Why does auditd only log `echo` when I use the absolute path?

Question

Info

Running auditd version 2.6.5 on Centos 7.

My rules file contains:

-a exit,always -F arch=b64 -F auid=0 -S execve -k root_action
-a exit,always -F arch=b32 -F auid=0 -S execve -k root_action

When I run which echo, I get /usr/bin/echo.

Issue

When I run echo "asd", nothing gets logged in /var/log/audit/audit.log. However, when I run /usr/bin/echo "asd" I see an event get logged. Why does it not work without the use of the absolute path?

Answer 1

echo is a shell builtin. /bin/echo is a binary.

Type type echo and which echo to see the difference.

When you give it the full path, you are telling it to use the binary rather than the shell builtin.