Thanks Tony. Regarding the auditd.service - I not only have auditd.service disabled, but masked. But thanks to systemd, after a system reboot, kernel audit logs appear from all origins - ssh, login, opera browser, etc. This might be worth another bug report.