Rules are edited with visudo: it checks the grammar before saving the file. sudo visudo -cf file checks a finished file without changing anything.
A colleague sent a draft rule for labops and says it passed the check. The requirement is the same: the engineer reads the last two lines of one log.
Check the draft rule
Read the draft rule and check its syntax. The draft lies outside /etc/sudoers.d and affects nothing; do not install it.
First, predict
What will sudo visudo -cf /srv/sudo-lab/candidate say about the draft?
Now start the exercise, run the command and compare your prediction with the output.
parsed OK means one thing: the line follows the grammar. What it allows, visudo does not judge. The draft has ALL in the command position, and such a rule would give labops any command as root without a password. You check a rule's meaning by eye, against the table above, and with calls made as the grantee.