Ansible errors and how to fix them

ansible-inventory --host <host>   # ansible_user: does it match the user in the message?

Correct ansible_user in the inventory, group_vars or host_vars; set it once per group rather than per host.

ssh -i ~/.ssh/<key> -o IdentitiesOnly=yes <user>@<address>   # also denied: the key is not installed for that user

Install the public key for that user (ssh-copy-id, or ansible.posix.authorized_key run from a login that still works).

ansible <host> -m ansible.builtin.ping -vvvv   # the 'Offering public key' lines name each key tried; yours is missing or never offered
ssh-add -l   # the agent's key fingerprints (no private key is printed)

Point ansible_ssh_private_key_file at the right key for that group, load it into the agent, and add -o IdentitiesOnly=yes to ansible_ssh_common_args when the agent holds many keys.

sudo journalctl -u ssh -n 20   # on the host (sshd on RHEL): 'Authentication refused: bad ownership or modes' means permissions

On the host: make the user own ~/.ssh, then chmod 700 ~/.ssh and chmod 600 ~/.ssh/authorized_keys; replace a DSA key with an ed25519 key.

ansible-inventory --host <host>   # ansible_host: is it the host's current address?

Correct ansible_host, or use a dynamic inventory plugin so cloud addresses stay current.

nc -vz -w 5 <address> 22   # times out: dropped on the way; 'refused': the host answered, see Connection refused

Allow port 22 from the control node's address only (security group or host firewall), not from 0.0.0.0/0.

ansible-inventory --host <host>   # no ansible_port, but the host uses a custom port

Set ansible_port for that host or group in the inventory.

ansible <host> -m ansible.builtin.ping -vvvv   # the ssh command line: no ProxyJump or ProxyCommand where one is needed

Set ansible_ssh_common_args: '-o ProxyJump=<user>@<bastion>' for that group in the inventory.

ssh -v <user>@<address>   # stops at 'Connecting to': nothing answered at all

Start the host or fix the route; then ansible.builtin.wait_for_connection before the next play.

sudo systemctl status ssh   # on the host, from its console (sshd on RHEL): inactive or failed

Start it: sudo systemctl enable --now ssh (sshd on RHEL), or wait for it after a reboot with ansible.builtin.wait_for_connection.

ansible-inventory --host <host>   # ansible_port missing or wrong
nc -vz <address> <port>   # 'succeeded' on the real port

Set ansible_port with the host in the inventory.

sudo firewall-cmd --list-services   # on the host (RHEL family): ssh missing; 'sudo ufw status' on Ubuntu

Allow SSH from the control node's address in the host firewall.

ansible-inventory --host <host>   # ansible_host: is it the address you expect?

Correct ansible_host.

ssh-keygen -F <address>   # the stored key (grep can miss it: Debian and Ubuntu hash known_hosts)
ssh-keyscan <address> 2>/dev/null | ssh-keygen -lf -   # the fingerprint offered now: matches the console or cloud boot log means a genuine rebuild

After the fingerprint matches: ssh-keygen -R <address> (and -R <name> if stored by name), then add the new key with ssh-keyscan <address> >> ~/.ssh/known_hosts.

ansible-inventory --host <host>   # ansible_host: is this still the right machine?

Point the inventory at the right address; for shared addresses, connect to each host's own address.

ssh-keyscan <address> 2>/dev/null | ssh-keygen -lf -   # does not match the console: do not connect

Do not replace the key; stop and investigate the network path.

ssh-keygen -F <address>   # no output: SSH has never stored this host's key

Compare ssh-keyscan <address> 2>/dev/null | ssh-keygen -lf - with the fingerprint from the host's console, then append ssh-keyscan <address> to ~/.ssh/known_hosts.

ssh-keygen -F <name>   # found by name but not by address

Store the key under the address Ansible uses, or under both.

whoami; echo ~   # the user and home directory Ansible runs with

Run Ansible as the user whose known_hosts holds the keys, or write that user's file from a reviewed list.

ansible-inventory --host <host>   # no ansible_host

Set ansible_host to the address, or add the name to DNS.

getent hosts <name>   # the exact name from the message; no output means it does not resolve here

Correct the name.

ssh -G <name> | grep -i '^hostname'   # what ~/.ssh/config turns the name into on this machine

