Comment 1 for bug 140784

I am also seeing this behaviour. I see a [kauditd] and /sbin/auditd running, yet none of the examples actually seem to work.