When searching the audit logs for messages using type=AVC, ausearch returns nothing even if the audit.log file does contain those entries:

$ ausearch -m AVC
<no matches>

$ cat /var/log/audit/audit.log | grep AVC
type=AVC msg=audit(1707163426.971:4088): apparmor="ALLOWED" operation="open" class="file" profile=....

This makes the audit framework quite difficult to use, especially in combination with tools like apparmor/SELinux. While the logs are still present, users would expect to find them with ausearch.

Audit Version: 4.0-1
Linux Kernel: 6.7.3