Put the address in the inventory, or give the runner the same DNS (VPN, resolver).

ansible <host> -m ansible.builtin.debug -a 'msg={{ ansible_become_password is defined }}'   # False: no password reaches this host (the value is not printed)

Run with -K (--ask-become-pass), or set ansible_become_password in Vault for the group the host is in.

ssh <user>@<address> sudo -n true   # 'a password is required': sudo wants a password for this user

Give the password as above, or add a reviewed NOPASSWD rule for a dedicated automation user.

ssh -t <user>@<address> sudo -l   # NOPASSWD for some commands only, not ALL

Use a become password, or a rule Ansible can use for the automation user; sudo command lists do not work with Ansible's wrapper.

ssh -t <user>@<address> sudo -v   # type the same password by hand: rejected here too means the password is wrong

Use the right password; store it per group in Vault when hosts differ.

ansible <host> -m ansible.builtin.debug -a 'msg={{ ansible_become_password | length }}'   # the length of the password this host gets, not the password

Set ansible_become_password in the group_vars of the group that owns that password.

sudo grep -rE 'rootpw|targetpw' /etc/sudoers /etc/sudoers.d   # on the host, as an admin: a match explains it

Give the password sudo really asks for, or change that sudoers setting for the automation user.

sudo faillock --user <user>   # on the host, as an admin: recent failures mean a lock
sudo chage -l <user>   # 'Password expires' in the past

Fix the password first, then unlock with faillock --user <user> --reset.

ansible <host> -m ansible.builtin.command -a whoami --become -vvvv   # the sudo command and what came back before the timeout
ssh <user>@<address> 'sudo -n true'   # 'a password is required': sudo wants a password

Give the password with -K or ansible_become_password from Vault, or allow NOPASSWD for the automation user.

ssh <user>@<address> 'getent hosts $(hostname)'   # no output: the host cannot resolve its own name

Add the host's own name to /etc/hosts.

ssh <user>@<address> uptime   # a very high load average

Raise the wait: timeout = 30 in the [defaults] section of ansible.cfg (or ANSIBLE_TIMEOUT=30).

ansible-inventory --host <host>   # ansible_become_method and ansible_become_user

Set the method and user that host really uses.

command -v sshpass   # on the control node: no output means not installed
ansible --version   # the ansible-core version decides whether sshpass is needed

Better: log in with an SSH key. Otherwise install sshpass on the control node (sudo apt install sshpass, or sudo dnf install sshpass; on RHEL it comes from AppStream or EPEL depending on the release), or on 2.19+ remove the password_mechanism = sshpass setting.

grep -rlE 'ansible_password|ansible_ssh_pass' inventory group_vars host_vars   # file names only, so no password is printed

Remove the password variable and use a key, or move it into Vault if you really need it.

ansible <host> -m ansible.builtin.command -a 'which setfacl'   # rc 1 and no path: acl is not installed

Install the acl package on the host (for example in the base role).

ansible-config dump | grep -i pipelining   # ANSIBLE_PIPELINING(default) = False

Set pipelining = True under [ssh_connection] (needs sudo without requiretty), and still install acl for copy and template.

ssh <user>@<address> sudo -n true   # the same parse error
visudo -c   # from the console or a root session: names the file and line

From the console or a root session, repair it with visudo -f /etc/sudoers.d/<file>, or remove the file.

ansible-inventory --graph   # the real group names

Use the real group name in hosts:, or add the group to the inventory.

ansible --version   # config file = the ansible.cfg in use
ansible-playbook <playbook> --list-hosts   # the hosts each play would target

Pass the right -i, or run from the project directory so its ansible.cfg is used.

ansible-inventory --graph 2>&1 | grep -i 'unable to parse'   # an earlier warning about that source

Fix that inventory source (see Unable to parse ... as an inventory source).

ansible-inventory --graph   # the names that exist

Use a name from the inventory; preview with --list-hosts.

ansible-inventory --host <name>   # works only for an inventory name

Limit by the inventory name or a group.

ansible-playbook <playbook> --limit <host> --list-hosts   # the play's host list is empty

Limit to a host in the play's group, or fix the host's group membership.

ls -l <inventory path>   # 'No such file or directory'

Point -i or ansible.cfg's inventory at the real file.

