What is the bitness problem with auditd?

Question

linux

I run in a virtual machine

arch
x86_64

When I try to add a simple rule, I get an error

auditctl -a exit,always -S open -F path=/etc/

WARNING - 32/64 bit syscall mismatch, you should specify an arch
Error sending add rule data request (Invalid argument)

On the Internet they write that this message can be safely ignored, but if you look at the rules, then it is empty

auditctl -l
No rules

tried to hide the architecture

auditctl -a always,exit -F arch=b32 -S open -F path=/etc/
Error sending add rule data request (Invalid argument)
 auditctl -a always,exit -F arch=b64 -S open -F path=/etc/
Error sending add rule data request (Invalid argument)

Nothing changes, list of rules is empty

Answer 1

The list and action are interchanged, and the path to the file must be specified. More or less like this:

auditctl -a exit,always -F arch=b64 -S open -F path=/etc