Repository: ansible/ansible

Issue:
Service module reports changed when actually failed
<!---
Verify first that your issue/request is not already reported on GitHub.
THIS FORM WILL BE READ BY A MACHINE, COMPLETE ALL SECTIONS AS DESCRIBED.
Also test if the latest release, and devel branch are affected too.
ALWAYS add information AFTER (OUTSIDE) these html comments.
Otherwise it may end up being automatically closed by our bot. -->

##### SUMMARY
Starting fail2ban with the service module and a missing required file reports `changed` even though it actually failed to start.

##### ISSUE TYPE
 - Bug Report

##### COMPONENT NAME
<!--- Insert, BELOW THIS COMMENT, the name of the module, plugin, task or feature.
Do not include extra details here, e.g. "vyos_command" not "the network module vyos_command" or the full path-->
`service` (Actual task)

`sysvinit` (Actually used, according to debug information)

##### ANSIBLE VERSION
<!--- Paste, BELOW THIS COMMENT, verbatim output from "ansible --version" between quotes below -->
```
ansible 2.7.0.dev0 (devel b6e9df2065) last updated 2018/07/17 14:58:07 (GMT +200)
  config file = None
  configured module search path = ['/home/user/.ansible/plugins/modules', '/usr/share/ansible/plugins/modules']
  ansible python module location = /home/user/.venv-asf/ansible/lib/ansible
  executable location = /home/user/.venv-asf/bin/ansible
  python version = 3.6.5 (default, May 11 2018, 04:00:52) [GCC 8.1.0]
```

##### CONFIGURATION
<!--- If using Ansible 2.4 or above, paste, BELOW THIS COMMENT, the results of "ansible-config dump --only-changed"
Otherwise, mention any settings you have changed/added/removed in ansible.cfg
(or using the ANSIBLE_* environment variables).-->
```
ANSIBLE_NOCOWS(env: ANSIBLE_NOCOWS) = True
```

##### OS / ENVIRONMENT
<!--- Mention, BELOW THIS COMMENT, the OS you are running Ansible from, and the OS you are
managing, or say "N/A" for anything that is not platform-specific.
Also mention the specific version of what you are trying to control,
e.g. if this is a network bug the version of firmware on the network device.-->
Using Arch Linux to manage a `ubuntu:18.04` Docker container.

##### STEPS TO REPRODUCE
<!--- For bugs, show exactly how to reproduce the problem, using a minimal test-case.
For new features, show how the feature would be used. -->

In a `ubuntu:18.04` container run the following tasks:

<!--- Paste example playbooks or commands between quotes below -->
```yaml
- name: Fail2Ban installed
  apt:
    name: fail2ban
    state: present
  become: true

- name: Fail2Ban running
  service:
    name: fail2ban
    state: started
    enabled: true
  become: true
```
<!--- You can also paste gist.github.com links for larger files -->

##### EXPECTED RESULTS
<!--- What did you expect to happen when running the steps above? -->
The tasks reports `failed` because in order to start `fail2ban` you should've added a file at `/var/log/auth.log` first.

##### ACTUAL RESULTS
<!--- What actually happened? If possible run with extra verbosity (-vvvv) -->
The first task reports `ok`, but the second task, that of starting the service reports `changed`. If you look at the debug output you can actually see that the message it gets back includes:
```
 * Starting authentication failure monitor fail2ban
 No file(s) found for glob /var/log/auth.log
 Failed during configuration: Have not found any log file for sshd jail
   ...fail!
```
Here is the complete output:
<!--- Paste verbatim command output between quotes below -->
```
    <instance> ESTABLISH DOCKER CONNECTION FOR USER: root
    <instance> EXEC ['/usr/bin/docker', b'exec', b'-i', 'instance', '/bin/sh', '-c', "/bin/sh -c 'echo ~ && sleep 0'"]
    <instance> EXEC ['/usr/bin/docker', b'exec', b'-i', 'instance', '/bin/sh', '-c', '/bin/sh -c \'( umask 77 && mkdir -p "` echo /root/.ansible/tmp/ansible-tmp-1531924072.3909743-167914333378086 `" && echo ansible-tmp-1531924072.3909743-167914333378086="` echo /root/.ansible/tmp/ansible-tmp-1531924072.3909743-167914333378086 `" ) && sleep 0\'']
    Using module file /home/user/.venv-asf/ansible/lib/ansible/modules/system/sysvinit.py
    <instance> PUT /home/user/.ansible/tmp/ansible-local-61614642htfz/tmp8sxko06z TO /root/.ansible/tmp/ansible-tmp-1531924072.3909743-167914333378086/sysvinit.py
    <instance> EXEC ['/usr/bin/docker', b'exec', b'-i', 'instance', '/bin/sh', '-c', "/bin/sh -c 'chmod u+x /root/.ansible/tmp/ansible-tmp-1531924072.3909743-167914333378086/ /root/.ansible/tmp/ansible-tmp-1531924072.3909743-167914333378086/sysvinit.py && sleep 0'"]
    <instance> EXEC ['/usr/bin/docker', b'exec', b'-i', 'instance', '/bin/sh', '-c', '/bin/sh -c \'sudo -H -S -n -u root /bin/sh -c \'"\'"\'echo BECOME-SUCCESS-oehluydgjfjfpyjzgjdpdpknmbwyunof; /usr/bin/python /root/.ansible/tmp/ansible-tmp-1531924072.3909743-167914333378086/sysvinit.py\'"\'"\' && sleep 0\'']
    <instance> EXEC ['/usr/bin/docker', b'exec', b'-i', 'instance', '/bin/sh', '-c', "/bin/sh -c 'rm -f -r /root/.ansible/tmp/ansible-tmp-1531924072.3909743-167914333378086/ > /dev/null 2>&1 && sleep 0'"]
    changed: [instance] => {
        "changed": true,
        "invocation": {
            "module_args": {
                "arguments": null,
                "daemonize": false,
                "enabled": true,
                "name": "fail2ban",
                "pattern": null,
                "runlevels": null,
                "sleep": 1,
                "state": "started"
            }
        },
        "name": "fail2ban",
        "status": {
            "enabled": {
                "changed": false,
                "rc": null,
                "stderr": null,
                "stdout": null
            },
            "started": {
                "changed": true,
                "rc": 0,
                "stderr": " No file(s) found for glob /var/log/auth.log\n Failed during configuration: Have not found any log file for sshd jail\n",
                "stdout": " * Starting authentication failure monitor fail2ban\n   ...fail!\n"
            }
        }
    }
    META: ran handlers
    META: ran handlers
```
Service module reports changed when actually failed
<!---
Verify first that your issue/request is not already reported on GitHub.
THIS FORM WILL BE READ BY A MACHINE, COMPLETE ALL SECTIONS AS DESCRIBED.
Also test if the latest release, and devel branch are affected too.
ALWAYS add information AFTER (OUTSIDE) these html comments.
Otherwise it may end up being automatically closed by our bot. -->