ansible --version   # config file = which ansible.cfg was read

Run from the project directory, or set ANSIBLE_CONFIG to the project's ansible.cfg.

ansible-inventory -i <path> --graph -vvv   # each plugin's reason for rejecting the file

Fix the syntax, or install the plugin's collection and name the file as its documentation requires (for example ending in aws_ec2.yml).

ls -ld .   # drwxrwxrwx means world writable
ansible --version   # config file = shows which ansible.cfg is really in use

Remove world write with chmod o-w ., or move the project into your home directory on a Linux file system. If neither is possible, name the file explicitly: export ANSIBLE_CONFIG=$PWD/ansible.cfg.

ansible-playbook <playbook> --tags <tag> --list-tasks   # the task is not listed

Tag the task, or tag it always when every run needs it.

ansible-playbook <playbook> --list-tags   # the included tasks have no tags of their own

Use import_tasks, or apply: { tags: [...] } on the include_tasks.

grep -rn -B3 'never' roles <playbook>   # tags: [never, ...] on the task

Ask for its tag explicitly, or remove never.

ansible-playbook <playbook> --syntax-check   # the line and column
cat -n <playbook>   # compare that line's indent with the line above

Line up the module with name: of its task, and its options two spaces deeper.

grep -n ': .*: ' <playbook>   # values with a second ': '

Quote the value: msg: "Status: ok".

ansible-playbook <playbook> --syntax-check   # the line and column
grep -nE ':\s+\{\{' <file>   # unquoted values starting with {{

Quote the whole value: dest: "{{ app_dir }}/releases".

cat -n <file>   # the named line does not line up with its siblings
ansible-playbook <playbook> --syntax-check

Make the line's indentation match its siblings.

cat -n <file>   # a '-' at a level that holds keys, or the reverse

Make each level all keys or all list items.

grep -nP '\t' <file>   # every line with a tab

Replace the tabs with spaces.

grep -nE ':\s+[@`]' <file>   # values starting with @ or `

Quote the value: user: "@ops".

ansible-playbook <playbook> --syntax-check   # the line it points at

Move the keyword to a task or block.

head -5 <file>   # a list of tasks with no hosts:

Run the playbook that uses the role, or wrap the tasks in a play with hosts: and tasks:.

grep -n '^- include:' <playbook>

Use - import_playbook: other.yml.

cat -n <playbook>   # the keyword's spelling and indent

Fix the spelling or indentation.

head -5 <file>   # a play with name: and tasks: but no hosts:

Add hosts: <group> to the play.

cat -n <file>   # hosts: deeper than name: and tasks:

Indent hosts: at the same level as the play's name:.

cat -n <file>   # two modules under one dash

Split them into two tasks, each starting with - name:.

cat -n <file>   # the second name is an option of the first module

Indent the options two spaces under the module.

cat -n <file>   # the task's keys: is there a module at the same level as name:?

Add the module at the same indentation as name:.

ansible-galaxy collection list community.general   # not listed

Add the collection to requirements.yml and run ansible-galaxy collection install -r requirements.yml.

ansible --version   # which Python and config file this ansible uses
ansible-config dump | grep -i collections_path   # the paths really searched

Install into one of the searched paths, or set collections_path in the project's ansible.cfg.

ansible-doc <module>   # 'module not found'

Use the full name from the collection's documentation.

ansible-doc -l | grep <module>   # the module under another collection name

Use the new full name and install that collection.

ansible-doc <module>   # the options this version accepts

Use an option name ansible-doc lists.

ansible-galaxy collection list <namespace.collection>   # the installed version
ansible-doc <module>   # describes the installed version

Upgrade the collection in requirements.yml, or use the option the installed version has.

ansible <host> -m ansible.builtin.raw -a 'command -v python3 || echo none'   # 'none': no Python

Install it with raw: ansible <host> -m ansible.builtin.raw -a 'apt-get update && apt-get install -y python3' -b (dnf install -y python3 on the RHEL family).

ansible-inventory --host <host> | grep interpreter   # a pinned path
ansible-config dump | grep -i interpreter_python

Correct the path, or remove the pin and let discovery find Python.

ssh <user>@<address> "/usr/bin/python3 -c 'import psycopg2'"   # ModuleNotFoundError: not installed for that Python

