<p dir="auto">It showed, that more reasonable for oVirt VMs <code class="notranslate">state</code> present is to don't start them. Better solution is just to create them if it don't exist and don't touch the state of the VM.</p>
<h5 dir="auto">ISSUE TYPE</h5>

<ul dir="auto">
<li>Bug Report</li>
</ul>
<h5 dir="auto">COMPONENT NAME</h5>

<p dir="auto">ovirt_vms</p>
<h5 dir="auto">ANSIBLE VERSION</h5>

<div class="snippet-clipboard-content notranslate position-relative overflow-auto" data-snippet-clipboard-copy-content="2.4.0"><pre class="notranslate"><code class="notranslate">2.4.0
</code></pre></div>
<h5 dir="auto">CONFIGURATION</h5>

<h5 dir="auto">OS / ENVIRONMENT</h5>

<h5 dir="auto">SUMMARY</h5>

<h5 dir="auto">STEPS TO REPRODUCE</h5>


<div class="highlight highlight-source-yaml notranslate position-relative overflow-auto" dir="auto" data-snippet-clipboard-copy-content=""><pre class="notranslate"></pre></div>

<h5 dir="auto">EXPECTED RESULTS</h5>

<h5 dir="auto">ACTUAL RESULTS</h5>


<div class="snippet-clipboard-content notranslate position-relative overflow-auto" data-snippet-clipboard-copy-content=""><pre class="notranslate"><code class="notranslate">
</code></pre></div>
<h5 dir="auto">ISSUE TYPE</h5>

<ul dir="auto">
<li>Bug Report</li>
</ul>
<h5 dir="auto">COMPONENT NAME</h5>

<p dir="auto">/usr/lib/python2.7/site-packages/ansible/modules/system/pamd.py</p>
<h5 dir="auto">ANSIBLE VERSION</h5>

<div class="snippet-clipboard-content notranslate position-relative overflow-auto" data-snippet-clipboard-copy-content="ansible 2.3.0.0
  config file = /var/lib/ansible/local/ansible.cfg
  configured module search path = Default w/o overrides
  python version = 2.7.5 (default, Aug 29 2016, 10:12:21) [GCC 4.8.5 20150623 (Red Hat 4.8.5-4)]"><pre class="notranslate"><code class="notranslate">ansible 2.3.0.0
  config file = /var/lib/ansible/local/ansible.cfg
  configured module search path = Default w/o overrides
  python version = 2.7.5 (default, Aug 29 2016, 10:12:21) [GCC 4.8.5 20150623 (Red Hat 4.8.5-4)]
</code></pre></div>
<h5 dir="auto">CONFIGURATION</h5>
<p dir="auto">[defaults]<br>
inventory      = ./inventory_dlabtuxm<br>
forks          = 30<br>
remote_port    = 22<br>
gather_subset	= all<br>
gather_timeout	= 10<br>
roles_path	= ./roles<br>
host_key_checking = False<br>
timeout = 5<br>
remote_user = root<br>
log_path = /var/log/ansible/ansible.log<br>
ansible_managed = Ansible managed<br>
squash_actions = apk,apt,dnf,homebrew,package,pacman,pkgng,yum,zypper<br>
no_log = False<br>
var_compression_level = 9<br>
module_compression = 'ZIP_DEFLATED'<br>
max_diff_size = 1048576<br>
[privilege_escalation]<br>
become=True<br>
become_method=sudo<br>
become_user=root<br>
become_ask_pass=False<br>
[ssh_connection]<br>
[colors]</p>
<h5 dir="auto">OS / ENVIRONMENT</h5>

<p dir="auto">N/A</p>
<h5 dir="auto">SUMMARY</h5>

<p dir="auto">When you have more than 2 parameters on a rule.control, the module duplicate parameters starting at second parameter, as many times as rule_types exits before. No matter whether apply some changes or not (in the playbook), this happens all the time and inserts these duplicates parameters each time you run the playbook.</p>
<h5 dir="auto">STEPS TO REPRODUCE</h5>

<p dir="auto">Example: /etc/pam.d/system-auth</p>
<p dir="auto">auth      	required	pam_env.so<br>
auth      	required	pam_tally2.so deny=5 onerr=fail<br>
auth      	sufficient	pam_fprintd.so<br>
auth      	[default=1 success=ok]	pam_localuser.so<br>
auth      	[success=done ignore=ignore default=die] ignore=ignore default=die] ignore=ignore default=die] ignore=ignore default=die] ignore=ignore default=die] pam_unix.so nullok</p>
<p dir="auto">As you can see, there are 4 rule_types (AUTH), before the rule_control ([success=done ignore=ignore default=die]), and it duplicates, starting the second parameter, a total of 4 times.</p>
<p dir="auto">I starting to analyze the code, and I think the string split to assign values to each rule could be enhanced with a loop. That way no matter how many parameters rule.control have.</p>
<p dir="auto"><a class="user-mention notranslate" data-hovercard-type="organization" data-hovercard-url="/orgs/classmethod/hovercard" data-octo-click="hovercard-link-click" data-octo-dimensions="link_type:self" href="https://github.com/classmethod">@classmethod</a><br>
def rulefromstring(cls, stringline):<br>
split_line = stringline.split()</p>
<div class="snippet-clipboard-content notranslate position-relative overflow-auto" data-snippet-clipboard-copy-content="    rule_type = split_line[0]
    rule_control = split_line[1]

