RB> since you haven't indicated if you have tried and > tested this already, please start by running those > simple commands while the auditd service is running > and verifying that those commands do get logged as > expected. If they don't, fix that first. The commands are logged when the auditd service is running.