# Prevent Module Arguments from Logging **URL:** \ **Category:** Ansible Developer\ **Created:** [March 14, 2014, 9:13pm UTC](https://forum.ansible.com/t/prevent-module-arguments-from-logging/14779 "2014-03-14T21:13:16Z")\ **Posts on this page:** 14\ **Page:** 1
**Author:** ![Jason\_Schwanz](https://avatars.discourse-cdn.com/v4/letter/j/ecccb3/32.png) [@Jason\_Schwanz](https://forum.ansible.com/u/Jason_Schwanz)\ **Post date:** [March 14, 2014, 9:13pm UTC](https://forum.ansible.com/t/prevent-module-arguments-from-logging/14779/1 "2014-03-14T21:13:16Z")
I’ve started incorporating the capabilities of Vault to encrypt private data (e.g. passphrases), and I want to make sure this data is still secure once I use it in a play. Specifically, I’m looking to develop a module to interact with our encryption software, and I want to make sure the passphrases I pass in are not going to be logged in the output. I’ve noticed when you run the user module with a -vvvv you get two log entries where the password is sanitized. \<127.0.0.1\> REMOTE\_MODULE user name=username state=present password=VALUE\_HIDDEN ok: [ansible1] =\> {“append”: false, “changed”: false, “comment”: “”, “home”: “/home/username”, “item”: “”, “move\_home”: false, “name”: “username”, “password”: “NOT\_LOGGING\_PASSWORD”, “shell”: “/bin/bash”, “state”: “present”} I’ve been able to trace out the NOT\_LOGGING\_PASSWORD in the user module file, but I’m not able to find any reference to VALUE\_HIDDEN. It would really defeat the purpose of Vault to encrypt private data, but display it in the logs. ---
**Author:** ![Jesse\_Keating](https://avatars.discourse-cdn.com/v4/letter/j/3bc359/32.png) [@Jesse\_Keating](https://forum.ansible.com/u/Jesse_Keating)\ **Post date:** [March 14, 2014, 9:24pm UTC](https://forum.ansible.com/t/prevent-module-arguments-from-logging/14779/2 "2014-03-14T21:24:04Z")
[https://github.com/ansible/ansible/blob/devel/lib/ansible/utils/\_\_init\_\_.py#L671](https://github.com/ansible/ansible/blob/devel/lib/ansible/utils/ __init__.py#L671) -jlk ---
**Author:** ![Jason\_Schwanz](https://avatars.discourse-cdn.com/v4/letter/j/ecccb3/32.png) [@Jason\_Schwanz](https://forum.ansible.com/u/Jason_Schwanz)\ **Post date:** [March 14, 2014, 9:35pm UTC](https://forum.ansible.com/t/prevent-module-arguments-from-logging/14779/3 "2014-03-14T21:35:27Z")
Thanks, Jesse. Just to make sure I fully understand, I need to create my private arguments with a key of password or login\_password, or change the private\_keys list to include the argument keys of my choosing. Is this correct? ---
**Author:** ![Jesse\_Keating](https://avatars.discourse-cdn.com/v4/letter/j/3bc359/32.png) [@Jesse\_Keating](https://forum.ansible.com/u/Jesse_Keating)\ **Post date:** [March 14, 2014, 10:22pm UTC](https://forum.ansible.com/t/prevent-module-arguments-from-logging/14779/4 "2014-03-14T22:22:00Z")
I believe so, yes. -jlk ---
**Author:** ![Kesten\_Broughton2](https://avatars.discourse-cdn.com/v4/letter/k/ecc23a/32.png) [@Kesten\_Broughton2](https://forum.ansible.com/u/Kesten_Broughton2)\ **Post date:** [March 17, 2014, 3:31pm UTC](https://forum.ansible.com/t/prevent-module-arguments-from-logging/14779/5 "2014-03-17T15:31:41Z")
Should “private\_keys” be configurable in .ansible.cfg not fixed in **init**.py? I can see a downside in that people in charge of security would have to maintain the list carefully. But, we have a lot of different types of keys and it would be nice to name them more specifically than this. Sometimes, it is considered a security breach just to know the activities that are used to secure processes. What about adding something like with\_security: state=[silent, encrypted] which could be appended to any task. silent would omit the task from the logs entirely while encrypted would encrypt all fields. \*\*[\*\ ***kbroughton@mb-kbroughton** : **lynx-ansible/dev-ansible** **+ (develop)]** grep -RH private\_keys $ansible /Users/kbroughton/vcp/git/mentat/ansible/lib/ansible/utils/ **init**.py: **private\_keys** = [‘password’, ‘login\_password’] /Users/kbroughton/vcp/git/mentat/ansible/lib/ansible/utils/ **init**.py: if k in **private\_keys** : ---
