# Multiple debug output redirection for incident response ?

**URL:** <https://forum.ansible.com/t/multiple-debug-output-redirection-for-incident-response/19320>\
**Category:** Ansible Developer\
**Created:** [September 21, 2015, 9:59pm UTC](https://forum.ansible.com/t/multiple-debug-output-redirection-for-incident-response/19320 "2015-09-21T21:59:32Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![Julien\_Touche](https://avatars.discourse-cdn.com/v4/letter/j/fbc32d/32.png) [@Julien\_Touche](https://forum.ansible.com/u/Julien_Touche)\
**Post date:** [September 21, 2015, 9:59pm UTC](https://forum.ansible.com/t/multiple-debug-output-redirection-for-incident-response/19320/1 "2015-09-21T21:59:32Z")

</div>

Hello,

It’s a few months than I started to work with ansible and find it an awesome tool. rebuilding my home lab 🙂  
Thanks a lot for this great piece of code!

One of the role/playbook that I work on is for incident response, when you want to collect as much as information as possible without modifying too much the evidence (memory, logs…)  
Depending on context, I can output to

- external media (hardly scalable)
- network share
- netcat on a server
- from where I launch ansible

problem of network share: requirements might be not available even if it is also the preferred way to get trusted binaries. netcat and ansible station would be ideal for output but I want to avoid having one playbook per output type, so I’m looking how to write it best.

the debug modules seems my best bet

- debug: var=cmd\_output.stdout\_lines  
but for now, it can only display on ansible station ([https://docs.ansible.com/ansible/debug\_module.html](https://docs.ansible.com/ansible/debug_module.html)), not saving to a local file or else

is there any plan to give more options to this modules?  
local file option or netcat/cryptcat with settings as vars would be great.

found some code here  
[https://github.com/ansible/ansible-modules-core/blob/3405f69281ddd63fdede4c5f13f06365c769de74/utilities/logic/debug.py](https://github.com/ansible/ansible-modules-core/blob/3405f69281ddd63fdede4c5f13f06365c769de74/utilities/logic/debug.py)  
but it seems more all over the place inside  
[https://github.com/ansible/ansible-modules-core](https://github.com/ansible/ansible-modules-core)  
or is there any specific files?

Any advices on how to handle best this problem?

For network shares into ansible, I found those links  
[https://docs.ansible.com/ansible/mount\_module.html](https://docs.ansible.com/ansible/mount_module.html) (but no network mount mentionned even if following seems to show it works modulo dependencies probably)  
[https://github.com/gc3-uzh-ch/ansible-playbooks/blob/master/roles/common/tasks/nfs-clients.yml](https://github.com/gc3-uzh-ch/ansible-playbooks/blob/master/roles/common/tasks/nfs-clients.yml)  
[https://servercheck.in/blog/getting-file-samba-server-ansible-playbook](https://servercheck.in/blog/getting-file-samba-server-ansible-playbook)  
[https://stackoverflow.com/questions/29899186/how-do-you-provide-domain-credentials-to-ansibles-mount-module](https://stackoverflow.com/questions/29899186/how-do-you-provide-domain-credentials-to-ansibles-mount-module)  
seems good enough if I have dependencies.

Thanks a lot!

J

---

<div class="post-metadata">

**Author:** ![Brian\_Coca](https://avatars.discourse-cdn.com/v4/letter/b/6de8d8/32.png) [@Brian\_Coca](https://forum.ansible.com/u/Brian_Coca)\
**Post date:** [September 22, 2015, 7:01pm UTC](https://forum.ansible.com/t/multiple-debug-output-redirection-for-incident-response/19320/2 "2015-09-22T19:01:31Z")

</div>

you can use the template module to put the same info into a file:

- template: src=debug.j2 dest=/path/to/logfile

debug.j2:

{{ cmd\_outp8ut.stdout\_lines|to\_nice\_json }}