> $ audearch -m DAEMON_START

read that as $ausearch -m DAEMON_START

The best option would still be just 'rpm -q audit' and check the output

--
Klaus Heinrich Kiwi/Brazil/IBM <klausk@br.ibm.com>
Software Engineer
IBM STG, Linux Technology Center
Phone:(+55-19) 2132-1909 [T/L 839-1909]