Idempotence

Author: P4T12ICK

tasks/install_auditd.yml

@@ -63,7 +63,6 @@
     owner: splunkfwd
     group: splunkfwd
     mode: '0755'
-    recurse: yes
   with_items:
     - /opt/splunkforwarder/etc/apps/auditd_app/local/
 
@@ -74,5 +73,4 @@
     dest: /opt/splunkforwarder/etc/apps/auditd_app/local/inputs.conf
     owner: splunkfwd
     group: splunkfwd
-    mode: '0644'
-    force: yes
+    mode: '0644'

tasks/install_osquery_linux.yml

@@ -10,13 +10,6 @@
     state: present    
     update_cache: true
 
-- name: drop the osquery_install.sh script /tmp
-  become: true
-  copy:
-    src: osquery_install.sh
-    dest: /tmp/osquery_install.sh 
-    mode: '0755'
-
 - name: check if osquery service exist
   stat: path=/etc/init.d/osqueryd
   register: service_status 
@@ -34,6 +27,14 @@
     state: stopped
   when: service_status.stat.exists
 
+- name: drop the osquery_install.sh script /tmp
+  become: true
+  copy:
+    src: osquery_install.sh
+    dest: /tmp/osquery_install.sh 
+    mode: '0755'
+  when: not osquery_installed.stat.exists | default(false)
+
 - name: run osquery_install.sh
   become: true
   command: sh /tmp/osquery_install.sh
@@ -44,6 +45,7 @@
   file:
     path: /tmp/osquery_install.sh
     state: absent
+  when: not osquery_installed.stat.exists | default(false)
 
 - name: copy template.osquery.conf
   become: true
@@ -97,7 +99,6 @@
     owner: splunkfwd
     group: splunkfwd
     mode: '0755'
-    recurse: yes
   with_items:
     - /opt/splunkforwarder/etc/apps/osquery_app/local/
 
@@ -108,5 +109,4 @@
     dest: /opt/splunkforwarder/etc/apps/osquery_app/local/inputs.conf
     owner: splunkfwd
     group: splunkfwd
-    mode: '0644'
-    force: yes
+    mode: '0644'

tasks/install_sysmon_linux.yml

@@ -43,11 +43,20 @@
   stat:
     path: /etc/sysmon/sysmon.xml
   register: sysmon_configured
+  changed_when: false
+
+- name: Check if sysmon service exists and is active
+  become: true
+  command: systemctl is-active sysmon.service
+  register: sysmon_service_check
+  changed_when: false
+  failed_when: false
 
 - name: launch with config
   become: true
   ansible.builtin.shell: sysmon -accepteula -i /tmp/SysMonLinux-CatchAll.xml
-  when: not sysmon_configured.stat.exists | default(false)
+  when: (not sysmon_configured.stat.exists | default(false)) and (sysmon_service_check.rc != 0 | default(true))
+  changed_when: false
 
 - name: install powershell
   become: true
@@ -64,7 +73,6 @@
     owner: splunkfwd
     group: splunkfwd
     mode: '0755'
-    recurse: yes
   with_items:
     - /opt/splunkforwarder/etc/apps/sysmon_app/local/
 
@@ -75,5 +83,4 @@
     dest: /opt/splunkforwarder/etc/apps/sysmon_app/local/inputs.conf
     owner: splunkfwd
     group: splunkfwd
-    mode: '0644'
-    force: yes
+    mode: '0644'