2026-07-02 18:24:07.280336 | Job console starting 2026-07-02 18:24:07.304445 | Updating git repos 2026-07-02 18:24:07.359408 | Cloning repos into workspace 2026-07-02 18:24:07.418765 | Restoring repo states 2026-07-02 18:24:07.455194 | Merging changes 2026-07-02 18:24:08.037671 | Checking out repos 2026-07-02 18:24:08.113889 | Preparing playbooks 2026-07-02 18:24:09.075643 | Running Ansible setup 2026-07-02 18:24:14.712647 | PRE-RUN START: [trusted : github.com/osism/zuul-config/playbooks/base/pre.yaml@main] 2026-07-02 18:24:15.564941 | 2026-07-02 18:24:15.565158 | PLAY [Base pre] 2026-07-02 18:24:15.585162 | 2026-07-02 18:24:15.585335 | TASK [Setup log path fact] 2026-07-02 18:24:15.617240 | debian-bookworm | ok 2026-07-02 18:24:15.633597 | 2026-07-02 18:24:15.633780 | TASK [set-zuul-log-path-fact : Set log path for a build] 2026-07-02 18:24:15.673622 | debian-bookworm | ok 2026-07-02 18:24:15.684653 | 2026-07-02 18:24:15.684798 | TASK [emit-job-header : Print job information] 2026-07-02 18:24:15.746559 | # Job Information 2026-07-02 18:24:15.746789 | Ansible Version: 2.16.14 2026-07-02 18:24:15.746828 | Job: ansible-collection-services-molecule-auditd 2026-07-02 18:24:15.747668 | Pipeline: check 2026-07-02 18:24:15.747700 | Executor: 521e9411259a 2026-07-02 18:24:15.747725 | Triggered by: https://github.com/osism/ansible-collection-services/pull/2090 2026-07-02 18:24:15.747751 | Event ID: 2d753d82-7643-11f1-8bae-07d27c294fe6 2026-07-02 18:24:15.753182 | 2026-07-02 18:24:15.753307 | LOOP [emit-job-header : Print node information] 2026-07-02 18:24:15.879646 | debian-bookworm | ok: 2026-07-02 18:24:15.879949 | debian-bookworm | # Node Information 2026-07-02 18:24:15.879988 | debian-bookworm | Inventory Hostname: debian-bookworm 2026-07-02 18:24:15.880046 | debian-bookworm | Hostname: debian 2026-07-02 18:24:15.880075 | debian-bookworm | Username: zuul 2026-07-02 18:24:15.880098 | debian-bookworm | Distro: Debian 12.14 2026-07-02 18:24:15.880123 | debian-bookworm | Provider: regiocloud-a 2026-07-02 18:24:15.880146 | debian-bookworm | Region: 2026-07-02 18:24:15.880167 | debian-bookworm | Label: debian-bookworm 2026-07-02 18:24:15.880188 | debian-bookworm | Product Name: OpenStack Nova 2026-07-02 18:24:15.880209 | debian-bookworm | Interface IP: 2a13:1a81:8000:3124:f816:3eff:fea7:ffbe 2026-07-02 18:24:15.936524 | debian-bookworm | ok: 2026-07-02 18:24:15.936680 | debian-bookworm | # Node Information 2026-07-02 18:24:15.936713 | debian-bookworm | Inventory Hostname: ubuntu-noble 2026-07-02 18:24:15.936738 | debian-bookworm | Hostname: ubuntu 2026-07-02 18:24:15.936765 | debian-bookworm | Username: zuul 2026-07-02 18:24:15.936787 | debian-bookworm | Distro: Ubuntu 24.04 2026-07-02 18:24:15.936807 | debian-bookworm | Provider: regiocloud-a 2026-07-02 18:24:15.936828 | debian-bookworm | Region: 2026-07-02 18:24:15.936848 | debian-bookworm | Label: ubuntu-noble 2026-07-02 18:24:15.936867 | debian-bookworm | Product Name: OpenStack Nova 2026-07-02 18:24:15.936886 | debian-bookworm | Interface IP: 2a13:1a81:8000:3124:f816:3eff:fee3:d6e2 2026-07-02 18:24:15.960625 | 2026-07-02 18:24:15.960815 | TASK [log-inventory : Ensure Zuul Ansible directory exists] 2026-07-02 18:24:16.482290 | debian-bookworm -> localhost | changed 2026-07-02 18:24:16.498238 | 2026-07-02 18:24:16.498434 | TASK [log-inventory : Copy ansible inventory to logs dir] 2026-07-02 18:24:17.684450 | ubuntu-noble -> localhost | changed 2026-07-02 18:24:17.726739 | debian-bookworm -> localhost | ok 2026-07-02 18:24:17.742906 | 2026-07-02 18:24:17.743113 | TASK [add-build-sshkey : Check to see if ssh key was already created for this build] 2026-07-02 18:24:18.054798 | debian-bookworm -> localhost | ok 2026-07-02 18:24:18.063563 | 2026-07-02 18:24:18.063707 | TASK [add-build-sshkey : Create a new key in workspace based on build UUID] 2026-07-02 18:24:18.090622 | debian-bookworm | ok 2026-07-02 18:24:18.105865 | ubuntu-noble | ok 2026-07-02 18:24:18.127596 | debian-bookworm | included: /var/lib/zuul/builds/8f3df11461124628bc01bd1cee92f2a3/trusted/project_1/github.com/osism/openinfra-zuul-jobs/roles/add-build-sshkey/tasks/create-key-and-replace.yaml 2026-07-02 18:24:18.127740 | ubuntu-noble | included: /var/lib/zuul/builds/8f3df11461124628bc01bd1cee92f2a3/trusted/project_1/github.com/osism/openinfra-zuul-jobs/roles/add-build-sshkey/tasks/create-key-and-replace.yaml 2026-07-02 18:24:18.134922 | 2026-07-02 18:24:18.135059 | TASK [add-build-sshkey : Create Temp SSH key] 2026-07-02 18:24:19.602120 | debian-bookworm -> localhost | Generating public/private rsa key pair. 2026-07-02 18:24:19.602497 | debian-bookworm -> localhost | Your identification has been saved in /var/lib/zuul/builds/8f3df11461124628bc01bd1cee92f2a3/work/8f3df11461124628bc01bd1cee92f2a3_id_rsa 2026-07-02 18:24:19.602560 | debian-bookworm -> localhost | Your public key has been saved in /var/lib/zuul/builds/8f3df11461124628bc01bd1cee92f2a3/work/8f3df11461124628bc01bd1cee92f2a3_id_rsa.pub 2026-07-02 18:24:19.602601 | debian-bookworm -> localhost | The key fingerprint is: 2026-07-02 18:24:19.602643 | debian-bookworm -> localhost | SHA256:wdZRmEphuHd8jWn6J3sh6PyNz1gU9QZIIHpH6aMgavE zuul-build-sshkey 2026-07-02 18:24:19.602683 | debian-bookworm -> localhost | The key's randomart image is: 2026-07-02 18:24:19.602724 | debian-bookworm -> localhost | +---[RSA 3072]----+ 2026-07-02 18:24:19.602760 | debian-bookworm -> localhost | | .+.+Bo.. .| 2026-07-02 18:24:19.602795 | debian-bookworm -> localhost | | .+.++.. o.| 2026-07-02 18:24:19.602861 | debian-bookworm -> localhost | | .o=+o +. o| 2026-07-02 18:24:19.602900 | debian-bookworm -> localhost | | . . oooo= = .o | 2026-07-02 18:24:19.602933 | debian-bookworm -> localhost | | + . oSo * . | 2026-07-02 18:24:19.602966 | debian-bookworm -> localhost | | o E . o ... | 2026-07-02 18:24:19.603015 | debian-bookworm -> localhost | | . o . ... | 2026-07-02 18:24:19.603052 | debian-bookworm -> localhost | | o o*o | 2026-07-02 18:24:19.603085 | debian-bookworm -> localhost | | .=*+ | 2026-07-02 18:24:19.603116 | debian-bookworm -> localhost | +----[SHA256]-----+ 2026-07-02 18:24:19.603206 | debian-bookworm -> localhost | ok: Runtime: 0:00:00.920347 2026-07-02 18:24:19.615180 | 2026-07-02 18:24:19.615341 | TASK [add-build-sshkey : Remote setup ssh keys (linux)] 2026-07-02 18:24:19.646199 | debian-bookworm | ok 2026-07-02 18:24:19.659086 | ubuntu-noble | ok 2026-07-02 18:24:19.673622 | debian-bookworm | included: /var/lib/zuul/builds/8f3df11461124628bc01bd1cee92f2a3/trusted/project_1/github.com/osism/openinfra-zuul-jobs/roles/add-build-sshkey/tasks/remote-linux.yaml 2026-07-02 18:24:19.673735 | ubuntu-noble | included: /var/lib/zuul/builds/8f3df11461124628bc01bd1cee92f2a3/trusted/project_1/github.com/osism/openinfra-zuul-jobs/roles/add-build-sshkey/tasks/remote-linux.yaml 2026-07-02 18:24:19.685194 | 2026-07-02 18:24:19.685320 | TASK [add-build-sshkey : Remove previously added zuul-build-sshkey] 2026-07-02 18:24:19.706281 | debian-bookworm | skipping: Conditional result was False 2026-07-02 18:24:19.717706 | ubuntu-noble | skipping: Conditional result was False 2026-07-02 18:24:19.725781 | 2026-07-02 18:24:19.725916 | TASK [add-build-sshkey : Enable access via build key on all nodes] 2026-07-02 18:24:20.490628 | debian-bookworm | changed 2026-07-02 18:24:20.516812 | ubuntu-noble | changed 2026-07-02 18:24:20.523448 | 2026-07-02 18:24:20.523602 | TASK [add-build-sshkey : Make sure user has a .ssh] 2026-07-02 18:24:20.806632 | debian-bookworm | ok 2026-07-02 18:24:20.858963 | ubuntu-noble | ok 2026-07-02 18:24:20.865563 | 2026-07-02 18:24:20.865715 | TASK [add-build-sshkey : Install build private key as SSH key on all nodes] 2026-07-02 18:24:21.598722 | debian-bookworm | changed 2026-07-02 18:24:21.628096 | ubuntu-noble | changed 2026-07-02 18:24:21.636234 | 2026-07-02 18:24:21.636397 | TASK [add-build-sshkey : Install build public key as SSH key on all nodes] 2026-07-02 18:24:22.387885 | debian-bookworm | changed 2026-07-02 18:24:22.392751 | ubuntu-noble | changed 2026-07-02 18:24:22.398243 | 2026-07-02 18:24:22.398372 | TASK [add-build-sshkey : Remote setup ssh keys (windows)] 2026-07-02 18:24:22.424500 | debian-bookworm | skipping: Conditional result was False 2026-07-02 18:24:22.435648 | ubuntu-noble | skipping: Conditional result was False 2026-07-02 18:24:22.442194 | 2026-07-02 18:24:22.442363 | TASK [remove-zuul-sshkey : Remove master key from local agent] 2026-07-02 18:24:22.884358 | debian-bookworm -> localhost | changed 2026-07-02 18:24:22.903428 | 2026-07-02 18:24:22.903592 | TASK [add-build-sshkey : Add back temp key] 2026-07-02 18:24:23.254437 | debian-bookworm -> localhost | Identity added: /var/lib/zuul/builds/8f3df11461124628bc01bd1cee92f2a3/work/8f3df11461124628bc01bd1cee92f2a3_id_rsa (zuul-build-sshkey) 2026-07-02 18:24:23.255128 | debian-bookworm -> localhost | ok: Runtime: 0:00:00.019253 2026-07-02 18:24:23.272322 | 2026-07-02 18:24:23.272604 | TASK [add-build-sshkey : Verify we can still SSH to all nodes] 2026-07-02 18:24:23.659049 | debian-bookworm | ok 2026-07-02 18:24:23.668314 | ubuntu-noble | ok 2026-07-02 18:24:23.677114 | 2026-07-02 18:24:23.677313 | TASK [add-build-sshkey : Verify we can still SSH to all nodes (windows)] 2026-07-02 18:24:23.710782 | debian-bookworm | skipping: Conditional result was False 2026-07-02 18:24:23.721913 | ubuntu-noble | skipping: Conditional result was False 2026-07-02 18:24:23.740535 | 2026-07-02 18:24:23.740793 | TASK [start-zuul-console : Start zuul_console daemon.] 2026-07-02 18:24:24.181658 | debian-bookworm | ok 2026-07-02 18:24:24.191664 | ubuntu-noble | ok 2026-07-02 18:24:24.211936 | 2026-07-02 18:24:24.212112 | TASK [validate-host : Define zuul_info_dir fact] 2026-07-02 18:24:24.255450 | debian-bookworm | ok 2026-07-02 18:24:24.261814 | ubuntu-noble | ok 2026-07-02 18:24:24.267982 | 2026-07-02 18:24:24.268161 | TASK [validate-host : Ensure Zuul Ansible directory exists] 2026-07-02 18:24:24.579811 | debian-bookworm -> localhost | ok 2026-07-02 18:24:24.601402 | 2026-07-02 18:24:24.601575 | TASK [validate-host : Collect information about the host] 2026-07-02 18:24:25.743904 | debian-bookworm | ok 2026-07-02 18:24:25.849462 | ubuntu-noble | ok 2026-07-02 18:24:25.861405 | 2026-07-02 18:24:25.861602 | TASK [validate-host : Sanitize hostname] 2026-07-02 18:24:25.941458 | debian-bookworm | ok 2026-07-02 18:24:25.978503 | ubuntu-noble | ok 2026-07-02 18:24:25.983972 | 2026-07-02 18:24:25.984143 | TASK [validate-host : Write out all ansible variables/facts known for each host] 2026-07-02 18:24:26.744353 | debian-bookworm -> localhost | changed 2026-07-02 18:24:27.000842 | ubuntu-noble -> localhost | changed 2026-07-02 18:24:27.008036 | 2026-07-02 18:24:27.008194 | TASK [validate-host : Collect information about zuul worker] 2026-07-02 18:24:27.537140 | debian-bookworm | ok 2026-07-02 18:24:27.566734 | ubuntu-noble | ok 2026-07-02 18:24:27.576772 | 2026-07-02 18:24:27.576933 | TASK [validate-host : Write out all zuul information for each host] 2026-07-02 18:24:28.406046 | debian-bookworm -> localhost | changed 2026-07-02 18:24:28.458359 | ubuntu-noble -> localhost | changed 2026-07-02 18:24:28.473036 | 2026-07-02 18:24:28.473209 | TASK [prepare-workspace-log : Start zuul_console daemon.] 2026-07-02 18:24:28.742140 | debian-bookworm | ok 2026-07-02 18:24:28.811072 | ubuntu-noble | ok 2026-07-02 18:24:28.819786 | 2026-07-02 18:24:28.819950 | TASK [prepare-workspace-log : Synchronize src repos to workspace directory.] 2026-07-02 18:24:30.187667 | ubuntu-noble | changed: 2026-07-02 18:24:30.188019 | ubuntu-noble | cd+++++++++ src/ 2026-07-02 18:24:30.188066 | ubuntu-noble | cd+++++++++ src/github.com/ 2026-07-02 18:24:30.188091 | ubuntu-noble | cd+++++++++ src/github.com/osism/ 2026-07-02 18:24:30.188113 | ubuntu-noble | cd+++++++++ src/github.com/osism/ansible-collection-services/ 2026-07-02 18:24:30.188134 | ubuntu-noble | config] provisioner.env found in /home/zuul/src/github.com/osism/ansible-collection-services/molecule/delegated/molecule.yml, this can be defined in ansible.env 2026-07-02 18:26:00.335670 | ubuntu-noble | WARNING Molecule scenarios should migrate to 'extensions/molecule' 2026-07-02 18:26:00.365235 | ubuntu-noble | DEBUG [unknown > config] provisioner.env found in /home/zuul/src/github.com/osism/ansible-collection-services/molecule/delegated/molecule.yml, this can be defined in ansible.env 2026-07-02 18:26:00.863757 | debian-bookworm | DEBUG [unknown > config] provisioner.env found in /home/zuul/src/github.com/osism/ansible-collection-services/molecule/delegated/molecule.yml, this can be defined in ansible.env 2026-07-02 18:26:00.864370 | debian-bookworm | DEBUG [delegated > validate] Validating schema /home/zuul/src/github.com/osism/ansible-collection-services/molecule/delegated/molecule.yml. 2026-07-02 18:26:00.885265 | debian-bookworm | DEBUG [default > validate] Validating schema /home/zuul/src/github.com/osism/ansible-collection-services/molecule/default/molecule.yml. 2026-07-02 18:26:00.891118 | debian-bookworm | INFO [delegated > discovery] scenario test matrix: dependency 2026-07-02 18:26:00.891191 | debian-bookworm | INFO [delegated > prerun] Performing prerun with role_name_check=0... 2026-07-02 18:26:00.910929 | ubuntu-noble | DEBUG [unknown > config] provisioner.env found in /home/zuul/src/github.com/osism/ansible-collection-services/molecule/delegated/molecule.yml, this can be defined in ansible.env 2026-07-02 18:26:00.911014 | ubuntu-noble | DEBUG [delegated > validate] Validating schema /home/zuul/src/github.com/osism/ansible-collection-services/molecule/delegated/molecule.yml. 2026-07-02 18:26:00.932186 | ubuntu-noble | DEBUG [default > validate] Validating schema /home/zuul/src/github.com/osism/ansible-collection-services/molecule/default/molecule.yml. 2026-07-02 18:26:00.937824 | ubuntu-noble | INFO [delegated > discovery] scenario test matrix: dependency 2026-07-02 18:26:00.937861 | ubuntu-noble | INFO [delegated > prerun] Performing prerun with role_name_check=0... 2026-07-02 18:26:02.109909 | debian-bookworm | INFO [delegated > dependency] Executing 2026-07-02 18:26:02.110347 | debian-bookworm | WARNING [delegated > dependency] Missing roles requirements file: requirements.yml 2026-07-02 18:26:02.289165 | ubuntu-noble | INFO [delegated > dependency] Executing 2026-07-02 18:26:02.289658 | ubuntu-noble | WARNING [delegated > dependency] Missing roles requirements file: requirements.yml 2026-07-02 18:26:02.524656 | debian-bookworm | ansible-galaxy [core 2.18.18] 2026-07-02 18:26:02.525130 | debian-bookworm | config file = None 2026-07-02 18:26:02.525549 | debian-bookworm | configured module search path = ['/home/zuul/src/github.com/osism/ansible-collection-services/plugins/modules', '/home/zuul/.ansible/plugins/modules', '/usr/share/ansible/plugins/modules'] 2026-07-02 18:26:02.526147 | debian-bookworm | ansible python module location = /home/zuul/venv/lib/python3.11/site-packages/ansible 2026-07-02 18:26:02.526532 | debian-bookworm | ansible collection location = /home/zuul/.ansible/collections:/usr/share/ansible/collections:/home/zuul/venv/lib/python3.11/site-packages:/home/zuul/venv/lib/python3.11/dist-packages:/home/zuul/venv/lib/python3/dist-packages:/home/zuul/venv/local/lib/python3.11/dist-packages 2026-07-02 18:26:02.526909 | debian-bookworm | executable location = /home/zuul/venv/bin/ansible-galaxy 2026-07-02 18:26:02.527233 | debian-bookworm | python version = 3.11.2 (main, Apr 8 2026, 01:58:00) [GCC 12.2.0] (/home/zuul/venv/bin/python3) 2026-07-02 18:26:02.527583 | debian-bookworm | jinja version = 3.1.6 2026-07-02 18:26:02.527910 | debian-bookworm | libyaml = True 2026-07-02 18:26:02.528198 | debian-bookworm | No config file found; using defaults 2026-07-02 18:26:02.528763 | debian-bookworm | Reading requirement file at '/home/zuul/src/github.com/osism/ansible-collection-services/molecule/delegated/collections.yml' 2026-07-02 18:26:02.535139 | debian-bookworm | Loading collection community.mysql from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/mysql 2026-07-02 18:26:02.535556 | debian-bookworm | Found installed collection community.mysql:3.16.1 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/mysql' 2026-07-02 18:26:02.536174 | debian-bookworm | Loading collection infinidat.infinibox from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/infinidat/infinibox 2026-07-02 18:26:02.536708 | debian-bookworm | Found installed collection infinidat.infinibox:1.6.3 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/infinidat/infinibox' 2026-07-02 18:26:02.537549 | debian-bookworm | Loading collection ngine_io.cloudstack from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/ngine_io/cloudstack 2026-07-02 18:26:02.538032 | debian-bookworm | Found installed collection ngine_io.cloudstack:2.5.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/ngine_io/cloudstack' 2026-07-02 18:26:02.538953 | debian-bookworm | Loading collection dellemc.enterprise_sonic from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/dellemc/enterprise_sonic 2026-07-02 18:26:02.539335 | debian-bookworm | Found installed collection dellemc.enterprise_sonic:2.5.1 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/dellemc/enterprise_sonic' 2026-07-02 18:26:02.577116 | debian-bookworm | Loading collection community.network from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/network 2026-07-02 18:26:02.577477 | debian-bookworm | Found installed collection community.network:5.1.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/network' 2026-07-02 18:26:02.578604 | debian-bookworm | Loading collection hetzner.hcloud from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/hetzner/hcloud 2026-07-02 18:26:02.579518 | debian-bookworm | Found installed collection hetzner.hcloud:4.3.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/hetzner/hcloud' 2026-07-02 18:26:02.579998 | debian-bookworm | Loading collection infoblox.nios_modules from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/infoblox/nios_modules 2026-07-02 18:26:02.580300 | debian-bookworm | Found installed collection infoblox.nios_modules:1.8.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/infoblox/nios_modules' 2026-07-02 18:26:02.580925 | debian-bookworm | Loading collection netapp_eseries.santricity from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/netapp_eseries/santricity 2026-07-02 18:26:02.581213 | debian-bookworm | Found installed collection netapp_eseries.santricity:1.4.1 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/netapp_eseries/santricity' 2026-07-02 18:26:02.581498 | debian-bookworm | Loading collection community.libvirt from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/libvirt 2026-07-02 18:26:02.582113 | debian-bookworm | Found installed collection community.libvirt:1.4.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/libvirt' 2026-07-02 18:26:02.583337 | debian-bookworm | Loading collection cisco.meraki from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/cisco/meraki 2026-07-02 18:26:02.583683 | debian-bookworm | Found installed collection cisco.meraki:2.21.8 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/cisco/meraki' 2026-07-02 18:26:02.584072 | debian-bookworm | Loading collection community.okd from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/okd 2026-07-02 18:26:02.584404 | debian-bookworm | Found installed collection community.okd:4.0.2 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/okd' 2026-07-02 18:26:02.585801 | debian-bookworm | Loading collection vyos.vyos from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/vyos/vyos 2026-07-02 18:26:02.586413 | debian-bookworm | Found installed collection vyos.vyos:5.0.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/vyos/vyos' 2026-07-02 18:26:02.586734 | debian-bookworm | Loading collection community.mongodb from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/mongodb 2026-07-02 18:26:02.587286 | debian-bookworm | Found installed collection community.mongodb:1.7.10 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/mongodb' 2026-07-02 18:26:02.587675 | debian-bookworm | Loading collection netapp.ontap from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/netapp/ontap 2026-07-02 18:26:02.588039 | debian-bookworm | Found installed collection netapp.ontap:22.14.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/netapp/ontap' 2026-07-02 18:26:02.588454 | debian-bookworm | Loading collection community.zabbix from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/zabbix 2026-07-02 18:26:02.588744 | debian-bookworm | Found installed collection community.zabbix:3.3.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/zabbix' 2026-07-02 18:26:02.589339 | debian-bookworm | Loading collection google.cloud from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/google/cloud 2026-07-02 18:26:02.589667 | debian-bookworm | Found installed collection google.cloud:1.9.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/google/cloud' 2026-07-02 18:26:02.589979 | debian-bookworm | Loading collection cloud.common from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/cloud/common 2026-07-02 18:26:02.590251 | debian-bookworm | Found installed collection cloud.common:4.2.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/cloud/common' 2026-07-02 18:26:02.593674 | debian-bookworm | Loading collection community.aws from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/aws 2026-07-02 18:26:02.593975 | debian-bookworm | Found installed collection community.aws:9.3.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/aws' 2026-07-02 18:26:02.594528 | debian-bookworm | Loading collection check_point.mgmt from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/check_point/mgmt 2026-07-02 18:26:02.594853 | debian-bookworm | Found installed collection check_point.mgmt:6.6.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/check_point/mgmt' 2026-07-02 18:26:02.595700 | debian-bookworm | Loading collection cisco.ios from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/cisco/ios 2026-07-02 18:26:02.596349 | debian-bookworm | Found installed collection cisco.ios:9.2.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/cisco/ios' 2026-07-02 18:26:02.596666 | debian-bookworm | Loading collection ansible.utils from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/ansible/utils 2026-07-02 18:26:02.596903 | debian-bookworm | Found installed collection ansible.utils:5.1.2 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/ansible/utils' 2026-07-02 18:26:02.597193 | debian-bookworm | Loading collection ibm.storage_virtualize from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/ibm/storage_virtualize 2026-07-02 18:26:02.597407 | debian-bookworm | Found installed collection ibm.storage_virtualize:2.7.4 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/ibm/storage_virtualize' 2026-07-02 18:26:02.597726 | debian-bookworm | Loading collection dellemc.powerflex from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/dellemc/powerflex 2026-07-02 18:26:02.598029 | debian-bookworm | Found installed collection dellemc.powerflex:2.6.1 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/dellemc/powerflex' 2026-07-02 18:26:02.598452 | debian-bookworm | Loading collection vultr.cloud from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/vultr/cloud 2026-07-02 18:26:02.598712 | debian-bookworm | Found installed collection vultr.cloud:1.13.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/vultr/cloud' 2026-07-02 18:26:02.600661 | debian-bookworm | Loading collection azure.azcollection from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/azure/azcollection 2026-07-02 18:26:02.600938 | debian-bookworm | Found installed collection azure.azcollection:3.10.1 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/azure/azcollection' 2026-07-02 18:26:02.601184 | debian-bookworm | Loading collection kaytus.ksmanage from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/kaytus/ksmanage 2026-07-02 18:26:02.601482 | debian-bookworm | Found installed collection kaytus.ksmanage:2.0.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/kaytus/ksmanage' 2026-07-02 18:26:02.601865 | debian-bookworm | Loading collection netapp.cloudmanager from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/netapp/cloudmanager 2026-07-02 18:26:02.602104 | debian-bookworm | Found installed collection netapp.cloudmanager:21.24.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/netapp/cloudmanager' 2026-07-02 18:26:02.602526 | debian-bookworm | Loading collection netapp.storagegrid from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/netapp/storagegrid 2026-07-02 18:26:02.602750 | debian-bookworm | Found installed collection netapp.storagegrid:21.14.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/netapp/storagegrid' 2026-07-02 18:26:02.603566 | debian-bookworm | Loading collection community.hrobot from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/hrobot 2026-07-02 18:26:02.603955 | debian-bookworm | Found installed collection community.hrobot:2.7.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/hrobot' 2026-07-02 18:26:02.604178 | debian-bookworm | Loading collection sensu.sensu_go from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/sensu/sensu_go 2026-07-02 18:26:02.604464 | debian-bookworm | Found installed collection sensu.sensu_go:1.14.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/sensu/sensu_go' 2026-07-02 18:26:02.606174 | debian-bookworm | Loading collection cisco.nxos from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/cisco/nxos 2026-07-02 18:26:02.606476 | debian-bookworm | Found installed collection cisco.nxos:9.4.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/cisco/nxos' 2026-07-02 18:26:02.607413 | debian-bookworm | Loading collection junipernetworks.junos from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/junipernetworks/junos 2026-07-02 18:26:02.607696 | debian-bookworm | Found installed collection junipernetworks.junos:9.1.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/junipernetworks/junos' 2026-07-02 18:26:02.608791 | debian-bookworm | Loading collection ansible.netcommon from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/ansible/netcommon 2026-07-02 18:26:02.609127 | debian-bookworm | Found installed collection ansible.netcommon:7.2.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/ansible/netcommon' 2026-07-02 18:26:02.609515 | debian-bookworm | Loading collection ansible.windows from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/ansible/windows 2026-07-02 18:26:02.609949 | debian-bookworm | Found installed collection ansible.windows:2.8.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/ansible/windows' 2026-07-02 18:26:02.612643 | debian-bookworm | Loading collection vmware.vmware_rest from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/vmware/vmware_rest 2026-07-02 18:26:02.612934 | debian-bookworm | Found installed collection vmware.vmware_rest:4.9.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/vmware/vmware_rest' 2026-07-02 18:26:02.614416 | debian-bookworm | Loading collection cisco.mso from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/cisco/mso 2026-07-02 18:26:02.614666 | debian-bookworm | Found installed collection cisco.mso:2.11.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/cisco/mso' 2026-07-02 18:26:02.615189 | debian-bookworm | Loading collection telekom_mms.icinga_director from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/telekom_mms/icinga_director 2026-07-02 18:26:02.615440 | debian-bookworm | Found installed collection telekom_mms.icinga_director:2.4.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/telekom_mms/icinga_director' 2026-07-02 18:26:02.615865 | debian-bookworm | Loading collection community.sap_libs from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/sap_libs 2026-07-02 18:26:02.616157 | debian-bookworm | Found installed collection community.sap_libs:1.5.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/sap_libs' 2026-07-02 18:26:02.616461 | debian-bookworm | Loading collection community.ciscosmb from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/ciscosmb 2026-07-02 18:26:02.616853 | debian-bookworm | Found installed collection community.ciscosmb:1.0.11 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/ciscosmb' 2026-07-02 18:26:02.617233 | debian-bookworm | Loading collection cisco.asa from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/cisco/asa 2026-07-02 18:26:02.617545 | debian-bookworm | Found installed collection cisco.asa:6.1.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/cisco/asa' 2026-07-02 18:26:02.617784 | debian-bookworm | Loading collection ibm.spectrum_virtualize from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/ibm/spectrum_virtualize 2026-07-02 18:26:02.618096 | debian-bookworm | Found installed collection ibm.spectrum_virtualize:2.0.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/ibm/spectrum_virtualize' 2026-07-02 18:26:02.618352 | debian-bookworm | Loading collection community.crypto from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/crypto 2026-07-02 18:26:02.618603 | debian-bookworm | Found installed collection community.crypto:2.26.6 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/crypto' 2026-07-02 18:26:02.618946 | debian-bookworm | Loading collection community.sops from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/sops 2026-07-02 18:26:02.619255 | debian-bookworm | Found installed collection community.sops:2.2.7 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/sops' 2026-07-02 18:26:02.620354 | debian-bookworm | Loading collection arista.eos from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/arista/eos 2026-07-02 18:26:02.620569 | debian-bookworm | Found installed collection arista.eos:10.1.1 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/arista/eos' 2026-07-02 18:26:02.621148 | debian-bookworm | Loading collection ibm.qradar from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/ibm/qradar 2026-07-02 18:26:02.621446 | debian-bookworm | Found installed collection ibm.qradar:4.0.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/ibm/qradar' 2026-07-02 18:26:02.625103 | debian-bookworm | Loading collection fortinet.fortios from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/fortinet/fortios 2026-07-02 18:26:02.625410 | debian-bookworm | Found installed collection fortinet.fortios:2.4.2 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/fortinet/fortios' 2026-07-02 18:26:02.625666 | debian-bookworm | Loading collection cisco.ucs from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/cisco/ucs 2026-07-02 18:26:02.626003 | debian-bookworm | Found installed collection cisco.ucs:1.16.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/cisco/ucs' 2026-07-02 18:26:02.626308 | debian-bookworm | Loading collection containers.podman from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/containers/podman 2026-07-02 18:26:02.626575 | debian-bookworm | Found installed collection containers.podman:1.18.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/containers/podman' 2026-07-02 18:26:02.627070 | debian-bookworm | Loading collection f5networks.f5_modules from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/f5networks/f5_modules 2026-07-02 18:26:02.627399 | debian-bookworm | Found installed collection f5networks.f5_modules:1.39.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/f5networks/f5_modules' 2026-07-02 18:26:02.628499 | debian-bookworm | Loading collection community.digitalocean from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/digitalocean 2026-07-02 18:26:02.628836 | debian-bookworm | Found installed collection community.digitalocean:1.27.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/digitalocean' 2026-07-02 18:26:02.629535 | debian-bookworm | Loading collection kubernetes.core from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/kubernetes/core 2026-07-02 18:26:02.629869 | debian-bookworm | Found installed collection kubernetes.core:5.4.1 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/kubernetes/core' 2026-07-02 18:26:02.630217 | debian-bookworm | Loading collection lowlydba.sqlserver from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/lowlydba/sqlserver 2026-07-02 18:26:02.630522 | debian-bookworm | Found installed collection lowlydba.sqlserver:2.7.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/lowlydba/sqlserver' 2026-07-02 18:26:02.631176 | debian-bookworm | Loading collection dellemc.openmanage from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/dellemc/openmanage 2026-07-02 18:26:02.631481 | debian-bookworm | Found installed collection dellemc.openmanage:9.12.3 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/dellemc/openmanage' 2026-07-02 18:26:02.632033 | debian-bookworm | Loading collection community.windows from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/windows 2026-07-02 18:26:02.632271 | debian-bookworm | Found installed collection community.windows:2.4.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/windows' 2026-07-02 18:26:02.634809 | debian-bookworm | Loading collection awx.awx from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/awx/awx 2026-07-02 18:26:02.635050 | debian-bookworm | Found installed collection awx.awx:24.6.1 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/awx/awx' 2026-07-02 18:26:02.635576 | debian-bookworm | Loading collection community.postgresql from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/postgresql 2026-07-02 18:26:02.635883 | debian-bookworm | Found installed collection community.postgresql:3.14.2 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/postgresql' 2026-07-02 18:26:02.636223 | debian-bookworm | Loading collection microsoft.iis from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/microsoft/iis 2026-07-02 18:26:02.636521 | debian-bookworm | Found installed collection microsoft.iis:1.0.3 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/microsoft/iis' 2026-07-02 18:26:02.636801 | debian-bookworm | Loading collection cyberark.conjur from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/cyberark/conjur 2026-07-02 18:26:02.637135 | debian-bookworm | Found installed collection cyberark.conjur:1.3.8 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/cyberark/conjur' 2026-07-02 18:26:02.637868 | debian-bookworm | Loading collection openstack.cloud from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/openstack/cloud 2026-07-02 18:26:02.638153 | debian-bookworm | Found installed collection openstack.cloud:2.5.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/openstack/cloud' 2026-07-02 18:26:02.638408 | debian-bookworm | Loading collection community.library_inventory_filtering_v1 from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/library_inventory_filtering_v1 2026-07-02 18:26:02.638707 | debian-bookworm | Found installed collection community.library_inventory_filtering_v1:1.1.5 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/library_inventory_filtering_v1' 2026-07-02 18:26:02.640288 | debian-bookworm | Loading collection community.vmware from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/vmware 2026-07-02 18:26:02.640593 | debian-bookworm | Found installed collection community.vmware:5.10.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/vmware' 2026-07-02 18:26:02.640918 | debian-bookworm | Loading collection hitachivantara.vspone_object from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/hitachivantara/vspone_object 2026-07-02 18:26:02.641204 | debian-bookworm | Found installed collection hitachivantara.vspone_object:1.0.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/hitachivantara/vspone_object' 2026-07-02 18:26:02.641503 | debian-bookworm | Loading collection grafana.grafana from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/grafana/grafana 2026-07-02 18:26:02.641864 | debian-bookworm | Found installed collection grafana.grafana:5.7.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/grafana/grafana' 2026-07-02 18:26:02.643568 | debian-bookworm | Loading collection cisco.aci from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/cisco/aci 2026-07-02 18:26:02.643936 | debian-bookworm | Found installed collection cisco.aci:2.12.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/cisco/aci' 2026-07-02 18:26:02.644588 | debian-bookworm | Loading collection ovirt.ovirt from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/ovirt/ovirt 2026-07-02 18:26:02.644917 | debian-bookworm | Found installed collection ovirt.ovirt:3.2.1 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/ovirt/ovirt' 2026-07-02 18:26:02.645272 | debian-bookworm | Loading collection purestorage.flashblade from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/purestorage/flashblade 2026-07-02 18:26:02.645566 | debian-bookworm | Found installed collection purestorage.flashblade:1.22.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/purestorage/flashblade' 2026-07-02 18:26:02.646391 | debian-bookworm | Loading collection netbox.netbox from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/netbox/netbox 2026-07-02 18:26:02.646696 | debian-bookworm | Found installed collection netbox.netbox:3.21.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/netbox/netbox' 2026-07-02 18:26:02.648447 | debian-bookworm | Loading collection theforeman.foreman from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/theforeman/foreman 2026-07-02 18:26:02.648802 | debian-bookworm | Found installed collection theforeman.foreman:4.2.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/theforeman/foreman' 2026-07-02 18:26:02.649021 | debian-bookworm | Loading collection cisco.intersight from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/cisco/intersight 2026-07-02 18:26:02.649387 | debian-bookworm | Found installed collection cisco.intersight:2.7.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/cisco/intersight' 2026-07-02 18:26:02.649573 | debian-bookworm | Loading collection cisco.ise from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/cisco/ise 2026-07-02 18:26:02.649965 | debian-bookworm | Found installed collection cisco.ise:2.10.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/cisco/ise' 2026-07-02 18:26:02.650248 | debian-bookworm | Loading collection microsoft.ad from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/microsoft/ad 2026-07-02 18:26:02.650501 | debian-bookworm | Found installed collection microsoft.ad:1.9.2 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/microsoft/ad' 2026-07-02 18:26:02.650885 | debian-bookworm | Loading collection community.grafana from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/grafana 2026-07-02 18:26:02.651168 | debian-bookworm | Found installed collection community.grafana:2.3.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/grafana' 2026-07-02 18:26:02.651443 | debian-bookworm | Loading collection community.routeros from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/routeros 2026-07-02 18:26:02.651712 | debian-bookworm | Found installed collection community.routeros:3.13.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/routeros' 2026-07-02 18:26:02.652154 | debian-bookworm | Loading collection community.proxmox from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/proxmox 2026-07-02 18:26:02.652401 | debian-bookworm | Found installed collection community.proxmox:1.4.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/proxmox' 2026-07-02 18:26:02.652683 | debian-bookworm | Loading collection inspur.ispim from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/inspur/ispim 2026-07-02 18:26:02.652995 | debian-bookworm | Found installed collection inspur.ispim:2.2.3 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/inspur/ispim' 2026-07-02 18:26:02.653495 | debian-bookworm | Loading collection community.docker from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/docker 2026-07-02 18:26:02.653835 | debian-bookworm | Found installed collection community.docker:4.8.2 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/docker' 2026-07-02 18:26:02.654306 | debian-bookworm | Loading collection wti.remote from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/wti/remote 2026-07-02 18:26:02.654586 | debian-bookworm | Found installed collection wti.remote:1.0.10 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/wti/remote' 2026-07-02 18:26:02.654923 | debian-bookworm | Loading collection community.rabbitmq from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/rabbitmq 2026-07-02 18:26:02.655211 | debian-bookworm | Found installed collection community.rabbitmq:1.6.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/rabbitmq' 2026-07-02 18:26:02.655505 | debian-bookworm | Loading collection ravendb.ravendb from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/ravendb/ravendb 2026-07-02 18:26:02.655762 | debian-bookworm | Found installed collection ravendb.ravendb:1.0.4 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/ravendb/ravendb' 2026-07-02 18:26:02.655990 | debian-bookworm | Loading collection cyberark.pas from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/cyberark/pas 2026-07-02 18:26:02.656317 | debian-bookworm | Found installed collection cyberark.pas:1.0.36 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/cyberark/pas' 2026-07-02 18:26:02.656607 | debian-bookworm | Loading collection chocolatey.chocolatey from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/chocolatey/chocolatey 2026-07-02 18:26:02.656888 | debian-bookworm | Found installed collection chocolatey.chocolatey:1.5.3 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/chocolatey/chocolatey' 2026-07-02 18:26:02.657422 | debian-bookworm | Loading collection hitachivantara.vspone_block from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/hitachivantara/vspone_block 2026-07-02 18:26:02.657752 | debian-bookworm | Found installed collection hitachivantara.vspone_block:3.5.1 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/hitachivantara/vspone_block' 2026-07-02 18:26:02.658132 | debian-bookworm | Loading collection kubevirt.core from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/kubevirt/core 2026-07-02 18:26:02.658426 | debian-bookworm | Found installed collection kubevirt.core:2.2.3 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/kubevirt/core' 2026-07-02 18:26:02.659363 | debian-bookworm | Loading collection cisco.iosxr from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/cisco/iosxr 2026-07-02 18:26:02.659638 | debian-bookworm | Found installed collection cisco.iosxr:10.3.1 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/cisco/iosxr' 2026-07-02 18:26:02.659878 | debian-bookworm | Loading collection community.proxysql from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/proxysql 2026-07-02 18:26:02.660166 | debian-bookworm | Found installed collection community.proxysql:1.7.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/proxysql' 2026-07-02 18:26:02.660936 | debian-bookworm | Loading collection dellemc.unity from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/dellemc/unity 2026-07-02 18:26:02.661280 | debian-bookworm | Found installed collection dellemc.unity:2.1.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/dellemc/unity' 2026-07-02 18:26:02.662038 | debian-bookworm | Loading collection splunk.es from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/splunk/es 2026-07-02 18:26:02.662384 | debian-bookworm | Found installed collection splunk.es:4.0.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/splunk/es' 2026-07-02 18:26:02.662630 | debian-bookworm | Loading collection ansible.posix from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/ansible/posix 2026-07-02 18:26:02.662921 | debian-bookworm | Found installed collection ansible.posix:1.6.2 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/ansible/posix' 2026-07-02 18:26:02.664270 | debian-bookworm | Loading collection amazon.aws from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/amazon/aws 2026-07-02 18:26:02.664565 | debian-bookworm | Found installed collection amazon.aws:9.5.2 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/amazon/aws' 2026-07-02 18:26:02.665717 | debian-bookworm | Loading collection vmware.vmware from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/vmware/vmware 2026-07-02 18:26:02.666237 | debian-bookworm | Found installed collection vmware.vmware:1.11.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/vmware/vmware' 2026-07-02 18:26:02.666513 | debian-bookworm | Loading collection community.hashi_vault from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/hashi_vault 2026-07-02 18:26:02.666991 | debian-bookworm | Found installed collection community.hashi_vault:6.2.1 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/hashi_vault' 2026-07-02 18:26:02.672950 | debian-bookworm | Loading collection fortinet.fortimanager from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/fortinet/fortimanager 2026-07-02 18:26:02.673432 | debian-bookworm | Found installed collection fortinet.fortimanager:2.11.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/fortinet/fortimanager' 2026-07-02 18:26:02.673973 | debian-bookworm | Loading collection cloudscale_ch.cloud from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/cloudscale_ch/cloud 2026-07-02 18:26:02.674382 | debian-bookworm | Found installed collection cloudscale_ch.cloud:2.5.2 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/cloudscale_ch/cloud' 2026-07-02 18:26:02.674902 | debian-bookworm | Loading collection community.dns from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/dns 2026-07-02 18:26:02.675197 | debian-bookworm | Found installed collection community.dns:3.4.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/dns' 2026-07-02 18:26:02.675585 | debian-bookworm | Loading collection purestorage.flasharray from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/purestorage/flasharray 2026-07-02 18:26:02.675956 | debian-bookworm | Found installed collection purestorage.flasharray:1.39.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/purestorage/flasharray' 2026-07-02 18:26:02.684600 | debian-bookworm | Loading collection community.general from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/general 2026-07-02 18:26:02.685055 | debian-bookworm | Found installed collection community.general:10.7.6 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/general' 2026-07-02 18:26:02.685428 | debian-bookworm | Loading collection ieisystem.inmanage from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/ieisystem/inmanage 2026-07-02 18:26:02.685879 | debian-bookworm | Found installed collection ieisystem.inmanage:3.0.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/ieisystem/inmanage' 2026-07-02 18:26:02.686165 | debian-bookworm | Loading collection cisco.dnac from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/cisco/dnac 2026-07-02 18:26:02.686585 | debian-bookworm | Found installed collection cisco.dnac:6.31.3 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/cisco/dnac' 2026-07-02 18:26:02.690904 | debian-bookworm | Loading collection osism.services from /home/zuul/.ansible/collections/ansible_collections/osism/services 2026-07-02 18:26:02.691273 | debian-bookworm | Found installed collection osism.services:999.0.0 at '/home/zuul/.ansible/collections/ansible_collections/osism/services' 2026-07-02 18:26:02.695113 | debian-bookworm | Initial connection to galaxy_server: https://galaxy.ansible.com 2026-07-02 18:26:02.695493 | debian-bookworm | Created /home/zuul/.ansible/galaxy_token 2026-07-02 18:26:02.695773 | debian-bookworm | Calling Galaxy at https://galaxy.ansible.com/api/ 2026-07-02 18:26:02.924451 | debian-bookworm | Found API version 'v3, pulp-v3, v1' with Galaxy server default (https://galaxy.ansible.com/api/) 2026-07-02 18:26:02.924925 | debian-bookworm | Calling Galaxy at https://galaxy.ansible.com/api/v3/collections/osism/commons/ 2026-07-02 18:26:02.678445 | ubuntu-noble | ansible-galaxy [core 2.18.18] 2026-07-02 18:26:02.680773 | ubuntu-noble | config file = None 2026-07-02 18:26:02.680797 | ubuntu-noble | configured module search path = ['/home/zuul/src/github.com/osism/ansible-collection-services/plugins/modules', '/home/zuul/.ansible/plugins/modules', '/usr/share/ansible/plugins/modules'] 2026-07-02 18:26:02.680803 | ubuntu-noble | ansible python module location = /home/zuul/venv/lib/python3.12/site-packages/ansible 2026-07-02 18:26:02.680814 | ubuntu-noble | ansible collection location = /home/zuul/.ansible/collections:/usr/share/ansible/collections:/home/zuul/venv/lib/python3.12/site-packages:/home/zuul/venv/lib/python3.12/dist-packages:/home/zuul/venv/lib/python3/dist-packages:/home/zuul/venv/local/lib/python3.12/dist-packages 2026-07-02 18:26:02.680821 | ubuntu-noble | executable location = /home/zuul/venv/bin/ansible-galaxy 2026-07-02 18:26:02.680847 | ubuntu-noble | python version = 3.12.3 (main, Mar 23 2026, 19:04:32) [GCC 13.3.0] (/home/zuul/venv/bin/python3) 2026-07-02 18:26:02.681137 | ubuntu-noble | jinja version = 3.1.6 2026-07-02 18:26:02.681423 | ubuntu-noble | libyaml = True 2026-07-02 18:26:02.681744 | ubuntu-noble | No config file found; using defaults 2026-07-02 18:26:02.682269 | ubuntu-noble | Reading requirement file at '/home/zuul/src/github.com/osism/ansible-collection-services/molecule/delegated/collections.yml' 2026-07-02 18:26:02.691972 | ubuntu-noble | Loading collection osism.services from /home/zuul/.ansible/collections/ansible_collections/osism/services 2026-07-02 18:26:02.692467 | ubuntu-noble | Found installed collection osism.services:999.0.0 at '/home/zuul/.ansible/collections/ansible_collections/osism/services' 2026-07-02 18:26:02.702591 | ubuntu-noble | Loading collection kaytus.ksmanage from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/kaytus/ksmanage 2026-07-02 18:26:02.703067 | ubuntu-noble | Found installed collection kaytus.ksmanage:2.0.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/kaytus/ksmanage' 2026-07-02 18:26:02.703649 | ubuntu-noble | Loading collection dellemc.powerflex from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/dellemc/powerflex 2026-07-02 18:26:02.704086 | ubuntu-noble | Found installed collection dellemc.powerflex:2.6.1 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/dellemc/powerflex' 2026-07-02 18:26:02.704510 | ubuntu-noble | Loading collection chocolatey.chocolatey from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/chocolatey/chocolatey 2026-07-02 18:26:02.705215 | ubuntu-noble | Found installed collection chocolatey.chocolatey:1.5.3 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/chocolatey/chocolatey' 2026-07-02 18:26:02.707529 | ubuntu-noble | Loading collection awx.awx from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/awx/awx 2026-07-02 18:26:02.707996 | ubuntu-noble | Found installed collection awx.awx:24.6.1 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/awx/awx' 2026-07-02 18:26:02.708405 | ubuntu-noble | Loading collection infoblox.nios_modules from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/infoblox/nios_modules 2026-07-02 18:26:02.708831 | ubuntu-noble | Found installed collection infoblox.nios_modules:1.8.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/infoblox/nios_modules' 2026-07-02 18:26:02.709819 | ubuntu-noble | Loading collection kubernetes.core from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/kubernetes/core 2026-07-02 18:26:02.710266 | ubuntu-noble | Found installed collection kubernetes.core:5.4.1 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/kubernetes/core' 2026-07-02 18:26:02.710572 | ubuntu-noble | Loading collection kubevirt.core from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/kubevirt/core 2026-07-02 18:26:02.710898 | ubuntu-noble | Found installed collection kubevirt.core:2.2.3 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/kubevirt/core' 2026-07-02 18:26:02.711263 | ubuntu-noble | Loading collection splunk.es from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/splunk/es 2026-07-02 18:26:02.711538 | ubuntu-noble | Found installed collection splunk.es:4.0.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/splunk/es' 2026-07-02 18:26:02.711934 | ubuntu-noble | Loading collection ansible.windows from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/ansible/windows 2026-07-02 18:26:02.712297 | ubuntu-noble | Found installed collection ansible.windows:2.8.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/ansible/windows' 2026-07-02 18:26:02.712724 | ubuntu-noble | Loading collection community.proxmox from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/proxmox 2026-07-02 18:26:02.713093 | ubuntu-noble | Found installed collection community.proxmox:1.4.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/proxmox' 2026-07-02 18:26:02.713434 | ubuntu-noble | Loading collection purestorage.flasharray from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/purestorage/flasharray 2026-07-02 18:26:02.713755 | ubuntu-noble | Found installed collection purestorage.flasharray:1.39.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/purestorage/flasharray' 2026-07-02 18:26:02.714173 | ubuntu-noble | Loading collection community.mysql from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/mysql 2026-07-02 18:26:02.714462 | ubuntu-noble | Found installed collection community.mysql:3.16.1 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/mysql' 2026-07-02 18:26:02.721608 | ubuntu-noble | Loading collection fortinet.fortimanager from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/fortinet/fortimanager 2026-07-02 18:26:02.722041 | ubuntu-noble | Found installed collection fortinet.fortimanager:2.11.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/fortinet/fortimanager' 2026-07-02 18:26:02.722460 | ubuntu-noble | Loading collection ovirt.ovirt from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/ovirt/ovirt 2026-07-02 18:26:02.722927 | ubuntu-noble | Found installed collection ovirt.ovirt:3.2.1 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/ovirt/ovirt' 2026-07-02 18:26:02.723316 | ubuntu-noble | Loading collection community.hrobot from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/hrobot 2026-07-02 18:26:02.723754 | ubuntu-noble | Found installed collection community.hrobot:2.7.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/hrobot' 2026-07-02 18:26:02.724222 | ubuntu-noble | Loading collection cisco.asa from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/cisco/asa 2026-07-02 18:26:02.724646 | ubuntu-noble | Found installed collection cisco.asa:6.1.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/cisco/asa' 2026-07-02 18:26:02.725401 | ubuntu-noble | Loading collection inspur.ispim from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/inspur/ispim 2026-07-02 18:26:02.725756 | ubuntu-noble | Found installed collection inspur.ispim:2.2.3 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/inspur/ispim' 2026-07-02 18:26:02.726158 | ubuntu-noble | Loading collection community.rabbitmq from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/rabbitmq 2026-07-02 18:26:02.726432 | ubuntu-noble | Found installed collection community.rabbitmq:1.6.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/rabbitmq' 2026-07-02 18:26:02.726748 | ubuntu-noble | Loading collection infinidat.infinibox from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/infinidat/infinibox 2026-07-02 18:26:02.727023 | ubuntu-noble | Found installed collection infinidat.infinibox:1.6.3 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/infinidat/infinibox' 2026-07-02 18:26:02.727374 | ubuntu-noble | Loading collection containers.podman from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/containers/podman 2026-07-02 18:26:02.727715 | ubuntu-noble | Found installed collection containers.podman:1.18.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/containers/podman' 2026-07-02 18:26:02.728014 | ubuntu-noble | Loading collection cloud.common from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/cloud/common 2026-07-02 18:26:02.728247 | ubuntu-noble | Found installed collection cloud.common:4.2.