[RHEL/6] Modify auditd.conf checking rules