**Author:** ![sivel](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/sivel/32/1198_2.png) [@sivel](https://forum.ansible.com/u/sivel)\ **Post date:** [March 17, 2014, 3:33pm UTC](https://forum.ansible.com/t/prevent-module-arguments-from-logging/14779/6 "2014-03-17T15:33:56Z")
There has been discussion around allowing the modules to configure these keys. Also note that there is a `no_log` configuration that can prevent things from being logged. ---
**Author:** ![Jason\_Schwanz](https://avatars.discourse-cdn.com/v4/letter/j/ecccb3/32.png) [@Jason\_Schwanz](https://forum.ansible.com/u/Jason_Schwanz)\ **Post date:** [March 17, 2014, 8:23pm UTC](https://forum.ansible.com/t/prevent-module-arguments-from-logging/14779/7 "2014-03-17T20:23:42Z")
I just added [https://github.com/ansible/ansible/issues/6533](https://github.com/ansible/ansible/issues/6533) as an idea for how this could be solved. ---
**Author:** ![Michael\_DeHaan1](https://avatars.discourse-cdn.com/v4/letter/m/5e9695/32.png) [@Michael\_DeHaan1](https://forum.ansible.com/u/Michael_DeHaan1)\ **Post date:** [March 17, 2014, 8:30pm UTC](https://forum.ansible.com/t/prevent-module-arguments-from-logging/14779/8 "2014-03-17T20:30:40Z")
So there’s already a convention around no\_log=True in the argument\_spec here. I’d use it 🙂 ---
**Author:** ![Kesten\_Broughton2](https://avatars.discourse-cdn.com/v4/letter/k/ecc23a/32.png) [@Kesten\_Broughton2](https://forum.ansible.com/u/Kesten_Broughton2)\ **Post date:** [March 17, 2014, 8:52pm UTC](https://forum.ansible.com/t/prevent-module-arguments-from-logging/14779/9 "2014-03-17T20:52:01Z")
no\_log: True or field1,field2… at a task level works for my needs! ---
**Author:** ![Michael\_DeHaan1](https://avatars.discourse-cdn.com/v4/letter/m/5e9695/32.png) [@Michael\_DeHaan1](https://forum.ansible.com/u/Michael_DeHaan1)\ **Post date:** [March 17, 2014, 8:54pm UTC](https://forum.ansible.com/t/prevent-module-arguments-from-logging/14779/10 "2014-03-17T20:54:01Z")
It also exists in the argument\_spec of the module as well. ---
**Author:** ![Jason\_Schwanz](https://avatars.discourse-cdn.com/v4/letter/j/ecccb3/32.png) [@Jason\_Schwanz](https://forum.ansible.com/u/Jason_Schwanz)\ **Post date:** [March 19, 2014, 4:14am UTC](https://forum.ansible.com/t/prevent-module-arguments-from-logging/14779/11 "2014-03-19T04:14:49Z")
With the following sanitized code, using the no\_log=True method, my private parameters are still being logged. What am I missing? ---
**Author:** ![Michael\_DeHaan1](https://avatars.discourse-cdn.com/v4/letter/m/5e9695/32.png) [@Michael\_DeHaan1](https://forum.ansible.com/u/Michael_DeHaan1)\ **Post date:** [March 19, 2014, 12:28pm UTC](https://forum.ansible.com/t/prevent-module-arguments-from-logging/14779/12 "2014-03-19T12:28:15Z")
“my private parameters are still being logged.” When you say “logged”, logged where? Before some users had confusion calling the output of the task name a log, so I want to make sure. ---
**Author:** ![Jason\_Schwanz](https://avatars.discourse-cdn.com/v4/letter/j/ecccb3/32.png) [@Jason\_Schwanz](https://forum.ansible.com/u/Jason_Schwanz)\ **Post date:** [March 19, 2014, 3:04pm UTC](https://forum.ansible.com/t/prevent-module-arguments-from-logging/14779/13 "2014-03-19T15:04:18Z")
Perhaps “logged” is not the correct term. I’m referring to the output seen with the -vvvv option. What I get: REMOTE\_MODULE mymodule pub1=value1 pub2=value2 priv=privvalue What I expect: REMOTE\_MODULE mymodule pub1=value1 pub2=value2 ---
**Author:** ![Michael\_DeHaan1](https://avatars.discourse-cdn.com/v4/letter/m/5e9695/32.png) [@Michael\_DeHaan1](https://forum.ansible.com/u/Michael_DeHaan1)\ **Post date:** [March 19, 2014, 3:07pm UTC](https://forum.ansible.com/t/prevent-module-arguments-from-logging/14779/14 "2014-03-19T15:07:11Z")
Please make sure there is a ticket filed on this request. Thanks!