{{{ oval_metadata("Force a reboot to change audit rules is enabled", rule_title=rule_title) }}} ^/etc/audit/rules\.d/.*\.rules$ ^\-e\s+2\s*$ 1 /etc/audit/audit.rules ^\-e\s+2\s*$ 1