diff --git a/RHEL6/input/checks/audit_rules_dac_modification_chmod.xml b/RHEL6/input/checks/audit_rules_dac_modification_chmod.xml
index bd5c3f1..a32183e 100644
--- a/RHEL6/input/checks/audit_rules_dac_modification_chmod.xml
+++ b/RHEL6/input/checks/audit_rules_dac_modification_chmod.xml
@@ -43,7 +43,7 @@
          -a always,exit -F arch=b32 -S chmod -F auid>=500 -F auid!=4294967295 -k perms
     -->
     <ind:pattern
-    operation="pattern match">^[\s]*-a[\s]+(always,exit|exit,always)[\s]+(?:.*-F[\s]+arch=b32[\s]+)(?:.*-S[\s]+chmod[\s]+)(?:.*-F\s+auid>=500[\s]+)(?:.*-F\s+auid!=4294967295[\s]+).*-k[\s]+[\S]+[\s]*$</ind:pattern>
+    operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b32[\s]+)(?:.*-S[\s]+chmod[\s]+)(?:.*-F\s+auid>=500[\s]+)(?:.*-F\s+auid!=4294967295[\s]+).*-k[\s]+[\S]+[\s]*$</ind:pattern>
     <ind:instance datatype="int">1</ind:instance>
   </ind:textfilecontent54_object>
 
@@ -69,7 +69,7 @@
          -a always,exit -F arch=b64 -S chmod -F auid>=500 -F auid!=4294967295 -k perms
     -->
     <ind:pattern
-    operation="pattern match">^[\s]*-a[\s]+(always,exit|exit,always)[\s]+(?:.*-F[\s]+arch=b64[\s]+)(?:.*-S[\s]+chmod[\s]+)(?:.*-F\s+auid>=500[\s]+)(?:.*-F\s+auid!=4294967295[\s]+).*-k[\s]+[\S]+[\s]*$</ind:pattern>
+    operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b64[\s]+)(?:.*-S[\s]+chmod[\s]+)(?:.*-F\s+auid>=500[\s]+)(?:.*-F\s+auid!=4294967295[\s]+).*-k[\s]+[\S]+[\s]*$</ind:pattern>
     <ind:instance datatype="int">1</ind:instance>
   </ind:textfilecontent54_object>
 
diff --git a/RHEL6/input/checks/audit_rules_dac_modification_chown.xml b/RHEL6/input/checks/audit_rules_dac_modification_chown.xml
index 71a1537..8fa6a58 100644
--- a/RHEL6/input/checks/audit_rules_dac_modification_chown.xml
+++ b/RHEL6/input/checks/audit_rules_dac_modification_chown.xml
@@ -43,7 +43,7 @@
          -a always,exit -F arch=b32 -S chown -F auid>=500 -F auid!=4294967295 -k perms
     -->
     <ind:pattern
-    operation="pattern match">^[\s]*-a[\s]+(always,exit|exit,always)[\s]+(?:.*-F[\s]+arch=b32[\s]+)(?:.*-S[\s]+chown[\s]+)(?:.*-F\s+auid>=500[\s]+)(?:.*-F\s+auid!=4294967295[\s]+).*-k[\s]+[\S]+[\s]*$</ind:pattern>
+    operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b32[\s]+)(?:.*-S[\s]+chown[\s]+)(?:.*-F\s+auid>=500[\s]+)(?:.*-F\s+auid!=4294967295[\s]+).*-k[\s]+[\S]+[\s]*$</ind:pattern>
     <ind:instance datatype="int">1</ind:instance>
   </ind:textfilecontent54_object>
 
@@ -69,7 +69,7 @@
          -a always,exit -F arch=b64 -S chown -F auid>=500 -F auid!=4294967295 -k perms
     -->
     <ind:pattern
-    operation="pattern match">^[\s]*-a[\s]+(always,exit|exit,always)[\s]+(?:.*-F[\s]+arch=b64[\s]+)(?:.*-S[\s]+chown[\s]+)(?:.*-F\s+auid>=500[\s]+)(?:.*-F\s+auid!=4294967295[\s]+).*-k[\s]+[\S]+[\s]*$</ind:pattern>
+    operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b64[\s]+)(?:.*-S[\s]+chown[\s]+)(?:.*-F\s+auid>=500[\s]+)(?:.*-F\s+auid!=4294967295[\s]+).*-k[\s]+[\S]+[\s]*$</ind:pattern>
     <ind:instance datatype="int">1</ind:instance>
   </ind:textfilecontent54_object>
 