Install it in a task before the module runs, for example ansible.builtin.package: name=python3-psycopg2.

ansible <host> -m ansible.builtin.setup -a 'filter=ansible_python'   # the executable Ansible uses

Install it for that Python, or set ansible_python_interpreter to the Python that has it.

ansible localhost -m ansible.builtin.setup -a 'filter=ansible_python'   # not your virtualenv's Python

Set ansible_python_interpreter: "{{ ansible_playbook_python }}" for localhost, and install the library in that virtualenv.

ansible <host> -m ansible.builtin.setup -a 'filter=ansible_python'   # the Python it found

Set ansible_python_interpreter: /usr/bin/python3 in group_vars, or keep discovery without the warning: interpreter_python = auto_silent in the [defaults] section of ansible.cfg.

ansible <host> -m ansible.builtin.setup -a 'filter=ansible_os_family'   # RedHat for a name from Debian, or the reverse

Load per-OS names with include_vars: "{{ ansible_facts['os_family'] }}.yml".

ansible <host> -a 'dnf repolist'   # RHEL family: the enabled repositories
ansible <host> -a 'apt-cache policy <package>'   # Debian family: 'Candidate: (none)'

Enable the repository first (ansible.builtin.yum_repository, ansible.builtin.deb822_repository, or register the host).

ansible <host> -a 'stat -c %y /var/lib/apt/lists'   # an old date

Add update_cache: true (with cache_valid_time) to the apt task.

ansible <host> -a 'dnf list --showduplicates <package>'   # or apt-cache madison <package>: the versions on offer

Pin a version the repository offers, or add the repository that has it.

ansible <host> -m ansible.builtin.command -a 'apt-get update' --become   # 'does not have a Release file' names the repository

Remove or correct the bad repository (for example ansible.builtin.apt_repository with state: absent), then run again.

ansible <host> -m ansible.builtin.command -a 'apt-get update' --become   # NO_PUBKEY or EXPKEYSIG

Install the key with the repository, for example ansible.builtin.deb822_repository with signed_by (ansible-core 2.15 and later).

ansible <host> -a 'date -u'   # far from the real time

Fix time sync (chrony or systemd-timesyncd), then update again.

ansible <host> -m ansible.builtin.command -a 'apt-get update' --become   # 'Could not resolve' or 'Connection timed out'

Fix the proxy setting or network path to the mirror.

The message says (13: Permission denied)
ansible <host> -m ansible.builtin.command -a whoami   # not root

Add become: true to the task.

ansible <host> -b -m ansible.builtin.command -a 'fuser -v /var/lib/dpkg/lock-frontend'   # the process holding it (fuser is in psmisc)
ansible <host> -m ansible.builtin.command -a 'cloud-init status'   # 'running' on a new host

Let apt wait: lock_timeout: 600 on the apt task (the default is 60 seconds); on new hosts, run cloud-init status --wait first. Never delete lock files or kill dpkg mid-run: it can leave packages half installed.

ansible <host> -a "systemctl list-unit-files 'httpd*' 'apache2*'"   # the name this host uses

Use the right name per OS from a per-OS vars file.

ansible <host> -a 'systemctl list-unit-files <name>.service'   # 0 unit files listed

Install the package before the service task.

ansible <host> -a 'systemctl cat <name>'   # 'No files found' although the file exists

Use ansible.builtin.systemd with daemon_reload: true after writing unit files.

ansible <host> -m ansible.builtin.setup -a 'filter=ansible_service_mgr'   # not systemd

Start the process another way in containers, or test on a host with the same init system as production.

ansible <host> -b -a 'journalctl -u <service> -n 30 --no-pager'   # the service's own error, often naming the file and line

Fix the file (use template for .j2), then restart.

ansible <host> -m ansible.builtin.stat -a path=<config>   # pw_name and mode: readable by the service user?

