fixed auditd
fixed rules