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/cloud/common' 2026-07-02 18:26:02.746115 | ubuntu-noble | Loading collection cisco.mso from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/cisco/mso 2026-07-02 18:26:02.748769 | ubuntu-noble | Found installed collection cisco.mso:2.11.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/cisco/mso' 2026-07-02 18:26:02.748795 | ubuntu-noble | Loading collection sensu.sensu_go from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/sensu/sensu_go 2026-07-02 18:26:02.748800 | ubuntu-noble | Found installed collection sensu.sensu_go:1.14.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/sensu/sensu_go' 2026-07-02 18:26:02.748805 | ubuntu-noble | Loading collection cyberark.conjur from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/cyberark/conjur 2026-07-02 18:26:02.748809 | ubuntu-noble | Found installed collection cyberark.conjur:1.3.8 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/cyberark/conjur' 2026-07-02 18:26:02.748812 | ubuntu-noble | Loading collection netbox.netbox from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/netbox/netbox 2026-07-02 18:26:02.748819 | ubuntu-noble | Found installed collection netbox.netbox:3.21.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/netbox/netbox' 2026-07-02 18:26:02.751066 | ubuntu-noble | Loading collection cisco.nxos from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/cisco/nxos 2026-07-02 18:26:02.751355 | ubuntu-noble | Found installed collection cisco.nxos:9.4.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/cisco/nxos' 2026-07-02 18:26:02.751761 | ubuntu-noble | Loading collection cisco.intersight from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/cisco/intersight 2026-07-02 18:26:02.752054 | ubuntu-noble | Found installed collection cisco.intersight:2.7.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/cisco/intersight' 2026-07-02 18:26:02.752632 | ubuntu-noble | Loading collection vmware.vmware from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/vmware/vmware 2026-07-02 18:26:02.752934 | ubuntu-noble | Found installed collection vmware.vmware:1.11.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/vmware/vmware' 2026-07-02 18:26:02.753218 | ubuntu-noble | Loading collection community.routeros from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/routeros 2026-07-02 18:26:02.753610 | ubuntu-noble | Found installed collection community.routeros:3.13.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/routeros' 2026-07-02 18:26:02.755441 | ubuntu-noble | Loading collection community.vmware from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/vmware 2026-07-02 18:26:02.755815 | ubuntu-noble | Found installed collection community.vmware:5.10.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/vmware' 2026-07-02 18:26:02.756080 | ubuntu-noble | Loading collection community.library_inventory_filtering_v1 from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/library_inventory_filtering_v1 2026-07-02 18:26:02.756295 | ubuntu-noble | Found installed collection community.library_inventory_filtering_v1:1.1.5 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/library_inventory_filtering_v1' 2026-07-02 18:26:02.758319 | ubuntu-noble | Loading collection azure.azcollection from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/azure/azcollection 2026-07-02 18:26:02.758594 | ubuntu-noble | Found installed collection azure.azcollection:3.10.1 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/azure/azcollection' 2026-07-02 18:26:02.759013 | ubuntu-noble | Loading collection ravendb.ravendb from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/ravendb/ravendb 2026-07-02 18:26:02.759250 | ubuntu-noble | Found installed collection ravendb.ravendb:1.0.4 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/ravendb/ravendb' 2026-07-02 18:26:02.759943 | ubuntu-noble | Loading collection ibm.qradar from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/ibm/qradar 2026-07-02 18:26:02.760180 | ubuntu-noble | Found installed collection ibm.qradar:4.0.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/ibm/qradar' 2026-07-02 18:26:02.760597 | ubuntu-noble | Loading collection ansible.posix from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/ansible/posix 2026-07-02 18:26:02.760864 | ubuntu-noble | Found installed collection ansible.posix:1.6.2 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/ansible/posix' 2026-07-02 18:26:02.761305 | ubuntu-noble | Loading collection community.sap_libs from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/sap_libs 2026-07-02 18:26:02.761703 | ubuntu-noble | Found installed collection community.sap_libs:1.5.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/sap_libs' 2026-07-02 18:26:02.762113 | ubuntu-noble | Loading collection community.zabbix from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/zabbix 2026-07-02 18:26:02.762466 | ubuntu-noble | Found installed collection community.zabbix:3.3.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/zabbix' 2026-07-02 18:26:02.762788 | ubuntu-noble | Loading collection community.hashi_vault from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/hashi_vault 2026-07-02 18:26:02.763025 | ubuntu-noble | Found installed collection community.hashi_vault:6.2.1 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/hashi_vault' 2026-07-02 18:26:02.763246 | ubuntu-noble | Loading collection hitachivantara.vspone_object from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/hitachivantara/vspone_object 2026-07-02 18:26:02.763509 | ubuntu-noble | Found installed collection hitachivantara.vspone_object:1.0.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/hitachivantara/vspone_object' 2026-07-02 18:26:02.763916 | ubuntu-noble | Loading collection microsoft.ad from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/microsoft/ad 2026-07-02 18:26:02.764141 | ubuntu-noble | Found installed collection microsoft.ad:1.9.2 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/microsoft/ad' 2026-07-02 18:26:02.764357 | ubuntu-noble | Loading collection community.libvirt from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/libvirt 2026-07-02 18:26:02.764717 | ubuntu-noble | Found installed collection community.libvirt:1.4.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/libvirt' 2026-07-02 18:26:02.769097 | ubuntu-noble | Loading collection community.aws from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/aws 2026-07-02 18:26:02.769618 | ubuntu-noble | Found installed collection community.aws:9.3.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/aws' 2026-07-02 18:26:02.769983 | ubuntu-noble | Loading collection community.ciscosmb from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/ciscosmb 2026-07-02 18:26:02.770293 | ubuntu-noble | Found installed collection community.ciscosmb:1.0.11 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/ciscosmb' 2026-07-02 18:26:02.770879 | ubuntu-noble | Loading collection netapp.cloudmanager from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/netapp/cloudmanager 2026-07-02 18:26:02.771209 | ubuntu-noble | Found installed collection netapp.cloudmanager:21.24.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/netapp/cloudmanager' 2026-07-02 18:26:02.771510 | ubuntu-noble | Loading collection cisco.ise from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/cisco/ise 2026-07-02 18:26:02.771992 | ubuntu-noble | Found installed collection cisco.ise:2.10.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/cisco/ise' 2026-07-02 18:26:02.772666 | ubuntu-noble | Loading collection telekom_mms.icinga_director from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/telekom_mms/icinga_director 2026-07-02 18:26:02.773025 | ubuntu-noble | Found installed collection telekom_mms.icinga_director:2.4.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/telekom_mms/icinga_director' 2026-07-02 18:26:02.773328 | ubuntu-noble | Loading collection cloudscale_ch.cloud from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/cloudscale_ch/cloud 2026-07-02 18:26:02.773850 | ubuntu-noble | Found installed collection cloudscale_ch.cloud:2.5.2 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/cloudscale_ch/cloud' 2026-07-02 18:26:02.774150 | ubuntu-noble | Loading collection community.mongodb from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/mongodb 2026-07-02 18:26:02.774417 | ubuntu-noble | Found installed collection community.mongodb:1.7.10 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/mongodb' 2026-07-02 18:26:02.774910 | ubuntu-noble | Loading collection community.digitalocean from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/digitalocean 2026-07-02 18:26:02.775266 | ubuntu-noble | Found installed collection community.digitalocean:1.27.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/digitalocean' 2026-07-02 18:26:02.775527 | ubuntu-noble | Loading collection cisco.dnac from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/cisco/dnac 2026-07-02 18:26:02.775923 | ubuntu-noble | Found installed collection cisco.dnac:6.31.3 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/cisco/dnac' 2026-07-02 18:26:02.776281 | ubuntu-noble | Loading collection hitachivantara.vspone_block from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/hitachivantara/vspone_block 2026-07-02 18:26:02.776693 | ubuntu-noble | Found installed collection hitachivantara.vspone_block:3.5.1 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/hitachivantara/vspone_block' 2026-07-02 18:26:02.777043 | ubuntu-noble | Loading collection community.dns from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/dns 2026-07-02 18:26:02.777287 | ubuntu-noble | Found installed collection community.dns:3.4.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/dns' 2026-07-02 18:26:02.778702 | ubuntu-noble | Loading collection amazon.aws from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/amazon/aws 2026-07-02 18:26:02.779053 | ubuntu-noble | Found installed collection amazon.aws:9.5.2 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/amazon/aws' 2026-07-02 18:26:02.779923 | ubuntu-noble | Loading collection arista.eos from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/arista/eos 2026-07-02 18:26:02.780221 | ubuntu-noble | Found installed collection arista.eos:10.1.1 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/arista/eos' 2026-07-02 18:26:02.782264 | ubuntu-noble | Loading collection cisco.meraki from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/cisco/meraki 2026-07-02 18:26:02.782599 | ubuntu-noble | Found installed collection cisco.meraki:2.21.8 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/cisco/meraki' 2026-07-02 18:26:02.782954 | ubuntu-noble | Loading collection ieisystem.inmanage from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/ieisystem/inmanage 2026-07-02 18:26:02.783250 | ubuntu-noble | Found installed collection ieisystem.inmanage:3.0.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/ieisystem/inmanage' 2026-07-02 18:26:02.783763 | ubuntu-noble | Loading collection f5networks.f5_modules from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/f5networks/f5_modules 2026-07-02 18:26:02.784062 | ubuntu-noble | Found installed collection f5networks.f5_modules:1.39.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/f5networks/f5_modules' 2026-07-02 18:26:02.784334 | ubuntu-noble | Loading collection ansible.utils from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/ansible/utils 2026-07-02 18:26:02.784637 | ubuntu-noble | Found installed collection ansible.utils:5.1.2 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/ansible/utils' 2026-07-02 18:26:02.784935 | ubuntu-noble | Loading collection lowlydba.sqlserver from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/lowlydba/sqlserver 2026-07-02 18:26:02.785214 | ubuntu-noble | Found installed collection lowlydba.sqlserver:2.7.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/lowlydba/sqlserver' 2026-07-02 18:26:02.785690 | ubuntu-noble | Loading collection community.okd from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/okd 2026-07-02 18:26:02.785994 | ubuntu-noble | Found installed collection community.okd:4.0.2 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/okd' 2026-07-02 18:26:02.786601 | ubuntu-noble | Loading collection dellemc.enterprise_sonic from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/dellemc/enterprise_sonic 2026-07-02 18:26:02.786935 | ubuntu-noble | Found installed collection dellemc.enterprise_sonic:2.5.1 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/dellemc/enterprise_sonic' 2026-07-02 18:26:02.787442 | ubuntu-noble | Loading collection community.crypto from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/crypto 2026-07-02 18:26:02.787715 | ubuntu-noble | Found installed collection community.crypto:2.26.6 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/crypto' 2026-07-02 18:26:02.788159 | ubuntu-noble | Loading collection netapp.storagegrid from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/netapp/storagegrid 2026-07-02 18:26:02.789763 | ubuntu-noble | Found installed collection netapp.storagegrid:21.14.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/netapp/storagegrid' 2026-07-02 18:26:02.790479 | ubuntu-noble | Loading collection theforeman.foreman from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/theforeman/foreman 2026-07-02 18:26:02.790849 | ubuntu-noble | Found installed collection theforeman.foreman:4.2.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/theforeman/foreman' 2026-07-02 18:26:02.791352 | ubuntu-noble | Loading collection community.docker from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/docker 2026-07-02 18:26:02.791696 | ubuntu-noble | Found installed collection community.docker:4.8.2 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/docker' 2026-07-02 18:26:02.792186 | ubuntu-noble | Loading collection wti.remote from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/wti/remote 2026-07-02 18:26:02.792485 | ubuntu-noble | Found installed collection wti.remote:1.0.10 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/wti/remote' 2026-07-02 18:26:02.793189 | ubuntu-noble | Loading collection dellemc.openmanage from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/dellemc/openmanage 2026-07-02 18:26:02.793424 | ubuntu-noble | Found installed collection dellemc.openmanage:9.12.3 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/dellemc/openmanage' 2026-07-02 18:26:02.793826 | ubuntu-noble | Loading collection grafana.grafana from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/grafana/grafana 2026-07-02 18:26:02.794168 | ubuntu-noble | Found installed collection grafana.grafana:5.7.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/grafana/grafana' 2026-07-02 18:26:02.794405 | ubuntu-noble | Loading collection ibm.spectrum_virtualize from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/ibm/spectrum_virtualize 2026-07-02 18:26:02.794676 | ubuntu-noble | Found installed collection ibm.spectrum_virtualize:2.0.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/ibm/spectrum_virtualize' 2026-07-02 18:26:02.795068 | ubuntu-noble | Loading collection netapp_eseries.santricity from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/netapp_eseries/santricity 2026-07-02 18:26:02.795304 | ubuntu-noble | Found installed collection netapp_eseries.santricity:1.4.1 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/netapp_eseries/santricity' 2026-07-02 18:26:02.795540 | ubuntu-noble | Loading collection cisco.ucs from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/cisco/ucs 2026-07-02 18:26:02.795849 | ubuntu-noble | Found installed collection cisco.ucs:1.16.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/cisco/ucs' 2026-07-02 18:26:02.796331 | ubuntu-noble | Loading collection community.windows from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/windows 2026-07-02 18:26:02.796637 | ubuntu-noble | Found installed collection community.windows:2.4.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/windows' 2026-07-02 18:26:02.800256 | ubuntu-noble | Loading collection fortinet.fortios from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/fortinet/fortios 2026-07-02 18:26:02.800596 | ubuntu-noble | Found installed collection fortinet.fortios:2.4.2 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/fortinet/fortios' 2026-07-02 18:26:02.800837 | ubuntu-noble | Loading collection community.sops from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/sops 2026-07-02 18:26:02.801186 | ubuntu-noble | Found installed collection community.sops:2.2.7 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/sops' 2026-07-02 18:26:02.803911 | ubuntu-noble | Loading collection vmware.vmware_rest from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/vmware/vmware_rest 2026-07-02 18:26:02.804251 | ubuntu-noble | Found installed collection vmware.vmware_rest:4.9.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/vmware/vmware_rest' 2026-07-02 18:26:02.805428 | ubuntu-noble | Loading collection junipernetworks.junos from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/junipernetworks/junos 2026-07-02 18:26:02.805673 | ubuntu-noble | Found installed collection junipernetworks.junos:9.1.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/junipernetworks/junos' 2026-07-02 18:26:02.806228 | ubuntu-noble | Loading collection vultr.cloud from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/vultr/cloud 2026-07-02 18:26:02.806541 | ubuntu-noble | Found installed collection vultr.cloud:1.13.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/vultr/cloud' 2026-07-02 18:26:02.808311 | ubuntu-noble | Loading collection cisco.aci from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/cisco/aci 2026-07-02 18:26:02.808667 | ubuntu-noble | Found installed collection cisco.aci:2.12.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/cisco/aci' 2026-07-02 18:26:02.809597 | ubuntu-noble | Loading collection cisco.iosxr from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/cisco/iosxr 2026-07-02 18:26:02.809834 | ubuntu-noble | Found installed collection cisco.iosxr:10.3.1 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/cisco/iosxr' 2026-07-02 18:26:02.810174 | ubuntu-noble | Loading collection purestorage.flashblade from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/purestorage/flashblade 2026-07-02 18:26:02.810485 | ubuntu-noble | Found installed collection purestorage.flashblade:1.22.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/purestorage/flashblade' 2026-07-02 18:26:02.811164 | ubuntu-noble | Loading collection check_point.mgmt from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/check_point/mgmt 2026-07-02 18:26:02.811394 | ubuntu-noble | Found installed collection check_point.mgmt:6.6.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/check_point/mgmt' 2026-07-02 18:26:02.812528 | ubuntu-noble | Loading collection ansible.netcommon from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/ansible/netcommon 2026-07-02 18:26:02.812801 | ubuntu-noble | Found installed collection ansible.netcommon:7.2.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/ansible/netcommon' 2026-07-02 18:26:02.853466 | ubuntu-noble | Loading collection community.network from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/network 2026-07-02 18:26:02.854151 | ubuntu-noble | Found installed collection community.network:5.1.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/network' 2026-07-02 18:26:02.856765 | ubuntu-noble | Loading collection google.cloud from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/google/cloud 2026-07-02 18:26:02.856789 | ubuntu-noble | Found installed collection google.cloud:1.9.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/google/cloud' 2026-07-02 18:26:02.856795 | ubuntu-noble | Loading collection vyos.vyos from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/vyos/vyos 2026-07-02 18:26:02.856799 | ubuntu-noble | Found installed collection vyos.vyos:5.0.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/vyos/vyos' 2026-07-02 18:26:02.856803 | ubuntu-noble | Loading collection openstack.cloud from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/openstack/cloud 2026-07-02 18:26:02.857112 | ubuntu-noble | Found installed collection openstack.cloud:2.5.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/openstack/cloud' 2026-07-02 18:26:02.857521 | ubuntu-noble | Loading collection cyberark.pas from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/cyberark/pas 2026-07-02 18:26:02.857958 | ubuntu-noble | Found installed collection cyberark.pas:1.0.36 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/cyberark/pas' 2026-07-02 18:26:02.858344 | ubuntu-noble | Loading collection dellemc.unity from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/dellemc/unity 2026-07-02 18:26:02.858791 | ubuntu-noble | Found installed collection dellemc.unity:2.1.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/dellemc/unity' 2026-07-02 18:26:02.859185 | ubuntu-noble | Loading collection community.proxysql from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/proxysql 2026-07-02 18:26:02.859485 | ubuntu-noble | Found installed collection community.proxysql:1.7.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/proxysql' 2026-07-02 18:26:02.868356 | ubuntu-noble | Loading collection community.general from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/general 2026-07-02 18:26:02.868811 | ubuntu-noble | Found installed collection community.general:10.7.6 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/general' 2026-07-02 18:26:02.869883 | ubuntu-noble | Loading collection netapp.ontap from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/netapp/ontap 2026-07-02 18:26:02.870235 | ubuntu-noble | Found installed collection netapp.ontap:22.14.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/netapp/ontap' 2026-07-02 18:26:02.871318 | ubuntu-noble | Loading collection hetzner.hcloud from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/hetzner/hcloud 2026-07-02 18:26:02.871712 | ubuntu-noble | Found installed collection hetzner.hcloud:4.3.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/hetzner/hcloud' 2026-07-02 18:26:02.872094 | ubuntu-noble | Loading collection ibm.storage_virtualize from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/ibm/storage_virtualize 2026-07-02 18:26:02.872416 | ubuntu-noble | Found installed collection ibm.storage_virtualize:2.7.4 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/ibm/storage_virtualize' 2026-07-02 18:26:02.872948 | ubuntu-noble | Loading collection ngine_io.cloudstack from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/ngine_io/cloudstack 2026-07-02 18:26:02.873295 | ubuntu-noble | Found installed collection ngine_io.cloudstack:2.5.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/ngine_io/cloudstack' 2026-07-02 18:26:02.873752 | ubuntu-noble | Loading collection microsoft.iis from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/microsoft/iis 2026-07-02 18:26:02.874097 | ubuntu-noble | Found installed collection microsoft.iis:1.0.3 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/microsoft/iis' 2026-07-02 18:26:02.874452 | ubuntu-noble | Loading collection community.postgresql from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/postgresql 2026-07-02 18:26:02.874798 | ubuntu-noble | Found installed collection community.postgresql:3.14.2 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/postgresql' 2026-07-02 18:26:02.875588 | ubuntu-noble | Loading collection cisco.ios from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/cisco/ios 2026-07-02 18:26:02.875899 | ubuntu-noble | Found installed collection cisco.ios:9.2.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/cisco/ios' 2026-07-02 18:26:02.876176 | ubuntu-noble | Loading collection community.grafana from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/grafana 2026-07-02 18:26:02.876451 | ubuntu-noble | Found installed collection community.grafana:2.3.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/grafana' 2026-07-02 18:26:02.880958 | ubuntu-noble | Initial connection to galaxy_server: https://galaxy.ansible.com 2026-07-02 18:26:02.881277 | ubuntu-noble | Created /home/zuul/.ansible/galaxy_token 2026-07-02 18:26:02.881590 | ubuntu-noble | Calling Galaxy at https://galaxy.ansible.com/api/ 2026-07-02 18:26:03.076214 | ubuntu-noble | Found API version 'v3, pulp-v3, v1' with Galaxy server default (https://galaxy.ansible.com/api/) 2026-07-02 18:26:03.076694 | ubuntu-noble | Calling Galaxy at https://galaxy.ansible.com/api/v3/collections/osism/commons/ 2026-07-02 18:26:03.497554 | debian-bookworm | Calling Galaxy at https://galaxy.ansible.com/api/v3/collections/osism/commons/versions/?limit=100 2026-07-02 18:26:03.543160 | ubuntu-noble | Calling Galaxy at https://galaxy.ansible.com/api/v3/collections/osism/commons/versions/?limit=100 2026-07-02 18:26:04.190862 | ubuntu-noble | Calling Galaxy at https://galaxy.ansible.com/api/v3/collections/osism/commons/versions/0.20260601.0/ 2026-07-02 18:26:05.054145 | ubuntu-noble | Server https://galaxy.ansible.com/api/ has not signed osism.commons:0.20260601.0 2026-07-02 18:26:05.054725 | ubuntu-noble | Fetching a collection tarball for 'osism.commons:0.20260601.0' from Ansible Galaxy 2026-07-02 18:26:06.291911 | ubuntu-noble | Validating downloaded file hash 1d41d3b5d145afda8cce7ec8515d5495c0afe9a3787ce4d2ea101956f5f7e2b1 with expected hash 1d41d3b5d145afda8cce7ec8515d5495c0afe9a3787ce4d2ea101956f5f7e2b1 2026-07-02 18:26:06.292651 | ubuntu-noble | Collection 'osism.commons:0.20260601.0' obtained from server default https://galaxy.ansible.com/api/ 2026-07-02 18:26:06.473361 | ubuntu-noble | Starting galaxy collection install process 2026-07-02 18:26:06.473985 | ubuntu-noble | Process install dependency map 2026-07-02 18:26:06.474801 | ubuntu-noble | Starting collection install process 2026-07-02 18:26:06.474835 | ubuntu-noble | 'ansible.posix:1.6.2' is already installed, skipping. 2026-07-02 18:26:06.475232 | ubuntu-noble | 'community.docker:4.8.2' is already installed, skipping. 2026-07-02 18:26:06.476074 | ubuntu-noble | 'community.general:10.7.6' is already installed, skipping. 2026-07-02 18:26:06.476988 | ubuntu-noble | 'community.library_inventory_filtering_v1:1.1.5' is already installed, skipping. 2026-07-02 18:26:06.477779 | ubuntu-noble | Downloading https://galaxy.ansible.com/api/v3/plugin/ansible/content/published/collections/artifacts/osism-commons-0.20260601.0.tar.gz to /home/zuul/.ansible/tmp/ansible-local-1846qmea1w1o/tmpn3ebseae/osism-commons-0.20260601.0-ropcgoyp 2026-07-02 18:26:06.477855 | ubuntu-noble | Installing 'osism.commons:0.20260601.0' to '/home/zuul/.ansible/collections/ansible_collections/osism/commons' 2026-07-02 18:26:06.478198 | ubuntu-noble | osism.commons:0.20260601.0 was installed successfully 2026-07-02 18:26:06.577924 | ubuntu-noble | INFO [delegated > dependency] Dependency completed successfully. 2026-07-02 18:26:06.578434 | ubuntu-noble | WARNING [delegated > dependency] Executed: Missing roles requirements file: requirements.yml (Remove from dependency_sequence to suppress) 2026-07-02 18:26:06.580112 | ubuntu-noble | WARNING Molecule executed 1 scenario (1 missing files) 2026-07-02 18:26:07.113270 | ubuntu-noble | ok: Runtime: 0:00:06.683765 2026-07-02 18:26:09.098483 | debian-bookworm | Calling Galaxy at https://galaxy.ansible.com/api/v3/collections/osism/commons/versions/0.20260601.0/ 2026-07-02 18:26:13.372057 | debian-bookworm | Server https://galaxy.ansible.com/api/ has not signed osism.commons:0.20260601.0 2026-07-02 18:26:13.372387 | debian-bookworm | Fetching a collection tarball for 'osism.commons:0.20260601.0' from Ansible Galaxy 2026-07-02 18:26:14.949532 | debian-bookworm | ok: Runtime: 0:00:15.039399 2026-07-02 18:26:14.972194 | 2026-07-02 18:26:14.972429 | TASK [ansible-molecule : Run molecule create action with scenario delegated] 2026-07-02 18:26:14.570359 | debian-bookworm | Validating downloaded file hash 1d41d3b5d145afda8cce7ec8515d5495c0afe9a3787ce4d2ea101956f5f7e2b1 with expected hash 1d41d3b5d145afda8cce7ec8515d5495c0afe9a3787ce4d2ea101956f5f7e2b1 2026-07-02 18:26:14.570489 | debian-bookworm | Collection 'osism.commons:0.20260601.0' obtained from server default https://galaxy.ansible.com/api/ 2026-07-02 18:26:14.742663 | debian-bookworm | Starting galaxy collection install process 2026-07-02 18:26:14.742778 | debian-bookworm | Process install dependency map 2026-07-02 18:26:14.742796 | debian-bookworm | Starting collection install process 2026-07-02 18:26:14.742839 | debian-bookworm | 'ansible.posix:1.6.2' is already installed, skipping. 2026-07-02 18:26:14.743093 | debian-bookworm | 'community.docker:4.8.2' is already installed, skipping. 2026-07-02 18:26:14.743179 | debian-bookworm | 'community.general:10.7.6' is already installed, skipping. 2026-07-02 18:26:14.743206 | debian-bookworm | 'community.library_inventory_filtering_v1:1.1.5' is already installed, skipping. 2026-07-02 18:26:14.743231 | debian-bookworm | Downloading https://galaxy.ansible.com/api/v3/plugin/ansible/content/published/collections/artifacts/osism-commons-0.20260601.0.tar.gz to /home/zuul/.ansible/tmp/ansible-local-1942ftftn2cm/tmp64o2u5p6/osism-commons-0.20260601.0-o6eqw097 2026-07-02 18:26:14.743424 | debian-bookworm | Installing 'osism.commons:0.20260601.0' to '/home/zuul/.ansible/collections/ansible_collections/osism/commons' 2026-07-02 18:26:14.743507 | debian-bookworm | osism.commons:0.20260601.0 was installed successfully 2026-07-02 18:26:14.833771 | debian-bookworm | INFO [delegated > dependency] Dependency completed successfully. 2026-07-02 18:26:14.833846 | debian-bookworm | WARNING [delegated > dependency] Executed: Missing roles requirements file: requirements.yml (Remove from dependency_sequence to suppress) 2026-07-02 18:26:14.833859 | debian-bookworm | WARNING Molecule executed 1 scenario (1 missing files) 2026-07-02 18:26:15.573955 | ubuntu-noble | skipping: Conditional result was False 2026-07-02 18:26:15.574706 | debian-bookworm | skipping: Conditional result was False 2026-07-02 18:26:15.581188 | 2026-07-02 18:26:15.581318 | TASK [ansible-molecule : Run molecule prepare action with scenario delegated] 2026-07-02 18:26:16.261563 | debian-bookworm | WARNING Molecule scenarios should migrate to 'extensions/molecule' 2026-07-02 18:26:16.271323 | debian-bookworm | DEBUG [unknown > config] provisioner.env found in /home/zuul/src/github.com/osism/ansible-collection-services/molecule/delegated/molecule.yml, this can be defined in ansible.env 2026-07-02 18:26:16.371791 | ubuntu-noble | WARNING Molecule scenarios should migrate to 'extensions/molecule' 2026-07-02 18:26:16.381782 | ubuntu-noble | DEBUG [unknown > config] provisioner.env found in /home/zuul/src/github.com/osism/ansible-collection-services/molecule/delegated/molecule.yml, this can be defined in ansible.env 2026-07-02 18:26:16.760305 | debian-bookworm | DEBUG [unknown > config] provisioner.env found in /home/zuul/src/github.com/osism/ansible-collection-services/molecule/delegated/molecule.yml, this can be defined in ansible.env 2026-07-02 18:26:16.760942 | debian-bookworm | DEBUG [delegated > validate] Validating schema /home/zuul/src/github.com/osism/ansible-collection-services/molecule/delegated/molecule.yml. 2026-07-02 18:26:16.796120 | debian-bookworm | DEBUG [default > validate] Validating schema /home/zuul/src/github.com/osism/ansible-collection-services/molecule/default/molecule.yml. 2026-07-02 18:26:16.804944 | debian-bookworm | INFO [delegated > discovery] scenario test matrix: prepare 2026-07-02 18:26:16.805031 | debian-bookworm | INFO [delegated > prerun] Performing prerun with role_name_check=0... 2026-07-02 18:26:16.942817 | ubuntu-noble | DEBUG [unknown > config] provisioner.env found in /home/zuul/src/github.com/osism/ansible-collection-services/molecule/delegated/molecule.yml, this can be defined in ansible.env 2026-07-02 18:26:16.942869 | ubuntu-noble | DEBUG [delegated > validate] Validating schema /home/zuul/src/github.com/osism/ansible-collection-services/molecule/delegated/molecule.yml. 2026-07-02 18:26:16.966391 | ubuntu-noble | DEBUG [default > validate] Validating schema /home/zuul/src/github.com/osism/ansible-collection-services/molecule/default/molecule.yml. 2026-07-02 18:26:16.974541 | ubuntu-noble | INFO [delegated > discovery] scenario test matrix: prepare 2026-07-02 18:26:16.974760 | ubuntu-noble | INFO [delegated > prerun] Performing prerun with role_name_check=0... 2026-07-02 18:26:18.107923 | debian-bookworm | INFO [delegated > prepare] Executing 2026-07-02 18:26:18.448342 | debian-bookworm | DEBUG [delegated > prepare] ansible-playbook version: ansible-playbook 2026-07-02 18:26:18.448407 | debian-bookworm | config file = None 2026-07-02 18:26:18.448424 | debian-bookworm | configured module search path = 2026-07-02 18:26:18.448430 | debian-bookworm | ansible python module location = /home/zuul/venv/lib/python3.11/site-packages/ansible 2026-07-02 18:26:18.448438 | debian-bookworm | ansible collection location = /home/zuul/.ansible/collections:/usr/share/ansible/collections 2026-07-02 18:26:18.448443 | debian-bookworm | executable location = /home/zuul/venv/bin/ansible-playbook 2026-07-02 18:26:18.448447 | debian-bookworm | python version = 3.11.2 (main, Apr 8 2026, 01:58:00) (/home/zuul/venv/bin/python3) 2026-07-02 18:26:18.448451 | debian-bookworm | jinja version = 3.1.6 2026-07-02 18:26:18.448456 | debian-bookworm | libyaml = True 2026-07-02 18:26:18.448563 | debian-bookworm | DEBUG ANSIBLE ENVIRONMENT: 2026-07-02 18:26:18.448571 | debian-bookworm | ANSIBLE_COLLECTIONS_PATH: /home/zuul/venv/.ansible/collections:/home/zuul/.ansible/collections 2026-07-02 18:26:18.448575 | debian-bookworm | ANSIBLE_CONFIG: /home/zuul/.ansible/tmp/molecule.oWZD.delegated/ansible.cfg 2026-07-02 18:26:18.448579 | debian-bookworm | ANSIBLE_LIBRARY: ../../plugins 2026-07-02 18:26:18.448584 | debian-bookworm | ANSIBLE_PYTHON_INTERPRETER: /home/zuul/venv/bin/python 2026-07-02 18:26:18.448587 | debian-bookworm | ANSIBLE_ROLE: auditd 2026-07-02 18:26:18.448591 | debian-bookworm | ANSIBLE_ROLES_PATH: ../../roles 2026-07-02 18:26:18.448595 | debian-bookworm | ANSIBLE_VERBOSITY: 1 2026-07-02 18:26:18.448599 | debian-bookworm | 2026-07-02 18:26:18.448832 | debian-bookworm | DEBUG MOLECULE ENVIRONMENT: 2026-07-02 18:26:18.448839 | debian-bookworm | MOLECULE_DEBUG: True 2026-07-02 18:26:18.448843 | debian-bookworm | MOLECULE_DEPENDENCY_NAME: galaxy 2026-07-02 18:26:18.448847 | debian-bookworm | MOLECULE_DRIVER_NAME: default 2026-07-02 18:26:18.448851 | debian-bookworm | MOLECULE_ENV_FILE: /home/zuul/src/github.com/osism/ansible-collection-services/.env.yml 2026-07-02 18:26:18.448855 | debian-bookworm | MOLECULE_EPHEMERAL_DIRECTORY: /home/zuul/.ansible/tmp/molecule.oWZD.delegated 2026-07-02 18:26:18.448859 | debian-bookworm | MOLECULE_FILE: /home/zuul/.ansible/tmp/molecule.oWZD.delegated/molecule.yml 2026-07-02 18:26:18.448864 | debian-bookworm | MOLECULE_INSTANCE_CONFIG: /home/zuul/.ansible/tmp/molecule.oWZD.delegated/instance_config.yml 2026-07-02 18:26:18.448867 | debian-bookworm | MOLECULE_INVENTORY_FILE: /home/zuul/.ansible/tmp/molecule.oWZD.delegated/inventory/ansible_inventory.yml 2026-07-02 18:26:18.448872 | debian-bookworm | MOLECULE_PROJECT_DIRECTORY: /home/zuul/src/github.com/osism/ansible-collection-services 2026-07-02 18:26:18.448876 | debian-bookworm | MOLECULE_PROVISIONER_NAME: ansible 2026-07-02 18:26:18.448880 | debian-bookworm | MOLECULE_SCENARIO_DIRECTORY: /home/zuul/src/github.com/osism/ansible-collection-services/molecule/delegated 2026-07-02 18:26:18.448884 | debian-bookworm | MOLECULE_SCENARIO_NAME: delegated 2026-07-02 18:26:18.448888 | debian-bookworm | MOLECULE_STATE_FILE: /home/zuul/.ansible/tmp/molecule.oWZD.delegated/state.yml 2026-07-02 18:26:18.448892 | debian-bookworm | MOLECULE_VERIFIER_NAME: testinfra 2026-07-02 18:26:18.448896 | debian-bookworm | MOLECULE_VERIFIER_TEST_DIRECTORY: /home/zuul/src/github.com/osism/ansible-collection-services/molecule/delegated/tests 2026-07-02 18:26:18.448900 | debian-bookworm | 2026-07-02 18:26:18.449123 | debian-bookworm | DEBUG SHELL REPLAY: ANSIBLE_COLLECTIONS_PATH=/home/zuul/venv/.ansible/collections:/home/zuul/.ansible/collections ANSIBLE_CONFIG=/home/zuul/.ansible/tmp/molecule.oWZD.delegated/ansible.cfg ANSIBLE_LIBRARY=../../plugins ANSIBLE_PYTHON_INTERPRETER=/home/zuul/venv/bin/python ANSIBLE_ROLE=auditd ANSIBLE_ROLES_PATH=../../roles ANSIBLE_VERBOSITY=1 MOLECULE_DEBUG=True MOLECULE_DEPENDENCY_NAME=galaxy MOLECULE_DRIVER_NAME=default MOLECULE_ENV_FILE=/home/zuul/src/github.com/osism/ansible-collection-services/.env.yml MOLECULE_EPHEMERAL_DIRECTORY=/home/zuul/.ansible/tmp/molecule.oWZD.delegated MOLECULE_FILE=/home/zuul/.ansible/tmp/molecule.oWZD.delegated/molecule.yml MOLECULE_INSTANCE_CONFIG=/home/zuul/.ansible/tmp/molecule.oWZD.delegated/instance_config.yml MOLECULE_INVENTORY_FILE=/home/zuul/.ansible/tmp/molecule.oWZD.delegated/inventory/ansible_inventory.yml MOLECULE_PROJECT_DIRECTORY=/home/zuul/src/github.com/osism/ansible-collection-services MOLECULE_PROVISIONER_NAME=ansible MOLECULE_SCENARIO_DIRECTORY=/home/zuul/src/github.com/osism/ansible-collection-services/molecule/delegated MOLECULE_SCENARIO_NAME=delegated MOLECULE_STATE_FILE=/home/zuul/.ansible/tmp/molecule.oWZD.delegated/state.yml MOLECULE_VERIFIER_NAME=testinfra MOLECULE_VERIFIER_TEST_DIRECTORY=/home/zuul/src/github.com/osism/ansible-collection-services/molecule/delegated/tests 2026-07-02 18:26:18.369877 | ubuntu-noble | INFO [delegated > prepare] Executing 2026-07-02 18:26:18.730818 | debian-bookworm | Using /home/zuul/.ansible/tmp/molecule.oWZD.delegated/ansible.cfg as config file 2026-07-02 18:26:19.010139 | debian-bookworm | 2026-07-02 18:26:19.010259 | debian-bookworm | PLAY [Prepare] ***************************************************************** 2026-07-02 18:26:19.010391 | debian-bookworm | 2026-07-02 18:26:19.010519 | debian-bookworm | TASK [Gathering Facts] ********************************************************* 2026-07-02 18:26:18.741842 | ubuntu-noble | DEBUG [delegated > prepare] ansible-playbook version: ansible-playbook 2026-07-02 18:26:18.741948 | ubuntu-noble | config file = None 2026-07-02 18:26:18.742007 | ubuntu-noble | configured module search path = 2026-07-02 18:26:18.742031 | ubuntu-noble | ansible python module location = /home/zuul/venv/lib/python3.12/site-packages/ansible 2026-07-02 18:26:18.742052 | ubuntu-noble | ansible collection location = /home/zuul/.ansible/collections:/usr/share/ansible/collections 2026-07-02 18:26:18.742063 | ubuntu-noble | executable location = /home/zuul/venv/bin/ansible-playbook 2026-07-02 18:26:18.742074 | ubuntu-noble | python version = 3.12.3 (main, Mar 23 2026, 19:04:32) (/home/zuul/venv/bin/python3) 2026-07-02 18:26:18.742085 | ubuntu-noble | jinja version = 3.1.6 2026-07-02 18:26:18.742095 | ubuntu-noble | libyaml = True 2026-07-02 18:26:18.743806 | ubuntu-noble | DEBUG ANSIBLE ENVIRONMENT: 2026-07-02 18:26:18.743860 | ubuntu-noble | ANSIBLE_COLLECTIONS_PATH: /home/zuul/venv/.ansible/collections:/home/zuul/.ansible/collections 2026-07-02 18:26:18.743874 | ubuntu-noble | ANSIBLE_CONFIG: /home/zuul/.ansible/tmp/molecule.oWZD.delegated/ansible.cfg 2026-07-02 18:26:18.743885 | ubuntu-noble | ANSIBLE_LIBRARY: ../../plugins 2026-07-02 18:26:18.743895 | ubuntu-noble | ANSIBLE_PYTHON_INTERPRETER: /home/zuul/venv/bin/python 2026-07-02 18:26:18.743905 | ubuntu-noble | ANSIBLE_ROLE: auditd 2026-07-02 18:26:18.743915 | ubuntu-noble | ANSIBLE_ROLES_PATH: ../../roles 2026-07-02 18:26:18.743924 | ubuntu-noble | ANSIBLE_VERBOSITY: 1 2026-07-02 18:26:18.743935 | ubuntu-noble | 2026-07-02 18:26:18.743948 | ubuntu-noble | DEBUG MOLECULE ENVIRONMENT: 2026-07-02 18:26:18.743959 | ubuntu-noble | MOLECULE_DEBUG: True 2026-07-02 18:26:18.743968 | ubuntu-noble | MOLECULE_DEPENDENCY_NAME: galaxy 2026-07-02 18:26:18.743978 | ubuntu-noble | MOLECULE_DRIVER_NAME: default 2026-07-02 18:26:18.743988 | ubuntu-noble | MOLECULE_ENV_FILE: /home/zuul/src/github.com/osism/ansible-collection-services/.env.yml 2026-07-02 18:26:18.743997 | ubuntu-noble | MOLECULE_EPHEMERAL_DIRECTORY: /home/zuul/.ansible/tmp/molecule.oWZD.delegated 2026-07-02 18:26:18.744007 | ubuntu-noble | MOLECULE_FILE: /home/zuul/.ansible/tmp/molecule.oWZD.delegated/molecule.yml 2026-07-02 18:26:18.744016 | ubuntu-noble | MOLECULE_INSTANCE_CONFIG: /home/zuul/.ansible/tmp/molecule.oWZD.delegated/instance_config.yml 2026-07-02 18:26:18.744026 | ubuntu-noble | MOLECULE_INVENTORY_FILE: /home/zuul/.ansible/tmp/molecule.oWZD.delegated/inventory/ansible_inventory.yml 2026-07-02 18:26:18.744036 | ubuntu-noble | MOLECULE_PROJECT_DIRECTORY: /home/zuul/src/github.com/osism/ansible-collection-services 2026-07-02 18:26:18.744046 | ubuntu-noble | MOLECULE_PROVISIONER_NAME: ansible 2026-07-02 18:26:18.744055 | ubuntu-noble | MOLECULE_SCENARIO_DIRECTORY: /home/zuul/src/github.com/osism/ansible-collection-services/molecule/delegated 2026-07-02 18:26:18.744065 | ubuntu-noble | MOLECULE_SCENARIO_NAME: delegated 2026-07-02 18:26:18.744074 | ubuntu-noble | MOLECULE_STATE_FILE: /home/zuul/.ansible/tmp/molecule.oWZD.delegated/state.yml 2026-07-02 18:26:18.744084 | ubuntu-noble | MOLECULE_VERIFIER_NAME: testinfra 2026-07-02 18:26:18.744093 | ubuntu-noble | MOLECULE_VERIFIER_TEST_DIRECTORY: /home/zuul/src/github.com/osism/ansible-collection-services/molecule/delegated/tests 2026-07-02 18:26:18.744104 | ubuntu-noble | 2026-07-02 18:26:18.744133 | ubuntu-noble | DEBUG SHELL REPLAY: ANSIBLE_COLLECTIONS_PATH=/home/zuul/venv/.ansible/collections:/home/zuul/.ansible/collections ANSIBLE_CONFIG=/home/zuul/.ansible/tmp/molecule.oWZD.delegated/ansible.cfg ANSIBLE_LIBRARY=../../plugins ANSIBLE_PYTHON_INTERPRETER=/home/zuul/venv/bin/python ANSIBLE_ROLE=auditd ANSIBLE_ROLES_PATH=../../roles ANSIBLE_VERBOSITY=1 MOLECULE_DEBUG=True MOLECULE_DEPENDENCY_NAME=galaxy MOLECULE_DRIVER_NAME=default MOLECULE_ENV_FILE=/home/zuul/src/github.com/osism/ansible-collection-services/.env.yml MOLECULE_EPHEMERAL_DIRECTORY=/home/zuul/.ansible/tmp/molecule.oWZD.delegated MOLECULE_FILE=/home/zuul/.ansible/tmp/molecule.oWZD.delegated/molecule.yml MOLECULE_INSTANCE_CONFIG=/home/zuul/.ansible/tmp/molecule.oWZD.delegated/instance_config.yml MOLECULE_INVENTORY_FILE=/home/zuul/.ansible/tmp/molecule.oWZD.delegated/inventory/ansible_inventory.yml MOLECULE_PROJECT_DIRECTORY=/home/zuul/src/github.com/osism/ansible-collection-services MOLECULE_PROVISIONER_NAME=ansible MOLECULE_SCENARIO_DIRECTORY=/home/zuul/src/github.com/osism/ansible-collection-services/molecule/delegated MOLECULE_SCENARIO_NAME=delegated MOLECULE_STATE_FILE=/home/zuul/.ansible/tmp/molecule.oWZD.delegated/state.yml MOLECULE_VERIFIER_NAME=testinfra MOLECULE_VERIFIER_TEST_DIRECTORY=/home/zuul/src/github.com/osism/ansible-collection-services/molecule/delegated/tests 2026-07-02 18:26:19.059672 | ubuntu-noble | Using /home/zuul/.ansible/tmp/molecule.oWZD.delegated/ansible.cfg as config file 2026-07-02 18:26:19.327186 | ubuntu-noble | 2026-07-02 18:26:19.327820 | ubuntu-noble | PLAY [Prepare] ***************************************************************** 2026-07-02 18:26:19.328216 | ubuntu-noble | 2026-07-02 18:26:19.330409 | ubuntu-noble | TASK [Gathering Facts] ********************************************************* 2026-07-02 18:26:20.164165 | debian-bookworm | ok: [molecule-auditd] 2026-07-02 18:26:20.164311 | debian-bookworm | 2026-07-02 18:26:20.164335 | debian-bookworm | TASK [Install packages in venv] ************************************************ 2026-07-02 18:26:20.668615 | ubuntu-noble | ok: [molecule-auditd] 2026-07-02 18:26:20.671309 | ubuntu-noble | 2026-07-02 18:26:20.671348 | ubuntu-noble | TASK [Install packages in venv] ************************************************ 2026-07-02 18:26:24.616200 | debian-bookworm | changed: [molecule-auditd] => (item=docker) => {"ansible_loop_var": "item", "changed": true, "cmd": ["/home/zuul/venv/bin/pip3", "install", "docker"], "item": "docker", "name": ["docker"], "requirements": null, "state": "present", "stderr": "", "stderr_lines": [], "stdout": "Collecting docker\n Downloading docker-7.1.0-py3-none-any.whl (147 kB)\n ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ 147.8/147.8 kB 4.4 MB/s eta 0:00:00\nRequirement already satisfied: requests>=2.26.0 in /home/zuul/venv/lib/python3.11/site-packages (from docker) (2.34.2)\nRequirement already satisfied: urllib3>=1.26.0 in /home/zuul/venv/lib/python3.11/site-packages (from docker) (2.7.0)\nRequirement already satisfied: charset_normalizer<4,>=2 in /home/zuul/venv/lib/python3.11/site-packages (from requests>=2.26.0->docker) (3.4.7)\nRequirement already satisfied: idna<4,>=2.5 in /home/zuul/venv/lib/python3.11/site-packages (from requests>=2.26.0->docker) (3.18)\nRequirement already satisfied: certifi>=2023.5.7 in /home/zuul/venv/lib/python3.11/site-packages (from requests>=2.26.0->docker) (2026.6.17)\nInstalling collected packages: docker\nSuccessfully installed docker-7.1.0\n", "stdout_lines": ["Collecting docker", " Downloading docker-7.1.0-py3-none-any.whl (147 kB)", " ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ 147.8/147.8 kB 4.4 MB/s eta 0:00:00", "Requirement already satisfied: requests>=2.26.0 in /home/zuul/venv/lib/python3.11/site-packages (from docker) (2.34.2)", "Requirement already satisfied: urllib3>=1.26.0 in /home/zuul/venv/lib/python3.11/site-packages (from docker) (2.7.0)", "Requirement already satisfied: charset_normalizer<4,>=2 in /home/zuul/venv/lib/python3.11/site-packages (from requests>=2.26.0->docker) (3.4.7)", "Requirement already satisfied: idna<4,>=2.5 in /home/zuul/venv/lib/python3.11/site-packages (from requests>=2.26.0->docker) (3.18)", "Requirement already satisfied: certifi>=2023.5.7 in /home/zuul/venv/lib/python3.11/site-packages (from requests>=2.26.0->docker) (2026.6.17)", "Installing collected packages: docker", "Successfully installed docker-7.1.0"], "version": null, "virtualenv": "/home/zuul/venv"} 2026-07-02 18:26:24.616425 | debian-bookworm | changed: [molecule-auditd] => (item=netaddr) => {"ansible_loop_var": "item", "changed": true, "cmd": ["/home/zuul/venv/bin/pip3", "install", "netaddr"], "item": "netaddr", "name": ["netaddr"], "requirements": null, "state": "present", "stderr": "", "stderr_lines": [], "stdout": "Collecting netaddr\n Downloading netaddr-1.3.0-py3-none-any.whl (2.3 MB)\n ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ 2.3/2.3 MB 13.7 MB/s eta 0:00:00\nInstalling collected packages: netaddr\nSuccessfully installed netaddr-1.3.0\n", "stdout_lines": ["Collecting netaddr", " Downloading netaddr-1.3.0-py3-none-any.whl (2.3 MB)", " ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ 2.3/2.3 MB 13.7 MB/s eta 0:00:00", "Installing collected packages: netaddr", "Successfully installed netaddr-1.3.0"], "version": null, "virtualenv": "/home/zuul/venv"} 2026-07-02 18:26:24.616581 | debian-bookworm | ok: [molecule-auditd] => (item=requests) => {"ansible_loop_var": "item", "changed": false, "cmd": ["/home/zuul/venv/bin/pip3", "install", "requests"], "item": "requests", "name": ["requests"], "requirements": null, "state": "present", "stderr": "", "stderr_lines": [], "stdout": "Requirement already satisfied: requests in /home/zuul/venv/lib/python3.11/site-packages (2.34.2)\nRequirement already satisfied: charset_normalizer<4,>=2 in /home/zuul/venv/lib/python3.11/site-packages (from requests) (3.4.7)\nRequirement already satisfied: idna<4,>=2.5 in /home/zuul/venv/lib/python3.11/site-packages (from requests) (3.18)\nRequirement already satisfied: urllib3<3,>=1.26 in /home/zuul/venv/lib/python3.11/site-packages (from requests) (2.7.0)\nRequirement already satisfied: certifi>=2023.5.7 in /home/zuul/venv/lib/python3.11/site-packages (from requests) (2026.6.17)\n", "stdout_lines": ["Requirement already satisfied: requests in /home/zuul/venv/lib/python3.11/site-packages (2.34.2)", "Requirement already satisfied: charset_normalizer<4,>=2 in /home/zuul/venv/lib/python3.11/site-packages (from requests) (3.4.7)", "Requirement already satisfied: idna<4,>=2.5 in /home/zuul/venv/lib/python3.11/site-packages (from requests) (3.18)", "Requirement already satisfied: urllib3<3,>=1.26 in /home/zuul/venv/lib/python3.11/site-packages (from requests) (2.7.0)", "Requirement already satisfied: certifi>=2023.5.7 in /home/zuul/venv/lib/python3.11/site-packages (from requests) (2026.6.17)"], "version": null, "virtualenv": "/home/zuul/venv"} 2026-07-02 18:26:24.616672 | debian-bookworm | 2026-07-02 18:26:24.616772 | debian-bookworm | TASK [Include required prepare tasks] ****************************************** 2026-07-02 18:26:24.639123 | debian-bookworm | included: /home/zuul/src/github.com/osism/ansible-collection-services/molecule/delegated/prepare/auditd.yml for molecule-auditd 2026-07-02 18:26:24.639252 | debian-bookworm | 2026-07-02 18:26:24.639389 | debian-bookworm | PLAY RECAP ********************************************************************* 2026-07-02 18:26:24.639518 | debian-bookworm | molecule-auditd : ok=3 changed=1 unreachable=0 failed=0 skipped=0 rescued=0 ignored=0 2026-07-02 18:26:24.639606 | debian-bookworm | 2026-07-02 18:26:24.720235 | debian-bookworm | INFO [delegated > prepare] Executed: Successful 2026-07-02 18:26:24.720979 | debian-bookworm | INFO Molecule executed 1 scenario (1 successful) 2026-07-02 18:26:25.748786 | ubuntu-noble | changed: [molecule-auditd] => (item=docker) => {"ansible_loop_var": "item", "changed": true, "cmd": ["/home/zuul/venv/bin/pip3", "install", "docker"], "item": "docker", "name": ["docker"], "requirements": null, "state": "present", "stderr": "", "stderr_lines": [], "stdout": "Collecting docker\n Downloading docker-7.1.0-py3-none-any.whl.metadata (3.8 kB)\nRequirement already satisfied: requests>=2.26.0 in /home/zuul/venv/lib/python3.12/site-packages (from docker) (2.34.2)\nRequirement already satisfied: urllib3>=1.26.0 in /home/zuul/venv/lib/python3.12/site-packages (from docker) (2.7.0)\nRequirement already satisfied: charset_normalizer<4,>=2 in /home/zuul/venv/lib/python3.12/site-packages (from requests>=2.26.0->docker) (3.4.7)\nRequirement already satisfied: idna<4,>=2.5 in /home/zuul/venv/lib/python3.12/site-packages (from requests>=2.26.0->docker) (3.18)\nRequirement already satisfied: certifi>=2023.5.7 in /home/zuul/venv/lib/python3.12/site-packages (from requests>=2.26.0->docker) (2026.6.17)\nDownloading docker-7.1.0-py3-none-any.whl (147 kB)\n ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ 147.8/147.8 kB 2.7 MB/s eta 0:00:00\nInstalling collected packages: docker\nSuccessfully installed docker-7.1.0\n", "stdout_lines": ["Collecting docker", " Downloading docker-7.1.0-py3-none-any.whl.metadata (3.8 kB)", "Requirement already satisfied: requests>=2.26.0 in /home/zuul/venv/lib/python3.12/site-packages (from docker) (2.34.2)", "Requirement already satisfied: urllib3>=1.26.0 in /home/zuul/venv/lib/python3.12/site-packages (from docker) (2.7.0)", "Requirement already satisfied: charset_normalizer<4,>=2 in /home/zuul/venv/lib/python3.12/site-packages (from requests>=2.26.0->docker) (3.4.7)", "Requirement already satisfied: idna<4,>=2.5 in /home/zuul/venv/lib/python3.12/site-packages (from requests>=2.26.0->docker) (3.18)", "Requirement already satisfied: certifi>=2023.5.7 in /home/zuul/venv/lib/python3.12/site-packages (from requests>=2.26.0->docker) (2026.6.17)", "Downloading docker-7.1.0-py3-none-any.whl (147 kB)", " ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ 147.8/147.8 kB 2.7 MB/s eta 0:00:00", "Installing collected packages: docker", "Successfully installed docker-7.1.0"], "version": null, "virtualenv": "/home/zuul/venv"} 2026-07-02 18:26:25.749501 | ubuntu-noble | changed: [molecule-auditd] => (item=netaddr) => {"ansible_loop_var": "item", "changed": true, "cmd": ["/home/zuul/venv/bin/pip3", "install", "netaddr"], "item": "netaddr", "name": ["netaddr"], "requirements": null, "state": "present", "stderr": "", "stderr_lines": [], "stdout": "Collecting netaddr\n Downloading netaddr-1.3.0-py3-none-any.whl.metadata (5.0 kB)\nDownloading netaddr-1.3.0-py3-none-any.whl (2.3 MB)\n ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ 2.3/2.3 MB 12.6 MB/s eta 0:00:00\nInstalling collected packages: netaddr\nSuccessfully installed netaddr-1.3.0\n", "stdout_lines": ["Collecting netaddr", " Downloading netaddr-1.3.0-py3-none-any.whl.metadata (5.0 kB)", "Downloading netaddr-1.3.0-py3-none-any.whl (2.3 MB)", " ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ 2.3/2.3 MB 12.6 MB/s eta 0:00:00", "Installing collected packages: netaddr", "Successfully installed netaddr-1.3.0"], "version": null, "virtualenv": "/home/zuul/venv"} 2026-07-02 18:26:25.749793 | ubuntu-noble | ok: [molecule-auditd] => (item=requests) => {"ansible_loop_var": "item", "changed": false, "cmd": ["/home/zuul/venv/bin/pip3", "install", "requests"], "item": "requests", "name": ["requests"], "requirements": null, "state": "present", "stderr": "", "stderr_lines": [], "stdout": "Requirement already satisfied: requests in /home/zuul/venv/lib/python3.12/site-packages (2.34.2)\nRequirement already satisfied: charset_normalizer<4,>=2 in /home/zuul/venv/lib/python3.12/site-packages (from requests) (3.4.7)\nRequirement already satisfied: idna<4,>=2.5 in /home/zuul/venv/lib/python3.12/site-packages (from requests) (3.18)\nRequirement already satisfied: urllib3<3,>=1.26 in /home/zuul/venv/lib/python3.12/site-packages (from requests) (2.7.0)\nRequirement already satisfied: certifi>=2023.5.7 in /home/zuul/venv/lib/python3.12/site-packages (from requests) (2026.6.17)\n", "stdout_lines": ["Requirement already satisfied: requests in /home/zuul/venv/lib/python3.12/site-packages (2.34.2)", "Requirement already satisfied: charset_normalizer<4,>=2 in /home/zuul/venv/lib/python3.12/site-packages (from requests) (3.4.7)", "Requirement already satisfied: idna<4,>=2.5 in /home/zuul/venv/lib/python3.12/site-packages (from requests) (3.18)", "Requirement already satisfied: urllib3<3,>=1.26 in /home/zuul/venv/lib/python3.12/site-packages (from requests) (2.7.0)", "Requirement already satisfied: certifi>=2023.5.7 in /home/zuul/venv/lib/python3.12/site-packages (from requests) (2026.6.17)"], "version": null, "virtualenv": "/home/zuul/venv"} 2026-07-02 18:26:25.750000 | ubuntu-noble | 2026-07-02 18:26:25.750194 | ubuntu-noble | TASK [Include required prepare tasks] ****************************************** 2026-07-02 18:26:25.769811 | ubuntu-noble | included: /home/zuul/src/github.com/osism/ansible-collection-services/molecule/delegated/prepare/auditd.yml for molecule-auditd 2026-07-02 18:26:25.769855 | ubuntu-noble | 2026-07-02 18:26:25.769862 | ubuntu-noble | PLAY RECAP ********************************************************************* 2026-07-02 18:26:25.769869 | ubuntu-noble | molecule-auditd : ok=3 changed=1 unreachable=0 failed=0 skipped=0 rescued=0 ignored=0 2026-07-02 18:26:25.769873 | ubuntu-noble | 2026-07-02 18:26:25.861551 | ubuntu-noble | INFO [delegated > prepare] Executed: Successful 2026-07-02 18:26:25.863808 | ubuntu-noble | INFO Molecule executed 1 scenario (1 successful) 2026-07-02 18:26:26.191815 | debian-bookworm | ok: Runtime: 0:00:08.863328 2026-07-02 18:26:26.198233 | ubuntu-noble | ok: Runtime: 0:00:09.940020 2026-07-02 18:26:26.204502 | 2026-07-02 18:26:26.204609 | TASK [ansible-molecule : Reset connection] 2026-07-02 18:26:26.234070 | 2026-07-02 18:26:26.234228 | TASK [ansible-molecule : Reset connection] 2026-07-02 18:26:26.299285 | 2026-07-02 18:26:26.299464 | TASK [ansible-molecule : Run molecule converge action with scenario delegated] 2026-07-02 18:26:27.137891 | debian-bookworm | WARNING Molecule scenarios should migrate to 'extensions/molecule' 2026-07-02 18:26:27.146922 | debian-bookworm | DEBUG [unknown > config] provisioner.env found in /home/zuul/src/github.com/osism/ansible-collection-services/molecule/delegated/molecule.yml, this can be defined in ansible.env 2026-07-02 18:26:27.285847 | ubuntu-noble | WARNING Molecule scenarios should migrate to 'extensions/molecule' 2026-07-02 18:26:27.296359 | ubuntu-noble | DEBUG [unknown > config] provisioner.env found in /home/zuul/src/github.com/osism/ansible-collection-services/molecule/delegated/molecule.yml, this can be defined in ansible.env 2026-07-02 18:26:27.559934 | debian-bookworm | DEBUG [unknown > config] provisioner.env found in /home/zuul/src/github.com/osism/ansible-collection-services/molecule/delegated/molecule.yml, this can be defined in ansible.env 2026-07-02 18:26:27.560535 | debian-bookworm | DEBUG [delegated > validate] Validating schema /home/zuul/src/github.com/osism/ansible-collection-services/molecule/delegated/molecule.yml. 2026-07-02 18:26:27.580490 | debian-bookworm | DEBUG [default > validate] Validating schema /home/zuul/src/github.com/osism/ansible-collection-services/molecule/default/molecule.yml. 2026-07-02 18:26:27.586076 | debian-bookworm | INFO [delegated > discovery] scenario test matrix: dependency, create, prepare, converge 2026-07-02 18:26:27.586158 | debian-bookworm | INFO [delegated > prerun] Performing prerun with role_name_check=0... 