I am also seeing this behaviour. I see a [kauditd] and /sbin/auditd running, yet none of the examples actually seem to work.
I am also seeing this behaviour. I see a [kauditd] and /sbin/auditd running, yet none of the examples actually seem to work.