An XCCDF Rule
auditd
syslog
audispd
active
/etc/audit/plugins.d/syslog.conf
yes
$ sudo service auditd restart