# no\_log: True being ignored **URL:** \ **Category:** Ansible Project\ **Tags:** ubuntu\ **Created:** [January 14, 2015, 2:54am UTC](https://forum.ansible.com/t/no-log-true-being-ignored/17258 "2015-01-14T02:54:56Z")\ **Posts on this page:** 4\ **Page:** 1
**Author:** ![Tom\_Bamford](https://avatars.discourse-cdn.com/v4/letter/t/c2a13f/32.png) [@Tom\_Bamford](https://forum.ansible.com/u/Tom_Bamford)\ **Post date:** [January 14, 2015, 2:54am UTC](https://forum.ansible.com/t/no-log-true-being-ignored/17258/1 "2015-01-14T02:54:56Z")
Hi Running Ansible 1.8.2 and I am trying to prevent sensitive information for a task from reaching the log at ANSIBLE\_LOG\_PATH or the console where ansible-playbook is running. My task: ```auto - name: Dump database command: pg_dump -with -some -params environment: PGPASSWORD: mysecret no_log: True ``` When running with `ANSIBLE_LOG_PATH=notsosecret.log ansible-playbook mybook.yml -vvv` this is my console output: ```auto TASK: [Dump database] ********************************************** <[ec2-x-x-x-x.us-west-2.compute.amazonaws.com](http://ec2-x-x-x-x.us-west-2.compute.amazonaws.com)> ESTABLISH CONNECTION FOR USER: ubuntu <[ec2-x-x-x-x.us-west-2.compute.amazonaws.com](http://ec2-x-x-x-x.us-west-2.compute.amazonaws.com)> REMOTE_MODULE command pg_dump -with -some -params NO_LOG=True <[ec2-x-x-x-x.us-west-2.compute.amazonaws.com](http://ec2-x-x-x-x.us-west-2.compute.amazonaws.com)> EXEC ssh -C -q -o ControlMaster=auto -o ControlPersist=4h -o ControlPath="/home/ubuntu/.ansible/cp/ansible-ssh-%h-%p-%r" -o StrictHostKeyChecking=no -o Port=22 -o KbdInteractiveAuthentication=no -o PreferredAuthentications=gssapi-with-mic,gssapi-keyex,hostbased,publickey -o PasswordAuthentication=no -o ConnectTimeout=10 [ec2-x-x-x-x.us-west-2.compute.amazonaws.com](http://ec2-x-x-x-x.us-west-2.compute.amazonaws.com) /bin/sh -c 'LANG=C PGPASSWORD=mysecret LC_CTYPE=C /usr/bin/python' ``` And my log file: ```auto 2015-01-14 02:40:45,102 p=3055 u=ubuntu | TASK: [Dump database] ********************************************** 2015-01-14 02:40:45,108 p=3055 u=ubuntu | <[ec2-x-x-x-x.us-west-2.compute.amazonaws.com](http://ec2-x-x-x-x.us-west-2.compute.amazonaws.com)> ESTABLISH CONNECTION FOR USER: ubuntu 2015-01-14 02:40:45,110 p=3055 u=ubuntu | <[ec2-x-x-x-x.us-west-2.compute.amazonaws.com](http://ec2-x-x-x-x.us-west-2.compute.amazonaws.com)> REMOTE_MODULE command pg_dump -with -some -params NO_LOG=True 2015-01-14 02:40:45,121 p=3055 u=ubuntu | <[ec2-x-x-x-x.us-west-2.compute.amazonaws.com](http://ec2-x-x-x-x.us-west-2.compute.amazonaws.com)> EXEC ssh -C -q -o ControlMaster=auto -o ControlPersist=4h -o ControlPath="/home/ubuntu/.ansible/cp/ansible-ssh-%h-%p-%r" -o StrictHostKeyChecking=no -o Port=22 -o KbdInteractiveAuthentication=no -o PreferredAuthentications=gssapi-with-mic,gssapi-keyex,hostbased,publickey -o PasswordAuthentication=no -o ConnectTimeout=10 [ec2-x-x-x-x.us-west-2.compute.amazonaws.com](http://ec2-x-x-x-x.us-west-2.compute.amazonaws.com) /bin/sh -c 'LANG=C PGPASSWORD=mysecret LC_CTYPE=C /usr/bin/python' ``` Is this a bug/regression? I read [https://github.com/ansible/ansible/issues/8647](https://github.com/ansible/ansible/issues/8647) which seems related and should be included in 1.8.2 if I’m not mistaken. Regards Tom ​ ---
