Repository: ansible/ansible
Pull request: Add variable for DEFAULT_NO_TARGET_SYSLOG
##### SUMMARY
Expose `DEFAULT_NO_TARGET_SYSLOG` through a variable and add notes that this also affects newer style PowerShell modules. Setting it on the task is done like

```
- win_stat:
    path: C:\Windows
  vars:
    ansible_no_target_syslog: True
```

Fixes https://github.com/ansible/ansible/issues/68656

##### ISSUE TYPE
- Docs Pull Request
- Feature Pull Request

##### COMPONENT NAME
config

Problem statement:
Ansible.Basic - do no output even log if DEFAULT_NO_TARGET_SYSLOG is set
<!--- Verify first that your issue is not already reported on GitHub -->
<!--- Also test if the latest release and devel branch are affected too -->
<!--- Complete *all* sections as described, this form is processed automatically -->

##### SUMMARY
<!--- Explain the problem briefly below -->
For reasons unknown, messages appear in the Windows Event Log (Event Viewer) when module win_stat has been used. It is unclear if this is being caused by a particular module argument.

##### ISSUE TYPE
- Bug Report

##### COMPONENT NAME
<!--- Write the short name of the module, plugin, task or feature below, use your best guess if unsure -->
win_stat

##### ANSIBLE VERSION
<!--- Paste verbatim output from "ansible --version" between quotes -->
```paste below
ansible 2.9.6
  config file = None
  configured module search path = ['/Users/michaelsmoody/.ansible/plugins/modules', '/usr/share/ansible/plugins/modules']
  ansible python module location = /usr/local/Cellar/ansible/2.9.6_1/libexec/lib/python3.8/site-packages/ansible
  executable location = /usr/local/bin/ansible
  python version = 3.8.2 (default, Mar 11 2020, 00:28:52) [Clang 11.0.0 (clang-1100.0.33.17)]
```

##### CONFIGURATION
<!--- Paste verbatim output from "ansible-config dump --only-changed" between quotes -->
```paste below
No Output
```

##### OS / ENVIRONMENT
<!--- Provide all relevant information below, e.g. target OS versions, network device firmware, etc. -->
macOS 10.14.6

##### STEPS TO REPRODUCE
<!--- Describe exactly how to reproduce the problem, using a minimal test-case -->
Use of win_stat in a playbook

<!--- Paste example playbooks or commands between quotes below -->
```yaml
- name: Get a directory via win_stat
  win_stat:
    path: "E:\\TheDirectoryPath"
  register: current_deploy_directory

```

<!--- HINT: You can paste gist.github.com links for larger files -->

##### EXPECTED RESULTS
<!--- Describe what you expected to happen when running the steps above -->
win_stat module is used without logging into Event Log (unless verbose flags enabled)

Interestingly, I'd love to know what actually causes this so I could cause certain modules TO cause events in the Event Log for audit purposes. But this one isn't expected. So, fix, but explain what the process is to make this happen.

##### ACTUAL RESULTS
<!--- Describe what actually happened. If possible run with extra verbosity (-vvvv) -->
Log in the Application log, level Information, source Ansible

```
Level	Date and Time	Source	Event ID	Task Category
Information	4/3/2020 12:00:01 AM	Ansible	0	None	"win_stat - Invoked with:
  get_checksum: True
  checksum_algorithm: sha1
  follow: False
  get_md5: False
  path: E:\TheDirectoryPath"
```

<!--- Paste verbatim command output between quotes -->
```paste below

```

Hints from issue discussion:
Files identified in the description:
* [`lib/ansible/modules/windows/win_stat.ps1`](https://github.com/ansible/ansible/blob/devel/lib/ansible/modules/windows/win_stat.ps1)

If these files are incorrect, please update the `component name` section of the description or use the `!component` bot command.

[click here for bot help](https://github.com/ansible/ansibullbot/blob/master/ISSUE_HELP.md)
<!--- boilerplate: components_banner --->
This is because win_stat uses the new Ansible.Basic module wrapper with this particular action at https://github.com/ansible/ansible/blob/devel/lib/ansible/module_utils/csharp/Ansible.Basic.cs#L231. You can disable this by setting `no_log: yes` on the task if you wish. Not all built in modules have been converted to use this newer format so that’s why you haven’t seen this behaviour with other modules.
Sorry, I meant to answer this, and got caught up in some other tasks. I wanted to mention that no_log isn't necessary an ideal situation, as it prevents output on the local host system. Is there a version of no_log that works only on the remote system, while still displaying expected output on the local host system?

(An example of why this might be useful, I want to run ansible-playbook with a verbose flag to enable debug, and see what win_stat did/is doing, but I don't necessarily want it to appear in the Event Log on the Windows system).

