Since CoreOs 766, the auditing subsystem is partially integrated:
The audit subsystem has been enabled in the kernel and auditctl added to the image. Most audit events are ignored by default. The audit rules may be modified in /etc/audit/rules.d. Note that auditd is not included, journald is responsible for logging events instead although it is a best effort mechanism. Unlike with auditd based systems the kernel will not panic if journald fails to record an event for some reason.
I have tried the following in order to audit syscalls on both 899 and alpha 1000 CoreOs releases.
# starting a new periodic process: $ while true; do echo "coreos ..." > /tmp/a.txt && sleep 5s; done &  4509 # get its pid and add a new audit rule: $ sudo auditctl -a always,exit -F arch=b64 -S read,write,close,dup2,wait4 -F pid=4509 # wait 5 minutes and check if any audit related event was logged into by the journald: $ journalctl | grep audit | wc 0 0 0
Why can't I see any event that's logged by the journald?
cn.ko is loaded properly and according the
auditctl -l output the rule is set successfully. Though it looks like
journald doesn't receive messages from the netlink interface.
I followed the following steps in order to enable debugging but it didn't give any hints either:
mkdir -p /etc/systemd/system/systemd-journald.service.d/
vim /etc/systemd/system/systemd-journald.service.d/10-debug.conf and filled it with following content:
And restart systemd-journald service:
systemctl daemon-reload systemctl restart systemd-journald dmesg | grep systemd-journald