2026-07-02 18:26:27.875371 | ubuntu-noble | DEBUG [unknown > config] provisioner.env found in /home/zuul/src/github.com/osism/ansible-collection-services/molecule/delegated/molecule.yml, this can be defined in ansible.env 2026-07-02 18:26:27.876224 | ubuntu-noble | DEBUG [delegated > validate] Validating schema /home/zuul/src/github.com/osism/ansible-collection-services/molecule/delegated/molecule.yml. 2026-07-02 18:26:27.899331 | ubuntu-noble | DEBUG [default > validate] Validating schema /home/zuul/src/github.com/osism/ansible-collection-services/molecule/default/molecule.yml. 2026-07-02 18:26:27.905226 | ubuntu-noble | INFO [delegated > discovery] scenario test matrix: dependency, create, prepare, converge 2026-07-02 18:26:27.905376 | ubuntu-noble | INFO [delegated > prerun] Performing prerun with role_name_check=0... 2026-07-02 18:26:28.720718 | debian-bookworm | INFO [delegated > dependency] Executing 2026-07-02 18:26:28.721494 | debian-bookworm | WARNING [delegated > dependency] Missing roles requirements file: requirements.yml 2026-07-02 18:26:29.040115 | debian-bookworm | ansible-galaxy [core 2.18.18] 2026-07-02 18:26:29.040523 | debian-bookworm | config file = None 2026-07-02 18:26:29.040937 | debian-bookworm | configured module search path = ['/home/zuul/src/github.com/osism/ansible-collection-services/plugins/modules', '/home/zuul/.ansible/plugins/modules', '/usr/share/ansible/plugins/modules'] 2026-07-02 18:26:29.041386 | debian-bookworm | ansible python module location = /home/zuul/venv/lib/python3.11/site-packages/ansible 2026-07-02 18:26:29.041847 | debian-bookworm | ansible collection location = /home/zuul/.ansible/collections:/usr/share/ansible/collections:/home/zuul/venv/lib/python3.11/site-packages:/home/zuul/venv/lib/python3.11/dist-packages:/home/zuul/venv/lib/python3/dist-packages:/home/zuul/venv/local/lib/python3.11/dist-packages 2026-07-02 18:26:29.042332 | debian-bookworm | executable location = /home/zuul/venv/bin/ansible-galaxy 2026-07-02 18:26:29.042722 | debian-bookworm | python version = 3.11.2 (main, Apr 8 2026, 01:58:00) [GCC 12.2.0] (/home/zuul/venv/bin/python3) 2026-07-02 18:26:29.043074 | debian-bookworm | jinja version = 3.1.6 2026-07-02 18:26:29.043381 | debian-bookworm | libyaml = True 2026-07-02 18:26:29.043675 | debian-bookworm | No config file found; using defaults 2026-07-02 18:26:29.044143 | debian-bookworm | Reading requirement file at '/home/zuul/src/github.com/osism/ansible-collection-services/molecule/delegated/collections.yml' 2026-07-02 18:26:29.046163 | debian-bookworm | Loading collection osism.services from /home/zuul/.ansible/collections/ansible_collections/osism/services 2026-07-02 18:26:29.046548 | debian-bookworm | Found installed collection osism.services:999.0.0 at '/home/zuul/.ansible/collections/ansible_collections/osism/services' 2026-07-02 18:26:29.046891 | debian-bookworm | Loading collection osism.commons from /home/zuul/.ansible/collections/ansible_collections/osism/commons 2026-07-02 18:26:29.048603 | debian-bookworm | Found installed collection osism.commons:0.20260601.0 at '/home/zuul/.ansible/collections/ansible_collections/osism/commons' 2026-07-02 18:26:29.054329 | debian-bookworm | Loading collection ovirt.ovirt from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/ovirt/ovirt 2026-07-02 18:26:29.054764 | debian-bookworm | Found installed collection ovirt.ovirt:3.2.1 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/ovirt/ovirt' 2026-07-02 18:26:29.055039 | debian-bookworm | Loading collection chocolatey.chocolatey from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/chocolatey/chocolatey 2026-07-02 18:26:29.055414 | debian-bookworm | Found installed collection chocolatey.chocolatey:1.5.3 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/chocolatey/chocolatey' 2026-07-02 18:26:29.058529 | debian-bookworm | Loading collection fortinet.fortios from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/fortinet/fortios 2026-07-02 18:26:29.058909 | debian-bookworm | Found installed collection fortinet.fortios:2.4.2 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/fortinet/fortios' 2026-07-02 18:26:29.059275 | debian-bookworm | Loading collection grafana.grafana from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/grafana/grafana 2026-07-02 18:26:29.059667 | debian-bookworm | Found installed collection grafana.grafana:5.7.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/grafana/grafana' 2026-07-02 18:26:29.060739 | debian-bookworm | Loading collection amazon.aws from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/amazon/aws 2026-07-02 18:26:29.061080 | debian-bookworm | Found installed collection amazon.aws:9.5.2 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/amazon/aws' 2026-07-02 18:26:29.061561 | debian-bookworm | Loading collection netapp_eseries.santricity from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/netapp_eseries/santricity 2026-07-02 18:26:29.061942 | debian-bookworm | Found installed collection netapp_eseries.santricity:1.4.1 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/netapp_eseries/santricity' 2026-07-02 18:26:29.062195 | debian-bookworm | Loading collection community.hashi_vault from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/hashi_vault 2026-07-02 18:26:29.062721 | debian-bookworm | Found installed collection community.hashi_vault:6.2.1 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/hashi_vault' 2026-07-02 18:26:29.063060 | debian-bookworm | Loading collection telekom_mms.icinga_director from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/telekom_mms/icinga_director 2026-07-02 18:26:29.063289 | debian-bookworm | Found installed collection telekom_mms.icinga_director:2.4.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/telekom_mms/icinga_director' 2026-07-02 18:26:29.063597 | debian-bookworm | Loading collection check_point.mgmt from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/check_point/mgmt 2026-07-02 18:26:29.063811 | debian-bookworm | Found installed collection check_point.mgmt:6.6.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/check_point/mgmt' 2026-07-02 18:26:29.064983 | debian-bookworm | Loading collection google.cloud from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/google/cloud 2026-07-02 18:26:29.065703 | debian-bookworm | Found installed collection google.cloud:1.9.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/google/cloud' 2026-07-02 18:26:29.066251 | debian-bookworm | Loading collection cisco.iosxr from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/cisco/iosxr 2026-07-02 18:26:29.066665 | debian-bookworm | Found installed collection cisco.iosxr:10.3.1 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/cisco/iosxr' 2026-07-02 18:26:29.066995 | debian-bookworm | Loading collection community.library_inventory_filtering_v1 from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/library_inventory_filtering_v1 2026-07-02 18:26:29.067482 | debian-bookworm | Found installed collection community.library_inventory_filtering_v1:1.1.5 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/library_inventory_filtering_v1' 2026-07-02 18:26:29.067816 | debian-bookworm | Loading collection wti.remote from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/wti/remote 2026-07-02 18:26:29.068119 | debian-bookworm | Found installed collection wti.remote:1.0.10 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/wti/remote' 2026-07-02 18:26:29.068573 | debian-bookworm | Loading collection junipernetworks.junos from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/junipernetworks/junos 2026-07-02 18:26:29.068888 | debian-bookworm | Found installed collection junipernetworks.junos:9.1.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/junipernetworks/junos' 2026-07-02 18:26:29.069293 | debian-bookworm | Loading collection dellemc.openmanage from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/dellemc/openmanage 2026-07-02 18:26:29.069713 | debian-bookworm | Found installed collection dellemc.openmanage:9.12.3 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/dellemc/openmanage' 2026-07-02 18:26:29.070232 | debian-bookworm | Loading collection hetzner.hcloud from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/hetzner/hcloud 2026-07-02 18:26:29.070710 | debian-bookworm | Found installed collection hetzner.hcloud:4.3.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/hetzner/hcloud' 2026-07-02 18:26:29.071017 | debian-bookworm | Loading collection community.grafana from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/grafana 2026-07-02 18:26:29.071529 | debian-bookworm | Found installed collection community.grafana:2.3.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/grafana' 2026-07-02 18:26:29.071981 | debian-bookworm | Loading collection netapp.ontap from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/netapp/ontap 2026-07-02 18:26:29.072763 | debian-bookworm | Found installed collection netapp.ontap:22.14.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/netapp/ontap' 2026-07-02 18:26:29.073082 | debian-bookworm | Loading collection purestorage.flasharray from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/purestorage/flasharray 2026-07-02 18:26:29.073513 | debian-bookworm | Found installed collection purestorage.flasharray:1.39.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/purestorage/flasharray' 2026-07-02 18:26:29.073867 | debian-bookworm | Loading collection cisco.asa from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/cisco/asa 2026-07-02 18:26:29.074153 | debian-bookworm | Found installed collection cisco.asa:6.1.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/cisco/asa' 2026-07-02 18:26:29.074454 | debian-bookworm | Loading collection inspur.ispim from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/inspur/ispim 2026-07-02 18:26:29.074834 | debian-bookworm | Found installed collection inspur.ispim:2.2.3 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/inspur/ispim' 2026-07-02 18:26:29.075125 | debian-bookworm | Loading collection ngine_io.cloudstack from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/ngine_io/cloudstack 2026-07-02 18:26:29.075491 | debian-bookworm | Found installed collection ngine_io.cloudstack:2.5.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/ngine_io/cloudstack' 2026-07-02 18:26:29.075892 | debian-bookworm | Loading collection vyos.vyos from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/vyos/vyos 2026-07-02 18:26:29.076127 | debian-bookworm | Found installed collection vyos.vyos:5.0.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/vyos/vyos' 2026-07-02 18:26:29.076465 | debian-bookworm | Loading collection community.crypto from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/crypto 2026-07-02 18:26:29.076692 | debian-bookworm | Found installed collection community.crypto:2.26.6 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/crypto' 2026-07-02 18:26:29.077011 | debian-bookworm | Loading collection containers.podman from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/containers/podman 2026-07-02 18:26:29.077245 | debian-bookworm | Found installed collection containers.podman:1.18.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/containers/podman' 2026-07-02 18:26:29.077628 | debian-bookworm | Loading collection community.sops from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/sops 2026-07-02 18:26:29.077870 | debian-bookworm | Found installed collection community.sops:2.2.7 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/sops' 2026-07-02 18:26:29.078171 | debian-bookworm | Loading collection ansible.posix from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/ansible/posix 2026-07-02 18:26:29.078480 | debian-bookworm | Found installed collection ansible.posix:1.6.2 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/ansible/posix' 2026-07-02 18:26:29.078731 | debian-bookworm | Loading collection vmware.vmware from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/vmware/vmware 2026-07-02 18:26:29.078912 | debian-bookworm | Found installed collection vmware.vmware:1.11.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/vmware/vmware' 2026-07-02 18:26:29.114425 | debian-bookworm | Loading collection community.network from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/network 2026-07-02 18:26:29.114869 | debian-bookworm | Found installed collection community.network:5.1.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/network' 2026-07-02 18:26:29.115272 | debian-bookworm | Loading collection ibm.spectrum_virtualize from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/ibm/spectrum_virtualize 2026-07-02 18:26:29.115596 | debian-bookworm | Found installed collection ibm.spectrum_virtualize:2.0.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/ibm/spectrum_virtualize' 2026-07-02 18:26:29.115995 | debian-bookworm | Loading collection vultr.cloud from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/vultr/cloud 2026-07-02 18:26:29.116291 | debian-bookworm | Found installed collection vultr.cloud:1.13.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/vultr/cloud' 2026-07-02 18:26:29.116720 | debian-bookworm | Loading collection lowlydba.sqlserver from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/lowlydba/sqlserver 2026-07-02 18:26:29.117014 | debian-bookworm | Found installed collection lowlydba.sqlserver:2.7.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/lowlydba/sqlserver' 2026-07-02 18:26:29.117443 | debian-bookworm | Loading collection splunk.es from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/splunk/es 2026-07-02 18:26:29.117825 | debian-bookworm | Found installed collection splunk.es:4.0.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/splunk/es' 2026-07-02 18:26:29.118167 | debian-bookworm | Loading collection openstack.cloud from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/openstack/cloud 2026-07-02 18:26:29.118442 | debian-bookworm | Found installed collection openstack.cloud:2.5.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/openstack/cloud' 2026-07-02 18:26:29.118777 | debian-bookworm | Loading collection ibm.storage_virtualize from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/ibm/storage_virtualize 2026-07-02 18:26:29.119029 | debian-bookworm | Found installed collection ibm.storage_virtualize:2.7.4 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/ibm/storage_virtualize' 2026-07-02 18:26:29.119401 | debian-bookworm | Loading collection f5networks.f5_modules from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/f5networks/f5_modules 2026-07-02 18:26:29.119674 | debian-bookworm | Found installed collection f5networks.f5_modules:1.39.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/f5networks/f5_modules' 2026-07-02 18:26:29.119992 | debian-bookworm | Loading collection dellemc.powerflex from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/dellemc/powerflex 2026-07-02 18:26:29.120202 | debian-bookworm | Found installed collection dellemc.powerflex:2.6.1 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/dellemc/powerflex' 2026-07-02 18:26:29.120825 | debian-bookworm | Loading collection ansible.netcommon from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/ansible/netcommon 2026-07-02 18:26:29.121093 | debian-bookworm | Found installed collection ansible.netcommon:7.2.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/ansible/netcommon' 2026-07-02 18:26:29.121396 | debian-bookworm | Loading collection ansible.windows from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/ansible/windows 2026-07-02 18:26:29.121696 | debian-bookworm | Found installed collection ansible.windows:2.8.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/ansible/windows' 2026-07-02 18:26:29.121999 | debian-bookworm | Loading collection community.postgresql from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/postgresql 2026-07-02 18:26:29.122274 | debian-bookworm | Found installed collection community.postgresql:3.14.2 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/postgresql' 2026-07-02 18:26:29.123740 | debian-bookworm | Loading collection cisco.aci from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/cisco/aci 2026-07-02 18:26:29.123970 | debian-bookworm | Found installed collection cisco.aci:2.12.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/cisco/aci' 2026-07-02 18:26:29.124424 | debian-bookworm | Loading collection community.docker from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/docker 2026-07-02 18:26:29.124666 | debian-bookworm | Found installed collection community.docker:4.8.2 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/docker' 2026-07-02 18:26:29.124901 | debian-bookworm | Loading collection infinidat.infinibox from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/infinidat/infinibox 2026-07-02 18:26:29.125131 | debian-bookworm | Found installed collection infinidat.infinibox:1.6.3 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/infinidat/infinibox' 2026-07-02 18:26:29.126653 | debian-bookworm | Loading collection theforeman.foreman from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/theforeman/foreman 2026-07-02 18:26:29.127470 | debian-bookworm | Found installed collection theforeman.foreman:4.2.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/theforeman/foreman' 2026-07-02 18:26:29.127986 | debian-bookworm | Loading collection ibm.qradar from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/ibm/qradar 2026-07-02 18:26:29.128400 | debian-bookworm | Found installed collection ibm.qradar:4.0.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/ibm/qradar' 2026-07-02 18:26:29.128812 | debian-bookworm | Loading collection ravendb.ravendb from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/ravendb/ravendb 2026-07-02 18:26:29.129099 | debian-bookworm | Found installed collection ravendb.ravendb:1.0.4 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/ravendb/ravendb' 2026-07-02 18:26:29.129404 | debian-bookworm | Loading collection purestorage.flashblade from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/purestorage/flashblade 2026-07-02 18:26:29.129737 | debian-bookworm | Found installed collection purestorage.flashblade:1.22.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/purestorage/flashblade' 2026-07-02 18:26:29.130093 | debian-bookworm | Loading collection microsoft.iis from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/microsoft/iis 2026-07-02 18:26:29.130584 | debian-bookworm | Found installed collection microsoft.iis:1.0.3 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/microsoft/iis' 2026-07-02 18:26:29.130875 | debian-bookworm | Loading collection cloud.common from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/cloud/common 2026-07-02 18:26:29.131153 | debian-bookworm | Found installed collection cloud.common:4.2.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/cloud/common' 2026-07-02 18:26:29.131555 | debian-bookworm | Loading collection sensu.sensu_go from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/sensu/sensu_go 2026-07-02 18:26:29.131866 | debian-bookworm | Found installed collection sensu.sensu_go:1.14.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/sensu/sensu_go' 2026-07-02 18:26:29.132237 | debian-bookworm | Loading collection azure.azcollection from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/azure/azcollection 2026-07-02 18:26:29.132519 | debian-bookworm | Found installed collection azure.azcollection:3.10.1 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/azure/azcollection' 2026-07-02 18:26:29.132770 | debian-bookworm | Loading collection community.sap_libs from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/sap_libs 2026-07-02 18:26:29.133109 | debian-bookworm | Found installed collection community.sap_libs:1.5.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/sap_libs' 2026-07-02 18:26:29.133368 | debian-bookworm | Loading collection community.zabbix from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/zabbix 2026-07-02 18:26:29.133673 | debian-bookworm | Found installed collection community.zabbix:3.3.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/zabbix' 2026-07-02 18:26:29.134018 | debian-bookworm | Loading collection community.routeros from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/routeros 2026-07-02 18:26:29.134292 | debian-bookworm | Found installed collection community.routeros:3.13.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/routeros' 2026-07-02 18:26:29.134670 | debian-bookworm | Loading collection netbox.netbox from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/netbox/netbox 2026-07-02 18:26:29.134933 | debian-bookworm | Found installed collection netbox.netbox:3.21.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/netbox/netbox' 2026-07-02 18:26:29.135181 | debian-bookworm | Loading collection ansible.utils from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/ansible/utils 2026-07-02 18:26:29.135567 | debian-bookworm | Found installed collection ansible.utils:5.1.2 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/ansible/utils' 2026-07-02 18:26:29.135827 | debian-bookworm | Loading collection ieisystem.inmanage from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/ieisystem/inmanage 2026-07-02 18:26:29.136050 | debian-bookworm | Found installed collection ieisystem.inmanage:3.0.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/ieisystem/inmanage' 2026-07-02 18:26:29.136252 | debian-bookworm | Loading collection community.proxysql from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/proxysql 2026-07-02 18:26:29.136562 | debian-bookworm | Found installed collection community.proxysql:1.7.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/proxysql' 2026-07-02 18:26:29.136770 | debian-bookworm | Loading collection netapp.storagegrid from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/netapp/storagegrid 2026-07-02 18:26:29.136974 | debian-bookworm | Found installed collection netapp.storagegrid:21.14.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/netapp/storagegrid' 2026-07-02 18:26:29.137174 | debian-bookworm | Loading collection cisco.dnac from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/cisco/dnac 2026-07-02 18:26:29.137433 | debian-bookworm | Found installed collection cisco.dnac:6.31.3 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/cisco/dnac' 2026-07-02 18:26:29.137730 | debian-bookworm | Loading collection community.dns from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/dns 2026-07-02 18:26:29.137976 | debian-bookworm | Found installed collection community.dns:3.4.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/dns' 2026-07-02 18:26:29.138188 | debian-bookworm | Loading collection community.proxmox from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/proxmox 2026-07-02 18:26:29.138479 | debian-bookworm | Found installed collection community.proxmox:1.4.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/proxmox' 2026-07-02 18:26:29.138739 | debian-bookworm | Loading collection kubernetes.core from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/kubernetes/core 2026-07-02 18:26:29.138955 | debian-bookworm | Found installed collection kubernetes.core:5.4.1 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/kubernetes/core' 2026-07-02 18:26:29.139185 | debian-bookworm | Loading collection community.mongodb from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/mongodb 2026-07-02 18:26:29.139371 | debian-bookworm | Found installed collection community.mongodb:1.7.10 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/mongodb' 2026-07-02 18:26:29.139598 | debian-bookworm | Loading collection netapp.cloudmanager from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/netapp/cloudmanager 2026-07-02 18:26:29.139822 | debian-bookworm | Found installed collection netapp.cloudmanager:21.24.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/netapp/cloudmanager' 2026-07-02 18:26:29.141197 | debian-bookworm | Loading collection community.vmware from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/vmware 2026-07-02 18:26:29.141447 | debian-bookworm | Found installed collection community.vmware:5.10.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/vmware' 2026-07-02 18:26:29.141900 | debian-bookworm | Loading collection community.windows from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/windows 2026-07-02 18:26:29.142123 | debian-bookworm | Found installed collection community.windows:2.4.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/windows' 2026-07-02 18:26:29.144778 | debian-bookworm | Loading collection vmware.vmware_rest from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/vmware/vmware_rest 2026-07-02 18:26:29.145007 | debian-bookworm | Found installed collection vmware.vmware_rest:4.9.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/vmware/vmware_rest' 2026-07-02 18:26:29.145285 | debian-bookworm | Loading collection community.hrobot from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/hrobot 2026-07-02 18:26:29.145543 | debian-bookworm | Found installed collection community.hrobot:2.7.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/hrobot' 2026-07-02 18:26:29.145789 | debian-bookworm | Loading collection cisco.intersight from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/cisco/intersight 2026-07-02 18:26:29.146014 | debian-bookworm | Found installed collection cisco.intersight:2.7.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/cisco/intersight' 2026-07-02 18:26:29.146800 | debian-bookworm | Loading collection arista.eos from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/arista/eos 2026-07-02 18:26:29.147029 | debian-bookworm | Found installed collection arista.eos:10.1.1 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/arista/eos' 2026-07-02 18:26:29.147253 | debian-bookworm | Loading collection community.libvirt from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/libvirt 2026-07-02 18:26:29.147504 | debian-bookworm | Found installed collection community.libvirt:1.4.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/libvirt' 2026-07-02 18:26:29.147926 | debian-bookworm | Loading collection hitachivantara.vspone_block from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/hitachivantara/vspone_block 2026-07-02 18:26:29.148191 | debian-bookworm | Found installed collection hitachivantara.vspone_block:3.5.1 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/hitachivantara/vspone_block' 2026-07-02 18:26:29.148437 | debian-bookworm | Loading collection kaytus.ksmanage from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/kaytus/ksmanage 2026-07-02 18:26:29.148653 | debian-bookworm | Found installed collection kaytus.ksmanage:2.0.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/kaytus/ksmanage' 2026-07-02 18:26:29.150904 | debian-bookworm | Loading collection awx.awx from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/awx/awx 2026-07-02 18:26:29.151118 | debian-bookworm | Found installed collection awx.awx:24.6.1 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/awx/awx' 2026-07-02 18:26:29.151327 | debian-bookworm | Loading collection cisco.ucs from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/cisco/ucs 2026-07-02 18:26:29.151556 | debian-bookworm | Found installed collection cisco.ucs:1.16.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/cisco/ucs' 2026-07-02 18:26:29.152246 | debian-bookworm | Loading collection dellemc.unity from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/dellemc/unity 2026-07-02 18:26:29.152483 | debian-bookworm | Found installed collection dellemc.unity:2.1.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/dellemc/unity' 2026-07-02 18:26:29.153534 | debian-bookworm | Loading collection community.digitalocean from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/digitalocean 2026-07-02 18:26:29.153769 | debian-bookworm | Found installed collection community.digitalocean:1.27.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/digitalocean' 2026-07-02 18:26:29.154034 | debian-bookworm | Loading collection community.rabbitmq from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/rabbitmq 2026-07-02 18:26:29.154255 | debian-bookworm | Found installed collection community.rabbitmq:1.6.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/rabbitmq' 2026-07-02 18:26:29.154661 | debian-bookworm | Loading collection community.okd from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/okd 2026-07-02 18:26:29.154871 | debian-bookworm | Found installed collection community.okd:4.0.2 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/okd' 2026-07-02 18:26:29.156210 | debian-bookworm | Loading collection cisco.mso from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/cisco/mso 2026-07-02 18:26:29.156488 | debian-bookworm | Found installed collection cisco.mso:2.11.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/cisco/mso' 2026-07-02 18:26:29.157101 | debian-bookworm | Loading collection dellemc.enterprise_sonic from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/dellemc/enterprise_sonic 2026-07-02 18:26:29.157371 | debian-bookworm | Found installed collection dellemc.enterprise_sonic:2.5.1 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/dellemc/enterprise_sonic' 2026-07-02 18:26:29.157644 | debian-bookworm | Loading collection cyberark.conjur from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/cyberark/conjur 2026-07-02 18:26:29.157864 | debian-bookworm | Found installed collection cyberark.conjur:1.3.8 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/cyberark/conjur' 2026-07-02 18:26:29.158074 | debian-bookworm | Loading collection community.ciscosmb from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/ciscosmb 2026-07-02 18:26:29.158279 | debian-bookworm | Found installed collection community.ciscosmb:1.0.11 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/ciscosmb' 2026-07-02 18:26:29.163749 | debian-bookworm | Loading collection fortinet.fortimanager from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/fortinet/fortimanager 2026-07-02 18:26:29.163964 | debian-bookworm | Found installed collection fortinet.fortimanager:2.11.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/fortinet/fortimanager' 2026-07-02 18:26:29.164177 | debian-bookworm | Loading collection microsoft.ad from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/microsoft/ad 2026-07-02 18:26:29.164481 | debian-bookworm | Found installed collection microsoft.ad:1.9.2 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/microsoft/ad' 2026-07-02 18:26:29.164692 | debian-bookworm | Loading collection cyberark.pas from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/cyberark/pas 2026-07-02 18:26:29.164905 | debian-bookworm | Found installed collection cyberark.pas:1.0.36 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/cyberark/pas' 2026-07-02 18:26:29.165179 | debian-bookworm | Loading collection infoblox.nios_modules from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/infoblox/nios_modules 2026-07-02 18:26:29.165406 | debian-bookworm | Found installed collection infoblox.nios_modules:1.8.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/infoblox/nios_modules' 2026-07-02 18:26:29.173896 | debian-bookworm | Loading collection community.general from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/general 2026-07-02 18:26:29.174151 | debian-bookworm | Found installed collection community.general:10.7.6 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/general' 2026-07-02 18:26:29.174816 | debian-bookworm | Loading collection cloudscale_ch.cloud from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/cloudscale_ch/cloud 2026-07-02 18:26:29.175472 | debian-bookworm | Found installed collection cloudscale_ch.cloud:2.5.2 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/cloudscale_ch/cloud' 2026-07-02 18:26:29.175911 | debian-bookworm | Loading collection hitachivantara.vspone_object from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/hitachivantara/vspone_object 2026-07-02 18:26:29.176214 | debian-bookworm | Found installed collection hitachivantara.vspone_object:1.0.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/hitachivantara/vspone_object' 2026-07-02 18:26:29.178928 | debian-bookworm | Loading collection community.aws from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/aws 2026-07-02 18:26:29.179322 | debian-bookworm | Found installed collection community.aws:9.3.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/aws' 2026-07-02 18:26:29.181049 | debian-bookworm | Loading collection cisco.nxos from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/cisco/nxos 2026-07-02 18:26:29.181465 | debian-bookworm | Found installed collection cisco.nxos:9.4.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/cisco/nxos' 2026-07-02 18:26:29.181814 | debian-bookworm | Loading collection community.mysql from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/mysql 2026-07-02 18:26:29.182211 | debian-bookworm | Found installed collection community.mysql:3.16.1 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/community/mysql' 2026-07-02 18:26:29.182606 | debian-bookworm | Loading collection cisco.ios from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/cisco/ios 2026-07-02 18:26:29.182982 | debian-bookworm | Found installed collection cisco.ios:9.2.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/cisco/ios' 2026-07-02 18:26:29.183275 | debian-bookworm | Loading collection kubevirt.core from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/kubevirt/core 2026-07-02 18:26:29.183695 | debian-bookworm | Found installed collection kubevirt.core:2.2.3 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/kubevirt/core' 2026-07-02 18:26:29.184919 | debian-bookworm | Loading collection cisco.meraki from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/cisco/meraki 2026-07-02 18:26:29.185272 | debian-bookworm | Found installed collection cisco.meraki:2.21.8 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/cisco/meraki' 2026-07-02 18:26:29.185611 | debian-bookworm | Loading collection cisco.ise from /home/zuul/venv/lib/python3.11/site-packages/ansible_collections/cisco/ise 2026-07-02 18:26:29.185936 | debian-bookworm | Found installed collection cisco.ise:2.10.0 at '/home/zuul/venv/lib/python3.11/site-packages/ansible_collections/cisco/ise' 2026-07-02 18:26:29.186281 | debian-bookworm | Starting galaxy collection install process 2026-07-02 18:26:29.186557 | debian-bookworm | Nothing to do. All requested collections are already installed. If you want to reinstall them, consider using `--force`. 2026-07-02 18:26:29.239572 | debian-bookworm | INFO [delegated > dependency] Dependency completed successfully. 2026-07-02 18:26:29.239875 | debian-bookworm | WARNING [delegated > dependency] Executed: Missing roles requirements file: requirements.yml (Remove from converge_sequence to suppress) 2026-07-02 18:26:29.254894 | debian-bookworm | INFO [delegated > create] Executing 2026-07-02 18:26:29.257144 | debian-bookworm | WARNING [delegated > create] Executed: Missing playbook (Remove from converge_sequence to suppress) 2026-07-02 18:26:29.266185 | debian-bookworm | INFO [delegated > prepare] Executing 2026-07-02 18:26:29.266266 | debian-bookworm | WARNING [delegated > prepare] Skipping, instances already prepared. 2026-07-02 18:26:29.266399 | debian-bookworm | INFO [delegated > prepare] Executed: Successful 2026-07-02 18:26:29.274315 | debian-bookworm | INFO [delegated > converge] Executing 2026-07-02 18:26:29.562737 | debian-bookworm | DEBUG [delegated > converge] ansible-playbook version: ansible-playbook 2026-07-02 18:26:29.562783 | debian-bookworm | config file = None 2026-07-02 18:26:29.562790 | debian-bookworm | configured module search path = 2026-07-02 18:26:29.562795 | debian-bookworm | ansible python module location = /home/zuul/venv/lib/python3.11/site-packages/ansible 2026-07-02 18:26:29.562800 | debian-bookworm | ansible collection location = /home/zuul/.ansible/collections:/usr/share/ansible/collections 2026-07-02 18:26:29.562804 | debian-bookworm | executable location = /home/zuul/venv/bin/ansible-playbook 2026-07-02 18:26:29.562808 | debian-bookworm | python version = 3.11.2 (main, Apr 8 2026, 01:58:00) (/home/zuul/venv/bin/python3) 2026-07-02 18:26:29.562812 | debian-bookworm | jinja version = 3.1.6 2026-07-02 18:26:29.562816 | debian-bookworm | libyaml = True 2026-07-02 18:26:29.562969 | debian-bookworm | DEBUG ANSIBLE ENVIRONMENT: 2026-07-02 18:26:29.562975 | debian-bookworm | ANSIBLE_COLLECTIONS_PATH: /home/zuul/venv/.ansible/collections:/home/zuul/.ansible/collections 2026-07-02 18:26:29.562986 | debian-bookworm | ANSIBLE_CONFIG: /home/zuul/.ansible/tmp/molecule.oWZD.delegated/ansible.cfg 2026-07-02 18:26:29.562990 | debian-bookworm | ANSIBLE_LIBRARY: ../../plugins 2026-07-02 18:26:29.562994 | debian-bookworm | ANSIBLE_PYTHON_INTERPRETER: /home/zuul/venv/bin/python 2026-07-02 18:26:29.562998 | debian-bookworm | ANSIBLE_ROLE: auditd 2026-07-02 18:26:29.563002 | debian-bookworm | ANSIBLE_ROLES_PATH: ../../roles 2026-07-02 18:26:29.563006 | debian-bookworm | ANSIBLE_VERBOSITY: 1 2026-07-02 18:26:29.563010 | debian-bookworm | 2026-07-02 18:26:29.563192 | debian-bookworm | DEBUG MOLECULE ENVIRONMENT: 2026-07-02 18:26:29.563198 | debian-bookworm | MOLECULE_DEBUG: True 2026-07-02 18:26:29.563202 | debian-bookworm | MOLECULE_DEPENDENCY_NAME: galaxy 2026-07-02 18:26:29.563215 | debian-bookworm | MOLECULE_DRIVER_NAME: default 2026-07-02 18:26:29.563219 | debian-bookworm | MOLECULE_ENV_FILE: /home/zuul/src/github.com/osism/ansible-collection-services/.env.yml 2026-07-02 18:26:29.563223 | debian-bookworm | MOLECULE_EPHEMERAL_DIRECTORY: /home/zuul/.ansible/tmp/molecule.oWZD.delegated 2026-07-02 18:26:29.563229 | debian-bookworm | MOLECULE_FILE: /home/zuul/.ansible/tmp/molecule.oWZD.delegated/molecule.yml 2026-07-02 18:26:29.563233 | debian-bookworm | MOLECULE_INSTANCE_CONFIG: /home/zuul/.ansible/tmp/molecule.oWZD.delegated/instance_config.yml 2026-07-02 18:26:29.563238 | debian-bookworm | MOLECULE_INVENTORY_FILE: /home/zuul/.ansible/tmp/molecule.oWZD.delegated/inventory/ansible_inventory.yml 2026-07-02 18:26:29.563242 | debian-bookworm | MOLECULE_PROJECT_DIRECTORY: /home/zuul/src/github.com/osism/ansible-collection-services 2026-07-02 18:26:29.563246 | debian-bookworm | MOLECULE_PROVISIONER_NAME: ansible 2026-07-02 18:26:29.563250 | debian-bookworm | MOLECULE_SCENARIO_DIRECTORY: /home/zuul/src/github.com/osism/ansible-collection-services/molecule/delegated 2026-07-02 18:26:29.563254 | debian-bookworm | MOLECULE_SCENARIO_NAME: delegated 2026-07-02 18:26:29.563258 | debian-bookworm | MOLECULE_STATE_FILE: /home/zuul/.ansible/tmp/molecule.oWZD.delegated/state.yml 2026-07-02 18:26:29.563261 | debian-bookworm | MOLECULE_VERIFIER_NAME: testinfra 2026-07-02 18:26:29.563265 | debian-bookworm | MOLECULE_VERIFIER_TEST_DIRECTORY: /home/zuul/src/github.com/osism/ansible-collection-services/molecule/delegated/tests 2026-07-02 18:26:29.563269 | debian-bookworm | 2026-07-02 18:26:29.563511 | debian-bookworm | DEBUG SHELL REPLAY: ANSIBLE_COLLECTIONS_PATH=/home/zuul/venv/.ansible/collections:/home/zuul/.ansible/collections ANSIBLE_CONFIG=/home/zuul/.ansible/tmp/molecule.oWZD.delegated/ansible.cfg ANSIBLE_LIBRARY=../../plugins ANSIBLE_PYTHON_INTERPRETER=/home/zuul/venv/bin/python ANSIBLE_ROLE=auditd ANSIBLE_ROLES_PATH=../../roles ANSIBLE_VERBOSITY=1 MOLECULE_DEBUG=True MOLECULE_DEPENDENCY_NAME=galaxy MOLECULE_DRIVER_NAME=default MOLECULE_ENV_FILE=/home/zuul/src/github.com/osism/ansible-collection-services/.env.yml MOLECULE_EPHEMERAL_DIRECTORY=/home/zuul/.ansible/tmp/molecule.oWZD.delegated MOLECULE_FILE=/home/zuul/.ansible/tmp/molecule.oWZD.delegated/molecule.yml MOLECULE_INSTANCE_CONFIG=/home/zuul/.ansible/tmp/molecule.oWZD.delegated/instance_config.yml MOLECULE_INVENTORY_FILE=/home/zuul/.ansible/tmp/molecule.oWZD.delegated/inventory/ansible_inventory.yml MOLECULE_PROJECT_DIRECTORY=/home/zuul/src/github.com/osism/ansible-collection-services MOLECULE_PROVISIONER_NAME=ansible MOLECULE_SCENARIO_DIRECTORY=/home/zuul/src/github.com/osism/ansible-collection-services/molecule/delegated MOLECULE_SCENARIO_NAME=delegated MOLECULE_STATE_FILE=/home/zuul/.ansible/tmp/molecule.oWZD.delegated/state.yml MOLECULE_VERIFIER_NAME=testinfra MOLECULE_VERIFIER_TEST_DIRECTORY=/home/zuul/src/github.com/osism/ansible-collection-services/molecule/delegated/tests 2026-07-02 18:26:29.815630 | debian-bookworm | Using /home/zuul/.ansible/tmp/molecule.oWZD.delegated/ansible.cfg as config file 2026-07-02 18:26:29.423342 | ubuntu-noble | INFO [delegated > dependency] Executing 2026-07-02 18:26:29.424083 | ubuntu-noble | WARNING [delegated > dependency] Missing roles requirements file: requirements.yml 2026-07-02 18:26:29.871005 | ubuntu-noble | ansible-galaxy [core 2.18.18] 2026-07-02 18:26:29.872783 | ubuntu-noble | config file = None 2026-07-02 18:26:29.872834 | ubuntu-noble | configured module search path = ['/home/zuul/src/github.com/osism/ansible-collection-services/plugins/modules', '/home/zuul/.ansible/plugins/modules', '/usr/share/ansible/plugins/modules'] 2026-07-02 18:26:29.872849 | ubuntu-noble | ansible python module location = /home/zuul/venv/lib/python3.12/site-packages/ansible 2026-07-02 18:26:29.872878 | ubuntu-noble | ansible collection location = /home/zuul/.ansible/collections:/usr/share/ansible/collections:/home/zuul/venv/lib/python3.12/site-packages:/home/zuul/venv/lib/python3.12/dist-packages:/home/zuul/venv/lib/python3/dist-packages:/home/zuul/venv/local/lib/python3.12/dist-packages 2026-07-02 18:26:29.873226 | ubuntu-noble | executable location = /home/zuul/venv/bin/ansible-galaxy 2026-07-02 18:26:29.873650 | ubuntu-noble | python version = 3.12.3 (main, Mar 23 2026, 19:04:32) [GCC 13.3.0] (/home/zuul/venv/bin/python3) 2026-07-02 18:26:29.874021 | ubuntu-noble | jinja version = 3.1.6 2026-07-02 18:26:29.874365 | ubuntu-noble | libyaml = True 2026-07-02 18:26:29.874732 | ubuntu-noble | No config file found; using defaults 2026-07-02 18:26:29.875325 | ubuntu-noble | Reading requirement file at '/home/zuul/src/github.com/osism/ansible-collection-services/molecule/delegated/collections.yml' 2026-07-02 18:26:29.885528 | ubuntu-noble | Loading collection osism.commons from /home/zuul/.ansible/collections/ansible_collections/osism/commons 2026-07-02 18:26:29.887516 | ubuntu-noble | Found installed collection osism.commons:0.20260601.0 at '/home/zuul/.ansible/collections/ansible_collections/osism/commons' 2026-07-02 18:26:29.888840 | ubuntu-noble | Loading collection osism.services from /home/zuul/.ansible/collections/ansible_collections/osism/services 2026-07-02 18:26:29.889307 | ubuntu-noble | Found installed collection osism.services:999.0.0 at '/home/zuul/.ansible/collections/ansible_collections/osism/services' 2026-07-02 18:26:29.901279 | ubuntu-noble | Loading collection cisco.mso from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/cisco/mso 2026-07-02 18:26:29.901846 | ubuntu-noble | Found installed collection cisco.mso:2.11.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/cisco/mso' 2026-07-02 18:26:29.902220 | ubuntu-noble | Loading collection community.hashi_vault from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/hashi_vault 2026-07-02 18:26:29.902706 | ubuntu-noble | Found installed collection community.hashi_vault:6.2.1 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/hashi_vault' 2026-07-02 18:26:29.903112 | ubuntu-noble | Loading collection lowlydba.sqlserver from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/lowlydba/sqlserver 2026-07-02 18:26:29.903517 | ubuntu-noble | Found installed collection lowlydba.sqlserver:2.7.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/lowlydba/sqlserver' 2026-07-02 18:26:29.905775 | ubuntu-noble | Loading collection ovirt.ovirt from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/ovirt/ovirt 2026-07-02 18:26:29.905841 | ubuntu-noble | Found installed collection ovirt.ovirt:3.2.1 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/ovirt/ovirt' 2026-07-02 18:26:29.905852 | ubuntu-noble | Loading collection dellemc.unity from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/dellemc/unity 2026-07-02 18:26:29.905862 | ubuntu-noble | Found installed collection dellemc.unity:2.1.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/dellemc/unity' 2026-07-02 18:26:29.905871 | ubuntu-noble | Loading collection dellemc.powerflex from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/dellemc/powerflex 2026-07-02 18:26:29.905880 | ubuntu-noble | Found installed collection dellemc.powerflex:2.6.1 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/dellemc/powerflex' 2026-07-02 18:26:29.911889 | ubuntu-noble | Loading collection fortinet.fortimanager from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/fortinet/fortimanager 2026-07-02 18:26:29.912289 | ubuntu-noble | Found installed collection fortinet.fortimanager:2.11.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/fortinet/fortimanager' 2026-07-02 18:26:30.028612 | debian-bookworm | 2026-07-02 18:26:30.028936 | debian-bookworm | PLAY [Converge] **************************************************************** 2026-07-02 18:26:30.029209 | debian-bookworm | 2026-07-02 18:26:30.029532 | debian-bookworm | TASK [Gathering Facts] ********************************************************* 2026-07-02 18:26:29.945560 | ubuntu-noble | Loading collection community.aws from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/aws 2026-07-02 18:26:29.946033 | ubuntu-noble | Found installed collection community.aws:9.3.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/aws' 2026-07-02 18:26:29.946447 | ubuntu-noble | Loading collection community.sap_libs from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/sap_libs 2026-07-02 18:26:29.946862 | ubuntu-noble | Found installed collection community.sap_libs:1.5.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/sap_libs' 2026-07-02 18:26:29.947237 | ubuntu-noble | Loading collection chocolatey.chocolatey from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/chocolatey/chocolatey 2026-07-02 18:26:29.947555 | ubuntu-noble | Found installed collection chocolatey.chocolatey:1.5.3 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/chocolatey/chocolatey' 2026-07-02 18:26:29.949187 | ubuntu-noble | Loading collection community.vmware from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/vmware 2026-07-02 18:26:29.949876 | ubuntu-noble | Found installed collection community.vmware:5.10.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/vmware' 2026-07-02 18:26:29.950570 | ubuntu-noble | Loading collection vultr.cloud from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/vultr/cloud 2026-07-02 18:26:29.951120 | ubuntu-noble | Found installed collection vultr.cloud:1.13.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/vultr/cloud' 2026-07-02 18:26:29.960280 | ubuntu-noble | Loading collection community.general from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/general 2026-07-02 18:26:29.960783 | ubuntu-noble | Found installed collection community.general:10.7.6 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/general' 2026-07-02 18:26:29.962654 | ubuntu-noble | Loading collection azure.azcollection from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/azure/azcollection 2026-07-02 18:26:29.963451 | ubuntu-noble | Found installed collection azure.azcollection:3.10.1 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/azure/azcollection' 2026-07-02 18:26:30.004630 | ubuntu-noble | Loading collection community.network from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/network 2026-07-02 18:26:30.005374 | ubuntu-noble | Found installed collection community.network:5.1.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/network' 2026-07-02 18:26:30.005939 | ubuntu-noble | Loading collection community.mysql from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/mysql 2026-07-02 18:26:30.006483 | ubuntu-noble | Found installed collection community.mysql:3.16.1 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/mysql' 2026-07-02 18:26:30.006944 | ubuntu-noble | Loading collection purestorage.flashblade from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/purestorage/flashblade 2026-07-02 18:26:30.007319 | ubuntu-noble | Found installed collection purestorage.flashblade:1.22.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/purestorage/flashblade' 2026-07-02 18:26:30.007873 | ubuntu-noble | Loading collection community.windows from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/windows 2026-07-02 18:26:30.009777 | ubuntu-noble | Found installed collection community.windows:2.4.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/windows' 2026-07-02 18:26:30.009808 | ubuntu-noble | Loading collection community.proxysql from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/proxysql 2026-07-02 18:26:30.009818 | ubuntu-noble | Found installed collection community.proxysql:1.7.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/proxysql' 2026-07-02 18:26:30.009827 | ubuntu-noble | Loading collection google.cloud from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/google/cloud 2026-07-02 18:26:30.009836 | ubuntu-noble | Found installed collection google.cloud:1.9.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/google/cloud' 2026-07-02 18:26:30.009969 | ubuntu-noble | Loading collection ibm.spectrum_virtualize from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/ibm/spectrum_virtualize 2026-07-02 18:26:30.010361 | ubuntu-noble | Found installed collection ibm.spectrum_virtualize:2.0.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/ibm/spectrum_virtualize' 2026-07-02 18:26:30.010768 | ubuntu-noble | Loading collection ansible.windows from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/ansible/windows 2026-07-02 18:26:30.011100 | ubuntu-noble | Found installed collection ansible.windows:2.8.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/ansible/windows' 2026-07-02 18:26:30.011404 | ubuntu-noble | Loading collection community.library_inventory_filtering_v1 from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/library_inventory_filtering_v1 2026-07-02 18:26:30.011851 | ubuntu-noble | Found installed collection community.library_inventory_filtering_v1:1.1.5 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/library_inventory_filtering_v1' 2026-07-02 18:26:30.012171 | ubuntu-noble | Loading collection community.mongodb from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/mongodb 2026-07-02 18:26:30.012599 | ubuntu-noble | Found installed collection community.mongodb:1.7.10 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/mongodb' 2026-07-02 18:26:30.012941 | ubuntu-noble | Loading collection grafana.grafana from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/grafana/grafana 2026-07-02 18:26:30.013198 | ubuntu-noble | Found installed collection grafana.grafana:5.7.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/grafana/grafana' 2026-07-02 18:26:30.013549 | ubuntu-noble | Loading collection community.digitalocean from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/digitalocean 2026-07-02 18:26:30.013832 | ubuntu-noble | Found installed collection community.digitalocean:1.27.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/digitalocean' 2026-07-02 18:26:30.014083 | ubuntu-noble | Loading collection ansible.posix from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/ansible/posix 2026-07-02 18:26:30.014399 | ubuntu-noble | Found installed collection ansible.posix:1.6.2 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/ansible/posix' 2026-07-02 18:26:30.014666 | ubuntu-noble | Loading collection kubevirt.core from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/kubevirt/core 2026-07-02 18:26:30.014938 | ubuntu-noble | Found installed collection kubevirt.core:2.2.3 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/kubevirt/core' 2026-07-02 18:26:30.015264 | ubuntu-noble | Loading collection junipernetworks.junos from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/junipernetworks/junos 2026-07-02 18:26:30.015643 | ubuntu-noble | Found installed collection junipernetworks.junos:9.1.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/junipernetworks/junos' 2026-07-02 18:26:30.015988 | ubuntu-noble | Loading collection cisco.asa from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/cisco/asa 2026-07-02 18:26:30.016316 | ubuntu-noble | Found installed collection cisco.asa:6.1.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/cisco/asa' 2026-07-02 18:26:30.017124 | ubuntu-noble | Loading collection netbox.netbox from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/netbox/netbox 2026-07-02 18:26:30.017475 | ubuntu-noble | Found installed collection netbox.netbox:3.21.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/netbox/netbox' 2026-07-02 18:26:30.020659 | ubuntu-noble | Loading collection awx.awx from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/awx/awx 2026-07-02 18:26:30.021393 | ubuntu-noble | Found installed collection awx.awx:24.6.1 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/awx/awx' 2026-07-02 18:26:30.021962 | ubuntu-noble | Loading collection inspur.ispim from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/inspur/ispim 2026-07-02 18:26:30.022458 | ubuntu-noble | Found installed collection inspur.ispim:2.2.3 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/inspur/ispim' 2026-07-02 18:26:30.022858 | ubuntu-noble | Loading collection cloud.common from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/cloud/common 2026-07-02 18:26:30.023374 | ubuntu-noble | Found installed collection cloud.common:4.2.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/cloud/common' 2026-07-02 18:26:30.023803 | ubuntu-noble | Loading collection f5networks.f5_modules from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/f5networks/f5_modules 2026-07-02 18:26:30.025796 | ubuntu-noble | Found installed collection f5networks.f5_modules:1.39.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/f5networks/f5_modules' 2026-07-02 18:26:30.025838 | ubuntu-noble | Loading collection arista.eos from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/arista/eos 2026-07-02 18:26:30.025850 | ubuntu-noble | Found installed collection arista.eos:10.1.1 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/arista/eos' 2026-07-02 18:26:30.025860 | ubuntu-noble | Loading collection openstack.cloud from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/openstack/cloud 2026-07-02 18:26:30.025901 | ubuntu-noble | Found installed collection openstack.cloud:2.5.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/openstack/cloud' 2026-07-02 18:26:30.026363 | ubuntu-noble | Loading collection community.zabbix from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/zabbix 2026-07-02 18:26:30.026787 | ubuntu-noble | Found installed collection community.zabbix:3.3.