diff --git a/tests/tacacs/test_accounting.py b/tests/tacacs/test_accounting.py
index 81b77df6067..1aec9ce4f17 100644
--- a/tests/tacacs/test_accounting.py
+++ b/tests/tacacs/test_accounting.py
@@ -85,13 +85,18 @@ def check_tacacs_server_no_other_user_log(ptfhost, tacacs_creds):
 
 def check_local_log_exist(duthost, tacacs_creds, command):
     """
+        Remove all ansible command log with /D command,
+        which will match following format:
+            "ansible.legacy.command Invoked"
+
         Find logs run by tacacs_rw_user from syslog:
             Find logs match following format:
                 "INFO audisp-tacplus: Accounting: user: tacacs_rw_user,.*, command: .*command,"
             Print matched logs with /P command.
     """
     username = tacacs_creds['tacacs_rw_user']
-    log_pattern = "/INFO audisp-tacplus.+Accounting: user: {0},.*, command: .*{1},/P" \
+    log_pattern = "/ansible.legacy.command Invoked/D;\
+                  /INFO audisp-tacplus.+Accounting: user: {0},.*, command: .*{1},/P" \
                   .format(username, command)
     logs = wait_for_log(duthost, "/var/log/syslog", log_pattern)
     pytest_assert(len(logs) > 0)
@@ -106,6 +111,9 @@ def check_local_log_exist(duthost, tacacs_creds, command):
 def check_local_no_other_user_log(duthost, tacacs_creds):
     """
         Find logs not run by tacacs_rw_user from syslog:
+            Remove all ansible command log with /D command,
+            which will match following format:
+                "ansible.legacy.command Invoked"
 
             Remove all tacacs_rw_user's log with /D command,
             which will match following format:
@@ -117,7 +125,9 @@ def check_local_no_other_user_log(duthost, tacacs_creds):
             Print matched logs with /P command, which are not run by tacacs_rw_user.
     """
     username = tacacs_creds['tacacs_rw_user']
-    log_pattern = "/INFO audisp-tacplus: Accounting: user: {0},/D;/INFO audisp-tacplus: Accounting: user:/P" \
+    log_pattern = "/ansible.legacy.command Invoked/D;\
+                  /INFO audisp-tacplus: Accounting: user: {0},/D;\
+                  /INFO audisp-tacplus: Accounting: user:/P" \
                   .format(username)
     logs = wait_for_log(duthost, "/var/log/syslog", log_pattern)