There are some syscall numbers that are not known by auditctl.
When running on IX86,
/usr/include/asm-i386/unistd.h contains:
#define __NR_setfsuid32 215
But I am unable to audit this syscall number. Because when I add the rule:
auditctl -a entry,always -S 215
auditctl returns:
AUDIT_LIST: entry always syscall=(null)
No rules
This is true for other syscalls found in /usr/include/asm-i386/unistd.h
that are not found in /usr/include/asm-x86_64/unistd.h
-debbie