Set owner, group and mode on the file task.

ansible <host> -b -a 'ausearch -m AVC -ts recent'   # RHEL family: a denial naming the service

Fix the label (restorecon, or setype on the file task) or allow the port with community.general.seport. Do not disable SELinux.

ansible <host> -b -a 'ss -ltnp'   # another program on the port

Stop the other process or change the port.

ansible <group> -b -a 'systemctl status <service>'   # started before the config change

Add meta: flush_handlers before the check.

ansible-playbook <playbook> --tags <tag> --list-tasks   # the step is missing

Tag the step so it runs, or run it, then check again.

ansible <group> -b -a 'journalctl -u <service> -n 30 --no-pager'   # errors from the new version

Roll back to the previous version.

ansible <group> -m ansible.builtin.uri -a 'url=http://localhost:8080/healthz'   # try the right port and path by hand

Correct the URL in the check.

ansible <host> -m ansible.builtin.command -a 'journalctl -u <service> -n 50 --no-pager' --become   # a start error

Fix why the service did not start, then run the play again.

ansible <host> -m ansible.builtin.command -a 'ss -ltnp' --become   # the real address and port

Point host: and port: at the address the app really listens on.

ansible <host> -m ansible.builtin.command -a 'ss -ltnp' --become   # listening now, a little after the failure

Raise timeout:.

grep -n -B5 'wait_for' <playbook>   # a delegate_to on the task

Use an address the delegated host can reach, or drop delegate_to.

ansible <host> -m ansible.builtin.stat -a path=<program>   # exists: false

Install the program, or use the module that does the job.

ansible <other host> -m ansible.builtin.stat -a path=<program>   # exists: true there

Add delegate_to: the host that has it.

ansible <host> -m ansible.builtin.shell -a 'command -v <program>; echo $PATH'   # shell, because command -v is a shell builtin

Use the full path, or set environment: { PATH: ... } on the task.

grep -n -A2 'command:' <file>   # | > && or cd in the command

Use ansible.builtin.shell when you need shell features, or a module.

ls roles/<role>/templates roles/<role>/files   # the file is elsewhere or missing

Move the file to one of the searched paths.

Compare the name in the message with the ls output, letter by letter

Correct src.

ansible <host> -m ansible.builtin.stat -a path=<file>   # exists: true on the host

Set remote_src: true on copy.

Read the Searched in: list: those are the only places it looks

Give src relative to the role's files/ or templates/, or build it from role_path or playbook_dir.

ansible <host> -m ansible.builtin.stat -a path=<directory>   # pw_name: root and not writable by others

Add become: true to the task.

ansible <host> -m ansible.builtin.stat -a path=<directory>   # exists: false

Create it first with ansible.builtin.file: state=directory, with the right owner and mode.

ansible-playbook <playbook> -v   # the full result: read stderr

Fix the command or its input.

The tool's manual page: what each exit code means

Define success with failed_when: result.rc not in [0, 1].

ansible <host> -m ansible.builtin.shell -a 'echo $PATH; id; locale'   # compare with your interactive shell

Use full paths and set what it needs with environment: on the task.

ansible <host> -m ansible.builtin.debug -a var=<variable>   # VARIABLE IS NOT DEFINED! ('is undefined' on 2.19+)
ansible-inventory --host <host>   # inventory variables only: no role defaults, play vars or facts

Define it in the role's defaults/main.yml, or in group_vars/all.

grep -rn <variable> group_vars host_vars roles

Use one spelling.

ansible-playbook <playbook> -v   # the registering task was skipped for this host

Make sure the task runs, or use | default(...) where a default makes sense.

ls <inventory dir>/group_vars <playbook dir>/group_vars

Move group_vars next to the inventory file or the playbook.

ansible-playbook <playbook>   # with a task: debug: var=<name>, shows a results list

Use <name>.results | map(attribute='stdout') | list, or loop over <name>.results.

debug: var=item inside the loop   # one item holding every key

Use loop: "{{ my_dict | dict2items }}" with item.key and item.value.

debug: var=<name>   # the keys it really has

Use the key the debug output shows.

ansible-playbook <playbook> --list-hosts   # those hosts are in no play

Add a play that gathers facts from those hosts first, or use inventory values such as ansible_host.

