load audit rules only if auditd started