##### SUMMARY
Starting fail2ban with the service module and a missing required file reports `changed` even though it actually failed to start.

##### ISSUE TYPE
 - Bug Report

##### COMPONENT NAME
<!--- Insert, BELOW THIS COMMENT, the name of the module, plugin, task or feature.
Do not include extra details here, e.g. "vyos_command" not "the network module vyos_command" or the full path-->
`service` (Actual task)

`sysvinit` (Actually used, according to debug information)

##### ANSIBLE VERSION
<!--- Paste, BELOW THIS COMMENT, verbatim output from "ansible --version" between quotes below -->
```
ansible 2.7.0.dev0 (devel b6e9df2065) last updated 2018/07/17 14:58:07 (GMT +200)
  config file = None
  configured module search path = ['/home/user/.ansible/plugins/modules', '/usr/share/ansible/plugins/modules']
  ansible python module location = /home/user/.venv-asf/ansible/lib/ansible
  executable location = /home/user/.venv-asf/bin/ansible
  python version = 3.6.5 (default, May 11 2018, 04:00:52) [GCC 8.1.0]
```

##### CONFIGURATION
<!--- If using Ansible 2.4 or above, paste, BELOW THIS COMMENT, the results of "ansible-config dump --only-changed"
Otherwise, mention any settings you have changed/added/removed in ansible.cfg
(or using the ANSIBLE_* environment variables).-->
```
ANSIBLE_NOCOWS(env: ANSIBLE_NOCOWS) = True
```

##### OS / ENVIRONMENT
<!--- Mention, BELOW THIS COMMENT, the OS you are running Ansible from, and the OS you are
managing, or say "N/A" for anything that is not platform-specific.
Also mention the specific version of what you are trying to control,
e.g. if this is a network bug the version of firmware on the network device.-->
Using Arch Linux to manage a `ubuntu:18.04` Docker container.

##### STEPS TO REPRODUCE
<!--- For bugs, show exactly how to reproduce the problem, using a minimal test-case.
For new features, show how the feature would be used. -->

In a `ubuntu:18.04` container run the following tasks:

<!--- Paste example playbooks or commands between quotes below -->
```yaml
- name: Fail2Ban installed
  apt:
    name: fail2ban
    state: present
  become: true

- name: Fail2Ban running
  service:
    name: fail2ban
    state: started
    enabled: true
  become: true
```
<!--- You can also paste gist.github.com links for larger files -->

##### EXPECTED RESULTS
<!--- What did you expect to happen when running the steps above? -->
The tasks reports `failed` because in order to start `fail2ban` you should've added a file at `/var/log/auth.log` first.