The command line or CI job has --limit

Enable fact caching, or include those hosts in the limit.

ansible <host> -m ansible.builtin.setup -a 'filter=ansible_default_ipv4'   # the fact exists when gathered fully
grep -rn gather_subset <playbook>

Include network in gather_subset for that play.

ansible <host> -m ansible.builtin.debug -a var=<variable>   # { } braces: a dictionary

Use loop: "{{ my_dict | dict2items }}" with item.key and item.value.

ansible <host> -m ansible.builtin.debug -a var=<variable>   # quotes around the whole value: a string

Store a real YAML list, use query() instead of lookup(), or split(',').

ansible <host> -m ansible.builtin.debug -a var=<variable>   # not defined for this host

Gather the facts you need (gather_subset: [min] is cheap), or add <variable> is defined and ....

ansible <host> -m ansible.builtin.debug -a 'msg={{ <expression> }}'   # the same error, outside the play

Correct the expression.

ansible <host> -m ansible.builtin.debug -a 'var=<variable>' -e <variable>=false   # shows "false" in quotes: a string

Use when: <variable> | bool, or pass JSON: -e '{"<variable>": false}'.

grep -rn "<variable>: ['\"]" group_vars host_vars roles   # a quoted value

Remove the quotes, or use | bool.

ansible <host> -m ansible.builtin.debug -a var=<variable>   # the value the host really gets (outside a role)
grep -rn <variable> inventory group_vars host_vars roles   # every place it is set

Remove the stronger value, or set yours at a level that wins; move role tunables from vars/ to defaults/.

ansible-inventory --host <host> --playbook-dir <playbook dir>   # differs from the same command without --playbook-dir

Keep each variable in one of the two places.

ansible <host> -m ansible.builtin.debug -a var=group_names   # the groups it is in

Set it in one group, or set ansible_group_priority.

ls host_vars/<host>*   # a file you forgot

Delete the stale value.

grep -rn -B2 '<file name>' roles/*/tasks   # copy: instead of template:
ansible <host> -b -a "grep -n '}}' <config>"   # only the lines with unrendered braces

Use the template module.

ls roles/<role>/files roles/<role>/templates

Move .j2 files to templates/ and use template.

ansible-doc -t filter -l | grep <name>   # no line: no filter by that name here

Correct the name.

ansible-galaxy collection list   # the collection is missing

Install the collection and use the filter's full name.

The String: part of the message: count the {{ and }}

Close every {{ with }} and quote the whole value in YAML.

ls -l <file>   # on the control node: not there

To read a file that is on the managed host, use ansible.builtin.slurp instead of a lookup.

ansible-playbook <playbook> -vvvvv 2>&1 | grep -i 'looking for\|search'   # every path tried

Put the file in files/ next to the playbook or in the role, or build the path from playbook_dir or role_path.

ls -l files/ roles/<role>/files/   # the real name

Correct the name.

grep -rn -i '<name>' <playbook> roles/*/handlers   # the handler's real spelling

Make notify match the handler's name, or add listen: <name> to the handler.

grep -rln '<name>' roles/*/handlers   # the role it lives in

Add the role to the play, or move the handler.

ansible <host> -b -a 'systemctl show <service> -p ActiveEnterTimestamp'   # started before the file changed
ansible <host> -m ansible.builtin.stat -a path=<file>   # mtime newer than the start time

Restart or reload once by hand.

ansible-playbook <playbook> -v   # RUNNING HANDLER only after the last task

Add meta: flush_handlers where later tasks need the change.

grep -rn -B5 'notify' roles <playbook> | grep changed_when

Give it a real changed_when.

Run the playbook twice: the task changed on the second run is the one

Use a module, or set changed_when to what really means changed, or creates:.

ansible <host> -a 'grep -c <line> <file>'   # the same line many times

Use ansible.builtin.lineinfile or blockinfile.

ansible-playbook <playbook> --check --diff -v   # 'Command would have run if not in check mode' or skipping

Manage the state with a module (lineinfile, template) that supports check and diff.

ansible-playbook <playbook> --check -v   # a later failure about the register

Set check_mode: false on read-only commands that later tasks depend on.

ansible-config dump | grep -i vault   # DEFAULT_VAULT_PASSWORD_FILE(default) = None and an empty DEFAULT_VAULT_IDENTITY_LIST

Pass --vault-password-file <file> or -J, or set vault_password_file in the project's ansible.cfg.

ansible --version   # config file = which ansible.cfg was read

Run from the project directory, or set the variable in the CI job.

ansible-vault view <file> --vault-password-file <password file> > /dev/null && echo opens   # tests the password without printing the secrets

Use the right password.

head -1 <file>   # $ANSIBLE_VAULT;1.2;AES256;prod: encrypted for the prod vault id

