Multiple debug output redirection for incident response ?

Hello,

It’s a few months than I started to work with ansible and find it an awesome tool. rebuilding my home lab :slight_smile:
Thanks a lot for this great piece of code!

One of the role/playbook that I work on is for incident response, when you want to collect as much as information as possible without modifying too much the evidence (memory, logs…)
Depending on context, I can output to

  • external media (hardly scalable)
  • network share
  • netcat on a server
  • from where I launch ansible

problem of network share: requirements might be not available even if it is also the preferred way to get trusted binaries. netcat and ansible station would be ideal for output but I want to avoid having one playbook per output type, so I’m looking how to write it best.

the debug modules seems my best bet

is there any plan to give more options to this modules?
local file option or netcat/cryptcat with settings as vars would be great.

found some code here
https://github.com/ansible/ansible-modules-core/blob/3405f69281ddd63fdede4c5f13f06365c769de74/utilities/logic/debug.py
but it seems more all over the place inside
https://github.com/ansible/ansible-modules-core
or is there any specific files?

Any advices on how to handle best this problem?

For network shares into ansible, I found those links
https://docs.ansible.com/ansible/mount_module.html (but no network mount mentionned even if following seems to show it works modulo dependencies probably)
https://github.com/gc3-uzh-ch/ansible-playbooks/blob/master/roles/common/tasks/nfs-clients.yml
https://servercheck.in/blog/getting-file-samba-server-ansible-playbook
https://stackoverflow.com/questions/29899186/how-do-you-provide-domain-credentials-to-ansibles-mount-module
seems good enough if I have dependencies.

Thanks a lot!

J

you can use the template module to put the same info into a file:

- template: src=debug.j2 dest=/path/to/logfile

debug.j2:

{{ cmd_outp8ut.stdout_lines|to_nice_json }}