audit system still audits auditd

I was doing a test: auditctl -a entry,always -S all -F auid=-1 It turns out this tends to report auditd doing things: type=SYSCALL msg=audit(1118858393.806:1338447): arch=40000003 syscall=240 success=yes exit=1 a0=b8ce64 a1=1 a2=1 a3=a79a208 items=0 pid=1716 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 comm="auditd" exe="/sbin/auditd" type=SYSCALL msg=audit(1118858393.806:1338456): arch=40000003 syscall=4 success=yes exit=254 a0=5 a1=b7fff000 a2=fe a3=fe items=0 pid=1716 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 comm="auditd" exe="/sbin/auditd" type=SYSCALL msg=audit(1118858393.806:1338459): arch=40000003 syscall=197 success=yes exit=0 a0=5 a1=b7fe81bc a2=659ff4 a3=b7fe81bc items=0 pid=1716 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 comm="auditd" exe="/sbin/auditd" Of course, the audit system dies in about 15 seconds since each record generates 10 new events. -Steve