Hi Richard.

It looks like the -F exe= option is not supported at all regardless of negation.

Starting auditd:                                           [  OK  ]
-F unknown field: exe


___

John Petrini