multiline entries in audit.rules