import sys
import _ctypes

did_get_dlsym_event = False
def on_audit(name, args):
    global did_get_dlsym_event
    if name == 'ctypes.dlsym':
        did_get_dlsym_event = True

sys.addaudithook(on_audit)
_ctypes.dlsym(_ctypes.dlopen('libc.so.6'), 'system')

assert did_get_dlsym_event