Essentially, is there a no_log_remote: yes, while still not requiring me to set no_log: yes?
There is https://docs.ansible.com/ansible/latest/reference_appendices/config.html#default-no-target-syslog but unfortunately it isn't hooked into the Ansible.Basic wrapper. This should probably be done so I'll leave the issue open until it is implemented.
After investigating it a bit more it looks like this inadvertently works without realising it does. The [DEFAULT_NO_TARGET_SYSLOG](https://docs.ansible.com/ansible/latest/reference_appendices/config.html#default-no-target-syslog) config value passes [_ansible_no_log](https://github.com/ansible/ansible/blob/46d82179d8fb32ec51ac0ba03ce4445d17c13d34/lib/ansible/plugins/action/__init__.py#L717) to the module. With no log being set only on the module side, things like the event log mechanism is disabled but the output that Ansible displayed is still there. I've tested this by adding `no_target_syslog = True` to the `[defaults]` section of my ansible.cfg and the module no longer reports the invocation details (or any other event log action) anymore.

I originally thought this option was passed under a different option like `_ansible_no_target_syslog` but that isn't the case. I'll look into updating the docs to state this also affect PowerShell modules on Windows and provide a way to set this through an variable so you can set it per task.

Commit message: Add variable for DEFAULT_NO_TARGET_SYSLOG

Patch to review:
diff --git a/changelogs/fragments/no_target_syslog-var.yaml b/changelogs/fragments/no_target_syslog-var.yaml
new file mode 100644
index 00000000000000..9929a690bd9040
--- /dev/null
+++ b/changelogs/fragments/no_target_syslog-var.yaml
@@ -0,0 +1,2 @@
+minor_changes:
+- Added the ability to set ``DEFAULT_NO_TARGET_SYSLOG`` through the ``ansible_no_target_syslog`` variable on a task
diff --git a/lib/ansible/config/base.yml b/lib/ansible/config/base.yml
index 981c003b597414..5547dbd28a232d 100644
--- a/lib/ansible/config/base.yml
+++ b/lib/ansible/config/base.yml
@@ -897,10 +897,14 @@ DEFAULT_NO_LOG:
 DEFAULT_NO_TARGET_SYSLOG:
   name: No syslog on target
   default: False
-  description: Toggle Ansible logging to syslog on the target when it executes tasks.
+  description:
+  - Toggle Ansible logging to syslog on the target when it executes tasks. On Windows hosts this will disable a newer
+    style PowerShell modules from writting to the event log.
   env: [{name: ANSIBLE_NO_TARGET_SYSLOG}]
   ini:
   - {key: no_target_syslog, section: defaults}
+  vars:
+  - {name: ansible_no_target_syslog}
   type: boolean
   yaml: {key: defaults.no_target_syslog}
 DEFAULT_NULL_REPRESENTATION:
diff --git a/lib/ansible/plugins/action/__init__.py b/lib/ansible/plugins/action/__init__.py
index 967c5b027cb504..89b80fb78b1a8b 100644
--- a/lib/ansible/plugins/action/__init__.py
+++ b/lib/ansible/plugins/action/__init__.py
@@ -714,7 +714,8 @@ def _update_module_args(self, module_name, module_args, task_vars):
             module_args['_ansible_check_mode'] = False
 
         # set no log in the module arguments, if required
-        module_args['_ansible_no_log'] = self._play_context.no_log or C.DEFAULT_NO_TARGET_SYSLOG
+        no_target_syslog = C.config.get_config_value('DEFAULT_NO_TARGET_SYSLOG', variables=task_vars)
+        module_args['_ansible_no_log'] = self._play_context.no_log or no_target_syslog
 
         # set debug in the module arguments, if required
         module_args['_ansible_debug'] = C.DEFAULT_DEBUG


Code review comments:
diff_hunk: @@ -897,10 +897,14 @@ DEFAULT_NO_LOG:
 DEFAULT_NO_TARGET_SYSLOG:
   name: No syslog on target
   default: False
-  description: Toggle Ansible logging to syslog on the target when it executes tasks.
+  description:
+  - Toggle Ansible logging to syslog on the target when it executes tasks. On Windows hosts this will disable a newer
+    style PowerShell modules from writting to the event log.
   env: [{name: ANSIBLE_NO_TARGET_SYSLOG}]
   ini:
   - {key: no_target_syslog, section: defaults}
+  vars:
+  - {name: ansible_no_target_syslog}
path: lib/ansible/config/base.yml
text: @user1:
version_added, also, its already a dict, no need for {}

@author:
I can't add the `version_added` key because the option has always been there. I can add an entry to the description saying this was added. Or can you do `version_added` for a vars entry?

@user1:
 version added can be added per env var, variable or even ini entry, also you can deprecate the whole config or just one of the ways to set it

```
 vars:
  - name: ansible_no_target_syslog
    version_added: '2.10'
```

it is the main reason they are all 'lists of dicts'

@author:
Ah cool, didn't know we could do it per entry and thought it was per option, will update it.