# sysctl module and removal of entry

**URL:** <https://forum.ansible.com/t/sysctl-module-and-removal-of-entry/16465>\
**Category:** Ansible Project\
**Created:** [October 8, 2014, 3:24pm UTC](https://forum.ansible.com/t/sysctl-module-and-removal-of-entry/16465 "2014-10-08T15:24:39Z")\
**Posts on this page:** 1\
**Page:** 1

<div class="post-metadata">

**Author:** ![KSS](https://avatars.discourse-cdn.com/v4/letter/k/a587f6/32.png) [@KSS](https://forum.ansible.com/u/KSS)\
**Post date:** [October 8, 2014, 3:24pm UTC](https://forum.ansible.com/t/sysctl-module-and-removal-of-entry/16465/1 "2014-10-08T15:24:39Z")

</div>

Hi,

I’ve come across a situation where the sysctl module is not removing an entry if the value matches even if the state is set to ‘absent’.

e.g,

- The following **does not remove** the sysctl entry if the value below matches that in the sysctl file;

- name: Test removal of sysctl key

sysctl: name={{ item }} value=0 state=absent reload=no  
with\_items:

- net.bridge.bridge-nf-call-ip6tables

- net.bridge.bridge-nf-call-iptables

- net.bridge.bridge-nf-call-arptables

- If the value is different, it **does remove** the key.

- name: Test removal of sysctl key  
sysctl: name={{ item }} value=1 state=absent reload=no  
with\_items:

- net.bridge.bridge-nf-call-ip6tables

- net.bridge.bridge-nf-call-iptables

- net.bridge.bridge-nf-call-arptables

- If the value is omitted, it **does remove** the key.

- name: Test removal of sysctl key

sysctl: name={{ item }} state=absent reload=no  
with\_items:

- net.bridge.bridge-nf-call-ip6tables
- net.bridge.bridge-nf-call-iptables
- net.bridge.bridge-nf-call-arptables

# ansible --version = ansible 1.7.1

Remote machine=CentOS6.5

In debug, it shows the state is set to absent even though it appears to ignore it;

PLAY [XX.XX.XX.XX] \*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*

GATHERING FACTS \*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*  
\<XX.XX.XX.XX\> ESTABLISH CONNECTION FOR USER: root on PORT 22 TO XX.XX.XX.XX  
\<XX.XX.XX.XX\> REMOTE\_MODULE setup  
\<XX.XX.XX.XX\> EXEC /bin/sh -c ‘mkdir -p $HOME/.ansible/tmp/ansible-tmp-1412781537.17-34022334345500 && echo $HOME/.ansible/tmp/ansible-tmp-1412781537.17-34022334345500’  
\<XX.XX.XX.XX\> PUT /tmp/tmpit9iZw TO /root/.ansible/tmp/ansible-tmp-1412781537.17-34022334345500/setup  
\<XX.XX.XX.XX\> EXEC /bin/sh -c ‘LANG=C LC\_CTYPE=C /usr/bin/python /root/.ansible/tmp/ansible-tmp-1412781537.17-34022334345500/setup; rm -rf /root/.ansible/tmp/ansible-tmp-1412781537.17-34022334345500/ \>/dev/null 2\>&1’  
ok: [XX.XX.XX.XX]

