The text 1e302476a736, as Debian 7 (Wheezy) shipped it.
build up search rule
ausearch_add_item(3) on Linux now