# Trying to setup ubuntu security patching only **URL:** \ **Category:** Get Help\ **Tags:** ubuntu\ **Created:** [December 11, 2025, 12:01am UTC](https://forum.ansible.com/t/trying-to-setup-ubuntu-security-patching-only/44982 "2025-12-11T00:01:47Z")\ **Posts on this page:** 10\ **Page:** 1
**Author:** ![merrittr](https://avatars.discourse-cdn.com/v4/letter/m/e480ec/32.png) [@merrittr](https://forum.ansible.com/u/merrittr)\ **Post date:** [December 11, 2025, 12:01am UTC](https://forum.ansible.com/t/trying-to-setup-ubuntu-security-patching-only/44982/1 "2025-12-11T00:01:48Z")
from the command line in ubuntu i can run: apt list --upgradable | grep security | cut -d/ -f1 | xargs sudo apt-get install -y but the ansible I have is : * * * - hosts: all become: true become\_user: root tasks: - name: Update apt repo and cache on all Debian/Ubuntu boxes apt: update\_cache=yes force\_apt\_get=yes cache\_valid\_time=3600 - name: Upgrade all packages on servers apt: upgrade=dist force\_apt\_get=yes - name: Check if a reboot is needed on all servers register: reboot\_required\_file stat: path=/var/run/reboot-required get\_checksum=no - name: Reboot the box if kernel updated reboot: msg: “Reboot initiated by Ansible for kernel updates” connect\_timeout: 5 reboot\_timeout: 300 pre\_reboot\_delay: 0 post\_reboot\_delay: 30 test\_command: uptime when: reboot\_required\_file.stat.exists how should I modify : apt: update\_cache=yes force\_apt\_get=yes cache\_valid\_time=3600 ---
**Author:** ![merrittr](https://avatars.discourse-cdn.com/v4/letter/m/e480ec/32.png) [@merrittr](https://forum.ansible.com/u/merrittr)\ **Post date:** [December 21, 2025, 7:03am UTC](https://forum.ansible.com/t/trying-to-setup-ubuntu-security-patching-only/44982/2 "2025-12-21T07:03:02Z")
I think I might have to use shell: apt list --upgradable | grep security | cut -d/ -f1 | xargs sudo apt-get install -y instead of that apt: task does that make sense? ---
**Author:** ![mikemorency](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/mikemorency/32/2672_2.png) [@mikemorency](https://forum.ansible.com/u/mikemorency)\ **Post date:** [December 22, 2025, 2:04pm UTC](https://forum.ansible.com/t/trying-to-setup-ubuntu-security-patching-only/44982/3 "2025-12-22T14:04:15Z")
A long time ago, I remember reading that Ansible makes simple things hard and hard things simple. This kind of reminds me of that 🙂 Modules are great for reducing the maintenance burden on you/your team and providing an easy interface for more complicated checks. When a module doesnt meet your needs, you have two options: 1. Write a new module or open a PR to update an existing module 2. Use the shell/command module I think your approach is great, given the constraints you’ve found. There is one change I would suggest though. I would use the `shell` module to get the list of packages, and then pass that into the apt module. That way, you get the best of both worlds. Something like this (I didnt test it): ```auto - name: Get security patches ansible.builtin.shell: apt list --upgradable | grep security | cut -d/ -f1 changed_when: false register: _security_pkg_list - name: Update ansible.builtin.apt: name: "{{ _security_pkg_list.stdout_lines }}" .... ``` ---
