Replaced "/etc/rc.d/auditd restart" -> "/etc/rc.d/auditd onerestart"