Thanks for the info.
While driving home I realized that I had not considered using systemctl and assessing the "Active:" field like you suggested here.
Then before reading your email I tried my own way, doing:
date +%s -d "$(systemctl status auditd | egrep Active | egrep -o "[[:digit:]]{4}-[[:digit:]]{2}--[[:digit:]]{2}\s*[[:digit:]]{2}:[[:digit:]]{2}:[[:digit:]]{2}")"
What is interesting is that I would expect both commands to render the same result, but for some reason your command reports today's date and time, whereas mine renders the valid date and time (from last week, which I know to be true).
When I say your command, I mean this one:
date --date="$(systemctl status auditd.service|grep Active|awk '{printf "%s %s", $6, $7}')" +"%s"
AH! I figured it out, I was missing the letter 'f' on printf.
--------------------------
Warron French