# platform = multi_platform_all
# reboot = false
# strategy = restrict
# complexity = low
# disruption = low







- name: "Resolve information before writing to audit logs"
  block:
    - name: "Check for duplicate values"
      ansible.builtin.lineinfile:
        path: '/etc/audit/auditd.conf'
        create: yes
        regexp: '(?i)(?i)^\s*log_format\s*=\s*'
        state: 'absent'
      check_mode: yes
      changed_when: no
      register: 'dupes'
    - name: "Deduplicate values from /etc/audit/auditd.conf"
      ansible.builtin.lineinfile:
        path: '/etc/audit/auditd.conf'
        create: yes
        regexp: '(?i)(?i)^\s*log_format\s*=\s*'
        state: 'absent'
      when: 'dupes.found is defined and dupes.found > 1'
    - name: "Insert correct line to /etc/audit/auditd.conf"
      ansible.builtin.lineinfile:
        path: '/etc/audit/auditd.conf'
        create: yes
        regexp: '(?i)(?i)^\s*log_format\s*=\s*'
        line: 'log_format = ENRICHED'
        state: present