Update audit.rules.erb

only log on write or attribute access to /var/spool/cron/root
Merge pull request #19 from gdestuynder/patch-3

Update audit.rules.erb