14 -k Inter-Process_Communication 2026-03-26 09:05:20.669941 | debian-bookworm | +## msgget 2026-03-26 09:05:20.670053 | debian-bookworm | +#-a always,exit -S ipc -F a0=13 -k Inter-Process_Communication 2026-03-26 09:05:20.670164 | debian-bookworm | +## Use these lines on x86_64, ia64 instead 2026-03-26 09:05:20.670278 | debian-bookworm | +-a always,exit -F arch=b64 -S msgctl -k Inter-Process_Communication 2026-03-26 09:05:20.670408 | debian-bookworm | +-a always,exit -F arch=b64 -S msgget -k Inter-Process_Communication 2026-03-26 09:05:20.670516 | debian-bookworm | + 2026-03-26 09:05:20.670624 | debian-bookworm | +## semctl 2026-03-26 09:05:20.670737 | debian-bookworm | +#-a always,exit -S ipc -F a0=3 -k Inter-Process_Communication 2026-03-26 09:05:20.670846 | debian-bookworm | +## semget 2026-03-26 09:05:20.670957 | debian-bookworm | +#-a always,exit -S ipc -F a0=2 -k Inter-Process_Communication 2026-03-26 09:05:20.671066 | debian-bookworm | +## semop 2026-03-26 09:05:20.671177 | debian-bookworm | +#-a always,exit -S ipc -F a0=1 -k Inter-Process_Communication 2026-03-26 09:05:20.671285 | debian-bookworm | +## semtimedop 2026-03-26 09:05:20.671430 | debian-bookworm | +#-a always,exit -S ipc -F a0=4 -k Inter-Process_Communication 2026-03-26 09:05:20.671545 | debian-bookworm | +## Use these lines on x86_64, ia64 instead 2026-03-26 09:05:20.671671 | debian-bookworm | +-a always,exit -F arch=b64 -S semctl -k Inter-Process_Communication 2026-03-26 09:05:20.671785 | debian-bookworm | +-a always,exit -F arch=b64 -S semget -k Inter-Process_Communication 2026-03-26 09:05:20.671897 | debian-bookworm | +-a always,exit -F arch=b64 -S semop -k Inter-Process_Communication 2026-03-26 09:05:20.672032 | debian-bookworm | +-a always,exit -F arch=b64 -S semtimedop -k Inter-Process_Communication 2026-03-26 09:05:20.672139 | debian-bookworm | + 2026-03-26 09:05:20.672246 | debian-bookworm | +## shmctl 2026-03-26 09:05:20.672375 | debian-bookworm | +#-a always,exit -S ipc -F a0=24 -k Inter-Process_Communication 2026-03-26 09:05:20.672487 | debian-bookworm | +## shmget 2026-03-26 09:05:20.672599 | debian-bookworm | +#-a always,exit -S ipc -F a0=23 -k Inter-Process_Communication 2026-03-26 09:05:20.672711 | debian-bookworm | +## Use these lines on x86_64, ia64 instead 2026-03-26 09:05:20.672824 | debian-bookworm | +-a always,exit -F arch=b64 -S shmctl -k Inter-Process_Communication 2026-03-26 09:05:20.672935 | debian-bookworm | +-a always,exit -F arch=b64 -S shmget -k Inter-Process_Communication 2026-03-26 09:05:20.673041 | debian-bookworm | + 2026-03-26 09:05:20.673154 | debian-bookworm | +# High Volume Events ---------------------------------------------------------- 2026-03-26 09:05:20.673261 | debian-bookworm | + 2026-03-26 09:05:20.673395 | debian-bookworm | +## Disable these rules if they create too many events in your environment 2026-03-26 09:05:20.673507 | debian-bookworm | + 2026-03-26 09:05:20.673623 | debian-bookworm | +## Common Shells 2026-03-26 09:05:20.673736 | debian-bookworm | +-w /bin/bash -p x -k susp_shell 2026-03-26 09:05:20.673852 | debian-bookworm | +-w /bin/dash -p x -k susp_shell 2026-03-26 09:05:20.673967 | debian-bookworm | +-w /bin/busybox -p x -k susp_shell 2026-03-26 09:05:20.674081 | debian-bookworm | +-w /bin/zsh -p x -k susp_shell 2026-03-26 09:05:20.674193 | debian-bookworm | +-w /bin/sh -p x -k susp_shell 2026-03-26 09:05:20.674306 | debian-bookworm | +-w /bin/ksh -p x -k susp_shell 2026-03-26 09:05:20.674460 | debian-bookworm | + 2026-03-26 09:05:20.674581 | debian-bookworm | +## Root command executions 2026-03-26 09:05:20.674699 | debian-bookworm | +-a always,exit -F arch=b64 -F euid=0 -F auid>=1000 -F auid!=-1 -S execve -k rootcmd 2026-03-26 09:05:20.674809 | debian-bookworm | + 2026-03-26 09:05:20.674929 | debian-bookworm | +## File Deletion Events by User 2026-03-26 09:05:20.675047 | debian-bookworm | +-a always,exit -F arch=b64 -S rmdir -S unlink -S unlinkat -S rename -S renameat -F auid>=1000 -F auid!=-1 -k delete 2026-03-26 09:05:20.675154 | debian-bookworm | + 2026-03-26 09:05:20.675263 | debian-bookworm | +## File Access 2026-03-26 09:05:20.675392 | debian-bookworm | +### Unauthorized Access (unsuccessful) 2026-03-26 09:05:20.675592 | debian-bookworm | +-a always,exit -F arch=b64 -S creat -S open -S openat -S open_by_handle_at -S truncate -S ftruncate -F exit=-EACCES -F auid>=1000 -F auid!=-1 -k file_access 2026-03-26 09:05:20.675714 | debian-bookworm | +-a always,exit -F arch=b64 -S creat -S open -S openat -S open_by_handle_at -S truncate -S ftruncate -F exit=-EPERM -F auid>=1000 -F auid!=-1 -k file_access 2026-03-26 09:05:20.675822 | debian-bookworm | + 2026-03-26 09:05:20.675962 | debian-bookworm | +### Unsuccessful Creation 2026-03-26 09:05:20.676080 | debian-bookworm | +-a always,exit -F arch=b64 -S mkdir,creat,link,symlink,mknod,mknodat,linkat,symlinkat -F exit=-EACCES -k file_creation 2026-03-26 09:05:20.676193 | debian-bookworm | +-a always,exit -F arch=b64 -S mkdir,link,symlink,mkdirat -F exit=-EPERM -k file_creation 2026-03-26 09:05:20.676302 | debian-bookworm | + 2026-03-26 09:05:20.676430 | debian-bookworm | +### Unsuccessful Modification 2026-03-26 09:05:20.676545 | debian-bookworm | +-a always,exit -F arch=b64 -S rename -S renameat -S truncate -S chmod -S setxattr -S lsetxattr -S removexattr -S lremovexattr -F exit=-EACCES -k file_modification 2026-03-26 09:05:20.676660 | debian-bookworm | +-a always,exit -F arch=b64 -S rename -S renameat -S truncate -S chmod -S setxattr -S lsetxattr -S removexattr -S lremovexattr -F exit=-EPERM -k file_modification 2026-03-26 09:05:20.676768 | debian-bookworm | + 2026-03-26 09:05:20.676879 | debian-bookworm | +## 32bit API Exploitation 2026-03-26 09:05:20.676993 | debian-bookworm | +### If you are on a 64 bit platform, everything _should_ be running 2026-03-26 09:05:20.677105 | debian-bookworm | +### in 64 bit mode. This rule will detect any use of the 32 bit syscalls 2026-03-26 09:05:20.677215 | debian-bookworm | +### because this might be a sign of someone exploiting a hole in the 32 2026-03-26 09:05:20.677356 | debian-bookworm | +### bit API. 2026-03-26 09:05:20.677479 | debian-bookworm | +-a always,exit -F arch=b32 -S all -k 32bit_api 2026-03-26 09:05:20.677587 | debian-bookworm | + 2026-03-26 09:05:20.677699 | debian-bookworm | +# Make The Configuration Immutable -------------------------------------------- 2026-03-26 09:05:20.677823 | debian-bookworm | + 2026-03-26 09:05:20.677932 | debian-bookworm | +##-e 2 2026-03-26 09:05:20.678037 | debian-bookworm | 2026-03-26 09:05:20.678315 | debian-bookworm | changed: [molecule-auditd] => (item=20-neo23x0.rules) => {"ansible_loop_var": "item", "changed": true, "checksum": "9f99ce5c4f891fbf3e2bce06ed4cb97fb9e01f41", "dest": "/etc/audit/rules.d/20-neo23x0.rules", "gid": 0, "group": "root", "item": "20-neo23x0.rules", "md5sum": "6ac57206fd77de34805c3f4d50ef8b1d", "mode": "0644", "owner": "root", "size": 27367, "src": "/home/zuul/.ansible/tmp/ansible-tmp-1774515919.6586142-2488-277077782859521/.source.rules", "state": "file", "uid": 0} 2026-03-26 09:05:20.678449 | debian-bookworm | 2026-03-26 09:05:20.678568 | debian-bookworm | TASK [auditd : Manage auditd service] ****************************************** 2026-03-26 09:05:20.936283 | ubuntu-noble | The following NEW packages will be installed: 2026-03-26 09:05:20.936354 | ubuntu-noble | audispd-plugins 2026-03-26 09:05:20.936361 | ubuntu-noble | 0 upgraded, 1 newly installed, 0 to remove and 0 not upgraded. 2026-03-26 09:05:20.936370 | ubuntu-noble | changed: [molecule-auditd] => {"cache_update_time": 1774515813, "cache_updated": false, "changed": true, "stderr": "debconf: delaying package configuration, since apt-utils is not installed\n", "stderr_lines": ["debconf: delaying package configuration, since apt-utils is not installed"], "stdout": "Reading package lists...\nBuilding dependency tree...\nReading state information...\nThe following NEW packages will be installed:\n audispd-plugins\n0 upgraded, 1 newly installed, 0 to remove and 0 not upgraded.\nNeed to get 38.8 kB of archives.\nAfter this operation, 131 kB of additional disk space will be used.\nGet:1 http://archive.ubuntu.com/ubuntu noble-updates/universe amd64 audispd-plugins amd64 1:3.1.2-2.1build1.1 [38.8 kB]\nFetched 38.8 kB in 1s (58.0 kB/s)\nSelecting previously unselected package audispd-plugins.\r\n(Reading database ... \r(Reading database ... 5%\r(Reading database ... 10%\r(Reading database ... 15%\r(Reading database ... 20%\r(Reading database ... 25%\r(Reading database ... 30%\r(Reading database ... 35%\r(Reading database ... 40%\r(Reading database ... 45%\r(Reading database ... 50%\r(Reading database ... 55%\r(Reading database ... 60%\r(Reading database ... 65%\r(Reading database ... 70%\r(Reading database ... 75%\r(Reading database ... 80%\r(Reading database ... 85%\r(Reading database ... 90%\r(Reading database ... 95%\r(Reading database ... 100%\r(Reading database ... 35533 files and directories currently installed.)\r\nPreparing to unpack .../audispd-plugins_1%3a3.1.2-2.1build1.1_amd64.deb ...\r\nUnpacking audispd-plugins (1:3.1.2-2.1build1.1) ...\r\nSetting up audispd-plugins (1:3.1.2-2.1build1.1) ...\r\n", "stdout_lines": ["Reading package lists...", "Building dependency tree...", "Reading state information...", "The following NEW packages will be installed:", " audispd-plugins", "0 upgraded, 1 newly installed, 0 to remove and 0 not upgraded.", "Need to get 38.8 kB of archives.", "After this operation, 131 kB of additional disk space will be used.", "Get:1 http://archive.ubuntu.com/ubuntu noble-updates/universe amd64 audispd-plugins amd64 1:3.1.2-2.1build1.1 [38.8 kB]", "Fetched 38.8 kB in 1s (58.0 kB/s)", "Selecting previously unselected package audispd-plugins.", "(Reading database ... ", "(Reading database ... 5%", "(Reading database ... 10%", "(Reading database ... 15%", "(Reading database ... 20%", "(Reading database ... 25%", "(Reading database ... 30%", "(Reading database ... 35%", "(Reading database ... 40%", "(Reading database ... 45%", "(Reading database ... 50%", "(Reading database ... 55%", "(Reading database ... 60%", "(Reading database ... 65%", "(Reading database ... 70%", "(Reading database ... 75%", "(Reading database ... 80%", "(Reading database ... 85%", "(Reading database ... 90%", "(Reading database ... 95%", "(Reading database ... 100%", "(Reading database ... 35533 files and directories currently installed.)", "Preparing to unpack .../audispd-plugins_1%3a3.1.2-2.1build1.1_amd64.deb ...", "Unpacking audispd-plugins (1:3.1.2-2.1build1.1) ...", "Setting up audispd-plugins (1:3.1.2-2.1build1.1) ..."]} 2026-03-26 09:05:20.936398 | ubuntu-noble | 2026-03-26 09:05:20.936403 | ubuntu-noble | TASK [auditd : Copy auditd.conf configuration files] *************************** 2026-03-26 09:05:21.527628 | debian-bookworm | ok: [molecule-auditd] => {"changed": false, "enabled": true, "name": "auditd", "state": "started", "status": {"ActiveEnterTimestamp": "Thu 2026-03-26 09:05:13 UTC", "ActiveEnterTimestampMonotonic": "150209014", "ActiveExitTimestampMonotonic": "0", "ActiveState": "active", "After": "system.slice local-fs.target systemd-journald.socket systemd-tmpfiles-setup.service", "AllowIsolate": "no", "AssertResult": "yes", "AssertTimestamp": "Thu 2026-03-26 09:05:13 UTC", "AssertTimestampMonotonic": "150135211", "Before": "sysinit.target ssh.service shutdown.target systemd-update-utmp.service", "BlockIOAccounting": "no", "BlockIOWeight": "[not set]", "CPUAccounting": "yes", "CPUAffinityFromNUMA": "no", "CPUQuotaPerSecUSec": "infinity", "CPUQuotaPeriodUSec": "infinity", "CPUSchedulingPolicy": "0", "CPUSchedulingPriority": "0", "CPUSchedulingResetOnFork": "no", "CPUShares": "[not set]", "CPUUsageNSec": "55696000", "CPUWeight": "[not set]", "CacheDirectoryMode": "0755", "CanFreeze": "yes", "CanIsolate": "no", "CanReload": "no", "CanStart": "yes", "CanStop": "yes", "CapabilityBoundingSet": "cap_chown cap_dac_override cap_dac_read_search cap_fowner cap_fsetid cap_kill cap_setgid cap_setuid cap_setpcap cap_linux_immutable cap_net_bind_service cap_net_broadcast cap_net_admin cap_net_raw cap_ipc_lock cap_ipc_owner cap_sys_rawio cap_sys_chroot cap_sys_ptrace cap_sys_pacct cap_sys_admin cap_sys_boot cap_sys_nice cap_sys_resource cap_sys_time cap_sys_tty_config cap_mknod cap_lease cap_audit_write cap_audit_control cap_setfcap cap_mac_override cap_mac_admin cap_syslog cap_wake_alarm cap_block_suspend cap_audit_read cap_perfmon cap_bpf cap_checkpoint_restore", "CleanResult": "success", "CollectMode": "inactive", "ConditionResult": "yes", "ConditionTimestamp": "Thu 2026-03-26 09:05:13 UTC", "ConditionTimestampMonotonic": "150135171", "ConfigurationDirectoryMode": "0755", "Conflicts": "shutdown.target", "ControlGroup": "/system.slice/auditd.service", "ControlGroupId": "3211", "ControlPID": "0", "CoredumpFilter": "0x33", "DefaultDependencies": "no", "DefaultMemoryLow": "0", "DefaultMemoryMin": "0", "Delegate": "no", "Description": "Security Auditing Service", "DevicePolicy": "auto", "Documentation": "\"man:auditd(8)\" https://github.com/linux-audit/audit-documentation", "DynamicUser": "no", "ExecMainCode": "0", "ExecMainExitTimestampMonotonic": "0", "ExecMainPID": "2260", "ExecMainStartTimestamp": "Thu 2026-03-26 09:05:13 UTC", "ExecMainStartTimestampMonotonic": "150174264", "ExecMainStatus": "0", "ExecStart": "{ path=/sbin/auditd ; argv[]=/sbin/auditd ; ignore_errors=no ; start_time=[Thu 2026-03-26 09:05:13 UTC] ; stop_time=[Thu 2026-03-26 09:05:13 UTC] ; pid=2259 ; code=exited ; status=0 }", "ExecStartEx": "{ path=/sbin/auditd ; argv[]=/sbin/auditd ; flags= ; start_time=[Thu 2026-03-26 09:05:13 UTC] ; stop_time=[Thu 2026-03-26 09:05:13 UTC] ; pid=2259 ; code=exited ; status=0 }", "ExecStartPost": "{ path=/sbin/augenrules ; argv[]=/sbin/augenrules --load ; ignore_errors=yes ; start_time=[Thu 2026-03-26 09:05:13 UTC] ; stop_time=[Thu 2026-03-26 09:05:13 UTC] ; pid=2263 ; code=exited ; status=0 }", "ExecStartPostEx": "{ path=/sbin/augenrules ; argv[]=/sbin/augenrules --load ; flags=ignore-failure ; start_time=[Thu 2026-03-26 09:05:13 UTC] ; stop_time=[Thu 2026-03-26 09:05:13 UTC] ; pid=2263 ; code=exited ; status=0 }", "ExitType": "main", "FailureAction": "none", "FileDescriptorStoreMax": "0", "FinalKillSignal": "9", "FragmentPath": "/lib/systemd/system/auditd.service", "FreezerState": "running", "GID": "[not set]", "GuessMainPID": "yes", "IOAccounting": "no", "IOReadBytes": "18446744073709551615", "IOReadOperations": "18446744073709551615", "IOSchedulingClass": "2", "IOSchedulingPriority": "4", "IOWeight": "[not set]", "IOWriteBytes": "18446744073709551615", "IOWriteOperations": "18446744073709551615", "IPAccounting": "no", "IPEgressBytes": "[no data]", "IPEgressPackets": "[no data]", "IPIngressBytes": "[no data]", "IPIngressPackets": "[no data]", "Id": "auditd.service", "IgnoreOnIsolate": "no", "IgnoreSIGPIPE": "yes", "InactiveEnterTimestampMonotonic": "0", "InactiveExitTimestamp": "Thu 2026-03-26 09:05:13 UTC", "InactiveExitTimestampMonotonic": "150157798", "InvocationID": "6345111b0c1f42f5bd035e9c69aaa037", "JobRunningTimeoutUSec": "infinity", "JobTimeoutAction": "none", "JobTimeoutUSec": "infinity", "KeyringMode": "private", "KillMode": "control-group", "KillSignal": "15", "LimitAS": "infinity", "LimitASSoft": "infinity", "LimitCORE": "infinity", "LimitCORESoft": "0", "LimitCPU": "infinity", "LimitCPUSoft": "infinity", "LimitDATA": "infinity", "LimitDATASoft": "infinity", "LimitFSIZE": "infinity", "LimitFSIZESoft": "infinity", "LimitLOCKS": "infinity", "LimitLOCKSSoft": "infinity", "LimitMEMLOCK": "8388608", "LimitMEMLOCKSoft": "8388608", "LimitMSGQUEUE": "819200", "LimitMSGQUEUESoft": "819200", "LimitNICE": "0", "LimitNICESoft": "0", "LimitNOFILE": "524288", "LimitNOFILESoft": "1024", "LimitNPROC": "15480", "LimitNPROCSoft": "15480", "LimitRSS": "infinity", "LimitRSSSoft": "infinity", "LimitRTPRIO": "0", "LimitRTPRIOSoft": "0", "LimitRTTIME": "infinity", "LimitRTTIMESoft": "infinity", "LimitSIGPENDING": "15480", "LimitSIGPENDINGSoft": "15480", "LimitSTACK": "infinity", "LimitSTACKSoft": "8388608", "LoadState": "loaded", "LockPersonality": "yes", "LogLevelMax": "-1", "LogRateLimitBurst": "0", "LogRateLimitIntervalUSec": "0", "LogsDirectoryMode": "0755", "MainPID": "2260", "ManagedOOMMemoryPressure": "auto", "ManagedOOMMemoryPressureLimit": "0", "ManagedOOMPreference": "none", "ManagedOOMSwap": "auto", "MemoryAccounting": "yes", "MemoryAvailable": "infinity", "MemoryCurrent": "720896", "MemoryDenyWriteExecute": "yes", "MemoryHigh": "infinity", "MemoryLimit": "infinity", "MemoryLow": "0", "MemoryMax": "infinity", "MemoryMin": "0", "MemorySwapMax": "infinity", "MountAPIVFS": "no", "NFileDescriptorStore": "0", "NRestarts": "0", "NUMAPolicy": "n/a", "Names": "auditd.service", "NeedDaemonReload": "no", "Nice": "0", "NoNewPrivileges": "no", "NonBlocking": "no", "NotifyAccess": "none", "OOMPolicy": "stop", "OOMScoreAdjust": "0", "OnFailureJobMode": "replace", "OnSuccessJobMode": "fail", "PIDFile": "/run/auditd.pid", "Perpetual": "no", "PrivateDevices": "no", "PrivateIPC": "no", "PrivateMounts": "no", "PrivateNetwork": "no", "PrivateTmp": "no", "PrivateUsers": "no", "ProcSubset": "all", "ProtectClock": "no", "ProtectControlGroups": "yes", "ProtectHome": "no", "ProtectHostname": "no", "ProtectKernelLogs": "no", "ProtectKernelModules": "yes", "ProtectKernelTunables": "no", "ProtectProc": "default", "ProtectSystem": "no", "RefuseManualStart": "no", "RefuseManualStop": "no", "ReloadResult": "success", "RemainAfterExit": "no", "RemoveIPC": "no", "Requires": "system.slice", "Restart": "on-failure", "RestartKillSignal": "15", "RestartPreventExitStatus": "2 4 6", "RestartUSec": "100ms", "RestrictNamespaces": "no", "RestrictRealtime": "yes", "RestrictSUIDSGID": "no", "Result": "success", "RootDirectoryStartOnly": "no", "RuntimeDirectoryMode": "0755", "RuntimeDirectoryPreserve": "no", "RuntimeMaxUSec": "infinity", "RuntimeRandomizedExtraUSec": "0", "SameProcessGroup": "no", "SecureBits": "0", "SendSIGHUP": "no", "SendSIGKILL": "yes", "Slice": "system.slice", "StandardError": "inherit", "StandardInput": "null", "StandardOutput": "journal", "StartLimitAction": "none", "StartLimitBurst": "5", "StartLimitIntervalUSec": "10s", "StartupBlockIOWeight": "[not set]", "StartupCPUShares": "[not set]", "StartupCPUWeight": "[not set]", "StartupIOWeight": "[not set]", "StateChangeTimestamp": "Thu 2026-03-26 09:05:13 UTC", "StateChangeTimestampMonotonic": "150209014", "StateDirectoryMode": "0755", "StatusErrno": "0", "StopWhenUnneeded": "no", "SubState": "running", "SuccessAction": "none", "SyslogFacility": "3", "SyslogLevel": "6", "SyslogLevelPrefix": "yes", "SyslogPriority": "30", "SystemCallErrorNumber": "2147483646", "TTYReset": "no", "TTYVHangup": "no", "TTYVTDisallocate": "no", "TasksAccounting": "yes", "TasksCurrent": "2", "TasksMax": "4644", "TimeoutAbortUSec": "1min 30s", "TimeoutCleanUSec": "infinity", "TimeoutStartFailureMode": "terminate", "TimeoutStartUSec": "1min 30s", "TimeoutStopFailureMode": "terminate", "TimeoutStopUSec": "1min 30s", "TimerSlackNSec": "50000", "Transient": "no", "Type": "forking", "UID": "[not set]", "UMask": "0022", "UnitFilePreset": "enabled", "UnitFileState": "enabled", "UtmpMode": "init", "WantedBy": "multi-user.target", "WatchdogSignal": "6", "WatchdogTimestampMonotonic": "0", "WatchdogUSec": "0"}} 2026-03-26 09:05:21.536571 | debian-bookworm | 2026-03-26 09:05:21.536668 | debian-bookworm | TASK [auditd : List existing rules files] ************************************** 2026-03-26 09:05:22.012800 | debian-bookworm | ok: [molecule-auditd] => {"changed": false, "cmd": ["find", "/etc/audit/rules.d", "-type", "f", "-printf", "%f\n"], "delta": "0:00:00.010014", "end": "2026-03-26 09:05:21.944256", "msg": "", "rc": 0, "start": "2026-03-26 09:05:21.934242", "stderr": "", "stderr_lines": [], "stdout": "audit.rules\n20-neo23x0.rules", "stdout_lines": ["audit.rules", "20-neo23x0.rules"]} 2026-03-26 09:05:22.012898 | debian-bookworm | 2026-03-26 09:05:22.012915 | debian-bookworm | TASK [auditd : Remove unmanaged rules files] *********************************** 2026-03-26 09:05:22.359194 | ubuntu-noble | --- before 2026-03-26 09:05:22.359313 | ubuntu-noble | +++ after: /home/zuul/.ansible/tmp/ansible-local-1906397nx_qm/tmpybzfdkw1/auditd.conf.j2 2026-03-26 09:05:22.359325 | ubuntu-noble | @@ -0,0 +1,37 @@ 2026-03-26 09:05:22.359332 | ubuntu-noble | +# 2026-03-26 09:05:22.359443 | ubuntu-noble | +# This file controls the configuration of the audit daemon 2026-03-26 09:05:22.359700 | ubuntu-noble | +# 2026-03-26 09:05:22.359935 | ubuntu-noble | + 2026-03-26 09:05:22.360245 | ubuntu-noble | +local_events = yes 2026-03-26 09:05:22.360498 | ubuntu-noble | +write_logs = yes 2026-03-26 09:05:22.360746 | ubuntu-noble | +log_file = /var/log/audit/audit.log 2026-03-26 09:05:22.360986 | ubuntu-noble | +log_group = adm 2026-03-26 09:05:22.361335 | ubuntu-noble | +log_format = RAW 2026-03-26 09:05:22.361604 | ubuntu-noble | +flush = INCREMENTAL_ASYNC 2026-03-26 09:05:22.361923 | ubuntu-noble | +freq = 50 2026-03-26 09:05:22.362276 | ubuntu-noble | +max_log_file = 8 2026-03-26 09:05:22.362606 | ubuntu-noble | +num_logs = 5 2026-03-26 09:05:22.362872 | ubuntu-noble | +priority_boost = 4 2026-03-26 09:05:22.363171 | ubuntu-noble | +disp_qos = lossy 2026-03-26 09:05:22.365096 | ubuntu-noble | +dispatcher = /sbin/audispd 2026-03-26 09:05:22.365122 | ubuntu-noble | +name_format = NONE 