1 ## First rule - delete all
4 ## Increase the buffers to survive stress events.
5 ## Make this bigger for busy systems
8 ## This determine how long to wait in burst of events
11 ## Set failure mode to syslog
14 ## Generate unlimited audit messages per second