> >recvfrom(3, "$\0\0\0\2\0\0\0\1\0\0\0\311_\0\0\352\377\377\377|\0\0\0"..., 8476, > > This is your problem. 352 is octal for -EINVAL. Your kernel doesn't understand > the netlink message type that the audit-libs is sending. I put audit-libs-0.9.10 > into rawhide and it should be available next time its pushed out. If you feel > like building it yourself, you can get it from people.redhat.com/sgrubb/audit For me, downgrading to audit-libs-0.9.5-1 solved this problem.