2026-03-26 09:05:22.365129 | ubuntu-noble | +##name = mydomain 2026-03-26 09:05:22.365136 | ubuntu-noble | +max_log_file_action = ROTATE 2026-03-26 09:05:22.365143 | ubuntu-noble | +space_left = 12361 2026-03-26 09:05:22.365150 | ubuntu-noble | +space_left_action = email 2026-03-26 09:05:22.365157 | ubuntu-noble | +verify_email = yes 2026-03-26 09:05:22.365164 | ubuntu-noble | +action_mail_acct = root 2026-03-26 09:05:22.365266 | ubuntu-noble | +admin_space_left = 50 2026-03-26 09:05:22.365517 | ubuntu-noble | +admin_space_left_action = SUSPEND 2026-03-26 09:05:22.365753 | ubuntu-noble | +disk_full_action = SUSPEND 2026-03-26 09:05:22.365987 | ubuntu-noble | +disk_error_action = SUSPEND 2026-03-26 09:05:22.366410 | ubuntu-noble | +use_libwrap = yes 2026-03-26 09:05:22.366670 | ubuntu-noble | +##tcp_listen_port = 60 2026-03-26 09:05:22.366875 | ubuntu-noble | +tcp_listen_queue = 5 2026-03-26 09:05:22.367094 | ubuntu-noble | +tcp_max_per_addr = 1 2026-03-26 09:05:22.367331 | ubuntu-noble | +##tcp_client_ports = 1024-65535 2026-03-26 09:05:22.367529 | ubuntu-noble | +tcp_client_max_idle = 0 2026-03-26 09:05:22.367725 | ubuntu-noble | +enable_krb5 = no 2026-03-26 09:05:22.367918 | ubuntu-noble | +krb5_principal = auditd 2026-03-26 09:05:22.368145 | ubuntu-noble | +##krb5_key_file = /etc/audit/audit.key 2026-03-26 09:05:22.368404 | ubuntu-noble | +distribute_network = no 2026-03-26 09:05:22.368592 | ubuntu-noble | 2026-03-26 09:05:22.368863 | ubuntu-noble | changed: [molecule-auditd] => {"changed": true, "checksum": "e902cc6bebf86c17087d153e359a2cc1231672e0", "dest": "/etc/audit/audit.conf", "gid": 0, "group": "root", "md5sum": "69dfd768317bae876a6a78c8aeb5cce1", "mode": "0640", "owner": "root", "size": 806, "src": "/home/zuul/.ansible/tmp/ansible-tmp-1774515920.955757-2307-54715315262233/.source.conf", "state": "file", "uid": 0} 2026-03-26 09:05:22.369055 | ubuntu-noble | 2026-03-26 09:05:22.369326 | ubuntu-noble | TASK [auditd : Adjust auditd/audispd configurations] *************************** 2026-03-26 09:05:22.394586 | debian-bookworm | --- before 2026-03-26 09:05:22.394636 | debian-bookworm | +++ after 2026-03-26 09:05:22.394642 | debian-bookworm | @@ -1,4 +1,4 @@ 2026-03-26 09:05:22.394648 | debian-bookworm | { 2026-03-26 09:05:22.394653 | debian-bookworm | "path": "/etc/audit/rules.d/audit.rules", 2026-03-26 09:05:22.394659 | debian-bookworm | - "state": "file" 2026-03-26 09:05:22.394664 | debian-bookworm | + "state": "absent" 2026-03-26 09:05:22.394668 | debian-bookworm | } 2026-03-26 09:05:22.394672 | debian-bookworm | 2026-03-26 09:05:22.394678 | debian-bookworm | changed: [molecule-auditd] => (item=audit.rules) => {"ansible_loop_var": "item", "changed": true, "item": "audit.rules", "path": "/etc/audit/rules.d/audit.rules", "state": "absent"} 2026-03-26 09:05:22.394686 | debian-bookworm | skipping: [molecule-auditd] => (item=20-neo23x0.rules) => {"ansible_loop_var": "item", "changed": false, "false_condition": "item not in auditd_rules_files", "item": "20-neo23x0.rules", "skip_reason": "Conditional result was False"} 2026-03-26 09:05:22.394698 | debian-bookworm | 2026-03-26 09:05:22.394703 | debian-bookworm | RUNNING HANDLER [auditd : Restart auditd service] ****************************** 2026-03-26 09:05:22.898906 | ubuntu-noble | ok: [molecule-auditd] => (item={'parameter': 'active', 'value': 'no', 'config': '/etc/audit/plugins.d/syslog.conf'}) => {"ansible_loop_var": "item", "backup": "", "changed": false, "item": {"config": "/etc/audit/plugins.d/syslog.conf", "parameter": "active", "value": "no"}, "msg": ""} 2026-03-26 09:05:22.900698 | ubuntu-noble | 2026-03-26 09:05:22.900970 | ubuntu-noble | TASK [auditd : Deploy rules for auditd] **************************************** 2026-03-26 09:05:23.168578 | debian-bookworm | changed: [molecule-auditd] => {"changed": true, "name": "auditd", "state": "started", "status": {"ActiveEnterTimestamp": "Thu 2026-03-26 09:05:13 UTC", "ActiveEnterTimestampMonotonic": "150209014", "ActiveExitTimestampMonotonic": "0", "ActiveState": "active", "After": "system.slice local-fs.target systemd-journald.socket systemd-tmpfiles-setup.service", "AllowIsolate": "no", "AssertResult": "yes", "AssertTimestamp": "Thu 2026-03-26 09:05:13 UTC", "AssertTimestampMonotonic": "150135211", "Before": "sysinit.target ssh.service shutdown.target systemd-update-utmp.service", "BlockIOAccounting": "no", "BlockIOWeight": "[not set]", "CPUAccounting": "yes", "CPUAffinityFromNUMA": "no", "CPUQuotaPerSecUSec": "infinity", "CPUQuotaPeriodUSec": "infinity", "CPUSchedulingPolicy": "0", "CPUSchedulingPriority": "0", "CPUSchedulingResetOnFork": "no", "CPUShares": "[not set]", "CPUUsageNSec": "56928000", "CPUWeight": "[not set]", "CacheDirectoryMode": "0755", "CanFreeze": "yes", "CanIsolate": "no", "CanReload": "no", "CanStart": "yes", "CanStop": "yes", "CapabilityBoundingSet": "cap_chown cap_dac_override cap_dac_read_search cap_fowner cap_fsetid cap_kill cap_setgid cap_setuid cap_setpcap cap_linux_immutable cap_net_bind_service cap_net_broadcast cap_net_admin cap_net_raw cap_ipc_lock cap_ipc_owner cap_sys_rawio cap_sys_chroot cap_sys_ptrace cap_sys_pacct cap_sys_admin cap_sys_boot cap_sys_nice cap_sys_resource cap_sys_time cap_sys_tty_config cap_mknod cap_lease cap_audit_write cap_audit_control cap_setfcap cap_mac_override cap_mac_admin cap_syslog cap_wake_alarm cap_block_suspend cap_audit_read cap_perfmon cap_bpf cap_checkpoint_restore", "CleanResult": "success", "CollectMode": "inactive", "ConditionResult": "yes", "ConditionTimestamp": "Thu 2026-03-26 09:05:13 UTC", "ConditionTimestampMonotonic": "150135171", "ConfigurationDirectoryMode": "0755", "Conflicts": "shutdown.target", "ControlGroup": "/system.slice/auditd.service", "ControlGroupId": "3211", "ControlPID": "0", "CoredumpFilter": "0x33", "DefaultDependencies": "no", "DefaultMemoryLow": "0", "DefaultMemoryMin": "0", "Delegate": "no", "Description": "Security Auditing Service", "DevicePolicy": "auto", "Documentation": "\"man:auditd(8)\" https://github.com/linux-audit/audit-documentation", "DynamicUser": "no", "ExecMainCode": "0", "ExecMainExitTimestampMonotonic": "0", "ExecMainPID": "2260", "ExecMainStartTimestamp": "Thu 2026-03-26 09:05:13 UTC", "ExecMainStartTimestampMonotonic": "150174264", "ExecMainStatus": "0", "ExecStart": "{ path=/sbin/auditd ; argv[]=/sbin/auditd ; ignore_errors=no ; start_time=[Thu 2026-03-26 09:05:13 UTC] ; stop_time=[Thu 2026-03-26 09:05:13 UTC] ; pid=2259 ; code=exited ; status=0 }", "ExecStartEx": "{ path=/sbin/auditd ; argv[]=/sbin/auditd ; flags= ; start_time=[Thu 2026-03-26 09:05:13 UTC] ; stop_time=[Thu 2026-03-26 09:05:13 UTC] ; pid=2259 ; code=exited ; status=0 }", "ExecStartPost": "{ path=/sbin/augenrules ; argv[]=/sbin/augenrules --load ; ignore_errors=yes ; start_time=[Thu 2026-03-26 09:05:13 UTC] ; stop_time=[Thu 2026-03-26 09:05:13 UTC] ; pid=2263 ; code=exited ; status=0 }", "ExecStartPostEx": "{ path=/sbin/augenrules ; argv[]=/sbin/augenrules --load ; flags=ignore-failure ; start_time=[Thu 2026-03-26 09:05:13 UTC] ; stop_time=[Thu 2026-03-26 09:05:13 UTC] ; pid=2263 ; code=exited ; status=0 }", "ExitType": "main", "FailureAction": "none", "FileDescriptorStoreMax": "0", "FinalKillSignal": "9", "FragmentPath": "/lib/systemd/system/auditd.service", "FreezerState": "running", "GID": "[not set]", "GuessMainPID": "yes", "IOAccounting": "no", "IOReadBytes": "18446744073709551615", "IOReadOperations": "18446744073709551615", "IOSchedulingClass": "2", "IOSchedulingPriority": "4", "IOWeight": "[not set]", "IOWriteBytes": "18446744073709551615", "IOWriteOperations": "18446744073709551615", "IPAccounting": "no", "IPEgressBytes": "[no data]", "IPEgressPackets": "[no data]", "IPIngressBytes": "[no data]", "IPIngressPackets": "[no data]", "Id": "auditd.service", "IgnoreOnIsolate": "no", "IgnoreSIGPIPE": "yes", "InactiveEnterTimestampMonotonic": "0", "InactiveExitTimestamp": "Thu 2026-03-26 09:05:13 UTC", "InactiveExitTimestampMonotonic": "150157798", "InvocationID": "6345111b0c1f42f5bd035e9c69aaa037", "JobRunningTimeoutUSec": "infinity", "JobTimeoutAction": "none", "JobTimeoutUSec": "infinity", "KeyringMode": "private", "KillMode": "control-group", "KillSignal": "15", "LimitAS": "infinity", "LimitASSoft": "infinity", "LimitCORE": "infinity", "LimitCORESoft": "0", "LimitCPU": "infinity", "LimitCPUSoft": "infinity", "LimitDATA": "infinity", "LimitDATASoft": "infinity", "LimitFSIZE": "infinity", "LimitFSIZESoft": "infinity", "LimitLOCKS": "infinity", "LimitLOCKSSoft": "infinity", "LimitMEMLOCK": "8388608", "LimitMEMLOCKSoft": "8388608", "LimitMSGQUEUE": "819200", "LimitMSGQUEUESoft": "819200", "LimitNICE": "0", "LimitNICESoft": "0", "LimitNOFILE": "524288", "LimitNOFILESoft": "1024", "LimitNPROC": "15480", "LimitNPROCSoft": "15480", "LimitRSS": "infinity", "LimitRSSSoft": "infinity", "LimitRTPRIO": "0", "LimitRTPRIOSoft": "0", "LimitRTTIME": "infinity", "LimitRTTIMESoft": "infinity", "LimitSIGPENDING": "15480", "LimitSIGPENDINGSoft": "15480", "LimitSTACK": "infinity", "LimitSTACKSoft": "8388608", "LoadState": "loaded", "LockPersonality": "yes", "LogLevelMax": "-1", "LogRateLimitBurst": "0", "LogRateLimitIntervalUSec": "0", "LogsDirectoryMode": "0755", "MainPID": "2260", "ManagedOOMMemoryPressure": "auto", "ManagedOOMMemoryPressureLimit": "0", "ManagedOOMPreference": "none", "ManagedOOMSwap": "auto", "MemoryAccounting": "yes", "MemoryAvailable": "infinity", "MemoryCurrent": "729088", "MemoryDenyWriteExecute": "yes", "MemoryHigh": "infinity", "MemoryLimit": "infinity", "MemoryLow": "0", "MemoryMax": "infinity", "MemoryMin": "0", "MemorySwapMax": "infinity", "MountAPIVFS": "no", "NFileDescriptorStore": "0", "NRestarts": "0", "NUMAPolicy": "n/a", "Names": "auditd.service", "NeedDaemonReload": "no", "Nice": "0", "NoNewPrivileges": "no", "NonBlocking": "no", "NotifyAccess": "none", "OOMPolicy": "stop", "OOMScoreAdjust": "0", "OnFailureJobMode": "replace", "OnSuccessJobMode": "fail", "PIDFile": "/run/auditd.pid", "Perpetual": "no", "PrivateDevices": "no", "PrivateIPC": "no", "PrivateMounts": "no", "PrivateNetwork": "no", "PrivateTmp": "no", "PrivateUsers": "no", "ProcSubset": "all", "ProtectClock": "no", "ProtectControlGroups": "yes", "ProtectHome": "no", "ProtectHostname": "no", "ProtectKernelLogs": "no", "ProtectKernelModules": "yes", "ProtectKernelTunables": "no", "ProtectProc": "default", "ProtectSystem": "no", "RefuseManualStart": "no", "RefuseManualStop": "no", "ReloadResult": "success", "RemainAfterExit": "no", "RemoveIPC": "no", "Requires": "system.slice", "Restart": "on-failure", "RestartKillSignal": "15", "RestartPreventExitStatus": "2 4 6", "RestartUSec": "100ms", "RestrictNamespaces": "no", "RestrictRealtime": "yes", "RestrictSUIDSGID": "no", "Result": "success", "RootDirectoryStartOnly": "no", "RuntimeDirectoryMode": "0755", "RuntimeDirectoryPreserve": "no", "RuntimeMaxUSec": "infinity", "RuntimeRandomizedExtraUSec": "0", "SameProcessGroup": "no", "SecureBits": "0", "SendSIGHUP": "no", "SendSIGKILL": "yes", "Slice": "system.slice", "StandardError": "inherit", "StandardInput": "null", "StandardOutput": "journal", "StartLimitAction": "none", "StartLimitBurst": "5", "StartLimitIntervalUSec": "10s", "StartupBlockIOWeight": "[not set]", "StartupCPUShares": "[not set]", "StartupCPUWeight": "[not set]", "StartupIOWeight": "[not set]", "StateChangeTimestamp": "Thu 2026-03-26 09:05:13 UTC", "StateChangeTimestampMonotonic": "150209014", "StateDirectoryMode": "0755", "StatusErrno": "0", "StopWhenUnneeded": "no", "SubState": "running", "SuccessAction": "none", "SyslogFacility": "3", "SyslogLevel": "6", "SyslogLevelPrefix": "yes", "SyslogPriority": "30", "SystemCallErrorNumber": "2147483646", "TTYReset": "no", "TTYVHangup": "no", "TTYVTDisallocate": "no", "TasksAccounting": "yes", "TasksCurrent": "2", "TasksMax": "4644", "TimeoutAbortUSec": "1min 30s", "TimeoutCleanUSec": "infinity", "TimeoutStartFailureMode": "terminate", "TimeoutStartUSec": "1min 30s", "TimeoutStopFailureMode": "terminate", "TimeoutStopUSec": "1min 30s", "TimerSlackNSec": "50000", "Transient": "no", "Type": "forking", "UID": "[not set]", "UMask": "0022", "UnitFilePreset": "enabled", "UnitFileState": "enabled", "UtmpMode": "init", "WantedBy": "multi-user.target", "WatchdogSignal": "6", "WatchdogTimestampMonotonic": "0", "WatchdogUSec": "0"}} 2026-03-26 09:05:23.174389 | debian-bookworm | 2026-03-26 09:05:23.174427 | debian-bookworm | RUNNING HANDLER [auditd : Generate auditd rules] ******************************* 2026-03-26 09:05:23.634803 | debian-bookworm | changed: [molecule-auditd] => {"changed": true, "cmd": ["augenrules", "--load"], "delta": "0:00:00.126232", "end": "2026-03-26 09:05:23.572288", "msg": "", "rc": 0, "start": "2026-03-26 09:05:23.446056", "stderr": "Unknown user: chrony\nThere was an error in line 24 of /etc/audit/audit.rules\nError sending add rule data request (No such file or directory)\nThere was an error in line 28 of /etc/audit/audit.rules\nUnknown user: ntp\nThere was an error in line 44 of /etc/audit/audit.rules\nError sending add rule data request (No such file or directory)\nThere was an error in line 83 of /etc/audit/audit.rules\nError sending add rule data request (No such file or directory)\nThere was an error in line 84 of /etc/audit/audit.rules\nError sending add rule data request (No such file or directory)\nThere was an error in line 112 of /etc/audit/audit.rules\nError sending add rule data request (No such file or directory)\nThere was an error in line 115 of /etc/audit/audit.rules\nError sending add rule data request (No such file or directory)\nThere was an error in line 176 of /etc/audit/audit.rules\nError sending add rule data request (No such file or directory)\nThere was an error in line 177 of /etc/audit/audit.rules\nError sending add rule data request (No such file or directory)\nThere was an error in line 178 of /etc/audit/audit.rules\nError sending add rule data request (No such file or directory)\nThere was an error in line 179 of /etc/audit/audit.rules\nError sending add rule data request (No such file or directory)\nThere was an error in line 180 of /etc/audit/audit.rules\nError sending add rule data request (No such file or directory)\nThere was an error in line 217 of /etc/audit/audit.rules\nError sending add rule data request (No such file or directory)\nThere was an error in line 218 of /etc/audit/audit.rules\nError sending add rule data request (No such file or directory)\nThere was an error in line 234 of /etc/audit/audit.rules\nError sending add rule data request (No such file or directory)\nThere was an error in line 285 of /etc/audit/audit.rules\nError sending add rule data request (No such file or directory)\nThere was an error in line 286 of /etc/audit/audit.rules\nError sending add rule data request (No such file or directory)\nThere was an error in line 324 of /etc/audit/audit.rules\nError sending add rule data request (No such file or directory)\nThere was an error in line 325 of /etc/audit/audit.rules\nError sending add rule data request (No such file or directory)\nThere was an error in line 346 of /etc/audit/audit.rules\nparameter passed without an option given\nThere was an error in line 347 of /etc/audit/audit.rules\nparameter passed without an option given\nThere was an error in line 348 of /etc/audit/audit.rules\nparameter passed without an option given\nThere was an error in line 349 of /etc/audit/audit.rules\nparameter passed without an option given\nThere was an error in line 350 of /etc/audit/audit.rules\nparameter passed without an option given\nThere was an error in line 351 of /etc/audit/audit.rules\nError sending add rule data request (No such file or directory)\nThere was an error in line 359 of /etc/audit/audit.rules", "stderr_lines": ["Unknown user: chrony", "There was an error in line 24 of /etc/audit/audit.rules", "Error sending add rule data request (No such file or directory)", "There was an error in line 28 of /etc/audit/audit.rules", "Unknown user: ntp", "There was an error in line 44 of /etc/audit/audit.rules", "Error sending add rule data request (No such file or directory)", "There was an error in line 83 of /etc/audit/audit.rules", "Error sending add rule data request (No such file or directory)", "There was an error in line 84 of /etc/audit/audit.rules", "Error sending add rule data request (No such file or directory)", "There was an error in line 112 of /etc/audit/audit.rules", "Error sending add rule data request (No such file or directory)", "There was an error in line 115 of /etc/audit/audit.rules", "Error sending add rule data request (No such file or directory)", "There was an error in line 176 of /etc/audit/audit.rules", "Error sending add rule data request (No such file or directory)", "There was an error in line 177 of /etc/audit/audit.rules", "Error sending add rule data request (No such file or directory)", "There was an error in line 178 of /etc/audit/audit.rules", "Error sending add rule data request (No such file or directory)", "There was an error in line 179 of /etc/audit/audit.rules", "Error sending add rule data request (No such file or directory)", "There was an error in line 180 of /etc/audit/audit.rules", "Error sending add rule data request (No such file or directory)", "There was an error in line 217 of /etc/audit/audit.rules", "Error sending add rule data request (No such file or directory)", "There was an error in line 218 of /etc/audit/audit.rules", "Error sending add rule data request (No such file or directory)", "There was an error in line 234 of /etc/audit/audit.rules", "Error sending add rule data request (No such file or directory)", "There was an error in line 285 of /etc/audit/audit.rules", "Error sending add rule data request (No such file or directory)", "There was an error in line 286 of /etc/audit/audit.rules", "Error sending add rule data request (No such file or directory)", "There was an error in line 324 of /etc/audit/audit.rules", "Error sending add rule data request (No such file or directory)", "There was an error in line 325 of /etc/audit/audit.rules", "Error sending add rule data request (No such file or directory)", "There was an error in line 346 of /etc/audit/audit.rules", "parameter passed without an option given", "There was an error in line 347 of /etc/audit/audit.rules", "parameter passed without an option given", "There was an error in line 348 of /etc/audit/audit.rules", "parameter passed without an option given", "There was an error in line 349 of /etc/audit/audit.rules", "parameter passed without an option given", "There was an error in line 350 of /etc/audit/audit.rules", "parameter passed without an option given", "There was an error in line 351 of /etc/audit/audit.rules", "Error sending add rule data request (No such file or directory)", "There was an error in line 359 of /etc/audit/audit.rules"], "stdout": "/usr/sbin/augenrules: No change\nNo rules\nenabled 1\nfailure 1\npid 2649\nrate_limit 0\nbacklog_limit 8192\nlost 0\nbacklog 94\nbacklog_wait_time 60000\nbacklog_wait_time_actual 0\nenabled 1\nfailure 1\npid 2649\nrate_limit 0\nbacklog_limit 8192\nlost 0\nbacklog 0\nbacklog_wait_time 60000\nbacklog_wait_time_actual 0", "stdout_lines": ["/usr/sbin/augenrules: No change", "No rules", "enabled 1", "failure 1", "pid 2649", "rate_limit 0", "backlog_limit 8192", "lost 0", "backlog 94", "backlog_wait_time 60000", "backlog_wait_time_actual 0", "enabled 1", "failure 1", "pid 2649", "rate_limit 0", "backlog_limit 8192", "lost 0", "backlog 0", "backlog_wait_time 60000", "backlog_wait_time_actual 0"]} 2026-03-26 09:05:23.634867 | debian-bookworm | 2026-03-26 09:05:23.634874 | debian-bookworm | RUNNING HANDLER [auditd : Restart auditd service] ****************************** 2026-03-26 09:05:23.898557 | ubuntu-noble | --- before 2026-03-26 09:05:23.898647 | ubuntu-noble | +++ after: /home/zuul/.ansible/tmp/ansible-local-1906397nx_qm/tmpaz0vkzx3/20-neo23x0.rules.j2 2026-03-26 09:05:23.898730 | ubuntu-noble | @@ -0,0 +1,750 @@ 2026-03-26 09:05:23.898830 | ubuntu-noble | +# ___ ___ __ __ 2026-03-26 09:05:23.898925 | ubuntu-noble | +# / | __ ______/ (_) /_____/ / 2026-03-26 09:05:23.899019 | ubuntu-noble | +# / /| |/ / / / __ / / __/ __ / 2026-03-26 09:05:23.899351 | ubuntu-noble | +# / ___ / /_/ / /_/ / / /_/ /_/ / 2026-03-26 09:05:23.899447 | ubuntu-noble | +# /_/ |_\__,_/\__,_/_/\__/\__,_/ 2026-03-26 09:05:23.899545 | ubuntu-noble | +# 2026-03-26 09:05:23.899647 | ubuntu-noble | +# Linux Audit Daemon - Best Practice Configuration 2026-03-26 09:05:23.899743 | ubuntu-noble | +# /etc/audit/audit.rules 2026-03-26 09:05:23.899837 | ubuntu-noble | +# 2026-03-26 09:05:23.899938 | ubuntu-noble | +# Compiled by Florian Roth 2026-03-26 09:05:23.900222 | ubuntu-noble | +# 2026-03-26 09:05:23.900319 | ubuntu-noble | +# Created : 2017/12/05 2026-03-26 09:05:23.900423 | ubuntu-noble | +# Modified : 2023/01/25 2026-03-26 09:05:23.900515 | ubuntu-noble | +# 2026-03-26 09:05:23.900618 | ubuntu-noble | +# Based on rules published here: 2026-03-26 09:05:23.900726 | ubuntu-noble | +# Gov.uk auditd rules 2026-03-26 09:05:23.903374 | ubuntu-noble | +# https://github.com/gds-operations/puppet-auditd/pull/1 2026-03-26 09:05:23.905134 | ubuntu-noble | +# CentOS 7 hardening 2026-03-26 09:05:23.905168 | ubuntu-noble | +# https://highon.coffee/blog/security-harden-centos-7/#auditd---audit-daemon 2026-03-26 09:05:23.905175 | ubuntu-noble | +# Linux audit repo 2026-03-26 09:05:23.905181 | ubuntu-noble | +# https://github.com/linux-audit/audit-userspace/tree/master/rules 