How can I log every command for which an Ansible playbook uses elevated permissions?

Question

I have an Ansible playbook that runs against a Linux target host and uses become to gain elevated permissions for those actions that require it.

For auditing purposes, I need a list of all the Unix commands that are executed using those elevated rights.

I.e., suppose the playbook uses the yum module to install a package:

- name: Example
  become: yes
  tasks:
    - name: Provide current Apache
      yum:
        name: httpd
        state: latest

I need to see that the /usr/bin/dnf binary is called with root permissions.

How can I configure the various logging systems involved to provide that information?

Answer 1

Maybe setting verbosity level inside Ansible could provide that information. You could either pass it as an argument '-vv or -v' or setting it in the ansible.cfg => verbosity = 2