# Excluding AWX/Tower Temporary Credential Extra Vars Files from ARA Recording **URL:** \ **Category:** Get Help\ **Tags:** ara, awx\ **Created:** [February 20, 2026, 4:12pm UTC](https://forum.ansible.com/t/excluding-awx-tower-temporary-credential-extra-vars-files-from-ara-recording/45372 "2026-02-20T16:12:04Z")\ **Posts on this page:** 5\ **Page:** 1
**Author:** ![orx57](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/orx57/32/7618_2.png) [@orx57](https://forum.ansible.com/u/orx57)\ **Post date:** [February 20, 2026, 4:12pm UTC](https://forum.ansible.com/t/excluding-awx-tower-temporary-credential-extra-vars-files-from-ara-recording/45372/1 "2026-02-20T16:12:04Z")
In AWX/Tower, credentials provided to a job template are injected as temporary extra vars files, with paths like: ```auto /tmp/bwrap__/awx__/tmp ``` These files are recorded by ARA: ![image](https://us1.discourse-cdn.com/ansible/original/2X/6/6b844cbc4c71a0d3c5a7c3a7d9acb2f6e86b92ff.png) I tested configurations of the ARA client to try to exclude them, using the **ignored\_files** parameter, among others, without success. Is there a known working pattern or an option I overlook to exclude **only** these temporary credential extra vars files from being recorded by ARA, while still retaining other non-sensitive extra vars? (I must say: I know 🙃 it’s still an AWX/Tower 3.8.5 here, but unfortunately that’s how it is… I hope it won’t be for much longer!) Thank you for your help! ---
**Author:** ![rfc2549](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/rfc2549/32/197_2.png) [@rfc2549](https://forum.ansible.com/u/rfc2549)\ **Post date:** [February 21, 2026, 1:43am UTC](https://forum.ansible.com/t/excluding-awx-tower-temporary-credential-extra-vars-files-from-ara-recording/45372/2 "2026-02-21T01:43:30Z")
Hi, The files included in a pattern provided to ARA\_IGNORED\_FILES will still be created but they should be empty a bit like this from the [integration tests](https://codeberg.org/ansible-community/ara/src/commit/717df99d364907cce7eda92c4741c48a7cea6a91/tests/integration/ignored_files.yaml#L102): ![Screenshot From 2026-02-20 20-39-27](https://us1.discourse-cdn.com/ansible/original/2X/8/879fdd17b300798e026529f030b23bb3c8933485.png) That result came from `export ARA_IGNORED_FILES=".ansible/tmp,ignored_task_file.yaml"`. In the example you provided `/tmp/bwrap` should work. ---
**Author:** ![orx57](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/orx57/32/7618_2.png) [@orx57](https://forum.ansible.com/u/orx57)\ **Post date:** [February 23, 2026, 9:28am UTC](https://forum.ansible.com/t/excluding-awx-tower-temporary-credential-extra-vars-files-from-ara-recording/45372/3 "2026-02-23T09:28:49Z")
Thanks @rfc2549 for your answer. I tested this. `ignored_files = .ansible/tmp,/tmp/bwrap` ![image](https://us1.discourse-cdn.com/ansible/original/2X/3/3c81931770e81b83e58a58dc4c723c0fb29f3116.png) This excludes **all** files of the job, including `env/extravars` and playbooks (`project/generate_freeze.yml` in the example here). ![image](https://us1.discourse-cdn.com/ansible/original/2X/7/7051cd4478adb49f9e11cb8ac7e4c913b4d26fd7.png) The fact that **credentials are provided as temporary extra vars files by AWX/Tower** , with dynamical id and random strings in name and path, and in the same path as all other files of the job, means that we cannot find a fixed string to use in `ignored_files` to **only** exclude credentials. ![image](https://us1.discourse-cdn.com/ansible/original/2X/5/59c19d9904ee3d81900e5dc2c6f0fbdbdb64136c.png) `/tmp/bwrap__/awx__/tmp` I think that in this case, it should be possible to use a regex in `ignored_files`, for example: `/tmp/bwrap_.*/awx_.*/tmp.*` Or is there something else possible? If not, do you think it would be useful to open an issue and look at this implementation? (I’m willing to try to come up with something, if it makes sense.) Have a good day! ---
**Author:** ![rfc2549](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/rfc2549/32/197_2.png) [@rfc2549](https://forum.ansible.com/u/rfc2549)\ **Post date:** [February 23, 2026, 4:21pm UTC](https://forum.ansible.com/t/excluding-awx-tower-temporary-credential-extra-vars-files-from-ara-recording/45372/4 "2026-02-23T16:21:13Z")
Ah, that’s a bit troublesome indeed, I understand better now, thanks. The filtering implementation lives in the ara callback and it’s simple pattern matching: [https://codeberg.org/ansible-community/ara/src/commit/717df99d364907cce7eda92c4741c48a7cea6a91/ara/plugins/callback/ara\_default.py#L727-L734](https://codeberg.org/ansible-community/ara/src/commit/717df99d364907cce7eda92c4741c48a7cea6a91/ara/plugins/callback/ara_default.py#L727-L734) It could be improved to be a list of regex patterns instead, I guess. Feel free to create an issue, no problem with a PR that lets the use case work for you. ---
**Author:** ![orx57](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/orx57/32/7618_2.png) [@orx57](https://forum.ansible.com/u/orx57)\ **Post date:** [February 25, 2026, 11:07am UTC](https://forum.ansible.com/t/excluding-awx-tower-temporary-credential-extra-vars-files-from-ara-recording/45372/5 "2026-02-25T11:07:53Z")
I opened an issue to track this enhancement request: [codeberg.org/ansible-community/ara#649](https://codeberg.org/ansible-community/ara/issues/649) It proposes regex support for `ignored_files` to better target dynamic AWX/Tower temporary credential files without over-filtering other files.