PROCESS_CHECK
As with file checks, an audited Unix platform can be tested for running processes. The implementation runs the ps command to obtain a list of running processes.
<custom_item>
system: "Linux"
type: PROCESS_CHECK
name: "auditd"
status: OFF
</custom_item>
<custom_item>
system: "Linux"
type: PROCESS_CHECK
name: "syslogd"
status: ON
</custom_item>