Question:
I want to ensure a list of services is disabled if they exist on a system. By default, many of these services won’t exist, but in cases where the service is installed, I want it disabled.
If a service doesn’t exist, ansible throws an error. While I can continue the task with ignore_error, I’m not comfortable with that because it not only masks a real problem, but the error is still shown in the ansible output, and I’d prefer the team not get in the habit of ignoring errors.
I’ve tried using failed_when, but I don’t seem to be able to get it working with a service, and all the examples use command, not service. Here’s the task–disable_services is a list declared elsewhere.
1 2 3 4 5 |
- name: "Stop and disable unneeded services" service: name={{ item }} enabled=no status=stopped failed_when: "'service not loaded' not in stderr" with_items: disable_services |
It fails with the following output:
1 2 3 |
TASK: [hardening | Stop and disable unneeded services] ************************ fatal: [host.example.com] => error while evaluating conditional: 'service not loaded' not in stderr |
I have tried registering the variable service_output, and checking to see that “service not loaded” not in service_output.stderr, but have the same error.
Is it possible to used failed_when on a service, and if so, what Layer 8 problem am I experiencing here?
Answer:
There are a few problems:
- It’s
state
, notstatus
. - You need to use
register
to bind the result to variable, and then use that variable infailed_when
. - Minor thing: you only check for one kind of failure (it should be OK in this instance, but it’s something to keep in mind).
This should work:
1 2 3 4 5 6 |
- name: "Stop and disable unneeded services" service: name={{ item }} enabled=no state=stopped failed_when: "stop_disabled_services | failed and 'service not found' not in stop_disabled_services.msg" register: stop_disabled_services with_items: disable_services |
And a note about how I got this code working:
I’ve used ignore_errors
and debug: var=stop_disable_services
to find what service
returns on failure. The most interesting part were the items of stop_disabled_services.results
list, as that’s the value of stop_disable_services
the failed_when
will see.
From there it was just some Jinja2 to make sure only some failures get ignored.