2026-03-26 09:05:23.905188 | ubuntu-noble | +# Auditd high performance linux auditing 2026-03-26 09:05:23.905194 | ubuntu-noble | +# https://linux-audit.com/tuning-auditd-high-performance-linux-auditing/ 2026-03-26 09:05:23.905199 | ubuntu-noble | +# 2026-03-26 09:05:23.905205 | ubuntu-noble | +# Further rules 2026-03-26 09:05:23.905210 | ubuntu-noble | +# For PCI DSS compliance see: 2026-03-26 09:05:23.905215 | ubuntu-noble | +# https://github.com/linux-audit/audit-userspace/blob/master/rules/30-pci-dss-v31.rules 2026-03-26 09:05:23.905220 | ubuntu-noble | +# For NISPOM compliance see: 2026-03-26 09:05:23.905253 | ubuntu-noble | +# https://github.com/linux-audit/audit-userspace/blob/master/rules/30-nispom.rules 2026-03-26 09:05:23.905363 | ubuntu-noble | + 2026-03-26 09:05:23.905469 | ubuntu-noble | +# Remove any existing rules 2026-03-26 09:05:23.905565 | ubuntu-noble | +-D 2026-03-26 09:05:23.905660 | ubuntu-noble | + 2026-03-26 09:05:23.905759 | ubuntu-noble | +# Buffer Size 2026-03-26 09:05:23.905865 | ubuntu-noble | +## Feel free to increase this if the machine panic's 2026-03-26 09:05:23.905961 | ubuntu-noble | +-b 8192 2026-03-26 09:05:23.906077 | ubuntu-noble | + 2026-03-26 09:05:23.906223 | ubuntu-noble | +# Failure Mode 2026-03-26 09:05:23.906329 | ubuntu-noble | +## Possible values: 0 (silent), 1 (printk, print a failure message), 2 (panic, halt the system) 2026-03-26 09:05:23.906428 | ubuntu-noble | +-f 1 2026-03-26 09:05:23.906523 | ubuntu-noble | + 2026-03-26 09:05:23.906621 | ubuntu-noble | +# Ignore errors 2026-03-26 09:05:23.906725 | ubuntu-noble | +## e.g. caused by users or files not found in the local environment 2026-03-26 09:05:23.906821 | ubuntu-noble | +-i 2026-03-26 09:05:23.906915 | ubuntu-noble | + 2026-03-26 09:05:23.907014 | ubuntu-noble | +# Self Auditing --------------------------------------------------------------- 2026-03-26 09:05:23.907151 | ubuntu-noble | + 2026-03-26 09:05:23.907311 | ubuntu-noble | +## Audit the audit logs 2026-03-26 09:05:23.907421 | ubuntu-noble | +### Successful and unsuccessful attempts to read information from the audit records 2026-03-26 09:05:23.907526 | ubuntu-noble | +-w /var/log/audit/ -p wra -k auditlog 2026-03-26 09:05:23.907627 | ubuntu-noble | +-w /var/audit/ -p wra -k auditlog 2026-03-26 09:05:23.907722 | ubuntu-noble | + 2026-03-26 09:05:23.907822 | ubuntu-noble | +## Auditd configuration 2026-03-26 09:05:23.907926 | ubuntu-noble | +### Modifications to audit configuration that occur while the audit collection functions are operating 2026-03-26 09:05:23.908025 | ubuntu-noble | +-w /etc/audit/ -p wa -k auditconfig 2026-03-26 09:05:23.908185 | ubuntu-noble | +-w /etc/libaudit.conf -p wa -k auditconfig 2026-03-26 09:05:23.908287 | ubuntu-noble | +-w /etc/audisp/ -p wa -k audispconfig 2026-03-26 09:05:23.908383 | ubuntu-noble | + 2026-03-26 09:05:23.908483 | ubuntu-noble | +## Monitor for use of audit management tools 2026-03-26 09:05:23.908583 | ubuntu-noble | +-w /sbin/auditctl -p x -k audittools 2026-03-26 09:05:23.908683 | ubuntu-noble | +-w /sbin/auditd -p x -k audittools 2026-03-26 09:05:23.908784 | ubuntu-noble | +-w /usr/sbin/auditd -p x -k audittools 2026-03-26 09:05:23.908934 | ubuntu-noble | +-w /usr/sbin/augenrules -p x -k audittools 2026-03-26 09:05:23.909026 | ubuntu-noble | + 2026-03-26 09:05:23.909176 | ubuntu-noble | +## Access to all audit trails 2026-03-26 09:05:23.909268 | ubuntu-noble | + 2026-03-26 09:05:23.909376 | ubuntu-noble | +-a always,exit -F path=/usr/sbin/ausearch -F perm=x -k audittools 2026-03-26 09:05:23.909482 | ubuntu-noble | +-a always,exit -F path=/usr/sbin/aureport -F perm=x -k audittools 2026-03-26 09:05:23.909585 | ubuntu-noble | +-a always,exit -F path=/usr/sbin/aulast -F perm=x -k audittools 2026-03-26 09:05:23.909690 | ubuntu-noble | +-a always,exit -F path=/usr/sbin/aulastlogin -F perm=x -k audittools 2026-03-26 09:05:23.909793 | ubuntu-noble | +-a always,exit -F path=/usr/sbin/auvirt -F perm=x -k audittools 2026-03-26 09:05:23.909888 | ubuntu-noble | + 2026-03-26 09:05:23.909988 | ubuntu-noble | +# Filters --------------------------------------------------------------------- 2026-03-26 09:05:23.910150 | ubuntu-noble | + 2026-03-26 09:05:23.910227 | ubuntu-noble | +### We put these early because audit is a first match wins system. 2026-03-26 09:05:23.910325 | ubuntu-noble | + 2026-03-26 09:05:23.910428 | ubuntu-noble | +## Ignore SELinux AVC records 2026-03-26 09:05:23.910529 | ubuntu-noble | +-a always,exclude -F msgtype=AVC 2026-03-26 09:05:23.910627 | ubuntu-noble | + 2026-03-26 09:05:23.910726 | ubuntu-noble | +## Ignore current working directory records 2026-03-26 09:05:23.910829 | ubuntu-noble | +-a always,exclude -F msgtype=CWD 2026-03-26 09:05:23.910922 | ubuntu-noble | + 2026-03-26 09:05:23.911028 | ubuntu-noble | +## Cron jobs fill the logs with stuff we normally don't want (works with SELinux) 2026-03-26 09:05:23.911159 | ubuntu-noble | +-a never,user -F subj_type=crond_t 2026-03-26 09:05:23.911259 | ubuntu-noble | +-a never,exit -F subj_type=crond_t 2026-03-26 09:05:23.911353 | ubuntu-noble | + 2026-03-26 09:05:23.911454 | ubuntu-noble | +## This prevents chrony from overwhelming the logs 2026-03-26 09:05:23.911559 | ubuntu-noble | +-a never,exit -F arch=b64 -S adjtimex -F auid=-1 -F uid=chrony -F subj_type=chronyd_t 2026-03-26 09:05:23.911652 | ubuntu-noble | + 2026-03-26 09:05:23.911757 | ubuntu-noble | +## This is not very interesting and wastes a lot of space if the server is public facing 2026-03-26 09:05:23.911866 | ubuntu-noble | +-a always,exclude -F msgtype=CRYPTO_KEY_USER 2026-03-26 09:05:23.912259 | ubuntu-noble | + 2026-03-26 09:05:23.912387 | ubuntu-noble | +## Open VM Tools 2026-03-26 09:05:23.912505 | ubuntu-noble | +-a exit,never -F arch=b64 -S all -F exe=/usr/bin/vmtoolsd 2026-03-26 09:05:23.912595 | ubuntu-noble | + 2026-03-26 09:05:23.912705 | ubuntu-noble | +## High Volume Event Filter (especially on Linux Workstations) 2026-03-26 09:05:23.912809 | ubuntu-noble | +-a never,exit -F arch=b64 -F dir=/dev/shm -k sharedmemaccess 2026-03-26 09:05:23.912915 | ubuntu-noble | +-a never,exit -F arch=b64 -F dir=/var/lock/lvm -k locklvm 2026-03-26 09:05:23.913008 | ubuntu-noble | + 2026-03-26 09:05:23.913158 | ubuntu-noble | +## FileBeat 2026-03-26 09:05:23.914092 | ubuntu-noble | +-a never,exit -F arch=b64 -F path=/opt/filebeat -k filebeat 2026-03-26 09:05:23.914115 | ubuntu-noble | + 2026-03-26 09:05:23.914120 | ubuntu-noble | +## More information on how to filter events 2026-03-26 09:05:23.914125 | ubuntu-noble | +### https://access.redhat.com/solutions/2482221 2026-03-26 09:05:23.914129 | ubuntu-noble | + 2026-03-26 09:05:23.914134 | ubuntu-noble | +# Rules ----------------------------------------------------------------------- 2026-03-26 09:05:23.914139 | ubuntu-noble | + 2026-03-26 09:05:23.914144 | ubuntu-noble | +## Kernel parameters 2026-03-26 09:05:23.914149 | ubuntu-noble | +-w /etc/sysctl.conf -p wa -k sysctl 2026-03-26 09:05:23.914252 | ubuntu-noble | +-w /etc/sysctl.d -p wa -k sysctl 2026-03-26 09:05:23.914347 | ubuntu-noble | + 2026-03-26 09:05:23.914448 | ubuntu-noble | +## Kernel module loading and unloading 2026-03-26 09:05:23.914559 | ubuntu-noble | +-a always,exit -F perm=x -F auid!=-1 -F path=/sbin/insmod -k modules 2026-03-26 09:05:23.914668 | ubuntu-noble | +-a always,exit -F perm=x -F auid!=-1 -F path=/sbin/modprobe -k modules 2026-03-26 09:05:23.914762 | ubuntu-noble | +-a always,exit -F perm=x -F auid!=-1 -F path=/sbin/rmmod -k modules 2026-03-26 09:05:23.914898 | ubuntu-noble | +-a always,exit -F arch=b64 -S finit_module -S init_module -S delete_module -F auid!=-1 -k modules 2026-03-26 09:05:23.915031 | ubuntu-noble | + 2026-03-26 09:05:23.915183 | ubuntu-noble | +## Modprobe configuration 2026-03-26 09:05:23.915285 | ubuntu-noble | +-w /etc/modprobe.conf -p wa -k modprobe 2026-03-26 09:05:23.915386 | ubuntu-noble | +-w /etc/modprobe.d -p wa -k modprobe 2026-03-26 09:05:23.915480 | ubuntu-noble | + 2026-03-26 09:05:23.915586 | ubuntu-noble | +## KExec usage (all actions) 2026-03-26 09:05:23.915689 | ubuntu-noble | +-a always,exit -F arch=b64 -S kexec_load -k KEXEC 2026-03-26 09:05:23.915782 | ubuntu-noble | + 2026-03-26 09:05:23.915882 | ubuntu-noble | +## Special files 2026-03-26 09:05:23.915988 | ubuntu-noble | +-a always,exit -F arch=b64 -S mknod -S mknodat -k specialfiles 2026-03-26 09:05:23.916151 | ubuntu-noble | + 2026-03-26 09:05:23.916254 | ubuntu-noble | +## Mount operations (only attributable) 2026-03-26 09:05:23.916376 | ubuntu-noble | +-a always,exit -F arch=b64 -S mount -S umount2 -F auid!=-1 -k mount 2026-03-26 09:05:23.916471 | ubuntu-noble | + 2026-03-26 09:05:23.916574 | ubuntu-noble | +### NFS mount 2026-03-26 09:05:23.916682 | ubuntu-noble | +-a always,exit -F path=/sbin/mount.nfs -F perm=x -F auid>=500 -F auid!=4294967295 -k T1078_Valid_Accounts 2026-03-26 09:05:23.916806 | ubuntu-noble | +-a always,exit -F path=/usr/sbin/mount.nfs -F perm=x -F auid>=500 -F auid!=4294967295 -k T1078_Valid_Accounts 2026-03-26 09:05:23.916890 | ubuntu-noble | + 2026-03-26 09:05:23.918260 | ubuntu-noble | +## Change swap (only attributable) 2026-03-26 09:05:23.918282 | ubuntu-noble | +-a always,exit -F arch=b64 -S swapon -S swapoff -F auid!=-1 -k swap 2026-03-26 09:05:23.918287 | ubuntu-noble | + 2026-03-26 09:05:23.918291 | ubuntu-noble | +## Time 2026-03-26 09:05:23.918295 | ubuntu-noble | +-a always,exit -F arch=b64 -F uid!=ntp -S adjtimex -S settimeofday -S clock_settime -k time 2026-03-26 09:05:23.918300 | ubuntu-noble | +### Local time zone 2026-03-26 09:05:23.918304 | ubuntu-noble | +-w /etc/localtime -p wa -k localtime 2026-03-26 09:05:23.918307 | ubuntu-noble | + 2026-03-26 09:05:23.918311 | ubuntu-noble | +## Stunnel 2026-03-26 09:05:23.918314 | ubuntu-noble | +-w /usr/sbin/stunnel -p x -k stunnel 2026-03-26 09:05:23.918318 | ubuntu-noble | +-w /usr/bin/stunnel -p x -k stunnel 2026-03-26 09:05:23.918321 | ubuntu-noble | + 2026-03-26 09:05:23.918325 | ubuntu-noble | +## Cron configuration & scheduled jobs 2026-03-26 09:05:23.918328 | ubuntu-noble | +-w /etc/cron.allow -p wa -k cron 2026-03-26 09:05:23.918335 | ubuntu-noble | +-w /etc/cron.deny -p wa -k cron 2026-03-26 09:05:23.918443 | ubuntu-noble | +-w /etc/cron.d/ -p wa -k cron 2026-03-26 09:05:23.918545 | ubuntu-noble | +-w /etc/cron.daily/ -p wa -k cron 2026-03-26 09:05:23.918638 | ubuntu-noble | +-w /etc/cron.hourly/ -p wa -k cron 2026-03-26 09:05:23.918742 | ubuntu-noble | +-w /etc/cron.monthly/ -p wa -k cron 2026-03-26 09:05:23.918838 | ubuntu-noble | +-w /etc/cron.weekly/ -p wa -k cron 2026-03-26 09:05:23.918939 | ubuntu-noble | +-w /etc/crontab -p wa -k cron 2026-03-26 09:05:23.919036 | ubuntu-noble | +-w /var/spool/cron/ -p wa -k cron 2026-03-26 09:05:23.919175 | ubuntu-noble | + 2026-03-26 09:05:23.919274 | ubuntu-noble | +## User, group, password databases 2026-03-26 09:05:23.919374 | ubuntu-noble | +-w /etc/group -p wa -k etcgroup 2026-03-26 09:05:23.919473 | ubuntu-noble | +-w /etc/passwd -p wa -k etcpasswd 2026-03-26 09:05:23.919573 | ubuntu-noble | +-w /etc/gshadow -k etcgroup 2026-03-26 09:05:23.919673 | ubuntu-noble | +-w /etc/shadow -k etcpasswd 2026-03-26 09:05:23.919773 | ubuntu-noble | +-w /etc/security/opasswd -k opasswd 2026-03-26 09:05:23.919866 | ubuntu-noble | + 2026-03-26 09:05:23.919965 | ubuntu-noble | +## Sudoers file changes 2026-03-26 09:05:23.920086 | ubuntu-noble | +-w /etc/sudoers -p wa -k actions 2026-03-26 09:05:23.920193 | ubuntu-noble | +-w /etc/sudoers.d/ -p wa -k actions 2026-03-26 09:05:23.920286 | ubuntu-noble | + 2026-03-26 09:05:23.920396 | ubuntu-noble | +## Passwd 2026-03-26 09:05:23.920486 | ubuntu-noble | +-w /usr/bin/passwd -p x -k passwd_modification 2026-03-26 09:05:23.920580 | ubuntu-noble | + 2026-03-26 09:05:23.920683 | ubuntu-noble | +## Tools to change group identifiers 2026-03-26 09:05:23.920782 | ubuntu-noble | +-w /usr/sbin/groupadd -p x -k group_modification 2026-03-26 09:05:23.920882 | ubuntu-noble | +-w /usr/sbin/groupmod -p x -k group_modification 2026-03-26 09:05:23.920984 | ubuntu-noble | +-w /usr/sbin/addgroup -p x -k group_modification 2026-03-26 09:05:23.921114 | ubuntu-noble | +-w /usr/sbin/useradd -p x -k user_modification 2026-03-26 09:05:23.921225 | ubuntu-noble | +-w /usr/sbin/userdel -p x -k user_modification 2026-03-26 09:05:23.921324 | ubuntu-noble | +-w /usr/sbin/usermod -p x -k user_modification 2026-03-26 09:05:23.921425 | ubuntu-noble | +-w /usr/sbin/adduser -p x -k user_modification 2026-03-26 09:05:23.921517 | ubuntu-noble | + 2026-03-26 09:05:23.921659 | ubuntu-noble | +## Login configuration and information 2026-03-26 09:05:23.921760 | ubuntu-noble | +-w /etc/login.defs -p wa -k login 2026-03-26 09:05:23.921859 | ubuntu-noble | +-w /etc/securetty -p wa -k login 2026-03-26 09:05:23.921962 | ubuntu-noble | +-w /var/log/faillog -p wa -k login 2026-03-26 09:05:23.922079 | ubuntu-noble | +-w /var/log/lastlog -p wa -k login 2026-03-26 09:05:23.922200 | ubuntu-noble | +-w /var/log/tallylog -p wa -k login 2026-03-26 09:05:23.922295 | ubuntu-noble | + 2026-03-26 09:05:23.922396 | ubuntu-noble | +## Network Environment 2026-03-26 09:05:23.922491 | ubuntu-noble | +### Changes to hostname 2026-03-26 09:05:23.922604 | ubuntu-noble | +-a always,exit -F arch=b64 -S sethostname -S setdomainname -k network_modifications 2026-03-26 09:05:23.922690 | ubuntu-noble | + 2026-03-26 09:05:23.922789 | ubuntu-noble | +### Detect Remote Shell Use 2026-03-26 09:05:23.922893 | ubuntu-noble | +-a always,exit -F arch=b64 -F exe=/bin/bash -F success=1 -S connect -k "remote_shell" 2026-03-26 09:05:23.922999 | ubuntu-noble | +-a always,exit -F arch=b64 -F exe=/usr/bin/bash -F success=1 -S connect -k "remote_shell" 2026-03-26 09:05:23.923126 | ubuntu-noble | + 2026-03-26 09:05:23.923235 | ubuntu-noble | +### Successful IPv4 Connections 2026-03-26 09:05:23.923346 | ubuntu-noble | +-a always,exit -F arch=b64 -S connect -F a2=16 -F success=1 -F key=network_connect_4 2026-03-26 09:05:23.923438 | ubuntu-noble | + 2026-03-26 09:05:23.923536 | ubuntu-noble | +### Successful IPv6 Connections 2026-03-26 09:05:23.923641 | ubuntu-noble | +-a always,exit -F arch=b64 -S connect -F a2=28 -F success=1 -F key=network_connect_6 2026-03-26 09:05:23.923735 | ubuntu-noble | + 2026-03-26 09:05:23.923834 | ubuntu-noble | +### Changes to other files 2026-03-26 09:05:23.923934 | ubuntu-noble | +-w /etc/hosts -p wa -k network_modifications 2026-03-26 09:05:23.924034 | ubuntu-noble | +-w /etc/sysconfig/network -p wa -k network_modifications 2026-03-26 09:05:23.924167 | ubuntu-noble | +-w /etc/sysconfig/network-scripts -p w -k network_modifications 2026-03-26 09:05:23.924264 | ubuntu-noble | +-w /etc/network/ -p wa -k network 2026-03-26 09:05:23.924376 | ubuntu-noble | +-a always,exit -F dir=/etc/NetworkManager/ -F perm=wa -k network_modifications 2026-03-26 09:05:23.924471 | ubuntu-noble | + 2026-03-26 09:05:23.924569 | ubuntu-noble | +### Changes to issue 2026-03-26 09:05:23.924665 | ubuntu-noble | +-w /etc/issue -p wa -k etcissue 2026-03-26 09:05:23.924779 | ubuntu-noble | +-w /etc/issue.net -p wa -k etcissue 2026-03-26 09:05:23.924867 | ubuntu-noble | + 2026-03-26 09:05:23.924964 | ubuntu-noble | +## System startup scripts 2026-03-26 09:05:23.925078 | ubuntu-noble | +-w /etc/inittab -p wa -k init 2026-03-26 09:05:23.925185 | ubuntu-noble | +-w /etc/init.d/ -p wa -k init 2026-03-26 09:05:23.925280 | ubuntu-noble | +-w /etc/init/ -p wa -k init 2026-03-26 09:05:23.925373 | ubuntu-noble | + 2026-03-26 09:05:23.925472 | ubuntu-noble | +## Library search paths 2026-03-26 09:05:23.925571 | ubuntu-noble | +-w /etc/ld.so.conf -p wa -k libpath 2026-03-26 09:05:23.925672 | ubuntu-noble | +-w /etc/ld.so.conf.d -p wa -k libpath 2026-03-26 09:05:23.925764 | ubuntu-noble | + 2026-03-26 09:05:23.925872 | ubuntu-noble | +## Systemwide library preloads (LD_PRELOAD) 2026-03-26 09:05:23.925969 | ubuntu-noble | +-w /etc/ld.so.preload -p wa -k systemwide_preloads 2026-03-26 09:05:23.926077 | ubuntu-noble | + 2026-03-26 09:05:23.926192 | ubuntu-noble | +## Pam configuration 2026-03-26 09:05:23.926295 | ubuntu-noble | +-w /etc/pam.d/ -p wa -k pam 2026-03-26 09:05:23.926396 | ubuntu-noble | +-w /etc/security/limits.conf -p wa -k pam 2026-03-26 09:05:23.926502 | ubuntu-noble | +-w /etc/security/limits.d -p wa -k pam 2026-03-26 09:05:23.926602 | ubuntu-noble | +-w /etc/security/pam_env.conf -p wa -k pam 2026-03-26 09:05:23.926699 | ubuntu-noble | +-w /etc/security/namespace.conf -p wa -k pam 2026-03-26 09:05:23.926801 | ubuntu-noble | +-w /etc/security/namespace.d -p wa -k pam 2026-03-26 09:05:23.926900 | ubuntu-noble | +-w /etc/security/namespace.init -p wa -k pam 2026-03-26 09:05:23.926997 | ubuntu-noble | + 2026-03-26 09:05:23.927154 | ubuntu-noble | +## Mail configuration 2026-03-26 09:05:23.927234 | ubuntu-noble | +-w /etc/aliases -p wa -k mail 2026-03-26 09:05:23.927334 | ubuntu-noble | +-w /etc/postfix/ -p wa -k mail 2026-03-26 09:05:23.927433 | ubuntu-noble | +-w /etc/exim4/ -p wa -k mail 2026-03-26 09:05:23.927525 | ubuntu-noble | + 2026-03-26 09:05:23.927627 | ubuntu-noble | +## SSH configuration 2026-03-26 09:05:23.927725 | ubuntu-noble | +-w /etc/ssh/sshd_config -k sshd 2026-03-26 09:05:23.927821 | ubuntu-noble | +-w /etc/ssh/sshd_config.d -k sshd 2026-03-26 09:05:23.927915 | ubuntu-noble | + 2026-03-26 09:05:23.928052 | ubuntu-noble | +## root ssh key tampering 2026-03-26 09:05:23.928143 | ubuntu-noble | +-w /root/.ssh -p wa -k rootkey 2026-03-26 09:05:23.928236 | ubuntu-noble | + 2026-03-26 09:05:23.928335 | ubuntu-noble | +# Systemd 2026-03-26 09:05:23.928434 | ubuntu-noble | +-w /bin/systemctl -p x -k systemd 2026-03-26 09:05:23.928533 | ubuntu-noble | +-w /etc/systemd/ -p wa -k systemd 2026-03-26 09:05:23.928633 | ubuntu-noble | +-w /usr/lib/systemd -p wa -k systemd 2026-03-26 09:05:23.928725 | ubuntu-noble | + 2026-03-26 09:05:23.928827 | ubuntu-noble | +## https://systemd.network/systemd.generator.html 2026-03-26 09:05:23.928932 | ubuntu-noble | +-w /etc/systemd/system-generators/ -p wa -k systemd_generator 2026-03-26 09:05:23.929124 | ubuntu-noble | +-w /usr/local/lib/systemd/system-generators/ -p wa -k systemd_generator 2026-03-26 09:05:23.931116 | ubuntu-noble | +-w /usr/lib/systemd/system-generators -p wa -k systemd_generator 2026-03-26 09:05:23.931161 | ubuntu-noble | + 2026-03-26 09:05:23.931167 | ubuntu-noble | +-w /etc/systemd/user-generators/ -p wa -k systemd_generator 2026-03-26 09:05:23.931170 | ubuntu-noble | +-w /usr/local/lib/systemd/user-generators/ -p wa -k systemd_generator 2026-03-26 09:05:23.931175 | ubuntu-noble | +-w /lib/systemd/system-generators/ -p wa -k systemd_generator 2026-03-26 09:05:23.931178 | ubuntu-noble | + 2026-03-26 09:05:23.931182 | ubuntu-noble | +## SELinux events that modify the system's Mandatory Access Controls (MAC) 2026-03-26 09:05:23.931185 | ubuntu-noble | +-w /etc/selinux/ -p wa -k mac_policy 2026-03-26 09:05:23.931189 | ubuntu-noble | + 2026-03-26 09:05:23.931192 | ubuntu-noble | +## Critical elements access failures 2026-03-26 09:05:23.931196 | ubuntu-noble | +-a always,exit -F arch=b64 -S open -F dir=/etc -F success=0 -k unauthedfileaccess 2026-03-26 09:05:23.931200 | ubuntu-noble | +-a always,exit -F arch=b64 -S open -F dir=/bin -F success=0 -k unauthedfileaccess 2026-03-26 09:05:23.931204 | ubuntu-noble | +-a always,exit -F arch=b64 -S open -F dir=/sbin -F success=0 -k unauthedfileaccess 2026-03-26 09:05:23.931207 | ubuntu-noble | +-a always,exit -F arch=b64 -S open -F dir=/usr/bin -F success=0 -k unauthedfileaccess 2026-03-26 09:05:23.931210 | ubuntu-noble | +-a always,exit -F arch=b64 -S open -F dir=/usr/sbin -F success=0 -k unauthedfileaccess 2026-03-26 09:05:23.931214 | ubuntu-noble | +-a always,exit -F arch=b64 -S open -F dir=/var -F success=0 -k unauthedfileaccess 2026-03-26 09:05:23.931217 | ubuntu-noble | +-a always,exit -F arch=b64 -S open -F dir=/home -F success=0 -k unauthedfileaccess 2026-03-26 09:05:23.931220 | ubuntu-noble | +-a always,exit -F arch=b64 -S open -F dir=/srv -F success=0 -k unauthedfileaccess 2026-03-26 09:05:23.931224 | ubuntu-noble | + 2026-03-26 09:05:23.931227 | ubuntu-noble | +## Process ID change (switching accounts) applications 2026-03-26 09:05:23.931230 | ubuntu-noble | +-w /bin/su -p x -k priv_esc 2026-03-26 09:05:23.931239 | ubuntu-noble | +-w /usr/bin/sudo -p x -k priv_esc 2026-03-26 09:05:23.931288 | ubuntu-noble | + 2026-03-26 09:05:23.931385 | ubuntu-noble | +## Power state 2026-03-26 09:05:23.931490 | ubuntu-noble | +-w /sbin/shutdown -p x -k power 2026-03-26 09:05:23.931585 | ubuntu-noble | +-w /sbin/poweroff -p x -k power 2026-03-26 09:05:23.931686 | ubuntu-noble | +-w /sbin/reboot -p x -k power 2026-03-26 09:05:23.931784 | ubuntu-noble | +-w /sbin/halt -p x -k power 2026-03-26 09:05:23.931880 | ubuntu-noble | + 2026-03-26 09:05:23.931979 | ubuntu-noble | +## Session initiation information 2026-03-26 09:05:23.932093 | ubuntu-noble | +-w /var/run/utmp -p wa -k session 2026-03-26 09:05:23.932206 | ubuntu-noble | +-w /var/log/btmp -p wa -k session 2026-03-26 09:05:23.932305 | ubuntu-noble | +-w /var/log/wtmp -p wa -k session 2026-03-26 09:05:23.932398 | ubuntu-noble | + 2026-03-26 09:05:23.932496 | ubuntu-noble | +## Discretionary Access Control (DAC) modifications 2026-03-26 09:05:23.932604 | ubuntu-noble | +-a always,exit -F arch=b64 -S chmod -F auid>=1000 -F auid!=-1 -k perm_mod 2026-03-26 09:05:23.932707 | ubuntu-noble | +-a always,exit -F arch=b64 -S chown -F auid>=1000 -F auid!