Repository: ansible/ansible
Pull request: Detect failed sysvinit module
##### SUMMARY
<!--- Describe the change, including rationale and design decisions -->
The rationale for this change was to close #42957

- This checks the stderr instead of the rc to detect whether the
  sysvinit module was successful or not, as even when failing, the
  rc would be 0.

- It immediatly became obvious that the debug info when failing
  was far too little to properly debug the role. To improve this,
  I also added the rc, stderr and stdout to the debug output.
<!--- If you are fixing an existing issue, please include "Fixes #nnn" in your
commit message and your description; but you should still explain what
the change does.-->
Fixes #42957
##### ISSUE TYPE
<!--- Pick one below and delete the rest: -->
 - Bugfix Pull Request

##### COMPONENT NAME
<!--- Name of the module, plugin, module or task -->
`sysvinit` (module)

##### ANSIBLE VERSION
<!--- Paste verbatim output from "ansible --version" between quotes below -->
```
ansible 2.7.0.dev0 (detect-failed-sysvinit 0f49244c8b) last updated 2018/07/22 12:28:39 (GMT +200)
  config file = None
  configured module search path = ['/home/user/.ansible/plugins/modules', '/usr/share/ansible/plugins/modules']
  ansible python module location = /home/user/documents/programming/ansible/lib/ansible
  executable location = /home/user/.venv/bin/ansible
  python version = 3.6.6 (default, Jun 27 2018, 13:11:40) [GCC 8.1.1 20180531]
```



Problem statement:
Service module reports changed when actually failed
<!---
Verify first that your issue/request is not already reported on GitHub.
THIS FORM WILL BE READ BY A MACHINE, COMPLETE ALL SECTIONS AS DESCRIBED.
Also test if the latest release, and devel branch are affected too.
ALWAYS add information AFTER (OUTSIDE) these html comments.
Otherwise it may end up being automatically closed by our bot. -->

##### SUMMARY
Starting fail2ban with the service module and a missing required file reports `changed` even though it actually failed to start.

##### ISSUE TYPE
 - Bug Report

##### COMPONENT NAME
<!--- Insert, BELOW THIS COMMENT, the name of the module, plugin, task or feature.
Do not include extra details here, e.g. "vyos_command" not "the network module vyos_command" or the full path-->
`service` (Actual task)

`sysvinit` (Actually used, according to debug information)

##### ANSIBLE VERSION
<!--- Paste, BELOW THIS COMMENT, verbatim output from "ansible --version" between quotes below -->
```
ansible 2.7.0.dev0 (devel b6e9df2065) last updated 2018/07/17 14:58:07 (GMT +200)
  config file = None
  configured module search path = ['/home/user/.ansible/plugins/modules', '/usr/share/ansible/plugins/modules']
  ansible python module location = /home/user/.venv-asf/ansible/lib/ansible
  executable location = /home/user/.venv-asf/bin/ansible
  python version = 3.6.5 (default, May 11 2018, 04:00:52) [GCC 8.1.0]
```

##### CONFIGURATION
<!--- If using Ansible 2.4 or above, paste, BELOW THIS COMMENT, the results of "ansible-config dump --only-changed"
Otherwise, mention any settings you have changed/added/removed in ansible.cfg
(or using the ANSIBLE_* environment variables).-->
```
ANSIBLE_NOCOWS(env: ANSIBLE_NOCOWS) = True
```

##### OS / ENVIRONMENT
<!--- Mention, BELOW THIS COMMENT, the OS you are running Ansible from, and the OS you are
managing, or say "N/A" for anything that is not platform-specific.
Also mention the specific version of what you are trying to control,
e.g. if this is a network bug the version of firmware on the network device.-->
Using Arch Linux to manage a `ubuntu:18.04` Docker container.

##### STEPS TO REPRODUCE
<!--- For bugs, show exactly how to reproduce the problem, using a minimal test-case.
For new features, show how the feature would be used. -->

In a `ubuntu:18.04` container run the following tasks:

<!--- Paste example playbooks or commands between quotes below -->
```yaml
- name: Fail2Ban installed
  apt:
    name: fail2ban
    state: present
  become: true

- name: Fail2Ban running
  service:
    name: fail2ban
    state: started
    enabled: true
  become: true
```
<!--- You can also paste gist.github.com links for larger files -->

##### EXPECTED RESULTS
<!--- What did you expect to happen when running the steps above? -->
The tasks reports `failed` because in order to start `fail2ban` you should've added a file at `/var/log/auth.log` first.

