# ansible\_failed\_task logs private variables

**URL:** <https://forum.ansible.com/t/ansible-failed-task-logs-private-variables/38097>\
**Category:** Ansible Developer\
**Tags:** vmware\
**Created:** [June 13, 2023, 3:03pm UTC](https://forum.ansible.com/t/ansible-failed-task-logs-private-variables/38097 "2023-06-13T15:03:30Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![Pinknes\_Einhorn](https://avatars.discourse-cdn.com/v4/letter/p/58f4c7/32.png) [@Pinknes\_Einhorn](https://forum.ansible.com/u/Pinknes_Einhorn)\
**Post date:** [June 13, 2023, 3:03pm UTC](https://forum.ansible.com/t/ansible-failed-task-logs-private-variables/38097/1 "2023-06-13T15:03:30Z")

</div>

Hey all,

I’ve been working with error handling during vmware deployment and noticed that Ansible seems to store cleartext passwords in the ansible\_failed\_tasks variable provided by rescue sections in blocks even tho they’ve been set to private.  
Not sure if this is a bug or intentional behavior( or user error), that’s why i wanted to ask if anybody else has experienced this behavior.

As example, here’s a shortened output of the variable:  
“ansible\_failed\_task”: {

“args”: {  
“provider”: {  
“password”: “password123”,  
}  
}

For comparisen, the ansible\_failed\_result variable stores the variable as NO\_LOG\_PARAMETER as i’d expect  
“ansible\_failed\_result”: {

“invocation”: {  
“module\_args”: {  
“provider”: {  
“password”: “VALUE\_SPECIFIED\_IN\_NO\_LOG\_PARAMETER” }}}}

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/ansible/original/1X/1882d9a01da5d8996a862359b0913cc568a39b84.svg) [@system](https://forum.ansible.com/u/system)\
**Post date:** [June 13, 2023, 3:50pm UTC](https://forum.ansible.com/t/ansible-failed-task-logs-private-variables/38097/2 "2023-06-13T15:50:33Z")

</div>

There is no concept of 'private variables' in Ansible, we do have  
'no\_log' for module parameters (or at a task level, but this does not  
seem to be this case). The `no_log` at the module level will handle  
any returns or log data from the module, but does not affect any  
variables that had been fed into it.