Description of problem: I have been running KVM this week bringing VM's up and down. But when I look for audit events there are none: ausearch --start this-week -m VIRT_CONTROL <no matches> There should be audit events.
Turns out there was a parsing problem in ausearch.