diff --git a/RHEL6/input/checks/audit_rules_dac_modification_fchmod.xml b/RHEL6/input/checks/audit_rules_dac_modification_fchmod.xml
index 9c3c120..44e9147 100644
--- a/RHEL6/input/checks/audit_rules_dac_modification_fchmod.xml
+++ b/RHEL6/input/checks/audit_rules_dac_modification_fchmod.xml
@@ -43,7 +43,7 @@
          -a always,exit -F arch=b32 -S fchmod -F auid>=500 -F auid!=4294967295 -k perms
     -->
     <ind:pattern
-    operation="pattern match">^[\s]*-a[\s]+(always,exit|exit,always)[\s]+(?:.*-F[\s]+arch=b32[\s]+)(?:.*-S[\s]+fchmod[\s]+)(?:.*-F\s+auid>=500[\s]+)(?:.*-F\s+auid!=4294967295[\s]+).*-k[\s]+[\S]+[\s]*$</ind:pattern>
+    operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b32[\s]+)(?:.*-S[\s]+fchmod[\s]+)(?:.*-F\s+auid>=500[\s]+)(?:.*-F\s+auid!=4294967295[\s]+).*-k[\s]+[\S]+[\s]*$</ind:pattern>
     <ind:instance datatype="int">1</ind:instance>
   </ind:textfilecontent54_object>
 
@@ -69,7 +69,7 @@
          -a always,exit -F arch=b64 -S fchmod -F auid>=500 -F auid!=4294967295 -k perms
     -->
     <ind:pattern
-    operation="pattern match">^[\s]*-a[\s]+(always,exit|exit,always)[\s]+(?:.*-F[\s]+arch=b64[\s]+)(?:.*-S[\s]+fchmod[\s]+)(?:.*-F\s+auid>=500[\s]+)(?:.*-F\s+auid!=4294967295[\s]+).*-k[\s]+[\S]+[\s]*$</ind:pattern>
+    operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b64[\s]+)(?:.*-S[\s]+fchmod[\s]+)(?:.*-F\s+auid>=500[\s]+)(?:.*-F\s+auid!=4294967295[\s]+).*-k[\s]+[\S]+[\s]*$</ind:pattern>
     <ind:instance datatype="int">1</ind:instance>
   </ind:textfilecontent54_object>
 
diff --git a/RHEL6/input/checks/audit_rules_dac_modification_fchmodat.xml b/RHEL6/input/checks/audit_rules_dac_modification_fchmodat.xml
index d117ead..f5aaccd 100644
--- a/RHEL6/input/checks/audit_rules_dac_modification_fchmodat.xml
+++ b/RHEL6/input/checks/audit_rules_dac_modification_fchmodat.xml
@@ -43,7 +43,7 @@
          -a always,exit -F arch=b32 -S fchmodat -F auid>=500 -F auid!=4294967295 -k perms
     -->
     <ind:pattern
-    operation="pattern match">^[\s]*-a[\s]+(always,exit|exit,always)[\s]+(?:.*-F[\s]+arch=b32[\s]+)(?:.*-S[\s]+fchmodat[\s]+)(?:.*-F\s+auid>=500[\s]+)(?:.*-F\s+auid!=4294967295[\s]+).*-k[\s]+[\S]+[\s]*$</ind:pattern>
+    operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b32[\s]+)(?:.*-S[\s]+fchmodat[\s]+)(?:.*-F\s+auid>=500[\s]+)(?:.*-F\s+auid!=4294967295[\s]+).*-k[\s]+[\S]+[\s]*$</ind:pattern>
     <ind:instance datatype="int">1</ind:instance>
   </ind:textfilecontent54_object>
 
@@ -69,7 +69,7 @@
          -a always,exit -F arch=b64 -S fchmodat -F auid>=500 -F auid!=4294967295 -k perms
     -->
     <ind:pattern
-    operation="pattern match">^[\s]*-a[\s]+(always,exit|exit,always)[\s]+(?:.*-F[\s]+arch=b64[\s]+)(?:.*-S[\s]+fchmodat[\s]+)(?:.*-F\s+auid>=500[\s]+)(?:.*-F\s+auid!=4294967295[\s]+).*-k[\s]+[\S]+[\s]*$</ind:pattern>
+    operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b64[\s]+)(?:.*-S[\s]+fchmodat[\s]+)(?:.*-F\s+auid>=500[\s]+)(?:.*-F\s+auid!=4294967295[\s]+).*-k[\s]+[\S]+[\s]*$</ind:pattern>
     <ind:instance datatype="int">1</ind:instance>
   </ind:textfilecontent54_object>
 
