the one I have on my test VM on Ubuntu (closest to Debian I have here) has this

--audit_allow_config=true
--audit_allow_sockets=true
--audit_persist=true
--disable_audit=false
--events_expiry=1
--events_max=50000
--logger_plugin=filesystem
--disable_events=false