why I have lost messages on boot even with very big backlog while I hunting only 2 syscalls?

Hello list ! A very technical question I have Ubuntu 16.10 Virtual Box , auditd 2.7.8 I have audit=1 parameter in grub.cfg I see that /proc/cmdline indeed sees it I see that auditd is started with PID 564 root 312 2 0 23:12 ? 00:00:00 [kauditd] root 564 1 0 23:12 ? 00:00:00 /sbin/auditd And I have 15 lost messages ??? auditctl -s enabled 1 failure 1 pid 564 rate_limit 0 backlog_limit 16384 lost 15 backlog 0 backlog_wait_time 30 loginuid_immutable 0 unlocked auditctl -l -a always,exit -F arch=b64 -S execve,execveat -F key=exec Do I understand correctly that auiditd is indeed started by systemd before other services, except 2 that is listed in auditd.service dependencuies - local-fs and some temp setup of systemd ? Regards, Lev