run script after auditd rotates logs