...

/usr/share/audit/sample-rules/11-loginuid.rules