jumpserver/jumpserver · error · RuntimeError

Failed to capture shell state before switching user. The log

Error message

Failed to capture shell state before switching user. The login shell did not return a verification marker.

What it means

Raised when the baseline marker command completed without error but produced no parseable verification marker (baseline_state is None). Without a baseline state the client cannot later prove the user switch took effect.

Source

Thrown at apps/libs/ansible/modules_utils/remote_client.py:658

        baseline_output, baseline_error = self.execute(
            [switch_state_cmd],
            [switch_state_re]
        )
        baseline_state = _extract_switch_state(baseline_output)
        self._debug(
            'privilege.user.baseline',
            output=baseline_output,
            error=baseline_error,
            state=baseline_state,
        )
        if baseline_error:
            raise RuntimeError(
                'Failed to capture shell state before switching user. '
                f'Output: {self._redact_text(baseline_output)}. '
                f'Error: {self._redact_text(baseline_error)}'
            )
        if baseline_state is None:
            raise RuntimeError(
                'Failed to capture shell state before switching user. '
                'The login shell did not return a verification marker.'
            )

        # A root `su` or NOPASSWD sudo may open the target shell without
        # displaying a password prompt. Read until either the deterministic
        # prompt appears or the channel becomes quiet, then only send the
        # secret when a prompt was actually observed.
        output_parts = []
        error = ''
        authentication_error = None
        password_sent = False
        try:
            channel = self.channel
            self._check_send(channel)
            self._send_command(channel, switch_cmd)
            switch_output = self._get_match_recv(
                prompt_re,

View on GitHub (pinned to 6ec464fabd)

Solutions

1. Increase recv_timeout and set an adequate delay_time so the marker is fully captured.
2. Disable paging/banners on the device for this session.
3. Check debug logs ('privilege.user.baseline') to see the raw output and why the pattern missed.

Example fix

# before
- name: run module
  my_module:
    recv_timeout: 15
# after
- name: run module
  my_module:
    recv_timeout: 60
    delay_time: 10

# Ensure enough time for the marker round-trip
- set_fact:
    recv_timeout: "{{ recv_timeout | default(60) }}"
- assert: { that: "recv_timeout | int > delay_time | int(0)" }

When it happens

Trigger: The login shell returns output that doesn't match the marker pattern — paging headers, banners, or CLI output swallowing the marker — or returns empty output.

Common situations: Network devices printing MOTB/banners around command output; terminal paging (--more--) interleaving; delay/timeout too short so marker arrives after the read window; custom prompts confusing the parser.

Related errors

• No response received during {method} privilege switching
• {name} timed out, wait {timeout}s
• delay_time must be less than recv_timeout
• Password is required for {method} privilege switching
• The privilege password cannot contain a line break

AI-assisted analysis of jumpserver/jumpserver@6ec464fabd (2026-08-28). Data as JSON: /api/errors/c4bcf33320e71df4. Report an issue: GitHub.