    if rule_control.startswith('['):
        rule_control = stringline[stringline.index('['):
                                  stringline.index(']')+1]"><pre class="notranslate"><code class="notranslate">    rule_type = split_line[0]
    rule_control = split_line[1]

    if rule_control.startswith('['):
        rule_control = stringline[stringline.index('['):
                                  stringline.index(']')+1]
</code></pre></div>
<p dir="auto">###################################################################<br>
if "]" in split_line[2]:<br>
rule_module_path = split_line[3]<br>
rule_module_args = split_line[4:]<br>
else:<br>
rule_module_path = split_line[2]<br>
rule_module_args = split_line[3:]<br>
###################################################################</p>
<div class="snippet-clipboard-content notranslate position-relative overflow-auto" data-snippet-clipboard-copy-content="    return cls(rule_type, rule_control, rule_module_path, rule_module_args)"><pre class="notranslate"><code class="notranslate">    return cls(rule_type, rule_control, rule_module_path, rule_module_args)
</code></pre></div>
<p dir="auto">I tried that piece of code, for example with this line:</p>
<p dir="auto">s="session      [success=1 default=ignore]      pam_succeed_if.so service in crond quiet use_uid"</p>
<p dir="auto">The result is OK:</p>
<p dir="auto">python test_rulefromstring.py<br>
('session', '[success=1 default=ignore]', 'pam_succeed_if.so', ['service', 'in', 'crond', 'quiet', 'use_uid'])</p>
<p dir="auto">But if you try with more than two parameter in the rule_control:</p>
<p dir="auto">s="account      [success=ok new_authtok_reqd=ok ignore=ignore default=bad] pam_sss.so service in crond quiet use_uid"</p>
<p dir="auto">The result is:</p>
<p dir="auto">python test_rulefromstring.py<br>
('account', '[success=ok new_authtok_reqd=ok ignore=ignore default=bad]', 'new_authtok_reqd=ok', ['ignore=ignore', 'default=bad]', 'pam_sss.so', 'service', 'in', 'crond', 'quiet', 'use_uid'])</p>
<p dir="auto">This means that rule_module_path and rule_module_args get an incorrect value.</p>
<p dir="auto">The loop:</p>
<p dir="auto">for line, val in enumerate(stringline.split()):<br>
print line, val<br>
if "]" in val:<br>
rule_module_path = split_line[line+1]<br>
rule_module_args = split_line[line+2:]<br>
else:<br>
rule_module_path = split_line[2]<br>
rule_module_args = split_line[3:]</p>
<h1 dir="auto">python test_rulefromstring.py</h1>
<p dir="auto">0 account<br>
1 [success=ok<br>
2 new_authtok_reqd=ok<br>
3 ignore=ignore<br>
4 default=bad]<br>
5 pam_sss.so<br>
6 service<br>
7 in<br>
8 crond<br>
9 quiet<br>
10 use_uid<br>
('account', '[success=ok new_authtok_reqd=ok ignore=ignore default=bad]', 'pam_sss.so', ['service', 'in', 'crond', 'quiet', 'use_uid'])</p>
<p dir="auto">I haven't been able to found which piece of code change the rule, would you be so kind to help me or guide me on this.</p>
<p dir="auto">Thanks in advance,</p>

<div class="highlight highlight-source-yaml notranslate position-relative overflow-auto" dir="auto" data-snippet-clipboard-copy-content=""><pre class="notranslate"></pre></div>

<h5 dir="auto">EXPECTED RESULTS</h5>

<p dir="auto">Example: /etc/pam.d/system-auth</p>
<p dir="auto">auth      	required	pam_env.so<br>
auth      	required	pam_tally2.so deny=5 onerr=fail<br>
auth      	sufficient	pam_fprintd.so<br>
auth      	[default=1 success=ok]	pam_localuser.so<br>
auth      	[success=done ignore=ignore default=die]  pam_unix.so nullok</p>
<h5 dir="auto">ACTUAL RESULTS</h5>

<p dir="auto">Example: /etc/pam.d/system-auth</p>
<p dir="auto">auth      	required	pam_env.so<br>
auth      	required	pam_tally2.so deny=5 onerr=fail<br>
auth      	sufficient	pam_fprintd.so<br>
auth      	[default=1 success=ok]	pam_localuser.so<br>
auth      	[success=done ignore=ignore default=die] ignore=ignore default=die] ignore=ignore default=die] ignore=ignore default=die] ignore=ignore default=die] pam_unix.so nullok</p>

<div class="snippet-clipboard-content notranslate position-relative overflow-auto" data-snippet-clipboard-copy-content=""><pre class="notranslate"><code class="notranslate">
</code></pre></div>