The text e610be99dfdd, as Debian 7 (Wheezy) shipped it.
build up search rule
ausearch_add_timestamp_item(3) on Linux now
