# how to control 100% of the state of a server

**URL:** <https://forum.ansible.com/t/how-to-control-100-of-the-state-of-a-server/23637>\
**Category:** Ansible Project\
**Created:** [February 4, 2017, 6:33am UTC](https://forum.ansible.com/t/how-to-control-100-of-the-state-of-a-server/23637 "2017-02-04T06:33:49Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![Ioannis\_Cherouvim](https://avatars.discourse-cdn.com/v4/letter/i/71e660/32.png) [@Ioannis\_Cherouvim](https://forum.ansible.com/u/Ioannis_Cherouvim)\
**Post date:** [February 4, 2017, 6:33am UTC](https://forum.ansible.com/t/how-to-control-100-of-the-state-of-a-server/23637/1 "2017-02-04T06:33:49Z")

</div>

Hello

I provision my servers using ansible, but sometimes developers will log into a server and do adhoc things.  
Changes that happen on things that have been provisioned by ansible (e.g templated files, changes on configs using ini\_file etc) can quickly be spotted by running the playbook using --diff --check  
But what about all other “ansible untracked” changes?

For example:

- someone adds a crontab entry
- someone alters something in /etc/hosts which is not provisioned by ansible
- someone installs a package which does not appear at all in my playbooks

I understand that ansible cannot easily solve this unless I write a million rules to catch all such cases.

So, what would a sensible approach to solving this be (apart from denying server access to those people)?

thanks

---

<div class="post-metadata">

**Author:** ![Brian\_Coca](https://avatars.discourse-cdn.com/v4/letter/b/6de8d8/32.png) [@Brian\_Coca](https://forum.ansible.com/u/Brian_Coca)\
**Post date:** [February 6, 2017, 2:52pm UTC](https://forum.ansible.com/t/how-to-control-100-of-the-state-of-a-server/23637/2 "2017-02-06T14:52:37Z")

</div>

You can use a file alteration monitor (tripwire, aide, osiris) to keep  
track of these things. If you don't want to go through all that, you  
can use gam and/or inotify to create a poor man's version.

---

<div class="post-metadata">

**Author:** ![Ioannis\_Cherouvim](https://avatars.discourse-cdn.com/v4/letter/i/71e660/32.png) [@Ioannis\_Cherouvim](https://forum.ansible.com/u/Ioannis_Cherouvim)\
**Post date:** [February 6, 2017, 7:22pm UTC](https://forum.ansible.com/t/how-to-control-100-of-the-state-of-a-server/23637/3 "2017-02-06T19:22:55Z")

</div>

Wow, that was an eye opener. Thanks!