I've checked Tumbleweed: # rpm -q kernel-default --info Name : kernel-default Version : 6.0.5 Release : 1.1 Architecture: armv7hl Install Date: Tue Nov 1 16:21:21 2022 Group : System/Kernel Size : 189385192 License : GPL-2.0-only Signature : RSA/SHA256, Sat Oct 29 01:20:49 2022, Key ID b88b2fd43dbdc284 Source RPM : kernel-default-6.0.5-1.1.nosrc.rpm Build Date : Sat Oct 29 00:53:33 2022 Build Host : obs-arm-6 Packager : http://bugs.opensuse.org Vendor : openSUSE URL : https://www.kernel.org/ Summary : The Standard Kernel Description : The standard kernel for both uniprocessor and multiprocessor systems. Source Timestamp: 2022-10-27 05:14:41 +0000 GIT Revision: 7359656e16c5fb0cf358bc75890037b4d7164011 GIT Branch: stable Distribution: openSUSE Tumbleweed # auditctl -a never,task Error sending add rule data request (Rule exists) It seems that audit is working. Audit-related kernel configuration is different from Leap one. CONFIG_AUDIT=y CONFIG_HAVE_ARCH_AUDITSYSCALL=y CONFIG_AUDITSYSCALL=y CONFIG_NETFILTER_XT_TARGET_AUDIT=m CONFIG_DM_AUDIT=y CONFIG_SECURITY_TOMOYO_MAX_AUDIT_LOG=1024 CONFIG_INTEGRITY_AUDIT=y CONFIG_AUDIT_GENERIC=y # CONFIG_AUDIT_ARCH_COMPAT_GENERIC is not set