<p>The simple answer is &quot;yes&quot; you <em>can</em> use Ansible for monitoring configuration, but you will have to do some extra work. As Vasily stated in their answer, Ansible does not have a built in triggering mechanism, so you need something to trigger the convergence of state. This can be done in several ways, the easiest being probably <a href="https://docs.ansible.com/ansible/latest/cli/ansible-pull.html" rel="nofollow noreferrer"><code>ansible-pull</code></a>. As the docs state, <code>ansible-pull</code></p>
<blockquote>
<p>... inverts the default push architecture of ansible into a pull architecture, which has near-limitless scaling potential.
The setup playbook can be tuned to change the cron frequency, logging locations, and parameters to ansible-pull. This is useful both for extreme scale-out <strong>as well as periodic remediation.</strong></p>
</blockquote>
<p><em>emphasis added</em>.</p>
<p>Ansible is idempotent, so it <em>does</em> know about the state of target machines, contrary to what Vasily's answer states - it just doesn't persist it in the same way as <a href="https://www.terraform.io/docs/state/index.html" rel="nofollow noreferrer">Terraform does</a>.</p>
<p>Your real problem does not sound like the question you are posing (&quot;Can Ansible be used to ensure the state of a machine?&quot;), but rather <strong>&quot;how can I detect configuration drift and trigger a remediation?&quot;</strong></p>
<p>If you think of this as a monitoring problem, you can reframe the question as &quot;how should I monitor my services in production?&quot;. Monitoring implies alarms on changes in state, which trigger actions to remediate. In your case, you would define an alarm on the health check of the service, when that is triggered, execute the playbook which converges to the desired state.</p>
<p>Since you have already invested time in writing the Ansible playbook, it would make sense to re-use it. The simplest would be to use that same playbook to invoke a cron which runs <code>ansible-pull</code> every 5 minutes or so, depending on your particular case.</p>

CC BY-SA 4.0
2020-11-25T09:27:17.457Z
is it *always* dempotent, or only employed so as to be so?
Nicholas Saunders
CC BY-SA 4.0
2020-09-03T05:46:35.003Z
2020-09-03T05:46:35.003Z
Bruce Becker
<p>Ansible is not state manager like Terraform but just automation tool. I think the only way to keep <strong>state A</strong> configuration is run ansible in cron. I saw such use case with chef automation tool.</p>

CC BY-SA 4.0
2020-09-03T05:01:39.497Z
2020-09-03T05:01:39.497Z
Vasiliy  Shakhunov
<p>I understand how Ansible works and what it is used for.</p>
<p>However, I was wondering if there is a way or feature (in open-source or enterprise edition) in Ansible using which, we can make sure that the configuration of a VM instance or server is always in sync with Ansible?</p>
<p><em><strong>For example:</strong></em></p>
<p>I used Ansible to install a few things (like MySQL server, spin up some docker containers etc.) on a <a href="https://cloud.google.com/compute/docs/instances" rel="nofollow noreferrer">Google Compute Instance</a>. Now after some time I manually SSH into this VM and stop the docker container created by Ansible. Can Ansible be notified of this in order to create the container again?</p>
<p>So if Ansible sets configuration of a VM in <em><strong>state A</strong></em> and another user manually changes the state to <em><strong>state B</strong></em>, is there a way that Ansible can be notified of this change and runs the playbooks again to set the configuration back to <em><strong>state A</strong></em>?</p>

<ansible><configuration-management><configuration><google-compute-engine><ansible-inventory>
Can we use Ansible for monitoring configuration?
Amit Yadav
# Can we use Ansible for monitoring configuration?

(Asked by: username_0 on 2020-09-02)

I understand how Ansible works and what it is used for.

However, I was wondering if there is a way or feature (in open-source or enterprise edition) in Ansible using which, we can make sure that the configuration of a VM instance or server is always in sync with Ansible?

***For example:***

I used Ansible to install a few things (like MySQL server, spin up some docker containers etc.) on a [Google Compute Instance](https://cloud.google.com/compute/docs/instances). Now after some time I manually SSH into this VM and stop the docker container created by Ansible. Can Ansible be notified of this in order to create the container again?

So if Ansible sets configuration of a VM in ***state A*** and another user manually changes the state to ***state B***, is there a way that Ansible can be notified of this change and runs the playbooks again to set the configuration back to ***state A***?

**Tags:** ansible, configuration-management, configuration, google-compute-engine, ansible-inventory


---

## 2 answers

### Answer by username_1 on 2020-09-03. Score: 2 | Accepted answer

The simple answer is "yes" you *can* use Ansible for monitoring configuration, but you will have to do some extra work. As Vasily stated in their answer, Ansible does not have a built in triggering mechanism, so you need something to trigger the convergence of state. This can be done in several ways, the easiest being probably [`ansible-pull`](https://docs.ansible.com/ansible/latest/cli/ansible-pull.html). As the docs state, `ansible-pull`

> ... inverts the default push architecture of ansible into a pull architecture, which has near-limitless scaling potential.
> The setup playbook can be tuned to change the cron frequency, logging locations, and parameters to ansible-pull. This is useful both for extreme scale-out **as well as periodic remediation.**

*emphasis added*.

Ansible is idempotent, so it *does* know about the state of target machines, contrary to what Vasily's answer states - it just doesn't persist it in the same way as [Terraform does](https://www.terraform.io/docs/state/index.html).

Your real problem does not sound like the question you are posing ("Can Ansible be used to ensure the state of a machine?"), but rather **"how can I detect configuration drift and trigger a remediation?"**

If you think of this as a monitoring problem, you can reframe the question as "how should I monitor my services in production?". Monitoring implies alarms on changes in state, which trigger actions to remediate. In your case, you would define an alarm on the health check of the service, when that is triggered, execute the playbook which converges to the desired state.

Since you have already invested time in writing the Ansible playbook, it would make sense to re-use it. The simplest would be to use that same playbook to invoke a cron which runs `ansible-pull` every 5 minutes or so, depending on your particular case.

> **Comments:**
> **username_2**: is it *always* dempotent, or only employed so as to be so?  

---

### Answer by username_3 on 2020-09-03. Score: 0

Ansible is not state manager like Terraform but just automation tool. I think the only way to keep **state A** configuration is run ansible in cron. I saw such use case with chef automation tool.


---

