The text d4d0ddb37c67, as Debian 13 (Trixie) shipped it.
build up search rule
ausearch_add_timestamp_item_ex(3) on Linux now
