Dear Maintainer,

*** Reporter, please consider answering these questions, where appropriate
***

   * What led up to the situation?
In /etc/audit/audit.rules, attempting to monitor execve() calls over an ELF
identified by a symlink (eg:netcat) produced no event

   * What exactly did you do (or not do) that was effective (or
     ineffective)?

The following rules don't produce any event:
-a exit,always -F arch=b64 -F path=/bin/nc -F filetype=link -S execve -k
netcat_symlink
-a exit,always -F arch=b64 -F path=/etc/alternatives/nc -F filetype=link -S
execve -k netcat_symlink


The following rule is working instead
-a exit,always -F arch=b64 -F path=/bin/nc.traditional -F filetype=file -S
execve -k netcat_elf


   * What was the outcome of this action?

   * What outcome did you expect instead?

Have logs even if the path= is a symlink (as stated in filetype=symlink)

Please, note the system information below are incorrectly stating that
/etc/audit/audit.rules doesn't exists. Here it is:

root@debian-unstable:/tmp# cat /etc/audit/audit.rules
# This file contains the auditctl rules that are loaded
# whenever the audit daemon is started via the initscripts.
# The rules are simply the parameters that would be passed
# to auditctl.

# First rule - delete all
-D

# Increase the buffers to survive stress events.
# Make this bigger for busy systems
-b 320

#continue loading if one file doesn't exist
-i


# Feel free to add below this line. See auditctl man page

#Tools execution
-a exit,always -F arch=b64 -F path=/bin/nc -F filetype=link -S execve -k
netcat_symlink
-a exit,always -F arch=b64 -F path=/etc/alternatives/nc -F filetype=link -S
execve -k netcat_symlink
-a exit,always -F arch=b64 -F path=/bin/nc.traditional -F filetype=file -S
execve -k netcat_elf


*** End of the template - remove these template lines ***