##### ACTUAL RESULTS
<!--- What actually happened? If possible run with extra verbosity (-vvvv) -->
The first task reports `ok`, but the second task, that of starting the service reports `changed`. If you look at the debug output you can actually see that the message it gets back includes:
```
 * Starting authentication failure monitor fail2ban
 No file(s) found for glob /var/log/auth.log
 Failed during configuration: Have not found any log file for sshd jail
   ...fail!
```
Here is the complete output:
<!--- Paste verbatim command output between quotes below -->
```
    <instance> ESTABLISH DOCKER CONNECTION FOR USER: root
    <instance> EXEC ['/usr/bin/docker', b'exec', b'-i', 'instance', '/bin/sh', '-c', "/bin/sh -c 'echo ~ && sleep 0'"]
    <instance> EXEC ['/usr/bin/docker', b'exec', b'-i', 'instance', '/bin/sh', '-c', '/bin/sh -c \'( umask 77 && mkdir -p "` echo /root/.ansible/tmp/ansible-tmp-1531924072.3909743-167914333378086 `" && echo ansible-tmp-1531924072.3909743-167914333378086="` echo /root/.ansible/tmp/ansible-tmp-1531924072.3909743-167914333378086 `" ) && sleep 0\'']
    Using module file /home/user/.venv-asf/ansible/lib/ansible/modules/system/sysvinit.py
    <instance> PUT /home/user/.ansible/tmp/ansible-local-61614642htfz/tmp8sxko06z TO /root/.ansible/tmp/ansible-tmp-1531924072.3909743-167914333378086/sysvinit.py
    <instance> EXEC ['/usr/bin/docker', b'exec', b'-i', 'instance', '/bin/sh', '-c', "/bin/sh -c 'chmod u+x /root/.ansible/tmp/ansible-tmp-1531924072.3909743-167914333378086/ /root/.ansible/tmp/ansible-tmp-1531924072.3909743-167914333378086/sysvinit.py && sleep 0'"]
    <instance> EXEC ['/usr/bin/docker', b'exec', b'-i', 'instance', '/bin/sh', '-c', '/bin/sh -c \'sudo -H -S -n -u root /bin/sh -c \'"\'"\'echo BECOME-SUCCESS-oehluydgjfjfpyjzgjdpdpknmbwyunof; /usr/bin/python /root/.ansible/tmp/ansible-tmp-1531924072.3909743-167914333378086/sysvinit.py\'"\'"\' && sleep 0\'']
    <instance> EXEC ['/usr/bin/docker', b'exec', b'-i', 'instance', '/bin/sh', '-c', "/bin/sh -c 'rm -f -r /root/.ansible/tmp/ansible-tmp-1531924072.3909743-167914333378086/ > /dev/null 2>&1 && sleep 0'"]
    changed: [instance] => {
        "changed": true,
        "invocation": {
            "module_args": {
                "arguments": null,
                "daemonize": false,
                "enabled": true,
                "name": "fail2ban",
                "pattern": null,
                "runlevels": null,
                "sleep": 1,
                "state": "started"
            }
        },
        "name": "fail2ban",
        "status": {
            "enabled": {
                "changed": false,
                "rc": null,
                "stderr": null,
                "stdout": null
            },
            "started": {
                "changed": true,
                "rc": 0,
                "stderr": " No file(s) found for glob /var/log/auth.log\n Failed during configuration: Have not found any log file for sshd jail\n",
                "stdout": " * Starting authentication failure monitor fail2ban\n   ...fail!\n"
            }
        }
    }
    META: ran handlers
    META: ran handlers
```

Hints from issue discussion:
Files identified in the description:
* [lib/ansible/modules/system/service.py](https://github.com/ansible/ansible/blob/devel/lib/ansible/modules/system/service.py)
* [lib/ansible/modules/system/sysvinit.py](https://github.com/ansible/ansible/blob/devel/lib/ansible/modules/system/sysvinit.py)

If these files are inaccurate, please update the `component name` section of the description or use the `!component` bot command.

[click here for bot help](https://github.com/ansible/ansibullbot/blob/master/ISSUE_HELP.md)
<!--- boilerplate: components_banner --->
cc @bcoca 
As the `rc` is still 0, I'm thinking that perhaps we could check for an empty `stderr`. There's still the problem that a `stderr` could be used for debug information and not indicate failure, but it could work.

Commit message: Detect failed sysvinit module

- This checks the stderr instead of the rc to detect whether the
  sysvinit module was successful or not, as even when failing, the
  rc would be 0.
- It immediatly became obvious that the debug info when failing
  was far too little to properly debug the role. To improve this,
  I also added the rc, stderr and stdout to the debug output.

Patch to review:
diff --git a/lib/ansible/modules/system/sysvinit.py b/lib/ansible/modules/system/sysvinit.py
index c39e2866ec1c1a..9a68fe16f0fd38 100644
--- a/lib/ansible/modules/system/sysvinit.py
+++ b/lib/ansible/modules/system/sysvinit.py
@@ -310,8 +310,8 @@ def runme(doit):
                 (rc, out, err) = module.run_command(cmd)
             # FIXME: ERRORS
 
-            if rc != 0:
-                module.fail_json(msg="Failed to %s service: %s" % (action, name))
+            if err != "":
+                module.fail_json(msg="Failed to %s service: %s" % (action, name), rc=rc, out=out, err=err)
 
             return (rc, out, err)
 


Code review comments:
diff_hunk: @@ -310,8 +310,8 @@ def runme(doit):
                 (rc, out, err) = module.run_command(cmd)
             # FIXME: ERRORS
 
-            if rc != 0:
-                module.fail_json(msg="Failed to %s service: %s" % (action, name))
+            if err != "":
+                module.fail_json(msg="Failed to %s service: %s" % (action, name), rc=rc, out=out, err=err)
path: lib/ansible/modules/system/sysvinit.py
text: @user1:
i would uset stdout and stderr as these are how we commonly name these fields in other modules.