BTW, do we need check if auditd service is running before this check...just a suggestion :)