silly question, but, you've enabled auditing via t...
# general
m
silly question, but, you've enabled auditing via the /etc/security/audit_control file, yes?