auditctl prevents auditd from starting as a service
The short version: auditctl fails to start at boot which blocks auditd from starting.
I'd like to say the logs were super helpful, but I doubt this helps anyone else more than it helped me.
$ sudo cat /run/uncaught-logs/current
@4000000066cc9bf016f91656 s6-rc: warning: unable to start service auditctl: command exited 1
Both work fine when started from the cli ("No rules" is expected output for auditctl, not a misconfiguration).
$ sudo auditctl -R /etc/audit/audit.rules
No rules
$ sudo auditd -n -f
Config file /etc/audit/auditd.conf opened for parsing
local_events_parser called with: yes
write_logs_parser called with: yes
log_file_parser called with: /var/log/audit/audit.log
...
The services fail regardless of whether it's at boot or manually attempted later. I'm not sure about this one, maybe someone else has run into it?