If the audit config is locked (audit_status.Enabled == 2) then the auditd metricset should either not attempt specific config changes or should continue on EPERM errors. The goal is to allow Auditbeat to read events even if the config has been locked in the kernel.

• https://github.com/linux-audit/audit-kernel/blob/bebc6082da0a9f5d47a1ea2edc099bf671058bd4/kernel/audit.c#L379