##### ACTUAL RESULTS
<!--- What actually happened? If possible run with extra verbosity (-vvvv) -->
The first task reports `ok`, but the second task, that of starting the service reports `changed`. If you look at the debug output you can actually see that the message it gets back includes:
```
 * Starting authentication failure monitor fail2ban
 No file(s) found for glob /var/log/auth.log
 Failed during configuration: Have not found any log file for sshd jail
   ...fail!
```
Here is the complete output:
<!--- Paste verbatim command output between quotes below -->
```
    <instance> ESTABLISH DOCKER CONNECTION FOR USER: root
    <instance> EXEC ['/usr/bin/docker', b'exec', b'-i', 'instance', '/bin/sh', '-c', "/bin/sh -c 'echo ~ && sleep 0'"]
    <instance> EXEC ['/usr/bin/docker', b'exec', b'-i', 'instance', '/bin/sh', '-c', '/bin/sh -c \'( umask 77 && mkdir -p "` echo /root/.ansible/tmp/ansible-tmp-1531924072.3909743-167914333378086 `" && echo ansible-tmp-1531924072.3909743-167914333378086="` echo /root/.ansible/tmp/ansible-tmp-1531924072.3909743-167914333378086 `" ) && sleep 0\'']
    Using module file /home/user/.venv-asf/ansible/lib/ansible/modules/system/sysvinit.py
    <instance> PUT /home/user/.ansible/tmp/ansible-local-61614642htfz/tmp8sxko06z TO /root/.ansible/tmp/ansible-tmp-1531924072.3909743-167914333378086/sysvinit.py
    <instance> EXEC ['/usr/bin/docker', b'exec', b'-i', 'instance', '/bin/sh', '-c', "/bin/sh -c 'chmod u+x /root/.ansible/tmp/ansible-tmp-1531924072.3909743-167914333378086/ /root/.ansible/tmp/ansible-tmp-1531924072.3909743-167914333378086/sysvinit.py && sleep 0'"]
    <instance> EXEC ['/usr/bin/docker', b'exec', b'-i', 'instance', '/bin/sh', '-c', '/bin/sh -c \'sudo -H -S -n -u root /bin/sh -c \'"\'"\'echo BECOME-SUCCESS-oehluydgjfjfpyjzgjdpdpknmbwyunof; /usr/bin/python /root/.ansible/tmp/ansible-tmp-1531924072.3909743-167914333378086/sysvinit.py\'"\'"\' && sleep 0\'']
    <instance> EXEC ['/usr/bin/docker', b'exec', b'-i', 'instance', '/bin/sh', '-c', "/bin/sh -c 'rm -f -r /root/.ansible/tmp/ansible-tmp-1531924072.3909743-167914333378086/ > /dev/null 2>&1 && sleep 0'"]
    changed: [instance] => {
        "changed": true,
        "invocation": {
            "module_args": {
                "arguments": null,
                "daemonize": false,
                "enabled": true,
                "name": "fail2ban",
                "pattern": null,
                "runlevels": null,
                "sleep": 1,
                "state": "started"
            }
        },
        "name": "fail2ban",
        "status": {
            "enabled": {
                "changed": false,
                "rc": null,
                "stderr": null,
                "stdout": null
            },
            "started": {
                "changed": true,
                "rc": 0,
                "stderr": " No file(s) found for glob /var/log/auth.log\n Failed during configuration: Have not found any log file for sshd jail\n",
                "stdout": " * Starting authentication failure monitor fail2ban\n   ...fail!\n"
            }
        }
    }
    META: ran handlers
    META: ran handlers
```


Discussion:
Files identified in the description:
* [lib/ansible/modules/system/service.py](https://github.com/ansible/ansible/blob/devel/lib/ansible/modules/system/service.py)
* [lib/ansible/modules/system/sysvinit.py](https://github.com/ansible/ansible/blob/devel/lib/ansible/modules/system/sysvinit.py)

If these files are inaccurate, please update the `component name` section of the description or use the `!component` bot command.

[click here for bot help](https://github.com/ansible/ansibullbot/blob/master/ISSUE_HELP.md)
<!--- boilerplate: components_banner --->
cc @bcoca 
As the `rc` is still 0, I'm thinking that perhaps we could check for an empty `stderr`. There's still the problem that a `stderr` could be used for debug information and not indicate failure, but it could work.
Files identified in the description:
* [lib/ansible/modules/system/service.py](https://github.com/ansible/ansible/blob/devel/lib/ansible/modules/system/service.py)
* [lib/ansible/modules/system/sysvinit.py](https://github.com/ansible/ansible/blob/devel/lib/ansible/modules/system/sysvinit.py)

If these files are inaccurate, please update the `component name` section of the description or use the `!component` bot command.

[click here for bot help](https://github.com/ansible/ansibullbot/blob/master/ISSUE_HELP.md)
<!--- boilerplate: components_banner --->
cc @bcoca 
As the `rc` is still 0, I'm thinking that perhaps we could check for an empty `stderr`. There's still the problem that a `stderr` could be used for debug information and not indicate failure, but it could work.

Resolving patch:
diff --git a/lib/ansible/modules/system/sysvinit.py b/lib/ansible/modules/system/sysvinit.py
--- a/lib/ansible/modules/system/sysvinit.py
+++ b/lib/ansible/modules/system/sysvinit.py
@@ -311,7 +311,7 @@ def runme(doit):
             # FIXME: ERRORS
 
             if rc != 0:
-                module.fail_json(msg="Failed to %s service: %s" % (action, name))
+                module.fail_json(msg="Failed to %s service: %s" % (action, name), rc=rc, stdout=out, stderr=err)
 
             return (rc, out, err)
 


Test patch: