Test if auditctl is in use for audit rules
multi_platform_all
Test if auditctl is in use for audit rules.
{{% if product in ['rhel10', 'ol10'] %}}
/usr/lib/systemd/system/audit-rules.service
^ExecStart=\/sbin\/auditctl.*$
{{% else %}}
/usr/lib/systemd/system/auditd.service
^ExecStartPost=\-\/sbin\/auditctl.*$
{{% endif %}}
1