question about audit _by default_ in Fedora cloud images