An XCCDF Rule
auditd
syslog
audispd
active
/etc/audisp/plugins.d/syslog.conf
yes
$ sudo service auditd restart