diff --git a/RHEL6/input/checks/audit_rules_dac_modification_fchown.xml b/RHEL6/input/checks/audit_rules_dac_modification_fchown.xml
index 63c0b91..4346ea4 100644
--- a/RHEL6/input/checks/audit_rules_dac_modification_fchown.xml
+++ b/RHEL6/input/checks/audit_rules_dac_modification_fchown.xml
@@ -43,7 +43,7 @@
          -a always,exit -F arch=b32 -S fchown -F auid>=500 -F auid!=4294967295 -k perms
     -->
     <ind:pattern
-    operation="pattern match">^[\s]*-a[\s]+(always,exit|exit,always)[\s]+(?:.*-F[\s]+arch=b32[\s]+)(?:.*-S[\s]+fchown[\s]+)(?:.*-F\s+auid>=500[\s]+)(?:.*-F\s+auid!=4294967295[\s]+).*-k[\s]+[\S]+[\s]*$</ind:pattern>
+    operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b32[\s]+)(?:.*-S[\s]+fchown[\s]+)(?:.*-F\s+auid>=500[\s]+)(?:.*-F\s+auid!=4294967295[\s]+).*-k[\s]+[\S]+[\s]*$</ind:pattern>
     <ind:instance datatype="int">1</ind:instance>
   </ind:textfilecontent54_object>
 
@@ -69,7 +69,7 @@
          -a always,exit -F arch=b64 -S fchown -F auid>=500 -F auid!=4294967295 -k perms
     -->
     <ind:pattern
-    operation="pattern match">^[\s]*-a[\s]+(always,exit|exit,always)[\s]+(?:.*-F[\s]+arch=b64[\s]+)(?:.*-S[\s]+fchown[\s]+)(?:.*-F\s+auid>=500[\s]+)(?:.*-F\s+auid!=4294967295[\s]+).*-k[\s]+[\S]+[\s]*$</ind:pattern>
+    operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b64[\s]+)(?:.*-S[\s]+fchown[\s]+)(?:.*-F\s+auid>=500[\s]+)(?:.*-F\s+auid!=4294967295[\s]+).*-k[\s]+[\S]+[\s]*$</ind:pattern>
     <ind:instance datatype="int">1</ind:instance>
   </ind:textfilecontent54_object>
 
diff --git a/RHEL6/input/checks/audit_rules_dac_modification_fchownat.xml b/RHEL6/input/checks/audit_rules_dac_modification_fchownat.xml
index 10c8a97..e0f1158 100644
--- a/RHEL6/input/checks/audit_rules_dac_modification_fchownat.xml
+++ b/RHEL6/input/checks/audit_rules_dac_modification_fchownat.xml
@@ -43,7 +43,7 @@
          -a always,exit -F arch=b32 -S fchownat -F auid>=500 -F auid!=4294967295 -k perms
     -->
     <ind:pattern
-    operation="pattern match">^[\s]*-a[\s]+(always,exit|exit,always)[\s]+(?:.*-F[\s]+arch=b32[\s]+)(?:.*-S[\s]+fchownat[\s]+)(?:.*-F\s+auid>=500[\s]+)(?:.*-F\s+auid!=4294967295[\s]+).*-k[\s]+[\S]+[\s]*$</ind:pattern>
+    operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b32[\s]+)(?:.*-S[\s]+fchownat[\s]+)(?:.*-F\s+auid>=500[\s]+)(?:.*-F\s+auid!=4294967295[\s]+).*-k[\s]+[\S]+[\s]*$</ind:pattern>
     <ind:instance datatype="int">1</ind:instance>
   </ind:textfilecontent54_object>
 
@@ -69,7 +69,7 @@
          -a always,exit -F arch=b64 -S fchownat -F auid>=500 -F auid!=4294967295 -k perms
     -->
     <ind:pattern
-    operation="pattern match">^[\s]*-a[\s]+(always,exit|exit,always)[\s]+(?:.*-F[\s]+arch=b64[\s]+)(?:.*-S[\s]+fchownat[\s]+)(?:.*-F\s+auid>=500[\s]+)(?:.*-F\s+auid!=4294967295[\s]+).*-k[\s]+[\S]+[\s]*$</ind:pattern>
+    operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b64[\s]+)(?:.*-S[\s]+fchownat[\s]+)(?:.*-F\s+auid>=500[\s]+)(?:.*-F\s+auid!=4294967295[\s]+).*-k[\s]+[\S]+[\s]*$</ind:pattern>
     <ind:instance datatype="int">1</ind:instance>
   </ind:textfilecontent54_object>
 
