ausearch_add_item(3) on Linux

The text 75ce83df8683, as Debian 12 (Bookworm), Debian 11 (Bullseye), Debian 10 (Buster), Debian 9 (Stretch), Debian 8 (Jessie) shipped it.

build up search rule