systemctl status systemd-journald-audit.socket | grep -w running
grep " audit\[.*\]:" /var/log/messages | grep -v grep

+ systemctl status systemd-journald-audit.socket
+ grep -w running
     Active: active (running) since Sun 2023-09-03 14:33:53 CST; 2h 36min ago

+ grep ' audit\[.*\]:' /var/log/messages
+ grep -v grep
Sep  3 16:14:53 openEuler audit[73599]: AVC avc:  denied  { read } for  pid=73599 comm="auditd" name="247912" dev="proc" ino=436736 scontext=system_u:system_r:auditd_t:s0 tcontext=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 tclass=dir permissive=0
Sep  3 16:14:53 openEuler audit[73599]: AVC avc:  denied  { search } for  pid=73599 comm="auditd" name="247912" dev="proc" ino=436736 scontext=system_u:system_r:auditd_t:s0 tcontext=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 tclass=dir permissive=0
Sep  3 16:14:53 openEuler audit[1]: SERVICE_STOP pid=1 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:init_t:s0 msg='unit=auditd comm="systemd" exe="/usr/lib/systemd/systemd" hostname=? addr=? terminal=? res=success'
Sep  3 16:14:55 openEuler audit[247924]: SYSCALL arch=c000003e syscall=44 success=yes exit=60 a0=3 a1=7ffc89ffa6c0 a2=3c a3=0 items=0 ppid=247923 pid=247924 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="auditd" exe="/usr/sbin/auditd" subj=system_u:system_r:auditd_t:s0 key=(null)
Sep  3 16:14:55 openEuler audit[247924]: SYSCALL arch=c000003e syscall=44 success=yes exit=60 a0=3 a1=7ffc89ff8380 a2=3c a3=0 items=0 ppid=247923 pid=247924 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="auditd" exe="/usr/sbin/auditd" subj=system_u:system_r:auditd_t:s0 key=(null)
......