/etc/audit/rules.d/audit.rules is in auditd 1:2.8.2-1ubuntu1.
This file is owned by root:root, with mode 0o640.
The actual contents of the file can be viewed below.
1 2 3 4 5 6 7 8 9 10 11 12 | ## First rule - delete all
-D
## Increase the buffers to survive stress events.
## Make this bigger for busy systems
-b 8192
## This determine how long to wait in burst of events
--backlog_wait_time 0
## Set failure mode to syslog
-f 1
|