Revised /etc/audit/audit.rules in the ks file.  Testing now.