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/zabbix' 2026-07-02 18:26:30.027153 | ubuntu-noble | Loading collection cisco.dnac from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/cisco/dnac 2026-07-02 18:26:30.027585 | ubuntu-noble | Found installed collection cisco.dnac:6.31.3 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/cisco/dnac' 2026-07-02 18:26:30.028136 | ubuntu-noble | Loading collection community.crypto from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/crypto 2026-07-02 18:26:30.028635 | ubuntu-noble | Found installed collection community.crypto:2.26.6 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/crypto' 2026-07-02 18:26:30.029018 | ubuntu-noble | Loading collection netapp_eseries.santricity from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/netapp_eseries/santricity 2026-07-02 18:26:30.029343 | ubuntu-noble | Found installed collection netapp_eseries.santricity:1.4.1 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/netapp_eseries/santricity' 2026-07-02 18:26:30.029684 | ubuntu-noble | Loading collection cyberark.conjur from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/cyberark/conjur 2026-07-02 18:26:30.030071 | ubuntu-noble | Found installed collection cyberark.conjur:1.3.8 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/cyberark/conjur' 2026-07-02 18:26:30.030381 | ubuntu-noble | Loading collection splunk.es from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/splunk/es 2026-07-02 18:26:30.030785 | ubuntu-noble | Found installed collection splunk.es:4.0.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/splunk/es' 2026-07-02 18:26:30.031237 | ubuntu-noble | Loading collection ieisystem.inmanage from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/ieisystem/inmanage 2026-07-02 18:26:30.031590 | ubuntu-noble | Found installed collection ieisystem.inmanage:3.0.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/ieisystem/inmanage' 2026-07-02 18:26:30.032073 | ubuntu-noble | Loading collection fortinet.fortios from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/fortinet/fortios 2026-07-02 18:26:30.032634 | ubuntu-noble | Found installed collection fortinet.fortios:2.4.2 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/fortinet/fortios' 2026-07-02 18:26:30.034146 | ubuntu-noble | Loading collection cisco.aci from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/cisco/aci 2026-07-02 18:26:30.034602 | ubuntu-noble | Found installed collection cisco.aci:2.12.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/cisco/aci' 2026-07-02 18:26:30.034942 | ubuntu-noble | Loading collection community.grafana from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/grafana 2026-07-02 18:26:30.035221 | ubuntu-noble | Found installed collection community.grafana:2.3.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/grafana' 2026-07-02 18:26:30.035549 | ubuntu-noble | Loading collection community.okd from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/okd 2026-07-02 18:26:30.035985 | ubuntu-noble | Found installed collection community.okd:4.0.2 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/okd' 2026-07-02 18:26:30.036849 | ubuntu-noble | Loading collection hetzner.hcloud from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/hetzner/hcloud 2026-07-02 18:26:30.037140 | ubuntu-noble | Found installed collection hetzner.hcloud:4.3.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/hetzner/hcloud' 2026-07-02 18:26:30.037471 | ubuntu-noble | Loading collection infoblox.nios_modules from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/infoblox/nios_modules 2026-07-02 18:26:30.037801 | ubuntu-noble | Found installed collection infoblox.nios_modules:1.8.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/infoblox/nios_modules' 2026-07-02 18:26:30.038081 | ubuntu-noble | Loading collection community.dns from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/dns 2026-07-02 18:26:30.038955 | ubuntu-noble | Found installed collection community.dns:3.4.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/dns' 2026-07-02 18:26:30.038981 | ubuntu-noble | Loading collection ibm.storage_virtualize from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/ibm/storage_virtualize 2026-07-02 18:26:30.038988 | ubuntu-noble | Found installed collection ibm.storage_virtualize:2.7.4 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/ibm/storage_virtualize' 2026-07-02 18:26:30.039772 | ubuntu-noble | Loading collection cloudscale_ch.cloud from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/cloudscale_ch/cloud 2026-07-02 18:26:30.039797 | ubuntu-noble | Found installed collection cloudscale_ch.cloud:2.5.2 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/cloudscale_ch/cloud' 2026-07-02 18:26:30.041440 | ubuntu-noble | Loading collection vmware.vmware from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/vmware/vmware 2026-07-02 18:26:30.041492 | ubuntu-noble | Found installed collection vmware.vmware:1.11.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/vmware/vmware' 2026-07-02 18:26:30.041502 | ubuntu-noble | Loading collection dellemc.enterprise_sonic from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/dellemc/enterprise_sonic 2026-07-02 18:26:30.041526 | ubuntu-noble | Found installed collection dellemc.enterprise_sonic:2.5.1 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/dellemc/enterprise_sonic' 2026-07-02 18:26:30.041866 | ubuntu-noble | Loading collection community.proxmox from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/proxmox 2026-07-02 18:26:30.042186 | ubuntu-noble | Found installed collection community.proxmox:1.4.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/proxmox' 2026-07-02 18:26:30.042507 | ubuntu-noble | Loading collection microsoft.iis from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/microsoft/iis 2026-07-02 18:26:30.042774 | ubuntu-noble | Found installed collection microsoft.iis:1.0.3 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/microsoft/iis' 2026-07-02 18:26:30.043501 | ubuntu-noble | Loading collection vyos.vyos from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/vyos/vyos 2026-07-02 18:26:30.043831 | ubuntu-noble | Found installed collection vyos.vyos:5.0.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/vyos/vyos' 2026-07-02 18:26:30.044137 | ubuntu-noble | Loading collection telekom_mms.icinga_director from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/telekom_mms/icinga_director 2026-07-02 18:26:30.044435 | ubuntu-noble | Found installed collection telekom_mms.icinga_director:2.4.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/telekom_mms/icinga_director' 2026-07-02 18:26:30.044722 | ubuntu-noble | Loading collection purestorage.flasharray from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/purestorage/flasharray 2026-07-02 18:26:30.045030 | ubuntu-noble | Found installed collection purestorage.flasharray:1.39.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/purestorage/flasharray' 2026-07-02 18:26:30.045334 | ubuntu-noble | Loading collection wti.remote from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/wti/remote 2026-07-02 18:26:30.045633 | ubuntu-noble | Found installed collection wti.remote:1.0.10 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/wti/remote' 2026-07-02 18:26:30.045934 | ubuntu-noble | Loading collection community.routeros from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/routeros 2026-07-02 18:26:30.046221 | ubuntu-noble | Found installed collection community.routeros:3.13.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/routeros' 2026-07-02 18:26:30.046503 | ubuntu-noble | Loading collection cisco.intersight from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/cisco/intersight 2026-07-02 18:26:30.046729 | ubuntu-noble | Found installed collection cisco.intersight:2.7.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/cisco/intersight' 2026-07-02 18:26:30.047475 | ubuntu-noble | Loading collection dellemc.openmanage from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/dellemc/openmanage 2026-07-02 18:26:30.048021 | ubuntu-noble | Found installed collection dellemc.openmanage:9.12.3 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/dellemc/openmanage' 2026-07-02 18:26:30.048395 | ubuntu-noble | Loading collection cisco.ise from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/cisco/ise 2026-07-02 18:26:30.049066 | ubuntu-noble | Found installed collection cisco.ise:2.10.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/cisco/ise' 2026-07-02 18:26:30.051790 | ubuntu-noble | Loading collection cisco.nxos from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/cisco/nxos 2026-07-02 18:26:30.051834 | ubuntu-noble | Found installed collection cisco.nxos:9.4.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/cisco/nxos' 2026-07-02 18:26:30.051845 | ubuntu-noble | Loading collection community.rabbitmq from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/rabbitmq 2026-07-02 18:26:30.051856 | ubuntu-noble | Found installed collection community.rabbitmq:1.6.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/rabbitmq' 2026-07-02 18:26:30.052028 | ubuntu-noble | Loading collection hitachivantara.vspone_object from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/hitachivantara/vspone_object 2026-07-02 18:26:30.052450 | ubuntu-noble | Found installed collection hitachivantara.vspone_object:1.0.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/hitachivantara/vspone_object' 2026-07-02 18:26:30.052940 | ubuntu-noble | Loading collection netapp.cloudmanager from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/netapp/cloudmanager 2026-07-02 18:26:30.053310 | ubuntu-noble | Found installed collection netapp.cloudmanager:21.24.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/netapp/cloudmanager' 2026-07-02 18:26:30.053787 | ubuntu-noble | Loading collection infinidat.infinibox from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/infinidat/infinibox 2026-07-02 18:26:30.054134 | ubuntu-noble | Found installed collection infinidat.infinibox:1.6.3 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/infinidat/infinibox' 2026-07-02 18:26:30.054617 | ubuntu-noble | Loading collection netapp.ontap from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/netapp/ontap 2026-07-02 18:26:30.054903 | ubuntu-noble | Found installed collection netapp.ontap:22.14.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/netapp/ontap' 2026-07-02 18:26:30.055168 | ubuntu-noble | Loading collection community.ciscosmb from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/ciscosmb 2026-07-02 18:26:30.055443 | ubuntu-noble | Found installed collection community.ciscosmb:1.0.11 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/ciscosmb' 2026-07-02 18:26:30.055797 | ubuntu-noble | Loading collection amazon.aws from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/amazon/aws 2026-07-02 18:26:30.056125 | ubuntu-noble | Found installed collection amazon.aws:9.5.2 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/amazon/aws' 2026-07-02 18:26:30.057673 | ubuntu-noble | Loading collection theforeman.foreman from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/theforeman/foreman 2026-07-02 18:26:30.058127 | ubuntu-noble | Found installed collection theforeman.foreman:4.2.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/theforeman/foreman' 2026-07-02 18:26:30.058500 | ubuntu-noble | Loading collection ansible.utils from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/ansible/utils 2026-07-02 18:26:30.058783 | ubuntu-noble | Found installed collection ansible.utils:5.1.2 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/ansible/utils' 2026-07-02 18:26:30.059111 | ubuntu-noble | Loading collection ngine_io.cloudstack from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/ngine_io/cloudstack 2026-07-02 18:26:30.059447 | ubuntu-noble | Found installed collection ngine_io.cloudstack:2.5.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/ngine_io/cloudstack' 2026-07-02 18:26:30.059980 | ubuntu-noble | Loading collection kubernetes.core from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/kubernetes/core 2026-07-02 18:26:30.060262 | ubuntu-noble | Found installed collection kubernetes.core:5.4.1 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/kubernetes/core' 2026-07-02 18:26:30.060566 | ubuntu-noble | Loading collection ravendb.ravendb from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/ravendb/ravendb 2026-07-02 18:26:30.060860 | ubuntu-noble | Found installed collection ravendb.ravendb:1.0.4 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/ravendb/ravendb' 2026-07-02 18:26:30.061077 | ubuntu-noble | Loading collection cyberark.pas from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/cyberark/pas 2026-07-02 18:26:30.061367 | ubuntu-noble | Found installed collection cyberark.pas:1.0.36 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/cyberark/pas' 2026-07-02 18:26:30.061612 | ubuntu-noble | Loading collection cisco.ucs from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/cisco/ucs 2026-07-02 18:26:30.061905 | ubuntu-noble | Found installed collection cisco.ucs:1.16.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/cisco/ucs' 2026-07-02 18:26:30.062123 | ubuntu-noble | Loading collection check_point.mgmt from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/check_point/mgmt 2026-07-02 18:26:30.062442 | ubuntu-noble | Found installed collection check_point.mgmt:6.6.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/check_point/mgmt' 2026-07-02 18:26:30.062715 | ubuntu-noble | Loading collection community.postgresql from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/postgresql 2026-07-02 18:26:30.063011 | ubuntu-noble | Found installed collection community.postgresql:3.14.2 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/postgresql' 2026-07-02 18:26:30.063230 | ubuntu-noble | Loading collection sensu.sensu_go from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/sensu/sensu_go 2026-07-02 18:26:30.063519 | ubuntu-noble | Found installed collection sensu.sensu_go:1.14.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/sensu/sensu_go' 2026-07-02 18:26:30.063729 | ubuntu-noble | Loading collection containers.podman from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/containers/podman 2026-07-02 18:26:30.064029 | ubuntu-noble | Found installed collection containers.podman:1.18.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/containers/podman' 2026-07-02 18:26:30.064238 | ubuntu-noble | Loading collection microsoft.ad from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/microsoft/ad 2026-07-02 18:26:30.064564 | ubuntu-noble | Found installed collection microsoft.ad:1.9.2 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/microsoft/ad' 2026-07-02 18:26:30.064861 | ubuntu-noble | Loading collection community.docker from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/docker 2026-07-02 18:26:30.065293 | ubuntu-noble | Found installed collection community.docker:4.8.2 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/docker' 2026-07-02 18:26:30.065314 | ubuntu-noble | Loading collection ibm.qradar from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/ibm/qradar 2026-07-02 18:26:30.065565 | ubuntu-noble | Found installed collection ibm.qradar:4.0.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/ibm/qradar' 2026-07-02 18:26:30.065844 | ubuntu-noble | Loading collection kaytus.ksmanage from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/kaytus/ksmanage 2026-07-02 18:26:30.066101 | ubuntu-noble | Found installed collection kaytus.ksmanage:2.0.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/kaytus/ksmanage' 2026-07-02 18:26:30.066601 | ubuntu-noble | Loading collection hitachivantara.vspone_block from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/hitachivantara/vspone_block 2026-07-02 18:26:30.066863 | ubuntu-noble | Found installed collection hitachivantara.vspone_block:3.5.1 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/hitachivantara/vspone_block' 2026-07-02 18:26:30.067088 | ubuntu-noble | Loading collection community.libvirt from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/libvirt 2026-07-02 18:26:30.067307 | ubuntu-noble | Found installed collection community.libvirt:1.4.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/libvirt' 2026-07-02 18:26:30.068094 | ubuntu-noble | Loading collection cisco.iosxr from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/cisco/iosxr 2026-07-02 18:26:30.068426 | ubuntu-noble | Found installed collection cisco.iosxr:10.3.1 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/cisco/iosxr' 2026-07-02 18:26:30.069175 | ubuntu-noble | Loading collection netapp.storagegrid from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/netapp/storagegrid 2026-07-02 18:26:30.069205 | ubuntu-noble | Found installed collection netapp.storagegrid:21.14.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/netapp/storagegrid' 2026-07-02 18:26:30.071581 | ubuntu-noble | Loading collection cisco.meraki from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/cisco/meraki 2026-07-02 18:26:30.071617 | ubuntu-noble | Found installed collection cisco.meraki:2.21.8 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/cisco/meraki' 2026-07-02 18:26:30.072875 | ubuntu-noble | Loading collection cisco.ios from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/cisco/ios 2026-07-02 18:26:30.072915 | ubuntu-noble | Found installed collection cisco.ios:9.2.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/cisco/ios' 2026-07-02 18:26:30.072921 | ubuntu-noble | Loading collection community.sops from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/sops 2026-07-02 18:26:30.072926 | ubuntu-noble | Found installed collection community.sops:2.2.7 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/sops' 2026-07-02 18:26:30.073533 | ubuntu-noble | Loading collection community.hrobot from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/hrobot 2026-07-02 18:26:30.073550 | ubuntu-noble | Found installed collection community.hrobot:2.7.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/community/hrobot' 2026-07-02 18:26:30.074572 | ubuntu-noble | Loading collection ansible.netcommon from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/ansible/netcommon 2026-07-02 18:26:30.074859 | ubuntu-noble | Found installed collection ansible.netcommon:7.2.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/ansible/netcommon' 2026-07-02 18:26:30.078397 | ubuntu-noble | Loading collection vmware.vmware_rest from /home/zuul/venv/lib/python3.12/site-packages/ansible_collections/vmware/vmware_rest 2026-07-02 18:26:30.078459 | ubuntu-noble | Found installed collection vmware.vmware_rest:4.9.0 at '/home/zuul/venv/lib/python3.12/site-packages/ansible_collections/vmware/vmware_rest' 2026-07-02 18:26:30.079641 | ubuntu-noble | Starting galaxy collection install process 2026-07-02 18:26:30.079668 | ubuntu-noble | Nothing to do. All requested collections are already installed. If you want to reinstall them, consider using `--force`. 2026-07-02 18:26:30.171812 | ubuntu-noble | INFO [delegated > dependency] Dependency completed successfully. 2026-07-02 18:26:30.171879 | ubuntu-noble | WARNING [delegated > dependency] Executed: Missing roles requirements file: requirements.yml (Remove from converge_sequence to suppress) 2026-07-02 18:26:30.184952 | ubuntu-noble | INFO [delegated > create] Executing 2026-07-02 18:26:30.187575 | ubuntu-noble | WARNING [delegated > create] Executed: Missing playbook (Remove from converge_sequence to suppress) 2026-07-02 18:26:30.196886 | ubuntu-noble | INFO [delegated > prepare] Executing 2026-07-02 18:26:30.197035 | ubuntu-noble | WARNING [delegated > prepare] Skipping, instances already prepared. 2026-07-02 18:26:30.197141 | ubuntu-noble | INFO [delegated > prepare] Executed: Successful 2026-07-02 18:26:30.205397 | ubuntu-noble | INFO [delegated > converge] Executing 2026-07-02 18:26:30.627286 | ubuntu-noble | DEBUG [delegated > converge] ansible-playbook version: ansible-playbook 2026-07-02 18:26:30.627369 | ubuntu-noble | config file = None 2026-07-02 18:26:30.627384 | ubuntu-noble | configured module search path = 2026-07-02 18:26:30.627394 | ubuntu-noble | ansible python module location = /home/zuul/venv/lib/python3.12/site-packages/ansible 2026-07-02 18:26:30.627433 | ubuntu-noble | ansible collection location = /home/zuul/.ansible/collections:/usr/share/ansible/collections 2026-07-02 18:26:30.627445 | ubuntu-noble | executable location = /home/zuul/venv/bin/ansible-playbook 2026-07-02 18:26:30.627455 | ubuntu-noble | python version = 3.12.3 (main, Mar 23 2026, 19:04:32) (/home/zuul/venv/bin/python3) 2026-07-02 18:26:30.627465 | ubuntu-noble | jinja version = 3.1.6 2026-07-02 18:26:30.627474 | ubuntu-noble | libyaml = True 2026-07-02 18:26:30.628021 | ubuntu-noble | DEBUG ANSIBLE ENVIRONMENT: 2026-07-02 18:26:30.628052 | ubuntu-noble | ANSIBLE_COLLECTIONS_PATH: /home/zuul/venv/.ansible/collections:/home/zuul/.ansible/collections 2026-07-02 18:26:30.628063 | ubuntu-noble | ANSIBLE_CONFIG: /home/zuul/.ansible/tmp/molecule.oWZD.delegated/ansible.cfg 2026-07-02 18:26:30.628073 | ubuntu-noble | ANSIBLE_LIBRARY: ../../plugins 2026-07-02 18:26:30.628083 | ubuntu-noble | ANSIBLE_PYTHON_INTERPRETER: /home/zuul/venv/bin/python 2026-07-02 18:26:30.628093 | ubuntu-noble | ANSIBLE_ROLE: auditd 2026-07-02 18:26:30.628102 | ubuntu-noble | ANSIBLE_ROLES_PATH: ../../roles 2026-07-02 18:26:30.628112 | ubuntu-noble | ANSIBLE_VERBOSITY: 1 2026-07-02 18:26:30.628125 | ubuntu-noble | 2026-07-02 18:26:30.628471 | ubuntu-noble | DEBUG MOLECULE ENVIRONMENT: 2026-07-02 18:26:30.628490 | ubuntu-noble | MOLECULE_DEBUG: True 2026-07-02 18:26:30.628500 | ubuntu-noble | MOLECULE_DEPENDENCY_NAME: galaxy 2026-07-02 18:26:30.628539 | ubuntu-noble | MOLECULE_DRIVER_NAME: default 2026-07-02 18:26:30.628550 | ubuntu-noble | MOLECULE_ENV_FILE: /home/zuul/src/github.com/osism/ansible-collection-services/.env.yml 2026-07-02 18:26:30.628561 | ubuntu-noble | MOLECULE_EPHEMERAL_DIRECTORY: /home/zuul/.ansible/tmp/molecule.oWZD.delegated 2026-07-02 18:26:30.628572 | ubuntu-noble | MOLECULE_FILE: /home/zuul/.ansible/tmp/molecule.oWZD.delegated/molecule.yml 2026-07-02 18:26:30.628582 | ubuntu-noble | MOLECULE_INSTANCE_CONFIG: /home/zuul/.ansible/tmp/molecule.oWZD.delegated/instance_config.yml 2026-07-02 18:26:30.628592 | ubuntu-noble | MOLECULE_INVENTORY_FILE: /home/zuul/.ansible/tmp/molecule.oWZD.delegated/inventory/ansible_inventory.yml 2026-07-02 18:26:30.628602 | ubuntu-noble | MOLECULE_PROJECT_DIRECTORY: /home/zuul/src/github.com/osism/ansible-collection-services 2026-07-02 18:26:30.628611 | ubuntu-noble | MOLECULE_PROVISIONER_NAME: ansible 2026-07-02 18:26:30.628621 | ubuntu-noble | MOLECULE_SCENARIO_DIRECTORY: /home/zuul/src/github.com/osism/ansible-collection-services/molecule/delegated 2026-07-02 18:26:30.628631 | ubuntu-noble | MOLECULE_SCENARIO_NAME: delegated 2026-07-02 18:26:30.628641 | ubuntu-noble | MOLECULE_STATE_FILE: /home/zuul/.ansible/tmp/molecule.oWZD.delegated/state.yml 2026-07-02 18:26:30.628650 | ubuntu-noble | MOLECULE_VERIFIER_NAME: testinfra 2026-07-02 18:26:30.628660 | ubuntu-noble | MOLECULE_VERIFIER_TEST_DIRECTORY: /home/zuul/src/github.com/osism/ansible-collection-services/molecule/delegated/tests 2026-07-02 18:26:30.628671 | ubuntu-noble | 2026-07-02 18:26:30.629127 | ubuntu-noble | DEBUG SHELL REPLAY: ANSIBLE_COLLECTIONS_PATH=/home/zuul/venv/.ansible/collections:/home/zuul/.ansible/collections ANSIBLE_CONFIG=/home/zuul/.ansible/tmp/molecule.oWZD.delegated/ansible.cfg ANSIBLE_LIBRARY=../../plugins ANSIBLE_PYTHON_INTERPRETER=/home/zuul/venv/bin/python ANSIBLE_ROLE=auditd ANSIBLE_ROLES_PATH=../../roles ANSIBLE_VERBOSITY=1 MOLECULE_DEBUG=True MOLECULE_DEPENDENCY_NAME=galaxy MOLECULE_DRIVER_NAME=default MOLECULE_ENV_FILE=/home/zuul/src/github.com/osism/ansible-collection-services/.env.yml MOLECULE_EPHEMERAL_DIRECTORY=/home/zuul/.ansible/tmp/molecule.oWZD.delegated MOLECULE_FILE=/home/zuul/.ansible/tmp/molecule.oWZD.delegated/molecule.yml MOLECULE_INSTANCE_CONFIG=/home/zuul/.ansible/tmp/molecule.oWZD.delegated/instance_config.yml MOLECULE_INVENTORY_FILE=/home/zuul/.ansible/tmp/molecule.oWZD.delegated/inventory/ansible_inventory.yml MOLECULE_PROJECT_DIRECTORY=/home/zuul/src/github.com/osism/ansible-collection-services MOLECULE_PROVISIONER_NAME=ansible MOLECULE_SCENARIO_DIRECTORY=/home/zuul/src/github.com/osism/ansible-collection-services/molecule/delegated MOLECULE_SCENARIO_NAME=delegated MOLECULE_STATE_FILE=/home/zuul/.ansible/tmp/molecule.oWZD.delegated/state.yml MOLECULE_VERIFIER_NAME=testinfra MOLECULE_VERIFIER_TEST_DIRECTORY=/home/zuul/src/github.com/osism/ansible-collection-services/molecule/delegated/tests 2026-07-02 18:26:31.064905 | debian-bookworm | ok: [molecule-auditd] 2026-07-02 18:26:31.065013 | debian-bookworm | 2026-07-02 18:26:31.065145 | debian-bookworm | TASK [Include required variables] ********************************************** 2026-07-02 18:26:31.089952 | debian-bookworm | ok: [molecule-auditd] => {"ansible_facts": {}, "ansible_included_var_files": ["/home/zuul/src/github.com/osism/ansible-collection-services/molecule/delegated/vars/auditd.yml"], "changed": false} 2026-07-02 18:26:31.090020 | debian-bookworm | 2026-07-02 18:26:31.090033 | debian-bookworm | TASK [Include role auditd] ***************************************************** 2026-07-02 18:26:31.130966 | debian-bookworm | included: auditd for molecule-auditd 2026-07-02 18:26:31.131050 | debian-bookworm | 2026-07-02 18:26:31.131161 | debian-bookworm | TASK [auditd : Include distribution specific install tasks] ******************** 2026-07-02 18:26:31.172348 | debian-bookworm | included: /home/zuul/src/github.com/osism/ansible-collection-services/roles/auditd/tasks/install-Debian-family.yml for molecule-auditd 2026-07-02 18:26:31.172431 | debian-bookworm | 2026-07-02 18:26:31.172547 | debian-bookworm | TASK [auditd : Install auditd package] ***************************************** 2026-07-02 18:26:30.954776 | ubuntu-noble | Using /home/zuul/.ansible/tmp/molecule.oWZD.delegated/ansible.cfg as config file 2026-07-02 18:26:31.217037 | ubuntu-noble | 2026-07-02 18:26:31.217596 | ubuntu-noble | PLAY [Converge] **************************************************************** 2026-07-02 18:26:31.217999 | ubuntu-noble | 2026-07-02 18:26:31.220338 | ubuntu-noble | TASK [Gathering Facts] ********************************************************* 2026-07-02 18:26:32.581185 | ubuntu-noble | ok: [molecule-auditd] 2026-07-02 18:26:32.581246 | ubuntu-noble | 2026-07-02 18:26:32.581254 | ubuntu-noble | TASK [Include required variables] ********************************************** 2026-07-02 18:26:32.621311 | ubuntu-noble | ok: [molecule-auditd] => {"ansible_facts": {}, "ansible_included_var_files": ["/home/zuul/src/github.com/osism/ansible-collection-services/molecule/delegated/vars/auditd.yml"], "changed": false} 2026-07-02 18:26:32.621522 | ubuntu-noble | 2026-07-02 18:26:32.623316 | ubuntu-noble | TASK [Include role auditd] ***************************************************** 2026-07-02 18:26:32.689706 | ubuntu-noble | included: auditd for molecule-auditd 2026-07-02 18:26:32.690042 | ubuntu-noble | 2026-07-02 18:26:32.690370 | ubuntu-noble | TASK [auditd : Include distribution specific install tasks] ******************** 2026-07-02 18:26:32.726424 | ubuntu-noble | included: /home/zuul/src/github.com/osism/ansible-collection-services/roles/auditd/tasks/install-Debian-family.yml for molecule-auditd 2026-07-02 18:26:32.726587 | ubuntu-noble | 2026-07-02 18:26:32.726805 | ubuntu-noble | TASK [auditd : Install auditd package] ***************************************** 2026-07-02 18:26:35.039207 | debian-bookworm | The following additional packages will be installed: 2026-07-02 18:26:35.039298 | debian-bookworm | libauparse0 2026-07-02 18:26:35.039384 | debian-bookworm | Suggested packages: 2026-07-02 18:26:35.039535 | debian-bookworm | audispd-plugins 2026-07-02 18:26:35.039686 | debian-bookworm | The following NEW packages will be installed: 2026-07-02 18:26:35.039839 | debian-bookworm | auditd libauparse0 2026-07-02 18:26:35.039980 | debian-bookworm | 0 upgraded, 2 newly installed, 0 to remove and 0 not upgraded. 2026-07-02 18:26:35.041126 | debian-bookworm | changed: [molecule-auditd] => {"cache_update_time": 1783016689, "cache_updated": false, "changed": true, "stderr": "debconf: delaying package configuration, since apt-utils is not installed\n", "stderr_lines": ["debconf: delaying package configuration, since apt-utils is not installed"], "stdout": "Reading package lists...\nBuilding dependency tree...\nReading state information...\nThe following additional packages will be installed:\n libauparse0\nSuggested packages:\n audispd-plugins\nThe following NEW packages will be installed:\n auditd libauparse0\n0 upgraded, 2 newly installed, 0 to remove and 0 not upgraded.\nNeed to get 279 kB of archives.\nAfter this operation, 934 kB of additional disk space will be used.\nGet:1 http://deb.debian.org/debian bookworm/main amd64 libauparse0 amd64 1:3.0.9-1 [61.9 kB]\nGet:2 http://deb.debian.org/debian bookworm/main amd64 auditd amd64 1:3.0.9-1 [218 kB]\nFetched 279 kB in 0s (3524 kB/s)\nSelecting previously unselected package libauparse0:amd64.\r\n(Reading database ... \r(Reading database ... 5%\r(Reading database ... 10%\r(Reading database ... 15%\r(Reading database ... 20%\r(Reading database ... 25%\r(Reading database ... 30%\r(Reading database ... 35%\r(Reading database ... 40%\r(Reading database ... 45%\r(Reading database ... 50%\r(Reading database ... 55%\r(Reading database ... 60%\r(Reading database ... 65%\r(Reading database ... 70%\r(Reading database ... 75%\r(Reading database ... 80%\r(Reading database ... 85%\r(Reading database ... 90%\r(Reading database ... 95%\r(Reading database ... 100%\r(Reading database ... 28691 files and directories currently installed.)\r\nPreparing to unpack .../libauparse0_1%3a3.0.9-1_amd64.deb ...\r\nUnpacking libauparse0:amd64 (1:3.0.9-1) ...\r\nSelecting previously unselected package auditd.\r\nPreparing to unpack .../auditd_1%3a3.0.9-1_amd64.deb ...\r\nUnpacking auditd (1:3.0.9-1) ...\r\nSetting up libauparse0:amd64 (1:3.0.9-1) ...\r\nSetting up auditd (1:3.0.9-1) ...\r\nCreated symlink /etc/systemd/system/multi-user.target.wants/auditd.service → /lib/systemd/system/auditd.service.\r\r\nProcessing triggers for libc-bin (2.36-9+deb12u14) ...\r\n", "stdout_lines": ["Reading package lists...", "Building dependency tree...", "Reading state information...", "The following additional packages will be installed:", " libauparse0", "Suggested packages:", " audispd-plugins", "The following NEW packages will be installed:", " auditd libauparse0", "0 upgraded, 2 newly installed, 0 to remove and 0 not upgraded.", "Need to get 279 kB of archives.", "After this operation, 934 kB of additional disk space will be used.", "Get:1 http://deb.debian.org/debian bookworm/main amd64 libauparse0 amd64 1:3.0.9-1 [61.9 kB]", "Get:2 http://deb.debian.org/debian bookworm/main amd64 auditd amd64 1:3.0.9-1 [218 kB]", "Fetched 279 kB in 0s (3524 kB/s)", "Selecting previously unselected package libauparse0:amd64.", "(Reading database ... ", "(Reading database ... 5%", "(Reading database ... 10%", "(Reading database ... 15%", "(Reading database ... 20%", "(Reading database ... 25%", "(Reading database ... 30%", "(Reading database ... 35%", "(Reading database ... 40%", "(Reading database ... 45%", "(Reading database ... 50%", "(Reading database ... 55%", "(Reading database ... 60%", "(Reading database ... 65%", "(Reading database ... 70%", "(Reading database ... 75%", "(Reading database ... 80%", "(Reading database ... 85%", "(Reading database ... 90%", "(Reading database ... 95%", "(Reading database ... 100%", "(Reading database ... 28691 files and directories currently installed.)", "Preparing to unpack .../libauparse0_1%3a3.0.9-1_amd64.deb ...", "Unpacking libauparse0:amd64 (1:3.0.9-1) ...", "Selecting previously unselected package auditd.", "Preparing to unpack .../auditd_1%3a3.0.9-1_amd64.deb ...", "Unpacking auditd (1:3.0.9-1) ...", "Setting up libauparse0:amd64 (1:3.0.9-1) ...", "Setting up auditd (1:3.0.9-1) ...", "Created symlink /etc/systemd/system/multi-user.target.wants/auditd.service → /lib/systemd/system/auditd.service.", "", "Processing triggers for libc-bin (2.36-9+deb12u14) ..."]} 2026-07-02 18:26:35.041172 | debian-bookworm | 2026-07-02 18:26:35.041255 | debian-bookworm | TASK [auditd : Install audispd-plugins package] ******************************** 2026-07-02 18:26:37.682994 | debian-bookworm | The following NEW packages will be installed: 2026-07-02 18:26:37.683329 | debian-bookworm | audispd-plugins 2026-07-02 18:26:37.683658 | debian-bookworm | 0 upgraded, 1 newly installed, 0 to remove and 0 not upgraded. 2026-07-02 18:26:37.684273 | debian-bookworm | changed: [molecule-auditd] => {"cache_update_time": 1783016689, "cache_updated": false, "changed": true, "stderr": "debconf: delaying package configuration, since apt-utils is not installed\n", "stderr_lines": ["debconf: delaying package configuration, since apt-utils is not installed"], "stdout": "Reading package lists...\nBuilding dependency tree...\nReading state information...\nThe following NEW packages will be installed:\n audispd-plugins\n0 upgraded, 1 newly installed, 0 to remove and 0 not upgraded.\nNeed to get 45.6 kB of archives.\nAfter this operation, 132 kB of additional disk space will be used.\nGet:1 http://deb.debian.org/debian bookworm/main amd64 audispd-plugins amd64 1:3.0.9-1 [45.6 kB]\nFetched 45.6 kB in 0s (955 kB/s)\nSelecting previously unselected package audispd-plugins.\r\n(Reading database ... \r(Reading database ... 5%\r(Reading database ... 10%\r(Reading database ... 15%\r(Reading database ... 20%\r(Reading database ... 25%\r(Reading database ... 30%\r(Reading database ... 35%\r(Reading database ... 40%\r(Reading database ... 45%\r(Reading database ... 50%\r(Reading database ... 55%\r(Reading database ... 60%\r(Reading database ... 65%\r(Reading database ... 70%\r(Reading database ... 75%\r(Reading database ... 80%\r(Reading database ... 85%\r(Reading database ... 90%\r(Reading database ... 95%\r(Reading database ... 100%\r(Reading database ... 28782 files and directories currently installed.)\r\nPreparing to unpack .../audispd-plugins_1%3a3.0.9-1_amd64.deb ...\r\nUnpacking audispd-plugins (1:3.0.9-1) ...\r\nSetting up audispd-plugins (1:3.0.9-1) ...\r\n", "stdout_lines": ["Reading package lists...", "Building dependency tree...", "Reading state information...", "The following NEW packages will be installed:", " audispd-plugins", "0 upgraded, 1 newly installed, 0 to remove and 0 not upgraded.", "Need to get 45.6 kB of archives.", "After this operation, 132 kB of additional disk space will be used.", "Get:1 http://deb.debian.org/debian bookworm/main amd64 audispd-plugins amd64 1:3.0.9-1 [45.6 kB]", "Fetched 45.6 kB in 0s (955 kB/s)", "Selecting previously unselected package audispd-plugins.", "(Reading database ... ", "(Reading database ... 5%", "(Reading database ... 10%", "(Reading database ... 15%", "(Reading database ... 20%", "(Reading database ... 25%", "(Reading database ... 30%", "(Reading database ... 35%", "(Reading database ... 40%", "(Reading database ... 45%", "(Reading database ... 50%", "(Reading database ... 55%", "(Reading database ... 60%", "(Reading database ... 65%", "(Reading database ... 70%", "(Reading database ... 75%", "(Reading database ... 80%", "(Reading database ... 85%", "(Reading database ... 90%", "(Reading database ... 95%", "(Reading database ... 100%", "(Reading database ... 28782 files and directories currently installed.)", "Preparing to unpack .../audispd-plugins_1%3a3.0.9-1_amd64.deb ...", "Unpacking audispd-plugins (1:3.0.9-1) ...", "Setting up audispd-plugins (1:3.0.9-1) ..."]} 2026-07-02 18:26:37.684671 | debian-bookworm | 2026-07-02 18:26:37.685112 | debian-bookworm | TASK [auditd : Copy auditd.conf configuration files] *************************** 2026-07-02 18:26:37.880454 | ubuntu-noble | The following additional packages will be installed: 2026-07-02 18:26:37.880610 | ubuntu-noble | libauparse0t64 2026-07-02 18:26:37.880801 | ubuntu-noble | Suggested packages: 2026-07-02 18:26:37.880967 | ubuntu-noble | audispd-plugins 2026-07-02 18:26:37.881132 | ubuntu-noble | The following NEW packages will be installed: 2026-07-02 18:26:37.881294 | ubuntu-noble | auditd libauparse0t64 2026-07-02 18:26:37.881462 | ubuntu-noble | 0 upgraded, 2 newly installed, 0 to remove and 5 not upgraded. 2026-07-02 18:26:37.886870 | ubuntu-noble | changed: [molecule-auditd] => {"cache_update_time": 1783016690, "cache_updated": false, "changed": true, "stderr": "debconf: delaying package configuration, since apt-utils is not installed\n", "stderr_lines": ["debconf: delaying package configuration, since apt-utils is not installed"], "stdout": "Reading package lists...\nBuilding dependency tree...\nReading state information...\nThe following additional packages will be installed:\n libauparse0t64\nSuggested packages:\n audispd-plugins\nThe following NEW packages will be installed:\n auditd libauparse0t64\n0 upgraded, 2 newly installed, 0 to remove and 5 not upgraded.\nNeed to get 274 kB of archives.\nAfter this operation, 893 kB of additional disk space will be used.\nGet:1 http://archive.ubuntu.com/ubuntu noble-updates/main amd64 libauparse0t64 amd64 1:3.1.2-2.1build1.1 [58.9 kB]\nGet:2 http://archive.ubuntu.com/ubuntu noble-updates/main amd64 auditd amd64 1:3.1.2-2.1build1.1 [215 kB]\nFetched 274 kB in 0s (2700 kB/s)\nSelecting previously unselected package libauparse0t64:amd64.\r\n(Reading database ... \r(Reading database ... 5%\r(Reading database ... 10%\r(Reading database ... 15%\r(Reading database ... 20%\r(Reading database ... 25%\r(Reading database ... 30%\r(Reading database ... 35%\r(Reading database ... 40%\r(Reading database ... 45%\r(Reading database ... 50%\r(Reading database ... 55%\r(Reading database ... 60%\r(Reading database ... 65%\r(Reading database ... 70%\r(Reading database ... 75%\r(Reading database ... 80%\r(Reading database ... 85%\r(Reading database ... 90%\r(Reading database ... 95%\r(Reading database ... 100%\r(Reading database ... 36096 files and directories currently installed.)\r\nPreparing to unpack .../libauparse0t64_1%3a3.1.2-2.1build1.1_amd64.deb ...\r\nAdding 'diversion of /lib/x86_64-linux-gnu/libauparse.so.0 to /lib/x86_64-linux-gnu/libauparse.so.0.usr-is-merged by libauparse0t64'\r\nAdding 'diversion of /lib/x86_64-linux-gnu/libauparse.so.0.0.0 to /lib/x86_64-linux-gnu/libauparse.so.0.0.0.usr-is-merged by libauparse0t64'\r\nUnpacking libauparse0t64:amd64 (1:3.1.2-2.1build1.1) ...\r\nSelecting previously unselected package auditd.\r\nPreparing to unpack .../auditd_1%3a3.1.2-2.1build1.1_amd64.deb ...\r\nUnpacking auditd (1:3.1.2-2.1build1.1) ...\r\nSetting up libauparse0t64:amd64 (1:3.1.2-2.1build1.1) ...\r\nSetting up auditd (1:3.1.2-2.1build1.1) ...\r\nCreated symlink /etc/systemd/system/multi-user.target.wants/auditd.service → /usr/lib/systemd/system/auditd.service.\r\r\nProcessing triggers for libc-bin (2.39-0ubuntu8.7) ...\r\n", "stdout_lines": ["Reading package lists...", "Building dependency tree...", "Reading state information...", "The following additional packages will be installed:", " libauparse0t64", "Suggested packages:", " audispd-plugins", "The following NEW packages will be installed:", " auditd libauparse0t64", "0 upgraded, 2 newly installed, 0 to remove and 5 not upgraded.", "Need to get 274 kB of archives.", "After this operation, 893 kB of additional disk space will be used.", "Get:1 http://archive.ubuntu.com/ubuntu noble-updates/main amd64 libauparse0t64 amd64 1:3.1.2-2.1build1.1 [58.9 kB]", "Get:2 http://archive.ubuntu.com/ubuntu noble-updates/main amd64 auditd amd64 1:3.1.2-2.1build1.1 [215 kB]", "Fetched 274 kB in 0s (2700 kB/s)", "Selecting previously unselected package libauparse0t64:amd64.", "(Reading database ... ", "(Reading database ... 5%", "(Reading database ... 10%", "(Reading database ... 15%", "(Reading database ... 20%", "(Reading database ... 25%", "(Reading database ... 30%", "(Reading database ... 35%", "(Reading database ... 40%", "(Reading database ... 45%", "(Reading database ... 50%", "(Reading database ... 55%", "(Reading database ... 60%", "(Reading database ... 65%", "(Reading database ... 70%", "(Reading database ... 75%", "(Reading database ... 80%", "(Reading database ... 85%", "(Reading database ... 90%", "(Reading database ... 95%", "(Reading database ... 100%", "(Reading database ... 36096 files and directories currently installed.)", "Preparing to unpack .../libauparse0t64_1%3a3.1.2-2.1build1.1_amd64.deb ...", "Adding 'diversion of /lib/x86_64-linux-gnu/libauparse.so.0 to /lib/x86_64-linux-gnu/libauparse.so.0.usr-is-merged by libauparse0t64'", "Adding 'diversion of /lib/x86_64-linux-gnu/libauparse.so.0.0.0 to /lib/x86_64-linux-gnu/libauparse.so.0.0.0.usr-is-merged by libauparse0t64'", "Unpacking libauparse0t64:amd64 (1:3.1.2-2.1build1.1) ...", "Selecting previously unselected package auditd.", "Preparing to unpack .../auditd_1%3a3.1.2-2.1build1.1_amd64.deb ...", "Unpacking auditd (1:3.1.2-2.1build1.1) ...", "Setting up libauparse0t64:amd64 (1:3.1.2-2.1build1.1) ...", "Setting up auditd (1:3.1.2-2.1build1.1) ...", "Created symlink /etc/systemd/system/multi-user.target.wants/auditd.service → /usr/lib/systemd/system/auditd.service.", "", "Processing triggers for libc-bin (2.39-0ubuntu8.7) ..."]} 2026-07-02 18:26:37.886932 | ubuntu-noble | 2026-07-02 18:26:37.886952 | ubuntu-noble | TASK [auditd : Install audispd-plugins package] ******************************** 2026-07-02 18:26:38.724341 | debian-bookworm | --- before 2026-07-02 18:26:38.724435 | debian-bookworm | +++ after: /home/zuul/.ansible/tmp/ansible-local-2197mx7_95w0/tmp9jx36ooo/auditd.conf.j2 2026-07-02 18:26:38.724451 | debian-bookworm | @@ -0,0 +1,37 @@ 2026-07-02 18:26:38.724467 | debian-bookworm | +# 2026-07-02 18:26:38.724504 | debian-bookworm | +# This file controls the configuration of the audit daemon 2026-07-02 18:26:38.724611 | debian-bookworm | +# 2026-07-02 18:26:38.724703 | debian-bookworm | + 2026-07-02 18:26:38.724805 | debian-bookworm | +local_events = yes 2026-07-02 18:26:38.724890 | debian-bookworm | +write_logs = yes 2026-07-02 18:26:38.724991 | debian-bookworm | +log_file = /var/log/audit/audit.log 2026-07-02 18:26:38.725092 | debian-bookworm | +log_group = adm 2026-07-02 18:26:38.725230 | debian-bookworm | +log_format = RAW 2026-07-02 18:26:38.725303 | debian-bookworm | +flush = INCREMENTAL_ASYNC 2026-07-02 18:26:38.725399 | debian-bookworm | +freq = 50 2026-07-02 18:26:38.725495 | debian-bookworm | +max_log_file = 8 2026-07-02 18:26:38.725617 | debian-bookworm | +num_logs = 5 2026-07-02 18:26:38.725706 | debian-bookworm | +priority_boost = 4 2026-07-02 18:26:38.725800 | debian-bookworm | +disp_qos = lossy 2026-07-02 18:26:38.725895 | debian-bookworm | +dispatcher = /sbin/audispd 2026-07-02 18:26:38.725988 | debian-bookworm | +name_format = NONE 2026-07-02 18:26:38.726081 | debian-bookworm | +##name = mydomain 2026-07-02 18:26:38.726176 | debian-bookworm | +max_log_file_action = ROTATE 2026-07-02 18:26:38.726279 | debian-bookworm | +space_left = 12361 2026-07-02 18:26:38.726372 | debian-bookworm | +space_left_action = email 2026-07-02 18:26:38.726464 | debian-bookworm | +verify_email = yes 2026-07-02 18:26:38.726558 | debian-bookworm | +action_mail_acct = root 2026-07-02 18:26:38.726650 | debian-bookworm | +admin_space_left = 50 2026-07-02 18:26:38.726746 | debian-bookworm | +admin_space_left_action = SUSPEND 2026-07-02 18:26:38.726849 | debian-bookworm | +disk_full_action = SUSPEND 2026-07-02 18:26:38.726941 | debian-bookworm | +disk_error_action = SUSPEND 2026-07-02 18:26:38.727034 | debian-bookworm | +use_libwrap = yes 2026-07-02 18:26:38.727128 | debian-bookworm | +##tcp_listen_port = 60 2026-07-02 18:26:38.727238 | debian-bookworm | +tcp_listen_queue = 5 2026-07-02 18:26:38.727333 | debian-bookworm | +tcp_max_per_addr = 1 2026-07-02 18:26:38.727428 | debian-bookworm | +##tcp_client_ports = 1024-65535 2026-07-02 18:26:38.727523 | debian-bookworm | +tcp_client_max_idle = 0 2026-07-02 18:26:38.727618 | debian-bookworm | +enable_krb5 = no 2026-07-02 18:26:38.727714 | debian-bookworm | +krb5_principal = auditd 2026-07-02 18:26:38.727974 | debian-bookworm | +##krb5_key_file = /etc/audit/audit.key 2026-07-02 18:26:38.728088 | debian-bookworm | +distribute_network = no 2026-07-02 18:26:38.728238 | debian-bookworm | 2026-07-02 18:26:38.728357 | debian-bookworm | changed: [molecule-auditd] => {"changed": true, "checksum": "e902cc6bebf86c17087d153e359a2cc1231672e0", "dest": "/etc/audit/audit.conf", "gid": 0, "group": "root", "md5sum": "69dfd768317bae876a6a78c8aeb5cce1", "mode": "0640", "owner": "root", "size": 806, "src": "/home/zuul/.ansible/tmp/ansible-tmp-1783016797.6997635-2567-261391412553463/.source.conf", "state": "file", "uid": 0} 2026-07-02 18:26:38.728429 | debian-bookworm | 2026-07-02 18:26:38.728536 | debian-bookworm | TASK [auditd : Adjust auditd/audispd configurations] *************************** 2026-07-02 18:26:39.086282 | debian-bookworm | ok: [molecule-auditd] => (item={'parameter': 'active', 'value': 'no', 'config': '/etc/audit/plugins.d/syslog.conf'}) => {"ansible_loop_var": "item", "backup": "", "changed": false, "item": {"config": "/etc/audit/plugins.d/syslog.conf", "parameter": "active", "value": "no"}, "msg": ""} 2026-07-02 18:26:39.086337 | debian-bookworm | 2026-07-02 18:26:39.086352 | debian-bookworm | TASK [auditd : Deploy rules for auditd] **************************************** 2026-07-02 18:26:39.827133 | debian-bookworm | --- before 2026-07-02 18:26:39.827343 | debian-bookworm | +++ after: /home/zuul/.ansible/tmp/ansible-local-2197mx7_95w0/tmp3tdps_i6/20-neo23x0.rules.j2 2026-07-02 18:26:39.827524 | debian-bookworm | @@ -0,0 +1,750 @@ 2026-07-02 18:26:39.827727 | debian-bookworm | +# ___ ___ __ __ 2026-07-02 18:26:39.827899 | debian-bookworm | +# / | __ ______/ (_) /_____/ / 2026-07-02 18:26:39.828072 | debian-bookworm | +# / /| |/ / / / __ / / __/ __ / 2026-07-02 18:26:39.828278 | debian-bookworm | +# / ___ / /_/ / /_/ / / /_/ /_/ / 2026-07-02 18:26:39.828441 | debian-bookworm | +# /_/ |_\__,_/\__,_/_/\__/\__,_/ 2026-07-02 18:26:39.828599 | debian-bookworm | +# 2026-07-02 18:26:39.828760 | debian-bookworm | +# Linux Audit Daemon - Best Practice Configuration 2026-07-02 18:26:39.828915 | debian-bookworm | +# /etc/audit/audit.rules 2026-07-02 18:26:39.829066 | debian-bookworm | +# 2026-07-02 18:26:39.829237 | debian-bookworm | +# Compiled by Florian Roth 2026-07-02 18:26:39.829387 | debian-bookworm | +# 2026-07-02 18:26:39.829543 | debian-bookworm | +# Created : 2017/12/05 2026-07-02 18:26:39.829923 | debian-bookworm | +# Modified : 2023/01/25 2026-07-02 18:26:39.830200 | debian-bookworm | +# 2026-07-02 18:26:39.830403 | debian-bookworm | +# Based on rules published here: 2026-07-02 18:26:39.830600 | debian-bookworm | +# Gov.uk auditd rules 2026-07-02 18:26:39.830959 | debian-bookworm | +# https://github.com/gds-operations/puppet-auditd/pull/1 2026-07-02 18:26:39.831236 | debian-bookworm | +# CentOS 7 hardening 2026-07-02 18:26:39.831490 | debian-bookworm | +# https://highon.coffee/blog/security-harden-centos-7/#auditd---audit-daemon 2026-07-02 18:26:39.831715 | debian-bookworm | +# Linux audit repo 2026-07-02 18:26:39.831949 | debian-bookworm | +# https://github.com/linux-audit/audit-userspace/tree/master/rules 2026-07-02 18:26:39.832189 | debian-bookworm | +# Auditd high performance linux auditing 2026-07-02 18:26:39.832422 | debian-bookworm | +# https://linux-audit.com/tuning-auditd-high-performance-linux-auditing/ 2026-07-02 18:26:39.832580 | debian-bookworm | +# 2026-07-02 18:26:39.832741 | debian-bookworm | +# Further rules 2026-07-02 18:26:39.832961 | debian-bookworm | +# For PCI DSS compliance see: 2026-07-02 18:26:39.833204 | debian-bookworm | +# https://github.com/linux-audit/audit-userspace/blob/master/rules/30-pci-dss-v31.rules 2026-07-02 18:26:39.833422 | debian-bookworm | +# For NISPOM compliance see: 2026-07-02 18:26:39.833667 | debian-bookworm | +# https://github.com/linux-audit/audit-userspace/blob/master/rules/30-nispom.rules 2026-07-02 18:26:39.833828 | debian-bookworm | + 2026-07-02 18:26:39.833991 | debian-bookworm | +# Remove any existing rules 2026-07-02 18:26:39.834147 | debian-bookworm | +-D 2026-07-02 18:26:39.834347 | debian-bookworm | + 2026-07-02 18:26:39.834490 | debian-bookworm | +# Buffer Size 2026-07-02 18:26:39.834634 | debian-bookworm | +## Feel free to increase this if the machine panic's 2026-07-02 18:26:39.834774 | debian-bookworm | +-b 8192 2026-07-02 18:26:39.834909 | debian-bookworm | + 2026-07-02 18:26:39.835048 | debian-bookworm | +# Failure Mode 2026-07-02 18:26:39.835207 | debian-bookworm | +## Possible values: 0 (silent), 1 (printk, print a failure message), 2 (panic, halt the system) 2026-07-02 18:26:39.835351 | debian-bookworm | +-f 1 2026-07-02 18:26:39.835489 | debian-bookworm | + 2026-07-02 18:26:39.835629 | debian-bookworm | +# Ignore errors 2026-07-02 18:26:39.835772 | debian-bookworm | +## e.g. caused by users or files not found in the local environment 2026-07-02 18:26:39.835911 | debian-bookworm | +-i 2026-07-02 18:26:39.836049 | debian-bookworm | + 2026-07-02 18:26:39.836237 | debian-bookworm | +# Self Auditing --------------------------------------------------------------- 2026-07-02 18:26:39.836424 | debian-bookworm | + 2026-07-02 18:26:39.836605 | debian-bookworm | +## Audit the audit logs 2026-07-02 18:26:39.836800 | debian-bookworm | +### Successful and unsuccessful attempts to read information from the audit records 2026-07-02 18:26:39.837000 | debian-bookworm | +-w /var/log/audit/ -p wra -k auditlog 2026-07-02 18:26:39.837249 | debian-bookworm | +-w /var/audit/ -p wra -k auditlog 2026-07-02 18:26:39.837454 | debian-bookworm | + 2026-07-02 18:26:39.837685 | debian-bookworm | +## Auditd configuration 2026-07-02 18:26:39.837881 | debian-bookworm | +### Modifications to audit configuration that occur while the audit collection functions are operating 2026-07-02 18:26:39.838069 | debian-bookworm | +-w /etc/audit/ -p wa -k auditconfig 2026-07-02 18:26:39.838267 | debian-bookworm | +-w /etc/libaudit.conf -p wa -k auditconfig 2026-07-02 18:26:39.838437 | debian-bookworm | +-w /etc/audisp/ -p wa -k audispconfig 2026-07-02 18:26:39.838615 | debian-bookworm | + 2026-07-02 18:26:39.838782 | debian-bookworm | +## Monitor for use of audit management tools 2026-07-02 18:26:39.838972 | debian-bookworm | +-w /sbin/auditctl -p x -k audittools 2026-07-02 18:26:39.839145 | debian-bookworm | +-w /sbin/auditd -p x -k audittools 2026-07-02 18:26:39.839350 | debian-bookworm | +-w /usr/sbin/auditd -p x -k audittools 2026-07-02 18:26:39.839527 | debian-bookworm | +-w /usr/sbin/augenrules -p x -k audittools 2026-07-02 18:26:39.839677 | debian-bookworm | + 2026-07-02 18:26:39.839817 | debian-bookworm | +## Access to all audit trails 2026-07-02 18:26:39.839950 | debian-bookworm | + 2026-07-02 18:26:39.840098 | debian-bookworm | +-a always,exit -F path=/usr/sbin/ausearch -F perm=x -k audittools 2026-07-02 18:26:39.840247 | debian-bookworm | +-a always,exit -F path=/usr/sbin/aureport -F perm=x -k audittools 2026-07-02 18:26:39.840384 | debian-bookworm | +-a always,exit -F path=/usr/sbin/aulast -F perm=x -k audittools 2026-07-02 18:26:39.840521 | debian-bookworm | +-a always,exit -F path=/usr/sbin/aulastlogin -F perm=x -k audittools 2026-07-02 18:26:39.840660 | debian-bookworm | +-a always,exit -F path=/usr/sbin/auvirt -F perm=x -k audittools 2026-07-02 18:26:39.840792 | debian-bookworm | + 2026-07-02 18:26:39.840925 | debian-bookworm | +# Filters --------------------------------------------------------------------- 2026-07-02 18:26:39.841053 | debian-bookworm | + 2026-07-02 18:26:39.841244 | debian-bookworm | +### We put these early because audit is a first match wins system. 2026-07-02 18:26:39.841370 | debian-bookworm | + 2026-07-02 18:26:39.841493 | debian-bookworm | +## Ignore SELinux AVC records 2026-07-02 18:26:39.841692 | debian-bookworm | +-a always,exclude -F msgtype=AVC 2026-07-02 18:26:39.841838 | debian-bookworm | + 2026-07-02 18:26:39.841967 | debian-bookworm | +## Ignore current working directory records 2026-07-02 18:26:39.842091 | debian-bookworm | +-a always,exclude -F msgtype=CWD 2026-07-02 18:26:39.842224 | debian-bookworm | + 2026-07-02 18:26:39.842352 | debian-bookworm | +## Cron jobs fill the logs with stuff we normally don't want (works with SELinux) 2026-07-02 18:26:39.842477 | debian-bookworm | +-a never,user -F subj_type=crond_t 2026-07-02 18:26:39.842600 | debian-bookworm | +-a never,exit -F subj_type=crond_t 2026-07-02 18:26:39.842719 | debian-bookworm | + 2026-07-02 18:26:39.842843 | debian-bookworm | +## This prevents chrony from overwhelming the logs 2026-07-02 18:26:39.842966 | debian-bookworm | +-a never,exit -F arch=b64 -S adjtimex -F auid=-1 -F uid=chrony -F subj_type=chronyd_t 2026-07-02 18:26:39.843082 | debian-bookworm | + 2026-07-02 18:26:39.843217 | debian-bookworm | +## This is not very interesting and wastes a lot of space if the server is public facing 2026-07-02 18:26:39.843345 | debian-bookworm | +-a always,exclude -F msgtype=CRYPTO_KEY_USER 2026-07-02 18:26:39.843463 | debian-bookworm | + 2026-07-02 18:26:39.843584 | debian-bookworm | +## Open VM Tools 2026-07-02 18:26:39.843708 | debian-bookworm | +-a exit,never -F arch=b64 -S all -F exe=/usr/bin/vmtoolsd 2026-07-02 18:26:39.843828 | debian-bookworm | + 2026-07-02 18:26:39.843953 | debian-bookworm | +## High Volume Event Filter (especially on Linux Workstations) 2026-07-02 18:26:39.844075 | debian-bookworm | +-a never,exit -F arch=b64 -F dir=/dev/shm -k sharedmemaccess 2026-07-02 18:26:39.844229 | debian-bookworm | +-a never,exit -F arch=b64 -F dir=/var/lock/lvm -k locklvm 2026-07-02 18:26:39.844354 | debian-bookworm | + 2026-07-02 18:26:39.844477 | debian-bookworm | +## FileBeat 2026-07-02 18:26:39.844608 | debian-bookworm | +-a never,exit -F arch=b64 -F path=/opt/filebeat -k filebeat 2026-07-02 18:26:39.844718 | debian-bookworm | + 2026-07-02 18:26:39.844829 | debian-bookworm | +## More information on how to filter events 2026-07-02 18:26:39.844941 | debian-bookworm | +### https://access.redhat.com/solutions/2482221 2026-07-02 18:26:39.845049 | debian-bookworm | + 2026-07-02 18:26:39.845166 | debian-bookworm | +# Rules ----------------------------------------------------------------------- 2026-07-02 18:26:39.845278 | debian-bookworm | + 2026-07-02 18:26:39.845388 | debian-bookworm | +## Kernel parameters 2026-07-02 18:26:39.845498 | debian-bookworm | +-w /etc/sysctl.conf -p wa -k sysctl 2026-07-02 18:26:39.845641 | debian-bookworm | +-w /etc/sysctl.d -p wa -k sysctl 2026-07-02 18:26:39.845760 | debian-bookworm | + 2026-07-02 18:26:39.845882 | debian-bookworm | +## Kernel module loading and unloading 2026-07-02 18:26:39.846014 | debian-bookworm | +-a always,exit -F perm=x -F auid!=-1 -F path=/sbin/insmod -k modules 2026-07-02 18:26:39.846130 | debian-bookworm | +-a always,exit -F perm=x -F auid!=-1 -F path=/sbin/modprobe -k modules 2026-07-02 18:26:39.846271 | debian-bookworm | +-a always,exit -F perm=x -F auid!=-1 -F path=/sbin/rmmod -k modules 2026-07-02 18:26:39.846388 | debian-bookworm | +-a always,exit -F arch=b64 -S finit_module -S init_module -S delete_module -F auid!=-1 -k modules 2026-07-02 18:26:39.846495 | debian-bookworm | + 2026-07-02 18:26:39.846605 | debian-bookworm | +## Modprobe configuration 2026-07-02 18:26:39.846723 | debian-bookworm | +-w /etc/modprobe.conf -p wa -k modprobe 2026-07-02 18:26:39.846836 | debian-bookworm | +-w /etc/modprobe.d -p wa -k modprobe 2026-07-02 18:26:39.846944 | debian-bookworm | + 2026-07-02 18:26:39.847060 | debian-bookworm | +## KExec usage (all actions) 2026-07-02 18:26:39.847200 | debian-bookworm | +-a always,exit -F arch=b64 -S kexec_load -k KEXEC 2026-07-02 18:26:39.847315 | debian-bookworm | + 2026-07-02 18:26:39.847423 | debian-bookworm | +## Special files 2026-07-02 18:26:39.847541 | debian-bookworm | +-a always,exit -F arch=b64 -S mknod -S mknodat -k specialfiles 2026-07-02 18:26:39.847651 | debian-bookworm | + 2026-07-02 18:26:39.847763 | debian-bookworm | +## Mount operations (only attributable) 2026-07-02 18:26:39.847882 | debian-bookworm | +-a always,exit -F arch=b64 -S mount -S umount2 -F auid!