diff --git a/RHEL6/input/checks/audit_rules_dac_modification_fremovexattr.xml b/RHEL6/input/checks/audit_rules_dac_modification_fremovexattr.xml
index 485642d..ec19bce 100644
--- a/RHEL6/input/checks/audit_rules_dac_modification_fremovexattr.xml
+++ b/RHEL6/input/checks/audit_rules_dac_modification_fremovexattr.xml
@@ -43,7 +43,7 @@
          -a always,exit -F arch=b32 -S fremovexattr -F auid>=500 -F auid!=4294967295 -k perms
     -->
     <ind:pattern
-    operation="pattern match">^[\s]*-a[\s]+(always,exit|exit,always)[\s]+(?:.*-F[\s]+arch=b32[\s]+)(?:.*-S[\s]+fremovexattr[\s]+)(?:.*-F\s+auid>=500[\s]+)(?:.*-F\s+auid!=4294967295[\s]+).*-k[\s]+[\S]+[\s]*$</ind:pattern>
+    operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b32[\s]+)(?:.*-S[\s]+fremovexattr[\s]+)(?:.*-F\s+auid>=500[\s]+)(?:.*-F\s+auid!=4294967295[\s]+).*-k[\s]+[\S]+[\s]*$</ind:pattern>
     <ind:instance datatype="int">1</ind:instance>
   </ind:textfilecontent54_object>
 
@@ -69,7 +69,7 @@
          -a always,exit -F arch=b64 -S fremovexattr -F auid>=500 -F auid!=4294967295 -k perms
     -->
     <ind:pattern
-    operation="pattern match">^[\s]*-a[\s]+(always,exit|exit,always)[\s]+(?:.*-F[\s]+arch=b64[\s]+)(?:.*-S[\s]+fremovexattr[\s]+)(?:.*-F\s+auid>=500[\s]+)(?:.*-F\s+auid!=4294967295[\s]+).*-k[\s]+[\S]+[\s]*$</ind:pattern>
+    operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b64[\s]+)(?:.*-S[\s]+fremovexattr[\s]+)(?:.*-F\s+auid>=500[\s]+)(?:.*-F\s+auid!=4294967295[\s]+).*-k[\s]+[\S]+[\s]*$</ind:pattern>
     <ind:instance datatype="int">1</ind:instance>
   </ind:textfilecontent54_object>
 
diff --git a/RHEL6/input/checks/audit_rules_dac_modification_fsetxattr.xml b/RHEL6/input/checks/audit_rules_dac_modification_fsetxattr.xml
index 0a7a5f2..380b258 100644
--- a/RHEL6/input/checks/audit_rules_dac_modification_fsetxattr.xml
+++ b/RHEL6/input/checks/audit_rules_dac_modification_fsetxattr.xml
@@ -43,7 +43,7 @@
          -a always,exit -F arch=b32 -S fsetxattr -F auid>=500 -F auid!=4294967295 -k perms
     -->
     <ind:pattern
-    operation="pattern match">^[\s]*-a[\s]+(always,exit|exit,always)[\s]+(?:.*-F[\s]+arch=b32[\s]+)(?:.*-S[\s]+fsetxattr[\s]+)(?:.*-F\s+auid>=500[\s]+)(?:.*-F\s+auid!=4294967295[\s]+).*-k[\s]+[\S]+[\s]*$</ind:pattern>
+    operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b32[\s]+)(?:.*-S[\s]+fsetxattr[\s]+)(?:.*-F\s+auid>=500[\s]+)(?:.*-F\s+auid!=4294967295[\s]+).*-k[\s]+[\S]+[\s]*$</ind:pattern>
     <ind:instance datatype="int">1</ind:instance>
   </ind:textfilecontent54_object>
 
@@ -69,7 +69,7 @@
          -a always,exit -F arch=b64 -S fsetxattr -F auid>=500 -F auid!=4294967295 -k perms
     -->
     <ind:pattern
-    operation="pattern match">^[\s]*-a[\s]+(always,exit|exit,always)[\s]+(?:.*-F[\s]+arch=b64[\s]+)(?:.*-S[\s]+fsetxattr[\s]+)(?:.*-F\s+auid>=500[\s]+)(?:.*-F\s+auid!=4294967295[\s]+).*-k[\s]+[\S]+[\s]*$</ind:pattern>
+    operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b64[\s]+)(?:.*-S[\s]+fsetxattr[\s]+)(?:.*-F\s+auid>=500[\s]+)(?:.*-F\s+auid!=4294967295[\s]+).*-k[\s]+[\S]+[\s]*$</ind:pattern>
     <ind:instance datatype="int">1</ind:instance>
   </ind:textfilecontent54_object>
 
