DId +cp /usr/share/doc/audit-2.8.4/rules/30-stig.rules stig.rules= to put these rules into /etc/audit/rules.d. Then restarted service using service auditd restart. For this command the systemctl mechanism is blocked for restart. However, some rules needed to be added (e.g., setuid and setgid monitoring).