I have hit this problem in the past. Personal anecdotal note: I feel like aa-logprof "works better" with rsyslogd vs auditd. Especially when I set /proc/sys/kerne/printk_ratelimit and /proc/sys/kerne/printk_ratelimit_burst to 0 during the duration of my profiling.
I have hit this problem in the past. Personal anecdotal note: I feel like aa-logprof "works better" with rsyslogd vs auditd. Especially when I set /proc/sys/ kerne/printk_ ratelimit and /proc/sys/ kerne/printk_ ratelimit_ burst to 0 during the duration of my profiling.