I did some research and am confused about starting the audit daemon at
boot time, so that you don't get auid's of 4294967295.
In RHEL 5.5, my grub.conf looks like this:
# grub.conf generated by anaconda
# Note that you do not have to rerun grub after making changes to this
# NOTICE: You have a /boot partition. This means that
# all kernel and initrd paths are relative to /boot/, eg.
# root (hd0,0)
# kernel /vmlinuz-version ro root=/dev/sda4
# initrd /initrd-version.img
title Red Hat Enterprise Linux Server (2.6.18-194.el5)
kernel /vmlinuz-2.6.18-194.el5 ro root=LABEL=/ rhgb quiet
audit=1 is the first line, so why am I still getting the 4294967295