Make sure, that auditd is started before syslog-ng.