diff --git a/RHEL6/input/checks/audit_rules_dac_modification_lchown.xml b/RHEL6/input/checks/audit_rules_dac_modification_lchown.xml
index 7d8de9a..8f8b218 100644
--- a/RHEL6/input/checks/audit_rules_dac_modification_lchown.xml
+++ b/RHEL6/input/checks/audit_rules_dac_modification_lchown.xml
@@ -43,7 +43,7 @@
          -a always,exit -F arch=b32 -S lchown -F auid>=500 -F auid!=4294967295 -k perms
     -->
     <ind:pattern
-    operation="pattern match">^[\s]*-a[\s]+(always,exit|exit,always)[\s]+(?:.*-F[\s]+arch=b32[\s]+)(?:.*-S[\s]+lchown[\s]+)(?:.*-F\s+auid>=500[\s]+)(?:.*-F\s+auid!=4294967295[\s]+).*-k[\s]+[\S]+[\s]*$</ind:pattern>
+    operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b32[\s]+)(?:.*-S[\s]+lchown[\s]+)(?:.*-F\s+auid>=500[\s]+)(?:.*-F\s+auid!=4294967295[\s]+).*-k[\s]+[\S]+[\s]*$</ind:pattern>
     <ind:instance datatype="int">1</ind:instance>
   </ind:textfilecontent54_object>
 
@@ -69,7 +69,7 @@
          -a always,exit -F arch=b64 -S lchown -F auid>=500 -F auid!=4294967295 -k perms
     -->
     <ind:pattern
-    operation="pattern match">^[\s]*-a[\s]+(always,exit|exit,always)[\s]+(?:.*-F[\s]+arch=b64[\s]+)(?:.*-S[\s]+lchown[\s]+)(?:.*-F\s+auid>=500[\s]+)(?:.*-F\s+auid!=4294967295[\s]+).*-k[\s]+[\S]+[\s]*$</ind:pattern>
+    operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b64[\s]+)(?:.*-S[\s]+lchown[\s]+)(?:.*-F\s+auid>=500[\s]+)(?:.*-F\s+auid!=4294967295[\s]+).*-k[\s]+[\S]+[\s]*$</ind:pattern>
     <ind:instance datatype="int">1</ind:instance>
   </ind:textfilecontent54_object>
 
diff --git a/RHEL6/input/checks/audit_rules_dac_modification_lremovexattr.xml b/RHEL6/input/checks/audit_rules_dac_modification_lremovexattr.xml
index c640578..5e84cc4 100644
--- a/RHEL6/input/checks/audit_rules_dac_modification_lremovexattr.xml
+++ b/RHEL6/input/checks/audit_rules_dac_modification_lremovexattr.xml
@@ -43,7 +43,7 @@
          -a always,exit -F arch=b32 -S lremovexattr -F auid>=500 -F auid!=4294967295 -k perms
     -->
     <ind:pattern
-    operation="pattern match">^[\s]*-a[\s]+(always,exit|exit,always)[\s]+(?:.*-F[\s]+arch=b32[\s]+)(?:.*-S[\s]+lremovexattr[\s]+)(?:.*-F\s+auid>=500[\s]+)(?:.*-F\s+auid!=4294967295[\s]+).*-k[\s]+[\S]+[\s]*$</ind:pattern>
+    operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b32[\s]+)(?:.*-S[\s]+lremovexattr[\s]+)(?:.*-F\s+auid>=500[\s]+)(?:.*-F\s+auid!=4294967295[\s]+).*-k[\s]+[\S]+[\s]*$</ind:pattern>
     <ind:instance datatype="int">1</ind:instance>
   </ind:textfilecontent54_object>
 
@@ -69,7 +69,7 @@
          -a always,exit -F arch=b64 -S lremovexattr -F auid>=500 -F auid!=4294967295 -k perms
     -->
     <ind:pattern
-    operation="pattern match">^[\s]*-a[\s]+(always,exit|exit,always)[\s]+(?:.*-F[\s]+arch=b64[\s]+)(?:.*-S[\s]+lremovexattr[\s]+)(?:.*-F\s+auid>=500[\s]+)(?:.*-F\s+auid!=4294967295[\s]+).*-k[\s]+[\S]+[\s]*$</ind:pattern>
+    operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b64[\s]+)(?:.*-S[\s]+lremovexattr[\s]+)(?:.*-F\s+auid>=500[\s]+)(?:.*-F\s+auid!=4294967295[\s]+).*-k[\s]+[\S]+[\s]*$</ind:pattern>
     <ind:instance datatype="int">1</ind:instance>
   </ind:textfilecontent54_object>
 
