Ubuntu 22.04 Ensure 'log_format' is configured with value 'ENRICHED' in /etc/audit/auditd.conf /etc/audit/auditd.conf ^[ \t]*(?i)log_format(?-i)[ \t]*=[ \t]*(.+?)[ \t]*(?:$|#) 1 ^(?i)ENRICHED(?-i)$