=-1 -k mount 2026-07-02 18:26:39.847992 | debian-bookworm | + 2026-07-02 18:26:39.848124 | debian-bookworm | +### NFS mount 2026-07-02 18:26:39.848269 | debian-bookworm | +-a always,exit -F path=/sbin/mount.nfs -F perm=x -F auid>=500 -F auid!=4294967295 -k T1078_Valid_Accounts 2026-07-02 18:26:39.848398 | debian-bookworm | +-a always,exit -F path=/usr/sbin/mount.nfs -F perm=x -F auid>=500 -F auid!=4294967295 -k T1078_Valid_Accounts 2026-07-02 18:26:39.848508 | debian-bookworm | + 2026-07-02 18:26:39.848620 | debian-bookworm | +## Change swap (only attributable) 2026-07-02 18:26:39.848732 | debian-bookworm | +-a always,exit -F arch=b64 -S swapon -S swapoff -F auid!=-1 -k swap 2026-07-02 18:26:39.848851 | debian-bookworm | + 2026-07-02 18:26:39.848967 | debian-bookworm | +## Time 2026-07-02 18:26:39.849109 | debian-bookworm | +-a always,exit -F arch=b64 -F uid!=ntp -S adjtimex -S settimeofday -S clock_settime -k time 2026-07-02 18:26:39.849271 | debian-bookworm | +### Local time zone 2026-07-02 18:26:39.849408 | debian-bookworm | +-w /etc/localtime -p wa -k localtime 2026-07-02 18:26:39.849522 | debian-bookworm | + 2026-07-02 18:26:39.849678 | debian-bookworm | +## Stunnel 2026-07-02 18:26:39.849804 | debian-bookworm | +-w /usr/sbin/stunnel -p x -k stunnel 2026-07-02 18:26:39.849916 | debian-bookworm | +-w /usr/bin/stunnel -p x -k stunnel 2026-07-02 18:26:39.850024 | debian-bookworm | + 2026-07-02 18:26:39.850134 | debian-bookworm | +## Cron configuration & scheduled jobs 2026-07-02 18:26:39.850281 | debian-bookworm | +-w /etc/cron.allow -p wa -k cron 2026-07-02 18:26:39.850399 | debian-bookworm | +-w /etc/cron.deny -p wa -k cron 2026-07-02 18:26:39.850558 | debian-bookworm | +-w /etc/cron.d/ -p wa -k cron 2026-07-02 18:26:39.850725 | debian-bookworm | +-w /etc/cron.daily/ -p wa -k cron 2026-07-02 18:26:39.850889 | debian-bookworm | +-w /etc/cron.hourly/ -p wa -k cron 2026-07-02 18:26:39.851042 | debian-bookworm | +-w /etc/cron.monthly/ -p wa -k cron 2026-07-02 18:26:39.851227 | debian-bookworm | +-w /etc/cron.weekly/ -p wa -k cron 2026-07-02 18:26:39.851383 | debian-bookworm | +-w /etc/crontab -p wa -k cron 2026-07-02 18:26:39.851535 | debian-bookworm | +-w /var/spool/cron/ -p wa -k cron 2026-07-02 18:26:39.851684 | debian-bookworm | + 2026-07-02 18:26:39.851833 | debian-bookworm | +## User, group, password databases 2026-07-02 18:26:39.851990 | debian-bookworm | +-w /etc/group -p wa -k etcgroup 2026-07-02 18:26:39.852143 | debian-bookworm | +-w /etc/passwd -p wa -k etcpasswd 2026-07-02 18:26:39.852311 | debian-bookworm | +-w /etc/gshadow -k etcgroup 2026-07-02 18:26:39.852461 | debian-bookworm | +-w /etc/shadow -k etcpasswd 2026-07-02 18:26:39.852613 | debian-bookworm | +-w /etc/security/opasswd -k opasswd 2026-07-02 18:26:39.852757 | debian-bookworm | + 2026-07-02 18:26:39.852904 | debian-bookworm | +## Sudoers file changes 2026-07-02 18:26:39.853049 | debian-bookworm | +-w /etc/sudoers -p wa -k actions 2026-07-02 18:26:39.853203 | debian-bookworm | +-w /etc/sudoers.d/ -p wa -k actions 2026-07-02 18:26:39.853314 | debian-bookworm | + 2026-07-02 18:26:39.853423 | debian-bookworm | +## Passwd 2026-07-02 18:26:39.853535 | debian-bookworm | +-w /usr/bin/passwd -p x -k passwd_modification 2026-07-02 18:26:39.853670 | debian-bookworm | + 2026-07-02 18:26:39.853783 | debian-bookworm | +## Tools to change group identifiers 2026-07-02 18:26:39.853893 | debian-bookworm | +-w /usr/sbin/groupadd -p x -k group_modification 2026-07-02 18:26:39.854003 | debian-bookworm | +-w /usr/sbin/groupmod -p x -k group_modification 2026-07-02 18:26:39.854112 | debian-bookworm | +-w /usr/sbin/addgroup -p x -k group_modification 2026-07-02 18:26:39.854233 | debian-bookworm | +-w /usr/sbin/useradd -p x -k user_modification 2026-07-02 18:26:39.854346 | debian-bookworm | +-w /usr/sbin/userdel -p x -k user_modification 2026-07-02 18:26:39.854456 | debian-bookworm | +-w /usr/sbin/usermod -p x -k user_modification 2026-07-02 18:26:39.854565 | debian-bookworm | +-w /usr/sbin/adduser -p x -k user_modification 2026-07-02 18:26:39.854673 | debian-bookworm | + 2026-07-02 18:26:39.854783 | debian-bookworm | +## Login configuration and information 2026-07-02 18:26:39.854892 | debian-bookworm | +-w /etc/login.defs -p wa -k login 2026-07-02 18:26:39.855003 | debian-bookworm | +-w /etc/securetty -p wa -k login 2026-07-02 18:26:39.855115 | debian-bookworm | +-w /var/log/faillog -p wa -k login 2026-07-02 18:26:39.855258 | debian-bookworm | +-w /var/log/lastlog -p wa -k login 2026-07-02 18:26:39.855372 | debian-bookworm | +-w /var/log/tallylog -p wa -k login 2026-07-02 18:26:39.855484 | debian-bookworm | + 2026-07-02 18:26:39.855596 | debian-bookworm | +## Network Environment 2026-07-02 18:26:39.855705 | debian-bookworm | +### Changes to hostname 2026-07-02 18:26:39.855819 | debian-bookworm | +-a always,exit -F arch=b64 -S sethostname -S setdomainname -k network_modifications 2026-07-02 18:26:39.855925 | debian-bookworm | + 2026-07-02 18:26:39.856034 | debian-bookworm | +### Detect Remote Shell Use 2026-07-02 18:26:39.856148 | debian-bookworm | +-a always,exit -F arch=b64 -F exe=/bin/bash -F success=1 -S connect -k "remote_shell" 2026-07-02 18:26:39.856273 | debian-bookworm | +-a always,exit -F arch=b64 -F exe=/usr/bin/bash -F success=1 -S connect -k "remote_shell" 2026-07-02 18:26:39.856382 | debian-bookworm | + 2026-07-02 18:26:39.856494 | debian-bookworm | +### Successful IPv4 Connections 2026-07-02 18:26:39.856608 | debian-bookworm | +-a always,exit -F arch=b64 -S connect -F a2=16 -F success=1 -F key=network_connect_4 2026-07-02 18:26:39.856716 | debian-bookworm | + 2026-07-02 18:26:39.856828 | debian-bookworm | +### Successful IPv6 Connections 2026-07-02 18:26:39.856941 | debian-bookworm | +-a always,exit -F arch=b64 -S connect -F a2=28 -F success=1 -F key=network_connect_6 2026-07-02 18:26:39.857047 | debian-bookworm | + 2026-07-02 18:26:39.857217 | debian-bookworm | +### Changes to other files 2026-07-02 18:26:39.857362 | debian-bookworm | +-w /etc/hosts -p wa -k network_modifications 2026-07-02 18:26:39.857478 | debian-bookworm | +-w /etc/sysconfig/network -p wa -k network_modifications 2026-07-02 18:26:39.857621 | debian-bookworm | +-w /etc/sysconfig/network-scripts -p w -k network_modifications 2026-07-02 18:26:39.857736 | debian-bookworm | +-w /etc/network/ -p wa -k network 2026-07-02 18:26:39.857853 | debian-bookworm | +-a always,exit -F dir=/etc/NetworkManager/ -F perm=wa -k network_modifications 2026-07-02 18:26:39.857962 | debian-bookworm | + 2026-07-02 18:26:39.858072 | debian-bookworm | +### Changes to issue 2026-07-02 18:26:39.858199 | debian-bookworm | +-w /etc/issue -p wa -k etcissue 2026-07-02 18:26:39.858315 | debian-bookworm | +-w /etc/issue.net -p wa -k etcissue 2026-07-02 18:26:39.858427 | debian-bookworm | + 2026-07-02 18:26:39.858538 | debian-bookworm | +## System startup scripts 2026-07-02 18:26:39.858649 | debian-bookworm | +-w /etc/inittab -p wa -k init 2026-07-02 18:26:39.858762 | debian-bookworm | +-w /etc/init.d/ -p wa -k init 2026-07-02 18:26:39.858871 | debian-bookworm | +-w /etc/init/ -p wa -k init 2026-07-02 18:26:39.858978 | debian-bookworm | + 2026-07-02 18:26:39.859087 | debian-bookworm | +## Library search paths 2026-07-02 18:26:39.859210 | debian-bookworm | +-w /etc/ld.so.conf -p wa -k libpath 2026-07-02 18:26:39.859321 | debian-bookworm | +-w /etc/ld.so.conf.d -p wa -k libpath 2026-07-02 18:26:39.859427 | debian-bookworm | + 2026-07-02 18:26:39.859539 | debian-bookworm | +## Systemwide library preloads (LD_PRELOAD) 2026-07-02 18:26:39.859649 | debian-bookworm | +-w /etc/ld.so.preload -p wa -k systemwide_preloads 2026-07-02 18:26:39.859757 | debian-bookworm | + 2026-07-02 18:26:39.859866 | debian-bookworm | +## Pam configuration 2026-07-02 18:26:39.859975 | debian-bookworm | +-w /etc/pam.d/ -p wa -k pam 2026-07-02 18:26:39.860096 | debian-bookworm | +-w /etc/security/limits.conf -p wa -k pam 2026-07-02 18:26:39.860240 | debian-bookworm | +-w /etc/security/limits.d -p wa -k pam 2026-07-02 18:26:39.860353 | debian-bookworm | +-w /etc/security/pam_env.conf -p wa -k pam 2026-07-02 18:26:39.860462 | debian-bookworm | +-w /etc/security/namespace.conf -p wa -k pam 2026-07-02 18:26:39.860571 | debian-bookworm | +-w /etc/security/namespace.d -p wa -k pam 2026-07-02 18:26:39.860678 | debian-bookworm | +-w /etc/security/namespace.init -p wa -k pam 2026-07-02 18:26:39.860785 | debian-bookworm | + 2026-07-02 18:26:39.860894 | debian-bookworm | +## Mail configuration 2026-07-02 18:26:39.861002 | debian-bookworm | +-w /etc/aliases -p wa -k mail 2026-07-02 18:26:39.861112 | debian-bookworm | +-w /etc/postfix/ -p wa -k mail 2026-07-02 18:26:39.861236 | debian-bookworm | +-w /etc/exim4/ -p wa -k mail 2026-07-02 18:26:39.861345 | debian-bookworm | + 2026-07-02 18:26:39.861453 | debian-bookworm | +## SSH configuration 2026-07-02 18:26:39.861563 | debian-bookworm | +-w /etc/ssh/sshd_config -k sshd 2026-07-02 18:26:39.861692 | debian-bookworm | +-w /etc/ssh/sshd_config.d -k sshd 2026-07-02 18:26:39.861801 | debian-bookworm | + 2026-07-02 18:26:39.861911 | debian-bookworm | +## root ssh key tampering 2026-07-02 18:26:39.862022 | debian-bookworm | +-w /root/.ssh -p wa -k rootkey 2026-07-02 18:26:39.862130 | debian-bookworm | + 2026-07-02 18:26:39.862250 | debian-bookworm | +# Systemd 2026-07-02 18:26:39.862361 | debian-bookworm | +-w /bin/systemctl -p x -k systemd 2026-07-02 18:26:39.862470 | debian-bookworm | +-w /etc/systemd/ -p wa -k systemd 2026-07-02 18:26:39.862581 | debian-bookworm | +-w /usr/lib/systemd -p wa -k systemd 2026-07-02 18:26:39.862688 | debian-bookworm | + 2026-07-02 18:26:39.862799 | debian-bookworm | +## https://systemd.network/systemd.generator.html 2026-07-02 18:26:39.862910 | debian-bookworm | +-w /etc/systemd/system-generators/ -p wa -k systemd_generator 2026-07-02 18:26:39.863022 | debian-bookworm | +-w /usr/local/lib/systemd/system-generators/ -p wa -k systemd_generator 2026-07-02 18:26:39.863133 | debian-bookworm | +-w /usr/lib/systemd/system-generators -p wa -k systemd_generator 2026-07-02 18:26:39.863274 | debian-bookworm | + 2026-07-02 18:26:39.863390 | debian-bookworm | +-w /etc/systemd/user-generators/ -p wa -k systemd_generator 2026-07-02 18:26:39.863506 | debian-bookworm | +-w /usr/local/lib/systemd/user-generators/ -p wa -k systemd_generator 2026-07-02 18:26:39.863618 | debian-bookworm | +-w /lib/systemd/system-generators/ -p wa -k systemd_generator 2026-07-02 18:26:39.863727 | debian-bookworm | + 2026-07-02 18:26:39.863857 | debian-bookworm | +## SELinux events that modify the system's Mandatory Access Controls (MAC) 2026-07-02 18:26:39.863975 | debian-bookworm | +-w /etc/selinux/ -p wa -k mac_policy 2026-07-02 18:26:39.864083 | debian-bookworm | + 2026-07-02 18:26:39.864206 | debian-bookworm | +## Critical elements access failures 2026-07-02 18:26:39.864323 | debian-bookworm | +-a always,exit -F arch=b64 -S open -F dir=/etc -F success=0 -k unauthedfileaccess 2026-07-02 18:26:39.864436 | debian-bookworm | +-a always,exit -F arch=b64 -S open -F dir=/bin -F success=0 -k unauthedfileaccess 2026-07-02 18:26:39.864548 | debian-bookworm | +-a always,exit -F arch=b64 -S open -F dir=/sbin -F success=0 -k unauthedfileaccess 2026-07-02 18:26:39.864672 | debian-bookworm | +-a always,exit -F arch=b64 -S open -F dir=/usr/bin -F success=0 -k unauthedfileaccess 2026-07-02 18:26:39.864787 | debian-bookworm | +-a always,exit -F arch=b64 -S open -F dir=/usr/sbin -F success=0 -k unauthedfileaccess 2026-07-02 18:26:39.864898 | debian-bookworm | +-a always,exit -F arch=b64 -S open -F dir=/var -F success=0 -k unauthedfileaccess 2026-07-02 18:26:39.865008 | debian-bookworm | +-a always,exit -F arch=b64 -S open -F dir=/home -F success=0 -k unauthedfileaccess 2026-07-02 18:26:39.865122 | debian-bookworm | +-a always,exit -F arch=b64 -S open -F dir=/srv -F success=0 -k unauthedfileaccess 2026-07-02 18:26:39.865242 | debian-bookworm | + 2026-07-02 18:26:39.865356 | debian-bookworm | +## Process ID change (switching accounts) applications 2026-07-02 18:26:39.865466 | debian-bookworm | +-w /bin/su -p x -k priv_esc 2026-07-02 18:26:39.865575 | debian-bookworm | +-w /usr/bin/sudo -p x -k priv_esc 2026-07-02 18:26:39.865710 | debian-bookworm | + 2026-07-02 18:26:39.865822 | debian-bookworm | +## Power state 2026-07-02 18:26:39.865935 | debian-bookworm | +-w /sbin/shutdown -p x -k power 2026-07-02 18:26:39.866045 | debian-bookworm | +-w /sbin/poweroff -p x -k power 2026-07-02 18:26:39.866155 | debian-bookworm | +-w /sbin/reboot -p x -k power 2026-07-02 18:26:39.866292 | debian-bookworm | +-w /sbin/halt -p x -k power 2026-07-02 18:26:39.866397 | debian-bookworm | + 2026-07-02 18:26:39.866505 | debian-bookworm | +## Session initiation information 2026-07-02 18:26:39.866613 | debian-bookworm | +-w /var/run/utmp -p wa -k session 2026-07-02 18:26:39.866721 | debian-bookworm | +-w /var/log/btmp -p wa -k session 2026-07-02 18:26:39.866831 | debian-bookworm | +-w /var/log/wtmp -p wa -k session 2026-07-02 18:26:39.866937 | debian-bookworm | + 2026-07-02 18:26:39.867048 | debian-bookworm | +## Discretionary Access Control (DAC) modifications 2026-07-02 18:26:39.867168 | debian-bookworm | +-a always,exit -F arch=b64 -S chmod -F auid>=1000 -F auid!=-1 -k perm_mod 2026-07-02 18:26:39.867281 | debian-bookworm | +-a always,exit -F arch=b64 -S chown -F auid>=1000 -F auid!=-1 -k perm_mod 2026-07-02 18:26:39.867392 | debian-bookworm | +-a always,exit -F arch=b64 -S fchmod -F auid>=1000 -F auid!=-1 -k perm_mod 2026-07-02 18:26:39.867503 | debian-bookworm | +-a always,exit -F arch=b64 -S fchmodat -F auid>=1000 -F auid!=-1 -k perm_mod 2026-07-02 18:26:39.867619 | debian-bookworm | +-a always,exit -F arch=b64 -S fchown -F auid>=1000 -F auid!=-1 -k perm_mod 2026-07-02 18:26:39.867730 | debian-bookworm | +-a always,exit -F arch=b64 -S fchownat -F auid>=1000 -F auid!=-1 -k perm_mod 2026-07-02 18:26:39.867840 | debian-bookworm | +-a always,exit -F arch=b64 -S fremovexattr -F auid>=1000 -F auid!=-1 -k perm_mod 2026-07-02 18:26:39.867953 | debian-bookworm | +-a always,exit -F arch=b64 -S fsetxattr -F auid>=1000 -F auid!=-1 -k perm_mod 2026-07-02 18:26:39.868064 | debian-bookworm | +-a always,exit -F arch=b64 -S lchown -F auid>=1000 -F auid!=-1 -k perm_mod 2026-07-02 18:26:39.868187 | debian-bookworm | +-a always,exit -F arch=b64 -S lremovexattr -F auid>=1000 -F auid!=-1 -k perm_mod 2026-07-02 18:26:39.868322 | debian-bookworm | +-a always,exit -F arch=b64 -S lsetxattr -F auid>=1000 -F auid!=-1 -k perm_mod 2026-07-02 18:26:39.868488 | debian-bookworm | +-a always,exit -F arch=b64 -S removexattr -F auid>=1000 -F auid!=-1 -k perm_mod 2026-07-02 18:26:39.868633 | debian-bookworm | +-a always,exit -F arch=b64 -S setxattr -F auid>=1000 -F auid!=-1 -k perm_mod 2026-07-02 18:26:39.868744 | debian-bookworm | + 2026-07-02 18:26:39.868862 | debian-bookworm | +# Special Rules --------------------------------------------------------------- 2026-07-02 18:26:39.868970 | debian-bookworm | + 2026-07-02 18:26:39.869078 | debian-bookworm | +## Reconnaissance 2026-07-02 18:26:39.869209 | debian-bookworm | +-w /usr/bin/whoami -p x -k recon 2026-07-02 18:26:39.869324 | debian-bookworm | +-w /usr/bin/id -p x -k recon 2026-07-02 18:26:39.869433 | debian-bookworm | +-w /bin/hostname -p x -k recon 2026-07-02 18:26:39.869543 | debian-bookworm | +-w /bin/uname -p x -k recon 2026-07-02 18:26:39.869710 | debian-bookworm | +-w /etc/issue -p r -k recon 2026-07-02 18:26:39.869829 | debian-bookworm | +-w /etc/hostname -p r -k recon 2026-07-02 18:26:39.869939 | debian-bookworm | + 2026-07-02 18:26:39.870049 | debian-bookworm | +## Suspicious activity 2026-07-02 18:26:39.870192 | debian-bookworm | +-w /usr/bin/wget -p x -k susp_activity 2026-07-02 18:26:39.870309 | debian-bookworm | +-w /usr/bin/curl -p x -k susp_activity 2026-07-02 18:26:39.870419 | debian-bookworm | +-w /usr/bin/base64 -p x -k susp_activity 2026-07-02 18:26:39.870529 | debian-bookworm | +-w /bin/nc -p x -k susp_activity 2026-07-02 18:26:39.870637 | debian-bookworm | +-w /bin/netcat -p x -k susp_activity 2026-07-02 18:26:39.870748 | debian-bookworm | +-w /usr/bin/ncat -p x -k susp_activity 2026-07-02 18:26:39.870855 | debian-bookworm | +-w /usr/bin/ss -p x -k susp_activity 2026-07-02 18:26:39.870974 | debian-bookworm | +-w /usr/bin/netstat -p x -k susp_activity 2026-07-02 18:26:39.871147 | debian-bookworm | +-w /usr/bin/ssh -p x -k susp_activity 2026-07-02 18:26:39.871274 | debian-bookworm | +-w /usr/bin/scp -p x -k susp_activity 2026-07-02 18:26:39.871385 | debian-bookworm | +-w /usr/bin/sftp -p x -k susp_activity 2026-07-02 18:26:39.871497 | debian-bookworm | +-w /usr/bin/ftp -p x -k susp_activity 2026-07-02 18:26:39.871606 | debian-bookworm | +-w /usr/bin/socat -p x -k susp_activity 2026-07-02 18:26:39.871715 | debian-bookworm | +-w /usr/bin/wireshark -p x -k susp_activity 2026-07-02 18:26:39.871826 | debian-bookworm | +-w /usr/bin/tshark -p x -k susp_activity 2026-07-02 18:26:39.871935 | debian-bookworm | +-w /usr/bin/rawshark -p x -k susp_activity 2026-07-02 18:26:39.872043 | debian-bookworm | +-w /usr/bin/rdesktop -p x -k susp_activity 2026-07-02 18:26:39.872154 | debian-bookworm | +-w /usr/local/bin/rdesktop -p x -k susp_activity 2026-07-02 18:26:39.872276 | debian-bookworm | +-w /usr/bin/wlfreerdp -p x -k susp_activity 2026-07-02 18:26:39.872384 | debian-bookworm | +-w /usr/bin/xfreerdp -p x -k susp_activity 2026-07-02 18:26:39.872494 | debian-bookworm | +-w /usr/local/bin/xfreerdp -p x -k susp_activity 2026-07-02 18:26:39.872605 | debian-bookworm | +-w /usr/bin/nmap -p x -k susp_activity 2026-07-02 18:26:39.872710 | debian-bookworm | + 2026-07-02 18:26:39.872819 | debian-bookworm | +## sssd 2026-07-02 18:26:39.872934 | debian-bookworm | +-a always,exit -F path=/usr/libexec/sssd/p11_child -F perm=x -F auid>=500 -F auid!=4294967295 -k T1078_Valid_Accounts 2026-07-02 18:26:39.873047 | debian-bookworm | +-a always,exit -F path=/usr/libexec/sssd/krb5_child -F perm=x -F auid>=500 -F auid!=4294967295 -k T1078_Valid_Accounts 2026-07-02 18:26:39.873180 | debian-bookworm | +-a always,exit -F path=/usr/libexec/sssd/ldap_child -F perm=x -F auid>=500 -F auid!=4294967295 -k T1078_Valid_Accounts 2026-07-02 18:26:39.873299 | debian-bookworm | +-a always,exit -F path=/usr/libexec/sssd/selinux_child -F perm=x -F auid>=500 -F auid!=4294967295 -k T1078_Valid_Accounts 2026-07-02 18:26:39.873413 | debian-bookworm | +-a always,exit -F path=/usr/libexec/sssd/proxy_child -F perm=x -F auid>=500 -F auid!=4294967295 -k T1078_Valid_Accounts 2026-07-02 18:26:39.873523 | debian-bookworm | + 2026-07-02 18:26:39.873680 | debian-bookworm | +## T1002 Data Compressed 2026-07-02 18:26:39.873794 | debian-bookworm | + 2026-07-02 18:26:39.873909 | debian-bookworm | +-w /usr/bin/zip -p x -k Data_Compressed 2026-07-02 18:26:39.874026 | debian-bookworm | +-w /usr/bin/gzip -p x -k Data_Compressed 2026-07-02 18:26:39.874136 | debian-bookworm | +-w /usr/bin/tar -p x -k Data_Compressed 2026-07-02 18:26:39.874261 | debian-bookworm | +-w /usr/bin/bzip2 -p x -k Data_Compressed 2026-07-02 18:26:39.874370 | debian-bookworm | + 2026-07-02 18:26:39.874480 | debian-bookworm | +-w /usr/bin/lzip -p x -k Data_Compressed 2026-07-02 18:26:39.874590 | debian-bookworm | +-w /usr/local/bin/lzip -p x -k Data_Compressed 2026-07-02 18:26:39.874697 | debian-bookworm | + 2026-07-02 18:26:39.874807 | debian-bookworm | +-w /usr/bin/lz4 -p x -k Data_Compressed 2026-07-02 18:26:39.874916 | debian-bookworm | +-w /usr/local/bin/lz4 -p x -k Data_Compressed 2026-07-02 18:26:39.875022 | debian-bookworm | + 2026-07-02 18:26:39.875131 | debian-bookworm | +-w /usr/bin/lzop -p x -k Data_Compressed 2026-07-02 18:26:39.875252 | debian-bookworm | +-w /usr/local/bin/lzop -p x -k Data_Compressed 2026-07-02 18:26:39.875360 | debian-bookworm | + 2026-07-02 18:26:39.875470 | debian-bookworm | +-w /usr/bin/plzip -p x -k Data_Compressed 2026-07-02 18:26:39.875581 | debian-bookworm | +-w /usr/local/bin/plzip -p x -k Data_Compressed 2026-07-02 18:26:39.875686 | debian-bookworm | + 2026-07-02 18:26:39.875793 | debian-bookworm | +-w /usr/bin/pbzip2 -p x -k Data_Compressed 2026-07-02 18:26:39.875901 | debian-bookworm | +-w /usr/local/bin/pbzip2 -p x -k Data_Compressed 2026-07-02 18:26:39.876006 | debian-bookworm | + 2026-07-02 18:26:39.876115 | debian-bookworm | +-w /usr/bin/lbzip2 -p x -k Data_Compressed 2026-07-02 18:26:39.876233 | debian-bookworm | +-w /usr/local/bin/lbzip2 -p x -k Data_Compressed 2026-07-02 18:26:39.876341 | debian-bookworm | + 2026-07-02 18:26:39.876449 | debian-bookworm | +-w /usr/bin/pixz -p x -k Data_Compressed 2026-07-02 18:26:39.876561 | debian-bookworm | +-w /usr/local/bin/pixz -p x -k Data_Compressed 2026-07-02 18:26:39.876667 | debian-bookworm | + 2026-07-02 18:26:39.876794 | debian-bookworm | +-w /usr/bin/pigz -p x -k Data_Compressed 2026-07-02 18:26:39.876907 | debian-bookworm | +-w /usr/local/bin/pigz -p x -k Data_Compressed 2026-07-02 18:26:39.877017 | debian-bookworm | +-w /usr/bin/unpigz -p x -k Data_Compressed 2026-07-02 18:26:39.877125 | debian-bookworm | +-w /usr/local/bin/unpigz -p x -k Data_Compressed 2026-07-02 18:26:39.877259 | debian-bookworm | + 2026-07-02 18:26:39.877371 | debian-bookworm | +-w /usr/bin/zstd -p x -k Data_Compressed 2026-07-02 18:26:39.877481 | debian-bookworm | +-w /usr/local/bin/zstd -p x -k Data_Compressed 2026-07-02 18:26:39.877619 | debian-bookworm | + 2026-07-02 18:26:39.877734 | debian-bookworm | +## Added to catch netcat on Ubuntu 2026-07-02 18:26:39.877847 | debian-bookworm | +-w /bin/nc.openbsd -p x -k susp_activity 2026-07-02 18:26:39.877962 | debian-bookworm | +-w /bin/nc.traditional -p x -k susp_activity 2026-07-02 18:26:39.878069 | debian-bookworm | + 2026-07-02 18:26:39.878191 | debian-bookworm | +## Sbin suspicious activity 2026-07-02 18:26:39.878302 | debian-bookworm | +-w /sbin/iptables -p x -k sbin_susp 2026-07-02 18:26:39.878410 | debian-bookworm | +-w /sbin/ip6tables -p x -k sbin_susp 2026-07-02 18:26:39.878517 | debian-bookworm | +-w /sbin/ifconfig -p x -k sbin_susp 2026-07-02 18:26:39.878625 | debian-bookworm | +-w /usr/sbin/arptables -p x -k sbin_susp 2026-07-02 18:26:39.878735 | debian-bookworm | +-w /usr/sbin/ebtables -p x -k sbin_susp 2026-07-02 18:26:39.878846 | debian-bookworm | +-w /sbin/xtables-nft-multi -p x -k sbin_susp 2026-07-02 18:26:39.878956 | debian-bookworm | +-w /usr/sbin/nft -p x -k sbin_susp 2026-07-02 18:26:39.879067 | debian-bookworm | +-w /usr/sbin/tcpdump -p x -k sbin_susp 2026-07-02 18:26:39.879188 | debian-bookworm | +-w /usr/sbin/traceroute -p x -k sbin_susp 2026-07-02 18:26:39.879298 | debian-bookworm | +-w /usr/sbin/ufw -p x -k sbin_susp 2026-07-02 18:26:39.879404 | debian-bookworm | + 2026-07-02 18:26:39.879512 | debian-bookworm | +### kde4 2026-07-02 18:26:39.879625 | debian-bookworm | +-a always,exit -F path=/usr/libexec/kde4/kpac_dhcp_helper -F perm=x -F auid>=1000 -F auid!=4294967295 -k T1078_Valid_Accounts 2026-07-02 18:26:39.879747 | debian-bookworm | +-a always,exit -F path=/usr/libexec/kde4/kdesud -F perm=x -F auid>=1000 -F auid!=4294967295 -k T1078_Valid_Accounts 2026-07-02 18:26:39.879860 | debian-bookworm | + 2026-07-02 18:26:39.879973 | debian-bookworm | +## dbus-send invocation 2026-07-02 18:26:39.880103 | debian-bookworm | +### may indicate privilege escalation CVE-2021-3560 2026-07-02 18:26:39.880231 | debian-bookworm | +-w /usr/bin/dbus-send -p x -k dbus_send 2026-07-02 18:26:39.880361 | debian-bookworm | +-w /usr/bin/gdbus -p x -k gdubs_call 2026-07-02 18:26:39.880477 | debian-bookworm | + 2026-07-02 18:26:39.880590 | debian-bookworm | +## pkexec invocation 2026-07-02 18:26:39.880709 | debian-bookworm | +### may indicate privilege escalation CVE-2021-4034 2026-07-02 18:26:39.880937 | debian-bookworm | +-w /usr/bin/pkexec -p x -k pkexec 2026-07-02 18:26:39.881067 | debian-bookworm | + 2026-07-02 18:26:39.881213 | debian-bookworm | +## Suspicious shells 2026-07-02 18:26:39.881335 | debian-bookworm | +-w /bin/ash -p x -k susp_shell 2026-07-02 18:26:39.881452 | debian-bookworm | +-w /bin/csh -p x -k susp_shell 2026-07-02 18:26:39.881569 | debian-bookworm | +-w /bin/fish -p x -k susp_shell 2026-07-02 18:26:39.881729 | debian-bookworm | +-w /bin/tcsh -p x -k susp_shell 2026-07-02 18:26:39.881887 | debian-bookworm | +-w /bin/tclsh -p x -k susp_shell 2026-07-02 18:26:39.882014 | debian-bookworm | +-w /bin/xonsh -p x -k susp_shell 2026-07-02 18:26:39.882147 | debian-bookworm | +-w /usr/local/bin/xonsh -p x -k susp_shell 2026-07-02 18:26:39.882329 | debian-bookworm | +-w /bin/open -p x -k susp_shell 2026-07-02 18:26:39.882505 | debian-bookworm | +-w /bin/rbash -p x -k susp_shell 2026-07-02 18:26:39.882671 | debian-bookworm | + 2026-07-02 18:26:39.882835 | debian-bookworm | +# Web Server Actvity 2026-07-02 18:26:39.882993 | debian-bookworm | +## Change the number "33" to the ID of your WebServer user. Default: www-data:x:33:33 2026-07-02 18:26:39.883181 | debian-bookworm | +-a always,exit -F arch=b64 -S execve -F euid=33 -k detect_execve_www 2026-07-02 18:26:39.883329 | debian-bookworm | + 2026-07-02 18:26:39.883483 | debian-bookworm | +### https://clustershell.readthedocs.io/ 2026-07-02 18:26:39.883645 | debian-bookworm | +-w /bin/clush -p x -k susp_shell 2026-07-02 18:26:39.883796 | debian-bookworm | +-w /usr/local/bin/clush -p x -k susp_shell 2026-07-02 18:26:39.883951 | debian-bookworm | +-w /etc/clustershell/clush.conf -p x -k susp_shell 2026-07-02 18:26:39.884097 | debian-bookworm | + 2026-07-02 18:26:39.884305 | debian-bookworm | +### https://github.com/tmux/tmux 2026-07-02 18:26:39.884471 | debian-bookworm | +-w /bin/tmux -p x -k susp_shell 2026-07-02 18:26:39.884632 | debian-bookworm | +-w /usr/local/bin/tmux -p x -k susp_shell 2026-07-02 18:26:39.884788 | debian-bookworm | + 2026-07-02 18:26:39.884922 | debian-bookworm | +## Shell/profile configurations 2026-07-02 18:26:39.885036 | debian-bookworm | +-w /etc/profile.d/ -p wa -k shell_profiles 2026-07-02 18:26:39.885146 | debian-bookworm | +-w /etc/profile -p wa -k shell_profiles 2026-07-02 18:26:39.885274 | debian-bookworm | +-w /etc/shells -p wa -k shell_profiles 2026-07-02 18:26:39.885384 | debian-bookworm | +-w /etc/bashrc -p wa -k shell_profiles 2026-07-02 18:26:39.885492 | debian-bookworm | +-w /etc/csh.cshrc -p wa -k shell_profiles 2026-07-02 18:26:39.885623 | debian-bookworm | +-w /etc/csh.login -p wa -k shell_profiles 2026-07-02 18:26:39.885738 | debian-bookworm | +-w /etc/fish/ -p wa -k shell_profiles 2026-07-02 18:26:39.885861 | debian-bookworm | +-w /etc/zsh/ -p wa -k shell_profiles 2026-07-02 18:26:39.885980 | debian-bookworm | + 2026-07-02 18:26:39.886091 | debian-bookworm | +### https://github.com/xxh/xxh 2026-07-02 18:26:39.886231 | debian-bookworm | +-w /usr/local/bin/xxh.bash -p x -k susp_shell 2026-07-02 18:26:39.886345 | debian-bookworm | +-w /usr/local/bin/xxh.xsh -p x -k susp_shell 2026-07-02 18:26:39.886455 | debian-bookworm | +-w /usr/local/bin/xxh.zsh -p x -k susp_shell 2026-07-02 18:26:39.886563 | debian-bookworm | + 2026-07-02 18:26:39.886674 | debian-bookworm | +## Injection 2026-07-02 18:26:39.886785 | debian-bookworm | +### These rules watch for code injection by the ptrace facility. 2026-07-02 18:26:39.886895 | debian-bookworm | +### This could indicate someone trying to do something bad or just debugging 2026-07-02 18:26:39.887007 | debian-bookworm | +-a always,exit -F arch=b64 -S ptrace -F a0=0x4 -k code_injection 2026-07-02 18:26:39.887119 | debian-bookworm | +-a always,exit -F arch=b64 -S ptrace -F a0=0x5 -k data_injection 2026-07-02 18:26:39.887248 | debian-bookworm | +-a always,exit -F arch=b64 -S ptrace -F a0=0x6 -k register_injection 2026-07-02 18:26:39.887361 | debian-bookworm | +-a always,exit -F arch=b64 -S ptrace -k tracing 2026-07-02 18:26:39.887467 | debian-bookworm | + 2026-07-02 18:26:39.887576 | debian-bookworm | +## Anonymous File Creation 2026-07-02 18:26:39.887686 | debian-bookworm | +### These rules watch the use of memfd_create 2026-07-02 18:26:39.887797 | debian-bookworm | +### "memfd_create" creates anonymous file and returns a file descriptor to access it 2026-07-02 18:26:39.887915 | debian-bookworm | +### When combined with "fexecve" can be used to stealthily run binaries in memory without touching disk 2026-07-02 18:26:39.888029 | debian-bookworm | +-a always,exit -F arch=b64 -S memfd_create -F key=anon_file_create 2026-07-02 18:26:39.888136 | debian-bookworm | + 2026-07-02 18:26:39.888272 | debian-bookworm | +## Privilege Abuse 2026-07-02 18:26:39.888388 | debian-bookworm | +### The purpose of this rule is to detect when an admin may be abusing power by looking in user's home dir. 2026-07-02 18:26:39.888503 | debian-bookworm | +-a always,exit -F dir=/home -F uid=0 -F auid>=1000 -F auid!=-1 -C auid!=obj_uid -k power_abuse 2026-07-02 18:26:39.888610 | debian-bookworm | + 2026-07-02 18:26:39.888718 | debian-bookworm | +# Socket Creations 2026-07-02 18:26:39.888829 | debian-bookworm | +# will catch both IPv4 and IPv6 2026-07-02 18:26:39.888935 | debian-bookworm | + 2026-07-02 18:26:39.889047 | debian-bookworm | +-a always,exit -F arch=b32 -S socket -F a0=2 -k network_socket_created 2026-07-02 18:26:39.889171 | debian-bookworm | +-a always,exit -F arch=b64 -S socket -F a0=2 -k network_socket_created 2026-07-02 18:26:39.889280 | debian-bookworm | + 2026-07-02 18:26:39.889391 | debian-bookworm | +-a always,exit -F arch=b32 -S socket -F a0=10 -k network_socket_created 2026-07-02 18:26:39.889501 | debian-bookworm | +-a always,exit -F arch=b64 -S socket -F a0=10 -k network_socket_created 2026-07-02 18:26:39.889635 | debian-bookworm | + 2026-07-02 18:26:39.889764 | debian-bookworm | +# Software Management --------------------------------------------------------- 2026-07-02 18:26:39.889871 | debian-bookworm | + 2026-07-02 18:26:39.889981 | debian-bookworm | +# RPM (Redhat/CentOS) 2026-07-02 18:26:39.890094 | debian-bookworm | +-w /usr/bin/rpm -p x -k software_mgmt 2026-07-02 18:26:39.890216 | debian-bookworm | +-w /usr/bin/yum -p x -k software_mgmt 2026-07-02 18:26:39.890325 | debian-bookworm | + 2026-07-02 18:26:39.890441 | debian-bookworm | +# DNF (Fedora/RedHat 8/CentOS 8) 2026-07-02 18:26:39.890551 | debian-bookworm | +-w /usr/bin/dnf -p x -k software_mgmt 2026-07-02 18:26:39.890658 | debian-bookworm | + 2026-07-02 18:26:39.890765 | debian-bookworm | +# YAST/Zypper/RPM (SuSE) 2026-07-02 18:26:39.890875 | debian-bookworm | +-w /sbin/yast -p x -k software_mgmt 2026-07-02 18:26:39.890985 | debian-bookworm | +-w /sbin/yast2 -p x -k software_mgmt 2026-07-02 18:26:39.891094 | debian-bookworm | +-w /bin/rpm -p x -k software_mgmt 2026-07-02 18:26:39.891214 | debian-bookworm | +-w /usr/bin/zypper -k software_mgmt 2026-07-02 18:26:39.891320 | debian-bookworm | + 2026-07-02 18:26:39.891429 | debian-bookworm | +# DPKG / APT-GET (Debian/Ubuntu) 2026-07-02 18:26:39.891538 | debian-bookworm | +-w /usr/bin/dpkg -p x -k software_mgmt 2026-07-02 18:26:39.891646 | debian-bookworm | +-w /usr/bin/apt -p x -k software_mgmt 2026-07-02 18:26:39.891759 | debian-bookworm | +-w /usr/bin/apt-add-repository -p x -k software_mgmt 2026-07-02 18:26:39.891866 | debian-bookworm | +-w /usr/bin/apt-get -p x -k software_mgmt 2026-07-02 18:26:39.891974 | debian-bookworm | +-w /usr/bin/aptitude -p x -k software_mgmt 2026-07-02 18:26:39.892084 | debian-bookworm | +-w /usr/bin/wajig -p x -k software_mgmt 2026-07-02 18:26:39.892218 | debian-bookworm | +-w /usr/bin/snap -p x -k software_mgmt 2026-07-02 18:26:39.892328 | debian-bookworm | + 2026-07-02 18:26:39.892440 | debian-bookworm | +# PIP(3) (Python installs) 2026-07-02 18:26:39.892551 | debian-bookworm | +-w /usr/bin/pip -p x -k third_party_software_mgmt 2026-07-02 18:26:39.892663 | debian-bookworm | +-w /usr/local/bin/pip -p x -k third_party_software_mgmt 2026-07-02 18:26:39.892784 | debian-bookworm | +-w /usr/bin/pip3 -p x -k third_party_software_mgmt 2026-07-02 18:26:39.892913 | debian-bookworm | +-w /usr/local/bin/pip3 -p x -k third_party_software_mgmt 2026-07-02 18:26:39.893029 | debian-bookworm | +-w /usr/bin/pipx -p x -k third_party_software_mgmt 2026-07-02 18:26:39.893140 | debian-bookworm | +-w /usr/local/bin/pipx -p x -k third_party_software_mgmt 2026-07-02 18:26:39.893262 | debian-bookworm | + 2026-07-02 18:26:39.893371 | debian-bookworm | +# npm 2026-07-02 18:26:39.893484 | debian-bookworm | +## T1072 third party software 2026-07-02 18:26:39.893609 | debian-bookworm | +## https://www.npmjs.com 2026-07-02 18:26:39.893739 | debian-bookworm | +## https://docs.npmjs.com/cli/v6/commands/npm-audit 2026-07-02 18:26:39.893853 | debian-bookworm | +-w /usr/bin/npm -p x -k third_party_software_mgmt 2026-07-02 18:26:39.893961 | debian-bookworm | + 2026-07-02 18:26:39.894072 | debian-bookworm | +# Comprehensive Perl Archive Network (CPAN) (CPAN installs) 2026-07-02 18:26:39.894207 | debian-bookworm | +## T1072 third party software 2026-07-02 18:26:39.894323 | debian-bookworm | +## https://www.cpan.org 2026-07-02 18:26:39.894438 | debian-bookworm | +-w /usr/bin/cpan -p x -k third_party_software_mgmt 2026-07-02 18:26:39.894548 | debian-bookworm | + 2026-07-02 18:26:39.894660 | debian-bookworm | +# Ruby (RubyGems installs) 2026-07-02 18:26:39.894774 | debian-bookworm | +## T1072 third party software 2026-07-02 18:26:39.894888 | debian-bookworm | +## https://rubygems.org 2026-07-02 18:26:39.895001 | debian-bookworm | +-w /usr/bin/gem -p x -k third_party_software_mgmt 2026-07-02 18:26:39.895108 | debian-bookworm | + 2026-07-02 18:26:39.895229 | debian-bookworm | +# LuaRocks (Lua installs) 2026-07-02 18:26:39.895342 | debian-bookworm | +## T1072 third party software 2026-07-02 18:26:39.895452 | debian-bookworm | +## https://luarocks.org 2026-07-02 18:26:39.895564 | debian-bookworm | +-w /usr/bin/luarocks -p x -k third_party_software_mgmt 2026-07-02 18:26:39.895672 | debian-bookworm | + 2026-07-02 18:26:39.895782 | debian-bookworm | +# Pacman (Arch Linux) 2026-07-02 18:26:39.895892 | debian-bookworm | +## https://wiki.archlinux.org/title/Pacman 2026-07-02 18:26:39.896002 | debian-bookworm | +## T1072 third party software 2026-07-02 18:26:39.896115 | debian-bookworm | +-w /etc/pacman.conf -p x -k third_party_software_mgmt 2026-07-02 18:26:39.896240 | debian-bookworm | +-w /etc/pacman.d -p x -k third_party_software_mgmt 2026-07-02 18:26:39.896347 | debian-bookworm | + 2026-07-02 18:26:39.896457 | debian-bookworm | +# Special Software ------------------------------------------------------------ 2026-07-02 18:26:39.896565 | debian-bookworm | + 2026-07-02 18:26:39.896673 | debian-bookworm | +## GDS specific secrets 2026-07-02 18:26:39.896783 | debian-bookworm | +-w /etc/puppet/ssl -p wa -k puppet_ssl 2026-07-02 18:26:39.896889 | debian-bookworm | + 2026-07-02 18:26:39.896997 | debian-bookworm | +## IBM Bigfix BESClient 2026-07-02 18:26:39.897111 | debian-bookworm | +-a always,exit -F arch=b64 -S open -F dir=/opt/BESClient -F success=0 -k soft_besclient 2026-07-02 18:26:39.897252 | debian-bookworm | +-w /var/opt/BESClient/ -p wa -k soft_besclient 2026-07-02 18:26:39.897365 | debian-bookworm | + 2026-07-02 18:26:39.897480 | debian-bookworm | +## CHEF https://www.chef.io/chef/ 2026-07-02 18:26:39.897606 | debian-bookworm | +-w /etc/chef -p wa -k soft_chef 2026-07-02 18:26:39.897723 | debian-bookworm | + 2026-07-02 18:26:39.897833 | debian-bookworm | +## Salt 2026-07-02 18:26:39.897945 | debian-bookworm | +## https://saltproject.io/ 2026-07-02 18:26:39.898060 | debian-bookworm | +## https://docs.saltproject.io/en/latest/ref/configuration/master.html 2026-07-02 18:26:39.898182 | debian-bookworm | +-w /etc/salt -p wa -k soft_salt 2026-07-02 18:26:39.898293 | debian-bookworm | +-w /usr/local/etc/salt -p wa -k soft_salt 2026-07-02 18:26:39.898401 | debian-bookworm | + 2026-07-02 18:26:39.898513 | debian-bookworm | +## Otter 2026-07-02 18:26:39.898623 | debian-bookworm | +## https://inedo.com/otter 2026-07-02 18:26:39.898736 | debian-bookworm | +-w /etc/otter -p wa -k soft_otter 2026-07-02 18:26:39.898847 | debian-bookworm | + 2026-07-02 18:26:39.898970 | debian-bookworm | +## T1081 Credentials In Files 2026-07-02 18:26:39.899092 | debian-bookworm | +-w /usr/bin/grep -p x -k string_search 2026-07-02 18:26:39.899230 | debian-bookworm | +-w /usr/bin/egrep -p x -k string_search 2026-07-02 18:26:39.899351 | debian-bookworm | +-w /usr/bin/ugrep -p x -k string_search 2026-07-02 18:26:39.899465 | debian-bookworm | +### macOS 2026-07-02 18:26:39.899581 | debian-bookworm | +-w /usr/local/bin/grep -p x -k string_search 2026-07-02 18:26:39.899696 | debian-bookworm | +-w /usr/local/bin/egrep -p x -k string_search 2026-07-02 18:26:39.899813 | debian-bookworm | +-w /usr/local/bin/ugrep -p x -k string_search 2026-07-02 18:26:39.899925 | debian-bookworm | + 2026-07-02 18:26:39.900040 | debian-bookworm | +### https://github.com/tmbinc/bgrep 2026-07-02 18:26:39.900164 | debian-bookworm | +-w /usr/bin/bgrep -p x -k string_search 2026-07-02 18:26:39.900278 | debian-bookworm | +### macOS 2026-07-02 18:26:39.900392 | debian-bookworm | +-w /usr/local/bin/bgrep -p x -k string_search 2026-07-02 18:26:39.900516 | debian-bookworm | + 2026-07-02 18:26:39.900648 | debian-bookworm | +### https://github.com/BurntSushi/ripgrep 2026-07-02 18:26:39.900761 | debian-bookworm | +-w /usr/bin/rg -p x -k string_search 2026-07-02 18:26:39.900873 | debian-bookworm | +### macOS 2026-07-02 18:26:39.900985 | debian-bookworm | +-w /usr/local/bin/rg -p x -k string_search 2026-07-02 18:26:39.901092 | debian-bookworm | + 2026-07-02 18:26:39.901214 | debian-bookworm | +### https://github.com/awgn/cgrep 2026-07-02 18:26:39.901321 | debian-bookworm | + 2026-07-02 18:26:39.901433 | debian-bookworm | +-w /usr/bin/cgrep -p x -k string_search 2026-07-02 18:26:39.901542 | debian-bookworm | +### macOS 2026-07-02 18:26:39.901680 | debian-bookworm | +-w /usr/local/bin/cgrep -p x -k string_search 2026-07-02 18:26:39.901791 | debian-bookworm | + 2026-07-02 18:26:39.901902 | debian-bookworm | +### https://github.com/jpr5/ngrep 2026-07-02 18:26:39.902011 | debian-bookworm | +-w /usr/bin/ngrep -p x -k string_search 2026-07-02 18:26:39.902118 | debian-bookworm | +### macOS 2026-07-02 18:26:39.902240 | debian-bookworm | +-w /usr/local/bin/ngrep -p x -k string_search 2026-07-02 18:26:39.902349 | debian-bookworm | + 2026-07-02 18:26:39.902458 | debian-bookworm | +### https://github.com/vrothberg/vgrep 2026-07-02 18:26:39.902568 | debian-bookworm | +-w /usr/bin/vgrep -p x -k string_search 2026-07-02 18:26:39.902676 | debian-bookworm | +### macOS 2026-07-02 18:26:39.902784 | debian-bookworm | +-w /usr/local/bin/vgrep -p x -k string_search 2026-07-02 18:26:39.902890 | debian-bookworm | + 2026-07-02 18:26:39.903001 | debian-bookworm | +### https://github.com/monochromegane/the_platinum_searcher 2026-07-02 18:26:39.903116 | debian-bookworm | +-w /usr/bin/pt -p x -k string_search 2026-07-02 18:26:39.903249 | debian-bookworm | +### macOS 2026-07-02 18:26:39.903361 | debian-bookworm | +-w /usr/local/bin/pt -p x -k string_search 2026-07-02 18:26:39.903470 | debian-bookworm | + 2026-07-02 18:26:39.903581 | debian-bookworm | +### https://github.com/gvansickle/ucg 2026-07-02 18:26:39.903690 | debian-bookworm | +-w /usr/bin/ucg -p x -k string_search 2026-07-02 18:26:39.903798 | debian-bookworm | +### macOS 2026-07-02 18:26:39.903906 | debian-bookworm | +-w /usr/local/bin/ucg -p x -k string_search 2026-07-02 18:26:39.904012 | debian-bookworm | + 2026-07-02 18:26:39.904121 | debian-bookworm | +### https://github.com/ggreer/the_silver_searcher 2026-07-02 18:26:39.904243 | debian-bookworm | +-w /usr/bin/ag -p x -k string_search 2026-07-02 18:26:39.904350 | debian-bookworm | +### macOS 2026-07-02 18:26:39.904458 | debian-bookworm | +-w /usr/local/bin/ag -p x -k string_search 2026-07-02 18:26:39.904564 | debian-bookworm | + 2026-07-02 18:26:39.904672 | debian-bookworm | +### https://github.com/beyondgrep/ack3 2026-07-02 18:26:39.904780 | debian-bookworm | +### https://beyondgrep.com 2026-07-02 18:26:39.904889 | debian-bookworm | +-w /usr/bin/ack -p x -k string_search 2026-07-02 18:26:39.904999 | debian-bookworm | +-w /usr/local/bin/ack -p x -k string_search 2026-07-02 18:26:39.905107 | debian-bookworm | +-w /usr/bin/semgrep -p x -k string_search 2026-07-02 18:26:39.905225 | debian-bookworm | +### macOS 2026-07-02 18:26:39.905334 | debian-bookworm | +-w /usr/local/bin/semgrep -p x -k string_search 2026-07-02 18:26:39.905438 | debian-bookworm | + 2026-07-02 18:26:39.905543 | debian-bookworm | +## Docker 2026-07-02 18:26:39.905670 | debian-bookworm | +-w /usr/bin/dockerd -k docker 2026-07-02 18:26:39.905781 | debian-bookworm | +-w /usr/bin/docker -k docker 2026-07-02 18:26:39.905896 | debian-bookworm | +-w /usr/bin/docker-containerd -k docker 2026-07-02 18:26:39.906005 | debian-bookworm | +-w /usr/bin/docker-runc -k docker 2026-07-02 18:26:39.906112 | debian-bookworm | +-w /var/lib/docker -p wa -k docker 2026-07-02 18:26:39.906228 | debian-bookworm | +-w /etc/docker -k docker 2026-07-02 18:26:39.906338 | debian-bookworm | +-w /etc/sysconfig/docker -k docker 2026-07-02 18:26:39.906446 | debian-bookworm | +-w /etc/sysconfig/docker-storage -k docker 2026-07-02 18:26:39.906556 | debian-bookworm | +-w /usr/lib/systemd/system/docker.service -k docker 2026-07-02 18:26:39.906666 | debian-bookworm | +-w /usr/lib/systemd/system/docker.socket -k docker 2026-07-02 18:26:39.906774 | debian-bookworm | + 2026-07-02 18:26:39.906883 | debian-bookworm | +## Virtualization stuff 2026-07-02 18:26:39.906992 | debian-bookworm | +-w /usr/bin/qemu-system-x86_64 -p x -k qemu-system-x86_64 2026-07-02 18:26:39.907101 | debian-bookworm | +-w /usr/bin/qemu-img -p x -k qemu-img 2026-07-02 18:26:39.907233 | debian-bookworm | +-w /usr/bin/qemu-kvm -p x -k qemu-kvm 2026-07-02 18:26:39.907344 | debian-bookworm | +-w /usr/bin/qemu -p x -k qemu 2026-07-02 18:26:39.907453 | debian-bookworm | +-w /usr/bin/virtualbox -p x -k virtualbox 2026-07-02 18:26:39.907562 | debian-bookworm | +-w /usr/bin/virt-manager -p x -k virt-manager 2026-07-02 18:26:39.907689 | debian-bookworm | +-w /usr/bin/VBoxManage -p x -k VBoxManage 2026-07-02 18:26:39.907835 | debian-bookworm | + 2026-07-02 18:26:39.907970 | debian-bookworm | +#### VirtualBox on macOS 2026-07-02 18:26:39.908114 | debian-bookworm | + 2026-07-02 18:26:39.908284 | debian-bookworm | +-w /usr/local/bin/VirtualBox -p x -k virt_tool 2026-07-02 18:26:39.908428 | debian-bookworm | +-w /usr/local/bin/VirtualBoxVM -p x -k virt_tool 2026-07-02 18:26:39.908569 | debian-bookworm | +-w /usr/local/bin/VBoxManage -p x -k virt_tool 2026-07-02 18:26:39.908714 | debian-bookworm | +-w /usr/local/bin/VBoxVRDP -p x -k virt_tool 2026-07-02 18:26:39.908845 | debian-bookworm | +-w /usr/local/bin/VBoxHeadless -p x -k virt_tool 2026-07-02 18:26:39.909004 | debian-bookworm | +-w /usr/local/bin/vboxwebsrv -p x -k virt_tool 2026-07-02 18:26:39.909137 | debian-bookworm | +-w /usr/local/bin/VBoxBugReport -p x -k virt_tool 2026-07-02 18:26:39.909338 | debian-bookworm | +-w /usr/local/bin/VBoxBalloonCtrl -p x -k virt_tool 2026-07-02 18:26:39.909496 | debian-bookworm | +-w /usr/local/bin/VBoxAutostart -p x -k virt_tool 2026-07-02 18:26:39.909648 | debian-bookworm | +-w /usr/local/bin/VBoxDTrace -p x -k virt_tool 2026-07-02 18:26:39.909791 | debian-bookworm | +-w /usr/local/bin/vbox-img -p x -k virt_tool 2026-07-02 18:26:39.909955 | debian-bookworm | +-w /Library/LaunchDaemons/org.virtualbox.startup.plist -p x -k virt_tool 2026-07-02 18:26:39.910184 | debian-bookworm | +-w /Library/Application Support/VirtualBox/LaunchDaemons/ -p x -k virt_tool 2026-07-02 18:26:39.910410 | debian-bookworm | +-w /Library/Application Support/VirtualBox/VBoxDrv.kext/ -p x -k virt_tool 2026-07-02 18:26:39.910620 | debian-bookworm | +-w /Library/Application Support/VirtualBox/VBoxUSB.kext/ -p x -k virt_tool 2026-07-02 18:26:39.910835 | debian-bookworm | +-w /Library/Application Support/VirtualBox/VBoxNetFlt.kext/ -p x -k virt_tool 2026-07-02 18:26:39.911048 | debian-bookworm | +-w /Library/Application Support/VirtualBox/VBoxNetAdp.kext/ -p x -k virt_tool 2026-07-02 18:26:39.911298 | debian-bookworm | + 2026-07-02 18:26:39.911607 | debian-bookworm | +### Parallels Desktop on macOS 2026-07-02 18:26:39.911829 | debian-bookworm | + 2026-07-02 18:26:39.912068 | debian-bookworm | +-w /usr/local/bin/prl_convert -p x -k virt_tool 2026-07-02 18:26:39.912308 | debian-bookworm | +-w /usr/local/bin/prl_disk_tool -p x -k virt_tool 2026-07-02 18:26:39.912494 | debian-bookworm | +-w /usr/local/bin/prl_perf_ctl -p x -k virt_tool 2026-07-02 18:26:39.912698 | debian-bookworm | +-w /usr/local/bin/prlcore2dmp -p x -k virt_tool 2026-07-02 18:26:39.912911 | debian-bookworm | +-w /usr/local/bin/prlctl -p x -k virt_tool 2026-07-02 18:26:39.913127 | debian-bookworm | +-w /usr/local/bin/prlexec -p x -k virt_tool 2026-07-02 18:26:39.913361 | debian-bookworm | +-w /usr/local/bin/prlsrvctl -p x -k virt_tool 2026-07-02 18:26:39.913623 | debian-bookworm | +-w /Library/Preferences/Parallels -p x -k virt_tool 2026-07-02 18:26:39.913829 | debian-bookworm | + 2026-07-02 18:26:39.913967 | debian-bookworm | +### qemu on macOS 2026-07-02 18:26:39.914076 | debian-bookworm | + 2026-07-02 18:26:39.914229 | debian-bookworm | +-w /usr/local/bin/qemu-edid -p x -k virt_tool 2026-07-02 18:26:39.914349 | debian-bookworm | +-w /usr/local/bin/qemu-img -p x -k virt_tool 2026-07-02 18:26:39.914464 | debian-bookworm | +-w /usr/local/bin/qemu-io -p x -k virt_tool 2026-07-02 18:26:39.914574 | debian-bookworm | +-w /usr/local/bin/qemu-nbd -p x -k virt_tool 2026-07-02 18:26:39.914687 | debian-bookworm | +-w /usr/local/bin/qemu-system-x86_64 -p x -k virt_tool 2026-07-02 18:26:39.914793 | debian-bookworm | + 2026-07-02 18:26:39.914902 | debian-bookworm | +## Kubelet 2026-07-02 18:26:39.915010 | debian-bookworm | +-w /usr/bin/kubelet -k kubelet 2026-07-02 18:26:39.915115 | debian-bookworm | + 2026-07-02 18:26:39.915237 | debian-bookworm | +# ipc system call 2026-07-02 18:26:39.915346 | debian-bookworm | +# /usr/include/linux/ipc.h 2026-07-02 18:26:39.915455 | debian-bookworm | + 2026-07-02 18:26:39.915576 | debian-bookworm | +## msgctl 2026-07-02 18:26:39.915692 | debian-bookworm | +#-a always,exit -S ipc -F a0=14 -k Inter-Process_Communication 2026-07-02 18:26:39.915800 | debian-bookworm | +## msgget 2026-07-02 18:26:39.915912 | debian-bookworm | +#-a always,exit -S ipc -F a0=13 -k Inter-Process_Communication 2026-07-02 18:26:39.916024 | debian-bookworm | +## Use these lines on x86_64, ia64 instead 2026-07-02 18:26:39.916138 | debian-bookworm | +-a always,exit -F arch=b64 -S msgctl -k Inter-Process_Communication 2026-07-02 18:26:39.916271 | debian-bookworm | +-a always,exit -F arch=b64 -S msgget -k Inter-Process_Communication 2026-07-02 18:26:39.916377 | debian-bookworm | + 2026-07-02 18:26:39.916483 | debian-bookworm | +## semctl 2026-07-02 18:26:39.916594 | debian-bookworm | +#-a always,exit -S ipc -F a0=3 -k Inter-Process_Communication 2026-07-02 18:26:39.916701 | debian-bookworm | +## semget 2026-07-02 18:26:39.916813 | debian-bookworm | +#-a always,exit -S ipc -F a0=2 -k Inter-Process_Communication 2026-07-02 18:26:39.916922 | debian-bookworm | +## semop 2026-07-02 18:26:39.917032 | debian-bookworm | +#-a always,exit -S ipc -F a0=1 -k Inter-Process_Communication 2026-07-02 18:26:39.917139 | debian-bookworm | +## semtimedop 2026-07-02 18:26:39.917272 | debian-bookworm | +#-a always,exit -S ipc -F a0=4 -k Inter-Process_Communication 2026-07-02 18:26:39.917421 | debian-bookworm | +## Use these lines on x86_64, ia64 instead 2026-07-02 18:26:39.917551 | debian-bookworm | +-a always,exit -F arch=b64 -S semctl -k Inter-Process_Communication 2026-07-02 18:26:39.917685 | debian-bookworm | +-a always,exit -F arch=b64 -S semget -k Inter-Process_Communication 2026-07-02 18:26:39.917799 | debian-bookworm | +-a always,exit -F arch=b64 -S semop -k Inter-Process_Communication 2026-07-02 18:26:39.917911 | debian-bookworm | +-a always,exit -F arch=b64 -S semtimedop -k Inter-Process_Communication 2026-07-02 18:26:39.918018 | debian-bookworm | + 2026-07-02 18:26:39.918133 | debian-bookworm | +## shmctl 2026-07-02 18:26:39.918279 | debian-bookworm | +#-a always,exit -S ipc -F a0=24 -k Inter-Process_Communication 2026-07-02 18:26:39.918390 | debian-bookworm | +## shmget 2026-07-02 18:26:39.918508 | debian-bookworm | +#-a always,exit -S ipc -F a0=23 -k Inter-Process_Communication 2026-07-02 18:26:39.918618 | debian-bookworm | +## Use these lines on x86_64, ia64 instead 2026-07-02 18:26:39.918733 | debian-bookworm | +-a always,exit -F arch=b64 -S shmctl -k Inter-Process_Communication 2026-07-02 18:26:39.918853 | debian-bookworm | +-a always,exit -F arch=b64 -S shmget -k Inter-Process_Communication 2026-07-02 18:26:39.918963 | debian-bookworm | + 2026-07-02 18:26:39.919076 | debian-bookworm | +# High Volume Events ---------------------------------------------------------- 2026-07-02 18:26:39.919194 | debian-bookworm | + 2026-07-02 18:26:39.919308 | debian-bookworm | +## Disable these rules if they create too many events in your environment 2026-07-02 18:26:39.919412 | debian-bookworm | + 2026-07-02 18:26:39.919520 | debian-bookworm | +## Common Shells 2026-07-02 18:26:39.919630 | debian-bookworm | +-w /bin/bash -p x -k susp_shell 2026-07-02 18:26:39.919740 | debian-bookworm | +-w /bin/dash -p x -k susp_shell 2026-07-02 18:26:39.919852 | debian-bookworm | +-w /bin/busybox -p x -k susp_shell 2026-07-02 18:26:39.919961 | debian-bookworm | +-w /bin/zsh -p x -k susp_shell 2026-07-02 18:26:39.920070 | debian-bookworm | +-w /bin/sh -p x -k susp_shell 2026-07-02 18:26:39.920188 | debian-bookworm | +-w /bin/ksh -p x -k susp_shell 2026-07-02 18:26:39.920296 | debian-bookworm | + 2026-07-02 18:26:39.920408 | debian-bookworm | +## Root command executions 2026-07-02 18:26:39.920518 | debian-bookworm | +-a always,exit -F arch=b64 -F euid=0 -F auid>=1000 -F auid!=-1 -S execve -k rootcmd 2026-07-02 18:26:39.920625 | debian-bookworm | + 2026-07-02 18:26:39.920735 | debian-bookworm | +## File Deletion Events by User 2026-07-02 18:26:39.920848 | debian-bookworm | +-a always,exit -F arch=b64 -S rmdir -S unlink -S unlinkat -S rename -S renameat -F auid>=1000 -F auid!=-1 -k delete 2026-07-02 18:26:39.920953 | debian-bookworm | + 2026-07-02 18:26:39.921061 | debian-bookworm | +## File Access 2026-07-02 18:26:39.921178 | debian-bookworm | +### Unauthorized Access (unsuccessful) 2026-07-02 18:26:39.921294 | debian-bookworm | +-a always,exit -F arch=b64 -S creat -S open -S openat -S open_by_handle_at -S truncate -S ftruncate -F exit=-EACCES -F auid>=1000 -F auid!=-1 -k file_access 2026-07-02 18:26:39.921411 | debian-bookworm | +-a always,exit -F arch=b64 -S creat -S open -S openat -S open_by_handle_at -S truncate -S ftruncate -F exit=-EPERM -F auid>=1000 -F auid!