The text 06931e2b0a9c, as Debian 13 (Trixie) shipped it.
build up search rule
ausearch_add_interpreted_item(3) on Linux now
