We found that auditd was not running on the systems where we were seeing the records on the screen and believe that this is the correct behavior in this case.