excluding auditd events

[Mr Dash Four]

> I do not know the answer to your question, but i suspect you will stand
> a better chance at finding a good answer on the linux-audit list.
>
> You can subscribe here:
> https://www.redhat.com/mailman/listinfo/linux-audit
>   
Thanks for the pointer (google failed me on that one!). I just 
subscribed, so will post there soon.

> Note though that this list is moderated. So it may be a while before
> your request for subscription is processed.
>   
Noted, thanks again!