What it asks for. Systems must be able to generate audit records for the event types defined under AU-2, let designated people choose which events are logged by which components, and produce the records with the content required by AU-3.
In practice. This means enabling logging on operating systems, applications, databases, network devices and cloud services in line with the logging policy, and confirming those logs actually arrive centrally. Auditors expect configuration evidence, a mapping of log sources to required event types, and checks that sources have not gone silent. CIS Control 8 sets similar expectations.
Common gaps. Logging is often enabled on servers but not on applications or SaaS platforms, or the default verbosity misses important events. Sources that stop sending logs are frequently not noticed.