[recentdarkness]

> The problem I found (on Centos 8) is that audit sometimes denies but nothing is logged

I doubt that. journalctl has always given me something when there was an actual denial. You might just not have looked right

[cpncrunch]

I did. It is trivial to recreate.