The text 48198c0013bc, as Debian 9 (Stretch), Debian 8 (Jessie) shipped it.
audit search expression format
ausearch-expression(5) on Linux now
