This barfs: Jan 18 12:46:32 machine 522i0x9l80z7gw56iahxjjsdjp0xi10q-audit-start[506]: The audit system is disabled
Part of the way towards #11864. We still don't have the auditd userland logging daemon, but journald also tracks audit logs so we can already use this.