I build and use my own OpenWrt images with audit enabled for 3 platforms:
Raspberry Pi 3B+
Linksys WRT-1900AC v1
Linksys WRT-1900ACS v2.
The 3 configurations that I built are almost identical. Drivers built-in kernel differ, but OpenWrt config is mostly the same for all 3.
On RPi, audit works properly.
On mvebu (both of them), kernel audit works, but auditd daemon segfaults on start.
I tried:
to make the package built-in, so there woudn't be any version conflict - segfaults too
to install auditd from the official OpenWrt package - segfaults too.
to start without any audit rules or config files - segfaults too.
to start manually and with various cmdline switches - still segfaults.
I have this situation for more than a year. At first I thought that there must be something wrong with my build. But after several images built, kernel major version changed, numerous cleanups, host gcc major version change (Gentoo), now I'm sure it must be a problem with OpenWrt.
Before reporting a bug, I just wanted to check one more time:
If any of you use mvebu, does auditd work on your system?