New filter-syslog rule, 386 audit.rules default