The tasks in auth.yml will install `auditd`_ and ensure it is running.

.. _auditd: http://people.redhat.com/sgrubb/audit/