Why doesn't this rule block syscall records?

I was trying out a syscall entry rule that I thought would block audit records from system services/daemons that haven't had their audit ID (auid) set yet. I've tried both: -a entry,never -S all -F auid=-1 AND -a entry,never -S all -F auid=4294967295 (4294967295) is the value that shows up in the audit log for these services. I would have thought this rule was saying that at syscall entry (for any system call), don't generate an audit event if the auid is -1 or 4294967295. It seems to have the opposite effect. Have I missed something? Is this rule not saying what I want? --Tad Taylor