added audit.log to ntp check