**Author:** ![merrittr](https://avatars.discourse-cdn.com/v4/letter/m/e480ec/32.png) [@merrittr](https://forum.ansible.com/u/merrittr)\ **Post date:** [December 29, 2025, 8:57pm UTC](https://forum.ansible.com/t/trying-to-setup-ubuntu-security-patching-only/44982/4 "2025-12-29T20:57:04Z")
> [@mikemorency](#): > > `_security_pkg_list` hmmm is there a command that I can use to write \_security\_pkg\_list out to a file? like - name: write to file shell: echo “{{ \_security\_pkg\_list.stdout\_lines }}” | /root/{{ inventory\_hostname }}.txt ---
**Author:** ![anon81884396](https://avatars.discourse-cdn.com/v4/letter/a/b782af/32.png) [@anon81884396](https://forum.ansible.com/u/anon81884396)\ **Post date:** [December 30, 2025, 12:13am UTC](https://forum.ansible.com/t/trying-to-setup-ubuntu-security-patching-only/44982/5 "2025-12-30T00:13:25Z")
You can use `ansible.builtin.copy` with `content` like so: ```auto - name: Use copy module to write the stdout_lines ansible.builtin.copy: content: "{{ _security_pkg_list.stdout_lines }}" dest: "/root/{{ inventory_hostname }}.txt" owner: root group: root ``` ---
**Author:** ![pureeaglepiscesmilk](https://avatars.discourse-cdn.com/v4/letter/p/a9adbd/32.png) [@pureeaglepiscesmilk](https://forum.ansible.com/u/pureeaglepiscesmilk)\ **Post date:** [January 5, 2026, 8:30pm UTC](https://forum.ansible.com/t/trying-to-setup-ubuntu-security-patching-only/44982/6 "2026-01-05T20:30:31Z")
I think I see the issue. You’re using `apt-get` in the Ansible playbook, but from the command line you’re using `apt` (which is the package manager for Ubuntu). Try changing `force_apt_get=yes` to `force_apt=yes` in the `apt` module. That should do the trick. ---
**Author:** ![merrittr](https://avatars.discourse-cdn.com/v4/letter/m/e480ec/32.png) [@merrittr](https://forum.ansible.com/u/merrittr)\ **Post date:** [January 7, 2026, 11:08pm UTC](https://forum.ansible.com/t/trying-to-setup-ubuntu-security-patching-only/44982/7 "2026-01-07T23:08:38Z")
ok thanks that works ---
**Author:** ![merrittr](https://avatars.discourse-cdn.com/v4/letter/m/e480ec/32.png) [@merrittr](https://forum.ansible.com/u/merrittr)\ **Post date:** [January 7, 2026, 11:13pm UTC](https://forum.ansible.com/t/trying-to-setup-ubuntu-security-patching-only/44982/8 "2026-01-07T23:13:03Z")
is there anyway to have that \_security\_pkg\_list output to have seperate lines so [“gir1.2-glib-2.0”, “libglib2.0-0t64”, “libglib2.0-bin”, “libglib2.0-data”] is displayed as [ “gir1.2-glib-2.0”, “libglib2.0-0t64”, “libglib2.0-bin”, “libglib2.0-data” ] ---
**Author:** ![mikemorency](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/mikemorency/32/2672_2.png) [@mikemorency](https://forum.ansible.com/u/mikemorency)\ **Post date:** [January 8, 2026, 1:04am UTC](https://forum.ansible.com/t/trying-to-setup-ubuntu-security-patching-only/44982/9 "2026-01-08T01:04:38Z")
You can pipe that variable to the to\_nice\_json filter For example ```auto - name: Use copy module to write the stdout_lines ansible.builtin.copy: content: "{{ _security_pkg_list.stdout_lines | to_nice_json }}" dest: "/root/{{ inventory_hostname }}.txt" owner: root group: root ``` ---
**Author:** ![system](https://us1.discourse-cdn.com/ansible/original/1X/1882d9a01da5d8996a862359b0913cc568a39b84.svg) [@system](https://forum.ansible.com/u/system)\ **Post date:** [February 7, 2026, 1:05am UTC](https://forum.ansible.com/t/trying-to-setup-ubuntu-security-patching-only/44982/10 "2026-02-07T01:05:10Z")
This topic was automatically closed 30 days after the last reply. New replies are no longer allowed.