=-1 -k perm_mod 2026-03-26 09:05:23.932813 | ubuntu-noble | +-a always,exit -F arch=b64 -S fchmod -F auid>=1000 -F auid!=-1 -k perm_mod 2026-03-26 09:05:23.932918 | ubuntu-noble | +-a always,exit -F arch=b64 -S fchmodat -F auid>=1000 -F auid!=-1 -k perm_mod 2026-03-26 09:05:23.933021 | ubuntu-noble | +-a always,exit -F arch=b64 -S fchown -F auid>=1000 -F auid!=-1 -k perm_mod 2026-03-26 09:05:23.933158 | ubuntu-noble | +-a always,exit -F arch=b64 -S fchownat -F auid>=1000 -F auid!=-1 -k perm_mod 2026-03-26 09:05:23.933259 | ubuntu-noble | +-a always,exit -F arch=b64 -S fremovexattr -F auid>=1000 -F auid!=-1 -k perm_mod 2026-03-26 09:05:23.933372 | ubuntu-noble | +-a always,exit -F arch=b64 -S fsetxattr -F auid>=1000 -F auid!=-1 -k perm_mod 2026-03-26 09:05:23.933471 | ubuntu-noble | +-a always,exit -F arch=b64 -S lchown -F auid>=1000 -F auid!=-1 -k perm_mod 2026-03-26 09:05:23.933574 | ubuntu-noble | +-a always,exit -F arch=b64 -S lremovexattr -F auid>=1000 -F auid!=-1 -k perm_mod 2026-03-26 09:05:23.933677 | ubuntu-noble | +-a always,exit -F arch=b64 -S lsetxattr -F auid>=1000 -F auid!=-1 -k perm_mod 2026-03-26 09:05:23.933780 | ubuntu-noble | +-a always,exit -F arch=b64 -S removexattr -F auid>=1000 -F auid!=-1 -k perm_mod 2026-03-26 09:05:23.933884 | ubuntu-noble | +-a always,exit -F arch=b64 -S setxattr -F auid>=1000 -F auid!=-1 -k perm_mod 2026-03-26 09:05:23.933979 | ubuntu-noble | + 2026-03-26 09:05:23.934125 | ubuntu-noble | +# Special Rules --------------------------------------------------------------- 2026-03-26 09:05:23.934237 | ubuntu-noble | + 2026-03-26 09:05:23.934339 | ubuntu-noble | +## Reconnaissance 2026-03-26 09:05:23.934439 | ubuntu-noble | +-w /usr/bin/whoami -p x -k recon 2026-03-26 09:05:23.934539 | ubuntu-noble | +-w /usr/bin/id -p x -k recon 2026-03-26 09:05:23.934640 | ubuntu-noble | +-w /bin/hostname -p x -k recon 2026-03-26 09:05:23.934738 | ubuntu-noble | +-w /bin/uname -p x -k recon 2026-03-26 09:05:23.934837 | ubuntu-noble | +-w /etc/issue -p r -k recon 2026-03-26 09:05:23.934936 | ubuntu-noble | +-w /etc/hostname -p r -k recon 2026-03-26 09:05:23.935030 | ubuntu-noble | + 2026-03-26 09:05:23.935156 | ubuntu-noble | +## Suspicious activity 2026-03-26 09:05:23.935258 | ubuntu-noble | +-w /usr/bin/wget -p x -k susp_activity 2026-03-26 09:05:23.935361 | ubuntu-noble | +-w /usr/bin/curl -p x -k susp_activity 2026-03-26 09:05:23.935463 | ubuntu-noble | +-w /usr/bin/base64 -p x -k susp_activity 2026-03-26 09:05:23.935561 | ubuntu-noble | +-w /bin/nc -p x -k susp_activity 2026-03-26 09:05:23.935663 | ubuntu-noble | +-w /bin/netcat -p x -k susp_activity 2026-03-26 09:05:23.935765 | ubuntu-noble | +-w /usr/bin/ncat -p x -k susp_activity 2026-03-26 09:05:23.935863 | ubuntu-noble | +-w /usr/bin/ss -p x -k susp_activity 2026-03-26 09:05:23.935963 | ubuntu-noble | +-w /usr/bin/netstat -p x -k susp_activity 2026-03-26 09:05:23.936080 | ubuntu-noble | +-w /usr/bin/ssh -p x -k susp_activity 2026-03-26 09:05:23.936192 | ubuntu-noble | +-w /usr/bin/scp -p x -k susp_activity 2026-03-26 09:05:23.936294 | ubuntu-noble | +-w /usr/bin/sftp -p x -k susp_activity 2026-03-26 09:05:23.936395 | ubuntu-noble | +-w /usr/bin/ftp -p x -k susp_activity 2026-03-26 09:05:23.936492 | ubuntu-noble | +-w /usr/bin/socat -p x -k susp_activity 2026-03-26 09:05:23.936593 | ubuntu-noble | +-w /usr/bin/wireshark -p x -k susp_activity 2026-03-26 09:05:23.936699 | ubuntu-noble | +-w /usr/bin/tshark -p x -k susp_activity 2026-03-26 09:05:23.936791 | ubuntu-noble | +-w /usr/bin/rawshark -p x -k susp_activity 2026-03-26 09:05:23.936891 | ubuntu-noble | +-w /usr/bin/rdesktop -p x -k susp_activity 2026-03-26 09:05:23.936992 | ubuntu-noble | +-w /usr/local/bin/rdesktop -p x -k susp_activity 2026-03-26 09:05:23.937153 | ubuntu-noble | +-w /usr/bin/wlfreerdp -p x -k susp_activity 2026-03-26 09:05:23.937239 | ubuntu-noble | +-w /usr/bin/xfreerdp -p x -k susp_activity 2026-03-26 09:05:23.937342 | ubuntu-noble | +-w /usr/local/bin/xfreerdp -p x -k susp_activity 2026-03-26 09:05:23.937442 | ubuntu-noble | +-w /usr/bin/nmap -p x -k susp_activity 2026-03-26 09:05:23.937537 | ubuntu-noble | + 2026-03-26 09:05:23.937634 | ubuntu-noble | +## sssd 2026-03-26 09:05:23.937784 | ubuntu-noble | +-a always,exit -F path=/usr/libexec/sssd/p11_child -F perm=x -F auid>=500 -F auid!=4294967295 -k T1078_Valid_Accounts 2026-03-26 09:05:23.937851 | ubuntu-noble | +-a always,exit -F path=/usr/libexec/sssd/krb5_child -F perm=x -F auid>=500 -F auid!=4294967295 -k T1078_Valid_Accounts 2026-03-26 09:05:23.937960 | ubuntu-noble | +-a always,exit -F path=/usr/libexec/sssd/ldap_child -F perm=x -F auid>=500 -F auid!=4294967295 -k T1078_Valid_Accounts 2026-03-26 09:05:23.938082 | ubuntu-noble | +-a always,exit -F path=/usr/libexec/sssd/selinux_child -F perm=x -F auid>=500 -F auid!=4294967295 -k T1078_Valid_Accounts 2026-03-26 09:05:23.938212 | ubuntu-noble | +-a always,exit -F path=/usr/libexec/sssd/proxy_child -F perm=x -F auid>=500 -F auid!=4294967295 -k T1078_Valid_Accounts 2026-03-26 09:05:23.938307 | ubuntu-noble | + 2026-03-26 09:05:23.938409 | ubuntu-noble | +## T1002 Data Compressed 2026-03-26 09:05:23.938499 | ubuntu-noble | + 2026-03-26 09:05:23.938604 | ubuntu-noble | +-w /usr/bin/zip -p x -k Data_Compressed 2026-03-26 09:05:23.938703 | ubuntu-noble | +-w /usr/bin/gzip -p x -k Data_Compressed 2026-03-26 09:05:23.938804 | ubuntu-noble | +-w /usr/bin/tar -p x -k Data_Compressed 2026-03-26 09:05:23.938905 | ubuntu-noble | +-w /usr/bin/bzip2 -p x -k Data_Compressed 2026-03-26 09:05:23.938997 | ubuntu-noble | + 2026-03-26 09:05:23.939128 | ubuntu-noble | +-w /usr/bin/lzip -p x -k Data_Compressed 2026-03-26 09:05:23.939225 | ubuntu-noble | +-w /usr/local/bin/lzip -p x -k Data_Compressed 2026-03-26 09:05:23.939316 | ubuntu-noble | + 2026-03-26 09:05:23.939420 | ubuntu-noble | +-w /usr/bin/lz4 -p x -k Data_Compressed 2026-03-26 09:05:23.939522 | ubuntu-noble | +-w /usr/local/bin/lz4 -p x -k Data_Compressed 2026-03-26 09:05:23.939614 | ubuntu-noble | + 2026-03-26 09:05:23.939715 | ubuntu-noble | +-w /usr/bin/lzop -p x -k Data_Compressed 2026-03-26 09:05:23.939819 | ubuntu-noble | +-w /usr/local/bin/lzop -p x -k Data_Compressed 2026-03-26 09:05:23.939963 | ubuntu-noble | + 2026-03-26 09:05:23.940015 | ubuntu-noble | +-w /usr/bin/plzip -p x -k Data_Compressed 2026-03-26 09:05:23.940160 | ubuntu-noble | +-w /usr/local/bin/plzip -p x -k Data_Compressed 2026-03-26 09:05:23.940235 | ubuntu-noble | + 2026-03-26 09:05:23.940336 | ubuntu-noble | +-w /usr/bin/pbzip2 -p x -k Data_Compressed 2026-03-26 09:05:23.940441 | ubuntu-noble | +-w /usr/local/bin/pbzip2 -p x -k Data_Compressed 2026-03-26 09:05:23.940596 | ubuntu-noble | + 2026-03-26 09:05:23.940693 | ubuntu-noble | +-w /usr/bin/lbzip2 -p x -k Data_Compressed 2026-03-26 09:05:23.940793 | ubuntu-noble | +-w /usr/local/bin/lbzip2 -p x -k Data_Compressed 2026-03-26 09:05:23.940895 | ubuntu-noble | + 2026-03-26 09:05:23.940988 | ubuntu-noble | +-w /usr/bin/pixz -p x -k Data_Compressed 2026-03-26 09:05:23.941126 | ubuntu-noble | +-w /usr/local/bin/pixz -p x -k Data_Compressed 2026-03-26 09:05:23.941214 | ubuntu-noble | + 2026-03-26 09:05:23.941336 | ubuntu-noble | +-w /usr/bin/pigz -p x -k Data_Compressed 2026-03-26 09:05:23.941477 | ubuntu-noble | +-w /usr/local/bin/pigz -p x -k Data_Compressed 2026-03-26 09:05:23.941580 | ubuntu-noble | +-w /usr/bin/unpigz -p x -k Data_Compressed 2026-03-26 09:05:23.941682 | ubuntu-noble | +-w /usr/local/bin/unpigz -p x -k Data_Compressed 2026-03-26 09:05:23.941775 | ubuntu-noble | + 2026-03-26 09:05:23.941878 | ubuntu-noble | +-w /usr/bin/zstd -p x -k Data_Compressed 2026-03-26 09:05:23.941979 | ubuntu-noble | +-w /usr/local/bin/zstd -p x -k Data_Compressed 2026-03-26 09:05:23.942150 | ubuntu-noble | + 2026-03-26 09:05:23.942222 | ubuntu-noble | +## Added to catch netcat on Ubuntu 2026-03-26 09:05:23.942323 | ubuntu-noble | +-w /bin/nc.openbsd -p x -k susp_activity 2026-03-26 09:05:23.942426 | ubuntu-noble | +-w /bin/nc.traditional -p x -k susp_activity 2026-03-26 09:05:23.942519 | ubuntu-noble | + 2026-03-26 09:05:23.942620 | ubuntu-noble | +## Sbin suspicious activity 2026-03-26 09:05:23.942715 | ubuntu-noble | +-w /sbin/iptables -p x -k sbin_susp 2026-03-26 09:05:23.942812 | ubuntu-noble | +-w /sbin/ip6tables -p x -k sbin_susp 2026-03-26 09:05:23.942910 | ubuntu-noble | +-w /sbin/ifconfig -p x -k sbin_susp 2026-03-26 09:05:23.943007 | ubuntu-noble | +-w /usr/sbin/arptables -p x -k sbin_susp 2026-03-26 09:05:23.943135 | ubuntu-noble | +-w /usr/sbin/ebtables -p x -k sbin_susp 2026-03-26 09:05:23.943235 | ubuntu-noble | +-w /sbin/xtables-nft-multi -p x -k sbin_susp 2026-03-26 09:05:23.943338 | ubuntu-noble | +-w /usr/sbin/nft -p x -k sbin_susp 2026-03-26 09:05:23.943441 | ubuntu-noble | +-w /usr/sbin/tcpdump -p x -k sbin_susp 2026-03-26 09:05:23.943540 | ubuntu-noble | +-w /usr/sbin/traceroute -p x -k sbin_susp 2026-03-26 09:05:23.943658 | ubuntu-noble | +-w /usr/sbin/ufw -p x -k sbin_susp 2026-03-26 09:05:23.943731 | ubuntu-noble | + 2026-03-26 09:05:23.943828 | ubuntu-noble | +### kde4 2026-03-26 09:05:23.943940 | ubuntu-noble | +-a always,exit -F path=/usr/libexec/kde4/kpac_dhcp_helper -F perm=x -F auid>=1000 -F auid!=4294967295 -k T1078_Valid_Accounts 2026-03-26 09:05:23.944047 | ubuntu-noble | +-a always,exit -F path=/usr/libexec/kde4/kdesud -F perm=x -F auid>=1000 -F auid!=4294967295 -k T1078_Valid_Accounts 2026-03-26 09:05:23.944726 | ubuntu-noble | + 2026-03-26 09:05:23.944755 | ubuntu-noble | +## dbus-send invocation 2026-03-26 09:05:23.944763 | ubuntu-noble | +### may indicate privilege escalation CVE-2021-3560 2026-03-26 09:05:23.944769 | ubuntu-noble | +-w /usr/bin/dbus-send -p x -k dbus_send 2026-03-26 09:05:23.944775 | ubuntu-noble | +-w /usr/bin/gdbus -p x -k gdubs_call 2026-03-26 09:05:23.944785 | ubuntu-noble | + 2026-03-26 09:05:23.944838 | ubuntu-noble | +## pkexec invocation 2026-03-26 09:05:23.944940 | ubuntu-noble | +### may indicate privilege escalation CVE-2021-4034 2026-03-26 09:05:23.945040 | ubuntu-noble | +-w /usr/bin/pkexec -p x -k pkexec 2026-03-26 09:05:23.945183 | ubuntu-noble | + 2026-03-26 09:05:23.945304 | ubuntu-noble | +## Suspicious shells 2026-03-26 09:05:23.945419 | ubuntu-noble | +-w /bin/ash -p x -k susp_shell 2026-03-26 09:05:23.945503 | ubuntu-noble | +-w /bin/csh -p x -k susp_shell 2026-03-26 09:05:23.945604 | ubuntu-noble | +-w /bin/fish -p x -k susp_shell 2026-03-26 09:05:23.945702 | ubuntu-noble | +-w /bin/tcsh -p x -k susp_shell 2026-03-26 09:05:23.945797 | ubuntu-noble | +-w /bin/tclsh -p x -k susp_shell 2026-03-26 09:05:23.945895 | ubuntu-noble | +-w /bin/xonsh -p x -k susp_shell 2026-03-26 09:05:23.946234 | ubuntu-noble | +-w /usr/local/bin/xonsh -p x -k susp_shell 2026-03-26 09:05:23.946342 | ubuntu-noble | +-w /bin/open -p x -k susp_shell 2026-03-26 09:05:23.946440 | ubuntu-noble | +-w /bin/rbash -p x -k susp_shell 2026-03-26 09:05:23.946538 | ubuntu-noble | + 2026-03-26 09:05:23.946638 | ubuntu-noble | +# Web Server Actvity 2026-03-26 09:05:23.946746 | ubuntu-noble | +## Change the number "33" to the ID of your WebServer user. Default: www-data:x:33:33 2026-03-26 09:05:23.946849 | ubuntu-noble | +-a always,exit -F arch=b64 -S execve -F euid=33 -k detect_execve_www 2026-03-26 09:05:23.946943 | ubuntu-noble | + 2026-03-26 09:05:23.947043 | ubuntu-noble | +### https://clustershell.readthedocs.io/ 2026-03-26 09:05:23.947272 | ubuntu-noble | +-w /bin/clush -p x -k susp_shell 2026-03-26 09:05:23.947372 | ubuntu-noble | +-w /usr/local/bin/clush -p x -k susp_shell 2026-03-26 09:05:23.947484 | ubuntu-noble | +-w /etc/clustershell/clush.conf -p x -k susp_shell 2026-03-26 09:05:23.947609 | ubuntu-noble | + 2026-03-26 09:05:23.947671 | ubuntu-noble | +### https://github.com/tmux/tmux 2026-03-26 09:05:23.947792 | ubuntu-noble | +-w /bin/tmux -p x -k susp_shell 2026-03-26 09:05:23.947891 | ubuntu-noble | +-w /usr/local/bin/tmux -p x -k susp_shell 2026-03-26 09:05:23.947989 | ubuntu-noble | + 2026-03-26 09:05:23.948126 | ubuntu-noble | +## Shell/profile configurations 2026-03-26 09:05:23.948226 | ubuntu-noble | +-w /etc/profile.d/ -p wa -k shell_profiles 2026-03-26 09:05:23.948328 | ubuntu-noble | +-w /etc/profile -p wa -k shell_profiles 2026-03-26 09:05:23.948426 | ubuntu-noble | +-w /etc/shells -p wa -k shell_profiles 2026-03-26 09:05:23.948527 | ubuntu-noble | +-w /etc/bashrc -p wa -k shell_profiles 2026-03-26 09:05:23.948628 | ubuntu-noble | +-w /etc/csh.cshrc -p wa -k shell_profiles 2026-03-26 09:05:23.948732 | ubuntu-noble | +-w /etc/csh.login -p wa -k shell_profiles 2026-03-26 09:05:23.948833 | ubuntu-noble | +-w /etc/fish/ -p wa -k shell_profiles 2026-03-26 09:05:23.948932 | ubuntu-noble | +-w /etc/zsh/ -p wa -k shell_profiles 2026-03-26 09:05:23.949028 | ubuntu-noble | + 2026-03-26 09:05:23.949188 | ubuntu-noble | +### https://github.com/xxh/xxh 2026-03-26 09:05:23.949294 | ubuntu-noble | +-w /usr/local/bin/xxh.bash -p x -k susp_shell 2026-03-26 09:05:23.949404 | ubuntu-noble | +-w /usr/local/bin/xxh.xsh -p x -k susp_shell 2026-03-26 09:05:23.949497 | ubuntu-noble | +-w /usr/local/bin/xxh.zsh -p x -k susp_shell 2026-03-26 09:05:23.949637 | ubuntu-noble | + 2026-03-26 09:05:23.949792 | ubuntu-noble | +## Injection 2026-03-26 09:05:23.949843 | ubuntu-noble | +### These rules watch for code injection by the ptrace facility. 2026-03-26 09:05:23.949947 | ubuntu-noble | +### This could indicate someone trying to do something bad or just debugging 2026-03-26 09:05:23.950069 | ubuntu-noble | +-a always,exit -F arch=b64 -S ptrace -F a0=0x4 -k code_injection 2026-03-26 09:05:23.950202 | ubuntu-noble | +-a always,exit -F arch=b64 -S ptrace -F a0=0x5 -k data_injection 2026-03-26 09:05:23.950308 | ubuntu-noble | +-a always,exit -F arch=b64 -S ptrace -F a0=0x6 -k register_injection 2026-03-26 09:05:23.950412 | ubuntu-noble | +-a always,exit -F arch=b64 -S ptrace -k tracing 2026-03-26 09:05:23.950506 | ubuntu-noble | + 2026-03-26 09:05:23.950609 | ubuntu-noble | +## Anonymous File Creation 2026-03-26 09:05:23.950709 | ubuntu-noble | +### These rules watch the use of memfd_create 2026-03-26 09:05:23.950874 | ubuntu-noble | +### "memfd_create" creates anonymous file and returns a file descriptor to access it 2026-03-26 09:05:23.950917 | ubuntu-noble | +### When combined with "fexecve" can be used to stealthily run binaries in memory without touching disk 2026-03-26 09:05:23.951747 | ubuntu-noble | +-a always,exit -F arch=b64 -S memfd_create -F key=anon_file_create 2026-03-26 09:05:23.951771 | ubuntu-noble | + 2026-03-26 09:05:23.951775 | ubuntu-noble | +## Privilege Abuse 2026-03-26 09:05:23.951779 | ubuntu-noble | +### The purpose of this rule is to detect when an admin may be abusing power by looking in user's home dir. 2026-03-26 09:05:23.951784 | ubuntu-noble | +-a always,exit -F dir=/home -F uid=0 -F auid>=1000 -F auid!=-1 -C auid!=obj_uid -k power_abuse 2026-03-26 09:05:23.951788 | ubuntu-noble | + 2026-03-26 09:05:23.951791 | ubuntu-noble | +# Socket Creations 2026-03-26 09:05:23.951803 | ubuntu-noble | +# will catch both IPv4 and IPv6 2026-03-26 09:05:23.951810 | ubuntu-noble | + 2026-03-26 09:05:23.952708 | ubuntu-noble | +-a always,exit -F arch=b32 -S socket -F a0=2 -k network_socket_created 2026-03-26 09:05:23.952732 | ubuntu-noble | +-a always,exit -F arch=b64 -S socket -F a0=2 -k network_socket_created 2026-03-26 09:05:23.952736 | ubuntu-noble | + 2026-03-26 09:05:23.952740 | ubuntu-noble | +-a always,exit -F arch=b32 -S socket -F a0=10 -k network_socket_created 2026-03-26 09:05:23.952744 | ubuntu-noble | +-a always,exit -F arch=b64 -S socket -F a0=10 -k network_socket_created 2026-03-26 09:05:23.952747 | ubuntu-noble | + 2026-03-26 09:05:23.952751 | ubuntu-noble | +# Software Management --------------------------------------------------------- 2026-03-26 09:05:23.953155 | ubuntu-noble | + 2026-03-26 09:05:23.953324 | ubuntu-noble | +# RPM (Redhat/CentOS) 2026-03-26 09:05:23.953435 | ubuntu-noble | +-w /usr/bin/rpm -p x -k software_mgmt 2026-03-26 09:05:23.953550 | ubuntu-noble | +-w /usr/bin/yum -p x -k software_mgmt 2026-03-26 09:05:23.953693 | ubuntu-noble | + 2026-03-26 09:05:23.953786 | ubuntu-noble | +# DNF (Fedora/RedHat 8/CentOS 8) 2026-03-26 09:05:23.954895 | ubuntu-noble | +-w /usr/bin/dnf -p x -k software_mgmt 2026-03-26 09:05:23.954916 | ubuntu-noble | + 2026-03-26 09:05:23.954921 | ubuntu-noble | +# YAST/Zypper/RPM (SuSE) 2026-03-26 09:05:23.954924 | ubuntu-noble | +-w /sbin/yast -p x -k software_mgmt 2026-03-26 09:05:23.954928 | ubuntu-noble | +-w /sbin/yast2 -p x -k software_mgmt 2026-03-26 09:05:23.954946 | ubuntu-noble | +-w /bin/rpm -p x -k software_mgmt 2026-03-26 09:05:23.954950 | ubuntu-noble | +-w /usr/bin/zypper -k software_mgmt 2026-03-26 09:05:23.954953 | ubuntu-noble | + 2026-03-26 09:05:23.954957 | ubuntu-noble | +# DPKG / APT-GET (Debian/Ubuntu) 2026-03-26 09:05:23.954960 | ubuntu-noble | +-w /usr/bin/dpkg -p x -k software_mgmt 2026-03-26 09:05:23.954964 | ubuntu-noble | +-w /usr/bin/apt -p x -k software_mgmt 2026-03-26 09:05:23.954971 | ubuntu-noble | +-w /usr/bin/apt-add-repository -p x -k software_mgmt 2026-03-26 09:05:23.955164 | ubuntu-noble | +-w /usr/bin/apt-get -p x -k software_mgmt 2026-03-26 09:05:23.955219 | ubuntu-noble | +-w /usr/bin/aptitude -p x -k software_mgmt 2026-03-26 09:05:23.955324 | ubuntu-noble | +-w /usr/bin/wajig -p x -k software_mgmt 2026-03-26 09:05:23.955426 | ubuntu-noble | +-w /usr/bin/snap -p x -k software_mgmt 2026-03-26 09:05:23.955671 | ubuntu-noble | + 2026-03-26 09:05:23.955680 | ubuntu-noble | +# PIP(3) (Python installs) 2026-03-26 09:05:23.955858 | ubuntu-noble | +-w /usr/bin/pip -p x -k third_party_software_mgmt 2026-03-26 09:05:23.955865 | ubuntu-noble | +-w /usr/local/bin/pip -p x -k third_party_software_mgmt 2026-03-26 09:05:23.955922 | ubuntu-noble | +-w /usr/bin/pip3 -p x -k third_party_software_mgmt 2026-03-26 09:05:23.956025 | ubuntu-noble | +-w /usr/local/bin/pip3 -p x -k third_party_software_mgmt 2026-03-26 09:05:23.957549 | ubuntu-noble | +-w /usr/bin/pipx -p x -k third_party_software_mgmt 2026-03-26 09:05:23.957570 | ubuntu-noble | +-w /usr/local/bin/pipx -p x -k third_party_software_mgmt 2026-03-26 09:05:23.957574 | ubuntu-noble | + 2026-03-26 09:05:23.957578 | ubuntu-noble | +# npm 2026-03-26 09:05:23.957582 | ubuntu-noble | +## T1072 third party software 2026-03-26 09:05:23.957585 | ubuntu-noble | +## https://www.npmjs.com 2026-03-26 09:05:23.957589 | ubuntu-noble | +## https://docs.npmjs.com/cli/v6/commands/npm-audit 2026-03-26 09:05:23.957593 | ubuntu-noble | +-w /usr/bin/npm -p x -k third_party_software_mgmt 2026-03-26 09:05:23.957596 | ubuntu-noble | + 2026-03-26 09:05:23.957600 | ubuntu-noble | +# Comprehensive Perl Archive Network (CPAN) (CPAN installs) 2026-03-26 09:05:23.957603 | ubuntu-noble | +## T1072 third party software 2026-03-26 09:05:23.957606 | ubuntu-noble | +## https://www.cpan.org 2026-03-26 09:05:23.957610 | ubuntu-noble | +-w /usr/bin/cpan -p x -k third_party_software_mgmt 2026-03-26 09:05:23.957613 | ubuntu-noble | + 2026-03-26 09:05:23.957617 | ubuntu-noble | +# Ruby (RubyGems installs) 2026-03-26 09:05:23.957623 | ubuntu-noble | +## T1072 third party software 2026-03-26 09:05:23.957799 | ubuntu-noble | +## https://rubygems.org 2026-03-26 09:05:23.957823 | ubuntu-noble | +-w /usr/bin/gem -p x -k third_party_software_mgmt 2026-03-26 09:05:23.957934 | ubuntu-noble | + 2026-03-26 09:05:23.958024 | ubuntu-noble | +# LuaRocks (Lua installs) 2026-03-26 09:05:23.958173 | ubuntu-noble | +## T1072 third party software 2026-03-26 09:05:23.958274 | ubuntu-noble | +## https://luarocks.org 2026-03-26 09:05:23.958374 | ubuntu-noble | +-w /usr/bin/luarocks -p x -k third_party_software_mgmt 2026-03-26 09:05:23.958471 | ubuntu-noble | + 2026-03-26 09:05:23.958572 | ubuntu-noble | +# Pacman (Arch Linux) 2026-03-26 09:05:23.958675 | ubuntu-noble | +## https://wiki.archlinux.org/title/Pacman 2026-03-26 09:05:23.958776 | ubuntu-noble | +## T1072 third party software 2026-03-26 09:05:23.958879 | ubuntu-noble | +-w /etc/pacman.conf -p x -k third_party_software_mgmt 2026-03-26 09:05:23.958981 | ubuntu-noble | +-w /etc/pacman.d -p x -k third_party_software_mgmt 2026-03-26 09:05:23.959171 | ubuntu-noble | + 2026-03-26 09:05:23.959217 | ubuntu-noble | +# Special Software ------------------------------------------------------------ 2026-03-26 09:05:23.959313 | ubuntu-noble | + 2026-03-26 09:05:23.959418 | ubuntu-noble | +## GDS specific secrets 2026-03-26 09:05:23.959658 | ubuntu-noble | +-w /etc/puppet/ssl -p wa -k puppet_ssl 2026-03-26 09:05:23.959665 | ubuntu-noble | + 2026-03-26 09:05:23.959684 | ubuntu-noble | +## IBM Bigfix BESClient 2026-03-26 09:05:23.959891 | ubuntu-noble | +-a always,exit -F arch=b64 -S open -F dir=/opt/BESClient -F success=0 -k soft_besclient 2026-03-26 09:05:23.959907 | ubuntu-noble | +-w /var/opt/BESClient/ -p wa -k soft_besclient 2026-03-26 09:05:23.962143 | ubuntu-noble | + 2026-03-26 09:05:23.962167 | ubuntu-noble | +## CHEF https://www.chef.io/chef/ 2026-03-26 09:05:23.962172 | ubuntu-noble | +-w /etc/chef -p wa -k soft_chef 2026-03-26 09:05:23.962176 | ubuntu-noble | + 2026-03-26 09:05:23.962179 | ubuntu-noble | +## Salt 2026-03-26 09:05:23.962183 | ubuntu-noble | +## https://saltproject.io/ 2026-03-26 09:05:23.962187 | ubuntu-noble | +## https://docs.saltproject.io/en/latest/ref/configuration/master.html 2026-03-26 09:05:23.962191 | ubuntu-noble | +-w /etc/salt -p wa -k soft_salt 2026-03-26 