We are experiencing the same issue below, that "echo" cannot be logged in auditd. Would like to know some detailed explanation here, and understand in general what would NOT be in the scope of auditd log.

https://serverfault.com/questions/871343/why-does-auditd-only-log-echo-when-i-use-the-absolute-path