auditd.conf: flush set to DATA or SYNC does nothing on many kernels?

Hello all, I believe auditd's flush configuration can only be set to INCREMENTAL to guarantee some form of log durability, while DATA or SYNC do nothing. Is this is a known bug or did I misinterpret auditd.conf's man page? In audit-event.c: in open_audit_log(): fcntl(F_SETFL, O_SYNC) is called on the already open log's file descriptor, but O_SYNC (and O_DSYNC) are ignored by F_SETFL You can check this in the kernel at fs/fcntl.c: #define SETFL_MASK (O_APPEND | O_NONBLOCK | O_NDELAY | O_DIRECT | O_NOATIME) The fcntl() man page also indicates this expected behavior. I checked both the kernel and audit source for CentOS 6.7 and Ubuntu 14.04.03 and I believe I've reproduced the problem on both distributions. Thanks, Cat