diff --git a/RHEL6/input/checks/audit_rules_dac_modification_lsetxattr.xml b/RHEL6/input/checks/audit_rules_dac_modification_lsetxattr.xml
index 20324c0..8663dc5 100644
--- a/RHEL6/input/checks/audit_rules_dac_modification_lsetxattr.xml
+++ b/RHEL6/input/checks/audit_rules_dac_modification_lsetxattr.xml
@@ -43,7 +43,7 @@
          -a always,exit -F arch=b32 -S lsetxattr -F auid>=500 -F auid!=4294967295 -k perms
     -->
     <ind:pattern
-    operation="pattern match">^[\s]*-a[\s]+(always,exit|exit,always)[\s]+(?:.*-F[\s]+arch=b32[\s]+)(?:.*-S[\s]+lsetxattr[\s]+)(?:.*-F\s+auid>=500[\s]+)(?:.*-F\s+auid!=4294967295[\s]+).*-k[\s]+[\S]+[\s]*$</ind:pattern>
+    operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b32[\s]+)(?:.*-S[\s]+lsetxattr[\s]+)(?:.*-F\s+auid>=500[\s]+)(?:.*-F\s+auid!=4294967295[\s]+).*-k[\s]+[\S]+[\s]*$</ind:pattern>
     <ind:instance datatype="int">1</ind:instance>
   </ind:textfilecontent54_object>
 
@@ -69,7 +69,7 @@
          -a always,exit -F arch=b64 -S lsetxattr -F auid>=500 -F auid!=4294967295 -k perms
     -->
     <ind:pattern
-    operation="pattern match">^[\s]*-a[\s]+(always,exit|exit,always)[\s]+(?:.*-F[\s]+arch=b64[\s]+)(?:.*-S[\s]+lsetxattr[\s]+)(?:.*-F\s+auid>=500[\s]+)(?:.*-F\s+auid!=4294967295[\s]+).*-k[\s]+[\S]+[\s]*$</ind:pattern>
+    operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b64[\s]+)(?:.*-S[\s]+lsetxattr[\s]+)(?:.*-F\s+auid>=500[\s]+)(?:.*-F\s+auid!=4294967295[\s]+).*-k[\s]+[\S]+[\s]*$</ind:pattern>
     <ind:instance datatype="int">1</ind:instance>
   </ind:textfilecontent54_object>
 
diff --git a/RHEL6/input/checks/audit_rules_dac_modification_removexattr.xml b/RHEL6/input/checks/audit_rules_dac_modification_removexattr.xml
index 59e4b2f..08f8cfc 100644
--- a/RHEL6/input/checks/audit_rules_dac_modification_removexattr.xml
+++ b/RHEL6/input/checks/audit_rules_dac_modification_removexattr.xml
@@ -43,7 +43,7 @@
          -a always,exit -F arch=b32 -S removexattr -F auid>=500 -F auid!=4294967295 -k perms
     -->
     <ind:pattern
-    operation="pattern match">^[\s]*-a[\s]+(always,exit|exit,always)[\s]+(?:.*-F[\s]+arch=b32[\s]+)(?:.*-S[\s]+removexattr[\s]+)(?:.*-F\s+auid>=500[\s]+)(?:.*-F\s+auid!=4294967295[\s]+).*-k[\s]+[\S]+[\s]*$</ind:pattern>
+    operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b32[\s]+)(?:.*-S[\s]+removexattr[\s]+)(?:.*-F\s+auid>=500[\s]+)(?:.*-F\s+auid!=4294967295[\s]+).*-k[\s]+[\S]+[\s]*$</ind:pattern>
     <ind:instance datatype="int">1</ind:instance>
   </ind:textfilecontent54_object>
 
@@ -69,7 +69,7 @@
          -a always,exit -F arch=b64 -S removexattr -F auid>=500 -F auid!=4294967295 -k perms
     -->
     <ind:pattern
-    operation="pattern match">^[\s]*-a[\s]+(always,exit|exit,always)[\s]+(?:.*-F[\s]+arch=b64[\s]+)(?:.*-S[\s]+removexattr[\s]+)(?:.*-F\s+auid>=500[\s]+)(?:.*-F\s+auid!=4294967295[\s]+).*-k[\s]+[\S]+[\s]*$</ind:pattern>
+    operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b64[\s]+)(?:.*-S[\s]+removexattr[\s]+)(?:.*-F\s+auid>=500[\s]+)(?:.*-F\s+auid!=4294967295[\s]+).*-k[\s]+[\S]+[\s]*$</ind:pattern>
     <ind:instance datatype="int">1</ind:instance>
   </ind:textfilecontent54_object>
 
