auditctl -l bug?