Please fill in the following information:

Issue description

The example auditctl command in the student workbook is incorrect:

Disable auditing of failed USER_LOGIN events for the example user.

[root@host ~]# auditctl -a exclude,never -F auid=example \
-F msgtype=USER_LOGIN -F success=0

Steps to reproduce:

[root@servera ~]# auditctl -a exclude,never -F auid=student -F msgtype=USER_LOGIN -F success=0
Only msgtype, uid, *gid, pid, and subj fields can be used with exclude filter

It can't use success=0 to determine whether the event failed, it should be difficult to implement this example. Maybe changing it to "Disable auditing of USER_LOGIN event for the example user" will make it easier to implement.

Workaround:

Expected result: