Hi
We are experiencing the same issue below, that "echo" cannot be logged in
auditd. Would like to know some detailed explanation here, and understand in general what
would NOT be in the scope of auditd log.
https://serverfault.com/questions/871343/why-does-auditd-only-log-echo-wh...
Regards
Hai