Why aren't SYSCALLS being logged in CentOS kernel (any ideas?)

Hi, I'm using CentOS, kernel 2.6.18-8.el5. I've compiled audit-1.5.6-1 and I'm getting USER_AUTH events (logins, su, etc...) but I'm not seeing any syscall events. My test audit.rules works fine in RHEL4, Suse10 and Fedora, but doesn't seem to generate any syscall events in CentOS 5. For testing purposes, I'm using the following in audit.rules: # Log execute failures -a exit,always -S execve -F success!=1 -F exit!=-2 -F exit!=-20 -F exit!=-17 -F exit!=-6 # Log administrative functions -a exit,always -S reboot -S clock_settime -S settimeofday -S adjtimex -S setdomainname -S sethostname -S reboot -S mount -S umount2 -a exit,always -S swapon -S swapoff -S create_module -S delete_module -S quotactl -F success!=1 # Log Read/Write functions -a exit,always -S open -S creat -S link -S symlink -S truncate -S ftruncate -S mknod -S rename -F success!=1 -F exit!=-2 -F exit!=-20 -F exit!=-17 -F exit!=-6 # Log file removal failures -a exit,always -S unlink -S rmdir -F success!=1 -F exit!=-2 -F exit!=-20 -F exit!=-17 -F exit!=-6 # Log file modification failures -a exit,always -S chmod -S chown -S lchown -S fchmod -S fchown -F success!=1 -F exit!=-2 -F exit!=-20 -F exit!=-17 -F exit!=-6 # Add watches for reboot stuff... -w /sbin/init -p x -k runlevel -w /sbin/telinit -p x -k runlevel -w /sbin/halt -p x -k runlevel -w /sbin/poweroff -p x -k runlevel -w /sbin/reboot -p x -k runlevel -w /sbin/shutdown -p x -k runlevel Any ideas? Bob