Ubuntu 22.04 Check if actions on '/var/spool/cron' are configured to be audited ^/etc/audit/rules\.d/.*\.rules$ 1 /etc/audit/audit.rules 1 ^\-w[\s]+ \/var\/spool\/cron [\s]+\-p[\s]+\b([rx]*w[rx]*a[rx]*|[rx]*a[rx]*w[rx]*)\b.*$