Selinux audit2allow comes up with new rules
everytime you run it
Kernel/Audit are dropping stuff.
read this:
http://blog.siphos.be/2015/05/audit-buffering-and-rate-limiting/