Ubuntu 22.04 Ensure 'local_events' is configured with value 'yes' in /etc/audit/auditd.conf /etc/audit/auditd.conf ^[ \t]*(?i)local_events(?-i)[ \t]*=[ \t]*(.+?)[ \t]*(?:$|#) 1 ^(?i)yes(?-i)$