it seems that auditd should not run