Nice spotted with the symlink! The shell builtin ... i still fail to understand why it is not audited. the audit is for filewatch and this basically looks for file access system calls Bash supposedly uses system calls to open the file, write to it and close it. So bash builtin operations should be logged by the filewatch systemcall auditing the same way?