Audit 2.6.x checks for AUDIT_FEATURE_VERSION to be defined in include/linux/audit.h (this define was introduced in kernel version 3.13) and then blindly assumes that struct audit_status has feature_bitmap. However this looks like a problem as feature_bitmap wasn't introduced until kernel 3.19, even though the requirements for Audit state that anything > 2.6.30 should work. (http://people.redhat.com/sgrubb/audit/) This causes a compile error when attempting to compile audit 2.6.x against kernel headers younger than 3.19. libaudit.c:609:33: error: 'struct audit_status' has no member named 'feature_bitmap' features_bitmap = rep.status->feature_bitmap;