From 78e5acf38763f919a0755300cd841f2f99ab9c0e Mon Sep 17 00:00:00 2001
From: gregmalkov <greg.malkov@threatstack.com>
Date: Mon, 11 Feb 2019 15:31:45 -0500
Subject: [PATCH] stop auditd on redhat/centos

---
 tasks/main.yml | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/tasks/main.yml b/tasks/main.yml
index 8aabcbd..5b48837 100644
--- a/tasks/main.yml
+++ b/tasks/main.yml
@@ -8,7 +8,9 @@
 
 - name: Disable auditd service
   include: disable_auditd.yml
-  when: ansible_distribution == 'Amazon'
+  when:
+    - ansible_os_family == 'RedHat'
+    - (ansible_distribution != 'Amazon' or ansible_kernel is search("\.amzn2\."))
 
 - name: Run Apt configure and install Threat Stack
   include: apt_install.yml