# platform = multi_platform_all
# reboot = false
# strategy = restrict
# complexity = low
# disruption = low

- (xccdf-var var_sudo_logfile)

- name: Ensure logfile is enabled with the appropriate value in /etc/sudoers
  ansible.builtin.lineinfile:
    path: /etc/sudoers
    regexp: '^[\s]*Defaults\s(.*)\blogfile=[-]?.+\b(.*)$'
    line: 'Defaults \1logfile={{ var_sudo_logfile }}\2'
    validate: /usr/sbin/visudo -cf %s
    backrefs: yes
  register: edit_sudoers_logfile_option

- name: Enable logfile option with appropriate value in /etc/sudoers
  ansible.builtin.lineinfile: # noqa 503
    path: /etc/sudoers
    line: 'Defaults logfile={{ var_sudo_logfile }}'
    validate: /usr/sbin/visudo -cf %s
  when: edit_sudoers_logfile_option is defined and not edit_sudoers_logfile_option.changed