=-1 -k file_access 2026-07-02 18:26:39.921516 | debian-bookworm | + 2026-07-02 18:26:39.921650 | debian-bookworm | +### Unsuccessful Creation 2026-07-02 18:26:39.921763 | debian-bookworm | +-a always,exit -F arch=b64 -S mkdir,creat,link,symlink,mknod,mknodat,linkat,symlinkat -F exit=-EACCES -k file_creation 2026-07-02 18:26:39.921876 | debian-bookworm | +-a always,exit -F arch=b64 -S mkdir,link,symlink,mkdirat -F exit=-EPERM -k file_creation 2026-07-02 18:26:39.921982 | debian-bookworm | + 2026-07-02 18:26:39.922092 | debian-bookworm | +### Unsuccessful Modification 2026-07-02 18:26:39.922233 | debian-bookworm | +-a always,exit -F arch=b64 -S rename -S renameat -S truncate -S chmod -S setxattr -S lsetxattr -S removexattr -S lremovexattr -F exit=-EACCES -k file_modification 2026-07-02 18:26:39.922354 | debian-bookworm | +-a always,exit -F arch=b64 -S rename -S renameat -S truncate -S chmod -S setxattr -S lsetxattr -S removexattr -S lremovexattr -F exit=-EPERM -k file_modification 2026-07-02 18:26:39.922462 | debian-bookworm | + 2026-07-02 18:26:39.922570 | debian-bookworm | +## 32bit API Exploitation 2026-07-02 18:26:39.922683 | debian-bookworm | +### If you are on a 64 bit platform, everything _should_ be running 2026-07-02 18:26:39.922795 | debian-bookworm | +### in 64 bit mode. This rule will detect any use of the 32 bit syscalls 2026-07-02 18:26:39.922906 | debian-bookworm | +### because this might be a sign of someone exploiting a hole in the 32 2026-07-02 18:26:39.923013 | debian-bookworm | +### bit API. 2026-07-02 18:26:39.923128 | debian-bookworm | +-a always,exit -F arch=b32 -S all -k 32bit_api 2026-07-02 18:26:39.923246 | debian-bookworm | + 2026-07-02 18:26:39.923358 | debian-bookworm | +# Make The Configuration Immutable -------------------------------------------- 2026-07-02 18:26:39.923474 | debian-bookworm | + 2026-07-02 18:26:39.923584 | debian-bookworm | +##-e 2 2026-07-02 18:26:39.923688 | debian-bookworm | 2026-07-02 18:26:39.923907 | debian-bookworm | changed: [molecule-auditd] => (item=20-neo23x0.rules) => {"ansible_loop_var": "item", "changed": true, "checksum": "9f99ce5c4f891fbf3e2bce06ed4cb97fb9e01f41", "dest": "/etc/audit/rules.d/20-neo23x0.rules", "gid": 0, "group": "root", "item": "20-neo23x0.rules", "md5sum": "6ac57206fd77de34805c3f4d50ef8b1d", "mode": "0644", "owner": "root", "size": 27367, "src": "/home/zuul/.ansible/tmp/ansible-tmp-1783016799.1121283-2645-110214881842220/.source.rules", "state": "file", "uid": 0} 2026-07-02 18:26:39.924016 | debian-bookworm | 2026-07-02 18:26:39.924128 | debian-bookworm | TASK [auditd : Manage auditd service] ****************************************** 2026-07-02 18:26:40.590218 | debian-bookworm | ok: [molecule-auditd] => {"changed": false, "enabled": true, "name": "auditd", "state": "started", "status": {"ActiveEnterTimestamp": "Thu 2026-07-02 18:26:34 UTC", "ActiveEnterTimestampMonotonic": "261847973", "ActiveExitTimestampMonotonic": "0", "ActiveState": "active", "After": "local-fs.target system.slice systemd-journald.socket systemd-tmpfiles-setup.service", "AllowIsolate": "no", "AssertResult": "yes", "AssertTimestamp": "Thu 2026-07-02 18:26:34 UTC", "AssertTimestampMonotonic": "261775320", "Before": "ssh.service systemd-update-utmp.service sysinit.target shutdown.target", "BlockIOAccounting": "no", "BlockIOWeight": "[not set]", "CPUAccounting": "yes", "CPUAffinityFromNUMA": "no", "CPUQuotaPerSecUSec": "infinity", "CPUQuotaPeriodUSec": "infinity", "CPUSchedulingPolicy": "0", "CPUSchedulingPriority": "0", "CPUSchedulingResetOnFork": "no", "CPUShares": "[not set]", "CPUUsageNSec": "50516000", "CPUWeight": "[not set]", "CacheDirectoryMode": "0755", "CanFreeze": "yes", "CanIsolate": "no", "CanReload": "no", "CanStart": "yes", "CanStop": "yes", "CapabilityBoundingSet": "cap_chown cap_dac_override cap_dac_read_search cap_fowner cap_fsetid cap_kill cap_setgid cap_setuid cap_setpcap cap_linux_immutable cap_net_bind_service cap_net_broadcast cap_net_admin cap_net_raw cap_ipc_lock cap_ipc_owner cap_sys_rawio cap_sys_chroot cap_sys_ptrace cap_sys_pacct cap_sys_admin cap_sys_boot cap_sys_nice cap_sys_resource cap_sys_time cap_sys_tty_config cap_mknod cap_lease cap_audit_write cap_audit_control cap_setfcap cap_mac_override cap_mac_admin cap_syslog cap_wake_alarm cap_block_suspend cap_audit_read cap_perfmon cap_bpf cap_checkpoint_restore", "CleanResult": "success", "CollectMode": "inactive", "ConditionResult": "yes", "ConditionTimestamp": "Thu 2026-07-02 18:26:34 UTC", "ConditionTimestampMonotonic": "261775276", "ConfigurationDirectoryMode": "0755", "Conflicts": "shutdown.target", "ControlGroup": "/system.slice/auditd.service", "ControlGroupId": "3250", "ControlPID": "0", "CoredumpFilter": "0x33", "DefaultDependencies": "no", "DefaultMemoryLow": "0", "DefaultMemoryMin": "0", "Delegate": "no", "Description": "Security Auditing Service", "DevicePolicy": "auto", "Documentation": "\"man:auditd(8)\" https://github.com/linux-audit/audit-documentation", "DynamicUser": "no", "ExecMainCode": "0", "ExecMainExitTimestampMonotonic": "0", "ExecMainPID": "2417", "ExecMainStartTimestamp": "Thu 2026-07-02 18:26:34 UTC", "ExecMainStartTimestampMonotonic": "261818199", "ExecMainStatus": "0", "ExecStart": "{ path=/sbin/auditd ; argv[]=/sbin/auditd ; ignore_errors=no ; start_time=[Thu 2026-07-02 18:26:34 UTC] ; stop_time=[Thu 2026-07-02 18:26:34 UTC] ; pid=2416 ; code=exited ; status=0 }", "ExecStartEx": "{ path=/sbin/auditd ; argv[]=/sbin/auditd ; flags= ; start_time=[Thu 2026-07-02 18:26:34 UTC] ; stop_time=[Thu 2026-07-02 18:26:34 UTC] ; pid=2416 ; code=exited ; status=0 }", "ExecStartPost": "{ path=/sbin/augenrules ; argv[]=/sbin/augenrules --load ; ignore_errors=yes ; start_time=[Thu 2026-07-02 18:26:34 UTC] ; stop_time=[Thu 2026-07-02 18:26:34 UTC] ; pid=2420 ; code=exited ; status=0 }", "ExecStartPostEx": "{ path=/sbin/augenrules ; argv[]=/sbin/augenrules --load ; flags=ignore-failure ; start_time=[Thu 2026-07-02 18:26:34 UTC] ; stop_time=[Thu 2026-07-02 18:26:34 UTC] ; pid=2420 ; code=exited ; status=0 }", "ExitType": "main", "FailureAction": "none", "FileDescriptorStoreMax": "0", "FinalKillSignal": "9", "FragmentPath": "/lib/systemd/system/auditd.service", "FreezerState": "running", "GID": "[not set]", "GuessMainPID": "yes", "IOAccounting": "no", "IOReadBytes": "18446744073709551615", "IOReadOperations": "18446744073709551615", "IOSchedulingClass": "2", "IOSchedulingPriority": "4", "IOWeight": "[not set]", "IOWriteBytes": "18446744073709551615", "IOWriteOperations": "18446744073709551615", "IPAccounting": "no", "IPEgressBytes": "[no data]", "IPEgressPackets": "[no data]", "IPIngressBytes": "[no data]", "IPIngressPackets": "[no data]", "Id": "auditd.service", "IgnoreOnIsolate": "no", "IgnoreSIGPIPE": "yes", "InactiveEnterTimestampMonotonic": "0", "InactiveExitTimestamp": "Thu 2026-07-02 18:26:34 UTC", "InactiveExitTimestampMonotonic": "261797381", "InvocationID": "2b0f645e5dca42ee822ca4f0f47d45f7", "JobRunningTimeoutUSec": "infinity", "JobTimeoutAction": "none", "JobTimeoutUSec": "infinity", "KeyringMode": "private", "KillMode": "control-group", "KillSignal": "15", "LimitAS": "infinity", "LimitASSoft": "infinity", "LimitCORE": "infinity", "LimitCORESoft": "0", "LimitCPU": "infinity", "LimitCPUSoft": "infinity", "LimitDATA": "infinity", "LimitDATASoft": "infinity", "LimitFSIZE": "infinity", "LimitFSIZESoft": "infinity", "LimitLOCKS": "infinity", "LimitLOCKSSoft": "infinity", "LimitMEMLOCK": "8388608", "LimitMEMLOCKSoft": "8388608", "LimitMSGQUEUE": "819200", "LimitMSGQUEUESoft": "819200", "LimitNICE": "0", "LimitNICESoft": "0", "LimitNOFILE": "524288", "LimitNOFILESoft": "1024", "LimitNPROC": "15480", "LimitNPROCSoft": "15480", "LimitRSS": "infinity", "LimitRSSSoft": "infinity", "LimitRTPRIO": "0", "LimitRTPRIOSoft": "0", "LimitRTTIME": "infinity", "LimitRTTIMESoft": "infinity", "LimitSIGPENDING": "15480", "LimitSIGPENDINGSoft": "15480", "LimitSTACK": "infinity", "LimitSTACKSoft": "8388608", "LoadState": "loaded", "LockPersonality": "yes", "LogLevelMax": "-1", "LogRateLimitBurst": "0", "LogRateLimitIntervalUSec": "0", "LogsDirectoryMode": "0755", "MainPID": "2417", "ManagedOOMMemoryPressure": "auto", "ManagedOOMMemoryPressureLimit": "0", "ManagedOOMPreference": "none", "ManagedOOMSwap": "auto", "MemoryAccounting": "yes", "MemoryAvailable": "infinity", "MemoryCurrent": "708608", "MemoryDenyWriteExecute": "yes", "MemoryHigh": "infinity", "MemoryLimit": "infinity", "MemoryLow": "0", "MemoryMax": "infinity", "MemoryMin": "0", "MemorySwapMax": "infinity", "MountAPIVFS": "no", "NFileDescriptorStore": "0", "NRestarts": "0", "NUMAPolicy": "n/a", "Names": "auditd.service", "NeedDaemonReload": "no", "Nice": "0", "NoNewPrivileges": "no", "NonBlocking": "no", "NotifyAccess": "none", "OOMPolicy": "stop", "OOMScoreAdjust": "0", "OnFailureJobMode": "replace", "OnSuccessJobMode": "fail", "PIDFile": "/run/auditd.pid", "Perpetual": "no", "PrivateDevices": "no", "PrivateIPC": "no", "PrivateMounts": "no", "PrivateNetwork": "no", "PrivateTmp": "no", "PrivateUsers": "no", "ProcSubset": "all", "ProtectClock": "no", "ProtectControlGroups": "yes", "ProtectHome": "no", "ProtectHostname": "no", "ProtectKernelLogs": "no", "ProtectKernelModules": "yes", "ProtectKernelTunables": "no", "ProtectProc": "default", "ProtectSystem": "no", "RefuseManualStart": "no", "RefuseManualStop": "no", "ReloadResult": "success", "RemainAfterExit": "no", "RemoveIPC": "no", "Requires": "system.slice", "Restart": "on-failure", "RestartKillSignal": "15", "RestartPreventExitStatus": "2 4 6", "RestartUSec": "100ms", "RestrictNamespaces": "no", "RestrictRealtime": "yes", "RestrictSUIDSGID": "no", "Result": "success", "RootDirectoryStartOnly": "no", "RuntimeDirectoryMode": "0755", "RuntimeDirectoryPreserve": "no", "RuntimeMaxUSec": "infinity", "RuntimeRandomizedExtraUSec": "0", "SameProcessGroup": "no", "SecureBits": "0", "SendSIGHUP": "no", "SendSIGKILL": "yes", "Slice": "system.slice", "StandardError": "inherit", "StandardInput": "null", "StandardOutput": "journal", "StartLimitAction": "none", "StartLimitBurst": "5", "StartLimitIntervalUSec": "10s", "StartupBlockIOWeight": "[not set]", "StartupCPUShares": "[not set]", "StartupCPUWeight": "[not set]", "StartupIOWeight": "[not set]", "StateChangeTimestamp": "Thu 2026-07-02 18:26:34 UTC", "StateChangeTimestampMonotonic": "261847973", "StateDirectoryMode": "0755", "StatusErrno": "0", "StopWhenUnneeded": "no", "SubState": "running", "SuccessAction": "none", "SyslogFacility": "3", "SyslogLevel": "6", "SyslogLevelPrefix": "yes", "SyslogPriority": "30", "SystemCallErrorNumber": "2147483646", "TTYReset": "no", "TTYVHangup": "no", "TTYVTDisallocate": "no", "TasksAccounting": "yes", "TasksCurrent": "2", "TasksMax": "4644", "TimeoutAbortUSec": "1min 30s", "TimeoutCleanUSec": "infinity", "TimeoutStartFailureMode": "terminate", "TimeoutStartUSec": "1min 30s", "TimeoutStopFailureMode": "terminate", "TimeoutStopUSec": "1min 30s", "TimerSlackNSec": "50000", "Transient": "no", "Type": "forking", "UID": "[not set]", "UMask": "0022", "UnitFilePreset": "enabled", "UnitFileState": "enabled", "UtmpMode": "init", "WantedBy": "multi-user.target", "WatchdogSignal": "6", "WatchdogTimestampMonotonic": "0", "WatchdogUSec": "0"}} 2026-07-02 18:26:40.595055 | debian-bookworm | 2026-07-02 18:26:40.595214 | debian-bookworm | TASK [auditd : List existing rules files] ************************************** 2026-07-02 18:26:40.960529 | debian-bookworm | ok: [molecule-auditd] => {"changed": false, "cmd": ["find", "/etc/audit/rules.d", "-type", "f", "-printf", "%f\n"], "delta": "0:00:00.007699", "end": "2026-07-02 18:26:40.921939", "msg": "", "rc": 0, "start": "2026-07-02 18:26:40.914240", "stderr": "", "stderr_lines": [], "stdout": "20-neo23x0.rules\naudit.rules", "stdout_lines": ["20-neo23x0.rules", "audit.rules"]} 2026-07-02 18:26:40.960693 | debian-bookworm | 2026-07-02 18:26:40.960879 | debian-bookworm | TASK [auditd : Remove unmanaged rules files] *********************************** 2026-07-02 18:26:41.265053 | debian-bookworm | skipping: [molecule-auditd] => (item=20-neo23x0.rules) => {"ansible_loop_var": "item", "changed": false, "false_condition": "item not in auditd_rules_files", "item": "20-neo23x0.rules", "skip_reason": "Conditional result was False"} 2026-07-02 18:26:41.265271 | debian-bookworm | --- before 2026-07-02 18:26:41.265481 | debian-bookworm | +++ after 2026-07-02 18:26:41.265705 | debian-bookworm | @@ -1,4 +1,4 @@ 2026-07-02 18:26:41.265863 | debian-bookworm | { 2026-07-02 18:26:41.266027 | debian-bookworm | "path": "/etc/audit/rules.d/audit.rules", 2026-07-02 18:26:41.266224 | debian-bookworm | - "state": "file" 2026-07-02 18:26:41.266378 | debian-bookworm | + "state": "absent" 2026-07-02 18:26:41.266527 | debian-bookworm | } 2026-07-02 18:26:41.266674 | debian-bookworm | 2026-07-02 18:26:41.266838 | debian-bookworm | changed: [molecule-auditd] => (item=audit.rules) => {"ansible_loop_var": "item", "changed": true, "item": "audit.rules", "path": "/etc/audit/rules.d/audit.rules", "state": "absent"} 2026-07-02 18:26:41.266989 | debian-bookworm | 2026-07-02 18:26:41.267150 | debian-bookworm | RUNNING HANDLER [auditd : Restart auditd service] ****************************** 2026-07-02 18:26:41.882259 | debian-bookworm | changed: [molecule-auditd] => {"changed": true, "name": "auditd", "state": "started", "status": {"ActiveEnterTimestamp": "Thu 2026-07-02 18:26:34 UTC", "ActiveEnterTimestampMonotonic": "261847973", "ActiveExitTimestampMonotonic": "0", "ActiveState": "active", "After": "local-fs.target system.slice systemd-journald.socket systemd-tmpfiles-setup.service", "AllowIsolate": "no", "AssertResult": "yes", "AssertTimestamp": "Thu 2026-07-02 18:26:34 UTC", "AssertTimestampMonotonic": "261775320", "Before": "ssh.service systemd-update-utmp.service sysinit.target shutdown.target", "BlockIOAccounting": "no", "BlockIOWeight": "[not set]", "CPUAccounting": "yes", "CPUAffinityFromNUMA": "no", "CPUQuotaPerSecUSec": "infinity", "CPUQuotaPeriodUSec": "infinity", "CPUSchedulingPolicy": "0", "CPUSchedulingPriority": "0", "CPUSchedulingResetOnFork": "no", "CPUShares": "[not set]", "CPUUsageNSec": "51492000", "CPUWeight": "[not set]", "CacheDirectoryMode": "0755", "CanFreeze": "yes", "CanIsolate": "no", "CanReload": "no", "CanStart": "yes", "CanStop": "yes", "CapabilityBoundingSet": "cap_chown cap_dac_override cap_dac_read_search cap_fowner cap_fsetid cap_kill cap_setgid cap_setuid cap_setpcap cap_linux_immutable cap_net_bind_service cap_net_broadcast cap_net_admin cap_net_raw cap_ipc_lock cap_ipc_owner cap_sys_rawio cap_sys_chroot cap_sys_ptrace cap_sys_pacct cap_sys_admin cap_sys_boot cap_sys_nice cap_sys_resource cap_sys_time cap_sys_tty_config cap_mknod cap_lease cap_audit_write cap_audit_control cap_setfcap cap_mac_override cap_mac_admin cap_syslog cap_wake_alarm cap_block_suspend cap_audit_read cap_perfmon cap_bpf cap_checkpoint_restore", "CleanResult": "success", "CollectMode": "inactive", "ConditionResult": "yes", "ConditionTimestamp": "Thu 2026-07-02 18:26:34 UTC", "ConditionTimestampMonotonic": "261775276", "ConfigurationDirectoryMode": "0755", "Conflicts": "shutdown.target", "ControlGroup": "/system.slice/auditd.service", "ControlGroupId": "3250", "ControlPID": "0", "CoredumpFilter": "0x33", "DefaultDependencies": "no", "DefaultMemoryLow": "0", "DefaultMemoryMin": "0", "Delegate": "no", "Description": "Security Auditing Service", "DevicePolicy": "auto", "Documentation": "\"man:auditd(8)\" https://github.com/linux-audit/audit-documentation", "DynamicUser": "no", "ExecMainCode": "0", "ExecMainExitTimestampMonotonic": "0", "ExecMainPID": "2417", "ExecMainStartTimestamp": "Thu 2026-07-02 18:26:34 UTC", "ExecMainStartTimestampMonotonic": "261818199", "ExecMainStatus": "0", "ExecStart": "{ path=/sbin/auditd ; argv[]=/sbin/auditd ; ignore_errors=no ; start_time=[Thu 2026-07-02 18:26:34 UTC] ; stop_time=[Thu 2026-07-02 18:26:34 UTC] ; pid=2416 ; code=exited ; status=0 }", "ExecStartEx": "{ path=/sbin/auditd ; argv[]=/sbin/auditd ; flags= ; start_time=[Thu 2026-07-02 18:26:34 UTC] ; stop_time=[Thu 2026-07-02 18:26:34 UTC] ; pid=2416 ; code=exited ; status=0 }", "ExecStartPost": "{ path=/sbin/augenrules ; argv[]=/sbin/augenrules --load ; ignore_errors=yes ; start_time=[Thu 2026-07-02 18:26:34 UTC] ; stop_time=[Thu 2026-07-02 18:26:34 UTC] ; pid=2420 ; code=exited ; status=0 }", "ExecStartPostEx": "{ path=/sbin/augenrules ; argv[]=/sbin/augenrules --load ; flags=ignore-failure ; start_time=[Thu 2026-07-02 18:26:34 UTC] ; stop_time=[Thu 2026-07-02 18:26:34 UTC] ; pid=2420 ; code=exited ; status=0 }", "ExitType": "main", "FailureAction": "none", "FileDescriptorStoreMax": "0", "FinalKillSignal": "9", "FragmentPath": "/lib/systemd/system/auditd.service", "FreezerState": "running", "GID": "[not set]", "GuessMainPID": "yes", "IOAccounting": "no", "IOReadBytes": "18446744073709551615", "IOReadOperations": "18446744073709551615", "IOSchedulingClass": "2", "IOSchedulingPriority": "4", "IOWeight": "[not set]", "IOWriteBytes": "18446744073709551615", "IOWriteOperations": "18446744073709551615", "IPAccounting": "no", "IPEgressBytes": "[no data]", "IPEgressPackets": "[no data]", "IPIngressBytes": "[no data]", "IPIngressPackets": "[no data]", "Id": "auditd.service", "IgnoreOnIsolate": "no", "IgnoreSIGPIPE": "yes", "InactiveEnterTimestampMonotonic": "0", "InactiveExitTimestamp": "Thu 2026-07-02 18:26:34 UTC", "InactiveExitTimestampMonotonic": "261797381", "InvocationID": "2b0f645e5dca42ee822ca4f0f47d45f7", "JobRunningTimeoutUSec": "infinity", "JobTimeoutAction": "none", "JobTimeoutUSec": "infinity", "KeyringMode": "private", "KillMode": "control-group", "KillSignal": "15", "LimitAS": "infinity", "LimitASSoft": "infinity", "LimitCORE": "infinity", "LimitCORESoft": "0", "LimitCPU": "infinity", "LimitCPUSoft": "infinity", "LimitDATA": "infinity", "LimitDATASoft": "infinity", "LimitFSIZE": "infinity", "LimitFSIZESoft": "infinity", "LimitLOCKS": "infinity", "LimitLOCKSSoft": "infinity", "LimitMEMLOCK": "8388608", "LimitMEMLOCKSoft": "8388608", "LimitMSGQUEUE": "819200", "LimitMSGQUEUESoft": "819200", "LimitNICE": "0", "LimitNICESoft": "0", "LimitNOFILE": "524288", "LimitNOFILESoft": "1024", "LimitNPROC": "15480", "LimitNPROCSoft": "15480", "LimitRSS": "infinity", "LimitRSSSoft": "infinity", "LimitRTPRIO": "0", "LimitRTPRIOSoft": "0", "LimitRTTIME": "infinity", "LimitRTTIMESoft": "infinity", "LimitSIGPENDING": "15480", "LimitSIGPENDINGSoft": "15480", "LimitSTACK": "infinity", "LimitSTACKSoft": "8388608", "LoadState": "loaded", "LockPersonality": "yes", "LogLevelMax": "-1", "LogRateLimitBurst": "0", "LogRateLimitIntervalUSec": "0", "LogsDirectoryMode": "0755", "MainPID": "2417", "ManagedOOMMemoryPressure": "auto", "ManagedOOMMemoryPressureLimit": "0", "ManagedOOMPreference": "none", "ManagedOOMSwap": "auto", "MemoryAccounting": "yes", "MemoryAvailable": "infinity", "MemoryCurrent": "716800", "MemoryDenyWriteExecute": "yes", "MemoryHigh": "infinity", "MemoryLimit": "infinity", "MemoryLow": "0", "MemoryMax": "infinity", "MemoryMin": "0", "MemorySwapMax": "infinity", "MountAPIVFS": "no", "NFileDescriptorStore": "0", "NRestarts": "0", "NUMAPolicy": "n/a", "Names": "auditd.service", "NeedDaemonReload": "no", "Nice": "0", "NoNewPrivileges": "no", "NonBlocking": "no", "NotifyAccess": "none", "OOMPolicy": "stop", "OOMScoreAdjust": "0", "OnFailureJobMode": "replace", "OnSuccessJobMode": "fail", "PIDFile": "/run/auditd.pid", "Perpetual": "no", "PrivateDevices": "no", "PrivateIPC": "no", "PrivateMounts": "no", "PrivateNetwork": "no", "PrivateTmp": "no", "PrivateUsers": "no", "ProcSubset": "all", "ProtectClock": "no", "ProtectControlGroups": "yes", "ProtectHome": "no", "ProtectHostname": "no", "ProtectKernelLogs": "no", "ProtectKernelModules": "yes", "ProtectKernelTunables": "no", "ProtectProc": "default", "ProtectSystem": "no", "RefuseManualStart": "no", "RefuseManualStop": "no", "ReloadResult": "success", "RemainAfterExit": "no", "RemoveIPC": "no", "Requires": "system.slice", "Restart": "on-failure", "RestartKillSignal": "15", "RestartPreventExitStatus": "2 4 6", "RestartUSec": "100ms", "RestrictNamespaces": "no", "RestrictRealtime": "yes", "RestrictSUIDSGID": "no", "Result": "success", "RootDirectoryStartOnly": "no", "RuntimeDirectoryMode": "0755", "RuntimeDirectoryPreserve": "no", "RuntimeMaxUSec": "infinity", "RuntimeRandomizedExtraUSec": "0", "SameProcessGroup": "no", "SecureBits": "0", "SendSIGHUP": "no", "SendSIGKILL": "yes", "Slice": "system.slice", "StandardError": "inherit", "StandardInput": "null", "StandardOutput": "journal", "StartLimitAction": "none", "StartLimitBurst": "5", "StartLimitIntervalUSec": "10s", "StartupBlockIOWeight": "[not set]", "StartupCPUShares": "[not set]", "StartupCPUWeight": "[not set]", "StartupIOWeight": "[not set]", "StateChangeTimestamp": "Thu 2026-07-02 18:26:34 UTC", "StateChangeTimestampMonotonic": "261847973", "StateDirectoryMode": "0755", "StatusErrno": "0", "StopWhenUnneeded": "no", "SubState": "running", "SuccessAction": "none", "SyslogFacility": "3", "SyslogLevel": "6", "SyslogLevelPrefix": "yes", "SyslogPriority": "30", "SystemCallErrorNumber": "2147483646", "TTYReset": "no", "TTYVHangup": "no", "TTYVTDisallocate": "no", "TasksAccounting": "yes", "TasksCurrent": "2", "TasksMax": "4644", "TimeoutAbortUSec": "1min 30s", "TimeoutCleanUSec": "infinity", "TimeoutStartFailureMode": "terminate", "TimeoutStartUSec": "1min 30s", "TimeoutStopFailureMode": "terminate", "TimeoutStopUSec": "1min 30s", "TimerSlackNSec": "50000", "Transient": "no", "Type": "forking", "UID": "[not set]", "UMask": "0022", "UnitFilePreset": "enabled", "UnitFileState": "enabled", "UtmpMode": "init", "WantedBy": "multi-user.target", "WatchdogSignal": "6", "WatchdogTimestampMonotonic": "0", "WatchdogUSec": "0"}} 2026-07-02 18:26:41.582037 | ubuntu-noble | The following NEW packages will be installed: 2026-07-02 18:26:41.582121 | ubuntu-noble | audispd-plugins 2026-07-02 18:26:41.582195 | ubuntu-noble | 0 upgraded, 1 newly installed, 0 to remove and 5 not upgraded. 2026-07-02 18:26:41.582359 | ubuntu-noble | changed: [molecule-auditd] => {"cache_update_time": 1783016690, "cache_updated": false, "changed": true, "stderr": "debconf: delaying package configuration, since apt-utils is not installed\n", "stderr_lines": ["debconf: delaying package configuration, since apt-utils is not installed"], "stdout": "Reading package lists...\nBuilding dependency tree...\nReading state information...\nThe following NEW packages will be installed:\n audispd-plugins\n0 upgraded, 1 newly installed, 0 to remove and 5 not upgraded.\nNeed to get 38.8 kB of archives.\nAfter this operation, 131 kB of additional disk space will be used.\nGet:1 http://archive.ubuntu.com/ubuntu noble-updates/universe amd64 audispd-plugins amd64 1:3.1.2-2.1build1.1 [38.8 kB]\nFetched 38.8 kB in 0s (682 kB/s)\nSelecting previously unselected package audispd-plugins.\r\n(Reading database ... \r(Reading database ... 5%\r(Reading database ... 10%\r(Reading database ... 15%\r(Reading database ... 20%\r(Reading database ... 25%\r(Reading database ... 30%\r(Reading database ... 35%\r(Reading database ... 40%\r(Reading database ... 45%\r(Reading database ... 50%\r(Reading database ... 55%\r(Reading database ... 60%\r(Reading database ... 65%\r(Reading database ... 70%\r(Reading database ... 75%\r(Reading database ... 80%\r(Reading database ... 85%\r(Reading database ... 90%\r(Reading database ... 95%\r(Reading database ... 100%\r(Reading database ... 36192 files and directories currently installed.)\r\nPreparing to unpack .../audispd-plugins_1%3a3.1.2-2.1build1.1_amd64.deb ...\r\nUnpacking audispd-plugins (1:3.1.2-2.1build1.1) ...\r\nSetting up audispd-plugins (1:3.1.2-2.1build1.1) ...\r\n", "stdout_lines": ["Reading package lists...", "Building dependency tree...", "Reading state information...", "The following NEW packages will be installed:", " audispd-plugins", "0 upgraded, 1 newly installed, 0 to remove and 5 not upgraded.", "Need to get 38.8 kB of archives.", "After this operation, 131 kB of additional disk space will be used.", "Get:1 http://archive.ubuntu.com/ubuntu noble-updates/universe amd64 audispd-plugins amd64 1:3.1.2-2.1build1.1 [38.8 kB]", "Fetched 38.8 kB in 0s (682 kB/s)", "Selecting previously unselected package audispd-plugins.", "(Reading database ... ", "(Reading database ... 5%", "(Reading database ... 10%", "(Reading database ... 15%", "(Reading database ... 20%", "(Reading database ... 25%", "(Reading database ... 30%", "(Reading database ... 35%", "(Reading database ... 40%", "(Reading database ... 45%", "(Reading database ... 50%", "(Reading database ... 55%", "(Reading database ... 60%", "(Reading database ... 65%", "(Reading database ... 70%", "(Reading database ... 75%", "(Reading database ... 80%", "(Reading database ... 85%", "(Reading database ... 90%", "(Reading database ... 95%", "(Reading database ... 100%", "(Reading database ... 36192 files and directories currently installed.)", "Preparing to unpack .../audispd-plugins_1%3a3.1.2-2.1build1.1_amd64.deb ...", "Unpacking audispd-plugins (1:3.1.2-2.1build1.1) ...", "Setting up audispd-plugins (1:3.1.2-2.1build1.1) ..."]} 2026-07-02 18:26:41.582439 | ubuntu-noble | 2026-07-02 18:26:41.582558 | ubuntu-noble | TASK [auditd : Copy auditd.conf configuration files] *************************** 2026-07-02 18:26:41.886099 | debian-bookworm | 2026-07-02 18:26:41.886119 | debian-bookworm | RUNNING HANDLER [auditd : Generate auditd rules] ******************************* 2026-07-02 18:26:42.238082 | debian-bookworm | changed: [molecule-auditd] => {"changed": true, "cmd": ["augenrules", "--load"], "delta": "0:00:00.100346", "end": "2026-07-02 18:26:42.192336", "msg": "", "rc": 0, "start": "2026-07-02 18:26:42.091990", "stderr": "Unknown user: chrony\nThere was an error in line 24 of /etc/audit/audit.rules\nError sending add rule data request (No such file or directory)\nThere was an error in line 28 of /etc/audit/audit.rules\nUnknown user: ntp\nThere was an error in line 44 of /etc/audit/audit.rules\nError sending add rule data request (No such file or directory)\nThere was an error in line 83 of /etc/audit/audit.rules\nError sending add rule data request (No such file or directory)\nThere was an error in line 84 of /etc/audit/audit.rules\nError sending add rule data request (No such file or directory)\nThere was an error in line 112 of /etc/audit/audit.rules\nError sending add rule data request (No such file or directory)\nThere was an error in line 115 of /etc/audit/audit.rules\nError sending add rule data request (No such file or directory)\nThere was an error in line 176 of /etc/audit/audit.rules\nError sending add rule data request (No such file or directory)\nThere was an error in line 177 of /etc/audit/audit.rules\nError sending add rule data request (No such file or directory)\nThere was an error in line 178 of /etc/audit/audit.rules\nError sending add rule data request (No such file or directory)\nThere was an error in line 179 of /etc/audit/audit.rules\nError sending add rule data request (No such file or directory)\nThere was an error in line 180 of /etc/audit/audit.rules\nError sending add rule data request (No such file or directory)\nThere was an error in line 217 of /etc/audit/audit.rules\nError sending add rule data request (No such file or directory)\nThere was an error in line 218 of /etc/audit/audit.rules\nError sending add rule data request (No such file or directory)\nThere was an error in line 234 of /etc/audit/audit.rules\nError sending add rule data request (No such file or directory)\nThere was an error in line 285 of /etc/audit/audit.rules\nError sending add rule data request (No such file or directory)\nThere was an error in line 286 of /etc/audit/audit.rules\nError sending add rule data request (No such file or directory)\nThere was an error in line 324 of /etc/audit/audit.rules\nError sending add rule data request (No such file or directory)\nThere was an error in line 325 of /etc/audit/audit.rules\nError sending add rule data request (No such file or directory)\nThere was an error in line 346 of /etc/audit/audit.rules\nparameter passed without an option given\nThere was an error in line 347 of /etc/audit/audit.rules\nparameter passed without an option given\nThere was an error in line 348 of /etc/audit/audit.rules\nparameter passed without an option given\nThere was an error in line 349 of /etc/audit/audit.rules\nparameter passed without an option given\nThere was an error in line 350 of /etc/audit/audit.rules\nparameter passed without an option given\nThere was an error in line 351 of /etc/audit/audit.rules\nError sending add rule data request (No such file or directory)\nThere was an error in line 359 of /etc/audit/audit.rules", "stderr_lines": ["Unknown user: chrony", "There was an error in line 24 of /etc/audit/audit.rules", "Error sending add rule data request (No such file or directory)", "There was an error in line 28 of /etc/audit/audit.rules", "Unknown user: ntp", "There was an error in line 44 of /etc/audit/audit.rules", "Error sending add rule data request (No such file or directory)", "There was an error in line 83 of /etc/audit/audit.rules", "Error sending add rule data request (No such file or directory)", "There was an error in line 84 of /etc/audit/audit.rules", "Error sending add rule data request (No such file or directory)", "There was an error in line 112 of /etc/audit/audit.rules", "Error sending add rule data request (No such file or directory)", "There was an error in line 115 of /etc/audit/audit.rules", "Error sending add rule data request (No such file or directory)", "There was an error in line 176 of /etc/audit/audit.rules", "Error sending add rule data request (No such file or directory)", "There was an error in line 177 of /etc/audit/audit.rules", "Error sending add rule data request (No such file or directory)", "There was an error in line 178 of /etc/audit/audit.rules", "Error sending add rule data request (No such file or directory)", "There was an error in line 179 of /etc/audit/audit.rules", "Error sending add rule data request (No such file or directory)", "There was an error in line 180 of /etc/audit/audit.rules", "Error sending add rule data request (No such file or directory)", "There was an error in line 217 of /etc/audit/audit.rules", "Error sending add rule data request (No such file or directory)", "There was an error in line 218 of /etc/audit/audit.rules", "Error sending add rule data request (No such file or directory)", "There was an error in line 234 of /etc/audit/audit.rules", "Error sending add rule data request (No such file or directory)", "There was an error in line 285 of /etc/audit/audit.rules", "Error sending add rule data request (No such file or directory)", "There was an error in line 286 of /etc/audit/audit.rules", "Error sending add rule data request (No such file or directory)", "There was an error in line 324 of /etc/audit/audit.rules", "Error sending add rule data request (No such file or directory)", "There was an error in line 325 of /etc/audit/audit.rules", "Error sending add rule data request (No such file or directory)", "There was an error in line 346 of /etc/audit/audit.rules", "parameter passed without an option given", "There was an error in line 347 of /etc/audit/audit.rules", "parameter passed without an option given", "There was an error in line 348 of /etc/audit/audit.rules", "parameter passed without an option given", "There was an error in line 349 of /etc/audit/audit.rules", "parameter passed without an option given", "There was an error in line 350 of /etc/audit/audit.rules", "parameter passed without an option given", "There was an error in line 351 of /etc/audit/audit.rules", "Error sending add rule data request (No such file or directory)", "There was an error in line 359 of /etc/audit/audit.rules"], "stdout": "/usr/sbin/augenrules: No change\nNo rules\nenabled 1\nfailure 1\npid 2806\nrate_limit 0\nbacklog_limit 8192\nlost 0\nbacklog 737\nbacklog_wait_time 60000\nbacklog_wait_time_actual 0\nenabled 1\nfailure 1\npid 2806\nrate_limit 0\nbacklog_limit 8192\nlost 0\nbacklog 628\nbacklog_wait_time 60000\nbacklog_wait_time_actual 0", "stdout_lines": ["/usr/sbin/augenrules: No change", "No rules", "enabled 1", "failure 1", "pid 2806", "rate_limit 0", "backlog_limit 8192", "lost 0", "backlog 737", "backlog_wait_time 60000", "backlog_wait_time_actual 0", "enabled 1", "failure 1", "pid 2806", "rate_limit 0", "backlog_limit 8192", "lost 0", "backlog 628", "backlog_wait_time 60000", "backlog_wait_time_actual 0"]} 2026-07-02 18:26:42.238155 | debian-bookworm | 2026-07-02 18:26:42.238162 | debian-bookworm | RUNNING HANDLER [auditd : Restart auditd service] ****************************** 2026-07-02 18:26:42.974465 | debian-bookworm | changed: [molecule-auditd] => {"changed": true, "name": "auditd", "state": "started", "status": {"ActiveEnterTimestamp": "Thu 2026-07-02 18:26:41 UTC", "ActiveEnterTimestampMonotonic": "269330983", "ActiveExitTimestamp": "Thu 2026-07-02 18:26:41 UTC", "ActiveExitTimestampMonotonic": "269172337", "ActiveState": "active", "After": "local-fs.target system.slice systemd-journald.socket systemd-tmpfiles-setup.service", "AllowIsolate": "no", "AssertResult": "yes", "AssertTimestamp": "Thu 2026-07-02 18:26:41 UTC", "AssertTimestampMonotonic": "269214799", "Before": "ssh.service systemd-update-utmp.service sysinit.target shutdown.target", "BlockIOAccounting": "no", "BlockIOWeight": "[not set]", "CPUAccounting": "yes", "CPUAffinityFromNUMA": "no", "CPUQuotaPerSecUSec": "infinity", "CPUQuotaPeriodUSec": "infinity", "CPUSchedulingPolicy": "0", "CPUSchedulingPriority": "0", "CPUSchedulingResetOnFork": "no", "CPUShares": "[not set]", "CPUUsageNSec": "158670000", "CPUWeight": "[not set]", "CacheDirectoryMode": "0755", "CanFreeze": "yes", "CanIsolate": "no", "CanReload": "no", "CanStart": "yes", "CanStop": "yes", "CapabilityBoundingSet": "cap_chown cap_dac_override cap_dac_read_search cap_fowner cap_fsetid cap_kill cap_setgid cap_setuid cap_setpcap cap_linux_immutable cap_net_bind_service cap_net_broadcast cap_net_admin cap_net_raw cap_ipc_lock cap_ipc_owner cap_sys_rawio cap_sys_chroot cap_sys_ptrace cap_sys_pacct cap_sys_admin cap_sys_boot cap_sys_nice cap_sys_resource cap_sys_time cap_sys_tty_config cap_mknod cap_lease cap_audit_write cap_audit_control cap_setfcap cap_mac_override cap_mac_admin cap_syslog cap_wake_alarm cap_block_suspend cap_audit_read cap_perfmon cap_bpf cap_checkpoint_restore", "CleanResult": "success", "CollectMode": "inactive", "ConditionResult": "yes", "ConditionTimestamp": "Thu 2026-07-02 18:26:41 UTC", "ConditionTimestampMonotonic": "269214738", "ConfigurationDirectoryMode": "0755", "Conflicts": "shutdown.target", "ControlGroup": "/system.slice/auditd.service", "ControlGroupId": "3289", "ControlPID": "0", "CoredumpFilter": "0x33", "DefaultDependencies": "no", "DefaultMemoryLow": "0", "DefaultMemoryMin": "0", "Delegate": "no", "Description": "Security Auditing Service", "DevicePolicy": "auto", "Documentation": "\"man:auditd(8)\" https://github.com/linux-audit/audit-documentation", "DynamicUser": "no", "ExecMainCode": "0", "ExecMainExitTimestampMonotonic": "0", "ExecMainPID": "2806", "ExecMainStartTimestamp": "Thu 2026-07-02 18:26:41 UTC", "ExecMainStartTimestampMonotonic": "269248843", "ExecMainStatus": "0", "ExecStart": "{ path=/sbin/auditd ; argv[]=/sbin/auditd ; ignore_errors=no ; start_time=[Thu 2026-07-02 18:26:41 UTC] ; stop_time=[Thu 2026-07-02 18:26:41 UTC] ; pid=2805 ; code=exited ; status=0 }", "ExecStartEx": "{ path=/sbin/auditd ; argv[]=/sbin/auditd ; flags= ; start_time=[Thu 2026-07-02 18:26:41 UTC] ; stop_time=[Thu 2026-07-02 18:26:41 UTC] ; pid=2805 ; code=exited ; status=0 }", "ExecStartPost": "{ path=/sbin/augenrules ; argv[]=/sbin/augenrules --load ; ignore_errors=yes ; start_time=[Thu 2026-07-02 18:26:41 UTC] ; stop_time=[Thu 2026-07-02 18:26:41 UTC] ; pid=2809 ; code=exited ; status=0 }", "ExecStartPostEx": "{ path=/sbin/augenrules ; argv[]=/sbin/augenrules --load ; flags=ignore-failure ; start_time=[Thu 2026-07-02 18:26:41 UTC] ; stop_time=[Thu 2026-07-02 18:26:41 UTC] ; pid=2809 ; code=exited ; status=0 }", "ExitType": "main", "FailureAction": "none", "FileDescriptorStoreMax": "0", "FinalKillSignal": "9", "FragmentPath": "/lib/systemd/system/auditd.service", "FreezerState": "running", "GID": "[not set]", "GuessMainPID": "yes", "IOAccounting": "no", "IOReadBytes": "18446744073709551615", "IOReadOperations": "18446744073709551615", "IOSchedulingClass": "2", "IOSchedulingPriority": "4", "IOWeight": "[not set]", "IOWriteBytes": "18446744073709551615", "IOWriteOperations": "18446744073709551615", "IPAccounting": "no", "IPEgressBytes": "[no data]", "IPEgressPackets": "[no data]", "IPIngressBytes": "[no data]", "IPIngressPackets": "[no data]", "Id": "auditd.service", "IgnoreOnIsolate": "no", "IgnoreSIGPIPE": "yes", "InactiveEnterTimestamp": "Thu 2026-07-02 18:26:41 UTC", "InactiveEnterTimestampMonotonic": "269213433", "InactiveExitTimestamp": "Thu 2026-07-02 18:26:41 UTC", "InactiveExitTimestampMonotonic": "269228774", "InvocationID": "08e630e2c0134bc5b17724eb8d817329", "JobRunningTimeoutUSec": "infinity", "JobTimeoutAction": "none", "JobTimeoutUSec": "infinity", "KeyringMode": "private", "KillMode": "control-group", "KillSignal": "15", "LimitAS": "infinity", "LimitASSoft": "infinity", "LimitCORE": "infinity", "LimitCORESoft": "0", "LimitCPU": "infinity", "LimitCPUSoft": "infinity", "LimitDATA": "infinity", "LimitDATASoft": "infinity", "LimitFSIZE": "infinity", "LimitFSIZESoft": "infinity", "LimitLOCKS": "infinity", "LimitLOCKSSoft": "infinity", "LimitMEMLOCK": "8388608", "LimitMEMLOCKSoft": "8388608", "LimitMSGQUEUE": "819200", "LimitMSGQUEUESoft": "819200", "LimitNICE": "0", "LimitNICESoft": "0", "LimitNOFILE": "524288", "LimitNOFILESoft": "1024", "LimitNPROC": "15480", "LimitNPROCSoft": "15480", "LimitRSS": "infinity", "LimitRSSSoft": "infinity", "LimitRTPRIO": "0", "LimitRTPRIOSoft": "0", "LimitRTTIME": "infinity", "LimitRTTIMESoft": "infinity", "LimitSIGPENDING": "15480", "LimitSIGPENDINGSoft": "15480", "LimitSTACK": "infinity", "LimitSTACKSoft": "8388608", "LoadState": "loaded", "LockPersonality": "yes", "LogLevelMax": "-1", "LogRateLimitBurst": "0", "LogRateLimitIntervalUSec": "0", "LogsDirectoryMode": "0755", "MainPID": "2806", "ManagedOOMMemoryPressure": "auto", "ManagedOOMMemoryPressureLimit": "0", "ManagedOOMPreference": "none", "ManagedOOMSwap": "auto", "MemoryAccounting": "yes", "MemoryAvailable": "infinity", "MemoryCurrent": "2072576", "MemoryDenyWriteExecute": "yes", "MemoryHigh": "infinity", "MemoryLimit": "infinity", "MemoryLow": "0", "MemoryMax": "infinity", "MemoryMin": "0", "MemorySwapMax": "infinity", "MountAPIVFS": "no", "NFileDescriptorStore": "0", "NRestarts": "0", "NUMAPolicy": "n/a", "Names": "auditd.service", "NeedDaemonReload": "no", "Nice": "0", "NoNewPrivileges": "no", "NonBlocking": "no", "NotifyAccess": "none", "OOMPolicy": "stop", "OOMScoreAdjust": "0", "OnFailureJobMode": "replace", "OnSuccessJobMode": "fail", "PIDFile": "/run/auditd.pid", "Perpetual": "no", "PrivateDevices": "no", "PrivateIPC": "no", "PrivateMounts": "no", "PrivateNetwork": "no", "PrivateTmp": "no", "PrivateUsers": "no", "ProcSubset": "all", "ProtectClock": "no", "ProtectControlGroups": "yes", "ProtectHome": "no", "ProtectHostname": "no", "ProtectKernelLogs": "no", "ProtectKernelModules": "yes", "ProtectKernelTunables": "no", "ProtectProc": "default", "ProtectSystem": "no", "RefuseManualStart": "no", "RefuseManualStop": "no", "ReloadResult": "success", "RemainAfterExit": "no", "RemoveIPC": "no", "Requires": "system.slice", "Restart": "on-failure", "RestartKillSignal": "15", "RestartPreventExitStatus": "2 4 6", "RestartUSec": "100ms", "RestrictNamespaces": "no", "RestrictRealtime": "yes", "RestrictSUIDSGID": "no", "Result": "success", "RootDirectoryStartOnly": "no", "RuntimeDirectoryMode": "0755", "RuntimeDirectoryPreserve": "no", "RuntimeMaxUSec": "infinity", "RuntimeRandomizedExtraUSec": "0", "SameProcessGroup": "no", "SecureBits": "0", "SendSIGHUP": "no", "SendSIGKILL": "yes", "Slice": "system.slice", "StandardError": "inherit", "StandardInput": "null", "StandardOutput": "journal", "StartLimitAction": "none", "StartLimitBurst": "5", "StartLimitIntervalUSec": "10s", "StartupBlockIOWeight": "[not set]", "StartupCPUShares": "[not set]", "StartupCPUWeight": "[not set]", "StartupIOWeight": "[not set]", "StateChangeTimestamp": "Thu 2026-07-02 18:26:41 UTC", "StateChangeTimestampMonotonic": "269330983", "StateDirectoryMode": "0755", "StatusErrno": "0", "StopWhenUnneeded": "no", "SubState": "running", "SuccessAction": "none", "SyslogFacility": "3", "SyslogLevel": "6", "SyslogLevelPrefix": "yes", "SyslogPriority": "30", "SystemCallErrorNumber": "2147483646", "TTYReset": "no", "TTYVHangup": "no", "TTYVTDisallocate": "no", "TasksAccounting": "yes", "TasksCurrent": "2", "TasksMax": "4644", "TimeoutAbortUSec": "1min 30s", "TimeoutCleanUSec": "infinity", "TimeoutStartFailureMode": "terminate", "TimeoutStartUSec": "1min 30s", "TimeoutStopFailureMode": "terminate", "TimeoutStopUSec": "1min 30s", "TimerSlackNSec": "50000", "Transient": "no", "Type": "forking", "UID": "[not set]", "UMask": "0022", "UnitFilePreset": "enabled", "UnitFileState": "enabled", "UtmpMode": "init", "WantedBy": "multi-user.target", "WatchdogSignal": "6", "WatchdogTimestampMonotonic": "0", "WatchdogUSec": "0"}} 2026-07-02 18:26:42.978218 | debian-bookworm | 2026-07-02 18:26:42.978241 | debian-bookworm | PLAY RECAP ********************************************************************* 2026-07-02 18:26:42.978247 | debian-bookworm | molecule-auditd : ok=15 changed=8 unreachable=0 failed=0 skipped=0 rescued=0 ignored=0 2026-07-02 18:26:42.978251 | debian-bookworm | 2026-07-02 18:26:43.046834 | debian-bookworm | INFO [delegated > converge] Executed: Successful 2026-07-02 18:26:43.047272 | debian-bookworm | WARNING Molecule executed 1 scenario (1 missing files) 2026-07-02 18:26:43.046805 | ubuntu-noble | --- before 2026-07-02 18:26:43.046874 | ubuntu-noble | +++ after: /home/zuul/.ansible/tmp/ansible-local-2116o3efp0cd/tmp3_f4sbzc/auditd.conf.j2 2026-07-02 18:26:43.046884 | ubuntu-noble | @@ -0,0 +1,37 @@ 2026-07-02 18:26:43.046891 | ubuntu-noble | +# 2026-07-02 18:26:43.046898 | ubuntu-noble | +# This file controls the configuration of the audit daemon 2026-07-02 18:26:43.046904 | ubuntu-noble | +# 2026-07-02 18:26:43.046910 | ubuntu-noble | + 2026-07-02 18:26:43.046916 | ubuntu-noble | +local_events = yes 2026-07-02 18:26:43.046922 | ubuntu-noble | +write_logs = yes 2026-07-02 18:26:43.046928 | ubuntu-noble | +log_file = /var/log/audit/audit.log 2026-07-02 18:26:43.046941 | ubuntu-noble | +log_group = adm 2026-07-02 18:26:43.046947 | ubuntu-noble | +log_format = RAW 2026-07-02 18:26:43.046987 | ubuntu-noble | +flush = INCREMENTAL_ASYNC 2026-07-02 18:26:43.047082 | ubuntu-noble | +freq = 50 2026-07-02 18:26:43.047182 | ubuntu-noble | +max_log_file = 8 2026-07-02 18:26:43.047277 | ubuntu-noble | +num_logs = 5 2026-07-02 18:26:43.047388 | ubuntu-noble | +priority_boost = 4 2026-07-02 18:26:43.047487 | ubuntu-noble | +disp_qos = lossy 2026-07-02 18:26:43.047594 | ubuntu-noble | +dispatcher = /sbin/audispd 2026-07-02 18:26:43.047694 | ubuntu-noble | +name_format = NONE 2026-07-02 18:26:43.047817 | ubuntu-noble | +##name = mydomain 2026-07-02 18:26:43.047925 | ubuntu-noble | +max_log_file_action = ROTATE 2026-07-02 18:26:43.048027 | ubuntu-noble | +space_left = 12361 2026-07-02 18:26:43.048122 | ubuntu-noble | +space_left_action = email 2026-07-02 18:26:43.048221 | ubuntu-noble | +verify_email = yes 2026-07-02 18:26:43.048317 | ubuntu-noble | +action_mail_acct = root 2026-07-02 18:26:43.048464 | ubuntu-noble | +admin_space_left = 50 2026-07-02 18:26:43.048570 | ubuntu-noble | +admin_space_left_action = SUSPEND 2026-07-02 18:26:43.048668 | ubuntu-noble | +disk_full_action = SUSPEND 2026-07-02 18:26:43.048803 | ubuntu-noble | +disk_error_action = SUSPEND 2026-07-02 18:26:43.048905 | ubuntu-noble | +use_libwrap = yes 2026-07-02 18:26:43.049005 | ubuntu-noble | +##tcp_listen_port = 60 2026-07-02 18:26:43.049105 | ubuntu-noble | +tcp_listen_queue = 5 2026-07-02 18:26:43.049202 | ubuntu-noble | +tcp_max_per_addr = 1 2026-07-02 18:26:43.049304 | ubuntu-noble | +##tcp_client_ports = 1024-65535 2026-07-02 18:26:43.051543 | ubuntu-noble | +tcp_client_max_idle = 0 2026-07-02 18:26:43.051575 | ubuntu-noble | +enable_krb5 = no 2026-07-02 18:26:43.051581 | ubuntu-noble | +krb5_principal = auditd 2026-07-02 18:26:43.051587 | ubuntu-noble | +##krb5_key_file = /etc/audit/audit.key 2026-07-02 18:26:43.051594 | ubuntu-noble | +distribute_network = no 2026-07-02 18:26:43.051600 | ubuntu-noble | 2026-07-02 18:26:43.051619 | ubuntu-noble | changed: [molecule-auditd] => {"changed": true, "checksum": "e902cc6bebf86c17087d153e359a2cc1231672e0", "dest": "/etc/audit/audit.conf", "gid": 0, "group": "root", "md5sum": "69dfd768317bae876a6a78c8aeb5cce1", "mode": "0640", "owner": "root", "size": 806, "src": "/home/zuul/.ansible/tmp/ansible-tmp-1783016801.6066158-2515-161430476126168/.source.conf", "state": "file", "uid": 0} 2026-07-02 18:26:43.051629 | ubuntu-noble | 2026-07-02 18:26:43.051635 | ubuntu-noble | TASK [auditd : Adjust auditd/audispd configurations] *************************** 2026-07-02 18:26:43.548451 | ubuntu-noble | ok: [molecule-auditd] => (item={'parameter': 'active', 'value': 'no', 'config': '/etc/audit/plugins.d/syslog.conf'}) => {"ansible_loop_var": "item", "backup": "", "changed": false, "item": {"config": "/etc/audit/plugins.d/syslog.conf", "parameter": "active", "value": "no"}, "msg": ""} 2026-07-02 18:26:43.548550 | ubuntu-noble | 2026-07-02 18:26:43.548700 | ubuntu-noble | TASK [auditd : Deploy rules for auditd] **************************************** 2026-07-02 18:26:44.496437 | ubuntu-noble | --- before 2026-07-02 18:26:44.496527 | ubuntu-noble | +++ after: /home/zuul/.ansible/tmp/ansible-local-2116o3efp0cd/tmp02jeu9zz/20-neo23x0.rules.j2 2026-07-02 18:26:44.496550 | ubuntu-noble | @@ -0,0 +1,750 @@ 2026-07-02 18:26:44.496625 | ubuntu-noble | +# ___ ___ __ __ 2026-07-02 18:26:44.496816 | ubuntu-noble | +# / | __ ______/ (_) /_____/ / 2026-07-02 18:26:44.497829 | ubuntu-noble | +# / /| |/ / / / __ / / __/ __ / 2026-07-02 18:26:44.497863 | ubuntu-noble | +# / ___ / /_/ / /_/ / / /_/ /_/ / 2026-07-02 18:26:44.497873 | ubuntu-noble | +# /_/ |_\__,_/\__,_/_/\__/\__,_/ 2026-07-02 18:26:44.497882 | ubuntu-noble | +# 2026-07-02 18:26:44.497891 | ubuntu-noble | +# Linux Audit Daemon - Best Practice Configuration 2026-07-02 18:26:44.497900 | ubuntu-noble | +# /etc/audit/audit.rules 2026-07-02 18:26:44.497978 | ubuntu-noble | +# 2026-07-02 18:26:44.498146 | ubuntu-noble | +# Compiled by Florian Roth 2026-07-02 18:26:44.498308 | ubuntu-noble | +# 2026-07-02 18:26:44.498488 | ubuntu-noble | +# Created : 2017/12/05 2026-07-02 18:26:44.498649 | ubuntu-noble | +# Modified : 2023/01/25 2026-07-02 18:26:44.498836 | ubuntu-noble | +# 2026-07-02 18:26:44.499022 | ubuntu-noble | +# Based on rules published here: 2026-07-02 18:26:44.499169 | ubuntu-noble | +# Gov.uk auditd rules 2026-07-02 18:26:44.500786 | ubuntu-noble | +# https://github.com/gds-operations/puppet-auditd/pull/1 2026-07-02 18:26:44.500819 | ubuntu-noble | +# CentOS 7 hardening 2026-07-02 18:26:44.500828 | ubuntu-noble | +# https://highon.coffee/blog/security-harden-centos-7/#auditd---audit-daemon 2026-07-02 18:26:44.500837 | ubuntu-noble | +# Linux audit repo 2026-07-02 18:26:44.500844 | ubuntu-noble | +# https://github.com/linux-audit/audit-userspace/tree/master/rules 2026-07-02 18:26:44.500981 | ubuntu-noble | +# Auditd high performance linux auditing 2026-07-02 18:26:44.501239 | ubuntu-noble | +# https://linux-audit.com/tuning-auditd-high-performance-linux-auditing/ 2026-07-02 18:26:44.501415 | ubuntu-noble | +# 2026-07-02 18:26:44.501579 | ubuntu-noble | +# Further rules 2026-07-02 18:26:44.501835 | ubuntu-noble | +# For PCI DSS compliance see: 2026-07-02 18:26:44.502090 | ubuntu-noble | +# https://github.com/linux-audit/audit-userspace/blob/master/rules/30-pci-dss-v31.rules 2026-07-02 18:26:44.502358 | ubuntu-noble | +# For NISPOM compliance see: 2026-07-02 18:26:44.502600 | ubuntu-noble | +# https://github.com/linux-audit/audit-userspace/blob/master/rules/30-nispom.rules 2026-07-02 18:26:44.502789 | ubuntu-noble | + 2026-07-02 18:26:44.502971 | ubuntu-noble | +# Remove any existing rules 2026-07-02 18:26:44.503136 | ubuntu-noble | +-D 2026-07-02 18:26:44.503293 | ubuntu-noble | + 2026-07-02 18:26:44.503489 | ubuntu-noble | +# Buffer Size 2026-07-02 18:26:44.503654 | ubuntu-noble | +## Feel free to increase this if the machine panic's 2026-07-02 18:26:44.503837 | ubuntu-noble | +-b 8192 2026-07-02 18:26:44.503981 | ubuntu-noble | + 2026-07-02 18:26:44.504121 | ubuntu-noble | +# Failure Mode 2026-07-02 18:26:44.504294 | ubuntu-noble | +## Possible values: 0 (silent), 1 (printk, print a failure message), 2 (panic, halt the system) 2026-07-02 18:26:44.504481 | ubuntu-noble | +-f 1 2026-07-02 18:26:44.504612 | ubuntu-noble | + 2026-07-02 18:26:44.504779 | ubuntu-noble | +# Ignore errors 2026-07-02 18:26:44.504921 | ubuntu-noble | +## e.g. caused by users or files not found in the local environment 2026-07-02 18:26:44.505039 | ubuntu-noble | +-i 2026-07-02 18:26:44.505157 | ubuntu-noble | + 2026-07-02 18:26:44.505284 | ubuntu-noble | +# Self Auditing --------------------------------------------------------------- 2026-07-02 18:26:44.505423 | ubuntu-noble | + 2026-07-02 18:26:44.505549 | ubuntu-noble | +## Audit the audit logs 2026-07-02 18:26:44.505682 | ubuntu-noble | +### Successful and unsuccessful attempts to read information from the audit records 2026-07-02 18:26:44.505843 | ubuntu-noble | +-w /var/log/audit/ -p wra -k auditlog 2026-07-02 18:26:44.506773 | ubuntu-noble | +-w /var/audit/ -p wra -k auditlog 2026-07-02 18:26:44.506799 | ubuntu-noble | + 2026-07-02 18:26:44.506806 | ubuntu-noble | +## Auditd configuration 2026-07-02 18:26:44.506813 | ubuntu-noble | +### Modifications to audit configuration that occur while the audit collection functions are operating 2026-07-02 18:26:44.506820 | ubuntu-noble | +-w /etc/audit/ -p wa -k auditconfig 2026-07-02 18:26:44.506825 | ubuntu-noble | +-w /etc/libaudit.conf -p wa -k auditconfig 2026-07-02 18:26:44.506831 | ubuntu-noble | +-w /etc/audisp/ -p wa -k audispconfig 2026-07-02 18:26:44.506840 | ubuntu-noble | + 2026-07-02 18:26:44.506956 | ubuntu-noble | +## Monitor for use of audit management tools 2026-07-02 18:26:44.507083 | ubuntu-noble | +-w /sbin/auditctl -p x -k audittools 2026-07-02 18:26:44.507212 | ubuntu-noble | +-w /sbin/auditd -p x -k audittools 2026-07-02 18:26:44.507352 | ubuntu-noble | +-w /usr/sbin/auditd -p x -k audittools 2026-07-02 18:26:44.507482 | ubuntu-noble | +-w /usr/sbin/augenrules -p x -k audittools 2026-07-02 18:26:44.507602 | ubuntu-noble | + 2026-07-02 18:26:44.507730 | ubuntu-noble | +## Access to all audit trails 2026-07-02 18:26:44.507864 | ubuntu-noble | + 2026-07-02 18:26:44.508001 | ubuntu-noble | +-a always,exit -F path=/usr/sbin/ausearch -F perm=x -k audittools 2026-07-02 18:26:44.508128 | ubuntu-noble | +-a always,exit -F path=/usr/sbin/aureport -F perm=x -k audittools 2026-07-02 18:26:44.508262 | ubuntu-noble | +-a always,exit -F path=/usr/sbin/aulast -F perm=x -k audittools 2026-07-02 18:26:44.508430 | ubuntu-noble | +-a always,exit -F path=/usr/sbin/aulastlogin -F perm=x -k audittools 2026-07-02 18:26:44.508559 | ubuntu-noble | +-a always,exit -F path=/usr/sbin/auvirt -F perm=x -k audittools 2026-07-02 18:26:44.508673 | ubuntu-noble | + 2026-07-02 18:26:44.508813 | ubuntu-noble | +# Filters --------------------------------------------------------------------- 2026-07-02 18:26:44.508927 | ubuntu-noble | + 2026-07-02 18:26:44.509051 | ubuntu-noble | +### We put these early because audit is a first match wins system. 2026-07-02 18:26:44.509162 | ubuntu-noble | + 2026-07-02 18:26:44.509286 | ubuntu-noble | +## Ignore SELinux AVC records 2026-07-02 18:26:44.509421 | ubuntu-noble | +-a always,exclude -F msgtype=AVC 2026-07-02 18:26:44.509532 | ubuntu-noble | + 2026-07-02 18:26:44.509656 | ubuntu-noble | +## Ignore current working directory records 2026-07-02 18:26:44.509794 | ubuntu-noble | +-a always,exclude -F msgtype=CWD 2026-07-02 18:26:44.509906 | ubuntu-noble | + 2026-07-02 18:26:44.510037 | ubuntu-noble | +## Cron jobs fill the logs with stuff we normally don't want (works with SELinux) 2026-07-02 18:26:44.510158 | ubuntu-noble | +-a never,user -F subj_type=crond_t 2026-07-02 18:26:44.510279 | ubuntu-noble | +-a never,exit -F subj_type=crond_t 2026-07-02 18:26:44.510403 | ubuntu-noble | + 2026-07-02 18:26:44.510523 | ubuntu-noble | +## This prevents chrony from overwhelming the logs 2026-07-02 18:26:44.510651 | ubuntu-noble | +-a never,exit -F arch=b64 -S adjtimex -F auid=-1 -F uid=chrony -F subj_type=chronyd_t 2026-07-02 18:26:44.510776 | ubuntu-noble | + 2026-07-02 18:26:44.510903 | ubuntu-noble | +## This is not very interesting and wastes a lot of space if the server is public facing 2026-07-02 18:26:44.511035 | ubuntu-noble | +-a always,exclude -F msgtype=CRYPTO_KEY_USER 2026-07-02 18:26:44.511148 | ubuntu-noble | + 2026-07-02 18:26:44.511267 | ubuntu-noble | +## Open VM Tools 2026-07-02 18:26:44.512780 | ubuntu-noble | +-a exit,never -F arch=b64 -S all -F exe=/usr/bin/vmtoolsd 2026-07-02 18:26:44.512806 | ubuntu-noble | + 2026-07-02 18:26:44.512811 | ubuntu-noble | +## High Volume Event Filter (especially on Linux Workstations) 2026-07-02 18:26:44.512816 | ubuntu-noble | +-a never,exit -F arch=b64 -F dir=/dev/shm -k sharedmemaccess 2026-07-02 18:26:44.512821 | ubuntu-noble | +-a never,exit -F arch=b64 -F dir=/var/lock/lvm -k locklvm 2026-07-02 18:26:44.512825 | ubuntu-noble | + 2026-07-02 18:26:44.512830 | ubuntu-noble | +## FileBeat 2026-07-02 18:26:44.512834 | ubuntu-noble | +-a never,exit -F arch=b64 -F path=/opt/filebeat -k filebeat 2026-07-02 18:26:44.512839 | ubuntu-noble | + 2026-07-02 18:26:44.512843 | ubuntu-noble | +## More information on how to filter events 2026-07-02 18:26:44.512848 | ubuntu-noble | +### https://access.redhat.com/solutions/2482221 2026-07-02 18:26:44.512852 | ubuntu-noble | + 2026-07-02 18:26:44.512856 | ubuntu-noble | +# Rules ----------------------------------------------------------------------- 2026-07-02 18:26:44.512865 | ubuntu-noble | + 2026-07-02 18:26:44.512909 | ubuntu-noble | +## Kernel parameters 2026-07-02 18:26:44.513018 | ubuntu-noble | +-w /etc/sysctl.conf -p wa -k sysctl 2026-07-02 18:26:44.513127 | ubuntu-noble | +-w /etc/sysctl.d -p wa -k sysctl 2026-07-02 18:26:44.513228 | ubuntu-noble | + 2026-07-02 18:26:44.513372 | ubuntu-noble | +## Kernel module loading and unloading 2026-07-02 18:26:44.513461 | ubuntu-noble | +-a always,exit -F perm=x -F auid!=-1 -F path=/sbin/insmod -k modules 2026-07-02 18:26:44.513573 | ubuntu-noble | +-a always,exit -F perm=x -F auid!=-1 -F path=/sbin/modprobe -k modules 2026-07-02 18:26:44.513687 | ubuntu-noble | +-a always,exit -F perm=x -F auid!=-1 -F path=/sbin/rmmod -k modules 2026-07-02 18:26:44.513836 | ubuntu-noble | +-a always,exit -F arch=b64 -S finit_module -S init_module -S delete_module -F auid!=-1 -k modules 2026-07-02 18:26:44.513940 | ubuntu-noble | + 2026-07-02 18:26:44.514049 | ubuntu-noble | +## Modprobe configuration 2026-07-02 18:26:44.514168 | ubuntu-noble | +-w /etc/modprobe.conf -p wa -k modprobe 2026-07-02 18:26:44.514270 | ubuntu-noble | +-w /etc/modprobe.d -p wa -k modprobe 2026-07-02 18:26:44.514413 | ubuntu-noble | + 2026-07-02 18:26:44.514523 | ubuntu-noble | +## KExec usage (all actions) 2026-07-02 18:26:44.514637 | ubuntu-noble | +-a always,exit -F arch=b64 -S kexec_load -k KEXEC 2026-07-02 18:26:44.514759 | ubuntu-noble | + 2026-07-02 18:26:44.514863 | ubuntu-noble | +## Special files 2026-07-02 18:26:44.514970 | ubuntu-noble | +-a always,exit -F arch=b64 -S mknod -S mknodat -k specialfiles 2026-07-02 18:26:44.515068 | ubuntu-noble | + 2026-07-02 18:26:44.515167 | ubuntu-noble | +## Mount operations (only attributable) 2026-07-02 18:26:44.515284 | ubuntu-noble | +-a always,exit -F arch=b64 -S mount -S umount2 -F auid!=-1 -k mount 2026-07-02 18:26:44.515393 | ubuntu-noble | + 2026-07-02 18:26:44.515495 | ubuntu-noble | +### NFS mount 2026-07-02 18:26:44.515604 | ubuntu-noble | +-a always,exit -F path=/sbin/mount.nfs -F perm=x -F auid>=500 -F auid!=4294967295 -k T1078_Valid_Accounts 2026-07-02 18:26:44.515712 | ubuntu-noble | +-a always,exit -F path=/usr/sbin/mount.nfs -F perm=x -F auid>=500 -F auid!=4294967295 -k T1078_Valid_Accounts 2026-07-02 18:26:44.515838 | ubuntu-noble | + 2026-07-02 18:26:44.515942 | ubuntu-noble | +## Change swap (only attributable) 2026-07-02 18:26:44.516051 | ubuntu-noble | +-a always,exit -F arch=b64 -S swapon -S swapoff -F auid!=-1 -k swap 2026-07-02 18:26:44.516137 | ubuntu-noble | + 2026-07-02 18:26:44.516230 | ubuntu-noble | +## Time 2026-07-02 18:26:44.516348 | ubuntu-noble | +-a always,exit -F arch=b64 -F uid!