ausearch_add_expression(3) on Linux

The text d72b32ed92c5, as Debian 11 (Bullseye), Debian 10 (Buster), Debian 9 (Stretch), Debian 8 (Jessie), Debian 7 (Wheezy) shipped it.

build up search expression