The DevOps of your SI reports that the Ansible master has been running strange playbooks on machines. You tell him that it was not a good idea to install Ansible on the same machine as the website, but that you will investigate. In prevention, he says he has put the site in maintenance and removed SSH keys on the nodes, but that he has not touched the logs.