**Author:** ![Brian\_Coca](https://avatars.discourse-cdn.com/v4/letter/b/6de8d8/32.png) [@Brian\_Coca](https://forum.ansible.com/u/Brian_Coca)\ **Post date:** [January 14, 2015, 12:52pm UTC](https://forum.ansible.com/t/no-log-true-being-ignored/17258/2 "2015-01-14T12:52:53Z")
currently no\_log applies to module output and arguments, not to environment variables. ---
**Author:** ![Tom\_Bamford](https://avatars.discourse-cdn.com/v4/letter/t/c2a13f/32.png) [@Tom\_Bamford](https://forum.ansible.com/u/Tom_Bamford)\ **Post date:** [January 14, 2015, 8:13pm UTC](https://forum.ansible.com/t/no-log-true-being-ignored/17258/3 "2015-01-14T20:13:55Z")
Thanks, I think the docs could perhaps be clarified a little in this regard. From [http://docs.ansible.com/faq.html#how-do-i-keep-secret-data-in-my-playbook](http://docs.ansible.com/faq.html#how-do-i-keep-secret-data-in-my-playbook) - “if you have a task that you don’t want to show the results or command given to it when using -v (verbose) mode, the following task or playbook attribute can be useful” along with an example which implies that command line arguments are censored when in fact they are not. It would be great if tasks could be completely censored in some way, environment variables and all. Often the reason that one passes environment variables instead of arguments is to avoid sensitive data showing up in log files and the likes of `ps` etc. Regards Tom ​ ---
**Author:** ![Tom\_Bamford](https://avatars.discourse-cdn.com/v4/letter/t/c2a13f/32.png) [@Tom\_Bamford](https://forum.ansible.com/u/Tom_Bamford)\ **Post date:** [January 15, 2015, 8:27pm UTC](https://forum.ansible.com/t/no-log-true-being-ignored/17258/4 "2015-01-15T20:27:57Z")
I wanted to test this in a more controlled fashion to be sure, so I used this playbook: ```auto --- - hosts: localhost connection: local gather_facts: no tasks: - command: echo -e out in the open - command: echo -e blah my secret no_log: True ``` This is my console output ```auto tom@hamlet:~/tmp/ansible ANSIBLE_LOG_PATH=no_log.log ansible-playbook no_log.yml -vvv PLAY [localhost] ************************************************************** TASK: [command echo -e out in the open] *************************************** REMOTE_MODULE command echo -e out in the open EXEC ['/bin/sh', '-c', 'mkdir -p $HOME/.ansible/tmp/ansible-tmp-1421353307.68-66582777801017 && chmod a+rx $HOME/.ansible/tmp/ansible-tmp-1421353307.68-66582777801017 && echo $HOME/.ansible/tmp/ansible-tmp-1421353307.68-66582777801017'] PUT /var/folders/4z/l8ng_d2n7mx61pfvhmf2r41m0000gn/T/tmpf6o4Mg TO /Users/tom/.ansible/tmp/ansible-tmp-1421353307.68-66582777801017/command EXEC ['/bin/sh', '-c', u'LANG=C LC_CTYPE=C /usr/bin/python /Users/tom/.ansible/tmp/ansible-tmp-1421353307.68-66582777801017/command; rm -rf /Users/tom/.ansible/tmp/ansible-tmp-1421353307.68-66582777801017/ >/dev/null 2>&1'] changed: [localhost] => {"changed": true, "cmd": ["echo", "-e", "out", "in", "the", "open"], "delta": "0:00:00.006201", "end": "2015-01-15 22:21:47.848086", "rc": 0, "start": "2015-01-15 22:21:47.841885", "stderr": "", "stdout": "-e out in the open", "warnings": []} TASK: [command echo -e blah my secret] **************************************** REMOTE_MODULE command echo -e blah my secret NO_LOG=True EXEC ['/bin/sh', '-c', 'mkdir -p $HOME/.ansible/tmp/ansible-tmp-1421353307.86-275694889373920 && chmod a+rx $HOME/.ansible/tmp/ansible-tmp-1421353307.86-275694889373920 && echo $HOME/.ansible/tmp/ansible-tmp-1421353307.86-275694889373920'] PUT /var/folders/4z/l8ng_d2n7mx61pfvhmf2r41m0000gn/T/tmpabg4Bx TO /Users/tom/.ansible/tmp/ansible-tmp-1421353307.86-275694889373920/command EXEC ['/bin/sh', '-c', u'LANG=C LC_CTYPE=C /usr/bin/python /Users/tom/.ansible/tmp/ansible-tmp-1421353307.86-275694889373920/command; rm -rf /Users/tom/.ansible/tmp/ansible-tmp-1421353307.86-275694889373920/ >/dev/null 2>&1'] changed: [localhost] => {"censored": "results hidden due to no_log parameter", "changed": true, "rc": 0} PLAY RECAP ******************************************************************** localhost : ok=2 changed=2 unreachable=0 failed=0 ``` and the contents of no\_log.log ```auto 2015-01-15 22:21:47,596 p=1876 u=tom | 2015-01-15 22:21:47,596 p=1876 u=tom | /usr/local/bin/ansible-playbook no_log.yml -vvv 2015-01-15 22:21:47,597 p=1876 u=tom | 2015-01-15 22:21:47,664 p=1876 u=tom | PLAY [localhost] ************************************************************** 2015-01-15 22:21:47,664 p=1876 u=tom | TASK: [command echo -e out in the open] *************************************** 2015-01-15 22:21:47,677 p=1876 u=tom | REMOTE_MODULE command echo -e out in the open 2015-01-15 22:21:47,680 p=1876 u=tom | EXEC ['/bin/sh', '-c', 'mkdir -p $HOME/.ansible/tmp/ansible-tmp-1421353307.68-66582777801017 && chmod a+rx $HOME/.ansible/tmp/ansible-tmp-1421353307.68-66582777801017 && echo $HOME/.ansible/tmp/ansible-tmp-1421353307.68-66582777801017'] 2015-01-15 22:21:47,730 p=1876 u=tom | PUT /var/folders/4z/l8ng_d2n7mx61pfvhmf2r41m0000gn/T/tmpf6o4Mg TO /Users/tom/.ansible/tmp/ansible-tmp-1421353307.68-66582777801017/command 2015-01-15 22:21:47,731 p=1876 u=tom | EXEC ['/bin/sh', '-c', u'LANG=C LC_CTYPE=C /usr/bin/python /Users/tom/.ansible/tmp/ansible-tmp-1421353307.68-66582777801017/command; rm -rf /Users/tom/.ansible/tmp/ansible-tmp-1421353307.68-66582777801017/ >/dev/null 2>&1'] 2015-01-15 22:21:47,859 p=1876 u=tom | changed: [localhost] => {"changed": true, "cmd": ["echo", "-e", "out", "in", "the", "open"], "delta": "0:00:00.006201", "end": "2015-01-15 22:21:47.848086", "rc": 0, "start": "2015-01-15 22:21:47.841885", "stderr": "", "stdout": "-e out in the open", "warnings": []} 2015-01-15 22:21:47,860 p=1876 u=tom | TASK: [command echo -e blah my secret] **************************************** 2015-01-15 22:21:47,861 p=1876 u=tom | REMOTE_MODULE command echo -e blah my secret NO_LOG=True 2015-01-15 22:21:47,863 p=1876 u=tom | EXEC ['/bin/sh', '-c', 'mkdir -p $HOME/.ansible/tmp/ansible-tmp-1421353307.86-275694889373920 && chmod a+rx $HOME/.ansible/tmp/ansible-tmp-1421353307.86-275694889373920 && echo $HOME/.ansible/tmp/ansible-tmp-1421353307.86-275694889373920'] 2015-01-15 22:21:47,872 p=1876 u=tom | PUT /var/folders/4z/l8ng_d2n7mx61pfvhmf2r41m0000gn/T/tmpabg4Bx TO /Users/tom/.ansible/tmp/ansible-tmp-1421353307.86-275694889373920/command 2015-01-15 22:21:47,873 p=1876 u=tom | EXEC ['/bin/sh', '-c', u'LANG=C LC_CTYPE=C /usr/bin/python /Users/tom/.ansible/tmp/ansible-tmp-1421353307.86-275694889373920/command; rm -rf /Users/tom/.ansible/tmp/ansible-tmp-1421353307.86-275694889373920/ >/dev/null 2>&1'] 2015-01-15 22:21:48,008 p=1876 u=tom | changed: [localhost] => {"censored": "results hidden due to no_log parameter", "changed": true, "rc": 0} 2015-01-15 22:21:48,009 p=1876 u=tom | PLAY RECAP ******************************************************************** 2015-01-15 22:21:48,009 p=1876 u=tom | localhost : ok=2 changed=2 unreachable=0 failed=0 ``` In conclusion, with no\_log specified, the command and its arguments are still written to stdout and the log file.