Why aren't SYSCALLS being logged in CentOS kernel (any ideas?)

[Robert Evans <bob.evans@jhuapl.edu>]

Hi,

I'm using CentOS, kernel 2.6.18-8.el5.  I've compiled audit-1.5.6-1 and I'm 
getting USER_AUTH events (logins, su, etc...) but I'm not seeing any syscall events.

My test audit.rules works fine in RHEL4, Suse10 and Fedora, but doesn't seem to 
generate any syscall events in CentOS 5.  For testing purposes, I'm using the 
following in audit.rules:

# Log execute failures
-a exit,always -S execve -F success!=1 -F exit!=-2 -F exit!=-20 -F exit!=-17 -F 
exit!=-6

# Log administrative functions
-a exit,always -S reboot -S clock_settime -S settimeofday -S adjtimex -S 
setdomainname -S sethostname -S reboot -S mount -S umount2
-a exit,always -S swapon -S swapoff -S create_module -S delete_module -S 
quotactl -F success!=1

# Log Read/Write functions
-a exit,always -S open -S creat -S link -S symlink -S truncate -S ftruncate -S 
mknod -S rename -F success!=1 -F exit!=-2 -F exit!=-20 -F exit!=-17 -F exit!=-6

# Log file removal failures
-a exit,always -S unlink -S rmdir -F success!=1 -F exit!=-2 -F exit!=-20 -F 
exit!=-17 -F exit!=-6

# Log file modification failures
-a exit,always -S chmod -S chown -S lchown -S fchmod -S fchown -F success!=1 -F 
exit!=-2 -F exit!=-20 -F exit!=-17 -F exit!=-6

# Add watches for reboot stuff...
-w /sbin/init -p x -k runlevel
-w /sbin/telinit -p x -k runlevel
-w /sbin/halt -p x -k runlevel
-w /sbin/poweroff -p x -k runlevel
-w /sbin/reboot -p x -k runlevel
-w /sbin/shutdown -p x -k runlevel

Any ideas?

Bob