diff --git a/RHEL6/input/checks/audit_rules_dac_modification_setxattr.xml b/RHEL6/input/checks/audit_rules_dac_modification_setxattr.xml
index 424ad9d..d7ea87a 100644
--- a/RHEL6/input/checks/audit_rules_dac_modification_setxattr.xml
+++ b/RHEL6/input/checks/audit_rules_dac_modification_setxattr.xml
@@ -43,7 +43,7 @@
          -a always,exit -F arch=b32 -S setxattr -F auid>=500 -F auid!=4294967295 -k perms
     -->
     <ind:pattern
-    operation="pattern match">^[\s]*-a[\s]+(always,exit|exit,always)[\s]+(?:.*-F[\s]+arch=b32[\s]+)(?:.*-S[\s]+setxattr[\s]+)(?:.*-F\s+auid>=500[\s]+)(?:.*-F\s+auid!=4294967295[\s]+).*-k[\s]+[\S]+[\s]*$</ind:pattern>
+    operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b32[\s]+)(?:.*-S[\s]+setxattr[\s]+)(?:.*-F\s+auid>=500[\s]+)(?:.*-F\s+auid!=4294967295[\s]+).*-k[\s]+[\S]+[\s]*$</ind:pattern>
     <ind:instance datatype="int">1</ind:instance>
   </ind:textfilecontent54_object>
 
@@ -69,7 +69,7 @@
          -a always,exit -F arch=b64 -S setxattr -F auid>=500 -F auid!=4294967295 -k perms
     -->
     <ind:pattern
-    operation="pattern match">^[\s]*-a[\s]+(always,exit|exit,always)[\s]+(?:.*-F[\s]+arch=b64[\s]+)(?:.*-S[\s]+setxattr[\s]+)(?:.*-F\s+auid>=500[\s]+)(?:.*-F\s+auid!=4294967295[\s]+).*-k[\s]+[\S]+[\s]*$</ind:pattern>
+    operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b64[\s]+)(?:.*-S[\s]+setxattr[\s]+)(?:.*-F\s+auid>=500[\s]+)(?:.*-F\s+auid!=4294967295[\s]+).*-k[\s]+[\S]+[\s]*$</ind:pattern>
     <ind:instance datatype="int">1</ind:instance>
   </ind:textfilecontent54_object>
 
diff --git a/RHEL6/input/checks/audit_rules_networkconfig_modification.xml b/RHEL6/input/checks/audit_rules_networkconfig_modification.xml
index e2fee0e..eab7914 100644
--- a/RHEL6/input/checks/audit_rules_networkconfig_modification.xml
+++ b/RHEL6/input/checks/audit_rules_networkconfig_modification.xml
@@ -33,7 +33,7 @@
   </ind:textfilecontent54_test>
   <ind:textfilecontent54_object id="object_audit_rules_networkconfig_modification_syscall" version="1">
     <ind:filepath>/etc/audit/audit.rules</ind:filepath>
-    <ind:pattern operation="pattern match">^\-a\s+(always,exit|exit,always)\s+(\-F\s+arch=(b64|b32)\s+)?\-S\s+sethostname\s+\-S\s+setdomainname\s+\-k\s+[-\w]+\s*$</ind:pattern>
+    <ind:pattern operation="pattern match">^\-a\s+always,exit\s+(\-F\s+arch=(b64|b32)\s+)?\-S\s+sethostname\s+\-S\s+setdomainname\s+\-k\s+[-\w]+\s*$</ind:pattern>
     <ind:instance datatype="int">1</ind:instance>
   </ind:textfilecontent54_object>
   <ind:textfilecontent54_object id="object_audit_rules_networkconfig_modification_etc_issue" version="1">
diff --git a/RHEL6/input/checks/audit_rules_time_adjtimex.xml b/RHEL6/input/checks/audit_rules_time_adjtimex.xml
index 6368c4e..bbafe7f 100644
--- a/RHEL6/input/checks/audit_rules_time_adjtimex.xml
+++ b/RHEL6/input/checks/audit_rules_time_adjtimex.xml
@@ -35,7 +35,7 @@
     <ind:path>/etc/audit</ind:path>
     <ind:filename>audit.rules</ind:filename>
     <ind:pattern 
-    operation="pattern match">^[\s]*-a[\s]+(always,exit|exit,always)[\s]+-F[\s]+arch=b32.*-S[\s]+adjtimex[\s]+.*-k[\s]+[\S]+[\s]*$</ind:pattern>
+    operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+-F[\s]+arch=b32.*-S[\s]+adjtimex[\s]+.*-k[\s]+[\S]+[\s]*$</ind:pattern>
     <ind:instance datatype="int">1</ind:instance>
   </ind:textfilecontent54_object>
 
