如何让Ansible在日志含Error/Traceback时返回执行失败

问题原因 #

你当前的检测任务仅能识别日志中的错误字符串，但没有配置主动触发任务失败的逻辑。默认情况下，egrep匹配到内容时返回0（Ansible判定为成功），未匹配到返回1（Ansible判定为失败），但你通过register捕获结果后，Ansible不会自动触发失败，需要显式定义失败条件。

方案一：用failed_when配合Shell模块 #

修改检测任务，通过failed_when指定失败条件，当匹配到错误字符串时标记任务失败：

- name: "Search log for errors"
  become: yes
  become_user: oracle
  register: presence
  shell: "egrep -w 'Error|Traceback' {{ log_file }}"
  # 匹配到错误（返回码0）时触发任务失败
  failed_when: presence.rc == 0
  # 未匹配到错误时忽略egrep的非0返回，避免任务直接失败
  ignore_errors: true
  # 标记任务无状态变更，避免干扰Playbook的变更统计
  changed_when: false

方案二：用assert模块实现直观断言 #

assert模块逻辑更清晰，适合新手理解，直接断言日志中不存在指定错误字符串：

- name: "Read log content"
  become: yes
  become_user: oracle
  register: log_content
  shell: "cat {{ log_file }}"
  changed_when: false

- name: "Fail if errors detected"
  assert:
    that:
      - "'Error' not in log_content.stdout"
      - "'Traceback' not in log_content.stdout"
    fail_msg: "Script failed: found 'Error' or 'Traceback' in log"
    success_msg: "No critical errors in log"

方案三：调整Shell命令返回码 #

让egrep在匹配到错误时返回非0值，让Ansible自动识别为失败：

- name: "Search log for errors"
  become: yes
  become_user: oracle
  shell: "egrep -w 'Error|Traceback' {{ log_file }} && exit 1 || exit 0"

逻辑说明：匹配到错误时执行exit 1（触发Ansible失败），未匹配到则执行exit 0（任务正常通过）。

整合到原Playbook的示例 #

将检测逻辑放到always块之后，确保日志输出后立即检查错误：

name: framework
  hosts: target_hosts
  vars:
    base_dir: /tmp
    log_file: "{{ base_dir }}/update_oem_{{ db_unique_name }}_{{ ansible_date_time.iso8601_basic_short }}.log"
  become_user: oracle
  become: yes
  tasks:
    - name: Execute module
      block:
        - name: "Run Update OEM against {{ db_unique_name }}"
          shell: "/local/oracle/myapp/workflows/run_update_oracle_home.sh {{ db_unique_name }} > {{ log_file }} 2>&1"

      rescue:
        - debug:
            msg: "Update failed, please engage Support team."
      always:
        - name: "Display log contents"
          shell: "cat {{ log_file }}"
          register: log_output
          changed_when: false

    - name: "Check for critical errors in log"
      assert:
        that:
          - "'Error' not in log_output.stdout"
          - "'Traceback' not in log_output.stdout"
        fail_msg: "Script execution failed: 'Error' or 'Traceback' found in log"

内容的提问来源于stack exchange，提问作者svk