I just rebooted my system. No changes on behavior of `praudit /dev/auditpipe` (still just writes `su` events) Still do you think there's no need to rebuild kernel? Best wishes, Mokhi.