By default, it seems that the argv from execs is not passed to the audit_syslog.so plugin. The binary audit log has the arguments included, but the plugin won't write them into the syslog. Everything else works as expected.
The line logged in syslog looks like:
Jan 5 12:27:31 bsmtest audit: [ID 702911 audit.notice] execve(2) ok session 1196955154 by root as root:root from client-1 obj /usr/bin/cat
Configuration:
#cat /etc/security/audit_control
dir:/var/audit
flags:lo,ex
minfree:10
naflags:lo
plugin: name=audit_syslog.so; p_flags=all
# auditconfig -getpolicy
audit policies = argv,cnt
