...
In the rewriting section, the texts are also adjusted to the newly defined event:
Further Rules and Performance Considerations
...
After that, your rule pack should look similar to this:
Testing these rules by creating and deleting a user on the monitored host results in the following events:
To get rid of the "unknown" events in-between, we can do two things:
...