# Ansible become-success command is logging variables

**URL:** <https://forum.ansible.com/t/ansible-become-success-command-is-logging-variables/25737>\
**Category:** Ansible Project\
**Created:** [October 12, 2017, 3:17pm UTC](https://forum.ansible.com/t/ansible-become-success-command-is-logging-variables/25737 "2017-10-12T15:17:13Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![Jonathan\_Nunez\_Aguin](https://avatars.discourse-cdn.com/v4/letter/j/aeb1de/32.png) [@Jonathan\_Nunez\_Aguin](https://forum.ansible.com/u/Jonathan_Nunez_Aguin)\
**Post date:** [October 12, 2017, 3:17pm UTC](https://forum.ansible.com/t/ansible-become-success-command-is-logging-variables/25737/1 "2017-10-12T15:17:13Z")

</div>

Hello,

I have a small play that runs in a remote server as a user X, during the become process, Ansible seems to invoke a remote command (command.py) that gets logged in the remote machine syslog. If the task for this play contains an environment variable, like PASSWORD for example, it will also be included in such log. Syslog is owned by root and not world-readable, but still I would like to be prevented. Is there a way to tell Ansible to include that environment variable inside the command.py?

Example play:

```auto
- hosts: dms
  gather_facts: no
  become: true
  become_user: remote_user
  tasks:
    - name: Test command
      shell: echo hello
      environment:
        PASSWORD: "supersecretpassword"

```

```auto

```

The logging observed on the syslog file (/var/log/messages):

```auto

```

```auto
Oct 12 15:13:39 remote-host sudo: myuser : TTY=pts/1 ; PWD=/home/myuser ; USER=remote_user ; COMMAND=/bin/bash -c echo BECOME-SUCCESS-gethoacihsravpsppeeepnhdcqkzgrpt; PASSWORD=supersecretpassword /usr/bin/python /tmp/ansible-tmp-1507821212.27-201142262398347/command.py
Oct 12 15:13:39 remote-host ansible-command: Invoked with warn=True executable=None _uses_shell=True _raw_params=echo hello removes=None creates=None chdir=None stdin=None

```

```auto

```

Thanks!

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/ansible/original/1X/1882d9a01da5d8996a862359b0913cc568a39b84.svg) [@system](https://forum.ansible.com/u/system)\
**Post date:** [October 12, 2017, 3:51pm UTC](https://forum.ansible.com/t/ansible-become-success-command-is-logging-variables/25737/2 "2017-10-12T15:51:02Z")

</div>

No, you CAN use the shell module instead and define the var inline:

- shell: PASSWORD=xxx /run/stuff

Another option is to 'silence' that command via `no_log: True` or even  
globally avoid logging on target via the 'no\_target\_syslog' setting.

---

<div class="post-metadata">

**Author:** ![Jonathan\_Nunez\_Aguin](https://avatars.discourse-cdn.com/v4/letter/j/aeb1de/32.png) [@Jonathan\_Nunez\_Aguin](https://forum.ansible.com/u/Jonathan_Nunez_Aguin)\
**Post date:** [October 12, 2017, 4:04pm UTC](https://forum.ansible.com/t/ansible-become-success-command-is-logging-variables/25737/3 "2017-10-12T16:04:44Z")

</div>

Hey Brian,

Unfortunately, “no\_target\_syslog” didn’t make any difference, I am still seeing the become-success message on the syslog, however the other ansible-command line has gone, although that one didn’t contain the password. The same behaviour was observed with no\_log.

Moving the variable to be inline solves the issue partially as now the task output shows it.

Is there anything else I can try out?

Thanks!

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/ansible/original/1X/1882d9a01da5d8996a862359b0913cc568a39b84.svg) [@system](https://forum.ansible.com/u/system)\
**Post date:** [October 12, 2017, 4:18pm UTC](https://forum.ansible.com/t/ansible-become-success-command-is-logging-variables/25737/4 "2017-10-12T16:18:04Z")

</div>

Ah, sorry, I forgot that running sudo itself produces log entries  
over which Ansible has no control. My previous email just lets you  
turn off the ones Ansible creates directly.