09:05:23.962195 | ubuntu-noble | +-w /usr/local/etc/salt -p wa -k soft_salt 2026-03-26 09:05:23.962198 | ubuntu-noble | + 2026-03-26 09:05:23.962202 | ubuntu-noble | +## Otter 2026-03-26 09:05:23.962218 | ubuntu-noble | +## https://inedo.com/otter 2026-03-26 09:05:23.962222 | ubuntu-noble | +-w /etc/otter -p wa -k soft_otter 2026-03-26 09:05:23.962226 | ubuntu-noble | + 2026-03-26 09:05:23.962229 | ubuntu-noble | +## T1081 Credentials In Files 2026-03-26 09:05:23.962233 | ubuntu-noble | +-w /usr/bin/grep -p x -k string_search 2026-03-26 09:05:23.962236 | ubuntu-noble | +-w /usr/bin/egrep -p x -k string_search 2026-03-26 09:05:23.962239 | ubuntu-noble | +-w /usr/bin/ugrep -p x -k string_search 2026-03-26 09:05:23.962243 | ubuntu-noble | +### macOS 2026-03-26 09:05:23.962246 | ubuntu-noble | +-w /usr/local/bin/grep -p x -k string_search 2026-03-26 09:05:23.962250 | ubuntu-noble | +-w /usr/local/bin/egrep -p x -k string_search 2026-03-26 09:05:23.962253 | ubuntu-noble | +-w /usr/local/bin/ugrep -p x -k string_search 2026-03-26 09:05:23.962260 | ubuntu-noble | + 2026-03-26 09:05:23.962264 | ubuntu-noble | +### https://github.com/tmbinc/bgrep 2026-03-26 09:05:23.962361 | ubuntu-noble | +-w /usr/bin/bgrep -p x -k string_search 2026-03-26 09:05:23.962456 | ubuntu-noble | +### macOS 2026-03-26 09:05:23.962560 | ubuntu-noble | +-w /usr/local/bin/bgrep -p x -k string_search 2026-03-26 09:05:23.962654 | ubuntu-noble | + 2026-03-26 09:05:23.962760 | ubuntu-noble | +### https://github.com/BurntSushi/ripgrep 2026-03-26 09:05:23.962861 | ubuntu-noble | +-w /usr/bin/rg -p x -k string_search 2026-03-26 09:05:23.962962 | ubuntu-noble | +### macOS 2026-03-26 09:05:23.963081 | ubuntu-noble | +-w /usr/local/bin/rg -p x -k string_search 2026-03-26 09:05:23.963184 | ubuntu-noble | + 2026-03-26 09:05:23.963284 | ubuntu-noble | +### https://github.com/awgn/cgrep 2026-03-26 09:05:23.963394 | ubuntu-noble | + 2026-03-26 09:05:23.963482 | ubuntu-noble | +-w /usr/bin/cgrep -p x -k string_search 2026-03-26 09:05:23.963579 | ubuntu-noble | +### macOS 2026-03-26 09:05:23.963680 | ubuntu-noble | +-w /usr/local/bin/cgrep -p x -k string_search 2026-03-26 09:05:23.963773 | ubuntu-noble | + 2026-03-26 09:05:23.963873 | ubuntu-noble | +### https://github.com/jpr5/ngrep 2026-03-26 09:05:23.963973 | ubuntu-noble | +-w /usr/bin/ngrep -p x -k string_search 2026-03-26 09:05:23.964097 | ubuntu-noble | +### macOS 2026-03-26 09:05:23.964218 | ubuntu-noble | +-w /usr/local/bin/ngrep -p x -k string_search 2026-03-26 09:05:23.964314 | ubuntu-noble | + 2026-03-26 09:05:23.964411 | ubuntu-noble | +### https://github.com/vrothberg/vgrep 2026-03-26 09:05:23.964521 | ubuntu-noble | +-w /usr/bin/vgrep -p x -k string_search 2026-03-26 09:05:23.964620 | ubuntu-noble | +### macOS 2026-03-26 09:05:23.964718 | ubuntu-noble | +-w /usr/local/bin/vgrep -p x -k string_search 2026-03-26 09:05:23.964815 | ubuntu-noble | + 2026-03-26 09:05:23.964920 | ubuntu-noble | +### https://github.com/monochromegane/the_platinum_searcher 2026-03-26 09:05:23.965021 | ubuntu-noble | +-w /usr/bin/pt -p x -k string_search 2026-03-26 09:05:23.965174 | ubuntu-noble | +### macOS 2026-03-26 09:05:23.965329 | ubuntu-noble | +-w /usr/local/bin/pt -p x -k string_search 2026-03-26 09:05:23.965428 | ubuntu-noble | + 2026-03-26 09:05:23.965535 | ubuntu-noble | +### https://github.com/gvansickle/ucg 2026-03-26 09:05:23.965637 | ubuntu-noble | +-w /usr/bin/ucg -p x -k string_search 2026-03-26 09:05:23.965729 | ubuntu-noble | +### macOS 2026-03-26 09:05:23.965833 | ubuntu-noble | +-w /usr/local/bin/ucg -p x -k string_search 2026-03-26 09:05:23.965927 | ubuntu-noble | + 2026-03-26 09:05:23.966030 | ubuntu-noble | +### https://github.com/ggreer/the_silver_searcher 2026-03-26 09:05:23.966169 | ubuntu-noble | +-w /usr/bin/ag -p x -k string_search 2026-03-26 09:05:23.966263 | ubuntu-noble | +### macOS 2026-03-26 09:05:23.966366 | ubuntu-noble | +-w /usr/local/bin/ag -p x -k string_search 2026-03-26 09:05:23.966458 | ubuntu-noble | + 2026-03-26 09:05:23.966560 | ubuntu-noble | +### https://github.com/beyondgrep/ack3 2026-03-26 09:05:23.966663 | ubuntu-noble | +### https://beyondgrep.com 2026-03-26 09:05:23.966762 | ubuntu-noble | +-w /usr/bin/ack -p x -k string_search 2026-03-26 09:05:23.966864 | ubuntu-noble | +-w /usr/local/bin/ack -p x -k string_search 2026-03-26 09:05:23.966963 | ubuntu-noble | +-w /usr/bin/semgrep -p x -k string_search 2026-03-26 09:05:23.967087 | ubuntu-noble | +### macOS 2026-03-26 09:05:23.967206 | ubuntu-noble | +-w /usr/local/bin/semgrep -p x -k string_search 2026-03-26 09:05:23.967301 | ubuntu-noble | + 2026-03-26 09:05:23.967401 | ubuntu-noble | +## Docker 2026-03-26 09:05:23.967498 | ubuntu-noble | +-w /usr/bin/dockerd -k docker 2026-03-26 09:05:23.967597 | ubuntu-noble | +-w /usr/bin/docker -k docker 2026-03-26 09:05:23.967731 | ubuntu-noble | +-w /usr/bin/docker-containerd -k docker 2026-03-26 09:05:23.967796 | ubuntu-noble | +-w /usr/bin/docker-runc -k docker 2026-03-26 09:05:23.967892 | ubuntu-noble | +-w /var/lib/docker -p wa -k docker 2026-03-26 09:05:23.967992 | ubuntu-noble | +-w /etc/docker -k docker 2026-03-26 09:05:23.968140 | ubuntu-noble | +-w /etc/sysconfig/docker -k docker 2026-03-26 09:05:23.968235 | ubuntu-noble | +-w /etc/sysconfig/docker-storage -k docker 2026-03-26 09:05:23.968340 | ubuntu-noble | +-w /usr/lib/systemd/system/docker.service -k docker 2026-03-26 09:05:23.968452 | ubuntu-noble | +-w /usr/lib/systemd/system/docker.socket -k docker 2026-03-26 09:05:23.968542 | ubuntu-noble | + 2026-03-26 09:05:23.968640 | ubuntu-noble | +## Virtualization stuff 2026-03-26 09:05:23.968745 | ubuntu-noble | +-w /usr/bin/qemu-system-x86_64 -p x -k qemu-system-x86_64 2026-03-26 09:05:23.968846 | ubuntu-noble | +-w /usr/bin/qemu-img -p x -k qemu-img 2026-03-26 09:05:23.968948 | ubuntu-noble | +-w /usr/bin/qemu-kvm -p x -k qemu-kvm 2026-03-26 09:05:23.969043 | ubuntu-noble | +-w /usr/bin/qemu -p x -k qemu 2026-03-26 09:05:23.969190 | ubuntu-noble | +-w /usr/bin/virtualbox -p x -k virtualbox 2026-03-26 09:05:23.969296 | ubuntu-noble | +-w /usr/bin/virt-manager -p x -k virt-manager 2026-03-26 09:05:23.969395 | ubuntu-noble | +-w /usr/bin/VBoxManage -p x -k VBoxManage 2026-03-26 09:05:23.969491 | ubuntu-noble | + 2026-03-26 09:05:23.969589 | ubuntu-noble | +#### VirtualBox on macOS 2026-03-26 09:05:23.969684 | ubuntu-noble | + 2026-03-26 09:05:23.969785 | ubuntu-noble | +-w /usr/local/bin/VirtualBox -p x -k virt_tool 2026-03-26 09:05:23.969912 | ubuntu-noble | +-w /usr/local/bin/VirtualBoxVM -p x -k virt_tool 2026-03-26 09:05:23.969988 | ubuntu-noble | +-w /usr/local/bin/VBoxManage -p x -k virt_tool 2026-03-26 09:05:23.970120 | ubuntu-noble | +-w /usr/local/bin/VBoxVRDP -p x -k virt_tool 2026-03-26 09:05:23.970227 | ubuntu-noble | +-w /usr/local/bin/VBoxHeadless -p x -k virt_tool 2026-03-26 09:05:23.970339 | ubuntu-noble | +-w /usr/local/bin/vboxwebsrv -p x -k virt_tool 2026-03-26 09:05:23.970444 | ubuntu-noble | +-w /usr/local/bin/VBoxBugReport -p x -k virt_tool 2026-03-26 09:05:23.970543 | ubuntu-noble | +-w /usr/local/bin/VBoxBalloonCtrl -p x -k virt_tool 2026-03-26 09:05:23.970641 | ubuntu-noble | +-w /usr/local/bin/VBoxAutostart -p x -k virt_tool 2026-03-26 09:05:23.970744 | ubuntu-noble | +-w /usr/local/bin/VBoxDTrace -p x -k virt_tool 2026-03-26 09:05:23.970845 | ubuntu-noble | +-w /usr/local/bin/vbox-img -p x -k virt_tool 2026-03-26 09:05:23.970950 | ubuntu-noble | +-w /Library/LaunchDaemons/org.virtualbox.startup.plist -p x -k virt_tool 2026-03-26 09:05:23.971080 | ubuntu-noble | +-w /Library/Application Support/VirtualBox/LaunchDaemons/ -p x -k virt_tool 2026-03-26 09:05:23.971203 | ubuntu-noble | +-w /Library/Application Support/VirtualBox/VBoxDrv.kext/ -p x -k virt_tool 2026-03-26 09:05:23.971309 | ubuntu-noble | +-w /Library/Application Support/VirtualBox/VBoxUSB.kext/ -p x -k virt_tool 2026-03-26 09:05:23.971412 | ubuntu-noble | +-w /Library/Application Support/VirtualBox/VBoxNetFlt.kext/ -p x -k virt_tool 2026-03-26 09:05:23.971516 | ubuntu-noble | +-w /Library/Application Support/VirtualBox/VBoxNetAdp.kext/ -p x -k virt_tool 2026-03-26 09:05:23.971609 | ubuntu-noble | + 2026-03-26 09:05:23.971712 | ubuntu-noble | +### Parallels Desktop on macOS 2026-03-26 09:05:23.971805 | ubuntu-noble | + 2026-03-26 09:05:23.971906 | ubuntu-noble | +-w /usr/local/bin/prl_convert -p x -k virt_tool 2026-03-26 09:05:23.972006 | ubuntu-noble | +-w /usr/local/bin/prl_disk_tool -p x -k virt_tool 2026-03-26 09:05:23.972148 | ubuntu-noble | +-w /usr/local/bin/prl_perf_ctl -p x -k virt_tool 2026-03-26 09:05:23.972235 | ubuntu-noble | +-w /usr/local/bin/prlcore2dmp -p x -k virt_tool 2026-03-26 09:05:23.972337 | ubuntu-noble | +-w /usr/local/bin/prlctl -p x -k virt_tool 2026-03-26 09:05:23.972438 | ubuntu-noble | +-w /usr/local/bin/prlexec -p x -k virt_tool 2026-03-26 09:05:23.972539 | ubuntu-noble | +-w /usr/local/bin/prlsrvctl -p x -k virt_tool 2026-03-26 09:05:23.972644 | ubuntu-noble | +-w /Library/Preferences/Parallels -p x -k virt_tool 2026-03-26 09:05:23.972732 | ubuntu-noble | + 2026-03-26 09:05:23.972830 | ubuntu-noble | +### qemu on macOS 2026-03-26 09:05:23.972925 | ubuntu-noble | + 2026-03-26 09:05:23.973028 | ubuntu-noble | +-w /usr/local/bin/qemu-edid -p x -k virt_tool 2026-03-26 09:05:23.973180 | ubuntu-noble | +-w /usr/local/bin/qemu-img -p x -k virt_tool 2026-03-26 09:05:23.973274 | ubuntu-noble | +-w /usr/local/bin/qemu-io -p x -k virt_tool 2026-03-26 09:05:23.973373 | ubuntu-noble | +-w /usr/local/bin/qemu-nbd -p x -k virt_tool 2026-03-26 09:05:23.973476 | ubuntu-noble | +-w /usr/local/bin/qemu-system-x86_64 -p x -k virt_tool 2026-03-26 09:05:23.973571 | ubuntu-noble | + 2026-03-26 09:05:23.973668 | ubuntu-noble | +## Kubelet 2026-03-26 09:05:23.973772 | ubuntu-noble | +-w /usr/bin/kubelet -k kubelet 2026-03-26 09:05:23.973868 | ubuntu-noble | + 2026-03-26 09:05:23.973967 | ubuntu-noble | +# ipc system call 2026-03-26 09:05:23.974082 | ubuntu-noble | +# /usr/include/linux/ipc.h 2026-03-26 09:05:23.974189 | ubuntu-noble | + 2026-03-26 09:05:23.974285 | ubuntu-noble | +## msgctl 2026-03-26 09:05:23.974391 | ubuntu-noble | +#-a always,exit -S ipc -F a0=14 -k Inter-Process_Communication 2026-03-26 09:05:23.974486 | ubuntu-noble | +## msgget 2026-03-26 09:05:23.974599 | ubuntu-noble | +#-a always,exit -S ipc -F a0=13 -k Inter-Process_Communication 2026-03-26 09:05:23.974691 | ubuntu-noble | +## Use these lines on x86_64, ia64 instead 2026-03-26 09:05:23.974795 | ubuntu-noble | +-a always,exit -F arch=b64 -S msgctl -k Inter-Process_Communication 2026-03-26 09:05:23.974897 | ubuntu-noble | +-a always,exit -F arch=b64 -S msgget -k Inter-Process_Communication 2026-03-26 09:05:23.974990 | ubuntu-noble | + 2026-03-26 09:05:23.975135 | ubuntu-noble | +## semctl 2026-03-26 09:05:23.975218 | ubuntu-noble | +#-a always,exit -S ipc -F a0=3 -k Inter-Process_Communication 2026-03-26 09:05:23.975349 | ubuntu-noble | +## semget 2026-03-26 09:05:23.975422 | ubuntu-noble | +#-a always,exit -S ipc -F a0=2 -k Inter-Process_Communication 2026-03-26 09:05:23.975518 | ubuntu-noble | +## semop 2026-03-26 09:05:23.975631 | ubuntu-noble | +#-a always,exit -S ipc -F a0=1 -k Inter-Process_Communication 2026-03-26 09:05:23.975719 | ubuntu-noble | +## semtimedop 2026-03-26 09:05:23.975820 | ubuntu-noble | +#-a always,exit -S ipc -F a0=4 -k Inter-Process_Communication 2026-03-26 09:05:23.975922 | ubuntu-noble | +## Use these lines on x86_64, ia64 instead 2026-03-26 09:05:23.976025 | ubuntu-noble | +-a always,exit -F arch=b64 -S semctl -k Inter-Process_Communication 2026-03-26 09:05:23.976169 | ubuntu-noble | +-a always,exit -F arch=b64 -S semget -k Inter-Process_Communication 2026-03-26 09:05:23.976275 | ubuntu-noble | +-a always,exit -F arch=b64 -S semop -k Inter-Process_Communication 2026-03-26 09:05:23.976421 | ubuntu-noble | +-a always,exit -F arch=b64 -S semtimedop -k Inter-Process_Communication 2026-03-26 09:05:23.976486 | ubuntu-noble | + 2026-03-26 09:05:23.976584 | ubuntu-noble | +## shmctl 2026-03-26 09:05:23.976687 | ubuntu-noble | +#-a always,exit -S ipc -F a0=24 -k Inter-Process_Communication 2026-03-26 09:05:23.976784 | ubuntu-noble | +## shmget 2026-03-26 09:05:23.976887 | ubuntu-noble | +#-a always,exit -S ipc -F a0=23 -k Inter-Process_Communication 2026-03-26 09:05:23.976988 | ubuntu-noble | +## Use these lines on x86_64, ia64 instead 2026-03-26 09:05:23.977123 | ubuntu-noble | +-a always,exit -F arch=b64 -S shmctl -k Inter-Process_Communication 2026-03-26 09:05:23.977262 | ubuntu-noble | +-a always,exit -F arch=b64 -S shmget -k Inter-Process_Communication 2026-03-26 09:05:23.977504 | ubuntu-noble | + 2026-03-26 09:05:23.977511 | ubuntu-noble | +# High Volume Events ---------------------------------------------------------- 2026-03-26 09:05:23.977548 | ubuntu-noble | + 2026-03-26 09:05:23.977651 | ubuntu-noble | +## Disable these rules if they create too many events in your environment 2026-03-26 09:05:23.977744 | ubuntu-noble | + 2026-03-26 09:05:23.977846 | ubuntu-noble | +## Common Shells 2026-03-26 09:05:23.977942 | ubuntu-noble | +-w /bin/bash -p x -k susp_shell 2026-03-26 09:05:23.978041 | ubuntu-noble | +-w /bin/dash -p x -k susp_shell 2026-03-26 09:05:23.978173 | ubuntu-noble | +-w /bin/busybox -p x -k susp_shell 2026-03-26 09:05:23.978689 | ubuntu-noble | +-w /bin/zsh -p x -k susp_shell 2026-03-26 09:05:23.978698 | ubuntu-noble | +-w /bin/sh -p x -k susp_shell 2026-03-26 09:05:23.978701 | ubuntu-noble | +-w /bin/ksh -p x -k susp_shell 2026-03-26 09:05:23.978705 | ubuntu-noble | + 2026-03-26 09:05:23.978708 | ubuntu-noble | +## Root command executions 2026-03-26 09:05:23.978746 | ubuntu-noble | +-a always,exit -F arch=b64 -F euid=0 -F auid>=1000 -F auid!=-1 -S execve -k rootcmd 2026-03-26 09:05:23.978839 | ubuntu-noble | + 2026-03-26 09:05:23.978939 | ubuntu-noble | +## File Deletion Events by User 2026-03-26 09:05:23.979044 | ubuntu-noble | +-a always,exit -F arch=b64 -S rmdir -S unlink -S unlinkat -S rename -S renameat -F auid>=1000 -F auid!=-1 -k delete 2026-03-26 09:05:23.979182 | ubuntu-noble | + 2026-03-26 09:05:23.979281 | ubuntu-noble | +## File Access 2026-03-26 09:05:23.979383 | ubuntu-noble | +### Unauthorized Access (unsuccessful) 2026-03-26 09:05:23.979497 | ubuntu-noble | +-a always,exit -F arch=b64 -S creat -S open -S openat -S open_by_handle_at -S truncate -S ftruncate -F exit=-EACCES -F auid>=1000 -F auid!=-1 -k file_access 2026-03-26 09:05:23.979604 | ubuntu-noble | +-a always,exit -F arch=b64 -S creat -S open -S openat -S open_by_handle_at -S truncate -S ftruncate -F exit=-EPERM -F auid>=1000 -F auid!=-1 -k file_access 2026-03-26 09:05:23.979698 | ubuntu-noble | + 2026-03-26 09:05:23.979800 | ubuntu-noble | +### Unsuccessful Creation 2026-03-26 09:05:23.979907 | ubuntu-noble | +-a always,exit -F arch=b64 -S mkdir,creat,link,symlink,mknod,mknodat,linkat,symlinkat -F exit=-EACCES -k file_creation 2026-03-26 09:05:23.980012 | ubuntu-noble | +-a always,exit -F arch=b64 -S mkdir,link,symlink,mkdirat -F exit=-EPERM -k file_creation 2026-03-26 09:05:23.980129 | ubuntu-noble | + 2026-03-26 09:05:23.980230 | ubuntu-noble | +### Unsuccessful Modification 2026-03-26 09:05:23.982133 | ubuntu-noble | +-a always,exit -F arch=b64 -S rename -S renameat -S truncate -S chmod -S setxattr -S lsetxattr -S removexattr -S lremovexattr -F exit=-EACCES -k file_modification 2026-03-26 09:05:23.982215 | ubuntu-noble | +-a always,exit -F arch=b64 -S rename -S renameat -S truncate -S chmod -S setxattr -S lsetxattr -S removexattr -S lremovexattr -F exit=-EPERM -k file_modification 2026-03-26 09:05:23.982220 | ubuntu-noble | + 2026-03-26 09:05:23.982225 | ubuntu-noble | +## 32bit API Exploitation 2026-03-26 09:05:23.982230 | ubuntu-noble | +### If you are on a 64 bit platform, everything _should_ be running 2026-03-26 09:05:23.982235 | ubuntu-noble | +### in 64 bit mode. This rule will detect any use of the 32 bit syscalls 2026-03-26 09:05:23.982239 | ubuntu-noble | +### because this might be a sign of someone exploiting a hole in the 32 2026-03-26 09:05:23.982243 | ubuntu-noble | +### bit API. 2026-03-26 09:05:23.982247 | ubuntu-noble | +-a always,exit -F arch=b32 -S all -k 32bit_api 2026-03-26 09:05:23.982250 | ubuntu-noble | + 2026-03-26 09:05:23.982254 | ubuntu-noble | +# Make The Configuration Immutable -------------------------------------------- 2026-03-26 09:05:23.982257 | ubuntu-noble | + 2026-03-26 09:05:23.982261 | ubuntu-noble | +##-e 2 2026-03-26 09:05:23.982265 | ubuntu-noble | 2026-03-26 09:05:23.982280 | ubuntu-noble | changed: [molecule-auditd] => (item=20-neo23x0.rules) => {"ansible_loop_var": "item", "changed": true, "checksum": "9f99ce5c4f891fbf3e2bce06ed4cb97fb9e01f41", "dest": "/etc/audit/rules.d/20-neo23x0.rules", "gid": 0, "group": "root", "item": "20-neo23x0.rules", "md5sum": "6ac57206fd77de34805c3f4d50ef8b1d", "mode": "0644", "owner": "root", "size": 27367, "src": "/home/zuul/.ansible/tmp/ansible-tmp-1774515922.9372015-2387-87284230641899/.source.rules", "state": "file", "uid": 0} 2026-03-26 09:05:23.982285 | ubuntu-noble | 2026-03-26 09:05:23.982289 | ubuntu-noble | TASK [auditd : Manage auditd service] ****************************************** 2026-03-26 09:05:24.503107 | debian-bookworm | changed: [molecule-auditd] => {"changed": true, "name": "auditd", "state": "started", "status": {"ActiveEnterTimestamp": "Thu 2026-03-26 09:05:23 UTC", "ActiveEnterTimestampMonotonic": "159705472", "ActiveExitTimestamp": "Thu 2026-03-26 09:05:22 UTC", "ActiveExitTimestampMonotonic": "159486028", "ActiveState": "active", "After": "system.slice local-fs.target systemd-journald.socket systemd-tmpfiles-setup.service", "AllowIsolate": "no", "AssertResult": "yes", "AssertTimestamp": "Thu 2026-03-26 09:05:22 UTC", "AssertTimestampMonotonic": "159538466", "Before": "sysinit.target ssh.service shutdown.target systemd-update-utmp.service", "BlockIOAccounting": "no", "BlockIOWeight": "[not set]", "CPUAccounting": "yes", "CPUAffinityFromNUMA": "no", "CPUQuotaPerSecUSec": "infinity", "CPUQuotaPeriodUSec": "infinity", "CPUSchedulingPolicy": "0", "CPUSchedulingPriority": "0", "CPUSchedulingResetOnFork": "no", "CPUShares": "[not set]", "CPUUsageNSec": "196347000", "CPUWeight": "[not set]", "CacheDirectoryMode": "0755", "CanFreeze": "yes", "CanIsolate": "no", "CanReload": "no", "CanStart": "yes", "CanStop": "yes", "CapabilityBoundingSet": "cap_chown cap_dac_override cap_dac_read_search cap_fowner cap_fsetid cap_kill cap_setgid cap_setuid cap_setpcap cap_linux_immutable cap_net_bind_service cap_net_broadcast cap_net_admin cap_net_raw cap_ipc_lock cap_ipc_owner cap_sys_rawio cap_sys_chroot cap_sys_ptrace cap_sys_pacct cap_sys_admin cap_sys_boot cap_sys_nice cap_sys_resource cap_sys_time cap_sys_tty_config cap_mknod cap_lease cap_audit_write cap_audit_control cap_setfcap cap_mac_override cap_mac_admin cap_syslog cap_wake_alarm cap_block_suspend cap_audit_read cap_perfmon cap_bpf cap_checkpoint_restore", "CleanResult": "success", "CollectMode": "inactive", "ConditionResult": "yes", "ConditionTimestamp": "Thu 2026-03-26 09:05:22 UTC", "ConditionTimestampMonotonic": "159538391", "ConfigurationDirectoryMode": "0755", "Conflicts": "shutdown.target", "ControlGroup": "/system.slice/auditd.service", "ControlGroupId": "3250", "ControlPID": "0", "CoredumpFilter": "0x33", "DefaultDependencies": "no", "DefaultMemoryLow": "0", "DefaultMemoryMin": "0", "Delegate": "no", "Description": "Security Auditing Service", "DevicePolicy": "auto", "Documentation": "\"man:auditd(8)\" https://github.com/linux-audit/audit-documentation", "DynamicUser": "no", "ExecMainCode": "0", "ExecMainExitTimestampMonotonic": "0", "ExecMainPID": "2649", "ExecMainStartTimestamp": "Thu 2026-03-26 09:05:22 UTC", "ExecMainStartTimestampMonotonic": "159576315", "ExecMainStatus": "0", "ExecStart": "{ path=/sbin/auditd ; argv[]=/sbin/auditd ; ignore_errors=no ; start_time=[Thu 2026-03-26 09:05:22 UTC] ; stop_time=[Thu 2026-03-26 09:05:22 UTC] ; pid=2648 ; code=exited ; status=0 }", "ExecStartEx": "{ path=/sbin/auditd ; argv[]=/sbin/auditd ; flags= ; start_time=[Thu 2026-03-26 09:05:22 UTC] ; stop_time=[Thu 2026-03-26 09:05:22 UTC] ; pid=2648 ; code=exited ; status=0 }", "ExecStartPost": "{ path=/sbin/augenrules ; argv[]=/sbin/augenrules --load ; ignore_errors=yes ; start_time=[Thu 2026-03-26 09:05:22 UTC] ; stop_time=[Thu 2026-03-26 09:05:23 UTC] ; pid=2652 ; code=exited ; status=0 }", "ExecStartPostEx": "{ path=/sbin/augenrules ; argv[]=/sbin/augenrules --load ; flags=ignore-failure ; start_time=[Thu 2026-03-26 09:05:22 UTC] ; stop_time=[Thu 2026-03-26 09:05:23 UTC] ; pid=2652 ; code=exited ; status=0 }", "ExitType": "main", "FailureAction": "none", "FileDescriptorStoreMax": "0", "FinalKillSignal": "9", "FragmentPath": "/lib/systemd/system/auditd.service", "FreezerState": "running", "GID": "[not set]", "GuessMainPID": "yes", "IOAccounting": "no", "IOReadBytes": "18446744073709551615", "IOReadOperations": "18446744073709551615", "IOSchedulingClass": "2", "IOSchedulingPriority": "4", "IOWeight": "[not set]", "IOWriteBytes": "18446744073709551615", "IOWriteOperations": "18446744073709551615", "IPAccounting": "no", "IPEgressBytes": "[no data]", "IPEgressPackets": "[no data]", "IPIngressBytes": "[no data]", "IPIngressPackets": "[no data]", "Id": "auditd.service", "IgnoreOnIsolate": "no", "IgnoreSIGPIPE": "yes", "InactiveEnterTimestamp": "Thu 2026-03-26 09:05:22 UTC", "InactiveEnterTimestampMonotonic": "159532589", "InactiveExitTimestamp": "Thu 