I have recently install auditd and play around with it. And i found on ubuntu 18 the auditd log will show record entry like this
audit[23183]: USER_CMD pid=23183 uid=1000 auid=1000 ses=517 msg='cwd="/home/vmtest1" cmd="pwd" terminal=pts/0 res=success
Note that it shows USER_CMD type record (References = https://access.redhat.com/articles/4409591#audit-record-types-2)
BUT - when i preform the same on ubuntu 20 or above, it does not show that event type record. I was wondering why. I have try to do some research on this and can not find a answer on how to configure this in auditd or why is it acting this way. That USER_CMD record type should be on all auditd pacakge regardless which Os as a default setting ... Would like some input on this. thanks
PS .. type=syscall also not appearing on ubuntu 18 but does on newer os.
