The text df2c138ac1dd, as Debian 13 (Trixie) shipped it.
build up search rule
ausearch_add_item(3) on Linux now
