Question about updating audit.rules