The text 486d2f04b184, as Debian 13 (Trixie) shipped it.
build up search rule
ausearch_add_timestamp_item(3) on Linux now
