I cannot reproduce it locally by working with the latest enterprise release - which release do you use?
Also, can you please send us your rsyslog.conf file? I was using the default one.
Also, where do you have this scylla-audit.log and is this the file you are reading? I was just looking at the logs with “journalctl”
I suspect there may be some configuration issue, not necessarily on scylla side.