@@ -50,7 +50,7 @@
     <ind:path>/etc/audit</ind:path>
     <ind:filename>audit.rules</ind:filename>
     <ind:pattern 
-    operation="pattern match">^[\s]*-a[\s]+(always,exit|exit,always)[\s]+-F[\s]+arch=b64.*-S[\s]+adjtimex[\s]+.*-k[\s]+[\S]+[\s]*$</ind:pattern>
+    operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+-F[\s]+arch=b64.*-S[\s]+adjtimex[\s]+.*-k[\s]+[\S]+[\s]*$</ind:pattern>
     <ind:instance datatype="int">1</ind:instance>
   </ind:textfilecontent54_object>
 </def-group>
diff --git a/RHEL6/input/checks/audit_rules_time_clock_settime.xml b/RHEL6/input/checks/audit_rules_time_clock_settime.xml
index 51b9325..3802543 100644
--- a/RHEL6/input/checks/audit_rules_time_clock_settime.xml
+++ b/RHEL6/input/checks/audit_rules_time_clock_settime.xml
@@ -35,7 +35,7 @@
     <ind:path>/etc/audit</ind:path>
     <ind:filename>audit.rules</ind:filename>
     <ind:pattern 
-    operation="pattern match">^[\s]*-a[\s]+(always,exit|exit,always)[\s]+-F[\s]+arch=b32.*-S[\s]+clock_settime[\s]+.*-k[\s]+[\S]+[\s]*$</ind:pattern>
+    operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+-F[\s]+arch=b32.*-S[\s]+clock_settime[\s]+.*-k[\s]+[\S]+[\s]*$</ind:pattern>
     <ind:instance datatype="int">1</ind:instance>
   </ind:textfilecontent54_object>
 
@@ -50,7 +50,7 @@
     <ind:path>/etc/audit</ind:path>
     <ind:filename>audit.rules</ind:filename>
     <ind:pattern 
-    operation="pattern match">^[\s]*-a[\s]+(always,exit|exit,always)[\s]+-F[\s]+arch=b64.*-S[\s]+clock_settime[\s]+.*-k[\s]+[\S]+[\s]*$</ind:pattern>
+    operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+-F[\s]+arch=b64.*-S[\s]+clock_settime[\s]+.*-k[\s]+[\S]+[\s]*$</ind:pattern>
     <ind:instance datatype="int">1</ind:instance>
   </ind:textfilecontent54_object>
 </def-group>
diff --git a/RHEL6/input/checks/audit_rules_time_settimeofday.xml b/RHEL6/input/checks/audit_rules_time_settimeofday.xml
index 4504888..9cff2a0 100644
--- a/RHEL6/input/checks/audit_rules_time_settimeofday.xml
+++ b/RHEL6/input/checks/audit_rules_time_settimeofday.xml
@@ -35,7 +35,7 @@
     <ind:path>/etc/audit</ind:path>
     <ind:filename>audit.rules</ind:filename>
     <ind:pattern 
-    operation="pattern match">^[\s]*-a[\s]+(always,exit|exit,always)[\s]+-F[\s]+arch=b32.*-S[\s]+settimeofday[\s]+.*-k[\s]+[\S]+[\s]*$</ind:pattern>
+    operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+-F[\s]+arch=b32.*-S[\s]+settimeofday[\s]+.*-k[\s]+[\S]+[\s]*$</ind:pattern>
     <ind:instance datatype="int">1</ind:instance>
   </ind:textfilecontent54_object>
 
@@ -50,7 +50,7 @@
     <ind:path>/etc/audit</ind:path>
     <ind:filename>audit.rules</ind:filename>
     <ind:pattern 
-    operation="pattern match">^[\s]*-a[\s]+(always,exit|exit,always)[\s]+-F[\s]+arch=b64.*-S[\s]+settimeofday[\s]+.*-k[\s]+[\S]+[\s]*$</ind:pattern>
+    operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+-F[\s]+arch=b64.*-S[\s]+settimeofday[\s]+.*-k[\s]+[\S]+[\s]*$</ind:pattern>
     <ind:instance datatype="int">1</ind:instance>
   </ind:textfilecontent54_object>
 </def-group>
diff --git a/RHEL6/input/checks/audit_rules_time_stime.xml b/RHEL6/input/checks/audit_rules_time_stime.xml
index d09e8db..179992a 100644
--- a/RHEL6/input/checks/audit_rules_time_stime.xml
+++ b/RHEL6/input/checks/audit_rules_time_stime.xml
@@ -33,7 +33,7 @@
     <ind:path>/etc/audit</ind:path>
     <ind:filename>audit.rules</ind:filename>
     <ind:pattern 
-    operation="pattern match">^[\s]*-a[\s]+(always,exit|exit,always)[\s]+-F[\s]+arch=b32.*-S[\s]+stime[\s]+.*-k[\s]+[\S]+[\s]*$</ind:pattern>
+    operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+-F[\s]+arch=b32.*-S[\s]+stime[\s]+.*-k[\s]+[\S]+[\s]*$</ind:pattern>
     <ind:instance datatype="int">1</ind:instance>
   </ind:textfilecontent54_object>
 