2026-03-26 09:05:22 UTC", "InactiveExitTimestampMonotonic": "159552789", "InvocationID": "b2a909e24dd74f7791a88a176acf362c", "JobRunningTimeoutUSec": "infinity", "JobTimeoutAction": "none", "JobTimeoutUSec": "infinity", "KeyringMode": "private", "KillMode": "control-group", "KillSignal": "15", "LimitAS": "infinity", "LimitASSoft": "infinity", "LimitCORE": "infinity", "LimitCORESoft": "0", "LimitCPU": "infinity", "LimitCPUSoft": "infinity", "LimitDATA": "infinity", "LimitDATASoft": "infinity", "LimitFSIZE": "infinity", "LimitFSIZESoft": "infinity", "LimitLOCKS": "infinity", "LimitLOCKSSoft": "infinity", "LimitMEMLOCK": "8388608", "LimitMEMLOCKSoft": "8388608", "LimitMSGQUEUE": "819200", "LimitMSGQUEUESoft": "819200", "LimitNICE": "0", "LimitNICESoft": "0", "LimitNOFILE": "524288", "LimitNOFILESoft": "1024", "LimitNPROC": "15480", "LimitNPROCSoft": "15480", "LimitRSS": "infinity", "LimitRSSSoft": "infinity", "LimitRTPRIO": "0", "LimitRTPRIOSoft": "0", "LimitRTTIME": "infinity", "LimitRTTIMESoft": "infinity", "LimitSIGPENDING": "15480", "LimitSIGPENDINGSoft": "15480", "LimitSTACK": "infinity", "LimitSTACKSoft": "8388608", "LoadState": "loaded", "LockPersonality": "yes", "LogLevelMax": "-1", "LogRateLimitBurst": "0", "LogRateLimitIntervalUSec": "0", "LogsDirectoryMode": "0755", "MainPID": "2649", "ManagedOOMMemoryPressure": "auto", "ManagedOOMMemoryPressureLimit": "0", "ManagedOOMPreference": "none", "ManagedOOMSwap": "auto", "MemoryAccounting": "yes", "MemoryAvailable": "infinity", "MemoryCurrent": "2064384", "MemoryDenyWriteExecute": "yes", "MemoryHigh": "infinity", "MemoryLimit": "infinity", "MemoryLow": "0", "MemoryMax": "infinity", "MemoryMin": "0", "MemorySwapMax": "infinity", "MountAPIVFS": "no", "NFileDescriptorStore": "0", "NRestarts": "0", "NUMAPolicy": "n/a", "Names": "auditd.service", "NeedDaemonReload": "no", "Nice": "0", "NoNewPrivileges": "no", "NonBlocking": "no", "NotifyAccess": "none", "OOMPolicy": "stop", "OOMScoreAdjust": "0", "OnFailureJobMode": "replace", "OnSuccessJobMode": "fail", "PIDFile": "/run/auditd.pid", "Perpetual": "no", "PrivateDevices": "no", "PrivateIPC": "no", "PrivateMounts": "no", "PrivateNetwork": "no", "PrivateTmp": "no", "PrivateUsers": "no", "ProcSubset": "all", "ProtectClock": "no", "ProtectControlGroups": "yes", "ProtectHome": "no", "ProtectHostname": "no", "ProtectKernelLogs": "no", "ProtectKernelModules": "yes", "ProtectKernelTunables": "no", "ProtectProc": "default", "ProtectSystem": "no", "RefuseManualStart": "no", "RefuseManualStop": "no", "ReloadResult": "success", "RemainAfterExit": "no", "RemoveIPC": "no", "Requires": "system.slice", "Restart": "on-failure", "RestartKillSignal": "15", "RestartPreventExitStatus": "2 4 6", "RestartUSec": "100ms", "RestrictNamespaces": "no", "RestrictRealtime": "yes", "RestrictSUIDSGID": "no", "Result": "success", "RootDirectoryStartOnly": "no", "RuntimeDirectoryMode": "0755", "RuntimeDirectoryPreserve": "no", "RuntimeMaxUSec": "infinity", "RuntimeRandomizedExtraUSec": "0", "SameProcessGroup": "no", "SecureBits": "0", "SendSIGHUP": "no", "SendSIGKILL": "yes", "Slice": "system.slice", "StandardError": "inherit", "StandardInput": "null", "StandardOutput": "journal", "StartLimitAction": "none", "StartLimitBurst": "5", "StartLimitIntervalUSec": "10s", "StartupBlockIOWeight": "[not set]", "StartupCPUShares": "[not set]", "StartupCPUWeight": "[not set]", "StartupIOWeight": "[not set]", "StateChangeTimestamp": "Thu 2026-03-26 09:05:23 UTC", "StateChangeTimestampMonotonic": "159705472", "StateDirectoryMode": "0755", "StatusErrno": "0", "StopWhenUnneeded": "no", "SubState": "running", "SuccessAction": "none", "SyslogFacility": "3", "SyslogLevel": "6", "SyslogLevelPrefix": "yes", "SyslogPriority": "30", "SystemCallErrorNumber": "2147483646", "TTYReset": "no", "TTYVHangup": "no", "TTYVTDisallocate": "no", "TasksAccounting": "yes", "TasksCurrent": "2", "TasksMax": "4644", "TimeoutAbortUSec": "1min 30s", "TimeoutCleanUSec": "infinity", "TimeoutStartFailureMode": "terminate", "TimeoutStartUSec": "1min 30s", "TimeoutStopFailureMode": "terminate", "TimeoutStopUSec": "1min 30s", "TimerSlackNSec": "50000", "Transient": "no", "Type": "forking", "UID": "[not set]", "UMask": "0022", "UnitFilePreset": "enabled", "UnitFileState": "enabled", "UtmpMode": "init", "WantedBy": "multi-user.target", "WatchdogSignal": "6", "WatchdogTimestampMonotonic": "0", "WatchdogUSec": "0"}} 2026-03-26 09:05:24.506219 | debian-bookworm | 2026-03-26 09:05:24.506260 | debian-bookworm | PLAY RECAP ********************************************************************* 2026-03-26 09:05:24.506270 | debian-bookworm | molecule-auditd : ok=15 changed=8 unreachable=0 failed=0 skipped=0 rescued=0 ignored=0 2026-03-26 09:05:24.506277 | debian-bookworm | 2026-03-26 09:05:24.612413 | debian-bookworm | INFO [delegated > converge] Executed: Successful 2026-03-26 09:05:24.612940 | debian-bookworm | WARNING Molecule executed 1 scenario (1 missing files) 2026-03-26 09:05:24.872147 | debian-bookworm | ok: Runtime: 0:00:20.344074 2026-03-26 09:05:24.873337 | ubuntu-noble | ok: [molecule-auditd] => {"changed": false, "enabled": true, "name": "auditd", "state": "started", "status": {"ActiveEnterTimestamp": "Thu 2026-03-26 09:05:15 UTC", "ActiveEnterTimestampMonotonic": "156662932", "ActiveExitTimestampMonotonic": "0", "ActiveState": "active", "After": "systemd-tmpfiles-setup.service system.slice local-fs.target systemd-journald.socket", "AllowIsolate": "no", "AssertResult": "yes", "AssertTimestamp": "Thu 2026-03-26 09:05:15 UTC", "AssertTimestampMonotonic": "156586084", "Before": "systemd-update-utmp.service shutdown.target ssh.service sysinit.target", "BlockIOAccounting": "no", "BlockIOWeight": "[not set]", "CPUAccounting": "yes", "CPUAffinityFromNUMA": "no", "CPUQuotaPerSecUSec": "infinity", "CPUQuotaPeriodUSec": "infinity", "CPUSchedulingPolicy": "0", "CPUSchedulingPriority": "0", "CPUSchedulingResetOnFork": "no", "CPUShares": "[not set]", "CPUUsageNSec": "60197000", "CPUWeight": "[not set]", "CacheDirectoryMode": "0755", "CanFreeze": "yes", "CanIsolate": "no", "CanReload": "no", "CanStart": "yes", "CanStop": "yes", "CapabilityBoundingSet": "cap_chown cap_dac_override cap_dac_read_search cap_fowner cap_fsetid cap_kill cap_setgid cap_setuid cap_setpcap cap_linux_immutable cap_net_bind_service cap_net_broadcast cap_net_admin cap_net_raw cap_ipc_lock cap_ipc_owner cap_sys_rawio cap_sys_chroot cap_sys_ptrace cap_sys_pacct cap_sys_admin cap_sys_boot cap_sys_nice cap_sys_resource cap_sys_time cap_sys_tty_config cap_mknod cap_lease cap_audit_write cap_audit_control cap_setfcap cap_mac_override cap_mac_admin cap_syslog cap_wake_alarm cap_block_suspend cap_audit_read cap_perfmon cap_bpf cap_checkpoint_restore", "CleanResult": "success", "CollectMode": "inactive", "ConditionResult": "yes", "ConditionTimestamp": "Thu 2026-03-26 09:05:15 UTC", "ConditionTimestampMonotonic": "156585982", "ConfigurationDirectoryMode": "0755", "Conflicts": "shutdown.target", "ControlGroup": "/system.slice/auditd.service", "ControlGroupId": "3826", "ControlPID": "0", "CoredumpFilter": "0x33", "CoredumpReceive": "no", "DefaultDependencies": "no", "DefaultMemoryLow": "0", "DefaultMemoryMin": "0", "DefaultStartupMemoryLow": "0", "Delegate": "no", "Description": "Security Auditing Service", "DevicePolicy": "auto", "Documentation": "\"man:auditd(8)\" https://github.com/linux-audit/audit-documentation", "DynamicUser": "no", "ExecMainCode": "0", "ExecMainExitTimestampMonotonic": "0", "ExecMainPID": "2152", "ExecMainStartTimestamp": "Thu 2026-03-26 09:05:15 UTC", "ExecMainStartTimestampMonotonic": "156618057", "ExecMainStatus": "0", "ExecStart": "{ path=/sbin/auditd ; argv[]=/sbin/auditd ; ignore_errors=no ; start_time=[Thu 2026-03-26 09:05:15 UTC] ; stop_time=[Thu 2026-03-26 09:05:15 UTC] ; pid=2151 ; code=exited ; status=0 }", "ExecStartEx": "{ path=/sbin/auditd ; argv[]=/sbin/auditd ; flags= ; start_time=[Thu 2026-03-26 09:05:15 UTC] ; stop_time=[Thu 2026-03-26 09:05:15 UTC] ; pid=2151 ; code=exited ; status=0 }", "ExecStartPost": "{ path=/sbin/augenrules ; argv[]=/sbin/augenrules --load ; ignore_errors=yes ; start_time=[Thu 2026-03-26 09:05:15 UTC] ; stop_time=[Thu 2026-03-26 09:05:15 UTC] ; pid=2156 ; code=exited ; status=0 }", "ExecStartPostEx": "{ path=/sbin/augenrules ; argv[]=/sbin/augenrules --load ; flags=ignore-failure ; start_time=[Thu 2026-03-26 09:05:15 UTC] ; stop_time=[Thu 2026-03-26 09:05:15 UTC] ; pid=2156 ; code=exited ; status=0 }", "ExitType": "main", "ExtensionImagePolicy": "root=verity+signed+encrypted+unprotected+absent:usr=verity+signed+encrypted+unprotected+absent:home=encrypted+unprotected+absent:srv=encrypted+unprotected+absent:tmp=encrypted+unprotected+absent:var=encrypted+unprotected+absent", "FailureAction": "none", "FileDescriptorStoreMax": "0", "FileDescriptorStorePreserve": "restart", "FinalKillSignal": "9", "FragmentPath": "/usr/lib/systemd/system/auditd.service", "FreezerState": "running", "GID": "[not set]", "GuessMainPID": "yes", "IOAccounting": "no", "IOReadBytes": "[not set]", "IOReadOperations": "[not set]", "IOSchedulingClass": "2", "IOSchedulingPriority": "4", "IOWeight": "[not set]", "IOWriteBytes": "[not set]", "IOWriteOperations": "[not set]", "IPAccounting": "no", "IPEgressBytes": "[no data]", "IPEgressPackets": "[no data]", "IPIngressBytes": "[no data]", "IPIngressPackets": "[no data]", "Id": "auditd.service", "IgnoreOnIsolate": "no", "IgnoreSIGPIPE": "yes", "InactiveEnterTimestampMonotonic": "0", "InactiveExitTimestamp": "Thu 2026-03-26 09:05:15 UTC", "InactiveExitTimestampMonotonic": "156592355", "InvocationID": "a737b3359c604722a9ba5327657e3993", "JobRunningTimeoutUSec": "infinity", "JobTimeoutAction": "none", "JobTimeoutUSec": "infinity", "KeyringMode": "private", "KillMode": "control-group", "KillSignal": "15", "LimitAS": "infinity", "LimitASSoft": "infinity", "LimitCORE": "infinity", "LimitCORESoft": "0", "LimitCPU": "infinity", "LimitCPUSoft": "infinity", "LimitDATA": "infinity", "LimitDATASoft": "infinity", "LimitFSIZE": "infinity", "LimitFSIZESoft": "infinity", "LimitLOCKS": "infinity", "LimitLOCKSSoft": "infinity", "LimitMEMLOCK": "8388608", "LimitMEMLOCKSoft": "8388608", "LimitMSGQUEUE": "819200", "LimitMSGQUEUESoft": "819200", "LimitNICE": "0", "LimitNICESoft": "0", "LimitNOFILE": "524288", "LimitNOFILESoft": "1024", "LimitNPROC": "15372", "LimitNPROCSoft": "15372", "LimitRSS": "infinity", "LimitRSSSoft": "infinity", "LimitRTPRIO": "0", "LimitRTPRIOSoft": "0", "LimitRTTIME": "infinity", "LimitRTTIMESoft": "infinity", "LimitSIGPENDING": "15372", "LimitSIGPENDINGSoft": "15372", "LimitSTACK": "infinity", "LimitSTACKSoft": "8388608", "LoadState": "loaded", "LockPersonality": "yes", "LogLevelMax": "-1", "LogRateLimitBurst": "0", "LogRateLimitIntervalUSec": "0", "LogsDirectoryMode": "0755", "MainPID": "2152", "ManagedOOMMemoryPressure": "auto", "ManagedOOMMemoryPressureLimit": "0", "ManagedOOMPreference": "none", "ManagedOOMSwap": "auto", "MemoryAccounting": "yes", "MemoryAvailable": "3503575040", "MemoryCurrent": "512000", "MemoryDenyWriteExecute": "yes", "MemoryHigh": "infinity", "MemoryKSM": "no", "MemoryLimit": "infinity", "MemoryLow": "0", "MemoryMax": "infinity", "MemoryMin": "0", "MemoryPeak": "1970176", "MemoryPressureThresholdUSec": "200ms", "MemoryPressureWatch": "auto", "MemorySwapCurrent": "0", "MemorySwapMax": "infinity", "MemorySwapPeak": "0", "MemoryZSwapCurrent": "0", "MemoryZSwapMax": "infinity", "MountAPIVFS": "no", "MountImagePolicy": "root=verity+signed+encrypted+unprotected+absent:usr=verity+signed+encrypted+unprotected+absent:home=encrypted+unprotected+absent:srv=encrypted+unprotected+absent:tmp=encrypted+unprotected+absent:var=encrypted+unprotected+absent", "NFileDescriptorStore": "0", "NRestarts": "0", "NUMAPolicy": "n/a", "Names": "auditd.service", "NeedDaemonReload": "no", "Nice": "0", "NoNewPrivileges": "no", "NonBlocking": "no", "NotifyAccess": "none", "OOMPolicy": "stop", "OOMScoreAdjust": "0", "OnFailureJobMode": "replace", "OnSuccessJobMode": "fail", "PIDFile": "/run/auditd.pid", "Perpetual": "no", "PrivateDevices": "no", "PrivateIPC": "no", "PrivateMounts": "no", "PrivateNetwork": "no", "PrivateTmp": "no", "PrivateUsers": "no", "ProcSubset": "all", "ProtectClock": "no", "ProtectControlGroups": "no", "ProtectHome": "no", "ProtectHostname": "no", "ProtectKernelLogs": "no", "ProtectKernelModules": "yes", "ProtectKernelTunables": "no", "ProtectProc": "default", "ProtectSystem": "no", "RefuseManualStart": "no", "RefuseManualStop": "no", "ReloadResult": "success", "ReloadSignal": "1", "RemainAfterExit": "no", "RemoveIPC": "no", "Requires": "system.slice", "Restart": "on-failure", "RestartKillSignal": "15", "RestartMaxDelayUSec": "infinity", "RestartMode": "normal", "RestartPreventExitStatus": "2 4 6", "RestartSteps": "0", "RestartUSec": "100ms", "RestartUSecNext": "100ms", "RestrictNamespaces": "no", "RestrictRealtime": "yes", "RestrictSUIDSGID": "no", "Result": "success", "RootDirectoryStartOnly": "no", "RootEphemeral": "no", "RootImagePolicy": "root=verity+signed+encrypted+unprotected+absent:usr=verity+signed+encrypted+unprotected+absent:home=encrypted+unprotected+absent:srv=encrypted+unprotected+absent:tmp=encrypted+unprotected+absent:var=encrypted+unprotected+absent", "RuntimeDirectoryMode": "0755", "RuntimeDirectoryPreserve": "no", "RuntimeMaxUSec": "infinity", "RuntimeRandomizedExtraUSec": "0", "SameProcessGroup": "no", "SecureBits": "0", "SendSIGHUP": "no", "SendSIGKILL": "yes", "SetLoginEnvironment": "no", "Slice": "system.slice", "StandardError": "inherit", "StandardInput": "null", "StandardOutput": "journal", "StartLimitAction": "none", "StartLimitBurst": "5", "StartLimitIntervalUSec": "10s", "StartupBlockIOWeight": "[not set]", "StartupCPUShares": "[not set]", "StartupCPUWeight": "[not set]", "StartupIOWeight": "[not set]", "StartupMemoryHigh": "infinity", "StartupMemoryLow": "0", "StartupMemoryMax": "infinity", "StartupMemorySwapMax": "infinity", "StartupMemoryZSwapMax": "infinity", "StateChangeTimestamp": "Thu 2026-03-26 09:05:15 UTC", "StateChangeTimestampMonotonic": "156662932", "StateDirectoryMode": "0755", "StatusErrno": "0", "StopWhenUnneeded": "no", "SubState": "running", "SuccessAction": "none", "SurviveFinalKillSignal": "no", "SyslogFacility": "3", "SyslogLevel": "6", "SyslogLevelPrefix": "yes", "SyslogPriority": "30", "SystemCallErrorNumber": "2147483646", "TTYReset": "no", "TTYVHangup": "no", "TTYVTDisallocate": "no", "TasksAccounting": "yes", "TasksCurrent": "2", "TasksMax": "4611", "TimeoutAbortUSec": "1min 30s", "TimeoutCleanUSec": "infinity", "TimeoutStartFailureMode": "terminate", "TimeoutStartUSec": "1min 30s", "TimeoutStopFailureMode": "terminate", "TimeoutStopUSec": "1min 30s", "TimerSlackNSec": "50000", "Transient": "no", "Type": "forking", "UID": "[not set]", "UMask": "0022", "UnitFilePreset": "enabled", "UnitFileState": "enabled", "UtmpMode": "init", "WantedBy": "multi-user.target", "WatchdogSignal": "6", "WatchdogTimestampMonotonic": "0", "WatchdogUSec": "0"}} 2026-03-26 09:05:24.886703 | ubuntu-noble | 2026-03-26 09:05:24.886778 | ubuntu-noble | TASK [auditd : List existing rules files] ************************************** 2026-03-26 09:05:25.392317 | ubuntu-noble | ok: [molecule-auditd] => {"changed": false, "cmd": ["find", "/etc/audit/rules.d", "-type", "f", "-printf", "%f\n"], "delta": "0:00:00.008831", "end": "2026-03-26 09:05:25.333582", "msg": "", "rc": 0, "start": "2026-03-26 09:05:25.324751", "stderr": "", "stderr_lines": [], "stdout": "20-neo23x0.rules\naudit.rules", "stdout_lines": ["20-neo23x0.rules", "audit.rules"]} 2026-03-26 09:05:25.392470 | ubuntu-noble | 2026-03-26 09:05:25.392533 | ubuntu-noble | TASK [auditd : Remove unmanaged rules files] *********************************** 2026-03-26 09:05:25.811142 | ubuntu-noble | skipping: [molecule-auditd] => (item=20-neo23x0.rules) => {"ansible_loop_var": "item", "changed": false, "false_condition": "item not in auditd_rules_files", "item": "20-neo23x0.rules", "skip_reason": "Conditional result was False"} 2026-03-26 09:05:25.811219 | ubuntu-noble | --- before 2026-03-26 09:05:25.811224 | ubuntu-noble | +++ after 2026-03-26 09:05:25.811228 | ubuntu-noble | @@ -1,4 +1,4 @@ 2026-03-26 09:05:25.811232 | ubuntu-noble | { 2026-03-26 09:05:25.811242 | ubuntu-noble | "path": "/etc/audit/rules.d/audit.rules", 2026-03-26 09:05:25.811389 | ubuntu-noble | - "state": "file" 2026-03-26 09:05:25.811551 | ubuntu-noble | + "state": "absent" 2026-03-26 09:05:25.811716 | ubuntu-noble | } 2026-03-26 09:05:25.811865 | ubuntu-noble | 2026-03-26 09:05:25.812108 | ubuntu-noble | changed: [molecule-auditd] => (item=audit.rules) => {"ansible_loop_var": "item", "changed": true, "item": "audit.rules", "path": "/etc/audit/rules.d/audit.rules", "state": "absent"} 2026-03-26 09:05:25.812258 | ubuntu-noble | 2026-03-26 09:05:25.812433 | ubuntu-noble | RUNNING HANDLER [auditd : Restart auditd service] ****************************** 2026-03-26 09:05:26.630791 | ubuntu-noble | changed: [molecule-auditd] => {"changed": true, "name": "auditd", "state": "started", "status": {"ActiveEnterTimestamp": "Thu 2026-03-26 09:05:15 UTC", "ActiveEnterTimestampMonotonic": "156662932", "ActiveExitTimestampMonotonic": "0", "ActiveState": "active", "After": "systemd-tmpfiles-setup.service system.slice local-fs.target systemd-journald.socket", "AllowIsolate": "no", "AssertResult": "yes", "AssertTimestamp": "Thu 2026-03-26 09:05:15 UTC", "AssertTimestampMonotonic": "156586084", "Before": "systemd-update-utmp.service shutdown.target ssh.service sysinit.target", "BlockIOAccounting": "no", "BlockIOWeight": "[not set]", "CPUAccounting": "yes", "CPUAffinityFromNUMA": "no", "CPUQuotaPerSecUSec": "infinity", "CPUQuotaPeriodUSec": "infinity", "CPUSchedulingPolicy": "0", "CPUSchedulingPriority": "0", "CPUSchedulingResetOnFork": "no", "CPUShares": "[not set]", "CPUUsageNSec": "62025000", "CPUWeight": "[not set]", "CacheDirectoryMode": "0755", "CanFreeze": "yes", "CanIsolate": "no", "CanReload": "no", "CanStart": "yes", "CanStop": "yes", "CapabilityBoundingSet": "cap_chown cap_dac_override cap_dac_read_search cap_fowner cap_fsetid cap_kill cap_setgid cap_setuid cap_setpcap cap_linux_immutable cap_net_bind_service cap_net_broadcast cap_net_admin cap_net_raw cap_ipc_lock cap_ipc_owner cap_sys_rawio cap_sys_chroot cap_sys_ptrace cap_sys_pacct cap_sys_admin cap_sys_boot cap_sys_nice cap_sys_resource cap_sys_time cap_sys_tty_config cap_mknod cap_lease cap_audit_write cap_audit_control cap_setfcap cap_mac_override cap_mac_admin cap_syslog cap_wake_alarm cap_block_suspend cap_audit_read cap_perfmon cap_bpf cap_checkpoint_restore", "CleanResult": "success", "CollectMode": "inactive", "ConditionResult": "yes", "ConditionTimestamp": "Thu 2026-03-26 09:05:15 UTC", "ConditionTimestampMonotonic": "156585982", "ConfigurationDirectoryMode": "0755", "Conflicts": "shutdown.target", "ControlGroup": "/system.slice/auditd.service", "ControlGroupId": "3826", "ControlPID": "0", "CoredumpFilter": "0x33", "CoredumpReceive": "no", "DefaultDependencies": "no", "DefaultMemoryLow": "0", "DefaultMemoryMin": "0", "DefaultStartupMemoryLow": "0", "Delegate": "no", "Description": "Security Auditing Service", "DevicePolicy": "auto", "Documentation": "\"man:auditd(8)\" https://github.com/linux-audit/audit-documentation", "DynamicUser": "no", "ExecMainCode": "0", "ExecMainExitTimestampMonotonic": "0", "ExecMainPID": "2152", "ExecMainStartTimestamp": "Thu 2026-03-26 09:05:15 UTC", "ExecMainStartTimestampMonotonic": "156618057", "ExecMainStatus": "0", "ExecStart": "{ path=/sbin/auditd ; argv[]=/sbin/auditd ; ignore_errors=no ; start_time=[Thu 2026-03-26 09:05:15 UTC] ; stop_time=[Thu 2026-03-26 09:05:15 UTC] ; pid=2151 ; code=exited ; status=0 }", "ExecStartEx": "{ path=/sbin/auditd ; argv[]=/sbin/auditd ; flags= ; start_time=[Thu 2026-03-26 09:05:15 UTC] ; stop_time=[Thu 2026-03-26 09:05:15 UTC] ; pid=2151 ; code=exited ; status=0 }", "ExecStartPost": "{ path=/sbin/augenrules ; argv[]=/sbin/augenrules --load ; ignore_errors=yes ; start_time=[Thu 2026-03-26 09:05:15 UTC] ; stop_time=[Thu 2026-03-26 09:05:15 UTC] ; pid=2156 ; code=exited ; status=0 }", "ExecStartPostEx": "{ path=/sbin/augenrules ; argv[]=/sbin/augenrules --load ; flags=ignore-failure ; start_time=[Thu 2026-03-26 09:05:15 UTC] ; stop_time=[Thu 2026-03-26 09:05:15 UTC] ; pid=2156 ; code=exited ; status=0 }", "ExitType": "main", "ExtensionImagePolicy": "root=verity+signed+encrypted+unprotected+absent:usr=verity+signed+encrypted+unprotected+absent:home=encrypted+unprotected+absent:srv=encrypted+unprotected+absent:tmp=encrypted+unprotected+absent:var=encrypted+unprotected+absent", "FailureAction": "none", "FileDescriptorStoreMax": "0", "FileDescriptorStorePreserve": "restart", "FinalKillSignal": "9", "FragmentPath": "/usr/lib/systemd/system/auditd.service", "FreezerState": "running", "GID": "[not set]", "GuessMainPID": "yes", "IOAccounting": "no", "IOReadBytes": "[not set]", "IOReadOperations": "[not set]", "IOSchedulingClass": "2", "IOSchedulingPriority": "4", "IOWeight": "[not set]", "IOWriteBytes": "[not set]", "IOWriteOperations": "[not set]", "IPAccounting": "no", "IPEgressBytes": "[no data]", "IPEgressPackets": "[no data]", "IPIngressBytes": "[no data]", "IPIngressPackets": "[no data]", "Id": "auditd.service", "IgnoreOnIsolate": "no", "IgnoreSIGPIPE": "yes", "InactiveEnterTimestampMonotonic": "0", "InactiveExitTimestamp": "Thu 2026-03-26 09:05:15 