=ntp -S adjtimex -S settimeofday -S clock_settime -k time 2026-07-02 18:26:44.516448 | ubuntu-noble | +### Local time zone 2026-07-02 18:26:44.516546 | ubuntu-noble | +-w /etc/localtime -p wa -k localtime 2026-07-02 18:26:44.516639 | ubuntu-noble | + 2026-07-02 18:26:44.516786 | ubuntu-noble | +## Stunnel 2026-07-02 18:26:44.516856 | ubuntu-noble | +-w /usr/sbin/stunnel -p x -k stunnel 2026-07-02 18:26:44.516958 | ubuntu-noble | +-w /usr/bin/stunnel -p x -k stunnel 2026-07-02 18:26:44.517102 | ubuntu-noble | + 2026-07-02 18:26:44.517217 | ubuntu-noble | +## Cron configuration & scheduled jobs 2026-07-02 18:26:44.517356 | ubuntu-noble | +-w /etc/cron.allow -p wa -k cron 2026-07-02 18:26:44.517458 | ubuntu-noble | +-w /etc/cron.deny -p wa -k cron 2026-07-02 18:26:44.517561 | ubuntu-noble | +-w /etc/cron.d/ -p wa -k cron 2026-07-02 18:26:44.517659 | ubuntu-noble | +-w /etc/cron.daily/ -p wa -k cron 2026-07-02 18:26:44.517775 | ubuntu-noble | +-w /etc/cron.hourly/ -p wa -k cron 2026-07-02 18:26:44.517881 | ubuntu-noble | +-w /etc/cron.monthly/ -p wa -k cron 2026-07-02 18:26:44.517974 | ubuntu-noble | +-w /etc/cron.weekly/ -p wa -k cron 2026-07-02 18:26:44.518075 | ubuntu-noble | +-w /etc/crontab -p wa -k cron 2026-07-02 18:26:44.518214 | ubuntu-noble | +-w /var/spool/cron/ -p wa -k cron 2026-07-02 18:26:44.518348 | ubuntu-noble | + 2026-07-02 18:26:44.518452 | ubuntu-noble | +## User, group, password databases 2026-07-02 18:26:44.518603 | ubuntu-noble | +-w /etc/group -p wa -k etcgroup 2026-07-02 18:26:44.519771 | ubuntu-noble | +-w /etc/passwd -p wa -k etcpasswd 2026-07-02 18:26:44.519794 | ubuntu-noble | +-w /etc/gshadow -k etcgroup 2026-07-02 18:26:44.519798 | ubuntu-noble | +-w /etc/shadow -k etcpasswd 2026-07-02 18:26:44.519802 | ubuntu-noble | +-w /etc/security/opasswd -k opasswd 2026-07-02 18:26:44.519806 | ubuntu-noble | + 2026-07-02 18:26:44.519810 | ubuntu-noble | +## Sudoers file changes 2026-07-02 18:26:44.519814 | ubuntu-noble | +-w /etc/sudoers -p wa -k actions 2026-07-02 18:26:44.519818 | ubuntu-noble | +-w /etc/sudoers.d/ -p wa -k actions 2026-07-02 18:26:44.519822 | ubuntu-noble | + 2026-07-02 18:26:44.519892 | ubuntu-noble | +## Passwd 2026-07-02 18:26:44.520038 | ubuntu-noble | +-w /usr/bin/passwd -p x -k passwd_modification 2026-07-02 18:26:44.520188 | ubuntu-noble | + 2026-07-02 18:26:44.520390 | ubuntu-noble | +## Tools to change group identifiers 2026-07-02 18:26:44.520551 | ubuntu-noble | +-w /usr/sbin/groupadd -p x -k group_modification 2026-07-02 18:26:44.520707 | ubuntu-noble | +-w /usr/sbin/groupmod -p x -k group_modification 2026-07-02 18:26:44.520894 | ubuntu-noble | +-w /usr/sbin/addgroup -p x -k group_modification 2026-07-02 18:26:44.521046 | ubuntu-noble | +-w /usr/sbin/useradd -p x -k user_modification 2026-07-02 18:26:44.521182 | ubuntu-noble | +-w /usr/sbin/userdel -p x -k user_modification 2026-07-02 18:26:44.521294 | ubuntu-noble | +-w /usr/sbin/usermod -p x -k user_modification 2026-07-02 18:26:44.521411 | ubuntu-noble | +-w /usr/sbin/adduser -p x -k user_modification 2026-07-02 18:26:44.521510 | ubuntu-noble | + 2026-07-02 18:26:44.521610 | ubuntu-noble | +## Login configuration and information 2026-07-02 18:26:44.521711 | ubuntu-noble | +-w /etc/login.defs -p wa -k login 2026-07-02 18:26:44.521837 | ubuntu-noble | +-w /etc/securetty -p wa -k login 2026-07-02 18:26:44.521943 | ubuntu-noble | +-w /var/log/faillog -p wa -k login 2026-07-02 18:26:44.522044 | ubuntu-noble | +-w /var/log/lastlog -p wa -k login 2026-07-02 18:26:44.522144 | ubuntu-noble | +-w /var/log/tallylog -p wa -k login 2026-07-02 18:26:44.522241 | ubuntu-noble | + 2026-07-02 18:26:44.522378 | ubuntu-noble | +## Network Environment 2026-07-02 18:26:44.522504 | ubuntu-noble | +### Changes to hostname 2026-07-02 18:26:44.522614 | ubuntu-noble | +-a always,exit -F arch=b64 -S sethostname -S setdomainname -k network_modifications 2026-07-02 18:26:44.522705 | ubuntu-noble | + 2026-07-02 18:26:44.522824 | ubuntu-noble | +### Detect Remote Shell Use 2026-07-02 18:26:44.522929 | ubuntu-noble | +-a always,exit -F arch=b64 -F exe=/bin/bash -F success=1 -S connect -k "remote_shell" 2026-07-02 18:26:44.523034 | ubuntu-noble | +-a always,exit -F arch=b64 -F exe=/usr/bin/bash -F success=1 -S connect -k "remote_shell" 2026-07-02 18:26:44.523129 | ubuntu-noble | + 2026-07-02 18:26:44.523230 | ubuntu-noble | +### Successful IPv4 Connections 2026-07-02 18:26:44.523364 | ubuntu-noble | +-a always,exit -F arch=b64 -S connect -F a2=16 -F success=1 -F key=network_connect_4 2026-07-02 18:26:44.523451 | ubuntu-noble | + 2026-07-02 18:26:44.523552 | ubuntu-noble | +### Successful IPv6 Connections 2026-07-02 18:26:44.523654 | ubuntu-noble | +-a always,exit -F arch=b64 -S connect -F a2=28 -F success=1 -F key=network_connect_6 2026-07-02 18:26:44.523803 | ubuntu-noble | + 2026-07-02 18:26:44.523912 | ubuntu-noble | +### Changes to other files 2026-07-02 18:26:44.524015 | ubuntu-noble | +-w /etc/hosts -p wa -k network_modifications 2026-07-02 18:26:44.524118 | ubuntu-noble | +-w /etc/sysconfig/network -p wa -k network_modifications 2026-07-02 18:26:44.525288 | ubuntu-noble | +-w /etc/sysconfig/network-scripts -p w -k network_modifications 2026-07-02 18:26:44.525325 | ubuntu-noble | +-w /etc/network/ -p wa -k network 2026-07-02 18:26:44.525330 | ubuntu-noble | +-a always,exit -F dir=/etc/NetworkManager/ -F perm=wa -k network_modifications 2026-07-02 18:26:44.525334 | ubuntu-noble | + 2026-07-02 18:26:44.525337 | ubuntu-noble | +### Changes to issue 2026-07-02 18:26:44.525341 | ubuntu-noble | +-w /etc/issue -p wa -k etcissue 2026-07-02 18:26:44.525345 | ubuntu-noble | +-w /etc/issue.net -p wa -k etcissue 2026-07-02 18:26:44.525348 | ubuntu-noble | + 2026-07-02 18:26:44.525351 | ubuntu-noble | +## System startup scripts 2026-07-02 18:26:44.525355 | ubuntu-noble | +-w /etc/inittab -p wa -k init 2026-07-02 18:26:44.525359 | ubuntu-noble | +-w /etc/init.d/ -p wa -k init 2026-07-02 18:26:44.525366 | ubuntu-noble | +-w /etc/init/ -p wa -k init 2026-07-02 18:26:44.525447 | ubuntu-noble | + 2026-07-02 18:26:44.525553 | ubuntu-noble | +## Library search paths 2026-07-02 18:26:44.525671 | ubuntu-noble | +-w /etc/ld.so.conf -p wa -k libpath 2026-07-02 18:26:44.525788 | ubuntu-noble | +-w /etc/ld.so.conf.d -p wa -k libpath 2026-07-02 18:26:44.525881 | ubuntu-noble | + 2026-07-02 18:26:44.525987 | ubuntu-noble | +## Systemwide library preloads (LD_PRELOAD) 2026-07-02 18:26:44.526087 | ubuntu-noble | +-w /etc/ld.so.preload -p wa -k systemwide_preloads 2026-07-02 18:26:44.526183 | ubuntu-noble | + 2026-07-02 18:26:44.526278 | ubuntu-noble | +## Pam configuration 2026-07-02 18:26:44.526388 | ubuntu-noble | +-w /etc/pam.d/ -p wa -k pam 2026-07-02 18:26:44.526494 | ubuntu-noble | +-w /etc/security/limits.conf -p wa -k pam 2026-07-02 18:26:44.526593 | ubuntu-noble | +-w /etc/security/limits.d -p wa -k pam 2026-07-02 18:26:44.526692 | ubuntu-noble | +-w /etc/security/pam_env.conf -p wa -k pam 2026-07-02 18:26:44.526808 | ubuntu-noble | +-w /etc/security/namespace.conf -p wa -k pam 2026-07-02 18:26:44.526910 | ubuntu-noble | +-w /etc/security/namespace.d -p wa -k pam 2026-07-02 18:26:44.527011 | ubuntu-noble | +-w /etc/security/namespace.init -p wa -k pam 2026-07-02 18:26:44.527104 | ubuntu-noble | + 2026-07-02 18:26:44.527204 | ubuntu-noble | +## Mail configuration 2026-07-02 18:26:44.527301 | ubuntu-noble | +-w /etc/aliases -p wa -k mail 2026-07-02 18:26:44.527444 | ubuntu-noble | +-w /etc/postfix/ -p wa -k mail 2026-07-02 18:26:44.527510 | ubuntu-noble | +-w /etc/exim4/ -p wa -k mail 2026-07-02 18:26:44.527604 | ubuntu-noble | + 2026-07-02 18:26:44.527703 | ubuntu-noble | +## SSH configuration 2026-07-02 18:26:44.527832 | ubuntu-noble | +-w /etc/ssh/sshd_config -k sshd 2026-07-02 18:26:44.527935 | ubuntu-noble | +-w /etc/ssh/sshd_config.d -k sshd 2026-07-02 18:26:44.528031 | ubuntu-noble | + 2026-07-02 18:26:44.528169 | ubuntu-noble | +## root ssh key tampering 2026-07-02 18:26:44.528272 | ubuntu-noble | +-w /root/.ssh -p wa -k rootkey 2026-07-02 18:26:44.528399 | ubuntu-noble | + 2026-07-02 18:26:44.528510 | ubuntu-noble | +# Systemd 2026-07-02 18:26:44.528605 | ubuntu-noble | +-w /bin/systemctl -p x -k systemd 2026-07-02 18:26:44.528701 | ubuntu-noble | +-w /etc/systemd/ -p wa -k systemd 2026-07-02 18:26:44.528820 | ubuntu-noble | +-w /usr/lib/systemd -p wa -k systemd 2026-07-02 18:26:44.528912 | ubuntu-noble | + 2026-07-02 18:26:44.529021 | ubuntu-noble | +## https://systemd.network/systemd.generator.html 2026-07-02 18:26:44.529119 | ubuntu-noble | +-w /etc/systemd/system-generators/ -p wa -k systemd_generator 2026-07-02 18:26:44.529222 | ubuntu-noble | +-w /usr/local/lib/systemd/system-generators/ -p wa -k systemd_generator 2026-07-02 18:26:44.529367 | ubuntu-noble | +-w /usr/lib/systemd/system-generators -p wa -k systemd_generator 2026-07-02 18:26:44.529426 | ubuntu-noble | + 2026-07-02 18:26:44.529529 | ubuntu-noble | +-w /etc/systemd/user-generators/ -p wa -k systemd_generator 2026-07-02 18:26:44.529631 | ubuntu-noble | +-w /usr/local/lib/systemd/user-generators/ -p wa -k systemd_generator 2026-07-02 18:26:44.529748 | ubuntu-noble | +-w /lib/systemd/system-generators/ -p wa -k systemd_generator 2026-07-02 18:26:44.529842 | ubuntu-noble | + 2026-07-02 18:26:44.529948 | ubuntu-noble | +## SELinux events that modify the system's Mandatory Access Controls (MAC) 2026-07-02 18:26:44.530048 | ubuntu-noble | +-w /etc/selinux/ -p wa -k mac_policy 2026-07-02 18:26:44.530142 | ubuntu-noble | + 2026-07-02 18:26:44.530242 | ubuntu-noble | +## Critical elements access failures 2026-07-02 18:26:44.530356 | ubuntu-noble | +-a always,exit -F arch=b64 -S open -F dir=/etc -F success=0 -k unauthedfileaccess 2026-07-02 18:26:44.530463 | ubuntu-noble | +-a always,exit -F arch=b64 -S open -F dir=/bin -F success=0 -k unauthedfileaccess 2026-07-02 18:26:44.530565 | ubuntu-noble | +-a always,exit -F arch=b64 -S open -F dir=/sbin -F success=0 -k unauthedfileaccess 2026-07-02 18:26:44.530708 | ubuntu-noble | +-a always,exit -F arch=b64 -S open -F dir=/usr/bin -F success=0 -k unauthedfileaccess 2026-07-02 18:26:44.530786 | ubuntu-noble | +-a always,exit -F arch=b64 -S open -F dir=/usr/sbin -F success=0 -k unauthedfileaccess 2026-07-02 18:26:44.530891 | ubuntu-noble | +-a always,exit -F arch=b64 -S open -F dir=/var -F success=0 -k unauthedfileaccess 2026-07-02 18:26:44.530995 | ubuntu-noble | +-a always,exit -F arch=b64 -S open -F dir=/home -F success=0 -k unauthedfileaccess 2026-07-02 18:26:44.531104 | ubuntu-noble | +-a always,exit -F arch=b64 -S open -F dir=/srv -F success=0 -k unauthedfileaccess 2026-07-02 18:26:44.531197 | ubuntu-noble | + 2026-07-02 18:26:44.531789 | ubuntu-noble | +## Process ID change (switching accounts) applications 2026-07-02 18:26:44.531806 | ubuntu-noble | +-w /bin/su -p x -k priv_esc 2026-07-02 18:26:44.531810 | ubuntu-noble | +-w /usr/bin/sudo -p x -k priv_esc 2026-07-02 18:26:44.531814 | ubuntu-noble | + 2026-07-02 18:26:44.531818 | ubuntu-noble | +## Power state 2026-07-02 18:26:44.531822 | ubuntu-noble | +-w /sbin/shutdown -p x -k power 2026-07-02 18:26:44.531887 | ubuntu-noble | +-w /sbin/poweroff -p x -k power 2026-07-02 18:26:44.532015 | ubuntu-noble | +-w /sbin/reboot -p x -k power 2026-07-02 18:26:44.532434 | ubuntu-noble | +-w /sbin/halt -p x -k power 2026-07-02 18:26:44.532821 | ubuntu-noble | + 2026-07-02 18:26:44.533018 | ubuntu-noble | +## Session initiation information 2026-07-02 18:26:44.533156 | ubuntu-noble | +-w /var/run/utmp -p wa -k session 2026-07-02 18:26:44.533257 | ubuntu-noble | +-w /var/log/btmp -p wa -k session 2026-07-02 18:26:44.533968 | ubuntu-noble | +-w /var/log/wtmp -p wa -k session 2026-07-02 18:26:44.533988 | ubuntu-noble | + 2026-07-02 18:26:44.533992 | ubuntu-noble | +## Discretionary Access Control (DAC) modifications 2026-07-02 18:26:44.533996 | ubuntu-noble | +-a always,exit -F arch=b64 -S chmod -F auid>=1000 -F auid!=-1 -k perm_mod 2026-07-02 18:26:44.534000 | ubuntu-noble | +-a always,exit -F arch=b64 -S chown -F auid>=1000 -F auid!=-1 -k perm_mod 2026-07-02 18:26:44.534004 | ubuntu-noble | +-a always,exit -F arch=b64 -S fchmod -F auid>=1000 -F auid!=-1 -k perm_mod 2026-07-02 18:26:44.534011 | ubuntu-noble | +-a always,exit -F arch=b64 -S fchmodat -F auid>=1000 -F auid!=-1 -k perm_mod 2026-07-02 18:26:44.534076 | ubuntu-noble | +-a always,exit -F arch=b64 -S fchown -F auid>=1000 -F auid!=-1 -k perm_mod 2026-07-02 18:26:44.534182 | ubuntu-noble | +-a always,exit -F arch=b64 -S fchownat -F auid>=1000 -F auid!=-1 -k perm_mod 2026-07-02 18:26:44.534286 | ubuntu-noble | +-a always,exit -F arch=b64 -S fremovexattr -F auid>=1000 -F auid!=-1 -k perm_mod 2026-07-02 18:26:44.534402 | ubuntu-noble | +-a always,exit -F arch=b64 -S fsetxattr -F auid>=1000 -F auid!=-1 -k perm_mod 2026-07-02 18:26:44.534506 | ubuntu-noble | +-a always,exit -F arch=b64 -S lchown -F auid>=1000 -F auid!=-1 -k perm_mod 2026-07-02 18:26:44.534610 | ubuntu-noble | +-a always,exit -F arch=b64 -S lremovexattr -F auid>=1000 -F auid!=-1 -k perm_mod 2026-07-02 18:26:44.534712 | ubuntu-noble | +-a always,exit -F arch=b64 -S lsetxattr -F auid>=1000 -F auid!=-1 -k perm_mod 2026-07-02 18:26:44.534831 | ubuntu-noble | +-a always,exit -F arch=b64 -S removexattr -F auid>=1000 -F auid!=-1 -k perm_mod 2026-07-02 18:26:44.534941 | ubuntu-noble | +-a always,exit -F arch=b64 -S setxattr -F auid>=1000 -F auid!=-1 -k perm_mod 2026-07-02 18:26:44.535049 | ubuntu-noble | + 2026-07-02 18:26:44.535127 | ubuntu-noble | +# Special Rules --------------------------------------------------------------- 2026-07-02 18:26:44.535222 | ubuntu-noble | + 2026-07-02 18:26:44.535349 | ubuntu-noble | +## Reconnaissance 2026-07-02 18:26:44.535466 | ubuntu-noble | +-w /usr/bin/whoami -p x -k recon 2026-07-02 18:26:44.535565 | ubuntu-noble | +-w /usr/bin/id -p x -k recon 2026-07-02 18:26:44.535665 | ubuntu-noble | +-w /bin/hostname -p x -k recon 2026-07-02 18:26:44.535786 | ubuntu-noble | +-w /bin/uname -p x -k recon 2026-07-02 18:26:44.535881 | ubuntu-noble | +-w /etc/issue -p r -k recon 2026-07-02 18:26:44.535980 | ubuntu-noble | +-w /etc/hostname -p r -k recon 2026-07-02 18:26:44.536072 | ubuntu-noble | + 2026-07-02 18:26:44.536176 | ubuntu-noble | +## Suspicious activity 2026-07-02 18:26:44.536273 | ubuntu-noble | +-w /usr/bin/wget -p x -k susp_activity 2026-07-02 18:26:44.536386 | ubuntu-noble | +-w /usr/bin/curl -p x -k susp_activity 2026-07-02 18:26:44.536489 | ubuntu-noble | +-w /usr/bin/base64 -p x -k susp_activity 2026-07-02 18:26:44.536590 | ubuntu-noble | +-w /bin/nc -p x -k susp_activity 2026-07-02 18:26:44.536687 | ubuntu-noble | +-w /bin/netcat -p x -k susp_activity 2026-07-02 18:26:44.536889 | ubuntu-noble | +-w /usr/bin/ncat -p x -k susp_activity 2026-07-02 18:26:44.536995 | ubuntu-noble | +-w /usr/bin/ss -p x -k susp_activity 2026-07-02 18:26:44.537098 | ubuntu-noble | +-w /usr/bin/netstat -p x -k susp_activity 2026-07-02 18:26:44.537214 | ubuntu-noble | +-w /usr/bin/ssh -p x -k susp_activity 2026-07-02 18:26:44.537294 | ubuntu-noble | +-w /usr/bin/scp -p x -k susp_activity 2026-07-02 18:26:44.537429 | ubuntu-noble | +-w /usr/bin/sftp -p x -k susp_activity 2026-07-02 18:26:44.537527 | ubuntu-noble | +-w /usr/bin/ftp -p x -k susp_activity 2026-07-02 18:26:44.537627 | ubuntu-noble | +-w /usr/bin/socat -p x -k susp_activity 2026-07-02 18:26:44.537746 | ubuntu-noble | +-w /usr/bin/wireshark -p x -k susp_activity 2026-07-02 18:26:44.537845 | ubuntu-noble | +-w /usr/bin/tshark -p x -k susp_activity 2026-07-02 18:26:44.537945 | ubuntu-noble | +-w /usr/bin/rawshark -p x -k susp_activity 2026-07-02 18:26:44.538052 | ubuntu-noble | +-w /usr/bin/rdesktop -p x -k susp_activity 2026-07-02 18:26:44.538145 | ubuntu-noble | +-w /usr/local/bin/rdesktop -p x -k susp_activity 2026-07-02 18:26:44.538246 | ubuntu-noble | +-w /usr/bin/wlfreerdp -p x -k susp_activity 2026-07-02 18:26:44.539371 | ubuntu-noble | +-w /usr/bin/xfreerdp -p x -k susp_activity 2026-07-02 18:26:44.539396 | ubuntu-noble | +-w /usr/local/bin/xfreerdp -p x -k susp_activity 2026-07-02 18:26:44.539400 | ubuntu-noble | +-w /usr/bin/nmap -p x -k susp_activity 2026-07-02 18:26:44.539404 | ubuntu-noble | + 2026-07-02 18:26:44.539408 | ubuntu-noble | +## sssd 2026-07-02 18:26:44.539412 | ubuntu-noble | +-a always,exit -F path=/usr/libexec/sssd/p11_child -F perm=x -F auid>=500 -F auid!=4294967295 -k T1078_Valid_Accounts 2026-07-02 18:26:44.539417 | ubuntu-noble | +-a always,exit -F path=/usr/libexec/sssd/krb5_child -F perm=x -F auid>=500 -F auid!=4294967295 -k T1078_Valid_Accounts 2026-07-02 18:26:44.539421 | ubuntu-noble | +-a always,exit -F path=/usr/libexec/sssd/ldap_child -F perm=x -F auid>=500 -F auid!=4294967295 -k T1078_Valid_Accounts 2026-07-02 18:26:44.539426 | ubuntu-noble | +-a always,exit -F path=/usr/libexec/sssd/selinux_child -F perm=x -F auid>=500 -F auid!=4294967295 -k T1078_Valid_Accounts 2026-07-02 18:26:44.539429 | ubuntu-noble | +-a always,exit -F path=/usr/libexec/sssd/proxy_child -F perm=x -F auid>=500 -F auid!=4294967295 -k T1078_Valid_Accounts 2026-07-02 18:26:44.539435 | ubuntu-noble | + 2026-07-02 18:26:44.539519 | ubuntu-noble | +## T1002 Data Compressed 2026-07-02 18:26:44.539611 | ubuntu-noble | + 2026-07-02 18:26:44.539751 | ubuntu-noble | +-w /usr/bin/zip -p x -k Data_Compressed 2026-07-02 18:26:44.539864 | ubuntu-noble | +-w /usr/bin/gzip -p x -k Data_Compressed 2026-07-02 18:26:44.539990 | ubuntu-noble | +-w /usr/bin/tar -p x -k Data_Compressed 2026-07-02 18:26:44.540094 | ubuntu-noble | +-w /usr/bin/bzip2 -p x -k Data_Compressed 2026-07-02 18:26:44.540188 | ubuntu-noble | + 2026-07-02 18:26:44.540288 | ubuntu-noble | +-w /usr/bin/lzip -p x -k Data_Compressed 2026-07-02 18:26:44.540414 | ubuntu-noble | +-w /usr/local/bin/lzip -p x -k Data_Compressed 2026-07-02 18:26:44.540506 | ubuntu-noble | + 2026-07-02 18:26:44.540607 | ubuntu-noble | +-w /usr/bin/lz4 -p x -k Data_Compressed 2026-07-02 18:26:44.540712 | ubuntu-noble | +-w /usr/local/bin/lz4 -p x -k Data_Compressed 2026-07-02 18:26:44.540850 | ubuntu-noble | + 2026-07-02 18:26:44.540959 | ubuntu-noble | +-w /usr/bin/lzop -p x -k Data_Compressed 2026-07-02 18:26:44.541059 | ubuntu-noble | +-w /usr/local/bin/lzop -p x -k Data_Compressed 2026-07-02 18:26:44.541155 | ubuntu-noble | + 2026-07-02 18:26:44.541266 | ubuntu-noble | +-w /usr/bin/plzip -p x -k Data_Compressed 2026-07-02 18:26:44.541376 | ubuntu-noble | +-w /usr/local/bin/plzip -p x -k Data_Compressed 2026-07-02 18:26:44.541469 | ubuntu-noble | + 2026-07-02 18:26:44.541633 | ubuntu-noble | +-w /usr/bin/pbzip2 -p x -k Data_Compressed 2026-07-02 18:26:44.541726 | ubuntu-noble | +-w /usr/local/bin/pbzip2 -p x -k Data_Compressed 2026-07-02 18:26:44.541875 | ubuntu-noble | + 2026-07-02 18:26:44.542020 | ubuntu-noble | +-w /usr/bin/lbzip2 -p x -k Data_Compressed 2026-07-02 18:26:44.542170 | ubuntu-noble | +-w /usr/local/bin/lbzip2 -p x -k Data_Compressed 2026-07-02 18:26:44.542285 | ubuntu-noble | + 2026-07-02 18:26:44.542400 | ubuntu-noble | +-w /usr/bin/pixz -p x -k Data_Compressed 2026-07-02 18:26:44.542501 | ubuntu-noble | +-w /usr/local/bin/pixz -p x -k Data_Compressed 2026-07-02 18:26:44.542598 | ubuntu-noble | + 2026-07-02 18:26:44.542714 | ubuntu-noble | +-w /usr/bin/pigz -p x -k Data_Compressed 2026-07-02 18:26:44.542833 | ubuntu-noble | +-w /usr/local/bin/pigz -p x -k Data_Compressed 2026-07-02 18:26:44.542931 | ubuntu-noble | +-w /usr/bin/unpigz -p x -k Data_Compressed 2026-07-02 18:26:44.543033 | ubuntu-noble | +-w /usr/local/bin/unpigz -p x -k Data_Compressed 2026-07-02 18:26:44.543128 | ubuntu-noble | + 2026-07-02 18:26:44.543228 | ubuntu-noble | +-w /usr/bin/zstd -p x -k Data_Compressed 2026-07-02 18:26:44.543377 | ubuntu-noble | +-w /usr/local/bin/zstd -p x -k Data_Compressed 2026-07-02 18:26:44.543471 | ubuntu-noble | + 2026-07-02 18:26:44.543573 | ubuntu-noble | +## Added to catch netcat on Ubuntu 2026-07-02 18:26:44.543681 | ubuntu-noble | +-w /bin/nc.openbsd -p x -k susp_activity 2026-07-02 18:26:44.543826 | ubuntu-noble | +-w /bin/nc.traditional -p x -k susp_activity 2026-07-02 18:26:44.543946 | ubuntu-noble | + 2026-07-02 18:26:44.544037 | ubuntu-noble | +## Sbin suspicious activity 2026-07-02 18:26:44.544139 | ubuntu-noble | +-w /sbin/iptables -p x -k sbin_susp 2026-07-02 18:26:44.544228 | ubuntu-noble | +-w /sbin/ip6tables -p x -k sbin_susp 2026-07-02 18:26:44.544351 | ubuntu-noble | +-w /sbin/ifconfig -p x -k sbin_susp 2026-07-02 18:26:44.544434 | ubuntu-noble | +-w /usr/sbin/arptables -p x -k sbin_susp 2026-07-02 18:26:44.544532 | ubuntu-noble | +-w /usr/sbin/ebtables -p x -k sbin_susp 2026-07-02 18:26:44.544630 | ubuntu-noble | +-w /sbin/xtables-nft-multi -p x -k sbin_susp 2026-07-02 18:26:44.544748 | ubuntu-noble | +-w /usr/sbin/nft -p x -k sbin_susp 2026-07-02 18:26:44.546528 | ubuntu-noble | +-w /usr/sbin/tcpdump -p x -k sbin_susp 2026-07-02 18:26:44.546554 | ubuntu-noble | +-w /usr/sbin/traceroute -p x -k sbin_susp 2026-07-02 18:26:44.546558 | ubuntu-noble | +-w /usr/sbin/ufw -p x -k sbin_susp 2026-07-02 18:26:44.546561 | ubuntu-noble | + 2026-07-02 18:26:44.546565 | ubuntu-noble | +### kde4 2026-07-02 18:26:44.546570 | ubuntu-noble | +-a always,exit -F path=/usr/libexec/kde4/kpac_dhcp_helper -F perm=x -F auid>=1000 -F auid!=4294967295 -k T1078_Valid_Accounts 2026-07-02 18:26:44.546574 | ubuntu-noble | +-a always,exit -F path=/usr/libexec/kde4/kdesud -F perm=x -F auid>=1000 -F auid!=4294967295 -k T1078_Valid_Accounts 2026-07-02 18:26:44.546578 | ubuntu-noble | + 2026-07-02 18:26:44.546582 | ubuntu-noble | +## dbus-send invocation 2026-07-02 18:26:44.546586 | ubuntu-noble | +### may indicate privilege escalation CVE-2021-3560 2026-07-02 18:26:44.546589 | ubuntu-noble | +-w /usr/bin/dbus-send -p x -k dbus_send 2026-07-02 18:26:44.546593 | ubuntu-noble | +-w /usr/bin/gdbus -p x -k gdubs_call 2026-07-02 18:26:44.546596 | ubuntu-noble | + 2026-07-02 18:26:44.546600 | ubuntu-noble | +## pkexec invocation 2026-07-02 18:26:44.546603 | ubuntu-noble | +### may indicate privilege escalation CVE-2021-4034 2026-07-02 18:26:44.546611 | ubuntu-noble | +-w /usr/bin/pkexec -p x -k pkexec 2026-07-02 18:26:44.546698 | ubuntu-noble | + 2026-07-02 18:26:44.547870 | ubuntu-noble | +## Suspicious shells 2026-07-02 18:26:44.547891 | ubuntu-noble | +-w /bin/ash -p x -k susp_shell 2026-07-02 18:26:44.547895 | ubuntu-noble | +-w /bin/csh -p x -k susp_shell 2026-07-02 18:26:44.547898 | ubuntu-noble | +-w /bin/fish -p x -k susp_shell 2026-07-02 18:26:44.547902 | ubuntu-noble | +-w /bin/tcsh -p x -k susp_shell 2026-07-02 18:26:44.547906 | ubuntu-noble | +-w /bin/tclsh -p x -k susp_shell 2026-07-02 18:26:44.547909 | ubuntu-noble | +-w /bin/xonsh -p x -k susp_shell 2026-07-02 18:26:44.547912 | ubuntu-noble | +-w /usr/local/bin/xonsh -p x -k susp_shell 2026-07-02 18:26:44.547916 | ubuntu-noble | +-w /bin/open -p x -k susp_shell 2026-07-02 18:26:44.547919 | ubuntu-noble | +-w /bin/rbash -p x -k susp_shell 2026-07-02 18:26:44.547926 | ubuntu-noble | + 2026-07-02 18:26:44.548013 | ubuntu-noble | +# Web Server Actvity 2026-07-02 18:26:44.548122 | ubuntu-noble | +## Change the number "33" to the ID of your WebServer user. Default: www-data:x:33:33 2026-07-02 18:26:44.548222 | ubuntu-noble | +-a always,exit -F arch=b64 -S execve -F euid=33 -k detect_execve_www 2026-07-02 18:26:44.548338 | ubuntu-noble | + 2026-07-02 18:26:44.548436 | ubuntu-noble | +### https://clustershell.readthedocs.io/ 2026-07-02 18:26:44.548577 | ubuntu-noble | +-w /bin/clush -p x -k susp_shell 2026-07-02 18:26:44.548678 | ubuntu-noble | +-w /usr/local/bin/clush -p x -k susp_shell 2026-07-02 18:26:44.548899 | ubuntu-noble | +-w /etc/clustershell/clush.conf -p x -k susp_shell 2026-07-02 18:26:44.548924 | ubuntu-noble | + 2026-07-02 18:26:44.549059 | ubuntu-noble | +### https://github.com/tmux/tmux 2026-07-02 18:26:44.549167 | ubuntu-noble | +-w /bin/tmux -p x -k susp_shell 2026-07-02 18:26:44.549271 | ubuntu-noble | +-w /usr/local/bin/tmux -p x -k susp_shell 2026-07-02 18:26:44.549400 | ubuntu-noble | + 2026-07-02 18:26:44.549482 | ubuntu-noble | +## Shell/profile configurations 2026-07-02 18:26:44.549583 | ubuntu-noble | +-w /etc/profile.d/ -p wa -k shell_profiles 2026-07-02 18:26:44.549720 | ubuntu-noble | +-w /etc/profile -p wa -k shell_profiles 2026-07-02 18:26:44.549856 | ubuntu-noble | +-w /etc/shells -p wa -k shell_profiles 2026-07-02 18:26:44.549956 | ubuntu-noble | +-w /etc/bashrc -p wa -k shell_profiles 2026-07-02 18:26:44.550058 | ubuntu-noble | +-w /etc/csh.cshrc -p wa -k shell_profiles 2026-07-02 18:26:44.550163 | ubuntu-noble | +-w /etc/csh.login -p wa -k shell_profiles 2026-07-02 18:26:44.550263 | ubuntu-noble | +-w /etc/fish/ -p wa -k shell_profiles 2026-07-02 18:26:44.550394 | ubuntu-noble | +-w /etc/zsh/ -p wa -k shell_profiles 2026-07-02 18:26:44.550492 | ubuntu-noble | + 2026-07-02 18:26:44.550591 | ubuntu-noble | +### https://github.com/xxh/xxh 2026-07-02 18:26:44.550695 | ubuntu-noble | +-w /usr/local/bin/xxh.bash -p x -k susp_shell 2026-07-02 18:26:44.552428 | ubuntu-noble | +-w /usr/local/bin/xxh.xsh -p x -k susp_shell 2026-07-02 18:26:44.552496 | ubuntu-noble | +-w /usr/local/bin/xxh.zsh -p x -k susp_shell 2026-07-02 18:26:44.553417 | ubuntu-noble | + 2026-07-02 18:26:44.553437 | ubuntu-noble | +## Injection 2026-07-02 18:26:44.553442 | ubuntu-noble | +### These rules watch for code injection by the ptrace facility. 2026-07-02 18:26:44.553446 | ubuntu-noble | +### This could indicate someone trying to do something bad or just debugging 2026-07-02 18:26:44.553450 | ubuntu-noble | +-a always,exit -F arch=b64 -S ptrace -F a0=0x4 -k code_injection 2026-07-02 18:26:44.553454 | ubuntu-noble | +-a always,exit -F arch=b64 -S ptrace -F a0=0x5 -k data_injection 2026-07-02 18:26:44.553457 | ubuntu-noble | +-a always,exit -F arch=b64 -S ptrace -F a0=0x6 -k register_injection 2026-07-02 18:26:44.553476 | ubuntu-noble | +-a always,exit -F arch=b64 -S ptrace -k tracing 2026-07-02 18:26:44.553482 | ubuntu-noble | + 2026-07-02 18:26:44.553572 | ubuntu-noble | +## Anonymous File Creation 2026-07-02 18:26:44.554292 | ubuntu-noble | +### These rules watch the use of memfd_create 2026-07-02 18:26:44.554339 | ubuntu-noble | +### "memfd_create" creates anonymous file and returns a file descriptor to access it 2026-07-02 18:26:44.554345 | ubuntu-noble | +### When combined with "fexecve" can be used to stealthily run binaries in memory without touching disk 2026-07-02 18:26:44.554349 | ubuntu-noble | +-a always,exit -F arch=b64 -S memfd_create -F key=anon_file_create 2026-07-02 18:26:44.554352 | ubuntu-noble | + 2026-07-02 18:26:44.554356 | ubuntu-noble | +## Privilege Abuse 2026-07-02 18:26:44.554360 | ubuntu-noble | +### The purpose of this rule is to detect when an admin may be abusing power by looking in user's home dir. 2026-07-02 18:26:44.554395 | ubuntu-noble | +-a always,exit -F dir=/home -F uid=0 -F auid>=1000 -F auid!=-1 -C auid!=obj_uid -k power_abuse 2026-07-02 18:26:44.554493 | ubuntu-noble | + 2026-07-02 18:26:44.554642 | ubuntu-noble | +# Socket Creations 2026-07-02 18:26:44.554705 | ubuntu-noble | +# will catch both IPv4 and IPv6 2026-07-02 18:26:44.555582 | ubuntu-noble | + 2026-07-02 18:26:44.555603 | ubuntu-noble | +-a always,exit -F arch=b32 -S socket -F a0=2 -k network_socket_created 2026-07-02 18:26:44.555608 | ubuntu-noble | +-a always,exit -F arch=b64 -S socket -F a0=2 -k network_socket_created 2026-07-02 18:26:44.555611 | ubuntu-noble | + 2026-07-02 18:26:44.555615 | ubuntu-noble | +-a always,exit -F arch=b32 -S socket -F a0=10 -k network_socket_created 2026-07-02 18:26:44.555619 | ubuntu-noble | +-a always,exit -F arch=b64 -S socket -F a0=10 -k network_socket_created 2026-07-02 18:26:44.555623 | ubuntu-noble | + 2026-07-02 18:26:44.555811 | ubuntu-noble | +# Software Management --------------------------------------------------------- 2026-07-02 18:26:44.556027 | ubuntu-noble | + 2026-07-02 18:26:44.556185 | ubuntu-noble | +# RPM (Redhat/CentOS) 2026-07-02 18:26:44.556337 | ubuntu-noble | +-w /usr/bin/rpm -p x -k software_mgmt 2026-07-02 18:26:44.556438 | ubuntu-noble | +-w /usr/bin/yum -p x -k software_mgmt 2026-07-02 18:26:44.556533 | ubuntu-noble | + 2026-07-02 18:26:44.556655 | ubuntu-noble | +# DNF (Fedora/RedHat 8/CentOS 8) 2026-07-02 18:26:44.557358 | ubuntu-noble | +-w /usr/bin/dnf -p x -k software_mgmt 2026-07-02 18:26:44.557373 | ubuntu-noble | + 2026-07-02 18:26:44.557535 | ubuntu-noble | +# YAST/Zypper/RPM (SuSE) 2026-07-02 18:26:44.557629 | ubuntu-noble | +-w /sbin/yast -p x -k software_mgmt 2026-07-02 18:26:44.557756 | ubuntu-noble | +-w /sbin/yast2 -p x -k software_mgmt 2026-07-02 18:26:44.559616 | ubuntu-noble | +-w /bin/rpm -p x -k software_mgmt 2026-07-02 18:26:44.559761 | ubuntu-noble | +-w /usr/bin/zypper -k software_mgmt 2026-07-02 18:26:44.559895 | ubuntu-noble | + 2026-07-02 18:26:44.560006 | ubuntu-noble | +# DPKG / APT-GET (Debian/Ubuntu) 2026-07-02 18:26:44.560115 | ubuntu-noble | +-w /usr/bin/dpkg -p x -k software_mgmt 2026-07-02 18:26:44.560205 | ubuntu-noble | +-w /usr/bin/apt -p x -k software_mgmt 2026-07-02 18:26:44.560329 | ubuntu-noble | +-w /usr/bin/apt-add-repository -p x -k software_mgmt 2026-07-02 18:26:44.560487 | ubuntu-noble | +-w /usr/bin/apt-get -p x -k software_mgmt 2026-07-02 18:26:44.560634 | ubuntu-noble | +-w /usr/bin/aptitude -p x -k software_mgmt 2026-07-02 18:26:44.560753 | ubuntu-noble | +-w /usr/bin/wajig -p x -k software_mgmt 2026-07-02 18:26:44.561300 | ubuntu-noble | +-w /usr/bin/snap -p x -k software_mgmt 2026-07-02 18:26:44.561326 | ubuntu-noble | + 2026-07-02 18:26:44.562962 | ubuntu-noble | +# PIP(3) (Python installs) 2026-07-02 18:26:44.562985 | ubuntu-noble | +-w /usr/bin/pip -p x -k third_party_software_mgmt 2026-07-02 18:26:44.562989 | ubuntu-noble | +-w /usr/local/bin/pip -p x -k third_party_software_mgmt 2026-07-02 18:26:44.562993 | ubuntu-noble | +-w /usr/bin/pip3 -p x -k third_party_software_mgmt 2026-07-02 18:26:44.562997 | ubuntu-noble | +-w /usr/local/bin/pip3 -p x -k third_party_software_mgmt 2026-07-02 18:26:44.563001 | ubuntu-noble | +-w /usr/bin/pipx -p x -k third_party_software_mgmt 2026-07-02 18:26:44.563004 | ubuntu-noble | +-w /usr/local/bin/pipx -p x -k third_party_software_mgmt 2026-07-02 18:26:44.563008 | ubuntu-noble | + 2026-07-02 18:26:44.563011 | ubuntu-noble | +# npm 2026-07-02 18:26:44.563015 | ubuntu-noble | +## T1072 third party software 2026-07-02 18:26:44.563018 | ubuntu-noble | +## https://www.npmjs.com 2026-07-02 18:26:44.563022 | ubuntu-noble | +## https://docs.npmjs.com/cli/v6/commands/npm-audit 2026-07-02 18:26:44.563025 | ubuntu-noble | +-w /usr/bin/npm -p x -k third_party_software_mgmt 2026-07-02 18:26:44.563029 | ubuntu-noble | + 2026-07-02 18:26:44.563309 | ubuntu-noble | +# Comprehensive Perl Archive Network (CPAN) (CPAN installs) 2026-07-02 18:26:44.563721 | ubuntu-noble | +## T1072 third party software 2026-07-02 18:26:44.563876 | ubuntu-noble | +## https://www.cpan.org 2026-07-02 18:26:44.563985 | ubuntu-noble | +-w /usr/bin/cpan -p x -k third_party_software_mgmt 2026-07-02 18:26:44.564077 | ubuntu-noble | + 2026-07-02 18:26:44.564181 | ubuntu-noble | +# Ruby (RubyGems installs) 2026-07-02 18:26:44.564282 | ubuntu-noble | +## T1072 third party software 2026-07-02 18:26:44.564395 | ubuntu-noble | +## https://rubygems.org 2026-07-02 18:26:44.564497 | ubuntu-noble | +-w /usr/bin/gem -p x -k third_party_software_mgmt 2026-07-02 18:26:44.564594 | ubuntu-noble | + 2026-07-02 18:26:44.564694 | ubuntu-noble | +# LuaRocks (Lua installs) 2026-07-02 18:26:44.565653 | ubuntu-noble | +## T1072 third party software 2026-07-02 18:26:44.565674 | ubuntu-noble | +## https://luarocks.org 2026-07-02 18:26:44.565690 | ubuntu-noble | +-w /usr/bin/luarocks -p x -k third_party_software_mgmt 2026-07-02 18:26:44.565694 | ubuntu-noble | + 2026-07-02 18:26:44.565698 | ubuntu-noble | +# Pacman (Arch Linux) 2026-07-02 18:26:44.565702 | ubuntu-noble | +## https://wiki.archlinux.org/title/Pacman 2026-07-02 18:26:44.565706 | ubuntu-noble | +## T1072 third party software 2026-07-02 18:26:44.565709 | ubuntu-noble | +-w /etc/pacman.conf -p x -k third_party_software_mgmt 2026-07-02 18:26:44.565716 | ubuntu-noble | +-w /etc/pacman.d -p x -k third_party_software_mgmt 2026-07-02 18:26:44.565835 | ubuntu-noble | + 2026-07-02 18:26:44.565927 | ubuntu-noble | +# Special Software ------------------------------------------------------------ 2026-07-02 18:26:44.566023 | ubuntu-noble | + 2026-07-02 18:26:44.566123 | ubuntu-noble | +## GDS specific secrets 2026-07-02 18:26:44.566227 | ubuntu-noble | +-w /etc/puppet/ssl -p wa -k puppet_ssl 2026-07-02 18:26:44.566336 | ubuntu-noble | + 2026-07-02 18:26:44.566431 | ubuntu-noble | +## IBM Bigfix BESClient 2026-07-02 18:26:44.566541 | ubuntu-noble | +-a always,exit -F arch=b64 -S open -F dir=/opt/BESClient -F success=0 -k soft_besclient 2026-07-02 18:26:44.566643 | ubuntu-noble | +-w /var/opt/BESClient/ -p wa -k soft_besclient 2026-07-02 18:26:44.566766 | ubuntu-noble | + 2026-07-02 18:26:44.566895 | ubuntu-noble | +## CHEF https://www.chef.io/chef/ 2026-07-02 18:26:44.566975 | ubuntu-noble | +-w /etc/chef -p wa -k soft_chef 2026-07-02 18:26:44.567070 | ubuntu-noble | + 2026-07-02 18:26:44.567167 | ubuntu-noble | +## Salt 2026-07-02 18:26:44.567266 | ubuntu-noble | +## https://saltproject.io/ 2026-07-02 18:26:44.567413 | ubuntu-noble | +## https://docs.saltproject.io/en/latest/ref/configuration/master.html 2026-07-02 18:26:44.567495 | ubuntu-noble | +-w /etc/salt -p wa -k soft_salt 2026-07-02 18:26:44.567594 | ubuntu-noble | +-w /usr/local/etc/salt -p wa -k soft_salt 2026-07-02 18:26:44.567690 | ubuntu-noble | + 2026-07-02 18:26:44.567811 | ubuntu-noble | +## Otter 2026-07-02 18:26:44.567908 | ubuntu-noble | +## https://inedo.com/otter 2026-07-02 18:26:44.568008 | ubuntu-noble | +-w /etc/otter -p wa -k soft_otter 2026-07-02 18:26:44.568105 | ubuntu-noble | + 2026-07-02 18:26:44.568199 | ubuntu-noble | +## T1081 Credentials In Files 2026-07-02 18:26:44.568300 | ubuntu-noble | +-w /usr/bin/grep -p x -k string_search 2026-07-02 18:26:44.568413 | ubuntu-noble | +-w /usr/bin/egrep -p x -k string_search 2026-07-02 18:26:44.568515 | ubuntu-noble | +-w /usr/bin/ugrep -p x -k string_search 2026-07-02 18:26:44.568613 | ubuntu-noble | +### macOS 2026-07-02 18:26:44.568721 | ubuntu-noble | +-w /usr/local/bin/grep -p x -k string_search 2026-07-02 18:26:44.568850 | ubuntu-noble | +-w /usr/local/bin/egrep -p x -k string_search 2026-07-02 18:26:44.568953 | ubuntu-noble | +-w /usr/local/bin/ugrep -p x -k string_search 2026-07-02 18:26:44.569061 | ubuntu-noble | + 2026-07-02 18:26:44.569148 | ubuntu-noble | +### https://github.com/tmbinc/bgrep 2026-07-02 18:26:44.569248 | ubuntu-noble | +-w /usr/bin/bgrep -p x -k string_search 2026-07-02 18:26:44.569371 | ubuntu-noble | +### macOS 2026-07-02 18:26:44.569476 | ubuntu-noble | +-w /usr/local/bin/bgrep -p x -k string_search 2026-07-02 18:26:44.569571 | ubuntu-noble | + 2026-07-02 18:26:44.569680 | ubuntu-noble | +### https://github.com/BurntSushi/ripgrep 2026-07-02 18:26:44.569833 | ubuntu-noble | +-w /usr/bin/rg -p x -k string_search 2026-07-02 18:26:44.569912 | ubuntu-noble | +### macOS 2026-07-02 18:26:44.570014 | ubuntu-noble | +-w /usr/local/bin/rg -p x -k string_search 2026-07-02 18:26:44.570142 | ubuntu-noble | + 2026-07-02 18:26:44.570211 | ubuntu-noble | +### https://github.com/awgn/cgrep 2026-07-02 18:26:44.570300 | ubuntu-noble | + 2026-07-02 18:26:44.570418 | ubuntu-noble | +-w /usr/bin/cgrep -p x -k string_search 2026-07-02 18:26:44.570515 | ubuntu-noble | +### macOS 2026-07-02 18:26:44.570618 | ubuntu-noble | +-w /usr/local/bin/cgrep -p x -k string_search 2026-07-02 18:26:44.570711 | ubuntu-noble | + 2026-07-02 18:26:44.570830 | ubuntu-noble | +### https://github.com/jpr5/ngrep 2026-07-02 18:26:44.571226 | ubuntu-noble | +-w /usr/bin/ngrep -p x -k string_search 2026-07-02 18:26:44.571234 | ubuntu-noble | +### macOS 2026-07-02 18:26:44.571237 | ubuntu-noble | +-w /usr/local/bin/ngrep -p x -k string_search 2026-07-02 18:26:44.571241 | ubuntu-noble | + 2026-07-02 18:26:44.571297 | ubuntu-noble | +### https://github.com/vrothberg/vgrep 2026-07-02 18:26:44.571424 | ubuntu-noble | +-w /usr/bin/vgrep -p x -k string_search 2026-07-02 18:26:44.571521 | ubuntu-noble | +### macOS 2026-07-02 18:26:44.571622 | ubuntu-noble | +-w /usr/local/bin/vgrep -p x -k string_search 2026-07-02 18:26:44.571715 | ubuntu-noble | + 2026-07-02 18:26:44.571832 | ubuntu-noble | +### https://github.com/monochromegane/the_platinum_searcher 2026-07-02 18:26:44.571931 | ubuntu-noble | +-w /usr/bin/pt -p x -k string_search 2026-07-02 18:26:44.572024 | ubuntu-noble | +### macOS 2026-07-02 18:26:44.572122 | ubuntu-noble | +-w /usr/local/bin/pt -p x -k string_search 2026-07-02 18:26:44.572216 | ubuntu-noble | + 2026-07-02 18:26:44.572352 | ubuntu-noble | +### https://github.com/gvansickle/ucg 2026-07-02 18:26:44.572426 | ubuntu-noble | +-w /usr/bin/ucg -p x -k string_search 2026-07-02 18:26:44.572523 | ubuntu-noble | +### macOS 2026-07-02 18:26:44.573377 | ubuntu-noble | +-w /usr/local/bin/ucg -p x -k string_search 2026-07-02 18:26:44.573399 | ubuntu-noble | + 2026-07-02 18:26:44.573403 | ubuntu-noble | +### https://github.com/ggreer/the_silver_searcher 2026-07-02 18:26:44.573407 | ubuntu-noble | +-w /usr/bin/ag -p x -k string_search 2026-07-02 18:26:44.573410 | ubuntu-noble | +### macOS 2026-07-02 18:26:44.573414 | ubuntu-noble | +-w /usr/local/bin/ag -p x -k string_search 2026-07-02 18:26:44.573417 | ubuntu-noble | + 2026-07-02 18:26:44.573420 | ubuntu-noble | +### https://github.com/beyondgrep/ack3 2026-07-02 18:26:44.573478 | ubuntu-noble | +### https://beyondgrep.com 2026-07-02 18:26:44.573622 | ubuntu-noble | +-w /usr/bin/ack -p x -k string_search 2026-07-02 18:26:44.573744 | ubuntu-noble | +-w /usr/local/bin/ack -p x -k string_search 2026-07-02 18:26:44.573853 | ubuntu-noble | +-w /usr/bin/semgrep -p x -k string_search 2026-07-02 18:26:44.573950 | ubuntu-noble | +### macOS 2026-07-02 18:26:44.574052 | ubuntu-noble | +-w /usr/local/bin/semgrep -p x -k string_search 2026-07-02 18:26:44.574148 | ubuntu-noble | + 2026-07-02 18:26:44.574247 | ubuntu-noble | +## Docker 2026-07-02 18:26:44.574356 | ubuntu-noble | +-w /usr/bin/dockerd -k docker 2026-07-02 18:26:44.574451 | ubuntu-noble | +-w /usr/bin/docker -k docker 2026-07-02 18:26:44.574551 | ubuntu-noble | +-w /usr/bin/docker-containerd -k docker 2026-07-02 18:26:44.574651 | ubuntu-noble | +-w /usr/bin/docker-runc -k docker 2026-07-02 18:26:44.574783 | ubuntu-noble | +-w /var/lib/docker -p wa -k docker 2026-07-02 18:26:44.574883 | ubuntu-noble | +-w /etc/docker -k docker 2026-07-02 18:26:44.574982 | ubuntu-noble | +-w /etc/sysconfig/docker -k docker 2026-07-02 18:26:44.575091 | ubuntu-noble | +-w /etc/sysconfig/docker-storage -k docker 2026-07-02 18:26:44.575193 | ubuntu-noble | +-w /usr/lib/systemd/system/docker.service -k docker 2026-07-02 18:26:44.575292 | ubuntu-noble | +-w /usr/lib/systemd/system/docker.socket -k docker 2026-07-02 18:26:44.575399 | ubuntu-noble | + 2026-07-02 18:26:44.575498 | ubuntu-noble | +## Virtualization stuff 2026-07-02 18:26:44.575620 | ubuntu-noble | +-w /usr/bin/qemu-system-x86_64 -p x -k qemu-system-x86_64 2026-07-02 18:26:44.575758 | ubuntu-noble | +-w /usr/bin/qemu-img -p x -k qemu-img 2026-07-02 18:26:44.575857 | ubuntu-noble | +-w /usr/bin/qemu-kvm -p x -k qemu-kvm 2026-07-02 18:26:44.575955 | ubuntu-noble | +-w /usr/bin/qemu -p x -k qemu 2026-07-02 18:26:44.576054 | ubuntu-noble | +-w /usr/bin/virtualbox -p x -k virtualbox 2026-07-02 18:26:44.576153 | ubuntu-noble | +-w /usr/bin/virt-manager -p x -k virt-manager 2026-07-02 18:26:44.576254 | ubuntu-noble | +-w /usr/bin/VBoxManage -p x -k VBoxManage 2026-07-02 18:26:44.576380 | ubuntu-noble | + 2026-07-02 18:26:44.576485 | ubuntu-noble | +#### VirtualBox on macOS 2026-07-02 18:26:44.576578 | ubuntu-noble | + 2026-07-02 18:26:44.576707 | ubuntu-noble | +-w /usr/local/bin/VirtualBox -p x -k virt_tool 2026-07-02 18:26:44.576797 | ubuntu-noble | +-w /usr/local/bin/VirtualBoxVM -p x -k virt_tool 2026-07-02 18:26:44.576900 | ubuntu-noble | +-w /usr/local/bin/VBoxManage -p x -k virt_tool 2026-07-02 18:26:44.577033 | ubuntu-noble | +-w /usr/local/bin/VBoxVRDP -p x -k virt_tool 2026-07-02 18:26:44.577102 | ubuntu-noble | +-w /usr/local/bin/VBoxHeadless -p x -k virt_tool 2026-07-02 18:26:44.577221 | ubuntu-noble | +-w /usr/local/bin/vboxwebsrv -p x -k virt_tool 2026-07-02 18:26:44.577298 | ubuntu-noble | +-w /usr/local/bin/VBoxBugReport -p x -k virt_tool 2026-07-02 18:26:44.577428 | ubuntu-noble | +-w /usr/local/bin/VBoxBalloonCtrl -p x -k virt_tool 2026-07-02 18:26:44.577528 | ubuntu-noble | +-w /usr/local/bin/VBoxAutostart -p x -k virt_tool 2026-07-02 18:26:44.577628 | ubuntu-noble | +-w /usr/local/bin/VBoxDTrace -p x -k virt_tool 2026-07-02 18:26:44.577746 | ubuntu-noble | +-w /usr/local/bin/vbox-img -p x -k virt_tool 2026-07-02 18:26:44.577847 | ubuntu-noble | +-w /Library/LaunchDaemons/org.virtualbox.startup.plist -p x -k virt_tool 2026-07-02 18:26:44.577952 | ubuntu-noble | +-w /Library/Application Support/VirtualBox/LaunchDaemons/ -p x -k virt_tool 2026-07-02 18:26:44.578758 | ubuntu-noble | +-w /Library/Application Support/VirtualBox/VBoxDrv.kext/ -p x -k virt_tool 2026-07-02 18:26:44.578775 | ubuntu-noble | +-w /Library/Application Support/VirtualBox/VBoxUSB.kext/ -p x -k virt_tool 2026-07-02 18:26:44.578779 | ubuntu-noble | +-w /Library/Application Support/VirtualBox/VBoxNetFlt.kext/ -p x -k virt_tool 2026-07-02 18:26:44.578783 | ubuntu-noble | +-w /Library/Application Support/VirtualBox/VBoxNetAdp.kext/ -p x -k virt_tool 2026-07-02 18:26:44.578787 | ubuntu-noble | + 2026-07-02 18:26:44.578791 | ubuntu-noble | +### Parallels Desktop on macOS 2026-07-02 18:26:44.578794 | ubuntu-noble | + 2026-07-02 18:26:44.578801 | ubuntu-noble | +-w /usr/local/bin/prl_convert -p x -k virt_tool 2026-07-02 18:26:44.578903 | ubuntu-noble | +-w /usr/local/bin/prl_disk_tool -p x -k virt_tool 2026-07-02 18:26:44.579003 | ubuntu-noble | +-w /usr/local/bin/prl_perf_ctl -p x -k virt_tool 2026-07-02 18:26:44.579138 | ubuntu-noble | +-w /usr/local/bin/prlcore2dmp -p x -k virt_tool 2026-07-02 18:26:44.579214 | ubuntu-noble | +-w /usr/local/bin/prlctl -p x -k virt_tool 2026-07-02 18:26:44.579326 | ubuntu-noble | +-w /usr/local/bin/prlexec -p x -k virt_tool 2026-07-02 18:26:44.579420 | ubuntu-noble | +-w /usr/local/bin/prlsrvctl -p x -k virt_tool 2026-07-02 18:26:44.579519 | ubuntu-noble | +-w /Library/Preferences/Parallels -p x -k virt_tool 2026-07-02 18:26:44.579611 | ubuntu-noble | + 2026-07-02 18:26:44.579708 | ubuntu-noble | +### qemu on macOS 2026-07-02 18:26:44.579815 | ubuntu-noble | + 2026-07-02 18:26:44.579944 | ubuntu-noble | +-w /usr/local/bin/qemu-edid -p x -k virt_tool 2026-07-02 18:26:44.580017 | ubuntu-noble | +-w /usr/local/bin/qemu-img -p x -k virt_tool 2026-07-02 18:26:44.580117 | ubuntu-noble | +-w /usr/local/bin/qemu-io -p x -k virt_tool 2026-07-02 18:26:44.580219 | ubuntu-noble | +-w /usr/local/bin/qemu-nbd -p x -k virt_tool 2026-07-02 18:26:44.580351 | ubuntu-noble | +-w /usr/local/bin/qemu-system-x86_64 -p x -k virt_tool 2026-07-02 18:26:44.580440 | ubuntu-noble | + 2026-07-02 18:26:44.580536 | ubuntu-noble | +## Kubelet 2026-07-02 18:26:44.580632 | ubuntu-noble | +-w /usr/bin/kubelet -k kubelet 2026-07-02 18:26:44.580727 | ubuntu-noble | + 2026-07-02 18:26:44.580841 | ubuntu-noble | +# ipc system call 2026-07-02 18:26:44.580940 | ubuntu-noble | +# /usr/include/linux/ipc.h 2026-07-02 18:26:44.581073 | ubuntu-noble | + 2026-07-02 18:26:44.582762 | ubuntu-noble | +## msgctl 2026-07-02 18:26:44.582786 | ubuntu-noble | +#-a always,exit -S ipc -F a0=14 -k Inter-Process_Communication 2026-07-02 18:26:44.582791 | ubuntu-noble | +## msgget 2026-07-02 18:26:44.582794 | ubuntu-noble | +#-a always,exit -S ipc -F a0=13 -k Inter-Process_Communication 2026-07-02 18:26:44.582807 | ubuntu-noble | +## Use these lines on x86_64, ia64 instead 2026-07-02 18:26:44.582811 | ubuntu-noble | +-a always,exit -F arch=b64 -S msgctl -k Inter-Process_Communication 2026-07-02 18:26:44.582815 | ubuntu-noble | +-a always,exit -F arch=b64 -S msgget -k Inter-Process_Communication 2026-07-02 18:26:44.582818 | ubuntu-noble | + 2026-07-02 18:26:44.582822 | ubuntu-noble | +## semctl 2026-07-02 18:26:44.582826 | ubuntu-noble | +#-a always,exit -S ipc -F a0=3 -k Inter-Process_Communication 2026-07-02 18:26:44.582829 | ubuntu-noble | +## semget 2026-07-02 18:26:44.582833 | ubuntu-noble | +#-a always,exit -S ipc -F a0=2 -k Inter-Process_Communication 2026-07-02 18:26:44.582836 | ubuntu-noble | +## semop 2026-07-02 18:26:44.582840 | ubuntu-noble | +#-a always,exit -S ipc -F a0=1 -k Inter-Process_Communication 2026-07-02 18:26:44.582843 | ubuntu-noble | +## semtimedop 2026-07-02 18:26:44.582847 | ubuntu-noble | +#-a always,exit -S ipc -F a0=4 -k Inter-Process_Communication 2026-07-02 18:26:44.582850 | ubuntu-noble | +## Use these lines on x86_64, ia64 instead 2026-07-02 18:26:44.582857 | ubuntu-noble | +-a always,exit -F arch=b64 -S semctl -k Inter-Process_Communication 2026-07-02 18:26:44.582861 | ubuntu-noble | +-a always,exit -F arch=b64 -S semget -k Inter-Process_Communication 2026-07-02 18:26:44.582961 | ubuntu-noble | +-a always,exit -F arch=b64 -S semop -k Inter-Process_Communication 2026-07-02 18:26:44.583066 | ubuntu-noble | +-a always,exit -F arch=b64 -S semtimedop -k Inter-Process_Communication 2026-07-02 18:26:44.583160 | ubuntu-noble | + 2026-07-02 18:26:44.583258 | ubuntu-noble | +## shmctl 2026-07-02 18:26:44.583382 | ubuntu-noble | +#-a always,exit -S ipc -F a0=24 -k Inter-Process_Communication 2026-07-02 18:26:44.583471 | ubuntu-noble | +## shmget 2026-07-02 18:26:44.583574 | ubuntu-noble | +#-a always,exit -S ipc -F a0=23 -k Inter-Process_Communication 2026-07-02 18:26:44.583673 | ubuntu-noble | +## Use these lines on x86_64, ia64 instead 2026-07-02 18:26:44.583791 | ubuntu-noble | +-a always,exit -F arch=b64 -S shmctl -k Inter-Process_Communication 2026-07-02 18:26:44.583903 | ubuntu-noble | +-a always,exit -F arch=b64 -S shmget -k Inter-Process_Communication 2026-07-02 18:26:44.583996 | ubuntu-noble | + 2026-07-02 18:26:44.584097 | ubuntu-noble | +# High Volume Events ---------------------------------------------------------- 2026-07-02 18:26:44.584189 | ubuntu-noble | + 2026-07-02 18:26:44.584493 | ubuntu-noble | +## Disable these rules if they create too many events in your environment 2026-07-02 18:26:44.584500 | ubuntu-noble | + 2026-07-02 18:26:44.584582 | ubuntu-noble | +## Common Shells 2026-07-02 18:26:44.584685 | ubuntu-noble | +-w /bin/bash -p x -k susp_shell 2026-07-02 18:26:44.584809 | ubuntu-noble | +-w /bin/dash -p x -k susp_shell 2026-07-02 18:26:44.584931 | ubuntu-noble | +-w /bin/busybox -p x -k susp_shell 2026-07-02 18:26:44.585079 | ubuntu-noble | +-w /bin/zsh -p x -k susp_shell 2026-07-02 18:26:44.585230 | ubuntu-noble | +-w /bin/sh -p x -k susp_shell 2026-07-02 18:26:44.585393 | ubuntu-noble | +-w /bin/ksh -p x -k susp_shell 2026-07-02 18:26:44.585527 | ubuntu-noble | + 2026-07-02 18:26:44.585677 | ubuntu-noble | +## Root command executions 2026-07-02 18:26:44.585858 | ubuntu-noble | +-a always,exit -F arch=b64 -F euid=0 -F auid>=1000 -F auid!=-1 -S execve -k rootcmd 2026-07-02 18:26:44.585997 | ubuntu-noble | + 2026-07-02 18:26:44.586156 | ubuntu-noble | +## File Deletion Events by User 2026-07-02 18:26:44.586284 | ubuntu-noble | +-a always,exit -F arch=b64 -S rmdir -S unlink -S unlinkat -S rename -S renameat -F auid>=1000 -F auid!=-1 -k delete 2026-07-02 18:26:44.586405 | ubuntu-noble | + 2026-07-02 18:26:44.586503 | ubuntu-noble | +## File Access 2026-07-02 18:26:44.586604 | ubuntu-noble | +### Unauthorized Access (unsuccessful) 2026-07-02 18:26:44.586711 | ubuntu-noble | +-a always,exit -F arch=b64 -S creat -S open -S openat -S open_by_handle_at -S truncate -S ftruncate -F exit=-EACCES -F auid>=1000 -F auid!=-1 -k file_access 2026-07-02 18:26:44.586837 | ubuntu-noble | +-a always,exit -F arch=b64 -S creat -S open -S openat -S open_by_handle_at -S truncate -S ftruncate -F exit=-EPERM -F auid>=1000 -F auid!=-1 -k file_access 2026-07-02 18:26:44.586930 | ubuntu-noble | + 2026-07-02 18:26:44.587029 | ubuntu-noble | +### Unsuccessful Creation 2026-07-02 18:26:44.587135 | ubuntu-noble | +-a always,exit -F arch=b64 -S mkdir,creat,link,symlink,mknod,mknodat,linkat,symlinkat -F exit=-EACCES -k file_creation 2026-07-02 18:26:44.587241 | ubuntu-noble | +-a always,exit -F arch=b64 -S mkdir,link,symlink,mkdirat -F exit=-EPERM -k file_creation 2026-07-02 18:26:44.587367 | ubuntu-noble | + 2026-07-02 18:26:44.587470 | ubuntu-noble | +### Unsuccessful Modification 2026-07-02 18:26:44.587576 | ubuntu-noble | +-a always,exit -F arch=b64 -S rename -S renameat -S truncate -S chmod -S setxattr -S lsetxattr -S removexattr -S lremovexattr -F exit=-EACCES -k file_modification 2026-07-02 18:26:44.587689 | ubuntu-noble | +-a always,exit -F arch=b64 -S rename -S renameat -S truncate -S chmod -S setxattr -S lsetxattr -S removexattr -S lremovexattr -F exit=-EPERM -k file_modification 2026-07-02 18:26:44.587821 | ubuntu-noble | + 2026-07-02 18:26:44.587920 | ubuntu-noble | +## 32bit API Exploitation 2026-07-02 18:26:44.588022 | ubuntu-noble | +### If you are on a 64 bit platform, everything _should_ be running 2026-07-02 18:26:44.588125 | ubuntu-noble | +### in 64 bit mode. This rule will detect any use of the 32 bit syscalls 2026-07-02 18:26:44.588226 | ubuntu-noble | +### because this might be a sign of someone exploiting a hole in the 32 2026-07-02 18:26:44.588370 | ubuntu-noble | +### bit API. 2026-07-02 18:26:44.588438 | ubuntu-noble | +-a always,exit -F arch=b32 -S all -k 32bit_api 2026-07-02 18:26:44.588532 | ubuntu-noble | + 2026-07-02 18:26:44.588634 | ubuntu-noble | +# Make The Configuration Immutable -------------------------------------------- 2026-07-02 18:26:44.588742 | ubuntu-noble | + 2026-07-02 18:26:44.588837 | ubuntu-noble | +##-e 2 2026-07-02 18:26:44.588930 | ubuntu-noble | 2026-07-02 18:26:44.589176 | ubuntu-noble | changed: [molecule-auditd] => (item=20-neo23x0.rules) => {"ansible_loop_var": "item", "changed": true, "checksum": "9f99ce5c4f891fbf3e2bce06ed4cb97fb9e01f41", "dest": "/etc/audit/rules.d/20-neo23x0.rules", "gid": 0, "group": "root", "item": "20-neo23x0.rules", "md5sum": "6ac57206fd77de34805c3f4d50ef8b1d", "mode": "0644", "owner": "root", "size": 27367, "src": "/home/zuul/.ansible/tmp/ansible-tmp-1783016803.580709-2593-71830686950633/.source.rules", "state": "file", "uid": 0} 2026-07-02 18:26:44.589267 | ubuntu-noble | 2026-07-02 18:26:44.589387 | ubuntu-noble | TASK [auditd : Manage auditd service] ****************************************** 2026-07-02 18:26:45.409182 | ubuntu-noble | ok: [molecule-auditd] => {"changed": false, "enabled": true, "name": "auditd", "state": "started", "status": {"ActiveEnterTimestamp": "Thu 2026-07-02 18:26:37 UTC", "ActiveEnterTimestampMonotonic": "6117789096", "ActiveExitTimestampMonotonic": "0", "ActiveState": "active", "After": "systemd-tmpfiles-setup.service local-fs.target systemd-journald.socket system.slice", "AllowIsolate": "no", "AssertResult": "yes", "AssertTimestamp": "Thu 2026-07-02 18:26:36 UTC", "AssertTimestampMonotonic": "6117705682", "Before": "systemd-update-utmp.service shutdown.target ssh.service sysinit.target", "BlockIOAccounting": "no", "BlockIOWeight": "[not set]", "CPUAccounting": "yes", "CPUAffinityFromNUMA": "no", "CPUQuotaPerSecUSec": "infinity", "CPUQuotaPeriodUSec": "infinity", "CPUSchedulingPolicy": "0", "CPUSchedulingPriority": "0", "CPUSchedulingResetOnFork": "no", "CPUShares": "[not set]", "CPUUsageNSec": "59839000", "CPUWeight": "[not set]", "CacheDirectoryMode": "0755", "CanFreeze": "yes", "CanIsolate": "no", "CanReload": "no", "CanStart": "yes", "CanStop": "yes", "CapabilityBoundingSet": "cap_chown cap_dac_override cap_dac_read_search cap_fowner cap_fsetid cap_kill cap_setgid cap_setuid cap_setpcap cap_linux_immutable cap_net_bind_service cap_net_broadcast cap_net_admin cap_net_raw cap_ipc_lock cap_ipc_owner cap_sys_rawio cap_sys_chroot cap_sys_ptrace cap_sys_pacct cap_sys_admin cap_sys_boot cap_sys_nice cap_sys_resource cap_sys_time cap_sys_tty_config cap_mknod cap_lease cap_audit_write cap_audit_control cap_setfcap cap_mac_override cap_mac_admin cap_syslog cap_wake_alarm cap_block_suspend cap_audit_read cap_perfmon cap_bpf cap_checkpoint_restore", "CleanResult": "success", "CollectMode": "inactive", "ConditionResult": "yes", "ConditionTimestamp": "Thu 2026-07-02 18:26:36 UTC", "ConditionTimestampMonotonic": "6117705585", "ConfigurationDirectoryMode": "0755", "Conflicts": "shutdown.target", "ControlGroup": "/system.slice/auditd.service", "ControlGroupId": "3868", "ControlPID": "0", "CoredumpFilter": "0x33", "CoredumpReceive": "no", "DefaultDependencies": "no", "DefaultMemoryLow": "0", "DefaultMemoryMin": "0", "DefaultStartupMemoryLow": "0", "Delegate": "no", "Description": "Security Auditing Service", "DevicePolicy": "auto", "Documentation": "\"man:auditd(8)\" https://github.com/linux-audit/audit-documentation", "DynamicUser": "no", "ExecMainCode": "0", "ExecMainExitTimestampMonotonic": "0", "ExecMainPID": "2362", "ExecMainStartTimestamp": "Thu 2026-07-02 18:26:37 UTC", "ExecMainStartTimestampMonotonic": "6117746092", "ExecMainStatus": "0", "ExecStart": "{ path=/sbin/auditd ; argv[]=/sbin/auditd ; ignore_errors=no ; start_time=[Thu 2026-07-02 18:26:37 UTC] ; stop_time=[Thu 2026-07-02 18:26:37 UTC] ; pid=2361 ; code=exited ; status=0 }", "ExecStartEx": "{ path=/sbin/auditd ; argv[]=/sbin/auditd ; flags= ; start_time=[Thu 2026-07-02 18:26:37 UTC] ; stop_time=[Thu 2026-07-02 18:26:37 UTC] ; pid=2361 ; code=exited ; status=0 }", "ExecStartPost": "{ path=/sbin/augenrules ; argv[]=/sbin/augenrules --load ; ignore_errors=yes ; start_time=[Thu 2026-07-02 18:26:37 UTC] ; stop_time=[Thu 2026-07-02 18:26:37 UTC] ; pid=2365 ; code=exited ; status=0 }", "ExecStartPostEx": "{ path=/sbin/augenrules ; argv[]=/sbin/augenrules --load ; flags=ignore-failure ; start_time=[Thu 2026-07-02 18:26:37 UTC] ; stop_time=[Thu 2026-07-02 18:26:37 UTC] ; pid=2365 ; code=exited ; status=0 }", "ExitType": "main", "ExtensionImagePolicy": "root=verity+signed+encrypted+unprotected+absent:usr=verity+signed+encrypted+unprotected+absent:home=encrypted+unprotected+absent:srv=encrypted+unprotected+absent:tmp=encrypted+unprotected+absent:var=encrypted+unprotected+absent", "FailureAction": "none", "FileDescriptorStoreMax": "0", "FileDescriptorStorePreserve": "restart", "FinalKillSignal": "9", "FragmentPath": "/usr/lib/systemd/system/auditd.service", "FreezerState": "running", "GID": "[not set]", "GuessMainPID": "yes", "IOAccounting": "no", "IOReadBytes": "[not set]", "IOReadOperations": "[not set]", "IOSchedulingClass": "2", "IOSchedulingPriority": "4", "IOWeight": "[not set]", "IOWriteBytes": "[not set]", "IOWriteOperations": "[not set]", "IPAccounting": "no", "IPEgressBytes": "[no data]", "IPEgressPackets": "[no data]", "IPIngressBytes": "[no data]", "IPIngressPackets": "[no data]", "Id": "auditd.service", "IgnoreOnIsolate": "no", "IgnoreSIGPIPE": "yes", "InactiveEnterTimestampMonotonic": "0", "InactiveExitTimestamp": "Thu 2026-07-02 18:26:37 UTC", "InactiveExitTimestampMonotonic": "6117710627", "InvocationID": "3ed89e72a844474aabe07cb3243d5765", "JobRunningTimeoutUSec": "infinity", "JobTimeoutAction": "none", "JobTimeoutUSec": "infinity", "KeyringMode": "private", "KillMode": "control-group", "KillSignal": "15", "LimitAS": "infinity", "LimitASSoft": "infinity", "LimitCORE": "infinity", "LimitCORESoft": "0", "LimitCPU": "infinity", "LimitCPUSoft": "infinity", "LimitDATA": "infinity", "LimitDATASoft": "infinity", "LimitFSIZE": "infinity", "LimitFSIZESoft": "infinity", "LimitLOCKS": "infinity", "LimitLOCKSSoft": "infinity", "LimitMEMLOCK": "8388608", "LimitMEMLOCKSoft": "8388608", "LimitMSGQUEUE": "819200", "LimitMSGQUEUESoft": "819200", "LimitNICE": "0", "LimitNICESoft": "0", "LimitNOFILE": "524288", "LimitNOFILESoft": "1024", "LimitNPROC": "15372", "LimitNPROCSoft": "15372", "LimitRSS": "infinity", "LimitRSSSoft": "infinity", "LimitRTPRIO": "0", "LimitRTPRIOSoft": "0", "LimitRTTIME": "infinity", "LimitRTTIMESoft": "infinity", "LimitSIGPENDING": "15372", "LimitSIGPENDINGSoft": "15372", "LimitSTACK": "infinity", "LimitSTACKSoft": "8388608", "LoadState": "loaded", "LockPersonality": "yes", "LogLevelMax": "-1", "LogRateLimitBurst": "0", "LogRateLimitIntervalUSec": "0", "LogsDirectoryMode": "0755", "MainPID": "2362", "ManagedOOMMemoryPressure": "auto", "ManagedOOMMemoryPressureLimit": "0", "ManagedOOMPreference": "none", "ManagedOOMSwap": "auto", "MemoryAccounting": "yes", "MemoryAvailable": "3497955328", "MemoryCurrent": "507904", "MemoryDenyWriteExecute": "yes", "MemoryHigh": "infinity", "MemoryKSM": "no", "MemoryLimit": "infinity", "MemoryLow": "0", "MemoryMax": "infinity", "MemoryMin": "0", "MemoryPeak": "2064384", "MemoryPressureThresholdUSec": "200ms", "MemoryPressureWatch": "auto", "MemorySwapCurrent": "0", "MemorySwapMax": "infinity", "MemorySwapPeak": "0", "MemoryZSwapCurrent": "0", "MemoryZSwapMax": "infinity", "MountAPIVFS": "no", "MountImagePolicy": "root=verity+signed+encrypted+unprotected+absent:usr=verity+signed+encrypted+unprotected+absent:home=encrypted+unprotected+absent:srv=encrypted+unprotected+absent:tmp=encrypted+unprotected+absent:var=encrypted+unprotected+absent", "NFileDescriptorStore": "0", "NRestarts": "0", "NUMAPolicy": "n/a", "Names": "auditd.service", "NeedDaemonReload": "no", "Nice": "0", "NoNewPrivileges": "no", "NonBlocking": "no", "NotifyAccess": "none", "OOMPolicy": "stop", "OOMScoreAdjust": "0", "OnFailureJobMode": "replace", "OnSuccessJobMode": "fail", "PIDFile": "/run/auditd.pid", "Perpetual": "no", "PrivateDevices": "no", "PrivateIPC": "no", "PrivateMounts": "no", "PrivateNetwork": "no", "PrivateTmp": "no", "PrivateUsers": "no", "ProcSubset": "all", "ProtectClock": "no", "ProtectControlGroups": "no", "ProtectHome": "no", "ProtectHostname": "no", "ProtectKernelLogs": "no", "ProtectKernelModules": "yes", "ProtectKernelTunables": "no", "ProtectProc": "default", "ProtectSystem": "no", "RefuseManualStart": "no", "RefuseManualStop": "no", "ReloadResult": "success", "ReloadSignal": "1", "RemainAfterExit": "no", "RemoveIPC": "no", "Requires": "system.slice", "Restart": "on-failure", "RestartKillSignal": "15", "RestartMaxDelayUSec": "infinity", "RestartMode": "normal", "RestartPreventExitStatus": "2 4 6", "RestartSteps": "0", "RestartUSec": "100ms", "RestartUSecNext": "100ms", "RestrictNamespaces": "no", "RestrictRealtime": "yes", "RestrictSUIDSGID": "no", "Result": "success", "RootDirectoryStartOnly": "no", "RootEphemeral": "no", "RootImagePolicy": "root=verity+signed+encrypted+unprotected+absent:usr=verity+signed+encrypted+unprotected+absent:home=encrypted+unprotected+absent:srv=encrypted+unprotected+absent:tmp=encrypted+unprotected+absent:var=encrypted+unprotected+absent", "RuntimeDirectoryMode": "0755", "RuntimeDirectoryPreserve": "no", "RuntimeMaxUSec": "infinity", "RuntimeRandomizedExtraUSec": "0", "SameProcessGroup": "no", "SecureBits": "0", "SendSIGHUP": "no", "SendSIGKILL": "yes", "SetLoginEnvironment": "no", "Slice": "system.slice", "StandardError": "inherit", "StandardInput": "null", "StandardOutput": "journal", "StartLimitAction": "none", "StartLimitBurst": "5", "StartLimitIntervalUSec": "10s", "StartupBlockIOWeight": "[not set]", "StartupCPUShares": "[not set]", "StartupCPUWeight": "[not set]", "StartupIOWeight": "[not set]", "StartupMemoryHigh": "infinity", "StartupMemoryLow": "0", "StartupMemoryMax": "infinity", "StartupMemorySwapMax": "infinity", "StartupMemoryZSwapMax": "infinity", "StateChangeTimestamp": "Thu 2026-07-02 18:26:37 UTC", "StateChangeTimestampMonotonic": "6117789096", "StateDirectoryMode": "0755", "StatusErrno": "0", "StopWhenUnneeded": "no", "SubState": "running", "SuccessAction": "none", "SurviveFinalKillSignal": "no", "SyslogFacility": "3", "SyslogLevel": "6", "SyslogLevelPrefix": "yes", "SyslogPriority": "30", "SystemCallErrorNumber": "2147483646", "TTYReset": "no", "TTYVHangup": "no", "TTYVTDisallocate": "no", "TasksAccounting": "yes", "TasksCurrent": "2", "TasksMax": "4611", "TimeoutAbortUSec": "1min 30s", "TimeoutCleanUSec": "infinity", "TimeoutStartFailureMode": "terminate", "TimeoutStartUSec": "1min 30s", "TimeoutStopFailureMode": "terminate", "TimeoutStopUSec": "1min 30s", "TimerSlackNSec": "50000", "Transient": "no", "Type": "forking", "UID": "[not set]", "UMask": "0022", "UnitFilePreset": "enabled", "UnitFileState": "enabled", "UtmpMode": "init", "WantedBy": "multi-user.target", "WatchdogSignal": "6", "WatchdogTimestampMonotonic": "0", "WatchdogUSec": "0"}} 2026-07-02 18:26:45.420600 | ubuntu-noble | 2026-07-02 18:26:45.420771 | ubuntu-noble | TASK [auditd : List existing rules files] ************************************** 2026-07-02 18:26:45.912899 | ubuntu-noble | ok: [molecule-auditd] => {"changed": false, "cmd": ["find", "/etc/audit/rules.d", "-type", "f", "-printf", "%f\n"], "delta": "0:00:00.007723", "end": "2026-07-02 18:26:45.863670", "msg": "", "rc": 0, "start": "2026-07-02 18:26:45.855947", "stderr": "", "stderr_lines": [], "stdout": "audit.rules\n20-neo23x0.rules", "stdout_lines": ["audit.rules", "20-neo23x0.rules"]} 2026-07-02 18:26:45.913017 | ubuntu-noble | 2026-07-02 18:26:45.913265 | ubuntu-noble | TASK [auditd : Remove unmanaged rules files] *********************************** 2026-07-02 18:26:46.288679 | ubuntu-noble | --- before 2026-07-02 18:26:46.288956 | ubuntu-noble | +++ after 2026-07-02 18:26:46.289237 | ubuntu-noble | @@ -1,4 +1,4 @@ 2026-07-02 18:26:46.289553 | ubuntu-noble | { 2026-07-02 18:26:46.292434 | ubuntu-noble | "path": "/etc/audit/rules.d/audit.rules", 2026-07-02 18:26:46.292466 | ubuntu-noble | - "state": "file" 2026-07-02 18:26:46.292472 | ubuntu-noble | + "state": "absent" 2026-07-02 18:26:46.292476 | ubuntu-noble | } 2026-07-02 18:26:46.292480 | ubuntu-noble | 2026-07-02 18:26:46.292486 | ubuntu-noble | changed: [molecule-auditd] => (item=audit.rules) => {"ansible_loop_var": "item", "changed": true, "item": "audit.rules", "path": "/etc/audit/rules.d/audit.rules", "state": "absent"} 2026-07-02 18:26:46.292493 | ubuntu-noble | skipping: [molecule-auditd] => (item=20-neo23x0.rules) => {"ansible_loop_var": "item", "changed": false, "false_condition": "item not in auditd_rules_files", "item": "20-neo23x0.rules", "skip_reason": "Conditional result was False"} 2026-07-02 18:26:46.292504 | ubuntu-noble | 2026-07-02 18:26:46.292508 | ubuntu-noble | RUNNING HANDLER [auditd : Restart auditd service] ****************************** 2026-07-02 18:26:47.057985 | ubuntu-noble | changed: [molecule-auditd] => {"changed": true, "name": "auditd", "state": "started", "status": {"ActiveEnterTimestamp": "Thu 2026-07-02 18:26:37 UTC", "ActiveEnterTimestampMonotonic": "6117789096", "ActiveExitTimestampMonotonic": "0", "ActiveState": "active", "After": "systemd-tmpfiles-setup.service local-fs.target systemd-journald.socket system.slice", "AllowIsolate": "no", "AssertResult": "yes", "AssertTimestamp": "Thu 2026-07-02 18:26:36 UTC", "AssertTimestampMonotonic": "6117705682", "Before": "systemd-update-utmp.service shutdown.target ssh.service sysinit.target", "BlockIOAccounting": "no", "BlockIOWeight": "[not set]", "CPUAccounting": "yes", "CPUAffinityFromNUMA": "no", "CPUQuotaPerSecUSec": "infinity", "CPUQuotaPeriodUSec": "infinity", "CPUSchedulingPolicy": "0", "CPUSchedulingPriority": "0", "CPUSchedulingResetOnFork": "no", "CPUShares": "[not set]", "CPUUsageNSec": "61559000", "CPUWeight": "[not set]", "CacheDirectoryMode": "0755", "CanFreeze": "yes", "CanIsolate": "no", "CanReload": "no", "CanStart": "yes", "CanStop": "yes", "CapabilityBoundingSet": "cap_chown cap_dac_override cap_dac_read_search cap_fowner cap_fsetid cap_kill cap_setgid cap_setuid cap_setpcap cap_linux_immutable cap_net_bind_service cap_net_broadcast cap_net_admin cap_net_raw cap_ipc_lock cap_ipc_owner cap_sys_rawio cap_sys_chroot cap_sys_ptrace cap_sys_pacct cap_sys_admin cap_sys_boot cap_sys_nice cap_sys_resource cap_sys_time cap_sys_tty_config cap_mknod cap_lease cap_audit_write cap_audit_control cap_setfcap cap_mac_override cap_mac_admin cap_syslog cap_wake_alarm cap_block_suspend cap_audit_read cap_perfmon cap_bpf cap_checkpoint_restore", "CleanResult": "success", "CollectMode": "inactive", "ConditionResult": "yes", "ConditionTimestamp": "Thu 2026-07-02 18:26:36 UTC", "ConditionTimestampMonotonic": "6117705585", "ConfigurationDirectoryMode": "0755", "Conflicts": "shutdown.target", "ControlGroup": "/system.slice/auditd.service", "ControlGroupId": "3868", "ControlPID": "0", "CoredumpFilter": "0x33", "CoredumpReceive": "no", "DefaultDependencies": "no", "DefaultMemoryLow": "0", "DefaultMemoryMin": "0", "DefaultStartupMemoryLow": "0", "Delegate": "no", "Description": "Security Auditing Service", "DevicePolicy": "auto", "Documentation": "\"man:auditd(8)\" https://github.com/linux-audit/audit-documentation", "DynamicUser": "no", "ExecMainCode": "0", "ExecMainExitTimestampMonotonic": "0", "ExecMainPID": "2362", "ExecMainStartTimestamp": "Thu 2026-07-02 18:26:37 UTC", "ExecMainStartTimestampMonotonic": "6117746092", "ExecMainStatus": "0", "ExecStart": "{ path=/sbin/auditd ; argv[]=/sbin/auditd ; ignore_errors=no ; start_time=[Thu 2026-07-02 18:26:37 UTC] ; stop_time=[Thu 2026-07-02 18:26:37 UTC] ; pid=2361 ; code=exited ; status=0 }", "ExecStartEx": "{ path=/sbin/auditd ; argv[]=/sbin/auditd ; flags= ; start_time=[Thu 2026-07-02 18:26:37 UTC] ; stop_time=[Thu 2026-07-02 18:26:37 UTC] ; pid=2361 ; code=exited ; status=0 }", "ExecStartPost": "{ path=/sbin/augenrules ; argv[]=/sbin/augenrules --load ; ignore_errors=yes ; start_time=[Thu 2026-07-02 18:26:37 UTC] ; stop_time=[Thu 2026-07-02 18:26:37 UTC] ; pid=2365 ; code=exited ; status=0 }", "ExecStartPostEx": "{ path=/sbin/augenrules ; argv[]=/sbin/augenrules --load ; flags=ignore-failure ; start_time=[Thu 2026-07-02 18:26:37 UTC] ; stop_time=[Thu 2026-07-02 18:26:37 UTC] ; pid=2365 ; code=exited ; status=0 }", "ExitType": "main", "ExtensionImagePolicy": "root=verity+signed+encrypted+unprotected+absent:usr=verity+signed+encrypted+unprotected+absent:home=encrypted+unprotected+absent:srv=encrypted+unprotected+absent:tmp=encrypted+unprotected+absent:var=encrypted+unprotected+absent", "FailureAction": "none", "FileDescriptorStoreMax": "0", "FileDescriptorStorePreserve": "restart", "FinalKillSignal": "9", "FragmentPath": "/usr/lib/systemd/system/auditd.service", "FreezerState": "running", "GID": "[not set]", "GuessMainPID": "yes", "IOAccounting": "no", "IOReadBytes": "[not set]", "IOReadOperations": "[not set]", "IOSchedulingClass": "2", "IOSchedulingPriority": "4", "IOWeight": "[not set]", "IOWriteBytes": "[not set]", "IOWriteOperations": "[not set]", "IPAccounting": "no", "IPEgressBytes": "[no data]", "IPEgressPackets": "[no data]", "IPIngressBytes": "[no data]", "IPIngressPackets": "[no data]", "Id": "auditd.service", "IgnoreOnIsolate": "no", "IgnoreSIGPIPE": "yes", "InactiveEnterTimestampMonotonic": "0", "InactiveExitTimestamp": "Thu 2026-07-02 18:26:37 UTC", "InactiveExitTimestampMonotonic": "6117710627", "InvocationID": "3ed89e72a844474aabe07cb3243d5765", "JobRunningTimeoutUSec": "infinity", "JobTimeoutAction": "none", "JobTimeoutUSec": "infinity", "KeyringMode": "private", "KillMode": "control-group", "KillSignal": "15", "LimitAS": "infinity", "LimitASSoft": "infinity", "LimitCORE": "infinity", "LimitCORESoft": "0", "LimitCPU": "infinity", "LimitCPUSoft": "infinity", "LimitDATA": "infinity", "LimitDATASoft": "infinity", "LimitFSIZE": "infinity", "LimitFSIZESoft": "infinity", "LimitLOCKS": "infinity", "LimitLOCKSSoft": "infinity", "LimitMEMLOCK": "8388608", "LimitMEMLOCKSoft": "8388608", "LimitMSGQUEUE": "819200", "LimitMSGQUEUESoft": "819200", "LimitNICE": "0", "LimitNICESoft": "0", "LimitNOFILE": "524288", "LimitNOFILESoft": "1024", "LimitNPROC": "15372", "LimitNPROCSoft": "15372", "LimitRSS": "infinity", "LimitRSSSoft": "infinity", "LimitRTPRIO": "0", "LimitRTPRIOSoft": "0", "LimitRTTIME": "infinity", "LimitRTTIMESoft": "infinity", "LimitSIGPENDING": "15372", "LimitSIGPENDINGSoft": "15372", "LimitSTACK": "infinity", "LimitSTACKSoft": "8388608", "LoadState": "loaded", "LockPersonality": "yes", "LogLevelMax": "-1", "LogRateLimitBurst": "0", "LogRateLimitIntervalUSec": "0", "LogsDirectoryMode": "0755", "MainPID": "2362", "ManagedOOMMemoryPressure": "auto", "ManagedOOMMemoryPressureLimit": "0", "ManagedOOMPreference": "none", "ManagedOOMSwap": "auto", "MemoryAccounting": "yes", "MemoryAvailable": "3514044416", "MemoryCurrent": "516096", "MemoryDenyWriteExecute": "yes", "MemoryHigh": "infinity", "MemoryKSM": "no", "MemoryLimit": "infinity", "MemoryLow": "0", "MemoryMax": "infinity", "MemoryMin": "0", "MemoryPeak": "2064384", "MemoryPressureThresholdUSec": "200ms", "MemoryPressureWatch": "auto", "MemorySwapCurrent": "0", "MemorySwapMax": "infinity", "MemorySwapPeak": "0", "MemoryZSwapCurrent": "0", "MemoryZSwapMax": "infinity", "MountAPIVFS": "no", "MountImagePolicy": "root=verity+signed+encrypted+unprotected+absent:usr=verity+signed+encrypted+unprotected+absent:home=encrypted+unprotected+absent:srv=encrypted+unprotected+absent:tmp=encrypted+unprotected+absent:var=encrypted+unprotected+absent", "NFileDescriptorStore": "0", "NRestarts": "0", "NUMAPolicy": "n/a", "Names": "auditd.service", "NeedDaemonReload": "no", "Nice": "0", "NoNewPrivileges": "no", "NonBlocking": "no", "NotifyAccess": "none", "OOMPolicy": "stop", "OOMScoreAdjust": "0", "OnFailureJobMode": "replace", "OnSuccessJobMode": "fail", "PIDFile": "/run/auditd.pid", "Perpetual": "no", "PrivateDevices": "no", "PrivateIPC": "no", "PrivateMounts": "no", "PrivateNetwork": "no", "PrivateTmp": "no", "PrivateUsers": "no", "ProcSubset": "all", "ProtectClock": "no", "ProtectControlGroups": "no", "ProtectHome": "no", "ProtectHostname": "no", "ProtectKernelLogs": "no", "ProtectKernelModules": "yes", "ProtectKernelTunables": "no", "ProtectProc": "default", "ProtectSystem": "no", "RefuseManualStart": "no", "RefuseManualStop": "no", "ReloadResult": "success", "ReloadSignal": "1", "RemainAfterExit": "no", "RemoveIPC": "no", "Requires": "system.slice", "Restart": "on-failure", "RestartKillSignal": "15", "RestartMaxDelayUSec": "infinity", "RestartMode": "normal", "RestartPreventExitStatus": "2 4 6", "RestartSteps": "0", "RestartUSec": "100ms", "RestartUSecNext": "100ms", "RestrictNamespaces": "no", "RestrictRealtime": "yes", "RestrictSUIDSGID": "no", "Result": "success", "RootDirectoryStartOnly": "no", "RootEphemeral": "no", "RootImagePolicy": "root=verity+signed+encrypted+unprotected+absent:usr=verity+signed+encrypted+unprotected+absent:home=encrypted+unprotected+absent:srv=encrypted+unprotected+absent:tmp=encrypted+unprotected+absent:var=encrypted+unprotected+absent", "RuntimeDirectoryMode": "0755", "RuntimeDirectoryPreserve": "no", "RuntimeMaxUSec": "infinity", "RuntimeRandomizedExtraUSec": "0", "SameProcessGroup": "no", "SecureBits": "0", "SendSIGHUP": "no", "SendSIGKILL": "yes", "SetLoginEnvironment": "no", "Slice": "system.slice", "StandardError": "inherit", "StandardInput": "null", "StandardOutput": "journal", "StartLimitAction": "none", "StartLimitBurst": "5", "StartLimitIntervalUSec": "10s", "StartupBlockIOWeight": "[not set]", "StartupCPUShares": "[not set]", "StartupCPUWeight": "[not set]", "StartupIOWeight": "[not set]", "StartupMemoryHigh": "infinity", "StartupMemoryLow": "0", "StartupMemoryMax": "infinity", "StartupMemorySwapMax": "infinity", "StartupMemoryZSwapMax": "infinity", "StateChangeTimestamp": "Thu 2026-07-02 18:26:37 UTC", "StateChangeTimestampMonotonic": "6117789096", "StateDirectoryMode": "0755", "StatusErrno": "0", "StopWhenUnneeded": "no", "SubState": "running", "SuccessAction": "none", "SurviveFinalKillSignal": "no", "SyslogFacility": "3", "SyslogLevel": "6", "SyslogLevelPrefix": "yes", "SyslogPriority": "30", "SystemCallErrorNumber": "2147483646", "TTYReset": "no", "TTYVHangup": "no", "TTYVTDisallocate": "no", "TasksAccounting": "yes", "TasksCurrent": "2", "TasksMax": "4611", "TimeoutAbortUSec": "1min 30s", "TimeoutCleanUSec": "infinity", "TimeoutStartFailureMode": "terminate", "TimeoutStartUSec": "1min 30s", "TimeoutStopFailureMode": "terminate", "TimeoutStopUSec": "1min 30s", "TimerSlackNSec": "50000", "Transient": "no", "Type": "forking", "UID": "[not set]", "UMask": "0022", "UnitFilePreset": "enabled", "UnitFileState": "enabled", "UtmpMode": "init", "WantedBy": "multi-user.target", "WatchdogSignal": "6", "WatchdogTimestampMonotonic": "0", "WatchdogUSec": "0"}} 2026-07-02 18:26:47.066558 | ubuntu-noble | 2026-07-02 18:26:47.066820 | ubuntu-noble | RUNNING HANDLER [auditd : Generate auditd rules] ******************************* 2026-07-02 18:26:47.491580 | ubuntu-noble | changed: [molecule-auditd] => {"changed": true, "cmd": ["augenrules", "--load"], "delta": "0:00:00.076907", "end": "2026-07-02 18:26:47.435257", "msg": "", "rc": 0, "start": "2026-07-02 18:26:47.358350", "stderr": "Unknown user: chrony\nThere was an error in line 24 of /etc/audit/audit.rules\nError sending add rule data request (No such file or directory)\nThere was an error in line 28 of /etc/audit/audit.rules\nUnknown user: ntp\nThere was an error in line 44 of /etc/audit/audit.rules\nError sending add rule data request (No such file or directory)\nThere was an error in line 83 of /etc/audit/audit.rules\nError sending add rule data request (No such file or directory)\nThere was an error in line 84 of /etc/audit/audit.rules\nError sending add rule data request (No such file or directory)\nThere was an error in line 86 of /etc/audit/audit.rules\nError sending add rule data request (No such file or directory)\nThere was an error in line 112 of /etc/audit/audit.rules\nError sending add rule data request (No such file or directory)\nThere was an error in line 115 of /etc/audit/audit.rules\nError sending add rule data request (No such file or directory)\nThere was an error in line 176 of /etc/audit/audit.rules\nError sending add rule data request (No such file or directory)\nThere was an error in line 177 of /etc/audit/audit.rules\nError sending add rule data request (No such file or directory)\nThere was an error in line 178 of /etc/audit/audit.rules\nError sending add rule data request (No such file or directory)\nThere was an error in line 179 of /etc/audit/audit.rules\nError sending add rule data request (No such file or directory)\nThere was an error in line 180 of /etc/audit/audit.rules\nError sending add rule data request (No such file or directory)\nThere was an error in line 217 of /etc/audit/audit.rules\nError sending add rule data request (No such file or directory)\nThere was an error in line 218 of /etc/audit/audit.rules\nError sending add rule data request (No such file or directory)\nThere was an error in line 234 of /etc/audit/audit.rules\nError sending add rule data request (No such file or directory)\nThere was an error in line 285 of /etc/audit/audit.rules\nError sending add rule data request (No such file or directory)\nThere was an error in line 286 of /etc/audit/audit.rules\nError sending add rule data request (No such file or directory)\nThere was an error in line 324 of /etc/audit/audit.rules\nError sending add rule data request (No such file or directory)\nThere was an error in line 325 of /etc/audit/audit.rules\nError sending add rule data request (No such file or directory)\nThere was an error in line 346 of /etc/audit/audit.rules\nparameter passed without an option given\nThere was an error in line 347 of /etc/audit/audit.rules\nparameter passed without an option given\nThere was an error in line 348 of /etc/audit/audit.rules\nparameter passed without an option given\nThere was an error in line 349 of /etc/audit/audit.rules\nparameter passed without an option given\nThere was an error in line 350 of /etc/audit/audit.rules\nparameter passed without an option given\nThere was an error in line 351 of /etc/audit/audit.rules\nError sending add rule data request (No such file or directory)\nThere was an error in line 359 of /etc/audit/audit.rules", "stderr_lines": ["Unknown user: chrony", "There was an error in line 24 of /etc/audit/audit.rules", "Error sending add rule data request (No such file or directory)", "There was an error in line 28 of /etc/audit/audit.rules", "Unknown user: ntp", "There was an error in line 44 of /etc/audit/audit.rules", "Error sending add rule data request (No such file or directory)", "There was an error in line 83 of /etc/audit/audit.rules", "Error sending add rule data request (No such file or directory)", "There was an error in line 84 of /etc/audit/audit.rules", "Error sending add rule data request (No such file or directory)", "There was an error in line 86 of /etc/audit/audit.rules", "Error sending add rule data request (No such file or directory)", "There was an error in line 112 of /etc/audit/audit.rules", "Error sending add rule data request (No such file or directory)", "There was an error in line 115 of /etc/audit/audit.rules", "Error sending add rule data request (No such file or directory)", "There was an error in line 176 of /etc/audit/audit.rules", "Error sending add rule data request (No such file or directory)", "There was an error in line 177 of /etc/audit/audit.rules", "Error sending add rule data request (No such file or directory)", "There was an error in line 178 of /etc/audit/audit.rules", "Error sending add rule data request (No such file or directory)", "There was an error in line 179 of /etc/audit/audit.rules", "Error sending add rule data request (No such file or directory)", "There was an error in line 180 of /etc/audit/audit.rules", "Error sending add rule data request (No such file or directory)", "There was an error in line 217 of /etc/audit/audit.rules", "Error sending add rule data request (No such file or directory)", "There was an error in line 218 of /etc/audit/audit.rules", "Error sending add rule data request (No such file or directory)", "There was an error in line 234 of /etc/audit/audit.rules", "Error sending add rule data request (No such file or directory)", "There was an error in line 285 of /etc/audit/audit.rules", "Error sending add rule data request (No such file or directory)", "There was an error in line 286 of /etc/audit/audit.rules", "Error sending add rule data request (No such file or directory)", "There was an error in line 324 of /etc/audit/audit.rules", "Error sending add rule data request (No such file or directory)", "There was an error in line 325 of /etc/audit/audit.rules", "Error sending add rule data request (No such file or directory)", "There was an error in line 346 of /etc/audit/audit.rules", "parameter passed without an option given", "There was an error in line 347 of /etc/audit/audit.rules", "parameter passed without an option given", "There was an error in line 348 of /etc/audit/audit.rules", "parameter passed without an option given", "There was an error in line 349 of /etc/audit/audit.rules", "parameter passed without an option given", "There was an error in line 350 of /etc/audit/audit.rules", "parameter passed without an option given", "There was an error in line 351 of /etc/audit/audit.rules", "Error sending add rule data request (No such file or directory)", "There was an error in line 359 of /etc/audit/audit.rules"], "stdout": "/usr/sbin/augenrules: No change\nNo rules\nenabled 1\nfailure 1\npid 2754\nrate_limit 0\nbacklog_limit 8192\nlost 0\nbacklog 1020\nbacklog_wait_time 60000\nbacklog_wait_time_actual 0\nenabled 1\nfailure 1\npid 2754\nrate_limit 0\nbacklog_limit 8192\nlost 0\nbacklog 1016\nbacklog_wait_time 60000\nbacklog_wait_time_actual 0", "stdout_lines": ["/usr/sbin/augenrules: No change", "No rules", "enabled 1", "failure 1", "pid 2754", "rate_limit 0", "backlog_limit 8192", "lost 0", "backlog 1020", "backlog_wait_time 60000", "backlog_wait_time_actual 0", "enabled 1", "failure 1", "pid 2754", "rate_limit 0", "backlog_limit 8192", "lost 0", "backlog 1016", "backlog_wait_time 60000", "backlog_wait_time_actual 0"]} 2026-07-02 18:26:47.491711 | ubuntu-noble | 2026-07-02 18:26:47.491770 | ubuntu-noble | RUNNING HANDLER [auditd : Restart auditd service] ****************************** 2026-07-02 18:26:49.326854 | ubuntu-noble | changed: [molecule-auditd] => {"changed": true, "name": "auditd", "state": "started", "status": {"ActiveEnterTimestamp": "Thu 2026-07-02 18:26:46 UTC", "ActiveEnterTimestampMonotonic": "6127688920", "ActiveExitTimestamp": "Thu 2026-07-02 18:26:46 UTC", "ActiveExitTimestampMonotonic": "6127537654", "ActiveState": "active", "After": "systemd-tmpfiles-setup.service local-fs.target systemd-journald.socket system.slice", "AllowIsolate": "no", "AssertResult": "yes", "AssertTimestamp": "Thu 2026-07-02 18:26:46 UTC", "AssertTimestampMonotonic": "6127579854", "Before": "systemd-update-utmp.service shutdown.target ssh.service sysinit.target", "BlockIOAccounting": "no", "BlockIOWeight": "[not set]", "CPUAccounting": "yes", "CPUAffinityFromNUMA": "no", "CPUQuotaPerSecUSec": "infinity", "CPUQuotaPeriodUSec": "infinity", "CPUSchedulingPolicy": "0", "CPUSchedulingPriority": "0", "CPUSchedulingResetOnFork": "no", "CPUShares": "[not set]", "CPUUsageNSec": "156154000", "CPUWeight": "[not set]", "CacheDirectoryMode": "0755", "CanFreeze": "yes", "CanIsolate": "no", "CanReload": "no", "CanStart": "yes", "CanStop": "yes", "CapabilityBoundingSet": "cap_chown cap_dac_override cap_dac_read_search cap_fowner cap_fsetid cap_kill cap_setgid cap_setuid cap_setpcap cap_linux_immutable cap_net_bind_service cap_net_broadcast cap_net_admin cap_net_raw cap_ipc_lock cap_ipc_owner cap_sys_rawio cap_sys_chroot cap_sys_ptrace cap_sys_pacct cap_sys_admin cap_sys_boot cap_sys_nice cap_sys_resource cap_sys_time cap_sys_tty_config cap_mknod cap_lease cap_audit_write cap_audit_control cap_setfcap cap_mac_override cap_mac_admin cap_syslog cap_wake_alarm cap_block_suspend cap_audit_read cap_perfmon cap_bpf cap_checkpoint_restore", "CleanResult": "success", "CollectMode": "inactive", "ConditionResult": "yes", "ConditionTimestamp": "Thu 2026-07-02 18:26:46 UTC", "ConditionTimestampMonotonic": "6127579762", "ConfigurationDirectoryMode": "0755", "Conflicts": "shutdown.target", "ControlGroup": "/system.slice/auditd.service", "ControlGroupId": "3910", "ControlPID": "0", "CoredumpFilter": "0x33", "CoredumpReceive": "no", "DefaultDependencies": "no", "DefaultMemoryLow": "0", "DefaultMemoryMin": "0", "DefaultStartupMemoryLow": "0", "Delegate": "no", "Description": "Security Auditing Service", "DevicePolicy": "auto", "Documentation": "\"man:auditd(8)\" https://github.com/linux-audit/audit-documentation", "DynamicUser": "no", "ExecMainCode": "0", "ExecMainExitTimestampMonotonic": "0", "ExecMainPID": "2754", "ExecMainStartTimestamp": "Thu 2026-07-02 18:26:46 UTC", "ExecMainStartTimestampMonotonic": "6127599765", "ExecMainStatus": "0", "ExecStart": "{ path=/sbin/auditd ; argv[]=/sbin/auditd ; ignore_errors=no ; start_time=[Thu 2026-07-02 18:26:46 UTC] ; stop_time=[Thu 2026-07-02 18:26:46 UTC] ; pid=2753 ; code=exited ; status=0 }", "ExecStartEx": "{ path=/sbin/auditd ; argv[]=/sbin/auditd ; flags= ; start_time=[Thu 2026-07-02 18:26:46 UTC] ; stop_time=[Thu 2026-07-02 18:26:46 UTC] ; pid=2753 ; code=exited ; status=0 }", "ExecStartPost": "{ path=/sbin/augenrules ; argv[]=/sbin/augenrules --load ; ignore_errors=yes ; start_time=[Thu 2026-07-02 18:26:46 UTC] ; stop_time=[Thu 2026-07-02 18:26:46 UTC] ; pid=2757 ; code=exited ; status=0 }", "ExecStartPostEx": "{ path=/sbin/augenrules ; argv[]=/sbin/augenrules --load ; flags=ignore-failure ; start_time=[Thu 2026-07-02 18:26:46 UTC] ; stop_time=[Thu 2026-07-02 18:26:46 UTC] ; pid=2757 ; code=exited ; status=0 }", "ExitType": "main", "ExtensionImagePolicy": "root=verity+signed+encrypted+unprotected+absent:usr=verity+signed+encrypted+unprotected+absent:home=encrypted+unprotected+absent:srv=encrypted+unprotected+absent:tmp=encrypted+unprotected+absent:var=encrypted+unprotected+absent", "FailureAction": "none", "FileDescriptorStoreMax": "0", "FileDescriptorStorePreserve": "restart", "FinalKillSignal": "9", "FragmentPath": "/usr/lib/systemd/system/auditd.service", "FreezerState": "running", "GID": "[not set]", "GuessMainPID": "yes", "IOAccounting": "no", "IOReadBytes": "[not set]", "IOReadOperations": "[not set]", "IOSchedulingClass": "2", "IOSchedulingPriority": "4", "IOWeight": "[not set]", "IOWriteBytes": "[not set]", "IOWriteOperations": "[not set]", "IPAccounting": "no", "IPEgressBytes": "[no data]", "IPEgressPackets": "[no data]", "IPIngressBytes": "[no data]", "IPIngressPackets": "[no data]", "Id": "auditd.service", "IgnoreOnIsolate": "no", "IgnoreSIGPIPE": "yes", "InactiveEnterTimestamp": "Thu 2026-07-02 18:26:46 UTC", "InactiveEnterTimestampMonotonic": "6127578141", "InactiveExitTimestamp": "Thu 2026-07-02 18:26:46 UTC", "InactiveExitTimestampMonotonic": "6127590365", "InvocationID": "2ab0d1ffc1984da6900a887f8b182535", "JobRunningTimeoutUSec": "infinity", "JobTimeoutAction": "none", "JobTimeoutUSec": "infinity", "KeyringMode": "private", "KillMode": "control-group", "KillSignal": "15", "LimitAS": "infinity", "LimitASSoft": "infinity", "LimitCORE": "infinity", "LimitCORESoft": "0", "LimitCPU": "infinity", "LimitCPUSoft": "infinity", "LimitDATA": "infinity", "LimitDATASoft": "infinity", "LimitFSIZE": "infinity", "LimitFSIZESoft": "infinity", "LimitLOCKS": "infinity", "LimitLOCKSSoft": "infinity", "LimitMEMLOCK": "8388608", "LimitMEMLOCKSoft": "8388608", "LimitMSGQUEUE": "819200", "LimitMSGQUEUESoft": "819200", "LimitNICE": "0", "LimitNICESoft": "0", "LimitNOFILE": "524288", "LimitNOFILESoft": "1024", "LimitNPROC": "15372", "LimitNPROCSoft": "15372", "LimitRSS": "infinity", "LimitRSSSoft": "infinity", "LimitRTPRIO": "0", "LimitRTPRIOSoft": "0", "LimitRTTIME": "infinity", "LimitRTTIMESoft": "infinity", "LimitSIGPENDING": "15372", "LimitSIGPENDINGSoft": "15372", "LimitSTACK": "infinity", "LimitSTACKSoft": "8388608", "LoadState": "loaded", "LockPersonality": "yes", "LogLevelMax": "-1", "LogRateLimitBurst": "0", "LogRateLimitIntervalUSec": "0", "LogsDirectoryMode": "0755", "MainPID": "2754", "ManagedOOMMemoryPressure": "auto", "ManagedOOMMemoryPressureLimit": "0", "ManagedOOMPreference": "none", "ManagedOOMSwap": "auto", "MemoryAccounting": "yes", "MemoryAvailable": "3494522880", "MemoryCurrent": "1851392", "MemoryDenyWriteExecute": "yes", "MemoryHigh": "infinity", "MemoryKSM": "no", "MemoryLimit": "infinity", "MemoryLow": "0", "MemoryMax": "infinity", "MemoryMin": "0", "MemoryPeak": "2330624", "MemoryPressureThresholdUSec": "200ms", "MemoryPressureWatch": "auto", "MemorySwapCurrent": "0", "MemorySwapMax": "infinity", "MemorySwapPeak": "0", "MemoryZSwapCurrent": "0", "MemoryZSwapMax": "infinity", "MountAPIVFS": "no", "MountImagePolicy": "root=verity+signed+encrypted+unprotected+absent:usr=verity+signed+encrypted+unprotected+absent:home=encrypted+unprotected+absent:srv=encrypted+unprotected+absent:tmp=encrypted+unprotected+absent:var=encrypted+unprotected+absent", "NFileDescriptorStore": "0", "NRestarts": "0", "NUMAPolicy": "n/a", "Names": "auditd.service", "NeedDaemonReload": "no", "Nice": "0", "NoNewPrivileges": "no", "NonBlocking": "no", "NotifyAccess": "none", "OOMPolicy": "stop", "OOMScoreAdjust": "0", "OnFailureJobMode": "replace", "OnSuccessJobMode": "fail", "PIDFile": "/run/auditd.pid", "Perpetual": "no", "PrivateDevices": "no", "PrivateIPC": "no", "PrivateMounts": "no", "PrivateNetwork": "no", "PrivateTmp": "no", "PrivateUsers": "no", "ProcSubset": "all", "ProtectClock": "no", "ProtectControlGroups": "no", "ProtectHome": "no", "ProtectHostname": "no", "ProtectKernelLogs": "no", "ProtectKernelModules": "yes", "ProtectKernelTunables": "no", "ProtectProc": "default", "ProtectSystem": "no", "RefuseManualStart": "no", "RefuseManualStop": "no", "ReloadResult": "success", "ReloadSignal": "1", "RemainAfterExit": "no", "RemoveIPC": "no", "Requires": "system.slice", "Restart": "on-failure", "RestartKillSignal": "15", "RestartMaxDelayUSec": "infinity", "RestartMode": "normal", "RestartPreventExitStatus": "2 4 6", "RestartSteps": "0", "RestartUSec": "100ms", "RestartUSecNext": "100ms", "RestrictNamespaces": "no", "RestrictRealtime": "yes", "RestrictSUIDSGID": "no", "Result": "success", "RootDirectoryStartOnly": "no", "RootEphemeral": "no", "RootImagePolicy": "root=verity+signed+encrypted+unprotected+absent:usr=verity+signed+encrypted+unprotected+absent:home=encrypted+unprotected+absent:srv=encrypted+unprotected+absent:tmp=encrypted+unprotected+absent:var=encrypted+unprotected+absent", "RuntimeDirectoryMode": "0755", "RuntimeDirectoryPreserve": "no", "RuntimeMaxUSec": "infinity", "RuntimeRandomizedExtraUSec": "0", "SameProcessGroup": "no", "SecureBits": "0", "SendSIGHUP": "no", "SendSIGKILL": "yes", "SetLoginEnvironment": "no", "Slice": "system.slice", "StandardError": "inherit", "StandardInput": "null", "StandardOutput": "journal", "StartLimitAction": "none", "StartLimitBurst": "5", "StartLimitIntervalUSec": "10s", "StartupBlockIOWeight": "[not set]", "StartupCPUShares": "[not set]", "StartupCPUWeight": "[not set]", "StartupIOWeight": "[not set]", "StartupMemoryHigh": "infinity", "StartupMemoryLow": "0", "StartupMemoryMax": "infinity", "StartupMemorySwapMax": "infinity", "StartupMemoryZSwapMax": "infinity", "StateChangeTimestamp": "Thu 2026-07-02 18:26:46 UTC", "StateChangeTimestampMonotonic": "6127688920", "StateDirectoryMode": "0755", "StatusErrno": "0", "StopWhenUnneeded": "no", "SubState": "running", "SuccessAction": "none", "SurviveFinalKillSignal": "no", "SyslogFacility": "3", "SyslogLevel": "6", "SyslogLevelPrefix": "yes", "SyslogPriority": "30", "SystemCallErrorNumber": "2147483646", "TTYReset": "no", "TTYVHangup": "no", "TTYVTDisallocate": "no", "TasksAccounting": "yes", "TasksCurrent": "2", "TasksMax": "4611", "TimeoutAbortUSec": "1min 30s", "TimeoutCleanUSec": "infinity", "TimeoutStartFailureMode": "terminate", "TimeoutStartUSec": "1min 30s", "TimeoutStopFailureMode": "terminate", "TimeoutStopUSec": "1min 30s", "TimerSlackNSec": "50000", "Transient": "no", "Type": "forking", "UID": "[not set]", "UMask": "0022", "UnitFilePreset": "enabled", "UnitFileState": "enabled", "UtmpMode": "init", "WantedBy": "multi-user.target", "WatchdogSignal": "6", "WatchdogTimestampMonotonic": "0", "WatchdogUSec": "0"}} 2026-07-02 18:26:49.326922 | ubuntu-noble | 2026-07-02 18:26:49.326929 | ubuntu-noble | PLAY RECAP ********************************************************************* 2026-07-02 18:26:49.326992 | ubuntu-noble | molecule-auditd : ok=15 changed=8 unreachable=0 failed=0 skipped=0 rescued=0 ignored=0 2026-07-02 18:26:49.327342 | ubuntu-noble | 2026-07-02 18:26:49.454083 | ubuntu-noble | INFO [delegated > converge] Executed: Successful 2026-07-02 18:26:49.455141 | ubuntu-noble | WARNING Molecule executed 1 scenario (1 missing files) 2026-07-02 18:26:49.957750 | debian-bookworm | ok: Runtime: 0:00:16.243011 2026-07-02 18:26:49.990792 | ubuntu-noble | ok: Runtime: 0:00:22.642145 2026-07-02 18:26:50.009226 | 2026-07-02 18:26:50.009376 | TASK [ansible-molecule : Run molecule verify action with scenario delegated] 2026-07-02 18:26:50.682202 | debian-bookworm | WARNING Molecule scenarios should migrate to 'extensions/molecule' 2026-07-02 18:26:50.692850 | debian-bookworm | DEBUG [unknown > config] provisioner.env found in /home/zuul/src/github.com/osism/ansible-collection-services/molecule/delegated/molecule.yml, this can be defined in ansible.env 2026-07-02 18:26:50.814161 | ubuntu-noble | WARNING Molecule scenarios should migrate to 'extensions/molecule' 2026-07-02 18:26:50.824399 | ubuntu-noble | DEBUG [unknown > config] provisioner.env found in /home/zuul/src/github.com/osism/ansible-collection-services/molecule/delegated/molecule.yml, this can be defined in ansible.env 2026-07-02 18:26:51.119865 | debian-bookworm | DEBUG [unknown > config] provisioner.env found in /home/zuul/src/github.com/osism/ansible-collection-services/molecule/delegated/molecule.yml, this can be defined in ansible.env 2026-07-02 18:26:51.120491 | debian-bookworm | DEBUG [delegated > validate] Validating schema /home/zuul/src/github.com/osism/ansible-collection-services/molecule/delegated/molecule.yml. 2026-07-02 18:26:51.141644 | debian-bookworm | DEBUG [default > validate] Validating schema /home/zuul/src/github.com/osism/ansible-collection-services/molecule/default/molecule.yml. 2026-07-02 18:26:51.146929 | debian-bookworm | INFO [delegated > discovery] scenario test matrix: verify 2026-07-02 18:26:51.147012 | debian-bookworm | INFO [delegated > prerun] Performing prerun with role_name_check=0... 2026-07-02 18:26:51.441436 | ubuntu-noble | DEBUG [unknown > config] provisioner.env found in /home/zuul/src/github.com/osism/ansible-collection-services/molecule/delegated/molecule.yml, this can be defined in ansible.env 2026-07-02 18:26:51.442343 | ubuntu-noble | DEBUG [delegated > validate] Validating schema /home/zuul/src/github.com/osism/ansible-collection-services/molecule/delegated/molecule.yml. 2026-07-02 18:26:51.482164 | ubuntu-noble | DEBUG [default > validate] Validating schema /home/zuul/src/github.com/osism/ansible-collection-services/molecule/default/molecule.yml. 2026-07-02 18:26:51.492298 | ubuntu-noble | INFO [delegated > discovery] scenario test matrix: verify 2026-07-02 18:26:51.492380 | ubuntu-noble | INFO [delegated > prerun] Performing prerun with role_name_check=0... 2026-07-02 18:26:52.431637 | debian-bookworm | INFO [delegated > verify] Executing 2026-07-02 18:26:52.435734 | debian-bookworm | INFO [delegated > verify] Executing Testinfra tests found in /home/zuul/src/github.com/osism/ansible-collection-services/molecule/delegated/tests/... 2026-07-02 18:26:52.437904 | debian-bookworm | DEBUG ANSIBLE ENVIRONMENT: 2026-07-02 18:26:52.437923 | debian-bookworm | ANSIBLE_COLLECTIONS_PATH: /home/zuul/venv/.ansible/collections:/home/zuul/.ansible/collections 2026-07-02 18:26:52.437940 | debian-bookworm | ANSIBLE_CONFIG: /home/zuul/.ansible/tmp/molecule.oWZD.delegated/ansible.cfg 2026-07-02 18:26:52.437946 | debian-bookworm | ANSIBLE_LIBRARY: ../../plugins 2026-07-02 18:26:52.437952 | debian-bookworm | ANSIBLE_PYTHON_INTERPRETER: /home/zuul/venv/bin/python 2026-07-02 18:26:52.437958 | debian-bookworm | ANSIBLE_ROLE: auditd 2026-07-02 18:26:52.437963 | debian-bookworm | ANSIBLE_ROLES_PATH: ../../roles 2026-07-02 18:26:52.437969 | debian-bookworm | ANSIBLE_VERBOSITY: 1 2026-07-02 18:26:52.437974 | debian-bookworm | 2026-07-02 18:26:52.438317 | debian-bookworm | DEBUG MOLECULE ENVIRONMENT: 2026-07-02 18:26:52.438400 | debian-bookworm | MOLECULE_DEBUG: True 2026-07-02 18:26:52.438420 | debian-bookworm | MOLECULE_DEPENDENCY_NAME: galaxy 2026-07-02 18:26:52.438436 | debian-bookworm | MOLECULE_DRIVER_NAME: default 2026-07-02 18:26:52.438450 | debian-bookworm | MOLECULE_ENV_FILE: /home/zuul/src/github.com/osism/ansible-collection-services/.env.yml 2026-07-02 18:26:52.438466 | debian-bookworm | MOLECULE_EPHEMERAL_DIRECTORY: /home/zuul/.ansible/tmp/molecule.oWZD.delegated 2026-07-02 18:26:52.438481 | debian-bookworm | MOLECULE_FILE: /home/zuul/.ansible/tmp/molecule.oWZD.delegated/molecule.yml 2026-07-02 18:26:52.438495 | debian-bookworm | MOLECULE_INSTANCE_CONFIG: /home/zuul/.ansible/tmp/molecule.oWZD.delegated/instance_config.yml 2026-07-02 18:26:52.438510 | debian-bookworm | MOLECULE_INVENTORY_FILE: /home/zuul/.ansible/tmp/molecule.oWZD.delegated/inventory/ansible_inventory.yml 2026-07-02 18:26:52.438525 | debian-bookworm | MOLECULE_PROJECT_DIRECTORY: /home/zuul/src/github.com/osism/ansible-collection-services 2026-07-02 18:26:52.438539 | debian-bookworm | MOLECULE_PROVISIONER_NAME: ansible 2026-07-02 18:26:52.438553 | debian-bookworm | MOLECULE_SCENARIO_DIRECTORY: /home/zuul/src/github.com/osism/ansible-collection-services/molecule/delegated 2026-07-02 18:26:52.438568 | debian-bookworm | MOLECULE_SCENARIO_NAME: delegated 2026-07-02 18:26:52.438582 | debian-bookworm | MOLECULE_STATE_FILE: /home/zuul/.ansible/tmp/molecule.oWZD.delegated/state.yml 2026-07-02 18:26:52.438597 | debian-bookworm | MOLECULE_VERIFIER_NAME: testinfra 2026-07-02 18:26:52.438612 | debian-bookworm | MOLECULE_VERIFIER_TEST_DIRECTORY: /home/zuul/src/github.com/osism/ansible-collection-services/molecule/delegated/tests 2026-07-02 18:26:52.438627 | debian-bookworm | 2026-07-02 18:26:52.438674 | debian-bookworm | DEBUG SHELL REPLAY: ANSIBLE_COLLECTIONS_PATH=/home/zuul/venv/.ansible/collections:/home/zuul/.ansible/collections ANSIBLE_CONFIG=/home/zuul/.ansible/tmp/molecule.oWZD.delegated/ansible.cfg ANSIBLE_LIBRARY=../../plugins ANSIBLE_PYTHON_INTERPRETER=/home/zuul/venv/bin/python ANSIBLE_ROLE=auditd ANSIBLE_ROLES_PATH=../../roles ANSIBLE_VERBOSITY=1 MOLECULE_DEBUG=True MOLECULE_DEPENDENCY_NAME=galaxy MOLECULE_DRIVER_NAME=default MOLECULE_ENV_FILE=/home/zuul/src/github.com/osism/ansible-collection-services/.env.yml MOLECULE_EPHEMERAL_DIRECTORY=/home/zuul/.ansible/tmp/molecule.oWZD.delegated MOLECULE_FILE=/home/zuul/.ansible/tmp/molecule.oWZD.delegated/molecule.yml MOLECULE_INSTANCE_CONFIG=/home/zuul/.ansible/tmp/molecule.oWZD.delegated/instance_config.yml MOLECULE_INVENTORY_FILE=/home/zuul/.ansible/tmp/molecule.oWZD.delegated/inventory/ansible_inventory.yml MOLECULE_PROJECT_DIRECTORY=/home/zuul/src/github.com/osism/ansible-collection-services MOLECULE_PROVISIONER_NAME=ansible MOLECULE_SCENARIO_DIRECTORY=/home/zuul/src/github.com/osism/ansible-collection-services/molecule/delegated MOLECULE_SCENARIO_NAME=delegated MOLECULE_STATE_FILE=/home/zuul/.ansible/tmp/molecule.oWZD.delegated/state.yml MOLECULE_VERIFIER_NAME=testinfra MOLECULE_VERIFIER_TEST_DIRECTORY=/home/zuul/src/github.com/osism/ansible-collection-services/molecule/delegated/tests 2026-07-02 18:26:52.707667 | debian-bookworm | writing pytest debug information to pytestdebug.log 2026-07-02 18:26:52.725535 | debian-bookworm | ============================= test session starts ============================== 2026-07-02 18:26:52.726034 | debian-bookworm | platform linux -- Python 3.11.2, pytest-9.1.1, pluggy-1.6.0 -- /home/zuul/venv/bin/python3 2026-07-02 18:26:52.726430 | debian-bookworm | using: pytest-9.1.1 2026-07-02 18:26:52.726756 | debian-bookworm | registered third-party plugins: 2026-07-02 18:26:52.727027 | debian-bookworm | pytest-testinfra-10.2.2 at /home/zuul/venv/lib/python3.11/site-packages/testinfra/plugin.py 2026-07-02 18:26:52.727228 | debian-bookworm | rootdir: /home/zuul 2026-07-02 18:26:52.727498 | debian-bookworm | plugins: testinfra-10.2.2 2026-07-02 18:26:52.948904 | ubuntu-noble | INFO [delegated > verify] Executing 2026-07-02 18:26:52.950122 | ubuntu-noble | INFO [delegated > verify] Executing Testinfra tests found in /home/zuul/src/github.com/osism/ansible-collection-services/molecule/delegated/tests/... 2026-07-02 18:26:52.951455 | ubuntu-noble | DEBUG ANSIBLE ENVIRONMENT: 2026-07-02 18:26:52.951489 | ubuntu-noble | ANSIBLE_COLLECTIONS_PATH: /home/zuul/venv/.ansible/collections:/home/zuul/.ansible/collections 2026-07-02 18:26:52.951508 | ubuntu-noble | ANSIBLE_CONFIG: /home/zuul/.ansible/tmp/molecule.oWZD.delegated/ansible.cfg 2026-07-02 18:26:52.951524 | ubuntu-noble | ANSIBLE_LIBRARY: ../../plugins 2026-07-02 18:26:52.951537 | ubuntu-noble | ANSIBLE_PYTHON_INTERPRETER: /home/zuul/venv/bin/python 2026-07-02 18:26:52.951550 | ubuntu-noble | ANSIBLE_ROLE: auditd 2026-07-02 18:26:52.951562 | ubuntu-noble | ANSIBLE_ROLES_PATH: ../../roles 2026-07-02 18:26:52.951575 | ubuntu-noble | ANSIBLE_VERBOSITY: 1 2026-07-02 18:26:52.951589 | ubuntu-noble | 2026-07-02 18:26:52.951612 | ubuntu-noble | DEBUG MOLECULE ENVIRONMENT: 2026-07-02 18:26:52.951625 | ubuntu-noble | MOLECULE_DEBUG: True 2026-07-02 18:26:52.951637 | ubuntu-noble | MOLECULE_DEPENDENCY_NAME: galaxy 2026-07-02 18:26:52.951650 | ubuntu-noble | MOLECULE_DRIVER_NAME: default 2026-07-02 18:26:52.951663 | ubuntu-noble | MOLECULE_ENV_FILE: /home/zuul/src/github.com/osism/ansible-collection-services/.env.yml 2026-07-02 18:26:52.951676 | ubuntu-noble | MOLECULE_EPHEMERAL_DIRECTORY: /home/zuul/.ansible/tmp/molecule.oWZD.delegated 2026-07-02 18:26:52.951688 | ubuntu-noble | MOLECULE_FILE: /home/zuul/.ansible/tmp/molecule.oWZD.delegated/molecule.yml 2026-07-02 18:26:52.951701 | ubuntu-noble | MOLECULE_INSTANCE_CONFIG: /home/zuul/.ansible/tmp/molecule.oWZD.delegated/instance_config.yml 2026-07-02 18:26:52.951714 | ubuntu-noble | MOLECULE_INVENTORY_FILE: /home/zuul/.ansible/tmp/molecule.oWZD.delegated/inventory/ansible_inventory.yml 2026-07-02 18:26:52.951727 | ubuntu-noble | MOLECULE_PROJECT_DIRECTORY: /home/zuul/src/github.com/osism/ansible-collection-services 2026-07-02 18:26:52.951778 | ubuntu-noble | MOLECULE_PROVISIONER_NAME: ansible 2026-07-02 18:26:52.951800 | ubuntu-noble | MOLECULE_SCENARIO_DIRECTORY: /home/zuul/src/github.com/osism/ansible-collection-services/molecule/delegated 2026-07-02 18:26:52.951824 | ubuntu-noble | MOLECULE_SCENARIO_NAME: delegated 2026-07-02 18:26:52.951840 | ubuntu-noble | MOLECULE_STATE_FILE: /home/zuul/.ansible/tmp/molecule.oWZD.delegated/state.yml 2026-07-02 18:26:52.951853 | ubuntu-noble | MOLECULE_VERIFIER_NAME: testinfra 2026-07-02 18:26:52.951865 | ubuntu-noble | MOLECULE_VERIFIER_TEST_DIRECTORY: /home/zuul/src/github.com/osism/ansible-collection-services/molecule/delegated/tests 2026-07-02 18:26:52.951878 | ubuntu-noble | 2026-07-02 18:26:52.951916 | ubuntu-noble | DEBUG SHELL REPLAY: ANSIBLE_COLLECTIONS_PATH=/home/zuul/venv/.ansible/collections:/home/zuul/.ansible/collections ANSIBLE_CONFIG=/home/zuul/.ansible/tmp/molecule.oWZD.delegated/ansible.cfg ANSIBLE_LIBRARY=../../plugins ANSIBLE_PYTHON_INTERPRETER=/home/zuul/venv/bin/python ANSIBLE_ROLE=auditd ANSIBLE_ROLES_PATH=../../roles ANSIBLE_VERBOSITY=1 MOLECULE_DEBUG=True MOLECULE_DEPENDENCY_NAME=galaxy MOLECULE_DRIVER_NAME=default MOLECULE_ENV_FILE=/home/zuul/src/github.com/osism/ansible-collection-services/.env.yml MOLECULE_EPHEMERAL_DIRECTORY=/home/zuul/.ansible/tmp/molecule.oWZD.delegated MOLECULE_FILE=/home/zuul/.ansible/tmp/molecule.oWZD.delegated/molecule.yml MOLECULE_INSTANCE_CONFIG=/home/zuul/.ansible/tmp/molecule.oWZD.delegated/instance_config.yml MOLECULE_INVENTORY_FILE=/home/zuul/.ansible/tmp/molecule.oWZD.delegated/inventory/ansible_inventory.yml MOLECULE_PROJECT_DIRECTORY=/home/zuul/src/github.com/osism/ansible-collection-services MOLECULE_PROVISIONER_NAME=ansible MOLECULE_SCENARIO_DIRECTORY=/home/zuul/src/github.com/osism/ansible-collection-services/molecule/delegated MOLECULE_SCENARIO_NAME=delegated MOLECULE_STATE_FILE=/home/zuul/.ansible/tmp/molecule.oWZD.delegated/state.yml MOLECULE_VERIFIER_NAME=testinfra MOLECULE_VERIFIER_TEST_DIRECTORY=/home/zuul/src/github.com/osism/ansible-collection-services/molecule/delegated/tests 2026-07-02 18:26:53.265777 | ubuntu-noble | writing pytest debug information to pytestdebug.log 2026-07-02 18:26:53.283780 | ubuntu-noble | ============================= test session starts ============================== 2026-07-02 18:26:53.283811 | ubuntu-noble | platform linux -- Python 3.12.3, pytest-9.1.1, pluggy-1.6.0 -- /home/zuul/venv/bin/python3 2026-07-02 18:26:53.283817 | ubuntu-noble | using: pytest-9.1.1 2026-07-02 18:26:53.283823 | ubuntu-noble | registered third-party plugins: 2026-07-02 18:26:53.284006 | ubuntu-noble | pytest-testinfra-10.2.2 at /home/zuul/venv/lib/python3.12/site-packages/testinfra/plugin.py 2026-07-02 18:26:53.284328 | ubuntu-noble | rootdir: /home/zuul 2026-07-02 18:26:53.284618 | ubuntu-noble | plugins: testinfra-10.2.2 2026-07-02 18:26:53.593327 | debian-bookworm | collecting ... collected 6 items 2026-07-02 18:26:53.593697 | debian-bookworm | 2026-07-02 18:26:54.305243 | ubuntu-noble | collecting ... collected 6 items 2026-07-02 18:26:54.305345 | ubuntu-noble | 2026-07-02 18:26:57.951962 | debian-bookworm | tests/auditd.py::test_pkg[ansible://molecule-auditd] PASSED [ 16%] 2026-07-02 18:26:58.002913 | debian-bookworm | tests/auditd.py::test_conffile[ansible://molecule-auditd] PASSED [ 33%] 2026-07-02 18:26:58.729950 | ubuntu-noble | tests/auditd.py::test_pkg[ansible://molecule-auditd] PASSED [ 16%] 2026-07-02 18:26:58.787463 | ubuntu-noble | tests/auditd.py::test_conffile[ansible://molecule-auditd] PASSED [ 33%] 2026-07-02 18:27:00.441065 | debian-bookworm | tests/auditd.py::test_adjustment[ansible://molecule-auditd] PASSED [ 50%] 2026-07-02 18:27:01.257855 | ubuntu-noble | tests/auditd.py::test_adjustment[ansible://molecule-auditd] PASSED [ 50%] 2026-07-02 18:27:04.766470 | debian-bookworm | tests/auditd.py::test_rulefiles[ansible://molecule-auditd] PASSED [ 66%] 2026-07-02 18:27:05.918565 | debian-bookworm | tests/auditd.py::test_srv[ansible://molecule-auditd] PASSED [ 83%] 2026-07-02 18:27:05.975869 | debian-bookworm | wrote pytest debug information to pytestdebug.log 2026-07-02 18:27:05.975951 | debian-bookworm | tests/auditd.py::test_function[ansible://molecule-auditd] PASSED [100%] 2026-07-02 18:27:05.975969 | debian-bookworm | 2026-07-02 18:27:05.975985 | debian-bookworm | ============================== 6 passed in 13.23s ============================== 2026-07-02 18:27:06.018391 | debian-bookworm | INFO [delegated > verify] Verifier completed successfully. 2026-07-02 18:27:06.018906 | debian-bookworm | INFO [delegated > verify] Executed: Successful 2026-07-02 18:27:06.019972 | debian-bookworm | INFO Molecule executed 1 scenario (1 successful) 2026-07-02 18:27:06.269937 | ubuntu-noble | tests/auditd.py::test_rulefiles[ansible://molecule-auditd] PASSED [ 66%] 2026-07-02 18:27:07.515708 | ubuntu-noble | tests/auditd.py::test_srv[ansible://molecule-auditd] PASSED [ 83%] 2026-07-02 18:27:07.552471 | ubuntu-noble | wrote pytest debug information to pytestdebug.log 2026-07-02 18:27:07.552532 | ubuntu-noble | tests/auditd.py::test_function[ansible://molecule-auditd] PASSED [100%] 2026-07-02 18:27:07.552547 | ubuntu-noble | 2026-07-02 18:27:07.552560 | ubuntu-noble | ============================== 6 passed in 14.26s ============================== 2026-07-02 18:27:07.589519 | ubuntu-noble | INFO [delegated > verify] Verifier completed successfully. 2026-07-02 18:27:07.591814 | ubuntu-noble | INFO [delegated > verify] Executed: Successful 2026-07-02 18:27:07.591853 | ubuntu-noble | INFO Molecule executed 1 scenario (1 successful) 2026-07-02 18:27:08.083753 | debian-bookworm | ok: Runtime: 0:00:15.720493 2026-07-02 18:27:08.092359 | ubuntu-noble | ok: Runtime: 0:00:17.217231 2026-07-02 18:27:08.099089 | 2026-07-02 18:27:08.099207 | TASK [ansible-molecule : Run molecule destroy action with scenario delegated] 2026-07-02 18:27:08.649430 | debian-bookworm | skipping: Conditional result was False 2026-07-02 18:27:08.650136 | ubuntu-noble | skipping: Conditional result was False 2026-07-02 18:27:08.662761 | 2026-07-02 18:27:08.662907 | PLAY RECAP 2026-07-02 18:27:08.662969 | debian-bookworm | ok: 17 changed: 12 unreachable: 0 failed: 0 skipped: 16 rescued: 0 ignored: 0 2026-07-02 18:27:08.663003 | ubuntu-noble | ok: 17 changed: 12 unreachable: 0 failed: 0 skipped: 16 rescued: 0 ignored: 0 2026-07-02 18:27:08.663025 | 2026-07-02 18:27:08.842100 | RUN END RESULT_NORMAL: [untrusted : github.com/osism/zuul-jobs/playbooks/ansible-molecule/run.yaml@main] 2026-07-02 18:27:08.844473 | POST-RUN START: [untrusted : github.com/osism/ansible-collection-services/playbooks/collect-container-logs.yml@main] 2026-07-02 18:27:09.665246 | 2026-07-02 18:27:09.665435 | PLAY [Collect container logs] 2026-07-02 18:27:09.691648 | 2026-07-02 18:27:09.691904 | TASK [Create container log directory] 2026-07-02 18:27:10.384715 | ubuntu-noble | changed 2026-07-02 18:27:10.399711 | debian-bookworm | changed 2026-07-02 18:27:10.408558 | 2026-07-02 18:27:10.411052 | TASK [Capture container overview] 2026-07-02 18:27:10.999528 | debian-bookworm | ok: Runtime: 0:00:00.014141 2026-07-02 18:27:11.056307 | ubuntu-noble | ok: Runtime: 0:00:00.012977 2026-07-02 18:27:11.063368 | 2026-07-02 18:27:11.063499 | TASK [List containers] 2026-07-02 18:27:11.629373 | debian-bookworm | ok: ERROR (ignored) 2026-07-02 18:27:11.629764 | debian-bookworm | { 2026-07-02 18:27:11.629810 | debian-bookworm | "failed_when_result": false, 2026-07-02 18:27:11.629836 | debian-bookworm | "msg": "[Errno 2] No such file or directory: b'docker'", 2026-07-02 18:27:11.629866 | debian-bookworm | "rc": 2 2026-07-02 18:27:11.629887 | debian-bookworm | } 2026-07-02 18:27:11.635566 | ubuntu-noble | ok: ERROR (ignored) 2026-07-02 18:27:11.635764 | ubuntu-noble | { 2026-07-02 18:27:11.635800 | ubuntu-noble | "failed_when_result": false, 2026-07-02 18:27:11.635823 | ubuntu-noble | "msg": "[Errno 2] No such file or directory: b'docker'", 2026-07-02 18:27:11.635845 | ubuntu-noble | "rc": 2 2026-07-02 18:27:11.635864 | ubuntu-noble | } 2026-07-02 18:27:11.645287 | 2026-07-02 18:27:11.645423 | LOOP [Save per-container logs] 2026-07-02 18:27:11.739415 | 2026-07-02 18:27:11.739683 | LOOP [Save per-container inspect (state and health)] 2026-07-02 18:27:11.849275 | 2026-07-02 18:27:11.849516 | TASK [Open container log permissions] 2026-07-02 18:27:12.190684 | debian-bookworm | ok 2026-07-02 18:27:12.236961 | ubuntu-noble | changed 2026-07-02 18:27:12.238653 | 2026-07-02 18:27:12.238737 | PLAY RECAP 2026-07-02 18:27:12.238799 | debian-bookworm | ok: 4 changed: 1 unreachable: 0 failed: 0 skipped: 2 rescued: 0 ignored: 0 2026-07-02 18:27:12.238891 | ubuntu-noble | ok: 4 changed: 2 unreachable: 0 failed: 0 skipped: 2 rescued: 0 ignored: 0 2026-07-02 18:27:12.238917 | 2026-07-02 18:27:12.390901 | POST-RUN END RESULT_NORMAL: [untrusted : github.com/osism/ansible-collection-services/playbooks/collect-container-logs.yml@main] 2026-07-02 18:27:12.392397 | POST-RUN START: [trusted : github.com/osism/zuul-config/playbooks/base/post-fetch.yaml@main] 2026-07-02 18:27:13.258578 | 2026-07-02 18:27:13.258799 | PLAY [Base post-fetch] 2026-07-02 18:27:13.275162 | 2026-07-02 18:27:13.275348 | TASK [diagnose-network : Ensure log directory exists] 2026-07-02 18:27:14.007150 | debian-bookworm | ok 2026-07-02 18:27:14.043442 | ubuntu-noble | ok 2026-07-02 18:27:14.052460 | 2026-07-02 18:27:14.052673 | TASK [diagnose-network : Snapshot dual-stack network state (post)] 2026-07-02 18:27:25.876733 | debian-bookworm | ok: Runtime: 0:00:06.076088 2026-07-02 18:27:26.018198 | ubuntu-noble | ok: Runtime: 0:00:06.060029 2026-07-02 18:27:26.025513 | 2026-07-02 18:27:26.025697 | TASK [diagnose-network : Snapshot Docker/BuildKit IPv6 config (teardown)] 2026-07-02 18:27:32.170152 | debian-bookworm | ok: Runtime: 0:00:00.009146 2026-07-02 18:27:32.413675 | ubuntu-noble | ok: Runtime: 0:00:00.011325 2026-07-02 18:27:32.421921 | 2026-07-02 18:27:32.422068 | TASK [diagnose-network : Probe container network namespace (teardown)] 2026-07-02 18:27:38.508958 | debian-bookworm | ok: Runtime: 0:00:00.009477 2026-07-02 18:27:38.704951 | ubuntu-noble | ok: Runtime: 0:00:00.012549 2026-07-02 18:27:38.728154 | 2026-07-02 18:27:38.728331 | TASK [fetch-output : Set log path for multiple nodes] 2026-07-02 18:27:38.794617 | debian-bookworm | ok 2026-07-02 18:27:38.810213 | ubuntu-noble | ok 2026-07-02 18:27:38.817456 | 2026-07-02 18:27:38.817644 | TASK [fetch-output : Set log path for single node] 2026-07-02 18:27:38.850478 | debian-bookworm | skipping: Conditional result was False 2026-07-02 18:27:38.882614 | ubuntu-noble | skipping: Conditional result was False 2026-07-02 18:27:38.889797 | 2026-07-02 18:27:38.889950 | LOOP [fetch-output : Ensure local output dirs] 2026-07-02 18:27:39.240590 | debian-bookworm -> localhost | changed: "/var/lib/zuul/builds/8f3df11461124628bc01bd1cee92f2a3/work/logs/debian-bookworm" 2026-07-02 18:27:39.263306 | ubuntu-noble -> localhost | changed: "/var/lib/zuul/builds/8f3df11461124628bc01bd1cee92f2a3/work/logs/ubuntu-noble" 2026-07-02 18:27:39.538463 | debian-bookworm -> localhost | changed: "/var/lib/zuul/builds/8f3df11461124628bc01bd1cee92f2a3/work/artifacts" 2026-07-02 18:27:39.554814 | ubuntu-noble -> localhost | ok: "/var/lib/zuul/builds/8f3df11461124628bc01bd1cee92f2a3/work/artifacts" 2026-07-02 18:27:39.816956 | debian-bookworm -> localhost | changed: "/var/lib/zuul/builds/8f3df11461124628bc01bd1cee92f2a3/work/docs" 2026-07-02 18:27:39.891182 | ubuntu-noble -> localhost | ok: "/var/lib/zuul/builds/8f3df11461124628bc01bd1cee92f2a3/work/docs" 2026-07-02 18:27:39.891380 | ubuntu-noble -> localhost | changed: All items complete 2026-07-02 18:27:39.891419 | 2026-07-02 18:27:39.916284 | 2026-07-02 18:27:39.916521 | LOOP [fetch-output : Collect logs, artifacts and docs] 2026-07-02 18:27:40.814491 | ubuntu-noble | changed: 2026-07-02 18:27:40.815048 | ubuntu-noble | .d..t...... ./ 2026-07-02 18:27:40.815126 | ubuntu-noble | >f+++++++++ net-debug.post.txt 2026-07-02 18:27:40.815167 | ubuntu-noble | >f+++++++++ net-debug.pre.txt 2026-07-02 18:27:40.815203 | ubuntu-noble | >f+++++++++ sudo-debug.txt 2026-07-02 18:27:40.815239 | ubuntu-noble | >f+++++++++ sudo-strace.log 2026-07-02 18:27:40.815273 | ubuntu-noble | >f+++++++++ sudo-strace.log.time 2026-07-02 18:27:40.815305 | ubuntu-noble | cd+++++++++ container-logs/ 2026-07-02 18:27:40.815335 | ubuntu-noble | >f+++++++++ container-logs/_overview.txt 2026-07-02 18:27:40.827673 | debian-bookworm | changed: 2026-07-02 18:27:40.827818 | debian-bookworm | .d..t...... ./ 2026-07-02 18:27:40.827851 | debian-bookworm | >f+++++++++ net-debug.post.txt 2026-07-02 18:27:40.827875 | debian-bookworm | >f+++++++++ net-debug.pre.txt 2026-07-02 18:27:40.827897 | debian-bookworm | >f+++++++++ sudo-debug.txt 2026-07-02 18:27:40.827917 | debian-bookworm | >f+++++++++ sudo-strace.log 2026-07-02 18:27:40.827936 | debian-bookworm | >f+++++++++ sudo-strace.log.time 2026-07-02 18:27:40.827956 | debian-bookworm | cd+++++++++ container-logs/ 2026-07-02 18:27:40.827975 | debian-bookworm | >f+++++++++ container-logs/_overview.txt 2026-07-02 18:27:41.409825 | ubuntu-noble | changed: .d..t...... ./ 2026-07-02 18:27:41.457846 | debian-bookworm | ok 2026-07-02 18:27:42.040073 | ubuntu-noble | changed: .d..t...... ./ 2026-07-02 18:27:42.085792 | debian-bookworm | ok 2026-07-02 18:27:42.085983 | debian-bookworm | changed: All items complete 2026-07-02 18:27:42.086037 | 2026-07-02 18:27:42.121171 | 2026-07-02 18:27:42.121346 | LOOP [merge-output-to-logs : Move artifacts and docs to logs dir] 2026-07-02 18:27:42.485502 | debian-bookworm -> localhost | ok: Item: artifacts Runtime: 0:00:00.012803 2026-07-02 18:27:42.790746 | debian-bookworm -> localhost | ok: Item: docs Runtime: 0:00:00.008879 2026-07-02 18:27:42.815191 | 2026-07-02 18:27:42.815428 | PLAY RECAP 2026-07-02 18:27:42.815493 | debian-bookworm | ok: 8 changed: 3 unreachable: 0 failed: 0 skipped: 1 rescued: 0 ignored: 0 2026-07-02 18:27:42.815528 | ubuntu-noble | ok: 7 changed: 2 unreachable: 0 failed: 0 skipped: 1 rescued: 0 ignored: 0 2026-07-02 18:27:42.815551 | 2026-07-02 18:27:42.983311 | POST-RUN END RESULT_NORMAL: [trusted : github.com/osism/zuul-config/playbooks/base/post-fetch.yaml@main] 2026-07-02 18:27:42.984790 | POST-RUN START: [trusted : github.com/osism/zuul-config/playbooks/base/post.yaml@main] 2026-07-02 18:27:43.780261 | 2026-07-02 18:27:43.780466 | PLAY [Base post] 2026-07-02 18:27:43.794894 | 2026-07-02 18:27:43.795060 | TASK [remove-build-sshkey : Remove the build SSH key from all nodes] 2026-07-02 18:27:44.656763 | debian-bookworm | changed 2026-07-02 18:27:44.724033 | ubuntu-noble | changed 2026-07-02 18:27:44.739442 | 2026-07-02 18:27:44.739638 | PLAY RECAP 2026-07-02 18:27:44.739756 | debian-bookworm | ok: 1 changed: 1 unreachable: 0 failed: 0 skipped: 0 rescued: 0 ignored: 0 2026-07-02 18:27:44.739804 | ubuntu-noble | ok: 1 changed: 1 unreachable: 0 failed: 0 skipped: 0 rescued: 0 ignored: 0 2026-07-02 18:27:44.739835 | 2026-07-02 18:27:44.926618 | POST-RUN END RESULT_NORMAL: [trusted : github.com/osism/zuul-config/playbooks/base/post.yaml@main] 2026-07-02 18:27:44.928242 | POST-RUN START: [trusted : github.com/osism/zuul-config/playbooks/base/post-logs.yaml@main] 2026-07-02 18:27:45.812752 | 2026-07-02 18:27:45.812945 | PLAY [Base post-logs] 2026-07-02 18:27:45.824520 | 2026-07-02 18:27:45.824706 | TASK [generate-zuul-manifest : Generate Zuul manifest] 2026-07-02 18:27:46.324255 | localhost | changed 2026-07-02 18:27:46.341486 | 2026-07-02 18:27:46.341693 | TASK [generate-zuul-manifest : Return Zuul manifest URL to Zuul] 2026-07-02 18:27:46.382726 | localhost | ok 2026-07-02 18:27:46.388281 | 2026-07-02 18:27:46.388424 | TASK [Set zuul-log-path fact] 2026-07-02 18:27:46.409454 | localhost | ok 2026-07-02 18:27:46.419040 | 2026-07-02 18:27:46.419183 | TASK [set-zuul-log-path-fact : Set log path for a build] 2026-07-02 18:27:46.445897 | localhost | ok 2026-07-02 18:27:46.449344 | 2026-07-02 18:27:46.449471 | TASK [upload-logs : Create log directories] 2026-07-02 18:27:46.978659 | localhost | changed 2026-07-02 18:27:46.986192 | 2026-07-02 18:27:46.986372 | TASK [upload-logs : Ensure logs are readable before uploading] 2026-07-02 18:27:47.543420 | localhost -> localhost | ok: Runtime: 0:00:00.009313 2026-07-02 18:27:47.551156 | 2026-07-02 18:27:47.551355 | TASK [upload-logs : Upload logs to log server] 2026-07-02 18:27:48.174812 | localhost | Output suppressed because no_log was given 2026-07-02 18:27:48.180044 | 2026-07-02 18:27:48.180271 | LOOP [upload-logs : Compress console log and json output] 2026-07-02 18:27:48.243781 | localhost | skipping: Conditional result was False 2026-07-02 18:27:48.249767 | localhost | skipping: Conditional result was False 2026-07-02 18:27:48.265800 | 2026-07-02 18:27:48.266092 | LOOP [upload-logs : Upload compressed console log and json output] 2026-07-02 18:27:48.319416 | localhost | skipping: Conditional result was False 2026-07-02 18:27:48.319906 | 2026-07-02 18:27:48.324356 | localhost | skipping: Conditional result was False 2026-07-02 18:27:48.332378 | 2026-07-02 18:27:48.332666 | LOOP [upload-logs : Upload console log and json output]