TASK: [Test removal of sysctl key] \*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*  
\<XX.XX.XX.XX\> ESTABLISH CONNECTION FOR USER: root on PORT 22 TO XX.XX.XX.XX  
\<XX.XX.XX.XX\> REMOTE\_MODULE sysctl name=net.bridge.bridge-nf-call-ip6tables value=0 **state=absent** reload=no  
\<XX.XX.XX.XX\> EXEC /bin/sh -c ‘mkdir -p $HOME/.ansible/tmp/ansible-tmp-1412781537.7-197935696377092 && echo $HOME/.ansible/tmp/ansible-tmp-1412781537.7-197935696377092’  
\<XX.XX.XX.XX\> PUT /tmp/tmpj3GFfR TO /root/.ansible/tmp/ansible-tmp-1412781537.7-197935696377092/sysctl  
\<XX.XX.XX.XX\> EXEC /bin/sh -c ‘LANG=C LC\_CTYPE=C /usr/bin/python /root/.ansible/tmp/ansible-tmp-1412781537.7-197935696377092/sysctl; rm -rf /root/.ansible/tmp/ansible-tmp-1412781537.7-197935696377092/ \>/dev/null 2\>&1’  
ok: [XX.XX.XX.XX] =\> (item=net.bridge.bridge-nf-call-ip6tables) =\> {“changed”: false, “item”: “net.bridge.bridge-nf-call-ip6tables”}  
\<XX.XX.XX.XX\> ESTABLISH CONNECTION FOR USER: root on PORT 22 TO XX.XX.XX.XX  
\<XX.XX.XX.XX\> REMOTE\_MODULE sysctl name=net.bridge.bridge-nf-call-iptables value=0 **state=absent** reload=no  
\<XX.XX.XX.XX\> EXEC /bin/sh -c ‘mkdir -p $HOME/.ansible/tmp/ansible-tmp-1412781538.12-44471411742706 && echo $HOME/.ansible/tmp/ansible-tmp-1412781538.12-44471411742706’  
\<XX.XX.XX.XX\> PUT /tmp/tmpWbVgcA TO /root/.ansible/tmp/ansible-tmp-1412781538.12-44471411742706/sysctl  
\<XX.XX.XX.XX\> EXEC /bin/sh -c ‘LANG=C LC\_CTYPE=C /usr/bin/python /root/.ansible/tmp/ansible-tmp-1412781538.12-44471411742706/sysctl; rm -rf /root/.ansible/tmp/ansible-tmp-1412781538.12-44471411742706/ \>/dev/null 2\>&1’  
ok: [XX.XX.XX.XX] =\> (item=net.bridge.bridge-nf-call-iptables) =\> {“changed”: false, “item”: “net.bridge.bridge-nf-call-iptables”}  
\<XX.XX.XX.XX\> ESTABLISH CONNECTION FOR USER: root on PORT 22 TO XX.XX.XX.XX  
\<XX.XX.XX.XX\> REMOTE\_MODULE sysctl name=net.bridge.bridge-nf-call-arptables value=0 **state=absent** reload=no  
\<XX.XX.XX.XX\> EXEC /bin/sh -c ‘mkdir -p $HOME/.ansible/tmp/ansible-tmp-1412781538.55-56695379779771 && echo $HOME/.ansible/tmp/ansible-tmp-1412781538.55-56695379779771’  
\<XX.XX.XX.XX\> PUT /tmp/tmpaq\_Q5s TO /root/.ansible/tmp/ansible-tmp-1412781538.55-56695379779771/sysctl  
\<XX.XX.XX.XX\> EXEC /bin/sh -c ‘LANG=C LC\_CTYPE=C /usr/bin/python /root/.ansible/tmp/ansible-tmp-1412781538.55-56695379779771/sysctl; rm -rf /root/.ansible/tmp/ansible-tmp-1412781538.55-56695379779771/ \>/dev/null 2\>&1’  
ok: [XX.XX.XX.XX] =\> (item=net.bridge.bridge-nf-call-arptables) =\> {“changed”: false, “item”: “net.bridge.bridge-nf-call-arptables”}

PLAY RECAP \*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*  
XX.XX.XX.XX : ok=2 changed=0 unreachable=0 failed=0

and the entry definitely exists on the remote host;

# grep bridge /etc/sysctl.conf

# Disable netfilter on bridges.

net.bridge.bridge-nf-call-ip6tables = 0  
net.bridge.bridge-nf-call-iptables = 0  
net.bridge.bridge-nf-call-arptables = 0

Is this known/expected behavior (I would expect an ‘absent’ state to remove the entry when it matches the name and value)?