UTC", "InactiveExitTimestampMonotonic": "156592355", "InvocationID": "a737b3359c604722a9ba5327657e3993", "JobRunningTimeoutUSec": "infinity", "JobTimeoutAction": "none", "JobTimeoutUSec": "infinity", "KeyringMode": "private", "KillMode": "control-group", "KillSignal": "15", "LimitAS": "infinity", "LimitASSoft": "infinity", "LimitCORE": "infinity", "LimitCORESoft": "0", "LimitCPU": "infinity", "LimitCPUSoft": "infinity", "LimitDATA": "infinity", "LimitDATASoft": "infinity", "LimitFSIZE": "infinity", "LimitFSIZESoft": "infinity", "LimitLOCKS": "infinity", "LimitLOCKSSoft": "infinity", "LimitMEMLOCK": "8388608", "LimitMEMLOCKSoft": "8388608", "LimitMSGQUEUE": "819200", "LimitMSGQUEUESoft": "819200", "LimitNICE": "0", "LimitNICESoft": "0", "LimitNOFILE": "524288", "LimitNOFILESoft": "1024", "LimitNPROC": "15372", "LimitNPROCSoft": "15372", "LimitRSS": "infinity", "LimitRSSSoft": "infinity", "LimitRTPRIO": "0", "LimitRTPRIOSoft": "0", "LimitRTTIME": "infinity", "LimitRTTIMESoft": "infinity", "LimitSIGPENDING": "15372", "LimitSIGPENDINGSoft": "15372", "LimitSTACK": "infinity", "LimitSTACKSoft": "8388608", "LoadState": "loaded", "LockPersonality": "yes", "LogLevelMax": "-1", "LogRateLimitBurst": "0", "LogRateLimitIntervalUSec": "0", "LogsDirectoryMode": "0755", "MainPID": "2152", "ManagedOOMMemoryPressure": "auto", "ManagedOOMMemoryPressureLimit": "0", "ManagedOOMPreference": "none", "ManagedOOMSwap": "auto", "MemoryAccounting": "yes", "MemoryAvailable": "3530100736", "MemoryCurrent": "520192", "MemoryDenyWriteExecute": "yes", "MemoryHigh": "infinity", "MemoryKSM": "no", "MemoryLimit": "infinity", "MemoryLow": "0", "MemoryMax": "infinity", "MemoryMin": "0", "MemoryPeak": "1970176", "MemoryPressureThresholdUSec": "200ms", "MemoryPressureWatch": "auto", "MemorySwapCurrent": "0", "MemorySwapMax": "infinity", "MemorySwapPeak": "0", "MemoryZSwapCurrent": "0", "MemoryZSwapMax": "infinity", "MountAPIVFS": "no", "MountImagePolicy": "root=verity+signed+encrypted+unprotected+absent:usr=verity+signed+encrypted+unprotected+absent:home=encrypted+unprotected+absent:srv=encrypted+unprotected+absent:tmp=encrypted+unprotected+absent:var=encrypted+unprotected+absent", "NFileDescriptorStore": "0", "NRestarts": "0", "NUMAPolicy": "n/a", "Names": "auditd.service", "NeedDaemonReload": "no", "Nice": "0", "NoNewPrivileges": "no", "NonBlocking": "no", "NotifyAccess": "none", "OOMPolicy": "stop", "OOMScoreAdjust": "0", "OnFailureJobMode": "replace", "OnSuccessJobMode": "fail", "PIDFile": "/run/auditd.pid", "Perpetual": "no", "PrivateDevices": "no", "PrivateIPC": "no", "PrivateMounts": "no", "PrivateNetwork": "no", "PrivateTmp": "no", "PrivateUsers": "no", "ProcSubset": "all", "ProtectClock": "no", "ProtectControlGroups": "no", "ProtectHome": "no", "ProtectHostname": "no", "ProtectKernelLogs": "no", "ProtectKernelModules": "yes", "ProtectKernelTunables": "no", "ProtectProc": "default", "ProtectSystem": "no", "RefuseManualStart": "no", "RefuseManualStop": "no", "ReloadResult": "success", "ReloadSignal": "1", "RemainAfterExit": "no", "RemoveIPC": "no", "Requires": "system.slice", "Restart": "on-failure", "RestartKillSignal": "15", "RestartMaxDelayUSec": "infinity", "RestartMode": "normal", "RestartPreventExitStatus": "2 4 6", "RestartSteps": "0", "RestartUSec": "100ms", "RestartUSecNext": "100ms", "RestrictNamespaces": "no", "RestrictRealtime": "yes", "RestrictSUIDSGID": "no", "Result": "success", "RootDirectoryStartOnly": "no", "RootEphemeral": "no", "RootImagePolicy": "root=verity+signed+encrypted+unprotected+absent:usr=verity+signed+encrypted+unprotected+absent:home=encrypted+unprotected+absent:srv=encrypted+unprotected+absent:tmp=encrypted+unprotected+absent:var=encrypted+unprotected+absent", "RuntimeDirectoryMode": "0755", "RuntimeDirectoryPreserve": "no", "RuntimeMaxUSec": "infinity", "RuntimeRandomizedExtraUSec": "0", "SameProcessGroup": "no", "SecureBits": "0", "SendSIGHUP": "no", "SendSIGKILL": "yes", "SetLoginEnvironment": "no", "Slice": "system.slice", "StandardError": "inherit", "StandardInput": "null", "StandardOutput": "journal", "StartLimitAction": "none", "StartLimitBurst": "5", "StartLimitIntervalUSec": "10s", "StartupBlockIOWeight": "[not set]", "StartupCPUShares": "[not set]", "StartupCPUWeight": "[not set]", "StartupIOWeight": "[not set]", "StartupMemoryHigh": "infinity", "StartupMemoryLow": "0", "StartupMemoryMax": "infinity", "StartupMemorySwapMax": "infinity", "StartupMemoryZSwapMax": "infinity", "StateChangeTimestamp": "Thu 2026-03-26 09:05:15 UTC", "StateChangeTimestampMonotonic": "156662932", "StateDirectoryMode": "0755", "StatusErrno": "0", "StopWhenUnneeded": "no", "SubState": "running", "SuccessAction": "none", "SurviveFinalKillSignal": "no", "SyslogFacility": "3", "SyslogLevel": "6", "SyslogLevelPrefix": "yes", "SyslogPriority": "30", "SystemCallErrorNumber": "2147483646", "TTYReset": "no", "TTYVHangup": "no", "TTYVTDisallocate": "no", "TasksAccounting": "yes", "TasksCurrent": "2", "TasksMax": "4611", "TimeoutAbortUSec": "1min 30s", "TimeoutCleanUSec": "infinity", "TimeoutStartFailureMode": "terminate", "TimeoutStartUSec": "1min 30s", "TimeoutStopFailureMode": "terminate", "TimeoutStopUSec": "1min 30s", "TimerSlackNSec": "50000", "Transient": "no", "Type": "forking", "UID": "[not set]", "UMask": "0022", "UnitFilePreset": "enabled", "UnitFileState": "enabled", "UtmpMode": "init", "WantedBy": "multi-user.target", "WatchdogSignal": "6", "WatchdogTimestampMonotonic": "0", "WatchdogUSec": "0"}} 2026-03-26 09:05:26.640939 | ubuntu-noble | 2026-03-26 09:05:26.640978 | ubuntu-noble | RUNNING HANDLER [auditd : Generate auditd rules] ******************************* 2026-03-26 09:05:27.107173 | ubuntu-noble | changed: [molecule-auditd] => {"changed": true, "cmd": ["augenrules", "--load"], "delta": "0:00:00.077281", "end": "2026-03-26 09:05:27.035942", "msg": "", "rc": 0, "start": "2026-03-26 09:05:26.958661", "stderr": "Unknown user: chrony\nThere was an error in line 24 of /etc/audit/audit.rules\nError sending add rule data request (No such file or directory)\nThere was an error in line 28 of /etc/audit/audit.rules\nUnknown user: ntp\nThere was an error in line 44 of /etc/audit/audit.rules\nError sending add rule data request (No such file or directory)\nThere was an error in line 83 of /etc/audit/audit.rules\nError sending add rule data request (No such file or directory)\nThere was an error in line 84 of /etc/audit/audit.rules\nError sending add rule data request (No such file or directory)\nThere was an error in line 86 of /etc/audit/audit.rules\nError sending add rule data request (No such file or directory)\nThere was an error in line 112 of /etc/audit/audit.rules\nError sending add rule data request (No such file or directory)\nThere was an error in line 115 of /etc/audit/audit.rules\nError sending add rule data request (No such file or directory)\nThere was an error in line 176 of /etc/audit/audit.rules\nError sending add rule data request (No such file or directory)\nThere was an error in line 177 of /etc/audit/audit.rules\nError sending add rule data request (No such file or directory)\nThere was an error in line 178 of /etc/audit/audit.rules\nError sending add rule data request (No such file or directory)\nThere was an error in line 179 of /etc/audit/audit.rules\nError sending add rule data request (No such file or directory)\nThere was an error in line 180 of /etc/audit/audit.rules\nError sending add rule data request (No such file or directory)\nThere was an error in line 217 of /etc/audit/audit.rules\nError sending add rule data request (No such file or directory)\nThere was an error in line 218 of /etc/audit/audit.rules\nError sending add rule data request (No such file or directory)\nThere was an error in line 234 of /etc/audit/audit.rules\nError sending add rule data request (No such file or directory)\nThere was an error in line 285 of /etc/audit/audit.rules\nError sending add rule data request (No such file or directory)\nThere was an error in line 286 of /etc/audit/audit.rules\nError sending add rule data request (No such file or directory)\nThere was an error in line 324 of /etc/audit/audit.rules\nError sending add rule data request (No such file or directory)\nThere was an error in line 325 of /etc/audit/audit.rules\nError sending add rule data request (No such file or directory)\nThere was an error in line 346 of /etc/audit/audit.rules\nparameter passed without an option given\nThere was an error in line 347 of /etc/audit/audit.rules\nparameter passed without an option given\nThere was an error in line 348 of /etc/audit/audit.rules\nparameter passed without an option given\nThere was an error in line 349 of /etc/audit/audit.rules\nparameter passed without an option given\nThere was an error in line 350 of /etc/audit/audit.rules\nparameter passed without an option given\nThere was an error in line 351 of /etc/audit/audit.rules\nError sending add rule data request (No such file or directory)\nThere was an error in line 359 of /etc/audit/audit.rules", "stderr_lines": ["Unknown user: chrony", "There was an error in line 24 of /etc/audit/audit.rules", "Error sending add rule data request (No such file or directory)", "There was an error in line 28 of /etc/audit/audit.rules", "Unknown user: ntp", "There was an error in line 44 of /etc/audit/audit.rules", "Error sending add rule data request (No such file or directory)", "There was an error in line 83 of /etc/audit/audit.rules", "Error sending add rule data request (No such file or directory)", "There was an error in line 84 of /etc/audit/audit.rules", "Error sending add rule data request (No such file or directory)", "There was an error in line 86 of /etc/audit/audit.rules", "Error sending add rule data request (No such file or directory)", "There was an error in line 112 of /etc/audit/audit.rules", "Error sending add rule data request (No such file or directory)", "There was an error in line 115 of /etc/audit/audit.rules", "Error sending add rule data request (No such file or directory)", "There was an error in line 176 of /etc/audit/audit.rules", "Error sending add rule data request (No such file or directory)", "There was an error in line 177 of /etc/audit/audit.rules", "Error sending add rule data request (No such file or directory)", "There was an error in line 178 of /etc/audit/audit.rules", "Error sending add rule data request (No such file or directory)", "There was an error in line 179 of /etc/audit/audit.rules", "Error sending add rule data request (No such file or directory)", "There was an error in line 180 of /etc/audit/audit.rules", "Error sending add rule data request (No such file or directory)", "There was an error in line 217 of /etc/audit/audit.rules", "Error sending add rule data request (No such file or directory)", "There was an error in line 218 of /etc/audit/audit.rules", "Error sending add rule data request (No such file or directory)", "There was an error in line 234 of /etc/audit/audit.rules", "Error sending add rule data request (No such file or directory)", "There was an error in line 285 of /etc/audit/audit.rules", "Error sending add rule data request (No such file or directory)", "There was an error in line 286 of /etc/audit/audit.rules", "Error sending add rule data request (No such file or directory)", "There was an error in line 324 of /etc/audit/audit.rules", "Error sending add rule data request (No such file or directory)", "There was an error in line 325 of /etc/audit/audit.rules", "Error sending add rule data request (No such file or directory)", "There was an error in line 346 of /etc/audit/audit.rules", "parameter passed without an option given", "There was an error in line 347 of /etc/audit/audit.rules", "parameter passed without an option given", "There was an error in line 348 of /etc/audit/audit.rules", "parameter passed without an option given", "There was an error in line 349 of /etc/audit/audit.rules", "parameter passed without an option given", "There was an error in line 350 of /etc/audit/audit.rules", "parameter passed without an option given", "There was an error in line 351 of /etc/audit/audit.rules", "Error sending add rule data request (No such file or directory)", "There was an error in line 359 of /etc/audit/audit.rules"], "stdout": "/usr/sbin/augenrules: No change\nNo rules\nenabled 1\nfailure 1\npid 2548\nrate_limit 0\nbacklog_limit 8192\nlost 0\nbacklog 1385\nbacklog_wait_time 60000\nbacklog_wait_time_actual 0\nenabled 1\nfailure 1\npid 2548\nrate_limit 0\nbacklog_limit 8192\nlost 0\nbacklog 1383\nbacklog_wait_time 60000\nbacklog_wait_time_actual 0", "stdout_lines": ["/usr/sbin/augenrules: No change", "No rules", "enabled 1", "failure 1", "pid 2548", "rate_limit 0", "backlog_limit 8192", "lost 0", "backlog 1385", "backlog_wait_time 60000", "backlog_wait_time_actual 0", "enabled 1", "failure 1", "pid 2548", "rate_limit 0", "backlog_limit 8192", "lost 0", "backlog 1383", "backlog_wait_time 60000", "backlog_wait_time_actual 0"]} 2026-03-26 09:05:27.107265 | ubuntu-noble | 2026-03-26 09:05:27.107279 | ubuntu-noble | RUNNING HANDLER [auditd : Restart auditd service] ****************************** 2026-03-26 09:05:28.236589 | ubuntu-noble | ok: Runtime: 0:00:23.785308 2026-03-26 09:05:28.260473 | 2026-03-26 09:05:28.260659 | TASK [ansible-molecule : Run molecule verify action with scenario delegated] 2026-03-26 09:05:27.989164 | ubuntu-noble | changed: [molecule-auditd] => {"changed": true, "name": "auditd", "state": "started", "status": {"ActiveEnterTimestamp": "Thu 2026-03-26 09:05:26 UTC", "ActiveEnterTimestampMonotonic": "168059458", "ActiveExitTimestamp": "Thu 2026-03-26 09:05:26 UTC", "ActiveExitTimestampMonotonic": "167879114", "ActiveState": "active", "After": "systemd-tmpfiles-setup.service system.slice local-fs.target systemd-journald.socket", "AllowIsolate": "no", "AssertResult": "yes", "AssertTimestamp": "Thu 2026-03-26 09:05:26 UTC", "AssertTimestampMonotonic": "167922328", "Before": "systemd-update-utmp.service shutdown.target ssh.service sysinit.target", "BlockIOAccounting": "no", "BlockIOWeight": "[not set]", "CPUAccounting": "yes", "CPUAffinityFromNUMA": "no", "CPUQuotaPerSecUSec": "infinity", "CPUQuotaPeriodUSec": "infinity", "CPUSchedulingPolicy": "0", "CPUSchedulingPriority": "0", "CPUSchedulingResetOnFork": "no", "CPUShares": "[not set]", "CPUUsageNSec": "198146000", "CPUWeight": "[not set]", "CacheDirectoryMode": "0755", "CanFreeze": "yes", "CanIsolate": "no", "CanReload": "no", "CanStart": "yes", "CanStop": "yes", "CapabilityBoundingSet": "cap_chown cap_dac_override cap_dac_read_search cap_fowner cap_fsetid cap_kill cap_setgid cap_setuid cap_setpcap cap_linux_immutable cap_net_bind_service cap_net_broadcast cap_net_admin cap_net_raw cap_ipc_lock cap_ipc_owner cap_sys_rawio cap_sys_chroot cap_sys_ptrace cap_sys_pacct cap_sys_admin cap_sys_boot cap_sys_nice cap_sys_resource cap_sys_time cap_sys_tty_config cap_mknod cap_lease cap_audit_write cap_audit_control cap_setfcap cap_mac_override cap_mac_admin cap_syslog cap_wake_alarm cap_block_suspend cap_audit_read cap_perfmon cap_bpf cap_checkpoint_restore", "CleanResult": "success", "CollectMode": "inactive", "ConditionResult": "yes", "ConditionTimestamp": "Thu 2026-03-26 09:05:26 UTC", "ConditionTimestampMonotonic": "167922221", "ConfigurationDirectoryMode": "0755", "Conflicts": "shutdown.target", "ControlGroup": "/system.slice/auditd.service", "ControlGroupId": "3868", "ControlPID": "0", "CoredumpFilter": "0x33", "CoredumpReceive": "no", "DefaultDependencies": "no", "DefaultMemoryLow": "0", "DefaultMemoryMin": "0", "DefaultStartupMemoryLow": "0", "Delegate": "no", "Description": "Security Auditing Service", "DevicePolicy": "auto", "Documentation": "\"man:auditd(8)\" https://github.com/linux-audit/audit-documentation", "DynamicUser": "no", "ExecMainCode": "0", "ExecMainExitTimestampMonotonic": "0", "ExecMainPID": "2548", "ExecMainStartTimestamp": "Thu 2026-03-26 09:05:26 UTC", "ExecMainStartTimestampMonotonic": "167951754", "ExecMainStatus": "0", "ExecStart": "{ path=/sbin/auditd ; argv[]=/sbin/auditd ; ignore_errors=no ; start_time=[Thu 2026-03-26 09:05:26 UTC] ; stop_time=[Thu 2026-03-26 09:05:26 UTC] ; pid=2547 ; code=exited ; status=0 }", "ExecStartEx": "{ path=/sbin/auditd ; argv[]=/sbin/auditd ; flags= ; start_time=[Thu 2026-03-26 09:05:26 UTC] ; stop_time=[Thu 2026-03-26 09:05:26 UTC] ; pid=2547 ; code=exited ; status=0 }", "ExecStartPost": "{ path=/sbin/augenrules ; argv[]=/sbin/augenrules --load ; ignore_errors=yes ; start_time=[Thu 2026-03-26 09:05:26 UTC] ; stop_time=[Thu 2026-03-26 09:05:26 UTC] ; pid=2551 ; code=exited ; status=0 }", "ExecStartPostEx": "{ path=/sbin/augenrules ; argv[]=/sbin/augenrules --load ; flags=ignore-failure ; start_time=[Thu 2026-03-26 09:05:26 UTC] ; stop_time=[Thu 2026-03-26 09:05:26 UTC] ; pid=2551 ; code=exited ; status=0 }", "ExitType": "main", "ExtensionImagePolicy": "root=verity+signed+encrypted+unprotected+absent:usr=verity+signed+encrypted+unprotected+absent:home=encrypted+unprotected+absent:srv=encrypted+unprotected+absent:tmp=encrypted+unprotected+absent:var=encrypted+unprotected+absent", "FailureAction": "none", "FileDescriptorStoreMax": "0", "FileDescriptorStorePreserve": "restart", "FinalKillSignal": "9", "FragmentPath": "/usr/lib/systemd/system/auditd.service", "FreezerState": "running", "GID": "[not set]", "GuessMainPID": "yes", "IOAccounting": "no", "IOReadBytes": "[not set]", "IOReadOperations": "[not set]", "IOSchedulingClass": "2", "IOSchedulingPriority": "4", "IOWeight": "[not set]", "IOWriteBytes": "[not set]", "IOWriteOperations": "[not set]", "IPAccounting": "no", "IPEgressBytes": "[no data]", "IPEgressPackets": "[no data]", "IPIngressBytes": "[no data]", "IPIngressPackets": "[no data]", "Id": "auditd.service", "IgnoreOnIsolate": "no", "IgnoreSIGPIPE": "yes", "InactiveEnterTimestamp": "Thu 2026-03-26 09:05:26 UTC", "InactiveEnterTimestampMonotonic": "167919496", "InactiveExitTimestamp": "Thu 2026-03-26 09:05:26 UTC", "InactiveExitTimestampMonotonic": "167930676", "InvocationID": "82e212f6661a440cb7bb00cdc29a33f4", "JobRunningTimeoutUSec": "infinity", "JobTimeoutAction": "none", "JobTimeoutUSec": "infinity", "KeyringMode": "private", "KillMode": "control-group", "KillSignal": "15", "LimitAS": "infinity", "LimitASSoft": "infinity", "LimitCORE": "infinity", "LimitCORESoft": "0", "LimitCPU": "infinity", "LimitCPUSoft": "infinity", "LimitDATA": "infinity", "LimitDATASoft": "infinity", "LimitFSIZE": "infinity", "LimitFSIZESoft": "infinity", "LimitLOCKS": "infinity", "LimitLOCKSSoft": "infinity", "LimitMEMLOCK": "8388608", "LimitMEMLOCKSoft": "8388608", "LimitMSGQUEUE": "819200", "LimitMSGQUEUESoft": "819200", "LimitNICE": "0", "LimitNICESoft": "0", "LimitNOFILE": "524288", "LimitNOFILESoft": "1024", "LimitNPROC": "15372", "LimitNPROCSoft": "15372", "LimitRSS": "infinity", "LimitRSSSoft": "infinity", "LimitRTPRIO": "0", "LimitRTPRIOSoft": "0", "LimitRTTIME": "infinity", "LimitRTTIMESoft": "infinity", "LimitSIGPENDING": "15372", "LimitSIGPENDINGSoft": "15372", "LimitSTACK": "infinity", "LimitSTACKSoft": "8388608", "LoadState": "loaded", "LockPersonality": "yes", "LogLevelMax": "-1", "LogRateLimitBurst": "0", "LogRateLimitIntervalUSec": "0", "LogsDirectoryMode": "0755", "MainPID": "2548", "ManagedOOMMemoryPressure": "auto", "ManagedOOMMemoryPressureLimit": "0", "ManagedOOMPreference": "none", "ManagedOOMSwap": "auto", "MemoryAccounting": "yes", "MemoryAvailable": "3529990144", "MemoryCurrent": "1863680", "MemoryDenyWriteExecute": "yes", "MemoryHigh": "infinity", "MemoryKSM": "no", "MemoryLimit": "infinity", "MemoryLow": "0", "MemoryMax": "infinity", "MemoryMin": "0", "MemoryPeak": "2142208", "MemoryPressureThresholdUSec": "200ms", "MemoryPressureWatch": "auto", "MemorySwapCurrent": "0", "MemorySwapMax": "infinity", "MemorySwapPeak": "0", "MemoryZSwapCurrent": "0", "MemoryZSwapMax": "infinity", "MountAPIVFS": "no", "MountImagePolicy": "root=verity+signed+encrypted+unprotected+absent:usr=verity+signed+encrypted+unprotected+absent:home=encrypted+unprotected+absent:srv=encrypted+unprotected+absent:tmp=encrypted+unprotected+absent:var=encrypted+unprotected+absent", "NFileDescriptorStore": "0", "NRestarts": "0", "NUMAPolicy": "n/a", "Names": "auditd.service", "NeedDaemonReload": "no", "Nice": "0", "NoNewPrivileges": "no", "NonBlocking": "no", "NotifyAccess": "none", "OOMPolicy": "stop", "OOMScoreAdjust": "0", "OnFailureJobMode": "replace", "OnSuccessJobMode": "fail", "PIDFile": "/run/auditd.pid", "Perpetual": "no", "PrivateDevices": "no", "PrivateIPC": "no", "PrivateMounts": "no", "PrivateNetwork": "no", "PrivateTmp": "no", "PrivateUsers": "no", "ProcSubset": "all", "ProtectClock": "no", "ProtectControlGroups": "no", "ProtectHome": "no", "ProtectHostname": "no", "ProtectKernelLogs": "no", "ProtectKernelModules": "yes", "ProtectKernelTunables": "no", "ProtectProc": "default", "ProtectSystem": "no", "RefuseManualStart": "no", "RefuseManualStop": "no", "ReloadResult": "success", "ReloadSignal": "1", "RemainAfterExit": "no", "RemoveIPC": "no", "Requires": "system.slice", "Restart": "on-failure", "RestartKillSignal": "15", "RestartMaxDelayUSec": "infinity", "RestartMode": "normal", "RestartPreventExitStatus": "2 4 6", "RestartSteps": "0", "RestartUSec": "100ms", "RestartUSecNext": "100ms", "RestrictNamespaces": "no", "RestrictRealtime": "yes", "RestrictSUIDSGID": "no", "Result": "success", "RootDirectoryStartOnly": "no", "RootEphemeral": "no", "RootImagePolicy": "root=verity+signed+encrypted+unprotected+absent:usr=verity+signed+encrypted+unprotected+absent:home=encrypted+unprotected+absent:srv=encrypted+unprotected+absent:tmp=encrypted+unprotected+absent:var=encrypted+unprotected+absent", "RuntimeDirectoryMode": "0755", "RuntimeDirectoryPreserve": "no", "RuntimeMaxUSec": "infinity", "RuntimeRandomizedExtraUSec": "0", "SameProcessGroup": "no", "SecureBits": "0", "SendSIGHUP": "no", "SendSIGKILL": "yes", "SetLoginEnvironment": "no", "Slice": "system.slice", "StandardError": "inherit", "StandardInput": "null", "StandardOutput": "journal", "StartLimitAction": "none", "StartLimitBurst": "5", "StartLimitIntervalUSec": "10s", "StartupBlockIOWeight": "[not set]", "StartupCPUShares": "[not set]", "StartupCPUWeight": "[not set]", "StartupIOWeight": "[not set]", "StartupMemoryHigh": "infinity", "StartupMemoryLow": "0", "StartupMemoryMax": "infinity", "StartupMemorySwapMax": "infinity", "StartupMemoryZSwapMax": "infinity", "StateChangeTimestamp": "Thu 2026-03-26 09:05:26 UTC", "StateChangeTimestampMonotonic": "168059458", "StateDirectoryMode": "0755", "StatusErrno": "0", "StopWhenUnneeded": "no", "SubState": "running", "SuccessAction": "none", "SurviveFinalKillSignal": "no", "SyslogFacility": "3", "SyslogLevel": "6", "SyslogLevelPrefix": "yes", "SyslogPriority": "30", "SystemCallErrorNumber": "2147483646", "TTYReset": "no", "TTYVHangup": "no", "TTYVTDisallocate": "no", "TasksAccounting": "yes", "TasksCurrent": "2", "TasksMax": "4611", "TimeoutAbortUSec": "1min 30s", "TimeoutCleanUSec": "infinity", "TimeoutStartFailureMode": "terminate", "TimeoutStartUSec": "1min 30s", "TimeoutStopFailureMode": "terminate", "TimeoutStopUSec": "1min 30s", "TimerSlackNSec": "50000", "Transient": "no", "Type": "forking", "UID": "[not set]", "UMask": "0022", "UnitFilePreset": "enabled", "UnitFileState": "enabled", "UtmpMode": "init", "WantedBy": "multi-user.target", "WatchdogSignal": "6", "WatchdogTimestampMonotonic": "0", "WatchdogUSec": "0"}} 2026-03-26 09:05:27.989630 | ubuntu-noble | 2026-03-26 09:05:27.989878 | ubuntu-noble | PLAY RECAP ********************************************************************* 2026-03-26 09:05:27.990162 | ubuntu-noble | molecule-auditd : ok=15 changed=8 unreachable=0 failed=0 skipped=0 rescued=0 ignored=0 2026-03-26 09:05:27.990351 | ubuntu-noble | 2026-03-26 09:05:28.087524 | ubuntu-noble | INFO [delegated > converge] Executed: Successful 2026-03-26 09:05:28.088387 | ubuntu-noble | WARNING Molecule executed 1 scenario (1 missing files) 2026-03-26 09:05:29.120688 | ubuntu-noble | WARNING Molecule scenarios should migrate to 'extensions/molecule' 2026-03-26 09:05:29.131962 | ubuntu-noble | DEBUG [unknown > config] provisioner.env found in /home/zuul/src/github.com/osism/ansible-collection-services/molecule/delegated/molecule.yml, this can be defined in ansible.env 2026-03-26 09:05:29.035577 | debian-bookworm | WARNING Molecule scenarios should migrate to 'extensions/molecule' 2026-03-26 09:05:29.047561 | debian-bookworm | DEBUG [unknown > config] provisioner.env found in /home/zuul/src/github.com/osism/ansible-collection-services/molecule/delegated/molecule.yml, this can be defined in ansible.env 2026-03-26 09:05:29.682597 | ubuntu-noble | DEBUG [unknown > config] provisioner.env found in /home/zuul/src/github.com/osism/ansible-collection-services/molecule/delegated/molecule.yml, this can be defined in ansible.env 2026-03-26 09:05:29.683397 | ubuntu-noble | DEBUG [delegated > validate] Validating schema /home/zuul/src/github.com/osism/ansible-collection-services/molecule/delegated/molecule.yml. 2026-03-26 09:05:29.697525 | ubuntu-noble | CRITICAL 'molecule/default/molecule.yml' glob failed. Exiting. 2026-03-26 09:05:29.697611 | ubuntu-noble | INFO default scenario not found, disabling shared state. 2026-03-26 09:05:29.700345 | ubuntu-noble | INFO [delegated > discovery] scenario test matrix: verify 2026-03-26 09:05:29.700394 | ubuntu-noble | INFO [delegated > prerun] Performing prerun with role_name_check=0... 2026-03-26 09:05:29.593210 | debian-bookworm | DEBUG [unknown > config] provisioner.env found in /home/zuul/src/github.com/osism/ansible-collection-services/molecule/delegated/molecule.yml, this can be defined in ansible.env 2026-03-26 09:05:29.593900 | debian-bookworm | DEBUG [delegated > validate] Validating schema /home/zuul/src/github.com/osism/ansible-collection-services/molecule/delegated/molecule.yml. 2026-03-26 09:05:29.606336 | debian-bookworm | CRITICAL 'molecule/default/molecule.yml' glob failed. Exiting. 2026-03-26 09:05:29.606440 | debian-bookworm | INFO default scenario not found, disabling shared state. 2026-03-26 09:05:29.606713 | debian-bookworm | INFO [delegated > discovery] scenario test matrix: verify 2026-03-26 09:05:29.606872 | debian-bookworm | INFO [delegated > prerun] Performing prerun with role_name_check=0... 2026-03-26 09:05:31.305749 | debian-bookworm | INFO [delegated > verify] Executing 2026-03-26 09:05:31.307306 | debian-bookworm | INFO [delegated > verify] Executing Testinfra tests found in /home/zuul/src/github.com/osism/ansible-collection-services/molecule/delegated/tests/... 2026-03-26 09:05:31.308375 | debian-bookworm | DEBUG ANSIBLE ENVIRONMENT: 2026-03-26 09:05:31.308391 | debian-bookworm | ANSIBLE_COLLECTIONS_PATH: /home/zuul/venv/.ansible/collections:/home/zuul/.ansible/collections 2026-03-26 09:05:31.308398 | debian-bookworm | ANSIBLE_CONFIG: /home/zuul/.ansible/tmp/molecule.oWZD.delegated/ansible.cfg 2026-03-26 09:05:31.308405 | debian-bookworm | ANSIBLE_LIBRARY: ../../plugins 2026-03-26 09:05:31.308411 | debian-bookworm | ANSIBLE_PYTHON_INTERPRETER: /home/zuul/venv/bin/python 2026-03-26 09:05:31.308416 | debian-bookworm | ANSIBLE_ROLE: auditd 2026-03-26 09:05:31.308421 | debian-bookworm | ANSIBLE_ROLES_PATH: ../../roles 2026-03-26 09:05:31.308427 | debian-bookworm | ANSIBLE_VERBOSITY: 1 2026-03-26 09:05:31.308432 | debian-bookworm | 2026-03-26 09:05:31.308523 | debian-bookworm | DEBUG MOLECULE ENVIRONMENT: 2026-03-26 09:05:31.308533 | debian-bookworm | MOLECULE_DEBUG: True 2026-03-26 09:05:31.308538 | debian-bookworm | MOLECULE_DEPENDENCY_NAME: galaxy 2026-03-26 09:05:31.308543 | debian-bookworm | MOLECULE_DRIVER_NAME: default 2026-03-26 09:05:31.308548 | debian-bookworm | MOLECULE_ENV_FILE: /home/zuul/src/github.com/osism/ansible-collection-services/.env.yml 2026-03-26 09:05:31.308553 | debian-bookworm | MOLECULE_EPHEMERAL_DIRECTORY: /home/zuul/.ansible/tmp/molecule.oWZD.delegated 2026-03-26 09:05:31.308559 | debian-bookworm | MOLECULE_FILE: /home/zuul/.ansible/tmp/molecule.oWZD.delegated/molecule.yml 2026-03-26 09:05:31.308564 | debian-bookworm | MOLECULE_INSTANCE_CONFIG: /home/zuul/.ansible/tmp/molecule.oWZD.delegated/instance_config.yml 2026-03-26 09:05:31.308569 | debian-bookworm | MOLECULE_INVENTORY_FILE: /home/zuul/.ansible/tmp/molecule.oWZD.delegated/inventory/ansible_inventory.yml 2026-03-26 09:05:31.308575 | debian-bookworm | MOLECULE_PROJECT_DIRECTORY: /home/zuul/src/github.com/osism/ansible-collection-services 2026-03-26 09:05:31.308580 | debian-bookworm | MOLECULE_PROVISIONER_NAME: ansible 2026-03-26 09:05:31.308585 | debian-bookworm | MOLECULE_SCENARIO_DIRECTORY: /home/zuul/src/github.com/osism/ansible-collection-services/molecule/delegated 2026-03-26 09:05:31.308590 | debian-bookworm | MOLECULE_SCENARIO_NAME: delegated 2026-03-26 09:05:31.308595 | debian-bookworm | MOLECULE_STATE_FILE: /home/zuul/.ansible/tmp/molecule.oWZD.delegated/state.yml 2026-03-26 09:05:31.308600 | debian-bookworm | MOLECULE_VERIFIER_NAME: testinfra 2026-03-26 09:05:31.308606 | debian-bookworm | MOLECULE_VERIFIER_TEST_DIRECTORY: /home/zuul/src/github.com/osism/ansible-collection-services/molecule/delegated/tests 2026-03-26 09:05:31.308611 | debian-bookworm | 2026-03-26 09:05:31.308628 | debian-bookworm | DEBUG SHELL REPLAY: ANSIBLE_COLLECTIONS_PATH=/home/zuul/venv/.ansible/collections:/home/zuul/.ansible/collections ANSIBLE_CONFIG=/home/zuul/.ansible/tmp/molecule.oWZD.delegated/ansible.cfg ANSIBLE_LIBRARY=../../plugins ANSIBLE_PYTHON_INTERPRETER=/home/zuul/venv/bin/python ANSIBLE_ROLE=auditd ANSIBLE_ROLES_PATH=../../roles ANSIBLE_VERBOSITY=1 MOLECULE_DEBUG=True MOLECULE_DEPENDENCY_NAME=galaxy MOLECULE_DRIVER_NAME=default MOLECULE_ENV_FILE=/home/zuul/src/github.com/osism/ansible-collection-services/.env.yml MOLECULE_EPHEMERAL_DIRECTORY=/home/zuul/.ansible/tmp/molecule.oWZD.delegated MOLECULE_FILE=/home/zuul/.ansible/tmp/molecule.oWZD.delegated/molecule.yml MOLECULE_INSTANCE_CONFIG=/home/zuul/.ansible/tmp/molecule.oWZD.delegated/instance_config.yml MOLECULE_INVENTORY_FILE=/home/zuul/.ansible/tmp/molecule.oWZD.delegated/inventory/ansible_inventory.yml MOLECULE_PROJECT_DIRECTORY=/home/zuul/src/github.com/osism/ansible-collection-services MOLECULE_PROVISIONER_NAME=ansible MOLECULE_SCENARIO_DIRECTORY=/home/zuul/src/github.com/osism/ansible-collection-services/molecule/delegated MOLECULE_SCENARIO_NAME=delegated MOLECULE_STATE_FILE=/home/zuul/.ansible/tmp/molecule.oWZD.delegated/state.yml MOLECULE_VERIFIER_NAME=testinfra MOLECULE_VERIFIER_TEST_DIRECTORY=/home/zuul/src/github.com/osism/ansible-collection-services/molecule/delegated/tests 2026-03-26 09:05:31.416631 | ubuntu-noble | INFO [delegated > verify] Executing 2026-03-26 09:05:31.418670 | ubuntu-noble | INFO [delegated > verify] Executing Testinfra tests found in /home/zuul/src/github.com/osism/ansible-collection-services/molecule/delegated/tests/... 2026-03-26 09:05:31.420089 | ubuntu-noble | DEBUG ANSIBLE ENVIRONMENT: 2026-03-26 09:05:31.420117 | ubuntu-noble | ANSIBLE_COLLECTIONS_PATH: /home/zuul/venv/.ansible/collections:/home/zuul/.ansible/collections 2026-03-26 09:05:31.420127 | ubuntu-noble | ANSIBLE_CONFIG: /home/zuul/.ansible/tmp/molecule.oWZD.delegated/ansible.cfg 2026-03-26 09:05:31.420136 | ubuntu-noble | ANSIBLE_LIBRARY: ../../plugins 2026-03-26 09:05:31.420144 | ubuntu-noble | ANSIBLE_PYTHON_INTERPRETER: /home/zuul/venv/bin/python 2026-03-26 09:05:31.420151 | ubuntu-noble | ANSIBLE_ROLE: auditd 2026-03-26 09:05:31.420158 | ubuntu-noble | ANSIBLE_ROLES_PATH: ../../roles 2026-03-26 09:05:31.420165 | ubuntu-noble | ANSIBLE_VERBOSITY: 1 2026-03-26 09:05:31.420173 | ubuntu-noble | 2026-03-26 09:05:31.420278 | ubuntu-noble | DEBUG MOLECULE ENVIRONMENT: 2026-03-26 09:05:31.420288 | ubuntu-noble | MOLECULE_DEBUG: True 2026-03-26 09:05:31.420296 | ubuntu-noble | MOLECULE_DEPENDENCY_NAME: galaxy 2026-03-26 09:05:31.420303 | ubuntu-noble | MOLECULE_DRIVER_NAME: default 2026-03-26 09:05:31.420311 | ubuntu-noble | MOLECULE_ENV_FILE: /home/zuul/src/github.com/osism/ansible-collection-services/.env.yml 2026-03-26 09:05:31.420318 | ubuntu-noble | MOLECULE_EPHEMERAL_DIRECTORY: /home/zuul/.ansible/tmp/molecule.oWZD.delegated 2026-03-26 09:05:31.420326 | ubuntu-noble | MOLECULE_FILE: /home/zuul/.ansible/tmp/molecule.oWZD.delegated/molecule.yml 2026-03-26 09:05:31.420334 | ubuntu-noble | MOLECULE_INSTANCE_CONFIG: /home/zuul/.ansible/tmp/molecule.oWZD.delegated/instance_config.yml 2026-03-26 09:05:31.420342 | ubuntu-noble | MOLECULE_INVENTORY_FILE: /home/zuul/.ansible/tmp/molecule.oWZD.delegated/inventory/ansible_inventory.yml 2026-03-26 09:05:31.420351 | ubuntu-noble | MOLECULE_PROJECT_DIRECTORY: /home/zuul/src/github.com/osism/ansible-collection-services 2026-03-26 09:05:31.420360 | ubuntu-noble | MOLECULE_PROVISIONER_NAME: ansible 2026-03-26 09:05:31.420368 | ubuntu-noble | MOLECULE_SCENARIO_DIRECTORY: /home/zuul/src/github.com/osism/ansible-collection-services/molecule/delegated 2026-03-26 09:05:31.420377 | ubuntu-noble | MOLECULE_SCENARIO_NAME: delegated 2026-03-26 09:05:31.420386 | ubuntu-noble | MOLECULE_STATE_FILE: /home/zuul/.ansible/tmp/molecule.oWZD.delegated/state.yml 2026-03-26 09:05:31.420394 | ubuntu-noble | MOLECULE_VERIFIER_NAME: testinfra 2026-03-26 09:05:31.420403 | ubuntu-noble | MOLECULE_VERIFIER_TEST_DIRECTORY: /home/zuul/src/github.com/osism/ansible-collection-services/molecule/delegated/tests 2026-03-26 09:05:31.420411 | ubuntu-noble | 2026-03-26 09:05:31.420511 | ubuntu-noble | DEBUG SHELL REPLAY: ANSIBLE_COLLECTIONS_PATH=/home/zuul/venv/.ansible/collections:/home/zuul/.ansible/collections ANSIBLE_CONFIG=/home/zuul/.ansible/tmp/molecule.oWZD.delegated/ansible.cfg ANSIBLE_LIBRARY=../../plugins ANSIBLE_PYTHON_INTERPRETER=/home/zuul/venv/bin/python ANSIBLE_ROLE=auditd ANSIBLE_ROLES_PATH=../../roles ANSIBLE_VERBOSITY=1 MOLECULE_DEBUG=True MOLECULE_DEPENDENCY_NAME=galaxy MOLECULE_DRIVER_NAME=default MOLECULE_ENV_FILE=/home/zuul/src/github.com/osism/ansible-collection-services/.env.yml MOLECULE_EPHEMERAL_DIRECTORY=/home/zuul/.ansible/tmp/molecule.oWZD.delegated MOLECULE_FILE=/home/zuul/.ansible/tmp/molecule.oWZD.delegated/molecule.yml MOLECULE_INSTANCE_CONFIG=/home/zuul/.ansible/tmp/molecule.oWZD.delegated/instance_config.yml MOLECULE_INVENTORY_FILE=/home/zuul/.ansible/tmp/molecule.oWZD.delegated/inventory/ansible_inventory.yml MOLECULE_PROJECT_DIRECTORY=/home/zuul/src/github.com/osism/ansible-collection-services MOLECULE_PROVISIONER_NAME=ansible MOLECULE_SCENARIO_DIRECTORY=/home/zuul/src/github.com/osism/ansible-collection-services/molecule/delegated MOLECULE_SCENARIO_NAME=delegated MOLECULE_STATE_FILE=/home/zuul/.ansible/tmp/molecule.oWZD.delegated/state.yml MOLECULE_VERIFIER_NAME=testinfra MOLECULE_VERIFIER_TEST_DIRECTORY=/home/zuul/src/github.com/osism/ansible-collection-services/molecule/delegated/tests 2026-03-26 09:05:31.730104 | ubuntu-noble | writing pytest debug information to pytestdebug.log 2026-03-26 09:05:31.749124 | ubuntu-noble | ============================= test session starts ============================== 2026-03-26 09:05:31.749178 | ubuntu-noble | platform linux -- Python 3.12.3, pytest-8.4.2, pluggy-1.6.0 -- /home/zuul/venv/bin/python3 2026-03-26 09:05:31.749189 | ubuntu-noble | using: pytest-8.4.2 2026-03-26 09:05:31.749198 | ubuntu-noble | registered third-party plugins: 2026-03-26 09:05:31.749206 | ubuntu-noble | pytest-testinfra-10.2.2 at /home/zuul/venv/lib/python3.12/site-packages/testinfra/plugin.py 2026-03-26 09:05:31.749506 | ubuntu-noble | rootdir: /home/zuul 2026-03-26 09:05:31.749736 | ubuntu-noble | plugins: testinfra-10.2.2 2026-03-26 09:05:31.582004 | debian-bookworm | writing pytest debug information to pytestdebug.log 2026-03-26 09:05:31.596962 | debian-bookworm | ============================= test session starts ============================== 2026-03-26 09:05:31.597654 | debian-bookworm | platform linux -- Python 3.11.2, pytest-8.4.2, pluggy-1.6.0 -- /home/zuul/venv/bin/python3 2026-03-26 09:05:31.598142 | debian-bookworm | using: pytest-8.4.2 2026-03-26 09:05:31.598758 | debian-bookworm | registered third-party plugins: 2026-03-26 09:05:31.599139 | debian-bookworm | pytest-testinfra-10.2.2 at /home/zuul/venv/lib/python3.11/site-packages/testinfra/plugin.py 2026-03-26 09:05:31.599594 | debian-bookworm | rootdir: /home/zuul 2026-03-26 09:05:31.600060 | debian-bookworm | plugins: testinfra-10.2.2 2026-03-26 09:05:32.629791 | debian-bookworm | collecting ... collected 6 items 2026-03-26 09:05:32.630108 | debian-bookworm | 2026-03-26 09:05:33.023289 | ubuntu-noble | collecting ... collected 6 items 2026-03-26 09:05:33.023645 | ubuntu-noble | 2026-03-26 09:05:37.299326 | debian-bookworm | tests/auditd.py::test_pkg[ansible://molecule-auditd] PASSED [ 16%] 2026-03-26 09:05:37.808113 | ubuntu-noble | tests/auditd.py::test_pkg[ansible://molecule-auditd] PASSED [ 16%] 2026-03-26 09:05:37.342203 | debian-bookworm | tests/auditd.py::test_conffile[ansible://molecule-auditd] PASSED [ 33%] 2026-03-26 09:05:37.854381 | ubuntu-noble | tests/auditd.py::test_conffile[ansible://molecule-auditd] PASSED [ 33%] 2026-03-26 09:05:40.100450 | debian-bookworm | tests/auditd.py::test_adjustment[ansible://molecule-auditd] PASSED [ 50%] 2026-03-26 09:05:40.685437 | ubuntu-noble | tests/auditd.py::test_adjustment[ansible://molecule-auditd] PASSED [ 50%] 2026-03-26 09:05:46.318945 | ubuntu-noble | tests/auditd.py::test_rulefiles[ansible://molecule-auditd] PASSED [ 66%] 2026-03-26 09:05:45.929838 | debian-bookworm | tests/auditd.py::test_rulefiles[ansible://molecule-auditd] PASSED [ 66%] 2026-03-26 09:05:47.750737 | ubuntu-noble | tests/auditd.py::test_srv[ansible://molecule-auditd] PASSED [ 83%] 2026-03-26 09:05:47.403553 | debian-bookworm | tests/auditd.py::test_srv[ansible://molecule-auditd] PASSED [ 83%] 2026-03-26 09:05:47.517507 | debian-bookworm | wrote pytest debug information to pytestdebug.log 2026-03-26 09:05:47.518159 | debian-bookworm | tests/auditd.py::test_function[ansible://molecule-auditd] PASSED [100%] 2026-03-26 09:05:47.518644 | debian-bookworm | 2026-03-26 09:05:47.518963 | debian-bookworm | ============================== 6 passed in 15.86s ============================== 2026-03-26 09:05:47.584192 | debian-bookworm | INFO [delegated > verify] Verifier completed successfully. 2026-03-26 09:05:47.584393 | debian-bookworm | INFO [delegated > verify] Executed: Successful 2026-03-26 09:05:47.585475 | debian-bookworm | INFO Molecule executed 1 scenario (1 successful) 2026-03-26 09:05:47.837529 | debian-bookworm | ok: Runtime: 0:00:19.068395 2026-03-26 09:05:48.120235 | ubuntu-noble | ok: Runtime: 0:00:19.283001 2026-03-26 09:05:48.126413 | 2026-03-26 09:05:48.126560 | TASK [ansible-molecule : Run molecule destroy action with scenario delegated] 2026-03-26 09:05:47.831111 | ubuntu-noble | wrote pytest debug information to pytestdebug.log 2026-03-26 09:05:47.832571 | ubuntu-noble | tests/auditd.py::test_function[ansible://molecule-auditd] PASSED [100%] 2026-03-26 09:05:47.834131 | ubuntu-noble | 2026-03-26 09:05:47.834183 | ubuntu-noble | ============================== 6 passed in 16.03s ============================== 2026-03-26 09:05:47.903770 | ubuntu-noble | INFO [delegated > verify] Verifier completed successfully. 2026-03-26 09:05:47.903967 | ubuntu-noble | INFO [delegated > verify] Executed: Successful 2026-03-26 09:05:47.904672 | ubuntu-noble | INFO Molecule executed 1 scenario (1 successful) 2026-03-26 09:05:48.681605 | debian-bookworm | skipping: Conditional result was False 2026-03-26 09:05:48.682972 | ubuntu-noble | skipping: Conditional result was False 2026-03-26 09:05:48.705215 | 2026-03-26 09:05:48.705324 | PLAY RECAP 2026-03-26 09:05:48.705387 | debian-bookworm | ok: 17 changed: 12 unreachable: 0 failed: 0 skipped: 16 rescued: 0 ignored: 0 2026-03-26 09:05:48.705443 | ubuntu-noble | ok: 17 changed: 12 unreachable: 0 failed: 0 skipped: 16 rescued: 0 ignored: 0 2026-03-26 09:05:48.705468 | 2026-03-26 09:05:48.897174 | RUN END RESULT_NORMAL: [untrusted : github.com/osism/zuul-jobs/playbooks/ansible-molecule/run.yaml@main] 2026-03-26 09:05:48.900950 | POST-RUN START: [trusted : github.com/osism/zuul-config/playbooks/base/post.yaml@main] 2026-03-26 09:05:49.745544 | 2026-03-26 09:05:49.745721 | PLAY [Base post] 2026-03-26 09:05:49.759537 | 2026-03-26 09:05:49.759693 | TASK [remove-build-sshkey : Remove the build SSH key from all nodes] 2026-03-26 09:05:50.658383 | debian-bookworm | changed 2026-03-26 09:05:50.806460 | ubuntu-noble | changed 2026-03-26 09:05:50.824348 | 2026-03-26 09:05:50.824493 | PLAY RECAP 2026-03-26 09:05:50.824602 | debian-bookworm | ok: 1 changed: 1 unreachable: 0 failed: 0 skipped: 0 rescued: 0 ignored: 0 2026-03-26 09:05:50.824643 | ubuntu-noble | ok: 1 changed: 1 unreachable: 0 failed: 0 skipped: 0 rescued: 0 ignored: 0 2026-03-26 09:05:50.824670 | 2026-03-26 09:05:50.976106 | POST-RUN END RESULT_NORMAL: [trusted : github.com/osism/zuul-config/playbooks/base/post.yaml@main] 2026-03-26 09:05:50.979844 | POST-RUN START: [trusted : github.com/osism/zuul-config/playbooks/base/post-logs.yaml@main] 2026-03-26 09:05:51.827287 | 2026-03-26 09:05:51.827470 | PLAY [Base post-logs] 2026-03-26 09:05:51.838865 | 2026-03-26 09:05:51.839031 | TASK [generate-zuul-manifest : Generate Zuul manifest] 2026-03-26 09:05:52.376598 | localhost | changed 2026-03-26 09:05:52.394167 | 2026-03-26 09:05:52.394392 | TASK [generate-zuul-manifest : Return Zuul manifest URL to Zuul] 2026-03-26 09:05:52.438357 | localhost | ok 2026-03-26 09:05:52.443392 | 2026-03-26 09:05:52.443525 | TASK [Set zuul-log-path fact] 2026-03-26 09:05:52.461944 | localhost | ok 2026-03-26 09:05:52.472362 | 2026-03-26 09:05:52.472489 | TASK [set-zuul-log-path-fact : Set log path for a build] 2026-03-26 09:05:52.500371 | localhost | ok 2026-03-26 09:05:52.504252 | 2026-03-26 09:05:52.504379 | TASK [upload-logs : Create log directories] 2026-03-26 09:05:53.060118 | localhost | changed 2026-03-26 09:05:53.063604 | 2026-03-26 09:05:53.063730 | TASK [upload-logs : Ensure logs are readable before uploading] 2026-03-26 09:05:53.595180 | localhost -> localhost | ok: Runtime: 0:00:00.008144 2026-03-26 09:05:53.602744 | 2026-03-26 09:05:53.603060 | TASK [upload-logs : Upload logs to log server] 2026-03-26 09:05:54.215433 | localhost | Output suppressed because no_log was given 2026-03-26 09:05:54.220379 | 2026-03-26 09:05:54.220625 | LOOP [upload-logs : Compress console log and json output] 2026-03-26 09:05:54.277428 | localhost | skipping: Conditional result was False 2026-03-26 09:05:54.297447 | localhost | skipping: Conditional result was False 2026-03-26 09:05:54.303464 | 2026-03-26 09:05:54.303649 | LOOP [upload-logs : Upload compressed console log and json output] 2026-03-26 09:05:54.368938 | localhost | skipping: Conditional result was False 2026-03-26 09:05:54.369975 | 2026-03-26 09:05:54.372797 | localhost | skipping: Conditional result was False 2026-03-26 09:05:54.387312 | 2026-03-26 09:05:54.387626 | LOOP [upload-logs : Upload console log and json output]