Answers: <p>Maybe setting verbosity level inside Ansible could provide that information.
  You could either pass it as an argument '<strong>-vv or -v</strong>' or setting it in the ansible.cfg =&gt; <strong>verbosity = 2</strong></p>
  
Answers: CC BY-SA 4.0
Answers: 2023-07-17T08:33:39.353Z
Answers: While this answer is factually correct, I would love to see more context provided as for example done in [this related answer](https://stackoverflow.com/a/18807711/19238131).
Answers: YoshiMbele
Answers: CC BY-SA 4.0
Answers: 2023-07-10T20:32:49.290Z
Answers: 2023-07-10T20:32:49.290Z
Answers: Ajdin Garibović
Body: <p>I have an Ansible playbook that runs against a Linux target host and uses <code>become</code> to gain elevated permissions for those actions that require it.</p>
  <p>For auditing purposes, I need a list of all the <em>Unix commands</em> that are executed using those elevated rights.</p>
  <p>I.e., suppose the playbook uses the <code>yum</code> module to install a package:</p>
  <pre><code>- name: Example
    become: yes
    tasks:
      - name: Provide current Apache
        yum:
          name: httpd
          state: latest
  </code></pre>
  <p>I need to see that the <code>/usr/bin/dnf</code> binary is called with root permissions.</p>
  <p>How can I configure the various logging systems involved to provide that information?</p>
  
Comments: CC BY-SA 4.0
Comments: 2023-07-19T05:08:49.623Z
Comments: Sounds like you want to implement auditing in your system, [Configure Linux system auditing with auditd](https://www.redhat.com/sysadmin/configure-linux-auditing-auditd).
Comments: U880D
Tags: <ansible><logging><audit>
Title: How can I log every command for which an Ansible playbook uses elevated permissions?
UserDisplayName: jstarek
ThreadText: # How can I log every command for which an Ansible playbook uses elevated permissions?
  
  (Asked by: username_0 on 2023-07-10)
  
  I have an Ansible playbook that runs against a Linux target host and uses `become` to gain elevated permissions for those actions that require it.
  
  For auditing purposes, I need a list of all the *Unix commands* that are executed using those elevated rights.
  
  I.e., suppose the playbook uses the `yum` module to install a package:
  
  ```
  - name: Example
    become: yes
    tasks:
      - name: Provide current Apache
        yum:
          name: httpd
          state: latest
  
  ```
  
  I need to see that the `/usr/bin/dnf` binary is called with root permissions.
  
  How can I configure the various logging systems involved to provide that information?
  
  **Tags:** ansible, logging, audit
  
  > **Comments:**
  > **username_1**: Sounds like you want to implement auditing in your system, [Configure Linux system auditing with auditd](https://www.redhat.com/sysadmin/configure-linux-auditing-auditd).  
  
  ---
  
  ## 1 answers
  
  ### Answer by username_2 on 2023-07-10. Score: 0
  
  Maybe setting verbosity level inside Ansible could provide that information.
  You could either pass it as an argument '**-vv or -v**' or setting it in the ansible.cfg => **verbosity = 2**
  
  > **Comments:**
  > **username_3**: While this answer is factually correct, I would love to see more context provided as for example done in [this related answer](https://stackoverflow.com/a/18807711/19238131).  
  
  ---
  
  