ausearch -c 'check_nrpe' --raw | audit2allow -M my-checknrpe