audit rule update/delete