Differentiating audit rules in an LSM stack