Pass --vault-id <label>@<file> for each password the run needs.

ls -l <password file>   # an x in the mode: it is run, not read

Fix the script, or chmod -x a plain password file.

head -1 <file>   # no $ANSIBLE_VAULT;1.1;AES256 line

Encrypt it: ansible-vault encrypt <file>; rotate any secret that was committed in plain text.

grep -c '!vault' <file>   # a number above 0: inline values

Leave the file as it is; to change a value, make a new one with ansible-vault encrypt_string and replace it.

ansible-playbook <playbook> -v 2>&1 | grep -ciE 'password|token|secret'   # a count, so the check does not print the secret again

Add no_log: true to every task that receives a secret; rotate the leaked secret.

grep -rn -A2 'debug:' roles <playbook>   # var= on a secret variable

Remove the debug task; rotate the secret.

grep -rnE 'password=|--password' roles <playbook>

Pass it with stdin: or a file with mode 0600, not as an argument.

stat -c '%a %A %n' <path>   # on the host: 1204 --w----r-T
grep -rnE 'mode: [0-7]{3}\s*$' roles playbooks   # every unquoted mode

Quote it with a leading zero, mode: "0644", or use a symbolic mode such as u=rw,g=r,o=r, then run the play again to correct the files it already wrote.

ansible-galaxy role list   # not listed
cat requirements.yml   # listed here?

ansible-galaxy install -r requirements.yml.

ansible-config dump | grep -i roles_path   # the paths really searched

Add the install directory to roles_path, or install into one of the searched paths.

ansible-galaxy collection list   # the collection that ships it

Use the full name: namespace.collection.role.

ls roles/

Match the name to the directory.

ansible --version   # core 2.16 or later
grep -rnE '^\s*-?\s*(ansible\.builtin\.)?include:' .   # every old include

Replace include: with import_tasks: (static) or include_tasks: (dynamic).

grep -n '^- include:' *.yml

Use - import_playbook: other.yml.

cat requirements.yml   # the name as written

Correct the name.

ansible-galaxy collection install -r requirements.yml -vvv   # the versions it found and the conflict

Loosen or correct the constraint.

ansible-config dump | grep -i galaxy_server   # the servers it asks

Add the server to [galaxy] server_list, or fix the proxy or CA settings.

ansible-config dump | grep -i forks   # DEFAULT_FORKS(default) = 5

Raise forks to what the control node's CPU and memory can handle.

Set `callbacks_enabled = ansible.posix.profile_tasks` in ansible.cfg   # Gathering Facts near the top of the timings

gather_subset: [min], gather_facts: false where facts are unused, or fact caching.

ansible-config dump | grep -i pipelining
grep -n ssh_args ansible.cfg   # a value without ControlPersist

pipelining = True in [ssh_connection]; keep -C -o ControlMaster=auto -o ControlPersist=60s in any ssh_args you set.

Time the command in staging

Raise async: above the longest run you expect, and keep poll: at a few seconds.

ansible <host> -m ansible.builtin.shell -a 'ps -ef | grep <command>'   # still there long after it should have ended

Make the command non-interactive so it cannot wait for input; find what holds the lock.

The job's normal duration

Start it with poll: 0, register the job, and check it later with ansible.builtin.async_status in an until loop.

sudo dmesg | grep -i 'killed process'   # on the control node: an ansible-playbook process

Lower forks, or give the control node more memory.

ansible-playbook <playbook> -vvv   # the last task before the abort

Upgrade or fix that plugin.

ssh -o ServerAliveInterval=30 <user>@<address> 'sleep 600'   # survives with keepalives, fails without

Add keepalives with ansible_ssh_common_args: '-o ServerAliveInterval=30' (ssh_args replaces the defaults, so keep ControlMaster and ControlPersist in it if you use that), or run the task with async and poll.

ansible <host> -a uptime   # a very short uptime: it rebooted
ansible <host> -b -a 'journalctl -k -n 50 --no-pager'   # out of memory messages

Find why it rebooted or ran out of memory; use ansible.builtin.reboot for planned reboots.

grep -n serial <playbook>   # no output

Roll back with -e version=<previous>, then add serial: 1 (or a percentage) and max_fail_percentage.

grep -n rescue <playbook>   # no output

Wrap the deploy in block/rescue that restores the previous release.