Use the systemd journal to retrieve audit messages, as the minimal images no longer ship auditd.
auditd